Shadpour v. Facebook, Inc.

Filing 1

COMPLAINT against Facebook, Inc. ( Filing fee $ 400, receipt number 0971-8310679.). Filed byDavid Shadpour. (Attachments: # 1 Civil Cover Sheet)(Glancy, Lionel) (Filed on 1/21/2014)

1
2
3
4

LIONEL Z. GLANCY (#134180)
GLANCY BINKOW & GOLDBERG LLP
1925 Century Park East, Suite 2100
Los Angeles, California 90067
Telephone: [phone]
Facsimile:
[phone]
E-mail:
[e-mail]

5
6

Counsel for Plaintiff DAVID SHADPOUR
[Additional Counsel on Signature Page]

7
8

UNITED STATES DISTRICT COURT

9

NORTHERN DISTRICT OF CALIFORNIA

10
11
12

DAVID SHADPOUR, Individually and on
Behalf of All Others Similarly Situated,
Plaintiff,

13
14
15
16

Case No. 5:14-cv-0307

CLASS ACTION COMPLAINT

vs.
FACEBOOK, INC.,
Defendants

17
18
19
20
21
22
23
24
25
26
27
28

CLASS ACTION COMPLAINT
The common law secures to each individual the right of determining,
ordinarily, to what extent his thoughts, sentiments, and emotions shall be
communicated to others. Under our system of government, he can never
be compelled to express them (except when upon the witness stand); and
even if he has chosen to give them expression, he generally retains the
power to fix the limits of the publicity which shall be given them. The
existence of this right does not depend upon the particular method of
expression adopted. It is immaterial whether it be by word or by signs, in
painting, by sculpture, or in music. Neither does the existence of the right
depend upon the nature or value of the thought or emotions, nor upon the
excellence of the means of expression. The same protection is accorded to
a casual letter or an entry in a diary and to the most valuable poem or
essay, to a botch or daub and to a masterpiece. In every such case the
individual is entitled to decide whether that which is his shall be given to
the public. No other has the right to publish his productions in any form,
CLASS ACTION COMPLAINT
1

without his consent. This right is wholly independent of the material on
which, the thought, sentiment, or emotions is expressed.1

1
2

I.

INTRODUCTION

3
1.

4

Speaking over 120 years ago, Justice Brandeis gave voice to a fundamental right

5

individuals possess in protecting their thoughts, communications, and other expressions from unwanted

6

public exposure and/or compilation. Justice Brandeis’ words ring true to this day, and his conviction

7

that an individual may set limitations on the public exposure of his thoughts, sentiments and emotions,

8

has found expression in legislation and rulemaking by authorities throughout the country, including the

9
10

State of California.
2.

11

Through technological advances, especially in the orchestration of a privacy

12

functionality that invites individual users to express their thoughts to a limited set of other users,

13

Defendant Facebook, Inc. (“Facebook” or “the Company”) has amassed over a billion users throughout

14

the globe, and is in the unique position of having unprecedented access to an individual’s thoughts,

15
16

communications and other expressions.
3.

17

Facebook establishes a user’s expectation of privacy, and invites sharing of thoughts,

18

sentiments and emotions, by publishing various terms of use, identifying a user’s customized privacy

19

settings, as well as other indications in the user experience to signify that a communication is and/or

20

can treated with varying forms of privacy and public exposure. For instance, a Facebook user may post

21
a comment or picture that will be shared with only one specific individual, three individuals or
22
23

alternatively with the public at large.
4.

24
25
26

In underscoring the purported privacy aspects of the Facebook experience, on Tuesday,

January 14, 2014, while speaking at a conference hosted by Stanford University, Facebook CEO Mark
Zuckerberg commented that the ingenuity and prime functionality of the Facebook service is a user’s

27
28

1

“The Right To Privacy”, Warren and Brandeis, Harvard Law Review, Vol. IV No. 5, December 15,
1890.
CLASS ACTION COMPLAINT
2

1
2

ability to control others access to her thoughts, communications and expressions.2 Mr. Zuckerberg
commented in relevant part:

3

[Prior to Facebook] There was no privacy infrastructure to communicate
with your community or just a set of friends all at once, and because of the
lack of that, basically if people wanted to communicate something they
had to choose to communicate with a very small audience or communicate
it publicly. A lot of times you’re not comfortable communicating it
publicly and maybe it’s just not worth communicating it to a small set or
that’s not the full potential of what you want to communicate so you just
don’t do it, it just gets lost. And that potential idea that could have been
shared, or thought, or human connection and kind of option to have more
connection and do more on that over time is lost.

4
5
6
7
8
9

So I actually think kind of the fundamental innovation that Facebook
brought was creating this space. Right, which is really, it’s a private space
that didn’t exist before. That there was no tool to be able to communicate
in that space.3

10
11
12
5.

13

Mr. Zuckerberg’s own account confirms that the major functionality of the Facebook

14

experience is a user’s purported ability to control the extent of her communications, and the ability to

15

share a “private” message with a specific number of individuals.

16
17

6.

Contrary to its representations however, “private” Facebook messages are in fact

scanned by the Company in an effort to glean, store and capitalize on the contents of its user’s

18
communications. Indeed, privacy security researchers have discovered that the Company reviews the
19
20

contents of its users’ messages for purposes unrelated to the facilitation of message transmissions.

21

When a user composes a Facebook message and includes a link to a third party website (a “URL”)4, the

22

Company scans the content of the Facebook message, follows the enclosed link, and searches for

23

information to profile the message-sender’s web activity.

24
25
26

2

http://m.stanford.edu/events/event?id=41407

27

3

https://www.youtube.com/watch?v=STV8X9ioMlg

28

4

A “URL,” or “uniform resource locator” is also known as a “web address.” It is a character string that
refers to a specific resource or location on the Internet. For example, “www.nytimes.com” is the URL for
the New York Times’ home page.
CLASS ACTION COMPLAINT
3

7.

1

Representing to users that the content of Facebook messages is “private” creates an

2

especially profitable opportunity for Facebook, because users who believe they are communicating on a

3

service free from surveillance are likely to reveal facts about themselves that they would not reveal had

4

they known such content was being monitored. Thus, Facebook has positioned itself to acquire pieces

5

of the users’ profiles that are likely unavailable to other data aggregators.

6
8.

7

Almost the entirety of Facebook’s revenues derive from the sale of third party

8

advertisements, which the Company is able to target towards its users based upon the personal data it

9

mines and stores. In 2011, Facebook earned $2.7 billion from targeted advertising sales. The more

10

otherwise-unavailable information the Company can collect about its users – including the contents of

11

their private communications – the more valuable its advertising capacity. Accordingly, Facebook

12
13

promotes itself as a rich source of information about the people who use the site, one which allows

14

businesses to “reach the right people,” through selective targeting of potential customers by, for

15

example, “location,” “age,” or “interests”5 drawn from “activities, education, job titles, pages they like

16

or groups to which they belong.”6

17

9.

All of Facebook’s activities complained of herein are performed without users’ consent.

18
Instead, to increase users’ comfort with the website and, thereby, increase the amount of information
19
20

they share, the Company makes assurances of user control over privacy settings and messaging options.

21

These assurances affirmatively state that only senders and intended recipients are privy to the contents

22

of their nonpublic communications. In reality, Facebook never intended to provide this level of

23

confidentiality. Instead, Facebook mines any and all transmissions across its network, including those it

24
labels “private,” in order to gather any and all morsels of information it can about its users.
25
10.

26
27

Plaintiff David Shadpour (“Plaintiff”) is a Facebook user who, during the relevant Class

Period, utilized Facebook’s private messaging function, including by way of posting messages or other

28
5

Reach the right people, Facebook, https://www.facebook.com/business/a/online-sales/target-your-ads.
CLASS ACTION COMPLAINT
4

1

communications to a specific user(s), while relying on representations that these private and personal

2

communications would be viewed only by the sender and the recipient. Instead, when Plaintiff sent

3

private messages containing URLs, Facebook scanned Plaintiff’s messages and searched the website

4

identified in the URL for purposes including but not limited to data mining and user profiling.

5

11.

This class action is brought on behalf of all natural person Facebook users located within

6
7

the United States who have sent or received private Facebook messages, including by way of a

8

Facebook post limited to a specific set of users that included a URL in the content of the Facebook

9

message. Upon information and belief, Facebook scanned or otherwise reviewed these private

10

Facebook messages.

11

12.

Such actions, described in detail below, are intentional interceptions of electronic

12
13
14

communications, committed in violation of California’s Invasion of Privacy Act, Cal. Penal Code §§
630 et seq. (“CIPA”).
13.

15
16
17

Under CIPA, Plaintiff seeks, individually and on behalf of the Class, injunctive and

declaratory relief, restitution, statutory damages, an award of reasonable attorney’s fees and other
litigation costs reasonably incurred, and any and all additional relief deemed appropriate by this Court.

18
II.

THE PARTIES

19
14.

20

Plaintiff David Shadpour is a resident of Los Angeles County, California. He established

21

a Facebook account in or around February 2006, which he has maintained consistently to the present.

22

He has made extensive use Facebook’s private messaging function throughout the relevant Class Period

23

for, inter alia, purposes of conveying messages whose content includes URL links.

24
15.

Defendant Facebook, Inc. is an American corporation, headquartered in Menlo Park,

25
26

California, incorporated under the laws of the State of Delaware. Facebook owns and operates an online

27
28
6

How to target Facebook ads, Facebook, https://www.facebook.com/business/a/online-sales/ad-targetingdetails.
CLASS ACTION COMPLAINT
5

1

social networking website that allows its users to communicate with each other through the sharing of

2

text, photograph, and video.

3

III.

4
5

JURISDICTION, VENUE, AND CHOICE OF LAW
16.

This Court has subject matter jurisdiction over this action pursuant to the Class Action

Fairness Act (“CAFA”), 28 USC § 1332(d)(2), as Plaintiff brings class claims on behalf of citizens of

6
states different than Facebook’s states of citizenship, and the amount in controversy exceeds $5 million,
7
8

and the proposed class contains in excess of 100 members.
17.

9
10

Plaintiff is a citizen of the state of California, and Defendant is incorporated in the state

of Delaware.

11

18.

This Court has personal jurisdiction over Defendant as Facebook maintains its

12
headquarters in California, and because it conducts substantial business throughout California.
13
19.

14

Venue is proper in this Judicial District pursuant to 28 U.S.C. § 1391(b) because (1)

15

Facebook resides in this Judicial District and (2) a substantial part of the events or omissions giving rise

16

to the claims asserted herein occurred in this Judicial District.

17
18

20.

Venue is also proper in this district pursuant to Facebook’s Statement of Rights and

Responsibilities, which governs the agreement between Plaintiff and Facebook, which states in

19
20
21

pertinent part that Plaintiff “will resolve any claim, cause of action or dispute (claim) . . . relating to . . .
Facebook exclusively in a state or federal court located in Santa Clara County.”

22
23
24

21.

California law governs the substantive legal issues in the instant matter, as Facebook’s

Statement of Rights and Responsibilities further states in pertinent part that “the laws of the State of
California will govern . . . any claim that might arise between you and us.”

25
26
27

IV.

FACTUAL BACKGROUND
A.

Online Data Collection

28

CLASS ACTION COMPLAINT
6

22.

1

Facebook does not charge users a subscription fee or solicit any direct payment by

2

Facebook users for the use of its service. Instead, Facebook’s generates revenues through the collection

3

and analysis of data on its users and display of advertisement to Facebook users.

4
5

23.

These display ads are tailored specifically to each user based on personal information

collected by Facebook through various channels, including through compilation of a user’s behavior on

6
7

the Facebook website and also through other activity the Company may acquire from third parties.

8

These tailored or “targeted” advertisements allow Facebook to charge advertisers more for delivery of

9

such relevant ads; and, the more accurate Facebook’s information is, the more it can charge advertisers

10

to deliver relevant ads.

11

24.

Because Facebook’s revenue model is so fundamentally dependent on advertising, and

12
13

because it can increase revenues by building more accurate “dossiers” on its users, Facebook is strongly

14

incentivized to gather as much personal information on users, no matter how sensitive, or under what

15

expectations of privacy.

16
17
18

25.

Even though many websites remove personally identifiable information from data when

they are initially sold, data aggregators are employing ever more sophisticated cross-referencing and
predictive analytics techniques to make more sources of data personally identifiable.7

19
26.

20

Widespread dissemination of even de-identified data is already causing problems for

21

internet users. Kate Crawford, a visiting professor at the MIT Center for Civic Media and a principal

22

researcher at Microsoft Research, and Jason Shultz, of the New York University School of Law,

23

explain the privacy risks arising from new methods of data aggregation and analysis:

24
Even very vague signals online, such as liking things on Facebook, can
generate a detailed picture. As one University of Cambridge study found,
‘highly sensitive personal attributes,’ such as sexual orientation, ethnicity,
religious and political views, personality traits, intelligence, use of

25
26
27
7

28

Kate Crawford and Jason Schultz, Big Data and Due Process: Toward a Framework to Redress
Predictive Privacy Harms, New York University School of Law Public Law & Legal Theory Research
Paper Series, Working Paper No. 13-64 at 8 (Oct. 2013),
http://papers.ssrn.com/sol3/papers.cfm?abstract_id=2325784.
CLASS ACTION COMPLAINT
7

addictive substances, parental separation, age and gender were predictable
with high degrees of success just from what people liked online. Thus,
racial discrimination could be applied to prevent some candidates from
seeing loans that might be advantageous to them, and housing renters and
sellers could potentially use big data to discriminate based on gender, all
while circumventing the fair housing laws.8

1
2
3
4
27.

5

In another example of the uses to which data aggregators are putting to predictive

6

analytics, a recent New York Times blog post reported that one man saw his American Express credit

7

card limit reduced because, according to American Express, “Other customers who have used their card

8

at establishments where you recently shopped have a poor repayment history with American Express.”9

9
28.

10

Furthermore, if companies like Facebook are not required to adhere to terms of their own

11

policies and representations regarding what data they collect, there is no basis for consumer trust.

12

Ultimately, the duplicity alleged herein by entities like Facebook will likely cause consumers to assume

13

that all communications they make are recorded and disseminated, significantly chilling free speech.

14

B.

Facebook

29.

With 1.1 billion users accessing this service on a monthly basis – approximately 51% of

15
16
17

all internet users – Facebook is the world’s largest social media company.
30.

18
19
20

The popularity of Facebook hinges upon the ability of its users to communicate with one

another. As the Company stated in a Securities and Exchange Commission filing in anticipation of its
May 2013 initial public offering or “IPO,” “[p]eople use Facebook to stay connected with their friends

21
and family, to discover what is going on in the world around them, and to share and express what
22
23

matters to them to the people they care about. . . . We believe that we are at the forefront of enabling

24
25
26
27
28

8

Id.
Lily Altavena, What Story Does Your Personal Data Tell?, N.Y. Times, The Learning Network (Feb.
17, 2013), http://learning.blogs.nytimes.com/2012/02/07/what-story-does-your-personal-data-tell/.
9

CLASS ACTION COMPLAINT
8

1
2

faster, easier, and richer communication between people and that Facebook has become an integral part
of many of our users’ daily lives.”10

3
4
5

31.

Communications among Facebook users span a continuum, from the publicly viewable

to the entirely private. In the Facebook tutorial “Get Started on Facebook,” guidance is offered on how
to share or send information via the service, either publicly or privately:

6
How


7

to Post & Share

8

Sharing

Status Updates and Other Stories

9

How do I share a status or other content on Facebook?

Depending on whom you’d like to share with, there are different ways to share

10

content on Facebook:
 Sharing with a broad audience: Use the share menu that’s located at the
top of your homepage and timeline to let others know what’s on your mind.
You can update your status and share photos, videos, links and other
application content. Things you share will appear as posts on your timeline,
and can appear in your News Feed. To control whether or not specific people
have the option to view your stories, you can change the privacy settings for
each piece of content you post.

11
12
13
14
15



16



17
18

Sharing with a small group of friends: Use the Groups feature to share
content with a select group of people, like family members, your soccer team
or your book club.
Sharing with an individual: You can use the share menu at the top of a
friend’s timeline to write or share something on his or her timeline. Friends
of your friend will also be able to view your post. If you’d like to share

something privately, you can always send someone a private
message.11

19
20
32.

21

Thus, Facebook states that its private messaging function is meant to be precisely that: a

22

“private” mechanism for communication between individuals using the Company’s services. Further,

23

Facebook telegraphs through the use of the words “privately” and “private” that when a user sends a

24

private message to another party, only the user and the intended recipient will be privy to the contents

25

of that communication.

26
27
28

10

Form S-1 Registration Statement for Facebook, Inc., as filed with the Securities and Exchange
Commission, “Prospectus Summary,” at 1 (Feb. 1, 2012),
http://www.sec.gov/Archives/edgar/data/1326801/000119312512034517/d287954ds1.htm.

11

Help Center: Get Started on Facebook: How to Post & Share (italic and bold emphasis added).
CLASS ACTION COMPLAINT
9

1)

1
33.

2

Facebook’s Private Messaging Function

On November 15, 2010, Facebook announced a new, integrated email and messaging

3

service for its users. Combining the functionality of email, chat, SMS,12 and in-service messaging into a

4

single platform, Facebook’s private messaging service enables Facebook users to communicate directly

5

with specifically chosen individuals, in a single conversation, across devices and through a variety of

6
7

popular media.13 Because the messaging service can also serve as an email address, account holders can

8

also use Facebook as a means of sending messages to, and receiving messages from, sources outside the

9

Company’s social media network.

10
11

34.

Facebook underscores to users the extent of its messaging functionality’s alleged privacy

features. In its rollout announcement, it said “[y]ou can also change your account settings to be even

12
13

more limited and bounce any emails that aren’t exclusively from friends. This kind of message control

14

is pretty unprecedented and people have been wanting to do this with email (and phone calls) for a long

15

time. ‘Messages’ reverses the approach to preventing unwanted contact. Instead of having to worry

16

about your email address getting out, you’re now in control of who can actually reach you.”14

17

35.

Thus, in Facebook’s initial representations of its private messaging service, it stressed

18
“unprecedented” amounts of (1) user control and (2) user privacy inherent in its product.
19
36.

20

Where Facebook discusses its private messaging service on its website, it does so in

21

terms that expressly contemplate a private communication, taking place only between the sender and

22

the intended recipient or recipients (e.g., “If you’d like to share something privately, you can always

23

send someone a private message”15 and “unprecedented” levels of “message control”16). Additionally,

24
Facebook’s website contains a “Help Center” which assists account holders in utilizing basic functions
25
26

12

“SMS” is an acronym for “short message service,” commonly known as “text messaging.”

27

13

See the Messages that Matter

28

14

Id. (emphasis added).
Help Center: Get Started on Facebook: How to Post & Share (emphasis added).
16
See the Messages that Matter
15

CLASS ACTION COMPLAINT
10

1

of the service. In the Help Center, under the heading “How do I send a message” the step-by-step

2

instruction begins with the prompt “To send a private message.”17 Under the heading “Who can see my

3

message,” Facebook states “You and the people you’re messaging with can view the contents and

4

history of your conversation.”18

5

37.

All of these representations reflect the representation that only the sender and the

6
7
8

recipient or recipients will be privy to the private message’s content, to the exclusion of any other party,
including Facebook, and especially unknown third parties.
2)

9
10
38.

11

Third-Party Security Researchers Demonstrate that Facebook is
Intercepting and Scanning the Content of “Private” Messages

Facebook’s representations of privacy have been debunked by numerous reliable

12

sources. Facebook has been caught surreptitiously intercepting and scanning the contents of its users’

13

private messages for a variety of purposes, none of which Facebook discloses in either its Terms of Use

14

or its Privacy Policy.

15
39.

16
17

On August 27, 2013, a Swiss security firm announced that it had conducted a simple

experiment to test how scrupulously the fifty largest social networks, web services, and free email

18

systems (“Web Services”) respected user privacy.19 The firm, High-Tech Bridge (“HTB”), used a

19

dedicated web server and generated a secret URL for each of the Web Services. HTB then used the

20

private messaging function of each of the Web Services, embedding a unique URL in each message.

21
40.

HTB then monitored its dedicated web server’s logs for all incoming HTTP requests, in

22
23
24

order to determine whether any of the Web Services would “click” on the test URLs that had been
transmitted via private message.

25
26
27
28

17

Help Center: Messaging: Messages: Sending a Message: How Do I Send a Message?, Facebook,
https://www.facebook.com/help/326534794098501/, (emphasis added).
18
Help Center: Messaging: Messages: Settings & Security: Who Can See My Messages?, Facebook,
https://www.facebook.com/help/212388195458335?sr=16&sid=0ntT7VdfDjw7Y5KSV
19
High-tech Bridge, Social Networks: Can Robots Violate User Privacy? (Aug. 27, 2013),
https://www.htbridge.com/news/social_networks_can_robots_violate_user_privacy.html.
CLASS ACTION COMPLAINT
11

41.

1
2

activity remaining undisclosed to the user.

3
4
5

Facebook was one of the Web Services that was caught scanning URLs despite such

42.

Concerning Facebook’s scanning of the contents of privately sent messages, HTB’s

Chief Research Officer stated, “there is no way to keep the URL and its content confidential . . . while
transferring the URL via social networks.”20

6
43.

7

Facebook performs this task to aggregate data on its users for purposes of advertising,

8

marketing and user profiling; specifically, at least in part, in the form of generating “Likes” for web

9

pages, generated via Facebook’s social plugins embedded on websites, thereby monitoring users’ web

10

browsing patterns.

11

3)

Facebook’s Social Plugins

12
44.

13

In addition to having users interact on its own website, Facebook also provides code for

14

third-party websites to embed, so-called “social plugins.” Facebook explains the social plugin as

15

follows,

16

Alright, so this is how it works. Let’s say you are logged in to Facebook,
but you check out a popular new site. It’s kind of a bummer, because
before you would have to choose between the social experience of
Facebook or the specialized information of a content site. Ok, well now, if
the website has a social plug-in, you can take your Facebook friends with
you and get both. Instead of having to comb through page after page of
article after article to find something that catches your eye, now you can
see what your friends have already enjoyed on a site. And with one click,
you can share an article or a video review with your friends.21

17
18
19
20
21
22
23

45.

The effect of embedding social plugins into third-party websites is that it enables

Facebook to extend its data gathering practices, keeping tabs on its users’ behavior even after they log

24
25
26
27
20

28

Id.
Understanding Social Plugins, Facebook tutorial video at 0:40–1:09 (posted June 7, 2010),
https://www.facebook.com/video/video.php?v=10150210521510484.

21

CLASS ACTION COMPLAINT
12

1
2

out of Facebook. One of the principal social plugins is the “Like” button commonly found on internet
websites.22 A video tutorial on Facebook’s website states:

3

When someone clicks “Like,” they’re highlighting the things that are
valuable to them and sharing that with their friends. And when all of this
goes to your News Feed, it’s like you have a real time, super-customized
window to the most valuable things on the Internet. But we understand
that many of the things people care about live outside of Facebook, so we
wanted to create a way to bring your friends with you to other websites.
So we created social plugins. Social plugins extend the things you love
about Facebook to your favorite websites.23

4
5
6
7
8

46.

The practice, purpose, and effect of scanning users’ private messages, as described

9
10
11

herein, are not disclosed by Facebook to its users, and these scans are undertaken without users’
consent.
47.

12
13
14

The practice, purpose, and effect of scanning users’ private messages, as described

herein, are not necessary for the rendition of Facebook’s private messaging service, the protection of
Facebook’s rights or property, or the security of Facebook users. These scans are not undertaken in the

15
16
17

ordinary course of business of an electronic communication service, as described in 28 U.S.C. §
2510(15).
48.

18
19

In 2009, 2010, and 2011, targeted advertising accounted for 98%, 95%, and 85%,

respectively, of the Company’s revenue.24

20

49.

However, Facebook’s desire to harness the myriad data points of its users has led to

21
overreach and intrusion on the part of the Company as it mines its account holders’ private
22
23

communications for monetary gain.
C.

24

Facebook Employs Devices and/or Technology to Scan, Extract, Acquire, and Use
the Contents of Its Users’ Messages.

25
26
27

22

Id. (listing the “Like” button as one of “the main social plugins.”).

28

23

Id. at 0:15–0:39

24

Id., Risks Related to Our Business and Industry, 12.
CLASS ACTION COMPLAINT
13

1.

1
2
3
4
5

50.

Web Crawlers and Social Plugins

Upon information and belief, Facebook uses a software application called a “web

crawler” to scan any URL contained in a user’s private message.
51.

These web crawlers perform the automated task of scanning the URL by sending HTTP

requests to the server associated with the URL and then seeking various items of information about the

6
7
8
9
10
11

web page to which the URL is linked.
52.

Upon information and belief, one of the items of information Facebook’s web crawlers

seek is whether or not the web page associated with the URL contains a “Like” button.
53.

Upon information and belief, where a web page does contain a “Like button, the web

crawlers transmit this information back to Facebook.

12
13
14
15
16
17

54.

Upon information and belief, Facebook then uses these data to register the URL sent via

private message as a “Like” for the web page.
55.

Upon information and belief, Facebook further provides these data to the web page at

issue, in the form of analytical analysis of web traffic to that site by Facebook users.
56.

Upon information and belief, Facebook further uses these data to build and refine user

18
profiles.
19
20
21

57.

and/or in transfer of users’ private messages.

22

2.

23
24
25
26
27

Upon information and belief, Facebook’s interception occurs in transit, in transmission,

58.

Facebook’s Message-Scanning Devices and/or Technology Constitute
Conduct Outside the Scope of the Company’s Ordinary Course of Business.

None of the practices complained of throughout this complaint are necessary for or

incidental to the ability to send or receive private messages – an electronic communication service –
across Facebook’s online social network.
59.

Facebook has the technical capacity to offer its private message service without

28
intercepting, scanning, and using the content of Plaintiff’s and Class Members’ private messages.
CLASS ACTION COMPLAINT
14

60.

1

Facebook’s acquisition and use of content from Plaintiff’s and Class Members’

2

electronic communications, as described in this Complaint, is not necessary for or incidental to the

3

protection of the rights or property of the Company, as provider of the service. Indeed, such activities,

4

as described herein, are outside the ordinary course of business of electronic communication service

5

providers.

6
D.

Facebook Fails to Disclose That Its Private Message Processes Read, Acquire, and
Use Private Message Content, in Violation of Its Express Agreements With
Facebook Users.

61.

7

In order to establish a Facebook account, a user must agree to the Company’s Statement

8
9
10
11
12
13

of Rights and Responsibilities and its Privacy Policy. Specifically, on Facebook’s main page, it states,
“By clicking Sign Up, you agree to our Terms and that you have read our Data Use Policy, including
our Cookie Use.”25 Within this sentence, the word “Terms” contains a hyperlink, leading to Facebook’s

14

“Statement of Rights and Responsibilities;”26 similarly, the words “Data Use Policy” contain a

15

hyperlink, leading to Facebook’s “Data Use Policy.”27

16

1.

17

62.

Facebook’s Statement of Rights and Responsibilities

The Statement of Rights and Responsibilities informs users that

18
This Statement of Rights and Responsibilities (“Statement,” “Terms,” or
“SRR”) derives from the Facebook Principles, and is our terms of service
that governs our relationship with users and others who interact with
Facebook. By using or accessing Facebook, you agree to this Statement, as
updated from time to time in accordance with Section 14 below.
Additionally, you will find resources at the end of this document that help
you understand how Facebook works.

19
20
21
22
23

(emphasis added).

24
63.

The very first enumerated section of the Statement of Rights and Responsibilities is

25
26

titled “Privacy.” It consists of three sentences:

27
28

25

Facebook, https://www.facebook.com.
Statement of Rights and Responsibilities, Facebook, https://www.facebook.com/legal/terms.
27
Data Use Policy, Facebook, https://www.facebook.com/about/privacy.
26

CLASS ACTION COMPLAINT
15

Your privacy is very important to us. We designed our Data Use Policy28
to make important disclosures about how you can use Facebook to share
with others and how we collect and can use your content and information.
We encourage you to read the Data Use Policy, and to use it to help you
make informed decisions.

1
2
3
4
5

64.

The above language incorporates Facebook’s Data Use Policy by reference, and

designates this document as governing the Company’s privacy policy with its users.

6
2.

7
65.

8
9
10

Facebook’s Data Use Policy

The term “message” is found in Facebook’s Data Use Policy (“the Policy”) only nine

times, and only once contemplates the Company receiving data related to users’ private messages.
Specifically, under the heading “Information we receive and how it is used,” the Company states:

11

Other information we receive about you

12
We also receive other types of information about you:

13



14
15
16
17

66.

We receive data about you whenever you use or are running Facebook,
such as when you look at another person’s timeline, send or receive a
message, search for a friend or a Page, click on, view or otherwise
interact with things, use a Facebook mobile app, or make purchases
through Facebook.29

Under the section titled “How we use the information we receive,” the Policy states:

18
We use the information we receive about you in connection with the
services and features we provide to you and other users like your friends,
our partners, the advertisers that purchase ads on the site, and the
developers that build the games, applications, and websites you use. For
example, in addition to helping people see and find things that you do and
share, we may use the information we receive about you:

19
20
21
22
23
24
25
26
27
28

28

As with the disclosure on the main page, “www.facebook.com,” the words “Data Use Policy” contain a
hyperlink leading to https://www.facebook.com/about/privacy/.
29

Data Use Policy: Information we receive and how it is used, Facebook,
https://www.facebook.com/full_data_use_policy. There have been minor revisions to this language during
the class period, not one of which is material to the allegations contained herein. Prior to November 15,
2013, this language read: “We receive data about you whenever you interact with Facebook, such as when
you look at another person’s timeline, send or receive a message, search for a friend or a Page, click on,
view or otherwise interact with things, use a Facebook mobile app, or purchase Facebook Credits or make
other purchases through Facebook.”
CLASS ACTION COMPLAINT
16



1




2
3



4



5
6
7
8



9
10

***
While you are allowing us to use the information we receive about
you, you always own all of your information. Your trust is
important to us, which is why we don’t share information we
receive about you with others unless we have:

11
12
13




14
15
16
17

as part of our efforts to keep Facebook products, services and
integrations safe and secure;
to protect Facebook’s or others’ rights or property;
to provide you with location features and services, like telling you
and your friends when something is going on nearby;
to measure or understand the effectiveness of ads you and others
see, including to deliver relevant ads to you;
to make suggestions to you and other users on Facebook, such as:
suggesting that your friend use our contact importer because you
found friends using it, suggesting that another user add you as a
friend because the user imported the same email address as you
did, or suggesting that your friend tag you in a picture they have
uploaded with you in it; and
for internal operations, including troubleshooting, data analysis,
testing, research and service improvement.

67.

received your permission;
given you notice, such as by telling you about it in this policy; or
removed your name or any other personally identifying
information from it.

These disclosures do not disclose that as a matter of course Facebook scans, mines, and

18

manipulates the content of its users’ private messages, acting in a manner in direct conflict with the

19

assurances it provides to its users regarding the privacy and control they should expect in using

20

Facebook’s services.

21
68.

Facebook misleads users into believing that they have a secure, private mechanism for

22
23

communication – Facebook’s private messaging function – when, in fact, Facebook intercepts and

24

scans the content and treats portions of that content no differently than a public “Like” or post,

25

broadcast openly across the Internet. Further, the purpose for the invasive scanning of these purportedly

26
27

“private” messages is not meant for the benefit of users, but rather is a mechanism for Facebook to
surreptitiously gather data in an effort to improve its marketing algorithms and increase its ability to

28
profit from data about Facebook users.
CLASS ACTION COMPLAINT
17

CLASS ALLEGATIONS

1
69.

2
3

Plaintiff brings this nationwide class action, pursuant to Rule 23 of the Federal Rules of

Civil Procedure, individually and on behalf of all members of the following Class:

4

All natural person Facebook users located within the United States who
have sent or received private messages, including by specifying the other
Facebook user(s) who had access to a specific post, whether by creating a
private group or posting a message to specific users, where such message
included URLs in the content, from within two years before the filing of
this action up through and including the date of the judgment in this case.

5
6
7
8

70.

Excluded from the Class are Defendant, any parent, subsidiary, affiliate or controlled

9
10
11
12
13
14

person of the Defendant, as well as the officers and directors (and their immediate family) of any such
person.
71.

The members of the Class are so numerous that joinder of all members is impracticable.

While the exact number of Class members is unknown to Plaintiff at the present time and can only be
ascertained through appropriate discovery, Plaintiff believes that there are in excess of 5 million

15
16
17
18
19
20

members of the Class located throughout the United States. It would be impractical to join the class
members individually.
72.

Plaintiff’s claims are typical of the members of the Class. Plaintiff and all members of

the Class have sustained injuries because of Defendants’ unlawful activities alleged herein and are
entitled to identical statutory damages. Plaintiff has retained counsel competent and experienced in

21
class actions and consumer protection litigation and intends to pursue this action vigorously. The
22
23
24
25
26

interests of the Class will be fairly and adequately protected by Plaintiff. Plaintiff has no interests which
are contrary to or in conflict with those of the Class that Plaintiff seeks to represent.
73.

A class action is superior to all other available methods for the fair and efficient

adjudication of this controversy.

27
28

CLASS ACTION COMPLAINT
18

1

74.

Common questions of law and fact exist as to all members of the Class and predominate

2

over any questions solely affecting individual members of the Class. Among the many questions of law

3

and fact common to the Class are:

4

(1)

whether Facebook messages and private posts are communications within the meaning

5

of CIPA;

6

(2)

whether Facebook intercepted these messages in transit;

7

(3)

whether Facebook uses a “machine, instrument or contrivance;”

8

(4)

whether Facebook obtained consent from Facebook users or was otherwise “authorized”
to intercept these messages;

9

11

(5)

whether Facebook intercepted “content,” and

(6)

10

whether Facebook acted “willfully.”

75.

Even if Class Members themselves could afford to prosecute this action on an individual

12
13

basis, judicial economy cautions against such a scenario. Given the complex legal and factual issues

14

involved, and considering that the Class could number in the tens of millions or greater, individualized

15

litigation would significantly increase the delay and expense to all parties and to the Court.

16

Individualized litigation would also create the potential for inconsistent or contradictory rulings. By

17

contrast, a class action presents far fewer management difficulties, allows claims to be heard which may

18
otherwise go unheard because of the relative expense of bringing individual lawsuits, and provides the
19
20

benefits of adjudication, economies of scale and comprehensive supervision by a single court.

21

CAUSES OF ACTION

22

COUNT ONE

23

CLAIM FOR RELIEF UNDER CALIFORNIA PENAL CODE § 630, ET SEQ.

24

A.

Violations of Cal. Penal Code § 631(a)

78.

Plaintiff repeats and realleges each and every allegation contained above.

79.

California Penal Code § 631 makes it unlawful, by means of any machine, instrument or

25
26
27
28

contrivance, to purposefully intercept the content of a communication over any “telegraph or telephone

CLASS ACTION COMPLAINT
19

1
2

wire, line, cable or instrument,” or to read or attempt to read or learn the contents of any such
communications without the consent of all parties to the communication.

3

80.

Facebook is a “person” within the meaning of the CIPA.

4

81.

In engaging in conduct alleged herein, Facebook has and continues to violate California

5

Penal Code § 631 as to Plaintiff and the Class.

6
7

82.

During the relevant time period, Facebook intercepted the content of private

8

communications from or to class members without their consent using web crawlers and servers which

9

qualify as machines, instruments or contrivances. The identity and name of the “machine,”

10

“instrument,” or “contrivance” used by Facebook is known by Facebook and otherwise unknown by

11

Plaintiff and the Class, but will be revealed through discovery.

12
13
14
15
16
17

83.

Facebook acts willfully when it reads, attempts to read, or learns the content or meaning

of Plaintiff’s and Class Members’ messages.
84.

Facebook does not have the consent of all parties to the communication or it acts in an

unauthorized manner when it reads, attempts to read, or learns the content or meaning of Plaintiff’s and
Class Members’ messages.

18
85.

Neither Plaintiff nor members of the proposed class consented to the interceptions.

19
20

Facebook’s scanning, processing, or copying of Plaintiff’s and Class Members’ email amounts to

21

Facebook reading, attempting to read, or learning the content or meaning of Plaintiff’s and Class

22

Members’ messages.

23

86.

At the time Facebook reads, attempts to read, or learns the contents or meaning of

24
Plaintiff’s and Class Members’ messages, the messages are in transit to the other Facebook users.
25
26
27

87.

At the time Facebook reads, attempts to read, or learns the contents or meaning of

Plaintiff’s and Class Members’ messages, the messages are passing over any wire, line, or cable.

28

CLASS ACTION COMPLAINT
20

B.

Violations of Cal. Penal Code § 632

2

76.

Pursuant to Cal. Penal Code §§ 7 and 632(b), Facebook, a corporation, is a “person.”

3

77.

Cal. Penal Code § 632 prohibits eavesdropping upon or the recording of any confidential

1

4
5

communication, including those occurring by telephone, telegraph or other device, through the use of
an amplification or electronic recording device without the consent of all parties to the communication.

6
7
8
9
10
11

78.

Facebook intentionally and without the consent of any party to the communication

eavesdrops upon and/or records the contents of Plaintiff’s and Class Members’ private messages.
79.

Facebook uses electronic amplifying or recording devices, including its web crawlers

and social plugins, to eavesdrop upon and to record Plaintiff’s and Class Members’ private messages,
for purposes independent and unrelated to storage.

12
13
14
15
16
17

80.

Plaintiff’s and Class Members’ private messages are confidential communications with

specifically identified and designated recipients.
81.

At the time Plaintiff and Class Members transmit private messages via Facebook, their

communications are confidential because the communications are confined to those persons specified
as recipients. There neither would, nor could, be any expectation that a third party, such as Facebook,

18
would act in any manner other than to facilitate the communication of the private message between the
19
20

sender and the intended recipient or recipients. There certainly would not and could not be any

21

expectation that Facebook – a third party – would scan the contents of the private message in an effort

22

to catalog and manipulate the information contained therein.

23

82.

There is no knowledge or expectation among Plaintiff and Class Members regarding the

24
extent of Facebook’s reading of users’ private message content, learning about the content or meaning
25
26

of the private messages, acquiring and collecting the content of such messages, and manipulating the

27

content of such messages – each action being beyond the normal occurrences, requirements, and

28

expectations regarding the facilitation and transmission of Facebook’s private messages.

CLASS ACTION COMPLAINT
21

1
2
3
4
5

83.

Plaintiff’s and Class Members’ private messages sent via Facebook are carried on

among the parties by means of an electronic device that is not a radio.
84.

Plaintiff and Class Members do not consent, expressly or impliedly, to Facebook’s

eavesdropping upon and recording of their private messages. Facebook does not disclose material
information to its users relating to its attempts at reading, scanning, acquiring, collecting, and

6
7
8

manipulating the contents of users’ private messages.
85.

While Plaintiff has identified certain accused devices and/or technology in this

9

Complaint, Plaintiff reserves the right to assert violations of Cal. Penal Code §§ 631 and 632 as to any

10

further devices or technology subsequently discovered or any devices or technology upon which

11

Facebook provides additional information.

12
13
14
15
16
17

C.

Relief Sought Under Cal. Penal Code § 637.2

86.

As a result of Facebook’s violations of Cal. Penal Code §§ 631 and 632, Plaintiff and the

Class are entitled to:
a.

Preliminary and permanent injunctive relief to require Facebook to fully disclose

the extent of its activities, to seek the informed and knowing consent of its users when scanning users’

18
private messages, and to halt Facebook’s violations;
19
20
21
22
23

b.

Appropriate declaratory relief;

c.

Monetary relief in the amount set forth in Cal. Penal Code § 637.2(a) for each

Class Member; and
d.

Reasonable attorney’s fees and other litigation costs reasonably incurred.

24
25
26
27
28

CLASS ACTION COMPLAINT
22

COUNT TWO

1
2

(VIOLATIONS OF CALIFORNIA’S UNFAIR COMPETITION LAW CALIFORNIA BUSINESS
& PROFESSIONS CODE § 17200 ET SEQ.)

3
4
5

87.

Plaintiff, and Class Members, reallege and incorporate by reference every allegation set

forth in the preceding paragraphs as though alleged in this Count.

6
88.

Facebook’s conduct as alleged herein constitutes unfair, unlawful, or fraudulent business

7
8
9
10
11

acts or practices as proscribed by Section 17200, et seq., of the California Business & Professions Code
(“UCL”).
89.

Facebook’s conduct constitutes “unlawful” business acts or practices by virtue of

Defendant’s violation of the Cal. Penal Code §§ 631(a) and 632.

12
90.

Plaintiff reasonably relied on Facebook’s representations that Plaintiff’s private

13
14

messages are viewable only by the sender and the recipient, and as a result engaged in “private”

15

messaging on Facebook. Facebook failed to disclose to Plaintiff and members of the general public that

16

it systematically reviews and captures the content of, and metadata associated with, Plaintiff’s private

17

messages. Facebook failed to disclose that it aggregates the content and data of private messages, using

18

it to sell advertising for a profit. Facebook’s Data Use Policy fails to disclose Facebook’s acts or

19
20

practices, and together with its statements that private messages are viewable only by the sender and the

21

recipient, are likely to deceive members of the public. As a result, Facebook’s conduct constitutes

22

“fraudulent” business acts or practices.

23
24

91.

Plaintiff has an interest in controlling the disposition and dissemination of his private

messages. Contrary to Plaintiff’s interests, Facebook exercised control over the content of Plaintiff’s

25
26
27
28

private messages, exploiting it for sale and profit without Plaintiff’s consent. As a result, Facebook’s
conduct constitutes “unfair” business acts or practices.
92.

Plaintiff has suffered injury in fact and lost money or property as a result of Facebook’s

business acts or practices.
CLASS ACTION COMPLAINT
23

93.

1

Plaintiff and Class Members seek an order to enjoin Facebook from such unlawful,

2

unfair, and fraudulent business acts or practices, and to restore to Plaintiff and Class Members their

3

interest in money or property that may have been acquired by Facebook by means of unfair

4

competition.

5

JURY DEMANDED

6
Pursuant to Federal Rule of Civil Procedure 38, Plaintiff, individually and on behalf of the Class

7
8

they seek to represent, demands a jury on any issue so triable of right by a jury.
PRAYER FOR RELIEF

9
10
11

WHEREFORE, Plaintiff, on behalf of themselves and all Class Members, request judgment be
entered against Facebook and that the Court grant the following:

12
1.

13

An order determining that this action may be maintained as a class action under Rule 23

14

of the Federal Rules of Civil Procedure, that Plaintiff are proper class representatives, that Plaintiff’s

15

attorneys be appointed Class counsel pursuant to Rule 23(g) of the Federal Rules of Civil Procedure,

16

and that Class notice be promptly issued;

17

2.

Judgment against Facebook for Plaintiff’s and Class Members’ asserted causes of action;

3.

Appropriate declaratory relief against Facebook;

4.

Preliminary and permanent injunctive relief against Facebook;

5.

An award of statutory damages to Plaintiff and Class Members pursuant to Cal. Penal

18
19
20
21
22
23

Code § 637.2, for each, the greater of $5,000 or three times the amount of actual damages sustained by
Plaintiff and Class Members;

24
6.

An award of reasonable attorney’s fees and other litigation costs reasonably incurred;

7.

Any and all relief to which Plaintiff and the Class may be entitled.

25
26
27

and

28

CLASS ACTION COMPLAINT
24

1

DATED: January 21, 2014

GLANCY BINKOW & GOLDBERG LLP

2
3
4
5
6
7
8
9
10
11
12
13
14
15

By: s/Lionel Z. Glancy
Lionel Z. Glancy
1925 Century Park East, Suite 2100
Los Angeles, California 90067
Telephone: [phone]
Facsimile: [phone]
Email: [e-mail]
POMERANTZ LLP
Jeremy A. Lieberman
Lesley F. Portnoy
600 Third Avenue, 20th Floor
New York, New York 10016
Telephone: [phone]
Facsimile: 212-661-8665
POMERANTZ LLP
Patrick V. Dahlstrom
10 South La Salle Street, Suite 3505
Chicago, Illinois 60603
Telephone: [phone]
Facsimile: [phone]
[e-mail]

16
Counsel for Plaintiff DAVID SHADPOUR
17
18
19
20
21
22
23
24
25
26
27
28

CLASS ACTION COMPLAINT
25