Campbell et al v. Facebook Inc.

Filing 196

AMENDED COMPLAINT Second Amended Class Action Complaint against Facebook Inc.. Filed byMatthew Campbell, Michael Hurley. (Sobol, Michael) (Filed on 6/7/2016)

Download PDF
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 Michael W. Sobol (State Bar No. 194857) msobol@lchb.com David T. Rudolph (State Bar No. 233457) drudolph@lchb.com Melissa Gardner (State Bar No. 289096) mgardner@lchb.com LIEFF CABRASER HEIMANN & BERNSTEIN, LLP 275 Battery Street, 29th Floor San Francisco, CA 94111-3339 Telephone: 415.956.1000 Facsimile: 415.956.1008 Rachel Geman rgeman@lchb.com Nicholas Diamand ndiamand@lchb.com LIEFF CABRASER HEIMANN & BERNSTEIN, LLP 250 Hudson Street, 8th Floor New York, NY 10013-1413 Telephone: 212.355.9500 Facsimile: 212.355.9592 Hank Bates (State Bar No. 167688) hbates@cbplaw.com Allen Carney acarney@cbplaw.com David Slade dslade@cbplaw.com CARNEY BATES & PULLIAM, PLLC 2800 Cantrell Road, Suite 510 Little Rock, AR 72202 Telephone: 501.312.8500 Facsimile: 501.312.8505 18 Attorneys for Plaintiffs and the Proposed Class 19 UNITED STATES DISTRICT COURT 20 NORTHERN DISTRICT OF CALIFORNIA 21 22 23 MATTHEW CAMPBELL and MICHAEL HURLEY, on behalf of themselves and all others similarly situated, 24 Case No. 13-cv-5996-PJH (MEJ) SECOND AMENDED CLASS ACTION COMPLAINT Plaintiffs, JURY TRIAL DEMANDED 25 v. 26 FACEBOOK, INC., 27 Defendant. 28 SECOND AMENDED CLASS ACTION COMPLAINT CASE NO. 13-CV-05996-PJH (MEJ) SECOND AMENDED CLASS ACTION COMPLAINT1 1 2 I. INTRODUCTION 1. 3 Defendant Facebook, Inc. (“Facebook”) has systematically intercepted Facebook 4 users’ private Facebook messages without their consent. Facebook’s conduct violates the 5 Electronic Communications Privacy Act, 18 U.S.C. §§ 2510 et seq. (“ECPA”), and the California 6 Invasion of Privacy Act, California Penal Code §§ 630 et seq. (“CIPA”). Plaintiffs seek, 7 individually and on behalf of the Class, injunctive and declaratory relief, restitution, and 8 monetary damages, on behalf of all Facebook users in the United States who have had their 9 Facebook private messages intercepted by Facebook in the manner alleged herein. 2. 10 Plaintiffs Matthew Campbell and Michael Hurley are Facebook users who, during 11 the class period, utilized Facebook’s private messaging function, each relying on representations 12 that these private and personal communications would be viewed only by the sender and the 13 recipient. Instead, when their ostensibly private messages contained links to other websites, also 14 known as “URLs,” Facebook scanned those messages and then analyzed the URL in the link. If 15 the website contained a Facebook “Like” button, Facebook treated the content of Plaintiffs’ 16 private messages as an endorsement of the website, adding up to two “Likes” to the page’s count. 17 Facebook acted without consent of its users for its own benefit. 3. 18 Generating “Likes” increases Facebook’s ability to gather massive amounts of user 19 data. Facebook primarily generates revenue from targeted advertising and the fundamental means 20 of amassing the user data needed for effective targeted advertising is through Facebook’s “Like” 21 function. The more data points Facebook has for each of its 1.2 billion users, the more Facebook 22 can take advantage of the data by utilizing complex predictive analytics to enhance the reach and 23 accuracy of its targeted advertising. Therefore, whether or not Facebook premises its targeted 24 advertising directly on the URLs it scans when intercepting private messages, it nonetheless has 25 intercepted private messages with URLs for the purpose of increasing the collection of data which 26 it does directly employ in its targeted advertising. 27 28 1 This Complaint is submitted pursuant to the Court’s Order of May 18, 2016 (Docket No. 192). -1- SECOND AMENDED CLASS ACTION COMPLAINT CASE NO. 13-CV-05996-PJH (MEJ) 1 4. In an effort to harness the myriad data points of its users, in the form of placing 2 and publicizing its social plugins across the web, Facebook has intentionally intercepted its users’ 3 private messages, scanned the contents of those electronic communications, and manipulated the 4 contents to attribute actions the users did not intend – “Liking” the web pages they were 5 discussing in their messages – for purposes unrelated to the users’ intent and solely for the benefit 6 of Facebook. 7 II. 8 9 THE PARTIES 5. Plaintiff Matthew Campbell is a resident of Pulaski County, Arkansas. He established a Facebook account in or around January 2009, which he has maintained consistently 10 to the present day. He has used Facebook’s private messaging function throughout the class 11 period for, inter alia, purposes of conveying messages whose content includes URL links. 12 6. Plaintiff Michael Hurley is a resident of North Plains, Oregon. He established a 13 Facebook account in or around October 2008, which he has maintained consistently to the present 14 day. He has used Facebook’s private messaging function throughout the class period for, inter 15 alia, purposes of conveying messages whose content contains URL links. 16 7. Defendant Facebook, Inc. is headquartered in Menlo Park, California, and 17 incorporated under the laws of the State of Delaware. 18 III. 19 JURISDICTION 8. Pursuant to 28 U.S.C. § 1331, this Court has original subject matter jurisdiction 20 over the claims of Plaintiffs and the Class that arise under the Electronic Communications 21 Privacy Act of 1986 (“ECPA”), 18 U.S.C. §§ 2510 et seq. 22 9. Pursuant to 28 U.S.C. § 1332, as amended by the Class Action Fairness Act of 23 2005 (“CAFA”), this Court has subject matter jurisdiction over this putative nationwide class 24 action because the matter in controversy exceeds $5,000,000.00, exclusive of interest and costs, 25 and is a class action in which some members of the Class are citizens of states different than 26 Defendant. See 28 U.S.C. § 1332(d)(2)(A). 27 28 -2- SECOND AMENDED CLASS ACTION COMPLAINT CASE NO. 13-CV-05996-PJH (MEJ) 1 10. This Court has personal jurisdiction over Facebook because its worldwide 2 headquarters are in California, and because it conducts in California substantial business from 3 which the claims in this case arise. 4 IV. 5 INTRADISTRICT ASSIGNMENT 11. Venue properly lies in this district pursuant to 28 U.S.C. § 1391(b)(1) because 6 Facebook is headquartered in this district and a substantial part of the events or omissions which 7 give rise to the claims alleged herein occurred in San Mateo County. 8 9 12. Venue is also proper in this district pursuant to Facebook’s Statement of Rights and Responsibilities, which governs the agreement between Plaintiffs and Facebook and which 10 states in pertinent part that Plaintiffs “will resolve any claim, cause of action or dispute (claim) . . 11 . relating to . . . Facebook exclusively in the U.S. District Court for the Northern District of 12 California or a state court located in San Mateo County.” 13 V. 14 CHOICE OF LAW 13. California law governs the substantive legal issues in the instant matter. 15 Facebook’s Statement of Rights and Responsibilities states in pertinent part that “the laws of the 16 State of California will govern . . . any claim that might arise between you and us.” 17 VI. 18 FACTS COMMON TO ALL COUNTS 14. Facebook operates the world’s largest social-networking website, with 19 approximately 1.2 billion users, representing approximately 51% of all internet users worldwide, 20 accessing its services monthly. Facebook’s online social networking website allows users to 21 communicate through the sharing of text, photograph, video, and internet content. 22 15. The core purpose of Facebook is to facilitate communication among its users. 23 Facebook facilitates public communications via Facebook pages, and private communications via 24 personal messages and chats. Chats happen in real-time and often give the appearance of 25 conversation. 26 16. In order to establish a Facebook account, a user must acknowledge Facebook’s 27 Statement of Rights and Responsibilities and its Privacy Policy. Facebook’s main page states, 28 “By clicking Sign Up, you agree to our Terms and that you have read our Data Use Policy.” See -3- SECOND AMENDED CLASS ACTION COMPLAINT CASE NO. 13-CV-05996-PJH (MEJ) 1 https://www.facebook.com.2 Within this sentence, the word “Terms” contains a hyperlink to 2 Facebook’s “Statement of Rights and Responsibilities;” (Statement of Rights and Responsibilities, 3 https://www.facebook.com/legal/terms), and the words “Data Use Policy” contain a hyperlink, 4 leading to Facebook’s “Data Use Policy.” Data Use Policy, 5 https://www.facebook.com/about/privacy. 6 17. The Statement of Rights and Responsibilities informs users that it “governs” 7 Facebook’s “relationship with users and others who interact with Facebook.” Under the 8 subsection “Privacy,” the Statement of Rights and Responsibilities provides: 9 Your privacy is very important to us. We designed our Data Use Policy to make important disclosures about how you can use Facebook to share with others and how we collect and can use your content and information. We encourage you to read the Data Use Policy, and to use it to help you make informed decisions. 10 11 12 As with the disclosure on the main page, “www.facebook.com,” the words “Data Use Policy” 13 contain a hyperlink to Facebook’s Data Use Policy. 14 18. Facebook’s Statement of Rights and Responsibilities and its Data Use Policy 15 specify the nature of the user “content and information” that Facebook receives and the manner in 16 which it can “use” it. The definition of “content” is expressly limited to data which a Facebook 17 user posts publicly on a Facebook page, and the definition of the “Information We [Facebook] 18 Receive About You” contained in the Data Use Policy excludes the content of users’ private 19 messages, including the content of users’ private messages which include an embedded link to a 20 URL. Facebook fails to disclose that it systematically scans URLs transmitted via private 21 message across its social network. 22 19. Facebook provides users with a spectrum of communication methods, 23 “[d]epending on whom you’d like to share with.” The options range from the broadest possible 24 audience, where posts are viewable to the general public, to posts viewable by small groups of 25 friends, to messages shared “privately” with a single individual. 26 27 28 2 Unless otherwise noted, a citation to any Facebook web page is to the version of that page in effect on December 30, 2013, the date on which the initial complaint was filed in this action. -4- SECOND AMENDED CLASS ACTION COMPLAINT CASE NO. 13-CV-05996-PJH (MEJ) 1 2 20. publicly or privately. It stated in pertinent part: 3 4 During the class period, Facebook offered a tutorial on how to communicate either  How to Post & Share  5 Sharing Status Updates and Other Stories How do I share a status or other content on Facebook? 6 Depending on whom you’d like to share with, there are different ways to share content on Facebook: 7  Sharing with a broad audience: Use the share menu that’s located at the top of your homepage and timeline to let others know what’s on your mind. You can update your status and share photos, videos, links and other application content. Things you share will appear as posts on your timeline, and can appear in your News Feed. To control whether or not specific people have the option to view your stories, you can change the privacy settings for each piece of content you post.  Sharing with a small group of friends: Use the Groups feature to share content with a select group of people, like family members, your soccer team or your book club.  8 Sharing with an individual: You can use the share menu at the top of a friend’s timeline to write or share something on his or her timeline. Friends of your friend will also be able to view your post. If you’d like to 9 10 11 12 13 14 share something privately, you can always send someone a private message. 15 16 17 18 Facebook Help Center, How to Post & Share (bold and italic emphasis added). 21. Facebook’s private message function combines email, chat, text messaging, and 19 Facebook’s in-service messaging feature, thereby enabling users to send and receive private 20 messages within and outside of Facebook, across different devices such as computers, 21 smartphones, and tablets. 22 22. Facebook represents to its users that this messaging service is private – that is, a 23 communication made through the service will take place only between the sender and the 24 intended recipient(s). This is evidenced by Facebook’s most basic instructions on how to use its 25 service: “If you’d like to share something privately, you can always send someone a private 26 message.” Indeed, whenever Facebook provides instructions on how to use its messaging service, 27 it does so in terms assuring private communications. At its website’s “Help Center,” in the step- 28 by-step instruction on how “[t]o send a private message,” under the heading “Who can see my -5- SECOND AMENDED CLASS ACTION COMPLAINT CASE NO. 13-CV-05996-PJH (MEJ) 1 message,” Facebook states, “You and the people you’re messaging with can view the contents 2 and history of your conversation.” Facebook Help Center, Messaging: Messages: Settings & 3 Security: Who Can See My Messages?, 4 https://www.facebook.com/help/212388195458335?sr=16&sid=0ntT7VdfDjw7Y5KSV. 5 23. When it first announced its private messaging service, Facebook represents that its 6 messaging function is “unprecedented” in terms of user control and the protection of privacy, 7 further emphasizing its promise that only the sender and the recipient or recipients are privy to the 8 private message’s content, to the exclusion of any other party, including Facebook. See 9 Seligstein, J., See the Messages that Matter, https://www.facebook.com/notes/facebook/see-the- 10 11 messages-that-matter/452288242130. 24. Contrary to its representations, Facebook has systematically intercepted the 12 contents of users’ “private” messages. Facebook scans the content of users’ private messages that 13 include a URL. On information and belief, whenever a private message contains a URL, 14 Facebook uses a software application called a “web crawler” to scan the URL, sending HTTP 15 requests to the server associated with the URL and then seeking various items of information 16 about the web page to which the URL is linked. On information and belief, Facebook’s 17 interception occurred in transit, in transmission, and/or during transfer of users’ private messages. 18 25. Facebook has developed items of code called “social plugins,” which can be 19 embedded in third-party websites and, when clicked on by visitors, interact with Facebook. One 20 such social plugin is the “Like” button. 21 26. On information and belief, at least until October 2012, Facebook has scanned 22 private messages to produce “Likes” for websites with an embedded “Like” button, where the 23 private message contains that website’s URL. After scanning the content of private messages that 24 include a link to a third-party website, Facebook has searched for information profiling the 25 message-sender’s web activity, and manipulated code in the third-party website to increase the 26 number of “Likes” indicated on the website’s Facebook plugin. 27 28 27. On information and belief, during the class period, one of the items of information that Facebook’s web crawlers sought was whether or not the web page associated with the URL -6- SECOND AMENDED CLASS ACTION COMPLAINT CASE NO. 13-CV-05996-PJH (MEJ) 1 contained a “Like” button, and when it did contain a “Like” button, the web crawlers transmitted 2 this information back to Facebook. During the class period, Facebook provided intercepted data 3 to the web page at issue, in the form of analysis of web traffic to that site by Facebook users. 4 28. Facebook further retained all intercepted private message content (and all data and 5 metadata derived therefrom) for the current or future objective of accumulating and analyzing 6 user data and thereafter refining user profiles and/or enhancing its targeted advertising efforts. 7 29. Facebook’s interception and scanning of the contents of its users’ private messages 8 for the purposes of manipulating code in third party’s websites to register “Likes” is not disclosed 9 in either Facebook’s Terms of Use or its Privacy Policy. 10 30. The effect of embedding social plugins into third-party websites is that it enables 11 Facebook to extend its data gathering practices, keeping tabs on its users’ behavior even after 12 they log out of Facebook. The “Like” button, one of Facebook’s principal social plug-ins, is 13 commonly found on internet web pages. A large number of “Likes” indicates that a web page is 14 popular. A video tutorial on Facebook’s website states: 15 When someone clicks “Like,” they’re highlighting the things that are valuable to them and sharing that with their friends. And when all of this goes to your News Feed, it’s like you have a real time, super-customized window to the most valuable things on the Internet. But we understand that many of the things people care about live outside of Facebook, so we wanted to create a way to bring your friends with you to other websites. So we created social plugins. Social plugins extend the things you love about Facebook to your favorite websites. 16 17 18 19 20 21 22 23 24 25 26 Facebook Tutorial Video, Understanding Social Plugins at 0:15 – 0:39 (June 7, 2010), https://www.facebook.com/video/video.php?v=10150210521510484. 31. In practice, Facebook social plugins serve as an extension of Facebook on the internet at large. In addition to Facebook’s “Like” button at the top of a news article, Facebook’s social plugins can take the form of a sidebar feed noting who among the users’ Facebook “Friends” have read or recommended the article, or featuring a clickable Facebook icon, as circled below. 27 28 -7- SECOND AMENDED CLASS ACTION COMPLAINT CASE NO. 13-CV-05996-PJH (MEJ) 1 2 3 4 5 6 7 8 Somini Sengupta, The Information Gathering Paradox, N.Y. Times, Oct. 26, 2013. 32. If users are concerned that their extra-Facebook web traffic is being broadcast across the world’s largest social network, Facebook offers this assurance: 9 When you start to see websites that are customized for you all over the Internet, you might wonder if everyone else can see it. But it’s not like that. Although you can see customized information on other sites, all the information lives on Facebook, and Facebook doesn’t share your information with anyone through social plugins. And each person has full control of what they want to share. You’re only sharing the information you want to, and you’re only sharing it with the people you want to share it with. 10 11 12 13 14 15 16 17 18 19 20 21 22 33. In October 2012, a security researcher published findings in the Wall Street Journal showing that Facebook scanned users’ private messages for URLs, further revealing that when a private message contained a link to a third-party web page, and that page had a “Like” social plugin, Facebook registered two “Likes” for that web page via the social media plugin. See Jennifer Valentino-DeVries and Ashkan Soltani, How Private Are Your Private Facebook Messages?, Wall St. J. (Oct. 3, 2012). 34. In this first screenshot, the website set up by the security researcher, Ashkan Soltani, “ashkansoltani.org/fb_test.html,” has two “Likes” registered to it: 23 24 25 26 Soltani also provided the html code for the website: 27 28 -8- SECOND AMENDED CLASS ACTION COMPLAINT CASE NO. 13-CV-05996-PJH (MEJ) 1 2 3 4 5 6 7 8 Soltani then logged into Facebook and sent a message that contained the URL and the text 9 “testing 1 2 3.” 10 11 12 13 14 15 16 17 18 19 20 21 22 23 Finally, Soltani navigated back to his test website to see if the number of “Likes” registered to it 24 increased, which they did. 25 26 27 28 -9- SECOND AMENDED CLASS ACTION COMPLAINT CASE NO. 13-CV-05996-PJH (MEJ) 1 A video showing Soltani complete this test in real-time can be found as part of the Digital Trends 2 article reporting on it. See McHugh, M., Facebook Scans Private Messages for Brand Page 3 Mentions, Admits a Bug Is Boosting Likes, Digital Trends (Oct. 4, 2012), 4 http://www.digitaltrends.com/social-media/facebook-scans-private-messages/. 5 35. The transmission of the URL in the private message increased the number of 6 “Likes” by a factor of two. The article notes that this practice is described in Facebook’s 7 guidance for developers – administrators of the third-party websites whom Facebook seeks to 8 entice to use social plugins. The developer guidance states that “the number of inbox messages 9 containing” a link to a page will count as “Likes.” 10 36. Facebook does not disclose anywhere in its Privacy Policy its practice of scanning 11 private messages and doling out “Likes” to websites if a URL is contained therein, nor has such a 12 practice ever been announced in any of Facebook’s disclosures to its users. Because Facebook 13 did not disclose this practice to its users, Facebook did not seek nor did it ever gain the consent of 14 its users to intercept their messages, or to use the data thus obtained. 15 37. If, at some point following the Wall Street Journal’s October 2012 exposé, 16 Facebook suspended its practice of intercepting and scanning users’ private messages and doling 17 out “Likes” whenever the scanned message referenced a URL with a social plugin, it has done so 18 quietly, without ever acknowledging either that it had engaged in this practice or that it had 19 discontinued it, nor has it confirmed that it will not engage in this practice in the future. 20 38. On August 27, 2013, the Swiss security firm High-Tech Bridge (“HTB”) 21 announced that it had conducted a test to assess users’ privacy in the fifty largest social networks, 22 web services, and free email systems (“Web Services”). Using the private messaging function of 23 each of the Web Services, HTB embedded in each message a URL unique to each Web Service. 24 HTB then monitored the logs of a dedicated web server for all incoming HTTP requests, to 25 determine whether a Web Service would “click” on the test URLs that had been transmitted in 26 private messages. HTB concluded that Facebook was scanning URLs in private messages. 27 28 - 10 - SECOND AMENDED CLASS ACTION COMPLAINT CASE NO. 13-CV-05996-PJH (MEJ) 1 39. The presence of a Facebook “Like” button on a web page enables Facebook to 2 collect individual users’ data, which it then employs in developing user profiles to support and 3 deliver targeted advertising – whether or not a user affirmatively clicks on the button. 4 40. The “Like” function is crucial in gathering data points for the profiles and 5 Facebook keeps on its users for purposes of delivering targeted advertising from which it 6 generates substantial revenue. The more websites that incorporate social plug-ins in response to 7 their apparent value to users, the more opportunities are created for Facebook to generate data on 8 users, and increase its own value to – and revenue from – third-party advertisers. 9 41. Any Facebook social plugin, including the “Like” button, is a series of Facebook- 10 controlled code inserted into a web page’s code. As soon as the web page is loaded, “the code 11 invokes a PHP script at Facebook.com that records information including the URL for the Web 12 page, your IP address, and your Facebook ID [if the user is simultaneously logged in on 13 Facebook].” Thus, “widespread use of the Like button allows Facebook to track people as they 14 switch from CNN.com to Yelp.com to ESPN.com, all of which are sites that…implement the 15 feature.” McCullagh, D., Facebook “Like” Button Draws Privacy Scrutiny, CNET News (June 2, 16 2010), http://news.cnet.com/8301-13578_3-20006532-38.html. 17 42. Even if a user does not affirmatively click a “Like” button, the presence on a web 18 page of the “Like” plugin enables Facebook to monitor the user’s online activity, collecting data 19 about the user, even if the user is logged out of Facebook. “If you put a Like button on your site,” 20 an attorney with the ACLU of Northern California cautioned, “you’re potentially selling out your 21 users’ privacy even if they never press that button….It’s another example of why user control 22 needs to be the default in Facebook.” 23 43. Facebook’s revenues depend on user data. Accordingly, Facebook has incentives 24 to encourage widespread placement of “Like” buttons and other Facebook-controlled social 25 plugins throughout the web because each social plugin amounts to a mechanism by which 26 Facebook can monitor internet traffic. 27 28 44. By doling out “Likes” to the web pages that install Facebook’s social plug-ins, Facebook increases the visibility and apparent popularity of these sites online, giving them a - 11 - SECOND AMENDED CLASS ACTION COMPLAINT CASE NO. 13-CV-05996-PJH (MEJ) 1 competitive advantage over sites that do not associate with Facebook. A recent Frontline exposé 2 accurately describes “Likes” as Facebook’s “currency.” See Rushkoff, D., Generation Like, 3 Frontline, http://www.pbs.org/wgbh/pages/frontline/media/generation-like/transcript-57/. 4 Websites that do not install Facebook’s social plug-ins are thus at a competitive disadvantage, 5 which Facebook exacerbates when it inflates the number of “Likes” on web pages associated with 6 it by adding a “Like” – or two “Likes” – each time a Facebook user shares the page’s URL in a 7 private message. To stay competitive and attract visitors, websites install Facebook’s plug-ins. 8 Greater participation rates, in turn, broaden the scope of Facebook’s data collection. 9 A. Facebook’s Other Sharing of Intercepted Data With Third Parties 10 45. Facebook intercepted private message content for purposes of sharing it with third 11 parties. When a user composes a private message with URL content, Facebook’s system detects 12 the URL content and generates a URL preview (much like a thumbnail). As the private message 13 is sent, Facebook’s programming redirects the URL content to create an “object” called an 14 “EntShare.” An EntShare is a set of data about a share event (such as sharing a URL in a Private 15 Message) tied to the specific user who sends the message. Facebook also creates another record 16 called an “EntGlobalShare” where Facebook stores the preview for a certain URL and keeps a 17 tally of the number of shares in users’ messages for that URL. 18 46. Facebook’s maintenance of the data derived from private messages containing a 19 URL, which includes data identifying the sender of the private message, is not related to the 20 facilitation of the transmission of the private message. Facebook retains all intercepted private 21 message content (and all data and metadata derived therefrom) for the current or future objective 22 of accumulating and analyzing user data and thereafter refining user profiles and/or enhancing its 23 targeted advertising efforts. 24 47. Through the creation of data objects derived from private message content, 25 Facebook provides analysis of web traffic to specific Internet sites by Facebook users which 26 includes demographic information about the senders and recipients of the scanned private 27 messages. Facebook provides this information through a product called “Insights” or “Domain 28 Insights” dashboard – a Facebook-controlled website (or “User Interface (UI)”) that page owners - 12 - SECOND AMENDED CLASS ACTION COMPLAINT CASE NO. 13-CV-05996-PJH (MEJ) 1 could access, which would provide them with breakdowns by age, gender, language, country, and 2 date, of Facebook users who had shared a given URL (including users who had shared the URL 3 in private messages). See Report of Dr. Jennifer Golbeck in Support of Plaintiffs’ Motion for 4 Class Certification (“Golbeck Report”) (Dkt. No. 183-4) at ¶¶ 65-75; see also Declaration of Alex 5 Himel in Support of Defendant Facebook, Inc.’s Opposition to Plaintiffs’ Motion for Class 6 Certification (“Himel Decl.”) (Dkt. No. 184-11) at ¶¶ 58-60. Facebook promoted its Insights 7 product as helping the website owner “tailor your content and products to your users” by 8 providing “demographic information for the interactions that occur on your site and on 9 Facebook.” FB000008722, Exhibit 13 to Plaintiffs’ Motion for Class Certification (“Class Cert. 10 Mot.”) (Dkt. No. 179-9). Facebook stored these metrics even when the website at issue had not 11 implemented Facebook’s code (i.e., Facebook recorded all instances of all URLs being shared in 12 users’ private messages; as well as the demographic data related to each sender and recipient), 13 stating “Domain Insights offers a consolidated view of key metrics for any website, even those 14 that have not implemented Facebook Platform.” Golbeck Report at ¶ 69 (citing FB000010688). 15 48. Additionally, Facebook incorporates private message content into several APIs 16 (“application program interfaces”), referred to by Facebook as the “Graph API” and the 17 “link_stats” API, which allowed third-party developers to query and utilize data related to the 18 number of times a URL was shared on Facebook (including via private message). Golbeck 19 Report at ¶¶ 79-81, Himel Decl. at 66-68. These data were available to any third party, for any 20 purpose. Golbeck Report at ¶ 79 (quoting FB000008643) (“This data is OPEN – anyone can 21 access it.”) According to Alex Himel, a senior Facebook engineer, Facebook “provided these 22 APIs publicly in order to allow for the development of products and features that incorporate 23 engagement statistics – products that take into account what people are interacting with now.” 24 Himel Decl. at ¶ 66. 25 49. Further, for an unspecified period of time, Facebook publicly exposed the fact that 26 users included certain URLs in their private messages via its Activity Feed Plugin, which would 27 identify both the URL at issue and the sender or recipient of the private message. Golbeck Report 28 at ¶¶ 75-78. - 13 - SECOND AMENDED CLASS ACTION COMPLAINT CASE NO. 13-CV-05996-PJH (MEJ) 1 50. Representing to users that the content of Facebook messages is “private” creates 2 an especially exploitable opportunity for Facebook, because users who believe they are 3 communicating on a service free from surveillance are more likely to reveal facts about 4 themselves that they would not reveal had they known the content was being monitored. Thus, 5 by representing that messaging would remain private, Facebook has positioned itself to monitor 6 user activity in ways that would otherwise be unavailable to it. By scanning users’ private 7 messages, inferring “Likes” and generating EntGlobalShare and EntShare objects from the 8 content of those messages, Facebook has been able to glean from its users data that they 9 otherwise would not have shared, allowing Facebook to generate even more robust, and 10 11 accordingly more valuable, user profiles. 51. All of Facebook’s activities complained of herein were undertaken without users’ 12 consent. Instead, to increase users’ comfort with the website and, thereby, to increase the amount 13 of information users share, Facebook assures users that they have individual control over privacy 14 settings and messaging options. These assurances affirmatively state that only senders and 15 intended recipients are privy to the contents of users’ nonpublic communications. In reality, 16 Facebook mined any and all transmissions across its network, including those it labels “private,” 17 for its own gain. 18 52. As information is shared by its more than one billion unique users, Facebook is 19 provided with sophisticated, exceedingly detailed data profiles which, when coupled with 20 proprietary analytics algorithms, enable Facebook to place ads throughout users’ accounts based 21 upon the extensive profiles assembled on each and every user. As Facebook has stated: 22 27 When an advertiser creates an ad, they are given the opportunity to choose their audience by location, demographics, likes, keywords, and any other information we receive or can tell about you and other users. For example, an advertiser can choose to target 18 to 35 year-old women who live in the United States and like basketball. An advertiser could also choose to target certain topics or keywords, like “music” or even people who like a particular song or artist. If you indicate that you are interested in topics, such as by liking a Page, including topics such as products, brands, religion, health status, or political views, you may see ads related to those topics as well. 28 * * * 23 24 25 26 - 14 - SECOND AMENDED CLASS ACTION COMPLAINT CASE NO. 13-CV-05996-PJH (MEJ) 1 Sometimes we allow advertisers to target a category of user, like a “moviegoer” or a “sci-fi fan.” We do this by bundling characteristics that we believe are related to the category. For example, if a person “likes” the “Star Trek” Page and mentions “Star Wars” when they check into a movie theater, we may conclude that this person is likely to be a sci-fi fan. Advertisers of sci-fi movies, for example, could ask us to target “sci-fi fans” and we would target that group, which may include you. Or if you “like” Pages that are car-related and mention a particular car brand in a post, we might put you in the “potential car buyer” category and let a car brand target to that group, which would include you. 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 Data Use Policy, IV. How Advertising and Sponsored Stories Work, Facebook, http://www.scribd.com/doc/191118234/Facebook-2. 53. The data profiles collected by Facebook enable it to deliver sophisticated targeted advertising. According to a third-party study, broadly targeted campaigns on Facebook (e.g., adults between the ages of 25 and 49) reach the desired audience with 95% accuracy, compared with an industry average of 72%; for more narrowly targeted campaigns (e.g., females between the ages of 25 and 34), Facebook reaches the desired audience with 90% accuracy, compared to an industry average of just 35%. In 2009, 2010, and 2011, targeted advertising accounted for 98%, 95%, and 85%, respectively, of Facebook’s revenue. 54. Facebook consciously harvests its users’ data, including through the conduct alleged herein. The more information Facebook acquires, the more nuance and sophistication it can exercise in profiling its users. Acquiring data is useful not only for aggregating traits that users self-select (for example, liking the page for a political candidate could be a good indicator that someone will vote for that candidate) but, as studies have shown, also for revealing attributes that a person would not have chosen to share (such as personality, sexual orientation, religion and intelligence). See, e.g., Kosinski, M. et al., Private Traits and Attributes are Predictable from Digital Records of Human Behavior, Nat. Acad. of Sci., 110(15), 5802-5805 (2013). Disparate data points when magnified and multiplied a billion-fold produce an exceptionally informative picture. Facebook has shown its interest in using these techniques for enhancing its ad targeting through its own published research. See e.g., Bakshy, E. et al., Social Influence in Social Advertising, 13th ACM Conf. on Elec. Commerce (2012). Therefore, the “Likes” and the 28 - 15 - SECOND AMENDED CLASS ACTION COMPLAINT CASE NO. 13-CV-05996-PJH (MEJ) 1 EntGlobalShare and EntShare objects generated by Facebook’s interception of users’ private 2 messages provide a trove of information that not only informs Facebook’s knowledge of those 3 users’ choices and characteristics but, combined with other users’ data, produces deep and 4 powerful knowledge of the user base as a whole. 5 55. On information and belief, Facebook retains the user data it has collected, 6 including the “Likes” and the EntGlobalShare and EntShare objects generated through 7 intercepting users’ private messages. Facebook exercises dominion and control over the user data 8 it collects, and individual users have no control whatsoever over their own user data collected or 9 retained by Facebook, including any subsequent exploitation, sale, or other use of the data. 10 Dissemination of information about individuals could empower the government against citizens 11 to a degree well beyond the contemplation of the Fourth Amendment. Facebook declares that it 12 only provides the stored contents of any account to the government with a warrant, yet it has been 13 reported that the companies that purchase such information can hand it over to government 14 agencies with no probable cause and with no warrant. Foreign regimes may also gain access to 15 users’ private data after it has been aggregated by companies like Facebook. 16 56. In 1986, Congress passed the ECPA with the express purpose of affording to 17 electronic communications, such as the private online communications at issue here, the same 18 protections that attach to private letters sent via the U.S. Postal Service. In recommending 19 adoption of the ECPA, the Senate Committee on the Judiciary issued the following statement: 20 21 22 23 24 25 26 27 A letter sent by first class mail is afforded a high level of protection against unauthorized opening by a combination of constitutional provisions, case law, and U.S. Postal Service statutes and regulations. Voice communications transmitted via common carrier are protected by title III of the Omnibus Crime Control and Safe Streets Act of 1968. But there are no comparable Federal statutory standards to protect the privacy and security of communications transmitted by new noncommon carrier communications services or new forms of telecommunications and computer technology. This is so, even though American citizens and American businesses are using these new forms of technology in lieu of, or side-by-side with, first class mail and common carrier telephone services. 28 - 16 - SECOND AMENDED CLASS ACTION COMPLAINT CASE NO. 13-CV-05996-PJH (MEJ) 1 57. The Senator who introduced the Electronic Communications Privacy Act to 2 Congress described its overarching goal as follows: “We cannot let any American feel less 3 confident in putting information into an electronic mail network than he or she would in putting it 4 into an envelope and dropping it off at the Post Office.” 5 58. In response to the threats posed by internet privacy invasions, the Department of 6 Commerce has recently recommended basic principles for internet regulation that align with the 7 goals underlying the CIPA and the ECPA. First articulated by the Department of Health and 8 Human Services more than 30 years ago, they are known as the Fair Information Practice 9 Principles (“FIPPs”). The FIPPs provide a recognized framework for privacy policies which 10 “provide a framework for balancing the need for privacy with other [commercial] interests.” The 11 GAO has provided an advisory statement affirming that the act of scanning the content of 12 customers’ private messages without consent, for purposes of profiting off of the messages’ 13 content in some way – i.e. the conduct which this complaint alleges Facebook has engaged in – is 14 contrary to the FIPPS and violates the ECPA. 15 59. Facebook’s practices of intercepting and scanning its users’ private messages, for 16 the purposes of manipulating code in third-party websites to register “Likes,” or for purposes of 17 collecting or storing information concerning URL content in the private messages, are not 18 necessary for, or incidental to, Facebook’s ability to provide users the service of sending and 19 receiving private messages, or the protection of its rights or property, and are outside the ordinary 20 course of Facebook’s business as an electronic communication service provider. Facebook has at 21 all times relevant possessed the technical capacity to offer its private message service without 22 intercepting, scanning, and storing the content of users’ private messages. 23 60. Nowhere does Facebook disclose, including in its Statement of Rights and 24 Responsibilities and in its Data Use Policy, that as a matter of course Facebook intercepts, scans, 25 and stores the content of its users’ private messages, that it uses the content of private messages to 26 register “Likes” on third parties’ websites, or that data derived therefrom will be shared with third 27 parties as alleged herein. 28 - 17 - SECOND AMENDED CLASS ACTION COMPLAINT CASE NO. 13-CV-05996-PJH (MEJ) 1 61. Facebook misleads users into believing that they have a secure, private mechanism 2 for communication – Facebook’s private messaging function – when, in fact, Facebook intercepts 3 and scans the content of private messages to gather data in an effort to bolster its “social plug-in” 4 network, to improve its marketing algorithms, and to increase its ability to profit from data about 5 Facebook users. 6 VII. 7 8 CLASS ALLEGATIONS 62. Rules of Civil Procedure, individually and on behalf of all members of the following Class: 9 All natural-person Facebook users located within the United States who have sent, or received from a Facebook user, private messages that included URLs in their content, (and from which Facebook generated a URL attachment), from within two years before the filing of this action up through the date of the certification of the class. 10 11 12 13 Plaintiffs bring this nationwide class action, pursuant to Rule 23 of the Federal 63. Excluded from the Class are the following individuals and/or entities: Facebook 14 and its parents, subsidiaries, affiliates, officers and directors, current or former employees, and 15 any entity in which Facebook has a controlling interest; counsel for the putative class; all 16 individuals who make a timely election to be excluded from this proceeding using the correct 17 protocol for opting out; any and all federal, state or local governments, including but not limited 18 to their departments, agencies, divisions, bureaus, boards, sections, groups, counsels and/or 19 subdivisions; and all judges assigned to hear any aspect of this litigation, as well as their 20 immediate family members. 21 22 23 64. Plaintiffs reserve the right to modify or amend the definition of the proposed Class before the Court determines whether certification is appropriate. 65. The Class is so numerous that joinder of all members is impracticable. On 24 information and belief, there are more than 166 million Facebook account holders in the United 25 States. The number of separate individuals who sent private messages via Facebook, where such 26 message included URLs in the content, within two years before the filing of this action, is likely 27 in the millions, and is identifiable and ascertainable based on Facebook’s records. 28 - 18 - SECOND AMENDED CLASS ACTION COMPLAINT CASE NO. 13-CV-05996-PJH (MEJ) 1 2 66. There are questions of law or fact common to the Class that will drive the resolution of this case. These questions include, but are not limited to, the following: 3 a. Whether Facebook intentionally intercepted, endeavored to intercept, or 4 procured any other person to intercept or endeavor to intercept Plaintiffs’ and Class Members’ 5 electronic communications sent via Facebook; 6 b. Whether Facebook intentionally used, or endeavored to use, the contents of 7 Plaintiffs’ and Class Members’ electronic communications sent via Facebook, knowing or having 8 reason to know that the information was obtained in violation of 18 U.S.C. § 2511(1)(d); 9 c. Whether Facebook acted intentionally in violating privacy rights; 10 d. Whether Facebook acquired any “contents” of Plaintiffs’ and Class 11 Members’ private messages, within the meaning of 18 U.S.C. § 2510(8); 12 13 e. Facebook were “electronic communications” within the meaning of 18 U.S.C. § 2510(12); 14 15 Whether Plaintiffs’ and Class Members’ private messages sent via f. Whether Facebook used an “electronic, mechanical, or other device,” within the meaning of 18 U.S.C. § 2510(5); 16 g. The amount of statutory damages that should be levied against Facebook; 17 h. Whether injunctive and/or declaratory relief against Facebook should be 19 i. Whether Facebook’s conduct was likely to deceive its users; 20 j. Whether Facebook’s conduct was unlawful; and 21 k. Whether Plaintiffs and Class Members are entitled to restitution. 18 22 awarded; 67. Plaintiffs’ claims are typical of the claims of the Class in that Plaintiffs and the 23 Class sent and/or received private messages via Facebook, where such messages contained URLs 24 in the content. In the process, Facebook intercepted, scanned, and acquired the private messages’ 25 content, sending HTTP requests to the servers housing the web pages referred to in Plaintiffs’ and 26 Class Members’ private messages. Facebook further used or endeavored to use the contents of 27 Plaintiffs’ and Class Members’ private messages, where Facebook identified URLs to webpages 28 containing social plugins, by manipulating such social plugins to generate “Likes” for web pages - 19 - SECOND AMENDED CLASS ACTION COMPLAINT CASE NO. 13-CV-05996-PJH (MEJ) 1 and to assemble profiles of users’ web traffic and personal preferences. Plaintiffs and Class 2 Members did not consent to the interception and uses of their private message content, which 3 form the basis for this suit. Plaintiffs and Class Members are entitled to declaratory relief, 4 statutory damages, restitution, and injunctive relief as a result of the conduct complained of 5 herein. Moreover, on information and belief, the conduct complained of herein is systemic. 6 Thus, the representative Plaintiffs, like all other Class Members, face substantial risk of the same 7 injury in the future. The factual basis of Facebook’s conduct is common to all Class Members, 8 and represents a common thread of conduct resulting in injury to all members of the Class. 9 Plaintiffs have suffered the harm alleged and have no interests antagonistic to any other Class 10 11 Member. 68. Plaintiffs will fairly and adequately protect the interests of the Class. Plaintiffs’ 12 interests do not conflict with the interests of the Class Members. Furthermore, Plaintiffs have 13 retained competent counsel experienced in class action litigation. Plaintiffs’ counsel will fairly 14 and adequately protect and represent the interests of the Class. Federal Rule of Civil Procedure 15 23(a)(4) and 23(g) are satisfied. 16 69. Plaintiffs assert that pursuant to Federal Rule of Civil Procedure 23(b)(3), 17 questions of law or fact common to the Class Members predominate over any questions affecting 18 only individual members. 19 70. A class action is superior to other available methods for the fair and efficient 20 adjudication of this controversy. Arguably no Class Member could afford to seek legal redress 21 individually for the claims alleged herein. Therefore, absent a class action, the Class Members 22 will continue to suffer losses and Facebook’s misconduct will proceed without remedy. 23 71. Even if Class Members themselves could afford such individual litigation, the 24 court system could not. Given the complex legal and factual issues involved, and considering that 25 the Class could number in the tens of millions or greater, individualized litigation would 26 significantly increase the delay and expense to all parties and to the Court. Individualized 27 litigation would also create the potential for inconsistent or contradictory rulings. By contrast, a 28 class action presents far fewer management difficulties, allows claims to be heard which may - 20 - SECOND AMENDED CLASS ACTION COMPLAINT CASE NO. 13-CV-05996-PJH (MEJ) 1 otherwise go unheard because of the relative expense of bringing individual lawsuits, and 2 provides the benefits of adjudication, economies of scale and comprehensive supervision by a 3 single court. 4 VIII. THE CLASS REPRESENTATIVES 5 72. Plaintiff Matthew Campbell set up a Facebook account in or around January 2009, 6 which he has maintained continuously to the present. During the class period, Plaintiff Campbell 7 used Facebook’s private messaging function for purposes of sending messages containing links to 8 other websites’ URLs. At the time he established his Facebook account, Plaintiff Campbell 9 reviewed the disclosures and statements made by Facebook regarding how information is to be 10 treated on Facebook, and reasonably relying thereon, believed that the content of his private 11 Facebook messages would be seen and used only by him and his recipient. 12 73. Plaintiff Michael Hurley set up a Facebook account in or around October 2008, 13 which he has maintained continuously to the present. During the class period, Plaintiff Hurley 14 used Facebook’s private messaging function for purposes of sending messages containing links to 15 other websites’ URLs. At the time he established his Facebook account, Plaintiff Hurley 16 reviewed the disclosures and statements made by Facebook regarding how information is to be 17 treated on Facebook, and reasonably relying thereon, believed that the content of his private 18 Facebook messages would be seen and used only by him and his recipient. 19 20 21 22 23 24 25 26 27 28 - 21 - SECOND AMENDED CLASS ACTION COMPLAINT CASE NO. 13-CV-05996-PJH (MEJ) 1 IX. CAUSES OF ACTION3 2 COUNT ONE 3 (Violations of the Electronic Communications Privacy Act, 18 U.S.C. §§ 2510 et seq.) 4 5 74. Plaintiffs adopt and incorporate each and every allegation of this complaint as if 6 stated fully herein. 7 75. Plaintiffs, individually and on behalf of Class Members, assert violations of 8 18 U.S.C. §§ 2511(1)(a) and (1)(d) for Facebook’s unlawful interception and use of Plaintiffs’ 9 electronic communications. 10 76. Facebook, as a corporation, is a “person” pursuant to 18 U.S.C. § 2510(6). 11 77. Throughout the entirety of the conduct upon which this suit is based, Facebook’s 12 actions have affected interstate commerce. On information and belief, Facebook has over 166 13 million users in the United States alone, and over one billion users worldwide. 78. 14 Facebook’s actions are and have been intentional as evidenced by, inter alia, its 15 disclosures to developers and the design and implementation of its private messaging service, 16 web crawlers, and social plugins. 79. 17 Facebook’s actions complained of herein are not necessary practices for providers 18 of electronic communications, nor are they incidental to the act of facilitating private messaging 19 via Facebook’s social network. 80. 20 Pursuant to 18 U.S.C. § 2511(1)(a), Facebook intentionally intercepted, intercepts, 21 or endeavored or endeavors to intercept the electronic communications of Plaintiffs and Class 22 Members. 23 81. Through Facebook’s scanning of users’ private messages, Facebook acquired and 24 continues to acquire the substance, purport, and meaning of private messages transmitted to and 25 from Plaintiffs and Class Members. 26 27 28 3 Plaintiffs have deleted reference to their claims under Cal. Penal Code § 632 and Cal. Bus & Prof. Code § 17200 in order to conform their Complaint to the Court’s Order of December 23, 2014, which dismissed those claims (Dkt. No. 43). Plaintiffs reserve their right to appeal the dismissal of these claims. - 22 - SECOND AMENDED CLASS ACTION COMPLAINT CASE NO. 13-CV-05996-PJH (MEJ) 1 82. The private messages transmitted to and from Plaintiffs and Class Members via 2 Facebook’s private messaging function are and have been at all relevant times electronic 3 communications. 4 83. Facebook utilizes each accused device for the purpose of acquiring and 5 manipulating content from the message in the course of the message’s transmission, and such 6 course of action does not occur while the private message is in storage. 7 84. Facebook utilized and continues to utilize one or more devices or technology 8 comprised of an electronic, mechanical, or other device or apparatus to intercept the electronic 9 communications transmitted to and from Plaintiffs and Class Members. Such devices or 10 11 12 13 14 15 technology include, but are not limited to, web crawlers and social plugins. 85. Facebook does not furnish the above-referenced devices or technology to its users, and users do not use the devices for connection to the facilities. 86. The intercepting devices or technology are not used for the ability to send or receive electronic communications. 87. The devices or technology are not used by Facebook, operating as an electronic 16 communication service, in the ordinary course of business as a provider of an electronic 17 communication service. 18 88. Facebook intercepted electronic communications sent by and to Plaintiffs and 19 Class Members (a) for undisclosed purposes; (b) for the purpose of generating “Likes” for third- 20 party websites; (c) for purposes of providing web traffic data to third parties; (d) for purposes of 21 cataloging user data; (e) for purposes beyond facilitating private messages sent via Facebook; 22 (f) in violation of its user agreements; (g) in violation of its public statements to users; (h) in 23 violation of federal and California law; and (i) in violation of the property rights of Plaintiffs, 24 Class Members, and third parties. These activities are not within the ordinary course of business 25 of a provider of an electronic communication service. 26 27 89. Pursuant to 18 U.S.C. § 2511(1)(d), Facebook intentionally used, uses, or endeavored or endeavors to use the contents of Plaintiffs’ and Class Members’ electronic 28 - 23 - SECOND AMENDED CLASS ACTION COMPLAINT CASE NO. 13-CV-05996-PJH (MEJ) 1 communications while knowing or having reason to know that it obtained the information through 2 the interception of the electronic communication in violation of 18 U.S.C. § 2511(1)(a). 3 90. Facebook’s interception of and use of the contents of Plaintiffs’ and Class 4 Members’ electronic communications were not performed by an employee engaged in any 5 activity necessary for the rendition of an electronic communication service or for the protection of 6 the rights or property of Facebook. 7 91. Facebook’s practice of intercepting, scanning, generating “Likes” from, users’ 8 private messages, and generating EntGlobalShares and EntShare data objects are not necessary 9 for the rendition of Facebook’s private messaging service, the protection of Facebook’s rights or 10 property, or the security of Facebook users. These scans have not been undertaken in the 11 ordinary course of business of an electronic communication service, as described in 28 U.S.C. 12 § 2510(15). 13 14 15 16 17 92. Facebook’s services that are not related to the ability to send and receive electronic communications are not electronic communication services. 93. No party to the electronic communications alleged herein consented to Facebook’s interception or use of the contents of the electronic communications. 94. Facebook intercepts Plaintiffs’ and Class Members’ electronic communications for 18 the purpose of committing a criminal or tortious act in violation of the laws of any state, and as 19 such, it cannot obtain consent pursuant to § 2511(2)(d). 20 21 22 95. As a result of Facebook’s violations of § 2511, pursuant to § 2520, Plaintiffs and the Class Members are entitled to relief as prayed for below. 96. While certain devices and/or technology have been identified in this Complaint, 23 Plaintiffs reserve the right to assert ECPA violations as to any further devices and/or technology 24 disclosed or those devices and/or technology upon which Facebook provides additional 25 information. 26 27 28 - 24 - SECOND AMENDED CLASS ACTION COMPLAINT CASE NO. 13-CV-05996-PJH (MEJ) 1 COUNT TWO 2 (Violations of the California Invasion of Privacy Act, Cal. Penal Code §§ 631) 3 4 97. Plaintiffs adopt and incorporate each and every allegation of this complaint as if 5 stated fully herein. 6 98. Plaintiffs, individually and on behalf of Class Members, assert violations of the 7 CIPA, California Penal Code §§ 630, et seq., specifically California Penal Code §§ 631(a) and 8 632, for Facebook’s unlawful interception and scanning of the contents of its users’ private 9 messages. Facebook uses this information about the sender and recipient for purposes of 10 11 profiling, marketing, and advertising. 99. California Penal Code § 630 provides that “The Legislature hereby declares that 12 advances in science and technology have led to the development of new devices and techniques 13 for the purpose of eavesdropping upon private communications and that the invasion of privacy 14 resulting from the continual and increasing use of such devices and techniques has created a 15 serious threat to the free exercise of personal liberties and cannot be tolerated in a free and 16 civilized society.” 17 100. Facebook’s acts in violation of the CIPA occurred in the State of California 18 because those acts resulted from business decisions, practices, and operating policies that 19 Facebook developed, implemented, and utilized in the State of California and which are unlawful 20 and constitute criminal conduct in the state of Facebook’s residence and principal business 21 operations. Facebook’s implementation of its business decisions, practices, and standard ongoing 22 policies that violate the CIPA took place and continue to take place in the State of California. 23 Facebook profited and continues to profit in the State of California as a result of its repeated and 24 systemic violations of the CIPA. Facebook’s unlawful conduct, which occurred in the State of 25 California, harmed and continues to harm Plaintiffs and Class Members. Facebook developed, 26 designed, built, and physically placed in California one or more of the accused devices or 27 technology employed by Facebook to violate the CIPA. 28 - 25 - SECOND AMENDED CLASS ACTION COMPLAINT CASE NO. 13-CV-05996-PJH (MEJ) 1 2 3 4 5 6 101. Plaintiffs and Class Members sent and received private messages, the contents of which included URLs, via Facebook’s services. 102. Facebook is not and was not at any time a party to Plaintiffs’ and Class Members’ private messages. 103. The private messages exchanged among Plaintiffs and Class Members are messages. 7 104. These messages are communications among Plaintiffs and Class Members. 8 105. Pursuant to California Penal Code § 7, Facebook, a corporation, is a “person.” 9 106. Facebook uses a “machine,” “instrument,” “contrivance,” or “in any other manner” 10 is able to, read or to learn the content or meaning of Plaintiffs’ and Class Members’ private 11 messages. 12 13 14 107. Facebook acts willfully when it reads, attempts to read, or learns the content or meaning of Plaintiffs’ and Class Members’ private messages. 108. Facebook does not have the consent of any party to the communication, or it acts 15 in an unauthorized manner, when it reads, attempts to read, or learns the content or meaning of 16 Plaintiffs’ and Class Members’ private messages. 17 18 19 20 21 109. Plaintiffs’ and Class Members’ private messages are “any message, report, or communication.” 110. At the time Facebook reads, attempts to read, or learns the content or meaning of Plaintiffs’ and Class Members’ private messages, the private messages are in transit. 111. At the time Facebook reads, attempts to read, or learns the content or meaning of 22 Plaintiffs’ and Class Members’ private messages, the private messages are passing over a wire, 23 line, or cable. 24 112. Private messages – coded, written messages sent electronically to remote locations 25 – are telegraphs within the meaning of the CIPA and this section of CIPA. As such, the wires, 26 lines, cables and/or instruments which carry and facilitate the transmission of Plaintiffs’ and Class 27 Members’ private messages are telegraph wires, lines, cables and/or instruments within the 28 meaning of the CIPA and CIPA § 631(a). - 26 - SECOND AMENDED CLASS ACTION COMPLAINT CASE NO. 13-CV-05996-PJH (MEJ) 1 113. Plaintiffs and Class Members do not consent, expressly or impliedly, to 2 Facebook’s eavesdropping upon and recording of their private messages. Facebook does not 3 disclose material information to its users relating to its attempts at, among other things, 4 intercepting, scanning and reading the contents of users’ private messages. 5 114. There is no knowledge or expectation among Plaintiffs and Class Members 6 regarding the extent of Facebook’s reading of message content, learning about the content or 7 meaning of users’ private messages, the acquisition of such content, the collection of such 8 content, or the manipulation of such content. Each and every one of these actions extends beyond 9 the normal occurrences, requirements, and expectations regarding the facilitation and 10 transmission of Facebook’s private messages. 11 JURY TRIAL DEMANDED 12 13 Pursuant to Federal Rule of Civil Procedure 38, Plaintiffs, individually and on behalf of the Class they seek to represent, demand a jury on any issue so triable of right by a jury. 14 PRAYER FOR RELIEF 15 16 WHEREFORE, Plaintiffs, on behalf of themselves and all Class Members, request judgment be entered against Facebook and that the Court grant the following: 17 1. An order determining that this action may be maintained as a class action under 18 Rule 23 of the Federal Rules of Civil Procedure, that Plaintiffs are proper class representatives, 19 that Plaintiffs’ attorneys be appointed Class counsel pursuant to Rule 23(g) of the Federal Rules 20 of Civil Procedure, and that Class notice be promptly issued; 21 2. Judgment against Facebook for Plaintiffs’ and Class Members’ asserted causes of 23 3. Appropriate declaratory relief against Facebook; 24 4. Preliminary and permanent injunctive relief against Facebook; 25 5. Any and all appropriate relief to Plaintiffs and Class members pursuant to the 22 action; 26 Electronic Communications Privacy Act, 118 U.S.C. § 2510 et seq., and the California Invasion 27 of Privacy Act, Cal. Penal Code § 630, et seq.; 28 - 27 - SECOND AMENDED CLASS ACTION COMPLAINT CASE NO. 13-CV-05996-PJH (MEJ) 1 2 3 6. An award of reasonable attorney’s fees and other litigation costs reasonably incurred; and 7. Any and all relief to which Plaintiffs and the Class may be entitled. 4 5 Dated: June 7, 2016 LIEFF CABRASER HEIMANN & BERNSTEIN, LLP 6 7 By: /s/ Michael W. Sobol Michael W. Sobol 8 9 10 11 12 13 Michael W. Sobol (State Bar No. 194857) msobol@lchb.com David T. Rudolph (State Bar No. 233457) drudolph@lchb.com Melissa Gardner (State Bar No. 289096) mgardner@lchb.com LIEFF CABRASER HEIMANN & BERNSTEIN, LLP 275 Battery Street, 29th Floor San Francisco, CA 94111-3339 Telephone: 415.956.1000 Facsimile: 415.956.1008 14 15 16 17 18 Rachel Geman rgeman@lchb.com Nicholas Diamand ndiamand@lchb.com LIEFF CABRASER HEIMANN & BERNSTEIN, LLP 250 Hudson Street, 8th Floor New York, NY 10013-1413 Telephone: 212.355.9500 Facsimile: 212.355.9592 19 20 21 22 23 24 Hank Bates (State Bar No. 167688) hbates@cbplaw.com Allen Carney acarney@cbplaw.com David Slade dslade@cbplaw.com CARNEY BATES & PULLIAM, PLLC 2800 Cantrell Road, Suite 510 Little Rock, AR 72202 Telephone: 501.312.8500 Facsimile: 501.312.8505 25 26 Attorneys for Plaintiffs and the Proposed Class 27 28 - 28 - SECOND AMENDED CLASS ACTION COMPLAINT CASE NO. 13-CV-05996-PJH (MEJ)

Disclaimer: Justia Dockets & Filings provides public litigation records from the federal appellate and district courts. These filings and docket sheets should not be considered findings of fact or liability, nor do they necessarily reflect the view of Justia.


Why Is My Information Online?