10/1/2020
`
`
`
`HUNTON ANDREWS KURTH LLP
`Ann Marie Mortimer (State Bar No. 169077)
`amortimer@HuntonAK.com
`Jason J. Kim (State Bar No. 221476)
`kimj@HuntonAK.com
`Jeff R. R. Nelson (State Bar No. 301546)
`jnelson@HuntonAK.com
`550 South Hope Street, Suite 2000
`Los Angeles, California 90071-2627
`Telephone: (213) 532-2000
`Facsimile: (213) 532-2020
`
`Attorneys for Plaintiff
`FACEBOOK, INC.
`
`
`SUPERIOR COURT OF CALIFORNIA
`
`COUNTY OF SAN MATEO
`
`
`FACEBOOK, INC., a Delaware corporation,
`
`
`Plaintiff,
`
`
`
`v.
`
`20-CIV-04256
`
`
` CASE NO.:
`
`COMPLAINT; DEMAND FOR JURY TRIAL
`
`
`
`
`BRANDTOTAL LTD., an Israeli corporation,
`and UNIMANIA, INC., a Delaware corporation,
`
`
`Defendants.
`
`
`
`
`
`
`
`
`
`
`COMPLAINT; DEMAND FOR JURY TRIAL
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Los Angeles, California 90071-2627
`550 South Hope Street, Suite 2000
`Hunton Andrews Kurth LLP
`
`
`
`

`

`
`
`Plaintiff Facebook, Inc. (“Facebook”) alleges the following:
`
`INTRODUCTION
`
`1.
`
`Beginning no later than September 2019 and continuing until at least September 2020,
`
`Defendants BrandTotal Ltd. (“BrandTotal”) and Unimania, Inc. (Unimania”) developed and
`
`distributed internet browser extensions (“malicious extensions”) designed to improperly collect data
`
`from Twitter, YouTube, LinkedIn, Amazon, Facebook, and Instagram. Defendants distributed the
`
`malicious extensions on the Google Chrome Store. Anyone who installed one of Defendants’
`
`malicious extensions essentially self-compromised their browsers to run automated programs designed
`
`to collect data about its user from specific websites. As to Facebook and Instagram, when a user
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`visited those sites with a self-compromised browser, Defendants used the malicious extensions to
`
`11
`
`connect to Facebook computers and collect or “scrape” user profile information (including name, user
`
`12
`
`ID, gender, date of birth, relationship status, and location information), advertisements and advertising
`
`13
`
`metrics (including name of the advertiser, image and text of the advertisement, and user interaction
`
`14
`
`and reaction metrics), and user Ad Preferences (user advertisement interest information). Defendants
`
`15
`
`used the data collected by the malicious extensions to sell “marketing intelligence,” and other services
`
`16
`
`through the website brandtotal.com. Defendants’ conduct was not authorized by Facebook.
`
`17
`
`2.
`
`Facebook brings this action to stop Defendants’ violations of Facebook’s and
`
`18
`
`Instagram’s Terms and Policies. Facebook also brings this action to obtain damages and disgorgement
`
`Los Angeles, California 90071-2627
`550 South Hope Street, Suite 2000
`Hunton Andrews Kurth LLP
`
`19
`
`for breach of contract and unjust enrichment.
`
`
`
`20
`
`21
`
`3.
`
`Plaintiff Facebook is a Delaware corporation with its principal place of business in
`
`PARTIES
`
`22
`
`Menlo Park, San Mateo County, California. Instagram is a subsidiary and product of Facebook.
`
`23
`
`4.
`
`Defendant BrandTotal Ltd. was incorporated in Israel on November 20, 2016, and on
`
`24
`
`information and belief, is headquartered in Israel. Ex. 1. BrandTotal Ltd. has a subsidiary named
`
`25
`
`BrandTotal Inc. that was incorporated in Delaware on November 13, 2017, has an office in New York,
`
`26
`
`New York, and sells BrandTotal’s services in the U.S. Exs. 2 – 4. BrandTotal operates the website
`
`27
`
`brandtotal.com, where it sells marketing intelligence through its software-as-a-service platform. Ex.
`
`28
`
`5. BrandTotal controls the malicious extension named “UpVoice” that was used to scrape data from
`
`
`
`
`
`1
`COMPLAINT; DEMAND FOR JURY TRIAL
`
`
`
`

`

`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`social media services. BrandTotal distributed the malicious extension on the Chrome Web Store under
`
`the developer name “UpVoice.” Ex. 6. Despite its scraping practices, BrandTotal received
`
`approximately $8 million in venture capital funding between 2017 and 2018. Ex. 7.
`
`5.
`
` Defendant Unimania, Inc. (“Unimania”) was incorporated in the State of Delaware on
`
`November 27, 2017. Ex. 8. Unimania developed and distributed the malicious extension named “Ads
`
`Feed” on the Chrome Web Store. Ex. 9. Unimania’s website, unimania.xyz, consists of only a landing
`
`page. Ex. 10. In May 2018, AdGuard Research reported that Unimania browser extensions for
`
`Chrome were designed to scrape data from Facebook. See https://adguard.com/en/blog/unimania-
`
`spyware-campaign.html. Those extensions were removed from the Google Chrome Store in 2018.
`
`10
`
`6.
`
`Defendants shared common employees and agents. For example, BrandTotal’s Chief
`
`11
`
`Product Officer and General Manager (Ex. 5), created Facebook accounts in the name of Unimania
`
`12
`
`and the Ads Feed extension. BrandTotal’s Chief Technology Officer and co-founder (Ex. 5) also
`
`13
`
`administered Unimania accounts on Facebook.
`
`14
`
`15
`
`JURISDICTION AND VENUE
`
`7.
`
`This Court has subject matter jurisdiction pursuant to California Code of Civil
`
`16
`
`Procedure § 410.10. The amount in controversy exceeds the jurisdictional minimum of this Court,
`
`17
`
`and the total amount of damages sought exceeds $25,000, exclusive of interest and costs. Defendants’
`
`18
`
`unlawful conduct and breaches have interfered with Facebook’s business and operation of its service.
`
`19
`
`8.
`
`Defendants had multiple Facebook accounts and thereby agreed to Facebook’s Terms
`
`Los Angeles, California 90071-2627
`550 South Hope Street, Suite 2000
`Hunton Andrews Kurth LLP
`
`20
`
`of Service and Commercial Terms. The Court has personal jurisdiction over Defendants because
`
`
`
`21
`
`Facebook’s Commercial Terms contain a forum selection clause that requires this complaint be
`
`22
`
`resolved in a state court located in San Mateo County, and that Defendants submit to the personal
`
`23
`
`jurisdiction of this Court.
`
`24
`
`9.
`
`Defendants also agreed to the Instagram Terms of Use. The Instagram Terms of Use
`
`25
`
`contain a forum selection clause that requires this complaint be resolved by this Court, and that
`
`26
`
`Defendants submit to the personal jurisdiction of this Court.
`
`27
`
`10.
`
`Additionally, the Court has personal jurisdiction over Defendants because they
`
`28
`
`knowingly directed and targeted their conduct at California and at Facebook, which has its principal
`
`
`
`
`
`2
`COMPLAINT; DEMAND FOR JURY TRIAL
`
`
`
`

`

`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`place of business in California. Defendants also transacted business and engaged in commerce in
`
`California by, among other things, distributing malicious extensions to California-based Facebook and
`
`Instagram users and using California-based services during their data harvesting scheme.
`
`11.
`
`By agreeing to the forum selection clause in the Facebook Terms of Service and
`
`Instagram Terms of Use, Defendants agreed that this Court is the proper venue for this matter.
`
`Additionally, venue is proper in this Court pursuant to California Code of Civil Procedure § 395.5
`
`because a substantial part of the events giving rise to the claims alleged in this complaint occurred in
`
`San Mateo County.
`
`FACTUAL ALLEGATIONS
`
`Background on Facebook and Instagram
`
`Facebook is a social networking website and mobile application that enables its users
`
`A.
`
`12.
`
`12
`
`to create their own personal profiles and connect with each other on their personal computers and
`
`13
`
`mobile devices. As of August 2020, Facebook daily active users averaged 1.79 billion and monthly
`
`14
`
`active users averaged 2.7 billion. Facebook has several products, including Instagram. Facebook
`
`15
`
`owns and operates the Instagram service, platform, and computers.
`
`16
`
`13.
`
`Instagram is a photo and video sharing service, mobile application, and social network.
`
`17
`
`Instagram users can post photos and videos to their profiles. They can also view and comment on
`
`18
`
`posts shared by others on Instagram.
`
`Los Angeles, California 90071-2627
`550 South Hope Street, Suite 2000
`Hunton Andrews Kurth LLP
`
`19
`
`14.
`
`To create a Facebook or Instagram account, Facebook requires users to register with a
`
`20
`
`unique username and password. Registered users can create user profiles and include information
`
`
`
`21
`
`about themselves, including email address, phone numbers, date of birth, and gender.
`
`22
`
`15.
`
`Anyone with a Facebook or Instagram account can create and place ads on Facebook
`
`23
`
`and Instagram. Every week, users and businesses create millions of ads through Facebook’s ad
`
`24
`
`platform, which provides advertisers with many options for reaching audiences.
`
`25
`
`26
`
`B.
`
`16.
`
`Facebook’s Ad Library
`
`The Facebook Ad Library (available at https://www.facebook.com/ads/library) allows
`
`27
`
`anyone to search and view ads published on Facebook or Instagram. It was first created as the Political
`
`28
`
`Ad Archive in May 2018. The current version was made public in March 2019 and expanded the
`
`
`
`
`
`3
`COMPLAINT; DEMAND FOR JURY TRIAL
`
`
`
`

`

`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`scope of the library to include all active ads running in all countries and inactive ads if the ad is about
`
`social issues, elections or politics. Ads from the latter category will be in the library for up to 7 years.
`
`Only ads that have been viewed by a Facebook or Instagram user will appear in the library.
`
`17.
`
`The Ad Library displays information about the Facebook Page responsible for running
`
`the ads. The “page transparency” section in the library displays the creation date of the Page, Page
`
`name changes, mergers with other Pages, and total spent by the Page on social issues, elections or
`
`politics.
`
`18.
`
`The library is also searchable. Ads can be searched using a key word and results display
`
`the text and image used in the ad. Results can further be filtered by geographic region, platform,
`
`10
`
`number of users that viewed the ad, and views on a particular day.
`
`11
`
`19.
`
`The library does not contain information about the specific users who viewed an ad or
`
`12
`
`a user’s reaction or interactions with an ad. Therefore, a user’s name, ID, date of birth, gender,
`
`13
`
`relationship status, location information, and Ad Preferences are not available in the Ad Library.
`
`14
`
`Similarly, the number of comments, likes, user shares, and other user interaction or reactions are not
`
`15
`
`publicly available in the Ad Library.
`
`16
`
`17
`
`C.
`
`20.
`
`Facebook and Instagram Terms and Policies
`
`All Facebook users must agree to Facebook’s Terms of Service (available at
`
`18
`
`https://www.facebook.com/terms.php) and other rules that govern access to and use of Facebook,
`
`19
`
`which may also include the Facebook Commercial Terms1 (collectively, “Facebook Terms and
`
`Los Angeles, California 90071-2627
`550 South Hope Street, Suite 2000
`Hunton Andrews Kurth LLP
`
`20
`
`Policies”).
`
`
`
`21
`
`21.
`
`Everyone who uses Instagram agrees to Instagram’s Terms of Use and to other rules
`
`22
`
`that govern access to and use of Instagram, including Instagram’s Community Guidelines and Platform
`
`23
`
`Policy (collectively, “Instagram Terms and Policies”).
`
`24
`
`22.
`
`Instagram’s Terms of Use and Section 3.2.1 of the Facebook Terms of Service prohibits
`
`25
`
`users from “do[ing] . . . anything unlawful, misleading, [ ] or fraudulent” or facilitate or support others
`
`26
`
`in doing so.
`
`27
`
`28
`
`
`1 Facebook Commercial Terms apply to access and use of Facebook and Facebook Products for any
`business or commercial purpose.
`
`
`
`
`
`4
`COMPLAINT; DEMAND FOR JURY TRIAL
`
`
`
`

`

`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`23.
`
`Section 3.2.2 of the Facebook Terms of Service prohibits users from “do[ing] anything
`
`that could . . . impair the proper working or appearance of [Facebook] Products.”
`
`24.
`
`Instagram’s Terms of Use also prohibit users from “do[ing] anything to interfere with
`
`or impair the intended operation of the [Instagram] Service.”
`
`25.
`
`Section 3.2.3 of the Facebook Terms of Service prohibits “access[ing] or collect[ing]
`
`data from [Facebook] Products using automated means (without our permission) or attempt[ing] to
`
`access data you don’t have permission to access.”
`
`26.
`
`The Instagram Terms of Use also prohibit (a) “access[ing] or collect[ing] in
`
`unauthorized ways . . . [including] collecting information in an automated way without our express
`
`10
`
`permission;” and (b) “violat[ing] someone else’s rights, including intellectual property rights.”
`
`11
`
`12
`
`D.
`
`27.
`
`Background on Scraping
`
`“Web scraping” refers to the process of extracting data from a website interface by
`
`13
`
`using unauthorized automated means, such as specialized tools and software. Websites, including the
`
`14
`
`official Facebook site, are designed for human end-users and not for automated use, and employ anti-
`
`15
`
`scraping measures to prevent and detect web scraping.
`
`16
`
`28.
`
`Automation tools and software are necessary for scraping. Facebook employs a
`
`17
`
`number of measures to detect and disrupt unauthorized automated requests on its systems, including
`
`18
`
`monitoring use patterns that are inconsistent with a human user, CAPTCHA, and disabling of accounts
`
`19
`
`engaged in automated activity.
`
`Los Angeles, California 90071-2627
`550 South Hope Street, Suite 2000
`Hunton Andrews Kurth LLP
`
`20
`
`29. When scrapers extract the desired data, they often restructure and format it, and save
`
`
`
`21
`
`and store it for further use, such as lead generation and pricing competition and ads optimization.
`
`22
`
`23
`
`E.
`
`30.
`
`Background on Internet Browser Extensions
`
`Internet browsers, such as Google Chrome, Opera, and Firefox, are used to access the
`
`24
`
`internet. Internet browsers follow instructions from websites, in computer code, to render and display
`
`25
`
`a website’s content for users to see. Website content is largely delivered in HTML code. Internet
`
`26
`
`browsers are designed to render the HTML code and display it in images and text for the user’s screen.
`
`27
`
`28
`
`
`
`
`
`5
`COMPLAINT; DEMAND FOR JURY TRIAL
`
`
`
`

`

`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`31.
`
`Internet browser extensions are software components that alter a browser’s
`
`functionality. Browser extensions can be installed to enhance user experience and the functionality of
`
`the browser. For example, a browser extension can block pop-up ads.
`
`32.
`
`Browser extensions can also be used in illicit ways. Browser extensions can be coded
`
`to access the full array of information available to the browser and its functionalities. For example, a
`
`browser extension can be designed to monitor a user’s browsing session, manipulate how the content
`
`of visited websites is displayed, and take other unauthorized actions.
`
`33.
`
`Browser extensions are available for download by users from online browser stores,
`
`which are often managed by the browser developer (i.e., Chrome Web Store). In order for a browser
`
`10
`
`extension to install, the user typically must grant permissions for the extension to download and install
`
`11
`
`on the user’s device.
`
`12
`
`13
`
`F.
`
`34.
`
`14
`
`and Policies.
`
`Defendants Accepted Facebook’s and Instagram’s Terms and Policies
`
`At all relevant times, Defendants were bound by Facebook’s and Instagram’s Terms
`
`15
`
`35.
`
`BrandTotal, through its agents and employees, created a Facebook account in the name
`
`16
`
`of “BrandTotal Analytics” on or about June 13, 2017, and a BrandTotal Instagram account on or about
`
`17
`
`December 5, 2016. BrandTotal also created a Facebook business account on or about February 21,
`
`Los Angeles, California 90071-2627
`550 South Hope Street, Suite 2000
`Hunton Andrews Kurth LLP
`
`18
`
`2017.
`
`19
`
`36.
`
`On or about September 3, 2019, BrandTotal, through its agents and employees, created
`
`20
`
`a Facebook business account for UpVoice. On or about June 8, 2020, BrandTotal, through its agents
`
`
`
`21
`
`and employees, created a Facebook business account named UpVoiceUS.
`
`22
`
`37.
`
`On July 4, 2018, Unimania, through its agents and employees, created a Facebook
`
`23
`
`business account in the name of Unimania.
`
`24
`
`38.
`
`Between 2017 and 2019, Defendants’ employees and agents created and administrated
`
`25
`
`three Facebook Pages. The Pages were used to promote both malicious extensions and BrandTotal’s
`
`26
`
`marketing service.
`
`27
`
`28
`
`
`
`
`
`6
`COMPLAINT; DEMAND FOR JURY TRIAL
`
`
`
`

`

`
`
`39.
`
`Between July 2018 and June 2020, Defendants’ employees and agents created and
`
`controlled seven Facebook advertising accounts. Defendants used Facebook to promote both
`
`malicious extensions and BrandTotal’s marketing service as set forth in Figures 1 and 2.
`
`Figure 1: BrandTotal Advertisement on
`Facebook
`
`Figure 2: UpVoice Extension Advertisement
`on Facebook
`
`BrandTotal
`Sponsored ,
`
`•••
`
`ill'Yo • UpVolce
`Sponsored · 0
`
`Spending a lot more time on your computer lately?
`Join the thousands of people who already earned gitt cards by joining
`UpVolce.
`Just add the Chrome extension to start earning.
`It's THAT easy!
`
`Discover who your competitors are marketing
`to, what they're targeting, when they're
`advertising, and how much they're spending
`using BrandTotal's all-in-one competitive
`intelligence platform.
`
`Get a free analysis on your competitors ...
`Here
`https://intelligence.brandtotal.oom
`
`WHAT ARE YOUR COMPETITORS
`SPENDING THEIR MONEY ON?
`
`Br11ndTot11I
`
`INTELLIGENCE.BRANDTOTALCOM
`All-In-One Competitor Intelligence Platform
`Find out who your competitors are marketing to, what...
`
`JOINUPVOICE.COM
`UpVoice I Browse regularly, earn gift cards
`Join thousands of people who earn gift cards by checking ...
`
`Download
`
`
`
`
`
`G.
`
`Defendants’ Unlawful Data Scraping Operation
`
`1.
`
`Overview
`
`40.
`
`Since at least September 2019 and continuing until at least September 2020, Defendants
`
`developed and distributed at least two malicious extensions called UpVoice and Ads Feed. Defendants
`
`distributed the malicious extensions on the Chrome Web Store. Exs. 6 and 9. Since September 2019,
`
`the malicious extensions have been installed by thousands of users. These malicious extensions were
`
`programmed to scrape data from various websites and deliver it to Defendants.
`
`41.
`
`BrandTotal enticed users to install the UpVoice extension from the Google Chrome
`
`Store by offering payments in exchange for installs, in the form of online gift cards, and claiming that
`
`
`
`
`
`7
`COMPLAINT; DEMAND FOR JURY TRIAL
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Los Angeles, California 90071-2627
`550 South Hope Street, Suite 2000
`Hunton Andrews Kurth LLP
`
`
`
`

`

`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`the users who installed the extension became “panelists . . . [who] impact the marketing decisions and
`
`brand strategies of multi-billion dollars (sic) corporations.” Ex. 6.
`
`42.
`
`Similarly, Unimania promoted its Ads Feed extension on the Google Chrome Store by
`
`claiming that the users became “a panel member of an elite community group that impacts the
`
`advertising decisions of multi-billion dollar corporations!” Ex. 9.
`
`43.
`
`Once installed by the users, however, Defendants used the users’ browsers as a proxy
`
`to access Facebook computers, without Facebook’s authorization, meanwhile pretending to be a
`
`legitimate Facebook or Instagram user. The malicious extensions contained JavaScript files designed
`
`to web scrape the user’s profile information, user advertisement interest information, and
`
`10
`
`advertisements and advertising metrics from ads appearing on a user’s account, while the user visited
`
`11
`
`the Facebook or Instagram websites. The data scraped by Defendants included both public and non-
`
`12
`
`publicly viewable data about the users.
`
`13
`
`44.
`
`Defendants’ malicious extensions were designed to web scrape Facebook and
`
`14
`
`Instagram user profile information, regardless of the account’s privacy settings. The malicious
`
`15
`
`extensions were programmed to send unauthorized, automated commands to Facebook and Instagram
`
`16
`
`servers purporting to originate from the user (instead of Defendants), web scrape the information, and
`
`17
`
`send the scraped data to the user’s computer, and then to servers that Defendants controlled.
`
`18
`
`45.
`
` Defendants used the data collected by the malicious extensions to sell “marketing
`
`19
`
`intelligence,” and other services through the website brandtotal.com. BrandTotal publicly stated that
`
`20
`
`it used the data obtained through the malicious extensions to provide marketing insights about users
`
`Los Angeles, California 90071-2627
`550 South Hope Street, Suite 2000
`Hunton Andrews Kurth LLP
`
`
`
`21
`
`and advertisers. Exs. 5 and 11.
`
`22
`
`23
`
`2.
`
`The UpVoice Malicious Extension
`
`46.
`
` Since at least September 2019, BrandTotal developed, promoted, and distributed the
`
`24
`
`UpVoice extension. BrandTotal programmed the UpVoice extension to web scrape data from both
`
`25
`
`Facebook and Instagram, as well as Amazon, Twitter, LinkedIn, Pinterest, and YouTube. BrandTotal
`
`26
`
`further programmed the UpVoice extension to send the scraped data to a server controlled by
`
`27
`
`Defendants.
`
`28
`
`
`
`
`
`8
`COMPLAINT; DEMAND FOR JURY TRIAL
`
`
`
`

`

`
`
`47.
`
`BrandTotal maintained and operated the website joinupvoice.com, which it used to
`
`promote the UpVoice malicious extension. Exs. 11-12. To incentivize the installation of that
`
`malicious extension, BrandTotal offered gift cards to visitors who installed it. Ex. 11. For example,
`
`on its website, as shown in Figure 3 below, BrandTotal promoted the UpVoice browser extension as
`
`a way to “[g]et paid for the time you spend on” Facebook, YouTube, LinkedIn, Amazon and Twitter.
`
`Id. And visitors to the website were instructed to “[a]dd the UpVoice Chrome extension to your
`
`desktop browser [to] start earning gift cards.” Id. Once a user registered on joinupvoice.com, the user
`
`would need to install the UpVoice malicious extension from the Chrome Web Store.
`
`Figure 3: UpVoice Website
`
`UPVDICE
`
`WWIUS
`
`HOWITWOAl(S
`
`REVIEWS
`
`REWARDS
`
`A80UT
`
`f) CON11NU(; WITH 1-ACEBOOK
`
`Get paid for the
`ti~ e 'ou spend on
`
`Add the UpVoice Chrome extension to your desktop browser and start eommg grit
`cords for vis,ting our portrc,patrng sites regularly. It's THAT easy!
`n CONTINUE WITH FACEBOOK
`
`► WATCH VIDEO
`
`Hovv it vvorks
`
`~ ~
`
`Browse
`Continue your regular browsing
`activity
`
`Install
`After signing up. we will invite you to
`install the UpVoice Chrome
`extension. It's safe and won't ,mpact
`your browser performance
`
`Earn
`When you browse through our
`participotrng srtes. the Chrome
`extension anonymously captures
`your ods and gives you daily parms
`hat can later be redeemed for a
`var ,ety of 91ft cards
`
`
`
`
`
`9
`COMPLAINT; DEMAND FOR JURY TRIAL
`
`
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Los Angeles, California 90071-2627
`550 South Hope Street, Suite 2000
`Hunton Andrews Kurth LLP
`
`
`
`

`

`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`48.
`
`BrandTotal deceived visitors to the website into believing Facebook, and other social
`
`networks were working with UpVoice and BrandTotal by identifying Facebook and the other
`
`companies as “participating sites,” (Exs. 11 and 13) when in fact, Facebook did not authorize
`
`Defendants to scrape data from its computers. Additionally, although Instagram was not included in
`
`the list of “participating sites,” BrandTotal collected advertising data and Instagram user profile
`
`information from users who installed the malicious extension. Ex. 13.
`
`49.
`
`BrandTotal programmed the malicious extension to web scrape user profile
`
`information and advertising data from Instagram users who installed the UpVoice malicious extension.
`
`Ex. 14. BrandTotal caused the malicious extension to scrape advertisements and advertising metrics,
`
`10
`
`including information about the advertiser, the image and text of the advertisement, and user
`
`11
`
`interaction and reaction metrics (e.g., number of views, comments, likes) associated with an
`
`12
`
`advertisement. Id.
`
`13
`
`50.
`
`BrandTotal programmed the malicious extension to scrape Instagram user profile
`
`14
`
`information, including the user’s name, account name, user ID, profile picture, and other information
`
`15
`
`about the user’s account. Id.
`
`16
`
`51.
`
`BrandTotal also programmed the UpVoice malicious extension to send automated
`
`17
`
`requests to Facebook servers to obtain user profile information for Facebook users and advertising
`
`18
`
`data. Exs. 15-19. The malicious extension was coded to scrape information when a user visited
`
`19
`
`Facebook. BrandTotal caused the user’s ID, gender, date of birth, relationship status, and location
`
`Los Angeles, California 90071-2627
`550 South Hope Street, Suite 2000
`Hunton Andrews Kurth LLP
`
`20
`
`information to be scraped, regardless of the user’s privacy settings. Id. BrandTotal also scraped Ad
`
`
`
`21
`
`Preferences information (Ex. 18), which is nonpublic information Facebook uses to determine what
`
`22
`
`ads to show a user based on a user’s activity on Facebook and Instagram, and other information.
`
`23
`
`52.
`
`BrandTotal also coded the UpVoice malicious extension to send requests to Facebook
`
`24
`
`servers to obtain advertisements and advertising metrics, including information about the advertiser,
`
`25
`
`the image and text of the advertisement, and user interaction and reaction metrics (e.g., number of
`
`26
`
`views, comments, likes) associated with an advertisement. Ex. 20.
`
`27
`
`28
`
`
`
`
`
`10
`COMPLAINT; DEMAND FOR JURY TRIAL
`
`
`
`

`

`
`
`3.
`
`Ads Feed Malicious Extension
`
`53.
`
`Since at least November 2019, Unimania developed, promoted, and distributed the Ads
`
`Feed malicious extension on the Google Chrome Store. Ex. 9. Unimania programmed the Ads Feed
`
`extension to web scrape data from both Facebook and Instagram, as well as Amazon, Twitter, and
`
`YouTube. The data collected through the Ads Feed malicious extension was sent to the same servers
`
`as the data collected through the UpVoice malicious extension.
`
`54.
`
`According to the overview of the malicious extension on the Google Chrome Store, the
`
`malicious extension saves 90 days of advertisements from Twitter, Facebook, Instagram, YouTube,
`
`and Amazon and allows the user to “click back to those that interest you.” Id. Unlike the UpVoice
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`malicious extension, BrandTotal did not offer users a financial incentive for installing the Ads Feed
`
`11
`
`malicious extension. Id.
`
`12
`
`55.
`
`The Ads Feed malicious extension used code almost identical to the code used in the
`
`13
`
`UpVoice malicious extension to scrape user profile data, advertisements and advertising metrics, and
`
`14
`
`Ad Preference information from Facebook and Instagram. For example, like the UpVoice extension,
`
`15
`
`the Ads Feed malicious extension scraped the image and text of the advertisement, and user
`
`16
`
`interactions with the ad (e.g., number of views, comments, likes) from Facebook and Instagram ads,
`
`17
`
`returned it to the user’s browser, and then sent it to a server controlled by Defendants.
`
`18
`
`19
`
`H.
`
`56.
`
`Facebook’s Enforcement Efforts
`
`In September 2020, Facebook took various technical enforcement measures against
`
`Los Angeles, California 90071-2627
`550 South Hope Street, Suite 2000
`Hunton Andrews Kurth LLP
`
`20
`
`Defendants, including disabling Facebook and Instagram accounts and Pages. Facebook also made
`
`
`
`21
`
`multiple requests to Google to remove and disable the extensions from the Chrome Store, but Google
`
`22
`
`has not yet done so.
`
`23
`
`24
`
`I.
`
`57.
`
`Defendants Unjustly Enriched Themselves and Harmed Facebook
`
`Defendants’ violations of Facebook’s and Instagram’s Terms and Policies have harmed
`
`25
`
`Facebook. Defendants interfered and continued to interfere with Facebook’s and Instagram’s
`
`26
`
`platforms.
`
`27
`
`28
`
`
`
`
`
`11
`COMPLAINT; DEMAND FOR JURY TRIAL
`
`
`
`

`

`
`
`58.
`
`Facebook suffered damages attributable to the efforts and resources it used to
`
`investigate and remediate Defendants’ conduct in an amount to be determined at trial, and in excess
`
`of $25,000.
`
`59.
`
`Since at least September 2019, Defendants have unjustly enriched themselves at
`
`Facebook’s expense in an amount to be determined at trial. Facebook is entitled to an accounting by
`
`Defendants and a disgorgement of all unlawful profits gained from their conduct.
`
`FIRST CAUSE OF ACTION
`
`(Breach of Contract)
`
`60.
`
`61.
`
`Facebook realleges and incorporates all preceding paragraphs here.
`
`Since December 2016, Defendants, through their employees and agents, created
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`multiple Facebook and Instagram accounts and agreed to Facebook’s and Instagram’s Terms and
`
`12
`
`Policies. Facebook’s and Instagram’s Terms constitute an agreement between Defendants and
`
`13
`
`Facebook. Defendants also agreed to Facebook and Instagram’s Terms and Policies through the use
`
`14
`
`of the service.
`
`15
`
`62.
`
`Facebook has performed all conditions, covenants, and promises required of them in
`
`16
`
`accordance with Facebook’s and Instagram’s Terms and Policies.
`
`17
`
`63.
`
`Defendants’ actions interfered and caused others to interfere with Facebook and
`
`18
`
`Instagram, and engaged with Facebook and Instagram in unauthorized ways.
`
`19
`
`64.
`
`Defendants have breached and continue to breach Facebook Terms 3.2.1, 3.2.2, and
`
`Los Angeles, California 90071-2627
`550 South Hope Street, Suite 2000
`Hunton Andrews Kurth LLP
`
`20
`
`3.2.3 and Instagram’s Terms of Use. Facebook’s Terms prohibit (a) using automated means without
`
`
`
`21
`
`Facebook’s permission to web scrape user profiles and account and advertising information from
`
`22
`
`Facebook and Instagram; (b) scraping Facebook and Instagram user profile information and
`
`23
`
`advertising data by sending code to Facebook that purported to originate from the user, which is
`
`24
`
`“unlawful, misleading, [ ] or fraudulent;” (c) falsely representing to users that Facebook is a
`
`25
`
`“participating site” in Defendants’ scraping activity; and (d) scraping the intellectual property rights
`
`26
`
`of others by harvesting advertising images and text. Instagram’s Terms of Use also prohibit the same
`
`27
`
`conduct.
`
`28
`
`
`
`
`
`12
`COMPLAINT; DEMAND FOR JURY TRIAL
`
`
`
`

`

`
`
`65.
`
`Defendants’ many breaches have caused Facebook to incur damages in excess of
`
`$25,000. Accordingly, Facebook seeks damages in an amount to be proven at trial.
`
`66.
`
`Facebook likewise seeks injunctive relief. As a direct result of Defendants’ unlawful
`
`actions, Facebook has suffered and continues to suffer irreparable harm for which there is no adequate
`
`remedy at law, and which will continue unless Defendants’ actions are enjoined.
`
`SECOND CAUSE OF ACTION
`
`(Unjust Enrichment)
`
`67.
`
`68.
`
`Facebook realleges and incorporates all preceding paragraphs here.
`
`Defendants’ acts as alleged herein constitute unjust enrichment of the Defendants at
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`Facebook’s expense.
`
`11
`
`69.
`
`Defendants accessed and used, without authorization or permission, Facebook’s
`
`12
`
`service, platform, and computer network, all of which belong to Facebook.
`
`13
`
`70.
`
`Defendants used Facebook’s service, platform, and computer network to, among other
`
`14
`
`things, scrape data from Instagram and Facebook, including non-publicly viewable data.
`
`15
`
`71.
`
`Defendants received a benefit by profiting from the data they wrongfully scraped from
`
`16
`
`Facebook and Instagram, which they used to sell “marketing intelligence” and services. But for
`
`17
`
`Defendants’ wrongful, unauthorized, and intentional use of Facebook and Instagram, they would not
`
`Los Angeles, California 90071-2627
`550 South Hope Street, Suite 2000
`Hunton Andrews Kurth LLP
`
`18
`
`have obtained such profits.
`
`19
`
`72.
`
`Defendants’ retention of the profits derived from their unauthorized use of Facebook’s
`
`20
`
`service, platform, and computer network, including data, would be unjust.
`
`
`
`21
`
`73.
`
`Facebook seeks an accounting and disgorgement of Defendants’ ill-gotten profits in an
`
`22
`
`amount to be determined at trial.
`
`23
`
`24
`
`25
`
`Facebook seeks a judgment awarding the following relief:
`
`PRAYER FOR RELIEF
`
`(a)
`
`A permanent injunc