509 F.Supp.3d 1182
N.D. Cal.2020Background
- Two related putative class actions against Facebook about its collection and use of location data: Heeger (Case No. 18-cv-06399) and Lundy (Case No. 18-cv-06793).
- Plaintiffs allege Facebook collected location information despite users turning off Location History/Location Services; Heeger plaintiffs primarily allege collection of IP addresses; Lundy plaintiffs allege logs showing latitude/longitude coordinates inferred from IPs and "enhanced" location techniques.
- Heeger FAC asserted CIPA, California constitutional privacy, intrusion upon seclusion, and unjust enrichment; Lundy FAC asserted constitutional privacy, intrusion, multiple fraud-based claims, breach of contract and implied covenant, negligent misrepresentation, and unjust enrichment.
- Facebook moved to dismiss both FACs under Rules 12(b)(1) and 12(b)(6); the court re-evaluated standing and substantive sufficiency after amendment.
- Ruling: Heeger FAC dismissed in full for lack of Article III standing (IP addresses alone not a legally protected privacy interest); Lundy FAC: standing found for several claims but many substantive claims dismissed with leave to amend.
- Court allowed leave to amend in both cases (final opportunity), with amended complaints due January 21, 2021; no new claims/defendants without leave of court.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Article III standing for privacy claims (Heeger) | Facebook collected users' IPs and other location data despite settings off; this is a privacy injury | Collection of IP addresses alone is not a legally protected privacy interest; no injury-in-fact | Dismissed for lack of standing — IP addresses alone do not establish a cognizable privacy injury |
| Article III standing for privacy & economic claims (Lundy) | Logs show IPs plus precise lat/long and "enhanced" location pinpointing; location data has economic value | Facebook argues plaintiffs fail to allege concrete injury (privacy or economic) | Standing found for constitutional privacy, intrusion, breach of contract/implied covenant, fraud, and unjust enrichment (pleaded economic value) |
| Substantive privacy claims (intrusion & CA constitutional privacy) | Facebook secretly pinpointed locations and used them after users opted out | Facebook says alleged data is generalized (city-level) and collected while app in use, so no reasonable expectation of privacy | Privacy claims dismissed for failure to plausibly allege a reasonable expectation of privacy and sensitive/serious intrusion; dismissal with leave to amend |
| Fraud / negligent misrepresentation (reliance) | Facebook’s Data Policy and statements misled users into believing location would not be collected without permission; plaintiffs relied by turning off settings | Facebook notes timing of privacy policy, plaintiffs’ continued use after discovering issues, and insufficient reliance/damages pleading | Fraud claims dismissed for inadequate reliance/damage allegations; leave to amend granted |
| Breach of contract & implied covenant | Plaintiffs point to Facebook’s Data Policy and representations about permissions | Facebook and precedent say the Data Use Policy may not form an enforceable contract; pleadings do not adequately allege a contract or damages | Contract and implied covenant claims dismissed with leave to amend |
| Unjust enrichment | Plaintiffs allege Facebook monetized location data and unjustly profited | Facebook argues no standalone unjust enrichment claim where contract exists and plaintiffs failed to plead misrepresentation or unfair action | Unjust enrichment dismissed (plaintiffs failed to oppose substantively); leave to amend granted |
Key Cases Cited
- In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589 (9th Cir. 2020) (framework for standing and privacy claims in online-tracking lawsuits)
- Carpenter v. United States, 138 S. Ct. 2206 (2018) (distinguishes privacy expectations for cell-site location information from other location identifiers)
- United States v. Forrester, 512 F.3d 500 (9th Cir. 2008) (no reasonable expectation of privacy in IP addresses)
- Lujan v. Defenders of Wildlife, 504 U.S. 555 (1992) (standing requires concrete, particularized injury fairly traceable to defendant and redressable)
- Patel v. Facebook Inc., 290 F. Supp. 3d 948 (N.D. Cal. 2018) (recognition that intangible privacy harms can support standing in online-privacy context)
- Hill v. Nat'l Collegiate Athletic Ass'n, 7 Cal. 4th 1 (1994) (California constitutional right to privacy principles)
- Hernandez v. Hillsides, Inc., 47 Cal. 4th 272 (2009) (elements of intrusion upon seclusion)
- Wittman v. Personhuballah, 136 S. Ct. 1732 (2016) (Article III case-or-controversy requirement)
- DaimlerChrysler Corp. v. Cuno, 547 U.S. 332 (2006) (standing must be shown for each claim and form of relief)