Campbell et al v. Facebook Inc.

Filing 31

RESPONSE (re 29 MOTION to Dismiss Consolidated Amended Complaint ) filed byMatthew Campbell, Michael Hurley, David Shadpour. (Attachments: # 1 Declaration of Michael W. Sobol, # 2 Exhibit A, # 3 Exhibit B, # 4 Exhibit C, # 5 Exhibit D)(Sobol, Michael) (Filed on 7/30/2014)

1
2
3
4
5
6
7
8
9
10
11

Michael W. Sobol (State Bar No. 194857)
[e-mail]
Melissa Gardner (State Bar No. 289096)
[e-mail]
LIEFF CABRASER HEIMANN & BERNSTEIN, LLP
275 Battery Street, 29th Floor
San Francisco, CA 94111-3339
Telephone: [phone]
Facsimile: 415.956.1008
Rachel Geman
[e-mail]
Nicholas Diamand
[e-mail]
LIEFF CABRASER HEIMANN & BERNSTEIN, LLP
250 Hudson Street, 8th Floor
New York, NY 10013-1413
Telephone: [phone]
Facsimile: 212.355.9592

16

Patrick V. Dahlstrom
[e-mail]
POMERANTZ, LLP
10 S. La Salle Street, Suite 3505
Chicago, Illinois 60603
Telephone: [phone]
Facsimile: 312.377.1184

Hank Bates (State Bar No. 167688)
[e-mail]
Allen Carney
[e-mail]
David Slade
[e-mail]
CARNEY BATES & PULLIAM, PLLC
11311 Arcade Drive
Little Rock, AR 72212
Telephone: [phone]
Facsimile: 501.312.8505

17

Jeremy A. Lieberman
Lesley F. Portnoy
[e-mail]
POMERANTZ, LLP
600 Third Avenue, 20th Floor
New York, New York 10016
Telephone: [phone]
Facsimile: 212.661.8665

Attorneys for Plaintiffs and the Proposed Class

12
13
14
15

18

UNITED STATES DISTRICT COURT

19

NORTHERN DISTRICT OF CALIFORNIA

20
21
22
23

MATTHEW CAMPBELL, MICHAEL
HURLEY, and DAVID SHADPOUR, on
behalf of themselves and all others
similarly situated,

24

Plaintiffs,

25

v.

26

FACEBOOK, INC.,

27

Case No. C 13-05996 PJH
PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
HEARING
Date: September 17, 2014
Time: 9:00 a.m.
Place: Courtroom 3, 3rd Floor
|
The Honorable Phyllis J. Hamilton

Defendant.

28
PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH

1

TABLE OF CONTENTS

2
3
4

Page
I.
II.

5
6
7
8

III.
IV.

9
10
11
12
13
14
15
16
17
18
19
20

INTRODUCTION .................................................................................................. 1
FACTUAL BACKGROUND ................................................................................. 3
A.
Facebook’s Private Message Service And Its Interceptions Of
Content Within Those Messages................................................................. 4
B.
Facebook’s Misleading Disclosures............................................................ 5
C.
The Role of Intercepting User Content On Facebook’s “Ordinary
Course Of Business.” .................................................................................. 5
LEGAL STANDARD ............................................................................................. 6
ARGUMENT .......................................................................................................... 6
A.
Facebook Violated The Electronic Communications Privacy Act. ............ 7
1.
Intercepting And Using The Contents Of Private
Correspondence Is Not Within Facebook’s Ordinary Course
Of Business. .................................................................................... 7
a.
The Plain Meaning Of Section 2510(5)(a)(ii),
ECPA’s Statutory Scheme, And The Legislative
History All Make Clear That The “Ordinary Course
Of Business” Exception Is A Narrow One.......................... 8
b.
Virtually All Courts Addressing “Ordinary Course
Of Business” Interpret The Exception Narrowly. ............... 9
c.
Facebook’s Cases Do Not Support Its Motion.................. 11
d.
Facebook’s Reliance On An Opinion About
Publicly-Disclosed Practices Is Particularly
Misplaced. ......................................................................... 12
2.
Plaintiffs Did Not Consent To Facebook’s Interception And
Use Of Their Private Messages. .................................................... 14
a.
Facebook Did Not Obtain Express Consent. .................... 15
b.
Facebook Did Not Obtain Implied Consent. ..................... 18
3.

21
22
23
24
25
26
27
28

V.

Facebook “Intercepted” Communications “In
Transmission.” .............................................................................. 19
B.
Facebook Violated California Penal Code § 631 ...................................... 19
C.
Facebook Violated California Penal Code § 632 ...................................... 19
D.
Plaintiffs’ Unfair Competition Law Claims Are Adequately
Pleaded. ..................................................................................................... 20
1.
Plaintiffs Have Standing Under the UCL. .................................... 20
2.
Facebook Violated the Unfair Competition Law. ......................... 24
E.
Plaintiffs Are Entitled To Seek Injunctive Relief. .................................... 25
F.
Leave To Amend Should Be Granted If Any Of Facebook’s Motion
Is Granted. ................................................................................................. 25
CONCLUSION ..................................................................................................... 26
-i-

PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH

1

TABLE OF AUTHORITIES

2

Page

3

Cases
Arias v. Mutual Cent. Alarm Serv.,
202 F.3d 553 (2d Cir. 2000) ....................................................................................................... 14
Ashcroft v. Iqbal,
556 U.S. 662 (2009) ............................................................................................................... 6, 19
Berry v. Funk,
146 F.3d 1003 (D.C. Cir. 1998) ........................................................................................... 10, 18
Brennan v. Concord EFS, Inc.,
369 F.Supp.2d 1127 (N.D. Cal. 2005) ....................................................................................... 19
City of Los Angeles v. Lyons,
461 U.S. 95 (1983) ..................................................................................................................... 25
Claridge v. RockYou, Inc.,
785 F. Supp. 2d 855 (N.D. Cal. 2011) ....................................................................................... 23
Cohen v. Facebook, Inc.,
798 F. Supp. 2d 1090 (N.D. Cal. 2011) ..................................................................................... 15
Deal v. Spears,
980 F.2d 1153 (8th Cir. 1992).............................................................................................. 10, 18
Deering v. CenturyTel, Inc.,
No. 10-63, 2011 U.S. Dist. LEXIS 51930 (D. Mont. May 16, 2011) ........................................ 17
Dep’t of Justice v. Reporters Comm. for Freedom of the Press,
489 U.S. 749 (1989) ..................................................................................................................... 6
Doe 1 v. AOL, LLC,
719 F. Supp. 2d 1102 (N.D. Cal. 2010) ..................................................................................... 23
Downing v. Mun. Court,
88 Cal. App. 2d 345 (Cal. App. 1948) ....................................................................................... 22
Dukes v. ADS Alliance Data Sys.,
2006 U.S. Dist. LEXIS 84311 (S.D. Ohio Nov. 20, 2006) ........................................................ 15
Dunbar v. Google, Inc.,
No. 10-194, 2011 U.S. Dist. LEXIS 157932 (E.D. Tex. May 23, 2011) ................................... 10
Duncan v. Walker,
533 U.S. 167 (2001) ..................................................................................................................... 8
Edwards v. First Am. Corp.,
610 F.3d 514 (9th Cir. 2010)...................................................................................................... 21
Farmers Ins. Exch. v. Superior Court,
2 Cal.4th 377 (Cal. 1992) ........................................................................................................... 24
Fisher v. United States,
425 U.S. 391 (1976) ..................................................................................................................... 6
FMC Corp. v. Capital Cities/ABC, Inc.,
915 F.2d 300 (7th Cir. 1990)...................................................................................................... 23
G.S. Rasmussen & Assocs. v. Kalitta Flying Serv.,
958 F.2d 896 (9th Cir. 1992)...................................................................................................... 22

4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

- ii -

PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

TABLE OF AUTHORITIES
(continued)
Page
Gilligan v. Jamco Dev. Corp.,
108 F.3d 246 (9th Cir. 1997)........................................................................................................ 6
Griggs-Ryan v. Smith,
904 F.2d 112 (1st Cir. 1990) ...................................................................................................... 18
Hall v. EarthLink Network, Inc.,
396 F.3d 500 (2d Cir. 2005) ................................................................................................. 11, 12
Haro v. Sebelius,
747 F.3d 1099 (9th Cir. 2014).................................................................................................... 25
Hernandez v. Path, Inc.,
2012 U.S. Dist. LEXIS 151035 (N.D. Cal. Oct. 17, 2012) ........................................................ 19
In re Facebook Privacy Litig.,
791 F. Supp. 2d 705 (N.D. Cal. 2011) ....................................................................................... 23
In re Facebook Privacy Litig.,
No. 12-15619, 2014 U.S. App. LEXIS 8679 (9th Cir. May 8, 2014) ........................................ 23
In re Google Inc. Gmail Litig. (“Gmail”),
No. 13-02430, 2013 U.S. Dist. LEXIS 172784
(N.D. Cal. Sept. 26, 2013)................................................................................................... passim
In re Google Inc. Gmail Litig.,
No. 13-02430, 2014 U.S. Dist. LEXIS 36957 (N.D. Cal. Mar. 18, 2014) ................................. 15
In re Google, Inc. Privacy Policy Litig.,
No. 12-01382, 2013 U.S. Dist. LEXIS 171124 (N.D. Cal. Dec. 3, 2013) ................................. 12
In re iPhone Application Litig.,
No. 11-02250, 2011 U.S. Dist. LEXIS 106865
(N.D. Cal. Sept. 20, 2011).......................................................................................................... 23
In re Pharmatrak, Inc. Privacy Litig,
329 F.3d 9 (1st Cir. 2003) .............................................................................................. 14, 15, 18
In re Tobacco II Cases,
46 Cal. 4th 298 (Cal. 2009) ........................................................................................................ 25
In re VistaPrint Corp Mktg. & Sales Practices Litig.,
2009 U.S. Dist. LEXIS 77509 (S.D. Tex. Aug. 31, 2009) ......................................................... 17
Johnson v. Trans Ag.,
770 F.2d 752 (9th Cir. 1984)........................................................................................................ 7
Kaiser Aetna v. United States,
444 U.S. 164 (1979) ................................................................................................................... 22
Kight v. CashCall, Inc.,
200 Cal. App. 4th 1377 (Cal. App. 2011) .................................................................................. 20
Kirch v. Embarq Mgmt. Co.,
702 F.3d 1245 (10th Cir. 2012)............................................................................................ 11, 12
Klamath Water Users Protective Ass’n v. Patterson,
204 F.3d 1206 (9th Cir. 2000).................................................................................................... 15
Korea Supply Co. v. Lockheed Martin Corp.,
29 Cal. 4th 1134 (Cal. 2003) ...................................................................................................... 24
- iii -

PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

TABLE OF AUTHORITIES
(continued)
Page
Kremen v. Cohen,
337 F.3d 1024 (9th Cir. 2003).................................................................................................... 22
Kwikset Corp. v. Superior Court,
51 Cal. 4th 310 (Cal. 2011) ............................................................................................ 21, 23, 24
MacDonald v. Ford Motor Co.,
No. 13-02988, 2014 U.S. Dist. LEXIS 44858
(N.D. Cal. Mar. 31, 2014) .......................................................................................................... 24
Marquis v. Google, Inc.,
No. 11-02808, Mass. Super. Ct. (Jan. 17, 2012) ....................................................................... 10
Mohamed v. Jeppesen Dataplan, Inc.,
579 F.3d 943 (9th Cir. 2009)........................................................................................................ 6
Moskal v. United States,
498 U.S. 103 (1990) ..................................................................................................................... 7
Neubronner v. Milken,
6 F.3d 666 (9th Cir. 1993).......................................................................................................... 25
Opperman v. Path, Inc.,
No. 13-00453, 2014 U.S. Dist. LEXIS 67225
(N.D. Cal. May 14, 2014) .......................................................................................................... 23
Ortega v. O’Connor,
146 F.3d 1149 (9th Cir. 1998)...................................................................................................... 6
People v. Kwok,
63 Cal. App. 4th 1236 (Cal. App. 1998) .................................................................................... 22
Petersen v. Boeing Co.,
715 F.3d 276 (9th Cir. 2013)...................................................................................................... 25
Quon v. Arch Wireless Operating Co., Inc.,
529 F.3d 892 (9th Cir. 2008)...................................................................................................... 17
Rogers v. Ulrich,
52 Cal. App. 3d 894 (1975)........................................................................................................ 20
Shroyer v. New Cingular Wireless Servs., Inc.,
606 F.3d 658 (9th Cir. 2010)........................................................................................................ 6
Shulman v. Group W Productions, Inc.,
18 Cal. 4th 200 (Cal. 1998) .................................................................................................... 3, 20
Siracusano v. Matrixx Initiatives, Inc.,
585 F.3d 1167 (9th Cir. 2009)...................................................................................................... 6
Thomasson v. GC Servs. Ltd. P’ship.,
321 F. App’x 557 (9th Cir. 2008) .............................................................................................. 20
United States v. Bass,
404 U.S. 336 (1971) ..................................................................................................................... 7
United States v. Murdock,
63 F.3d 1391 (6th Cir. 1995)...................................................................................................... 10
United States v. Staves,
383 F.3d 977 (9th Cir. 2004)...................................................................................................... 18
- iv -

PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

TABLE OF AUTHORITIES
(continued)
Page
United States v. Szymuszkiewicz,
622 F.3d 701 (7th Cir. 2010)...................................................................................................... 11
Valentine v. Wideopen West Fin., LLC,
288 F.R.D. 407 (N.D. Ill. 2012) ................................................................................................. 14
Watkins v. L.M. Berry & Co.,
704 F.2d 577 (11th Cir. 1983)........................................................................................ 10, 14, 18
Whalen v. Roe,
429 U.S. 589 (1977) ..................................................................................................................... 6
Statutes
18 U.S.C. § 2510 et seq. ....................................................................................................... 1, 7, 8, 9
18 U.S.C. § 2511(1)(a) ..................................................................................................................... 7
Cal. Bus. & Prof. Code § 17200 et seq. ........................................................................................... 1
Cal. Civ. Code § 654 ...................................................................................................................... 22
Cal. Pen. Code § 631 et seq. ............................................................................................................ 1
Cal. Pen. Code § 632(a) ................................................................................................................. 20
Rules
Fed. R. Civ. P. 15(a)(2) .................................................................................................................. 25
Other Authorities
CAL. CONST., Art. I, § 1 ................................................................................................................ 6
S. Rep. No. 99-541 (1986) ............................................................................................................... 9

17
18
19
20
21
22
23
24
25
26
27
28
-v-

PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH

1

ISSUES TO BE DECIDED

2

1. Does Plaintiffs’ Consolidated Amended Complaint adequately set forth facts, which if

3

considered in a light most favorable to Plaintiffs and taken as true for purposes of this

4

motion, state claims upon which relief may be granted?

5

2. Does Plaintiffs’ Consolidated Amended Complaint adequately set forth facts, which if

6

considered in a light most favorable to Plaintiffs and taken as true for purposes of this

7

motion, demonstrate UCL standing in that they have suffered injury in fact, by

8

alleging violation of federally protected rights, and have lost property or money, by

9

alleging that Facebook has deprived them of exclusive use of their private

10

correspondence?

11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
- vi -

PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH

1
2

I.

INTRODUCTION
Defendant Facebook, Inc.’s (“Facebook’s”) motion to dismiss should be denied because it

3

prematurely and improperly seeks to litigate questions of fact and misstates the relevant law.

4

Contrary to Facebook’s incorrect argument that this is copycat litigation, Plaintiffs’ detailed

5

Consolidated Amended Complaint (“CAC”) centers on practices unique to Facebook.

6

Specifically, on October, 2012, security researchers published proof that Facebook was

7

scanning its users’ private messages to learn the substance of those communications. Facebook

8

employed devices to seek out URLs in private messages, and to include that information in

9

profiles of its users. Facebook thus added code to its messaging process that was unnecessary for

10

any purpose other than to enable it to analyze the substance of its users’ messages and determine

11

their meaning, as well as to tie that meaning back to the users.

12

Once these practices were brought to light, Facebook, by its own admission, ceased these

13

scanning practices without changing its disclosures, underscoring that it in no way needed to

14

access the content of messages in order to provide its messaging service, and that its scanning

15

practices were in no way disclosed to its users.

16

The acts articulated in the CAC violate the Electronic Communications Privacy Act,

17

18 U.S.C. §§ 2510 et seq. (“ECPA”), and the California Invasion of Privacy Act, Cal. Penal Code

18

§§ 631 et seq. (“CIPA”) – which broadly prohibit the interception of private communications for

19

purposes of acquiring the substance of those communications – as well as California’s Unfair

20

Competition Law, Cal. Bus. & Prof. Code §§ 17200 et seq. (“UCL”), which prohibits unlawful,

21

unfair, and fraudulent business practices.

22

Plaintiffs’ ECPA Claims – Facebook argues that any “systematic conduct . . . that

23

generates revenue for a company” is exempt from liability under ECPA’s “ordinary course of

24

business” exception. Defendant’s Motion to Dismiss (“Mot.”) at 15. However, and

25

unsurprisingly, no court has ever held that secretly acquiring the substance of private

26

communications is within the ordinary course of a company’s business, and the case law cited in

27

Facebook’s motion is inapposite. Facebook’s circular logic that any conduct done by a business

28

is therefore within the ordinary course of business lacks textual, precedential, or logical support.
-1-

PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH

1

Facebook also submits that its loosely-worded terms of service mean that users have

2

granted explicit consent to these practices. Yet, nothing in Facebook’s disclosures remotely

3

suggests that it would analyze the content of users’ messages – messages that Facebook in fact

4

repeatedly, publicly, characterizes as “private” – to scan them for their substance, and then

5

catalog the information contained in them in a data profile. Facebook’s implied consent argument

6

is equally infirm, and raises questions of fact outside the CAC by suggesting that Facebook’s

7

separate practice of allegedly previewing URLs has anything to do with the issues here.

8
9
10

Finally, Facebook’s argument that its interceptions of private messages did not occur “in
transmission” is another attempt to insert facts not pled in the CAC – indeed, facts in conflict with
those pled – and, thus, is wholly inappropriate to consider at this stage of the litigation.

11

Plaintiffs’ CIPA Claims – Facebook’s argument that Plaintiffs’ communications were

12

“entirely contained” within Facebook’s network has no basis in fact, and is expressly contradicted

13

by Plaintiffs’ allegations. To the extent that Facebook renews its argument regarding consent in

14

the context of CIPA, such an argument fails for the same reasons as it fails under ECPA. Further,

15

the communications at issue are “confidential” within the meaning of CIPA, and Facebook’s

16

activities amounted to “eavesdropping” under the statute.

17

Plaintiffs’ UCL Claims –California law recognizes private communications as property

18

and Plaintiffs have pled facts sufficient to confer standing to assert a UCL claim. Similarly, the

19

facts set forth in the CAC sufficiently articulate a violation of each prong of the UCL. Facebook

20

unlawfully violated both ECPA and CIPA; it unfairly sacrificed the rights of consumers in pursuit

21

of its personal gain, and it fraudulently misled both Plaintiffs and the public that “private”

22

messages sent over Facebook would be just that – private.

23

Plaintiffs’ Request for Injunctive Relief – Finally, Facebook’s concession that it

24

abandoned its invasive practices once they were uncovered should not preclude injunctive relief

25

here, as there is no guarantee that Facebook will not resume its conduct at any point in the future.

26

While Facebook attempts to recast its conduct as innocuous routing protocol coupled with

27

“anonymized”1 observation, in reality it has committed a breach of trust from which every

28

1

Here, again, Facebook advances facts in not pled in the CAC. Specifically, it claims that the
Footnote continued on next page
-2-

PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH

1

facilitator of communications is prohibited: it acquired the substance of its users’ communications

2

without their consent. These acts are the twenty-first-century equivalent of AT&T eavesdropping

3

on each of its customers’ phone conversations, or of a common carrier taking information from

4

private correspondence; acts which would uniformly be condemned as egregious and illegal

5

invasions of privacy under any circumstance. As the California Supreme Court has said:

6

[A] measure of personal isolation and personal control over the
conditions of its abandonment is of the very essence of personal
freedom and dignity…. A [person]…whose conversations may be
overheard at the will of another…is less of a [person], has less
human dignity, on that account. He who may intrude upon another
at will is the master of the other and, in fact, intrusion is a primary
weapon of the tyrant.

7
8
9
10
11

Shulman v. Group W Productions, Inc., 18 Cal. 4th 200, 231 (Cal. 1998) (citation omitted).

12

II.

13

FACTUAL BACKGROUND
Facebook systematically intercepted its users’ private messages to acquire information

14

concerning their content. CAC¶¶ 25-58. Specifically, when users employed Facebook’s private

15

message service, Facebook surreptitiously utilized devices to scan the contents of those messages,

16

in order to determine whether users had included links to other websites within them. Id. ¶¶ 17-

17

24, 31, 34, 38-39, 47-48. When the message contained a link to a third party website, Facebook’s

18

routing procedures and code would then notate that link, in that it would add it as a data point on

19

user profiles it assembled for both the sender and recipient of the message. It then used that

20

information to inflate the “Like” counters on websites associated with Facebook. Id.

21

Facebook in no way needed to engage in this practice to provide its private messaging

22

service. Id. ¶¶ 22-58. In fact, actions that Facebook attempts to characterize as (1) minimal,

23

technical steps incident to providing its most basic services and (2) procedures openly disclosed

24

to its users were, in fact, so opaque and so far outside the norm that, when exposed, the story

25

made national news in the Wall Street Journal. Id. ¶¶ 35-39. Within a month of being exposed in

26
27
28

Footnote continued from previous page
data points assembled from its message scans are “anonymous and aggregate” Mot. at 1
(emphasis original). Plaintiffs have instead asserted that these data points are precisely what
Facebook uses in assembling its individualized user profiles. CAC ¶¶ 41-49.
-3-

PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH

1

the press, Facebook quietly ceased its practice of intercepting private messages’ content. Id.

2

¶¶ 39, 59 n.3. This about-face had no impact on Facebook’s ability to transmit private messages

3

or protect the security of its services. Id. ¶ 39. Nor did it occasion a revision to any of

4

Facebook’s disclosures to its users, an implicit admission that the practice was never disclosed to

5

users in the first place. Id.

6

A.

7
8
9

Facebook’s Private Message Service And Its Interceptions Of Content Within
Those Messages.

Recognizing that users do not wish for every activity on Facebook to be part of a record,
Facebook offers a “private message” service as a counterpoint to public or group posts. Id. ¶¶ 20-

10

24. The service combines email, chat, text messaging, and in-service messaging, thereby

11

enabling users to send and receive private messages within and outside of Facebook, and across

12

different devices. Id. ¶ 22. Facebook tells users they have “unprecedented” control over privacy

13

when operating this service, promising they are “only sharing the information you want to, and

14

you’re only sharing it with the people you want to share it with.” Id. ¶¶ 23-24. But Facebook’s

15

assurances of user control and privacy were directly contradicted by its actions. Id. ¶¶ 25-58.

16

At least until it was exposed by the press in October, 2012, Facebook took several steps in

17

the private message routing process to intercept the substance of users’ private messages. Id.

18

When a user’s private message included a link to a web page (a “URL”), Facebook employed

19

devices called “web crawlers” to (1) scan the web page’s contents, (2) determine whether there

20

was a “Like” plugin2 embedded in that page, (3) add a “Like” to the aggregate count on behalf of

21

the sender and each recipient, and (4) associate “Liking” that web page with the secretly-

22

assembled profiles of the sender and each recipient. Id. Facebook engaged in this conduct in

23

order to compile data points for its ever-expanding user profiles. Id.

24

As discussed above, Facebook’s conduct is an elemental invasion of privacy. Id. ¶¶ 53-

25

55. By intercepting private message content Facebook gained significant, and completely

26

2

27
28

Facebook uses a variety of mechanisms to record activity not just on its social network, but on
the Internet, at large. CAC ¶¶ 26-34, 41-49. One such mechanism is the “Like” button; code that
enables users to publicly “Like” third party websites – and alerts Facebook to the fact that those
users have some affinity for the material on that web page. Id. Facebook relies heavily on what
individual users “Like” to create user profiles for serving targeted advertising. Id.
-4-

PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH

1

personalized, intelligence on each user – information the user chose to share privately – without

2

their knowledge or consent. Id. ¶¶ 32-34, 41-52, 56-58.

3

B.

4

At all times relevant to this litigation, Facebook failed to notify users that it intercepted

Facebook’s Misleading Disclosures.

5

and catalogued the content of their private correspondence. Id. ¶¶ 17-24, 31. Indeed, Facebook

6

affirmatively represented that users’ messages would be “private,” and provide “unprecedented”

7

user control. Id. Facebook’s Data Use Policy conspicuously failed to seek users’ permission to

8

access user-generated content and correspondence. Ex. B3; Part IV-A-2, infra. And in separate

9

disclosures about technical data – which do not concern such content at all – Facebook stated

10

only that it may collect “data about” users’ messages. Id. In direct contradiction to its

11

representations to users, Facebook scanned users’ private messages to get information about their

12

substance. Id. When Facebook purportedly discontinued that practice, it did not revise any of its

13

disclosures, which had never disclosed the interceptions to begin with. Id. ¶¶ 17-24, 31, 38-39.

14

C.

15
16

The Role of Intercepting User Content On Facebook’s “Ordinary Course Of
Business.”

Similarly, while Facebook may have ceased intercepting, cataloging, and manipulating the

17

content within its users’ private messages following an exposé in the Wall Street Journal, this re-

18

tooling of its routing processes and devices had no impact on Facebook’s ability to transmit

19

messages, ensure service safety, protect intellectual property, or to generally offer its product or

20

services. Id. ¶¶ 37-39. Instead, Facebook simply (and quietly) ceased practices that were wholly

21

extraneous to the services it purported to offer, and that were employed for the sole purpose of

22

mining private communications for information that would benefit Facebook’s bottom line. Id.

23

On December 30, 2013, Plaintiffs brought this action for damages and injunctive relief

24

against Facebook under ECPA, CIPA and the UCL, and declaratory relief and restitution under

25

ECPA and the UCL. The CAC was filed on April 25, 2014. On June 17, 2014, Facebook filed

26

the instant motion to dismiss.

27
28

3

Unless otherwise stated, references to exhibits (“Ex.”) are to the Declaration of Michael Sobol.
-5-

PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH

1

III.

LEGAL STANDARD

2

Dismissal under Rule 12(b)(6) is appropriate only where the complaint lacks “a

3

cognizable legal theory” or “sufficient facts to support a cognizable legal theory.” Shroyer v.

4

New Cingular Wireless Servs., Inc., 606 F.3d 658, 664 (9th Cir. 2010). The issue is not whether

5

the non-moving party will ultimately prevail but whether it is entitled to offer evidence to support

6

the claims asserted. Gilligan v. Jamco Dev. Corp., 108 F.3d 246, 249 (9th Cir. 1997). The Court

7

must draw “all reasonable inferences from the complaint in [plaintiffs’] favor,” Mohamed v.

8

Jeppesen Dataplan, Inc., 579 F.3d 943, 949 (9th Cir. 2009), and “must accept as true all of the

9

factual allegations contained in the complaint” and “construe them in the light most favorable to

10

the plaintiffs.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009); Siracusano v. Matrixx Initiatives,

11

Inc., 585 F.3d 1167, 1177 (9th Cir. 2009).

12

IV.

ARGUMENT
The right of privacy is a personal and fundamental right in California4 and the United

13
14

States.5 “Personal letters,” in particular, “constitute an integral aspect of a person’s private

15

enclave.” Fisher v. United States, 425 U.S. 391, 427 (1976); Ortega v. O’Connor, 146 F.3d

16

1149, 1161 (9th Cir. 1998) (personal communications “lie at the heart of our sense of privacy.”)

17

(citation omitted). Federal law has long protected privacy rights in personal communications.

18

ECPA was passed in 1986 with the express purpose of affording to electronic communications

19

the same protections that attach to private letters sent via the U.S. Postal Service. In

20

recommending that ECPA be adopted, the Senate Committee on the Judiciary stated:

21

A letter sent by first class mail is afforded a high level of protection
against unauthorized opening by a combination of constitutional
provisions, case law, and U.S. Postal Service statutes and
regulations. Voice communications transmitted via common carrier
are protected by Title III of the Omnibus Crime Control and Safe

22
23
24
25
26
27
28

4

CAL. CONST., Art. I, § 1, adopted as ballot measure in 1972 (“All people are by nature free
and independent and have inalienable rights. Among these are enjoying and defending life and
liberty, acquiring, possessing, and protecting property, and pursuing and obtaining safety,
happiness, and privacy.”)
5
Dep’t of Justice v. Reporters Comm. for Freedom of the Press, 489 U.S. 749, 763 (1989)
(“[B]oth common law and the literal understanding of privacy encompass the individual’s control
of information concerning his or her own person”); Whalen v. Roe, 429 U.S. 589, 605 (1977).
-6-

PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH

1

Streets Act of 1968. But there are no comparable Federal statutory
standards to protect the privacy and security of communications
transmitted by new noncommon carrier communications services or
new forms of telecommunications and computer technology. This is
so, even though American citizens and American businesses are
using these new forms of technology in lieu of, or side-by-side
with, first class mail and common carrier telephone services.

2
3
4
5
6

CAC ¶ 53.
A.

7

ECPA provides a civil cause of action against any person who “intentionally intercepts . . .

8
9
10
11
12
13
14
15
16

Facebook Violated The Electronic Communications Privacy Act.

any wire, oral, or electronic communication.” 18 U.S.C. § 2511(1)(a). The Act further clarifies
that intercepting a message’s content is proscribed, and defines “intercept” as “the aural or other
acquisition of the contents of any wire, electronic, or oral communication through the use of any
electronic, mechanical, or other device.” Id. at § 2510(4) (emphasis added). “Contents” are
defined as “any information concerning the [communication’s] substance, purport, or meaning.”
Id. at § 2510(8). Thus, ECPA prohibits Facebook’s conduct alleged here: it prohibits any nonparticipant to an electronic communication from acquiring “any information concerning the
substance, purport, or meaning” of the communication. Id. (emphasis added). 6
1.

17

Intercepting And Using The Contents Of Private Correspondence Is
Not Within Facebook’s Ordinary Course Of Business.

18
ECPA provides a narrow exception to its blanket prohibition on message interception,

19
20
21
22
23
24
25
26
27
28

exempting from its definition of “device” any equipment used by an electronic communications
service in the “ordinary course of its business.” Id. § 2510(5)(a)(ii). As with any affirmative
defense, the burden to prove this exception falls upon the party asserting the defense – here,
Facebook. See Johnson v. Trans Ag., 770 F.2d 752, 762 (9th Cir. 1984). Facebook cannot meet
6

Facebook argues that ECPA must be construed narrowly because it is a criminal statute. But
that rule of lenity, if it is of any relevance in a civil context, applies only where a statute is
ambiguous, and there is no ambiguity here. Accordingly, the rule cannot avail Facebook. See
Moskal v. United States, 498 U.S. 103, 108 (1990) (rule of lenity applies only where “a
reasonable doubt persists about a statute’s intended scope even after resort to ‘the language and
structure, legislative history, and motivating policies’ of the statute.”) (citation omitted); United
States v. Bass, 404 U.S. 336, 347 (1971) (court should rely on lenity only if, “after seizing every
thing from which aid can be derived,” it is “left with an ambiguous statute”) (citations omitted).
-7-

PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH

1

its burden for multiple reasons. First, the plain meaning of ECPA, its statutory scheme, and its

2

legislative history, all make plain that the ordinary course of business exception is a narrow one.

3

Second, every court considering the applicability of section 2510(5)(a)(ii) to the kind of conduct

4

at issue here – the undisclosed interception and mining of the content of private communications,

5

for an undisclosed commercial purpose, in a manner unrelated to the transmission of the messages

6

– has rejected Facebook’s interpretation of the statute. Indeed, the cases upon which Facebook

7

relies for its incorrect and broad reading of “ordinary course of business” do not directly address

8

allegations of invasion of privacy such as scanning messages to obtain their substance. Further,

9

to the extent that Facebook interprets one lone holding to require a broad interpretation of section

10

2510(5)(a)(ii), Facebook’s contorted interpretation of that holding is at odds with established

11

ECPA precedent.

12
13

a.

The Plain Meaning Of Section 2510(5)(a)(ii), ECPA’s Statutory
Scheme, And The Legislative History All Make Clear That The
“Ordinary Course Of Business” Exception Is A Narrow One.

14

At the outset, it is critical to note that Congress circumscribed the term “course of

15

business” with the limiting modifier “ordinary.” In re Google Inc. Gmail Litig. (“Gmail”), No.

16

13-02430, 2013 U.S. Dist. LEXIS 172784, at *29 (N.D. Cal. Sept. 26, 2013) (Koh, J.) (“The

17

presence of the modifier ‘ordinary’ must mean that not everything [a defendant] does in the

18

course of its business would fall within the exception.”). Ignoring this, Facebook posits that any

19

“systematic conduct . . . that generates revenue for a company” is entitled to an exemption. Mot.

20

at 15. This writes “ordinary” completely out of the statute, thus conflicting with bedrock rules of

21

statutory interpretation. Duncan v. Walker, 533 U.S. 167, 174 (2001) (in interpreting a statute,

22

courts should “give effect, if possible, to every clause and word[.]”).

23

Beyond the plain meaning of section 2510(5)(a)(ii), ECPA’s broader statutory scheme

24

indicates that the “ordinary course of business” exception is focused only on devices used for

25

transmitting communications. ECPA defines an “electronic communication service” (“ECS”) as

26

“any service which provides the users thereof the ability to send or receive wire or electronic

27

communications.” 18 U.S.C. § 2510(15) (emphasis added). Similarly, an “electronic

28

communications system” is a facility used for the “transmission of wire or electronic
-8-

PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH

1

communications.” 18 U.S.C. § 2510(14) (emphasis added). These definitions evidence the

2

legislature’s understanding of the “business” in which ECS providers are involved: transmitting

3

communications – not harvesting them for profitable tidbits about the authors.

4

A separate exception to the Wiretap Act related to ECS providers is also instructive; it

5

states that ECS providers may intercept communications “while engaged in any activity which is

6

a necessary incident to the rendition of his service or to the protection of the rights or property of

7

the provider of that service,” but the provider may not “utilize service observing or random

8

monitoring except for mechanical or service quality control checks.” Gmail, 2013 U.S. Dist.

9

LEXIS 172784, at *35 (quoting 18 U.S.C. § 2511(2)(a)(i)). As Gmail held, because this language

10

“explicitly limits the use of service observing or random monitoring by [ECS] providers to

11

mechanical and service quality control checks . . . the statutory scheme suggests that Congress did

12

not intend to allow [ECS] providers unlimited leeway to engage in any interception that would

13

benefit their business models.” Id. at *36.

14

Finally, legislative history supports a narrow reading of section 2510(5)(a)(ii). A Senate

15

Report on ECPA states that, while ECS providers may have to “monitor a stream of transmissions

16

in order to properly route, terminate, and otherwise manage the individual messages they

17

contain,” these acts do not violate ECPA only because “[t]hese monitoring functions . . . do not

18

involve humans listening in on voice conversations.” Ex. C (S. Rep. No. 99-541, at 20 (1986)).

19

Analyzing this language, Gmail found that an ECS provider therefore “must show some link

20

between the alleged interceptions at issue and its ability to operate the communication system” to

21

be eligible for section 210(5)(a)(ii)’s protection. 2013 U.S. Dist. LEXIS 172784, at *37.

22

Congress created a narrow exception to ECPA under section 2510(5)(a)(ii), one that

23

applies only when an ECS provider employs technologies incidental to transmitting

24

communications, and not for undisclosed acquisition of the “substance, purport, or meaning” of

25

the content contained within those communications.

26
27
28

b.

Virtually All Courts Addressing “Ordinary Course Of
Business” Interpret The Exception Narrowly.

To date, every court assessing the applicability of section 2510(5)(a)(ii) to a defendant’s
-9-

PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH

1

undisclosed acts of intercepting and mining of private communications’ content has found such

2

conduct to be outside of ECPA’s narrow exception. See Gmail, 2013 U.S. Dist. LEXIS 172784 at

3

*27-28 (section 2510(5)(a)(ii) applies only when interceptions are an “instrumental part of the

4

transmission;” scanning for user profiling or advertising is not “related to . . . transmission.”)

5

(emphasis added); Dunbar v. Google, Inc., No. 10-194, 2011 U.S. Dist. LEXIS 157932, at *11

6

(E.D. Tex. May 23, 2011) (when scanning was for purposes other than facilitating email

7

transmission, “[t]he applicability of the ‘ordinary course of business’ exception . . . cannot be

8

resolved at the pleading stage.”); Ex. D (Marquis v. Google, Inc., No. 11-02808, Mass. Super.

9

Ct., at Suffolk at 8-9 (Jan. 17, 2012) (same, interpreting an analogous Massachusetts state law)).

10

A defendant does not enjoy section 2510(5)(a)(ii)’s protection when, as here, the

11

interception “is both physically and purposively unrelated to [the] provision of email services.”

12

Gmail, 2013 U.S. Dist. LEXIS 172784 at *42. See also Watkins v. L.M. Berry & Co., 704 F.2d

13

577, 582 (11th Cir. 1983) (“The phrase ‘in the ordinary course of business’ cannot be expanded to

14

mean anything that interests a company.”); Berry v. Funk, 146 F.3d 1003, 1009 (D.C. Cir. 1998)

15

(actions are in the ordinary course of business only if they are “justified by a valid business

16

purpose” or “shown to be undertaken normally”).

17

Moreover, as Gmail emphasized, a companion clause articulating an “ordinary course of

18

business” exception in the employment context, section 2510(5)(a)(i), is routinely – narrowly –

19

interpreted. 2013 U.S. Dist. LEXIS 172784 at *39-40; see also United States v. Murdock, 63

20

F.3d 1391, 1396-97 (6th Cir. 1995) (noting that a “substantial body of law has . . . narrowly

21

construed the phrase ‘ordinary course of business,’” and that “indiscriminate recording of both

22

incoming and outgoing calls” does not constitute the ordinary course of business.); Deal v.

23

Spears, 980 F.2d 1153, 1158 (8th Cir. 1992) (stating that general practice of surreptitious

24

monitoring “takes us well beyond the boundaries of the ordinary course of business.”).

25
26
27
28

Finally, the Seventh Circuit’s analysis in United States v. Szymuszkiewicz makes plain that
a “device” can be used in violation of ECPA even if it otherwise facilitates transmission:
[W]e don’t see any need to search for a device that is different
from, or not integral to, the legitimate communication. [Courts
have] added this “different device” requirement to the statutory text
- 10 -

PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH

1

to avoid what those judges thought would otherwise be a rule that
made ordinary usage of a telephone or computer criminal. . . . This
fear just shows why it is a mistake to read snippets of a statute in
isolation. For another section of [ECPA] declares that ‘it shall not
be unlawful . . . for a person . . . to intercept a wire, oral or
electronic communication where such person is a party to the
communication or where one of the parties . . . has given prior
consent.’ [citation omitted]. . . . It is better to follow the statute
than to make up limitations to avert imaginary problems.

2
3
4
5
6
7

622 F.3d 701, 707 (7th Cir. 2010) (Easterbrook, J.) (emphasis added).7
c.

8

Facebook’s Cases Do Not Support Its Motion.

The cases relied upon by Facebook are distinguishable from this case, chiefly because

9
10

none of them involved defendants intercepting message content without consent. Indeed, while

11

the cases discussed above analyzed the ordinary course of business exception in the relevant

12

context: secretly acquiring the substance of intercepted communications, two of the three

13

principal cases cited by Facebook involved defendants who had merely transmitted electronic

14

communications, which they at no point scanned for “any information concerning the substance,

15

purport, or meaning.” Further, these opinions addressed rulings at the summary judgment stage,

16

and are thus scarcely relevant to this Court’s analysis at the pleadings stage. See Hall v.

17

EarthLink Network, Inc., 396 F.3d 500 (2d Cir. 2005) (affirming order granting summary

18

judgment); Kirch v. Embarq Mgmt. Co., 702 F.3d 1245 (10th Cir. 2012) (same). The remaining

19

case, upon which Facebook principally relies, only addresses challenges to a defendant’s

20

disclosed practices, and is thus wholly inapposite.

21

For its expansive reading of section 2510(5)(a)(ii), Facebook misleadingly cites to Hall v.

22

EarthLink Network, Inc., a case about a disgruntled Earthlink email account-holder who, after his

23

account was closed, sued Earthlink for failing to “bounce” emails subsequently sent to the

24

account. 396 F.3d 500, 502 (2d Cir. 2005). The Second Circuit held that Earthlink did not

25
26
27
28

7

This reasoning applies with equal force to Facebook’s argument. Facebook explains away its
ECPA violations on the premise that it “requires access to message information . . . for myriad
features crucial to providing its services.” Mot. at 10. However, at no point does Facebook
explain – nor can it – how obtaining the content within those messages furthers those purposes,
nor does it explain how protocols and portions of code that Facebook ceased utilizing almost two
years ago remain critical to its “ordinary course of business” today, or indeed were ever critical.
- 11 -

PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH

1

violate ECPA given that (1) no evidence that receipt of emails – and nothing more than mere

2

receipt – was outside Earthlink’s ordinary course of business; and (2) Earthlink did not have the

3

technical ability to bounce emails after closing an account. 396 F.3d at 505. By contrast, beyond

4

“receiving” messages, here Facebook accessed, analyzed, and used the content within them.

5

CAC ¶¶ 25-58. Further, Plaintiffs allege – and Facebook concedes – that Facebook did have the

6

capacity to transmit private messages without intercepting their content, as evidenced by its

7

ceasing the practice following the Wall Street Journal exposé. Id. ¶¶ 39, 59 n.3; Mot. at 25.

8
9

Far from supporting Facebook’s defense, Kirch v. Embarq Management Company further
clarifies that the ordinary course of business exception cannot avail ECS providers that access

10

communications to learn information about their content. 702 F.3d 1245 (10th Cir. 2012). Kirch

11

concerned an internet service provider, Embarq, that had given third party, NebuAd, access to

12

user data on its network. Only NebuAd, not Embarq, had examined transmissions to discern their

13

content and meaning. Id. at 1250. The court held that Embarq had not violated ECPA where it

14

never examined “any of the raw data that NebuAd may have looked at.” Id. Implicit in this

15

holding is that if Embarq had itself attempted to divine the contents of user transmissions, then it

16

would have violated ECPA just like NebuAd.8 2013 U.S. Dist. LEXIS 172784 at *32 (“Google is

17

more akin to NebuAd, which intercepted data for the purpose of . . . advertising – a purpose

18

separate and apart from . . . provision of internet service.”). Here, Plaintiffs allege that Facebook

19

acquired and examined the contents of Plaintiffs’ messages in order to learn information about

20

their “substance, purport, or meaning.” CAC ¶¶ 25-58. Thus Kirch is inapposite.

21

d.

22

Facebook’s Reliance On An Opinion About Publicly-Disclosed
Practices Is Particularly Misplaced.

23

Chiefly, Facebook cites In re Google, Inc. Privacy Policy Litig. (“Google”), in support of

24

its far-reaching argument that “systematic conduct . . . that generates revenue for a company is the

25

very essence of a company acting ‘in the ordinary course of it business.’” Mot. at 15 (citing No.

26

12-01382, 2013 U.S. Dist. LEXIS 171124 (N.D. Cal. Dec. 3, 2013)). Facebook’s interpretation

27
28

8

The Kirch plaintiffs settled their claims against NebuAd in a prior proceeding. 702 F.3d at
1248, n.2.
- 12 -

PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH

1

of Google leads to absurd results; creating blanket immunity for any ECS provider, so long as

2

they acted in pursuit of profit. Such a broad reading contradicts the principle evident throughout

3

ECPA’s text, legislative history, and interpretive case law, that ECS providers may not secretly

4

monitor users’ communications to learn about their substance. Further, Google is distinguishable

5

because it concerned a claim entirely different from that here – one based upon neither

6

undisclosed scanning of message content nor the violation of internal policies, and to the extent

7

that Google could support an expansive reading of section 2510(5)(a)(ii), the court’s analysis did

8

not substantively distinguish the more comprehensive analysis of the Gmail opinion.

9

The core of the plaintiffs’ case in Google was profoundly different from this case. There,

10

users complained that Google had adopted a universal policy covering all of its services – e.g.,

11

Gmail, YouTube, Google Maps – which enabled it to share user data across all of these services.

12

Id. at *6. Previously, such data was not comingled. Id. Thus, the plaintiffs did not plead that

13

Google had done anything secretly, but rather had acted in accord with announced practices. Id.

14

This fact – absent here – was fatal to the ECPA claim. Id. at *36 (“Plaintiffs’ claim is not that

15

Google did anything in secret . . . .”). Here, Facebook’s monitoring was undertaken

16

surreptitiously. See, e.g. CAC ¶ 38. This fact, alone, renders the Google holding inapposite.

17

To the extent that Google may support a broad reading of section 2510(5)(a)(ii), the

18

court’s analysis focused solely on the presence of the word “business,” and neglected to account

19

for the modifier “ordinary.” 2013 U.S. Dist. LEXIS 171124 at *33. For the reasons discussed in

20

Part IV-A-1-a above, this inverts the critical inquiry – the limiting modifier “ordinary” must be

21

reconciled with Congressional intent. Gmail, 2013 U.S. Dist. LEXIS 172784 at *29.

22

Additionally, although it referenced Gmail, Google did not controvert Gmail’s analysis of

23

ECPA’s statutory scheme, case law, or legislative history. 2013 U.S. Dist. LEXIS 171124 at *37.

24

Instead, Google distinguished Gmail on the grounds that “among other things, the court’s

25

thorough analysis addressed allegations that Google’s practices violated its own internal policies,

26

further establishing that its actions are outside the course of its business.” Id. Here, too, Google’s

27

holding cannot be readily analogized in light of the CAC’s factual allegations contrasting

28

representations Facebook made to users with Facebook’s surreptitious scans of private messages.
- 13 -

PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH

1

See, e.g., CAC at ¶¶ 9-21, 23-25; 34; 47; 48; 57-58; Exs. A-B.

2

Ultimately, Google conflates the “ordinary course of business” analysis with whether or

3

not the practice was disclosed, i.e., whether consent was obtained. 2013 U.S. Dist. LEXIS

4

171124 at *36 (emphasizing that practice was “publicly announced”). 9 In the court’s view, if an

5

ECS announces a practice, it is presumptively in the ECS’s “ordinary course of business.” Id. at

6

*36-37. However, even assuming arguendo that such an analysis is proper under ECPA,

7

Plaintiffs still prevail here: Facebook did not disclose its practice of scanning private messages

8

for their content, and thus cannot presumptively have acted in the ordinary course of business.

9

Accordingly, the Court should reject Facebook’s contention that intercepting the contents

10

of users’ private messages is lawful under ECPA’s narrow ordinary course of business exception.

11

2.

12

Plaintiffs Did Not Consent To Facebook’s Interception And Use Of
Their Private Messages.

13

Facebook argues that Plaintiffs consented to its conduct – expressly, because Plaintiffs

14

viewed Facebook’s disclosures, and impliedly, because when Plaintiffs pasted a URL link into

15

their messages, a “thumbnail preview” would appear, which showed a brief description of the

16

website at that link. Mot. at 17-18. As “the party seeking the benefit of the exception,” Facebook

17

bears the burden of proving consent. In re Pharmatrak, Inc. Privacy Litig, 329 F.3d 9, 19 (1st

18

Cir. 2003). Consent is “an affirmative defense to an ECPA claim that need not be anticipated by

19

Plaintiffs in the pleadings.” Valentine v. Wideopen West Fin., LLC, 288 F.R.D. 407, 413 (N.D.

20

Ill. 2012). Under ECPA, consent may be express or implied, but it “is not an all-or-nothing

21

proposition.” Gmail, 2013 U.S. Dist. LEXIS 172784, at *47. A party “may consent to the

22

interception of only part of a communication or to the interception of only a subset of its

23

communications.” Pharmatrak, 329 F.3d at 21 (consent to collecting non-identifiable user data

24

not consent for identifiable data).10 “[A] reviewing court must inquire into the dimensions of the

25

9

26
27
28

Under ECPA, consent and acting within the ordinary course of business are two, distinct
inquiries. See, e.g., Arias v. Mutual Cent. Alarm Serv., 202 F.3d 553, 559 (2d Cir. 2000)
(“Given . . . this distinct consent exception, . . . it is a misreading of Title III to import wholesale a
consent requirement into the ordinary course of business analysis at issue here.”).
10
See also Gmail, 2013 U.S. Dist. LEXIS 172784, at *50 (consent to process email for spam not
consent to process for profiling and advertising); Watkins, 704 F.2d 577 at 582 (consent to
Footnote continued on next page
- 14 -

PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH

1
2

consent and then ascertain whether the interception exceeded those boundaries.” Id. at 21.
Facebook presents its express consent argument by cobbling together out-of-context

3

snippets from its Data Use Policy. But read in context, Facebook’s snippets give away the ruse.

4

See Klamath Water Users Protective Ass’n v. Patterson, 204 F.3d 1206, 1210 (9th Cir. 2000)

5

(“[A] written contract must be read as a whole . . . with preference given to reasonable

6

interpretations.”) Even standing alone, these snippets do not notify users that Facebook would

7

intercept the substance of their messages. And Facebook fatally misunderstands what it must

8

show to establish implied consent. Accordingly, it cannot escape liability under ECPA.

9
10

a.

Facebook Did Not Obtain Express Consent.

Plaintiffs did not expressly consent to Facebook’s interceptions. “[E]xpress consent is

11

usually a question of fact, where a fact-finder needs to interpret the express terms of any

12

agreements to determine whether these agreements adequately notify individuals regarding the

13

interceptions.” In re Google Inc. Gmail Litig., No. 13-02430, 2014 U.S. Dist. LEXIS 36957, at

14

*57 (N.D. Cal. Mar. 18, 2014). This analysis asks what the relevant disclosures would mean to a

15

reasonable person. Id. at *55; Cohen v. Facebook, Inc., 798 F. Supp. 2d 1090, 1095 (N.D. Cal.

16

2011) (holding that given a “natural” reading, disclosures by Facebook provided inadequate

17

notice of alleged privacy invasions to establish consent).

18

At least until this litigation, Facebook has unswervingly told users that “[y]ou own all of

19

the content and information you post on Facebook, and you can control how it is shared. . . .”

20

Ex. A at 1.11 Facebook’s Data Use Policy thus seeks users’ permission to process specific types

21

of user information for identified purposes. Ex. B at 4. Facebook therefore has encouraged users

22

to read its disclosures narrowly, as notice of specific exceptions to the general rule that users own

23

and control their data themselves. Facebook’s disclosures of the “[i]nformation we receive about

24

you” is broken up into three discrete sections of the Data Use Policy. These sections identify

25

what Facebook calls “different types of information” that Facebook receives, namely: (1) “Your

26

Footnote continued from previous page
monitoring sales calls not consent for personal calls); Dukes v. ADS Alliance Data Sys., 2006 U.S.
Dist. LEXIS 84311, 44 (S.D. Ohio Nov. 20, 2006) (consent to monitoring calls for customer
service not consent for listening in on private calls).
11
See also Ex. B at 4 (Data Use Policy) (“[Y]ou always own all of your information.”).

27
28

- 15 -

PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH

1

information”; (2) “Information others share about you”; and (3) “Other information we receive

2

about you”. Ex. B at 2-3.

3

The “Your information” section is devoted to user-generated content and communications.

4

It expressly encompasses the “Information you choose to share” such as “when you post a status

5

update, upload a photo, or comment on a friend’s story . . . [and] . . . when you communicate with

6

[Facebook], such as when you contact [Facebook] using an email address . . . .” Ex. B at 2. A

7

reasonable user would expect to find any disclosures about the content of private messages in the

8

“Your information” section along with the disclosures about the content of other communications,

9

but it is not there. By listing every type of communication related to Facebook except private

10

messages, the “Your information” disclosure implicitly excludes such messages from those that

11

Facebook seeks permission to access and use. In Gmail, the Court found that an analogous

12

omission – stating that emails directly to Google would be monitored but failing to mention other

13

communications – “could mislead users into believing that user communications to each other or

14

to nonusers were not intercepted.” Gmail, 2013 U.S. Dist. LEXIS 172784, at *53 (denying

15

motion to dismiss on express consent defense).

16

Indeed, Facebook’s sole reference to when users “send or receive a message” is altogether

17

independent of the disclosures under “Your information.” It appears in a separate section,

18

applicable to a “different type[] of information” titled “Other information we receive about you.”

19

A reasonable user would not expect to find notice about the content of private communications in

20

the “Other information” section because it concerns “data” of a technical nature. First, it says that

21

Facebook receives “data about you whenever you use or are running Facebook,” including when

22

you “send or receive a message.” Ex. B at 2-3. The remaining categories of “data about you”

23

that Facebook seeks permission to collect here are:

24
25
26
27
28

[M]etadata such as the time, date, and place you took [photos or
videos] . . . .[N]etwork and communication information, such as
your IP address or mobile phone number . . . your internet service,
operating system, location, the type (including identifiers) of the
device or browser you use, or the pages you visit . . . .[T]he date
and time you visit [a game, application, or certain websites] . . .; the
web address, or URL, you’re on; technical information about the IP
address, browser and the operating system you use . . . .Data from .
- 16 -

PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH

1

. . third parties . . . [such as] how you responded to an ad on
Facebook or on another site . . . .

2
3

Id. Facebook’s self-serving interpretation of the reference within “Other information” to

4

messages – i.e. that users should have understood “data about” their correspondence to include its

5

substance – should be rejected. Nothing there told users that Facebook would open up their

6

private messages and use the contents to profile users and boost “Like” counters. At most, users

7

consented to interception of “data about” their private messages, such as when and to whom they

8

were sent – the kind of data any common carrier might receive about a communication, without

9

opening it up. Cf. Quon v. Arch Wireless Operating Co., Inc., 529 F.3d 892, 905 (9th Cir. 2008)

10

(“As with letters and e-mails, it is not reasonable to expect privacy in the information used to

11

‘address’ a text message . . . . However, users do have a reasonable expectation of privacy in the

12

content of their text messages vis-à-vis the service provider.”)
Facebook cannot show that Plaintiffs had specific notice of its interceptions and their

13
14

purposes, as it must to prevail on its defense. For the same reason, the authority cited in support

15

of Facebook’s motion is inapposite here. Deering v. CenturyTel, Inc., held that a defendant had

16

obtained consent to give a third-party data about users’ browsing habits because it notified users

17

in advance that it would give that data to that third party for specified purposes, and gave users

18

the choice to opt out. No. 10-63, 2011 U.S. Dist. LEXIS 51930, at *7 (D. Mont. May 16, 2011).

19

Similarly, In re VistaPrint Corp Mktg. & Sales Practices Litig., merely observed that the

20

plaintiffs had authorized the defendant to transfer their “name[s], address[es] and credit/debit card

21

information” to a specific third party by clicking “Yes” on the defendant’s request for permission

22

to transfer that information to that third party. 2009 U.S. Dist. LEXIS 77509, at *29 (S.D. Tex.

23

Aug. 31, 2009).12 In contrast to the specific notice provided in Deering and VistaPrint,

24

Facebook’s disclosures are vague and, in fact, suggest the opposite of what Facebook now asserts

25

they mean. Facebook is not entitled to dismissal based upon express consent that it never

26

obtained.

27
28

12

VistaPrint did not analyze the plaintiffs’ consent because the defendant was itself a consenting
party to the relevant communications.
- 17 -

PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH

1

b.

Facebook Did Not Obtain Implied Consent.

Nor did Plaintiffs impliedly consent. “[I]mplied consent applies only in a narrow set of

2
3

cases.” Gmail, 2013 U.S. Dist. LEXIS 172784, at *47 (citation omitted). Implied consent “is not

4

constructive consent. Rather, [it] is ‘consent in fact’ which is inferred ‘from surrounding

5

circumstances indicating that the party knowingly agreed to the surveillance.’” Griggs-Ryan v.

6

Smith, 904 F.2d 112, 116-117 (1st Cir. 1990) (citations omitted). Thus, like express consent, to

7

impliedly consent, a party must have actual notice of the specific interception and its purpose.

8

Pharmatrak, 329 F.3d at 19-21. Notice that interceptions are possible is not enough. United

9

States v. Staves, 383 F.3d 977, 981 (9th Cir. 2004) (“[F]oreseeability of monitoring is insufficient

10

to infer consent. Rather, the circumstances must indicate that a party to the communication knew

11

that interception was likely and agreed to the monitoring.”); Watkins, 704 F.2d at 581

12

(“Knowledge of the capability of monitoring alone cannot be considered implied consent.”).13
Facebook’s argument for implied consent here is just a thinly disguised theory of

13
14

constructive consent, and an implausible one at that. Facebook argues users should have deduced

15

from URL previews in their draft messages that hitting “send” would cause Facebook to intercept

16

their message in transit, note any URLs therein, and use that information in unspecified ways.

17

Mot. at 18. Beyond the fact that this is deeply improbable, notice that an interception is merely

18

possible does not establish consent. Watkins, 704 F.2d at 581. “Actual” consent requires actual

19

knowledge of the fact of interception, and its purpose. Pharmatrak, 329 F.3d at 21; Gmail, 2013

20

U.S. Dist. LEXIS 172784, at *50; Watkins, 704 F.2d at 582. Moreover, as discussed above,

21

Facebook represented to users that their messages are “private,” provide “unprecedented” control,

22

and can be limited to “[s]haring with an individual.” Facebook omits private messages from its

23

disclosure of information that it “receives” from users. Therefore, even if a user did somehow

24

suspect, based on a URL preview, that Facebook could monitor message content, Facebook’s

25

own representations about the messaging service would put a reasonable user’s suspicions to rest.
Thus, Facebook’s motion to dismiss based upon consent should be denied.

26
27
28

13

See also Deal v. Spears, 980 F.2d 1153, 1156-57 (8th Cir. 1992) (consent could not be implied
from notice that a business owner only might monitor company phones); Berry, 146 F.3d at 1011
(same, in law enforcement context).
- 18 -

PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH

1

3.

Facebook “Intercepted” Communications “In Transmission.”

Facebook rearranges fragments of the CAC to pretend that Plaintiffs’ real claim involves

2
3

messages in electronic storage, and thus are unprotected here. Mot. at 20. In fact, the CAC

4

consistently alleges that Facebook intercepted private messages in transmission. See, e.g., CAC

5

¶ 25 (describing scanning as “in transit, in transmission, and/or during transfer” of private

6

messages.”); Id. ¶ 36 (showing screen grabs of private message being sent, a scan occurring, and

7

the implicated “Like” count increasing contemporaneously.). Plaintiffs have amply established

8

the “plausibility” of their claims, demonstrating that there is “more than a sheer possibility that a

9

defendant has acted unlawfully.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (citations omitted).

10

B.

11

Again contorting the CAC’s allegations, Facebook mistakenly suggests that describing its

12

conduct as taking place “across its network” amounts to “concessions that messages were entirely

13

contained within Facebook’s network.” Mot. at 20. In reality, according to a post by Facebook

14

on its website, Facebook’s private messaging service allowed users to exchange emails with non-

15

Facebook email addresses. CAC ¶ 24 (citing post); Id. ¶ 22 (“Facebook’s private message

16

function [includes] email.”). Facebook does not explain – nor can it – how a non-Facebook email

17

can be sent to or received from a Facebook user’s private messages inbox if the transmissions are

18

“entirely contained within Facebook’s network.” Such an assertion contradicts the CAC, and thus

19

is inappropriate to consider at this stage of motion practice. See Brennan v. Concord EFS, Inc.,

20

369 F.Supp.2d 1127, 1133 (N.D. Cal. 2005) (Arguments “contrary to plaintiffs’ pleading [are]

21

inappropriate for resolution at the motion to dismiss stage.”).14

Facebook Violated California Penal Code § 631

22

C.

23

Facebook incorrectly claims it was not “eavesdropping” under Penal Code section 632.

Facebook Violated California Penal Code § 632

24

Offering no further clarification, Facebook simply contends that, because it “stored Plaintiffs’

25

messages in the course of providing the Messages product,” it could not have been “secretly”

26

14

27
28

Facebook mischaracterizes Hernandez v. Path, Inc., which dismissed ECPA and CIPA claims
on the ground that, as alleged, the interceptions were not contemporaneous with transmission.
2012 U.S. Dist. LEXIS 151035, at *9 (N.D. Cal. Oct. 17, 2012). Here, Plaintiffs allege that the
interceptions occurred contemporaneously with the transmission. CAC at ¶¶ 25, 36, 40. Whether
or not the transmissions occurred exclusively across Facebook’s network is thus immaterial.
- 19 -

PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH

1

recording the contents of Plaintiffs’ communications.15 Mot. at 23. Nothing in CIPA supports

2

this proposition.16 Instead, the law is clear that whenever a non-party to a communication

3

acquires its content without obtaining the consent of the parties, section 632 has been violated.

4

Cal. Pen. Code § 632(a) (prohibiting “eavesdrop[ing] upon or record[ing]” confidential

5

communications “intentionally and without the consent of all parties.).

6

Facebook acted without users’ consent. See Part A-2, supra. Facebook’s argument that

7

private messages are somehow not “confidential” because they are “Internet communications” – a

8

term Facebook does not define and a term not included in the CAC – is unavailing. The act of re-

9

sharing by a conversation’s participant simply does not factor into “confidential[ity]” under

10

section 632. Instead, the analysis hinges upon whether (1) the monitoring was disclosed and

11

(2) whether all parties to the conversation agreed to its recording. Kight v. CashCall, Inc.,

12

200 Cal. App. 4th 1377, 1389 (Cal. App. 2011) (“secret monitoring denies the speaker . . . the

13

right to control the nature and extent of the firsthand dissemination of his statements . . . . A new

14

audience – either electronic or human – has been introduced . . . [But], section 632 requires the

15

assent of all parties to a communication before another may listen.”); accord Shulman, 18 Cal.

16

4th at 234-35. The Supreme Court of California makes plain that the only inquiry is whether

17

there has been a “simultaneous dissemination [of the communication] to an unannounced second

18

auditor, whether that auditor be a person or a mechanical device.” Id. This is precisely

19

Facebook’s behavior. CAC ¶¶ 25-58.

20

D.

21

1.

22
23

Plaintiffs’ Unfair Competition Law Claims Are Adequately Pleaded.
Plaintiffs Have Standing Under the UCL.

Plaintiffs meet the UCL’s standing requirements because they suffered (1) “injury in fact,”
and (2) “lost money or property.” See Kwikset Corp. v. Superior Court, 51 Cal. 4th 310, 322

24
25
26
27
28

15

In support, Facebook cites to cases in which the defendant was a party to the conversation.
See, e.g., Thomasson v. GC Servs. Ltd. P’ship., 321 F. App’x 557, 559 (9th Cir. 2008) (no CIPA
violation when “[n]o third party listened in on the conversations between the Thomassons and GC
Services..”); Rogers v. Ulrich, 52 Cal. App. 3d 894, 896 (1975) (Defendant recorded
conversations between himself and plaintiff).
16
Indeed, “storing” a message does not give Facebook a legal right to inspect its contents any
more than the Postal Service’s act of “storing” a letter in a P.O. Box allows it to open that letter.
- 20 -

PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH

1

(Cal. 2011). Facebook’s challenges to both prongs of the standing requirement fail.

2

The UCL’s standard for injury in fact expressly mirrors that of the U.S. Constitution (id.);

3

thus the requisite injury “can exist solely by virtue of statutes creating legal rights.” Edwards v.

4

First Am. Corp., 610 F.3d 514, 517 (9th Cir. 2010) (citation omitted). Here, because Plaintiffs

5

allege that Facebook violated their rights under ECPA, Facebook’s argument based on injury in

6

fact is baseless and should be rejected. CAC ¶¶ 72-94.17

7

Plaintiffs also adequately allege that they have “lost property” within the meaning of the

8

UCL. As alleged in the CAC, Facebook itself acknowledges that Plaintiffs’ electronic

9

correspondence belongs to them, as it expressly states to its users that they “own” the content of

10

their “private” messages. (CAC ¶ 17 (incorporating Internet links to Facebook’s online policies);

11

¶ 23; Exs. A-B (copies of the documents referenced in CAC)). Moreover, like any private

12

correspondence, private messages on Facebook satisfy California’s three-prong test for a property

13

interest. “First, there must be an interest capable of precise definition; second, it must be capable

14

of exclusive possession or control; and third, the putative owner must have established a

15

legitimate claim to exclusivity.” Kremen, 337 F.3d at 1030; Cal. Civ. Code § 654. Here, the

16

CAC alleges “an interest capable of precise definition,” the right to own and exclude non-parties

17

like Facebook from private communications is well-established (CAC ¶¶ 23-24; 47-48; 53-54;

18

100), and, as just stated, Facebook acknowledges that private messages legitimately belong

19

exclusively to the communicating parties.

20

Facebook makes little effort to argue that, as a matter of law, senders and recipients of

21

private messages do not have a property interest in them. Instead, Facebook asserts that Plaintiffs

22

fail to allege they “lost” any property when Facebook used their messages. Mot. at 24.

23

Facebook’s argument fails because by interfering with users’ exclusive right to use their own

24

property, Plaintiffs have, as a matter of well-settled California law, been deprived of their

25

property. As the Ninth Circuit has recognized, “California defines property very broadly: ‘The

26

ownership of a thing is the right of one or more persons to possess and use it to the exclusion of

27
28

17

The spuriousness of Facebook’s “injury in fact” argument is apparent in the fact that Facebook
stopped short of even attempting to challenge Plaintiffs’ standing under Article III directly.
- 21 -

PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH

1

others. . . . The thing of which there may be ownership is called property.’” G.S. Rasmussen &

2

Assocs. v. Kalitta Flying Serv., 958 F.2d 896, 902 (9th Cir. 1992), quoting Cal. Civ. Code § 654.18

3

Therefore, as California’s Supreme Court recently held, having “a present or future property

4

interest diminished” is one of “innumerable ways” to show “lost money or property—economic

5

injury” under the UCL. Kwikset, 51 Cal. 4th at 323.

6

Plaintiffs adequately allege this loss of property. Indeed, when Facebook explicitly

7

represented to users that private messages are their property, it also emphasized that users, not

8

Facebook, can control the sharing and use of those messages: “You own all of the content and

9

information you post on Facebook . . . you can control how it is shared. . . .” (Ex. A at 1,

10

referenced at CAC ¶ 17 (emphasis added); Ex. B.). The control promised by Facebook

11

exemplifies the exclusivity inherent in a property interest. However, Facebook treated Plaintiffs’

12

private messages as though they were Facebook’s property to freely open up, inspect, and use for

13

any purpose that suited Facebook. CAC ¶¶ 1-4. Facebook’s actions deprived Plaintiffs of their

14

exclusive right to their correspondence. Kaiser Aetna v. United States, 444 U.S. 164, 176 (1979)

15

(exclusivity is “one of the most essential sticks in the bundle of rights that are commonly

16

characterized as property.”).19

17

The exclusivity inherent in a property right extends to unauthorized copying and

18

subsequent use of property. “[A]lthough the owner may retain possession of the original

19

property, there has been nevertheless a deprivation of property when a copy is made and retained

20

by another.” People v. Kwok, 63 Cal. App. 4th 1236, 1251 (Cal. App. 1998). In People v. Kwok,

21

a California Court of Appeal held that making an unauthorized copy of a victim’s house key

22

constituted theft even though the victim never lost possession of her own key. The court reasoned

23

that “a homeowner’s or tenant’s property interest in his or her house key is not just the right to

24

maintain possession of a tangible object – the key – but also the right to control the intangible

25

18

26
27
28

See also Kremen v. Cohen, 337 F.3d 1024, 1030 (9th Cir. 2003), quoting Downing v. Mun.
Court, 88 Cal. App. 2d 345, 350 (Cal. App. 1948) (“Property . . . includes every intangible benefit
and prerogative susceptible of possession or disposition.”).
19
See also Prop. Reserve, Inc. v. Superior Court, 224 Cal. App. 4th 828, 862-863 (Cal. App. 3d
2014); Preston v. Bd. of Equalization, 25 Cal. 4th 197, 208 (Cal. 2001) (“Intangible property . . .
is generally defined as property that is a ‘right’ rather than a physical object.”).
- 22 -

PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH

1

benefit conferred by ownership of the key, i.e., the ability to control access to one’s residence.”

2

Id. Here, even though Plaintiffs retained their original messages, Facebook’s actions deprived

3

Plaintiffs of the fundamental right to exclude others, including Facebook, from using the

4

messages’ content. As the CAC alleges, “users have no control whatsoever over their own user

5

data collected or retained by Facebook” CAC ¶ 52; see Claridge v. RockYou, Inc., 785 F. Supp.

6

2d 855, 862 (N.D. Cal. 2011) (Hamilton, J.) (noting that one court has defined “lost” property as

7

property that has passed beyond the owner’s control).20

8
9

The argument advanced, and cases cited by, Facebook to convince this Court to decline to
acknowledge a loss of a property interest here are flatly inapposite. The private correspondence

10

at issue in this case, which carries with it an historically-recognized property interest, is in no way

11

analogous to “referrer headers” automatically generated by computers,21 digital contacts lists,22 or

12

other involuntary footprints of Internet use.23 To the contrary, this case is about Plaintiffs’

13

fundamental right to protect the exclusivity of private messages transmitted over Facebook. By

14

20

15
16
17
18
19
20
21
22
23
24
25
26
27
28

Facebook may argue in reply that another standard applies, i.e., that “lost” property requires the
owner be deprived of the property’s “use and possession.” Kwikset, however, clarified that
conduct diminishing a “present or future property interest” creates economic injury under the
UCL. 51 Cal. 4th at 323. Depriving the owner of use and possession, an element of the common
law tort, conversion, need not be shown for UCL standing. See FMC Corp. v. Capital
Cities/ABC, Inc., 915 F.2d 300, 303 (7th Cir. 1990) (noting that under California law, making
unauthorized copies of property ordinarily does not give rise to liability for conversion).
21
In In re Facebook Privacy Litig., 791 F. Supp. 2d 705, 715 (N.D. Cal. 2011) (Ware, J.), aff’d,
No. 12-15619, 2014 U.S. App. LEXIS 8679, at *1 (9th Cir. May 8, 2014), the court expressly
drew the distinction between “personal information” such as the referring headers at issue, and
personal financial records that a company has promised to safeguard. There, the court
acknowledged that UCL standing may be established in the latter circumstance, albeit focusing on
“lost money,” given that it was describing a paid service. Id., citing Doe 1 v. AOL, LLC, 719 F.
Supp. 2d 1102, 1111-1113 (N.D. Cal. 2010) (finding UCL standing where defendant failed to
safeguard the content of users’ financial records). Here, as with the financial records described in
Facebook Privacy, Facebook has promised its users that their private messages will remain theirs,
subject to the users’ control. CAC ¶ 17; Ex. A and B. Facebook’s violation of users’ exclusive
right to those private messages establishes the requisite “lost property” required to show standing
under the UCL, akin to the violation that gave rise to plaintiffs’ standing in AOL.
22
Opperman v. Path, Inc., No. 13-00453, 2014 U.S. Dist. LEXIS 67225, at *83 & n.22 (N.D.
Cal. May 14, 2014) (Tigar, J.) (acknowledging that consumers may have a property interest in
personal information, but finding that plaintiffs lacked standing based solely on whether plaintiffs
incurred economic loss, i.e., lost “money.”).
23
Claridge v. RockYou, Inc., 785 F. Supp. 2d 855, 862 (N.D. Cal. 2011) (Hamilton, J.)
(concerning users’ login credentials stolen from the defendant by a third-party; finding that
plaintiffs failed to allege credentials had passed beyond their control); In re iPhone Application
Litig., No. 11-02250, 2011 U.S. Dist. LEXIS 106865, at *45 (N.D. Cal. Sept. 20, 2011) (Koh, J.)
(concerning user data such as cell phone numbers, geolocation, and sim card serial numbers).
- 23 -

PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH

1

abusing its ability as an ECS provider to monetize the substance of Plaintiffs’ messages,

2

Facebook not only violated Plaintiffs’ privacy, it diminished their property rights as well,

3

cementing Plaintiffs’ standing under the UCL. Kwikset, 51 Cal. 4th at 323.

4

Moreover, to deny Plaintiffs standing here would thwart the purpose of the UCL’s “lost

5

money or property” requirement, which is “to eliminate standing for those who have not engaged

6

in any business dealings with would-be defendants . . . while preserving for actual victims of

7

deception and other acts of unfair competition the ability to sue and enjoin such practices.”

8

Kwikset, 51 Cal. 4th at 317 (emphasis added). Facebook attracted users to its site by representing

9

that they owned their own content and that messages sent over Facebook would be “private.”

10

CAC ¶¶ 21-25. Then Facebook mined users’ private messages for information without their

11

consent. As the victims of Facebook’s self-serving misrepresentations and deception, Plaintiffs

12

have standing to bring this action to enjoin Facebook’s misconduct.24

13

2.

14

Facebook Violated the Unfair Competition Law.

This Court should not credit Facebook’s unsubstantiated assertion in a footnote that

15

Plaintiffs allege no “unlawful, unfair, or fraudulent” business acts or practices. Mot. at 24 n.13.

16

All three prongs of Plaintiffs’ UCL claim are well pled. First, the UCL’s “unlawful” prong is

17

satisfied because Facebook violated ECPA and CIPA. CAC ¶ 126; Farmers Ins. Exch. v.

18

Superior Court, 2 Cal.4th 377, 383 (Cal. 1992) (“Unlawful” prong borrows violations of other

19

laws). Second, extensive allegations show that Facebook deprived Plaintiffs ownership of their

20

private messages solely to benefit Facebook, and that no public utility derived from Facebook’s

21

misconduct. CAC ¶¶ 1-4;19; 23-51 (describing Facebook’s deceptions and incentives to mislead

22

users). Thus, the conduct was “unfair.” MacDonald v. Ford Motor Co., No. 13-02988, 2014

23

U.S. Dist. LEXIS 44858, at *27 (N.D. Cal. Mar. 31, 2014) (Tigar, J.); see also id. (finding no

24

public benefit in company’s failure to disclose vehicle safety problems). Third, the CAC details

25
26
27
28

24

Facebook’s reliance on Korea Supply Co. v. Lockheed Martin Corp. is misplaced. Korea
Supply held that restitution is unavailable to a plaintiff who never had a vested interest in the
funds it sought to have “restored.” 29 Cal. 4th 1134, 1148-49 (Cal. 2003). By contrast, Plaintiffs’
property interest in their messages is “vested.” Thus, any benefits Facebook derived from using
their messages are “benefits in which [Plaintiffs have] an ownership interest,” and for which
Plaintiffs may seek restitution under the UCL. Id.
- 24 -

PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH

1

extensively Facebook’s fraudulent concealment of the “who, what, when, where, and how” of

2

Facebook’s intrusion upon Facebook’s private messages. CAC ¶¶ 21-25; 38; 47-48; 69-71;

3

127.25 Because Facebook’s representations and omissions are likely to, and did, deceive both

4

Plaintiffs and the public, they are “fraudulent.” In re Tobacco II Cases, 46 Cal. 4th 298, 312

5

(Cal. 2009). Accordingly, Plaintiffs’ UCL claims should not be dismissed.

6

E.

7

Facebook claims that because it may have stopped the alleged interceptions when the Wall

Plaintiffs Are Entitled To Seek Injunctive Relief.

8

Street Journal exposed it, Plaintiffs therefore cannot seek injunctive relief. Mot. at 25. But

9

Plaintiffs are entitled to seek injunctive relief if there is “a sufficient likelihood that [they] will

10

again be wronged in a similar way.” Haro v. Sebelius, 747 F.3d 1099, 1108 (9th Cir. 2014),

11

citing City of Los Angeles v. Lyons, 461 U.S. 95, 109 (1983). Here, that standard is met.

12

Plaintiffs are still active Facebook users. CAC ¶¶ 5-7. If Facebook truly has ceased all of the

13

unlawful conduct alleged – and Facebook has not confirmed that it has – nothing in the CAC

14

supports finding that Facebook could not again intrude on Plaintiffs’ private correspondence. On

15

the contrary, Plaintiffs allege that Facebook, could surreptitiously repeat this, or similar,

16

misconduct in the future. Id. ¶ 39. Thus, an injunction would constitute appropriate relief.

17

F.

18
19

Leave To Amend Should Be Granted If Any Of Facebook’s Motion Is
Granted.

“[D]ismissal without leave to amend is improper unless it is clear . . . that the complaint

20

could not be saved by any amendment.” Petersen v. Boeing Co., 715 F.3d 276, 280 (9th Cir.

21

2013) (leave to amend “should be granted with extreme liberality.”); Fed. R. Civ. P. 15(a)(2).

22

Plaintiffs have articulated viable legal theories for each of their claims, and should be afforded an

23

opportunity to allege more facts should the Court require it, since in no instance would

24

amendment be futile. Therefore, should the Court grant Facebook’s motion in any part, it should

25

also grant Plaintiffs leave to amend.

26
27
28

25

The CAC therefore meets the pleading requirements of Federal Rule 9(b). Facebook could not
credibly maintain, nor does it in its motion, that it lacks “notice of the particular misconduct . . .
alleged to constitute the fraud[.]” Neubronner v. Milken, 6 F.3d 666, 671 (9th Cir. 1993).
- 25 -

PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH

1
2

V.

CONCLUSION
For the foregoing reasons, Facebook’s motion should be denied in its entirety.

3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21

Dated: July 30, 2014

LIEFF CABRASER HEIMANN & BERNSTEIN, LLP
By:

/s/ Michael W. Sobol
Michael W. Sobol

Michael W. Sobol (State Bar No. 194857)
[e-mail]
Melissa Gardner (State Bar No. 289096)
[e-mail]
LIEFF CABRASER HEIMANN & BERNSTEIN, LLP
275 Battery Street, 29th Floor
San Francisco, CA 94111-3339
Telephone: [phone]
Facsimile: 415.956.1008
Rachel Geman
[e-mail]
Nicholas Diamand
[e-mail]
LIEFF CABRASER HEIMANN & BERNSTEIN, LLP
250 Hudson Street, 8th Floor
New York, NY 10013-1413
Telephone: [phone]
Facsimile: 212.355.9592
Hank Bates (State Bar No. 167688)
[e-mail]
Allen Carney
[e-mail]
David Slade
[e-mail]
CARNEY BATES & PULLIAM, PLLC
11311 Arcade Drive
Little Rock, AR 72212
Telephone: [phone]
Facsimile: 501.312.8505

22
23
24
25
26
27
28
- 26 -

PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH

1
2
3
4

Jeremy A. Lieberman
Lesley F. Portnoy
[e-mail]
POMERANTZ, LLP
600 Third Avenue, 20th Floor
New York, NY 10016
Telephone: [phone]
Facsimile: 212.661.8665

5
6
7
8

Patrick V. Dahlstrom
[e-mail]
POMERANTZ, LLP
10 S. La Salle Street, Suite 3505
Chicago, IL 60603
Telephone: [phone]
Facsimile: 312.377.1184

9
10
11
12

Jon Tostrud (State Bar No. 199502)
[e-mail]
TOSTRUD LAW GROUP, PC
1925 Century Park East, Suite 2125
Los Angeles, CA 90067
Telephone: [phone]
Facsimile: 310.278.2640

13
14

Attorneys for Plaintiffs and the Proposed Class

15
16
17
18
19
20
21
22
23
24
25
26
27
28
- 27 -

PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH