`
`FOR PUBLICATION
`
`UNITED STATES COURT OF APPEALS
`FOR THE NINTH CIRCUIT
`
`No. 17-17486
`
`D.C. No.
`5:12-md-02314-
`EJD
`
`OPINION
`
`IN RE FACEBOOK, INC. INTERNET
`TRACKING LITIGATION,
`
`PERRIN AIKENS DAVIS; BRIAN K.
`LENTZ; CYNTHIA D. QUINN;
`MATTHEW J. VICKERY,
`Plaintiffs-Appellants,
`
`v.
`
`FACEBOOK, INC.,
`Defendant-Appellee.
`
`Appeal from the United States District Court
`for the Northern District of California
`Edward J. Davila, District Judge, Presiding
`
`Argued and Submitted April 16, 2019
`San Francisco, California
`
`Filed April 9, 2020
`
`
`
`Case: 17-17486, 04/09/2020, ID: 11655970, DktEntry: 85-1, Page 2 of 38
`
`2
`
`IN RE FACEBOOK, INC. INTERNET TRACKING LITIG.
`
`Before: Sidney R. Thomas, Chief Judge, Milan D.
`Smith, Jr., Circuit Judge, and Katherine H. Vratil,*
`District Judge.
`
`Opinion by Chief Judge Thomas
`
`SUMMARY**
`
`Standing / Privacy Law
`
`The panel affirmed the district court’s dismissal of the
`Stored Communications Act (“SCA”), breach of contract, and
`breach of implied covenant claims; reversed the dismissal of
`the remaining claims; and remanded for further consideration,
`in an action alleging privacy-related claims against Facebook,
`Inc.
`
`Facebook uses plug-ins to track users’ browsing histories
`when they visit third-party websites, and then complies these
`browsing histories into personal profiles which are sold to
`advertisers to generate revenue. Plaintiffs filed an amended
`complaint on behalf of themselves and a putative class of
`people who had active Facebook accounts between May 27,
`2010 and September 26, 2011. They alleged that Facebook
`executives were aware of the tracking of logged-out users and
`
`* The Honorable Kathryn H. Vratil, United States District Judge for
`the District of Kansas, sitting by designation.
`
`** This summary constitutes no part of the opinion of the court. It has
`been prepared by court staff for the convenience of the reader.
`
`
`
`Case: 17-17486, 04/09/2020, ID: 11655970, DktEntry: 85-1, Page 3 of 38
`
`IN RE FACEBOOK, INC. INTERNET TRACKING LITIG.
`
`3
`
`recognized that these practices posed various user-privacy
`issues.
`
`As an initial matter, the panel held that plaintiffs had
`standing to bring their claims. Specifically, the panel held
`that plaintiffs adequately alleged an invasion of a legally
`protected interest that was concrete and particularized.
`
`As to the statutory claims, the panel held that the
`legislative history and statutory text demonstrated that
`Congress and the California legislature intended to protect
`these historical privacy rights when they passed the Wiretap
`Act, SCA, and the California Invasion of Privacy Act
`(“CIPA”). In addition, plaintiffs adequately alleged that
`Facebook’s tracking and collection practices would cause
`harm or a material risk to their interest in controlling their
`personal information. Accordingly, plaintiffs sufficiently
`alleged a clear invasion of their right to privacy, and plaintiffs
`had standing to pursue their privacy claims under these
`statutes.
`
`As to plaintiffs’ alleged theories of California common
`law trespass to chattels and fraud, statutory larceny, and
`violations of the Computer Data Access and Fraud Act, the
`panel held that plaintiffs sufficiently alleged a state law
`interest whose violation constituted an injury sufficient to
`establish standing to bring their claims. Because California
`law recognizes a legal interest in unjustly earned profits,
`plaintiffs adequately pled an entitlement to Facebook’s profits
`from users’ data sufficient to confer Article III standing.
`Plaintiffs also sufficiently alleged that Facebook profited
`from this valuable data.
`
`
`
`Case: 17-17486, 04/09/2020, ID: 11655970, DktEntry: 85-1, Page 4 of 38
`
`4
`
`IN RE FACEBOOK, INC. INTERNET TRACKING LITIG.
`
`Turning to the merits, the panel held that plaintiffs
`adequately stated claims for relief for intrusion upon
`seclusion and invasion of privacy under California law. First,
`the panel held that in light of the privacy interests and
`Facebook’s allegedly surreptitious and unseen data collection,
`plaintiffs adequately alleged a reasonable expectation of
`privacy to survive a Fed. R. Civ. P. 12(b)(6) motion to
`dismiss. Second, plaintiffs identified sufficient facts to
`survive a motion to dismiss on the ultimate question of
`whether Facebook’s tracking and collection practices could
`highly offend a reasonable individual.
`
`The panel held that plaintiffs sufficiently alleged that
`Facebook’s tracking and collection practices violated the
`Wiretap Act and CIPA. Both statutes contain an exemption
`from liability for a person who is a “party” to the
`communication. Noting a circuit split, the panel adopted the
`First and Seventh Circuits’ understanding that simultaneous
`unknown duplication and communication of GET requests
`did not exempt Facebook from liability under the party
`exception. The panel concluded that Facebook was not
`exempt from liability as a matter of law under the Wiretap
`Act or CIPA, and did not opine whether plaintiffs adequately
`pleaded the other requisite elements of the statutes.
`
`The panel held that the district court properly dismissed
`plaintiffs’ claims under the SCA, which required plaintiffs to
`plead that Facebook gained unauthorized access to a
`“facility” where it accessed electronic communications in
`“electronic storage.” The panel agreed with the district
`court’s determination that plaintiffs’ data was not in
`electronic storage. The panel concluded that plaintiffs’
`claims for relief under the SCA were insufficient.
`
`
`
`Case: 17-17486, 04/09/2020, ID: 11655970, DktEntry: 85-1, Page 5 of 38
`
`IN RE FACEBOOK, INC. INTERNET TRACKING LITIG.
`
`5
`
`The panel held that the district court properly dismissed
`plaintiffs’ breach of contract claim for failure to state a claim.
`Plaintiffs alleged that Facebook entered into a contract with
`each plaintiff consisting of the Statement of Rights and
`Responsibilities, Privacy Policy, and relevant Help Center
`pages. The panel held that plaintiffs failed to adequately
`allege the existence of a contract that was subject to breach.
`The panel also held that the district court properly dismissed
`plaintiffs’ claim that Facebook’s tracking practices violated
`the implied covenant of good faith and fair dealing, where the
`allegations did not go beyond the asserted breach of contract
`theories.
`
`COUNSEL
`
`David A. Straite (argued), Frederic S. Fox, and Ralph E.
`Labaton, Kaplan Fox & Kilsheimer LLP, New York, New
`York; Laurence D. King, Matthew George, and Mario M.
`Choi, Kaplan Fox & Kilsheimer LLP, San Francisco,
`California; Stephen G. Grygiel, Silverman Thompson Slutkin
`White LLC, Baltimore, Maryland; for Plaintiffs-Appellants.
`
`Lauren R. Goldman (argued) and Michael Rayfield, Mayer
`Brown LLP, New York, New York; Matthew D. Brown,
`Cooley LLP, San Francisco, California; for Defendant-
`Appellee.
`
`Marc Rotenberg, Alan Butler, Natasha Babazadeh, and Sam
`Lester, Electronic Privacy Information Center, Washington,
`D.C., for Amicus Curiae Electronic Privacy Information
`Center (EPIC).
`
`
`
`Case: 17-17486, 04/09/2020, ID: 11655970, DktEntry: 85-1, Page 6 of 38
`
`IN RE FACEBOOK, INC. INTERNET TRACKING LITIG.
`
`ouglas Laycock, University of Virginia Law School,
`Charlottesville, Virginia; Steven W. Perlstein, Kobre & Kim
`LLP, New York, New York; Beau D. Barnes, Kobre & Kim
`LLP, Washington, D.C.; for Amicus Curiae Professor
`Douglas Laycock.
`
`6 D
`
`OPINION
`
`THOMAS, Chief Judge:
`
`In this appeal, we are asked to determine whether:
`(1) Facebook-users Perrin Davis, Brian Lentz, Cynthia Quinn,
`and Mathew Vickery (“Plaintiffs”) have standing to allege
`privacy-related claims against Facebook, and (2) Plaintiffs
`adequately allege claims that Facebook is liable for common
`law and statutory privacy violations when it tracked their
`browsing histories after they had logged out of the Facebook
`application. We have jurisdiction pursuant to 28 U.S.C.
`§ 1291. We affirm in part; reverse in part; and remand for
`further proceedings.
`
`I
`
`Facebook uses plug-ins1 to track users’ browsing histories
`when they visit third-party websites, and then compiles these
`browsing histories into personal profiles which are sold to
`advertisers to generate revenue. The parties do not dispute
`that Facebook engaged in these tracking practices after its
`users had logged out of Facebook.
`
`1 A plug-in is a program that extends the functionality of an existing
`program, such as an internet browser.
`
`
`
`Case: 17-17486, 04/09/2020, ID: 11655970, DktEntry: 85-1, Page 7 of 38
`
`IN RE FACEBOOK, INC. INTERNET TRACKING LITIG.
`
`7
`
`Facebook facilitated this practice by embedding third-
`party plug-ins on third-party web pages. The plug-ins, such
`as Facebook’s “Like” button, contain bits of Facebook code.
`When a user visits a page that includes these plug-ins, this
`code is able to replicate and send the user data to Facebook
`through a separate, but simultaneous, channel in a manner
`undetectable by the user.
`
`As relevant to this appeal, the information Facebook
`allegedly collected included the website’s Uniform Resource
`Locator (“URL”) that was accessed by the user. URLs both
`identify an internet resource and describe its location or
`address. “[W]hen users enter URL addresses into their web
`browser using the ‘http’ web address format, or click on
`hyperlinks, they are actually telling their web browsers (the
`client) which resources to request and where to find them. In
`re Zynga Privacy Litig., 750 F.3d 1098, 1101 (9th Cir. 2014).
`Thus, the URL provides significant information regarding the
`user’s browsing history, including the identity of the
`individual internet user and the web server, as well as the
`name of the web page and the search terms that the user used
`to find it. In technical parlance, this collected URL is called
`a “referer header” or “referer.” Facebook also allegedly
`collected the third-party website’s Internet Protocol (“IP”)
`address,2 which reveals only the owner of the website.
`
`Facebook allegedly compiled the referer headers it
`collected into personal user profiles using “cookies”—small
`text files stored on the user’s device. When a user creates a
`Facebook account, more than ten Facebook cookies are
`
`2 An “IP address” is a numerical identifier for each computer or
`network connected to the Internet. hiQ Labs, Inc. v. LinkedIn Corp., 938
`F.3d 985, 991 n.4 (9th Cir. 2019).
`
`
`
`Case: 17-17486, 04/09/2020, ID: 11655970, DktEntry: 85-1, Page 8 of 38
`
`IN RE FACEBOOK, INC. INTERNET TRACKING LITIG.
`
`laced on the user’s browser. These cookies store the user’s
`login ID, and they capture, collect, and compile the referer
`headers from the web pages visited by the user. As most
`relevant to this appeal, these cookies allegedly continued to
`capture information after a user logged out of Facebook and
`visited other websites.
`
`8 p
`
`Plaintiffs claim that internal Facebook communications
`revealed that company executives were aware of the tracking
`of logged-out users and recognized that these practices posed
`various user-privacy issues. According to the Plaintiffs,
`Facebook stopped tracking logged-out users only after
`Australian blogger Nik Cubrilovic published a blog detailing
`Facebook’s tracking practices.3
`
`Plaintiffs filed a consolidated complaint on behalf of
`themselves and a putative class of people who had active
`Facebook accounts between May 27, 2010 and September 26,
`2011. After the district court dismissed their first complaint
`with leave to amend, Plaintiffs filed an amended complaint.
`In the amended complaint, they alleged a number of claims.
`The claims relevant to this appeal consist of: (1) violation of
`the Wiretap Act, 18 U.S.C. § 2510, et seq.; (2) violation of
`the Stored Communications Act (“SCA”), 18 U.S.C. § 2701;
`(3) violation of the California Invasion of Privacy Act
`(“CIPA”), Cal. Pen. Code §§ 631, 632; (4) invasion of
`privacy; (5) intrusion upon seclusion; (6) breach of contract;
`(7) breach of the duty of good faith and fair dealing; (8) civil
`
`3 The blog post quickly gained notoriety and played a role in a lawsuit
`that alleged multiple counts of deceptive trade practices brought against
`Facebook by the Federal Trade Commission. In the Matter of Facebook
`Inc., FTC File No. 0923184. Facebook reached a settlement with the FTC
`in November 2011.
`
`
`
`Case: 17-17486, 04/09/2020, ID: 11655970, DktEntry: 85-1, Page 9 of 38
`
`IN RE FACEBOOK, INC. INTERNET TRACKING LITIG.
`
`9
`
`fraud; (9) trespass to chattels; (10) violations of California
`Penal Code § 502 Computer Data Access and Fraud Act
`(“CDAFA”); and (11) statutory larceny under California
`Penal Code §§ 484 and 496.
`
`The district court granted Facebook’s motion to dismiss
`the amended complaint. First, the district court determined
`that Plaintiffs had failed to show they had standing to pursue
`claims that included economic damages as an element, thus
`disposing of the claims for trespass to chattels, violations of
`the CDAFA, fraud, and statutory larceny. It dismissed these
`claims without leave to amend.
`
`The district court also dismissed for failure to state a
`claim, without leave to amend, Plaintiffs’ claims for
`violations of the Wiretap Act, CIPA, and the SCA, as well as
`their common law claims for invasion of privacy and
`intrusion upon seclusion. The district court dismissed the
`claims for breach of contract and the breach of the implied
`covenant of good faith and fair dealing, but granted leave to
`amend these claims. In response, Plaintiffs amended their
`complaint as to the breach of contract and implied covenant
`claims. The district court subsequently granted Facebook’s
`motion to dismiss the amended claims. This timely appeal
`followed.
`
`We review de novo a district court’s determination of
`whether a party has standing. San Luis & Delta-Mendota
`Water Auth. v. United States, 672 F.3d 676, 699 (9th Cir.
`2012). We review de novo dismissals for failure to state a
`claim under Rule 12(b)(6). Dougherty v. City of Covina,
`654 F.3d 892, 897 (9th Cir. 2011).
`
`
`
`Case: 17-17486, 04/09/2020, ID: 11655970, DktEntry: 85-1, Page 10 of 38
`
`10
`
`IN RE FACEBOOK, INC. INTERNET TRACKING LITIG.
`
`II
`
`The Plaintiffs have standing to bring their claims.
`“Where standing is raised in connection with a motion to
`dismiss, the court is to ‘accept as true all material allegations
`of the complaint, and . . . construe the complaint in favor of
`the complaining party.’” Levine v. Vilsack, 587 F.3d 986,
`991 (9th Cir. 2009) (quoting Thomas v. Mundell, 572 F.3d
`756, 760 (9th Cir. 2009)).
`
`To establish standing, a “[p]laintiff must have (1) suffered
`an injury in fact, (2) that is fairly traceable to the challenged
`conduct of the defendant, and (3) that is likely to be redressed
`by a favorable judicial decision.” Spokeo v. Robins, __ U.S.
`__, 136 S. Ct. 1540, 1547 (2016). To establish an injury in
`fact, a plaintiff must show that he or she suffered “an invasion
`of a legally protected interest” that is “concrete and
`particularized.” Id. at 1548 (quoting Lujan v. Defs. of
`Wildlife, 504 U.S. 555, 560 (1992)). A particularized injury
`is one that affects the plaintiff in a “personal and individual
`way.” Id.; see also Dutta v. State Farm Mutual Auto. Ins.
`Co., 895 F.3d 1166, 1173 (9th Cir. 2018).
`
`A concrete injury is one that is “real and not abstract.”
`Spokeo, 136 S.Ct. at 1548 (internal quotation marks omitted).
`Although an injury “must be ‘real’ and ‘not abstract’ or
`purely ‘procedural’ . . . it need not be ‘tangible.’” Dutta,
`895 F.3d at 1173. Indeed, though a bare procedural violation
`of a statute is insufficient to establish an injury in fact,
`Congress may “elevat[e] to the status of legally cognizable
`injuries concrete, de facto injuries that were previously
`inadequate” to confer standing. Spokeo, 136 S. Ct. at 1549
`(quoting Lujan, 504 U.S. at 578).
`
`
`
`Case: 17-17486, 04/09/2020, ID: 11655970, DktEntry: 85-1, Page 11 of 38
`
`IN RE FACEBOOK, INC. INTERNET TRACKING LITIG. 11
`
`To determine whether Congress has done so, we ask
`whether: (1) “Congress enacted the statute at issue to protect
`a concrete interest that is akin to a historical, common law
`interest[,]” and (2) the alleged procedural violation caused
`real harm or a material risk of harm to these interests. Dutta,
`895 F.3d at 1174.
`
`A
`
`The district court properly concluded that Plaintiffs had
`established standing to bring claims for invasion of privacy,
`intrusion upon seclusion, breach of contract, breach of the
`implied covenant of good faith and fair dealing, as well as
`claims under the Wiretap Act and CIPA, because they
`adequately alleged privacy harms.
`
`Plaintiffs have adequately alleged an invasion of a legally
`protected interest that is concrete and particularized.
`“[V]iolations of the right to privacy have long been
`actionable at common law.” Patel v. Facebook, 932 F.3d
`1264, 1272 (9th Cir. 2019) (quoting Eichenberger v. ESPN,
`Inc., 876 F.3d 979, 983 (9th Cir. 2017)). A right to privacy
`“encompass[es] the individual’s control of information
`concerning his or her person.” Eichenberger, 876 F.3d at 983
`(quoting U.S. Dep’t of Justice v. Reporters Comm. for
`Freedom of the Press, 489 U.S. 749, 763 (1989)).
`
`As to the statutory claims, the legislative history and
`statutory text demonstrate that Congress and the California
`legislature intended to protect these historical privacy rights
`when they passed the Wiretap Act, SCA, and CIPA. See S.
`REP. NO. 99-541, at 2 (1986) (“[The Wiretap Act] is the
`primary law protecting the security and privacy of business
`and personal communications in the United States today.”);
`
`
`
`Case: 17-17486, 04/09/2020, ID: 11655970, DktEntry: 85-1, Page 12 of 38
`
`12
`
`IN RE FACEBOOK, INC. INTERNET TRACKING LITIG.
`
`Id. at 3 (“[The SCA] is modeled after the Right to Financial
`Privacy Act, 12 U.S.C. § 3401 et seq. to protect privacy
`interests in personal and proprietary information . . . .”); Cal.
`Pen. Code § 630 (noting that CIPA was passed “to protect the
`right of privacy of the people of this state”). Thus, these
`statutory provisions codify a substantive right to privacy, the
`violation of which gives rise to a concrete injury sufficient to
`confer standing. See Campbell v. Facebook, Inc., —F.3d—,
`2020 WL 1023350, at *7–8 (9th Cir. Mar. 3, 2020).
`
`Plaintiffs have adequately alleged harm to these privacy
`interests. Plaintiffs alleged that Facebook continued to
`collect their data after they had logged off the social media
`platform, in order to receive and compile their personally
`identifiable browsing history. As alleged in the complaint,
`this tracking occurred “no matter how sensitive” or personal
`users’ browsing histories were.
` Facebook allegedly
`constantly compiled and updated its database with its users’
`browsing activities, including what they did when they were
`not using Facebook. According to Plaintiffs, by correlating
`users’ browsing history with users’ personal Facebook
`profiles—profiles that could include a user’s employment
`history and political and religious affiliations—Facebook
`gained a cradle-to-grave profile without users’ consent.
`
`Here, Plaintiffs have adequately alleged that Facebook’s
`tracking and collection practices would cause harm or a
`material risk of harm to their interest in controlling their
`personal information. As alleged, Facebook’s tracking
`practices allow it to amass a great degree of personalized
`information. Facebook’s user profiles would allegedly reveal
`an individual’s likes, dislikes, interests, and habits over a
`significant amount of time, without affording users a
`
`
`
`Case: 17-17486, 04/09/2020, ID: 11655970, DktEntry: 85-1, Page 13 of 38
`
`IN RE FACEBOOK, INC. INTERNET TRACKING LITIG. 13
`
`meaningful opportunity to control or prevent the unauthorized
`exploration of their private lives.
`
`“[A]dvances in technology can increase the potential for
`unreasonable intrusions into personal privacy.” Patel,
`932 F.3d at 1272. As the Third Circuit has noted, “[i]n an era
`when millions of Americans conduct their affairs increasingly
`through electronic devices, the assertion . . . that federal
`courts are powerless to provide a remedy when an internet
`company surreptitiously collects private data . . . is untenable.
`Nothing in Spokeo or any other Supreme Court decision
`suggests otherwise.” In re Google Inc. Cookie Placement
`Consumer Privacy Litig., 934 F.3d 316, 325 (3rd Cir. 2019)
`(“In re Google Cookie”).
`
`Accordingly, Plaintiffs have sufficiently alleged a clear
`invasion of the historically recognized right to privacy.
`Therefore, Plaintiffs have standing to pursue their privacy
`claims under the Wiretap Act, SCA, and CIPA, as well as
`their claims for breach of contract and breach of the implied
`covenant of good faith and fair dealing.
`
`B
`
`Plaintiffs also alleged theories of California common law
`trespass to chattels and fraud, statutory larceny, and
`violations of the CDAFA. The district court dismissed these
`claims for lack of standing, concluding that the Plaintiffs
`failed to demonstrate that they had suffered the economic
`
`
`
`Case: 17-17486, 04/09/2020, ID: 11655970, DktEntry: 85-1, Page 14 of 38
`
`14
`
`IN RE FACEBOOK, INC. INTERNET TRACKING LITIG.
`
`injury the district court viewed as necessary to bring each of
`these claims.4 We respectfully disagree.
`
`Plaintiffs allege that Facebook is unjustly enriched
`through the use of their data. Facebook argues that unjust
`enrichment is not sufficient to confer standing, and that
`Plaintiffs must instead demonstrate that they either planned
`to sell their data, or that their data was made less valuable
`through Facebook’s use. They similarly assert that Plaintiffs’
`entitlement to damages does not constitute an injury for
`purposes of standing.
`
`However, “state law can create interests that support
`standing in federal courts.” Cantrell v. City of Long Beach,
`241 F.3d 674, 684 (9th Cir. 2001). As relevant here,
`California law recognizes a right to disgorgement of profits
`resulting from unjust enrichment, even where an individual
`has not suffered a corresponding loss. See Cty. of San
`Bernardino v. Walsh, 158 Cal. App. 4th 533, 542 (2007)
`(noting that where “a benefit has been received by the
`defendant but the plaintiff has not suffered a corresponding
`loss, or in some cases, any loss, but nevertheless the
`enrichment of the defendant would be unjust . . . [t]he
`defendant may be under a duty to give to the plaintiff the
`
`4 To prevail on a claim for trespass to chattels, Plaintiffs must
`demonstrate that some actual injury may have occurred and that the owner
`of the property at issue may only recover the actual damages suffered as
`a result of the defendant’s actions. Intel Corp. v. Hamidi, 30 Cal. 4th
`1342, 1351–52 (2003). Fraud similarly requires damages, Beckwith v.
`Dahl, 205 Cal. App. 4th 1039, 1064 (2012), as does a violation of the
`CDAFA, Mintz v. Mark Bartelstein & Assocs., 906 F. Supp. 2d 1017,
`1032 (C.D. Cal. 2012) (noting that “[u]nder the plain language of the
`statute[,]” damages must be established). Damages is an inherent element
`of larceny.
`
`
`
`Case: 17-17486, 04/09/2020, ID: 11655970, DktEntry: 85-1, Page 15 of 38
`
`IN RE FACEBOOK, INC. INTERNET TRACKING LITIG. 15
`
`amount by which [the defendant] has been enriched” (quoting
`Rest., Restitution, § 1, com. e)); see also Ghirardo v.
`Antonioli, 14 Cal. 4th 39, 51 (1996) (“Under the law of
`restitution, an individual may be required to make restitution
`if he is unjustly enriched at the expense of another.”).
`
`In other words, California law requires disgorgement of
`unjustly earned profits regardless of whether a defendant’s
`actions caused a plaintiff to directly expend his or her own
`financial resources or whether a defendant’s actions directly
`caused the plaintiff’s property to become less valuable. See,
`e.g., CTC Real Estate Servs. v. Lepe, 140 Cal. App. 4th 856,
`860–61 (2006) (holding that a woman whose identity was
`stolen and used to obtain later-foreclosed-upon property was
`entitled to surplus funds from the sale at auction because “she
`was entitled to the product of identity theft”); Ward v.
`Taggert, 51 Cal. 2d 736, 742–43 (1959) (holding that
`plaintiffs could recover profits unjustly realized by a real
`estate agent who misrepresented the purchase price of real
`estate, even though the plaintiffs did not pay more than the
`land was worth when they purchased it); cf. Walsh, 158 Cal.
`App. 4th at 542–43 (holding that the district court did not err
`where it solely relied on profit to the defendants rather than
`loss to the plaintiffs to calculate damages).
`
`“The ‘gist of the question of standing’ is whether the
`plaintiff has a sufficiently ‘personal stake in the outcome of
`the controversy.’” Washington v. Trump, 847 F.3d 1151,
`1159 (9th Cir. 2017) (quoting Massachusetts v. EPA,
`549 U.S. 497, 517 (2007)). Because California law
`recognizes that individuals maintain an entitlement to
`unjustly earned profits, to establish standing, Plaintiffs must
`allege they retain a stake in the profits garnered from their
`personal browsing histories because “the circumstances are
`
`
`
`Case: 17-17486, 04/09/2020, ID: 11655970, DktEntry: 85-1, Page 16 of 38
`
`16
`
`IN RE FACEBOOK, INC. INTERNET TRACKING LITIG.
`
`such that, as between the two [parties], it is unjust for
`[Facebook] to retain it.” McBride v. Boughton, 123 Cal. App.
`4th 379, 389 (2004) (emphasis in original) (quoting First
`Nationwide Savings v. Perry, 11 Cal. App. 4th 1657, 1662
`(1992)). Under California law, this stake in unjustly earned
`profits exists regardless of whether an individual planned to
`sell his or her data or whether the individual’s data is made
`less valuable.
`
`Because California law recognizes a legal interest in
`unjustly earned profits, Plaintiffs have adequately pleaded an
`entitlement to Facebook’s profits from users’ personal data
`sufficient to confer Article III standing. Plaintiffs allege that
`their browsing histories carry financial value. They point to
`the existence of a study that values users’ browsing histories
`at $52 per year, as well as research panels that pay
`participants for access to their browsing histories.
`
`Plaintiffs also sufficiently allege that Facebook profited
`from this valuable data. According to the complaint,
`Facebook sold user data to advertisers in order to generate
`revenue. Indeed, as alleged, Facebook’s ad sales constituted
`over 90% of the social media platform’s revenue during the
`relevant period of logged-out user tracking.
`
`Plaintiffs’ allegations are sufficient at the pleading stage
`to demonstrate that these profits were unjustly earned. As
`stated in the complaint, “despite Facebook’s false guarantee
`to the contrary,” the platform “charges users by acquiring the
`users’ sensitive and valuable personal information” and
`selling it to advertisers for a profit. Plaintiffs allegedly did
`not provide authorization for the use of their personal
`information, nor did they have any control over its use to
`
`
`
`Case: 17-17486, 04/09/2020, ID: 11655970, DktEntry: 85-1, Page 17 of 38
`
`IN RE FACEBOOK, INC. INTERNET TRACKING LITIG. 17
`
`produce revenue. This unauthorized use of their information
`for profit would entitle Plaintiffs to profits unjustly earned.
`
`Thus, Plaintiffs sufficiently alleged a state law interest
`whose violation constitutes an injury sufficient to establish
`standing to bring their claims for CDAFA violations and
`California common law trespass to chattels, fraud, and
`statutory larceny.
`
`III
`
`Plaintiffs adequately stated claims for relief for invasion
`of privacy, intrusion upon seclusion, breach of contract,
`breach of the implied covenant of good faith and fair dealing,
`as well as their claims under the Wiretap Act and CIPA. In
`order to survive a motion to dismiss under Federal Rule of
`Civil Procedure 12(b)(6), the facts alleged must “plausibly
`give rise to an entitlement to relief.” Dougherty, 654 F.3d
`at 897 (quoting Ashcroft v. Iqbal, 556 U.S. 662, 679 (2009)).
`At the pleading stage, all allegations of material fact are taken
`as true and construed in the light most favorable to the non-
`moving party. Id.
`
`A
`
`Plaintiffs adequately stated claims for relief for intrusion
`upon seclusion and invasion of privacy under California law.
`To state a claim for intrusion upon seclusion under California
`common law, a plaintiff must plead that (1) a defendant
`“intentionally intrude[d] into a place, conversation, or matter
`as to which the plaintiff has a reasonable expectation of
`privacy[,]” and (2) the intrusion “occur[red] in a manner
`highly offensive to a reasonable person.” Hernandez v.
`Hillsides, Inc., 47 Cal. 4th 272, 286 (2009).
`
`
`
`Case: 17-17486, 04/09/2020, ID: 11655970, DktEntry: 85-1, Page 18 of 38
`
`18
`
`IN RE FACEBOOK, INC. INTERNET TRACKING LITIG.
`
`A claim for invasion of privacy under the California
`Constitution involves similar elements. Plaintiffs must show
`that (1) they possess a legally protected privacy interest,
`(2) they maintain a reasonable expectation of privacy, and (3)
`the intrusion is “so serious . . . as to constitute an egregious
`breach of the social norms” such that the breach is “highly
`offensive.” Id. at 287.
`
`Because of the similarity of the tests, courts consider the
`claims together and ask whether: (1) there exists a reasonable
`expectation of privacy, and (2) the intrusion was highly
`offensive. Id. We address both in turn.
`
`1
`
`The existence of a reasonable expectation of privacy,
`given the circumstances of each case, is a mixed question of
`law and fact. Hill v. NCAA, 7 Cal. 4th 1, 40 (1994).
`“[M]ixed questions of fact and law are reviewed de novo,
`unless the mixed question is primarily factual.” N.B. v.
`Hellgate Elem. Sch. Dist., ex rel. Bd. of Dirs., Missoula Cty.,
`Mont., 541 F.3d 1202, 1207 (9th Cir. 2008). Here, because
`we are reviewing the district court’s legal conclusions, we
`review de novo.
`
`We first consider whether a defendant gained “unwanted
`access to data by electronic or other covert means, in
`violation of the law or social norms.” Hernandez, 47 Cal.
`4th at 286 (internal quotation marks omitted). To make this
`determination, courts consider a variety of factors, including
`the customs, practices, and circumstances surrounding a
`defendant’s particular activities. Hill, 7 Cal. 4th at 36.
`
`
`
`Case: 17-17486, 04/09/2020, ID: 11655970, DktEntry: 85-1, Page 19 of 38
`
`IN RE FACEBOOK, INC. INTERNET TRACKING LITIG. 19
`
`Thus, the relevant question here is whether a user would
`reasonably expect that Facebook would have access to the
`user’s individual data after the user logged out of the
`application. Facebook’s privacy disclosures at the time
`allegedly failed to acknowledge its tracking of logged-out
`users, suggesting that users’ information would not be
`tracked.
`
`The applicable Facebook Statement of Rights and
`Responsibilities (“SRR”) stated:
`
`Your privacy is very important to us. We
`designed our Privacy Policy
`to make
`important disclosures about how you can use
`Facebook to share with others and how we
`collect and can use your content and
`information. We encourage you to read the
`Privacy Policy, and to use it to make informed
`decisions.
`
`SRR, dated April 26, 2011.
`
`Facebook’s applicable Data Use Policy,5 in turn, stated:
`
`We receive data whenever you visit a game,
`application, or website that uses [Facebook’s
`services]. This may include the date and time
`you visit the site; the web address, or URL,
`you’re on; technical information about the IP
`address, browser and the operating system
`
`5 This policy was originally titled “Privacy Policy.” During the class
`period, its title was changed to “Data Use Policy.”
`
`
`
`Case: 17-17486, 04/09/2020, ID: 11655970, DktEntry: 85-1, Page 20 of 38
`
`20
`
`IN RE FACEBOOK, INC. INTERNET TRACKING LITIG.
`
`you use; and, if you are logged in to
`Facebook, your user ID.
`
`Data Use Policy, dated September 7, 2011 (emphasis added).
`
`Finally, Facebook’s “Help Center” at the time included
`answers to questions related to data tracking. Most
`relevantly, one answer from a Help Center page at the time
`answered the question “[w]hat information does Facebook
`receive about me when I visit a website with a Facebook
`social plug in?”6 The Help Center page first stated that
`Facebook collected the date and time of the visit, the referer
`URL, and other technical information. It continued, “[i]f you
`are logged into Facebook, we also see your user ID number
`and email address. . . . If you log out of Facebook, we will
`not receive this information about partner websites but you
`will also not see personalized experiences on these sites.”
`
`Plaintiffs have plausibly alleged that an individual reading
`Facebook’s promise to “make important privacy disclosures”
`could have reasonably concluded that the basics of
`Facebook’s tracking—when, why, and how it tracks user
`information—would be provided. Plaintiffs have pla