Case4:13-cv-05996-PJH Document1 Filed12/30/13 Page1 of 36

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17

Michael W. Sobol (State Bar No. 194857) [email protected] Melissa Gardner (State Bar No. 289096) [email protected] LIEFF CABRASER HEIMANN & BERNSTEIN, LLP 275 Battery Street, 29th Floor San Francisco, CA 94111-3339 Telephone: 415.956.1000 Facsimile: 415.956.1008 Rachel Geman [email protected] Nicholas Diamand [email protected] LIEFF CABRASER HEIMANN & BERNSTEIN, LLP 250 Hudson Street, 8th Floor New York, NY 10013-1413 Telephone: 212.355.9500 Facsimile: 212.355.9592 Hank Bates (State Bar No. 167688) [email protected] Allen Carney [email protected] David Slade [email protected] CARNEY BATES & PULLIAM, PLLC 11311 Arcade Drive Little Rock, AR 72212 Telephone: 501.312.8500 Facsimile: 501.312.8505 Attorneys for Plaintiffs

18 UNITED STATES DISTRICT COURT 19 NORTHERN DISTRICT OF CALIFORNIA 20 21 22 23 Plaintiffs, 24 v. 25 FACEBOOK, INC., 26 Defendant. 27 28
CLASS ACTION COMPLAINT 1147096.1

MATTHEW CAMPBELL and MICHAEL HURLEY, on behalf of themselves and all others similarly situated,

Case No. ________ CLASS ACTION COMPLAINT

Case4:13-cv-05996-PJH Document1 Filed12/30/13 Page2 of 36

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 I. INTRODUCTION 1.

CLASS ACTION COMPLAINT

The right of privacy is a personal and fundamental right in California 1 and the

United States. 2 An individuals privacy is directly implicated by the collection, use, and dissemination of personal information. Defendant Facebook, Inc. (Facebook or the Company) has systematically violated consumers privacy by reading its users personal, private Facebook messages without their consent. 2. Facebook is a social-networking site that boasts more than one billion users

worldwide, making it the largest online social network in the world. 3. Across the various services it offers, Facebook takes pains to promise a stark

distinction in the types of communications it facilitates. Users may choose to communicate publicly via individual Facebook pages, or privately via personal messages and chats. 3 4. Specifically, Facebook describes communication options [d]epending on whom

youd like to share with. The options range from the broadest possible audience (a post which the public may see, including via searches on the internet), to posts viewable by small groups of friends, to Facebook messages shared privately with a single individual. 4 Facebook touts the privacy of its messaging function as unprecedented in terms of user control and the prevention of unwanted contact. 5

CAL. CONST., Art. I, 1, adopted as ballot measure in 1972 (All people are by nature free and independent and have inalienable rights. Among these are enjoying and defending life and liberty, acquiring, possessing, and protecting property, and pursuing and obtaining safety, happiness, and privacy.). See also Am. Acad. of Pediatrics v. Lungren, 16 Cal. 4th 307, 326 (1997) ([T]he scope and application of the state constitutional right of privacy is broader and more protective of privacy than the federal constitutional right of privacy as interpreted by the federal courts.). 2 Dept of Justice v. Reporters Comm. for Freedom of the Press, 489 U.S. 749, 763 (1989) (both the common law and the literal understandings of privacy encompass the individuals control of information concerning his or her person); Whalen v. Roe, 429 U.S. 589, 605 (1977). 3 The distinction between messages and chats on Facebook is one of timing: chats happen in real-time and often give the appearance of conversation, whereas messages act more like email. 4 Help Center: Get Started on Facebook: How to Post & Share, Facebook, https://www.facebook.com/help/333140160100643/. 5 Joel Seligstein, See the Messages that Matter, Facebook, https://www.facebook.com/notes/facebook/see-the-messages-that-matter/452288242130.
1147096.1

-1-

CLASS ACTION COMPLAINT

Case4:13-cv-05996-PJH Document1 Filed12/30/13 Page3 of 36

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28
6

5.

Contrary to its representations, private Facebook messages are systematically

intercepted by the Company in an effort to learn the contents of the users communications. In the course of the last year, independent security researchers discovered that Facebook reviews the contents of its users private Facebook messages for purposes unrelated to the facilitation of message transmission. When a user composes a Facebook message and includes a link to a third party website (a URL) 6, the Company scans the content of the Facebook message, follows the enclosed link, and searches for information to profile the message-senders web activity. 6. This practice is not done to facilitate the transmission of users communications

via Facebook, but because it enables Facebook to mine user data and profit from those data by sharing them with third parties namely, advertisers, marketers, and other data aggregators. 7. Representing to users that the content of Facebook messages is private creates

an especially profitable opportunity for Facebook, because users who believe they are communicating on a service free from surveillance are likely to reveal facts about themselves that they would not reveal had they known the content was being monitored. Thus, Facebook has positioned itself to acquire pieces of the users profiles that are likely unavailable to other data aggregators. 8. Almost the entirety of Facebooks revenues derive from the sale of third party

advertisements, which the Company is able to target towards its users based upon the personal data it mines and stores. In 2011, Facebook earned $2.7 billion from targeted advertising sales. The more otherwise-unavailable information the Company can collect about its users including the contents of their private communications the more valuable its advertising capacity. Accordingly, Facebook promotes itself as a rich source of information about the people who use the site, one which allows businesses to reach the right people, through selective targeting of

A URL, or uniform resource locator is also known as a web address. It is a character string that refers to a specific resource or location on the Internet. For example, www.nytimes.com is the URL for the New York Times home page.
1147096.1

-2-

CLASS ACTION COMPLAINT

Case4:13-cv-05996-PJH Document1 Filed12/30/13 Page4 of 36

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

potential customers by, for example, location, age, or interests 7 drawn from activities, education, job titles, Pages they like or groups to which they belong.8 9. All of Facebooks activities complained of herein are performed without users

consent. Instead, to increase users comfort with the website and, thereby, increase the amount of information they share, the Company makes assurances of user control over privacy settings and messaging options. These assurances affirmatively state that only senders and intended recipients are privy to the contents of their nonpublic communications. In reality, Facebook never intended to provide this level of confidentiality. Instead, Facebook mines any and all transmissions across its network, including those it labels private, in order to gather any and all morsels of information it can about its users. 10. Plaintiffs Matthew Campbell and Michael Hurley are Facebook users who, during

the relevant Class Period, utilized Facebooks private messaging function, each relying on representations that these private and personal communications would be viewed only by the sender and the recipient. Instead, where Plaintiffs sent private messages containing URLs, Facebook scanned Plaintiffs messages and searched the website identified in the URL for purposes including but not limited to data mining and user profiling. 11. While Facebook hides the extent of this intrusive behavior from its users, it is

candid about these activities in its technical guidance for web developers. Web developers are computer programmers who specialize in the development of internet applications, or distributed network applications that are run from a web server 9 to a web browser, 10 over HTTP. 11 Web
7

Reach the right people, Facebook, https://www.facebook.com/business/a/online-sales/targetyour-ads. 8 How to target Facebook ads, Facebook, https://www.facebook.com/business/a/online-sales/adtargeting-details. 9 A web server can refer to either the hardware (the computer) or the software (the computer application) that helps deliver web content that can be accessed through the Internet. 10 A web browser is a software application for retrieving, presenting and traversing information resources on the Internet. 11 HTTP or Hypertext Transfer Protocol is a set of standards that allows users of the World Wide Web to exchange information found on web pages. When an internet user enters http:// in front of a web address, this tells the web browser to communicate over HTTP. An HTTP request is a request sent by a client to a server via the internet, asking for information contained on the server. The most common example of this is when a web browser (e.g., Internet Explorer) sends a request to a server to call up the information associated with a web pages URL. For
1147096.1

-3-

CLASS ACTION COMPLAINT

Case4:13-cv-05996-PJH Document1 Filed12/30/13 Page5 of 36

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

developers are website administrators to whom Facebook offers or allows access to data created by its users web traffic. Some of these web developers work at Facebook, while others work for companies that do business with Facebook, and still others are freelancers or contractors. 12. This class action is brought on behalf of all natural person Facebook users located

within the United States who have sent or received private Facebook messages that included a URL in the content of the Facebook message. Upon information and belief, Facebook read these private Facebook messages. 13. Such actions, described in detail below, are intentional interceptions of electronic

communications, committed in violation of the Electronic Communications Privacy Act, 18 U.S.C. 2510 et seq. (ECPA), Californias Invasion of Privacy Act, Cal. Penal Code 630 et seq. (CIPA), and the California Unfair Competition Law (UCL). 14. Under ECPA, the CIPA, and the UCL, Plaintiffs seek, individually and on behalf

of the Class, injunctive and declaratory relief, restitution, statutory damages, an award of reasonable attorneys fees and other litigation costs reasonably incurred, and any and all additional relief deemed appropriate by this Court. II. THE PARTIES 15. Plaintiff Matthew Campbell a resident of Pulaski County, Arkansas. He

established a Facebook account in or around January 2009, which he has maintained consistently to the present day. He has used Facebooks private messaging function throughout the relevant Class Period for, inter alia, purposes of conveying messages whose content includes URL links. 16. Plaintiff Michael Hurley is a resident of North Plains, Oregon. He established a

Facebook account in or around October 2008, which he has maintained consistently to the present day. He has used Facebooks private messaging function throughout the relevant class period for, inter alia, purposes of conveying messages whose content contains URL links.

instance, where one enters the URL www.nytimes.com into the address bar of a web browser (the client) and hits the Enter button on the keyboard, the web browser will send a request to the New York Times server for information associated with the front page of the Times website. The server responds to the request by sending this information to the client, which then displays the webpage.
1147096.1

-4-

CLASS ACTION COMPLAINT

Case4:13-cv-05996-PJH Document1 Filed12/30/13 Page6 of 36

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28
1147096.1

17.

Defendant Facebook, Inc. is an American corporation, headquartered in Menlo

Park, California, and incorporated under the laws of the State of Delaware. Facebook owns and operates an online social networking website that allows its users to communicate with each other through the sharing of text, photograph, and video. III. JURISDICTION, VENUE, AND CHOICE OF LAW 18. Pursuant to 28 U.S.C. 1331, this Court has original subject matter jurisdiction

over the claims of Plaintiffs and the Class that arise under the Electronic Communications Privacy Act of 1986 (ECPA), 18 U.S.C. 2510 et seq. 19. Further, this Court has subject matter jurisdiction over this putative nationwide

class action pursuant to 28 U.S.C. 1332, as amended by the Class Action Fairness Act of 2005 (CAFA), because the matter in controversy exceeds $5,000,000.00, exclusive of interest and costs, and is a class action in which some members of the Class are citizens of states different than Defendant. See 28 U.S.C. 1332(d)(2)(A). Therefore, both elements of diversity jurisdiction under CAFA are present, and this Court has jurisdiction. 20. This Court has personal jurisdiction over Facebook because Facebook owns and

operates a business that is headquartered in California, and because it conducts substantial business throughout California. 21. Venue properly lies in this district pursuant to 28 U.S.C. 1391(b)(1), as

Facebook is headquartered in this district. 22. Venue is also proper in this district pursuant to Facebooks Statement of Rights

and Responsibilities, which governs the agreement between Plaintiffs and Facebook and which states in pertinent part that Plaintiffs will resolve any claim, cause of action or dispute (claim) . . . relating to . . . Facebook exclusively in a state or federal court located in Santa Clara County. 23. California law governs the substantive legal issues in the instant matter, as

Facebooks Statement of Rights and Responsibilities further states in pertinent part that the laws of the State of California will govern . . . any claim that might arise between you and us.

-5-

CLASS ACTION COMPLAINT

Case4:13-cv-05996-PJH Document1 Filed12/30/13 Page7 of 36

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

IV.

FACTUAL BACKGROUND A. 24. Data Aggregation Many websites capitalize on the personal information they can collect from users.

Some sell the data directly; some use the data to build valuable profiles of users for sale or their own use. 25. Data aggregation and sale are highly lucrative, both in the United States and

abroad. In the United States alone, data-driven marketing was reportedly worth $156 billion in 2012, 12 whereas a recent Boston Consulting Group Report puts the numbers in Europe even higher: it estimates a total digital identity value of Europeans in 2011 as 315 billion, a number expected to reach 1 trillion by 2020. 13 26. Even though many websites remove personally identifiable information from data

when they are initially sold, data aggregators are employing ever more sophisticated crossreferencing and predictive analytics techniques to make more sources of data personally identifiable. 14 27. Widespread dissemination of even de-identified data is already causing problems

for internet users. Kate Crawford, a visiting professor at the MIT Center for Civic Media and a principal researcher at Microsoft Research, and Jason Shultz, of the New York University School of Law, explain the privacy risks arising from new methods of data aggregation and analysis: Even very vague signals online, such as liking things on Facebook, can generate a detailed picture. As one University of Cambridge study found, highly sensitive personal attributes, such as sexual orientation, ethnicity, religious and political views, personality traits, intelligence, use of addictive substances, parental separation, age and gender were predictable with high degrees of success just from what people liked online. Thus, racial discrimination could be applied to prevent some candidates from seeing loans that might be US Data Marketing Worth $156 bn, Warc (fka World Advertising Research Center) (Oct. 16, 2013), http://www.warc.com/Content/News/N32077_US_data_marketing_worth_24156bn_.content?CI D=N32077&ID=6bba593a-da7f-433f-9030-c2c91452cc4b&q=direct+response+advertising&qr=. 13 The Value of Our Digital Identity, The Boston Consulting Group (Nov. 2012), http://www.libertyglobal.com/PDF/public-policy/The-Value-of-Our-Digital-Identity.pdf. 14 Kate Crawford and Jason Schultz, Big Data and Due Process: Toward a Framework to Redress Predictive Privacy Harms, New York University School of Law Public Law & Legal Theory Research Paper Series, Working Paper No. 13-64 at 8 (Oct. 2013), http://papers.ssrn.com/sol3/papers.cfm?abstract_id=2325784.
1147096.1 12

-6-

CLASS ACTION COMPLAINT

Case4:13-cv-05996-PJH Document1 Filed12/30/13 Page8 of 36

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28
15 16

advantageous to them, and housing renters and sellers could potentially use big data to discriminate based on gender, all while circumventing the fair housing laws. 15 28. Information that people never intended to make public can be used against them in

other ways, such as to deny healthcare coverage. According to Crawford and Schulz: [D]ata about our online behavior generally such as buying an ebook about breast cancer survival or liking a disease foundations Facebook page can also reveal information about our health . . . When these data sets are cross-referenced with traditional health information, as big data is designed to do, it is possible to generate a detailed picture about a persons health, including information a person may never have disclosed to a health provider. The combination of data sets and use of predictive analytics can dramatically increase the amount of data that can be considered private. 16 29. In another example of the uses to which data aggregators are putting predictive

analytics, a recent New York Times blog post reported that one man saw his American Express credit card limit reduced because, according to American Express, Other customers who have used their card at establishments where you recently shopped have a poor repayment history with American Express. 17 30. Even if a company only stores user information, and does not immediately use the

data it gleans from users private messages to target advertisements or for any purpose directly associated with the individual, it may sell that information at its discretion, and it can be resold by any company that buys it. Companies that acquire user data can retain that information indefinitely and use it for any purpose not prohibited by law or contract. 31. This puts people at risk of crime, discrimination, or embarrassment, and they are

powerless to stop it because once a company like Facebook obtains their data, users have no control over subsequent analysis, sale, or other use of the data. 32. Widespread dissemination of information about individuals empowers the

government against citizens to a degree well beyond the contemplation of the Fourth

Id. Id. at 6. 17 Lily Altavena, What Story Does Your Personal Data Tell?, N.Y. Times, The Learning Network (Feb. 17, 2013), http://learning.blogs.nytimes.com/2012/02/07/what-story-does-your-personaldata-tell/.
1147096.1

-7-

CLASS ACTION COMPLAINT

Case4:13-cv-05996-PJH Document1 Filed12/30/13 Page9 of 36

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

Amendment. Facebook declares that it only provides the stored contents of any account to the government with a warrant, 18 yet it has been reported that the companies that purchase such information can hand it over to government agencies with no probable cause and with no warrant. 19 33. Foreign regimes may also gain access to users private data after it has been

aggregated by companies like Facebook. 20 34. Furthermore, if companies like Facebook do not have to adhere to terms of their

own policies and representations regarding what data they collect, there is no basis for consumer trust. Ultimately, the duplicity alleged herein by entities like Facebook will likely cause consumers to assume that all communications they make are recorded and disseminated, significantly chilling free speech. 35. In response to the threats posed by internet privacy invasions, the Department of

Commerce has recently recommended basic principles for internet regulation that align with the goals underlying the CIPA and the ECPA. First articulated by the Department of Health and Human Services more than 30 years ago, they are known as the Fair Information Practice Principles (FIPPs). The FIPPs stand for eight relatively straightforward ideas:
18

Transparency: Individuals should have clear notice about the data collection practices involving them. Individual Participation: Individuals should have the right to consent to the use of their information. Purpose Specification: Data collectors should describe why they need particular information. Data Minimization: Information should only be collected if it is needed.

Information for Law Enforcement Authorities, Facebook, https://www.facebook.com/safety/groups/law/guidelines/. 19 American Civil Liberties Union, Focus on Data Aggregation, at 2 (June 2010) (The federal government is also a customer of private data companies. Its cheaper to buy information thats already been assimilated; it also avoids warrants or court oversight.) 20 Repressive regimes like Iran have demonstrated an interest in the online activities of U.S. citizens. For example, dozens of American Facebook users who posted political messages critical of Iran have reported that Iranian authorities subsequently questioned and detained their relatives. Electronic Privacy Information Center, Frequently Asked Questions Regarding EPICs Facebook Complaint, http://epic.org/privacy/socialnet/fbfaq.html.
1147096.1

-8-

CLASS ACTION COMPLAINT

Case4:13-cv-05996-PJH Document1 Filed12/30/13 Page10 of 36

1 2 3 4 5 6 7 8

B. 36.

Use Limitation: Information collected for one purpose should not be used for another. Data Quality and Integrity: Information should be accurate. Security: Information should be kept secure. Accountability and Auditing: Data collectors should know who has accessed information and how it is used. Facebook With 1.1 billion users accessing this service on a monthly basis approximately

51% of all internet users Facebook is the worlds largest social media company. 9 37. 10 with one another. As the Company stated in a Securities and Exchange Commission filing in 11 anticipation of its May 2013 initial public offering or IPO, [p]eople use Facebook to stay 12 connected with their friends and family, to discover what is going on in the world around them, 13 and to share and express what matters to them to the people they care about. . . . We believe that 14 we are at the forefront of enabling faster, easier, and richer communication between people and 15 16 38. 17 viewable to the entirely private. In the Facebook tutorial Get Started on Facebook, guidance is 18 offered on how to share or send information via the service, either publicly or privately: 19 20 21 22 23 24 25 26 27 28
21

The popularity of Facebook hinges upon the ability of its users to communicate

that Facebook has become an integral part of many of our users daily lives. 21 Communications among Facebook users span a continuum, from the publicly

How to Post & Share

Sharing Status Updates and Other Stories

Depending on whom youd like to share with, there are different ways to
share content on Facebook: Sharing with a broad audience: Use the share menu thats located at the top of your homepage and timeline to let others know whats on your mind. You can update your status and share photos, videos, links and other application content. Things you share will appear as posts on your timeline, and can appear in your News Feed. To control whether or not

Form S-1 Registration Statement for Facebook, Inc., as filed with the Securities and Exchange Commission, Prospectus Summary, at 1 (Feb. 1, 2012), http://www.sec.gov/Archives/edgar/data/1326801/000119312512034517/d287954ds1.htm.
1147096.1

-9-

CLASS ACTION COMPLAINT

Case4:13-cv-05996-PJH Document1 Filed12/30/13 Page11 of 36

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28
22 23

specific people have the option to view your stories, you can change the privacy settings for each piece of content you post. Sharing with a small group of friends: Use the Groups feature to share content with a select group of people, like family members, your soccer team or your book club. Sharing with an individual: You can use the share menu at the top of a friends timeline to write or share something on his or her timeline. Friends of your friend will also be able to view your post. I f youd like to

share som ething privately, you can alw ays send som eone a private m essage. 22

39.

Thus, Facebook states that its private messaging function is meant to be precisely

that: a private mechanism for communication between individuals using the Companys services. Further, Facebook telegraphs through the use of the words privately and private that when a user sends a private message to another party, only the user and the intended recipient will be privy to the contents of that communication. 1. 40. Facebooks Private Messaging Function

On November 15, 2010, Facebook announced a new, integrated email and

messaging service for its users. Combining the functionality of email, chat, SMS, 23 and inservice messaging into a single platform, Facebooks private messaging service enables Facebook users to communicate directly with specifically chosen individuals, in a single conversation, across devices and through a variety of popular media. 24 Because the messaging service can also serve as an email address, account holders can also use Facebook as a means of sending messages to, and receiving messages from, sources outside the Companys social media network. 41. Facebook took special pains to tout the privacy features of its new private

messaging service. In its rollout announcement, it said [y]ou can also change your account settings to be even more limited and bounce any emails that arent exclusively from friends. This kind of message control is pretty unprecedented and people have been wanting to do this with email (and phone calls) for a long time. Messages reverses the approach to preventing

Help Center: Get Started on Facebook: How to Post & Share (italic and bold emphasis added). SMS is an acronym for short message service, commonly known as text messaging. 24 See the Messages that Matter
1147096.1

- 10 -

CLASS ACTION COMPLAINT

Case4:13-cv-05996-PJH Document1 Filed12/30/13 Page12 of 36

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

unwanted contact. Instead of having to worry about your email address getting out, youre now in control of who can actually reach you. 25 42. Thus, in Facebooks inaugural representations of its private messaging service, it

stressed unprecedented amounts of (1) user control and (2) user privacy inherent in its product. 43. Where Facebook discusses its private messaging service on its website, it does so

in terms that expressly contemplate a private communication, taking place only between the sender and the intended recipient or recipients (e.g., If youd like to share something privately, you can always send someone a private message 26 and unprecedented levels of message control 27). Additionally, Facebooks website contains a Help Center which assists account holders in utilizing basic functions of the service. In the Help Center, under the heading How do I send a message the step-by-step instruction begins with the prompt To send a private message. 28 Under the heading Who can see my message, Facebook states You and the people youre messaging with can view the contents and history of your conversation. 29 44. All of these representations reflect the promise that only the sender and the

recipient or recipients will be privy to the private messages content, to the exclusion of any other party, including Facebook. 2. Third-Party Security Researchers Demonstrate that Facebook is Intercepting and Scanning the Content of Private Messages

45.

Facebooks representations of privacy have been discredited by security

researchers over the past year. Facebook has been caught surreptitiously intercepting and scanning the contents of its users private messages for a variety of purposes, none of which Facebook discloses in either its Terms of Use or its Privacy Policy.

25 26

Id. (emphasis added). Help Center: Get Started on Facebook: How to Post & Share (emphasis added). 27 See the Messages that Matter 28 Help Center: Messaging: Messages: Sending a Message: How Do I Send a Message?, Facebook, https://www.facebook.com/help/326534794098501/, (emphasis added). 29 Help Center: Messaging: Messages: Settings & Security: Who Can See My Messages?, Facebook, https://www.facebook.com/help/212388195458335?sr=16&sid=0ntT7VdfDjw7Y5KSV.
1147096.1

- 11 -

CLASS ACTION COMPLAINT

Case4:13-cv-05996-PJH Document1 Filed12/30/13 Page13 of 36

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28
30

46.

On August 27, 2013, a Swiss security firm announced that it had conducted a

simple experiment to test how scrupulously the fifty largest social networks, web services, and free email systems (Web Services) respected user privacy. 30 The firm, High-Tech Bridge (HTB), used a dedicated web server and generated a secret URL for each of the Web Services. HTB then used the private messaging function of each of the Web Services, embedding a unique URL in each message. 47. HTB then monitored its dedicated web servers logs for all incoming HTTP

requests, in order to see whether any of the Web Services would click on the test URLs that had been transmitted via private message. 48. Facebook was one of the Web Services that was caught scanning URLs despite

such activity remaining undisclosed to the user. 49. Concerning Facebooks scanning of the contents of privately sent messages,

HTBs Chief Research Officer stated, there is no way to keep the URL and its content confidential . . . while transferring the URL via social networks. 31 50. Facebook performs this task to aggregate data on its users for purposes of

advertising, marketing and user profiling; specifically, at least in part, in the form of generating Likes for web pages, generated via Facebooks social plugins embedded on websites, thereby monitoring users web browsing patterns. 3. 51. Facebooks Social Plugins

In addition to having users interact on its own website, Facebook also provides

code for third-party websites to embed, so-called social plugins. Facebook explains the social plugin as follows, Alright, so this is how it works. Lets say you are logged in to Facebook, but you check out a popular new site. Its kind of a bummer, because before you would have to choose between the social experience of Facebook or the specialized information of a content site. Ok, well now, if the website has a social plug-in, you can take your Facebook friends with you and get both. Instead of having to comb through page after page of article after article to High-tech Bridge, Social Networks: Can Robots Violate User Privacy? (Aug. 27, 2013), https://www.htbridge.com/news/social_networks_can_robots_violate_user_privacy.html. 31 Id.
1147096.1

- 12 -

CLASS ACTION COMPLAINT

Case4:13-cv-05996-PJH Document1 Filed12/30/13 Page14 of 36

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28
32

find something that catches your eye, now you can see what your friends have already enjoyed on a site. And with one click, you can share an article or a video review with your friends. 32 52. The effect of embedding social plugins into third-party websites is that it enables

Facebook to extend its data gathering practices, keeping tabs on its users behavior even after they log out of Facebook. One of the principal social plugins is the Like button commonly found on internet websites. 33 A video tutorial on Facebooks website states: When someone clicks Like, theyre highlighting the things that are valuable to them and sharing that with their friends. And when all of this goes to your News Feed, its like you have a real time, super-customized window to the most valuable things on the Internet. But we understand that many of the things people care about live outside of Facebook, so we wanted to create a way to bring your friends with you to other websites. So we created social plugins. Social plugins extend the things you love about Facebook to your favorite websites. 34 53. In practice, Facebook social plugins serve as an extension of Facebook on the

internet at large. In addition to Facebooks Like button at the top of a news article, Facebooks social plugins can take the form of a sidebar feed noting any friends who have read or recommended the article, or a clickable Facebook icon, as circled below.

35

54.

If users are concerned that their extra-Facebook web traffic is being broadcast

across the worlds largest social network, the Company offers this assurance: When you start to see websites that are customized for you all over the Internet, you might wonder if everyone else can see it. But its not like that. Although you can see customized information on other sites, all the information lives on Facebook, and Facebook Understanding Social Plugins, Facebook tutorial video at 0:40 1:09 (posted June 7, 2010), https://www.facebook.com/video/video.php?v=10150210521510484. 33 Id. (listing the Like button as one of the main social plugins.). 34 Id. at 0:15 0:39 35 Somini Sengupta, The Information Gathering Paradox, N.Y. Times, Oct. 26, 2013.
1147096.1

- 13 -

CLASS ACTION COMPLAINT

Case4:13-cv-05996-PJH Document1 Filed12/30/13 Page15 of 36

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28
36 37

doesnt share your information with anyone through social plugins. And each person has full control of what they want to share. Youre only sharing the information you want to, and youre only sharing it with the people you want to share it with. 36 55. In October 2012, a security researcher published findings in the Wall Street

Journal showing that Facebook scans users private messages for URLs. 37 When a private message contains a link to a third-party website, and that website has a Like social plugin, Facebook registers up to two Likes for that web page via the social media plugin. 38 56. In this first screenshot, the website set up by the security researcher, Ashkan

Soltani, ashkansoltani.org/fb_test.html, has two (2) likes registered to it.

Soltani also provided the html code for the website:

Soltani then logged into Facebook and sent a message that contained the URL and the text testing 1 2 3.

Understanding Social Plugins, at 1:14 1:37 (emphasis added). Jennifer Valentino-DeVries and Ashkan Soltani, How Private Are Your Private Facebook Messages?, Wall St. J., Oct. 3, 2012. 38 Id.
1147096.1

- 14 -

CLASS ACTION COMPLAINT

Case4:13-cv-05996-PJH Document1 Filed12/30/13 Page16 of 36

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 57. The article notes that this practice is described in Facebooks guidance for Finally, Soltani navigated back to his test website to see if the number of Likes registered to it increased, which they did. 39

developers administrators of the third-party websites whom Facebook seeks to entice to use social plugins. The developer guidance states that the number of inbox messages containing a Indeed, as a result of a technical glitch at the time, Facebook added two Likes per URL instead of one. A video showing Soltani complete this test in real-time can be found as part of the Digital Trends article reporting on it. See Molly McHugh, Facebook Scans Private Messages for Brand Page Mentions, Admits a Bug Is Boosting Likes, Digital Trends (Oct. 4, 2012), http://www.digitaltrends.com/social-media/facebook-scans-private-messages/.
1147096.1 39

- 15 -

CLASS ACTION COMPLAINT

Case4:13-cv-05996-PJH Document1 Filed12/30/13 Page17 of 36

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

link to a page will count as Likes. 40 However, this practice scanning private messages and doling out Likes to websites if a hyperlink is contained therein is not disclosed anywhere in Facebooks Privacy Policy. 58. Beyond scanning messages for social plugin purposes, Facebook also has

conceded that it uses a combination of software and human screening to comb through private messages and search for criminal activity. 41 Upon information and belief, this practice extends beyond the scanning of URLs and involves a combination of keyword searches, user profiling, and other, extensive but little discussed technology, 42 all of which enables Facebook to gather additional private information about its users. 59. As discussed in paragraph 63, the Like function is crucial in gathering data

points for the profiles Facebook keeps on its users for profit, including for purposes of delivering targeted advertising. 60. The practice, purpose, and effect of scanning users private messages, as described

herein, are not disclosed by Facebook to its users, and these scans are undertaken without users consent. 61. The practice, purpose, and effect of scanning users private messages, as described

herein, are not necessary for the rendition of Facebooks private messaging service, the protection of Facebooks rights or property, or the security of Facebook users. These scans are not undertaken in the ordinary course of business of an electronic communication service, as described in 28 U.S.C. 2510(15). 4. 62. Facebooks Incentive: Mining User Data

As information is shared by its more than one billion unique users, Facebook is

provided with sophisticated, exceedingly detailed data profiles. These vast databases of individual user information and behavior, coupled with proprietary analytics algorithms, enable
40

26 27 28

Id., citing Facebook.com, Facebook Developers: Social Plugins: Like Button, https://developers.facebook.com/docs/plugins/like-button/. 41 Joseph Menn, Social Networks Scan For Sexual Predators, With Uneven Results, Reuters (July 12, 2012), http://www.reuters.com/article/2012/07/12/us-usa-internet-predatorsidUSBRE86B05G20120712. 42 Id.
1147096.1

- 16 -

CLASS ACTION COMPLAINT

Case4:13-cv-05996-PJH Document1 Filed12/30/13 Page18 of 36

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

Facebook to surgically place ads throughout users accounts based upon the extensive profiles assembled on each and every user. As the Company explains: When an advertiser creates an ad, they are given the opportunity to choose their audience by location, demographics, likes, keywords, and any other information we receive or can tell about you and other users. For example, an advertiser can choose to target 18 to 35 year-old women who live in the United States and like basketball. An advertiser could also choose to target certain topics or keywords, like music or even people who like a particular song or artist. If you indicate that you are interested in topics, such as by liking a Page, including topics such as products, brands, religion, health status, or political views, you may see ads related to those topics as well. **** Sometimes we allow advertisers to target a category of user, like a moviegoer or a sci-fi fan. We do this by bundling characteristics that we believe are related to the category. For example, if a person likes the Star Trek Page and mentions Star Wars when they check into a movie theater, we may conclude that this person is likely to be a sci-fi fan. Advertisers of sci-fi movies, for example, could ask us to target sci-fi fans and we would target that group, which may include you. Or if you like Pages that are car-related and mention a particular car brand in a post, we might put you in the potential car buyer category and let a car brand target to that group, which would include you. 43 63. As the above statement by the Company makes clear, Likes are essential to

Facebook in its creation of data profiles for each of its users. These data profiles in turn enable Facebook to deliver ads with industry-leading accuracy. According to a third-party study, broadly targeted campaigns on Facebook (e.g., adults between the ages of 25 and 49) reach the desired audience with 95% accuracy, compared with an industry average of 72%; for more narrowly targeted campaigns (e.g., females between the ages of 25 and 34), Facebook reaches the desired audience with 90% accuracy, compared to an industry average of just 35%. 44 64. In 2009, 2010, and 2011, targeted advertising accounted for 98%, 95%, and 85%,

respectively, of the Companys revenue. 45

43

Data Use Policy, IV. How Advertising and Sponsored Stories Work, Facebook (updated Dec. 11, 2012), http://www.scribd.com/doc/191118234/Facebook-2. 44 Form S-1 Registration Statement for Facebook, Inc., How We Create Value for Advertisers and Marketers, 76. 45 Id., Risks Related to Our Business and Industry, 12.
1147096.1

- 17 -

CLASS ACTION COMPLAINT

Case4:13-cv-05996-PJH Document1 Filed12/30/13 Page19 of 36

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

65.

However, as discussed throughout this Complaint, Facebooks desire to harness

the myriad data points of its users has led to overreach and intrusion on the part of the Company as it mines its account holders private communications for monetary gain. C. Facebook Employs Devices and/or Technology to Scan, Extract, Acquire, and Use the Contents of Its Users Messages. 1. 66. Web Crawlers and Social Plugins

Upon information and belief, Facebook uses a software application called a web

crawler to scan any URL contained in a users private message. 67. These web crawlers perform the automated task of scanning the URL by sending

HTTP requests to the server associated with the URL and then seeking various items of information about the web page to which the URL is linked. 68. As discussed in paragraphs 51-54, Facebook has developed items of code called

social plugins, which can be embedded in third-party websites and, when clicked on by visitors, interact with Facebook. 69. 70. Such social plugins include, among others, the Like button. 46 Upon information and belief, one of the items of information Facebooks web

crawlers seek is whether or not the web page associated with the URL contains a Like button. 71. Upon information and belief, where a web page does contain a Like button, the

web crawlers transmit this information back to Facebook. 72. Upon information and belief, Facebook then uses these data to register the URL

sent via private message as a Like for the web page. 73. Upon information and belief, Facebook further provides these data to the web page

at issue, in the form of analytical analysis of web traffic to that site by Facebook users. 74. user profiles. 75. Upon information and belief, Facebooks interception occurs in transit, in Upon information and belief, Facebook further uses these data to build and refine

transmission, and/or in transfer of users private messages.

Product Docs: Social Plugins, Facebook, https://developers.facebook.com/docs/plugins/. - 18 CLASS ACTION COMPLAINT

1147096.1

Case4:13-cv-05996-PJH Document1 Filed12/30/13 Page20 of 36

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28
47 48

2.

Facebooks Message-Scanning Devices and/or Technology Constitute Conduct Outside the Scope of the Companys Ordinary Course of Business.

76.

None of the practices complained of throughout this complaint are necessary for or

incidental to the ability to send or receive private messages an electronic communication service across Facebooks online social network. 77. Facebook has the technical capacity to offer its private message service without

intercepting, scanning, and using the content of Plaintiffs and Class Members private messages. 78. Facebooks acquisition and use of content from Plaintiffs and Class Members

electronic communications, as described in this Complaint, is not necessary for or incidental to the protection of the rights or property of the Company, as provider of the service. Indeed, such activities, as described herein, are outside the ordinary course of business of electronic communication service providers. D. Facebook Fails to Disclose That Its Private Message Processes Read, Acquire, and Use Private Message Content, in Violation of Its Express Agreements With Facebook Users. 1. No user consents to Facebooks unlawful conduct because Facebooks Statement of Rights and Responsibilities and Privacy Policy are silent on the private-message-scanning processes.

79.

In order to establish a Facebook account, a user must agree to the Companys

Statement of Rights and Responsibilities and its Privacy Policy. Specifically, on Facebooks main page, it states, By clicking Sign Up, you agree to our Terms and that you have read our Data Use Policy, including our Cookie Use. 47 Within this sentence, the word Terms contains a hyperlink, leading to Facebooks Statement of Rights and Responsibilities; 48 similarly, the words Data Use Policy contain a hyperlink, leading to Facebooks Data Use Policy. 49 2. 80. Facebooks Statement of Rights and Responsibilities

The Statement of Rights and Responsibilities informs users that This Statement of Rights and Responsibilities (Statement, Terms, or SRR) derives from the Facebook Principles, and is our terms of service that governs our relationship with users and

Facebook, https://www.facebook.com. Statement of Rights and Responsibilities, Facebook, https://www.facebook.com/legal/terms. 49 Data Use Policy, Facebook, https://www.facebook.com/about/privacy.
1147096.1

- 19 -

CLASS ACTION COMPLAINT

Case4:13-cv-05996-PJH Document1 Filed12/30/13 Page21 of 36

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28
50

others who interact with Facebook. By using or accessing Facebook, you agree to this Statement, as updated from time to time in accordance with Section 14 below. Additionally, you will find resources at the end of this document that help you understand how Facebook works. (emphasis added). 81. The very first enumerated section of the Statement of Rights and Responsibilities

is titled Privacy. It consists of three sentences: Your privacy is very important to us. We designed our Data Use Policy50 to make important disclosures about how you can use Facebook to share with others and how we collect and can use your content and information. We encourage you to read the Data Use Policy, and to use it to help you make informed decisions. 82. The above language incorporates Facebooks Data Use Policy by reference, and

designates this document as governing the Companys privacy policy with its users. 3. 83. Facebooks Data Use Policy

The term message is found in Facebooks Data Use Policy (the Policy) only

nine times, and only once contemplates the Company receiving data related to users private messages. Specifically, under the heading Information we receive and how it is used, the Company states: Other information we receive about you We also receive other types of information about you: We receive data about you whenever you use or are running Facebook, such as when you look at another persons timeline, send or receive a message, search for a friend or a Page, click on, view or otherwise interact with things, use a Facebook mobile app, or make purchases through Facebook. 51

As with the disclosure on the main page, www.facebook.com, the words Data Use Policy contain a hyperlink leading to https://www.facebook.com/about/privacy/. 51 Data Use Policy: Information we receive and how it is used, Facebook, https://www.facebook.com/full_data_use_policy. There have been minor revisions to this language during the class period, not one of which is material to the allegations contained herein. Prior to November 15, 2013, this language read: We receive data about you whenever you interact with Facebook, such as when you look at another persons timeline, send or receive a message, search for a friend or a Page, click on, view or otherwise interact with things, use a Facebook mobile app, or purchase Facebook Credits or make other purchases through Facebook.
1147096.1

- 20 -

CLASS ACTION COMPLAINT

Case4:13-cv-05996-PJH Document1 Filed12/30/13 Page22 of 36

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28
1147096.1

84. states:

Under the section titled How we use the information we receive, the Policy

We use the information we receive about you in connection with the services and features we provide to you and other users like your friends, our partners, the advertisers that purchase ads on the site, and the developers that build the games, applications, and websites you use. For example, in addition to helping people see and find things that you do and share, we may use the information we receive about you:

as part of our efforts to keep Facebook products, services and integrations safe and secure; to protect Facebooks or others rights or property; to provide you with location features and services, like telling you and your friends when something is going on nearby; to measure or understand the effectiveness of ads you and others see, including to deliver relevant ads to you; to make suggestions to you and other users on Facebook, such as: suggesting that your friend use our contact importer because you found friends using it, suggesting that another user add you as a friend because the user imported the same email address as you did, or suggesting that your friend tag you in a picture they have uploaded with you in it; and for internal operations, including troubleshooting, data analysis, testing, research and service improvement. ***

While you are allowing us to use the information we receive about you, you always own all of your information. Your trust is important to us, which is why we dont share information we receive about you with others unless we have:

received your permission; given you notice, such as by telling you about it in this policy; or removed your name or any other personally identifying information from it.

85.

These disclosures do not disclose that as a matter of course Facebook scans,

mines, and manipulates the content of its users private messages, acting in a manner in direct conflict with the assurances it provides to its users regarding the privacy and control they should expect in using Facebooks services. See 38-44, etc., supra.

- 21 -

CLASS ACTION COMPLAINT

Case4:13-cv-05996-PJH Document1 Filed12/30/13 Page23 of 36

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

86.

In contrast to its disclosures to developers discussed in paragraph 57, supra,

Facebooks disclosures to users do not state that Facebook scans URLs transmitted via private message across its social network. 87. In contrast to its disclosures to developers discussed in paragraph 57, supra,

Facebooks disclosures to users do not state that Facebook will register the fact that a URL is communicated privately, via its private message function, as a Like for a particular web page. 88. In contrast to its disclosures to developers discussed in paragraph 57, supra,

Facebooks disclosures to users do not state that, when a user sends a URL as part of a private message, this act will become part of Facebooks data profile of web traffic for the linked-to website. 89. In contrast to its disclosures to developers discussed in paragraph 57, supra,

Facebooks disclosures to users do not state that, when a user sends a URL as part of a private message, this act will become part of Facebooks data profile of the user. 90. Instead, Facebook misleads users into believing that they have a secure, private

mechanism for communication Facebooks private messaging function when, in fact, Facebook intercepts and scans the content and treats portions of that content no differently than a public Like or post, broadcast openly across the Internet. Further, the purpose for the invasive scanning of these purportedly private messages is not meant for the benefit of users, but rather is a mechanism for Facebook to surreptitiously gather data in an effort to improve its marketing algorithms and increase its ability to profit from data about Facebook users. CLASS ALLEGATIONS 91. Plaintiffs bring this nationwide class action, pursuant to Rule 23 of the Federal

Rules of Civil Procedure, individually and on behalf of all members of the following Class: All natural person Facebook users located within the United States who have sent or received private messages where such message included URLs in the content, from within two years before the filing of this action up through and including the date of the judgment in this case. 92. Excluded from the Class are the following individuals and/or entities: Facebook

and its parents, subsidiaries, affiliates, officers and directors, current or former employees, and
1147096.1

- 22 -

CLASS ACTION COMPLAINT

Case4:13-cv-05996-PJH Document1 Filed12/30/13 Page24 of 36

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

any entity in which Facebook has a controlling interest; all individuals who make a timely election to be excluded from this proceeding using the correct protocol for opting out; any and all federal, state or local governments, including but not limited to their departments, agencies, divisions, bureaus, boards, sections, groups, counsels and/or subdivisions; and all judges assigned to hear any aspect of this litigation, as well as their immediate family members. 93. Plaintiffs reserve the right to modify or amend the definition of the proposed Class

before the Court determines whether certification is appropriate. 94. The Class is so numerous that joinder of all members is impracticable. Upon

information and belief, there are more than 166 million Facebook account holders in the United States. The number of separate individuals who sent private messages via Facebook, where such message included URLs in the content, within two years before the filing of this action, is likely in the millions, and is identifiable and ascertainable based on Facebooks records. 95. There are questions of law or fact common to the Class. These questions include,

but are not limited to, the following: a. Whether Facebook intentionally intercepted, endeavored to intercept, or

procured any other person to intercept or endeavor to intercept Plaintiffs and Class Members electronic communications sent via Facebook; b. Whether Facebook intentionally used, or endeavored to use, the contents of

Plaintiffs and Class Members electronic communications sent via Facebook, knowing or having reason to know that the information was obtained in violation of 18 U.S.C. 2511(1)(d); c. d. Whether Facebook acted intentionally in violating privacy rights; Whether Facebook acquired any contents of Plaintiffs and Class

Members private messages, within the meaning of 18 U.S.C. 2510(8); e. Whether Plaintiffs and Class Members private messages sent via

Facebook were electronic communications within the meaning of 18 U.S.C. 2510(12); f. Whether Facebook used an electronic, mechanical, or other device,

within the meaning of 18 U.S.C. 2510(5); g.

The amount of statutory damages that should be levied against Facebook; - 23 CLASS ACTION COMPLAINT

Case4:13-cv-05996-PJH Document1 Filed12/30/13 Page25 of 36

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28
1147096.1

h. awarded; i. j. k. 96.

Whether injunctive and/or declaratory relief against Facebook should be

Whether Facebooks conduct was likely to deceive its users; Whether Facebooks conduct was unlawful; and Whether Plaintiffs and Class Members are entitled to restitution.

Plaintiffs claims are typical of the claims of the Class in that Plaintiffs and the

Class sent and/or received private messages via Facebook, where such messages contained URLs in the content. In the process, Facebook intercepted, scanned, and acquired the private messages content, sending HTTP requests to the servers housing the web pages referred to in Plaintiffs and Class Members private messages. Facebook further used or endeavored to use the contents of Plaintiffs and Class Members private messages, where the Company found URLs to webpages containing social plugins, manipulating such social plugins to generate Likes for web pages and to assemble profiles of users web traffic and personal preferences. Plaintiffs and Class Members did not consent to the interception and uses of their private message content, which comprise the basis for this suit. Plaintiffs and Class Members are entitled to declaratory relief, statutory damages, restitution, and injunctive relief as a result of the conduct complained of herein. Moreover, upon information and belief, the conduct complained of herein is systemic. Thus, the representative Plaintiffs, like all other Class Members, face substantial risk of the same injury in the future. The factual basis of Facebooks conduct is common to all Class Members, and represents a common thread of conduct resulting in injury to all members of the Class. Plaintiffs have suffered the harm alleged and have no interests antagonistic to any other Class Member. 97. Plaintiffs will fairly and adequately protect the interests of the Class. Plaintiffs

interests do not conflict with the interests of the Class Members. Furthermore, Plaintiffs have retained competent counsel experienced in class action litigation. Plaintiffs counsel will fairly and adequately protect and represent the interests of the Class. Fed. R. Civ. P. 23(a)(4) and 23(g) are satisfied.

- 24 -

CLASS ACTION COMPLAINT

Case4:13-cv-05996-PJH Document1 Filed12/30/13 Page26 of 36

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

98.

Plaintiffs assert that pursuant to Fed. R. Civ. P. 23(b)(3), questions of law or fact

common to the Class Members predominate over any questions affecting only individual members. 99. A class action is superior to other available methods for the fair and efficient

adjudication of this controversy. Arguably no Class Member could afford to seek legal redress individually for the claims alleged herein. Therefore, absent a class action, the Class Members will continue to suffer losses and Facebooks misconduct will proceed without remedy. 100. Even if Class Members themselves could afford such individual litigation, the

court system could not. Given the complex legal and factual issues involved, and considering that the Class could number in the tens of millions or greater, individualized litigation would significantly increase the delay and expense to all parties and to the Court. Individualized litigation would also create the potential for inconsistent or contradictory rulings. By contrast, a class action presents far fewer management difficulties, allows claims to be heard which may otherwise go unheard because of the relative expense of bringing individual lawsuits, and provides the benefits of adjudication, economies of scale and comprehensive supervision by a single court. CAUSES OF ACTION COUNT ONE (Violations of the Electronic Communications Privacy Act, 18 U.S.C. 2510 et seq.) 101. Plaintiffs adopt and incorporate each and every allegation of this complaint as if

stated fully herein. 102. Plaintiffs, individually and on behalf of Class Members, assert violations of

18 U.S.C. 2511(1)(a) and (1)(d) for Facebooks unlawful interception and use of Plaintiffs electronic communications. 103. 104. Facebook, as a corporation, is a person pursuant to 18 U.S.C. 2510(6). Throughout the entirety of the conduct upon which this suit is based, Facebooks

actions have affected interstate commerce. Upon information and belief, the Company has over 166 million users in the United States alone, and over one billion users worldwide.
1147096.1

- 25 -

CLASS ACTION COMPLAINT

Case4:13-cv-05996-PJH Document1 Filed12/30/13 Page27 of 36

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28
1147096.1

105.

Facebooks actions are and have been intentional as evidenced by, inter alia, its

disclosures to developers and the design and implementation of its private messaging service, web crawlers, and social plugins. 106. Facebooks actions complained of herein are not necessary practices for providers

of electronic communications, nor are they incidental to the act of facilitating private messages across Facebooks social network. 107. Pursuant to 18 U.S.C. 2511(1)(a), Facebook intentionally intercepted, intercepts,

or endeavored or endeavors to intercept the electronic communications of Plaintiffs and Class Members. 108. Through Facebooks scanning of users private messages, the Company acquired

and continues to acquire the substance, purport, and meaning of private messages transmitted to and from Plaintiffs and Class Members. 109. The private messages transmitted to and from Plaintiffs and Class Members via

Facebooks private messaging function are and have been at all relevant times electronic communications. 110. The conduct alleged herein does not occur while the private message is in storage.

Rather, Facebook utilizes each accused device for the purpose of acquiring and manipulating content from the message in the course of the messages transmission. 111. Facebook utilized and continues to utilize one or more devices or technology

comprised of an electronic, mechanical, or other device or apparatus to intercept the electronic communications transmitted to and from Plaintiffs and Class Members. Such devices or technology include, but are not limited to, web crawlers and social plugins. 112. Facebook does not furnish the above-referenced devices or technology to its users,

and users do not use the devices for connection to the facilities. 113. The intercepting devices or technology are not used for the ability to send or

receive electronic communications.

- 26 -

CLASS ACTION COMPLAINT

Case4:13-cv-05996-PJH Document1 Filed12/30/13 Page28 of 36

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28
1147096.1

114.

The devices or technology are not used by Facebook, operating as an electronic

communication service, in the ordinary course of business as a provider of an electronic communication service. 115. Facebooks interception of electronic communications sent by and to Plaintiffs and

Class Members (a) for undisclosed purposes; (b) for the purpose of generating Likes for thirdparty websites; (c) for purposes of providing web traffic data to third parties; (d) for purposes of cataloging user data for targeted advertising and building user profiles; (e) for purposes beyond facilitating private messages sent via Facebook; (f) in violation of its user agreements; (g) in violation of its public statements to users; (h) in violation of federal and California law; and (i) in violation of the property rights of Plaintiffs, Class Members, and third parties. These activities are not within the ordinary course of business of a provider of an electronic communication service. 116. Pursuant to 18 U.S.C. 2511(1)(d), Facebook intentionally used, uses, or

endeavored or endeavors to use the contents of Plaintiffs and Class Members electronic communications while knowing or having reason to know that it obtained the information through the interception of the electronic communication in violation of 18 U.S.C. 2511(1)(a). 117. Facebooks interception of and use of the contents of Plaintiffs and Class

Members electronic communications were not performed by an employee engaged in any activity necessary for the rendition of an electronic communication service or for the protection of the rights or property of Facebook. 118. Facebooks services that are not related to the ability to send and receive electronic

communications are not electronic communication services. 119. No party to the electronic communications alleged herein consented to Facebooks

interception or use of the contents of the electronic communications. 120. Facebook intercepts Plaintiffs and Class Members electronic communications for

the purpose of committing a criminal or tortious act in violation of the laws of any state, and as such, it cannot obtain consent pursuant to 2511(2)(d).

- 27 -

CLASS ACTION COMPLAINT

Case4:13-cv-05996-PJH Document1 Filed12/30/13 Page29 of 36

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

121.

As a result of Facebooks violations of 2511, pursuant to 2520, Plaintiffs and

the Class Members are entitled to: a. Preliminary and permanent injunctive relief to require Facebook to fully

disclose the extent of its activities, to seek the informed and knowing consent of its users when scanning users private messages, and to halt Facebooks violations; b. c. Appropriate declaratory relief; For Plaintiffs and each Class Member, the greater of $100 a day for each

day of violation or $10,000; and d. 122. Reasonable attorneys fees and other litigation costs reasonably incurred.

While certain devices and/or technology have been identified in this Complaint,

Plaintiffs reserve the right to assert ECPA violations as to any further devices and/or technology disclosed or those devices and/or technology upon which Facebook provides additional information. COUNT TWO (Violations of the California Invasion of Privacy Act, Cal. Penal Code 630, et seq.) 123. Plaintiffs adopt and incorporate each and every allegation of this complaint as if

stated fully herein. 124. Plaintiffs, individually and on behalf of Class Members, assert violations of the

CIPA, Cal. Penal Code 630, et seq., specifically Cal. Penal Code 631(a) and 632, for Facebooks unlawful interception and scanning of the contents of its users private messages. Facebook uses this information about the sender and recipient for purposes of profiling, marketing, and advertising. 125. Cal. Penal Code 630 provides that The Legislature hereby declares that

advances in science and technology have led to the development of new devices and techniques for the purpose of eavesdropping upon private communications and that the invasion of privacy resulting from the continual and increasing use of such devices and techniques has created a serious threat to the free exercise of personal liberties and cannot be tolerated in a free and civilized society.
1147096.1

- 28 -

CLASS ACTION COMPLAINT

Case4:13-cv-05996-PJH Document1 Filed12/30/13 Page30 of 36

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

126.

Facebooks acts in violation of the CIPA occurred in the State of California

because those acts resulted from business decisions, practices, and operating policies that Facebook developed, implemented, and utilized in the State of California and which are unlawful and constitute criminal conduct in the state of Facebooks residence and principal business operations. Facebooks implementation of its business decisions, practices, and standard ongoing policies that violate the CIPA took place and continue to take place in the State of California. Facebook profited and continues to profit in the State of California as a result of its repeated and systemic violations of the CIPA. Facebooks unlawful conduct, which occurred in the State of California, harmed and continues to harm Plaintiffs and Class Members. Facebook developed, designed, built, and physically placed in California one or more of the accused devices or technology employed by Facebook to violate the CIPA. 127. Plaintiffs and Class Members sent and received private messages, the contents of

which included URLs, via Facebooks services. 128. Facebook is not and was not at any time a party to Plaintiffs and Class Members

private messages. 129. messages. 130. A. 131. 132. These messages are communications among Plaintiffs and Class Members. Violations of Cal. Penal Code 631(a) Pursuant to Cal. Penal Code 7, Facebook, a corporation, is a person. Facebook uses a machine, instrument, contrivance, or in any other manner The private messages exchanged among Plaintiffs and Class Members are

is able to, read or to learn the content or meaning of Plaintiffs and Class Members private messages. 133. Facebook acts willfully when it reads, attempts to read, or learns the content or

meaning of Plaintiffs and Class Members private messages. 134. Facebook does not have the consent of any party to the communication, or it acts

in an unauthorized manner, when it reads, attempts to read, or learns the content or meaning of Plaintiffs and Class Members private messages.
1147096.1

- 29 -

CLASS ACTION COMPLAINT

Case4:13-cv-05996-PJH Document1 Filed12/30/13 Page31 of 36

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28
1147096.1

135.

Plaintiffs and Class Members private messages are any message, report, or

communication. 136. At the time Facebook reads, attempts to read, or learns the content or meaning of

Plaintiffs and Class Members private messages, the private messages are in transit. 137. At the time Facebook reads, attempts to read, or learns the content or meaning of

Plaintiffs and Class Members private messages, the private messages are passing over any wire, line, or cable. 138. Private messages coded, written messages sent electronically to remote locations

are telegraphs within the meaning of the CIPA and this section of CIPA. As such, the wires, lines, cables and/or instruments which carry and facilitate the transmission of Plaintiffs and Class Members private messages are telegraph wires, lines, cables and/or instruments within the meaning of the CIPA and CIPA 631(a). 139. Plaintiffs and Class Members do not consent, expressly or impliedly, to

Facebooks eavesdropping upon and recording of their private messages. Facebook does not disclose material information to its users relating to its attempts at, among other things, intercepting, scanning and reading the contents of users private messages. 140. There is no knowledge or expectation among Plaintiffs and Class Members

regarding the extent of Facebooks reading of message content, learning about the content or meaning of users private messages, the acquisition of such content, the collection of such content, or the manipulation of such content. Each and every one of these actions extends beyond the normal occurrences, requirements, and expectations regarding the facilitation and transmission of Facebooks private messages. B. 141. person. 142. Cal. Penal Code 632 prohibits eavesdropping upon or the recording of any Violations of Cal. Penal Code 632 Pursuant to Cal. Penal Code 7 and 632(b), Facebook, a corporation, is a

confidential communication, including those occurring by telephone, telegraph or other device,

- 30 -

CLASS ACTION COMPLAINT

Case4:13-cv-05996-PJH Document1 Filed12/30/13 Page32 of 36

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

through the use of an amplification or electronic recording device without the consent of all parties to the communication. 143. Facebook intentionally and without the consent of any party to the communication

eavesdrops upon and/or records the contents of Plaintiffs and Class Members private messages. 144. Facebook uses electronic amplifying or recording devices, including its web

crawlers and social plugins, to eavesdrop upon and to record Plaintiffs and Class Members private messages, for purposes independent and unrelated to storage. 145. Plaintiffs and Class Members private messages are confidential communications

with specifically identified and designated recipients. 146. At the time Plaintiffs and Class Members transmit private messages via Facebook,

their communications are confidential because the communications are confined to those persons specified as recipients in the destination address fields. There neither would nor could be any expectation that a third party, such as Facebook, would act in any manner other than to facilitate the communication of the private message between the sender and the intended recipient or recipients. There certainly would not and could not be any expectation that Facebook a third party would scan the contents of the private message in an effort to catalog and manipulate the information contained therein. 147. There is no knowledge or expectation among Plaintiffs and Class Members

regarding the extent of Facebooks reading of users private message content, learning about the content or meaning of the private messages, acquiring and collecting the content of such messages, and manipulating the content of such messages each action being beyond the normal occurrences, requirements, and expectations regarding the facilitation and transmission of Facebooks private messages. 148. Plaintiffs and Class Members private messages sent via Facebook are carried on

among the parties by means of an electronic device that is not a radio. 149. Plaintiffs and Class Members do not consent, expressly or impliedly, to

Facebooks eavesdropping upon and recording of their private messages. Facebook does not

1147096.1

- 31 -

CLASS ACTION COMPLAINT

Case4:13-cv-05996-PJH Document1 Filed12/30/13 Page33 of 36

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

disclose material information to its users relating to its attempts at reading, scanning, acquiring, collecting, and manipulating the contents of users private messages. 150. While Plaintiffs have identified certain accused devices and/or technology in this

Complaint, Plaintiffs reserve the right to assert violations of Cal. Penal Code 631 and 632 as to any further devices or technology subsequently discovered or any devices or technology upon which Facebook provides additional information. C. 151. Relief Sought Under Cal. Penal Code 637.2 As a result of Facebooks violations of Cal. Penal Code 631 and 632, Plaintiffs

and the Class are entitled to: a. Preliminary and permanent injunctive relief to require Facebook to fully

disclose the extent of its activities, to seek the informed and knowing consent of its users when scanning users private messages, and to halt Facebooks violations; b. c. Appropriate declaratory relief; Monetary relief in the amount set forth in Cal. Penal Code 637.2(a) for

each Class Member; and d. Reasonable attorneys fees and other litigation costs reasonably incurred. COUNT THREE (Violations of Californias Unfair Competition Law California Business & Professions Code 17200 et seq.) 152. Plaintiffs and Class Members reallege and incorporate by reference every

allegation set forth in the preceding paragraphs as though alleged in this Count. 153. Facebooks conduct as alleged herein constitutes unfair, unlawful, or fraudulent

business acts or practices as proscribed by Section 17200, et seq., of the California Business & Professions Code (UCL). 154. Facebooks conduct constitutes unlawful business acts or practices by virtue of

Defendants violation of the Electronic Communications Privacy Act, 18 U.S.C. 2510, et seq., Cal. Penal Code 631(a) and 632. 155. Plaintiffs reasonably relied on Facebooks representations that Plaintiffs private

messages are viewable only by the sender and the recipient, and as a result engaged in private
1147096.1

- 32 -

CLASS ACTION COMPLAINT

Case4:13-cv-05996-PJH Document1 Filed12/30/13 Page34 of 36

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

messaging on Facebook. Facebook failed to disclose to Plaintiffs and members of the general public that it systematically reviews and captures the content of, and metadata associated with, Plaintiffs private messages. Facebook failed to disclose that it aggregates the content and data of private messages, using it to sell advertising for a profit. Facebooks Data Use Policy fails to disclose Facebooks acts or practices, and together with its statements that private messages are viewable only by the sender and the recipient, are likely to deceive members of the public. As a result, Facebooks conduct constitutes fraudulent business acts or practices. 156. Plaintiffs have an interest in controlling the disposition and dissemination of their

private messages. Contrary to Plaintiffs interests, Facebook exercised control over the content of Plaintiffs private messages, exploiting it for sale and profit without Plaintiffs consent. As a result, Facebooks conduct constitutes unfair business acts or practices. 157. Plaintiffs have suffered injury in fact and lost money or property as a result of

Facebooks business acts or practices. 158. Plaintiffs and Class Members seek an order to enjoin Facebook from such

unlawful, unfair, and fraudulent business acts or practices, and to restore to Plaintiffs and Class Members their interest in money or property that may have been acquired by Facebook by means of unfair competition. JURY DEMANDED Pursuant to Federal Rule of Civil Procedure 38, Plaintiffs, individually and on behalf of the Class they seek to represent, demand a jury on any issue so triable of right by a jury. PRAYER FOR RELIEF WHEREFORE, Plaintiffs, on behalf of themselves and all Class Members, request judgment be entered against Facebook and that the Court grant the following: 1. An order determining that this action may be maintained as a class action under

Rule 23 of the Federal Rules of Civil Procedure, that Plaintiffs are proper class representatives, that Plaintiffs attorneys be appointed Class counsel pursuant to Rule 23(g) of the Federal Rules of Civil Procedure, and that Class notice be promptly issued;

1147096.1

- 33 -

CLASS ACTION COMPLAINT

Case4:13-cv-05996-PJH Document1 Filed12/30/13 Page35 of 36

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28
1147096.1

2. action; 3. 4. 5.

Judgment against Facebook for Plaintiffs and Class Members asserted causes of

Appropriate declaratory relief against Facebook; Preliminary and permanent injunctive relief against Facebook; An award of statutory damages to Plaintiffs and Class Members pursuant to

18 U.S.C. 2520, for each, the greater of $100 a day for each day of violation of Count One, or $10,000; 6. An award of statutory damages to Plaintiffs and Class Members pursuant to Cal.

Penal Code 637.2, for each, the greater of $5,000 or three times the amount of actual damages sustained by Plaintiffs and Class Members; 7. incurred; and 8. Any and all relief to which Plaintiffs and the Class may be entitled. An award of reasonable attorneys fees and other litigation costs reasonably

- 34 -

CLASS ACTION COMPLAINT

Case4:13-cv-05996-PJH Document1 Filed12/30/13 Page36 of 36

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

Dated: December 30, 2013

LIEFF CABRASER HEIMANN & BERNSTEIN, LLP

By:

/s/ Michael W. Sobol Michael W. Sobol

Michael W. Sobol (State Bar No. 194857) [email protected] Melissa Gardner (State Bar No. 289096) [email protected] LIEFF CABRASER HEIMANN & BERNSTEIN, LLP 275 Battery Street, 29th Floor San Francisco, CA 94111-3339 Telephone: 415.956.1000 Facsimile: 415.956.1008 Rachel Geman [email protected] Nicholas Diamand [email protected] LIEFF CABRASER HEIMANN & BERNSTEIN, LLP 250 Hudson Street, 8th Floor New York, NY 10013-1413 Telephone: 212.355.9500 Facsimile: 212.355.9592 Hank Bates (State Bar No. 167688) [email protected] Allen Carney [email protected] David Slade [email protected] CARNEY BATES & PULLIAM, PLLC 11311 Arcade Drive Little Rock, AR 72212 Telephone: 501.312.8500 Facsimile: 501.312.8505 Attorneys for Plaintiffs and the Proposed Class

1147096.1

- 35 -

CLASS ACTION COMPLAINT