9th Circuit: Privacy Breach Lawsuit Against Facebook Can Move Forward

A class action on behalf of all Facebook users active between May 27, 2010 and September 26, 2011, alleges that Facebook violated federal and state privacy laws by tracking users even when they were logged out of Facebook.
However, a district court threw out the lawsuit, finding that the plaintiffs lacked standing to bring the claims, and that even if they did have standing, Facebook's actions as alleged did not violate any privacy laws. On appeal, the Ninth Circuit Court of Appeals disagreed, saying that the class action can move forward.
Facebook Tracking
Facebook uses cookies and other methods to help compile information about its users into profiles, which it then uses for targeted advertising. The complaint alleges that Facebook knowingly tracked users even after they had logged out of Facebook, which could potentially violate the Wiretap Act and other federal and state privacy laws.
Facebook allegedly stopped tracking this user data only after a blogger revealed Facebook's practices. The plaintiffs are not alleging that Facebook sold this data to third parties.
Invasion of Privacy and Other Claims
The Ninth Circuit panel found that the plaintiffs, who were active Facebook users in 2010, had suffered a clear violation of a statutorily and historically recognized right to privacy, if their allegations were true. Because of this, they had standing to move forward on claims Facebook violated the Wiretap Act, the Stored Communications Act, and the Children's Internet Protection Act, among others.
Potential Violations of Several Privacy Laws
In addition, the appeals court held that the Facebook users did enough to show that Facebook, if it acted as alleged, did potentially violate the Wiretap Act, CIPA, and California's invasion of privacy law.
According to the Ninth Circuit, Facebook's privacy policy at the time failed to adequately inform users of the ways it was compiling information about them. Instead, “[p]laintiffs have plausibly alleged that Facebook set an expectation that logged-out user data would not be collected, but then collected it anyway."
And while Facebook did allow users to prevent Facebook from using cookies, this opt-in measure is a fact-based defense that needs to be litigated at trial, not at the pleadings stage.
The panel did, however, affirm the dismissal of some claims, including a breach of contract claim. The lawsuit now heads back to lower court to be litigated on the merits.
Related Resources
- Bad Day for Facebook and Big Tech (FindLaw's D.C. Circuit)
- Facebook Sued Over Video Numbers -- Again (FindLaw's U.S. Ninth Circuit)