384 F. Supp. 3d 1043
N.D. Cal.2018Background
- Plaintiffs (consumers from CA, FL, KS, NY, TX) allege Facebook Messenger and Facebook Lite for Android exploited an Android permission-OS vulnerability that allowed Facebook to collect users' call and text logs when users granted contact-list access.
- Plaintiffs contend Facebook incorporated those logs into user profiles and monetized them via advertising and data-sharing agreements.
- Ars Technica reported the practice in March 2018; Facebook allegedly stopped after Android deprecated the vulnerability in October 2017.
- Plaintiffs brought claims including: CLRA, UCL, CDAFA (Cal. Penal Code §502), California constitutional privacy, intrusion upon seclusion, trespass to chattel, New York GBL §349, and unjust enrichment.
- Facebook moved to dismiss all claims: arguing lack of particularized/ concrete injury (standing), that the contact-upload prompt (not pled in the complaint) permitted the collection, and that NY GBL is barred by Facebook’s choice-of-law clause.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Standing (injury in fact) for CDAFA & GBL §349 | Monetization of user data deprived plaintiffs of income; privacy invasion is concrete | Plaintiffs plead only speculative or generalized injuries; CDAFA/GBL require actual economic harm or loss | Plaintiffs lack standing for CDAFA and GBL §349 absent actual individualized injury; those claims dismissed for lack of standing |
| Sufficiency of fraud/omission pleading (Rule 9(b)) | Fraud arises from Facebook’s failure to disclose collection of call/text logs when prompting for contact upload | Complaint omits the operative contact-upload prompt text; plaintiffs fail to plead who/what/when/where/how of any misrepresentation/omission | Dismissal for failure to plead fraud with particularity; plaintiffs given leave to amend to plead prompt or particularized omissions |
| Effect of contact-upload prompt / incorporation by reference & judicial notice | Not necessary in complaint to plead claims; article mention suffices | The prompt (as shown in Ars Technica) negates claims because it disclosed collection/consent; Facebook seeks incorporation/judicial notice | Court refused to accept disputed prompt via incorporation or judicial notice at MTD stage; cannot rely on that prompt to defeat claims without dispute resolved |
| Choice of law re: NY GBL §349 | GBL protects NY consumers; plaintiffs seek statutory remedies | Facebook’s Statement of Rights and Responsibilities selects California law; CA has substantial relation and reasonable basis; no fundamental policy conflict with NY | GBL §349 claim dismissed without leave to amend based on enforceable choice-of-law clause selecting California law |
Key Cases Cited
- Ashcroft v. Iqbal, 556 U.S. 662 (establishes plausibility standard for Rule 8)
- Bell Atlantic v. Twombly, 550 U.S. 544 (pleading must state plausible claim)
- Cooper v. Pickett, 137 F.3d 616 (Rule 9(b) requires who/what/when/where/how for fraud)
- Vess v. Ciba-Geigy Corp. USA, 317 F.3d 1097 (plaintiff must plead why a statement is false or misleading)
- Lujan v. Defenders of Wildlife, 504 U.S. 555 (Article III standing requirements)
- Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (intangible harms can be concrete, but Congress/history matter to standing)
- Khoja v. Orexigen Therapeutics, Inc., 899 F.3d 988 (limits on incorporation-by-reference and judicial notice at pleading stage)
- Van Patten v. Vertical Fitness Group, LLC, 847 F.3d 1037 (clarifies when intangible privacy injuries may be concrete)
- In re Facebook Internet Tracking Litigation, 263 F. Supp. 3d 836 (standing analysis for privacy/data claims against Facebook)