In re Facebook Internet Tracking Litig., Case No. 5:12-md-02314-EJD

• Decision Date: 23 October 2015
• Docket Number: Case No. 5:12-md-02314-EJD
• Citation: 140 F.Supp.3d 922
• Parties: In re Facebook Internet Tracking Litigation
• Court: U.S. District Court — Northern District of California

140 F.Supp.3d 922

In re Facebook Internet Tracking Litigation

Case No. 5:12-md-02314-EJD

United States District Court, N.D. California, San Jose Division.

Signed October 23, 2015

ORDER GRANTING DEFENDANT'S MOTION TO DISMISS

EDWARD J. DAVILA

, United States District Judge

Facebook, Inc. ("Facebook") operates an online "social network" that permits its members to interact with each other through a website—www.facebook.com. Id . at ¶ 9. This consolidated, multi-district lawsuit against the social network, brought by and on behalf of individuals with active Facebook accounts from May 27, 2010, through September 26, 2011 (the "Class Period"), seeks "in excess of $15 billion in damages and injunctive relief" and "arises from Facebook's knowing interception of users' internet communications and activity after logging out of their Facebook accounts." See Corrected First Am. Consolidated Class Action Compl. ("CCAC"), Docket Item No. 35, at ¶ 1. Plaintiffs Perrin Davis, Cynthia Quinn, Brian Lentz, and Matthew Vickery (collectively, "Plaintiffs"), each of whom had an active Facebook account during the entire Class Period, allege that Facebook tracked and stored their post-logout internet usage using small text files—or "cookies"—which Facebook had embedded in their computers' browsers. Id . at ¶¶ 103-106.

Federal jurisdiction arises pursuant to 28 U.S.C. §§ 1331

and 1332(d). Presently before the court is Facebook's Motion to Dismiss pursuant to Federal Rules of Civil Procedure 12(b)(1) and 12(b)(6)

. See Docket Item No. 44. Plaintiffs oppose the motion. Having carefully considered the parties' arguments, the court has concluded that Facebook's arguments are meritorious. Accordingly, the motion will be granted for the reasons explained below.

I. BACKGROUND

A. "Cookies"

As noted, a "cookie" is a small text file that a server creates and sends to a browser, which then stores the file in a particular directory on an individual's computer. Id . at ¶ 38. A cookie contains a limited amount of information which can relate to the browser or to a specific individual. Id . at ¶¶ 38, 39.

When an individual using a web browser contacts a server—often represented by a particular webpage or internet address—the browser software checks to see if that server has previously set any cookies on the individual's computer. Id . at ¶ 39. If the server recognizes any valid, unexpired cookies, then the computer "sends" those cookies to the server. Id . at ¶ 39. After examining the information stored in the cookie, the server knows if it is interacting with a computer with which it has interacted before. Id . at ¶ 41. Since servers create database records that correspond to individuals, sessions and browsers, the server can locate the database record that corresponds to the individual, session or browser using the information from the cookie. Id .

B. Facebook and its Use of "Cookies"

Plaintiffs allege that Facebook is the brainchild of the company's founder, Mark Zuckerberg, who wrote the first version of "The Facebook" in his Harvard University dorm room and later launched Facebook as a company in 2004. Id . at ¶ 10. Since then, Facebook has become the largest social networking site in the world with other 800 million users world-wide and over 150 million users in the United States. Id . at ¶ 11. According to Plaintiffs, the key to this success "was to convince people to create unique, individualized profiles with such personal information as employment history and political and religious affiliations, which then could be shared among their own network of family and friends." Id . at ¶ 10. Facebook uses this repository of personal data to connect advertisers with its users. Id . at ¶ 12. Historically, 90% of Facebook's revenue is attributable to third-party advertising and "Facebook is driven to continue to find new and creative ways to leverage its access to users' data in order to sustain its phenomenal growth." Id . at ¶ 13.

Facebook does not charge a fee for membership. Id . at ¶ 14. However, Plaintiffs contend that Facebook membership is not free. Id . at ¶ 14. Specifically, they allege that through the Statement of Rights and Responsibilities and other documents and policies governing use of the website, "Facebook conditions its membership upon users providing sensitive and personal information... including name, birth date, gender and email address," and requires that users accept numerous Facebook cookies on their computers. Id . at ¶¶ 14, 16. These cookies allow Facebook to intercept a user's electronic communications and track internet browsing history. Id .

Facebook cookies come in two flavors. The first is a "session cookie," which is set when a user logs into Facebook. Id . at ¶ 15. It is directly associated with a user's Facebook account and contains unique information, such as the user's Facebook identification. Id . Session cookies are supposed to be deleted when the user logs out of Facebook. Id .

The second type is a "tracking cookie," which is also known as a persistent cookie. Id . This cookie sends data back to Facebook any time an individual makes a request of www.facebook.com, such as when an individual accesses a page with the Facebook "like" button. Id . The tracking takes place, however, regardless of whether the individual actually interacts with the "like" button; "[i]n effect, Facebook is getting details of where you go on the Internet." Id . Tracking cookies do not expire when a user logs out of Facebook. Id . In fact, Facebook sets these cookies on an individual's computer whether or not they have a Facebook account. Id .

When a Facebook user leaves the Facebook webpage without logging out and then browses the web, both tracking cookies (such as a "datr" cookie) and session cookies (such as a "c_user" cookie) are left to operate on the computer. Id . Under those circumstances, Facebook is notified through the datr cookie whenever the user loads a page with embedded content from Facebook, and also can easily connect that data back to the user's individual Facebook profile through the c_user cookie. Id .

For example, if a logged-in Facebook user accesses the news website www.cnn.com through the browser on his or her computer, the CNN server responds with the file for the CNN homepage, which also contains embedded code from Facebook. Id . at ¶¶ 59, 60. The user's browser, triggered by the Facebook code, sends a request to the Facebook server to display certain content on the CNN webpage, such as the Facebook "like" button. Id . at ¶ 61. This request also includes information contained in the user's datr and c_user cookies as well as the specific details of the webpage that the user accessed. Id . at ¶ 63. When Facebook receives this information, the Facebook server adds it to its database records for the browser and the user. Id . at ¶ 67. The Facebook server then responds by sending the requested content to the user's browser. Id . at ¶ 70.

C. Facebook Tracks Logged-Out Users

Aside from tracking logged-in users, Plaintiffs allege that Facebook has also intentionally tracked users' browsing activity after they logged-out of the Facebook website despite contrary representations in the social network's governing materials. Id . at ¶ 17. Facebook is able to engage in such tracking though the persistent datr cookie its server embeds after the user accesses www.facebook.com. Id . at ¶ 73.

Again using the CNN website as an example, if a user logs out of Facebook and then directs his or her computer's browser to www.cnn.com, the CNN server responds in much the same way as if the user was still logged-in to Facebook: by sending to the browser a file with the contents of the CNN website which contains a piece of Facebook code pertaining to the "like" button. Id . at ¶¶ 72-75. The browser, triggered by the Facebook code, sends a request to the Facebook server to display the "like" button on the CNN webpage. Id . at ¶ 77. This request also includes any personally identifiable information contained in cookies associated with the browser, such as the datr cookie. Id . at ¶ 78. The Facebook server then creates a database log entry of the request, stores the cookie information it received, and responds by sending the content requested for display on the CNN website. Id . at ¶¶ 78-82.

Plaintiffs allege the information Facebook receives through tracking logged-out users is specific enough to identify the user without the need for an additional Facebook cookie containing the user's identification. Id . at ¶ 83. Indeed, they allege that "[f]rom the first time a Facebook user logs into Facebook and the datr tracking cookie is set on his machine, all of that user's browsing to Facebook partner sites using that browser is linked by Facebook back to that user because the datr tracking cookie contains a unique number, which is also unique to that particular user's browser and his specific computer or mobile device, that indexes into the Facebook database which tracks users and browser sessions both on computers and mobile devices such as Android cell phones, iPhones, iPads, and the iPod Touch." Id . Furthermore, Plaintiffs believe that Facebook implemented a P3P "compact policy"¹ that circumvented privacy settings on Microsoft's Internet Explorer ("IE") browser to allow Facebook's cookies, thereby ensuring that IE would transmit information from Facebook cookies back to the Facebook server when users visited affiliated non-Facebook websites. Id . at ¶¶ 101, 102.

Plaintiffs contend that the personal information Facebook receives from its users, including users' browsing history, has "massive economic value" and that a market exists for such information. Id . at ¶¶ 112, 122-124. They point out that "internet giant" Google, Inc. conducts a panel called "Google Screenwise Trends," the purpose of which is "to learn more about how everyday people use the Internet." Id . at ¶ 118. Through this program, internet users consent to share with Google the websites they...