Campbell et al v. Facebook Inc.

Filing 138

MOTION to Certify Class filed by Matthew Campbell, Michael Hurley. Motion Hearing set for 3/16/2016 09:00 AM in Courtroom 3, 3rd Floor, Oakland before Hon. Phyllis J. Hamilton. Responses due by 1/15/2016. Replies due by 2/19/2016. (Attachments: # 1 Declaration of Michael W. Sobol, # 2 Declaration of Hank Bates, # 3 Declaration of David T. Rudolph, # 4 Declaration of Melissa Gardner, # 5 Proposed Order)(Sobol, Michael) (Filed on 11/13/2015)

1
2
3
4
5
6
7

Michael W. Sobol (State Bar No. 194857)
[e-mail]
David T. Rudolph (State Bar No. 233457)
[e-mail]
Melissa Gardner (State Bar No. 289096)
[e-mail]
LIEFF CABRASER HEIMANN & BERNSTEIN, LLP
275 Battery Street, 29th Floor
San Francisco, CA 94111-3339
Telephone: [phone]
Facsimile: 415.956.1008

12

Hank Bates (State Bar No. 167688)
[e-mail]
Allen Carney
[e-mail]
David Slade
[e-mail]
CARNEY BATES & PULLIAM, PLLC
11311 Arcade Drive
Little Rock, AR 72212
Telephone: [phone]
Facsimile: 501.312.8505

13

Attorneys for Plaintiffs and the Proposed Class

8
9
10
11

14
15

UNITED STATES DISTRICT COURT

16

NORTHERN DISTRICT OF CALIFORNIA

17
18
19

MATTHEW CAMPBELL and MICHAEL
HURLEY, on behalf of themselves and all
others similarly situated,

PLAINTIFFS’ MOTION FOR CLASS
CERTIFICATION

Plaintiffs,

20
21

v.

22

FACEBOOK, INC.,

23

Case No. C 13-05996 PJH

Date:
Time:
Judge:
Place:

March 16, 2016
9:00 a.m.
Hon. Phyllis J. Hamilton
Courtroom 3, 3rd Floor

Defendant.

24
25
26
27
28
PLAINTIFFS’ MOTION FOR CLASS CERTIFICATION

C 13-05996 PJH

1
2

NOTICE OF MOTION AND MOTION FOR CLASS CERTIFICATION
TO ALL PARTIES AND THEIR ATTORNEYS OF RECORD:

3

PLEASE TAKE NOTICE that at 9:00 a.m. on March 16, 2016, or as soon thereafter as

4

the matter may be heard by the above-entitled Court, in the courtroom of the Honorable Phyllis J.

5

Hamilton, 1301 Clay Street, Oakland, CA 94612, Plaintiffs Matthew Campbell and Michael

6

Hurley (“Plaintiffs”) will and hereby do move under Federal Rule of Civil Procedure 23(b)(3), or

7

in the alternative, Rule 23(b)(2) for an order certifying the following Class:

8

All natural-person Facebook users located within the United States
who have sent, or received from a Facebook user, private messages
that included URLs in their content (and from which Facebook
generated a URL attachment), from within two years before the
filing of this action up through the date of the certification of the
class.[1]

9
10
11

This Motion is based on this Notice of Motion and Motion, the within Memorandum of
12
Points and Authorities, the Declarations of Michael Sobol, Hank Bates, David Rudolph, and
13
Melissa Gardner (including as attached thereto, the Reports of experts Jennifer Golbeck and
14
Fernando Torres), filed in support of the Motion, the Court’s files in this action, the arguments of
15
counsel, and any other matter that the Court may properly consider.
16
.
17
18
19
20
21
22
23
24
25
26
27
28

[1]

Excluded from the Class are the following individuals and/or entities: Facebook and its parents,
subsidiaries, affiliates, officers and directors, current or former employees, and any entity in
which Facebook has a controlling interest; counsel for the putative class; all individuals who
make a timely election to be excluded from this proceeding using the correct protocol for opting
out; and any and all federal, state or local governments, including but not limited to their
departments, agencies, divisions, bureaus, boards, sections, groups, counsels and/or subdivisions;
and all judges assigned to hear any aspect of this litigation, as well as their immediate family
members.
-i-

PLAINTIFFS’ MOTION FOR CLASS
CERTIFICATION C 13-05996 PJH

1

TABLE OF CONTENTS

2
3
4

Page
I.
II.
III.

5
6
7
8
9
10
11
IV.
12
13
14
15
16
17
18
19
20
21

7
2.
Facebook’s Sharing of User Data With Third Parties. .................... 8
3.
Increasing “Like” Counts on Third-Party Websites........................ 9
CLASS CERTIFICATION IS PROPER .............................................................. 10
A.
The Rule 23(a) Criteria Are Met ............................................................... 11
1.
The Class is so Numerous that Joinder is Impracticable............... 11
2.
Questions of Law and Fact Are Common to the Class ................. 12
3.
Plaintiffs’ Claims Are Typical of the Class .................................. 13
4.
Plaintiffs And their Counsel Will Adequately Represent the
Class .............................................................................................. 14
5.
The Class Is Ascertainable ............................................................ 14
B.
The Class Is Properly Maintained Under Fed. R. Civ. P. 23(b)(3) ........... 15
1.
Common Issues Predominate ........................................................ 15
a.
Facebook’s ECPA Violation Will be Established by
Common Proof .................................................................. 16
b.
Facebook’s CIPA Violation Will be Established by
Common Proof .................................................................. 17
c.

22
23
24
25
26
27

INTRODUCTION .................................................................................................. 1
ISSUE TO BE DECIDED....................................................................................... 3
STATEMENT OF FACTS—HOW FACEBOOK ACQUIRES,
REDIRECTS AND USES URL CONTENT FROM PRIVATE
MESSAGES ............................................................................................................ 3
A.
Facebook Intercepts Content From Private Messages During
Transmission ............................................................................................... 4
B.
Facebook Uses Content From Intercepted Private Messages ..................... 6
1.

V.

Plaintiffs’ and the Class Members’ Lack of Consent
to Facebook Practices will be Established Through
Common Proof .................................................................. 18
d.
Allocation of Monetary Relief to Plaintiffs and the
Class can be Done on a Classwide Basis .......................... 21
2.
A Class Action Is Superior to Any Alternative............................. 22
3.
This Class Action Is Manageable.................................................. 23
C.
Alternatively, Class Certification Under Rule 23(b)(2) Is
Appropriate ............................................................................................... 24
CONCLUSION ..................................................................................................... 25

28
- ii -

PLAINTIFFS’ MOTION FOR CLASS CERTIFICATION

C 13-05996 PJH

1

TABLE OF AUTHORITIES

2

Page

3

CASES

4

ABF Capital Corp. v. Osley,
414 F.3d 1061 (9th Cir. 2005).................................................................................................... 18
Ades v. Omni Hotels Mgmt. Corp.,
No. 13-02468, 2014 WL 4627271 (C.D. Cal. Sept. 8, 2014) .............................................. 13, 19
Amchem Prods., Inc. v. Windsor,
521 U.S. 591 (1997) ................................................................................................................... 15
Bateman v. Am. Multi-Cinema, Inc.,
623 F.3d 708 (9th Cir. 2010) ..................................................................................................... 22
Blackie v. Barrack,
524 F.2d 891 (9th Cir. 1975)...................................................................................................... 21
Comcast Corp. v. Behrend,
133 S. Ct. 1426 (2013) ............................................................................................................... 21
Ellis v. Costco Wholesale Corp.,
657 F.3d 970 (9th Cir. 2011)................................................................................................ 13, 14
Gen. Tel. Co. of Sw. v. Falcon,
457 U.S. 147 (1982) ................................................................................................................... 13
Gray v. Golden Gate Nat’l Recreational Area,
279 F.R.D. 501 (N.D. Cal. 2011) ............................................................................................... 14
Hanlon v. Chrysler Corp.,
150 F.3d 1011 (9th Cir. 1998).................................................................................. 12, 14, 15, 23
Hanon v. Dataproducts Corp.,
976 F.2d 497 (9th Cir. 1992)...................................................................................................... 13
Holloway v. Full Spectrum Lending,
976 F.2d 497 (C.D. Cal. 2007)................................................................................................... 21
In re Abbott Labs. Norvir Antitrust Litig.,
Nos. 04–1511, 04–4203, 2007 WL 1689899 (N.D. Cal. June 11, 2007) ................................... 11
In re Google Inc. Gmail Litig.,
No. 13-02430, 2014 WL 1102660 (N.D. Cal. Mar. 18, 2014)....................................... 14, 19, 20
In re High-Tech Employee Antitrust Litig.,
985 F. Supp. 2d 1167 (N.D. Cal. 2013) ............................................................................... 14, 15
In re Online DVD Rental Antitrust Litig.,
No. 09-2029, 2010 WL 5396064 (N.D. Cal. Dec. 23, 2010) aff'd,
779 F.3d 934 (9th Cir. 2015)...................................................................................................... 24
In re Yahoo Mail Litig.,
308 F.R.D. 577 (N.D. Cal. 2015) ................................................................................... 16, 24, 25
Karim v. Hewlett-Packard Co.,
No. 12-5240, 2014 WL 555934 (N.D. Cal. Feb. 10, 2014) ....................................................... 24
Klaxon Co. v. Stentor Elec. Mfg. Co.,
313 U.S. 487 (1941) ................................................................................................................... 18
Murray v. GMAC Mortg. Corp.,

5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

- iii -

PLAINTIFFS’ MOTION FOR CLASS CERTIFICATION

C 13-05996 PJH

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

TABLE OF AUTHORITIES
(continued)
Page
434 F.3d 948 (7th Cir. Ill. 2006) ................................................................................................ 22
Nedlloyd Lines B.V. v. Super. Ct.,
3 Cal. 4th 459 (1992) ................................................................................................................. 18
O’Connor v. Boeing North America, Inc.,
184 F.R.D. 311 (C.D. Cal. 1998) ............................................................................................... 14
Phillips Petroleum Co. v. Shutts,
472 U.S. 797 (1985) ................................................................................................................... 18
Rodriguez v. Hayes,
591 F.3d 1105 (9th Cir. 2010).............................................................................................. 12, 24
Silbaugh v. Viking Mag. Servs.,
278 F.R.D. 389 (N.D. Ill. 2012) ................................................................................................. 19
Six (6) Mexican Workers v. Az. Citrus Growers,
904 F.2d 1301 (9th Cir. 1990).................................................................................................... 24
Vietnam Veterans of Am. v. C.I.A.,
288 F.R.D. 192 (N.D. Cal. 2012) ............................................................................................... 12
Wal-Mart Stores, Inc. v. Dukes,
131 S. Ct. 2541 (2011) ......................................................................................................... 12, 16
Walters v. Reno,
145 F.3d 1032 (9th Cir. 1998).................................................................................................... 24
Wolin v. Jaguar Land Rover North America,
617 F.3d 1168, 1175 (9th Cir. 2010).......................................................................................... 13
Wolph v. Acer Am. Corp.,
272 F.R.D. 477 (N.D. Cal. 2011) ............................................................................................... 18
Zinser v. Accufix Research Inst., Inc.,
253 F.3d 1180 (9th Cir. 2001).................................................................................................... 18
STATUTES
18 U.S.C. § 2510(5)(a) ................................................................................................................... 17
18 U.S.C. § 2511(1)(a) ................................................................................................................... 16
18 U.S.C. § 2520(b)(1)................................................................................................................... 22
18 U.S.C. § 2520(c)(2) ............................................................................................................. 21, 22
Cal. Pen. Code § 637.2 ................................................................................................................... 21
RULES
Fed. R. Civ. P. Rule 23(a)(1) ......................................................................................................... 11
Fed. R. Civ. P. Rule 23(a)(2) ......................................................................................................... 12
Fed. R. Civ. P. Rule 23(a)(3) ......................................................................................................... 13
Fed. R. Civ. P. Rule 23(a)(4) ......................................................................................................... 13
Fed. R. Civ. P. Rule 23(b)(2) ................................................................................................... 16, 24
Fed. R. Civ. P. Rule 23(g)(1)(A).................................................................................................... 14
- iv -

PLAINTIFFS’ MOTION FOR CLASS
CERTIFICATION C 13-05996 PJH

1
2
3
4
5
6
7

TABLE OF AUTHORITIES
(continued)
Page
TREATISES
5 James W. Moore, Moore’s Federal Practice,
§ 23.21[3] (Matthew Bender 3d ed.) .......................................................................................... 15
Newberg on Class Actions § 3.3
(4th ed. 2002) ............................................................................................................................. 11
OTHER AUTHORITIES
J. Cohen, What Privacy Is For,
126 Harv. L. Rev. 1904 , (2013) .......................................................................................... 11, 23

8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
-v-

PLAINTIFFS’ MOTION FOR CLASS
CERTIFICATION C 13-05996 PJH

1
2

I.

INTRODUCTION
The Court should certify for class treatment the Plaintiffs’ claims under the Electronic

3

Communications Privacy Act, 18 U.S.C. §§ 2510 et seq. (“ECPA”) and the California Invasion of

4

Privacy Act, Cal. Penal Code §§ 631 et seq. (“CIPA”), on behalf of all persons in the United

5

States who sent a private message containing an Internet link (or URL address) via Defendant

6

Facebook, Inc.’s (“Facebook”) electronic messaging service, on the grounds that common proof

7

will establish that Facebook unlawfully intercepts the content of private messages in violation of

8

these laws, without the consent of its users, and monetizes the content of these private messages

9

for its sole benefit.

10

Facebook’s routine business practices, confirmed by its operational computer source code,

11

reveal rampant abuses of its users’ privacy, continuing to this day. Every time a user sends a

12

private message with an Internet link, Facebook

13

It also contemporaneously redirects the URL information

14
15

. The interception of this private message content occurs

16
. Facebook acquires

17
18

the content of private messages simultaneously with their transmission using
.

19
20

Facebook admits that it previously captured URL information in private messages to

21

publicly increase “Like” counts on third-party websites (though it hides behind hyper-technical,

22

and erroneous, defenses to liability). However, Facebook admits to just this sliver of its practices

23

to deflect scrutiny from its more pervasive—and continuing—acquisition of private message

24

content which more generally informs its targeted advertising. Facebook’s obfuscation has

25

included repeated efforts to define Plaintiffs’ case as only relating to the increase in the Like

26

counts (in order to, e.g., impede the proper scope of discovery). However, as the rulings of the

27

Court and Magistrate Judge hold, Plaintiffs’ ECPA and CIPA claims concern the acquisition of

28

any and all private message content, and are not limited by any single specific use Facebook
-1-

PLAINTIFFS’ MOTION FOR CLASS CERTIFICATION

C 13-05996 PJH

1

makes of that content. As a result, Plaintiffs have amassed relevant evidence demonstrating that

2

with each private message containing a URL,

3

Indeed, Facebook’s own

4

technicians cannot discern the full extent of Facebook’s exploitation of users’ private message

5

content, stating that

6

That conduct alone is

7

sufficient for purposes of establishing violations of ECPA and CIPA. However, Facebook also

8

fueled its targeted advertising platform with the intercepted private message content to

9
10
11
12

as well as to increment the “Like” social plugin counter. Facebook’s surreptitious
conduct is essential to its ability to become one of the wealthiest corporations on the planet.
The evidence of Facebook’s conduct will undoubtedly be common as to the Plaintiffs and

13

the class members, and will command the focus of the trial of this matter. Plaintiffs’ and the class

14

members’ unwitting entanglement in Facebook’s scheme will likewise be demonstrated through

15

common proof. In its ruling on the Motion to Dismiss, this Court noted that Facebook’s self-

16

serving disclosures were insufficient to show users’ express consent to interception of their

17

private messages. These self-serving statements also comprise common proof of users’ lack of

18

consent. Moreover, unlike other cases where it was found that consent could be implied from

19

attendant circumstances, here no such attendant circumstances exist. To the contrary, there is

20

overwhelming, common evidence that Facebook has actively concealed its practices from public

21

view. Facebook’s deliberate efforts to hide its unbounded use of private messages will be shown

22

through common evidence and will defeat Facebook’s cynical attempt to imply users’ knowing

23

and intelligent relinquishment of their privacy rights.

24

Class certification under Rule 23(b)(3) is appropriate because the trial of this matter will

25

predominately consist of common evidence establishing Facebook’s liability and Plaintiffs’ and

26

class members’ entitlement to statutory damages or restitution. Alternatively, class certification

27

of Plaintiffs’ request for declaratory and injunctive relief is appropriate under Rule 23(b)(2)

28

because Facebook’s unlawful interception, scanning and sharing of the content of private
-2-

PLAINTIFFS’ MOTION FOR CLASS CERTIFICATION

C 13-05996 PJH

1

messages, is conduct “generally applicable to the class as a whole.”

2

Accordingly, Plaintiffs request that the Court grant their motion for class certification,

3

appoint plaintiffs as class representatives, and appoint Lieff Cabraser Heimann & Bernstein and

4

Carney Bates & Pulliam as class counsel.

5

II.

6

ISSUE TO BE DECIDED
Whether plaintiffs’ claims satisfy the requirements for class certification under Federal

7

Rule of Civil Procedure 23(a) and 23(b)(3), or in the alternative Rule 23(b)(2).

8

III.

9

STATEMENT OF FACTS—HOW FACEBOOK ACQUIRES, REDIRECTS AND
USES URL CONTENT FROM PRIVATE MESSAGES

10

Facebook systematically employs computer source code devices, designed for the

11

exclusive purpose of acquiring the content of users’ private messages and redirecting it to

12

, contemporaneously with, but prior to completion of, the transmission of the message to

13

the recipient. The source code Facebook employs to capture and redirect private message content

14

is distinct from, and wholly unnecessary for, the transmission of the message, the scanning of the

15

message for malware or illegal content, or even for generating the thumbnail preview of the URL

16

destination. Facebook’s interception of private messages allows its source code to divine the

17

meaning of the messages content and record their characteristics as

18

.

19

After intercepting these records in transit, Facebook retains them indefinitely for future

20

use. Facebook acknowledges one such use— its former practice of bumping up the “Like” count

21

on other websites, which it ceased doing shortly after this practice was publicly exposed in

22

October 2012. Facebook has claimed several times in this litigation that it has changed its

23

business practices, implying that it no longer intercepts the content of private messages.1

24
25
26
27
28

1

When this Court asked Facebook’s counsel: “[w]hen you say ‘the cessation of conduct,’ what
specific conduct ceased?” Ex. 1 (October 1, 2015 Hearing Transcript at 5:10-11), Facebook’s
counsel only identified the increment in the Like counter. Id. at 7:4-7 (“If you included the URL
in the message, this anonymous aggregate number…went up, and that’s the conduct, that’s – that
stopped”). The Court pressed, asking, “[b]ut did the actual conduct of scanning or looking at
these messages that are sent stop?” Id. at 8:9-10. Facebook’s counsel did not respond directly,
but rather began discussing scanning for purposes of detecting malware or criminal conduct, but
nothing else. Id. at 9:2-9.
-3-

PLAINTIFFS’ MOTION FOR CLASS CERTIFICATION

C 13-05996 PJH

1

However, Facebook’s source code not only reveals that Facebook continues to acquire URL

2

content from private messages, but that it also continues to make use of the content it acquires.

3

A.

4

As alleged in the Consolidated Amended Complaint (“CAC”) and detailed in the Report

Facebook Intercepts Content From Private Messages During Transmission

5

of Dr. Jennifer Golbeck in Support of Plaintiffs’ Motion for Class Certification (“Golbeck

6

Report”), Facebook “intercepts” private messages while in transit, using source code-based

7

devices designed solely for the purpose of exploiting their content.2

8

Facebook employs a component of its source code
.3

9
10
11
12
13

4

14
15

Thereafter, employing a separate and distinct component of its source code,

16
17
18
19
20
21
.7

22
23
24
25
26
27
28

2

Ex. 2 (Golbeck Report) at ¶¶ 32-55; 116-118. Unless otherwise stated, all exhibits are to the
Declaration of Melissa Gardner in Support of Plaintiffs’ Motion for Class Certification.
3
Id. at ¶¶ 19-29.
4
Ex. 3 (Facebook’s Suppl. Responses and Objections to Plaintiffs’ First Set of Interrogatories), at
13:4-5.
5
Ex. 2 (Golbeck Report), at ¶¶ 40-42.
6
Id. at ¶ 100.
7
Id. at ¶ 41.
-4-

PLAINTIFFS’ MOTION FOR CLASS CERTIFICATION

C 13-05996 PJH

1

Facebook code further intercepts and redirects private message content by

2
.8 For example, in one instance, private message content is

3
4
5

.9 In another instance, Facebook

6
7

, described below.10

8
9
10

In sum, Facebook employs unique code-based devices to intercept, redirect and log the
contents of user’s private messages, including code that

11
.11

12
13

.12 Facebook did not need to create these data points to process or send the message,

14
15

and Facebook employs

16

.13

17

The above-described transmission procedures and code, including the code pertaining to

18

the interception of message content and

19

remained consistent from the beginning of the class period to the present.14

, has

20
21
22
23
24
25
26
27
28

8

Id. at ¶¶ 43-54.
Id. at ¶¶ 44-51; 57-64.
10
Id. at ¶ 41.
11
Id. at ¶ 55.
12
Id. at ¶¶ 108-115;117.
13
Id. at ¶¶ 19-29; 108-115.
14
Id. at ¶ 107. The most current version of the Facebook source code that Facebook has
produced is dated December 31, 2012, and while the descriptions of the source code set forth
herein are as of that date, Facebook has not produced, or informed Plaintiffs of, any material and
relevant changes to Facebook’s source code since then, if any. Notably, Facebook’s production
of documents show that as of at least April 20, 2104
. Id. at ¶ 96;
Ex. 35 (FB000005802-R).
9

-5-

PLAINTIFFS’ MOTION FOR CLASS CERTIFICATION

C 13-05996 PJH

1

B.

2

According to Facebook, the extent of the records it creates from private message content

Facebook Uses Content From Intercepted Private Messages

3

border on limitless, as do the uses to which it puts such content. In a declaration in this

4

proceeding, a Facebook Engineering Manager acknowledged:

5
15

6
7
8
16

9
10

Turning to how Facebook uses the intercepted content, the same declarant

explained the possibilities are as expansive as Facebook’s entire source code:

11
17

12
13

Accordingly, “the abstract hypothetical question as to all possible

uses is likely impossible to answer.”18
Facebook places no limitations on how it may exploit its users’ data, including the data it

14
15

acquires from its users’ private messages. Facebook has large and complex data behind its site.

16

Facebook currently stores this data in a data model called TAO (The Associations and Objects).19

17

Objects represent things on Facebook—e.g., users, pages, checkins, comments, locations.

18

Associations represent relationships between objects—e.g., friendships between users, a Like that

19

connects a user to a page, or a location that is tied to a user check-in.20 In deposition, Facebook’s

20

30(b)(6) witness testifying on how the company uses private message content stated that
”21 Thus, the records

21
22

that Facebook creates from its users’ private messages, and which are stored indefinitely, may be

23

put to any use, for any reason, by any Facebook employee, at any time.

24

15

25
26
27
28

Declaration of Dale Harrison for Defendant Facebook, Inc. (Dkt No. 125, Ex. A), at ¶ 17.
Id. at ¶ 19.
17
Id. at 20.
18
Id.
19
Ex. 2 (Golbeck Report), at ¶ 32.
20
Id. at ¶ 33.
21
Ex. 5 (September 25, 2015 Deposition of Ray He, “He Dep.”), at 172:2-3.
16

-6-

PLAINTIFFS’ MOTION FOR CLASS CERTIFICATION

C 13-05996 PJH

1

1.

2
3

Facebook’s code is written to scan private messages

4

. Specifically, during the

5
6
7
8
9
10
11
12
13
14
The tally of the number of times a URL was discussed in private messages—

15
16
17

was and continues to be used by Facebook for purposes beyond simply increasing the publicly

18

displayed “Like” count on the website associated with that URL, conduct to which Facebook has

19

already publicly admitted. During the class period, Facebook also used the

20
.25

21
As one example, Facebook utilized

22
23

22

24
25
26

See, e.g., Ex. 4 (FB000005502-R) (in which the field designated “
).
Ex. 6 (FB000008489) at 2 (“
); See also Golbeck

Decl. ¶ 38 (
”)
24

27
28

Ex. 2 (Golbeck Report), at ¶ 84.
25

Id. at ¶¶ 56-64.
-7-

PLAINTIFFS’ MOTION FOR CLASS CERTIFICATION

C 13-05996 PJH

1
2
3
4
5
6
7
8
29

9

Thus,

10

to specific users.

11

2.

12

Facebook’s Sharing of User Data With Third Parties.

Facebook intentionally and publicly shared demographic data about its users and their

13

private messages with website owners and developers.30 Facebook employed multiple source-

14

code devices to

15

Facebook’s “Insights” product, directed to website owners, provides demographic information

16

about interactions on external websites. This includes data

17

.

18

Facebook makes this information available to any website owner, with the pitch that such

19

information will help the website customize content for its existing visitors and target advertising

20

(presumably, via Facebook) to attract new visitors. Additionally, Facebook’s API (“application

21

program interface”) allowed third-party app developers to

22
23
24

. This content could be used for any purpose and by any developer.
26

Facebook documents describe
(FB000003118). Ray He further explains that “

.” Ex. 7

25
26
27
28

Ex. 5 (He Dep.) at 227:3-4; 11-12.
Ex. 5 (He Dep.), at 229:19-230:6.
28
Ex. 2 (Golbeck Report), at ¶¶ 61-64.
29
Id.
30
Ex. 33 (Torres Report), at ¶ 16.
27

-8-

PLAINTIFFS’ MOTION FOR CLASS CERTIFICATION

C 13-05996 PJH

1

3.

Increasing “Like” Counts on Third-Party Websites

The Like button is critical for Facebook’s targeted advertising business.31 The Like

2
3

button allows Facebook to monitor its users’ activity, even when those users are on third-party

4

websites.32 With active Likes, if a user clicks a “Like,”

5
6
. Further, through

7
8

Facebook’s Insights product, the Like button enables a third-party website to covertly monitor

9

Facebook users’ interaction with the website—Facebook promotes this feature as helping the

10

website “

” by providing “
.”35

11

Prior to October 2012, Facebook used the combined values in the “tracking_info” field of

12
13

an EntGlobalShare—including the share_count derived from private message content—as the

14

Like count publicly displayed on the corresponding third-party website.36 However, when

15

exposed by the Wall Street Journal in early October 2012, Facebook
.37

16
17
18
19
20
21

31

See, e.g., Ex. 8 (FB000014365), a 2012 email in which a Facebook employee states

When explaining what data contributes to the
Like count (including URLs found through private message scans), Facebook employee Austin
Haugen states
” Ex. 9
(FB000003335). See also Ex. 10 (FB000004996)
32

See, e.g., Ex. 11 (FB000012539), at 2:

33

See, e.g., Ex. 12 (FB000008268), a Facebook document entitled

22
23
24
25
34

26
27
28

Facebook does this through its Open Graph Protocol, a portion of its platform dedicated to
linking items of data across its social network. See, e.g., Ex. 11 (FB000012539) at 2.
35
Ex. 13 (FB000008722), at 2.
36
Ex. 2 (Golbeck Report), at ¶¶ 82-93.
37
For example, a Facebook
Footnote continued on next page
-9-

PLAINTIFFS’ MOTION FOR CLASS CERTIFICATION

C 13-05996 PJH

1

Indeed, the value of Likes to the business was recognized at the highest levels of the company. 38

2

In an

3

Facebook engineer Alex Himel notes that

4
39

5
6

comments that this is

Id. However, Facebook took pains to
.40

7
8
9

In the same document, Himel further

Nonetheless, Facebook continues to create

from private messages containing

URLs, and additionally continues to
.41 As discussed above, Facebook

10
11

.

12

In short, Facebook has intercepted users’ private message content has used it for profit,

13

and appears to be doing so to this day.

14

IV.

15

Certification of the following class is proper under Fed. R. Civ. P. 23:

16

All natural-person Facebook users located within the United States
who have sent, or received from a Facebook user, private messages
that included URLs in their content (and from which Facebook
generated a URL attachment), from within two years before the
filing of this action up through the date of the certification of the

17
18
19

CLASS CERTIFICATION IS PROPER

Footnote continued from previous page

20
Ex. 14 (FB000000594).
21

38

22
23
24
25
26
27
28

39
40

Ex. 16 (FB000001265).
When engineers
Ex. 17

(FB000006429) at 3.
41
Ex. 2 (Golbeck Report), at ¶¶ 90-92.
- 10 -

PLAINTIFFS’ MOTION FOR CLASS CERTIFICATION

C 13-05996 PJH

class.42

1

Without certification of an appropriate class, privacy rights long acknowledged in the

2
3

Common Law, as reflected in the legislative enactments of ECPA and CIPA, will go unenforced,

4

thus eviscerating the privacy interests necessary to the sound functioning of a democratic society.

5

See, e.g., J. Cohen, What Privacy Is For, 126 Harv. L. Rev. 1904, 1927 (2013) (“In addition,

6

privacy does not only protect individuals. Privacy furthers fundamental public policy goals

7

relating to liberal democratic citizenship, innovation, and human flourishing.”).

8

A.

9

Plaintiffs have set forth prima facie facts that satisfy the four requirements of Rule 23(a):

10

The Rule 23(a) Criteria Are Met

(1) numerosity; (2) commonality; (3) typicality; and (4) adequacy of representation.

11

1.

The Class is so Numerous that Joinder is Impracticable

Plaintiffs satisfy the numerosity requirement because the class “is so numerous that

12
13

joinder of all members is impracticable.” Fed. R. Civ. P. 23(a)(1). “Where ‘the exact size of the

14

class is unknown, but general knowledge and common sense indicate that it is large, the

15

numerosity requirement is satisfied.’” In re Abbott Labs. Norvir Antitrust Litig., Nos. 04–1511,

16

04–4203, 2007 WL 1689899, at *6 (N.D. Cal. June 11, 2007) (Wilken, J.) (quoting Newberg on

17

Class Actions § 3.3 (4th ed. 2002)). During 2012, Facebook identified approximately

18

monthly active users who utilized the private message function.43 Facebook’s Q4 earnings

19

statement from 2012 states that it had 1.056 billion monthly active users worldwide, with

20
21
22
23
24
25

42

Excluded from the Class are the following individuals and/or entities: Facebook and its parents,
subsidiaries, affiliates, officers and directors, current or former employees, and any entity in
which Facebook has a controlling interest; counsel for the putative class; all individuals who
make a timely election to be excluded from this proceeding using the correct protocol for opting
out; and any and all federal, state or local governments, including but not limited to their
departments, agencies, divisions, bureaus, boards, sections, groups, counsels and/or subdivisions;
and all judges assigned to hear any aspect of this litigation, as well as their immediate family
members.
43
In Ex. 18 (FB000008271), at 4, Facebook

26
27
28

“MAU” appears to stand for “Monthly Active User,” a term Facebook uses elsewhere in the
course of describing user engagement. See, e.g., Facebook’s press release for Second Quarter
2015 financial results (defining “MAUs” as “[m]onthly active users.”) (available at
http://investor.fb.com/releasedetail.cfm?ReleaseID=924562).
- 11 -

PLAINTIFFS’ MOTION FOR CLASS CERTIFICATION

C 13-05996 PJH

1

193 million of those users located in North America.44 Assuming an even distribution among

2

active message users worldwide, this means as many as tens of millions of members exist in the

3

United States, such that even a tiny percentage of those users would satisfy the numerosity

4

requirement.

5

2.

6

Questions of Law and Fact Are Common to the Class

Rule 23(a)(2) requires that there be “questions of law or fact common to the class.”

7

Commonality is thus satisfied where the claims of all class members “depend upon a common

8

contention...of such a nature that it is capable of classwide resolution—which means that

9

determination of its truth or falsity will resolve an issue that is central to the validity of each one

10

of the claims in one stroke.” Wal-Mart Stores, Inc. v. Dukes, 131 S. Ct. 2541, 2551 (2011)

11

(common questions must “generate common answers” that are “apt to drive the resolution of the

12

litigation”) (citation omitted). “All questions of fact and law need not be common to satisfy the

13

rule.” Hanlon v. Chrysler Corp., 150 F.3d 1011, 1019 (9th Cir. 1998); Rodriguez v. Hayes,

14

591 F.3d 1105, 1122 (9th Cir. 2010) (noting that “common” does not mean “complete

15

congruence”). In fact, “[t]hat ‘commonality only requires a single significant question of law or

16

fact’ was recently recognized by both the Supreme Court and the Ninth Circuit.” Vietnam

17

Veterans of Am. v. C.I.A., 288 F.R.D. 192, 212-13 (N.D. Cal. 2012) (Wilken, J.) (citations

18

omitted) (citing cases).

19

In the Joint Case Management Conference Statement, Facebook itself identifies relevant

20

common issues which track the elements to establish Facebook’s violations of ECPA and CIPA.

21

See Dkt. 6 at 4-7. 45 Proof of the elements of ECPA and CIPA is necessarily common because it

22

will focus upon Facebook’s uniform conduct. Such evidence will concern Facebook’s internal

23

operations and source code, revealing its “intent,” to “intercept” private messages while in transit,

24

deriving its “content” and “redirecting” it elsewhere for purposes outside the “ordinary course of

25

44

26
27
28

Ex. 19 (Facebook Quarterly Earnings Slides Q4 2012) at 3.
Common questions identified by Facebook include: (a) whether Facebook unlawfully
‘redirected’ the content of users’ private messages; (b) whether the interception was
contemporaneous with the messages’ transmission; (c) whether the “ordinary course of business”
exemption applies to Facebook’s conduct; and (d) whether Plaintiffs and the class members
expressly or impliedly consented to the interceptions. Id.
45

- 12 -

PLAINTIFFS’ MOTION FOR CLASS CERTIFICATION

C 13-05996 PJH

1

its business.” Here, even the issue of Plaintiffs’ lack of consent to Facebook’s conduct will focus

2

on Facebook’s conduct, i.e., its failure to procure express consent, and its secret, but active

3

concealment of its actual practices. Therefore, proof of these elements will necessarily require

4

the same evidence for any one Plaintiff as it will for the class as a whole, and resolution of these

5

issues will necessarily generate common answers.

6

3.

7

Plaintiffs’ Claims Are Typical of the Class

Rule 23(a)(3)’s “typicality requirement is to assure that the interest of the named

8

representative aligns with the interests of the class.” Wolin v. Jaguar Land Rover North America,

9

617 F.3d 1168, 1175 (9th Cir. 2010) (quoting Hanon v. Dataproducts Corp., 976 F.2d 497, 508

10

(9th Cir. 1992)). Typicality exists when the class representatives and the class members are

11

subjected to and injured by the same course of conduct. Ellis v. Costco Wholesale Corp.,

12

657 F.3d 970, 984 (9th Cir. 2011).

13

Representative Plaintiffs Matthew Campbell and Michael Hurley are Facebook users who

14

have sent private messages which contained a URL, or Internet link.46 Discovery in this case has

15

confirmed that by operation of its source code and internal policies, Facebook intercepted the

16

representative Plaintiffs’ private messages, acquired the messages’ content, redirected those

17

messages to generate records about the content acquired therein, and stored these records, in

18

perpetuity. Ex. 20 (Defs.’ Suppl. Resp. and Objs. To Narrowed Second Set of Interrogatories), at

19

Ex. 1. Discovery has further revealed that Facebook processed and scanned all private messages

20

, and that Facebook’s code, and accompanying, code-based

21

message-scanning devices, operated uniformly across all class members. 47 Any Facebook user in

22

the class sending a private message would have URL content intercepted in the same manner as

23

the representative Plaintiffs. Accordingly, the representative Plaintiffs’ claims and the class

24

members’ claims “are so interrelated that the interests of the class members will be fairly and

25

adequately protected in their absence.” Gen. Tel. Co. of Sw. v. Falcon, 457 U.S. 147, 163 n.13

26

(1982); Ades v. Omni Hotels Mgmt. Corp., No. 13-02468, 2014 WL 4627271, at *9 (C.D. Cal.

27

46

28

47

Id.
Ex. 2 (Golbeck Report), at ¶ 107.
- 13 -

PLAINTIFFS’ MOTION FOR CLASS CERTIFICATION

C 13-05996 PJH

1

Sept. 8, 2014) (finding class representatives’ claims typical where “course of conduct…common

2

to the class, and privacy invasions typical to those of the class generally” were alleged).

3
4

4.

Plaintiffs And their Counsel Will Adequately Represent the Class

Rule 23(a)(4) requires that the class representatives and their counsel will “fairly and

5

adequately protect the interests of the class.” See Ellis, 657 F.3d at 985 (quoting Hanlon,

6

150 F.3d at 1020). “Adequate representation depends on, among other factors, an absence of

7

antagonism between representatives and absentees, and a sharing of interest between

8

representatives and absentees.” Id. In considering the adequacy of plaintiffs’ counsel, the court

9

must consider “(i) the work counsel has done in identifying or investigating potential claims in

10

the action; (ii) counsel’s experience in handling class actions, other complex litigation, and the

11

types of claims asserted in the action; (iii) counsel’s knowledge of the applicable law; and (iv) the

12

resources that counsel will commit to representing the class.” Fed. R. Civ. P. 23(g)(1)(A).

13

As Plaintiffs’ claims are typical of the class, they have no antagonism with class

14

members’ interests. Plaintiffs also have committed to prosecute the case vigorously on behalf of

15

all class members, and have devoted substantial time and effort in the case already. Plaintiffs

16

have retained counsel with substantial experience in litigating privacy claims and class actions

17

generally. Bates Decl. Ex. A; Sobol Decl. ¶ 5. Plaintiffs’ counsel have devoted a significant

18

amount of time to identifying and investigating the potential claims and pursuing discovery in this

19

matter, and will continue to commit the resources necessary to represent the class. Accordingly,

20

Plaintiffs and their counsel will adequately represent the class.

21
22

5.

The Class Is Ascertainable

“[C]ourts have implied an additional requirement under Rule 23(a): that the class to be

23

certified be ascertainable.” In re Google Inc. Gmail Litig., No. 13-02430, 2014 WL 1102660, at

24

*10 (N.D. Cal. Mar. 18, 2014) (Koh, J.). “‘A class definition should be precise, objective, and

25

presently ascertainable,’ though ‘the class need not be so ascertainable that every potential

26

member can be identified at the commencement of the action.’” Gray v. Golden Gate Nat’l

27

Recreational Area, 279 F.R.D. 501, 508 (N.D. Cal. 2011) (LaPorte, J.) (quoting O’Connor v.

28

Boeing N. Am., Inc., 184 F.R.D. 311, 319 (C.D. Cal. 1998)). “A class definition is sufficient if
- 14 -

PLAINTIFFS’ MOTION FOR CLASS CERTIFICATION

C 13-05996 PJH

1

the description of the class is ‘definite enough so that it is administratively feasible for a court to

2

ascertain whether an individual is a member.’” In re High-Tech Employee Antitrust Litig., 985 F.

3

Supp. 2d 1167, 1182 (N.D. Cal. 2013) (Koh, J.) (quoting O’Connor, 184 F.R.D. at 319). It must

4

be possible to determine whether a class member is included “by reference to objective criteria.”

5

Id. (quoting 5 James W. Moore, Moore’s Federal Practice, § 23.21[3] (Matthew Bender 3d ed.)).
Plaintiffs have precisely defined the class based on objective criteria.48 Dr. Golbeck has

6
7

demonstrated that, by

8

users in the United States during the relevant time period from whose messages Facebook has

9

intercepted URL content

Facebook can identify all Facebook

. 49 In any event, any

10

Facebook user can readily determine whether she sent or received a Facebook message containing

11

a URL within the relevant time period.

12

B.

13

Rule 23(b)(3) permits the maintenance of a class where common issues predominate and a

14

The Class Is Properly Maintained Under Fed. R. Civ. P. 23(b)(3)

class action is superior to individual actions.

15

1.

Common Issues Predominate

16

The predominance requirement “tests whether proposed classes are sufficiently cohesive

17

to warrant adjudication by representation.” Amchem Prods., Inc. v. Windsor, 521 U.S. 591, 623

18

(1997). Predominance is satisfied when “[a] common nucleus of facts and potential legal

19

remedies dominate [the] litigation.” Hanlon, 150 F.3d at 1022. “When common questions

20

present a significant aspect of the case and they can be resolved for all members of the class in a

21

single adjudication, there is clear justification for handling the dispute on a representative rather

22

48

23
24
25
26
27

“All natural-person Facebook users located within the United States who have sent, or received
from a Facebook user, private messages that included URLs in their content (and from which
Facebook generated a URL attachment). . . .” When a user includes a URL in a private message,
Facebook's source code
. Ex. 2
(Golbeck Report), at ¶¶ 18-29. While the private message is still in transit, the source code

Id. at ¶¶ 30-54. Facebook has nit-picked elsewhere
that
. Although this is the rare
exception, Plaintiffs have tailored the class definition by referring to the generation of the URL
attachment because, by operation of Facebook’s source code,
49
Id. at ¶¶ 98-106. In the

28
- 15 -

PLAINTIFFS’ MOTION FOR CLASS CERTIFICATION

C 13-05996 PJH

1

than on an individual basis.” Hanlon, 150 F.3d at 1022. (citation omitted).

2

This case turns on evidence of Facebook’s uniform treatment of millions of class

3

members. Facebook literally programmed itself to operate exactly the same way with regard to

4

all of its users. Common issues of fact and law predominate because resolution of the common

5

issues—whether Facebook’s programmed, uniform treatment of users who send private messages

6

containing URLs or Internet links violates ECPA and CIPA—can be achieved in this one

7

proceeding.

8

a.

9
10

Facebook’s ECPA Violation Will be Established by Common
Proof

Plaintiffs’ ECPA claim can be adjudicated based upon evidence common to the class.

11

ECPA provides for civil penalties against any person who “intentionally intercepts, endeavors to

12

intercept, or procures any other person to intercept or endeavor to intercept, any wire, oral, or

13

electronic communication through the use of any electronic, mechanical, or other device” while in

14

transit. 18 U.S.C. § 2511(1)(a). An “interception” means acquiring the content of the

15

communication such that “the contents of a wire communication are captured or redirected in any

16

way.” Order on Motion to Dismiss, Dkt. 43 at 5.

17

An ECPA claim is naturally suited to classwide determination. In a similar case earlier

18

this year, another court within this District held that “[w]hether Yahoo intercepts emails to and

19

from non-Yahoo mail subscribers while those emails are in transit is a ‘common contention’ that

20

‘is capable of classwide resolution’ and ‘will resolve an issue that is central to the validity of each

21

one of the claims in one stroke.’” In re Yahoo Mail Litig., 308 F.R.D. 577, 590-91 (N.D. Cal.

22

2015) (Koh, J.), quoting Dukes, 131 S.Ct. at 2552. Although the court in Yahoo Mail Litig. did

23

not reach the issue of predominance because plaintiffs there only sought certification under

24

Fed. R. Civ. P. 23(b)(2), its rationale that these basic elements of an ECPA claim are “central to

25

the validity” of the claims and can be adjudicated classwide, compels a determination of

26

predominance here.

27
28

While Facebook denies that it intentionally intercepts private messages while in transit,
within the meaning of ECPA, the determination of those issues are undeniably common and
- 16 -

PLAINTIFFS’ MOTION FOR CLASS CERTIFICATION

C 13-05996 PJH

1

susceptible to common proof. Here, expert analysis of Facebook’s source code, corroborated by

2

other internal records, will show that an intentional interception of URL content occurs during

3

transmission and

4

code analysis demonstrates that upon interception of private message URL content, Facebook

5

redirected the content to

6
7

to make use of the content for purposes wholly unrelated to facilitating the
transmission of the message.51

8
9

.50 Moreover, the source

ECPA has an exception to liability for interceptions conducted through a device that is
“being used by a provider of wire or electronic communication service in the ordinary course of

10

its business.” 18 U.S.C. § 2510(5)(a); Order on Motion to Dismiss, Dkt. 43 at 6. The

11

determination of Facebook’s defense through this exception also will be subject to common proof

12

as it focuses exclusively on Facebook’s conduct, source code and development of the private

13

message function. For example, Plaintiffs have determined that Facebook’s source code that

14

redirects private message content operates independently of, and at another point in time from,

15

that Facebook asserts is part

16

of the message transmission process.52 See Order on Motion to Dismiss, Dkt. 43 at 12 (“The fact

17

that Facebook can configure its code to scan message content for certain purposes, but not for

18

others, leaves open the possibility that the challenged practice constitutes a separate

19

‘interception.’ Simply put, the application of the ‘ordinary course of business’ exception to this

20

case depends upon the details of Facebook’s software code.”).

21

b.

22
23

Facebook’s CIPA Violation Will be Established by Common
Proof

As Facebook acknowledges, the core issues in dispute under the CIPA claim mirror the

24
50

25
26

51
52

Ex. 2 (Golbeck Report), at ¶¶ 116-118.
Id. at ¶¶ 32-54; 109
Id. at ¶¶ 108-115; 55

27
28
- 17 -

PLAINTIFFS’ MOTION FOR CLASS CERTIFICATION

C 13-05996 PJH

1

issues applicable to the ECPA claim. Dkt. 60 at 7. For the reasons set forth above, common

2

issues clearly predominate.

3

At the class certification stage, this Court must ensure that a nationwide class under the

4

law of a single state, CIPA, comports with due process. Phillips Petroleum Co. v. Shutts,

5

472 U.S. 797, 818 (1985). California’s choice of law rules govern this consideration. Klaxon

6

Co. v. Stentor Elec. Mfg. Co., 313 U.S. 487, 496 (1941); Zinser v. Accufix Research Inst., Inc.,

7

253 F.3d 1180, 1187 (9th Cir. 2001). The starting point in this analysis is Facebook’s terms of

8

service, which provide that “the laws of the State of California will govern…any claim that might

9

arise between you and us.”53 See Nedlloyd Lines B.V. v. Super. Ct., 3 Cal. 4th 459, 468-70 (1992)

10

(concluding that where the parties have entered into an agreement that specifies that a particular

11

jurisdiction’s law will govern their disputes, a court’s choice-of-law analysis should begin with an

12

inquiry into whether the claims of putative class members fall within its scope). The broad scope

13

of Facebook’s choice-of-law provision clearly evidences an intent to have California law apply to

14

all disputes arising out of the relationship between Facebook and its users. Moreover, California

15

law has a substantial relationship to the parties. Nedlloyd, 3 Cal. 4th at 464. A substantial

16

relationship exists where one of the parties has its principal place of business in the chosen state.

17

ABF Capital Corp. v. Osley, 414 F.3d 1061, 1065 (9th Cir. 2005). Accordingly, certification of a

18

CIPA claim on behalf of a nationwide class is appropriate. See Wolph v. Acer Am. Corp.,

19

272 F.R.D. 477, 484-85 (N.D. Cal. 2011) (White, J.).

20

c.

21
22

Plaintiffs’ and the Class Members’ Lack of Consent to
Facebook Practices will be Established Through Common
Proof

Both ECPA and CIPA require that the offending interception occur without the consent of

23

the user. In the ruling on the Motion to Dismiss, the Court reviewed all of Facebook’s relevant

24

disclosures and concluded: “…in the context of express consent, any consent with respect to the

25

processing and sending of messages itself does not necessarily constitute consent to the specific

26

practice alleged in this case—that is, the scanning of message content for use in targeted

27

advertising.” Order on Motion to Dismiss, Dkt. 43 at 16. The three iterations of Facebook’s Data

28

53

Ex. 21 (FB000000001), at 7; Ex. 22 (FB000000032), at 8; Ex. 23 (FB000000058), at 6.
- 18 -

PLAINTIFFS’ MOTION FOR CLASS CERTIFICATION

C 13-05996 PJH

1

Use Policy during the class period were applicable to all class members and therefore constitute

2

common proof, making the issue of whether these terms disclosed Facebook’s practices of

3

scanning private messages suitable for a classwide determination. Exs. 24 – 26. Gmail, 2014

4

WL 1102660, at *15 (finding that express consent is a common question for class members

5

exposed to the same disclosures).

6

In critical respects, this case is not like Gmail, where the Court found that individual

7

issues regarding actual, implied consent would predominate. There, the record was replete with

8

evidence of class members’ potential, actual advance notice of Google’s practices making implied

9

consent “an intensely individualized” factual question. Id. at *20. Here, in contrast, there is a

10

complete absence of any evidence of advance notice. Despite extensive discovery, including not

11

only the depositions of the class representatives, but also the depositions of the recipients of the

12

class representatives’ private messages, Facebook has not produced relevant evidence from which

13

actual notice can be reasonably implied. Silbaugh v. Viking Mag. Servs., 278 F.R.D. 389, 393

14

(N.D. Ill. 2012) (“Having produced no evidence that any individual consented to receive the text

15

messages…defendant is unable to realistically argue that individual issues regarding consent

16

outweigh the commonality.”) Thus, unlike Gmail, there is no indication that individual consent

17

issues will overwhelm issues Plaintiffs have shown herein to be resolvable through classwide

18

proof.

19

Rather, this case is more like Omni Hotels, where the court found predominance in the

20

absence of actual notification to the class members. 2014 WL 4627271, at 13. Here, Facebook’s

21

undisclosed use of private message content was so extensive that actual consent to the scope of its

22

practices is not reasonably possible. Facebook’s 30(b)(6) witness testified on the topic of

23

Facebook’s use of private message content, stating that

24

Ex. 5 (He Dep.) at 172:1-3. Thus, the records that

25

Facebook creates from its users’ private messages, and which are stored indefinitely, have no

26

limitation, and may be put to any use, for any reason, by any Facebook employee, at any point in

27

the future. Facebook’s Engineering Manager submitted a declaration asserting that not even

28

Facebook can determine the extent to which it uses private message content, and that finding a
- 19 -

PLAINTIFFS’ MOTION FOR CLASS CERTIFICATION

C 13-05996 PJH

1

way to identify all objects created in connection with a given Facebook message, “would likely

2

be impossible.” Dkt. 126 (Harrison Decl.), at ¶ 12. If Facebook cannot identify the extent of its

3

use of private message content, surely the average user cannot be implied to have that actual

4

knowledge of those practices.

5

Further, Plaintiffs will present common evidence that rather than disclose its practices (to

6

provide some basis for “actual” knowledge necessary to imply consent), Facebook actively

7

sought to conceal its practices from users. In fact, whether Facebook’s cover-up of its actions

8

defeats any findings of implied consent here, will be a common question. Gmail, 2014 WL

9

1102660, at *14 (noting that disclosures by Google which indicated that scanning was not

10

occurring indicated “the opposite” of establishing consent). Throughout the class period, and

11

afterwards, Facebook has known that its users were not aware of the scanning at issue in this case,

12

and has affirmatively tried to prevent them from finding out. See, e.g. Ex. 27 (FB000006435), at

13

3-6

14
15
16

See also Ex. 28 (FB000004406)

17
18
19
20

) Indeed, with regard to
Facebook’s incrementing of the Like counter, its executives determined that they “

21
22
23

.” Ex. 29 (FB000007924), at 2. Indeed, when
reversing that practice, Facebook kept it deliberately quiet. See Ex. 30 (FB000000502)

24
25
26

Discovery also demonstrates that Facebook’s public-facing statements about “procedural

27

safeguards” for ensuring user privacy in product development are false. Facebook has

28

represented, inter alia, in its filings with the Security and Exchange Commission that it has “a
- 20 -

PLAINTIFFS’ MOTION FOR CLASS CERTIFICATION

C 13-05996 PJH

1

dedicated team of privacy professionals who are involved in new product and feature

2

development from design through launch” and who conduct “ongoing review and monitoring of

3

the way data is handled by existing features and applications.”54 However, when asked to

4

produce documents sufficient to identify the individuals comprising this “dedicated team,”55

5

Facebook responded that none existed.56

6

d.

7
8
9

Allocation of Monetary Relief to Plaintiffs and the Class can be
Done on a Classwide Basis

Plaintiffs’ and the class members’ monetary relief is “capable of measurement on a
classwide basis.” Comcast Corp. v. Behrend, 133 S. Ct. 1426, 1433 (2013). “The amount of

10

damages is invariably an individual question and does not defeat class action treatment.”

11

Blackie v. Barrack, 524 F.2d 891, 905 (9th Cir. 1975); see also Leyva v. Medline Indus. Inc.,

12

716 F.3d 510, 513-14 (9th Cir. 2013) (holding that the district court abused its discretion in

13

finding that individualized issues of damages precluded class certification).

14

Both ECPA and CIPA provide for statutory damages. 18 U.S.C. § 2520(c)(2); Cal. Pen.

15

Code § 637.2. Federal courts “regularly recognize the superiority of class litigation in suits for

16

statutory damages.” Holloway v. Full Spectrum Lending, 976 F.2d 497, *8-9 (C.D. Cal. 2007).

17

Moreover, the Ninth Circuit clearly states that the superiority analysis does not change when the

18

size of the class creates an excessively large damages model. Bateman v. Am. Multi-Cinema,

19

Inc., 623 F.3d 708, 721 (9th Cir. 2010) (“enormous” aggregate damages liability “is not an

20

appropriate reason to deny class certification under Rule 23(b)(3).”). Instead, “the district court

21

may be entitled to reduce the award if it is unconstitutionally excessive…but constitutional limits

22

are best applied after a class has been certified.” Id. at 723 (quoting Murray v. GMAC Mortg.

23

Corp., 434 F.3d 948, 954 (7th Cir. Ill. 2006)). The Seventh Circuit further clarifies the policy

24

54

25
26
27
28

Facebook Form 10-K for the fiscal year ended December 31, 2013. (available at
http://www.sec.gov/Archives/edgar/data/1326801/000132680114000007/fb-12312013x10k.htm).
55
Ex. 31 (Pltfs.’ First Set Requests for Prod.), Request No. 29 (seeking “[a]ll Documents and ESI
related to – and sufficient to identify – the ‘dedicated team of privacy professionals’ identified on
page 8 of Your Form 10-K for fiscal year ending December 31, 2013.”)
56
Ex. 32 (Ltr. from Joshua Jessen to Hank Bates, April 10, 2015), at 1 (“With respect to Request
No. 29, please be advised that there is no specific list of the ‘dedicated team of privacy
professionals’ referenced in the Request.”).
- 21 -

PLAINTIFFS’ MOTION FOR CLASS CERTIFICATION

C 13-05996 PJH

1

underlying this holding: “[C]onstitutional limits are best applied after a class has been certified.

2

Then a judge may evaluate the defendant's overall conduct and control its total exposure.

3

Reducing recoveries by forcing everyone to litigate independently—so that constitutional bounds

4

are not tested, because the statute cannot be enforced by more than a handful of victims—has

5

little to recommend it.” Murray, 434 F.3d at 954.

6

ECPA also authorizes “equitable…relief as may be appropriate,” as well as “profits made

7

by the violator as a result of the violation.” 18 U.S.C. § 2520(b)(1), (c)(2). Plaintiffs can offer

8

common proof to calculate the value which Facebook derived from intercepting private message

9

content, as well as a method for an equitable allocation of those ill-gotten gains to the members of

10

the class. See Ex. 33, Report of Fernando Torres in Support of Plaintiffs’ Motion for Class

11

Certification (“Torres Report”). Through interceptions of private messages, Facebook creates

12

related Objects and Associations which populate Facebook’s Social Graph. Id. at ¶ 23.

13

Facebook’s Social Graph represents the integration of information collected by Facebook about

14

Facebook users, and encompasses their location, demographics, interests, behaviors, and

15

connections. Id. at ¶ 21. The unlawfully intercepted private message content contributes

16

meaningful data to the Social Graph, increasing the quality of its ability to provide predictive

17

value, and, consequently, increasing Facebook’s advertising revenue and value. Id. at ¶¶ 36 et

18

seq. A reasonable value to Facebook of the intercepted content can be assigned on a per URL

19

basis, and can be allocated to class members on that basis. Id. at ¶ 60.

20

In addition, Facebook generated value from its inflation of third-party Like counters. The

21

economic benefit derived by Facebook attributable to this conduct lies between two bounds: a

22

higher bound represented by the cost that client websites saved by not having to acquire

23

additional Likes; and a lower bound determined by the market value of artificially acquired Likes.

24

Id. at ¶ 63. Again, the value of these Likes can be allocated to class members based upon

25

Facebook’s data which retains user-specific logs for each artificially derived Like. Id. at ¶ 73.

26
27
28

2.

A Class Action Is Superior to Any Alternative

The “objectives of the particular class action procedure will be achieved in th[is]
particular case,” making class certification the superior method for litigating class members’
- 22 -

PLAINTIFFS’ MOTION FOR CLASS CERTIFICATION

C 13-05996 PJH

1

claims. Hanlon, 150 F.3d at 1023. Here, a class action is the only mechanism by which Plaintiffs

2

and class members can practically vindicate the privacy interest at issue, as it stands in direct

3

conflict with the business model of one of the world’s largest corporations.57 The resources

4

required to litigate these claims could never sustain an individual action against Facebook.58

5

Accordingly, absent class certification, the boundaries of permissible private surveillance,

6

established by the Common Law and embodied in ECPA and CIPA, will go unenforced and will

7

likely be breached with impunity. As electronic communications through social media such as

8

Facebook become the dominant mode of interpersonal communication, the need for proper

9

boundaries has never been more important. See, e.g., J. Cohen, What Privacy Is For, 126 Harv.

10

L. Rev. 1904, 1927-32 (2013).

11

3.

This Class Action Is Manageable

12

Class-wide resolution of class members’ claims will be manageable. First, all of the

13

claims are governed by the same statutory laws. Second, the central issue of liability will hinge on

14

the several categories of common proof outlined herein: Either Facebook intercepted messages in

15

transit, or it did not; either Facebook’s scanning devices were “being used in the ordinary course

16

of its business,” or they were not; either Facebook’s public disclosures of its practice could have

17

provided “actual knowledge,” of the alleged violations, or they did not. Third, the potential

18

measures of class-wide relief require common proof: statutory damages, profits resulting from

19

Facebook’s conduct, and/or other appropriate equitable relief. See Six (6) Mexican Workers v. Az.

20

57

This weighing of fundamental privacy interests against corporate profit is exemplified by

21
22

Ex. 30 (FB000000502). Implicit in this analysis is the
proposition that,
Earlier,

23

. See, e.g., Ex. 34 (FB00000802)

24
25
26
27
28

58

See Declaration of Joshua Jessen in Support of Defendant Facebook, Inc.’s Opposition to
Plaintiffs’ Renewed Motion to Continue Deadlines (Dkt. 135-1) (detailing, generally, productions
occurring from February, 2015 through the end of October, 2015; discovery disputes resolved by
Magistrate Judge Maria-Elena James; and the fact that “Plaintiffs and their experts have
collectively spent 48 days reviewing Facebook’s source code.”).
- 23 -

PLAINTIFFS’ MOTION FOR CLASS CERTIFICATION

C 13-05996 PJH

1

Citrus Growers, 904 F.2d 1301, 1306 (9th Cir. 1990) (affirming class certification, explaining

2

that individualized proof manageability issues “are not at issue where the underlying statute

3

permits awards without a showing of actual damage.”). “Indeed, the only difficulties likely to be

4

encountered in this case would result from not certifying the class, given the expenditure of time

5

and resources that would result—from both the court's and the parties' perspectives—in requiring

6

each class member's action to proceed independently.” In re Online DVD Rental Antitrust Litig.,

7

No. 09-2029, 2010 WL 5396064, at *12 (N.D. Cal. Dec. 23, 2010) (Hamilton, J.) aff'd, 779 F.3d

8

934 (9th Cir. 2015).59

9

C.

Alternatively, Class Certification Under Rule 23(b)(2) Is Appropriate

10

A class may be certified pursuant to Fed. R. Civ. P. 23(b)(2) when plaintiffs “complain of

11

a pattern or practice that is generally applicable to the class as a whole.’” Rodriguez, 591 F.3d, at

12

1125 (quoting Walters v. Reno, 145 F.3d 1032, 1047 (9th Cir. 1998)); Fed. R. Civ. P. 23(b)(2).

13

The conduct Plaintiffs challenge in this litigation—Facebook’s scanning, intercepting, cataloging,

14

and using of private message content—affects all class members uniformly and has been

15

implemented in a way that violated class members’ legal rights identically and consistently.

16

Yahoo Mail Litig. (certifying a class under Rule 23(b)(2) where “[p]laintiffs contend that all

17

emails sent from and to Yahoo Mail subscribers are subject to the same interception and scanning

18

processes [and thus] challenge a pattern or practice that is generally applicable to the class as a

19

whole.”) 308 F.R.D. at 598 (internal citations, quotations omitted). Further, the relief sought—

20

cessation of the practice, destruction of any records created from illegally-obtained private

21

message content, and a declaration that such conduct violates ECPA and CIPA—would benefit

22

the class as a whole. Id. (“Moreover, Plaintiffs seek only injunctive and declaratory relief, which

23

is appropriate under Rule 23(b)(2).”) (citations omitted). Accordingly, as an alternative to

24

certification pursuant to Rule 23(b)(3), the Court should allow the class to seek injunctive and

25

declaratory relief pursuant to Rule 23(b)(2).

26
27
28

59

The superiority and manageability of the proposed class proceeding are so straightforward that
a trial plan is self-evident. See Karim v. Hewlett-Packard Co., No. 12-5240, 2014 WL 555934, at
*7 (N.D. Cal. Feb. 10, 2014) (Hamilton, J.) (certifying class action because superiority is selfevident even without a trial plan).
- 24 -

PLAINTIFFS’ MOTION FOR CLASS CERTIFICATION

C 13-05996 PJH

1
2

V.

CONCLUSION
Plaintiffs request that the Court grant their motion for class certification, appoint Matthew

3

Campbell and Michael Hurley as class representatives, and appoint Lieff Cabraser Heimann &

4

Bernstein and Carney Bates & Pulliam as class counsel.

5

Dated: November 13, 2015

6

Lieff Cabraser Heimann & Bernstein, LLP
By:

/s/ Michael W. Sobol
Michael W. Sobol

7
8
9
10
11
12

Michael W. Sobol (State Bar No. 194857)
[e-mail]
David T. Rudolph (State Bar No. 233457)
[e-mail]
Melissa Gardner (State Bar No. 289096)
[e-mail]
LIEFF CABRASER HEIMANN & BERNSTEIN, LLP
275 Battery Street, 29th Floor
San Francisco, CA 94111-3339
Telephone: [phone]
Facsimile: 415.956.1008

13
14
15
16
17

Rachel Geman
[e-mail]
Nicholas Diamand
[e-mail]
LIEFF CABRASER HEIMANN & BERNSTEIN, LLP
250 Hudson Street, 8th Floor
New York, NY 10013-1413
Telephone: [phone]
Facsimile: 212.355.9592

18
19
20
21
22
23

Hank Bates (State Bar No. 167688)
[e-mail]
Allen Carney
[e-mail]
David Slade
[e-mail]
CARNEY BATES & PULLIAM, PLLC
11311 Arcade Drive
Little Rock, AR 72212
Telephone: [phone]
Facsimile: 501.312.8505

24
Attorneys for Plaintiffs and the Proposed Class
25
26
27
28
- 25 -

PLAINTIFFS’ MOTION FOR CLASS CERTIFICATION

C 13-05996 PJH