Campbell et al v. Facebook Inc.

Filing 25

CONSOLIDATED AMENDED CLASS ACTION COMPLAINT with Jury Demand, against Facebook Inc.. Filed by Matthew Campbell, Michael Hurley, David Shadpour. (Sobol, Michael) (Filed on 4/25/2014) Modified on 4/28/2014 (jlmS, COURT STAFF).

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

Michael W. Sobol (State Bar No. 194857)
[e-mail]
Melissa Gardner (State Bar No. 289096)
[e-mail]
LIEFF CABRASER HEIMANN & BERNSTEIN, LLP
275 Battery Street, 29th Floor
San Francisco, CA 94111-3339
Telephone: [phone]
Facsimile: 415.956.1008
Rachel Geman
[e-mail]
Nicholas Diamand
[e-mail]
LIEFF CABRASER HEIMANN & BERNSTEIN, LLP
250 Hudson Street, 8th Floor
New York, NY 10013-1413
Telephone: [phone]
Facsimile: 212.355.9592

Jeremy A. Lieberman
Lesley F. Portnoy
[e-mail]
POMERANTZ, LLP
600 Third Avenue, 20th Floor
New York, New York 10016
Telephone: [phone]
Facsimile: 212.661.8665
Patrick V. Dahlstrom
[e-mail]
POMERANTZ, LLP
10 S. La Salle Street, Suite 3505
Chicago, Illinois 60603
Telephone: [phone]
Facsimile: 312.377.1184

Hank Bates (State Bar No. 167688)
[e-mail]
Allen Carney
[e-mail]
David Slade
[e-mail]
CARNEY BATES & PULLIAM, PLLC
11311 Arcade Drive
Little Rock, AR 72212
Telephone: [phone]
Facsimile: 501.312.8505

17
Attorneys for Plaintiffs and the Proposed Class
18
UNITED STATES DISTRICT COURT
19
NORTHERN DISTRICT OF CALIFORNIA
20
21
22
23

MATTHEW CAMPBELL, MICHAEL
HURLEY, and DAVID SHADPOUR, on
behalf of themselves and all others
similarly situated,
Plaintiffs,

24
25

CONSOLIDATED AMENDED CLASS
ACTION COMPLAINT
JURY TRIAL DEMANDED

v.

26

Case No. 4:13-cv-05996

FACEBOOK, INC.,
Defendant.

27
28

CONSOLIDATED AMENDED CLASS ACTION COMPLAINT

1172205.1

CONSOLIDATED AMENDED CLASS ACTION COMPLAINT1

1
2

I.

INTRODUCTION
1.

3

Defendant Facebook, Inc. (“Facebook”) has systematically intercepted Facebook

4

users’ private Facebook messages without their consent. Facebook’s conduct violates the

5

Electronic Communications Privacy Act, 18 U.S.C. §§ 2510 et seq. (“ECPA”), the California

6

Invasion of Privacy Act, California Penal Code §§ 630 et seq. (“CIPA”), and the California

7

Unfair Competition Law, Cal. Bus. & Prof. Code §§ 17200 et seq. (“UCL”). Plaintiffs seek,

8

individually and on behalf of the Class, injunctive and declaratory relief, restitution, and

9

monetary damages, on behalf of all Facebook users in the United States who have had their

10

Facebook private messages intercepted by Facebook in the manner alleged herein.
2.

11

Plaintiffs Matthew Campbell, Michael Hurley, and David Shadpour are Facebook

12

users who, during the class period, utilized Facebook’s private messaging function, each relying

13

on representations that these private and personal communications would be viewed only by the

14

sender and the recipient. Instead, when their ostensibly private messages contained links to other

15

websites, also known as “URLs,” Facebook scanned those messages and then analyzed the URL

16

in the link. If the website contained a Facebook “Like” button, Facebook treated the content of

17

Plaintiffs’ private messages as an endorsement of the website, adding up to two “Likes” to the

18

page’s count. Facebook acted without consent of its users for its own benefit.
3.

19

Generating “Likes” increases Facebook’s ability to gather massive amounts of user

20

data. Facebook primarily generates revenue from targeted advertising and the fundamental means

21

of amassing the user data needed for effective targeted advertising is through Facebook’s “Like”

22

function. The more data points Facebook has for each of its 1.2 billion users, the more Facebook

23

can take advantage of the data by utilizing complex predictive analytics to enhance the reach and

24

accuracy of its targeted advertising. Therefore, whether or not Facebook premises its targeted

25

advertising directly on the URLs it scans when intercepting private messages, it nonetheless has

26

intercepted private messages with URLs for the purpose of increasing the collection of data which

27

it does directly employ in its targeted advertising.

28

1

This Complaint is submitted pursuant to the Court’s Order of March 11, 2014 (Docket No. 17).

1172205.1

-1-

CONSOLIDATED AMENDED CLASS ACTION COMPLAINT

1

4.

In an effort to harness the myriad data points of its users, in the form of placing

2

and publicizing its social plugins across the web, Facebook has intentionally intercepted its users’

3

private messages, scanned the contents of those electronic communications, and manipulated the

4

contents to attribute actions the users did not intend – “Liking” the web pages they were

5

discussing in their messages – for purposes unrelated to the users’ intent and solely for the benefit

6

of Facebook.

7

II.

8
9

THE PARTIES
5.

Plaintiff Matthew Campbell is a resident of Pulaski County, Arkansas. He

established a Facebook account in or around January 2009, which he has maintained consistently

10

to the present day. He has used Facebook’s private messaging function throughout the class

11

period for, inter alia, purposes of conveying messages whose content includes URL links.

12

6.

Plaintiff Michael Hurley is a resident of North Plains, Oregon. He established a

13

Facebook account in or around October 2008, which he has maintained consistently to the present

14

day. He has used Facebook’s private messaging function throughout the class period for, inter

15

alia, purposes of conveying messages whose content contains URL links.

16

7.

Plaintiff David Shadpour is a resident of Los Angeles County, California. He

17

established a Facebook account in our around February 2006, which he has maintained

18

consistently to the present day. He has used Facebook’s private messaging function throughout

19

the class period for, inter alia, purposes of conveying messages whose content includes URL

20

links.

21

8.

Defendant Facebook, Inc. is headquartered in Menlo Park, California, and

22

incorporated under the laws of the State of Delaware.

23

III.

24

JURISDICTION
9.

Pursuant to 28 U.S.C. § 1331, this Court has original subject matter jurisdiction

25

over the claims of Plaintiffs and the Class that arise under the Electronic Communications

26

Privacy Act of 1986 (“ECPA”), 18 U.S.C. §§ 2510 et seq.

27
28

10.

Pursuant to 28 U.S.C. § 1332, as amended by the Class Action Fairness Act of

2005 (“CAFA”), this Court has subject matter jurisdiction over this putative nationwide class
1172205.1

-2-

CONSOLIDATED AMENDED CLASS ACTION COMPLAINT

1

action because the matter in controversy exceeds $5,000,000.00, exclusive of interest and costs,

2

and is a class action in which some members of the Class are citizens of states different than

3

Defendant. See 28 U.S.C. § 1332(d)(2)(A).

4

11.

This Court has personal jurisdiction over Facebook because its worldwide

5

headquarters are in California, and because it conducts in California substantial business from

6

which the claims in this case arise.

7

IV.

8
9
10

INTRADISTRICT ASSIGNMENT
12.

Venue properly lies in this district pursuant to 28 U.S.C. § 1391(b)(1) because

Facebook is headquartered in this district and a substantial part of the events or omissions which
give rise to the claims alleged herein occurred in San Mateo County.

11

13.

Venue is also proper in this district pursuant to Facebook’s Statement of Rights

12

and Responsibilities, which governs the agreement between Plaintiffs and Facebook and which

13

states in pertinent part that Plaintiffs “will resolve any claim, cause of action or dispute (claim) . .

14

. relating to . . . Facebook exclusively in the U.S. District Court for the Northern District of

15

California or a state court located in San Mateo County.”

16

V.

17

CHOICE OF LAW
14.

California law governs the substantive legal issues in the instant matter.

18

Facebook’s Statement of Rights and Responsibilities states in pertinent part that “the laws of the

19

State of California will govern . . . any claim that might arise between you and us.”

20

VI.

21

FACTS COMMON TO ALL COUNTS
15.

Facebook operates the world’s largest social-networking website, with

22

approximately 1.2 billion users, representing approximately 51% of all internet users worldwide,

23

accessing its services monthly. Facebook’s online social networking website allows users to

24

communicate through the sharing of text, photograph, video, and internet content.

25

16.

The core purpose of Facebook is to facilitate communication among its users.

26

Facebook facilitates public communications via Facebook pages, and private communications via

27

personal messages and chats. Chats happen in real-time and often give the appearance of

28

conversation.
1172205.1

-3-

CONSOLIDATED AMENDED CLASS ACTION COMPLAINT

1

17.

In order to establish a Facebook account, a user must acknowledge Facebook’s

2

Statement of Rights and Responsibilities and its Privacy Policy. Facebook’s main page states,

3

“By clicking Sign Up, you agree to our Terms and that you have read our Data Use Policy.” See

4

https://www.facebook.com.2 Within this sentence, the word “Terms” contains a hyperlink to

5

Facebook’s “Statement of Rights and Responsibilities;” (Statement of Rights and Responsibilities,

6

https://www.facebook.com/legal/terms), and the words “Data Use Policy” contain a hyperlink,

7

leading to Facebook’s “Data Use Policy.” Data Use Policy,

8

https://www.facebook.com/about/privacy.

9

18.

The Statement of Rights and Responsibilities informs users that it “governs”

10

Facebook’s “relationship with users and others who interact with Facebook.” Under the

11

subsection “Privacy,” the Statement of Rights and Responsibilities provides:

12

Your privacy is very important to us. We designed our Data Use
Policy to make important disclosures about how you can use
Facebook to share with others and how we collect and can use your
content and information. We encourage you to read the Data Use
Policy, and to use it to help you make informed decisions.

13
14
15

As with the disclosure on the main page, “www.facebook.com,” the words “Data Use Policy”

16

contain a hyperlink to Facebook’s Data Use Policy.

17

19.

Facebook’s Statement of Rights and Responsibilities and its Data Use Policy

18

specify the nature of the user “content and information” that Facebook receives and the manner in

19

which it can “use” it. The definition of “content” is expressly limited to data which a Facebook

20

user posts publicly on a Facebook page, and the definition of the “Information We [Facebook]

21

Receive About You” contained in the Data Use Policy excludes the content of users’ private

22

messages, including the content of users’ private messages which include an embedded link to a

23

URL. Facebook fails to disclose that it systematically scans URLs transmitted via private

24

message across its social network.

25
26

20.

Facebook provides users with a spectrum of communication methods,

“[d]epending on whom you’d like to share with.” The options range from the broadest possible

27
28

2

Unless otherwise noted, a citation to any Facebook web page is to the version of that page in
effect on December 30, 2013, the date on which the initial complaint was filed in this action.
1172205.1

-4-

CONSOLIDATED AMENDED CLASS ACTION COMPLAINT

1

audience, where posts are viewable to the general public, to posts viewable by small groups of

2

friends, to messages shared “privately” with a single individual.

3
4

21.

During the class period, Facebook offered a tutorial on how to communicate either

publicly or privately. It stated in pertinent part:

5


6

How to Post & Share


7

Sharing Status Updates and Other Stories
How do I share a status or other content on Facebook?

8

Depending on whom you’d like to share with, there are different ways to
share content on Facebook:

9


Sharing with a broad audience: Use the share menu that’s located at
the top of your homepage and timeline to let others know what’s on your
mind. You can update your status and share photos, videos, links and
other application content. Things you share will appear as posts on your
timeline, and can appear in your News Feed. To control whether or not
specific people have the option to view your stories, you can change the
privacy settings for each piece of content you post.



Sharing with a small group of friends: Use the Groups feature to
share content with a select group of people, like family members, your
soccer team or your book club.



10

Sharing with an individual: You can use the share menu at the top of
a friend’s timeline to write or share something on his or her timeline.
Friends of your friend will also be able to view your post. If you’d like to

11
12
13
14
15
16

share something privately, you can always send someone a
private message.

17
18
19

Facebook Help Center, How to Post & Share (bold and italic emphasis added).
22.

20

Facebook’s private message function combines email, chat, text messaging, and

21

Facebook’s in-service messaging feature, thereby enabling users to send and receive private

22

messages within and outside of Facebook, across different devices such as computers,

23

smartphones, and tablets.
23.

24

Facebook represents to its users that this messaging service is private – that is, a

25

communication made through the service will take place only between the sender and the

26

intended recipient(s). This is evidenced by Facebook’s most basic instructions on how to use its

27

service: “If you’d like to share something privately, you can always send someone a private

28

message.” Indeed, whenever Facebook provides instructions on how to use its messaging service,

1172205.1

-5-

CONSOLIDATED AMENDED CLASS ACTION COMPLAINT

1

it does so in terms assuring private communications. At its website’s “Help Center,” in the step-

2

by-step instruction on how “[t]o send a private message,” under the heading “Who can see my

3

message,” Facebook states, “You and the people you’re messaging with can view the contents

4

and history of your conversation.” Facebook Help Center, Messaging: Messages: Settings &

5

Security: Who Can See My Messages?,

6

https://www.facebook.com/help/212388195458335?sr=16&sid=0ntT7VdfDjw7Y5KSV.

7

24.

When it first announced its private messaging service, Facebook represents that its

8

messaging function is “unprecedented” in terms of user control and the protection of privacy,

9

further emphasizing its promise that only the sender and the recipient or recipients are privy to the

10

private message’s content, to the exclusion of any other party, including Facebook. See

11

Seligstein, J., See the Messages that Matter, https://www.facebook.com/notes/facebook/see-the-

12

messages-that-matter/452288242130.

13

25.

Contrary to its representations, Facebook has systematically intercepted the

14

contents of users’ “private” messages. Facebook scans the content of users’ private messages that

15

include a URL. On information and belief, whenever a private message contains a URL,

16

Facebook uses a software application called a “web crawler” to scan the URL, sending HTTP

17

requests to the server associated with the URL and then seeking various items of information

18

about the web page to which the URL is linked. On information and belief, Facebook’s

19

interception occurred in transit, in transmission, and/or during transfer of users’ private messages.

20

26.

Facebook has developed items of code called “social plugins,” which can be

21

embedded in third-party websites and, when clicked on by visitors, interact with Facebook. One

22

such social plugin is the “Like” button.

23

27.

On information and belief, at least until October 2012, Facebook has scanned

24

private messages to produce “Likes” for websites with an embedded “Like” button, where the

25

private message contains that website’s URL. After scanning the content of private messages that

26

include a link to a third-party website, Facebook has searched for information profiling the

27

message-sender’s web activity, and manipulated code in the third-party website to increase the

28

number of “Likes” indicated on the website’s Facebook plugin.
1172205.1

-6-

CONSOLIDATED AMENDED CLASS ACTION COMPLAINT

1

28.

On information and belief, during the class period, one of the items of information

2

that Facebook’s web crawlers sought was whether or not the web page associated with the URL

3

contained a “Like” button, and when it did contain a “Like” button, the web crawlers transmitted

4

this information back to Facebook.

5

29.

On information and belief, during the class period, Facebook further provided

6

these data to the web page at issue, in the form of analysis of web traffic to that site by Facebook

7

users.

8
9
10

30.

On information and belief, Facebook further retained these data for the current or

future objective of accumulating and analyzing user data and thereafter refining user profiles
and/or enhancing its targeted advertising efforts.

11

31.

Facebook’s interception and scanning of the contents of its users’ private messages

12

for the purposes of manipulating code in third party’s websites to register “Likes” is not disclosed

13

in either Facebook’s Terms of Use or its Privacy Policy.

14

32.

The effect of embedding social plugins into third-party websites is that it enables

15

Facebook to extend its data gathering practices, keeping tabs on its users’ behavior even after

16

they log out of Facebook. The “Like” button, one of Facebook’s principal social plug-ins, is

17

commonly found on internet web pages. A large number of “Likes” indicates that a web page is

18

popular. A video tutorial on Facebook’s website states:

19

When someone clicks “Like,” they’re highlighting the things that
are valuable to them and sharing that with their friends. And when
all of this goes to your News Feed, it’s like you have a real time,
super-customized window to the most valuable things on the
Internet. But we understand that many of the things people care
about live outside of Facebook, so we wanted to create a way to
bring your friends with you to other websites. So we created social
plugins. Social plugins extend the things you love about Facebook
to your favorite websites.

20
21
22
23
24
25

Facebook Tutorial Video, Understanding Social Plugins at 0:15 – 0:39 (June 7, 2010),
https://www.facebook.com/video/video.php?v=10150210521510484.

26
27
28

33.

In practice, Facebook social plugins serve as an extension of Facebook on the

internet at large. In addition to Facebook’s “Like” button at the top of a news article, Facebook’s
social plugins can take the form of a sidebar feed noting who among the users’ Facebook
1172205.1

-7-

CONSOLIDATED AMENDED CLASS ACTION COMPLAINT

1

“Friends” have read or recommended the article, or featuring a clickable Facebook icon, as

2

circled below.

3
4
5
6
7
8

Somini Sengupta, The Information Gathering Paradox, N.Y. Times, Oct. 26, 2013.

9
10

34.

If users are concerned that their extra-Facebook web traffic is being broadcast

across the world’s largest social network, Facebook offers this assurance:

11

When you start to see websites that are customized for you all over
the Internet, you might wonder if everyone else can see it. But it’s
not like that. Although you can see customized information on
other sites, all the information lives on Facebook, and Facebook
doesn’t share your information with anyone through social plugins.
And each person has full control of what they want to share.
You’re only sharing the information you want to, and you’re only
sharing it with the people you want to share it with.

12
13
14
15
16
35.

17
18
19
20
21
22

Journal showing that Facebook scanned users’ private messages for URLs, further revealing that
when a private message contained a link to a third-party web page, and that page had a “Like”
social plugin, Facebook registered two “Likes” for that web page via the social media plugin. See
Jennifer Valentino-DeVries and Ashkan Soltani, How Private Are Your Private Facebook
Messages?, Wall St. J. (Oct. 3, 2012).
36.

23
24

In October 2012, a security researcher published findings in the Wall Street

In this first screenshot, the website set up by the security researcher, Ashkan

Soltani, “ashkansoltani.org/fb_test.html,” has two “Likes” registered to it:

25
26
27
28

Soltani also provided the html code for the website:

1172205.1

-8-

CONSOLIDATED AMENDED CLASS ACTION COMPLAINT

1
2
3
4
5
6
7
8

Soltani then logged into Facebook and sent a message that contained the URL and the text

9

“testing 1 2 3.”

10
11
12
13
14
15
16
17
18
19
20
21
22
23
Finally, Soltani navigated back to his test website to see if the number of “Likes” registered to it
24
increased, which they did.
25
26
27
28
1172205.1

-9-

CONSOLIDATED AMENDED CLASS ACTION COMPLAINT

1

A video showing Soltani complete this test in real-time can be found as part of the Digital Trends

2

article reporting on it. See McHugh, M., Facebook Scans Private Messages for Brand Page

3

Mentions, Admits a Bug Is Boosting Likes, Digital Trends (Oct. 4, 2012),

4

http://www.digitaltrends.com/social-media/facebook-scans-private-messages/.

5

37.

The transmission of the URL in the private message increased the number of

6

“Likes” by a factor of two. The article notes that this practice is described in Facebook’s

7

guidance for developers – administrators of the third-party websites whom Facebook seeks to

8

entice to use social plugins. The developer guidance states that “the number of inbox messages

9

containing” a link to a page will count as “Likes.”

10

38.

Facebook does not disclose anywhere in its Privacy Policy its practice of scanning

11

private messages and doling out “Likes” to websites if a URL is contained therein, nor has such a

12

practice ever been announced in any of Facebook’s disclosures to its users. Because Facebook

13

did not disclose this practice to its users, Facebook did not seek nor did it ever gain the consent of

14

its users to intercept their messages, or to use the data thus obtained.

15

39.

If, at some point following the Wall Street Journal’s October 2012 exposé,

16

Facebook suspended its practice of intercepting and scanning users’ private messages and doling

17

out “Likes” whenever the scanned message referenced a URL with a social plugin, it has done so

18

quietly, without ever acknowledging either that it had engaged in this practice or that it had

19

discontinued it, nor has it confirmed that it will not engage in this practice in the future.

20

40.

On August 27, 2013, the Swiss security firm High-Tech Bridge (“HTB”)

21

announced that it had conducted a test to assess users’ privacy in the fifty largest social networks,

22

web services, and free email systems (“Web Services”). Using the private messaging function of

23

each of the Web Services, HTB embedded in each message a URL unique to each Web Service.

24

HTB then monitored the logs of a dedicated web server for all incoming HTTP requests, to

25

determine whether a Web Service would “click” on the test URLs that had been transmitted in

26

private messages. HTB concluded that Facebook was scanning URLs in private messages.

27
28
1172205.1

- 10 -

CONSOLIDATED AMENDED CLASS ACTION COMPLAINT

1

41.

The presence of a Facebook “Like” button on a web page enables Facebook to

2

collect individual users’ data, which it then employs in developing user profiles to support and

3

deliver targeted advertising – whether or not a user affirmatively clicks on the button.

4

42.

The “Like” function is crucial in gathering data points for the profiles and

5

Facebook keeps on its users for purposes of delivering targeted advertising from which it

6

generates substantial revenue. The more websites that incorporate social plug-ins in response to

7

their apparent value to users, the more opportunities are created for Facebook to generate data on

8

users, and increase its own value to – and revenue from – third-party advertisers.

9

43.

Any Facebook social plugin, including the “Like” button, is a series of Facebook-

10

controlled code inserted into a web page’s code. As soon as the web page is loaded, “the code

11

invokes a PHP script at Facebook.com that records information including the URL for the Web

12

page, your IP address, and your Facebook ID [if the user is simultaneously logged in on

13

Facebook].” Thus, “widespread use of the Like button allows Facebook to track people as they

14

switch from CNN.com to Yelp.com to ESPN.com, all of which are sites that…implement the

15

feature.” McCullagh, D., Facebook “Like” Button Draws Privacy Scrutiny, CNET News (June 2,

16

2010), http://news.cnet.com/8301-13578_3-20006532-38.html.

17

44.

Even if a user does not affirmatively click a “Like” button, the presence on a web

18

page of the “Like” plugin enables Facebook to monitor the user’s online activity, collecting data

19

about the user, even if the user is logged out of Facebook. “If you put a Like button on your site,”

20

an attorney with the ACLU of Northern California cautioned, “you’re potentially selling out your

21

users’ privacy even if they never press that button….It’s another example of why user control

22

needs to be the default in Facebook.”

23

45.

Facebook’s revenues depend on user data. Accordingly, Facebook has incentives

24

to encourage widespread placement of “Like” buttons and other Facebook-controlled social

25

plugins throughout the web because each social plugin amounts to a mechanism by which

26

Facebook can monitor internet traffic.

27
28

46.

By doling out “Likes” to the web pages that install Facebook’s social plug-ins,

Facebook increases the visibility and apparent popularity of these sites online, giving them a
1172205.1

- 11 -

CONSOLIDATED AMENDED CLASS ACTION COMPLAINT

1

competitive advantage over sites that do not associate with Facebook. A recent Frontline exposé

2

accurately describes “Likes” as Facebook’s “currency.” See Rushkoff, D., Generation Like,

3

Frontline, http://www.pbs.org/wgbh/pages/frontline/media/generation-like/transcript-57/.

4

Websites that do not install Facebook’s social plug-ins are thus at a competitive disadvantage,

5

which Facebook exacerbates when it inflates the number of “Likes” on web pages associated with

6

it by adding a “Like” – or two “Likes” – each time a Facebook user shares the page’s URL in a

7

private message. To stay competitive and attract visitors, websites install Facebook’s plug-ins.

8

Greater participation rates, in turn, broaden the scope of Facebook’s data collection.

9

47.

Representing to users that the content of Facebook messages is “private” creates

10

an especially exploitable opportunity for Facebook, because users who believe they are

11

communicating on a service free from surveillance are more likely to reveal facts about

12

themselves that they would not reveal had they known the content was being monitored. Thus,

13

by representing that messaging would remain private, Facebook has positioned itself to monitor

14

user activity in ways that would otherwise be unavailable to it. By scanning users’ private

15

messages, and inferring “Likes” from the content of those messages, Facebook has been able to

16

glean from its users data that they otherwise would not have shared, allowing Facebook to

17

generate even more robust, and accordingly more valuable, user profiles.

18

48.

All of Facebook’s activities complained of herein were undertaken without users’

19

consent. Instead, to increase users’ comfort with the website and, thereby, to increase the amount

20

of information users share, Facebook assures users that they have individual control over privacy

21

settings and messaging options. These assurances affirmatively state that only senders and

22

intended recipients are privy to the contents of users’ nonpublic communications. In reality,

23

Facebook mined any and all transmissions across its network, including those it labels “private,”

24

for its own gain.

25

49.

As information is shared by its more than one billion unique users, Facebook is

26

provided with sophisticated, exceedingly detailed data profiles which, when coupled with

27

proprietary analytics algorithms, enable Facebook to place ads throughout users’ accounts based

28

upon the extensive profiles assembled on each and every user. As Facebook has stated:
1172205.1

- 12 -

CONSOLIDATED AMENDED CLASS ACTION COMPLAINT

1

6

When an advertiser creates an ad, they are given the opportunity to
choose their audience by location, demographics, likes, keywords,
and any other information we receive or can tell about you and
other users. For example, an advertiser can choose to target 18 to 35
year-old women who live in the United States and like basketball.
An advertiser could also choose to target certain topics or
keywords, like “music” or even people who like a particular song or
artist. If you indicate that you are interested in topics, such as by
liking a Page, including topics such as products, brands, religion,
health status, or political views, you may see ads related to those
topics as well.

7

* * *

8

Sometimes we allow advertisers to target a category of user, like a
“moviegoer” or a “sci-fi fan.” We do this by bundling
characteristics that we believe are related to the category. For
example, if a person “likes” the “Star Trek” Page and mentions
“Star Wars” when they check into a movie theater, we may
conclude that this person is likely to be a sci-fi fan. Advertisers of
sci-fi movies, for example, could ask us to target “sci-fi fans” and
we would target that group, which may include you. Or if you
“like” Pages that are car-related and mention a particular car brand
in a post, we might put you in the “potential car buyer” category
and let a car brand target to that group, which would include you.

2
3
4
5

9
10
11
12
13
14

Data Use Policy, IV. How Advertising and Sponsored Stories Work, Facebook,

15

http://www.scribd.com/doc/191118234/Facebook-2.
50.

16

The data profiles collected by Facebook enable it to deliver sophisticated targeted

17

advertising. According to a third-party study, broadly targeted campaigns on Facebook (e.g.,

18

adults between the ages of 25 and 49) reach the desired audience with 95% accuracy, compared

19

with an industry average of 72%; for more narrowly targeted campaigns (e.g., females between

20

the ages of 25 and 34), Facebook reaches the desired audience with 90% accuracy, compared to

21

an industry average of just 35%. In 2009, 2010, and 2011, targeted advertising accounted for

22

98%, 95%, and 85%, respectively, of Facebook’s revenue.
51.

23

Facebook consciously harvests its users’ data, including through the conduct

24

alleged herein. The more information Facebook acquires, the more nuance and sophistication it

25

can exercise in profiling its users. Acquiring data is useful not only for aggregating traits that

26

users self-select (for example, liking the page for a political candidate could be a good indicator

27

that someone will vote for that candidate) but, as studies have shown, also for revealing attributes

28

that a person would not have chosen to share (such as personality, sexual orientation, religion and
1172205.1

- 13 -

CONSOLIDATED AMENDED CLASS ACTION COMPLAINT

1

intelligence). See, e.g., Kosinski, M. et al., Private Traits and Attributes are Predictable from

2

Digital Records of Human Behavior, Nat. Acad. of Sci., 110(15), 5802-5805 (2013). Disparate

3

data points when magnified and multiplied a billion-fold produce an exceptionally informative

4

picture. Facebook has shown its interest in using these techniques for enhancing its ad targeting

5

through its own published research. See e.g., Bakshy, E. et al., Social Influence in Social

6

Advertising, 13th ACM Conf. on Elec. Commerce (2012). Therefore, “Likes” generated by

7

Facebook’s interception of users’ private messages provide a trove of information that not only

8

informs Facebook’s knowledge of those users’ choices and characteristics but, combined with

9

other users’ data, produces deep and powerful knowledge of the user base as a whole.

10

52.

On information and belief, Facebook retains the user data it has collected,

11

including the “Likes” assigned through intercepting users’ private messages. Facebook exercises

12

dominion and control over the user data it collects, and individual users have no control

13

whatsoever over their own user data collected or retained by Facebook, including any subsequent

14

exploitation, sale, or other use of the data. Dissemination of information about individuals could

15

empower the government against citizens to a degree well beyond the contemplation of the

16

Fourth Amendment. Facebook declares that it only provides the stored contents of any account to

17

the government with a warrant, yet it has been reported that the companies that purchase such

18

information can hand it over to government agencies with no probable cause and with no warrant.

19

Foreign regimes may also gain access to users’ private data after it has been aggregated by

20

companies like Facebook.

21

53.

In 1986, Congress passed the ECPA with the express purpose of affording to

22

electronic communications, such as the private online communications at issue here, the same

23

protections that attach to private letters sent via the U.S. Postal Service. In recommending

24

adoption of the ECPA, the Senate Committee on the Judiciary issued the following statement:

25

A letter sent by first class mail is afforded a high level of
protection against unauthorized opening by a combination of
constitutional provisions, case law, and U.S. Postal Service statutes
and regulations. Voice communications transmitted via common
carrier are protected by title III of the Omnibus Crime Control and
Safe Streets Act of 1968. But there are no comparable Federal

26
27
28
1172205.1

- 14 -

CONSOLIDATED AMENDED CLASS ACTION COMPLAINT

1

statutory standards to protect the privacy and security of
communications transmitted by new noncommon carrier
communications services or new forms of telecommunications and
computer technology. This is so, even though American citizens
and American businesses are using these new forms of technology
in lieu of, or side-by-side with, first class mail and common carrier
telephone services.

2
3
4
5
6

54.

The Senator who introduced the Electronic Communications Privacy Act to

7

Congress described its overarching goal as follows: “We cannot let any American feel less

8

confident in putting information into an electronic mail network than he or she would in putting it

9

into an envelope and dropping it off at the Post Office.”

10

55.

In response to the threats posed by internet privacy invasions, the Department of

11

Commerce has recently recommended basic principles for internet regulation that align with the

12

goals underlying the CIPA and the ECPA. First articulated by the Department of Health and

13

Human Services more than 30 years ago, they are known as the Fair Information Practice

14

Principles (“FIPPs”). The FIPPs provide a recognized framework for privacy policies which

15

“provide a framework for balancing the need for privacy with other [commercial] interests.” The

16

GAO has provided an advisory statement affirming that the act of scanning the content of

17

customers’ private messages without consent, for purposes of profiting off of the messages’

18

content in some way – i.e. the conduct which this complaint alleges Facebook has engaged in – is

19

contrary to the FIPPS and violates the ECPA.

20

56.

Facebook’s practices of intercepting and scanning its users’ private messages, for

21

the purposes of manipulating code in third-party websites to register “Likes,” or for purposes of

22

collecting or storing information concerning URL content in the private messages, are not

23

necessary for, or incidental to, Facebook’s ability to provide users the service of sending and

24

receiving private messages, or the protection of its rights or property, and are outside the ordinary

25

course of Facebook’s business as an electronic communication service provider. Facebook has at

26

all times relevant possessed the technical capacity to offer its private message service without

27

intercepting, scanning, and storing the content of users’ private messages.

28
1172205.1

- 15 -

CONSOLIDATED AMENDED CLASS ACTION COMPLAINT

1

57.

Nowhere does Facebook disclose, including in its Statement of Rights and

2

Responsibilities and in its Data Use Policy, that as a matter of course Facebook intercepts, scans,

3

and stores the content of its users’ private messages, or that it uses the content of private

4

messages to register “Likes” on third parties’ websites.

5

58.

Facebook misleads users into believing that they have a secure, private mechanism

6

for communication – Facebook’s private messaging function – when, in fact, Facebook intercepts

7

and scans the content of private messages to gather data in an effort to bolster its “social plug-in”

8

network, to improve its marketing algorithms, and to increase its ability to profit from data about

9

Facebook users.

10

VII.

11
12

CLASS ALLEGATIONS
59.

Plaintiffs bring this nationwide class action, pursuant to Rule 23 of the Federal

Rules of Civil Procedure, individually and on behalf of all members of the following Class:

13

All natural-person Facebook users located within the United
States who have sent or received private messages that included
URLs in their content, from within two years before the filing of
this action up through and including the date when Facebook
ceased its practice.3

14
15
16

60.

Excluded from the Class are the following individuals and/or entities: Facebook

17

and its parents, subsidiaries, affiliates, officers and directors, current or former employees, and

18

any entity in which Facebook has a controlling interest; all individuals who make a timely

19

election to be excluded from this proceeding using the correct protocol for opting out; any and all

20

federal, state or local governments, including but not limited to their departments, agencies,

21

divisions, bureaus, boards, sections, groups, counsels and/or subdivisions; and all judges assigned

22

to hear any aspect of this litigation, as well as their immediate family members.

23
24

61.

before the Court determines whether certification is appropriate.

25
26

Plaintiffs reserve the right to modify or amend the definition of the proposed Class

62.

The Class is so numerous that joinder of all members is impracticable. On

information and belief, there are more than 166 million Facebook account holders in the United

27
28

3

On information and belief, Facebook ceased this illegal practice at some point after it was
exposed in October 2012. This date will be determined through discovery.
1172205.1

- 16 -

CONSOLIDATED AMENDED CLASS ACTION COMPLAINT

1

States. The number of separate individuals who sent private messages via Facebook, where such

2

message included URLs in the content, within two years before the filing of this action, is likely

3

in the millions, and is identifiable and ascertainable based on Facebook’s records.

4
5

63.

There are questions of law or fact common to the Class that will drive the

resolution of this case. These questions include, but are not limited to, the following:

6

a.

Whether Facebook intentionally intercepted, endeavored to intercept, or

7

procured any other person to intercept or endeavor to intercept Plaintiffs’ and Class Members’

8

electronic communications sent via Facebook;

9

b.

Whether Facebook intentionally used, or endeavored to use, the contents of

10

Plaintiffs’ and Class Members’ electronic communications sent via Facebook, knowing or having

11

reason to know that the information was obtained in violation of 18 U.S.C. § 2511(1)(d);

12

c.

Whether Facebook acted intentionally in violating privacy rights;

13

d.

Whether Facebook acquired any “contents” of Plaintiffs’ and Class

14

Members’ private messages, within the meaning of 18 U.S.C. § 2510(8);

15
16

e.

Facebook were “electronic communications” within the meaning of 18 U.S.C. § 2510(12);

17
18

Whether Plaintiffs’ and Class Members’ private messages sent via

f.

Whether Facebook used an “electronic, mechanical, or other device,”

within the meaning of 18 U.S.C. § 2510(5);

19

g.

The amount of statutory damages that should be levied against Facebook;

20

h.

Whether injunctive and/or declaratory relief against Facebook should be

22

i.

Whether Facebook’s conduct was likely to deceive its users;

23

j.

Whether Facebook’s conduct was unlawful; and

24

k.

Whether Plaintiffs and Class Members are entitled to restitution.

21

awarded;

25

64.

Plaintiffs’ claims are typical of the claims of the Class in that Plaintiffs and the

26

Class sent and/or received private messages via Facebook, where such messages contained URLs

27

in the content. In the process, Facebook intercepted, scanned, and acquired the private messages’

28

content, sending HTTP requests to the servers housing the web pages referred to in Plaintiffs’ and
1172205.1

- 17 -

CONSOLIDATED AMENDED CLASS ACTION COMPLAINT

1

Class Members’ private messages. Facebook further used or endeavored to use the contents of

2

Plaintiffs’ and Class Members’ private messages, where Facebook identified URLs to webpages

3

containing social plugins, by manipulating such social plugins to generate “Likes” for web pages

4

and to assemble profiles of users’ web traffic and personal preferences. Plaintiffs and Class

5

Members did not consent to the interception and uses of their private message content, which

6

form the basis for this suit. Plaintiffs and Class Members are entitled to declaratory relief,

7

statutory damages, restitution, and injunctive relief as a result of the conduct complained of

8

herein. Moreover, on information and belief, the conduct complained of herein is systemic.

9

Thus, the representative Plaintiffs, like all other Class Members, face substantial risk of the same

10

injury in the future. The factual basis of Facebook’s conduct is common to all Class Members,

11

and represents a common thread of conduct resulting in injury to all members of the Class.

12

Plaintiffs have suffered the harm alleged and have no interests antagonistic to any other Class

13

Member.

14

65.

Plaintiffs will fairly and adequately protect the interests of the Class. Plaintiffs’

15

interests do not conflict with the interests of the Class Members. Furthermore, Plaintiffs have

16

retained competent counsel experienced in class action litigation. Plaintiffs’ counsel will fairly

17

and adequately protect and represent the interests of the Class. Federal Rule of Civil Procedure

18

23(a)(4) and 23(g) are satisfied.

19

66.

Plaintiffs assert that pursuant to Federal Rule of Civil Procedure 23(b)(3),

20

questions of law or fact common to the Class Members predominate over any questions affecting

21

only individual members.

22

67.

A class action is superior to other available methods for the fair and efficient

23

adjudication of this controversy. Arguably no Class Member could afford to seek legal redress

24

individually for the claims alleged herein. Therefore, absent a class action, the Class Members

25

will continue to suffer losses and Facebook’s misconduct will proceed without remedy.

26

68.

Even if Class Members themselves could afford such individual litigation, the

27

court system could not. Given the complex legal and factual issues involved, and considering that

28

the Class could number in the tens of millions or greater, individualized litigation would
1172205.1

- 18 -

CONSOLIDATED AMENDED CLASS ACTION COMPLAINT

1

significantly increase the delay and expense to all parties and to the Court. Individualized

2

litigation would also create the potential for inconsistent or contradictory rulings. By contrast, a

3

class action presents far fewer management difficulties, allows claims to be heard which may

4

otherwise go unheard because of the relative expense of bringing individual lawsuits, and

5

provides the benefits of adjudication, economies of scale and comprehensive supervision by a

6

single court.

7

VIII. THE CLASS REPRESENTATIVES

8

69.

Plaintiff Matthew Campbell set up a Facebook account in or around January 2009,

9

which he has maintained continuously to the present. During the class period, Plaintiff Campbell

10

used Facebook’s private messaging function for purposes of sending messages containing links to

11

other websites’ URLs. At the time he established his Facebook account, Plaintiff Campbell

12

reviewed the disclosures and statements made by Facebook regarding how information is to be

13

treated on Facebook, and reasonably relying thereon, believed that the content of his private

14

Facebook messages would be seen and used only by him and his recipient.

15

70.

Plaintiff Michael Hurley set up a Facebook account in or around October 2008,

16

which he has maintained continuously to the present. During the class period, Plaintiff Hurley

17

used Facebook’s private messaging function for purposes of sending messages containing links to

18

other websites’ URLs. At the time he established his Facebook account, Plaintiff Hurley

19

reviewed the disclosures and statements made by Facebook regarding how information is to be

20

treated on Facebook, and reasonably relying thereon, believed that the content of his private

21

Facebook messages would be seen and used only by him and his recipient.

22

71.

Plaintiff David Shadpour set up a Facebook account in or around February 2006,

23

which he has maintained continuously to the present. During the class period, Plaintiff Shadpour

24

used Facebook’s private messaging function for purposes of sending messages containing links to

25

other websites’ URLs. At the time he established his Facebook account, Plaintiff Shadpour

26

reviewed the disclosures and statements made by Facebook regarding how information is to be

27

treated on Facebook, and reasonably relying thereon, believed that the content of his private

28

Facebook messages would be seen and used only by him and his recipient.
1172205.1

- 19 -

CONSOLIDATED AMENDED CLASS ACTION COMPLAINT

1

IX.

CAUSES OF ACTION

2

COUNT ONE

3

(Violations of the Electronic Communications Privacy Act,
18 U.S.C. §§ 2510 et seq.)

4
5

72.

stated fully herein.

6
7
8

73.

electronic communications.
74.

15

million users in the United States alone, and over one billion users worldwide.
76.

18

web crawlers, and social plugins.
77.

21

via Facebook’s social network.
78.

24

Members.
79.

27

Through Facebook’s scanning of users’ private messages, Facebook acquired and

continues to acquire the substance, purport, and meaning of private messages transmitted to and
from Plaintiffs and Class Members.

25
26

Pursuant to 18 U.S.C. § 2511(1)(a), Facebook intentionally intercepted, intercepts,

or endeavored or endeavors to intercept the electronic communications of Plaintiffs and Class

22
23

Facebook’s actions complained of herein are not necessary practices for providers

of electronic communications, nor are they incidental to the act of facilitating private messaging

19
20

Facebook’s actions are and have been intentional as evidenced by, inter alia, its

disclosures to developers and the design and implementation of its private messaging service,

16
17

Throughout the entirety of the conduct upon which this suit is based, Facebook’s

actions have affected interstate commerce. On information and belief, Facebook has over 166

13
14

Facebook, as a corporation, is a “person” pursuant to 18 U.S.C. § 2510(6).

75.

10

12

Plaintiffs, individually and on behalf of Class Members, assert violations of

18 U.S.C. §§ 2511(1)(a) and (1)(d) for Facebook’s unlawful interception and use of Plaintiffs’

9

11

Plaintiffs adopt and incorporate each and every allegation of this complaint as if

80.

The private messages transmitted to and from Plaintiffs and Class Members via

Facebook’s private messaging function are and have been at all relevant times electronic
communications.

28
1172205.1

- 20 -

CONSOLIDATED AMENDED CLASS ACTION COMPLAINT

1

81.

Facebook utilizes each accused device for the purpose of acquiring and

2

manipulating content from the message in the course of the message’s transmission, and such

3

course of action does not occur while the private message is in storage.

4

82.

Facebook utilized and continues to utilize one or more devices or technology

5

comprised of an electronic, mechanical, or other device or apparatus to intercept the electronic

6

communications transmitted to and from Plaintiffs and Class Members. Such devices or

7

technology include, but are not limited to, web crawlers and social plugins.

8
9

83.

and users do not use the devices for connection to the facilities.

10
11

Facebook does not furnish the above-referenced devices or technology to its users,

84.

The intercepting devices or technology are not used for the ability to send or

receive electronic communications.

12

85.

The devices or technology are not used by Facebook, operating as an electronic

13

communication service, in the ordinary course of business as a provider of an electronic

14

communication service.

15

86.

Facebook intercepted electronic communications sent by and to Plaintiffs and

16

Class Members (a) for undisclosed purposes; (b) for the purpose of generating “Likes” for third-

17

party websites; (c) for purposes of providing web traffic data to third parties; (d) for purposes of

18

cataloging user data; (e) for purposes beyond facilitating private messages sent via Facebook; (f)

19

in violation of its user agreements; (g) in violation of its public statements to users; (h) in

20

violation of federal and California law; and (i) in violation of the property rights of Plaintiffs,

21

Class Members, and third parties. These activities are not within the ordinary course of business

22

of a provider of an electronic communication service.

23

87.

Pursuant to 18 U.S.C. § 2511(1)(d), Facebook intentionally used, uses, or

24

endeavored or endeavors to use the contents of Plaintiffs’ and Class Members’ electronic

25

communications while knowing or having reason to know that it obtained the information through

26

the interception of the electronic communication in violation of 18 U.S.C. § 2511(1)(a).

27
28

88.

Facebook’s interception of and use of the contents of Plaintiffs’ and Class

Members’ electronic communications were not performed by an employee engaged in any
1172205.1

- 21 -

CONSOLIDATED AMENDED CLASS ACTION COMPLAINT

1

activity necessary for the rendition of an electronic communication service or for the protection of

2

the rights or property of Facebook.

3

89.

Facebook’s practice of intercepting, scanning, and generating “Likes” from, users’

4

private messages, are not necessary for the rendition of Facebook’s private messaging service,

5

the protection of Facebook’s rights or property, or the security of Facebook users. These scans

6

have not been undertaken in the ordinary course of business of an electronic communication

7

service, as described in 28 U.S.C. § 2510(15).

8
9

90.

communications are not electronic communication services.

10
11

Facebook’s services that are not related to the ability to send and receive electronic

91.

No party to the electronic communications alleged herein consented to Facebook’s

interception or use of the contents of the electronic communications.

12

92.

Facebook intercepts Plaintiffs’ and Class Members’ electronic communications for

13

the purpose of committing a criminal or tortious act in violation of the laws of any state, and as

14

such, it cannot obtain consent pursuant to § 2511(2)(d).

15
16

93.

As a result of Facebook’s violations of § 2511, pursuant to § 2520, Plaintiffs and

the Class Members are entitled to relief as prayed for below.

17

94.

While certain devices and/or technology have been identified in this Complaint,

18

Plaintiffs reserve the right to assert ECPA violations as to any further devices and/or technology

19

disclosed or those devices and/or technology upon which Facebook provides additional

20

information.

21

COUNT TWO

22

(Violations of the California Invasion of Privacy Act,
Cal. Penal Code §§ 630, et seq.)

23
95.

Plaintiffs adopt and incorporate each and every allegation of this complaint as if

24
stated fully herein.
25
96.

Plaintiffs, individually and on behalf of Class Members, assert violations of the

26
CIPA, California Penal Code §§ 630, et seq., specifically California Penal Code §§ 631(a) and
27
632, for Facebook’s unlawful interception and scanning of the contents of its users’ private
28
1172205.1

- 22 -

CONSOLIDATED AMENDED CLASS ACTION COMPLAINT

1

messages. Facebook uses this information about the sender and recipient for purposes of

2

profiling, marketing, and advertising.

3

97.

California Penal Code § 630 provides that “The Legislature hereby declares that

4

advances in science and technology have led to the development of new devices and techniques

5

for the purpose of eavesdropping upon private communications and that the invasion of privacy

6

resulting from the continual and increasing use of such devices and techniques has created a

7

serious threat to the free exercise of personal liberties and cannot be tolerated in a free and

8

civilized society.”

9

98.

Facebook’s acts in violation of the CIPA occurred in the State of California

10

because those acts resulted from business decisions, practices, and operating policies that

11

Facebook developed, implemented, and utilized in the State of California and which are unlawful

12

and constitute criminal conduct in the state of Facebook’s residence and principal business

13

operations. Facebook’s implementation of its business decisions, practices, and standard ongoing

14

policies that violate the CIPA took place and continue to take place in the State of California.

15

Facebook profited and continues to profit in the State of California as a result of its repeated and

16

systemic violations of the CIPA. Facebook’s unlawful conduct, which occurred in the State of

17

California, harmed and continues to harm Plaintiffs and Class Members. Facebook developed,

18

designed, built, and physically placed in California one or more of the accused devices or

19

technology employed by Facebook to violate the CIPA.

20
21

99.

which included URLs, via Facebook’s services.

22
23

100.

Facebook is not and was not at any time a party to Plaintiffs’ and Class Members’

private messages.

24
25

Plaintiffs and Class Members sent and received private messages, the contents of

101.

The private messages exchanged among Plaintiffs and Class Members are

messages.

26

102.

These messages are communications among Plaintiffs and Class Members.

27

A.

Violations of California Penal Code § 631(a)

28

103.

Pursuant to California Penal Code § 7, Facebook, a corporation, is a “person.”

1172205.1

- 23 -

CONSOLIDATED AMENDED CLASS ACTION COMPLAINT

1

104.

Facebook uses a “machine,” “instrument,” “contrivance,” or “in any other manner”

2

is able to, read or to learn the content or meaning of Plaintiffs’ and Class Members’ private

3

messages.

4
5

105.

Facebook acts willfully when it reads, attempts to read, or learns the content or

meaning of Plaintiffs’ and Class Members’ private messages.

6

106.

Facebook does not have the consent of any party to the communication, or it acts

7

in an unauthorized manner, when it reads, attempts to read, or learns the content or meaning of

8

Plaintiffs’ and Class Members’ private messages.

9
10

107.

communication.”

11
12

Plaintiffs’ and Class Members’ private messages are “any message, report, or

108.

At the time Facebook reads, attempts to read, or learns the content or meaning of

Plaintiffs’ and Class Members’ private messages, the private messages are in transit.

13

109.

At the time Facebook reads, attempts to read, or learns the content or meaning of

14

Plaintiffs’ and Class Members’ private messages, the private messages are passing over a wire,

15

line, or cable.

16

110.

Private messages – coded, written messages sent electronically to remote locations

17

– are telegraphs within the meaning of the CIPA and this section of CIPA. As such, the wires,

18

lines, cables and/or instruments which carry and facilitate the transmission of Plaintiffs’ and Class

19

Members’ private messages are telegraph wires, lines, cables and/or instruments within the

20

meaning of the CIPA and CIPA § 631(a).

21

111.

Plaintiffs and Class Members do not consent, expressly or impliedly, to

22

Facebook’s eavesdropping upon and recording of their private messages. Facebook does not

23

disclose material information to its users relating to its attempts at, among other things,

24

intercepting, scanning and reading the contents of users’ private messages.

25

112.

There is no knowledge or expectation among Plaintiffs and Class Members

26

regarding the extent of Facebook’s reading of message content, learning about the content or

27

meaning of users’ private messages, the acquisition of such content, the collection of such

28

content, or the manipulation of such content. Each and every one of these actions extends beyond
1172205.1

- 24 -

CONSOLIDATED AMENDED CLASS ACTION COMPLAINT

1

the normal occurrences, requirements, and expectations regarding the facilitation and

2

transmission of Facebook’s private messages.

3

B.

Violations of California Penal Code § 632

4

113.

Pursuant to California Penal Code §§ 7 and 632(b), Facebook, a corporation, is a

5

“person.”

6

114.

California Penal Code § 632 prohibits eavesdropping upon or the recording of any

7

confidential communication, including those occurring by telephone, telegraph or other device,

8

through the use of an amplification or electronic recording device without the consent of all

9

parties to the communication.

10
11

115.

Facebook intentionally and without the consent of any party to the communication

eavesdrops upon and/or records the contents of Plaintiffs’ and Class Members’ private messages.

12

116.

Facebook uses electronic amplifying or recording devices, including its web

13

crawlers and social plugins, to eavesdrop upon and to record Plaintiffs’ and Class Members’

14

private messages, for purposes independent and unrelated to storage.

15
16

117.

Plaintiffs’ and Class Members’ private messages are confidential communications

with specifically identified and designated recipients.

17

118.

At the time Plaintiffs and Class Members transmit private messages via Facebook,

18

their communications are confidential because the communications are confined to those persons

19

specified as recipients in the destination address fields. There neither would nor could be any

20

expectation that a third party, such as Facebook, would act in any manner other than to facilitate

21

the communication of the private message between the sender and the intended recipient or

22

recipients. There certainly would not and could not be any expectation that Facebook – a third

23

party – would scan the contents of the private message in an effort to learn and profit from the

24

information contained therein.

25

119.

There is no knowledge or expectation among Plaintiffs and Class Members

26

regarding the extent of Facebook’s reading of users’ private message content, learning about the

27

content or meaning of the private messages, acquiring and collecting the content of such

28

messages, and manipulating the content of such messages – each action being beyond the normal
1172205.1

- 25 -

CONSOLIDATED AMENDED CLASS ACTION COMPLAINT

1

occurrences, requirements, and expectations regarding the facilitation and transmission of private

2

messages via Facebook.

3
4

120.

Plaintiffs’ and Class Members’ private messages sent via Facebook are carried on

among the parties by means of an electronic device that is not a radio.

5

121.

Plaintiffs and Class Members do not consent, expressly or impliedly, to

6

Facebook’s eavesdropping upon and recording of their private messages. Facebook does not

7

disclose material information to its users relating to its attempts at reading, scanning, acquiring,

8

collecting, and manipulating the contents of users’ private messages.

9

122.

While Plaintiffs have identified certain accused devices and/or technology in this

10

Complaint, Plaintiffs reserve the right to assert violations of California Penal Code §§ 631 and

11

632 as to any further devices or technology subsequently discovered or any devices or technology

12

upon which Facebook provides additional information.

13
14

123.

As a result of Facebook’s violations of California Penal Code §§ 631 and 632,

Plaintiffs and the Class are entitled to relief as prayed for below.

15

COUNT THREE

16

(Violations of California’s Unfair Competition
Law, Cal. Bus. & Prof. Code § 17200, et seq.)

17
124.

Plaintiffs and Class Members reallege and incorporate by reference every

18
allegation set forth in the preceding paragraphs as though alleged in this Count.
19
125.

Facebook’s conduct as alleged herein constitutes unfair, unlawful, or fraudulent

20
business acts or practices as proscribed by Section 17200, et seq., of the California Business &
21
Professions Code (“UCL”).
22
126.

Facebook’s conduct constitutes “unlawful” business acts or practices by virtue of

23
Defendant’s violation of the Electronic Communications Privacy Act, 18 U.S.C. §§ 2510, et seq.,
24
California Penal Code §§ 631(a) and 632.
25
127.

Plaintiffs reasonably relied on Facebook’s representations that Plaintiffs’ private

26
messages are viewable only by the sender and the recipient and, as a result, engaged in “private”
27
messaging on Facebook. Facebook failed to disclose to Plaintiffs and members of the general
28
1172205.1

- 26 -

CONSOLIDATED AMENDED CLASS ACTION COMPLAINT

1

public that it systematically reviews and captures the content of, and metadata associated with,

2

Plaintiffs’ private messages. Facebook failed to disclose that it aggregates the content and data of

3

private messages, using it to turn a profit. Facebook’s Data Use Policy fails to disclose

4

Facebook’s acts or practices, and together with its statements that private messages are viewable

5

only by the sender and the recipient, are likely to deceive members of the public. As a result,

6

Facebook’s conduct constitutes “fraudulent” business acts or practices.

7

128.

Plaintiffs have an interest in controlling the disposition and dissemination of their

8

private messages. Contrary to Plaintiffs’ interests, Facebook exercised control over the content of

9

Plaintiffs’ private messages, exploiting it for profit without Plaintiffs’ consent. As a result,

10

Facebook’s conduct constitutes “unfair” business acts or practices.

11
12

129.

Plaintiffs have suffered injury in fact and lost money or property as a result of

Facebook’s business acts or practices.

13

130.

Plaintiffs and Class Members seek an order to enjoin Facebook from such

14

unlawful, unfair, and fraudulent business acts or practices, and to restore to Plaintiffs and Class

15

Members their interest in money or property that may have been acquired by Facebook by means

16

of unfair competition.

17

JURY TRIAL DEMANDED

18
19

Pursuant to Federal Rule of Civil Procedure 38, Plaintiffs, individually and on behalf of
the Class they seek to represent, demand a jury on any issue so triable of right by a jury.

20

PRAYER FOR RELIEF

21
22

WHEREFORE, Plaintiffs, on behalf of themselves and all Class Members, request
judgment be entered against Facebook and that the Court grant the following:

23

1.

An order determining that this action may be maintained as a class action under

24

Rule 23 of the Federal Rules of Civil Procedure, that Plaintiffs are proper class representatives,

25

that Plaintiffs’ attorneys be appointed Class counsel pursuant to Rule 23(g) of the Federal Rules

26

of Civil Procedure, and that Class notice be promptly issued;

27
28

2.

Judgment against Facebook for Plaintiffs’ and Class Members’ asserted causes of

action;
1172205.1

- 27 -

CONSOLIDATED AMENDED CLASS ACTION COMPLAINT

1

3.

Appropriate declaratory relief against Facebook;

2

4.

Preliminary and permanent injunctive relief against Facebook;

3

5.

Restitution pursuant to the California Business and Professions Code, Section

4

17200, et seq., including reimbursement to the Plaintiffs and all Class Members of all losses

5

incurred by them as a result of the privacy violations described herein and also including

6

disgorgement of all amounts accruing to Facebook because of its unlawful, unfair, and/or

7

fraudulent business practices;

8

6.

Actual damages suffered by Plaintiffs in an amount according to proof at trial;

9

7.

An award of damages to Plaintiffs and Class Members pursuant to 18 U.S.C.

10

§ 2520;

11
12

8.

Penal Code § 637.2;

13
14

An award of damages to Plaintiffs and Class Members pursuant to California

9.

An award of reasonable attorney’s fees and other litigation costs reasonably

incurred; and

15

10.

Any and all relief to which Plaintiffs and the Class may be entitled.

16
17

Dated: April 25, 2014

LIEFF CABRASER HEIMANN & BERNSTEIN, LLP

18
By:

19

/s/ Michael W. Sobol
Michael W. Sobol

20
Michael W. Sobol (State Bar No. 194857)
[e-mail]
Melissa Gardner (State Bar No. 289096)
[e-mail]
LIEFF CABRASER HEIMANN & BERNSTEIN, LLP
275 Battery Street, 29th Floor
San Francisco, CA 94111-3339
Telephone: [phone]
Facsimile: 415.956.1008

21
22
23
24
25
26
27
28
1172205.1

- 28 -

CONSOLIDATED AMENDED CLASS ACTION COMPLAINT

1

Rachel Geman
[e-mail]
Nicholas Diamand
[e-mail]
LIEFF CABRASER HEIMANN & BERNSTEIN, LLP
250 Hudson Street, 8th Floor
New York, NY 10013-1413
Telephone: [phone]
Facsimile: 212.355.9592

2
3
4
5
6

Hank Bates (State Bar No. 167688)
[e-mail]
Allen Carney
[e-mail]
David Slade
[e-mail]
CARNEY BATES & PULLIAM, PLLC
11311 Arcade Drive
Little Rock, AR 72212
Telephone: [phone]
Facsimile: 501.312.8505

7
8
9
10
11
12

Jeremy A. Lieberman
Lesley F. Portnoy
[e-mail]
POMERANTZ, LLP
600 Third Avenue, 20th Floor
New York, NY 10016
Telephone: [phone]
Facsimile: 212.661.8665

13
14
15
16

Patrick V. Dahlstrom
[e-mail]
POMERANTZ, LLP
10 S. La Salle Street, Suite 3505
Chicago, IL 60603
Telephone: [phone]
Facsimile: 312.377.1184

17
18
19
20

Jon Tostrud (State Bar No. 199502)
[e-mail]
TOSTRUD LAW GROUP, PC
1925 Century Park East, Suite 2125
Los Angeles, CA 90067
Telephone: [phone]
Facsimile: 310.278.2640

21
22
23
24
25

Attorneys for Plaintiffs and the Proposed Class

26
27
28
1172205.1

- 29 -

CONSOLIDATED AMENDED CLASS ACTION COMPLAINT