throbber
Case: 17-17486, 04/09/2020, ID: 11655970, DktEntry: 85-1, Page 1 of 38
`
`FOR PUBLICATION
`
`UNITED STATES COURT OF APPEALS
`FOR THE NINTH CIRCUIT
`
`No. 17-17486
`
`D.C. No.
`5:12-md-02314-
`EJD
`
`OPINION
`
`IN RE FACEBOOK, INC. INTERNET
`TRACKING LITIGATION,
`
`PERRIN AIKENS DAVIS; BRIAN K.
`LENTZ; CYNTHIA D. QUINN;
`MATTHEW J. VICKERY,
`Plaintiffs-Appellants,
`
`v.
`
`FACEBOOK, INC.,
`Defendant-Appellee.
`
`Appeal from the United States District Court
`for the Northern District of California
`Edward J. Davila, District Judge, Presiding
`
`Argued and Submitted April 16, 2019
`San Francisco, California
`
`Filed April 9, 2020
`
`

`

`Case: 17-17486, 04/09/2020, ID: 11655970, DktEntry: 85-1, Page 2 of 38
`
`2
`
`IN RE FACEBOOK, INC. INTERNET TRACKING LITIG.
`
`Before: Sidney R. Thomas, Chief Judge, Milan D.
`Smith, Jr., Circuit Judge, and Katherine H. Vratil,*
`District Judge.
`
`Opinion by Chief Judge Thomas
`
`SUMMARY**
`
`Standing / Privacy Law
`
`The panel affirmed the district court’s dismissal of the
`Stored Communications Act (“SCA”), breach of contract, and
`breach of implied covenant claims; reversed the dismissal of
`the remaining claims; and remanded for further consideration,
`in an action alleging privacy-related claims against Facebook,
`Inc.
`
`Facebook uses plug-ins to track users’ browsing histories
`when they visit third-party websites, and then complies these
`browsing histories into personal profiles which are sold to
`advertisers to generate revenue. Plaintiffs filed an amended
`complaint on behalf of themselves and a putative class of
`people who had active Facebook accounts between May 27,
`2010 and September 26, 2011. They alleged that Facebook
`executives were aware of the tracking of logged-out users and
`
`* The Honorable Kathryn H. Vratil, United States District Judge for
`the District of Kansas, sitting by designation.
`
`** This summary constitutes no part of the opinion of the court. It has
`been prepared by court staff for the convenience of the reader.
`
`

`

`Case: 17-17486, 04/09/2020, ID: 11655970, DktEntry: 85-1, Page 3 of 38
`
`IN RE FACEBOOK, INC. INTERNET TRACKING LITIG.
`
`3
`
`recognized that these practices posed various user-privacy
`issues.
`
`As an initial matter, the panel held that plaintiffs had
`standing to bring their claims. Specifically, the panel held
`that plaintiffs adequately alleged an invasion of a legally
`protected interest that was concrete and particularized.
`
`As to the statutory claims, the panel held that the
`legislative history and statutory text demonstrated that
`Congress and the California legislature intended to protect
`these historical privacy rights when they passed the Wiretap
`Act, SCA, and the California Invasion of Privacy Act
`(“CIPA”). In addition, plaintiffs adequately alleged that
`Facebook’s tracking and collection practices would cause
`harm or a material risk to their interest in controlling their
`personal information. Accordingly, plaintiffs sufficiently
`alleged a clear invasion of their right to privacy, and plaintiffs
`had standing to pursue their privacy claims under these
`statutes.
`
`As to plaintiffs’ alleged theories of California common
`law trespass to chattels and fraud, statutory larceny, and
`violations of the Computer Data Access and Fraud Act, the
`panel held that plaintiffs sufficiently alleged a state law
`interest whose violation constituted an injury sufficient to
`establish standing to bring their claims. Because California
`law recognizes a legal interest in unjustly earned profits,
`plaintiffs adequately pled an entitlement to Facebook’s profits
`from users’ data sufficient to confer Article III standing.
`Plaintiffs also sufficiently alleged that Facebook profited
`from this valuable data.
`
`

`

`Case: 17-17486, 04/09/2020, ID: 11655970, DktEntry: 85-1, Page 4 of 38
`
`4
`
`IN RE FACEBOOK, INC. INTERNET TRACKING LITIG.
`
`Turning to the merits, the panel held that plaintiffs
`adequately stated claims for relief for intrusion upon
`seclusion and invasion of privacy under California law. First,
`the panel held that in light of the privacy interests and
`Facebook’s allegedly surreptitious and unseen data collection,
`plaintiffs adequately alleged a reasonable expectation of
`privacy to survive a Fed. R. Civ. P. 12(b)(6) motion to
`dismiss. Second, plaintiffs identified sufficient facts to
`survive a motion to dismiss on the ultimate question of
`whether Facebook’s tracking and collection practices could
`highly offend a reasonable individual.
`
`The panel held that plaintiffs sufficiently alleged that
`Facebook’s tracking and collection practices violated the
`Wiretap Act and CIPA. Both statutes contain an exemption
`from liability for a person who is a “party” to the
`communication. Noting a circuit split, the panel adopted the
`First and Seventh Circuits’ understanding that simultaneous
`unknown duplication and communication of GET requests
`did not exempt Facebook from liability under the party
`exception. The panel concluded that Facebook was not
`exempt from liability as a matter of law under the Wiretap
`Act or CIPA, and did not opine whether plaintiffs adequately
`pleaded the other requisite elements of the statutes.
`
`The panel held that the district court properly dismissed
`plaintiffs’ claims under the SCA, which required plaintiffs to
`plead that Facebook gained unauthorized access to a
`“facility” where it accessed electronic communications in
`“electronic storage.” The panel agreed with the district
`court’s determination that plaintiffs’ data was not in
`electronic storage. The panel concluded that plaintiffs’
`claims for relief under the SCA were insufficient.
`
`

`

`Case: 17-17486, 04/09/2020, ID: 11655970, DktEntry: 85-1, Page 5 of 38
`
`IN RE FACEBOOK, INC. INTERNET TRACKING LITIG.
`
`5
`
`The panel held that the district court properly dismissed
`plaintiffs’ breach of contract claim for failure to state a claim.
`Plaintiffs alleged that Facebook entered into a contract with
`each plaintiff consisting of the Statement of Rights and
`Responsibilities, Privacy Policy, and relevant Help Center
`pages. The panel held that plaintiffs failed to adequately
`allege the existence of a contract that was subject to breach.
`The panel also held that the district court properly dismissed
`plaintiffs’ claim that Facebook’s tracking practices violated
`the implied covenant of good faith and fair dealing, where the
`allegations did not go beyond the asserted breach of contract
`theories.
`
`COUNSEL
`
`David A. Straite (argued), Frederic S. Fox, and Ralph E.
`Labaton, Kaplan Fox & Kilsheimer LLP, New York, New
`York; Laurence D. King, Matthew George, and Mario M.
`Choi, Kaplan Fox & Kilsheimer LLP, San Francisco,
`California; Stephen G. Grygiel, Silverman Thompson Slutkin
`White LLC, Baltimore, Maryland; for Plaintiffs-Appellants.
`
`Lauren R. Goldman (argued) and Michael Rayfield, Mayer
`Brown LLP, New York, New York; Matthew D. Brown,
`Cooley LLP, San Francisco, California; for Defendant-
`Appellee.
`
`Marc Rotenberg, Alan Butler, Natasha Babazadeh, and Sam
`Lester, Electronic Privacy Information Center, Washington,
`D.C., for Amicus Curiae Electronic Privacy Information
`Center (EPIC).
`
`

`

`Case: 17-17486, 04/09/2020, ID: 11655970, DktEntry: 85-1, Page 6 of 38
`
`IN RE FACEBOOK, INC. INTERNET TRACKING LITIG.
`
`ouglas Laycock, University of Virginia Law School,
`Charlottesville, Virginia; Steven W. Perlstein, Kobre & Kim
`LLP, New York, New York; Beau D. Barnes, Kobre & Kim
`LLP, Washington, D.C.; for Amicus Curiae Professor
`Douglas Laycock.
`
`6 D
`
`OPINION
`
`THOMAS, Chief Judge:
`
`In this appeal, we are asked to determine whether:
`(1) Facebook-users Perrin Davis, Brian Lentz, Cynthia Quinn,
`and Mathew Vickery (“Plaintiffs”) have standing to allege
`privacy-related claims against Facebook, and (2) Plaintiffs
`adequately allege claims that Facebook is liable for common
`law and statutory privacy violations when it tracked their
`browsing histories after they had logged out of the Facebook
`application. We have jurisdiction pursuant to 28 U.S.C.
`§ 1291. We affirm in part; reverse in part; and remand for
`further proceedings.
`
`I
`
`Facebook uses plug-ins1 to track users’ browsing histories
`when they visit third-party websites, and then compiles these
`browsing histories into personal profiles which are sold to
`advertisers to generate revenue. The parties do not dispute
`that Facebook engaged in these tracking practices after its
`users had logged out of Facebook.
`
`1 A plug-in is a program that extends the functionality of an existing
`program, such as an internet browser.
`
`

`

`Case: 17-17486, 04/09/2020, ID: 11655970, DktEntry: 85-1, Page 7 of 38
`
`IN RE FACEBOOK, INC. INTERNET TRACKING LITIG.
`
`7
`
`Facebook facilitated this practice by embedding third-
`party plug-ins on third-party web pages. The plug-ins, such
`as Facebook’s “Like” button, contain bits of Facebook code.
`When a user visits a page that includes these plug-ins, this
`code is able to replicate and send the user data to Facebook
`through a separate, but simultaneous, channel in a manner
`undetectable by the user.
`
`As relevant to this appeal, the information Facebook
`allegedly collected included the website’s Uniform Resource
`Locator (“URL”) that was accessed by the user. URLs both
`identify an internet resource and describe its location or
`address. “[W]hen users enter URL addresses into their web
`browser using the ‘http’ web address format, or click on
`hyperlinks, they are actually telling their web browsers (the
`client) which resources to request and where to find them. In
`re Zynga Privacy Litig., 750 F.3d 1098, 1101 (9th Cir. 2014).
`Thus, the URL provides significant information regarding the
`user’s browsing history, including the identity of the
`individual internet user and the web server, as well as the
`name of the web page and the search terms that the user used
`to find it. In technical parlance, this collected URL is called
`a “referer header” or “referer.” Facebook also allegedly
`collected the third-party website’s Internet Protocol (“IP”)
`address,2 which reveals only the owner of the website.
`
`Facebook allegedly compiled the referer headers it
`collected into personal user profiles using “cookies”—small
`text files stored on the user’s device. When a user creates a
`Facebook account, more than ten Facebook cookies are
`
`2 An “IP address” is a numerical identifier for each computer or
`network connected to the Internet. hiQ Labs, Inc. v. LinkedIn Corp., 938
`F.3d 985, 991 n.4 (9th Cir. 2019).
`
`

`

`Case: 17-17486, 04/09/2020, ID: 11655970, DktEntry: 85-1, Page 8 of 38
`
`IN RE FACEBOOK, INC. INTERNET TRACKING LITIG.
`
`laced on the user’s browser. These cookies store the user’s
`login ID, and they capture, collect, and compile the referer
`headers from the web pages visited by the user. As most
`relevant to this appeal, these cookies allegedly continued to
`capture information after a user logged out of Facebook and
`visited other websites.
`
`8 p
`
`Plaintiffs claim that internal Facebook communications
`revealed that company executives were aware of the tracking
`of logged-out users and recognized that these practices posed
`various user-privacy issues. According to the Plaintiffs,
`Facebook stopped tracking logged-out users only after
`Australian blogger Nik Cubrilovic published a blog detailing
`Facebook’s tracking practices.3
`
`Plaintiffs filed a consolidated complaint on behalf of
`themselves and a putative class of people who had active
`Facebook accounts between May 27, 2010 and September 26,
`2011. After the district court dismissed their first complaint
`with leave to amend, Plaintiffs filed an amended complaint.
`In the amended complaint, they alleged a number of claims.
`The claims relevant to this appeal consist of: (1) violation of
`the Wiretap Act, 18 U.S.C. § 2510, et seq.; (2) violation of
`the Stored Communications Act (“SCA”), 18 U.S.C. § 2701;
`(3) violation of the California Invasion of Privacy Act
`(“CIPA”), Cal. Pen. Code §§ 631, 632; (4) invasion of
`privacy; (5) intrusion upon seclusion; (6) breach of contract;
`(7) breach of the duty of good faith and fair dealing; (8) civil
`
`3 The blog post quickly gained notoriety and played a role in a lawsuit
`that alleged multiple counts of deceptive trade practices brought against
`Facebook by the Federal Trade Commission. In the Matter of Facebook
`Inc., FTC File No. 0923184. Facebook reached a settlement with the FTC
`in November 2011.
`
`

`

`Case: 17-17486, 04/09/2020, ID: 11655970, DktEntry: 85-1, Page 9 of 38
`
`IN RE FACEBOOK, INC. INTERNET TRACKING LITIG.
`
`9
`
`fraud; (9) trespass to chattels; (10) violations of California
`Penal Code § 502 Computer Data Access and Fraud Act
`(“CDAFA”); and (11) statutory larceny under California
`Penal Code §§ 484 and 496.
`
`The district court granted Facebook’s motion to dismiss
`the amended complaint. First, the district court determined
`that Plaintiffs had failed to show they had standing to pursue
`claims that included economic damages as an element, thus
`disposing of the claims for trespass to chattels, violations of
`the CDAFA, fraud, and statutory larceny. It dismissed these
`claims without leave to amend.
`
`The district court also dismissed for failure to state a
`claim, without leave to amend, Plaintiffs’ claims for
`violations of the Wiretap Act, CIPA, and the SCA, as well as
`their common law claims for invasion of privacy and
`intrusion upon seclusion. The district court dismissed the
`claims for breach of contract and the breach of the implied
`covenant of good faith and fair dealing, but granted leave to
`amend these claims. In response, Plaintiffs amended their
`complaint as to the breach of contract and implied covenant
`claims. The district court subsequently granted Facebook’s
`motion to dismiss the amended claims. This timely appeal
`followed.
`
`We review de novo a district court’s determination of
`whether a party has standing. San Luis & Delta-Mendota
`Water Auth. v. United States, 672 F.3d 676, 699 (9th Cir.
`2012). We review de novo dismissals for failure to state a
`claim under Rule 12(b)(6). Dougherty v. City of Covina,
`654 F.3d 892, 897 (9th Cir. 2011).
`
`

`

`Case: 17-17486, 04/09/2020, ID: 11655970, DktEntry: 85-1, Page 10 of 38
`
`10
`
`IN RE FACEBOOK, INC. INTERNET TRACKING LITIG.
`
`II
`
`The Plaintiffs have standing to bring their claims.
`“Where standing is raised in connection with a motion to
`dismiss, the court is to ‘accept as true all material allegations
`of the complaint, and . . . construe the complaint in favor of
`the complaining party.’” Levine v. Vilsack, 587 F.3d 986,
`991 (9th Cir. 2009) (quoting Thomas v. Mundell, 572 F.3d
`756, 760 (9th Cir. 2009)).
`
`To establish standing, a “[p]laintiff must have (1) suffered
`an injury in fact, (2) that is fairly traceable to the challenged
`conduct of the defendant, and (3) that is likely to be redressed
`by a favorable judicial decision.” Spokeo v. Robins, __ U.S.
`__, 136 S. Ct. 1540, 1547 (2016). To establish an injury in
`fact, a plaintiff must show that he or she suffered “an invasion
`of a legally protected interest” that is “concrete and
`particularized.” Id. at 1548 (quoting Lujan v. Defs. of
`Wildlife, 504 U.S. 555, 560 (1992)). A particularized injury
`is one that affects the plaintiff in a “personal and individual
`way.” Id.; see also Dutta v. State Farm Mutual Auto. Ins.
`Co., 895 F.3d 1166, 1173 (9th Cir. 2018).
`
`A concrete injury is one that is “real and not abstract.”
`Spokeo, 136 S.Ct. at 1548 (internal quotation marks omitted).
`Although an injury “must be ‘real’ and ‘not abstract’ or
`purely ‘procedural’ . . . it need not be ‘tangible.’” Dutta,
`895 F.3d at 1173. Indeed, though a bare procedural violation
`of a statute is insufficient to establish an injury in fact,
`Congress may “elevat[e] to the status of legally cognizable
`injuries concrete, de facto injuries that were previously
`inadequate” to confer standing. Spokeo, 136 S. Ct. at 1549
`(quoting Lujan, 504 U.S. at 578).
`
`

`

`Case: 17-17486, 04/09/2020, ID: 11655970, DktEntry: 85-1, Page 11 of 38
`
`IN RE FACEBOOK, INC. INTERNET TRACKING LITIG. 11
`
`To determine whether Congress has done so, we ask
`whether: (1) “Congress enacted the statute at issue to protect
`a concrete interest that is akin to a historical, common law
`interest[,]” and (2) the alleged procedural violation caused
`real harm or a material risk of harm to these interests. Dutta,
`895 F.3d at 1174.
`
`A
`
`The district court properly concluded that Plaintiffs had
`established standing to bring claims for invasion of privacy,
`intrusion upon seclusion, breach of contract, breach of the
`implied covenant of good faith and fair dealing, as well as
`claims under the Wiretap Act and CIPA, because they
`adequately alleged privacy harms.
`
`Plaintiffs have adequately alleged an invasion of a legally
`protected interest that is concrete and particularized.
`“[V]iolations of the right to privacy have long been
`actionable at common law.” Patel v. Facebook, 932 F.3d
`1264, 1272 (9th Cir. 2019) (quoting Eichenberger v. ESPN,
`Inc., 876 F.3d 979, 983 (9th Cir. 2017)). A right to privacy
`“encompass[es] the individual’s control of information
`concerning his or her person.” Eichenberger, 876 F.3d at 983
`(quoting U.S. Dep’t of Justice v. Reporters Comm. for
`Freedom of the Press, 489 U.S. 749, 763 (1989)).
`
`As to the statutory claims, the legislative history and
`statutory text demonstrate that Congress and the California
`legislature intended to protect these historical privacy rights
`when they passed the Wiretap Act, SCA, and CIPA. See S.
`REP. NO. 99-541, at 2 (1986) (“[The Wiretap Act] is the
`primary law protecting the security and privacy of business
`and personal communications in the United States today.”);
`
`

`

`Case: 17-17486, 04/09/2020, ID: 11655970, DktEntry: 85-1, Page 12 of 38
`
`12
`
`IN RE FACEBOOK, INC. INTERNET TRACKING LITIG.
`
`Id. at 3 (“[The SCA] is modeled after the Right to Financial
`Privacy Act, 12 U.S.C. § 3401 et seq. to protect privacy
`interests in personal and proprietary information . . . .”); Cal.
`Pen. Code § 630 (noting that CIPA was passed “to protect the
`right of privacy of the people of this state”). Thus, these
`statutory provisions codify a substantive right to privacy, the
`violation of which gives rise to a concrete injury sufficient to
`confer standing. See Campbell v. Facebook, Inc., —F.3d—,
`2020 WL 1023350, at *7–8 (9th Cir. Mar. 3, 2020).
`
`Plaintiffs have adequately alleged harm to these privacy
`interests. Plaintiffs alleged that Facebook continued to
`collect their data after they had logged off the social media
`platform, in order to receive and compile their personally
`identifiable browsing history. As alleged in the complaint,
`this tracking occurred “no matter how sensitive” or personal
`users’ browsing histories were.
` Facebook allegedly
`constantly compiled and updated its database with its users’
`browsing activities, including what they did when they were
`not using Facebook. According to Plaintiffs, by correlating
`users’ browsing history with users’ personal Facebook
`profiles—profiles that could include a user’s employment
`history and political and religious affiliations—Facebook
`gained a cradle-to-grave profile without users’ consent.
`
`Here, Plaintiffs have adequately alleged that Facebook’s
`tracking and collection practices would cause harm or a
`material risk of harm to their interest in controlling their
`personal information. As alleged, Facebook’s tracking
`practices allow it to amass a great degree of personalized
`information. Facebook’s user profiles would allegedly reveal
`an individual’s likes, dislikes, interests, and habits over a
`significant amount of time, without affording users a
`
`

`

`Case: 17-17486, 04/09/2020, ID: 11655970, DktEntry: 85-1, Page 13 of 38
`
`IN RE FACEBOOK, INC. INTERNET TRACKING LITIG. 13
`
`meaningful opportunity to control or prevent the unauthorized
`exploration of their private lives.
`
`“[A]dvances in technology can increase the potential for
`unreasonable intrusions into personal privacy.” Patel,
`932 F.3d at 1272. As the Third Circuit has noted, “[i]n an era
`when millions of Americans conduct their affairs increasingly
`through electronic devices, the assertion . . . that federal
`courts are powerless to provide a remedy when an internet
`company surreptitiously collects private data . . . is untenable.
`Nothing in Spokeo or any other Supreme Court decision
`suggests otherwise.” In re Google Inc. Cookie Placement
`Consumer Privacy Litig., 934 F.3d 316, 325 (3rd Cir. 2019)
`(“In re Google Cookie”).
`
`Accordingly, Plaintiffs have sufficiently alleged a clear
`invasion of the historically recognized right to privacy.
`Therefore, Plaintiffs have standing to pursue their privacy
`claims under the Wiretap Act, SCA, and CIPA, as well as
`their claims for breach of contract and breach of the implied
`covenant of good faith and fair dealing.
`
`B
`
`Plaintiffs also alleged theories of California common law
`trespass to chattels and fraud, statutory larceny, and
`violations of the CDAFA. The district court dismissed these
`claims for lack of standing, concluding that the Plaintiffs
`failed to demonstrate that they had suffered the economic
`
`

`

`Case: 17-17486, 04/09/2020, ID: 11655970, DktEntry: 85-1, Page 14 of 38
`
`14
`
`IN RE FACEBOOK, INC. INTERNET TRACKING LITIG.
`
`injury the district court viewed as necessary to bring each of
`these claims.4 We respectfully disagree.
`
`Plaintiffs allege that Facebook is unjustly enriched
`through the use of their data. Facebook argues that unjust
`enrichment is not sufficient to confer standing, and that
`Plaintiffs must instead demonstrate that they either planned
`to sell their data, or that their data was made less valuable
`through Facebook’s use. They similarly assert that Plaintiffs’
`entitlement to damages does not constitute an injury for
`purposes of standing.
`
`However, “state law can create interests that support
`standing in federal courts.” Cantrell v. City of Long Beach,
`241 F.3d 674, 684 (9th Cir. 2001). As relevant here,
`California law recognizes a right to disgorgement of profits
`resulting from unjust enrichment, even where an individual
`has not suffered a corresponding loss. See Cty. of San
`Bernardino v. Walsh, 158 Cal. App. 4th 533, 542 (2007)
`(noting that where “a benefit has been received by the
`defendant but the plaintiff has not suffered a corresponding
`loss, or in some cases, any loss, but nevertheless the
`enrichment of the defendant would be unjust . . . [t]he
`defendant may be under a duty to give to the plaintiff the
`
`4 To prevail on a claim for trespass to chattels, Plaintiffs must
`demonstrate that some actual injury may have occurred and that the owner
`of the property at issue may only recover the actual damages suffered as
`a result of the defendant’s actions. Intel Corp. v. Hamidi, 30 Cal. 4th
`1342, 1351–52 (2003). Fraud similarly requires damages, Beckwith v.
`Dahl, 205 Cal. App. 4th 1039, 1064 (2012), as does a violation of the
`CDAFA, Mintz v. Mark Bartelstein & Assocs., 906 F. Supp. 2d 1017,
`1032 (C.D. Cal. 2012) (noting that “[u]nder the plain language of the
`statute[,]” damages must be established). Damages is an inherent element
`of larceny.
`
`

`

`Case: 17-17486, 04/09/2020, ID: 11655970, DktEntry: 85-1, Page 15 of 38
`
`IN RE FACEBOOK, INC. INTERNET TRACKING LITIG. 15
`
`amount by which [the defendant] has been enriched” (quoting
`Rest., Restitution, § 1, com. e)); see also Ghirardo v.
`Antonioli, 14 Cal. 4th 39, 51 (1996) (“Under the law of
`restitution, an individual may be required to make restitution
`if he is unjustly enriched at the expense of another.”).
`
`In other words, California law requires disgorgement of
`unjustly earned profits regardless of whether a defendant’s
`actions caused a plaintiff to directly expend his or her own
`financial resources or whether a defendant’s actions directly
`caused the plaintiff’s property to become less valuable. See,
`e.g., CTC Real Estate Servs. v. Lepe, 140 Cal. App. 4th 856,
`860–61 (2006) (holding that a woman whose identity was
`stolen and used to obtain later-foreclosed-upon property was
`entitled to surplus funds from the sale at auction because “she
`was entitled to the product of identity theft”); Ward v.
`Taggert, 51 Cal. 2d 736, 742–43 (1959) (holding that
`plaintiffs could recover profits unjustly realized by a real
`estate agent who misrepresented the purchase price of real
`estate, even though the plaintiffs did not pay more than the
`land was worth when they purchased it); cf. Walsh, 158 Cal.
`App. 4th at 542–43 (holding that the district court did not err
`where it solely relied on profit to the defendants rather than
`loss to the plaintiffs to calculate damages).
`
`“The ‘gist of the question of standing’ is whether the
`plaintiff has a sufficiently ‘personal stake in the outcome of
`the controversy.’” Washington v. Trump, 847 F.3d 1151,
`1159 (9th Cir. 2017) (quoting Massachusetts v. EPA,
`549 U.S. 497, 517 (2007)). Because California law
`recognizes that individuals maintain an entitlement to
`unjustly earned profits, to establish standing, Plaintiffs must
`allege they retain a stake in the profits garnered from their
`personal browsing histories because “the circumstances are
`
`

`

`Case: 17-17486, 04/09/2020, ID: 11655970, DktEntry: 85-1, Page 16 of 38
`
`16
`
`IN RE FACEBOOK, INC. INTERNET TRACKING LITIG.
`
`such that, as between the two [parties], it is unjust for
`[Facebook] to retain it.” McBride v. Boughton, 123 Cal. App.
`4th 379, 389 (2004) (emphasis in original) (quoting First
`Nationwide Savings v. Perry, 11 Cal. App. 4th 1657, 1662
`(1992)). Under California law, this stake in unjustly earned
`profits exists regardless of whether an individual planned to
`sell his or her data or whether the individual’s data is made
`less valuable.
`
`Because California law recognizes a legal interest in
`unjustly earned profits, Plaintiffs have adequately pleaded an
`entitlement to Facebook’s profits from users’ personal data
`sufficient to confer Article III standing. Plaintiffs allege that
`their browsing histories carry financial value. They point to
`the existence of a study that values users’ browsing histories
`at $52 per year, as well as research panels that pay
`participants for access to their browsing histories.
`
`Plaintiffs also sufficiently allege that Facebook profited
`from this valuable data. According to the complaint,
`Facebook sold user data to advertisers in order to generate
`revenue. Indeed, as alleged, Facebook’s ad sales constituted
`over 90% of the social media platform’s revenue during the
`relevant period of logged-out user tracking.
`
`Plaintiffs’ allegations are sufficient at the pleading stage
`to demonstrate that these profits were unjustly earned. As
`stated in the complaint, “despite Facebook’s false guarantee
`to the contrary,” the platform “charges users by acquiring the
`users’ sensitive and valuable personal information” and
`selling it to advertisers for a profit. Plaintiffs allegedly did
`not provide authorization for the use of their personal
`information, nor did they have any control over its use to
`
`

`

`Case: 17-17486, 04/09/2020, ID: 11655970, DktEntry: 85-1, Page 17 of 38
`
`IN RE FACEBOOK, INC. INTERNET TRACKING LITIG. 17
`
`produce revenue. This unauthorized use of their information
`for profit would entitle Plaintiffs to profits unjustly earned.
`
`Thus, Plaintiffs sufficiently alleged a state law interest
`whose violation constitutes an injury sufficient to establish
`standing to bring their claims for CDAFA violations and
`California common law trespass to chattels, fraud, and
`statutory larceny.
`
`III
`
`Plaintiffs adequately stated claims for relief for invasion
`of privacy, intrusion upon seclusion, breach of contract,
`breach of the implied covenant of good faith and fair dealing,
`as well as their claims under the Wiretap Act and CIPA. In
`order to survive a motion to dismiss under Federal Rule of
`Civil Procedure 12(b)(6), the facts alleged must “plausibly
`give rise to an entitlement to relief.” Dougherty, 654 F.3d
`at 897 (quoting Ashcroft v. Iqbal, 556 U.S. 662, 679 (2009)).
`At the pleading stage, all allegations of material fact are taken
`as true and construed in the light most favorable to the non-
`moving party. Id.
`
`A
`
`Plaintiffs adequately stated claims for relief for intrusion
`upon seclusion and invasion of privacy under California law.
`To state a claim for intrusion upon seclusion under California
`common law, a plaintiff must plead that (1) a defendant
`“intentionally intrude[d] into a place, conversation, or matter
`as to which the plaintiff has a reasonable expectation of
`privacy[,]” and (2) the intrusion “occur[red] in a manner
`highly offensive to a reasonable person.” Hernandez v.
`Hillsides, Inc., 47 Cal. 4th 272, 286 (2009).
`
`

`

`Case: 17-17486, 04/09/2020, ID: 11655970, DktEntry: 85-1, Page 18 of 38
`
`18
`
`IN RE FACEBOOK, INC. INTERNET TRACKING LITIG.
`
`A claim for invasion of privacy under the California
`Constitution involves similar elements. Plaintiffs must show
`that (1) they possess a legally protected privacy interest,
`(2) they maintain a reasonable expectation of privacy, and (3)
`the intrusion is “so serious . . . as to constitute an egregious
`breach of the social norms” such that the breach is “highly
`offensive.” Id. at 287.
`
`Because of the similarity of the tests, courts consider the
`claims together and ask whether: (1) there exists a reasonable
`expectation of privacy, and (2) the intrusion was highly
`offensive. Id. We address both in turn.
`
`1
`
`The existence of a reasonable expectation of privacy,
`given the circumstances of each case, is a mixed question of
`law and fact. Hill v. NCAA, 7 Cal. 4th 1, 40 (1994).
`“[M]ixed questions of fact and law are reviewed de novo,
`unless the mixed question is primarily factual.” N.B. v.
`Hellgate Elem. Sch. Dist., ex rel. Bd. of Dirs., Missoula Cty.,
`Mont., 541 F.3d 1202, 1207 (9th Cir. 2008). Here, because
`we are reviewing the district court’s legal conclusions, we
`review de novo.
`
`We first consider whether a defendant gained “unwanted
`access to data by electronic or other covert means, in
`violation of the law or social norms.” Hernandez, 47 Cal.
`4th at 286 (internal quotation marks omitted). To make this
`determination, courts consider a variety of factors, including
`the customs, practices, and circumstances surrounding a
`defendant’s particular activities. Hill, 7 Cal. 4th at 36.
`
`

`

`Case: 17-17486, 04/09/2020, ID: 11655970, DktEntry: 85-1, Page 19 of 38
`
`IN RE FACEBOOK, INC. INTERNET TRACKING LITIG. 19
`
`Thus, the relevant question here is whether a user would
`reasonably expect that Facebook would have access to the
`user’s individual data after the user logged out of the
`application. Facebook’s privacy disclosures at the time
`allegedly failed to acknowledge its tracking of logged-out
`users, suggesting that users’ information would not be
`tracked.
`
`The applicable Facebook Statement of Rights and
`Responsibilities (“SRR”) stated:
`
`Your privacy is very important to us. We
`designed our Privacy Policy
`to make
`important disclosures about how you can use
`Facebook to share with others and how we
`collect and can use your content and
`information. We encourage you to read the
`Privacy Policy, and to use it to make informed
`decisions.
`
`SRR, dated April 26, 2011.
`
`Facebook’s applicable Data Use Policy,5 in turn, stated:
`
`We receive data whenever you visit a game,
`application, or website that uses [Facebook’s
`services]. This may include the date and time
`you visit the site; the web address, or URL,
`you’re on; technical information about the IP
`address, browser and the operating system
`
`5 This policy was originally titled “Privacy Policy.” During the class
`period, its title was changed to “Data Use Policy.”
`
`

`

`Case: 17-17486, 04/09/2020, ID: 11655970, DktEntry: 85-1, Page 20 of 38
`
`20
`
`IN RE FACEBOOK, INC. INTERNET TRACKING LITIG.
`
`you use; and, if you are logged in to
`Facebook, your user ID.
`
`Data Use Policy, dated September 7, 2011 (emphasis added).
`
`Finally, Facebook’s “Help Center” at the time included
`answers to questions related to data tracking. Most
`relevantly, one answer from a Help Center page at the time
`answered the question “[w]hat information does Facebook
`receive about me when I visit a website with a Facebook
`social plug in?”6 The Help Center page first stated that
`Facebook collected the date and time of the visit, the referer
`URL, and other technical information. It continued, “[i]f you
`are logged into Facebook, we also see your user ID number
`and email address. . . . If you log out of Facebook, we will
`not receive this information about partner websites but you
`will also not see personalized experiences on these sites.”
`
`Plaintiffs have plausibly alleged that an individual reading
`Facebook’s promise to “make important privacy disclosures”
`could have reasonably concluded that the basics of
`Facebook’s tracking—when, why, and how it tracks user
`information—would be provided. Plaintiffs have pla

This document is available on Docket Alarm but you must sign up to view it.


Or .

Accessing this document will incur an additional charge of $.

After purchase, you can access this document again without charge.

Accept $ Charge
throbber

Still Working On It

This document is taking longer than usual to download. This can happen if we need to contact the court directly to obtain the document and their servers are running slowly.

Give it another minute or two to complete, and then try the refresh button.

throbber

A few More Minutes ... Still Working

It can take up to 5 minutes for us to download a document if the court servers are running slowly.

Thank you for your continued patience.

This document could not be displayed.

We could not find this document within its docket. Please go back to the docket page and check the link. If that does not work, go back to the docket and refresh it to pull the newest information.

Your account does not support viewing this document.

You need a Paid Account to view this document. Click here to change your account type.

Your account does not support viewing this document.

Set your membership status to view this document.

With a Docket Alarm membership, you'll get a whole lot more, including:

  • Up-to-date information for this case.
  • Email alerts whenever there is an update.
  • Full text search for other cases.
  • Get email alerts whenever a new case matches your search.

Become a Member

One Moment Please

The filing “” is large (MB) and is being downloaded.

Please refresh this page in a few minutes to see if the filing has been downloaded. The filing will also be emailed to you when the download completes.

Your document is on its way!

If you do not receive the document in five minutes, contact support at support@docketalarm.com.

Sealed Document

We are unable to display this document, it may be under a court ordered seal.

If you have proper credentials to access the file, you may proceed directly to the court's system using your government issued username and password.


Access Government Site

We are redirecting you
to a mobile optimized page.





Document Unreadable or Corrupt

Refresh this Document
Go to the Docket

We are unable to display this document.

Refresh this Document
Go to the Docket