In re Facebook Internet Tracking Litig., Case No. 5:12-md-02314-EJD

CourtUnited States District Courts. 9th Circuit. United States District Courts. 9th Circuit. Northern District of California
Citation140 F.Supp.3d 922
Docket NumberCase No. 5:12-md-02314-EJD
Parties In re Facebook Internet Tracking Litigation
Decision Date23 October 2015

140 F.Supp.3d 922

In re Facebook Internet Tracking Litigation

Case No. 5:12-md-02314-EJD

United States District Court, N.D. California, San Jose Division.

Signed October 23, 2015

140 F.Supp.3d 925


EDWARD J. DAVILA, United States District Judge

Facebook, Inc. ("Facebook") operates an online "social network" that permits its members to interact with each other through a website— Id . at ¶ 9. This consolidated, multi-district lawsuit against the social network, brought by and on behalf of individuals with active Facebook accounts from May 27, 2010, through September 26, 2011 (the "Class Period"), seeks "in excess of $15 billion in damages and injunctive relief" and "arises from Facebook's knowing interception of users' internet communications and activity after logging out of their Facebook accounts." See Corrected First Am. Consolidated Class Action Compl. ("CCAC"), Docket Item No. 35, at ¶ 1. Plaintiffs Perrin Davis, Cynthia Quinn, Brian Lentz, and Matthew Vickery (collectively, "Plaintiffs"), each of whom had an active Facebook account during the entire Class Period, allege that Facebook tracked and stored their post-logout internet usage using small text files—or "cookies"—which Facebook had embedded in their computers' browsers. Id . at ¶¶ 103-106.

Federal jurisdiction arises pursuant to 28 U.S.C. §§ 1331 and 1332(d). Presently

140 F.Supp.3d 926

before the court is Facebook's Motion to Dismiss pursuant to Federal Rules of Civil Procedure 12(b)(1) and 12(b)(6). See Docket Item No. 44. Plaintiffs oppose the motion. Having carefully considered the parties' arguments, the court has concluded that Facebook's arguments are meritorious. Accordingly, the motion will be granted for the reasons explained below.


A. "Cookies"

As noted, a "cookie" is a small text file that a server creates and sends to a browser, which then stores the file in a particular directory on an individual's computer. Id . at ¶ 38. A cookie contains a limited amount of information which can relate to the browser or to a specific individual. Id . at ¶¶ 38, 39.

When an individual using a web browser contacts a server—often represented by a particular webpage or internet address—the browser software checks to see if that server has previously set any cookies on the individual's computer. Id . at ¶ 39. If the server recognizes any valid, unexpired cookies, then the computer "sends" those cookies to the server. Id . at ¶ 39. After examining the information stored in the cookie, the server knows if it is interacting with a computer with which it has interacted before. Id . at ¶ 41. Since servers create database records that correspond to individuals, sessions and browsers, the server can locate the database record that corresponds to the individual, session or browser using the information from the cookie. Id .

B. Facebook and its Use of "Cookies"

Plaintiffs allege that Facebook is the brainchild of the company's founder, Mark Zuckerberg, who wrote the first version of "The Facebook" in his Harvard University dorm room and later launched Facebook as a company in 2004. Id . at ¶ 10. Since then, Facebook has become the largest social networking site in the world with other 800 million users world-wide and over 150 million users in the United States. Id . at ¶ 11. According to Plaintiffs, the key to this success "was to convince people to create unique, individualized profiles with such personal information as employment history and political and religious affiliations, which then could be shared among their own network of family and friends." Id . at ¶ 10. Facebook uses this repository of personal data to connect advertisers with its users. Id . at ¶ 12. Historically, 90% of Facebook's revenue is attributable to third-party advertising and "Facebook is driven to continue to find new and creative ways to leverage its access to users' data in order to sustain its phenomenal growth." Id . at ¶ 13.

Facebook does not charge a fee for membership. Id . at ¶ 14. However, Plaintiffs contend that Facebook membership is not free. Id . at ¶ 14. Specifically, they allege that through the Statement of Rights and Responsibilities and other documents and policies governing use of the website, "Facebook conditions its membership upon users providing sensitive and personal information... including name, birth date, gender and email address," and requires that users accept numerous Facebook cookies on their computers. Id . at ¶¶ 14, 16. These cookies allow Facebook to intercept a user's electronic communications and track internet browsing history. Id .

Facebook cookies come in two flavors. The first is a "session cookie," which is set when a user logs into Facebook. Id . at ¶ 15. It is directly associated with a user's Facebook account and contains unique information, such as the user's Facebook identification. Id . Session cookies are supposed

140 F.Supp.3d 927

to be deleted when the user logs out of Facebook. Id .

The second type is a "tracking cookie," which is also known as a persistent cookie. Id . This cookie sends data back to Facebook any time an individual makes a request of, such as when an individual accesses a page with the Facebook "like" button. Id . The tracking takes place, however, regardless of whether the individual actually interacts with the "like" button; "[i]n effect, Facebook is getting details of where you go on the Internet." Id . Tracking cookies do not expire when a user logs out of Facebook. Id . In fact, Facebook sets these cookies on an individual's computer whether or not they have a Facebook account. Id .

When a Facebook user leaves the Facebook webpage without logging out and then browses the web, both tracking cookies (such as a "datr" cookie) and session cookies (such as a "c_user" cookie) are left to operate on the computer. Id . Under those circumstances, Facebook is notified through the datr cookie whenever the user loads a page with embedded content from Facebook, and also can easily connect that data back to the user's individual Facebook profile through the c_user cookie. Id .

For example, if a logged-in Facebook user accesses the news website through the browser on his or her computer, the CNN server responds with the file for the CNN homepage, which also contains embedded code from Facebook. Id . at ¶¶ 59, 60. The user's browser, triggered by the Facebook code, sends a request to the Facebook server to display certain content on the CNN webpage, such as the Facebook "like" button. Id . at ¶ 61. This request also includes information contained in the user's datr and c_user cookies as well as the specific details of the webpage that the user accessed. Id . at ¶ 63. When Facebook receives this information, the Facebook server adds it to its database records for the browser and the user. Id . at ¶ 67. The Facebook server then responds by sending the requested content to the user's browser. Id . at ¶ 70.

C. Facebook Tracks Logged-Out Users

Aside from tracking logged-in users, Plaintiffs allege that Facebook has also intentionally tracked users' browsing activity after they logged-out of the Facebook website despite contrary representations in the social network's governing materials. Id . at ¶ 17. Facebook is able to engage in such tracking though the persistent datr cookie its server embeds after the user accesses Id . at ¶ 73.

Again using the CNN website as an example, if a user logs out of Facebook and then directs his or her computer's browser to, the CNN server responds in much the same way as if the user was still logged-in to Facebook: by sending to the browser a file with the contents of the CNN website which contains a piece of Facebook code pertaining to the "like" button. Id . at ¶¶ 72-75. The browser, triggered by the Facebook code, sends a request to the Facebook server to display the "like" button on the CNN webpage. Id . at ¶ 77. This request also includes any personally identifiable information contained in cookies associated with the browser, such as the datr cookie. Id . at ¶ 78. The Facebook server then creates a database log entry of the request, stores the cookie information it received, and responds by sending the content requested for display on the CNN website. Id . at ¶¶ 78-82.

Plaintiffs allege the information Facebook receives through tracking logged-out users is specific enough to identify the user without the need for an additional Facebook cookie containing the user's identification. Id . at ¶ 83. Indeed, they

140 F.Supp.3d 928

allege that "[f]rom the first time a Facebook user logs into Facebook and the datr tracking cookie is set on his machine, all of that user's browsing to Facebook partner sites using that browser is linked by Facebook back to that user because the datr tracking cookie contains a unique number, which is also unique to that particular user's browser and his specific computer or mobile device, that indexes into the Facebook database which tracks users and browser...

To continue reading

Request your trial
9 cases
  • In re Facebook, Inc., MDL No. 2843
    • United States
    • United States District Courts. 9th Circuit. United States District Courts. 9th Circuit. Northern District of California
    • September 9, 2019
    ...theory is therefore purely hypothetical and does not give rise to standing. See In re Facebook Internet Tracking Litigation , 140 F. Supp. 3d 922, 931-32 (N.D. Cal. 2015) ; Opperman v. Path, Inc. , 87 F. Supp. 3d 1018, 1057 (N.D. Cal. 2014) ; Yunker v. Pandora Media, Inc. , 2013 WL 1282980,......
  • In re Google Assistant Privacy Litig., Case No. 19-cv-04286-BLF
    • United States
    • United States District Courts. 9th Circuit. United States District Courts. 9th Circuit. Northern District of California
    • July 1, 2021
    ...harm or loss that is attributable to [Google's] alleged conduct.’ " Mot. at 20-21 (quoting In re Facebook Internet Tracking Litig. , 140 F.Supp.3d 922, 931 (N.D. Cal. 2015)).The Court finds that Plaintiffs’ theory of economic loss here is "purely hypothetical." In re Facebook, Inc., Consume......
  • Sekura v. Krishna Schaumburg Tan, Inc., 1-18-0175
    • United States
    • United States Appellate Court of Illinois
    • September 28, 2018
    ...v. AMC Network Entertainment L.L.C. , 98 F.Supp.3d 662 (S.D.N.Y. 2015) ; see also In re Facebook Internet Tracking Litig. , 140 F.Supp.3d 922 (N.D. Ill. 2015) (applying similar reasoning and allowing suit under other federal privacy laws without dangers)."¶ 17 The trial court observed:"Furt......
  • CS Wang & Assoc. v. Wells Fargo Bank, N.A., 16 C 11223
    • United States
    • United States District Courts. 7th Circuit. United States District Court (Northern District of Illinois)
    • March 29, 2018
    ...of privacy under CIPA, see Vera v. O'Keefe , 791 F.Supp.2d 959, 967 (S.D. Cal. 2011) ; In re Facebook Internet Tracking Litig. , 140 F.Supp.3d 922, 933–34 (N.D. Cal. 2015), or, more commonly, failed to discuss it at all.The other cases cited by Ironwood do not establish a bright-line rule f......
  • Request a trial to view additional results
3 books & journal articles
    • United States
    • Journal of Law, Technology and the Internet No. 12, January 2021
    • January 1, 2021
    ...STATUS, AND FIDUCIARY LAW 326-27 (Paul B. Miller & Andrew S. Gold, eds. 2016). (693) In re Facebook Internet Tracking Litigation, 140 F. Supp. 3d 922, 930 (N. D. Cal. (694) Danvers Motor Co. Inc. v. Ford Motor Co., 432 F. 3d 286, 294 (3rd Cir. 2005). (695) In re Google Inc. Privacy Poli......
    • United States
    • Michigan Law Review Vol. 121 No. 5, March 2023
    • March 1, 2023
    ...was repeatedly dismissed for lack of standing and for failure to state a claim, see, e.g., In re Facebook Internet Tracking Litig., 140 F. Supp. 3d 922 (N.D. Cal. 2015) (dismissing earlier claim), ultimately resulted in a historic $90 million settlement agreement, see Order Granting Motion ......
    • United States
    • Journal of Law, Technology and the Internet No. 12, January 2021
    • January 1, 2021
    ...31, 2017), (925) See In re Facebook Internet Tracking Litigation, 140 F. Supp. 3d 922, 928 (N.D. Cal. (926) Zeynep Tufekci, Mark Zuckerberg, Let Me Pay for Facebook, N.Y. TIMES (June 4, 2015),

VLEX uses login cookies to provide you with a better browsing experience. If you click on 'Accept' or continue browsing this site we consider that you accept our cookie policy. ACCEPT