In re Facebook, Inc.

• Decision Date: 09 September 2019
• Docket Number: MDL No. 2843,Case No. 18-md-02843-VC
• Court: U.S. District Court — Northern District of California
• Parties: IN RE: FACEBOOK, INC., CONSUMER PRIVACY USER PROFILE LITIGATION This document relates to: All Actions

402 F.Supp.3d 767

IN RE: FACEBOOK, INC., CONSUMER PRIVACY USER PROFILE LITIGATION This document relates to: All Actions

MDL No. 2843

Case No. 18-md-02843-VC

United States District Court, N.D. California.

Signed September 9, 2019

PRETRIAL ORDER NO. 20: GRANTING IN PART AND DENYING IN PART MOTION TO DISMISS FIRST AMENDED COMPLAINT

VINCE CHHABRIA, United States District Judge

This lawsuit, which stems from the Cambridge Analytica scandal, is about Facebook's practice of sharing its users' personal information with third parties. The plaintiffs are current and former Facebook users who believe that their information was compromised by the company. Their principal allegations are that Facebook: (i) made sensitive user information available to countless companies and individuals without the consent of the users; and (ii) failed to prevent those same companies and individuals from selling or otherwise misusing the information. The plaintiffs do not merely allege that Facebook shared what we often describe as "data" – basic facts such as gender, age, address, and the like. They allege that Facebook shared far more substantive and revealing content that users intended only for a limited audience, such as their photographs, videos they made, videos they watched, their religious and political views, their relationship information, and the actual words contained in their messages.

Facebook has filed a motion to dismiss the lawsuit. Although the company makes many different arguments, there are three main ones. First, Facebook argues that people have no legitimate privacy interest in any information they make available to their friends on social media. This means, according to Facebook, that if people use social media to communicate sensitive information with a limited number of friends, they have no right to complain of a privacy violation if the social media company turns around and shares that information with a virtually unlimited audience. As explained in Section II of this ruling, Facebook's argument could not be more wrong. When you share sensitive information with a limited audience (especially when you've made clear that you intend your audience to be limited), you retain privacy rights and can sue someone for violating them.

Second, Facebook argues that even if its users had a privacy interest in the information they made available only to friends, there is no standing to sue in federal court because there were no tangible negative consequences from the dissemination of this information. That too is wrong. As explained in Section III, the law has long recognized that a privacy invasion is itself the kind of injury that can be redressed in federal court, even if the invasion does not lead to some secondary economic injury like identity theft.

Facebook's third main argument is that even if users retained a privacy interest in the information that was disclosed, and even if a "bare" privacy invasion confers standing to sue in federal court, this lawsuit must be dismissed because Facebook users consented, in fine print, to the wide dissemination of their sensitive information. As discussed in Section IV, this question is more difficult than the first two. California law requires the Court to assume as a legal matter (even if it's not true as a factual matter) that users reviewed, understood, and agreed to all of Facebook's contractual terms when they signed up for their accounts. These terms included a description of at least some of Facebook's information-sharing practices, for at least a portion of the time period covered by this lawsuit. In particular, from roughly 2009 to 2015, Facebook disclosed its practice of allowing app developers to obtain, through a user's Facebook friends, any information about the user that the friends had access to.

That single disclosure, however, is relatively inconsequential for this motion to dismiss. The complaint adequately alleges that users who established their Facebook accounts prior to roughly 2009 never consented to this practice. Plaintiffs in this category may pursue claims based on information-sharing with app developers. Moreover, the complaint adequately alleges that no users ever consented to Facebook's other information-sharing practices – specifically, sharing with certain "whitelisted apps" starting in 2015, and sharing with certain "business partners" during much of the relevant time period. Finally, the complaint adequately alleges that users never consented to Facebook's widespread practice of allowing companies to sell and otherwise misuse sensitive user information, as opposed to restricting the use of this information as Facebook promised it would. Therefore, even though Facebook's arguments regarding user consent have some legal force and will somewhat limit the scope of the lawsuit, they cannot defeat the lawsuit entirely, at least at the pleading stage.

Accordingly, as set forth in Section V (which discusses the specific legal claims asserted by the plaintiffs), although Facebook's motion to dismiss will be granted for a few of the claims, most claims survive.

I. BACKGROUND

Cambridge Analytica, a British political consulting firm, used personal information from millions of Facebook accounts to send targeted political messages during the 2016 presidential campaign. The firm obtained this information from Aleksandr Kogan, a researcher who had acquired it through his app, which Facebook had allowed him to deploy on its platform. The Cambridge Analytica incident began receiving significant press coverage in 2018, which in turn generated increased scrutiny of Facebook's information-sharing practices. In the months that followed, reports emerged suggesting that the ability of people like Kogan and entities like Cambridge Analytica to obtain sensitive Facebook user information was the norm rather than the exception. Broadly speaking, this case is about whether Facebook acted unlawfully in making user information widely available to third parties. It's also about whether Facebook acted unlawfully in failing to do anything meaningful to prevent third parties from misusing the information they obtained.

Following the Cambridge Analytica outcry, dozens of lawsuits were filed against Facebook in various courts around the country. The lawsuits were mostly in federal court, and they were mostly proposed class actions by individual Facebook users who contended that Facebook disseminated their sensitive personal information to Kogan without their consent and failed to prevent him from transferring it to Cambridge Analytica. One of the first of these lawsuits was filed in the Northern District of California and randomly assigned to this Court.

When multiple, similar federal lawsuits are filed around the country, there is a process within the federal judiciary for handling them. Congress has created the Judicial Panel on Multidistrict Litigation, which considers whether to transfer similar cases to a single federal judge for pretrial proceedings. The purpose is to promote the orderly adjudication of multiple similar cases, avoiding conflicting rulings from different judges and alleviating the strain on the system that would result from many judges adjudicating the same complicated pretrial issues. The multidistrict litigation process contemplates that once the assigned judge adjudicates those issues, the individual cases are sent back for trial to the courts where they originated. In these cases against Facebook, the panel concluded that assignment to a single judge was warranted, and assigned the lawsuits to this Court.

This Court subsequently appointed two attorneys to serve as lead plaintiffs' counsel. Thereafter, lead counsel, representing roughly three dozen individual Facebook users, filed a consolidated class action complaint. The plaintiffs propose to represent a class consisting of all Facebook users in the United States and the United Kingdom whose personal information was improperly disseminated and/or inadequately protected by Facebook from 2007 to the present. The practical effect of the proposed class action is that this one consolidated complaint could potentially resolve all claims by private parties against Facebook arising from the company's practices of disseminating user information during this period. In other words, this proceeding has effectively become one large proposed class action, as opposed to a group of several dozen separate lawsuits.¹

Facebook filed a motion to dismiss, and a lengthy hearing took place during which the parties and the Court discussed many potential deficiencies in the complaint. The hearing ended with the Court giving the plaintiffs permission to file an amended complaint to address any such deficiencies.

The amended complaint, which is the subject of the current motion to dismiss, runs 414 pages and includes 1,442 paragraphs. It appears to include all the claims that were asserted in the cases that were transferred here by the multidistrict litigation panel, and more. But for manageability purposes, the complaint is divided into "prioritized claims" and "nonprioritized claims." The idea is that the prioritized claims (which presumably reflect lead counsel's judgment about their relative strength or importance) will be adjudicated first, and the nonprioritized claims should be stayed and addressed later if necessary. The complaint names multiple defendants (for example, CEO Mark Zuckerberg, in addition to Facebook itself), but again divides those defendants into the "prioritized" and "non-prioritized" categories. Facebook is the only prioritized defendant.

It's worth noting that the case has expanded in scope. While the initial lawsuits focused largely on Facebook's conduct that was the subject of the Cambridge Analytica scandal, the case now includes allegations stemming from the subsequent revelations about Facebook's wider information-sharing practices. Moreover, although the complaint purports to assert 12 prioritized "claims,"...