`
`
`
`Mark N. Todzo (California Bar No. 168389)
`LEXINGTON LAW GROUP
`503 Divisadero Street
`San Francisco, CA 94117
`Telephone: 415-913-7800
`Facsimile: 415-759-4112
`mtodzo@lexlawgroup.com
`
`Christian Levis (pro hac vice forthcoming)
`Amanda Fiorilla (pro hac vice forthcoming)
`LOWEY DANNENBERG, P.C.
`44 South Broadway, Suite 1100
`White Plains, NY 10601
`Telephone: (914) 997-0500
`Facsimile: (914) 997-0035
`clevis@lowey.com
`afiorilla@lowey.com
`
`Anthony M. Christina (pro hac vice forthcoming)
`LOWEY DANNENBERG, P.C.
`One Tower Bridge
`100 Front Street, Suite 520
`West Conshohocken, PA 19428
`Telephone: (215) 399-4770
`Facsimile: (914) 997-0035
`achristina@lowey.com
`
`Attorneys for Plaintiff Brittany Conditi
`
`
`UNITED STATES DISTRICT COURT
`
`NORTHERN DISTRICT OF CALIFORNIA
`
`SAN FRANCISCO / OAKLAND DIVISION
`
`
`
`BRITTANY CONDITI, individually and on
`behalf of all others similarly situated,
`
`
`Plaintiff,
`
`v.
`
`
`INSTAGRAM, LLC, a Delaware limited
`liability company, and FACEBOOK, INC., a
`Delaware corporation,
`
`
`Defendants.
`
`Case No.: ______________
`
`
`CLASS ACTION COMPLAINT
`
`JURY TRIAL DEMANDED
`
`
`CLASS ACTION COMPLAINT AND DEMAND FOR JURY TRIAL
`CASE NO. ____________
`
`1 2 3 4 5 6 7 8 9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`
`
`Case 3:20-cv-06534-AGT Document 1 Filed 09/17/20 Page 2 of 36
`
`
`
`Plaintiff Brittany Conditi, individually and on behalf of all others similarly situated, asserts
`
`the following against Defendants Instagram, LLC (“Instagram”) and Facebook, Inc. (“Facebook”)
`(collectively “Defendants”), based upon personal knowledge, where applicable, information and
`
`belief, and the investigation of counsel.
`
`SUMMARY OF ALLEGATIONS
`
`1.
`
`Instagram is a popular social media platform, wholly owned by Facebook, with
`
`approximately one billion annual active users.
`
`2.
`
`Instagram’s focus as a social media platform is based on allowing users to share
`
`photographs and videos with one another. Originally, users were only able to post photographs or
`
`videos to their Instagram “Feed,” which is a permanent collection of users’ content that others can
`interact with by viewing, commenting, or liking. In August 2016, Instagram launched “Stories,” a
`
`feature where users can post photographs or videos that disappear from view within a 24-hour
`
`period.
`
`3.
`
`As a social media platform that allows users to post photographs and videos,
`
`Instagram has access to a user’s smartphone camera for the limited purpose of allowing users to
`
`directly take a photograph or video and then post that content to its platform.
`
`4.
`
`Instagram claims to only access users’ smartphone cameras with user permission,
`such as when a user is interacting with the Instagram application’s (also referred to as an “app”)
`
`camera feature.
`
`5.
`
`For example, Instagram recently released a statement saying “[Instagram] only
`access[es] your camera when you tell us to—for example, when you swipe from Feed to Camera.”
`Instagram claims when its camera feature is not used, it does not access users’ smartphone cameras.1
`
`6.
`
`However, Instagram does more than it claims. Instagram is constantly accessing
`
`users’ smartphone camera feature while the app is open and monitors users without permission, i.e.,
`
`
`1
`Filipe Esposito, Instagram Promises to Fix Bug After Being Exposed By Always Accessing
`the Camera on iOS 14, 9TO5MAC, (July 25, 2020), https://9to5mac.com/2020/07/25/instagram-
`promises-to-fix-bug-after-being-exposed-by-always-accessing-the-camera-on-ios-14/.
`
`1
`CLASS ACTION COMPLAINT AND DEMAND FOR JURY TRIAL
`CASE NO. ____________
`
`1 2 3 4 5 6 7 8 9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`
`
`Case 3:20-cv-06534-AGT Document 1 Filed 09/17/20 Page 3 of 36
`
`
`
`when users are not interacting with Instagram’s camera feature.
`
`7.
`
`This access goes beyond the services that Instagram promises to provide. Instagram
`
`has no legitimate reason for accessing users’ smartphone cameras when they are not using the
`
`Instagram camera feature.
`
`8.
`
`By doing so, Defendants have been able to monitor users’ most intimate moments,
`
`including those in the privacy of their own homes, in addition to collecting valuable insight and
`
`market research on its users.
`
`9.
`
`Defendants engage in this conduct for one main reason: to collect lucrative and
`
`valuable data on its users that it would not otherwise have access to. By obtaining extremely private
`
`and intimate personal data on their users, including in the privacy of their own homes, Defendants
`
`are able to increase their advertising revenue by targeting users more than ever before. For example,
`
`Defendants are able to see in-real time how users respond to advertisements on Instagram, providing
`
`extremely valuable information to its advertisers.
`
`10.
`
`The full extent and scope of Defendants’ conduct is only just beginning to come to
`light as a result of an update to the Apple Inc.’s (“Apple”) iPhone operating system, which provides
`
`notice to consumers when third parties are accessing their camera and microphone or collecting their
`
`data. The update to iPhone’s operating system was only made available to developers on June 22,
`
`2020, and to the general public on July 9, 2020.
`
`11.
`
`Defendants’ conduct constitutes an egregious violation of Plaintiff’s and Class
`members’ privacy rights, as established through California’s privacy laws. In addition, Defendants’
`
`actions constitute violations of the common law as well as several state and federal laws.
`
`JURISDICTION AND VENUE
`
`12.
`
`This Court has jurisdiction over the subject matter of this action pursuant to 28 U.S.C
`
`§ 1332(d), because the amount in controversy for the Class exceeds $5,000,000 exclusive of interest
`
`and costs, there are more than 100 putative class members, and minimal diversity exists because a
`
`significant portion of putative class members are citizens of a state different from the citizenship of
`
`Defendants.
`
`2
`CLASS ACTION COMPLAINT AND DEMAND FOR JURY TRIAL
`CASE NO. ____________
`
`1 2 3 4 5 6 7 8 9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`
`
`Case 3:20-cv-06534-AGT Document 1 Filed 09/17/20 Page 4 of 36
`
`
`
`13.
`
`This Court has general personal jurisdiction over Defendants because their principal
`
`place of business is in California. Additionally, Defendants are subject to specific personal
`
`jurisdiction in California because a substantial part of the events and conduct giving rise to
`
`Plaintiff’s claims occurred in California.
`
`14.
`
`Venue is proper in this District pursuant to 28 U.S.C. § 1391(b) because a substantial
`
`portion of the conduct described in this Complaint was carried out in this District. Furthermore,
`
`Defendants Instagram, LLC and Facebook, Inc. are headquartered in this District and subject to
`
`personal jurisdiction in this District.
`
`15.
`
`Intra-district Assignment (L.R. 3-2(c) and (e) and 3-5(b)): This action arises in
`
`San Mateo County, in that a substantial part of the events which give rise to the claims asserted
`
`herein occurred in San Mateo County. Pursuant to L.R. 3-2(e), all civil actions that arise in San
`
`Mateo County shall be assigned to either the San Francisco Division or Oakland Division.
`
`A.
`
`16.
`
`Plaintiff
`Plaintiff Brittany Conditi (“Plaintiff”) is a natural person and citizen of the State of
`
`PARTIES
`
`New Jersey and a resident of Bergen County.
`
`17.
`
`Plaintiff downloaded the Instagram application to her smartphone and regularly uses
`
`Instagram, including during intimate moments in private places. For example, on a routine basis
`
`Plaintiff uses her smartphone and the Instagram app while she is in her bedroom.
`
`18. Without her consent, Instagram secretly accessed Plaintiff’s smartphone camera and
`monitored Plaintiff—beyond the scope of any of the services that Instagram provides and while the
`Instagram camera feature was not in use—including in the privacy of her own home.
`
`B.
`
`19.
`
`Defendants
`
`Defendant Instagram, LLC is a limited liability company, organized and existing
`
`under the laws of the State of Delaware, with its principal place of business located at 1601 Willow
`
`Road, Menlo Park, CA 94025.
`
`3
`CLASS ACTION COMPLAINT AND DEMAND FOR JURY TRIAL
`CASE NO. ____________
`
`1 2 3 4 5 6 7 8 9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`
`
`Case 3:20-cv-06534-AGT Document 1 Filed 09/17/20 Page 5 of 36
`
`
`
`20.
`
`Defendant Facebook, Inc. is the parent company of Instagram, LLC. Defendant
`
`Facebook, Inc. is a corporation, incorporated and existing under the laws of the State of Delaware,
`
`with its principal place of business located at 1601 Willow Road, Menlo Park, California 94025.
`
`21.
`
`Defendant Instagram is a wholly owned subsidiary of Defendant Facebook, Inc.
`
`Instagram is considered a “Facebook Product” and is provided to users “[b]y Facebook, Inc.”2 Both
`
`Instagram and Facebook “share technology, systems, insights, and information-including
`
`information [they] have about [users].”3
`
`FACTUAL BACKGROUND
`
`
`
`The History of Facebook and Instagram
`
`22.
`
`Facebook which was founded in 2004 by Mark Zuckerberg, Eduardo Saverin, Dustin
`
`Moskovitz, and Chris Hughes, first began as a new social media platform directed towards college
`
`students. By the end of the following year, Facebook had amassed over six million users.
`
`23.
`
`In 2006, Facebook expanded its membership from college students to anyone over
`
`the age of thirteen. Four years later, Facebook had not only surpassed “Myspace” as the most popular
`
`and most visited, social media platform, but it had also accomplished the difficult task of having
`
`over 400 million active users. To date, Facebook reports over 2.6 billion active users.
`
`24.
`
`Facebook’s rise to becoming the most popular social media platform in the United
`
`States was no small feat. During the process, and to maintain its dominance in the market, Facebook
`
`acquired several other social media platforms and other apps to boost its portfolio. Some of
`
`Facebook’s most popular acquisitions have included “WhatsApp” and “Instagram.”
`
`25.
`
`Instagram was launched as a social media platform in 2010 by Kevin Systrom. On
`
`the day the app launched it was downloaded over 25,000 times. A few short months later, Instagram
`
`surpassed one million active users. To date, Instagram has over one billion active annual users.
`
`
`2
`Terms of Use, INSTAGRAM, https://help.instagram.com/581066165581870 (last visited July
`30, 2020).
`3
`Id.
`
`4
`CLASS ACTION COMPLAINT AND DEMAND FOR JURY TRIAL
`CASE NO. ____________
`
`1 2 3 4 5 6 7 8 9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`
`
`Case 3:20-cv-06534-AGT Document 1 Filed 09/17/20 Page 6 of 36
`
`
`
`26.
`
`Due to Instagram’s ever-increasing user base, Instagram began to garner attention
`
`from larger technology companies, such as Facebook, Twitter, and Benchmark Capital. After
`
`denying an offer to be bought-out by Twitter, Facebook eventually acquired Instagram for one
`
`billion dollars in 2012.
`
`27.
`
`Instagram has become a large part of Facebook’s overall revenue stream. For
`
`example, in 2019, Instagram brought in over $20 billion in advertising revenue, accounting for more
`
`than a quarter of Facebook’s total revenue that year.
`
`28. With access to so many users, Defendants have claimed to value full transparency
`
`and to respect user’s privacy. For example, Mark Zuckerberg claimed in an open letter while
`“Facebook and Instagram have helped people connect with friends, communities, and interests . . .
`people increasingly also want to connect privately.”4
`To that end, Mark Zuckerberg promised to build a “privacy-focused platform” and
`claimed to have “worked hard to build privacy into all our products, including those for public
`sharing.”5 These empty promises have not been fulfilled.
`
`29.
`
`30.
`
`As alleged herein, Defendants took advantage of Plaintiff and Class members by
`
`secretly accessing their smartphone cameras to monitor users beyond the scope of any services that
`
`Defendants agreed to provide, i.e., when users were not interacting with the Instagram camera
`
`feature.
`
`31.
`
`As a result, Defendants have been able to secretly spy on users, including Plaintiff
`
`and Class members, during intimate moments and in private places, such as their bedroom, to gather
`
`lucrative data to increase its advertising revenue.
`
`
`
`Instagram Watches Users Through Their Smartphone Cameras
`
`32.
`
`On July 25, 2020, reports emerged for the first time that Instagram was secretly
`
`
`4
`Mark Zuckerberg, A Privacy-Focused Vision for Social Networking, FACEBOOK, (Mar. 6,
`https://www.facebook.com/notes/mark-zuckerberg/a-privacy-focused-vision-for-social-
`2019),
`networking/10156700570096634/.
`5
`Id.
`
`5
`CLASS ACTION COMPLAINT AND DEMAND FOR JURY TRIAL
`CASE NO. ____________
`
`1 2 3 4 5 6 7 8 9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`
`
`Case 3:20-cv-06534-AGT Document 1 Filed 09/17/20 Page 7 of 36
`
`
`
`accessing and spying on users through their smartphone camera without their consent.
`
`33.
`
`Users were able to discover that Instagram was secretly monitoring them through a
`
`new update to Apple’s smartphone operating system.
`Apple’s latest operating system (“iOS”) update has been declared a “game-changer”
`
`34.
`
`by Forbes, specifically because it allows users to see exactly how companies access and use their
`
`personal information.6
`
`35.
`
`Apple released iOS 14 to developers on June 22, 2020, and the general public on July
`
`9, 2020. Among other things, the update allows users to see which applications are accessing their
`
`camera or microphone, which reportedly “exposed” Instagram’s conduct.
`The update informs users by a green “camera on” indicator that companies, such as
`
`36.
`
`Instagram, are monitoring them through their camera. Instagram users were notified by the green
`
`“camera on” indicator that Instagram was accessing, and monitoring them through, their cameras
`while they were not using Instagram’s camera feature and for reasons beyond any “service” that
`
`Instagram claims to provide.
`
`37.
`
`Instagram is not the only company who has been caught spying on users as a result
`
`of Apple’s latest update. TikTok, LinkedIn, and Reddit all face scrutiny for copying user’s clipboard
`
`information after Apple began providing similar notifications whenever this occurred.
`
`38.
`
`In a statement, Instagram claimed to “only access your camera when you tell us to—
`for example when you swipe from Feed to Camera.”7 Instagram’s data policy provides similar
`
`assurances about the services it does, and does not, provide, and when it collects information and
`
`data.
`
`39.
`
`Instagram’s data policy states that it can collect information, such as “what you see
`
`Davey Winder, Apple iOS 14 Exposes Microsoft’s LinkedIn App Reading Clipboard Data,
`6
`FORBES, (July 4, 2020), https://www.forbes.com/sites/daveywinder/2020/07/04/apple-ios-14-
`catches-microsofts-linkedin-spying-on-clipboard-tiktok-apps-privacy-iphone-ipad-
`macbook/#10c5380f5896.
`Kim Lyons, An Instagram bug showed a ‘camera on’ indicator for iOIS 14 devices even
`7
`when
`users
`weren’t
`taking
`photos,
`THE
`VERGE,
`(July
`25,
`2020),
`https://www.theverge.com/2020/7/25/21338151/instagram-bug-camera-privacy-ios14-apple.
`
`6
`CLASS ACTION COMPLAINT AND DEMAND FOR JURY TRIAL
`CASE NO. ____________
`
`1 2 3 4 5 6 7 8 9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`
`
`Case 3:20-cv-06534-AGT Document 1 Filed 09/17/20 Page 8 of 36
`
`
`
`through features we provide, such as our camera, so [Instagram] can do things like suggest masks
`
`and filters that you might like, or give you tips on using camera formats.”8 Instagram discloses that
`it collects “information about how you use features like our camera.”9
`However, nowhere in Instagram’s data policy does it disclose that, when users are
`not using its camera feature, Instagram is secretly accessing users’ smartphone camera to monitor
`
`40.
`
`individuals, such as Plaintiff. This is beyond the scope of services that Instagram provides and
`
`Instagram has no legitimate reason to access users’ smartphone cameras while they are not
`interacting with Instagram’s camera feature.
` Instagram’s conduct in secretly monitoring users constitutes an egregious violation
`
`41.
`
`of their privacy rights, especially because many users, including Plaintiff, were monitored in the
`
`privacy of their own home.
`
`42.
`
`Defendants abused their ability to access users’ smartphone cameras, and committed
`
`egregious privacy violations, for one specific reason: to increase their advertising revenue. By
`
`obtaining extremely private and intimate personal data on their users, including in the privacy of
`
`their own home, Defendants are able to target users more than ever before.
`
`43.
`
`Facebook has acknowledged the impact that Apple’s update to its operating system
`
`will pose to its potential advertising revenue, which it earns through its extensive data collection.
`
`Since Apple began rolling out its latest operating system update, which gives users unprecedented
`
`control over their own data, Facebook has begun meeting with its most notable advertising partners
`
`to discuss its potential repercussions.
`
`44.
`
`Apple’s Chief Financial Officer, David Wehner, told CNBC that it believes Apple’s
`update will “make it harder for app developers and others to grow ads on Facebook and
`
`
`8
`Data Policy, INSTAGRAM,
`https://help.instagram.com/519522125107875?helpref=page_content (last visited July 30, 2020).
`9
`Id.
`
`7
`CLASS ACTION COMPLAINT AND DEMAND FOR JURY TRIAL
`CASE NO. ____________
`
`1 2 3 4 5 6 7 8 9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`
`
`Case 3:20-cv-06534-AGT Document 1 Filed 09/17/20 Page 9 of 36
`
`
`
`elsewhere.”10 Considering that Instagram’s advertising revenue constitutes a significant part of
`Facebook’s overall revenue, it’s not surprising the lengths they would go in pursuit of obtaining
`users’ data for advertising purposes, regardless of the privacy violations they commit in the process.
`
`
`
`Instagram Does Not Obtain Consent or Disclose That it Monitors Users
`Instagram does not obtain users’ consent to access their smartphone cameras while
`users are not interacting with Instagram’s camera feature.
`Nowhere in Instagram’s data policy does it disclose that it (1) accesses users’
`
`45.
`
`46.
`
`smartphone camera while the Instagram camera feature is not in use; or (2) obtain consent to do so.
`
`47.
`
`Nor could it. Instagram has no legitimate purpose for accessing users’ smartphone
`cameras while they are not using Instagram’s services, i.e., accessing Instagram’s camera feature.
`Since this is not a part of any services that Instagram provides, and Instagram claims to “only access
`your camera when you tell us to,” users could in no way consent to this conduct.
`Rather, Instagram has claimed this was simply a “mistake” because of “a bug in iOS
`14 Beta that [ ] indicates that some people are using the camera when they aren’t.”11 iOS is Apple’s
`proprietary operating system. Apple has not acknowledged that there is any “bug” in its software
`
`48.
`
`that would affect the operation of Instagram.
`
`49.
`
`Tellingly, Facebook came under similar scrutiny for also accessing users’
`smartphone cameras last year. Users reported that the camera for “Facebook Stories,” similar to
`
`Instagram Stories, would open in the background while they were watching videos or viewing
`
`pictures on Facebook.
`
`50.
`
`Similar to Instagram, Facebook claimed this was a “bug” and entirely inadvertent.12
`
`
`10
`Filipe Esposito, Facebook raises concerns that iOS 14 could harm its ad business,
`9TO5MAC, (July 30, 2020), https://9to5mac.com/2020/07/30/facebook-raises-concerns-that-ios-14-
`could-harm-its-ad-business/.
`11
`Kim Lyons, supra note 9.
`Jay Peters, Facebook’s iOS app might be opening the camera in the background without
`12
`your
`knowledge,
`THE
`VERGE
`(Nov.
`12,
`2019),
`https://www.theverge.com/2019/11/12/20961332/facebooks-ios-app-reportedly-camera-
`background-security.
`
`8
`CLASS ACTION COMPLAINT AND DEMAND FOR JURY TRIAL
`CASE NO. ____________
`
`1 2 3 4 5 6 7 8 9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`
`
`Case 3:20-cv-06534-AGT Document 1 Filed 09/17/20 Page 10 of 36
`
`
`
`Notably, neither company came forward about these “bugs” until after users discovered what they
`were doing through Apple’s update to its operating system.
`
`51.
`
`As Instagram denies that it monitors users while its camera function is not in use,
`
`this is not listed as one of the services Instagram promises to provide its users nor is it listed as one
`
`of the ways Instagram collects user data.
`
`52.
`
`Similarly, since Instagram does not disclose this practice, there is no way for users
`
`to provide consent to be monitored through their smartphone camera while they are not engaging
`
`with Instagram’s camera function.
`
`
`
`Instagram’s Conduct Violates the California Consumer Privacy Act
` The California Consumer Privacy Act (“CCPA”) protects consumers’ personal
`53.
`
`information from collection and use by businesses without providing proper notice and obtaining
`
`consent.
`
`54.
`
`Instagram and Facebook are required to comply with the CCPA because they
`
`individually earn more than $25 million in annual gross revenue. Additionally, the CCPA applies to
`
`Defendants because they buy, sell, receive, or share, for commercial purposes, the personal
`
`information of more than 50,000 consumers, households, or devices.
`
`55.
`
`The CCPA requires that a business who collects consumer’s personal information,
`such as Defendants, disclose either “at or before the point of collection . . . the categories of personal
`
`information to be collected and the purposes for which the categories of personal information shall
`
`be used. See Cal. Civ Code § 1798.100(b).
`
`56.
`
`Furthermore, “[a] business shall not collect additional categories of personal
`
`information or use personal information collected for additional purposes without providing the
`
`consumer with notice consistent with this section.” See id.
`
`57.
`
`Defendants violated the CCPA by failing to disclose that it monitors users through
`
`their smartphone camera, while it’s not in use, to collect personal information. Instagram only
`
`9
`CLASS ACTION COMPLAINT AND DEMAND FOR JURY TRIAL
`CASE NO. ____________
`
`1 2 3 4 5 6 7 8 9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`
`
`Case 3:20-cv-06534-AGT Document 1 Filed 09/17/20 Page 11 of 36
`
`
`
`discloses that it collects “information about how you use features like our camera.”13 Since users
`were not interacting with Instagram’s camera feature at the time they were monitored, and
`
`Defendants failed to disclose its conduct, Defendants violated the CCPA.
`
`
`
`Instagram Users Have a Reasonable Expectation of Privacy
`
`58.
`
` Plaintiff and Class members have a reasonable expectation of privacy not to be
`
`watched and monitored without their permission. This expectation of privacy is deeply enshrined in
`
`California’s Constitution.
`Article I, section 1 of the California Constitution provides: “All people are by nature
`
`59.
`
`free and independent and have inalienable rights. Among these are enjoying and defending life and
`
`liberty, acquiring, possessing, and protecting property, and pursuing and obtaining safety,
`
`happiness, and privacy.” Art. I., Sec. 1, Cal. Const. [Emphasis added].
`The phrase “and privacy” was added in 1972 after voters approved a proposed
`
`60.
`
`legislative constitutional amendment designated as Proposition 11. Critically, the argument in favor
`
`of Proposition 11 reveals that the legislative intent was to curb businesses’ control over the
`unauthorized collection and use of consumers’ personal information, stating in relevant part:
`
`
`
`The right of privacy is the right to be left alone . . . It prevents government and
`business interests from collecting and stockpiling unnecessary information about us
`and from misusing information gathered for one purpose in order to serve other
`purposes or to embarrass us.
`
`Fundamental to our privacy is the ability to control circulation of personal
`information. This is essential to social relationships and personal freedom. The
`proliferation of government and business records over which we have no control
`limits our ability to control our personal lives. Often we do not know that these
`records even exist and we are certainly unable to determine who has access to them.14
`
`
`(Emphasis added).
`
`61.
`
`Consistent with this language, an abundance of studies examining the collection of
`
`consumers’ personal data confirms that the surreptitious monitoring of millions of individuals, as
`
`13
`Data Policy, INSTAGRAM,
`https://help.instagram.com/519522125107875?helpref=page_content (last visited Aug. 19, 2020).
`14
`Ballot Pamp., Proposed Amends. to Cal. Const. with arguments to voters, Gen. Elec. (Nov.
`7, 1972) at 27.
`
`10
`CLASS ACTION COMPLAINT AND DEMAND FOR JURY TRIAL
`CASE NO. ____________
`
`1 2 3 4 5 6 7 8 9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`
`
`Case 3:20-cv-06534-AGT Document 1 Filed 09/17/20 Page 12 of 36
`
`
`
`Instagram has done here, violates expectations of privacy that have been established as general
`
`social norms. Privacy polls and studies uniformly show that the overwhelming majority of
`
`Americans consider one of the most important privacy rights to be the need for an individual’s
`affirmative consent before a company collects and shares its customers’ personal data.
`
`62.
`
`For example, a recent study by Consumer Reports shows that 92% of Americans
`
`believe that internet companies and websites should be required to obtain consent before selling or
`
`sharing their data and the same percentage believe internet companies and websites should be
`
`required to provide consumers with a complete list of the data that has been collected about them.15
`
`63. Moreover, according to a study by Pew Research, a majority of Americans,
`
`approximately 79%, are concerned about how data is collected about them by companies. Pew
`
`Research also found that 85% of Americans are concerned about the personal information social
`
`media sites know about them.
`
`64.
`
`Instagram has failed to obtain adequate consent to access users’ smartphone camera
`while users are not interacting with Instagram’s camera feature and has chosen to secretly monitor
`users without their permission. This constitutes a violation of Plaintiff’s and Class members’ privacy
`
`interests, including those explicitly enshrined in the California Constitution.
`
`
`
`Facebook’s and Instagram’s Shared History of Privacy Violations
`Since its inception in 2004, Facebook’s core business model has been monetizing
`65.
`user information. As the Federal Trade Commission (“FTC”) noted in a 2019 complaint against
`Facebook, “substantially all of Facebook’s $55.8 billion in 2018 revenues came from advertising.”16
`It is therefore no surprise that Facebook’s fortune rises only at the expense of its users, as evidenced
`by Facebook’s long history of data abuse and privacy violations.
`For example, back in 2007, when Facebook launched “Facebook Beacon,” users
`
`66.
`
`were unaware that their online activity was tracked, and that the privacy settings originally did not
`
`
`15
`Consumers Less Confident About Healthcare, Data Privacy, and Car Safety, New Survey
`Finds, CONSUMER REPORTS (May 11, 2017), https://www.consumerreports.org/consumer-
`reports/consumers-less-confident-about-healthcare-data-privacy-and-car-safety/.
`16
`United States v. Facebook, Inc., Case No. 19-cv-2184.
`
`11
`CLASS ACTION COMPLAINT AND DEMAND FOR JURY TRIAL
`CASE NO. ____________
`
`1 2 3 4 5 6 7 8 9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`
`
`Case 3:20-cv-06534-AGT Document 1 Filed 09/17/20 Page 13 of 36
`
`
`
`allow users to opt-out. As a result of widespread criticism, Facebook Beacon was eventually shut
`
`down.
`
`67.
`
`Just two short years later, Facebook made controversial modifications to its Terms
`
`of Service, which allowed Facebook to use anything a user uploaded to its site for any purpose, at
`
`any time, even after the user ceased to use Facebook. The Terms of Service also failed to provide
`
`anyway for users to completely delete their accounts. Under immense public pressure, Facebook
`
`eventually returned to its previous Terms of Service.
`
`68.
`
`In November of 2011, Facebook agreed to settle FTC charges that it repeatedly failed
`
`to keep promises concerning user privacy, including claims that Facebook promised users it would
`
`not share personal information with advertisers. Jon Leibowitz, Chairman of the FTC, warned
`
`“Facebook is obligated to keep the promises about privacy that it makes to its hundreds of millions
`of users . . . Facebook’s innovation does not have to come at the expense of consumer privacy.”17
`
`69.
`
`The resulting Consent Order prohibited Facebook from misrepresenting the extent to
`
`which consumers can control the privacy of their information, the steps that consumers must take to
`
`implement such controls, and the extent to which Facebook makes user information accessible to
`
`third parties.18
`
`70.
`
`But this was not the last time Facebook abused users’ data. In 2015, a journalist for
`The Guardian reported that Cambridge Analytica was using data harvested from millions of users’
`
`Facebook accounts mostly without user consent.
`
`71.
`
`In 2018, Facebook testified before Congress that Cambridge Analytica may have
`
`harvested the data of up to 87 million users in connection with the 2016 election. This led to yet
`
`another FTC investigation in 2019 into Facebook’s data collection and privacy practices, resulting
`
`in a record-breaking five billion dollar settlement.
`
`72.
`
`Acknowledging that Facebook does not “currently have a strong reputation for
`building privacy protective services,” Mark Zuckerberg promised to build a “privacy-focused
`
`
`17
`Id.
`18 Fed. Trade Comm’n., In re Facebook, Decision and Order, FTC File No. 092 3184 (Jul. 27, 2012)
`
`12
`CLASS ACTION COMPLAINT AND DEMAND FOR JURY TRIAL
`CASE NO. ____________
`
`1 2 3 4 5 6 7 8 9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`
`
`Case 3:20-cv-06534-AGT Document 1 Filed 09/17/20 Page 14 of 36
`
`
`
`platform” and assured users that it has “worked hard to build privacy into all our products, including
`those for public sharing.”19
`
`73.
`
`Despite these promises, Facebook has continued to fail to live up to its promises. In
`
`April 2019, a cybersecurity firm found that millions of Facebook records were made public on
`
`Amazon’s cloud computing server, which were “accessible and downloadable for anyone who could
`find them online.”20
`
`74.
`
`Even more significant, Facebook has come under scrutiny for nearly the same exact
`
`thing Instagram is alleged to have done here. In November of 2019, The Verge reported that
`
`“Facebook’s iOS app appears to be activating the camera in the background of the app in some
`situations without a user’s knowledge.”21 Like here, Facebook’s conduct was only revealed by users
`with iPhones running a new version of Apple’s operating software. Tellingly, Facebook, like
`Instagram here, claimed that this was merely a “bug” that they would fix.
`
`75.
`
`Instagram has followed a similar path of repeated privacy violations as its parent
`
`company. In 2012, shortly after being acquired by Facebook, Instagram announced sweeping
`
`changes to its Terms of Service disclosing that “a business or other entity may pay” Instagram for
`the use of a users’ images “without any compensation [to the user].”22 The changes also allowed
`
`Instagram to disclose user data to Facebook and third-party advertisers. Even worse, Instagram
`
`proposed that parents of minors implicitly consented to the use of their children’s images for
`
`
`19
`Mark Zuckerberg, A Privacy-Focused Vision for Social Networking, FACEBOOK, (Mar. 6,
`https://www.facebook.com/notes/mark-zuckerberg/a-privacy-focused-vision-for-social-
`2019),
`networking/10156700570096634/.
`20
`Sarah Frier, Matt Day & Josh Eidelson, Hundreds of Millions of Facebook User Records
`Exposed
`on
`Amazon
`Cloud
`Servers,
`LA
`TIMES,
`(April
`3,
`2019),
`https://www.lat