Virtue et al v. Myspace, Inc.

Filing 1

COMPLAINT against Myspace, Inc. Disclosure Statement on Civil Cover Sheet completed -yes,, filed by Linda Virtue, Lily Castro. (Attachments: # 1 Civil Cover Sheet) (Siegfried, Evan) (Entered: 04/13/2011)

v

FILED ,;·
CLERK

fJ _

SUMMONS ISSUEtl

I

2a11 APR 13 AM II: 47
U.S. DISTRiCT COUHT
EASTERN DISTRiCT
OF hEV1 Y0f'i( UNITED STATES DISTRICT COURT
EASTERN DISTRICT OF NEW YORK
LINDA VIRTUE and LILY CASTRO,
individually and on behalf of all others similarly
situated,
Plaintiffs,
v.

) CaseNo.
)

)jJjai1j_~~N

~·•Lr!l -l800
) JURY TRIAL DEMANDED
)
)
)
)

MYSPACE, INC.,
Defendant.

)

~AUSKOPF, J.

l.EvY M.J

Plaintiffs Linda Virtue and Lily Castro ("Plaintiffs") bring this action individually and on
behalf of a Class of all persons similarly situated in the United States against Myspace, Inc.
("Myspace" or "Defendant"). It arises from Defendant's intentional and knowing transmission
of data to advertising companies and data aggregators that is used to identifY M yspace members,
and associate them by name with their Internet browsing histories, without the Myspace
members' knowledge or consent. This conduct was in violation of federal and state laws and in
breach ofMyspace's purported agreements with its members. Plaintiffs and the class seek
damages and equitable relief.
Plaintiffs allege the following upon personal knowledge as to their own acts, and upon
information and belief based on the investigation conducted by Plaintiffs' counsel as to all other
matters.

·.·f.fl

STATEMENT OF THE CASE
Myspace Promises Its Members a Private Space but
Discloses Their Personal Information to Data Aggregators
I.

Myspace purports to operate a password-protected social network website for its

members. It urges such members to create personal online profiles, including photos, journals,
and comments --- i.e., to create a place in the cyber-world that can be "myspace" --- and to share
that space with other designated Myspace members. Myspace purports to allow members to
restrict access to their postings and private email messages and states on its website that
"Myspace takes privacy seriously."
2.

Indeed, Myspace Co-President, Mike Jones, stated in a May 2010 blog posting

that, "Myspace's core value of allowing self-expression and representation of yourself remains
true, without the fear that your unique contribution to Myspace will be unknowingly used for an
alternative purpose."
3.

Unfortunately for consumers, Myspace shares much more information than its

members choose to publicize. Unbeknownst to its members, Myspace knowingly serves as and
profits handsomely from being a conduit through which details of the most intimate aspects of its
members' lives, as reflected in their Internet browsing history and otherwise, are transmitted to
data aggregators, who package the information into profiles and sell it like any other commodity
to advertisers who use the information for marketing and other purposes.
4.

Specifically, as Myspace is well aware, Internet tracking companies secretly plant

millions of tracking devices in users' personal computers. Each tracking company can follow
users as they browse the Internet and can link their records of each new page the user visits to
their records of all the pages that the user has visited in the previous minutes, months and years.
Thus, tracking companies can construct and update a long-term profile of what particular users

2

are doing with their web browsers. Anyone who has used the Internet to seek advice about
hemorrhoids, sexually transmitted disease, abortion, drug rehabilitation, dementia --- the list goes
on and on --- can be reasonably certain that a browsing history created by such surreptitious
tracking has been incorporated into a profile for sale to marketers. For example, one such data
aggregator, Audience Science, states that its work involves "recording billions of behavioral
events daily and reaching over 385 million unique Internet users" and then making such data
available to its clients: "web publishers, marketers, networks, exchanges, and agencies, to create
intelligent audience segments to connect people with relevant advertising driving the transition to
data-driven audience marketing online."
5.

Such profiles are often anonymous, meaning that they reflect the viewing habits

of some computer user at some IP address but are not associated with the viewing patterns of a
specific person. Not so for Myspace members, however, because Myspace knowingly provides
the link that enables advertisers to put a name to these profiles. Specifically, upon signup,
Myspace assigns each member a unique ID number that is associated with their profile page.
Myspace allows the user ID to be displayed, along with associated secret tracking devices
revealing the user's browsing history, when the Myspace user clicks on advertisements and/or
third party applications appear on the user's Myspace page.
6.

The ID number directs the data aggregator to the members' profile pages, where

third parties have access to whatever information the user posted. Even if the users do not post
their full names, or other personally identifiable information, computer programs can quickly and
automatically determine their identity from snatches of information. This, combined with each
users' browsing history, as reflected on secret tracking devices, and data derived therefrom,

3

provides the aggregator with a detailed profile of the users' behavior and interests that can be
sold to marketers who then carry out "behavioral targeting" marketing. As noted:
Information collected voluntarily from a user may be compiled with user metrics
such as data stored on cookie files. Thus, data that previously identified a unique
person's preferences (such as the sites visited and likely interests), but not the
identity of that unique user, made (sic] be combined with personally identifying
information, removing the anonymity of web browsing and Internet statistics.
Not all sites, however, combine personal information and web statistics.
Ian C. Bailon, Web Beacons, Cookies and Other Online Data Gathering Mechanisms,
£-Commerce & Internet Law§ 26.03, at 26-20 (2010~2011 update).

7.

The Electronic Frontier Foundation ("EFF"), a non-profit group focused on

protecting consumers' rights on the Internet, has published a research article in which it
explained in greater detail how social network sites can work with online tracking companies to
create personally identifiable user profiles, for purchase and sale as commodities, based on webbrowsing history. The research article by the EFF began by explaining the role of online
tracking companies:
3rd party advertising and tracking firms are ubiquitous on the modem web. When
you visit a webpage, there's a good chance that it contains tiny images or invisible
JavaScript that exists for the sole purpose of tracking and recording your
browsing habits.

*

*

*

[W]hen we went to CareerBuilder.com, which is the largest online jobs site in the
United States, and searched for a job, CareerBuilder included JavaScript code
from 10 (!) different tracking domains. . . . There are pretty sound reasons to hope
that when you search for a job online, that fact is not broadcast to dozens of
companies you've never heard of- but that precisely what's happening here.
(Peter Eckersley, How Online Tracking Companies Know Most of What You Do Online (And
What Social Networks Are Doing to Help Them) (Sept. 21, 2009),

http://www.eff.org/deep1inks/2009/09/ online-trackers-and-social-networks). The EFF research

4

article next turned to online social networking websites such as Myspace, raising -- and
answering -- the question that is at the heart ofthis case:
Given how much tracking firms know about our browsing history, it's worth
asking whether these companies also know who we are.
The answer,
unfortunately, appears to be "yes," at least for those of us who use social
networking sites.

*

*

*

A recent research paper by Balanchander Krishnamurthy and Craig Wills shows
that social networking sites like Face book, Linkedln and MySpace are giving the
hungry cloud of tracking companies an easy way to add your name, list of
friends, and other profile information to the records they already keep on you.
!d. (emphasis added).
8.

On May 21,2010, the Wall Street Journal published an article in which it reached

a similar conclusion. The article stated that Myspace had been sending user names or ID
numbers that could direct advertisers back to a profile page full of personal information. The
article cited the paper prepared by Balachander Krishnamurthy and Craig Wills, in which the
authors reported that there were "multiple ways" outside companies could access Myspace user
data. (Balachander Krishnamurthy and Craig E. Wills, On the Leakage of Personally
Identifiable Information Via Online Social Networks, http://www2.research.att.com/-bala/papers

/wosn09.pdQ. After analyzing Myspace and other online social network websites, the
researchers concluded that:
The popularity of Online Social Networks (OSN) has accelerated the appearance
of vast amounts of personal information on the Internet. Our research shows that
it is possible for third-parties to link PII, which is leaked via OSNs [such as
Myspace], with user actions both within OSN sites and elsewhere on non-OSN
sites.

5

9.

The On the Leakage of Personally Identifiable Information Via Online Social

Networks research paper also stated that:

"Personally identifiable information" (PII) is defined as information which can be
used to distinguish or trace an individual's identity either alone or when combined
with other public information that is linkable to a specific individual. The growth
in identity theft has increased concerns regarding unauthorized disclosure of PII.

!d.
10.

In response to the investigation by the Wall Street Journal, Myspace admitted the

violation. Myspace also told the Wall Street Journal that Myspace was "currently implementing
a methodology that will obfuscate the 'FriendiD' in any URL that is passed along to
advertisers."' !d. at 3. Myspace has broken this promise in that it has not implemented this
methodology, but continues to this very day to disclose user IDs to advertisers, thereby exposing
the personal identity of individuals along with their private Internet browsing history. See, e.g.,
Geoffrey A. Fowler & Emily Steel, What They Know: A Wall Street Journal Investigation:
MySpace, Apps Leak User Data --Site Sends Personal IDs When Ads Are Clicked, a Journal
Investigation Finds, Wall St. J., Oct. 23, 2010.

Myspace Engages In The Unlawful Conduct To Maximize Its Revenues

11.

Personal information is a commodity that is priced, bought and sold in discrete

units. "Websites and stores can ... easily buy and sell information on valued visitors with the
intention of merging behavioral with demographic and geographic data in ways that will create
social categories that advertisers covet and target with ads tailored to them or people like them."
Joseph Turow, Jennifer King, Chris Jay Hoofuagle, Amy Bleakley & Michael Hennessy,
Americans Reject Tailored Advertising and Three Activities that Enable It (Sept. 29, 2009),

http://papers.ssrn.com/so13/papers.cfm?abstract id=l478214. The more information that is
known about a consumer, the more a company will pay to deliver a precisely-targeted

6

advertisement to him or her. See F.T.C., Protecting Consumer Privacy in an Era ofRapid

Change, Preliminary Staff Report (Dec. 2010) ("F.T.C. Report"), at 24.
12.

Personal data is also viewed as currency. "In many instances, consumers pay for

free content and services by disclosing their personal information," according to then F.T.C.
commissioner Pamela Jones Harbour. F. T C. Roundtable Series I on: Exploring Privacy (Matter
No. P095416) Dec. 7, 2009, at 148. (available at http://www.ftc.gov/bcp/
workshops/privacyroundtables/PrivacyRoundtable Dec 2009 Transcript. pdf). In Property,

Privacy, and Personal Data, Professor Paul M. Schwartz wrote:
Personal information is an important currency in the new millennium. The
monetary value of personal data is large and still growing, and corporate America
is moving quickly to profit from this trend. Companies view this information as a
corporate asset and have invested heavily in software that facilitates the collection
of consumer information.
Paul M. Schwartz, Property, Privacy and Personal Data, 117 Harv. L. Rev. 2055, 2056-57 (May
2004).
13.

On February 28,2011, the Wall Street Journal published an article under the

headline "Web's Hot New Commodity: Privacy," in which it highlighted a company called
"Allow Ltd.," one of nearly a dozen companies that offer to sell people's personal information
on their behalf and give them 70% of the sale. An Allow Ltd. customer received a payment of
$8.95 for letting Allow tell a credit card company he is shopping for new plastic. Id.
14.

In Myspace's business model, Myspace consumers "pay" for "free" products by

disclosing their personal information, which Myspace uses to offer a particularly attractive
advertising platform that can deliver targeted ads to Myspace users. It is the value of this user
personal information for advertising that powers Myspace's business.
15.

Unbeknownst to Plaintiffs, Myspace goes a step further, disclosing personally

identifiable browsing histories without its members' consent, and it does so to increase its

7

revenues from advertisers and other third parties who pay for and use the information to create
personal profiles that can be sold in an active market place for such information.

Myspace Misleads Consumers Regarding Disclosure of of Consumers' Personally
Identifiable Browsing History
16.

Myspace's privacy policy does not inform members that it provides data

aggregators with both its members' user ID numbers and secret tracking devices that allows data
aggregators to put a name (and a face) to highly personal and in many cases, embarrassing
information, derived from Internet browsing history, that would otherwise be anonymous.
17.

Who would ever consent to public exposure of such embarrassing details? Not

Myspace members. Indeed, Myspace's "terms of service" and "privacy policy" are so opaque
and deceptive that they cannot constitute consent by the reasonable consumer to the conduct at
issue here.
18.

Specifically, during the Myspace sign up process, users are presented with a

button that says "Sign Up Free," above which is text stating, "By clicking Sign Up Free, you
agree to Myspace terms of service and privacy policy." The terms provide a link to the terms of
service and privacy policy, respectively, but Myspace does not make it necessary for the user to
access either before becoming a member and, as such, subject to the improper practices alleged
herein.
19.

It is now widely accepted that this method of obtaining the purported assent of

website users is ineffective. In a Preliminary Staff Report, titled Protecting Consumer Privacy in

an Era of Rapid Change, the Federal Trade Commission stated that, "[T]he notice-and-choice
model, as implemented, has led to long, incomprehensible privacy policies that consumers
typically do not read, let along understand" and that are wholly inadequate in an age in which
companies "collect and use consumers' information in ways that often are invisible to

8

consumers." F.T.C. Report at iii. The FTC also found that "privacy notices are often opaque,
lack uniformity, and are too long and difficult to navigate. Too frequently they bury disclosures
of important information .... A particularly strong illustration of where privacy policies have
been ineffective is in the mobile context where, because of the small size of the device, a privacy
notice can be spread out over 100 separate screens. Indeed, it is difficult to imagine consumers
scrolling through each screen or making informed choices based on the information contained in
them." !d. at 70. See also, Aleecia M. McDonald & Lorrie Faith Cranor, The Cost of Reading

Privacy Policies, 4 L.J. & Pol'y for Info. Soc'y 543, 565 (2008) (estimating that it would take
consumers hundreds of hours to read the privacy policies they might typically encounter in one
year on the Internet).
20.

Research confirms that reasonable consumers never read privacy policies or terms

of service and that, moreover, when they see the hyperlinked words "Privacy Policy" on a Web
site, they assume that they mean that their information is not being collected or shared, even if
the policy says just the opposite. See Joseph Turow, Americans Reject Tailored Advertising and

Three Activities that Enable It (Sept. 29, 2009), http://papers.ssm.com/
sol3/papers.cfm?abstract id=1478214. The take-it-or-leave-it Myspace "privacy policy"--which would be more aptly named a "disclosure policy" and not "privacy policy" --- is no
exception. It misleads its users into believing that the "privacy policy" functions to prevent
disclosure of personal information with the following assurances:
(a)

"When you voluntarily provide PII [personally identifiable information] to

Myspace, we will make sure you are informed about who is collecting information, how and why
the information is being collected and the types of uses Myspace will make of the information to

9

the extent it is being used in a manner that differs from what is allowed pursuant to this Privacy
Policy."
(b)

"At the time you provide your PII, Myspace will notify you of your

options regarding our use of PII (See "Choice" below). Except as described in this Privacy
Policy, Myspace will not share your PII with third parties unless you have given Myspace
permission to do so (See "Use" below)."
(c)

"Except as described in this Privacy Policy, Myspace will get your

permission before we use PII in a way that is inconsistent with the purpose for which it was
submitted or share your PII with third parties that are not affiliated with Myspace."
(d)

"Myspace uses commercially reasonable administrative, technical,

personnel and physical measures to safeguard PII and credit card information in its possession
against loss, theft and unauthorized use, disclosure or modification."
21.

The Myspace Privacy Policy purports to define personally identifiable

information parenthetically, as follows: '"PII' -- your full name, email address, mailing address,
telephone number, or credit card number." This is misleading because the privacy policy's
purported definition of "personally identifiable information" (in the form of a parenthetical
enumeration) is under inclusive as it fails to include information that is commonly viewed as
"personally identifiable information," including Plaintiff's Myspace personal identification
number.
22.

Defendant's own lawyer recognizes that the Myspace Privacy Policy definition of

personally identifiable information is under-inclusive, describing personally identifiable
information instead as follows: "The adjective personally identifying information describes a
particular type of information that, by definition, necessarily identifies a person. The term

10

personally identifiable information, while perhaps less clear and less grammatically correct,
conveys the uncertainty associated with information that may or may not identify a particular
person." Bailon, supra, 1 £-Commerce & Internet Law§ 26.01, at 26-7, n.6. Indeed, the
proposition that Plaintiffs user identification number is not "personally identifiable information"
is, on its face, oxymoronic doublespeak: how can a number that identifies the user (user
identification number) not be personally identifiable information?
23.

Moreover, the Privacy Policy is misleading in so far as it suggests that "personally

identifiable data" is materially different from other anonymous user data and that each is treated
differently, with the former receiving more protection. However, this distinction is meaningless.
As explained by Bailon:
Data privacy historically has been thought of in terms of personally identifying
information (alternatively called personally identifiable or individually
identifiable information or referred to simply as PII). Attention has been focused
on personal data that could identify an individual person --- by data elements such
as a person's name, postal address, email address, social security number or
driver's license number --- as opposed to aggregate data, which may be useful to
companies but not reveal anything in particular about any individual user, or data
unique to a person that could distinguish that person from someone else, but not
reveal a person's identity (such as cookie data that shows almost everything about
a user's use of a site except who that user is.) ... The Federal Trade Commission
noted in a 2009 report, however, that changes in data collection and use practices
and new technologies increasingly make the distinction between PII and non-PII
less meaningful. ... As technologies improve, it is assumed that it will be easier
to actually identify a specific person based on data that to date has been
considered non-PII or pseudonymous .

•

•

•

Even where data itself is anonymous or pseudonymous, it cau become
identifiable when combined and linked together . . . Thus, distinctions
between PH and non-PH may not have any bearing on the particular privacy
risks at issue. . . . For all of these reasons, the FTC has suggested that, at
least in the context of behavioral advertising, the relevant criteria is whether
information reasonably could be associated with a particular consumer or
device, not whether it is PH or non-PH.

•

•
II

•

The increased use of third party cookies, the use of cookies for increasingly
more sensitive data and the practice of some sites in combining information
voluntarily obtained with data collected through cookies and other technical
means have blurred the difference between personally identifying
information and non-PH."
Bailon, supra, at 26-7-26-9,26-20-26-21 (emphasis added; footnotes omitted).
JURISDICTION AND VENUE

24.

This Court has subject matter jurisdiction pursuant to the Class Action Fairness

Act of2005, 28 U.S.C. §§ 1332(a) and 1332(d), because the amount in controversy exceeds
$5,000,000.00, exclusive of interests and costs, and more than two-thirds ofthe members of the
Class are citizens of states different from that of Defendant. This Court also has federal question
jurisdiction as this Complaint alleges violations of the Stored Communications Act (18 U.S.C. §
2701 et seq.) (the "SCA").
25.

Venue for this action properly lies in this District pursuant to 28 U.S.C. § 1391, as

Plaintiff Linda Virtue resides in this District in Brooklyn, New York.

PARTIES
26.

Plaintiff Linda Virtue is an individual who resides in Brooklyn, New York and is

a member ofMyspace's social networking website. As a condition of her Myspace membership,
Ms. Virtue was required to and did provide Myspace with personally identifiable information.
Myspace has disclosed Ms. Virtue's personally identifiable information in connection with her
browsing history without her consent. Had she been given the choice, Ms. Virtue would not
have disclosed her personally identifiable browsing history to third parties. Ms. Virtue was
embarrassed and humiliated by the disclosure of her personally identifiable browsing history.
Moreover, Ms. Virtue's personally identifiable browsing history is valuable personal property
with a market value. As a result of Defendant's unlawful conduct, Ms. Virtue relinquished this
valuable personal property without the compensation to which she was due.

12

27.

Plaintiff Lily Castro is an individual who resides in San Francisco, California and

is a member ofMyspace's social networking website. As a condition of his Myspace
membership, Ms. Castro was required to and did provide Myspace with personally identifiable
information. Myspace has disclosed Ms. Castro's personally identifiable information in
connection with her browsing history without her consent. Had she been given the choice, Ms.
Castro would not have disclosed her personally identifiable browsing history to third parties.
Ms. Castro was embarrassed and humiliated by the disclosure of her personally identifiable
browsing history. Moreover, Ms. Castro's personally identifiable browsing history is valuable
personal property with a market value. As a result of Defendant's unlawful conduct, Ms. Castro
relinquished this valuable personal property without the compensation to which she was due.
28.

Defendant Myspace is located at 407 North Maple Drive, Beverly Hills,

California. Myspace operates a social network platform that allows members to create personal
profiles online, including photos and journals, which they can share with designated "friends."
Myspace's website address is found at http://www.myspace.com. Myspace had nearly 70
million unique U.S. users and 101 million unique global users as of June 2010. Myspace
conducts business from California throughout the United States.
29.

Myspace is an electronic service provider as that term is defined in the Stored

Communications Act ("SCA"), 18 U.S.C. §§ 2510(14) and (15), among other reasons, because it
provides private email messaging services and "comment posting" services. Myspace is a
remote computing service as that term is defined in the SCA, 18 U.S.C. § 2711(2), among other
reasons, because it provides backup protection for posted comments by means of an electronic
communications system.

13

CLASS ACTION ALLEGATIONS
30.

Plaintiffs bring this action on behalf of themselves and all other persons similarly

situated, pursuant to Fed. R. Civ. P. 23, defined as follows: persons who reside in the United
States and who at any time after April 13, 2006 had signed up for Myspace's service.
31.

Excluded from the Class are Defendant; any parent, subsidiary, or affiliate of

Defendant or any employees, officers, or directors of Defendant; legal representatives,
successors, or assigns of Defendant; and any justice, judge or magistrate judge of the United
States who may hear the case, and all persons related to any such judicial officer, as defined in
28 U.S.C. § 455(b).
32.

Numerosity. The Class members are so numerous and dispersed nationwide that

joinder of all members is impracticable. Upon information and belief, the Class members
number in the hundreds of thousands, if not millions. The exact number of Class members is
unknown, but can be determined from Defendant's computerized and other records. Plaintiffs
reasonably estimate and believes that there are thousands of persons in the Class.
3 3.

Commonality. There are numerous and substantial questions of law and fact that

are common to all members of the Class, which predominate over any question affecting only
individual Class members. The members of the Class were and continue to be subjected to the
same practices of the Defendant. The common questions and issues raised by Plaintiffs' claims
include: whether Defendant shared Plaintiffs' and the Class's personal information with thirdparty advertisers and Internet tracking companies; whether Plaintiffs consented to Defendant's
sharing of Plaintiffs' personal information with third-party advertisers and Internet tracking
companies; whether Defendant violated its own Terms and Privacy Policies by sharing Plaintiffs'
personal information with third-party advertisers and Internet tracking companies; whether
Plaintiffs and the Class have been damaged as a result of Defendant's alleged violations as
14

alleged herein; and, if so, the appropriate relief for Defendant's violations; whether Defendant
has violated the SCA and, if so, the appropriate measure of damages and remedies against
Defendant for any violations of the SCA; whether Defendant breached its contract, and if so, the
appropriate measure of damages and remedies against Defendant for such breach; whether
Defendant breached the covenant of good faith and fair dealing, and if so, the appropriate
measure of damages and remedies against Defendant for such breach; and, the nature and extent
of any other remedies, and injunctive relief, to which Plaintiffs and the Class are entitled.
34.

Typicality. Plaintiffs' claims are typical ofthe claims of all of the other members

of the Class, because their claims are based on the same legal and remedial theories as the claims
of the Class and arise from the same course of conduct by Defendant.
35.

Adequacy. Plaintiffs will fairly and adequately protect the interests of all

members of the class in the prosecution of this Action and in the administration of all matters
relating to the claims stated herein. Plaintiffs are similarly situated with, and have suffered
similar injuries as, the members of the Class they seek to represent. Plaintiffs have retained
counsel experienced in handling class action lawsuits. Neither Plaintiffs nor their counsel have
any interest that might cause them not to vigorously pursue this action.
36.

Superiority. A class action is superior to other available methods for the fair and

efficient adjudication of the controversy, since individual joinder of the Class members is
impracticable. Even if individual Class members were able to afford individual litigation, it
would be unduly burdensome to the Courts in which the individual litigation would proceed.
Defendant has subjected the Class to the same violations as referenced herein. Accordingly,
class certification is appropriate under Rule 23 because common issues of!aw and fact regarding
Defendant's uniform violations predominate over individual issues, and class certification is a

15

superior method of resolving these claims. No unusual difficulties are likely to be encountered
in the management of this action as a class action. Defendant acted and continues to act in a
manner that is generally applicable to all members of the Class, making final injunctive relief
appropriate.
37.

Notice. Plaintiffs anticipate notice can be made by sending notice directly to

class members at their email addresses.
VIOLATIONS OF NEW YORK AND CALIFORNIA LAW

38.

New York law applies to this action because Plaintiff Virtue resides in New York,

was in New York when she used the Myspace service, and Defendant's terms of use contains a
choice oflaw provision that states: "The Agreement shall be governed by and construed in
accordance with the laws of the state of New York, without regard to its conflict of law
provisions." Additionally, Myspace's corporate parent, News Corp., has its principal executive
office located in New York.
39.

California law applies to the claims and issues asserted herein if the choice of law

provision in the Terms of Use is deemed to be unconscionable. Additionally, Plaintiff Castro
and fellow Californians have a right to protection under California's constitution, statutory and
common laws. Moreover, all of Defendant's relevant business, including the formulation and
execution of the unlawful practices alleged herein, occurred in, or emanated from California,
where Defendant has its principal place of business. Accordingly, California has significant
contacts and/or a significant aggregation of contacts to the claims asserted by Plaintiffs and all
Class members.
40.

Additionally, California has a materially greater interest than any other state in

regulating unlawful conduct by Defendant, which conducted its unlawful practices out of its
principal place of business in California, and in enforcing the rights and remedies granted to
16

United States consumers, including California residents, under the California laws invoked by
this complaint. These rights and remedies further strong fundamental public policies of
California.
FIRST CAUSE OF ACTION
(Stored Communications Act, 18 U.S.C. § 2701 et seq.)

41.

Plaintiffs hereby incorporate by reference the allegations contained in all of the

preceding paragraphs of this complaint.
42.

Myspace provides an electronic communication service to the public via its social

networking website. 18 U.S.C. § 2510(15).
43.

Myspace provides remote computing service to the public because it provides

computer storage and processing services by means of an electronic communications system. 18
U.S.C. § 2711(2).
44.

Plaintiffs' personally identifiable browsing history is a content of electronic

communications within the meaning of 18 U.S.C. § 2510(12).
45.

By divulging contents of a communication in electronic storage (Plaintiffs' unique

Myspace identification number and other personally identifiable information in connection with
her browsing history) Defendant violated 18 U.S.C. § 2702 (a) (I)
46.

Myspace carries and maintains its members' Myspace profiles solely for the

purpose of providing storage and computer processing services to its users. My space is not
authorized to access this information for purposes other than providing storage and computer
processing. 18 U.S.C. § 2702(a)(l).
47.

By divulging contents of communication carried or maintained on the Myspace

service (Plaintiffs' unique Myspace identification number and other personally identifiable

17

information in connection with their browsing history), Myspace violated 18 U.S.C. §
2702(a)(2).
48.

Myspace engages in the foregoing acts without obtaining the lawful consent of the

user. 18 U.S.C. § 2702(b)(3).
49.

Section 2707 of the SCA provides for a civil cause of action and allows for

damages, and declaratory and equitable relief.
50.

Plaintiffs and the Class are entitled to statutory damages of no less than $1,000.00

(one thousand dollars) per violation. Because Myspace's violations were willful and intentional,
Plaintiffs and the Class are entitled to recover punitive damages as provided by 18 U.S.C. § 2702
(c).

SECOND CAUSE OF ACTION
(Violation Of New York General Business Law § 349)

51.

Plaintiffs hereby incorporates by reference the allegations contained in all of the

preceding paragraphs of this complaint.
52.

New York Gen. Bus. Law § 349 declares unlawful "deceptive acts or practices in

the conduct of any business, trade or commerce or in the furnishing of any service in this State."
Gen. Bus. Law § 349(g) provides that § 349 "shall apply to all deceptive acts or practices
declared to be unlawful, whether or not subject to any other law of this State."
53.

Gen. Bus. Law§ 349(h) provides a private right of action to any person injured by

reason of violation of that Section and authorizes the court to award reasonable attorney's fees to
the prevailing plaintiff. In relevant part, it provides: "any person who has been injured by reason
of any violation of this section may bring an action in his own name to enjoin such unlawful act
or practice and to recover her actual damages or $50, whichever is greater. The court may, in its
discretion, increase the award of damages to an amount not to exceed three times the actual

18

damages up to $1,000 ifthe court finds the defendant intentionally and knowingly violated this
section. The court may award reasonable attorney's fees to a prevailing plaintiff."
54.

Defendant's conduct as alleged herein is consumer oriented within the meaning of

General Business Law§ 349.
55.

Defendant, by its acts alleged and described herein, has committed a violation of

Gen. Bus. Law§ 349 by: (a) falsely stating that it would not disclose Plaintiffs' personally
identifiable information --- their personally identifiable browsing history --- without their
knowledge or consent and (b) disclosing such personally identifiable information. Additionally,
Defendant falsely represented that the Myspace service was "free," when in fact, Myspace users
were and are required to relinquish personally identifiable information as a condition of using the
service. Moreover, all of the representations set forth in paragraph 20 above were false.
56.

Defendant's misrepresentations were both deceptive and material.

57.

Myspace disclosed Plaintiffs' personally identifiable information in connection

with their browsing history. Had they been given the choice, Plaintiffs would not have disclosed
their personally identifiable browsing history to third parties. Plaintiffs were embarrassed and
humiliated by the disclosure of their personally identifiable browsing history. Moreover,
Plaintiffs' personally identifiable browsing history is valuable personal property with a market
value. As a result of Defendant's unlawful conduct, Plaintiffs relinquished this valuable
personal property without the compensation to which they were due.

THIRD CAUSE OF ACTION
(New York and California Common Law Conversion)
58.

Plaintiffs hereby incorporate by reference the allegations contained in all of the

preceding paragraphs of this complaint.

19

59.

Plaintiffs' personally identifiable information- including full name, email

address, mailing address, telephone number, and credit card number and personal browsing
history- is valuable property owned by Plaintiffs for which there is an active market.
60.

Defendant unlawfully and without authorization exercised dominion over said

property and thereby converted Plaintiffs' and the Class members' respective personal
information by providing it to third parties in violation ofthe Stored Communications Act, 18
U.S.C. § 2701 et seq. and in violation of its contracts with Plaintiffs and the respective class
members.
61.

Plaintiffs and the Class were damaged thereby.
FOURTH CAUSE OF ACTION
(New York and California Common Law Breach of Contract)

62.

Plaintiffs hereby incorporate by reference the allegations contained in all ofthe

preceding paragraphs of this complaint.
63.

Plaintiffs submit personally identifiable information to Myspace in exchange for

use of the Myspace service and Myspace promises it will not share this information with thirdparty advertisers or applications developers without Plaintiffs' consent and the consent of each
Class member, respectively.
64.

Despite this promise, Myspace did in fact knowingly share users' personally

identifiable information and non-anonymous user information with outside advertisers and
application developers in violation of its own Agreement with its users.
65.

Plaintiffs never consented to the sharing of their personally identifiable

information to third-party advertisers and/or application developers.
66.

Plaintiffs have performed their obligations under the contract.

20

67.

Myspace materially breached its contractual obligations through its conduct as

alleged herein, including its transmission of Plaintiffs' personal information to third-party
advertisers and application developers, as well as Plaintiffs' user ID without consent.
68.

Plaintiffs and the Class have been damaged as a direct and proximate result of

Myspace's breach of its agreements with Plaintiffs the other members of the class. Plaintiffs and
the Class have been damaged in an amount to be proven at trial.

FIFTH CAUSE OF ACTION
(New York and California Common Law
Breach of Implied Covenant of Good Faith and Fair Dealing)
69.

Plaintiffs hereby incorporate by reference the allegations contained in all of the

preceding paragraphs of this complaint.
70.

Once Plaintiffs agreed to use Myspace's social network website, they agreed to

Myspace's Agreement and Privacy Policy, which constitute an enforceable contract.
71.

A covenant of good faith and fair dealing, which imposes upon each party to a

contract a duty of good faith and fair dealing in its performance, is implied in every contract,
including the Agreement that embodies the relationship between Myspace and its members.
72.

Good faith and fair dealing is an element imposed by common law or statute as an

element of every contract under the laws of every state. Under the covenant of good faith and
fair dealing, both parties to a contract impliedly promise not to violate the spirit of the bargain
and not to intentionally do anything to injure the other party's right to receive the benefits of the
contract.
73.

Plaintiffs reasonably relied upon Myspace to act in good faith both with regard to

the contract and in the methods and manner in which it carries out the contract terms. Bad faith
can violate the spirit of the Agreement and may be overt or may consist of inaction. Myspace's

21

inaction in failing to adequately notify Plaintiffs of the release of personal information to outside
advertisers and application developers evidences bad faith and ill motive.
74.

The contract is a form contract, the terms of which Plaintiffs are deemed to have

accepted once Plaintiffs and the Class signed up with Myspace. The contract purports to give
discretion to Myspace relating to Myspace's protection of members' privacy. Myspace is subject
to an obligation to exercise that discretion in good faith. The covenant of good faith and fair
dealing is breached when a party to a contract uses discretion conferred by the contract to act
dishonestly or to act outside of accepted commercial practices. Myspace breached its implied
covenant of good faith and fair dealing by exercising bad faith in using its discretionary rights to
deliberately, routinely, and systematically make Plaintiffs' personal information available to
third parties.
75.

Plaintiffs have performed all, or substantially all, of the obligations imposed on

them under the contract, whereas My space has acted in a manner as to evade the spirit of the
contract, in particular by deliberately, routinely, and systematically without notifying Plaintiffs
of its disclosure of their personal information to third-party advertisers. Such actions represent a
fundamental wrong that is clearly beyond the reasonable expectations of the parties. Myspace's
disclosure of such information to third party advertisers and tracking companies is not in
accordance with the reasonable expectations of the parties and evidences a dishonest purpose.
76.

Myspace's ill motive is further evidenced by its failure to obtain Plaintiffs'

consent in its data mining efforts while at the same time consciously and deliberately utilizing
data mining to automatically and without notice providing user information to third-party
advertisers and Internet tracking companies. Myspace profits from advertising revenues derived
from its data mining efforts from Plaintiffs and the Class.

22

77.

The obligation imposed by the implied covenant of good faith and fair dealing is

an obligation to refrain from opportunistic behavior. Myspace has breached the implied
covenant of good faith and fair dealing in the Agreement through its policies and practices as
alleged herein. Plaintiffs and the Class have sustained damages and seek a determination that the
policies and procedures ofMyspace are not consonant with Myspace's implied duties of good
faith and fair dealing.
SEVENTH CAUSE OF ACTION
(New York and California Promissory Estoppel)

78.

Plaintiffs hereby incorporate by reference the allegations contained in all of the

preceding paragraphs of this complaint.
79.

Plaintiffs and the Class submitted personally identifiable information to Myspace

in detrimental reliance upon Myspace's clear promise that Myspace would not share the
personally identifiable information with third parties without her consent and, as a consequence,
Plaintiffs and the Class suffered damages.
EIGHTH CAUSE OF ACTION
(Violation of California Business and Professions Code § 17200 et seq.
Unlawful, Unfair and Fraudulent Business Practices)

80.

Plaintiffs hereby incorporates by reference the allegations contained in all of the

preceding paragraphs ofthis complaint.
81.

Beginning at an exact date unknown to Plaintiffs, but within the Class Period, and

at all times mentioned herein, Defendant has engaged, and continues to engage, in unfair,
unlawful, and fraudulent trade practices in California by engaging in the unfair and illegal
business practices detailed above.
82.

Defendant knowingly and intentionally misled consumers by continuously and

falsely representing during the Class Period that it would not make personally identifiable

23

information available to third parties without the consent of Plaintiffs when in fact it secretly
provided such information to third parties as alleged herein.
83.

Defendant engaged in these unfair and fraudulent practices to increase its profits.

The business practices alleged above are unlawful under § 17200 et seq. because they violate §
17500 et seq., which forbids untrue and misleading advertising. These business practices also
are unlawful under the SCA, and the California Consumer Legal Remedies Act as discussed
herein.
84.

Defendant's representations regarding personally identifiable information were

important to Plaintiffs and likely to affect their decision to entrust Defendant with their valuable
personal information. Plaintiffs were injured by Defendant's unfair, unlawful and/or fraudulent
acts in that he was forced to relinquish, for free, valuable personal information. Had Plaintiffs
known that Defendant would share their personally identifiable information with third parties,
they would not have subscribed to Defendant's service.
85.

As a direct and proximate cause of Defendant's acts of unfair competition,

Plaintiff and members of the class have suffered, and continue to suffer, injury in fact and have
lost money and/or property as a result of such fraudulent, unfair and/or unlawful business
practices, in an amount that will be proven at trial, but which is in excess of the jurisdictional
minimum of this Court.
86.

The aforementioned practices that Defendant has used, and continues to use to its

significant gain, also constitute unlawful competition and provide an unlawful advantage over
Defendant's competitors, as well as injury to Plaintiffs.
87.

Plaintiffs seek full restitution and disgorgement of monies, as necessary and

according to proof, to restore to Plaintiffs the value of all personal information that Defendant

24

unlawfully converted by means of the unfair and/or fraudulent trade practices complained of
herein, plus interest thereon.
88.

Plaintiffs seek an injunction to prohibit Defendant from continuing to engage in

the unfair trade practices complained of herein. Cal. Bus. & Prof. Code§ 17203.
89.

Plaintiffs are further entitled to and does seek both a declaration that the above-

described trade practices are unfair, unlawful, and/or fraudulent, and injunctive relief restraining
Defendant from engaging in any of such deceptive, unfair, and/or unlawful trade practices in the
future. Such misconduct by Defendant, unless and until enjoined and restrained by order of this
Court, will continue to cause injury in fact to the general public and the loss of money and
property in that Defendant will continue to violate the law, unless specifically ordered to comply
with the same. This expectation of future violations will require current and future customers to
repeatedly and continuously seek legal redress in order to recoup monies paid to Defendant to
which Defendant is not entitled. Plaintiffs have no other adequate remedy at law to ensure future
compliance with the California Business & Professions Code alleged to have been violated
herein.
90.

As a direct and proximate result of such actions, Defendant enjoyed, and

continues to enjoy, significant financial gain in an amount that will be proven at trial, but which
is in excess of the jurisdictional minimum of this Court.
NINTH CAUSE OF ACTION
(Violation of California Business and Professions Code § 17500 et seq.
Misleading, Deceptive or Untrue Advertising)

91.

Plaintiffs hereby incorporate by reference the allegations contained in all of the

preceding paragraphs of this complaint.
92.

Plaintiffs assert this cause of action against Defendant for violations of California

Business and Professions Code § 17500 et seq. for misleading and deceptive advertising.

25

93.

At all material times, Defendant engaged in a scheme of offering its Myspace

service to Plaintiffs by way of, inter alia, commercial marketing and advertising, the World Wide
Web (Internet), product packaging and labeling, and other promotional materials. These
materials misrepresented and/or omitted the truth about the extent to which Defendant would
share valuable personal information with third parties. Defendant knew, or in the exercise of
reasonable care should have known, that these statements were deceptive, misleading, or untrue.
94.

Said advertisements and inducements were made within the State of California

and come within the definition of advertising as contained in Business and Professions Code §
17500 et seq. in that such promotional materials were intended as inducements to subscribe to
Myspace and are statements disseminated by Defendant to Plaintiffs and were intended to reach
Plaintiffs. Defendant knew, or in the exercise of reasonable care should have known, that these
statements were misleading and deceptive.
95.

In furtherance of said plan and scheme, Defendant has prepared and distributed

within the State of California via commercial marketing and advertising, the World Wide Web
(Internet), product packaging and labeling, and other promotional materials, statements that
misleadingly and deceptively represent the truth about personal information that Myspace
members entrust to Myspace.
96.

Consumers, including Plaintiffs, were among the intended targets of such

representations.
97.

The above acts of Defendant, in disseminating said misleading and deceptive

statements throughout the State of California to consumers, including Plaintiffs, were and are
likely to deceive reasonable consumers, including Plaintiffs, by obfuscating the truth about

26

Myspace's use of their personal information, all in violation of the "misleading prong" of
California Business and Professions Code § 17500.
98.

As a result of the above violations of the "misleading prong" of Business and

Professions Code § 17500 et seq., Defendant has been unjustly enriched at the expense of
Plaintiffs and the Class. Plaintiffs and the Members ofthe Class, pursuant to Business and
Professions Code§ 17535, are entitled to an order of this Court enjoining such future conduct on
the part of Defendant, and such other orders and judgments that may be necessary to disgorge
Defendant's ill-gotten gains and restore to any person in interest any money paid for Defendant's
services as a result of the wrongful conduct of Defendant.

TENTH CAUSE OF ACTION
(Violation of the California Consumer Legal Remedies ActCal. Civ. Code § 1750 et seq.- Injunctive Relief Only)
99.

Plaintiffs hereby incorporate by reference the allegations contained in all of the

preceding paragraphs of this complaint.
I 00.

This cause of action is brought pursuant to the California Consumers Legal

Remedies Act, Cal. Civ. Code § 1750 et seq. (the "CLRA"). This cause of action does not seek
monetary damages at this point, but is limited solely to injunctive relief.
101.

Defendant's actions, representations, and conduct have violated, and continue to

violate the CLRA, because they extend to transactions that are intended to result, or that have
resulted, in the sale or lease of goods or services to consumers.
I 02.

Each ofthe Plaintiffs is a "consumer" as that term is defined by the CLRA in

California Civil Code§ 1761(d).
I 03.

Myspace provided "services" to Plaintiffs within the meaning of California Civil

Code§ 1761(b).

27

I 04.

By engaging in the actions, misrepresentations, and misconduct set forth in this

Class Action Complaint, Defendant has violated, and continues to violate, § 1770(a)(5) of the
CLRA. Specifically, in violation of California Civil Code§ 1770(a)(5), Defendant's acts and
practices constitute unfair methods of competition and unfair or fraudulent acts or practices in
that they misrepresent that the service has particular uses, benefits, or quantities that it does not
have.
105.

By engaging in the actions, misrepresentations, and misconduct set forth in this

Class Action Complaint, Defendant has violated, and continues to violate,§ 1770(a)(7) of the
CLRA. Specifically, in violation of California Civil Code§ 1770(a)(7), Defendant's acts and
practices constitute unfair methods of competition and unfair or fraudulent acts or practices in
that they misrepresent that the service is of a particular standard, quality, or grade.
I 06.

By engaging in the actions, misrepresentations, and misconduct set forth in this

complaint, Defendant has violated, and continues to violate, § 1770(a)(9) of the CLRA.
Specifically, in violation of California Civil Code§ 1770(a)(9), Defendant's acts and practices
constitute unfair methods of competition and unfair or fraudulent acts or practices in that they
advertise services with intent not to sell them as advertised.
107.

By engaging in the actions, misrepresentations, and misconduct set forth in this

complaint, Defendant has violated, and continues to violate,§ 1770(a)(l6) of the CLRA.
Specifically, in violation of California Civil Code§ 1770(a)(l6), Defendant's acts and practices
constitute unfair methods of competition and unfair or fraudulent acts or practices in that they
represent that a subject of a transaction has been supplied in accordance with a previous
representation when they have not.

28

108.

Plaintiffs request that this Court enjoin Defendant from continuing to employ the

unlawful methods, acts, and practices alleged herein pursuant to California Civil Code §
1780(a)(2). If Defendant is not restrained from engaging in these types of practices in the future,
Plaintiffs and the Class will continue to suffer harm.
ELEVENTH CAUSE OF ACTION
(Violation of Cal. Civ. Code§§ 1572 & 1573)

109.

Plaintiffs hereby incorporate by reference the allegations contained in all of the

preceding paragraphs of this complaint.
110.

Cal. Civ. Code § 1572 provides in relevant part that actual fraud exists when a

party to a contract suppresses "that which is true, by one having knowledge or belief of the fact"
"with intent to deceive another party thereto, or to induce them to enter into the contract."
Ill.

Cal. Civ. Code§ 1573 provides in relevant part that constructive fraud exists "[i]n

any such act or omission as the law specifically declares to be fraudulent, without respect to
actual fraud."
112.

Defendants intentionally violated§ 1572 through their repeated and explicit

assertions, which they knew were false, that they would not share Plaintiffs' personally
identifiable information with third parties without their consent, as described herein. Defendant
further violated this section by suppressing knowledge of this fact with the intention of deceiving
Plaintiffs.
113.

Additionally, and/or alternatively, Defendants violated§ 1573 by breaching their

duty to protect users' personally identifiable information from third parties and gaining an
advantage in doing so, by misleading users to their prejudice, as described herein.
114.

Plaintiffs seek injunctive relief and damages including but not limited to

disgorgement of all proceeds Defendant obtained from its unlawful business practices.

29

TWELFTH CAUSE OF ACTION
(California Common Law Invasion of Privacy)

Plaintiffs hereby incorporate by reference the allegations contained in all ofthe

115.

preceding paragraphs of this complaint.
116.

Plaintiffs had a legally protected informational privacy interest in the confidential

and sensitive information that Myspace obtained from them and unlawfully disseminated.
117.

Plaintiffs had a legally protected autonomy privacy interest in making intimate

personal decisions regarding their use of the Internet without observation, intrusion or
interference.
118.

Plaintiffs reasonably expected that their confidential and sensitive information

and intimate personal decisions would be kept private.
119.

Defendant intentionally committed a "serious invasion of privacy" that would be

highly offensive to a reasonable person by making public Plaintiffs' personally identifying
information in conjunction with data tracking cookies.
120.

As a consequence, Plaintiffs were personally injured and suffered emotional

distress damages.
THIRTEENTH CAUSE OF ACTION
(ARTICLE I, SECTION 1 OF THE CALIFORNIA CONSTITUTION)

121.

Plaintiff Castro, on her own behalf and on behalf of all California residents who

signed up for MySpace during the Class Period ("California Subclass"), hereby incorporate by
reference the allegations contained in all of the preceding paragraphs of this complaint.
122.

The California constitution expressly grants California residents an inalienable

right to privacy.

30

123.

Plaintiff Castro and members of the California Subclass had a legally protected

informational privacy interest in the confidential and sensitive information that Myspace
obtained from them and unlawfully disseminated.
124.

Plaintiff Castro and members of the California Subclass had a legally protected

autonomy privacy interest in making intimate personal decisions regarding their use of the
internet without observation, intrusion or interference.
125.

Plaintiff Castro and members of the California Subclass reasonably expected that

their confidential and sensitive information and intimate personal decisions would be kept
private.
126.

Defendant intentionally committed a "serious invasion of privacy" by making

public plaintiff Castro's and other members of the California Subclass's personally identifying
information in conjunction with data tracking services.
127.

As a consequence, Plaintiff Castro and members of the California Subclass were

personally injured and suffered emotional distress damages.

REQUEST FOR RELIEF

WHEREFORE, Plaintiffs Linda Virtue and Lily Castro, on behalf of themselves and the
Class, requests the following relief:
A.

An order certifying that this action is properly brought and may be maintained as

a class action under Rule 23 of the Federal Rules of Civil Procedure, that Plaintiffs be appointed
as Class Representatives, and that Plaintiffs' counsel be appointed Class Counsel;
B.

An award of damages, except as to the CLRA claim as alleged above in the

Eleventh Cause of Action;

31

.-

C.

Restitution of all monies unjustly obtained or to be obtained from Plaintiffs and

members of the Class;
D.

Disgorgement of revenues obtained by Myspace as a result of the misconduct

alleged herein;
E.

Declaratory and injunctive relief;

F.

An award of reasonable attorneys' fees and costs; and

G.

Such other relief at law or equity as this court may deem just and proper.
DEMAND FOR JURY TRIAL

Plaintiffs hereby demand trial of their claims by jury to the extent authorized by law.
DATED:

April 13, 2011

Respectfully submitted,

[e-mail]
Sanford P. Dumain
[e-mail]
Charles Slidders
[e-mail]
One Pennsylvania Plaza, 49th Floor
New York, New York 10119
Telephone:
[phone]
Facsimile:
[phone]
Attorneys for Plaintiffs Linda Virtue and Lily
Castro

32

REESE RICHMAN LLP
Michael R. Reese
[e-mail]
Kim E. Richman
[e-mail]
875 Avenue of the Americas, 18th Floor
New York, New York 10001
Telephone: [phone]
Facsimile: [phone]
Attorneys for Plaintiffs Linda Virtue and Lily
Castro

[552909v2]

33