Embed Size (px)
Citation preview
Complaint for Damages and Injunctive Relief - 1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
Dana B. Taschner, State Bar No. 135494 LANIER LAW FIRM, PC 2029 Century Park East Suite 1400 Los Angeles, CA 90067 Phone: (310) 277-5100 Fax: (310) 277-5103 [email protected] W. Mark Lanier LANIER LAW FIRM, PC 6810 FM 1960 West Houston, Texas 77069 Phone: (713) 659-5200 Fax: (713) 659-2204 Attorneys for Plaintiffs
SUPERIOR COURT OF THE STATE OF CALIFORNIA
COUNTY OF ORANGE
ELISHA MELKONIAN, XAVIER O., a
minor by and through his guardian ad
litem, CHRIS C., a minor by and through
his guardian ad litem, CATHERINE AIKO,
and ELVINA BECK,
Plaintiffs,
V.
FACEBOOK, INC., a Delaware
Corporation, and DOES 1-100, inclusive,
Defendants,
) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) )
CASE NO. COMPLAINT FOR: 1) VIOLATION OF CALIFORNIA CIVIL
CODE § 3344 2) MISAPPROPRIATION OF NAME AND LIKENESS 3) UNFAIR COMPETITION AND FALSE
ADVERTISING UNDER CALIFORNIA BUSINESS AND PROFESSIONS CODE § 17200
4) VIOLATION OF CALIFORNIA CONSTITUTIONAL RIGHT TO PRIVACY
5) VIOLATION OF CALIFORNIA ONLINE PRIVACY ACT
DEMAND FOR JURY TRIAL
) )
Complaint for Damages and Injunctive Relief - 2
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
24
16
17
18
19
20
21
22
23
1. This is a private Attorney General action brought by on behalf of Plaintiffs
and the general public to remedy violations of California’s Civil Code Section 3344,
California Constitutional Rights of Privacy, the California Online Privacy Act, Consumer
Legal Remedies Act (CLRA), California Civil Code Sections 1750 et seq, and the Unfair
Trade Practices Act, California Business & Professions §17200, arising out of
Defendants’ commercial misappropriation of Plaintiff’s’ names, photographs, likenesses,
and private information. Plaintiffs relied on Defendant’s misrepresentations and
omissions of material facts, and violations of California’s privacy and right of publicity
laws.
25
26
27
28
2. Facebook is the nation’s foremost social networking website. It is owned
and operated by Facebook, Inc. Facebook markets itself as a social utility that connects
people with friends and others who work, study and live around them. Facebook has
become one of the fastest growing websites with reports of a million new Users signing
up each week. It is now one of the top websites in the U.S. with more than 250 million
Plaintiffs ELISHA MELKONIAN, XAVIER O., a minor by and through his guardian
ad litem, CHRIS C., a minor by and through his guardian ad litem, CATHERINE AIKO,
and ELVINA BECK (collectively, “Plaintiffs’”), on behalf of themselves and the general
public, allege all on information and belief the following against Defendants,
FACEBOOK, INC., (hereinafter referred to as “Facebook”) and Does 1 through 100,
inclusive, for violations of California Civil Code Section 3344, California Constitutional
Rights of Privacy, the California Online Privacy Act, Consumer Legal Remedies Act
(CLRA), California Civil Code Section 1750, Unfair Competition and False Advertising
Under Business and Professions Code Section 17200, and other claims.
I. INTRODUCTION & SUMMARY OF ACTION
Complaint for Damages and Injunctive Relief - 3
1
2
3
Users. Much of that phenomenal growth can be attributed to Users’ trust in the
company’s privacy assurances. Users are led to believe that access to the data they
post is limited to other Users they have expressly authorized.
4
8
15
21
27
28
5
6
7
3. Facebook’s business model, however, has transformed from that of a
social network into that of a a data mining company. Facebook actively seeks to open
and/or disseminate private information to third parties for commercial purposes and
economic benefit.
9
10
11
12
13
14
4. Facebook’s interface and website architecture – whereby Users accept or
ignore “friend” requests with the expectation that personal data is shared only with
authorized “friends” – causes Users to believe and understand that personal information
and photos uploaded to Facebook are private. Users may be unaware that data they
submit, or that data others submit about them, may be extracted and then shared,
stored, licensed, or downloaded by other persons or third parties they have not
expressly authorized.
16
17
18
19
20
5. On information and belief, Plaintiffs allege that Facebook’s license
agreement amounts to effective ownership and perpetual title to all data uploaded to
Facebook by any source even if a Facebook User terminates service. On information
and belief, Plaintiffs allege that Facebook has ignored or failed to comply with User
requests to cease and desist posting of personal or private information including posting
of photographs or images owned by Users or depicting Users.
22
23
24
25
26
6. Original work, in the form of writings or photographs or other images in
any tangible medium including the Internet is protected by state and federal law upon
creation. Uploading or downloading of protected works without the authority of the
creator or owner is an infringement of that creator or owner’s exclusive right of
reproduction and distribution. State and federal laws protect publicity rights, as well as
ownership rights such as copyright.
Complaint for Damages and Injunctive Relief - 4
1
17
27
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
7. Plaintiff Elisha Melkonian is a resident of Orange County and
accomplished photographer. She is a member of the Photo Laureates, Photographic
Society of America, the American Society of Picture Professionals, and Women in
Photography International. Plaintiff Melkonian specializes in digital photography and
has photographed people and landscapes throughout the United States and abroad.
Her exclusive ownership of her photographs is protected by federal copyright law, which
prohibits the uploading or downloading of her work without her permission. Plaintiff
Melkonian has observed her digital images posted on Facebook without her consent,
knowledge or compensation. Plaintiff Melkonian has sought to protect her images and
prevent the downloading and dissemination of her photographs on Facebook through
various efforts and the Facebook interface without success. Plaintiff Melkonian has
joined more than 150,000 Facebook Users in providing notice to Facebook to change
the unconscionable language of the Facebook Terms and Conditions and Policies
policies, in that that she owns the copyright and all rights concerning her photographs,
and demands that Facebook not sell or distribute her photographs and change the
Facebook Terms and Conditions.
18
19
20
21
22
23
24
25
26
8. Plaintiff Xavier O. is an 11-year-old minor residing with his parents in
Orange County, California. Plaintiff Xavier O. has a Facebook account that was opened
without the knowledge or consent of his parent or guardian. Plaintiff Xavier O. has
uploaded personal information, videos and photographs, including swimming and/or
partially clothed photographs of children ages 5 to11. On or about August 8, 2009,
Plaintiff Xavier O. posted “Xavier O. has swine flu…Please pray for me…God Bless.”
Upon learning of the Facebook account and the posting of an uncertain medical
condition, Plaintiff Xavier O’s parents removed the medical condition posting from
Facebook. Xavier O. and his parents have been unable to learn where the minor’s
medical information may have been stored, disseminated or sold by Facebook.
28
9. Plaintiff Chris C. is a 12-year-old minor residing with his parents in Orange
County, California. Plaintiff Chris C. has a Facebook account that was opened without
Complaint for Damages and Injunctive Relief - 5
1
2
the knowledge or consent of his parent or guardian. Plaintiff Chris C. has uploaded
personal information including photographs.
3
14
19
27
4
5
6
7
8
9
10
11
12
13
10. Catherine Aiko is a college student. She joined “a Mark Zuckerberg
production” called “Thefacebook” in or about May 2005, and was required to have a
verified college email to join. Thefacebook of 2004 and/or 2005 states Thefacebook is
“an online directory that connects people through social networks at schools” that
“prides itself in being a positive environment for peers to safely interact.” Thefacebook
of 2004 and/or 2005 states it was “limited to your own college or university, and
“members” could “use Thefacebook to: Search for people at your school, Find out who
is in your classes, and Look up your friends' friends.” The Terms and Conditions of 2004
and 2005 changed over time and at various dates stated “You may remove your
Member Content from the site at any time. If you choose to remove your Member
Content, the license granted…will automatically expire.”
15
16
17
18
11. In 2004 and/or 2005, Facebook generally limited and grouped college
students into Facebook “networks” and limited User functions. “TheFacebook.com”
changed to Facebook.com during Plaintiffs Use. The Facebook Terms and Conditions
and User interface have changed several times and without notice to, or consent of,
Plaintiffs since 2004.
20
21
22
23
24
25
26
12. Plaintiff Elvina Beck is an accomplished actress and model residing in Los
Angeles, California. Plaintiff Beck has multiple commercial representatives/agents for
print, commercial and theatrical work. Plaintiff Beck’s name, likeness and photos are
highly valuable commercial assets. Plaintiff Beck appears in national print
advertisements, commercials and films, and she is compensated for such work. Beck’s
filmography includes Love Hurts, Privileged, CSI: New York, and ESPN 25. Plaintiff
Beck’s digital images have been disseminated by Facebook without her consent,
knowledge, or compensation.
28
13. Facebook has been changing its Terms of Service and privacy settings of
existing Users to make posted content – thought by Facebook Users to be private –
Complaint for Damages and Injunctive Relief - 6
1
2
3
more broadly disseminated and available online without User consent or knowledge for
the purpose of increasing the use of the consumer data and the economic value of
Facebook.
4
9
19
25
5
6
7
8
14. On information and belief, Facebook is aware that consumers do not want
to have personal and private information disseminated without consent. On information
and belief, Plaintiffs assert that Facebook has received thousands of complaints from
consumers concerning unauthorized publication and use of private information and
photos.
10
11
12
13
14
15
16
17
18
15. On February 4, 2009, Facebook revised its Terms of Service, a document
Facebook asserts it is legally permitted to update “AT ANY TIME WITHOUT
INFORMING USERS.” On or about April 24, 2009, Facebook again revised the Terms
of Service. In response to Facebook’s changing Terms of Service, more than 2,500,000
Users joined the group MILLIONS AGAINST FACEBOOK’S NEW LAYOUT AND
TERMS OF SERVICE, and more than 130,000 Users have joined the group “People
Against the New Terms of Service.” Additionally, more than 150,000 Users have joined
the group “My Photos are MINE! Change the Terms and Conditions,” and more than
50,000 have joined the group “Facebook: Do Not Sell My Private Pictures: Change your
Terms of Use NOW!”
20
21
22
23
24
16. Based upon the obligations imposed upon Defendants and their
experience in the industry, Defendants either knew, recklessly disregarded, reasonably
should have known or were obligated under the law to understand that their systemic
personal and private data collection, harvesting, manipulation, distribution, and
commercialization activities violated state consumer protection, privacy, and right of
publicity laws.
26
27
28
17. Such conduct is of a continuing nature and requires prompt relief in order
to prevent further undisclosed or unauthorized harvesting, warehousing, dissemination,
and commercialization of private and personal data. The urgency of such relief is
underscored by the fact that once data is distributed to third parties and across
Complaint for Damages and Injunctive Relief - 7
1
2
computer networks outside of Facebook’s control, such data becomes impossible to
retrieve or purge.
3
9
18
19
20
21
24
4
5
6
7
8
18. Facebook users face irreparable harm in terms of, inter alia, not being fully
informed of the true facts, not having the full value of any monies wrongfully received by
Facebook or third parties as a result of the unauthorized commercial use of their identity
or likeness, having their personal and private of data distributed or reproduced without
their informed consent, and having the offending materials still publicly available,
accessible and usable.
10
11
12
13
14
15
16
17
19. Damages and equitable relief are appropriate and required to protect
consumer, privacy, and publicity rights of millions of existing and prospective future
Users. Equitable relief is appropriate to ensure adequate and effective policies,
technologies, and controls are in place to ensure the wrongful acts, including
concealment and misrepresentation, infringement of privacy rights, and
misappropriation of publicity rights that occurred are remedied and do not recur, and
that the true facts are revealed to the public. In addition, any monies Defendants
wrongfully obtained as a result of these wrongful practices rightfully belong to the
Plaintiffs and other victims.
22
23
20. Defendant Facebook, Inc. is a Delaware corporation with its principal
place of business in Palo Alto, California. Facebook’s web address is
www.facebook.com.
25
26
27
28
21. Plaintiff is informed and believes and based thereon alleges that each of
the fictitiously named Defendants is responsible in some manner for the occurrences,
acts and omissions alleged herein and that Plaintiff’s damages were proximately caused
by their conduct. For convenience, each reference to a named Defendant herein shall
refer to the Doe Defendants and each of them.
II. DEFENDANT PARTIES
Complaint for Damages and Injunctive Relief - 8
1
2
3
4
7
17
23
24
25
26
5
6
22. This Court has jurisdiction over all causes of action asserted herein
pursuant to the California Constitution, Article VI, §10, and California Civil Code § 3344,
and Consumer Legal Remedies Act (CLRA), California Civil Code Section 1750.
8
9
10
11
12
13
14
15
16
23. This Court has jurisdiction over the claims asserted and each of the
Defendants because each are individuals, associations or corporations that are either
based in, authorized or registered to conduct, or in fact do conduct, substantial business
in the State of California. Each of the defendants has sufficient minimum contacts with
California, or otherwise intentionally avail themselves of the markets within California,
through collecting monies, entering into contracts and/or distributing their products or
services in California to render the exercise of jurisdiction by the California courts
permissible under traditional notions of fair play and substantial justice. No state or
federal regulatory agency has primary, exclusive or any jurisdiction over the claims at
issue herein and/or is able to provide the complete relief prayed for in this matter.
18
19
20
21
22
24. Venue is proper in this County as the acts upon which this action is based
occurred in part in this County. Plaintiffs reside and/or work in this County, and one or
more of the Defendants received substantial compensation and profits from entering
into agreements and/or the sale of their products or services to persons located in this
County, caused misrepresentations to be disseminated, entered into transactions and/or
provided services in this County. Defendants’ liability arose in part in this County.
27
28
25. Founded in 2004 as a social networking site for college students with a
web address of
III. JURISDICTION AND VENUE
IV. BACKGROUND AND FACTS
A. FACEBOOK BACKGROUND AND FEATURES
http://www.facebook.com, Facebook is operated and privately owned by
Facebook, Inc.
Complaint for Damages and Injunctive Relief - 9
1
8
13
19
26
2
3
4
5
6
7
26. Facebook’s website allows members to communicate and share
information with friends, family, coworkers, classmates, and other people who share
similar interests or activities, or who are interested in exploring the interests and
activities of others. Facebook Users can create a personal profile, and post messages,
photos and videos. Users can add friends and send them messages, and update their
profiles to notify friends about themselves. Additionally, Users can join networks
organized by city, workplace, school, and region.
9
10
11
12
27. Facebook’s website states that, “Facebook is a social utility that helps
people communicate more efficiently with their friends, family and coworkers. The
company develops technologies that facilitate the sharing of information through the
social graph, the digital mapping of people’s real-world social connections. Anyone can
sign up for Facebook and interact with the people they know in a trusted environment.”
14
15
16
17
18
28. Facebook claims more than 250 million active Users and more than 120
million of those Users log on to Facebook at least once each day. Recent statistics
published by Facebook indicate that approximately 850 million photos are uploaded to
Facebook each day, more than one billion pieces of content (web links, news stories,
blog posts, notes, photos, etc.) are shared each week, and more than 2.5 million events
are created each month.
20
21
22
23
24
25
29. A person may join Facebook by signing up for an account on the
Facebook website. Registration is free and typically only takes a few minutes.
Registration requires the providing of a name, gender, date of birth and a valid email.
Registered Users are asked to provide the name of their high school, college, and
employer to create a User profile. Users can expand their profile by adding information
about various interests and hobbies. They can also add contact information including
address, website, email and phones numbers.
27
28
30. Users can find friends in several ways. A User can browse and join
networks, which are organized into four categories: regions, high schools, colleges, and
workplaces. Once a User joins a network, they are able to browse through the list of
Complaint for Damages and Injunctive Relief - 10
1
2
3
4
5
6
7
members and search for people they know. In addition, Users can let Facebook pull
contacts from a Web-based email account. In order to do this, Users must give
Facebook their email address and password. Facebook uses a program that searches
through the User’s email contacts and compares the list against its membership
database. If Facebook discovers a match, it gives the User the option to add that person
as a friend. In addition, Users can type a person’s name into Facebook’s search engine,
and Facebook will display any profiles that match the name.
8
27
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
31. Facebook’s website incorporates various features, many of which provide
detailed deep data specific to each individual, data that is highly valuable to Facebook
and to third parties. One feature is a “wall,” which is a space on every User's profile
page that allows friends to post messages for the User to see. Another feature is a
“news feed” and "mini feed" section, which displays updates regarding information or
content (notes, photos, etc.) added to a User profile. Other features include a “photo”
application that allows Users to upload an unlimited number of photos and tag (or
associate) such photos with another Facebook User. A “video” application allows
members to upload videos. A “groups” application allows Users to join other members’
groups or create a group of their own. An “events” application allows Facebook Users to
invite other members to a real-life gathering. A “marketplace” application allows Users
to connect with other Users who want to buy or sell items, much like classified ads. A
“posted items” application allows Users to post or hyperlink almost any content from a
Web page to their profile. A “gifts” application, allows Users to send other Users a virtual
gift in the form of a small icon. A “status” application acts a mini blogging tool that allows
Users to inform their friends of their current whereabouts, actions, or thoughts. A “chat”
application is an instant messaging tool allowing one User to directly text messages to
another User. These are applications developed by Facebook and are available to all
members.
28
32. In addition to first-party applications developed by Facebook, Facebook
has also allowed third-party developers to create additional applications, such as
Complaint for Damages and Injunctive Relief - 11
1
2
3
4
5
6
7
8
9
10
11
games, horoscopes, quizzes and other interactive features. These applications may
also provide valuable data. According to the Facebook website, there are “more than
one million developers and entrepreneurs from more than 180 countries” and more than
“350,000 active applications currently on Facebook Platform.” Every month, more than
70% of Facebook Users engage with Platform applications and “more than 200
applications have more than one million monthly active Users.” Third-party developers
generate income from such applications through built-in advertising for products or
services. According to a Facebook developer blog, applications “range from simple
applications created by single Users to share with their friends to impressive businesses
employing hundreds of people and reaching tens of millions of Users every month and
generating tens of millions of dollars of revenue.”
12
16
25
13
14
15
33. Facebook permits integration and exchange of data with third-party
websites through Facebook’s “Connect” service. Facebook Connect enables Users to
log in to affiliated sites using their Facebook account and share information from such
sites with their Facebook friends.
17
18
19
20
21
22
23
24
34. Facebook generates revenue primarily through various types of
advertisements which are targeted to Users based on User profiles, demographics, and
in some instances information culled from Users’ personal data and/or their friends’
data. Some advertisements may use a User’s likeness or name to market products or
services to other Facebook members in that Users’ friends’ list or network. Another
advertising technology developed by Facebook called “Beacon” allows the tracking and
capture of information from Facebook from external websites. Such information, which
may include purchase data or other actions taken by Facebook Users, are used to
target and advertise products to other Facebook Users.
26
27
28
35. On August 10, 2009, Facebook acquired FriendFeed, Inc., which provides
additional technologies to facilitate the capture and consolidation of information from
FriendFeed and Facebook Users across a wide range of websites, blogs, and other
online sources of information.
Complaint for Damages and Injunctive Relief - 12
1
2
3
11
15
21
25
4
5
6
7
8
9
10
36. The right of privacy is a personal and fundamental right in the law of
California and the United States. The privacy of an individual is directly affected by the
collection, use, and dissemination of personal information. The opportunities for an
individual to secure employment, insurance, and credit, to obtain medical services, and
the rights of due process may be jeopardized by the misuse of certain personal
information. Further, the rapid growth and popularity of social networking sites has
facilitated and increased the likelihood of identity theft, cybercrime, and online sexual
predation.
12
13
14
37. Even as an increasing number of consumers rely on the Internet and new
technologies for communication, information, entertainment, and to perform
transactions, the vast majority of consumers are concerned about how their personal
information is being used and expect and desire greater privacy protections.
16
17
18
19
20
38. Several recent polls establish that most Americans are concerned about
what is being done with their personal information online. An April 2007 UPI-Zogby
International poll, found that 91% of respondents said they are concerned that their
identity might be stolen and used to make unauthorized purchases. In addition, 85% of
respondents said privacy of their personal information is important to them as
consumers.
22
23
24
39. A September 2008 poll by the Pew Research Center found that 90% of
respondents said that they “would be very concerned if the company at which their data
were stored sold it to another party” and 80% say “they would be very concerned if
companies used their photos or other data in marketing campaigns.”
26
27
28
40. A poll by the Consumer Reports National Research Center showed that
72% of respondents are concerned that their online behaviors were being tracked and
profiled by companies. The poll also found that while 68% percent of consumers have
provided personal information in order to access a website, 53% are uncomfortable with
B. FACEBOOK VIOLATES THE PRIVACY RIGHTS OF FACEBOOK USERS
Complaint for Damages and Injunctive Relief - 13
1
2
3
4
5
6
7
8
internet companies using their email content or browsing history to send relevant ads,
and 54% are uncomfortable with third parties collecting information about their online
behavior. The poll also found that 93% of Americans think Internet companies should
always ask for permission before using personal information. According to one policy
analyst, “Americans are clearly concerned with how their personal information is being
collected and used by internet companies...The vast majority of consumers want more
control over their personal information online and want the ability to stop Internet
companies from tracking and profiling them.”
9
19
25
28
10
11
12
13
14
15
16
17
18
41. The interests of many Internet-based businesses are often in direct
conflict with consumers’ privacy rights. Personal consumer data is a highly valuable
commodity – it is used by businesses to profile consumers, predict consumer behavior
and to target and market to consumers more effectively. Such personal data is often
harvested, sold, or licensed to other businesses. The valuation of many companies is
based in no small part by the amount of useful data that they can compile and
effectively utilize. Thus, whereas consumers desire to limit the dissemination and use of
their private and personal data due to privacy concerns and fears of identity theft and
cybercrime, online businesses have a huge financial disincentive to satisfy consumer
privacy expectations and limit the collection and use of personal User data.
20
21
22
23
24
42. Plaintiffs and the general public desire and expect a level of privacy, which
Facebook has failed to satisfy under its current policies, procedures, practices, and
technology. Plaintiffs allege that all Facebook users have individual and valuable
property rights in their personal and private data which entitle them to make informed
decisions about what or which personal data may be revealed, disseminated, stored,
licensed, transferred, or sold, and to what businesses or firms, and for what purposes.
26
27
43. Facebook has been repeatedly condemned by Facebook Users, and
numerous consumer rights and privacy advocates for unclear or vastly overreaching
policies, practices, and technologies which jeopardize or compromise the safety of
Complaint for Damages and Injunctive Relief - 14
1
2
personal and private User data, and which violate, infringe, and erode Users’ privacy
rights and expectations.
3
6
14
19
24
28
4
5
44. In November 2007, the non-profit public advocacy group MoveOn.org
denounced Facebook's tracking and advertising technology, which notified Facebook
Users about purchases made by people on their friends list.
7
8
9
10
11
12
13
45. On May 31, 2008, the Canadian Internet Policy and Public Interest Clinic,
filed a complaint with the Office of the Privacy Commissioner against Facebook, based
on 22 breaches of the Canadian Personal Information Protection and Electronic
Documents Act. On July 16, 2009, the Canadian Privacy Commissioner issued a report
concluding that several of the allegations were well founded and required action in order
to protect the privacy rights of Facebook Users. A true and correct copy of the Canadian
Internet Policy and Public Interest Clinic Facebook Complaint dated May 30, 2008 is
attached hereto as Exhibit A.
15
16
17
18
46. In February 2009, The Electronic Privacy Information Center (EPIC)
prepared a formal complaint with the Federal Trade Commission (FTC) over
Facebook’s new Terms of Use and Privacy Policy, which granted Facebook a perpetual
and irrevocable license over User content. In response to threat of a lawsuit and User
furor over the onerous new terms and policies, Facebook revised its Terms of Use.
20
21
22
23
47. In March 2009, the University of Cambridge issued a report criticizing the
misleading, contradictory, and unworkable nature of Facebook current revised policies.
The report also gained the support of the non-profit privacy advocate group Open
Rights Group. A true and correct copy of the University of Cambridge Computer
Laboratory Report dated March 29, 2009 is attached hereto as Exhibit B.
25
26
27
48. On June 12, 2009, the Data Protection Working Party, working under the
European Commission, Directorate General Justice, Freedom and Security adopted
Opinion 5/2009 on online social networking (EU Opinion) concerning emerging concern
over processing of sensitive personal information and images, retention of personal
Complaint for Damages and Injunctive Relief - 15
1
2
information and images, and advertising and marketing of data collection on social
networks. A true and correct copy of the EU Opinion is attached hereto as Exhibit C
3
8
15
16
17
18
23
4
5
6
7
49. On July 16, 2009 the Assistant Privacy Commission of Canada issued the
Report of Findings Into the Complaint if Filed By the Canadian Internet Police and
Public Interest Clinic (CIPPIN) against Facebook Under the Personal Information
Protection and Electronic Documents Act (Canadian Findings). A true and correct copy
of the Canadian Findings is attached hereto as Exhibit D.
9
10
11
12
13
14
50. Many Facebook Users are under 18. Plaintiffs allege on information and
belief that millions of Facebook Users are under the age of 13, and that Facebook is
aware that many Users are underage. Minors do not have the legal or mental capacity,
bargaining ability or expertise in privacy issues to understand the significance of the
loss of control or dissemination or sale of their private and personal data, or to
understand the complex, misleading, confusing, and changing nature of the policies and
privacy settings of Facebook.
19
20
21
22
51. Data mining is a well established multi-billion dollar industry. Data mining
is the process of collecting, harvesting, refining, and selling the commodity of data and
information. Recent federal court decisions have determined that data mining is
“conduct.” At least 15 states have adopted some type of privacy law preventing
disclosure of personal data.
24
25
26
27
28
52. In 2007, the Facebook data processing infrastructure was created around
a data warehouse built using a commercial relational database management system
(RDBMS), which extracts, sorts, analyzes, and optimizes data. Collection of data was
accelerated and Facebook data grew from a 15TB (a terabyte is a unit of digital data
storage equal to 1000 gigabytes. A gigabyte is 1,000,000,000 bytes) in 2007 to a 2PB
(a petabyte is a unit of information or computer data storage equal to one quadrillion
C. FACEBOOK IS A DATA MINING COMPANY THAT AGGRESIVELY SEEKS THE
ACQUISITION AND USE OF PRIVATE AND PERSONAL USER DATA WITHOUT
THE KNOWLEDGE OR CONSENT OF USERS
Complaint for Damages and Injunctive Relief - 16
1
2
bytes) as of July 2009, or +13,233.3% increase in digital data collection in the last two
years.
3
7
18
22
26
4
5
6
53. The Facebook infrastructure in 2007 was such that some daily data
processing jobs were taking more than a day to process. Facebook determined it would
create an infrastructure capable of collecting, harvesting, and mining data at an
unprecedented level.
8
9
10
11
12
13
14
15
16
17
54. Facebook created a Data Team and hired data analysts to enable the
collection, management, analysis, shaping and exploitation of User data. One of the
defined cores values of the Data Team is “Move Fast” to collect, analyze and mine data
to make Facebook decisions. The Facebook Data Team is seeking to hire people who
“move fast and want to be a data ninja.” The Facebook Data Infrastructure Team has
created sophisticated tools like Hive and HiPal to maximize data collection, extraction,
analysis and mining. Facebook has a 600 machine cluster with 4800 cores and more
than 2PB raw storage, and each node has 8 cores and 4TB of storage, to crunch data
and mine personal information provided by Users. Facebook uses Hadoop to store
copies of internal log and dimension data sources and use it as a source for
reporting/analytics and machine learning.
19
20
21
55. Facebook uses streaming and Java Application Programming Interface
(“apis”). Facebook has built a high level data warehousing framework using these
features called Hive (http://hadoop.apache.org/hive/). Facebook has also developed a
FUSE implementation over Hadoop Distributed File System (“hdfs”).
23
24
25
56. The Hive/Hadoop cluster at Facebook stores more than 2PB of
uncompressed data and routinely loads 15TB of data daily. Facebook is spending
approximately $20 million to $25 million a year on data center space, and approximately
$500,000 per month for bandwidth.
27
28
57. Facebook is now permitting third party data mining of personal information
with data extraction instruction publicly available over the Internet.
(http://programmaremobile.blogspot.com/2009/01/facebook-java-apieng.html).
Complaint for Damages and Injunctive Relief - 17
1
4
11
17
24
28
2
3
58. Facebook is engaged in unprecedented high-volume, large-scale, data-
intensive data mining processing. Facebook is posturing to fully exploit its data mining
ability and marketing analytics.
5
6
7
8
9
10
59. Data mining businesses employ various technologies, techniques, and
practices in order to collect and analyze vast amounts of consumer data for the purpose
consumer surveillance, predicting consumer behavior, profiling consumers, and
increasing marketing effectiveness. Consumer data is a highly valuable product and
companies pay large sums to access and utilize such data. Many states are seeking to
ban or limit certain data mining practices using rights of privacy and confidentiality
rubrics.
12
13
14
15
16
60. Facebook presents itself as a social network service, and values itself as a
marketing and data mining company that values and collects enormous amounts of
personal consumer information and uses such data to increase and measure company
value. Facebook’s business model and technologies are intentionally designed to
collect maximum amounts of highly valuable and uniquely identifiable personal and
personal data.
18
19
20
21
22
23
61. Facebook intentionally and aggressively seeks to increase company value
and revenues by engaging in a pattern and practice of collecting, harvesting, storing,
mining, using, manipulating, disseminating, and commercializing highly valuable
personal, private, and uniquely identifiable information and data, including but not
limited to written content, photographs and other images, video, and other properties
such as names, phone numbers, birthdays, schools, relationships, health and activities,
without consumer consent, understanding or knowledge of such uses by Users.
25
26
27
62. The market and financial incentives for Facebook to collect, harvest, mine,
and process personal data are high. Facebook’s website and business architecture is
designed in significant part to collect User information and extract high value objects or
data that have commercial value. The data collected is a primary component of the
Complaint for Damages and Injunctive Relief - 18
1
2
Facebook business model and comprises a significant part of the value of Facebook’s
assets.
3
6
14
21
25
26
27
28
4
5
63. On information and belief, data collected from Facebook Users is the key
commercial asset that Facebook uses for market valuation, internal marketing
purposes, and for licensing and/or direct or indirect sale of data to third parties.
7
8
9
10
11
12
13
64. Facebook has an enormous financial incentive to collect and manipulate
private and personal information. Facebook gains the full benefit and value of using the
private and personal information when company assets are valued, and when it
receives fees from, or directly or indirectly sells or provides the data to third parties.
Facebook rarely suffers losses from the disclosure of personal and private data as
Facebook customers are often not aware of the disclosure of their personal or private
data, and the Facebook User is unable to control or discipline Facebook for such
disclosure.
15
16
17
18
19
20
65. As a consequence of Facebook allowing Users to access use and upload
private and personal information on Facebook, Users are effectively assigning valuable
property and privacy rights to Facebook without consent, knowledge, understanding, or
consideration. Facebook Users, including minors, have unknowingly assigned valuable
property rights to Facebook and such rights, data, and information constitute the core
value of Facebook. Facebook has failed to compensate in any way Facebook Users for
such rights.
22
23
24
66. Facebook intentionally harvests and extracts personal information through
the hiring of employees and analysts skilled and committed to such enterprise. On
January 27, 2007, Facebook advertised on BlogSpot, seeking an expert is “data mining”
and other areas:
“Facebook is seeking a Data Analyst with strong communication skills and a mild obsession with extracting useful information from data. The ideal candidate will...be interested in the business and product of an online social network while having a passion for data analysis and visualization.
Responsibilities
Complaint for Damages and Injunctive Relief - 19
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
26
24
25
27
28
• Work closely with business Users and product managers to determine how the data we collect could help solve their problems
• Apply your expertise in statistical inference, data mining, and the presentation of data to help inform and support our business and product decisions
• Work with the data infrastructure team to translate the business requirements into technical specifications
• Possess a thorough understanding of our data collection methods • Develop reports and monitor the validity of the data being reported
Requirements
• Data junkie • The ability to communicate the results of your analyses in a clear
and effective manner • Crazy Excel skills or experience with data reporting and analysis
tools such as Spotfire, Business Objects, Cognos, Tableau, et al. • Experience with R, Matlab, SAS, SPSS, or a similar tool for data
analysis • Understanding of the methodologies of the major internet audience
measurement firms: comScore Media Metrix, Nielsen//NetRatings, Hitwise, Quantcast, Alexa, Compete
• Basic knowledge of relational databases and SQL • Strong willingness to contribute to a small team”
(http://statjobs.blogspot.com/2007/01/data-analyst-data-insight-group.html - accessed on August 12, 2009)
A true and correct copy of Facebook’s Analytic Talent/Data Analyst/Data Insight Group
job posting on www.DataShaping.com and accessed on www.blogspot.com is attached
hereto as Exhibit E.
E. FACEBOOK TERMS OF USE AND PRIVACY POLICIES ARE INCOMPLETE,
MISLEADING, DECEPTIVE, AND UNFAIR
67. Facebook has made numerous changes to it Terms of Use and Privacy
Policy, often in response to scathing criticism from privacy advocates, watchdog groups,
and Users wronged or harmed as a result of Facebook’s policies and practices.
68. On February 4, 2009, Facebook updated its Terms of Use granting
Facebook a perpetual, irrevocable license to use any type of User data in almost any
manner it wishes. The Terms of Use, in relevant part, stated:
Complaint for Damages and Injunctive Relief - 20
1
2
3
4
5
6
7
8
9
10
11
12
13
18
22
28
14
15
16
17
69. The revised Terms of Use temporarily deleted the following key language
which limited Facebook’s license over Users’ personal data: “You may remove your
User Content from the Site at any time. If you choose to remove your User Content, the
license granted above will automatically expire, however you acknowledge that the
Company may retain archived copies of your User Content.”
19
20
21
70. Facebook did not actively notify Facebook Users of this major policy
change. The changes went into effect on February 4, 2009, and went unnoticed until
Chris Walters, a blogger for the consumer-oriented blog, The Consumerist, noticed the
change on February 15, 2009.
23
24
25
26
27
71. Not surprisingly the change in terms created outraged response from
privacy advocates and millions of Facebook Users and the general public. The new
policies prompted The Electronic Privacy Information Center (EPIC) to prepare a formal
complaint with the Federal Trade. In response to the threat of mass Facebook User
revolt and litigation, Facebook changed its policies to something ostensibly less
invasive.
“You hereby grant Facebook an irrevocable, perpetual, non-exclusive,
transferable, fully paid, worldwide license (with the right to sublicense) to (a) use,
copy, publish, stream, store, retain, publicly perform or display, transmit, scan,
reformat, modify, edit, frame, translate, excerpt, adapt, create derivative works
and distribute (through multiple tiers), any User Content you (i) Post on or in
connection with the Facebook Service or the promotion thereof subject only to
your privacy settings or (ii) enable a User to Post, including by offering a Share
Link on your website and (b) to use your name, likeness and image for any
purpose, including commercial or advertising, each of (a) and (b) on or in
connection with the Facebook Service or the promotion thereof.”
Complaint for Damages and Injunctive Relief - 21
1
7
9
10
11
12
13
14
15
16
17
18
2
3
4
5
6
72. In spite of the change, the current Terms or Use (alternately referred to as
“Statement of Rights and Responsibilities”) and Privacy Policy remain confusing and
misleading to vast majority of users and fail to give users adequate information to make
an informed decision regarding the use, dissemination, and security of their valuable
personal and private data. Furthermore they continue to grant Facebook vast control
over the use, transfer, and retention of personal and private information.
8
7
19
20
21
22
23
24
25
26
27
28
74. Facebook’s asserts the license to use content covered by intellectual
property rights such as photos and video (“IP content”) ends when the User deletes the
content or their account. However, both the Facebook Terms of Use and Privacy Policy
do not clearly specify how Facebook may retain or use other types of important
information not strictly defined as “IP content,” which presumably may include a
multitude of valuable and sensitive information such as a User’s name, contact
information, date of birth, email, gender, schools attended, occupation, addresses,
phone numbers, demographic information, hobbies, interests, groups, organizations,
and information about friends, family or coworkers. Furthermore, the term “IP content” is
ambiguous. There is no indication whether highly personal communications such as
messages, chats, activities, comments, and posts are subject to the limited “IP content”
3. Significant language regarding the licensing of personal User data to
Facebook has been subtly altered to the following:
“For content that is covered by intellectual property rights, like photos and videos
("IP content"), you specifically give us the following permission, subject to your
privacy and application settings: you grant us a non-exclusive, transferable, sub-
licensable, royalty-free, worldwide license to use any IP content that you post on
or in connection with Facebook ("IP License"). This IP License ends when you
delete your IP content or your account (except to the extent your content has
been shared with others, and they have not deleted it).”
Complaint for Damages and Injunctive Relief - 22
1
2
license. Thus, under the current terms, Facebook does not specify the rights it asserts
over non “IP content” or other personal and private information.
3
6
7
8
9
10
11
12
16
26
28
4
5
75. The Facebook Privacy Policy in effect at time of the filing of this Action
also allows Facebook to collect, aggregate and use information about users from
virtually any source. The policy states in relevant part:
13
14
15
76. The Facebook policy, in combination with Facebook’s sophisticated data
harvesting technologies, enables Facebook to compile unprecedented amounts of
information about individuals from various sources not disclosed or expressly allowed
by Users.
17
18
19
20
21
22
23
24
25
77. On August 10, 2009, Facebook, Inc. acquired FriendFeed, Inc., which
provides numerous data harvesting technologies including a real-time feed aggregator
that consolidates the updates from numerous social media and social networking
websites, social bookmarking websites, blogs and micro-blogging updates, as well as
other types of information feeds. The combined technologies of Facebook and
FriendFeed enable Facebook to collect unprecedented amounts of personal information
from millions of Internet Users across a broad spectrum of online sources. The
acquisition of FriendFeed enables to Facebook to greatly expand the breadth and value
of its personal data harvesting operations and further violates and threatens the privacy
rights and security of millions of Users.
27
“We may use information about you that we collect from other sources, including
but not limited to newspapers and Internet sources such as blogs, instant
messaging services, Facebook Platform developers and other Users of
Facebook, to supplement your profile.”
78. The Facebook website represents that, “Facebook does not sell your
information” and “Facebook doesn’t sell your information to advertisers.” Tellingly, this
Complaint for Damages and Injunctive Relief - 23
1
2
statement does not appear in either the Terms of Use or Privacy Policy, nor does the
statement establish that Facebook will never sell Users’ information.
3
8
16
21
28
4
5
6
7
79. The statement that “Facebook does not sell your information” is
misleading, and false. The company’s valuation, advertising revenue, and income is
fundamentally tied to Facebook’s unprecedented private and personal data collection
and harvesting practices and the distribution, licensing, and/or direct or indirect sale of
said data to advertisers, affiliates, and third party developers and content providers.
9
10
11
12
13
14
15
80. The representation that “Facebook does not sell your information” is false
and contradicts the provision in the Terms of Use directed at Developers and Operators
of Applications and Websites which states, “We do not guarantee that Platform will
always be free.” As discussed in greater detail below, third-party developers have
almost unlimited access to User data. Thus, should at any future time Facebook begin
to charge third-party developers or affiliates for their use of the Facebook website or
platform, they will essentially be profiting from the transfer and use of User data by
those third parties.
17
18
19
20
81. Facebook has misled Users with policies, statements and languages that
imply that Users have control over their personal data. Facebook has also misled
Facebook Users and the public by representing that the governance of Facebook and
policy changes are a democratic process dependent on Users’ comments, input, and
consent.
22
23
24
25
26
27
82. In response to the public outage caused by the February 2009 policy
language changes, Facebook has temporarily updated the “Amendments” section of
their Terms of Use (also called the “Statement of Rights and Responsibilities”). The
“Amendments” discusses Facebook Users’ participation in the adoption of new policies.
Plaintiffs allege that the language was created for the primary purpose of assuaging the
fears of privacy advocates and Facebook Users stemming from the highly disapproved
February 2009 Terms of Use. The section states:
Complaint for Damages and Injunctive Relief - 24
1
2
3
4
5
6
7
8
9
10
11
12
13
14
21
24
25
26
27
28
15
16
17
18
19
20
83. Facebook’s most recent “Amendments” are misleading, disingenuous, and
unintelligible to most consumers. On information and belief, Plaintiffs allege that the
majority of Facebook Users under the age of 18 have never read, or cannot adequately
understand Facebook’s morphing Terms & Conditions, Privacy Policy and
Amendments. On information and belief, Plaintiffs also allege that Facebook has
designed and presented the Terms & Conditions, Privacy Policy and Amendments in a
manner and fashion to limit the reading of these materials by Facebook Users.
22
23
84. In March 2009 a group of computer scientists from the University of
Cambridge analyzed and condemned the proposed (and since adopted) “Amendments”
and “Terms of Use.” As one of the authors noted in a separate statement:
“1. We can change this Statement so long as we provide you notice through
Facebook (unless you opt-out of such notice) and an opportunity to comment.
2. For changes to sections 7, 8, 9, and 11 (sections relating to payments,
application developers, website operators, and advertisers), we will give you a
minimum of three days notice. For all other changes we will give you a minimum
of seven days notice.
3. If more than 7,000 Users comment on the proposed change, we will also give
you the opportunity to participate in a vote in which you will be provided
alternatives. The vote shall be binding on us if more than 30% of all active
registered Users as of the date of the notice vote.
4. We can make changes for legal or administrative reasons upon notice without
opportunity to comment.”
“The Statement of Rights and Responsibilities primarily assigns rights to
Facebook and responsibilities on Users, developers, and advertisers. Facebook
still demands a broad license to all User content, shifts all responsibility for
enforcing privacy onto developers, and sneakily disclaims itself of all liability. Yet
Complaint for Damages and Injunctive Relief - 25
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
24
25
26
27
28
18
19
20
21
22
23
85. Facebook is continually attempting to bypass or obfuscate serious privacy
concerns of Users and the public through the adoption of newer but no less confusing,
misleading, deceptive, or ineffective policies. Facebook’s policies have changed several
times prior to the filing of this complaint, and will likely continue to change during the
pendency of this action. As such, Facebook Users require protections against future
changes to Facebook’s policies that may further mislead, deceive, and erode or violate
Users’ privacy rights.
it demands an unrealistic set of obligations: a literal reading of the document
requires Users to get explicit permission from other Users before viewing their
content.”
“Users are free to comment on terms, but Facebook is under no obligation to
listen. Facebook’s official group for comments contains a disorganized jumble of
thousands of comments, some insightful and many inane. It is difficult to extract
intelligent analysis here. Under certain conditions a vote can be called, but this is
hopelessly weakened: it only applies to certain types of changes, the conditions
of the vote are poorly specified and subject to manipulation by Facebook, and in
fact they reserve the right to ignore the vote for “administrative reasons…”
“…The goal [of Facebook] is not to actually turn governance over to Users, but to
use the appearance of democracy and User involvement to ward off future
criticism.”
Complaint for Damages and Injunctive Relief - 26
1
2
3
4
5
6
13
19
25
26
27
7
8
9
10
11
12
86. Facebook has failed to provide adequate warnings to Users over the
dangers and risks of posting highly sensitive information, including but not limited to
addresses, phone numbers, passwords, social security numbers, family information,
information about minors, financial information, and health information. The release of
such data into cyberspace exposes Users to various risks and dangers including identity
theft, theft of password or account information, cybercrimes, stalking, child predation,
and misappropriation of legally protected financial and health information.
14
15
16
17
18
87. Facebook, through its website, Terms of Use, Privacy Policy, Privacy
setting tools, and public statements, has aggressively promoted the virtues and benefits
of facilitating and “sharing” information online, but has failed to educate or provide
adequate warnings to Users regarding the importance and value of such personal
information and the risks and dangers of disclosing such information to Facebook, to
Facebook Users, and Facebook third-party affiliates and developers.
20
21
22
23
24
88. Plaintiffs allege that Facebook is aware that the average Facebook User,
especially younger Users, do not understand or appreciate the risks and dangers of
disclosing personal information. Plaintiffs also allege that rather than potentially scare
Users away from Facebook with clear and effective warnings regarding the risks and
dangers of sharing personal information online, Facebook has instead purposely
downplayed, minimized, or omitted such important disclosures.
28
F. FACEBOOK IS ENGAGED IN DECEPTVE AND MISLEADING PRACTICES IN
ORDER TO INCREASE THE NUMBER OF FACEBOOK USERS AND COLLECT
PRIVATE AND VALUABLE INFORMATION; AND FACEBOOK HAS FAILED TO
ADEQUATELY WARN CONSUMERS OF THE DANGERS OF PROVIDING
FACEBOOK AND FACEBOOK AFFILIATES WITH SUCH INFORMATION
G. FACEBOOK TERMS OF USE AND PRIVACY POLICIES ARE NOT ADEQUATELY
DISCLOSED TO USERS DURING THE FACEBOOK SIGN-UP PROCESS
89. Plaintiffs allege that Facebook has created a business model and
apparatus designed to harvest as much personal and private information as possible in
Complaint for Damages and Injunctive Relief - 27
1
2
3
4
5
6
7
the easiest, quickest, and most innocuous-looking manner possible. On information and
belief, Plaintiffs allege that Facebook created a User interface designed to limit the
number of Facebook Users actually reading the Facebook Terms of Use and Privacy
Policy. On information and belief, Plaintiffs allege Facebook has made the Terms of Use
and Privacy Policy hard to find with small font for the express purpose of maneuvering
Facebook Users into loading and or uploading personal and private information and
photos without first reviewing the Terms of Use and Privacy Policy.
8
14
27
9
10
11
12
13
90. Plaintiffs further allege that the majority of Facebook Users and
prospective new Users have never read the Facebook Terms of Use and Privacy Policy,
and that Facebook is aware of this fact. Furthermore, Facebook has not employed
effective measures to ensure that new prospective Users read and understand the
policies prior to signing up with Facebook or that existing members are notified when
the terms or policies are changed.
15
16
17
18
19
20
21
22
23
24
25
26
91. The Facebook sign-up or registration process is designed to obfuscate
review of the Terms of Use and Privacy Policy. Joining Facebook has been designed to
be both quick and easy. A person who wants to join Facebook simply needs to go to the
Facebook website and answer a few questions. An average person can typically
complete the entire sign-up process in less than three minutes. At no point in time
during the entire Facebook sign-up or registration process does Facebook automatically
display or require a prospective new User to scroll through and expressly accept
Facebook’s privacy policies or Terms of Use before joining Facebook. The current
Facebook sign-up webpage contains an innocuous statement in significantly smaller
font size than the rest of the webpage that states “By clicking Sign Up, you are
indicating that you have read and agree to the Terms of Use and Privacy Policy.” The
tiny statement is followed by equally small links to the Facebook Terms of Use and
Privacy Policy.
28
92. The sign-up process requires prospective Users to provide their first and
last name, date of birth, gender, and email address. Immediately after sign-up, newly
Complaint for Damages and Injunctive Relief - 28
1
2
3
4
5
6
7
8
9
registered Users are then asked to provide their email account password, a photograph
of themselves, and the name of their high school, college, and employer. By the end of
the sign-up process, Facebook has already captured commercially valuable personal
and private information including the name, gender, date of birth, and email address of
Users, and has captured the photographs, high school, college, and company
information from a significant number of these Users. This private and personal
information is captured without ever receiving an express and informed consent from
the user that they have reviewed, understand, and agree to the Terms of Use and
Privacy Policy.
10
18
19
20
24
26
28
11
12
13
14
15
16
17
93. Facebook could easily implement controls to ensure that every
prospective new User is displayed the entire Privacy Policy and Terms of Use. For
example, many websites employ a pop-up box or window accompanied by a button or
link that the User must affirmatively press to confirm that they have read, understand
and agree to the policies before finalizing registration. Instead, Plaintiffs allege that
Facebook created and uses a sign-up process expressly designed to have the vast
majority of prospective new Users overlook or disregard the buried and hidden Privacy
Policy and Terms of Use while surrendering valuable private and personal information.
21
22
23
94. Facebook has implemented privacy setting tools ostensibly designed to
allow consumers to restrict the use and dissemination of their data by other Users,
advertisers, and third-party affiliates and developers. Unfortunately for Facebook Users,
such tools are misleading, confusing, and ineffective.
25
27
H. FACEBOOK PRIVACY TOOLS ARE CONFUSING, MISLEADING, DECEPTIVE,
AND INEFFECTIVE
95. Prospective Facebook Users are not required or even prompted to adjust
their privacy settings during the sign-up process or even following registration.
96. Furthermore, the privacy settings are not prominently displayed on the
Users’ Facebook pages and consequently, the average User may overlook the settings
Complaint for Damages and Injunctive Relief - 29
1
2
and continue to post personal and private information without selecting the most secure
privacy settings.
3
5
8
12
17
19
26
27
28
4
9
6
7
98. Even those Users that do seek out and find the privacy setting tools are
still faced with numerous confusing pages and privacy options. As it currently stands,
there are more than 40 individual privacy settings scattered over several web pages.
9
10
11
99. Privacy settings are not by default set to the maximum allowable privacy
setting. The current default privacy settings allow a User’s photos to be shared among
all Users in the Facebook and furthermore, allow a person’s profile to become
searchable on search engines such as Google.
13
14
15
16
100. Plaintiffs allege that the practical effect of Facebook’s interface and
privacy controls are to minimize, delay, or circumvent Users’ privacy concerns for the
purpose of aggregating as much personal and private information as possible without
consent, payment and/or consideration for such commercially valuable data and
information.
18
1
20
21
22
23
24
25
102. Furthermore, the privacy setting tools are both ineffective and misleading
in that they falsely suggest to the average User that they present a technical safeguard
or barrier against unauthorized use of their personal data by third-party application
developers, when in fact, no such technological barriers exist. Whether or not a third
party developer honors a user’s individual privacy settings or the written policies of
Facebook is entirely within the discretion of the third-party developers, and not known or
disclosed to the consumer whose information is being used.
7. Additionally, Users are not advised of the potential consequences of not
adjusting the privacy settings.
01. On information and belief, Facebook has admitted that the majority of
Facebook Users do not use the privacy setting tools.
Complaint for Damages and Injunctive Relief - 30
1
2
3
4
16
21
5
6
7
8
9
10
11
12
13
14
15
103. Facebook provides third-party developers with a platform, tools and
instructions that allow them to create Facebook applications, such as games or quizzes
or other interactive programs that users can add to their accounts. Such applications
reside on the developers’ servers and allow access to Facebook’s database and User
information, including name, picture, gender, birthday, hometown location (city/state/
country), current location (city/state/ country), political view, activities, interests, musical
preferences, television preferences, movie preferences, book interests, relationship
status, dating interests, relationship interests, summer plans, network affiliation,
educational history, employment history, photos posted on Facebook, meta-data
associated with the user (time of uploads, comments on user photos), usage
information concerning number of messages sent or received, User IDs mapped to
Users’ Facebook friends, social timelines, and events associated with User profiles.
17
18
19
20
104. Although Facebook has implemented written policies directed at third-
party developers that are intended to restrict their use of Facebook User data, in actual
practice there are no technical safeguards to prevent the misappropriation and misuse
of user data by the third-party developers. Most Facebook Users are not aware that
third party developers have access to their personal information.
22
23
24
25
26
27
28
105. According to the conclusions of a recent report by Office of Privacy
Commissioner of Canada, “with the exception of contact information, applications
technically can access virtually any personal information in a given User’s account,
including the list of friends, some information about the friends, and information that
could be considered sensitive outside the circle of friends.” The report also found that
although Facebook written policies contractually requires developers to respect Users’
privacy settings, Facebook has not provided “any evidence of any technological barrier
to a developer’s access to information precluded by the settings.” The reports also
I. FACEBOOK’S POLCIES AND TECHNOLOGIES REGARDING THIRD-PARTY
DEVELOPER ACQUISITION AND USE OF PERSONAL USER DATA VIOLATE
USERS’ PRIVACY RIGHTS.
Complaint for Damages and Injunctive Relief - 31
1
2
3
stated that “there is no evidence that Facebook makes any significant sustained effort to
ensure that the information accessed by developers is only that which is truly needed to
run their applications.”
4
13
16
24
5
6
7
8
9
10
11
12
106. When a Facebook User decides to install a third-party application the
information that is submitted to the third-party developer also includes information about
every “friend” that appears in that User’s account or profile. Thus, a User who installs a
third-party application not only surrenders his or her information but also surrenders
information about his or her Facebook friends. Facebook Users may unknowingly and
without their consent have their personal information sent to a third party developer
based on the actions of one of their Facebook friends. Facebook has failed to warn
Users of such disclosures and has also failed implement controls to prevent third-party
developers from gaining access to such information.
14
15
107. Facebook has not provided users with adequate information to make a
meaningful and informed decision regarding the harvesting and use of their personal
data by third-party developers.
17
18
19
20
21
22
23
108. Although Facebook tells users in its Privacy Policy, that it “does not
screen or approve Platform Developers” and “cannot control how…Platform Developers
use any personal information that they may obtain in connection with Platform
Applications,” it fails to adequately disclose the dire ramifications and dangers of
allowing unscreened third-party developers almost complete, unrestricted access to a
User’s personal data. A third-party developer could copy Facebook User data onto to
their own servers, which are outside the control of Facebook, and retain the information
indefinitely and use it for any conceivable purpose.
25
26
27
28
109. As the custodian of User data, Facebook has the superior knowledge and
ability to develop technological safeguards to protect User data against unauthorized or
wrongful use by third parties. By allowing unscreened developers almost unrestricted
access and use of user data, Facebook has compromised the privacy, identity, and
safety of those Users.
Complaint for Damages and Injunctive Relief - 32
1
2
3
4
5
21
24
27
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
110. Facebook intentionally designed its site to make it impossible for Users to
delete their Facebook account and permanently purge all their data from Facebook
and/or third party databases. Facebook allows Users to “deactivate” their account, and
Users may believe that their data is then purged. However, deactivation does not result
in the automatic deletion and purging of all their data. Facebook recently implemented a
“delete my account” feature that allows the deletion (as opposed to mere deactivation)
of a User’s account. However, that option is currently not displayed in the account
options section of a Facebook User’s account, which is where the deactivation option is
located. Users must search for the “delete my account” option in order to find and use it.
Even if Users successfully locate the “delete my account” option, there is no indication
or guarantee by Facebook that the “delete my account” option will permanently purge all
User data. The statement accompanying the “delete my account” option merely states,
“If you do not think you will use Facebook again and would like your account deleted,
we can take care of this for you. Keep in mind that you will not be able to reactivate your
account or retrieve any of the content or information you have added.” Thus, the “delete
my account” option merely represents that the User will not be able to retrieve the data.
22
23
111. Facebook also does not inform Users as to the length of time that their
personal data may be stored by Facebook. Based on Facebook’s current ambiguous
policy, Facebook may conceivably store User data indefinitely.
25
26
112. Information shared with other Facebook Users is not affected by
deactivation of deletion and therefore such information may persist indefinitely on other
Users’ accounts.
28
1
J. FACEBOOK FAILS TO PROVIDE USERS WITH SIMPLE AND PERMANENT
MEANS TO DELETE THEIR ACCOUNT AND PERSONAL DATA AND MAY RETAIN
PERSONAL DATA INDEFINITELY
13. Information released by Facebook to third parties is outside the control of
Facebook and therefore is not affected by deactivation or delete account features.
Complaint for Damages and Injunctive Relief - 33
1
2
There are no technological controls in place to retrieve or destroy such data once it has
been transferred to a third party.
3
4
5
19
20
6
7
8
9
10
11
12
13
14
15
16
17
18
114. Plaintiffs also allege that Facebook, through its technologically
sophisticated advertising practices, has violated the publicity rights of many Users.
California law prohibits the use of another’s name, photograph or likeness in advertising
or soliciting without prior consent. Facebook employs various forms of advertising in
order to generate revenue. Plaintiffs understand and appreciate the need for Facebook,
like any other business, to advertise in order to generate income, achieve profitability,
and provide its services to the public. However, Plaintiffs allege Facebook has used
specific types of invasive and targeted advertising technologies that violate or infringe
users privacy and publicity rights. Such advertising technologies include the generation
and transmission or display of customized advertisements that use users’ personal and
private data including name, photo or likeness in order to advertise products and
services to friends or other Users within that person’s network. Such practices and
technologies go beyond the usual, non-personally identifiable types of targeted
advertising that are prevalent on the Internet.
21
22
23
24
25
26
27
28
115. In November 2007 Facebook introduced a tracking technology called
Beacon. Facebook Users were automatically signed up for the Beacon system. The
Facebook tracking technology allows third-party affiliate websites to track and gather
information, such as purchases or other activities, from Facebook Users who visit their
websites. Furthermore, the Facebook tracking technology allows third-party affiliates to
publish the gathered information in the form of advertisements appearing in the “news
feed” sections of the Facebook User’s friends. The CA Research Threat Group
determined that the Facebook tracking technology tracks all Users at participating sites,
including logged off, former, and non Facebook members. The Facebook tracking
K. FACEBOOK ADVERTISING VIOLATES FACEBOOK USERS’ PRIVACY AND
PUBLICITY RIGHTS
L. FACEBOOK TRACKING TECHNOLOGY
Complaint for Damages and Injunctive Relief - 34
1
2
3
technology collects and returns data about Facebook Users and non Users to
Facebook. The Facebook tracking technology provides third-party affiliates with highly
personalized, targeted, and invasive ads.
4
10
11
19
20
21
25
27
5
6
7
8
9
116. Facebook fails to disclose tracking technologies to Facebook Users or
provide the necessary controls to prevent unwanted tracking. Many Facebook Users are
unwitting participants of Facebook tracking technologies and have had their purchases
and/or other online activities published to other Facebook Users without their express
consent. Facebook and participating affiliates thus profited from the misappropriation
and misuse of personal and private data.
12
13
14
15
16
17
18
117. Facebook is engaged in displaying Users’ photographs to advertise
products or services without User knowledge or consent. These advertisements, which
display user photographs to tacitly endorse products or services, are referred to as
“social ads.” Default privacy settings for “social ads” allow “social ads” to be displayed to
any person designated as a user’s “friend.” Current privacy settings are confusing and
unlikely to be fully understood or used by a large number of Users. Additionally,
Facebook has commenced direct advertisements to Plaintiffs including sexually oriented
and provocative material.
22
23
24
118. Plaintiffs allege that Facebook is aware that a significant number of
Facebook Users are under the age of 13. Facebook does not have adequate
safeguards and monitoring technology to prevent the registration and/or use of
Facebook by those under the age of 13.
26
1
28
1
M. FACEBOOK “SOCIAL ADS”
N. FACEBOOK DOES NOT HAVE ADEQUATE SAFEGUARDS IN PLACE TO
PREVENT REGISTRATION OR USE OF PERSONS UNDER THE AGE OF 13
19. On August 10, 2009, Plaintiff, Xavier O. who is 11 years old, posted
"Xavier O. has swine flu. Please pray 4 me. God Bless. Xavier O.”
20. Xavier O. did not seek approval from his parents to post health
information.
Complaint for Damages and Injunctive Relief - 35
1
2
3
4
5
6
7
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
8
VI. CLAIMS FOR RELIEF
FIRST CAUSE OF ACTION
VIOLATION OF CALIFORNIA Civil Code § 3344
121. Plaintiffs reallege and incorporate by reference, as if fully set forth herein,
the allegations in paragraphs 1-116 above.
122. California Civil Code § 3344(a) provides:
“Any person who knowingly uses another’s name, voice, signature,
photograph, or likeness, in any manner on or in products, merchandise, or
goods, or for purposes of advertising or selling, or soliciting purchases of
products, merchandise, goods or services, without such person’s prior
consent, or, in the case of a minor, the prior consent of his parent or legal
guardian, shall be liable for any damages sustained by the person or
persons injured as a result thereof. In addition, in any action brought under
this section, the person who violated the section shall be liable to the
injured party or parties in an amount equal to the greater of seven hundred
fifty dollars ($750) or the actual damages suffered by him or her as a
result of the unauthorized use, and any profits from the unauthorized use
that are attributable to the use and are not taken into account in computing
the actual damages. In establishing such profits, the injured party or
parties are required to prove his or her deductible expenses. Punitive
damages may also be awarded to the injured party or parties. The
prevailing party in any action under this section shall also be entitled to
attorney’s fees and costs.”
Complaint for Damages and Injunctive Relief - 36
1
5
8
11
14
15
16
17
18
19
21
23
26
27
28
2
3
4
123. Defendants and each of them used Plaintiffs’ names, photographs, and
likenesses knowingly and deliberately, without the prior consent of any of the Plaintiffs,
and in the case of minor Plaintiffs Xavier O. and Chris C., without the prior consent of
their parents or legal guardians, and
6
7
9
10
125. Plaintiffs have suffered actual damages as a result of Defendants’
deliberate use of their names, photographs, and likenesses on advertisements and
other types of solicitations for goods or services.
12
13
126. Defendants engaged in outrageous conduct, carried on with willful and
conscious disregard of the rights of Plaintiffs. Plaintiffs are entitled to compensatory and
punitive damages. Plaintiffs are entitled to attorney fees and costs.
20
22
24
25
124. Each such use was unequivocally and directly for purposes of advertising
or selling, or soliciting purchases of products, merchandise, goods or services by
Facebook, such that prior consent was required.
SECOND CAUSE OF ACTION
MISSAPROPRIATION OF NAME AND LIKENESS UNDER
CALIFORNIA COMMON LAW
127. Plaintiffs reallege and incorporates by reference, as if fully set forth herein,
the allegations in paragraphs 1-122 above.
128. Defendants have and are using Plaintiffs’ name, identity, likeness, and
personal information for commercial advantage without Plaintiff’s consent.
129. Defendants’ misappropriation of Plaintiffs’ names, identities, photographs,
likenesses, and personal information has resulted in injury to Plaintiffs and each of
them.
130. Plaintiffs are entitled to compensatory damages.
Complaint for Damages and Injunctive Relief - 37
1
2
3
4
6
8
9
12
14
19
21
22
23
24
26
5
7
10
11
13
15
16
17
18
20
25
27
28
THIRD CAUSE OF ACTION
VIOLATIONS OF BUSINESS AND PROFESSIONS CODE § 17200
(UNFAIR COMPETITION)
131. Plaintiffs reallege and incorporates by reference, as if fully set forth herein,
the allegations in paragraphs 1-125 above.
132. Defendants promised and represented that User information would remain
private.
133. Plaintiffs relied on the promises and representations of Defendants.
134. Plaintiffs were injured by Defendants' concealment of their data mining
practices and wrongful use, dissemination, and sale of Users' personal and private
information and data as described above.
135. Plaintiffs have suffered injury in fact and lost money or property as a result
of such unfair business practices.
136. Defendants’ acts and conduct are unfair, unlawful and fraudulent business
practices. Defendants' acts and practices are also unlawful because they violate Civil
Code sections 1750 et seq (Consumer Legal Remedies Act); California Constitution Art.
1, section 1; and Business and Professions Code sections 22575-579 (Online Privacy
Protection Act).
137. Plaintiffs seek an order of this Court awarding damages, restitution,
disgorgement, injunctive relief and all other relief allowed under §17200, et seq.
FOURTH CAUSE OF ACTION
VIOLATION OF CALIFORNIA CONSTITUTIONAL RIGHT TO PRIVACY
138. Plaintiffs reallege and incorporate by reference, as if fully set forth herein,
the allegations in paragraphs 1-132 above.
139. Plaintiffs had and continue to have privacy rights in their personal
information, identities, data, photographs, and communications pursuant to Article One,
Section One of the California Constitution.
Complaint for Damages and Injunctive Relief - 38
1
5
8
10
12
13
14
15
17
21
23
24
25
26
28
2
3
4
140. Defendants, through unlawful means, violated the California constitutional
privacy rights of Plaintiffs by Defendants’ unauthorized access, copying, distribution,
use, commercialization, and/or sale of Plaintiffs’ private and personal information,
identities, data, photographs, and communications.
6
7
9
14
11
1
16
18
19
20
22
27
141. Defendants had no authorization or privilege to gain access, copy,
distribute, use, commercialize, and/or sell Plaintiffs’ private and personal information,
identities, data, photographs, and communications.
2. As a consequence, Plaintiffs have suffered and will continue to suffer
damages.
43. Plaintiffs are entitled to compensatory damages, restitution, disgorgement,
and injunctive relief.
FIFTH CAUSE OF ACTION
VIOLATION OF THE CALIFORNIA ONLINE PRIVACY ACT
(CALIFORNIA BUSINESS AND PROFESSIONS CODE § 22575-22579)
144. Plaintiffs reallege and incorporate by reference, as if fully set forth herein,
the allegations in paragraphs 1-137 above.
145. The California Online Privacy Act, California Business and Professions
Code § 22575-22579 provides that operators of commercial websites that collect
personally identifiable information from California’s residents are required to
conspicuously post and comply with a privacy policy requirements as defined in the Act.
146. Plaintiffs are entitled to compensatory damages, restitution, disgorgement,
and injunctive relief.
SIXTH CAUSE OF ACTION
VIOLATION OF THE CALIFORNIA CONSUMER LEGAL REMEDIES ACT
(CALIFORNIA CIVIL CODE § 1750 et seq)
147. Plaintiffs reallege and incorporate by reference, as if fully set forth herein,
the allegations in paragraphs 1-139 above.
Complaint for Damages and Injunctive Relief - 39
1
4
7
9
11
13
17
19
21
23
26
28
2
3
5
6
8
15
10
1
12
1
14
15
16
153. Defendants’ unilateral change of the Terms of Use, Statement of Rights
and Responsibilities, and Privacy Policy without notice to Users after Users have
commenced use of Facebook are unconscionable and violate Civil Code section
1770(a)(19).
18
1
20
1
22
1
24
25
157. Defendant’s deceptive acts and omissions and unfair business practices
occurred in the course of providing a consumer service and violate Civil Code section
1770(a).
27
1
148. The Consumer Legal Remedies Act (CLRA), California Civil Code
sections 1750 et seq, applies to Defendants’ actions and conduct because such actions
and conduct pertain to consumer services.
149. Defendants have engaged in deceptive practices, unlawful methods of
competition and/or unfair acts as defined by Civ. Code §1770, to the detriment of
Plaintiffs.
0. Plaintiffs have suffered harm as a proximate result of the violations of law
and wrongful conduct of Defendants alleged herein.
51. Defendants intentionally and unlawfully perpetrated harm upon Plaintiffs
by the above described acts.
52. Defendants’ Terms of Use, Statement of Rights and Responsibilities, and
Privacy Policy are unconscionable and violate Civil Code section 1770(a)(19).
54. In violation of Civil Code section 1770(a)(14), Facebook represented that
User information would remain private.
55. Defendants concealed material information regarding their data mining
activity, and the dissemination and sale of User data.
56. Users, including Plaintiffs, relied upon Facebook’s representations in
uploading and sharing personal information and data.
58. As a direct and proximate result of Defendant’s violations of the CLRA,
Plaintiffs and other class members have suffered harm.
Complaint for Damages and Injunctive Relief - 40
1
5
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
2
3
4
159. Defendants’ policies and practices are unlawful, unethical, oppressive,
fraudulent and malicious. The gravity of the harm to all consumers from Defendants’
policies and practices far outweighs any purported utility those policies and practices
have.
6
7
160. Plaintiffs are entitled to (a) actual damages; (b) restitution of money to
Plaintiffs and Class members; (c) punitive damages; (d) attorneys’ fees and costs; and
(e) other relief that this Court deems proper
VII. PRAYER FOR RELIEF
WHEREFORE, Plaintiffs pray for the following relief:
A. For injunctive relief, as follows: An order enjoining Facebook from
uploading, downloading, disseminating, or selling identifiable information or
photographs of minors without consent of parents or guardians. ;
B. An order enjoining Facebook from uploading, downloading, disseminating,
or selling identifiable information or photographs or work of Users without their consent.
D. An order enjoining Facebook from permitting the unauthorized
downloading of copyrighted images (photographs);
E. An order enjoining Facebook from retaining, disseminating, and selling
private and personal information of Facebook Users who terminate their service;
F. For judgment in favor of Plaintiffs, and against the Defendants, for
damages in such amounts as may be proven at trial;
G. Pursuant to California Civil Code § 3344, for compensatory damages in an
amount equal to or greater of seven hundred fifty dollars ($750) for each unauthorized
use Plaintiffs’ names or photographs, or actual damages suffered by Plaintiffs. Cal. Civ.
Code § 3344(a);
H. Punitive damages;
I. For attorneys’ fees and costs;
Complaint for Damages and Injunctive Relief - 41
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
J. For such other relief as the Court may deem just and proper.
_________________________________
Dana B. Taschner
THE LANIER LAW FIRM
JURY DEMAND
Plaintiffs demand a trial by jury.
_________________________________
Dana B. Taschner
THE LANIER LAW FIRM
