605 F.Supp.3d 1218
N.D. Cal.2022Background
- Meta sued BrandTotal alleging unauthorized automated scraping and misuse of Facebook/Instagram data via browser extensions (notably UpVoice) and other tools; BrandTotal counterclaimed for interference and UCL claims.
- BrandTotal used a Rapid7 logging service that retained diagnostic logs for 30 days; those logs contained users’ access tokens and were not preserved after litigation began.
- Earlier BrandTotal products (ASV, Story Savebox) transmitted access credentials; later UpVoice 2021 was redesigned to record only data the user received and user-entered demographics.
- Meta successfully had older UpVoice removed from Google’s store; Meta then filed this action and sought sanctions for spoliation and for alleged false 30(b)(6) testimony by BrandTotal’s former R&D VP (Oren Dor).
- The court found negligent spoliation (failure to preserve Rapid7 logs), authorized a jury instruction about the loss and allowed a permissive adverse inference; BrandTotal must pay 75% of Meta’s sanctions-motion fees.
- On summary judgment the court (inter alia) awarded Meta judgment on breach of contract, on CDAFA liability for active/former legacy collection and some direct access using purchased/fake accounts, denied a full Rule 37(e)(2) adverse-presumption, and held that UpVoice 2021 and access to public pages do not violate the CFAA/CDAFA.
Issues
| Issue | Plaintiff's Argument (Meta) | Defendant's Argument (BrandTotal) | Held |
|---|---|---|---|
| Sanctions for loss of Rapid7 logs (spoliation) | BrandTotal had duty to preserve logs once litigation anticipated; deleted logs would show systematic exfiltration and misuse of access tokens; seek adverse-presumption and fees | Rapid7 deleted logs per ordinary 30-day retention; deletion was negligent, not intentional; remedies excessive | Court: spoliation shown (negligent); Rule 37(e)(2) intent not established; jury will be told BrandTotal failed to preserve and may infer adverse facts if intentional; 75% of sanctions-motion fees awarded to Meta |
| Exclusion of/relief for Dor’s prior deposition testimony | Meta: Dor gave false 30(b)(6) testimony about ASV not transmitting tokens; seek to bar reliance on his testimony | BrandTotal: testimony not central to MSJ; could be mistake or misunderstanding; impeachment possible at trial | Court: declined to preclude Dor’s testimony now; left to impeachment/credibility at trial; no present sanction barring use |
| Enforceability of §3.2.3 of Facebook TOS (public policy / unconscionability defense) | Meta: TOS enforceable; protects platform and users; section survives termination | BrandTotal: clause violates public policy (privacy/competition/free flow of info) and is unconscionable as adhesive and one-sided | Court: BrandTotal failed to show invalidation on public-policy or substantive unconscionability grounds; procedural unconscionability present (adhesion) but not enough to void §3.2.3; BrandTotal’s SJ on unenforceability denied |
| Breach of contract (Meta’s claim) | Meta: BrandTotal breached §3.2.3 via automated collection and use of accounts/tokens | BrandTotal: UpVoice 2021 only collects data from panelists’ machines; some arguments waived | Court: Meta entitled to summary judgment on breach (liability); damages to be determined at trial (nominal damages available) |
| CFAA/CDAFA scope re: UpVoice 2021 and public pages | Meta: automated collection and parsing constitute unauthorized access; seeks statutory relief (CFAA needs ≥$5,000 loss) | BrandTotal: UpVoice 2021 only processes data client-side (user-authorized); public pages are not "without authorization" under Ninth Circuit hiQ; direct access limited or ceased | Court: UpVoice 2021 and access to public (non-password) pages do not violate CFAA/CDAFA; direct server-side access to password-protected pages and legacy active collection after revocation did violate CDAFA (and CFAA if Meta shows ≥$5,000 loss); issues about ongoing server-side use and Restricted Panel Extension remain for trial |
| UCL (unlawful/unfair/fraudulent prongs) | Meta: BrandTotal’s conduct unlawful (CFAA/CDAFA), unfair and fraudulent | BrandTotal: UpVoice 2021 lawful; no deception; no antitrust showing | Held: UCL relief granted to extent underlying CFAA/CDAFA violations proved (legacy active collection and direct password-protected access); UpVoice 2021 does not violate UCL; unfair/fraudulent prongs largely remain for trial except where tied to statutory violations |
| BrandTotal counterclaims (tortious interference / UCL counterclaim) | Meta: communications to Google were legitimate enforcement of rights and in good faith | BrandTotal: Meta acted in bad faith and made false statements to Google to take down UpVoice | Court: Meta entitled to summary judgment on interference and related UCL counterclaim — Meta acted with a legitimate business purpose and in good faith based on contemporaneous investigation and Google’s independent conclusions |
Key Cases Cited
- Chambers v. NASCO, 501 U.S. 32 (court’s inherent authority to sanction)
- Leon v. IDX Sys. Corp., 464 F.3d 951 (9th Cir.) (courts’ inherent sanctioning power for spoliation)
- Residential Funding Corp. v. DeGeorge Fin. Corp., 306 F.3d 99 (2d Cir.) (culpable state of mind for spoliation includes negligence standard discussion)
- Zubulake v. UBS Warburg LLC, 220 F.R.D. 212 (S.D.N.Y.) (spoliation three-part test)
- Van Buren v. United States, 141 S. Ct. 1648 (Supreme Court) (narrow construction of CFAA; focus on hacking)
- hiQ Labs, Inc. v. LinkedIn Corp., 31 F.4th 1180 (9th Cir.) (public-website access not ‘‘without authorization’’ under CFAA)
- Facebook, Inc. v. Power Ventures, Inc., 844 F.3d 1058 (9th Cir.) (continued access after revocation can be unauthorized under CFAA)
- Cel-Tech Commc’ns, Inc. v. L.A. Cellular Tel. Co., 20 Cal.4th 163 (Cal. 1999) (standard for UCL unfairness analysis)
- Sheppard, Mullin, Richter & Hampton, LLP v. J-M Mfg. Co., 6 Cal.5th 59 (Cal. 2018) (public-policy doctrine in contract enforceability)