Trial News

In a multidistrict litigation (MDL) involving Facebook users who allege the company compromised their personal information, the judge has denied most of the social media giant’s motion to dismiss. A victory for consumers, the decision allows the majority of privacy claims under California and federal law to proceed. (In re Facebook, Inc., Consumer Privacy User Profile Litig., 2019 WL 4261048 (N.D. Cal. Sept. 9, 2019).)

During the 2016 presidential campaign, the consulting firm Cambridge Analytica used personal information gathered from millions of Facebook users to create targeted political messages. In 2018, this incident—which occurred without Facebook users’ knowledge—began receiving widespread media attention. After learning that Facebook had shared their information without their consent, numerous Facebook users sued the company. Suits were consolidated into an MDL assigned to Judge Vince Chhabria in the Northern District of California.

The amended complaint, which covers the dissemination of information to Cambridge Analytica and other third parties, describes four ways that Facebook allegedly violated users’ privacy: giving app developers access to sensitive user information, giving certain “preferred” apps access to user information, sharing sensitive user information with business partners, and failing to restrict the use of sensitive information released to third parties.

Facebook moved to dismiss all claims. Before addressing its arguments, however, the judge first discussed Facebook’s position regarding users’ privacy expectations. Facebook argued that users who share information with friends on social media have relinquished privacy interests; as a result, Facebook claimed, users do not need to consent before their social media information can be shared with third parties. The judge rejected this argument, which it characterized as “so wrong.” Sharing information with social media friends “does not categorically eliminate [users’] privacy interest in that information, and the plaintiffs’ claims in this lawsuit must be analyzed against that backdrop,” Chhabria wrote.

The court then turned to two “global issues” Facebook raised: standing and user consent. First, the court affirmed that the plaintiffs have standing and had suffered a concrete and particularized injury, as required under Spokeo, Inc. v. Robins (136 S. Ct. 1540 (2016)). The plaintiffs’ allegations that their sensitive information and private communications were disseminated to third parties in violation of their privacy were sufficient to confer standing. An injury does not need to be “tangible” to be cognizable, and the Ninth Circuit has “repeatedly explained that intangible privacy injuries can be redressed in the federal courts.”

Next, the court addressed whether the plaintiffs had agreed that Facebook could disseminate their “friends only” information by opening Facebook accounts and clicking through user agreements. Although Facebook framed this as a standing issue, the court determined that whether users consented to these practices is a separate inquiry governed by California contract law. The court reviewed the language in Facebook’s 2012 user agreements, which it identified as an example of what most plaintiffs had agreed to when joining Facebook.

Although the agreements included language disclosing the first category of alleged misconduct—sharing information with app developers—the court held the complaint plausibly alleged that not all plaintiffs had consented to this because the language in question was added after 2009. For the other three categories—sharing with preferred apps, sharing with business partners, and failing to prevent third-party misuse of information—the court found that the complaint plausibly alleged that none of the plaintiffs had consented. As further support, Chhabria noted that Facebook had not even attempted to argue that the agreements disclosed that user information might be shared with preferred apps or business partners.

The court dismissed only two of the plaintiffs' individual claims in full—the ones brought under California’s common law right of publicity and the state’s Unfair Competition Law. The remaining state and federal claims survived, at least in part, including, among others, privacy-based torts asserted under California law (for public disclosure of private facts, intrusion into private affairs, and violation of the constitutional right to privacy) and a claim under the federal Video Privacy Protection Act, which prohibits the knowing disclosure of “personally identifiable information” by a video tape service provider.

In a joint statement, Oakland, Calif., attorney Lesley Weaver and Seattle attorney Derek Loeser, who represent the plaintiffs, said they were “pleased that the district court allowed this important litigation to proceed and especially gratified that the court is respecting Facebook users’ right to privacy. We look forward to the discovery process that will prove our clients’ claims.”

Rochester, N.Y., attorney Hadley Matarrazo, who handles consumer protection cases, called the decision a positive one for consumers. “It sends an important message that individuals whose privacy rights are violated are entitled to their day in court. Social media companies will have to think carefully before making sensitive user information widely available to third parties, especially in situations when they have no control over what third parties do with the information.”