In Re Facebook Privacy Litigation
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
I. INTRODUCTION
Plaintiffs
1
bring this рutative class action against Facebook, Inc. (“Defendant”) alleging violations of the Electronic Communications Privacy Act,
Presently before the Court is Defendant’s Motion to Dismiss. 2 The Court conducted a hearing on March 28, 2011. Based on the papers submitted to date and oral argument, the Court GRANTS in part and DENIES in part Defendant’s Motion to Dismiss.
II. BACKGROUND
In a Consolidated Class Action Complaint 3 filed on October 11, 2010, Plaintiffs allege as follows:
Defendant is a Delaware corporation that maintains its headquarters in Santa Clara County, California. (Complaint ¶ 6.) Defеndant operates the world’s largest social networking website. (Id. ¶ 11.) Defendant allows anyone with access to a computer and Internet connection to register for its services free of charge. (Id. ¶ 12.) One of the few requirements Defendant places on its registrants is that they provide their actual names. (Id. ¶ 13.) Once registered, a user of Defendant’s website may also post personal information to a “profile” webpage. (Id. ¶ 14.)
Each user of Defendant’s website has a user ID number which uniquely identifies that user. (Complaint ¶ 15.) If a person knows the user ID number or “username” of an individual who is a user of Defendant’s website, that person can see the user’s profile webpage and see the user’s real name, gender, picture, and other information. (Id.)
Defendant now “serves more advertisement] impressions than any other online entity.” (Complaint ¶ 18.) Because it possesses personal informationabout its users, Defendant’s advertisers are able to target advertising to users of Defendant’s website. (Id. ¶ 19.) Defendant’s own policies prohibit Defendant from revealing any user’s “true identity” or specific personal information to advertisers. (Id. ¶¶ 20-25.)
When a user of Defendant’s website clicks on an advertisement posted on the website, Defendant sends a “Referrer Header” tо the corresponding advertiser. (Complaint ¶ 28.) This Referrer Header reveals the specific webpage address that the user was looking at prior to clicking on the advertisement. (Id.) Thus, Defendant has caused users’ Internet browsers to send Referrer Header transmissions which report the user ID or username of the user who clicked on an advertisement, as well as information identifying the webpage the user was viewing just prior to clicking on that advertisement. (Id.) Because of this, when an advertiser receives a Referrer Header transmission from Defendant, the advertiser can obtain substantial additional information about a user of Defendant’s website, such as the user’s name, gender and picture. (Id. ¶ 29.) Through these transmissions, Defendant shares users’ personal information with third-party advertisers without users’ knowledge or consent, in violation of Defendant’s own policies. (Id. ¶ 27.)
Defendant began these transmissions no later than February, 2010, and they continued until May 21, 2010. (Complaint ¶¶ 31-33.) Software engineers employed by Defendant knew or should have known that these transmissions would divulge private user information to third-party advertisers. (Id. ¶ 36.) As a result of Defendant’s misconduct, Plaintiffs “suffered injury.” (Id. ¶ 109.)
On the basis of the allegations outlined above, Plaintiffs assert eight causes of action: (1) Violation of the Electronic Communications Privacy Act (“ECPA”),
Presently before the Court is Defendant’s Motion to Dismiss pursuant to Rule 12(b)(1) and Rule 12(b)(6).
III. STANDARDS
A. Lack of Subject Matter Jurisdiction
B. Failure to State a Claim
Pursuant to
However, mere conclusions couched in factual allegations are not sufficient to state a cause of action.
Papasan v. Allain,
FV. DISCUSSION
Defendant moves to dismiss on the grounds that: (1) Plaintiffs fail to allege injury-in-fact that would give them standing to maintain an action in federal court; (2) Plaintiffs fail to state a claim under the Wiretap Act, because they do not allege disclosure of the “contents of a communication”; (3) Plaintiffs fail to state a claim under the Stored Communications Act, because they do not allege disclosure of the “contents of a communication” and because the same conduct cannot be a violation of both the Wiretap Act and the Stored Communications Act; (4) Plaintiffs fail to state a claim under the UCL because they lack standing, since they have -not alleged that they have lost money or property; (5) Plaintiffs fail to state a claim under
Plaintiffs respond that: (1) Plaintiffs have alleged a violation of their statutory rights, which is a sufficient allegation of injury-in-fact to give them standing; (2)
A. Injury-in-Fact
At issue is whether Plaintiffs have alleged injury-in-fact sufficiently to establish standing.
To satisfy the standing requirements of Article III, a plaintiff must show that he has suffered an “injury in fact” that is (a) concrete and particularized and (b) actual or imminent, not conjectural or hypothetical.
Gest v. Bradbury,
Here, Plaintiffs allege as follows:
From at least February 2010, and until May 21, 2010, Defendant transmitted to advertisers communications which disclosed both users’ identities and the URL of the webpage the user was viewing when that user clicked on an advertisement. (Complaint ¶¶ 31-33.) By divulging user identities and other user information to advertisers without user consent, Defendant intentionally violated, inter alia,18 U.S.C. § 2511(3)(a) .(Id. ¶ 57.) Both Plaintiffs were registered users of Defendant’s services during the relevant time period. (Id. ¶¶ 4, 5.) Both Plaintiffs clicked on at least one third-party advertisement displayed on Defendant’s website during the relevant time period. (Id.)
Based on the allegations above, and without addressing the merits of the claim, the Court finds that Plaintiffs allege a violation of their statutory rights under the Wiretap Act,
Defendant’s contention that at the pleading stage of a class action, each individual plaintiff must include allegations sufficient to establish injury-in-fact as to each of them is mistaken. (Motion at 6-7.) In Hepting v. AT & T Corp., 6 the court rejected a similar argument. In Hepting, the court considered allegations that the defendant had “created a dragnet” which collected the contents of its customer’s communications. Id. at 1000. The court found that it would be impossible for “any one plaintiff [to] have failеd to demonstrate injury-in-fact if that plaintiff effectively demonstrates that all class members have so suffered.” Id. The court held that the mere fact that the named plaintiffs each alleged that they were the defendant’s “customers during the relevant time period” was sufficient to establish that the defendant’s alleged conduct “would have imparted a concrete injury on each of them.” Id. Similarly, if Plaintiffs here are able to show that Defendant transmitted the contents of its users’ communications in the manner alleged, they will have effectively demonstrated that all of the users of Defendant’s website suffered the same injury, which will necessаrily mean that each individual Plaintiff will have demonstrated that he was injured.
Accordingly, the Court DENIES Defendant’s Motion to Dismiss on the ground that Plaintiffs have failed to allege injury-in-fact sufficient to establish standing.
B. Wiretap Act
At issue is whether Plaintiffs state a claim under the Wiretap Act.
The Wiretap Act states that an entity “providing an electronic communication service to the public shall not intentionally divulge the contents of any communication (other than one to such entity, or an agent thereof) while in transmission on that service to any person or entity other than an addressee or intended recipient of such communication or an agent of suсh addressee or intended recipient.”
Here, Plaintiffs allege as follows:
When a user of Defendant’s website clicks on an advertisement banner displayed on that website, the user is asking Defendant to send an electronic communication to the advertiser who supplied the advertisement. (Complaint ¶ 56.) However, users do not expect and do not consent to Defendant’s disclosure of all contents of that communication. (Id.) Users expect that certain aspects of their communications concerning advertisers — namely, their identities and the webpage they were viewing at the time they clicked on an advertisement — will be configured by Defendаnt to be private. (Id.)
Based on the allegations above, the Court finds that there are two possible ways to understand Plaintiffs’ allegations. On the first view, Plaintiffs allege that when a user of Defendant’s website clicks on an advertisement banner displayed on that website, that click constitutes an electronic communication from the user to Defendant. 7 Under this interpretation, the content of the user’s communication with Defendant is a request that Defendant “send [a further] electronic communication to [an] advertiser.” On the second view, Plaintiffs allege that when a user of Defendant’s website clicks on an advertisement banner, that сlick constitutes an electronic communication from the user to the advertiser. Under this interpretation, Plaintiffs are merely “asking Defendant” to pass the communication along to its intended recipient, who is the advertiser.
The Court finds that as a matter of law, Plaintiffs cannot state a claim under the Wiretap Act under either interpretation. Under the first interpretation, the communication is sent from the user to Defendant. However, the Wiretap Act states that an “entity providing an electronic communication service to the public shall not intentionally divulge the contents of any communication
(other than one to such person or entity, or an agent thereof)
...”
Accordingly, the Court GRANTS Defendant’s Motion to Dismiss Plaintiffs’ Cause of Action under the Wiretap Act without prejudice, with leave to amend to allege specific facts showing that the information allegedly disclosed by Defendant was not part of a сommunication from Plaintiffs to an addressee or intended recipient of that communication, if so desired.
C. Stored Communications Act
At issue is whether Plaintiffs state a claim under the Stored Communications Act.
Under the Stored Communications Act, an entity providing an electronic communication service to the public “shall not knowingly divulge to any person or entity the contents of a communication while in electronic storage by that service.”
As discussed previously, Plaintiffs either allege that the communications at issue were sent to Defendant or to advertisers. Under either interpretation, Plaintiffs fail to state a claim under the Stored Communications Act. If the communications were sent to Defendant, then Defendant was their “addressee or intended recipient,” and thus was permitted to divulge the communications to advertisers so long as it had its own “lawful consent” to do so.
8
Accordingly, the Court GRANTS Defendant’s Motion to Dismiss Plaintiffs’ Cause of Action under the Stored Communications Act without prejudice, with leave to amend to allege specific facts showing that the information allegedly disclosed by Defendant was not part of a communication frоm Plaintiffs to an addressee or intended recipient of that communication, if so desired.
D. UCL
At issue is whether Plaintiffs state a claim for violation of the UCL.
To assert a UCL claim, a private plaintiff needs to have “suffered injury in fact and ... lost money or property as a result of the unfair competition.”
Rubio v. Capital One Bank,
Here, Plaintiffs do not allege that they lost money as a result of Defendant’s conduct. Instead, Plaintiffs allege that Defendant unlawfully shared their “personally identifiable information” with third-party advertisers. (Complaint ¶¶ 1-3.) However, personal information does not constitute property for purposes of a UCL claim.
Thompson,
Plaintiffs’ reliance on
Doe 1 v. AOL, LLC
9
is misplaced. In
AOL,
the court considered claims under the UCL brought by plaintiffs whose personal and financial information had been disclosed to the public by an Internet service provider.
Id.
at 1111. Significantly, the
AOL
court found that the defendant’s “disclosure of mem
Accordingly, the Court GRANTS Defendаnt’s Motion to Dismiss Plaintiffs’ Cause of Action under the UCL with prejudice.
E.
At issue is whether Plaintiffs state a claim under
In a recent case, this Court considered the meaning of the term “without permission” in
Here, Plaintiffs’ allegations under those subsections of
Accordingly, the Court GRANTS Defendant’s Motion to Dismiss Plaintiffs’ Cause of Action under
F. CLRA
At issue is whether Plaintiffs state a claim under the CLRA.
The CLRA provides protection to a specific category of consumers from damages suffered in connection with a сonsumer transaction.
Robinson v. HSBC Bank USA
Here, Plaintiffs allege that Defendant “allows anyone ... to register for its services free of charge.” (Complaint ¶ 12.) As discussed previously, Plaintiffs’ contention that their personal information constitutes a form of “payment” to Defendant is unsupported by law. Since it is not possible for Plaintiffs to state a claim pursuant to the CLRA under Plaintiffs’ own allegations, the Court dismisses Plaintiffs’ CLRA claim with prejudice.
Accordingly, the Court GRANTS Dеfendants’ Motion to Dismiss Plaintiffs’ Cause of Action under the CLRA with prejudice.
G. Breach of Contract
At issue is whether Plaintiffs state a claim for breach of contract.
Under California law, to state a cause of action for breach of contract a plaintiff must plead: “the contract, plaintiffs’ performance (or excuse for nonperformance), defendant’s breach, and damage to plaintiff therefrom.”
Gautier v. General Tel. Co.,
Here, in regard to damages, Plaintiffs allege only that as a result of the alleged breach of contract, Plaintiffs “suffered injury.” (Complaint ¶ 109.) However, Plaintiffs fail to allege any actual damages in their Complaint. Thus, under California law Plaintiffs fail to state a claim for breach of contract.
Accordingly, the Court GRANTS Defendant’s Motion to Dismiss Plaintiffs’ Cause of Action for breach of contract, with leave to amend to allege specific facts showing appreciable and actual damages in support of their claim, if so desired.
H.
At issue is whether Plaintiffs state a claim under
Here, Plaintiffs fail to allege that they relied upon any allegedly fraudulent misrepresentations by Defendant. Thus, under California law Plaintiffs fail to state a claim for fraud under either
Accordingly, the Court GRANTS Defendant’s Motion to Dismiss Plaintiffs’ Cause of Action under
At issue is whether Plaintiffs are entitled to stаte a claim for unjust enrichment in the alternative, given that they allege breach of an express contract.
Under California law, unjust enrichment is an action in quasi-contract.
Gerlinger v. Amazon.Com, Inc.,
Here, Plaintiffs allege that they assented to Defendant’s “Terms and Conditions and Privacy Policy,” and that the provisions of this Policy “constitute a valid and enforceable contract” between Plaintiffs and Defendant. (Complaint ¶¶ 101, 102.) Because Plaintiffs allege that an express contract existed between themselves and Defendant, they cannot also assert an unjust enrichment claim.
Gerlinger,
Accordingly, the Court GRANTS Defendant’s Motion to Dismiss Plaintiffs’ Cause of Action for unjust enrichment with prejudice.
V. CONCLUSION
The Court GRANTS in part and DENIES in part Defendant’s Motion to Dismiss as follows:
(1) The Court DENIES Defendant’s Motion to Dismiss on the ground that Plaintiffs laсk standing under Article III;
(2) The Court GRANTS Defendant’s Motion to Dismiss Plaintiffs’ Cause of Action under the Wiretap Act with leave to amend;
(3) The Court GRANTS Defendant’s Motion to Dismiss Plaintiffs’ Cause of Action under the Stored Communications Act with leave to amend;
(4) The Court GRANTS Defendant’s Motion to Dismiss Plaintiffs’ Cause of Action under the UCL with prejudice;
(5) The Court GRANTS Defendant’s Motion to Dismiss Plaintiffs’ Cause of Action underCal.Penal Code §§ 502(c)(1) , (2), (3), (6), & (7) with prejudice, and as to§ 502(c)(8) with leave to amend;
(6) The Court GRANTS Defendant’s Motion to Dismiss Plaintiffs’ Cause of Action under the CLRA with prejudice;
(7) The Court GRANTS Defendant’s Motion to Dismiss Plaintiffs’ Cause of Action for breach of contract with leave to amend;
(8) The Court GRANTS Defendant’s Motion to Dismiss Plaintiffs’ Cause of Action underCal. Civ.Code §§ 1572 , 1573 with leave to amend; and
(9) The Court GRANTS Defendant’s Motion to Dismiss Plaintiffs’ Cause of Action for unjust enrichment with prejudice.
Notes
.Named Plaintiffs are David Gould and Mike Robertson, both of whom are residents of California who have been registered users of Defendant's services since at least 2008.
. (See Defendant's Motion to Dismiss Consolidated Class Action Complaint, hereafter, "Motion,'' Docket Item No. 75.)
. (Consolidated Class Action Complaint, hereafter, "Complaint,” Docket Item No. 36.)
. Plaintiffs do not distinguish between their claims under Title I of the ECPA (the Wiretap Act) and Title II of the ECPA (the Stored Communications Act). (See Plaintiffs’ Opposition to Facebook’s Motion to Dismiss Consolidated Class Action Complaint 11-17, hereafter, “Opp’n,” Docket Item No. 86.) Instead, Plaintiffs appear to assume that the same allegations suffice to state a claim under both the Wiretap Act and the Stored Communications Act. (See id. at 11.)
. A plaintiff may satisfy the injury-in-fact requirements to have standing under Article III, and thus may be able to "bring a civil action without suffering dismissal for want of standing to sue,” without being able to assert a cause of action successfully.
See Doe v. Chao,
.
. This interpretation is embraced by Plaintiffs themselves in their Opposition, though the Consolidated Class Action Complaint itself is ambiguous on this point. (See Opp'n at 11-12, 16.)
. Plaintiffs do not contend that Defendant would .be unable to give itself "lawful consent” to divulge Plaintiffs' communications to Defendant. In similar situations, courts have held that a defendant cannot be liable under the Stored Communications Act for disclosing communications where the defendant was itself the "addressee or intended recipient” of those communications.
See, e.g., In re Am. Airlines, Inc., Privacy Litig.,
.
. Plaintiffs further contend that personal information itself: (1) "constitutes currency”; and (2) is a form of property.
(See
Opp'n at 6-11.) However, Plaintiffs offer no caselaw in support of these propositions. As another court has noted when confronted with a similar claim: "Nor has [the plaintiff] presented any authority to support the contention that unauthorized release of personal information constitutes a loss of property. Without any such authority, thе Court is constrained to find that [the plaintiff] has not alleged any loss of property and therefore has not stated a valid claim under [the UCL].”
Ruiz v. Gap, Inc.,
. Plaintiffs also allege a violation of
... any set of computer instructions that are designed to modify, damage, destroy, record, or transmit information within a computer, computer system, or computer network without the intent or permission of the owner of the information. They include, but are not limited to, a group of comрuter instructions commonly called viruses or worms, that are self-replicating or self-propagating and are designed to contaminate other computer programs or computer data, consume computer resources, modify, destroy, record, or transmit data, or in some other fashion usurp the normal operation of the computer, computer system, or computer network.
Plaintiffs do not allege any facts suggesting that Defendant introduced computer instructions designed to "usurp the normal operation” of a computer, computer system or computer network. Thus, under California law Plaintiffs fail to state a claim under
. Any allegations of fraud must be pleaded with particularity.
See