In re Facebook, Inc. - 402 F. Supp. 3d 767 (N.D. Cal. 2019)

Rule:

The law has long recognized that a privacy invasion is itself the kind of injury that can be redressed in federal court, even if the invasion does not lead to some secondary economic injury like identity theft.

Facts:

Cambridge Analytica, a British political consulting firm, used personal information from millions of Facebook accounts to send targeted political messages during the 2016 presidential campaign. The firm obtained this information from Aleksandr Kogan, a researcher who had acquired it through his app, which Facebook had allowed him to deploy on its platform. In the months that followed, reports emerged suggesting that the ability of people like Kogan and entities like Cambridge Analytica to obtain sensitive Facebook user information was the norm rather than the exception. Following the Cambridge Analytica outcry, dozens of lawsuits were filed against Facebook in various courts around the country. The lawsuits were mostly in federal court, and they were mostly proposed class actions by individual Facebook users who contended that Facebook disseminated their sensitive personal information to Kogan without their consent and failed to prevent him from transferring it to Cambridge Analytica. Subsequently, Congress created the Judicial Panel on Multidistrict Litigation, which concluded that assignment to a single judge was warranted. A consolidated class action complaint was then filed. Facebook filed a motion to dismiss, arguing that people had no legitimate privacy interest in any information they make available to their friends on social media. Moreover, Facebook argued that even if its users had a privacy interest in the in the information they made available only to friends, there was no standing to sue in federal court because there was no tangible negative consequences from the dissemination of the information. Facebook also asserted that even if users retained a privacy interest in the information that was disclosed, and even if a “bare” privacy invasion conferred standing to sue in federal court, the lawsuit must be dismissed because Facebook users consented, in fine print, to the wide dissemination of their sensitive information. 

Issue:

1. Did the plaintiffs have standing to sue in federal court? 
2. Did the plaintiff Facebook users consent to the wide dissemination of their sensitive information? 

Answer:

1) Yes. 2) No.

Conclusion:

The Court denied Facebook’s motion to dismiss, except as regards few of the plaintiffs’ claims, holding that when a person shared sensitive information with a limited audience, the person retained privacy rights and can sue someone for violating such rights. Moreover, the Court held that the law has long recognized that a privacy invasion was itself the kind of injury that can be redressed in federal court, even if the invasion did not lead to some secondary economic injury like identity theft. The Court also held that the complaint adequately alleged that users who established their Facebook accounts prior to roughly 2009 never consented to the practice of disseminating their sensitive information. The Court further held that the complaint adequately alleged that no users ever consented to Facebook's other information-sharing practices — specifically, sharing with certain "whitelisted apps" starting in 2015, and sharing with certain "business partners" during much of the relevant time period. The complaint also adequately alleged that the users never consented to Facebook's widespread practice of allowing companies to sell and otherwise misuse sensitive user information, as opposed to restricting the use of this information as Facebook promised it would.