Campbell et al v. Facebook Inc.
Filing
31
RESPONSE (re 29 MOTION to Dismiss Consolidated Amended Complaint ) filed byMatthew Campbell, Michael Hurley, David Shadpour. (Attachments: # 1 Declaration of Michael W. Sobol, # 2 Exhibit A, # 3 Exhibit B, # 4 Exhibit C, # 5 Exhibit D)(Sobol, Michael) (Filed on 7/30/2014)
1
2
3
4
5
6
7
8
9
10
11
Michael W. Sobol (State Bar No. 194857)
msobol@lchb.com
Melissa Gardner (State Bar No. 289096)
mgardner@lchb.com
LIEFF CABRASER HEIMANN & BERNSTEIN, LLP
275 Battery Street, 29th Floor
San Francisco, CA 94111-3339
Telephone: 415.956.1000
Facsimile: 415.956.1008
Rachel Geman
rgeman@lchb.com
Nicholas Diamand
ndiamand@lchb.com
LIEFF CABRASER HEIMANN & BERNSTEIN, LLP
250 Hudson Street, 8th Floor
New York, NY 10013-1413
Telephone: 212.355.9500
Facsimile: 212.355.9592
16
Patrick V. Dahlstrom
pdahlstrom@pomlaw.com
POMERANTZ, LLP
10 S. La Salle Street, Suite 3505
Chicago, Illinois 60603
Telephone: 312.377.1181
Facsimile: 312.377.1184
Hank Bates (State Bar No. 167688)
hbates@cbplaw.com
Allen Carney
acarney@cbplaw.com
David Slade
dslade@cbplaw.com
CARNEY BATES & PULLIAM, PLLC
11311 Arcade Drive
Little Rock, AR 72212
Telephone: 501.312.8500
Facsimile: 501.312.8505
17
Jeremy A. Lieberman
Lesley F. Portnoy
info@pomlaw.com
POMERANTZ, LLP
600 Third Avenue, 20th Floor
New York, New York 10016
Telephone: 212.661.1100
Facsimile: 212.661.8665
Attorneys for Plaintiffs and the Proposed Class
12
13
14
15
18
UNITED STATES DISTRICT COURT
19
NORTHERN DISTRICT OF CALIFORNIA
20
21
22
23
MATTHEW CAMPBELL, MICHAEL
HURLEY, and DAVID SHADPOUR, on
behalf of themselves and all others
similarly situated,
24
Plaintiffs,
25
v.
26
FACEBOOK, INC.,
27
Case No. C 13-05996 PJH
PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
HEARING
Date: September 17, 2014
Time: 9:00 a.m.
Place: Courtroom 3, 3rd Floor
|
The Honorable Phyllis J. Hamilton
Defendant.
28
PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH
1
TABLE OF CONTENTS
2
3
4
Page
I.
II.
5
6
7
8
III.
IV.
9
10
11
12
13
14
15
16
17
18
19
20
INTRODUCTION .................................................................................................. 1
FACTUAL BACKGROUND ................................................................................. 3
A.
Facebook’s Private Message Service And Its Interceptions Of
Content Within Those Messages................................................................. 4
B.
Facebook’s Misleading Disclosures............................................................ 5
C.
The Role of Intercepting User Content On Facebook’s “Ordinary
Course Of Business.” .................................................................................. 5
LEGAL STANDARD ............................................................................................. 6
ARGUMENT .......................................................................................................... 6
A.
Facebook Violated The Electronic Communications Privacy Act. ............ 7
1.
Intercepting And Using The Contents Of Private
Correspondence Is Not Within Facebook’s Ordinary Course
Of Business. .................................................................................... 7
a.
The Plain Meaning Of Section 2510(5)(a)(ii),
ECPA’s Statutory Scheme, And The Legislative
History All Make Clear That The “Ordinary Course
Of Business” Exception Is A Narrow One.......................... 8
b.
Virtually All Courts Addressing “Ordinary Course
Of Business” Interpret The Exception Narrowly. ............... 9
c.
Facebook’s Cases Do Not Support Its Motion.................. 11
d.
Facebook’s Reliance On An Opinion About
Publicly-Disclosed Practices Is Particularly
Misplaced. ......................................................................... 12
2.
Plaintiffs Did Not Consent To Facebook’s Interception And
Use Of Their Private Messages. .................................................... 14
a.
Facebook Did Not Obtain Express Consent. .................... 15
b.
Facebook Did Not Obtain Implied Consent. ..................... 18
3.
21
22
23
24
25
26
27
28
V.
Facebook “Intercepted” Communications “In
Transmission.” .............................................................................. 19
B.
Facebook Violated California Penal Code § 631 ...................................... 19
C.
Facebook Violated California Penal Code § 632 ...................................... 19
D.
Plaintiffs’ Unfair Competition Law Claims Are Adequately
Pleaded. ..................................................................................................... 20
1.
Plaintiffs Have Standing Under the UCL. .................................... 20
2.
Facebook Violated the Unfair Competition Law. ......................... 24
E.
Plaintiffs Are Entitled To Seek Injunctive Relief. .................................... 25
F.
Leave To Amend Should Be Granted If Any Of Facebook’s Motion
Is Granted. ................................................................................................. 25
CONCLUSION ..................................................................................................... 26
-i-
PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH
1
TABLE OF AUTHORITIES
2
Page
3
Cases
Arias v. Mutual Cent. Alarm Serv.,
202 F.3d 553 (2d Cir. 2000) ....................................................................................................... 14
Ashcroft v. Iqbal,
556 U.S. 662 (2009) ............................................................................................................... 6, 19
Berry v. Funk,
146 F.3d 1003 (D.C. Cir. 1998) ........................................................................................... 10, 18
Brennan v. Concord EFS, Inc.,
369 F.Supp.2d 1127 (N.D. Cal. 2005) ....................................................................................... 19
City of Los Angeles v. Lyons,
461 U.S. 95 (1983) ..................................................................................................................... 25
Claridge v. RockYou, Inc.,
785 F. Supp. 2d 855 (N.D. Cal. 2011) ....................................................................................... 23
Cohen v. Facebook, Inc.,
798 F. Supp. 2d 1090 (N.D. Cal. 2011) ..................................................................................... 15
Deal v. Spears,
980 F.2d 1153 (8th Cir. 1992).............................................................................................. 10, 18
Deering v. CenturyTel, Inc.,
No. 10-63, 2011 U.S. Dist. LEXIS 51930 (D. Mont. May 16, 2011) ........................................ 17
Dep’t of Justice v. Reporters Comm. for Freedom of the Press,
489 U.S. 749 (1989) ..................................................................................................................... 6
Doe 1 v. AOL, LLC,
719 F. Supp. 2d 1102 (N.D. Cal. 2010) ..................................................................................... 23
Downing v. Mun. Court,
88 Cal. App. 2d 345 (Cal. App. 1948) ....................................................................................... 22
Dukes v. ADS Alliance Data Sys.,
2006 U.S. Dist. LEXIS 84311 (S.D. Ohio Nov. 20, 2006) ........................................................ 15
Dunbar v. Google, Inc.,
No. 10-194, 2011 U.S. Dist. LEXIS 157932 (E.D. Tex. May 23, 2011) ................................... 10
Duncan v. Walker,
533 U.S. 167 (2001) ..................................................................................................................... 8
Edwards v. First Am. Corp.,
610 F.3d 514 (9th Cir. 2010)...................................................................................................... 21
Farmers Ins. Exch. v. Superior Court,
2 Cal.4th 377 (Cal. 1992) ........................................................................................................... 24
Fisher v. United States,
425 U.S. 391 (1976) ..................................................................................................................... 6
FMC Corp. v. Capital Cities/ABC, Inc.,
915 F.2d 300 (7th Cir. 1990)...................................................................................................... 23
G.S. Rasmussen & Assocs. v. Kalitta Flying Serv.,
958 F.2d 896 (9th Cir. 1992)...................................................................................................... 22
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
- ii -
PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
TABLE OF AUTHORITIES
(continued)
Page
Gilligan v. Jamco Dev. Corp.,
108 F.3d 246 (9th Cir. 1997)........................................................................................................ 6
Griggs-Ryan v. Smith,
904 F.2d 112 (1st Cir. 1990) ...................................................................................................... 18
Hall v. EarthLink Network, Inc.,
396 F.3d 500 (2d Cir. 2005) ................................................................................................. 11, 12
Haro v. Sebelius,
747 F.3d 1099 (9th Cir. 2014).................................................................................................... 25
Hernandez v. Path, Inc.,
2012 U.S. Dist. LEXIS 151035 (N.D. Cal. Oct. 17, 2012) ........................................................ 19
In re Facebook Privacy Litig.,
791 F. Supp. 2d 705 (N.D. Cal. 2011) ....................................................................................... 23
In re Facebook Privacy Litig.,
No. 12-15619, 2014 U.S. App. LEXIS 8679 (9th Cir. May 8, 2014) ........................................ 23
In re Google Inc. Gmail Litig. (“Gmail”),
No. 13-02430, 2013 U.S. Dist. LEXIS 172784
(N.D. Cal. Sept. 26, 2013)................................................................................................... passim
In re Google Inc. Gmail Litig.,
No. 13-02430, 2014 U.S. Dist. LEXIS 36957 (N.D. Cal. Mar. 18, 2014) ................................. 15
In re Google, Inc. Privacy Policy Litig.,
No. 12-01382, 2013 U.S. Dist. LEXIS 171124 (N.D. Cal. Dec. 3, 2013) ................................. 12
In re iPhone Application Litig.,
No. 11-02250, 2011 U.S. Dist. LEXIS 106865
(N.D. Cal. Sept. 20, 2011).......................................................................................................... 23
In re Pharmatrak, Inc. Privacy Litig,
329 F.3d 9 (1st Cir. 2003) .............................................................................................. 14, 15, 18
In re Tobacco II Cases,
46 Cal. 4th 298 (Cal. 2009) ........................................................................................................ 25
In re VistaPrint Corp Mktg. & Sales Practices Litig.,
2009 U.S. Dist. LEXIS 77509 (S.D. Tex. Aug. 31, 2009) ......................................................... 17
Johnson v. Trans Ag.,
770 F.2d 752 (9th Cir. 1984)........................................................................................................ 7
Kaiser Aetna v. United States,
444 U.S. 164 (1979) ................................................................................................................... 22
Kight v. CashCall, Inc.,
200 Cal. App. 4th 1377 (Cal. App. 2011) .................................................................................. 20
Kirch v. Embarq Mgmt. Co.,
702 F.3d 1245 (10th Cir. 2012)............................................................................................ 11, 12
Klamath Water Users Protective Ass’n v. Patterson,
204 F.3d 1206 (9th Cir. 2000).................................................................................................... 15
Korea Supply Co. v. Lockheed Martin Corp.,
29 Cal. 4th 1134 (Cal. 2003) ...................................................................................................... 24
- iii -
PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
TABLE OF AUTHORITIES
(continued)
Page
Kremen v. Cohen,
337 F.3d 1024 (9th Cir. 2003).................................................................................................... 22
Kwikset Corp. v. Superior Court,
51 Cal. 4th 310 (Cal. 2011) ............................................................................................ 21, 23, 24
MacDonald v. Ford Motor Co.,
No. 13-02988, 2014 U.S. Dist. LEXIS 44858
(N.D. Cal. Mar. 31, 2014) .......................................................................................................... 24
Marquis v. Google, Inc.,
No. 11-02808, Mass. Super. Ct. (Jan. 17, 2012) ....................................................................... 10
Mohamed v. Jeppesen Dataplan, Inc.,
579 F.3d 943 (9th Cir. 2009)........................................................................................................ 6
Moskal v. United States,
498 U.S. 103 (1990) ..................................................................................................................... 7
Neubronner v. Milken,
6 F.3d 666 (9th Cir. 1993).......................................................................................................... 25
Opperman v. Path, Inc.,
No. 13-00453, 2014 U.S. Dist. LEXIS 67225
(N.D. Cal. May 14, 2014) .......................................................................................................... 23
Ortega v. O’Connor,
146 F.3d 1149 (9th Cir. 1998)...................................................................................................... 6
People v. Kwok,
63 Cal. App. 4th 1236 (Cal. App. 1998) .................................................................................... 22
Petersen v. Boeing Co.,
715 F.3d 276 (9th Cir. 2013)...................................................................................................... 25
Quon v. Arch Wireless Operating Co., Inc.,
529 F.3d 892 (9th Cir. 2008)...................................................................................................... 17
Rogers v. Ulrich,
52 Cal. App. 3d 894 (1975)........................................................................................................ 20
Shroyer v. New Cingular Wireless Servs., Inc.,
606 F.3d 658 (9th Cir. 2010)........................................................................................................ 6
Shulman v. Group W Productions, Inc.,
18 Cal. 4th 200 (Cal. 1998) .................................................................................................... 3, 20
Siracusano v. Matrixx Initiatives, Inc.,
585 F.3d 1167 (9th Cir. 2009)...................................................................................................... 6
Thomasson v. GC Servs. Ltd. P’ship.,
321 F. App’x 557 (9th Cir. 2008) .............................................................................................. 20
United States v. Bass,
404 U.S. 336 (1971) ..................................................................................................................... 7
United States v. Murdock,
63 F.3d 1391 (6th Cir. 1995)...................................................................................................... 10
United States v. Staves,
383 F.3d 977 (9th Cir. 2004)...................................................................................................... 18
- iv -
PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
TABLE OF AUTHORITIES
(continued)
Page
United States v. Szymuszkiewicz,
622 F.3d 701 (7th Cir. 2010)...................................................................................................... 11
Valentine v. Wideopen West Fin., LLC,
288 F.R.D. 407 (N.D. Ill. 2012) ................................................................................................. 14
Watkins v. L.M. Berry & Co.,
704 F.2d 577 (11th Cir. 1983)........................................................................................ 10, 14, 18
Whalen v. Roe,
429 U.S. 589 (1977) ..................................................................................................................... 6
Statutes
18 U.S.C. § 2510 et seq. ....................................................................................................... 1, 7, 8, 9
18 U.S.C. § 2511(1)(a) ..................................................................................................................... 7
Cal. Bus. & Prof. Code § 17200 et seq. ........................................................................................... 1
Cal. Civ. Code § 654 ...................................................................................................................... 22
Cal. Pen. Code § 631 et seq. ............................................................................................................ 1
Cal. Pen. Code § 632(a) ................................................................................................................. 20
Rules
Fed. R. Civ. P. 15(a)(2) .................................................................................................................. 25
Other Authorities
CAL. CONST., Art. I, § 1 ................................................................................................................ 6
S. Rep. No. 99-541 (1986) ............................................................................................................... 9
17
18
19
20
21
22
23
24
25
26
27
28
-v-
PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH
1
ISSUES TO BE DECIDED
2
1. Does Plaintiffs’ Consolidated Amended Complaint adequately set forth facts, which if
3
considered in a light most favorable to Plaintiffs and taken as true for purposes of this
4
motion, state claims upon which relief may be granted?
5
2. Does Plaintiffs’ Consolidated Amended Complaint adequately set forth facts, which if
6
considered in a light most favorable to Plaintiffs and taken as true for purposes of this
7
motion, demonstrate UCL standing in that they have suffered injury in fact, by
8
alleging violation of federally protected rights, and have lost property or money, by
9
alleging that Facebook has deprived them of exclusive use of their private
10
correspondence?
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
- vi -
PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH
1
2
I.
INTRODUCTION
Defendant Facebook, Inc.’s (“Facebook’s”) motion to dismiss should be denied because it
3
prematurely and improperly seeks to litigate questions of fact and misstates the relevant law.
4
Contrary to Facebook’s incorrect argument that this is copycat litigation, Plaintiffs’ detailed
5
Consolidated Amended Complaint (“CAC”) centers on practices unique to Facebook.
6
Specifically, on October, 2012, security researchers published proof that Facebook was
7
scanning its users’ private messages to learn the substance of those communications. Facebook
8
employed devices to seek out URLs in private messages, and to include that information in
9
profiles of its users. Facebook thus added code to its messaging process that was unnecessary for
10
any purpose other than to enable it to analyze the substance of its users’ messages and determine
11
their meaning, as well as to tie that meaning back to the users.
12
Once these practices were brought to light, Facebook, by its own admission, ceased these
13
scanning practices without changing its disclosures, underscoring that it in no way needed to
14
access the content of messages in order to provide its messaging service, and that its scanning
15
practices were in no way disclosed to its users.
16
The acts articulated in the CAC violate the Electronic Communications Privacy Act,
17
18 U.S.C. §§ 2510 et seq. (“ECPA”), and the California Invasion of Privacy Act, Cal. Penal Code
18
§§ 631 et seq. (“CIPA”) – which broadly prohibit the interception of private communications for
19
purposes of acquiring the substance of those communications – as well as California’s Unfair
20
Competition Law, Cal. Bus. & Prof. Code §§ 17200 et seq. (“UCL”), which prohibits unlawful,
21
unfair, and fraudulent business practices.
22
Plaintiffs’ ECPA Claims – Facebook argues that any “systematic conduct . . . that
23
generates revenue for a company” is exempt from liability under ECPA’s “ordinary course of
24
business” exception. Defendant’s Motion to Dismiss (“Mot.”) at 15. However, and
25
unsurprisingly, no court has ever held that secretly acquiring the substance of private
26
communications is within the ordinary course of a company’s business, and the case law cited in
27
Facebook’s motion is inapposite. Facebook’s circular logic that any conduct done by a business
28
is therefore within the ordinary course of business lacks textual, precedential, or logical support.
-1-
PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH
1
Facebook also submits that its loosely-worded terms of service mean that users have
2
granted explicit consent to these practices. Yet, nothing in Facebook’s disclosures remotely
3
suggests that it would analyze the content of users’ messages – messages that Facebook in fact
4
repeatedly, publicly, characterizes as “private” – to scan them for their substance, and then
5
catalog the information contained in them in a data profile. Facebook’s implied consent argument
6
is equally infirm, and raises questions of fact outside the CAC by suggesting that Facebook’s
7
separate practice of allegedly previewing URLs has anything to do with the issues here.
8
9
10
Finally, Facebook’s argument that its interceptions of private messages did not occur “in
transmission” is another attempt to insert facts not pled in the CAC – indeed, facts in conflict with
those pled – and, thus, is wholly inappropriate to consider at this stage of the litigation.
11
Plaintiffs’ CIPA Claims – Facebook’s argument that Plaintiffs’ communications were
12
“entirely contained” within Facebook’s network has no basis in fact, and is expressly contradicted
13
by Plaintiffs’ allegations. To the extent that Facebook renews its argument regarding consent in
14
the context of CIPA, such an argument fails for the same reasons as it fails under ECPA. Further,
15
the communications at issue are “confidential” within the meaning of CIPA, and Facebook’s
16
activities amounted to “eavesdropping” under the statute.
17
Plaintiffs’ UCL Claims –California law recognizes private communications as property
18
and Plaintiffs have pled facts sufficient to confer standing to assert a UCL claim. Similarly, the
19
facts set forth in the CAC sufficiently articulate a violation of each prong of the UCL. Facebook
20
unlawfully violated both ECPA and CIPA; it unfairly sacrificed the rights of consumers in pursuit
21
of its personal gain, and it fraudulently misled both Plaintiffs and the public that “private”
22
messages sent over Facebook would be just that – private.
23
Plaintiffs’ Request for Injunctive Relief – Finally, Facebook’s concession that it
24
abandoned its invasive practices once they were uncovered should not preclude injunctive relief
25
here, as there is no guarantee that Facebook will not resume its conduct at any point in the future.
26
While Facebook attempts to recast its conduct as innocuous routing protocol coupled with
27
“anonymized”1 observation, in reality it has committed a breach of trust from which every
28
1
Here, again, Facebook advances facts in not pled in the CAC. Specifically, it claims that the
Footnote continued on next page
-2-
PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH
1
facilitator of communications is prohibited: it acquired the substance of its users’ communications
2
without their consent. These acts are the twenty-first-century equivalent of AT&T eavesdropping
3
on each of its customers’ phone conversations, or of a common carrier taking information from
4
private correspondence; acts which would uniformly be condemned as egregious and illegal
5
invasions of privacy under any circumstance. As the California Supreme Court has said:
6
[A] measure of personal isolation and personal control over the
conditions of its abandonment is of the very essence of personal
freedom and dignity…. A [person]…whose conversations may be
overheard at the will of another…is less of a [person], has less
human dignity, on that account. He who may intrude upon another
at will is the master of the other and, in fact, intrusion is a primary
weapon of the tyrant.
7
8
9
10
11
Shulman v. Group W Productions, Inc., 18 Cal. 4th 200, 231 (Cal. 1998) (citation omitted).
12
II.
13
FACTUAL BACKGROUND
Facebook systematically intercepted its users’ private messages to acquire information
14
concerning their content. CAC¶¶ 25-58. Specifically, when users employed Facebook’s private
15
message service, Facebook surreptitiously utilized devices to scan the contents of those messages,
16
in order to determine whether users had included links to other websites within them. Id. ¶¶ 17-
17
24, 31, 34, 38-39, 47-48. When the message contained a link to a third party website, Facebook’s
18
routing procedures and code would then notate that link, in that it would add it as a data point on
19
user profiles it assembled for both the sender and recipient of the message. It then used that
20
information to inflate the “Like” counters on websites associated with Facebook. Id.
21
Facebook in no way needed to engage in this practice to provide its private messaging
22
service. Id. ¶¶ 22-58. In fact, actions that Facebook attempts to characterize as (1) minimal,
23
technical steps incident to providing its most basic services and (2) procedures openly disclosed
24
to its users were, in fact, so opaque and so far outside the norm that, when exposed, the story
25
made national news in the Wall Street Journal. Id. ¶¶ 35-39. Within a month of being exposed in
26
27
28
Footnote continued from previous page
data points assembled from its message scans are “anonymous and aggregate” Mot. at 1
(emphasis original). Plaintiffs have instead asserted that these data points are precisely what
Facebook uses in assembling its individualized user profiles. CAC ¶¶ 41-49.
-3-
PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH
1
the press, Facebook quietly ceased its practice of intercepting private messages’ content. Id.
2
¶¶ 39, 59 n.3. This about-face had no impact on Facebook’s ability to transmit private messages
3
or protect the security of its services. Id. ¶ 39. Nor did it occasion a revision to any of
4
Facebook’s disclosures to its users, an implicit admission that the practice was never disclosed to
5
users in the first place. Id.
6
A.
7
8
9
Facebook’s Private Message Service And Its Interceptions Of Content Within
Those Messages.
Recognizing that users do not wish for every activity on Facebook to be part of a record,
Facebook offers a “private message” service as a counterpoint to public or group posts. Id. ¶¶ 20-
10
24. The service combines email, chat, text messaging, and in-service messaging, thereby
11
enabling users to send and receive private messages within and outside of Facebook, and across
12
different devices. Id. ¶ 22. Facebook tells users they have “unprecedented” control over privacy
13
when operating this service, promising they are “only sharing the information you want to, and
14
you’re only sharing it with the people you want to share it with.” Id. ¶¶ 23-24. But Facebook’s
15
assurances of user control and privacy were directly contradicted by its actions. Id. ¶¶ 25-58.
16
At least until it was exposed by the press in October, 2012, Facebook took several steps in
17
the private message routing process to intercept the substance of users’ private messages. Id.
18
When a user’s private message included a link to a web page (a “URL”), Facebook employed
19
devices called “web crawlers” to (1) scan the web page’s contents, (2) determine whether there
20
was a “Like” plugin2 embedded in that page, (3) add a “Like” to the aggregate count on behalf of
21
the sender and each recipient, and (4) associate “Liking” that web page with the secretly-
22
assembled profiles of the sender and each recipient. Id. Facebook engaged in this conduct in
23
order to compile data points for its ever-expanding user profiles. Id.
24
As discussed above, Facebook’s conduct is an elemental invasion of privacy. Id. ¶¶ 53-
25
55. By intercepting private message content Facebook gained significant, and completely
26
2
27
28
Facebook uses a variety of mechanisms to record activity not just on its social network, but on
the Internet, at large. CAC ¶¶ 26-34, 41-49. One such mechanism is the “Like” button; code that
enables users to publicly “Like” third party websites – and alerts Facebook to the fact that those
users have some affinity for the material on that web page. Id. Facebook relies heavily on what
individual users “Like” to create user profiles for serving targeted advertising. Id.
-4-
PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH
1
personalized, intelligence on each user – information the user chose to share privately – without
2
their knowledge or consent. Id. ¶¶ 32-34, 41-52, 56-58.
3
B.
4
At all times relevant to this litigation, Facebook failed to notify users that it intercepted
Facebook’s Misleading Disclosures.
5
and catalogued the content of their private correspondence. Id. ¶¶ 17-24, 31. Indeed, Facebook
6
affirmatively represented that users’ messages would be “private,” and provide “unprecedented”
7
user control. Id. Facebook’s Data Use Policy conspicuously failed to seek users’ permission to
8
access user-generated content and correspondence. Ex. B3; Part IV-A-2, infra. And in separate
9
disclosures about technical data – which do not concern such content at all – Facebook stated
10
only that it may collect “data about” users’ messages. Id. In direct contradiction to its
11
representations to users, Facebook scanned users’ private messages to get information about their
12
substance. Id. When Facebook purportedly discontinued that practice, it did not revise any of its
13
disclosures, which had never disclosed the interceptions to begin with. Id. ¶¶ 17-24, 31, 38-39.
14
C.
15
16
The Role of Intercepting User Content On Facebook’s “Ordinary Course Of
Business.”
Similarly, while Facebook may have ceased intercepting, cataloging, and manipulating the
17
content within its users’ private messages following an exposé in the Wall Street Journal, this re-
18
tooling of its routing processes and devices had no impact on Facebook’s ability to transmit
19
messages, ensure service safety, protect intellectual property, or to generally offer its product or
20
services. Id. ¶¶ 37-39. Instead, Facebook simply (and quietly) ceased practices that were wholly
21
extraneous to the services it purported to offer, and that were employed for the sole purpose of
22
mining private communications for information that would benefit Facebook’s bottom line. Id.
23
On December 30, 2013, Plaintiffs brought this action for damages and injunctive relief
24
against Facebook under ECPA, CIPA and the UCL, and declaratory relief and restitution under
25
ECPA and the UCL. The CAC was filed on April 25, 2014. On June 17, 2014, Facebook filed
26
the instant motion to dismiss.
27
28
3
Unless otherwise stated, references to exhibits (“Ex.”) are to the Declaration of Michael Sobol.
-5-
PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH
1
III.
LEGAL STANDARD
2
Dismissal under Rule 12(b)(6) is appropriate only where the complaint lacks “a
3
cognizable legal theory” or “sufficient facts to support a cognizable legal theory.” Shroyer v.
4
New Cingular Wireless Servs., Inc., 606 F.3d 658, 664 (9th Cir. 2010). The issue is not whether
5
the non-moving party will ultimately prevail but whether it is entitled to offer evidence to support
6
the claims asserted. Gilligan v. Jamco Dev. Corp., 108 F.3d 246, 249 (9th Cir. 1997). The Court
7
must draw “all reasonable inferences from the complaint in [plaintiffs’] favor,” Mohamed v.
8
Jeppesen Dataplan, Inc., 579 F.3d 943, 949 (9th Cir. 2009), and “must accept as true all of the
9
factual allegations contained in the complaint” and “construe them in the light most favorable to
10
the plaintiffs.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009); Siracusano v. Matrixx Initiatives,
11
Inc., 585 F.3d 1167, 1177 (9th Cir. 2009).
12
IV.
ARGUMENT
The right of privacy is a personal and fundamental right in California4 and the United
13
14
States.5 “Personal letters,” in particular, “constitute an integral aspect of a person’s private
15
enclave.” Fisher v. United States, 425 U.S. 391, 427 (1976); Ortega v. O’Connor, 146 F.3d
16
1149, 1161 (9th Cir. 1998) (personal communications “lie at the heart of our sense of privacy.”)
17
(citation omitted). Federal law has long protected privacy rights in personal communications.
18
ECPA was passed in 1986 with the express purpose of affording to electronic communications
19
the same protections that attach to private letters sent via the U.S. Postal Service. In
20
recommending that ECPA be adopted, the Senate Committee on the Judiciary stated:
21
A letter sent by first class mail is afforded a high level of protection
against unauthorized opening by a combination of constitutional
provisions, case law, and U.S. Postal Service statutes and
regulations. Voice communications transmitted via common carrier
are protected by Title III of the Omnibus Crime Control and Safe
22
23
24
25
26
27
28
4
CAL. CONST., Art. I, § 1, adopted as ballot measure in 1972 (“All people are by nature free
and independent and have inalienable rights. Among these are enjoying and defending life and
liberty, acquiring, possessing, and protecting property, and pursuing and obtaining safety,
happiness, and privacy.”)
5
Dep’t of Justice v. Reporters Comm. for Freedom of the Press, 489 U.S. 749, 763 (1989)
(“[B]oth common law and the literal understanding of privacy encompass the individual’s control
of information concerning his or her own person”); Whalen v. Roe, 429 U.S. 589, 605 (1977).
-6-
PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH
1
Streets Act of 1968. But there are no comparable Federal statutory
standards to protect the privacy and security of communications
transmitted by new noncommon carrier communications services or
new forms of telecommunications and computer technology. This is
so, even though American citizens and American businesses are
using these new forms of technology in lieu of, or side-by-side
with, first class mail and common carrier telephone services.
2
3
4
5
6
CAC ¶ 53.
A.
7
ECPA provides a civil cause of action against any person who “intentionally intercepts . . .
8
9
10
11
12
13
14
15
16
Facebook Violated The Electronic Communications Privacy Act.
any wire, oral, or electronic communication.” 18 U.S.C. § 2511(1)(a). The Act further clarifies
that intercepting a message’s content is proscribed, and defines “intercept” as “the aural or other
acquisition of the contents of any wire, electronic, or oral communication through the use of any
electronic, mechanical, or other device.” Id. at § 2510(4) (emphasis added). “Contents” are
defined as “any information concerning the [communication’s] substance, purport, or meaning.”
Id. at § 2510(8). Thus, ECPA prohibits Facebook’s conduct alleged here: it prohibits any nonparticipant to an electronic communication from acquiring “any information concerning the
substance, purport, or meaning” of the communication. Id. (emphasis added). 6
1.
17
Intercepting And Using The Contents Of Private Correspondence Is
Not Within Facebook’s Ordinary Course Of Business.
18
ECPA provides a narrow exception to its blanket prohibition on message interception,
19
20
21
22
23
24
25
26
27
28
exempting from its definition of “device” any equipment used by an electronic communications
service in the “ordinary course of its business.” Id. § 2510(5)(a)(ii). As with any affirmative
defense, the burden to prove this exception falls upon the party asserting the defense – here,
Facebook. See Johnson v. Trans Ag., 770 F.2d 752, 762 (9th Cir. 1984). Facebook cannot meet
6
Facebook argues that ECPA must be construed narrowly because it is a criminal statute. But
that rule of lenity, if it is of any relevance in a civil context, applies only where a statute is
ambiguous, and there is no ambiguity here. Accordingly, the rule cannot avail Facebook. See
Moskal v. United States, 498 U.S. 103, 108 (1990) (rule of lenity applies only where “a
reasonable doubt persists about a statute’s intended scope even after resort to ‘the language and
structure, legislative history, and motivating policies’ of the statute.”) (citation omitted); United
States v. Bass, 404 U.S. 336, 347 (1971) (court should rely on lenity only if, “after seizing every
thing from which aid can be derived,” it is “left with an ambiguous statute”) (citations omitted).
-7-
PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH
1
its burden for multiple reasons. First, the plain meaning of ECPA, its statutory scheme, and its
2
legislative history, all make plain that the ordinary course of business exception is a narrow one.
3
Second, every court considering the applicability of section 2510(5)(a)(ii) to the kind of conduct
4
at issue here – the undisclosed interception and mining of the content of private communications,
5
for an undisclosed commercial purpose, in a manner unrelated to the transmission of the messages
6
– has rejected Facebook’s interpretation of the statute. Indeed, the cases upon which Facebook
7
relies for its incorrect and broad reading of “ordinary course of business” do not directly address
8
allegations of invasion of privacy such as scanning messages to obtain their substance. Further,
9
to the extent that Facebook interprets one lone holding to require a broad interpretation of section
10
2510(5)(a)(ii), Facebook’s contorted interpretation of that holding is at odds with established
11
ECPA precedent.
12
13
a.
The Plain Meaning Of Section 2510(5)(a)(ii), ECPA’s Statutory
Scheme, And The Legislative History All Make Clear That The
“Ordinary Course Of Business” Exception Is A Narrow One.
14
At the outset, it is critical to note that Congress circumscribed the term “course of
15
business” with the limiting modifier “ordinary.” In re Google Inc. Gmail Litig. (“Gmail”), No.
16
13-02430, 2013 U.S. Dist. LEXIS 172784, at *29 (N.D. Cal. Sept. 26, 2013) (Koh, J.) (“The
17
presence of the modifier ‘ordinary’ must mean that not everything [a defendant] does in the
18
course of its business would fall within the exception.”). Ignoring this, Facebook posits that any
19
“systematic conduct . . . that generates revenue for a company” is entitled to an exemption. Mot.
20
at 15. This writes “ordinary” completely out of the statute, thus conflicting with bedrock rules of
21
statutory interpretation. Duncan v. Walker, 533 U.S. 167, 174 (2001) (in interpreting a statute,
22
courts should “give effect, if possible, to every clause and word[.]”).
23
Beyond the plain meaning of section 2510(5)(a)(ii), ECPA’s broader statutory scheme
24
indicates that the “ordinary course of business” exception is focused only on devices used for
25
transmitting communications. ECPA defines an “electronic communication service” (“ECS”) as
26
“any service which provides the users thereof the ability to send or receive wire or electronic
27
communications.” 18 U.S.C. § 2510(15) (emphasis added). Similarly, an “electronic
28
communications system” is a facility used for the “transmission of wire or electronic
-8-
PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH
1
communications.” 18 U.S.C. § 2510(14) (emphasis added). These definitions evidence the
2
legislature’s understanding of the “business” in which ECS providers are involved: transmitting
3
communications – not harvesting them for profitable tidbits about the authors.
4
A separate exception to the Wiretap Act related to ECS providers is also instructive; it
5
states that ECS providers may intercept communications “while engaged in any activity which is
6
a necessary incident to the rendition of his service or to the protection of the rights or property of
7
the provider of that service,” but the provider may not “utilize service observing or random
8
monitoring except for mechanical or service quality control checks.” Gmail, 2013 U.S. Dist.
9
LEXIS 172784, at *35 (quoting 18 U.S.C. § 2511(2)(a)(i)). As Gmail held, because this language
10
“explicitly limits the use of service observing or random monitoring by [ECS] providers to
11
mechanical and service quality control checks . . . the statutory scheme suggests that Congress did
12
not intend to allow [ECS] providers unlimited leeway to engage in any interception that would
13
benefit their business models.” Id. at *36.
14
Finally, legislative history supports a narrow reading of section 2510(5)(a)(ii). A Senate
15
Report on ECPA states that, while ECS providers may have to “monitor a stream of transmissions
16
in order to properly route, terminate, and otherwise manage the individual messages they
17
contain,” these acts do not violate ECPA only because “[t]hese monitoring functions . . . do not
18
involve humans listening in on voice conversations.” Ex. C (S. Rep. No. 99-541, at 20 (1986)).
19
Analyzing this language, Gmail found that an ECS provider therefore “must show some link
20
between the alleged interceptions at issue and its ability to operate the communication system” to
21
be eligible for section 210(5)(a)(ii)’s protection. 2013 U.S. Dist. LEXIS 172784, at *37.
22
Congress created a narrow exception to ECPA under section 2510(5)(a)(ii), one that
23
applies only when an ECS provider employs technologies incidental to transmitting
24
communications, and not for undisclosed acquisition of the “substance, purport, or meaning” of
25
the content contained within those communications.
26
27
28
b.
Virtually All Courts Addressing “Ordinary Course Of
Business” Interpret The Exception Narrowly.
To date, every court assessing the applicability of section 2510(5)(a)(ii) to a defendant’s
-9-
PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH
1
undisclosed acts of intercepting and mining of private communications’ content has found such
2
conduct to be outside of ECPA’s narrow exception. See Gmail, 2013 U.S. Dist. LEXIS 172784 at
3
*27-28 (section 2510(5)(a)(ii) applies only when interceptions are an “instrumental part of the
4
transmission;” scanning for user profiling or advertising is not “related to . . . transmission.”)
5
(emphasis added); Dunbar v. Google, Inc., No. 10-194, 2011 U.S. Dist. LEXIS 157932, at *11
6
(E.D. Tex. May 23, 2011) (when scanning was for purposes other than facilitating email
7
transmission, “[t]he applicability of the ‘ordinary course of business’ exception . . . cannot be
8
resolved at the pleading stage.”); Ex. D (Marquis v. Google, Inc., No. 11-02808, Mass. Super.
9
Ct., at Suffolk at 8-9 (Jan. 17, 2012) (same, interpreting an analogous Massachusetts state law)).
10
A defendant does not enjoy section 2510(5)(a)(ii)’s protection when, as here, the
11
interception “is both physically and purposively unrelated to [the] provision of email services.”
12
Gmail, 2013 U.S. Dist. LEXIS 172784 at *42. See also Watkins v. L.M. Berry & Co., 704 F.2d
13
577, 582 (11th Cir. 1983) (“The phrase ‘in the ordinary course of business’ cannot be expanded to
14
mean anything that interests a company.”); Berry v. Funk, 146 F.3d 1003, 1009 (D.C. Cir. 1998)
15
(actions are in the ordinary course of business only if they are “justified by a valid business
16
purpose” or “shown to be undertaken normally”).
17
Moreover, as Gmail emphasized, a companion clause articulating an “ordinary course of
18
business” exception in the employment context, section 2510(5)(a)(i), is routinely – narrowly –
19
interpreted. 2013 U.S. Dist. LEXIS 172784 at *39-40; see also United States v. Murdock, 63
20
F.3d 1391, 1396-97 (6th Cir. 1995) (noting that a “substantial body of law has . . . narrowly
21
construed the phrase ‘ordinary course of business,’” and that “indiscriminate recording of both
22
incoming and outgoing calls” does not constitute the ordinary course of business.); Deal v.
23
Spears, 980 F.2d 1153, 1158 (8th Cir. 1992) (stating that general practice of surreptitious
24
monitoring “takes us well beyond the boundaries of the ordinary course of business.”).
25
26
27
28
Finally, the Seventh Circuit’s analysis in United States v. Szymuszkiewicz makes plain that
a “device” can be used in violation of ECPA even if it otherwise facilitates transmission:
[W]e don’t see any need to search for a device that is different
from, or not integral to, the legitimate communication. [Courts
have] added this “different device” requirement to the statutory text
- 10 -
PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH
1
to avoid what those judges thought would otherwise be a rule that
made ordinary usage of a telephone or computer criminal. . . . This
fear just shows why it is a mistake to read snippets of a statute in
isolation. For another section of [ECPA] declares that ‘it shall not
be unlawful . . . for a person . . . to intercept a wire, oral or
electronic communication where such person is a party to the
communication or where one of the parties . . . has given prior
consent.’ [citation omitted]. . . . It is better to follow the statute
than to make up limitations to avert imaginary problems.
2
3
4
5
6
7
622 F.3d 701, 707 (7th Cir. 2010) (Easterbrook, J.) (emphasis added).7
c.
8
Facebook’s Cases Do Not Support Its Motion.
The cases relied upon by Facebook are distinguishable from this case, chiefly because
9
10
none of them involved defendants intercepting message content without consent. Indeed, while
11
the cases discussed above analyzed the ordinary course of business exception in the relevant
12
context: secretly acquiring the substance of intercepted communications, two of the three
13
principal cases cited by Facebook involved defendants who had merely transmitted electronic
14
communications, which they at no point scanned for “any information concerning the substance,
15
purport, or meaning.” Further, these opinions addressed rulings at the summary judgment stage,
16
and are thus scarcely relevant to this Court’s analysis at the pleadings stage. See Hall v.
17
EarthLink Network, Inc., 396 F.3d 500 (2d Cir. 2005) (affirming order granting summary
18
judgment); Kirch v. Embarq Mgmt. Co., 702 F.3d 1245 (10th Cir. 2012) (same). The remaining
19
case, upon which Facebook principally relies, only addresses challenges to a defendant’s
20
disclosed practices, and is thus wholly inapposite.
21
For its expansive reading of section 2510(5)(a)(ii), Facebook misleadingly cites to Hall v.
22
EarthLink Network, Inc., a case about a disgruntled Earthlink email account-holder who, after his
23
account was closed, sued Earthlink for failing to “bounce” emails subsequently sent to the
24
account. 396 F.3d 500, 502 (2d Cir. 2005). The Second Circuit held that Earthlink did not
25
26
27
28
7
This reasoning applies with equal force to Facebook’s argument. Facebook explains away its
ECPA violations on the premise that it “requires access to message information . . . for myriad
features crucial to providing its services.” Mot. at 10. However, at no point does Facebook
explain – nor can it – how obtaining the content within those messages furthers those purposes,
nor does it explain how protocols and portions of code that Facebook ceased utilizing almost two
years ago remain critical to its “ordinary course of business” today, or indeed were ever critical.
- 11 -
PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH
1
violate ECPA given that (1) no evidence that receipt of emails – and nothing more than mere
2
receipt – was outside Earthlink’s ordinary course of business; and (2) Earthlink did not have the
3
technical ability to bounce emails after closing an account. 396 F.3d at 505. By contrast, beyond
4
“receiving” messages, here Facebook accessed, analyzed, and used the content within them.
5
CAC ¶¶ 25-58. Further, Plaintiffs allege – and Facebook concedes – that Facebook did have the
6
capacity to transmit private messages without intercepting their content, as evidenced by its
7
ceasing the practice following the Wall Street Journal exposé. Id. ¶¶ 39, 59 n.3; Mot. at 25.
8
9
Far from supporting Facebook’s defense, Kirch v. Embarq Management Company further
clarifies that the ordinary course of business exception cannot avail ECS providers that access
10
communications to learn information about their content. 702 F.3d 1245 (10th Cir. 2012). Kirch
11
concerned an internet service provider, Embarq, that had given third party, NebuAd, access to
12
user data on its network. Only NebuAd, not Embarq, had examined transmissions to discern their
13
content and meaning. Id. at 1250. The court held that Embarq had not violated ECPA where it
14
never examined “any of the raw data that NebuAd may have looked at.” Id. Implicit in this
15
holding is that if Embarq had itself attempted to divine the contents of user transmissions, then it
16
would have violated ECPA just like NebuAd.8 2013 U.S. Dist. LEXIS 172784 at *32 (“Google is
17
more akin to NebuAd, which intercepted data for the purpose of . . . advertising – a purpose
18
separate and apart from . . . provision of internet service.”). Here, Plaintiffs allege that Facebook
19
acquired and examined the contents of Plaintiffs’ messages in order to learn information about
20
their “substance, purport, or meaning.” CAC ¶¶ 25-58. Thus Kirch is inapposite.
21
d.
22
Facebook’s Reliance On An Opinion About Publicly-Disclosed
Practices Is Particularly Misplaced.
23
Chiefly, Facebook cites In re Google, Inc. Privacy Policy Litig. (“Google”), in support of
24
its far-reaching argument that “systematic conduct . . . that generates revenue for a company is the
25
very essence of a company acting ‘in the ordinary course of it business.’” Mot. at 15 (citing No.
26
12-01382, 2013 U.S. Dist. LEXIS 171124 (N.D. Cal. Dec. 3, 2013)). Facebook’s interpretation
27
28
8
The Kirch plaintiffs settled their claims against NebuAd in a prior proceeding. 702 F.3d at
1248, n.2.
- 12 -
PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH
1
of Google leads to absurd results; creating blanket immunity for any ECS provider, so long as
2
they acted in pursuit of profit. Such a broad reading contradicts the principle evident throughout
3
ECPA’s text, legislative history, and interpretive case law, that ECS providers may not secretly
4
monitor users’ communications to learn about their substance. Further, Google is distinguishable
5
because it concerned a claim entirely different from that here – one based upon neither
6
undisclosed scanning of message content nor the violation of internal policies, and to the extent
7
that Google could support an expansive reading of section 2510(5)(a)(ii), the court’s analysis did
8
not substantively distinguish the more comprehensive analysis of the Gmail opinion.
9
The core of the plaintiffs’ case in Google was profoundly different from this case. There,
10
users complained that Google had adopted a universal policy covering all of its services – e.g.,
11
Gmail, YouTube, Google Maps – which enabled it to share user data across all of these services.
12
Id. at *6. Previously, such data was not comingled. Id. Thus, the plaintiffs did not plead that
13
Google had done anything secretly, but rather had acted in accord with announced practices. Id.
14
This fact – absent here – was fatal to the ECPA claim. Id. at *36 (“Plaintiffs’ claim is not that
15
Google did anything in secret . . . .”). Here, Facebook’s monitoring was undertaken
16
surreptitiously. See, e.g. CAC ¶ 38. This fact, alone, renders the Google holding inapposite.
17
To the extent that Google may support a broad reading of section 2510(5)(a)(ii), the
18
court’s analysis focused solely on the presence of the word “business,” and neglected to account
19
for the modifier “ordinary.” 2013 U.S. Dist. LEXIS 171124 at *33. For the reasons discussed in
20
Part IV-A-1-a above, this inverts the critical inquiry – the limiting modifier “ordinary” must be
21
reconciled with Congressional intent. Gmail, 2013 U.S. Dist. LEXIS 172784 at *29.
22
Additionally, although it referenced Gmail, Google did not controvert Gmail’s analysis of
23
ECPA’s statutory scheme, case law, or legislative history. 2013 U.S. Dist. LEXIS 171124 at *37.
24
Instead, Google distinguished Gmail on the grounds that “among other things, the court’s
25
thorough analysis addressed allegations that Google’s practices violated its own internal policies,
26
further establishing that its actions are outside the course of its business.” Id. Here, too, Google’s
27
holding cannot be readily analogized in light of the CAC’s factual allegations contrasting
28
representations Facebook made to users with Facebook’s surreptitious scans of private messages.
- 13 -
PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH
1
See, e.g., CAC at ¶¶ 9-21, 23-25; 34; 47; 48; 57-58; Exs. A-B.
2
Ultimately, Google conflates the “ordinary course of business” analysis with whether or
3
not the practice was disclosed, i.e., whether consent was obtained. 2013 U.S. Dist. LEXIS
4
171124 at *36 (emphasizing that practice was “publicly announced”). 9 In the court’s view, if an
5
ECS announces a practice, it is presumptively in the ECS’s “ordinary course of business.” Id. at
6
*36-37. However, even assuming arguendo that such an analysis is proper under ECPA,
7
Plaintiffs still prevail here: Facebook did not disclose its practice of scanning private messages
8
for their content, and thus cannot presumptively have acted in the ordinary course of business.
9
Accordingly, the Court should reject Facebook’s contention that intercepting the contents
10
of users’ private messages is lawful under ECPA’s narrow ordinary course of business exception.
11
2.
12
Plaintiffs Did Not Consent To Facebook’s Interception And Use Of
Their Private Messages.
13
Facebook argues that Plaintiffs consented to its conduct – expressly, because Plaintiffs
14
viewed Facebook’s disclosures, and impliedly, because when Plaintiffs pasted a URL link into
15
their messages, a “thumbnail preview” would appear, which showed a brief description of the
16
website at that link. Mot. at 17-18. As “the party seeking the benefit of the exception,” Facebook
17
bears the burden of proving consent. In re Pharmatrak, Inc. Privacy Litig, 329 F.3d 9, 19 (1st
18
Cir. 2003). Consent is “an affirmative defense to an ECPA claim that need not be anticipated by
19
Plaintiffs in the pleadings.” Valentine v. Wideopen West Fin., LLC, 288 F.R.D. 407, 413 (N.D.
20
Ill. 2012). Under ECPA, consent may be express or implied, but it “is not an all-or-nothing
21
proposition.” Gmail, 2013 U.S. Dist. LEXIS 172784, at *47. A party “may consent to the
22
interception of only part of a communication or to the interception of only a subset of its
23
communications.” Pharmatrak, 329 F.3d at 21 (consent to collecting non-identifiable user data
24
not consent for identifiable data).10 “[A] reviewing court must inquire into the dimensions of the
25
9
26
27
28
Under ECPA, consent and acting within the ordinary course of business are two, distinct
inquiries. See, e.g., Arias v. Mutual Cent. Alarm Serv., 202 F.3d 553, 559 (2d Cir. 2000)
(“Given . . . this distinct consent exception, . . . it is a misreading of Title III to import wholesale a
consent requirement into the ordinary course of business analysis at issue here.”).
10
See also Gmail, 2013 U.S. Dist. LEXIS 172784, at *50 (consent to process email for spam not
consent to process for profiling and advertising); Watkins, 704 F.2d 577 at 582 (consent to
Footnote continued on next page
- 14 -
PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH
1
2
consent and then ascertain whether the interception exceeded those boundaries.” Id. at 21.
Facebook presents its express consent argument by cobbling together out-of-context
3
snippets from its Data Use Policy. But read in context, Facebook’s snippets give away the ruse.
4
See Klamath Water Users Protective Ass’n v. Patterson, 204 F.3d 1206, 1210 (9th Cir. 2000)
5
(“[A] written contract must be read as a whole . . . with preference given to reasonable
6
interpretations.”) Even standing alone, these snippets do not notify users that Facebook would
7
intercept the substance of their messages. And Facebook fatally misunderstands what it must
8
show to establish implied consent. Accordingly, it cannot escape liability under ECPA.
9
10
a.
Facebook Did Not Obtain Express Consent.
Plaintiffs did not expressly consent to Facebook’s interceptions. “[E]xpress consent is
11
usually a question of fact, where a fact-finder needs to interpret the express terms of any
12
agreements to determine whether these agreements adequately notify individuals regarding the
13
interceptions.” In re Google Inc. Gmail Litig., No. 13-02430, 2014 U.S. Dist. LEXIS 36957, at
14
*57 (N.D. Cal. Mar. 18, 2014). This analysis asks what the relevant disclosures would mean to a
15
reasonable person. Id. at *55; Cohen v. Facebook, Inc., 798 F. Supp. 2d 1090, 1095 (N.D. Cal.
16
2011) (holding that given a “natural” reading, disclosures by Facebook provided inadequate
17
notice of alleged privacy invasions to establish consent).
18
At least until this litigation, Facebook has unswervingly told users that “[y]ou own all of
19
the content and information you post on Facebook, and you can control how it is shared. . . .”
20
Ex. A at 1.11 Facebook’s Data Use Policy thus seeks users’ permission to process specific types
21
of user information for identified purposes. Ex. B at 4. Facebook therefore has encouraged users
22
to read its disclosures narrowly, as notice of specific exceptions to the general rule that users own
23
and control their data themselves. Facebook’s disclosures of the “[i]nformation we receive about
24
you” is broken up into three discrete sections of the Data Use Policy. These sections identify
25
what Facebook calls “different types of information” that Facebook receives, namely: (1) “Your
26
Footnote continued from previous page
monitoring sales calls not consent for personal calls); Dukes v. ADS Alliance Data Sys., 2006 U.S.
Dist. LEXIS 84311, 44 (S.D. Ohio Nov. 20, 2006) (consent to monitoring calls for customer
service not consent for listening in on private calls).
11
See also Ex. B at 4 (Data Use Policy) (“[Y]ou always own all of your information.”).
27
28
- 15 -
PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH
1
information”; (2) “Information others share about you”; and (3) “Other information we receive
2
about you”. Ex. B at 2-3.
3
The “Your information” section is devoted to user-generated content and communications.
4
It expressly encompasses the “Information you choose to share” such as “when you post a status
5
update, upload a photo, or comment on a friend’s story . . . [and] . . . when you communicate with
6
[Facebook], such as when you contact [Facebook] using an email address . . . .” Ex. B at 2. A
7
reasonable user would expect to find any disclosures about the content of private messages in the
8
“Your information” section along with the disclosures about the content of other communications,
9
but it is not there. By listing every type of communication related to Facebook except private
10
messages, the “Your information” disclosure implicitly excludes such messages from those that
11
Facebook seeks permission to access and use. In Gmail, the Court found that an analogous
12
omission – stating that emails directly to Google would be monitored but failing to mention other
13
communications – “could mislead users into believing that user communications to each other or
14
to nonusers were not intercepted.” Gmail, 2013 U.S. Dist. LEXIS 172784, at *53 (denying
15
motion to dismiss on express consent defense).
16
Indeed, Facebook’s sole reference to when users “send or receive a message” is altogether
17
independent of the disclosures under “Your information.” It appears in a separate section,
18
applicable to a “different type[] of information” titled “Other information we receive about you.”
19
A reasonable user would not expect to find notice about the content of private communications in
20
the “Other information” section because it concerns “data” of a technical nature. First, it says that
21
Facebook receives “data about you whenever you use or are running Facebook,” including when
22
you “send or receive a message.” Ex. B at 2-3. The remaining categories of “data about you”
23
that Facebook seeks permission to collect here are:
24
25
26
27
28
[M]etadata such as the time, date, and place you took [photos or
videos] . . . .[N]etwork and communication information, such as
your IP address or mobile phone number . . . your internet service,
operating system, location, the type (including identifiers) of the
device or browser you use, or the pages you visit . . . .[T]he date
and time you visit [a game, application, or certain websites] . . .; the
web address, or URL, you’re on; technical information about the IP
address, browser and the operating system you use . . . .Data from .
- 16 -
PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH
1
. . third parties . . . [such as] how you responded to an ad on
Facebook or on another site . . . .
2
3
Id. Facebook’s self-serving interpretation of the reference within “Other information” to
4
messages – i.e. that users should have understood “data about” their correspondence to include its
5
substance – should be rejected. Nothing there told users that Facebook would open up their
6
private messages and use the contents to profile users and boost “Like” counters. At most, users
7
consented to interception of “data about” their private messages, such as when and to whom they
8
were sent – the kind of data any common carrier might receive about a communication, without
9
opening it up. Cf. Quon v. Arch Wireless Operating Co., Inc., 529 F.3d 892, 905 (9th Cir. 2008)
10
(“As with letters and e-mails, it is not reasonable to expect privacy in the information used to
11
‘address’ a text message . . . . However, users do have a reasonable expectation of privacy in the
12
content of their text messages vis-à-vis the service provider.”)
Facebook cannot show that Plaintiffs had specific notice of its interceptions and their
13
14
purposes, as it must to prevail on its defense. For the same reason, the authority cited in support
15
of Facebook’s motion is inapposite here. Deering v. CenturyTel, Inc., held that a defendant had
16
obtained consent to give a third-party data about users’ browsing habits because it notified users
17
in advance that it would give that data to that third party for specified purposes, and gave users
18
the choice to opt out. No. 10-63, 2011 U.S. Dist. LEXIS 51930, at *7 (D. Mont. May 16, 2011).
19
Similarly, In re VistaPrint Corp Mktg. & Sales Practices Litig., merely observed that the
20
plaintiffs had authorized the defendant to transfer their “name[s], address[es] and credit/debit card
21
information” to a specific third party by clicking “Yes” on the defendant’s request for permission
22
to transfer that information to that third party. 2009 U.S. Dist. LEXIS 77509, at *29 (S.D. Tex.
23
Aug. 31, 2009).12 In contrast to the specific notice provided in Deering and VistaPrint,
24
Facebook’s disclosures are vague and, in fact, suggest the opposite of what Facebook now asserts
25
they mean. Facebook is not entitled to dismissal based upon express consent that it never
26
obtained.
27
28
12
VistaPrint did not analyze the plaintiffs’ consent because the defendant was itself a consenting
party to the relevant communications.
- 17 -
PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH
1
b.
Facebook Did Not Obtain Implied Consent.
Nor did Plaintiffs impliedly consent. “[I]mplied consent applies only in a narrow set of
2
3
cases.” Gmail, 2013 U.S. Dist. LEXIS 172784, at *47 (citation omitted). Implied consent “is not
4
constructive consent. Rather, [it] is ‘consent in fact’ which is inferred ‘from surrounding
5
circumstances indicating that the party knowingly agreed to the surveillance.’” Griggs-Ryan v.
6
Smith, 904 F.2d 112, 116-117 (1st Cir. 1990) (citations omitted). Thus, like express consent, to
7
impliedly consent, a party must have actual notice of the specific interception and its purpose.
8
Pharmatrak, 329 F.3d at 19-21. Notice that interceptions are possible is not enough. United
9
States v. Staves, 383 F.3d 977, 981 (9th Cir. 2004) (“[F]oreseeability of monitoring is insufficient
10
to infer consent. Rather, the circumstances must indicate that a party to the communication knew
11
that interception was likely and agreed to the monitoring.”); Watkins, 704 F.2d at 581
12
(“Knowledge of the capability of monitoring alone cannot be considered implied consent.”).13
Facebook’s argument for implied consent here is just a thinly disguised theory of
13
14
constructive consent, and an implausible one at that. Facebook argues users should have deduced
15
from URL previews in their draft messages that hitting “send” would cause Facebook to intercept
16
their message in transit, note any URLs therein, and use that information in unspecified ways.
17
Mot. at 18. Beyond the fact that this is deeply improbable, notice that an interception is merely
18
possible does not establish consent. Watkins, 704 F.2d at 581. “Actual” consent requires actual
19
knowledge of the fact of interception, and its purpose. Pharmatrak, 329 F.3d at 21; Gmail, 2013
20
U.S. Dist. LEXIS 172784, at *50; Watkins, 704 F.2d at 582. Moreover, as discussed above,
21
Facebook represented to users that their messages are “private,” provide “unprecedented” control,
22
and can be limited to “[s]haring with an individual.” Facebook omits private messages from its
23
disclosure of information that it “receives” from users. Therefore, even if a user did somehow
24
suspect, based on a URL preview, that Facebook could monitor message content, Facebook’s
25
own representations about the messaging service would put a reasonable user’s suspicions to rest.
Thus, Facebook’s motion to dismiss based upon consent should be denied.
26
27
28
13
See also Deal v. Spears, 980 F.2d 1153, 1156-57 (8th Cir. 1992) (consent could not be implied
from notice that a business owner only might monitor company phones); Berry, 146 F.3d at 1011
(same, in law enforcement context).
- 18 -
PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH
1
3.
Facebook “Intercepted” Communications “In Transmission.”
Facebook rearranges fragments of the CAC to pretend that Plaintiffs’ real claim involves
2
3
messages in electronic storage, and thus are unprotected here. Mot. at 20. In fact, the CAC
4
consistently alleges that Facebook intercepted private messages in transmission. See, e.g., CAC
5
¶ 25 (describing scanning as “in transit, in transmission, and/or during transfer” of private
6
messages.”); Id. ¶ 36 (showing screen grabs of private message being sent, a scan occurring, and
7
the implicated “Like” count increasing contemporaneously.). Plaintiffs have amply established
8
the “plausibility” of their claims, demonstrating that there is “more than a sheer possibility that a
9
defendant has acted unlawfully.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (citations omitted).
10
B.
11
Again contorting the CAC’s allegations, Facebook mistakenly suggests that describing its
12
conduct as taking place “across its network” amounts to “concessions that messages were entirely
13
contained within Facebook’s network.” Mot. at 20. In reality, according to a post by Facebook
14
on its website, Facebook’s private messaging service allowed users to exchange emails with non-
15
Facebook email addresses. CAC ¶ 24 (citing post); Id. ¶ 22 (“Facebook’s private message
16
function [includes] email.”). Facebook does not explain – nor can it – how a non-Facebook email
17
can be sent to or received from a Facebook user’s private messages inbox if the transmissions are
18
“entirely contained within Facebook’s network.” Such an assertion contradicts the CAC, and thus
19
is inappropriate to consider at this stage of motion practice. See Brennan v. Concord EFS, Inc.,
20
369 F.Supp.2d 1127, 1133 (N.D. Cal. 2005) (Arguments “contrary to plaintiffs’ pleading [are]
21
inappropriate for resolution at the motion to dismiss stage.”).14
Facebook Violated California Penal Code § 631
22
C.
23
Facebook incorrectly claims it was not “eavesdropping” under Penal Code section 632.
Facebook Violated California Penal Code § 632
24
Offering no further clarification, Facebook simply contends that, because it “stored Plaintiffs’
25
messages in the course of providing the Messages product,” it could not have been “secretly”
26
14
27
28
Facebook mischaracterizes Hernandez v. Path, Inc., which dismissed ECPA and CIPA claims
on the ground that, as alleged, the interceptions were not contemporaneous with transmission.
2012 U.S. Dist. LEXIS 151035, at *9 (N.D. Cal. Oct. 17, 2012). Here, Plaintiffs allege that the
interceptions occurred contemporaneously with the transmission. CAC at ¶¶ 25, 36, 40. Whether
or not the transmissions occurred exclusively across Facebook’s network is thus immaterial.
- 19 -
PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH
1
recording the contents of Plaintiffs’ communications.15 Mot. at 23. Nothing in CIPA supports
2
this proposition.16 Instead, the law is clear that whenever a non-party to a communication
3
acquires its content without obtaining the consent of the parties, section 632 has been violated.
4
Cal. Pen. Code § 632(a) (prohibiting “eavesdrop[ing] upon or record[ing]” confidential
5
communications “intentionally and without the consent of all parties.).
6
Facebook acted without users’ consent. See Part A-2, supra. Facebook’s argument that
7
private messages are somehow not “confidential” because they are “Internet communications” – a
8
term Facebook does not define and a term not included in the CAC – is unavailing. The act of re-
9
sharing by a conversation’s participant simply does not factor into “confidential[ity]” under
10
section 632. Instead, the analysis hinges upon whether (1) the monitoring was disclosed and
11
(2) whether all parties to the conversation agreed to its recording. Kight v. CashCall, Inc.,
12
200 Cal. App. 4th 1377, 1389 (Cal. App. 2011) (“secret monitoring denies the speaker . . . the
13
right to control the nature and extent of the firsthand dissemination of his statements . . . . A new
14
audience – either electronic or human – has been introduced . . . [But], section 632 requires the
15
assent of all parties to a communication before another may listen.”); accord Shulman, 18 Cal.
16
4th at 234-35. The Supreme Court of California makes plain that the only inquiry is whether
17
there has been a “simultaneous dissemination [of the communication] to an unannounced second
18
auditor, whether that auditor be a person or a mechanical device.” Id. This is precisely
19
Facebook’s behavior. CAC ¶¶ 25-58.
20
D.
21
1.
22
23
Plaintiffs’ Unfair Competition Law Claims Are Adequately Pleaded.
Plaintiffs Have Standing Under the UCL.
Plaintiffs meet the UCL’s standing requirements because they suffered (1) “injury in fact,”
and (2) “lost money or property.” See Kwikset Corp. v. Superior Court, 51 Cal. 4th 310, 322
24
25
26
27
28
15
In support, Facebook cites to cases in which the defendant was a party to the conversation.
See, e.g., Thomasson v. GC Servs. Ltd. P’ship., 321 F. App’x 557, 559 (9th Cir. 2008) (no CIPA
violation when “[n]o third party listened in on the conversations between the Thomassons and GC
Services..”); Rogers v. Ulrich, 52 Cal. App. 3d 894, 896 (1975) (Defendant recorded
conversations between himself and plaintiff).
16
Indeed, “storing” a message does not give Facebook a legal right to inspect its contents any
more than the Postal Service’s act of “storing” a letter in a P.O. Box allows it to open that letter.
- 20 -
PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH
1
(Cal. 2011). Facebook’s challenges to both prongs of the standing requirement fail.
2
The UCL’s standard for injury in fact expressly mirrors that of the U.S. Constitution (id.);
3
thus the requisite injury “can exist solely by virtue of statutes creating legal rights.” Edwards v.
4
First Am. Corp., 610 F.3d 514, 517 (9th Cir. 2010) (citation omitted). Here, because Plaintiffs
5
allege that Facebook violated their rights under ECPA, Facebook’s argument based on injury in
6
fact is baseless and should be rejected. CAC ¶¶ 72-94.17
7
Plaintiffs also adequately allege that they have “lost property” within the meaning of the
8
UCL. As alleged in the CAC, Facebook itself acknowledges that Plaintiffs’ electronic
9
correspondence belongs to them, as it expressly states to its users that they “own” the content of
10
their “private” messages. (CAC ¶ 17 (incorporating Internet links to Facebook’s online policies);
11
¶ 23; Exs. A-B (copies of the documents referenced in CAC)). Moreover, like any private
12
correspondence, private messages on Facebook satisfy California’s three-prong test for a property
13
interest. “First, there must be an interest capable of precise definition; second, it must be capable
14
of exclusive possession or control; and third, the putative owner must have established a
15
legitimate claim to exclusivity.” Kremen, 337 F.3d at 1030; Cal. Civ. Code § 654. Here, the
16
CAC alleges “an interest capable of precise definition,” the right to own and exclude non-parties
17
like Facebook from private communications is well-established (CAC ¶¶ 23-24; 47-48; 53-54;
18
100), and, as just stated, Facebook acknowledges that private messages legitimately belong
19
exclusively to the communicating parties.
20
Facebook makes little effort to argue that, as a matter of law, senders and recipients of
21
private messages do not have a property interest in them. Instead, Facebook asserts that Plaintiffs
22
fail to allege they “lost” any property when Facebook used their messages. Mot. at 24.
23
Facebook’s argument fails because by interfering with users’ exclusive right to use their own
24
property, Plaintiffs have, as a matter of well-settled California law, been deprived of their
25
property. As the Ninth Circuit has recognized, “California defines property very broadly: ‘The
26
ownership of a thing is the right of one or more persons to possess and use it to the exclusion of
27
28
17
The spuriousness of Facebook’s “injury in fact” argument is apparent in the fact that Facebook
stopped short of even attempting to challenge Plaintiffs’ standing under Article III directly.
- 21 -
PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH
1
others. . . . The thing of which there may be ownership is called property.’” G.S. Rasmussen &
2
Assocs. v. Kalitta Flying Serv., 958 F.2d 896, 902 (9th Cir. 1992), quoting Cal. Civ. Code § 654.18
3
Therefore, as California’s Supreme Court recently held, having “a present or future property
4
interest diminished” is one of “innumerable ways” to show “lost money or property—economic
5
injury” under the UCL. Kwikset, 51 Cal. 4th at 323.
6
Plaintiffs adequately allege this loss of property. Indeed, when Facebook explicitly
7
represented to users that private messages are their property, it also emphasized that users, not
8
Facebook, can control the sharing and use of those messages: “You own all of the content and
9
information you post on Facebook . . . you can control how it is shared. . . .” (Ex. A at 1,
10
referenced at CAC ¶ 17 (emphasis added); Ex. B.). The control promised by Facebook
11
exemplifies the exclusivity inherent in a property interest. However, Facebook treated Plaintiffs’
12
private messages as though they were Facebook’s property to freely open up, inspect, and use for
13
any purpose that suited Facebook. CAC ¶¶ 1-4. Facebook’s actions deprived Plaintiffs of their
14
exclusive right to their correspondence. Kaiser Aetna v. United States, 444 U.S. 164, 176 (1979)
15
(exclusivity is “one of the most essential sticks in the bundle of rights that are commonly
16
characterized as property.”).19
17
The exclusivity inherent in a property right extends to unauthorized copying and
18
subsequent use of property. “[A]lthough the owner may retain possession of the original
19
property, there has been nevertheless a deprivation of property when a copy is made and retained
20
by another.” People v. Kwok, 63 Cal. App. 4th 1236, 1251 (Cal. App. 1998). In People v. Kwok,
21
a California Court of Appeal held that making an unauthorized copy of a victim’s house key
22
constituted theft even though the victim never lost possession of her own key. The court reasoned
23
that “a homeowner’s or tenant’s property interest in his or her house key is not just the right to
24
maintain possession of a tangible object – the key – but also the right to control the intangible
25
18
26
27
28
See also Kremen v. Cohen, 337 F.3d 1024, 1030 (9th Cir. 2003), quoting Downing v. Mun.
Court, 88 Cal. App. 2d 345, 350 (Cal. App. 1948) (“Property . . . includes every intangible benefit
and prerogative susceptible of possession or disposition.”).
19
See also Prop. Reserve, Inc. v. Superior Court, 224 Cal. App. 4th 828, 862-863 (Cal. App. 3d
2014); Preston v. Bd. of Equalization, 25 Cal. 4th 197, 208 (Cal. 2001) (“Intangible property . . .
is generally defined as property that is a ‘right’ rather than a physical object.”).
- 22 -
PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH
1
benefit conferred by ownership of the key, i.e., the ability to control access to one’s residence.”
2
Id. Here, even though Plaintiffs retained their original messages, Facebook’s actions deprived
3
Plaintiffs of the fundamental right to exclude others, including Facebook, from using the
4
messages’ content. As the CAC alleges, “users have no control whatsoever over their own user
5
data collected or retained by Facebook” CAC ¶ 52; see Claridge v. RockYou, Inc., 785 F. Supp.
6
2d 855, 862 (N.D. Cal. 2011) (Hamilton, J.) (noting that one court has defined “lost” property as
7
property that has passed beyond the owner’s control).20
8
9
The argument advanced, and cases cited by, Facebook to convince this Court to decline to
acknowledge a loss of a property interest here are flatly inapposite. The private correspondence
10
at issue in this case, which carries with it an historically-recognized property interest, is in no way
11
analogous to “referrer headers” automatically generated by computers,21 digital contacts lists,22 or
12
other involuntary footprints of Internet use.23 To the contrary, this case is about Plaintiffs’
13
fundamental right to protect the exclusivity of private messages transmitted over Facebook. By
14
20
15
16
17
18
19
20
21
22
23
24
25
26
27
28
Facebook may argue in reply that another standard applies, i.e., that “lost” property requires the
owner be deprived of the property’s “use and possession.” Kwikset, however, clarified that
conduct diminishing a “present or future property interest” creates economic injury under the
UCL. 51 Cal. 4th at 323. Depriving the owner of use and possession, an element of the common
law tort, conversion, need not be shown for UCL standing. See FMC Corp. v. Capital
Cities/ABC, Inc., 915 F.2d 300, 303 (7th Cir. 1990) (noting that under California law, making
unauthorized copies of property ordinarily does not give rise to liability for conversion).
21
In In re Facebook Privacy Litig., 791 F. Supp. 2d 705, 715 (N.D. Cal. 2011) (Ware, J.), aff’d,
No. 12-15619, 2014 U.S. App. LEXIS 8679, at *1 (9th Cir. May 8, 2014), the court expressly
drew the distinction between “personal information” such as the referring headers at issue, and
personal financial records that a company has promised to safeguard. There, the court
acknowledged that UCL standing may be established in the latter circumstance, albeit focusing on
“lost money,” given that it was describing a paid service. Id., citing Doe 1 v. AOL, LLC, 719 F.
Supp. 2d 1102, 1111-1113 (N.D. Cal. 2010) (finding UCL standing where defendant failed to
safeguard the content of users’ financial records). Here, as with the financial records described in
Facebook Privacy, Facebook has promised its users that their private messages will remain theirs,
subject to the users’ control. CAC ¶ 17; Ex. A and B. Facebook’s violation of users’ exclusive
right to those private messages establishes the requisite “lost property” required to show standing
under the UCL, akin to the violation that gave rise to plaintiffs’ standing in AOL.
22
Opperman v. Path, Inc., No. 13-00453, 2014 U.S. Dist. LEXIS 67225, at *83 & n.22 (N.D.
Cal. May 14, 2014) (Tigar, J.) (acknowledging that consumers may have a property interest in
personal information, but finding that plaintiffs lacked standing based solely on whether plaintiffs
incurred economic loss, i.e., lost “money.”).
23
Claridge v. RockYou, Inc., 785 F. Supp. 2d 855, 862 (N.D. Cal. 2011) (Hamilton, J.)
(concerning users’ login credentials stolen from the defendant by a third-party; finding that
plaintiffs failed to allege credentials had passed beyond their control); In re iPhone Application
Litig., No. 11-02250, 2011 U.S. Dist. LEXIS 106865, at *45 (N.D. Cal. Sept. 20, 2011) (Koh, J.)
(concerning user data such as cell phone numbers, geolocation, and sim card serial numbers).
- 23 -
PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH
1
abusing its ability as an ECS provider to monetize the substance of Plaintiffs’ messages,
2
Facebook not only violated Plaintiffs’ privacy, it diminished their property rights as well,
3
cementing Plaintiffs’ standing under the UCL. Kwikset, 51 Cal. 4th at 323.
4
Moreover, to deny Plaintiffs standing here would thwart the purpose of the UCL’s “lost
5
money or property” requirement, which is “to eliminate standing for those who have not engaged
6
in any business dealings with would-be defendants . . . while preserving for actual victims of
7
deception and other acts of unfair competition the ability to sue and enjoin such practices.”
8
Kwikset, 51 Cal. 4th at 317 (emphasis added). Facebook attracted users to its site by representing
9
that they owned their own content and that messages sent over Facebook would be “private.”
10
CAC ¶¶ 21-25. Then Facebook mined users’ private messages for information without their
11
consent. As the victims of Facebook’s self-serving misrepresentations and deception, Plaintiffs
12
have standing to bring this action to enjoin Facebook’s misconduct.24
13
2.
14
Facebook Violated the Unfair Competition Law.
This Court should not credit Facebook’s unsubstantiated assertion in a footnote that
15
Plaintiffs allege no “unlawful, unfair, or fraudulent” business acts or practices. Mot. at 24 n.13.
16
All three prongs of Plaintiffs’ UCL claim are well pled. First, the UCL’s “unlawful” prong is
17
satisfied because Facebook violated ECPA and CIPA. CAC ¶ 126; Farmers Ins. Exch. v.
18
Superior Court, 2 Cal.4th 377, 383 (Cal. 1992) (“Unlawful” prong borrows violations of other
19
laws). Second, extensive allegations show that Facebook deprived Plaintiffs ownership of their
20
private messages solely to benefit Facebook, and that no public utility derived from Facebook’s
21
misconduct. CAC ¶¶ 1-4;19; 23-51 (describing Facebook’s deceptions and incentives to mislead
22
users). Thus, the conduct was “unfair.” MacDonald v. Ford Motor Co., No. 13-02988, 2014
23
U.S. Dist. LEXIS 44858, at *27 (N.D. Cal. Mar. 31, 2014) (Tigar, J.); see also id. (finding no
24
public benefit in company’s failure to disclose vehicle safety problems). Third, the CAC details
25
26
27
28
24
Facebook’s reliance on Korea Supply Co. v. Lockheed Martin Corp. is misplaced. Korea
Supply held that restitution is unavailable to a plaintiff who never had a vested interest in the
funds it sought to have “restored.” 29 Cal. 4th 1134, 1148-49 (Cal. 2003). By contrast, Plaintiffs’
property interest in their messages is “vested.” Thus, any benefits Facebook derived from using
their messages are “benefits in which [Plaintiffs have] an ownership interest,” and for which
Plaintiffs may seek restitution under the UCL. Id.
- 24 -
PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH
1
extensively Facebook’s fraudulent concealment of the “who, what, when, where, and how” of
2
Facebook’s intrusion upon Facebook’s private messages. CAC ¶¶ 21-25; 38; 47-48; 69-71;
3
127.25 Because Facebook’s representations and omissions are likely to, and did, deceive both
4
Plaintiffs and the public, they are “fraudulent.” In re Tobacco II Cases, 46 Cal. 4th 298, 312
5
(Cal. 2009). Accordingly, Plaintiffs’ UCL claims should not be dismissed.
6
E.
7
Facebook claims that because it may have stopped the alleged interceptions when the Wall
Plaintiffs Are Entitled To Seek Injunctive Relief.
8
Street Journal exposed it, Plaintiffs therefore cannot seek injunctive relief. Mot. at 25. But
9
Plaintiffs are entitled to seek injunctive relief if there is “a sufficient likelihood that [they] will
10
again be wronged in a similar way.” Haro v. Sebelius, 747 F.3d 1099, 1108 (9th Cir. 2014),
11
citing City of Los Angeles v. Lyons, 461 U.S. 95, 109 (1983). Here, that standard is met.
12
Plaintiffs are still active Facebook users. CAC ¶¶ 5-7. If Facebook truly has ceased all of the
13
unlawful conduct alleged – and Facebook has not confirmed that it has – nothing in the CAC
14
supports finding that Facebook could not again intrude on Plaintiffs’ private correspondence. On
15
the contrary, Plaintiffs allege that Facebook, could surreptitiously repeat this, or similar,
16
misconduct in the future. Id. ¶ 39. Thus, an injunction would constitute appropriate relief.
17
F.
18
19
Leave To Amend Should Be Granted If Any Of Facebook’s Motion Is
Granted.
“[D]ismissal without leave to amend is improper unless it is clear . . . that the complaint
20
could not be saved by any amendment.” Petersen v. Boeing Co., 715 F.3d 276, 280 (9th Cir.
21
2013) (leave to amend “should be granted with extreme liberality.”); Fed. R. Civ. P. 15(a)(2).
22
Plaintiffs have articulated viable legal theories for each of their claims, and should be afforded an
23
opportunity to allege more facts should the Court require it, since in no instance would
24
amendment be futile. Therefore, should the Court grant Facebook’s motion in any part, it should
25
also grant Plaintiffs leave to amend.
26
27
28
25
The CAC therefore meets the pleading requirements of Federal Rule 9(b). Facebook could not
credibly maintain, nor does it in its motion, that it lacks “notice of the particular misconduct . . .
alleged to constitute the fraud[.]” Neubronner v. Milken, 6 F.3d 666, 671 (9th Cir. 1993).
- 25 -
PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH
1
2
V.
CONCLUSION
For the foregoing reasons, Facebook’s motion should be denied in its entirety.
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
Dated: July 30, 2014
LIEFF CABRASER HEIMANN & BERNSTEIN, LLP
By:
/s/ Michael W. Sobol
Michael W. Sobol
Michael W. Sobol (State Bar No. 194857)
msobol@lchb.com
Melissa Gardner (State Bar No. 289096)
mgardner@lchb.com
LIEFF CABRASER HEIMANN & BERNSTEIN, LLP
275 Battery Street, 29th Floor
San Francisco, CA 94111-3339
Telephone: 415.956.1000
Facsimile: 415.956.1008
Rachel Geman
rgeman@lchb.com
Nicholas Diamand
ndiamand@lchb.com
LIEFF CABRASER HEIMANN & BERNSTEIN, LLP
250 Hudson Street, 8th Floor
New York, NY 10013-1413
Telephone: 212.355.9500
Facsimile: 212.355.9592
Hank Bates (State Bar No. 167688)
hbates@cbplaw.com
Allen Carney
acarney@cbplaw.com
David Slade
dslade@cbplaw.com
CARNEY BATES & PULLIAM, PLLC
11311 Arcade Drive
Little Rock, AR 72212
Telephone: 501.312.8500
Facsimile: 501.312.8505
22
23
24
25
26
27
28
- 26 -
PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH
1
2
3
4
Jeremy A. Lieberman
Lesley F. Portnoy
info@pomlaw.com
POMERANTZ, LLP
600 Third Avenue, 20th Floor
New York, NY 10016
Telephone: 212.661.1100
Facsimile: 212.661.8665
5
6
7
8
Patrick V. Dahlstrom
pdahlstrom@pomlaw.com
POMERANTZ, LLP
10 S. La Salle Street, Suite 3505
Chicago, IL 60603
Telephone: 312.377.1181
Facsimile: 312.377.1184
9
10
11
12
Jon Tostrud (State Bar No. 199502)
jtostrud@tostrudlaw.com
TOSTRUD LAW GROUP, PC
1925 Century Park East, Suite 2125
Los Angeles, CA 90067
Telephone: 310.278.2600
Facsimile: 310.278.2640
13
14
Attorneys for Plaintiffs and the Proposed Class
15
16
17
18
19
20
21
22
23
24
25
26
27
28
- 27 -
PLAINTIFFS’ OPPOSITION TO
DEFENDANT’S MOTION TO DISMISS
CASE NO. C 13-05996-PJH
Disclaimer: Justia Dockets & Filings provides public litigation records from the federal appellate and district courts. These filings and docket sheets should not be considered findings of fact or liability, nor do they necessarily reflect the view of Justia.
Why Is My Information Online?