2:24pm PT by Ashley Cullins
Facebook Can't Deactivate Privacy Class Action
Facebook must face an invasion of privacy class action after a California federal judge on Monday largely denied its motion to dismiss the complaint.
A class of Facebook users in June 2018 sued the company claiming their privacy was invaded when sensitive information including photos, videos and private messages were shared with app developers and business partners.
Facebook asked the court to toss the lawsuit, and U.S. District Judge Vince Chhabria started his analysis by looking at the company's underlying arguments regarding privacy and consent, many of which he skewered.
"Facebook’s view is that once you make information available to your friends on social media, you completely relinquish any privacy interest in that information," Chhabria writes. "The problem with Facebook’s argument is that it treats privacy as an all-or-nothing proposition — either you retain a full privacy interest by not sharing information with anyone, or you have no privacy interest whatsoever by virtue of sharing it even in a limited fashion."
Chhabria finds that users can have their privacy invaded if information they meant to be consumed by a limited group is more widely disseminated, although in a footnote he posits that a user may lose any expectation of privacy if their settings allow "friends of friends" access.
Next, he turns the the argument that the plaintiffs don't have standing to sue in federal court because there were no further consequences stemming from the dissemination of the information. "To say that a 'mere' privacy invasion is not capable of inflicting an 'actual injury' serious enough to warrant the attention of the federal courts is to disregard the importance of privacy in our society, not to mention the historic role of the federal judiciary in protecting it," writes Chhabria.
Chhabria has a tougher time with the company's consent argument, which he summarizes as "Facebook users consented, in fine print, to the wide dissemination of their sensitive information."
He explains that under California law he's bound to assume — even if it isn't true — that users "reviewed, understood, and agreed to" all of Facebook's terms when signing up for accounts. Still, Chhabria won't dismiss the complaint now. "[E]ven though Facebook’s arguments regarding user consent have some legal force and will somewhat limit the scope of the lawsuit, they cannot defeat the lawsuit entirely, at least at the pleading stage," he writes.
Chhabria notes that some of the information sharing was detailed in Facebook's Data Use Policy, specifically that “if you share something on Facebook anyone who can see it can share it with others, including the games, applications, and websites they use.” In order to stop it, the policy instructed users to turn off all platform applications, which would also prevent them from using any third-party games and apps. This term was added in 2009 and Chhabria will allow any user who signed up before then to still pursue claims based on the alleged app-sharing conduct.
"The bottom line on the issue of consent is this: the complaint plausibly alleges that some users (and some plaintiffs) did not consent to the arrangement whereby app developers could access their sensitive information simply by interacting with their friends," he writes. "For the remaining three categories of misconduct — sharing with whitelisted apps, sharing with business partners, and failing to prevent misuse of information by third parties — the complaint plausibly alleges that none of the users consented."
While most of the plaintiffs' claims survived the motion to dismiss, Chhabria did throw out the causes of action for violation of the right of publicity and unfair competition and most claims related to the app-sharing allegation for anyone who joined the site after the terms changed in 2009.
The full opinion is posted below.