Campbell et al v. Facebook Inc.

Filing 196

AMENDED COMPLAINT Second Amended Class Action Complaint against Facebook Inc.. Filed byMatthew Campbell, Michael Hurley. (Sobol, Michael) (Filed on 6/7/2016)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

Michael W. Sobol (State Bar No. 194857)
[e-mail]
David T. Rudolph (State Bar No. 233457)
[e-mail]
Melissa Gardner (State Bar No. 289096)
[e-mail]
LIEFF CABRASER HEIMANN & BERNSTEIN, LLP
275 Battery Street, 29th Floor
San Francisco, CA 94111-3339
Telephone: [phone]
Facsimile: 415.956.1008
Rachel Geman
[e-mail]
Nicholas Diamand
[e-mail]
LIEFF CABRASER HEIMANN & BERNSTEIN, LLP
250 Hudson Street, 8th Floor
New York, NY 10013-1413
Telephone: [phone]
Facsimile: 212.355.9592
Hank Bates (State Bar No. 167688)
[e-mail]
Allen Carney
[e-mail]
David Slade
[e-mail]
CARNEY BATES & PULLIAM, PLLC
2800 Cantrell Road, Suite 510
Little Rock, AR 72202
Telephone: [phone]
Facsimile: 501.312.8505

18
Attorneys for Plaintiffs and the Proposed Class
19
UNITED STATES DISTRICT COURT
20
NORTHERN DISTRICT OF CALIFORNIA
21
22
23

MATTHEW CAMPBELL and MICHAEL
HURLEY, on behalf of themselves and all
others similarly situated,

24

Case No. 13-cv-5996-PJH (MEJ)
SECOND AMENDED CLASS ACTION
COMPLAINT

Plaintiffs,
JURY TRIAL DEMANDED

25
v.
26
FACEBOOK, INC.,
27
Defendant.
28

SECOND AMENDED CLASS ACTION COMPLAINT

CASE NO. 13-CV-05996-PJH (MEJ)

SECOND AMENDED CLASS ACTION COMPLAINT1

1
2

I.

INTRODUCTION
1.

3

Defendant Facebook, Inc. (“Facebook”) has systematically intercepted Facebook

4

users’ private Facebook messages without their consent. Facebook’s conduct violates the

5

Electronic Communications Privacy Act, 18 U.S.C. §§ 2510 et seq. (“ECPA”), and the California

6

Invasion of Privacy Act, California Penal Code §§ 630 et seq. (“CIPA”). Plaintiffs seek,

7

individually and on behalf of the Class, injunctive and declaratory relief, restitution, and

8

monetary damages, on behalf of all Facebook users in the United States who have had their

9

Facebook private messages intercepted by Facebook in the manner alleged herein.
2.

10

Plaintiffs Matthew Campbell and Michael Hurley are Facebook users who, during

11

the class period, utilized Facebook’s private messaging function, each relying on representations

12

that these private and personal communications would be viewed only by the sender and the

13

recipient. Instead, when their ostensibly private messages contained links to other websites, also

14

known as “URLs,” Facebook scanned those messages and then analyzed the URL in the link. If

15

the website contained a Facebook “Like” button, Facebook treated the content of Plaintiffs’

16

private messages as an endorsement of the website, adding up to two “Likes” to the page’s count.

17

Facebook acted without consent of its users for its own benefit.
3.

18

Generating “Likes” increases Facebook’s ability to gather massive amounts of user

19

data. Facebook primarily generates revenue from targeted advertising and the fundamental means

20

of amassing the user data needed for effective targeted advertising is through Facebook’s “Like”

21

function. The more data points Facebook has for each of its 1.2 billion users, the more Facebook

22

can take advantage of the data by utilizing complex predictive analytics to enhance the reach and

23

accuracy of its targeted advertising. Therefore, whether or not Facebook premises its targeted

24

advertising directly on the URLs it scans when intercepting private messages, it nonetheless has

25

intercepted private messages with URLs for the purpose of increasing the collection of data which

26

it does directly employ in its targeted advertising.

27
28

1

This Complaint is submitted pursuant to the Court’s Order of May 18, 2016 (Docket No. 192).
-1-

SECOND AMENDED CLASS ACTION COMPLAINT

CASE NO. 13-CV-05996-PJH (MEJ)

1

4.

In an effort to harness the myriad data points of its users, in the form of placing

2

and publicizing its social plugins across the web, Facebook has intentionally intercepted its users’

3

private messages, scanned the contents of those electronic communications, and manipulated the

4

contents to attribute actions the users did not intend – “Liking” the web pages they were

5

discussing in their messages – for purposes unrelated to the users’ intent and solely for the benefit

6

of Facebook.

7

II.

8
9

THE PARTIES
5.

Plaintiff Matthew Campbell is a resident of Pulaski County, Arkansas. He

established a Facebook account in or around January 2009, which he has maintained consistently

10

to the present day. He has used Facebook’s private messaging function throughout the class

11

period for, inter alia, purposes of conveying messages whose content includes URL links.

12

6.

Plaintiff Michael Hurley is a resident of North Plains, Oregon. He established a

13

Facebook account in or around October 2008, which he has maintained consistently to the present

14

day. He has used Facebook’s private messaging function throughout the class period for, inter

15

alia, purposes of conveying messages whose content contains URL links.

16

7.

Defendant Facebook, Inc. is headquartered in Menlo Park, California, and

17

incorporated under the laws of the State of Delaware.

18

III.

19

JURISDICTION
8.

Pursuant to 28 U.S.C. § 1331, this Court has original subject matter jurisdiction

20

over the claims of Plaintiffs and the Class that arise under the Electronic Communications

21

Privacy Act of 1986 (“ECPA”), 18 U.S.C. §§ 2510 et seq.

22

9.

Pursuant to 28 U.S.C. § 1332, as amended by the Class Action Fairness Act of

23

2005 (“CAFA”), this Court has subject matter jurisdiction over this putative nationwide class

24

action because the matter in controversy exceeds $5,000,000.00, exclusive of interest and costs,

25

and is a class action in which some members of the Class are citizens of states different than

26

Defendant. See 28 U.S.C. § 1332(d)(2)(A).

27
28
-2-

SECOND AMENDED CLASS ACTION COMPLAINT

CASE NO. 13-CV-05996-PJH (MEJ)

1

10.

This Court has personal jurisdiction over Facebook because its worldwide

2

headquarters are in California, and because it conducts in California substantial business from

3

which the claims in this case arise.

4

IV.

5

INTRADISTRICT ASSIGNMENT
11.

Venue properly lies in this district pursuant to 28 U.S.C. § 1391(b)(1) because

6

Facebook is headquartered in this district and a substantial part of the events or omissions which

7

give rise to the claims alleged herein occurred in San Mateo County.

8
9

12.

Venue is also proper in this district pursuant to Facebook’s Statement of Rights

and Responsibilities, which governs the agreement between Plaintiffs and Facebook and which

10

states in pertinent part that Plaintiffs “will resolve any claim, cause of action or dispute (claim) . .

11

. relating to . . . Facebook exclusively in the U.S. District Court for the Northern District of

12

California or a state court located in San Mateo County.”

13

V.

14

CHOICE OF LAW
13.

California law governs the substantive legal issues in the instant matter.

15

Facebook’s Statement of Rights and Responsibilities states in pertinent part that “the laws of the

16

State of California will govern . . . any claim that might arise between you and us.”

17

VI.

18

FACTS COMMON TO ALL COUNTS
14.

Facebook operates the world’s largest social-networking website, with

19

approximately 1.2 billion users, representing approximately 51% of all internet users worldwide,

20

accessing its services monthly. Facebook’s online social networking website allows users to

21

communicate through the sharing of text, photograph, video, and internet content.

22

15.

The core purpose of Facebook is to facilitate communication among its users.

23

Facebook facilitates public communications via Facebook pages, and private communications via

24

personal messages and chats. Chats happen in real-time and often give the appearance of

25

conversation.

26

16.

In order to establish a Facebook account, a user must acknowledge Facebook’s

27

Statement of Rights and Responsibilities and its Privacy Policy. Facebook’s main page states,

28

“By clicking Sign Up, you agree to our Terms and that you have read our Data Use Policy.” See
-3-

SECOND AMENDED CLASS ACTION COMPLAINT

CASE NO. 13-CV-05996-PJH (MEJ)

1

https://www.facebook.com.2 Within this sentence, the word “Terms” contains a hyperlink to

2

Facebook’s “Statement of Rights and Responsibilities;” (Statement of Rights and Responsibilities,

3

https://www.facebook.com/legal/terms), and the words “Data Use Policy” contain a hyperlink,

4

leading to Facebook’s “Data Use Policy.” Data Use Policy,

5

https://www.facebook.com/about/privacy.

6

17.

The Statement of Rights and Responsibilities informs users that it “governs”

7

Facebook’s “relationship with users and others who interact with Facebook.” Under the

8

subsection “Privacy,” the Statement of Rights and Responsibilities provides:

9

Your privacy is very important to us. We designed our Data Use
Policy to make important disclosures about how you can use
Facebook to share with others and how we collect and can use your
content and information. We encourage you to read the Data Use
Policy, and to use it to help you make informed decisions.

10
11
12

As with the disclosure on the main page, “www.facebook.com,” the words “Data Use Policy”

13

contain a hyperlink to Facebook’s Data Use Policy.

14

18.

Facebook’s Statement of Rights and Responsibilities and its Data Use Policy

15

specify the nature of the user “content and information” that Facebook receives and the manner in

16

which it can “use” it. The definition of “content” is expressly limited to data which a Facebook

17

user posts publicly on a Facebook page, and the definition of the “Information We [Facebook]

18

Receive About You” contained in the Data Use Policy excludes the content of users’ private

19

messages, including the content of users’ private messages which include an embedded link to a

20

URL. Facebook fails to disclose that it systematically scans URLs transmitted via private

21

message across its social network.

22

19.

Facebook provides users with a spectrum of communication methods,

23

“[d]epending on whom you’d like to share with.” The options range from the broadest possible

24

audience, where posts are viewable to the general public, to posts viewable by small groups of

25

friends, to messages shared “privately” with a single individual.

26
27
28

2

Unless otherwise noted, a citation to any Facebook web page is to the version of that page in
effect on December 30, 2013, the date on which the initial complaint was filed in this action.
-4-

SECOND AMENDED CLASS ACTION COMPLAINT

CASE NO. 13-CV-05996-PJH (MEJ)

1
2

20.

publicly or privately. It stated in pertinent part:

3
4

During the class period, Facebook offered a tutorial on how to communicate either



How to Post & Share


5

Sharing Status Updates and Other Stories
How do I share a status or other content on Facebook?

6

Depending on whom you’d like to share with, there are different ways to
share content on Facebook:

7


Sharing with a broad audience: Use the share menu that’s located at
the top of your homepage and timeline to let others know what’s on your
mind. You can update your status and share photos, videos, links and
other application content. Things you share will appear as posts on your
timeline, and can appear in your News Feed. To control whether or not
specific people have the option to view your stories, you can change the
privacy settings for each piece of content you post.



Sharing with a small group of friends: Use the Groups feature to
share content with a select group of people, like family members, your
soccer team or your book club.



8

Sharing with an individual: You can use the share menu at the top of
a friend’s timeline to write or share something on his or her timeline.
Friends of your friend will also be able to view your post. If you’d like to

9
10
11
12
13
14

share something privately, you can always send someone a
private message.

15
16
17
18

Facebook Help Center, How to Post & Share (bold and italic emphasis added).
21.

Facebook’s private message function combines email, chat, text messaging, and

19

Facebook’s in-service messaging feature, thereby enabling users to send and receive private

20

messages within and outside of Facebook, across different devices such as computers,

21

smartphones, and tablets.

22

22.

Facebook represents to its users that this messaging service is private – that is, a

23

communication made through the service will take place only between the sender and the

24

intended recipient(s). This is evidenced by Facebook’s most basic instructions on how to use its

25

service: “If you’d like to share something privately, you can always send someone a private

26

message.” Indeed, whenever Facebook provides instructions on how to use its messaging service,

27

it does so in terms assuring private communications. At its website’s “Help Center,” in the step-

28

by-step instruction on how “[t]o send a private message,” under the heading “Who can see my
-5-

SECOND AMENDED CLASS ACTION COMPLAINT

CASE NO. 13-CV-05996-PJH (MEJ)

1

message,” Facebook states, “You and the people you’re messaging with can view the contents

2

and history of your conversation.” Facebook Help Center, Messaging: Messages: Settings &

3

Security: Who Can See My Messages?,

4

https://www.facebook.com/help/212388195458335?sr=16&sid=0ntT7VdfDjw7Y5KSV.

5

23.

When it first announced its private messaging service, Facebook represents that its

6

messaging function is “unprecedented” in terms of user control and the protection of privacy,

7

further emphasizing its promise that only the sender and the recipient or recipients are privy to the

8

private message’s content, to the exclusion of any other party, including Facebook. See

9

Seligstein, J., See the Messages that Matter, https://www.facebook.com/notes/facebook/see-the-

10
11

messages-that-matter/452288242130.
24.

Contrary to its representations, Facebook has systematically intercepted the

12

contents of users’ “private” messages. Facebook scans the content of users’ private messages that

13

include a URL. On information and belief, whenever a private message contains a URL,

14

Facebook uses a software application called a “web crawler” to scan the URL, sending HTTP

15

requests to the server associated with the URL and then seeking various items of information

16

about the web page to which the URL is linked. On information and belief, Facebook’s

17

interception occurred in transit, in transmission, and/or during transfer of users’ private messages.

18

25.

Facebook has developed items of code called “social plugins,” which can be

19

embedded in third-party websites and, when clicked on by visitors, interact with Facebook. One

20

such social plugin is the “Like” button.

21

26.

On information and belief, at least until October 2012, Facebook has scanned

22

private messages to produce “Likes” for websites with an embedded “Like” button, where the

23

private message contains that website’s URL. After scanning the content of private messages that

24

include a link to a third-party website, Facebook has searched for information profiling the

25

message-sender’s web activity, and manipulated code in the third-party website to increase the

26

number of “Likes” indicated on the website’s Facebook plugin.

27
28

27.

On information and belief, during the class period, one of the items of information

that Facebook’s web crawlers sought was whether or not the web page associated with the URL
-6-

SECOND AMENDED CLASS ACTION COMPLAINT

CASE NO. 13-CV-05996-PJH (MEJ)

1

contained a “Like” button, and when it did contain a “Like” button, the web crawlers transmitted

2

this information back to Facebook. During the class period, Facebook provided intercepted data

3

to the web page at issue, in the form of analysis of web traffic to that site by Facebook users.

4

28.

Facebook further retained all intercepted private message content (and all data and

5

metadata derived therefrom) for the current or future objective of accumulating and analyzing

6

user data and thereafter refining user profiles and/or enhancing its targeted advertising efforts.

7

29.

Facebook’s interception and scanning of the contents of its users’ private messages

8

for the purposes of manipulating code in third party’s websites to register “Likes” is not disclosed

9

in either Facebook’s Terms of Use or its Privacy Policy.

10

30.

The effect of embedding social plugins into third-party websites is that it enables

11

Facebook to extend its data gathering practices, keeping tabs on its users’ behavior even after

12

they log out of Facebook. The “Like” button, one of Facebook’s principal social plug-ins, is

13

commonly found on internet web pages. A large number of “Likes” indicates that a web page is

14

popular. A video tutorial on Facebook’s website states:

15

When someone clicks “Like,” they’re highlighting the things that
are valuable to them and sharing that with their friends. And when
all of this goes to your News Feed, it’s like you have a real time,
super-customized window to the most valuable things on the
Internet. But we understand that many of the things people care
about live outside of Facebook, so we wanted to create a way to
bring your friends with you to other websites. So we created social
plugins. Social plugins extend the things you love about Facebook
to your favorite websites.

16
17
18
19
20
21
22
23
24
25
26

Facebook Tutorial Video, Understanding Social Plugins at 0:15 – 0:39 (June 7, 2010),
https://www.facebook.com/video/video.php?v=10150210521510484.
31.

In practice, Facebook social plugins serve as an extension of Facebook on the

internet at large. In addition to Facebook’s “Like” button at the top of a news article, Facebook’s
social plugins can take the form of a sidebar feed noting who among the users’ Facebook
“Friends” have read or recommended the article, or featuring a clickable Facebook icon, as
circled below.

27
28
-7-

SECOND AMENDED CLASS ACTION COMPLAINT

CASE NO. 13-CV-05996-PJH (MEJ)

1
2
3
4
5
6
7
8

Somini Sengupta, The Information Gathering Paradox, N.Y. Times, Oct. 26, 2013.
32.

If users are concerned that their extra-Facebook web traffic is being broadcast

across the world’s largest social network, Facebook offers this assurance:

9

When you start to see websites that are customized for you all over
the Internet, you might wonder if everyone else can see it. But it’s
not like that. Although you can see customized information on
other sites, all the information lives on Facebook, and Facebook
doesn’t share your information with anyone through social plugins.
And each person has full control of what they want to share.
You’re only sharing the information you want to, and you’re only
sharing it with the people you want to share it with.

10
11
12
13
14
15
16
17
18
19
20
21
22

33.

In October 2012, a security researcher published findings in the Wall Street

Journal showing that Facebook scanned users’ private messages for URLs, further revealing that
when a private message contained a link to a third-party web page, and that page had a “Like”
social plugin, Facebook registered two “Likes” for that web page via the social media plugin. See
Jennifer Valentino-DeVries and Ashkan Soltani, How Private Are Your Private Facebook
Messages?, Wall St. J. (Oct. 3, 2012).
34.

In this first screenshot, the website set up by the security researcher, Ashkan

Soltani, “ashkansoltani.org/fb_test.html,” has two “Likes” registered to it:

23
24
25
26

Soltani also provided the html code for the website:

27
28
-8-

SECOND AMENDED CLASS ACTION COMPLAINT

CASE NO. 13-CV-05996-PJH (MEJ)

1
2
3
4
5
6
7
8

Soltani then logged into Facebook and sent a message that contained the URL and the text

9

“testing 1 2 3.”

10
11
12
13
14
15
16
17
18
19
20
21
22
23
Finally, Soltani navigated back to his test website to see if the number of “Likes” registered to it
24
increased, which they did.
25
26
27
28
-9-

SECOND AMENDED CLASS ACTION COMPLAINT

CASE NO. 13-CV-05996-PJH (MEJ)

1

A video showing Soltani complete this test in real-time can be found as part of the Digital Trends

2

article reporting on it. See McHugh, M., Facebook Scans Private Messages for Brand Page

3

Mentions, Admits a Bug Is Boosting Likes, Digital Trends (Oct. 4, 2012),

4

http://www.digitaltrends.com/social-media/facebook-scans-private-messages/.

5

35.

The transmission of the URL in the private message increased the number of

6

“Likes” by a factor of two. The article notes that this practice is described in Facebook’s

7

guidance for developers – administrators of the third-party websites whom Facebook seeks to

8

entice to use social plugins. The developer guidance states that “the number of inbox messages

9

containing” a link to a page will count as “Likes.”

10

36.

Facebook does not disclose anywhere in its Privacy Policy its practice of scanning

11

private messages and doling out “Likes” to websites if a URL is contained therein, nor has such a

12

practice ever been announced in any of Facebook’s disclosures to its users. Because Facebook

13

did not disclose this practice to its users, Facebook did not seek nor did it ever gain the consent of

14

its users to intercept their messages, or to use the data thus obtained.

15

37.

If, at some point following the Wall Street Journal’s October 2012 exposé,

16

Facebook suspended its practice of intercepting and scanning users’ private messages and doling

17

out “Likes” whenever the scanned message referenced a URL with a social plugin, it has done so

18

quietly, without ever acknowledging either that it had engaged in this practice or that it had

19

discontinued it, nor has it confirmed that it will not engage in this practice in the future.

20

38.

On August 27, 2013, the Swiss security firm High-Tech Bridge (“HTB”)

21

announced that it had conducted a test to assess users’ privacy in the fifty largest social networks,

22

web services, and free email systems (“Web Services”). Using the private messaging function of

23

each of the Web Services, HTB embedded in each message a URL unique to each Web Service.

24

HTB then monitored the logs of a dedicated web server for all incoming HTTP requests, to

25

determine whether a Web Service would “click” on the test URLs that had been transmitted in

26

private messages. HTB concluded that Facebook was scanning URLs in private messages.

27
28
- 10 -

SECOND AMENDED CLASS ACTION COMPLAINT

CASE NO. 13-CV-05996-PJH (MEJ)

1

39.

The presence of a Facebook “Like” button on a web page enables Facebook to

2

collect individual users’ data, which it then employs in developing user profiles to support and

3

deliver targeted advertising – whether or not a user affirmatively clicks on the button.

4

40.

The “Like” function is crucial in gathering data points for the profiles and

5

Facebook keeps on its users for purposes of delivering targeted advertising from which it

6

generates substantial revenue. The more websites that incorporate social plug-ins in response to

7

their apparent value to users, the more opportunities are created for Facebook to generate data on

8

users, and increase its own value to – and revenue from – third-party advertisers.

9

41.

Any Facebook social plugin, including the “Like” button, is a series of Facebook-

10

controlled code inserted into a web page’s code. As soon as the web page is loaded, “the code

11

invokes a PHP script at Facebook.com that records information including the URL for the Web

12

page, your IP address, and your Facebook ID [if the user is simultaneously logged in on

13

Facebook].” Thus, “widespread use of the Like button allows Facebook to track people as they

14

switch from CNN.com to Yelp.com to ESPN.com, all of which are sites that…implement the

15

feature.” McCullagh, D., Facebook “Like” Button Draws Privacy Scrutiny, CNET News (June 2,

16

2010), http://news.cnet.com/8301-13578_3-20006532-38.html.

17

42.

Even if a user does not affirmatively click a “Like” button, the presence on a web

18

page of the “Like” plugin enables Facebook to monitor the user’s online activity, collecting data

19

about the user, even if the user is logged out of Facebook. “If you put a Like button on your site,”

20

an attorney with the ACLU of Northern California cautioned, “you’re potentially selling out your

21

users’ privacy even if they never press that button….It’s another example of why user control

22

needs to be the default in Facebook.”

23

43.

Facebook’s revenues depend on user data. Accordingly, Facebook has incentives

24

to encourage widespread placement of “Like” buttons and other Facebook-controlled social

25

plugins throughout the web because each social plugin amounts to a mechanism by which

26

Facebook can monitor internet traffic.

27
28

44.

By doling out “Likes” to the web pages that install Facebook’s social plug-ins,

Facebook increases the visibility and apparent popularity of these sites online, giving them a
- 11 -

SECOND AMENDED CLASS ACTION COMPLAINT

CASE NO. 13-CV-05996-PJH (MEJ)

1

competitive advantage over sites that do not associate with Facebook. A recent Frontline exposé

2

accurately describes “Likes” as Facebook’s “currency.” See Rushkoff, D., Generation Like,

3

Frontline, http://www.pbs.org/wgbh/pages/frontline/media/generation-like/transcript-57/.

4

Websites that do not install Facebook’s social plug-ins are thus at a competitive disadvantage,

5

which Facebook exacerbates when it inflates the number of “Likes” on web pages associated with

6

it by adding a “Like” – or two “Likes” – each time a Facebook user shares the page’s URL in a

7

private message. To stay competitive and attract visitors, websites install Facebook’s plug-ins.

8

Greater participation rates, in turn, broaden the scope of Facebook’s data collection.

9

A.

Facebook’s Other Sharing of Intercepted Data With Third Parties

10

45.

Facebook intercepted private message content for purposes of sharing it with third

11

parties. When a user composes a private message with URL content, Facebook’s system detects

12

the URL content and generates a URL preview (much like a thumbnail). As the private message

13

is sent, Facebook’s programming redirects the URL content to create an “object” called an

14

“EntShare.” An EntShare is a set of data about a share event (such as sharing a URL in a Private

15

Message) tied to the specific user who sends the message. Facebook also creates another record

16

called an “EntGlobalShare” where Facebook stores the preview for a certain URL and keeps a

17

tally of the number of shares in users’ messages for that URL.

18

46.

Facebook’s maintenance of the data derived from private messages containing a

19

URL, which includes data identifying the sender of the private message, is not related to the

20

facilitation of the transmission of the private message. Facebook retains all intercepted private

21

message content (and all data and metadata derived therefrom) for the current or future objective

22

of accumulating and analyzing user data and thereafter refining user profiles and/or enhancing its

23

targeted advertising efforts.

24

47.

Through the creation of data objects derived from private message content,

25

Facebook provides analysis of web traffic to specific Internet sites by Facebook users which

26

includes demographic information about the senders and recipients of the scanned private

27

messages. Facebook provides this information through a product called “Insights” or “Domain

28

Insights” dashboard – a Facebook-controlled website (or “User Interface (UI)”) that page owners
- 12 -

SECOND AMENDED CLASS ACTION COMPLAINT

CASE NO. 13-CV-05996-PJH (MEJ)

1

could access, which would provide them with breakdowns by age, gender, language, country, and

2

date, of Facebook users who had shared a given URL (including users who had shared the URL

3

in private messages). See Report of Dr. Jennifer Golbeck in Support of Plaintiffs’ Motion for

4

Class Certification (“Golbeck Report”) (Dkt. No. 183-4) at ¶¶ 65-75; see also Declaration of Alex

5

Himel in Support of Defendant Facebook, Inc.’s Opposition to Plaintiffs’ Motion for Class

6

Certification (“Himel Decl.”) (Dkt. No. 184-11) at ¶¶ 58-60. Facebook promoted its Insights

7

product as helping the website owner “tailor your content and products to your users” by

8

providing “demographic information for the interactions that occur on your site and on

9

Facebook.” FB000008722, Exhibit 13 to Plaintiffs’ Motion for Class Certification (“Class Cert.

10

Mot.”) (Dkt. No. 179-9). Facebook stored these metrics even when the website at issue had not

11

implemented Facebook’s code (i.e., Facebook recorded all instances of all URLs being shared in

12

users’ private messages; as well as the demographic data related to each sender and recipient),

13

stating “Domain Insights offers a consolidated view of key metrics for any website, even those

14

that have not implemented Facebook Platform.” Golbeck Report at ¶ 69 (citing FB000010688).

15

48.

Additionally, Facebook incorporates private message content into several APIs

16

(“application program interfaces”), referred to by Facebook as the “Graph API” and the

17

“link_stats” API, which allowed third-party developers to query and utilize data related to the

18

number of times a URL was shared on Facebook (including via private message). Golbeck

19

Report at ¶¶ 79-81, Himel Decl. at 66-68. These data were available to any third party, for any

20

purpose. Golbeck Report at ¶ 79 (quoting FB000008643) (“This data is OPEN – anyone can

21

access it.”) According to Alex Himel, a senior Facebook engineer, Facebook “provided these

22

APIs publicly in order to allow for the development of products and features that incorporate

23

engagement statistics – products that take into account what people are interacting with now.”

24

Himel Decl. at ¶ 66.

25

49.

Further, for an unspecified period of time, Facebook publicly exposed the fact that

26

users included certain URLs in their private messages via its Activity Feed Plugin, which would

27

identify both the URL at issue and the sender or recipient of the private message. Golbeck Report

28

at ¶¶ 75-78.
- 13 -

SECOND AMENDED CLASS ACTION COMPLAINT

CASE NO. 13-CV-05996-PJH (MEJ)

1

50.

Representing to users that the content of Facebook messages is “private” creates

2

an especially exploitable opportunity for Facebook, because users who believe they are

3

communicating on a service free from surveillance are more likely to reveal facts about

4

themselves that they would not reveal had they known the content was being monitored. Thus,

5

by representing that messaging would remain private, Facebook has positioned itself to monitor

6

user activity in ways that would otherwise be unavailable to it. By scanning users’ private

7

messages, inferring “Likes” and generating EntGlobalShare and EntShare objects from the

8

content of those messages, Facebook has been able to glean from its users data that they

9

otherwise would not have shared, allowing Facebook to generate even more robust, and

10
11

accordingly more valuable, user profiles.
51.

All of Facebook’s activities complained of herein were undertaken without users’

12

consent. Instead, to increase users’ comfort with the website and, thereby, to increase the amount

13

of information users share, Facebook assures users that they have individual control over privacy

14

settings and messaging options. These assurances affirmatively state that only senders and

15

intended recipients are privy to the contents of users’ nonpublic communications. In reality,

16

Facebook mined any and all transmissions across its network, including those it labels “private,”

17

for its own gain.

18

52.

As information is shared by its more than one billion unique users, Facebook is

19

provided with sophisticated, exceedingly detailed data profiles which, when coupled with

20

proprietary analytics algorithms, enable Facebook to place ads throughout users’ accounts based

21

upon the extensive profiles assembled on each and every user. As Facebook has stated:

22

27

When an advertiser creates an ad, they are given the opportunity to
choose their audience by location, demographics, likes, keywords,
and any other information we receive or can tell about you and
other users. For example, an advertiser can choose to target 18 to 35
year-old women who live in the United States and like basketball.
An advertiser could also choose to target certain topics or
keywords, like “music” or even people who like a particular song or
artist. If you indicate that you are interested in topics, such as by
liking a Page, including topics such as products, brands, religion,
health status, or political views, you may see ads related to those
topics as well.

28

* * *

23
24
25
26

- 14 -

SECOND AMENDED CLASS ACTION COMPLAINT

CASE NO. 13-CV-05996-PJH (MEJ)

1

Sometimes we allow advertisers to target a category of user, like a
“moviegoer” or a “sci-fi fan.” We do this by bundling
characteristics that we believe are related to the category. For
example, if a person “likes” the “Star Trek” Page and mentions
“Star Wars” when they check into a movie theater, we may
conclude that this person is likely to be a sci-fi fan. Advertisers of
sci-fi movies, for example, could ask us to target “sci-fi fans” and
we would target that group, which may include you. Or if you
“like” Pages that are car-related and mention a particular car brand
in a post, we might put you in the “potential car buyer” category
and let a car brand target to that group, which would include you.

2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

Data Use Policy, IV. How Advertising and Sponsored Stories Work, Facebook,
http://www.scribd.com/doc/191118234/Facebook-2.
53.

The data profiles collected by Facebook enable it to deliver sophisticated targeted

advertising. According to a third-party study, broadly targeted campaigns on Facebook (e.g.,
adults between the ages of 25 and 49) reach the desired audience with 95% accuracy, compared
with an industry average of 72%; for more narrowly targeted campaigns (e.g., females between
the ages of 25 and 34), Facebook reaches the desired audience with 90% accuracy, compared to
an industry average of just 35%. In 2009, 2010, and 2011, targeted advertising accounted for
98%, 95%, and 85%, respectively, of Facebook’s revenue.
54.

Facebook consciously harvests its users’ data, including through the conduct

alleged herein. The more information Facebook acquires, the more nuance and sophistication it
can exercise in profiling its users. Acquiring data is useful not only for aggregating traits that
users self-select (for example, liking the page for a political candidate could be a good indicator
that someone will vote for that candidate) but, as studies have shown, also for revealing attributes
that a person would not have chosen to share (such as personality, sexual orientation, religion and
intelligence). See, e.g., Kosinski, M. et al., Private Traits and Attributes are Predictable from
Digital Records of Human Behavior, Nat. Acad. of Sci., 110(15), 5802-5805 (2013). Disparate
data points when magnified and multiplied a billion-fold produce an exceptionally informative
picture. Facebook has shown its interest in using these techniques for enhancing its ad targeting
through its own published research. See e.g., Bakshy, E. et al., Social Influence in Social
Advertising, 13th ACM Conf. on Elec. Commerce (2012). Therefore, the “Likes” and the

28
- 15 -

SECOND AMENDED CLASS ACTION COMPLAINT

CASE NO. 13-CV-05996-PJH (MEJ)

1

EntGlobalShare and EntShare objects generated by Facebook’s interception of users’ private

2

messages provide a trove of information that not only informs Facebook’s knowledge of those

3

users’ choices and characteristics but, combined with other users’ data, produces deep and

4

powerful knowledge of the user base as a whole.

5

55.

On information and belief, Facebook retains the user data it has collected,

6

including the “Likes” and the EntGlobalShare and EntShare objects generated through

7

intercepting users’ private messages. Facebook exercises dominion and control over the user data

8

it collects, and individual users have no control whatsoever over their own user data collected or

9

retained by Facebook, including any subsequent exploitation, sale, or other use of the data.

10

Dissemination of information about individuals could empower the government against citizens

11

to a degree well beyond the contemplation of the Fourth Amendment. Facebook declares that it

12

only provides the stored contents of any account to the government with a warrant, yet it has been

13

reported that the companies that purchase such information can hand it over to government

14

agencies with no probable cause and with no warrant. Foreign regimes may also gain access to

15

users’ private data after it has been aggregated by companies like Facebook.

16

56.

In 1986, Congress passed the ECPA with the express purpose of affording to

17

electronic communications, such as the private online communications at issue here, the same

18

protections that attach to private letters sent via the U.S. Postal Service. In recommending

19

adoption of the ECPA, the Senate Committee on the Judiciary issued the following statement:

20
21
22
23
24
25
26
27

A letter sent by first class mail is afforded a high level of
protection against unauthorized opening by a combination of
constitutional provisions, case law, and U.S. Postal Service statutes
and regulations. Voice communications transmitted via common
carrier are protected by title III of the Omnibus Crime Control and
Safe Streets Act of 1968. But there are no comparable Federal
statutory standards to protect the privacy and security of
communications transmitted by new noncommon carrier
communications services or new forms of telecommunications and
computer technology. This is so, even though American citizens
and American businesses are using these new forms of technology
in lieu of, or side-by-side with, first class mail and common carrier
telephone services.

28
- 16 -

SECOND AMENDED CLASS ACTION COMPLAINT

CASE NO. 13-CV-05996-PJH (MEJ)

1

57.

The Senator who introduced the Electronic Communications Privacy Act to

2

Congress described its overarching goal as follows: “We cannot let any American feel less

3

confident in putting information into an electronic mail network than he or she would in putting it

4

into an envelope and dropping it off at the Post Office.”

5

58.

In response to the threats posed by internet privacy invasions, the Department of

6

Commerce has recently recommended basic principles for internet regulation that align with the

7

goals underlying the CIPA and the ECPA. First articulated by the Department of Health and

8

Human Services more than 30 years ago, they are known as the Fair Information Practice

9

Principles (“FIPPs”). The FIPPs provide a recognized framework for privacy policies which

10

“provide a framework for balancing the need for privacy with other [commercial] interests.” The

11

GAO has provided an advisory statement affirming that the act of scanning the content of

12

customers’ private messages without consent, for purposes of profiting off of the messages’

13

content in some way – i.e. the conduct which this complaint alleges Facebook has engaged in – is

14

contrary to the FIPPS and violates the ECPA.

15

59.

Facebook’s practices of intercepting and scanning its users’ private messages, for

16

the purposes of manipulating code in third-party websites to register “Likes,” or for purposes of

17

collecting or storing information concerning URL content in the private messages, are not

18

necessary for, or incidental to, Facebook’s ability to provide users the service of sending and

19

receiving private messages, or the protection of its rights or property, and are outside the ordinary

20

course of Facebook’s business as an electronic communication service provider. Facebook has at

21

all times relevant possessed the technical capacity to offer its private message service without

22

intercepting, scanning, and storing the content of users’ private messages.

23

60.

Nowhere does Facebook disclose, including in its Statement of Rights and

24

Responsibilities and in its Data Use Policy, that as a matter of course Facebook intercepts, scans,

25

and stores the content of its users’ private messages, that it uses the content of private messages to

26

register “Likes” on third parties’ websites, or that data derived therefrom will be shared with third

27

parties as alleged herein.

28
- 17 -

SECOND AMENDED CLASS ACTION COMPLAINT

CASE NO. 13-CV-05996-PJH (MEJ)

1

61.

Facebook misleads users into believing that they have a secure, private mechanism

2

for communication – Facebook’s private messaging function – when, in fact, Facebook intercepts

3

and scans the content of private messages to gather data in an effort to bolster its “social plug-in”

4

network, to improve its marketing algorithms, and to increase its ability to profit from data about

5

Facebook users.

6

VII.

7
8

CLASS ALLEGATIONS
62.

Rules of Civil Procedure, individually and on behalf of all members of the following Class:

9

All natural-person Facebook users located within the United
States who have sent, or received from a Facebook user, private
messages that included URLs in their content, (and from which
Facebook generated a URL attachment), from within two years
before the filing of this action up through the date of the
certification of the class.

10
11
12
13

Plaintiffs bring this nationwide class action, pursuant to Rule 23 of the Federal

63.

Excluded from the Class are the following individuals and/or entities: Facebook

14

and its parents, subsidiaries, affiliates, officers and directors, current or former employees, and

15

any entity in which Facebook has a controlling interest; counsel for the putative class; all

16

individuals who make a timely election to be excluded from this proceeding using the correct

17

protocol for opting out; any and all federal, state or local governments, including but not limited

18

to their departments, agencies, divisions, bureaus, boards, sections, groups, counsels and/or

19

subdivisions; and all judges assigned to hear any aspect of this litigation, as well as their

20

immediate family members.

21
22
23

64.

Plaintiffs reserve the right to modify or amend the definition of the proposed Class

before the Court determines whether certification is appropriate.
65.

The Class is so numerous that joinder of all members is impracticable. On

24

information and belief, there are more than 166 million Facebook account holders in the United

25

States. The number of separate individuals who sent private messages via Facebook, where such

26

message included URLs in the content, within two years before the filing of this action, is likely

27

in the millions, and is identifiable and ascertainable based on Facebook’s records.

28
- 18 -

SECOND AMENDED CLASS ACTION COMPLAINT

CASE NO. 13-CV-05996-PJH (MEJ)

1
2

66.

There are questions of law or fact common to the Class that will drive the

resolution of this case. These questions include, but are not limited to, the following:

3

a.

Whether Facebook intentionally intercepted, endeavored to intercept, or

4

procured any other person to intercept or endeavor to intercept Plaintiffs’ and Class Members’

5

electronic communications sent via Facebook;

6

b.

Whether Facebook intentionally used, or endeavored to use, the contents of

7

Plaintiffs’ and Class Members’ electronic communications sent via Facebook, knowing or having

8

reason to know that the information was obtained in violation of 18 U.S.C. § 2511(1)(d);

9

c.

Whether Facebook acted intentionally in violating privacy rights;

10

d.

Whether Facebook acquired any “contents” of Plaintiffs’ and Class

11

Members’ private messages, within the meaning of 18 U.S.C. § 2510(8);

12
13

e.

Facebook were “electronic communications” within the meaning of 18 U.S.C. § 2510(12);

14
15

Whether Plaintiffs’ and Class Members’ private messages sent via

f.

Whether Facebook used an “electronic, mechanical, or other device,”

within the meaning of 18 U.S.C. § 2510(5);

16

g.

The amount of statutory damages that should be levied against Facebook;

17

h.

Whether injunctive and/or declaratory relief against Facebook should be

19

i.

Whether Facebook’s conduct was likely to deceive its users;

20

j.

Whether Facebook’s conduct was unlawful; and

21

k.

Whether Plaintiffs and Class Members are entitled to restitution.

18

22

awarded;

67.

Plaintiffs’ claims are typical of the claims of the Class in that Plaintiffs and the

23

Class sent and/or received private messages via Facebook, where such messages contained URLs

24

in the content. In the process, Facebook intercepted, scanned, and acquired the private messages’

25

content, sending HTTP requests to the servers housing the web pages referred to in Plaintiffs’ and

26

Class Members’ private messages. Facebook further used or endeavored to use the contents of

27

Plaintiffs’ and Class Members’ private messages, where Facebook identified URLs to webpages

28

containing social plugins, by manipulating such social plugins to generate “Likes” for web pages
- 19 -

SECOND AMENDED CLASS ACTION COMPLAINT

CASE NO. 13-CV-05996-PJH (MEJ)

1

and to assemble profiles of users’ web traffic and personal preferences. Plaintiffs and Class

2

Members did not consent to the interception and uses of their private message content, which

3

form the basis for this suit. Plaintiffs and Class Members are entitled to declaratory relief,

4

statutory damages, restitution, and injunctive relief as a result of the conduct complained of

5

herein. Moreover, on information and belief, the conduct complained of herein is systemic.

6

Thus, the representative Plaintiffs, like all other Class Members, face substantial risk of the same

7

injury in the future. The factual basis of Facebook’s conduct is common to all Class Members,

8

and represents a common thread of conduct resulting in injury to all members of the Class.

9

Plaintiffs have suffered the harm alleged and have no interests antagonistic to any other Class

10
11

Member.
68.

Plaintiffs will fairly and adequately protect the interests of the Class. Plaintiffs’

12

interests do not conflict with the interests of the Class Members. Furthermore, Plaintiffs have

13

retained competent counsel experienced in class action litigation. Plaintiffs’ counsel will fairly

14

and adequately protect and represent the interests of the Class. Federal Rule of Civil Procedure

15

23(a)(4) and 23(g) are satisfied.

16

69.

Plaintiffs assert that pursuant to Federal Rule of Civil Procedure 23(b)(3),

17

questions of law or fact common to the Class Members predominate over any questions affecting

18

only individual members.

19

70.

A class action is superior to other available methods for the fair and efficient

20

adjudication of this controversy. Arguably no Class Member could afford to seek legal redress

21

individually for the claims alleged herein. Therefore, absent a class action, the Class Members

22

will continue to suffer losses and Facebook’s misconduct will proceed without remedy.

23

71.

Even if Class Members themselves could afford such individual litigation, the

24

court system could not. Given the complex legal and factual issues involved, and considering that

25

the Class could number in the tens of millions or greater, individualized litigation would

26

significantly increase the delay and expense to all parties and to the Court. Individualized

27

litigation would also create the potential for inconsistent or contradictory rulings. By contrast, a

28

class action presents far fewer management difficulties, allows claims to be heard which may
- 20 -

SECOND AMENDED CLASS ACTION COMPLAINT

CASE NO. 13-CV-05996-PJH (MEJ)

1

otherwise go unheard because of the relative expense of bringing individual lawsuits, and

2

provides the benefits of adjudication, economies of scale and comprehensive supervision by a

3

single court.

4

VIII. THE CLASS REPRESENTATIVES

5

72.

Plaintiff Matthew Campbell set up a Facebook account in or around January 2009,

6

which he has maintained continuously to the present. During the class period, Plaintiff Campbell

7

used Facebook’s private messaging function for purposes of sending messages containing links to

8

other websites’ URLs. At the time he established his Facebook account, Plaintiff Campbell

9

reviewed the disclosures and statements made by Facebook regarding how information is to be

10

treated on Facebook, and reasonably relying thereon, believed that the content of his private

11

Facebook messages would be seen and used only by him and his recipient.

12

73.

Plaintiff Michael Hurley set up a Facebook account in or around October 2008,

13

which he has maintained continuously to the present. During the class period, Plaintiff Hurley

14

used Facebook’s private messaging function for purposes of sending messages containing links to

15

other websites’ URLs. At the time he established his Facebook account, Plaintiff Hurley

16

reviewed the disclosures and statements made by Facebook regarding how information is to be

17

treated on Facebook, and reasonably relying thereon, believed that the content of his private

18

Facebook messages would be seen and used only by him and his recipient.

19
20
21
22
23
24
25
26
27
28
- 21 -

SECOND AMENDED CLASS ACTION COMPLAINT

CASE NO. 13-CV-05996-PJH (MEJ)

1

IX.

CAUSES OF ACTION3

2

COUNT ONE

3

(Violations of the Electronic Communications Privacy Act,
18 U.S.C. §§ 2510 et seq.)

4
5

74.

Plaintiffs adopt and incorporate each and every allegation of this complaint as if

6

stated fully herein.

7

75.

Plaintiffs, individually and on behalf of Class Members, assert violations of

8

18 U.S.C. §§ 2511(1)(a) and (1)(d) for Facebook’s unlawful interception and use of Plaintiffs’

9

electronic communications.

10

76.

Facebook, as a corporation, is a “person” pursuant to 18 U.S.C. § 2510(6).

11

77.

Throughout the entirety of the conduct upon which this suit is based, Facebook’s

12

actions have affected interstate commerce. On information and belief, Facebook has over 166

13

million users in the United States alone, and over one billion users worldwide.
78.

14

Facebook’s actions are and have been intentional as evidenced by, inter alia, its

15

disclosures to developers and the design and implementation of its private messaging service,

16

web crawlers, and social plugins.
79.

17

Facebook’s actions complained of herein are not necessary practices for providers

18

of electronic communications, nor are they incidental to the act of facilitating private messaging

19

via Facebook’s social network.
80.

20

Pursuant to 18 U.S.C. § 2511(1)(a), Facebook intentionally intercepted, intercepts,

21

or endeavored or endeavors to intercept the electronic communications of Plaintiffs and Class

22

Members.

23

81.

Through Facebook’s scanning of users’ private messages, Facebook acquired and

24

continues to acquire the substance, purport, and meaning of private messages transmitted to and

25

from Plaintiffs and Class Members.

26
27
28

3

Plaintiffs have deleted reference to their claims under Cal. Penal Code § 632 and Cal. Bus &
Prof. Code § 17200 in order to conform their Complaint to the Court’s Order of December 23,
2014, which dismissed those claims (Dkt. No. 43). Plaintiffs reserve their right to appeal the
dismissal of these claims.
- 22 -

SECOND AMENDED CLASS ACTION COMPLAINT

CASE NO. 13-CV-05996-PJH (MEJ)

1

82.

The private messages transmitted to and from Plaintiffs and Class Members via

2

Facebook’s private messaging function are and have been at all relevant times electronic

3

communications.

4

83.

Facebook utilizes each accused device for the purpose of acquiring and

5

manipulating content from the message in the course of the message’s transmission, and such

6

course of action does not occur while the private message is in storage.

7

84.

Facebook utilized and continues to utilize one or more devices or technology

8

comprised of an electronic, mechanical, or other device or apparatus to intercept the electronic

9

communications transmitted to and from Plaintiffs and Class Members. Such devices or

10
11
12
13
14
15

technology include, but are not limited to, web crawlers and social plugins.
85.

Facebook does not furnish the above-referenced devices or technology to its users,

and users do not use the devices for connection to the facilities.
86.

The intercepting devices or technology are not used for the ability to send or

receive electronic communications.
87.

The devices or technology are not used by Facebook, operating as an electronic

16

communication service, in the ordinary course of business as a provider of an electronic

17

communication service.

18

88.

Facebook intercepted electronic communications sent by and to Plaintiffs and

19

Class Members (a) for undisclosed purposes; (b) for the purpose of generating “Likes” for third-

20

party websites; (c) for purposes of providing web traffic data to third parties; (d) for purposes of

21

cataloging user data; (e) for purposes beyond facilitating private messages sent via Facebook;

22

(f) in violation of its user agreements; (g) in violation of its public statements to users; (h) in

23

violation of federal and California law; and (i) in violation of the property rights of Plaintiffs,

24

Class Members, and third parties. These activities are not within the ordinary course of business

25

of a provider of an electronic communication service.

26
27

89.

Pursuant to 18 U.S.C. § 2511(1)(d), Facebook intentionally used, uses, or

endeavored or endeavors to use the contents of Plaintiffs’ and Class Members’ electronic

28
- 23 -

SECOND AMENDED CLASS ACTION COMPLAINT

CASE NO. 13-CV-05996-PJH (MEJ)

1

communications while knowing or having reason to know that it obtained the information through

2

the interception of the electronic communication in violation of 18 U.S.C. § 2511(1)(a).

3

90.

Facebook’s interception of and use of the contents of Plaintiffs’ and Class

4

Members’ electronic communications were not performed by an employee engaged in any

5

activity necessary for the rendition of an electronic communication service or for the protection of

6

the rights or property of Facebook.

7

91.

Facebook’s practice of intercepting, scanning, generating “Likes” from, users’

8

private messages, and generating EntGlobalShares and EntShare data objects are not necessary

9

for the rendition of Facebook’s private messaging service, the protection of Facebook’s rights or

10

property, or the security of Facebook users. These scans have not been undertaken in the

11

ordinary course of business of an electronic communication service, as described in 28 U.S.C.

12

§ 2510(15).

13
14
15
16
17

92.

Facebook’s services that are not related to the ability to send and receive electronic

communications are not electronic communication services.
93.

No party to the electronic communications alleged herein consented to Facebook’s

interception or use of the contents of the electronic communications.
94.

Facebook intercepts Plaintiffs’ and Class Members’ electronic communications for

18

the purpose of committing a criminal or tortious act in violation of the laws of any state, and as

19

such, it cannot obtain consent pursuant to § 2511(2)(d).

20
21
22

95.

As a result of Facebook’s violations of § 2511, pursuant to § 2520, Plaintiffs and

the Class Members are entitled to relief as prayed for below.
96.

While certain devices and/or technology have been identified in this Complaint,

23

Plaintiffs reserve the right to assert ECPA violations as to any further devices and/or technology

24

disclosed or those devices and/or technology upon which Facebook provides additional

25

information.

26
27
28
- 24 -

SECOND AMENDED CLASS ACTION COMPLAINT

CASE NO. 13-CV-05996-PJH (MEJ)

1

COUNT TWO

2

(Violations of the California Invasion of Privacy Act,
Cal. Penal Code §§ 631)

3
4

97.

Plaintiffs adopt and incorporate each and every allegation of this complaint as if

5

stated fully herein.

6

98.

Plaintiffs, individually and on behalf of Class Members, assert violations of the

7

CIPA, California Penal Code §§ 630, et seq., specifically California Penal Code §§ 631(a) and

8

632, for Facebook’s unlawful interception and scanning of the contents of its users’ private

9

messages. Facebook uses this information about the sender and recipient for purposes of

10
11

profiling, marketing, and advertising.
99.

California Penal Code § 630 provides that “The Legislature hereby declares that

12

advances in science and technology have led to the development of new devices and techniques

13

for the purpose of eavesdropping upon private communications and that the invasion of privacy

14

resulting from the continual and increasing use of such devices and techniques has created a

15

serious threat to the free exercise of personal liberties and cannot be tolerated in a free and

16

civilized society.”

17

100.

Facebook’s acts in violation of the CIPA occurred in the State of California

18

because those acts resulted from business decisions, practices, and operating policies that

19

Facebook developed, implemented, and utilized in the State of California and which are unlawful

20

and constitute criminal conduct in the state of Facebook’s residence and principal business

21

operations. Facebook’s implementation of its business decisions, practices, and standard ongoing

22

policies that violate the CIPA took place and continue to take place in the State of California.

23

Facebook profited and continues to profit in the State of California as a result of its repeated and

24

systemic violations of the CIPA. Facebook’s unlawful conduct, which occurred in the State of

25

California, harmed and continues to harm Plaintiffs and Class Members. Facebook developed,

26

designed, built, and physically placed in California one or more of the accused devices or

27

technology employed by Facebook to violate the CIPA.

28
- 25 -

SECOND AMENDED CLASS ACTION COMPLAINT

CASE NO. 13-CV-05996-PJH (MEJ)

1
2
3
4
5
6

101.

Plaintiffs and Class Members sent and received private messages, the contents of

which included URLs, via Facebook’s services.
102.

Facebook is not and was not at any time a party to Plaintiffs’ and Class Members’

private messages.
103.

The private messages exchanged among Plaintiffs and Class Members are

messages.

7

104.

These messages are communications among Plaintiffs and Class Members.

8

105.

Pursuant to California Penal Code § 7, Facebook, a corporation, is a “person.”

9

106.

Facebook uses a “machine,” “instrument,” “contrivance,” or “in any other manner”

10

is able to, read or to learn the content or meaning of Plaintiffs’ and Class Members’ private

11

messages.

12
13
14

107.

Facebook acts willfully when it reads, attempts to read, or learns the content or

meaning of Plaintiffs’ and Class Members’ private messages.
108.

Facebook does not have the consent of any party to the communication, or it acts

15

in an unauthorized manner, when it reads, attempts to read, or learns the content or meaning of

16

Plaintiffs’ and Class Members’ private messages.

17
18
19
20
21

109.

Plaintiffs’ and Class Members’ private messages are “any message, report, or

communication.”
110.

At the time Facebook reads, attempts to read, or learns the content or meaning of

Plaintiffs’ and Class Members’ private messages, the private messages are in transit.
111.

At the time Facebook reads, attempts to read, or learns the content or meaning of

22

Plaintiffs’ and Class Members’ private messages, the private messages are passing over a wire,

23

line, or cable.

24

112.

Private messages – coded, written messages sent electronically to remote locations

25

– are telegraphs within the meaning of the CIPA and this section of CIPA. As such, the wires,

26

lines, cables and/or instruments which carry and facilitate the transmission of Plaintiffs’ and Class

27

Members’ private messages are telegraph wires, lines, cables and/or instruments within the

28

meaning of the CIPA and CIPA § 631(a).
- 26 -

SECOND AMENDED CLASS ACTION COMPLAINT

CASE NO. 13-CV-05996-PJH (MEJ)

1

113.

Plaintiffs and Class Members do not consent, expressly or impliedly, to

2

Facebook’s eavesdropping upon and recording of their private messages. Facebook does not

3

disclose material information to its users relating to its attempts at, among other things,

4

intercepting, scanning and reading the contents of users’ private messages.

5

114.

There is no knowledge or expectation among Plaintiffs and Class Members

6

regarding the extent of Facebook’s reading of message content, learning about the content or

7

meaning of users’ private messages, the acquisition of such content, the collection of such

8

content, or the manipulation of such content. Each and every one of these actions extends beyond

9

the normal occurrences, requirements, and expectations regarding the facilitation and

10

transmission of Facebook’s private messages.

11

JURY TRIAL DEMANDED

12
13

Pursuant to Federal Rule of Civil Procedure 38, Plaintiffs, individually and on behalf of
the Class they seek to represent, demand a jury on any issue so triable of right by a jury.

14

PRAYER FOR RELIEF

15
16

WHEREFORE, Plaintiffs, on behalf of themselves and all Class Members, request
judgment be entered against Facebook and that the Court grant the following:

17

1.

An order determining that this action may be maintained as a class action under

18

Rule 23 of the Federal Rules of Civil Procedure, that Plaintiffs are proper class representatives,

19

that Plaintiffs’ attorneys be appointed Class counsel pursuant to Rule 23(g) of the Federal Rules

20

of Civil Procedure, and that Class notice be promptly issued;

21

2.

Judgment against Facebook for Plaintiffs’ and Class Members’ asserted causes of

23

3.

Appropriate declaratory relief against Facebook;

24

4.

Preliminary and permanent injunctive relief against Facebook;

25

5.

Any and all appropriate relief to Plaintiffs and Class members pursuant to the

22

action;

26

Electronic Communications Privacy Act, 118 U.S.C. § 2510 et seq., and the California Invasion

27

of Privacy Act, Cal. Penal Code § 630, et seq.;

28
- 27 -

SECOND AMENDED CLASS ACTION COMPLAINT

CASE NO. 13-CV-05996-PJH (MEJ)

1
2
3

6.

An award of reasonable attorney’s fees and other litigation costs reasonably

incurred; and
7.

Any and all relief to which Plaintiffs and the Class may be entitled.

4
5

Dated: June 7, 2016

LIEFF CABRASER HEIMANN & BERNSTEIN, LLP

6
7

By:

/s/ Michael W. Sobol
Michael W. Sobol

8
9
10
11
12
13

Michael W. Sobol (State Bar No. 194857)
[e-mail]
David T. Rudolph (State Bar No. 233457)
[e-mail]
Melissa Gardner (State Bar No. 289096)
[e-mail]
LIEFF CABRASER HEIMANN & BERNSTEIN, LLP
275 Battery Street, 29th Floor
San Francisco, CA 94111-3339
Telephone: [phone]
Facsimile: 415.956.1008

14
15
16
17
18

Rachel Geman
[e-mail]
Nicholas Diamand
[e-mail]
LIEFF CABRASER HEIMANN & BERNSTEIN, LLP
250 Hudson Street, 8th Floor
New York, NY 10013-1413
Telephone: [phone]
Facsimile: 212.355.9592

19
20
21
22
23
24

Hank Bates (State Bar No. 167688)
[e-mail]
Allen Carney
[e-mail]
David Slade
[e-mail]
CARNEY BATES & PULLIAM, PLLC
2800 Cantrell Road, Suite 510
Little Rock, AR 72202
Telephone: [phone]
Facsimile: 501.312.8505

25
26

Attorneys for Plaintiffs and the Proposed Class

27
28
- 28 -

SECOND AMENDED CLASS ACTION COMPLAINT

CASE NO. 13-CV-05996-PJH (MEJ)