Case 3:18-cv-06399-LB Document 1 Filed 10/19/18 Page 1 of 25 1 2 3 4 5 6 7 Sabita J. Soneji (SBN 224262) Katherine M. Aizpuru (to be admitted pro hac vice) TYCKO & ZAVAREEI LLP The Tower Building 1970 Broadway, Suite 1070 Oakland, California 94612 Telephone: (510) 254-6808 Facsimile: (202) 973-0950 Email: ssoneji@tzlegal.com kaizpuru@tzlegal.com 12 Norman E. Siegel (to be admitted pro hac vice) Barrett J. Vahle (to be admitted pro hac vice) STUEVE SIEGEL HANSON LLP 460 Nichols Road, Suite 200 Kansas City, Missouri 64112 Telephone: (816) 714-7100 Facsimile: (816) 714-7101 Email: siegel@stuevesiegel.com vahle@stuevesiegel.com 13 Counsel for Plaintiff 8 9 10 11 14 15 UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF CALIFORNIA 16 17 18 19 20 21 Case No. 3:18-cv-6399 BRETT HEEGER, CLASS ACTION COMPLAINT Plaintiff, JURY TRIAL DEMANDED v. FACEBOOK, INC., Defendant. 22 23 24 25 26 27 28 -1CLASS ACTION COMPLAINT Case 3:18-cv-06399-LB Document 1 Filed 10/19/18 Page 2 of 25 1 Plaintiff BRETT HEEGER (“Plaintiff”), through his undersigned attorneys, on behalf of 2 himself and all persons similarly situated, brings this complaint against Defendant Facebook, Inc. 3 (“Facebook” or “Defendant”). INTRODUCTION 4 1. 5 Facebook misleads its users by offering them the option to restrict Facebook from 6 tracking, logging, and storing their private location information, but then continuing to track, log, and 7 store that location information regardless of users’ choices. Facebook’s “Location History” feature 8 allows Facebook to build a history of precise locations received through users’ smartphones or other 9 devices. Facebook gives its users the option to turn “off” Location History, but selecting that option 10 does not stop Facebook from tracking the location of its users. In fact, Facebook secretly tracks, logs, 11 and stores location data for all of its users—including those who have sought to limit the information 12 about their locations that Facebook may store in its servers by choosing to turn Location History off. 13 Because Facebook misleads users and engages in this deceptive practice, collecting and storing private 14 location data against users’ expressed choice, Plaintiff brings this class action on behalf of himself and 15 similarly situated Facebook users. 2. 16 Facebook is a data aggregation and marketing company cloaked as a social networking 17 platform. Facebook’s surface-level social networking platform facilitates the sharing of information, 18 photographs, website links, and videos among friends, family, and coworkers. As Facebook explains, 19 “[p]eople use Facebook to stay connected with friends and family, to discover what’s going on in the 20 world, and to share and express what matters to them.” 1 By the end of 2017, Facebook had more than 21 2.2 billion active users. 3. 22 To encourage use of its social networking platform, which it uses to aggregate and 23 market personal data, Facebook provides multiple mechanisms through which users may access its 24 social media product. These include, but are not limited to, a website accessed through a computer or 25 26 27 28 Company Info, Facebook, Inc., available at https://newsroom.fb.com/company-info/ (last visited October 15, 2018). -2- 1 CLASS ACTION COMPLAINT Case 3:18-cv-06399-LB Document 1 Filed 10/19/18 Page 3 of 25 1 mobile device’s web browser and auxiliary applications such as Facebook and Facebook Messenger 2 created for mobile devices. 4. 3 Facebook has numerous privacy settings that purportedly give users the ability to share 4 and restrict their private information based on their own specific preferences. These purported privacy 5 protections, and the fact that Facebook does not disclose that turning “off” Location History will have 6 no impact on Facebook’s tracking, collection, and storage of users’ private location data, lead 7 reasonable consumers to believe that their private location information is not tracked once they turn 8 “off” that feature. 9 5. Despite users’ attempts to protect their location privacy, Facebook exploitatively tracks, 10 collects, and stores information about where users have logged in and used Facebook, without those 11 users’ consent. Facebook stores this location data in its servers, sometimes for years, without informing 12 users that it is collecting their location data or keeping records of where users have been, thereby 13 invading users’ reasonable expectations of privacy. 6. 14 Location data is highly sensitive—it reveals not only where an individual is at a 15 particular time, but also other personal information, such as an individual’s job, medical treatment, 16 personal relationships, and private interests. Without vindication of individual privacy rights, 17 corporations like Facebook will enjoy unfettered ability to surveil, track, store, and ultimately profit 18 from the most intimate and private details of users’ lives. 7. 19 Facebook’s deceptive acts in this regard are contrary to Facebook’s own representations 20 about how users can control the personal information that they share with Facebook. Facebook’s 21 misleading and untrue statements give average consumers the impression that they can limit the 22 location data that Facebook is allowed to track, log, and store. For example, Facebook assures users 23 that “When Location History is turned off, Facebook will stop adding new information to your 24 Location History which you can view in your Location Settings,” and promises users that they can 25 “delete your previously recorded location from your Location History.” 2 Facebook also promises users 26 27 28 About Location History, Facebook, Inc., available at https://www.facebook.com/location_history/info/ (last visited October 10, 2018). 2 -3CLASS ACTION COMPLAINT Case 3:18-cv-06399-LB Document 1 Filed 10/19/18 Page 4 of 25 1 that “You’re in control of who sees your location on Facebook Company Products.” 3 However, the 2 option to turn Location History off is meaningless, since in reality there is no way for users to prevent 3 Facebook from tracking and storing their location information. 8. 4 By giving users the option to turn Location History off, Facebook offers its users a false 5 sense of security, leading them to believe that they have control over the personal data it collects and 6 stores. Facebook’s false assurances are intended to make users feel comfortable continuing to use 7 Facebook and share their personal information so that Facebook can continue to be profitable, at the 8 expense of user privacy. Facebook employs users’ location information to specifically target its 9 advertisements to users and expose them to content and news tagged with nearby locations. Advertisers 10 pay Facebook to place advertisements because Facebook is so effective at using location information to 11 target advertisements to consumers. Facebook’s growth strategy depends on Facebook’s ability to 12 collect, store, and ultimately sell personal consumer data, including location information. 9. 13 Because Facebook systematically and covertly tracks, collects, and stores users’ private 14 location information even after users have affirmatively opted not to share their location history, 15 Plaintiff brings this class action on behalf of himself and others similarly situated to vindicate his rights 16 under the Stored Communications Act, 18 U.S.C. §§ 2701 et seq., the California Invasion of Privacy Act, 17 Cal. Pen. Code § 630 et seq., the California Constitution, and state law. Plaintiff seeks compensatory and 18 statutory damages, and seeks an injunction requiring Facebook to stop tracking and collecting users’ 19 location data without affirmatively obtaining the consent of those users. PARTIES 20 10. 21 Plaintiff Brett Heeger is a citizen of California, residing in North Hollywood. Plaintiff 22 joined Facebook in 2004. During the relevant time period, Plaintiff accessed his Facebook through a 23 web browser on his smart phone and through web browsers on both laptop and desktop computers. 24 Plaintiff has not used the Facebook app since 2016. Plaintiff expressly attempted to limit Facebook’s 25 tracking of his location by turning the Location History tracking and storage option to “off.” In doing 26 27 28 Privacy Basics, Location, Facebook, Inc., available at https://www.facebook.com/about/basics/manage-your-privacy/location#7 (last visited October 10, 2018). -43 CLASS ACTION COMPLAINT Case 3:18-cv-06399-LB Document 1 Filed 10/19/18 Page 5 of 25 1 so, Plaintiff relied on Facebook’s promise that, if he turned Location History “off,” Facebook would no 2 longer build a Location History logging his private location information. Plaintiff understood Facebook 3 to be representing that it would no longer track and collect his private location information once he had 4 exercised the option to turn Location History off. Nevertheless, Facebook continued to track and store 5 his private location information without his knowledge or consent even when Plaintiff did not use the 6 Facebook app or tag his location in posts. Plaintiff suffered damages when he was deprived of control 7 over access to his private location information. 8 9 10 11. Defendant Facebook, Inc. is incorporated in Delaware and its headquarters are located at 1601 Willow Rd., Menlo Park, California 94025. With over 2.2 billion monthly users, Facebook is the world’s leading online social media and networking platform. 4 JURISDICTION AND VENUE 11 12. 12 This Court has original jurisdiction pursuant to 28 U.S.C. § 1332(d)(2). The matter in 13 controversy, exclusive of interest and costs, exceeds the sum or value of $5,000,000, and members of 14 the Class are citizens of different states from Defendant. 13. 15 Venue is proper in this Court under 28 U.S.C. § 1391 because significant events giving 16 rise to this case took place in this District, and because Facebook is authorized to conduct business in 17 this District, has intentionally availed itself of the laws and markets within this District, does substantial 18 business in this District, and is subject to personal jurisdiction in this District. 14. 19 Venue is further proper in this Court under Facebook’s Terms of Service, which 20 provide: [A]ny claim, cause of action, or dispute . . . that arises out of or relates to these Terms or the 21 Facebook Products (“claim”) . . . will be resolved exclusively in the U.S. District Court for the Northern 22 District of California . . . and that the laws of the State of California will govern these terms and any 23 claim, without regard to conflict of law provisions. 5 24 25 26 27 28 Terms of Service, Facebook, Inc., (Date of Revision: April 19, 2018), available at https://www.facebook.com/terms.php (last visited October 5, 2018). 5 -5CLASS ACTION COMPLAINT Case 3:18-cv-06399-LB Document 1 Filed 10/19/18 Page 6 of 25 FACTUAL ALLEGATIONS 1 2 A. 3 15. Facebook’s Social Media Platform Facebook is the world’s leading online social media and networking platform. Its users 4 can access Facebook from desktop and laptop computers as well as mobile devices, including smart 5 phones and tablets. Facebook’s self-proclaimed mission is to “give people the power to build 6 community and bring the world closer together.” 6 16. 7 As of June 30, 2018, Facebook has more than 2.23 billion monthly users and 1.47 billion 8 daily active users. Facebook claims that it has “only begun to fulfill” its mission to “bring the world 9 closer together.” 7 10 17. 11 environment that rewards creative problem solving and active decision making.” 8 12 13 14 15 16 17 18 21 Facebook Provides Privacy Settings that Lead Reasonable Consumers to Believe that They Have Control over Their Private Location Data and History 18. Facebook’s “Location History” is a record of locations received through the Location into Facebook and accessing the “Settings” tab. Because Location History is “on” by default, Facebook adds current precise location information to users’ Location History and builds a detailed chronology of users’ location information. According to Facebook, Location History helps users “explore what’s around,” “get more relevant ads,” and “improve Facebook.” 19. However, many Facebook users do not want Facebook to build and keep a precise history of their location. For those users, Facebook offers users the option to turn Location History “off.” 22 23 B. Services setting on users’ smartphones or other devices. Users can view Location History by logging 19 20 As a company, Facebook prides itself on its “hacker culture,” which it describes as “an 20. Users can turn Location History off by logging into their Facebook account, accessing the “Settings” tab, and choosing “Location.” On the Location page, users can toggle the Location 24 25 26 27 28 Facebook, Inc., available at https://www.facebook.com/pg/facebook/about/ (last visited October 11, 2018). 6 Our Culture, Facebook, Inc., available at https://newsroom.fb.com/company-info/ (last visited October 11, 2018). 8 Id. -67 CLASS ACTION COMPLAINT Case 3:18-cv-06399-LB Document 1 Filed 10/19/18 Page 7 of 25 1 History setting to off. Users can also view the Location History that Facebook has compiled, and delete 2 it if they choose. 21. 3 Facebook affirmatively represents to its users that when Location History is off, 4 Facebook will no longer collect and store information about the places that they go. Facebook states 5 that “[w]hen Location History is turned off, Facebook will stop adding new information to your 6 Location History which you can view in your Location Settings.” 9 Since Facebook does not disclose 7 that it tracks and stores location information in other places, this representation would lead a reasonable 8 consumer to believe that Facebook does not track and store private location data once Location 9 History has been turned off. 22. 10 When users who have turned Location History off view their “Location Settings,” 11 Facebook assures those users that “Your Location History is off” and that “[i]f you don’t have the 12 [Facebook] app installed, locations cannot be received from the device” 10: 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 About Location History, Facebook, Inc., available at https://www.facebook.com/location_history/info/ (last visited October 10, 2018). 10 For a Facebook accountholder who has turned Location History off, this image can be seen at Location Settings, Facebook, Inc., available at https://www.facebook.com/settings?tab=location (last visited October 10, 2018). 9 -7CLASS ACTION COMPLAINT Case 3:18-cv-06399-LB Document 1 Filed 10/19/18 Page 8 of 25 23. 1 If a user who has turned Location History off tries to view their Location History, 2 Facebook again informs the user that “Location History is off.” Facebook promises users that their 3 Location History is “private and secure” and that they can “manage” it at any time. 11 4 5 6 24. 7 8 9 Then, in a section of the Facebook website called “Privacy Basics,” Facebook again promises users that they can “turn [Location History] on or off in your location settings or delete it at any time within the Facebook app.” 12 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 For a Facebook accountholder who has turned Location History off, this image can be seen at Location History, available at https://www.facebook.com/location_history/view/ (last visited October 10, 2018) 12 Privacy Basics, Location, Facebook, Inc., available at https://www.facebook.com/about/basics/manage-your-privacy/location#6 (last visited October 10, 2018). -811 CLASS ACTION COMPLAINT Case 3:18-cv-06399-LB Document 1 Filed 10/19/18 Page 9 of 25 25. 1 2 Facebook goes out of its way to assure users that they are “in control of who sees your location on Facebook Company Products,” and that users “can manage” their location information. 13 3 4 5 6 7 8 9 10 11 12 13 26. 14 15 In its terms of service, Facebook even promises users that it only collects device location “if you’ve allowed us to collect it.” 14 16 17 18 19 20 21 22 23 24 25 26 27 28 Privacy Basics, Location, Facebook, Inc., available at https://www.facebook.com/about/basics/manage-your-privacy/location#7 (last visited October 10, 2018). 14 Terms of Service, Facebook, Inc., (Date of Revision: April 19, 2018), available at https://www.facebook.com/terms.php (last visited October 5, 2018). -913 CLASS ACTION COMPLAINT Case 3:18-cv-06399-LB Document 1 Filed 10/19/18 Page 10 of 25 1 27. In this way, Facebook affirmatively—and misleadingly—represents to its users that 2 turning off “Location History” would result in Facebook ceasing to track, record, store, and use users’ 3 location information. These representations also omit the material facts that Facebook continues to 4 track, record, store, and use users’ location information when Location History is off. 5 C. 6 28. 7 8 9 Facebook Tracks Location Regardless of Privacy Settings Notwithstanding these representations and assurances, Facebook tracks and stores users’ location information regardless of their privacy settings. 29. Even when Location History is turned off, users’ location is stored every time they use Facebook. Facebook stores “Login Protection Data” that shows users’ “Estimated location inferred 10 from IP,” right down to users’ latitude and longitude on the date and time of login. Facebook also 11 stores “Where You’re Logged In,” a list of locations where users logged into Facebook according to the 12 date and time of use. Because users frequently log in with their mobile device, this tracking inferred 13 from IP effectively means that Facebook is actively tracking users everywhere they go. As far as 14 Plaintiff can tell, there is currently no way to prevent Facebook from tracking and storing this location 15 information. 16 30. In other words, turning off Location History only stops Facebook from displaying a 17 Location History that is visible on the Location History page. Turning off Location History does not 18 stop Facebook from tracking, logging, and storing users’ personal and intimate location information. 19 31. Facebook does not disclose that, even when Location History is turned off, it continues 20 to track users’ approximate location using IP addresses and other information gleaned from Wi-Fi 21 connections. Specifically Facebook states: “You can control whether your device shares precise location 22 information with Facebook Company Products via Location Services, a setting on your mobile device. 23 We may still understand your location using things like check-ins, events, and information about your 24 internet connection.” However, Facebook never discloses to consumers that—even after a consumer 25 has turned Location History off—it is continuing to log, store, and create a history of the private 26 location information that it “understands” from the consumer’s use of Facebook. And Facebook never 27 discloses to consumers that it is logging, storing, and creating a history of private location information 28 even if users do not “tag” their posts with a specific location or “check in” at locations. -10CLASS ACTION COMPLAINT Case 3:18-cv-06399-LB Document 1 Filed 10/19/18 Page 11 of 25 32. 1 The only way for users to discover this secret tracking and collecting is by downloading 2 all of their data from Facebook and searching through multiple levels of obscure folders (not the 3 Location History folder, but rather the “security_and_login_information” folder and the 4 “login_protection_data” and “where_you’re_logged_in” subfolders). Downloading and searching one’s 5 Facebook data in this manner is only possible on a desktop computer, not on a mobile device, even 6 though many Facebook users primarily or exclusively rely upon their mobile devices for their Facebook 7 interactions. Indeed, users can only turn off Location History on their mobile device, but then are 8 unable to see the tracked location information anywhere but on a desktop computer. 33. 9 Facebook’s conduct is contrary to users’ reasonable expectations of privacy. The 10 average consumer understands that turning Location History off has a purpose and an effect: to limit 11 Facebook from tracking, logging, and storing location information. Reasonable users of Facebook 12 would not expect Facebook to continue tracking, logging, and storing private location information once 13 they have turned Location History off. As Princeton computer scientist and former chief technologist 14 for the Federal Communications Commission’s enforcement bureau Jonathan Mayer stated in regard to 15 similar conduct by Google, Inc., “If you’re going to allow users to turn off something called ‘Location 16 History,’ then all the places where you maintain location history should be turned off. That seems like a 17 pretty straightforward position to have.” 15 34. 18 Facebook profits from users’ location information that it surreptitiously collects and 19 stores. Indeed, Facebook admits that it uses location-related information to “personalize” 20 advertisements. Facebook’s business model is built upon using personal information, like location 21 information, to provide third party companies with targeted advertising. Allowing users to actually 22 disable Facebook’s ability to continuously track their location would thwart Facebook’s ability to use 23 their information and profit from such targeted advertising. 24 25 26 27 28 Nakashima, Ryan. “AP Exclusive: Google tracks your movements, like it or not.” The AP (Aug. 13, 2018), https://www.apnews.com/828aefab64d4411bac257a07c1af0ecb/AP-Exclusive:-Google-tracksyour-movements,-like-it-or-not. -11- 15 CLASS ACTION COMPLAINT Case 3:18-cv-06399-LB Document 1 Filed 10/19/18 Page 12 of 25 D. 1 35. 2 Facebook’s Conduct Violates Its Consent Decree with the Federal Trade Commission In 2009, the FTC filed a complaint against Facebook for its failure to keep promises it 3 made regarding user privacy. 16 The FTC complaint described a number of failed promises made by 4 Facebook, including: 1) In December 2009, Facebook changed its website, without providing notice to users, so that certain information that users designated as private, such as their Friends List, was made public; 5 6 2) Facebook represented to users that they could restrict the sharing of data to limited audiences—for example, restricting data-sharing with “Friends Only”—but their information was still shared with third-party applications installed by users’ friends; and 7 8 9 3) Facebook represented that third-party applications that users installed would only have access to users’ data that the applications needed to operate but, in fact, the applications had access to all of the users’ data, including data not needed to operate. 17 10 11 12 36. 13 14 15 16 17 18 Facebook “not [to] misrepresent in any manner . . . the extent to which it maintains the privacy or security of covered information,” including but not limited to “the extent to which a consumer can control the privacy of any covered information maintained by [Facebook] and the steps a consumer must take to implement such controls.” 18 “Covered information” includes “Internet Protocol (“IP”) address[es]” and “physical location.” 37. 19 20 21 In 2011, Facebook entered into a twenty-year Consent Decree with the FTC requiring In violation of the FTC Consent Decree, Facebook has continued to track, log, and store information about users’ IP addresses and physical location despite representing to consumers that they have the ability to prevent Facebook from doing so. 22 23 24 25 26 27 28 Federal Trade Commission, Facebook Settles FTC Charges That It Deceived Consumers by Failing to Keep Privacy Promises, available at https://www.ftc.gov/news-events/pressreleases/2011/11/facebook-settles-ftc-charges-it-deceived-consumers-failing-keep (last visited October 15, 2018). 17 Id. 18 In the Matter of Facebook, Inc., a corporation, Agreement Containing Consent Order, at Section I, available at https://www.ftc.gov/sites/default/files/documents/cases/2011/11/111129facebookagree.pdf (last visited October 15, 2018) (“FTC Consent Order”); see also Federal Trade Commission, FTC Approves Final Settlement With Facebook, Aug. 10, 2012, https://www.ftc.gov/news-events/pressreleases/2012/08/ftc-approves-final-settlement-facebook (last visited October 15, 2018). -1216 CLASS ACTION COMPLAINT Case 3:18-cv-06399-LB Document 1 Filed 10/19/18 Page 13 of 25 E. 1 2 38. 3 4 The FTC Has Held that Tracking Individuals’ Geolocations without Permission (and In Contravention of Their Wishes) Is a Deceptive Trade Practice The FTC has expressly found behavior like Facebook’s to be a deceptive trade practice in violation of Section 5 of the FTC Act. 39. 5 In June 2016, the FTC announced that it had entered into a settlement agreement with a 6 mobile advertising company, InMobi PTE, after the agency charged InMobi with deceptively tracking 7 the locations of hundreds of millions of individuals without their knowledge or consent in order to 8 serve them geo-targeted advertising (i.e., advertisements tailored to an individual based on where they 9 live or places they frequent). 40. 10 In this analogous case, the FTC alleged that InMobi misrepresented that its advertising 11 software would only track consumers’ locations when they opted into being tracked, in a manner 12 consistent with their device’s privacy settings. According to the FTC Complaint, 19 InMobi was actually 13 tracking consumers’ locations regardless of whether the apps using InMobi’s software asked for 14 consumers’ permission to do so and even when consumers denied permission to access their locations. 41. 15 As a result of the FTC enforcement action, InMobi agreed to pay $950,000 in civil 16 penalties and implement a comprehensive privacy program, including a prohibition from collecting 17 individuals’ location information without their affirmative express consent and a requirement that 18 InMobi honor consumers’ location privacy settings. The company was required to delete all user 19 location information that it had collected without user consent and was prohibited from further 20 misrepresenting its privacy practices. The settlement also required InMobi to institute a comprehensive 21 privacy program that will be independently audited ever two years for twenty years from the date of 22 settlement. 23 42. 24 Facebook’s conduct, as alleged in this Complaint, mirrors the location tracking activities condemned and sanctioned by the FTC. 25 26 27 28 “Mobile Advertising Network InMobi Settles FTC Charges It Tracked Hundreds of Millions of Consumers’ Locations Without Permission,” Federal Trade Commission (June 22, 2016) (available at https://www.ftc.gov/news-events/press-releases/2016/06/mobile-advertising-networkinmobi-settles-ftc-charges-it-tracked) (last visited October 15, 2018). -13- 19 CLASS ACTION COMPLAINT Case 3:18-cv-06399-LB Document 1 Filed 10/19/18 Page 14 of 25 CLASS ALLEGATIONS 1 2 43. Pursuant to Federal Rule of Civil Procedure 23, Plaintiff, individually and on behalf of 3 all others similarly situated, brings this lawsuit on behalf of himself and as a class action on behalf of the 4 following Class: All Facebook users in the United States who turned off “Location History” during the applicable limitations period. Excluded from the Class are any entities, including Facebook, and Facebook’s officers, agents, and employees. Also excluded from the Class are counsel for Plaintiff, the judge assigned to this action, and any member of the judge’s immediate family. 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 44. Members of the Class are so numerous that joinder is impracticable. While the exact number of class members is unknown to Plaintiff, it is believed that the Class is comprised of millions of members geographically dispersed throughout the United States. The Class is readily identifiable from information and records in the possession of Facebook and third parties. 45. Common questions of law and fact exist as to all members of the Class. These questions predominate over questions that may affect only individual class members because Facebook has acted on grounds generally applicable to the Class. Such common and legal factual questions include: a. Whether Facebook’s acts and practices complained of amount to the use of an electronic tracking device to determine the location or movement of a person in violation of Cal. Pen. Code § 637.7; b. Whether Facebook’s acts and practices complained of herein amount to egregious breaches of social norms; c. Whether Facebook acted intentionally in violating Plaintiff’s and Class members’ privacy rights; d. Whether Plaintiff and Class members have a legally protected interest in their location data; e. Whether Plaintiff and Class members have a reasonable expectation of privacy in their location data; f. Whether Facebook intentionally intruded on Plaintiff’s and Class members’ solitude, seclusion or private affairs by tracking, logging, and storing their location data without their knowledge or consent; g. Whether Facebook created a condition that was an obstruction to the free use of Plaintiff’s and Class members’ location data so as to interfere with the comfortable enjoyment of that data; -14CLASS ACTION COMPLAINT Case 3:18-cv-06399-LB Document 1 Filed 10/19/18 Page 15 of 25 1 2 3 4 h. Whether Facebook’s act of tracking, logging, and storing Plaintiff’s and the Class’s location information would reasonably annoy or disturb the ordinary person; i. Whether Plaintiff and Class members are entitled to equitable relief, including, but not limited to, injunctive relief, restitution, and disgorgement; and j. Whether Plaintiff and Class members are entitled to actual, statutory, punitive or other forms of damages, and other monetary relief. 5 6 46. Plaintiff’s claims are typical of the members of the Class, as all members of the Class are 7 similarly affected by Facebook’s actionable conduct. Facebook’s conduct, which gave rise to the claims 8 of Plaintiff and members of the Class, is the same for all members of the Class. 9 47. Plaintiff will fairly and adequately protect the interests of the Class because he has no 10 interests antagonistic to, or in conflict with, the Class that Plaintiff seeks to represent. Furthermore, 11 Plaintiff has retained counsel experienced and competent in the prosecution of complex class action 12 litigation, including data privacy litigation. 13 48. Class action treatment is a superior method for the fair and efficient adjudication of this 14 controversy, in that, among other things, such treatment will permit a large number of similarly situated 15 persons or entities to prosecute their common claims in a single forum simultaneously, efficiently, and 16 without the unnecessary duplication of evidence, effort, expense, or the possibility of inconsistent or 17 contradictory judgments that numerous individual actions would engender. The benefits of the class 18 mechanism, including providing injured persons or entities with a method for obtaining redress on 19 claims that might not be practicable to pursue individually, substantially outweigh any difficulties that 20 may arise in the management of this class action. 21 22 23 49. Plaintiff knows of no difficulty to be encountered in the maintenance of this action that would preclude its maintenance as a class action. 50. Facebook has acted or refused to act on grounds generally applicable to the Class, 24 thereby making appropriate final injunctive relief or corresponding declaratory relief with respect to the 25 Class as a whole. 26 51. Plaintiff suffers a substantial risk of repeated injury in the future. Although Plaintiff, like 27 all Class members, wishes to control the circumstances under which his location information can be 28 collected and used by Facebook, Facebook has not only shown deliberate indifference to those wishes, -15CLASS ACTION COMPLAINT Case 3:18-cv-06399-LB Document 1 Filed 10/19/18 Page 16 of 25 1 but has in fact taken pains to deceive Plaintiff (and all Class members) and thwart those wishes. Plaintiff 2 and the Class members are entitled to injunctive and declaratory relief as a result of the conduct 3 complained of herein. Money damages alone could not afford adequate and complete relief, and 4 injunctive relief is necessary to restrain Facebook from continuing to commit its unfair and illegal 5 violations of privacy. 6 CLAIMS FOR RELIEF 7 COUNT I 8 Violation of the California Invasion of Privacy Act 9 (Cal. Pen. Code §§ 630, et seq. ) 10 11 12 52. Plaintiff re-alleges and incorporates each and every allegation set forth above as if fully written herein. 53. Cal. Pen. Code § 630, part of the California Invasion of Privacy Act (the “CIPA”), 13 provides: “The Legislature hereby declares that advances in science and technology have led to the 14 development of new devices and techniques for the purpose of eavesdropping upon private 15 communications and that the invasion of privacy resulting from the continual and increasing use of 16 such devices and techniques has created a serious threat to the free exercise of personal liberties and 17 cannot be tolerated in a free and civilized society.” 18 54. Cal. Pen. Code § 637.7 prohibits the use of “an electronic tracking device to determine 19 the location or movement of a person.” Under section 637.7(d), an “electronic tracking device” means 20 “any device attached . . . to a movable thing that reveals its location or movement by the transmission 21 of electronic signals.” 22 55. Without the consent of Plaintiff or Class members, Facebook continued to record, 23 store, and use the location information of Plaintiff and Class members after they disabled the Location 24 History feature on their mobile phones. 25 56. Facebook used “electronic tracking devices” including applications, software, device 26 components, and other technology on Plaintiff’s and each Class members’ mobile phone (a “movable 27 thing” under section 637.7(d)), and this technology “reveals its location or movement by the 28 transmission of electronic signals.” -16CLASS ACTION COMPLAINT Case 3:18-cv-06399-LB Document 1 Filed 10/19/18 Page 17 of 25 1 57. Facebook’s actions as described herein, engaged in for purposes of acquiring and using 2 the location of mobile phone users and their mobile phones without their consent, violated and 3 continues to violate Cal. Pen. Code § 637.7. 4 5 58. As a result of Facebook’s violations of Cal. Pen. Code § 637.7, and pursuant to Cal. Pen. Code § 637.2, Plaintiff and Class members are entitled to the following relief: 6 a. A declaration that Facebook’s conduct violates the California Invasion of Privacy Act; 7 b. Statutory damages and/or trebled actual damages; 8 9 10 11 12 13 c. Injunctive relief including but not limited to an order enjoining Facebook from tracking, recording, and storing the location Plaintiff and Class members in violation of the CIPA; requiring Facebook to destroy all data created or otherwise obtained from its collection and storage of the location of Plaintiff and Class members and their phones in violation of the CIPA; and requiring Facebook to provide Plaintiff and Class members with prompt notice of what improper location data collection has taken place; d. An award of attorney’s fees and costs of litigation under all applicable law, including but not limited to California’s private attorney general jurisprudence, Cal. Civ. Code § 1021.5, and the CIPA. 14 15 COUNT II 16 Violation of California’s Constitutional Right of Privacy 17 18 19 20 21 22 23 24 25 26 27 59. Plaintiff re-alleges and incorporates each and every allegation set forth above as if fully written herein. 60. Article 1, Section 1 of the California Constitution expressly provides a right to privacy. This right is enforced through the intrusion tort of invasion of privacy. 61. Plaintiff and Class members have reasonable expectations of privacy in their mobile devices and their physical locations. Plaintiff’s and Class members’ private affairs include their behavior on their mobile phones and any other behavior that may be monitored by surreptitious location tracking. This expectation of privacy is particularly strong where, as here, Facebook provided the option to turn Location History off, and Plaintiff and Class members took affirmative action to protect information regarding their location by disabling Location History on their mobile phones. Facebook did not disclose that it was continuing to keep and store detailed location information. 28 -17CLASS ACTION COMPLAINT Case 3:18-cv-06399-LB Document 1 Filed 10/19/18 Page 18 of 25 1 62. Plaintiff’s and Class members’ privacy interest as described herein is legally protected by 2 the law of the State of California because they have an interest in precluding the dissemination or 3 misuse of sensitive information and an interest in making intimate personal decisions and conducting 4 personal activities without observation, intrusion, or interference, including tracking, recording, and 5 storing the locations to which they carry their mobile phones. 6 63. Facebook intentionally intruded on Plaintiff’s and Class Members’ solitude, seclusion, 7 right of privacy, and private affairs by continuing to track, build and store detailed location histories 8 without their knowledge or consent. 9 64. This intrusion is a serious invasion of privacy and is highly offensive to a reasonable 10 person. Various courts, legislatures, regulators, and published articles recognize the importance and 11 sensitivity of location information and the social and privacy harms caused by unauthorized surveillance 12 and location tracking. Facebook’s actions alleged herein are particularly egregious because it 13 surreptitiously, and in an unfair and deceptive manner, continued and continues to track Plaintiff and 14 Class Members after they affirmatively disabled Location History on their mobile phones. This 15 behavior by Facebook was malicious, oppressive, and willful, and calculated to injure Plaintiff and Class 16 members in conscious disregard of their rights. 17 18 19 20 21 22 65. Plaintiff and Class members were harmed by the intrusion into their private affairs as detailed herein. 66. Facebook’s actions described herein were a substantial factor in causing the harm suffered by Plaintiff and Class members. 67. As a result of Facebook’s actions, Plaintiff and Class members seek damages, including compensatory, nominal, and punitive damages, in an amount to be determined at trial. 23 COUNT III 24 Intrusion Upon Seclusion 25 26 27 28 68. Plaintiff re-alleges and incorporates each and every allegation set forth above as if fully written herein. 69. Plaintiff and Class members have reasonable expectations of privacy in their mobile devices and online behavior generally, including their physical locations. This is particularly true where, -18CLASS ACTION COMPLAINT Case 3:18-cv-06399-LB Document 1 Filed 10/19/18 Page 19 of 25 1 as here, Facebook provided users the option to turn Location History off, and Plaintiff and Class 2 members took affirmative action to protect information regarding their location by disabling Location 3 History on their mobile phones. Facebook did not disclose that it was continuing to keep and store 4 detailed location information. 5 70. Plaintiff’s and Class members’ privacy interest as described herein is legally protected by 6 the law of the State of California because they have an interest in precluding the dissemination or 7 misuse of sensitive information and an interest in making intimate personal decisions and conducting 8 personal activities without observation, intrusion, or interference, including tracking, recording, and 9 storing the locations to which they carry their mobile phones. 10 71. Facebook intentionally intruded on Plaintiff’s and Class Members’ solitude, seclusion, 11 and private affairs by continuing to track, build and store detailed location histories without their 12 knowledge or consent. 13 72. This intrusion is highly offensive to a reasonable person. Various courts, legislatures, 14 regulators, and published articles recognize the importance and sensitivity of location information and 15 the social and privacy harms caused by unauthorized surveillance and location tracking. Facebook’s 16 actions alleged herein are particularly egregious because they surreptitiously, and in an unfair and 17 deceptive manner, continue to track Plaintiff and Class Members after they affirmatively disabled 18 Location History on their mobile phones. This behavior by Facebook was malicious, oppressive, and 19 willful, and calculated to injure Plaintiff and Class members in conscious disregard of their rights. 20 21 22 23 24 25 73. Plaintiff and Class members were harmed by the intrusion into their private affairs as detailed herein. 74. Facebook’s actions described herein were a substantial factor in causing the harm suffered by Plaintiff and Class members. 75. As a result of Facebook’s actions, Plaintiff and Class members seek damages, including compensatory, nominal, and punitive damages, in an amount to be determined at trial. 26 27 28 -19CLASS ACTION COMPLAINT Case 3:18-cv-06399-LB Document 1 Filed 10/19/18 Page 20 of 25 1 COUNT IV 2 Violation of the Stored Communications Act 18 U.S.C. §§ 2701, et seq. 3 4 5 6 76. Plaintiff re-alleges and incorporates each and every allegation set forth above as if fully written herein. 77. The federal Stored Communications Act (“SCA”) allows a private right of action against 7 “a person or entity providing an electronic communication service to the public” who “knowingly 8 divulge(s) to any person or entity the contents of a communication while in electronic storage by that 9 service.” 18 U.S.C. § 2702(a)(1); see also 18 U.S.C. § 2707(a). 10 78. Facebook users, unknowingly and in contravention of their privacy settings, transmit 11 their private location information, in the form of data, via the Internet from various devices, including 12 laptop computers and mobile cell phones, to Facebook’s servers. This data constitutes “electronic 13 communication” under the SCA. The SCA incorporates the definition of “electronic communication” 14 set forth in the Electronic Communications Privacy Act, 18 U.S.C. §§ 2510, et seq. (“ECPA”). The 15 ECPA defines an “electronic communication” as “any transfer of signs, signals, writing, images, sounds, 16 data, or intelligence of any nature transmitted in whole or in part by a wire, radio, electromagnetic, 17 photoelectronic or photooptical system that affects interstate or foreign commerce . . . .” 18 U.S.C. § 18 2510(12). 19 79. Facebook is an electronic communication service provider covered by the SCA. An 20 “electronic communication service” is “any service which provides to users thereof the ability to send 21 or receive wire or electronic communications.” 18 U.S.C. § 2510(15). See Ehling v. Monmouth-Ocean Hosp. 22 Serv. Corp., 961 F. Supp. 2d 659, 667 (D.N.J. 2013). 23 80. Facebook saves and archives location data obtained from users on its servers 24 indefinitely, and thus this data is in “electronic storage” for purposes of the SCA, which defines 25 electronic storage as “any storage of such communication by an electronic communication for purposes 26 of backup protection of such communication.” 18 U.S.C. § 2510(17)(B). 27 28 -20CLASS ACTION COMPLAINT Case 3:18-cv-06399-LB Document 1 Filed 10/19/18 Page 21 of 25 81. 1 Facebook allows users to select privacy settings for their Facebook account. Facebook 2 gives users the option to turn “off” location tracking. When users exercise that option, their location 3 data is considered private for purposes of the SCA. 82. 4 Facebook knowingly tracks and collects that private location data without users’ 5 knowledge or consent. Facebook indirectly shares that location data with advertisers by providing 6 advertisers targeted advertising based on user location. 83. 7 Facebook has violated 18 U.S.C. § 2702(a) because it knowingly and without users’ 8 consent collected and disclosed to advertisers users’ private location data while in Facebook’s electronic 9 storage. 10 11 12 84. Facebook had actual knowledge of, and benefitted from, this practice, including by sustaining monetary profits. 85. Because of Facebook’s conduct described herein and its violations of 18 U.S.C. § 2702, 13 Plaintiff and the Class have suffered actual injury in the form of disclosure of their private location data, 14 costs of mitigation for the disclosure, loss of sales value of that private location data, and emotional 15 distress. 16 86. Plaintiff, on behalf of himself and the Class, seeks an order enjoining Facebook’s 17 conduct and is entitled to the greater of actual damages or statutory damages of $1,000 per violation, as 18 well as disgorgement, punitive damages, attorneys’ fees, and costs. 18 U.S.C. § 2707(c). 19 COUNT V 20 Violation of California’s Consumers Legal Remedies Act 21 Cal. Civ. Code §§ 1750, et seq. 22 23 24 87. Plaintiff re-alleges and incorporates each and every allegation set forth above as if fully written herein. 88. The Consumers Legal Remedies Act, Cal. Civ. Code §§ 1750, et seq. (“CLRA”) is a 25 comprehensive statutory scheme that is to be liberally construed to protect consumers against unfair 26 and deceptive business practices in connection with the conduct of businesses providing goods, 27 property or services to consumers primarily for personal, family, or household use. 28 -21CLASS ACTION COMPLAINT Case 3:18-cv-06399-LB Document 1 Filed 10/19/18 Page 22 of 25 1 2 3 89. Facebook is a “person” as defined by Cal. Civ. Code §§ 1761(c) and 1770, and has provided “services” as defined by Cal. Civ. Code §§ 1761(b) and 1770. 90. Plaintiff and Class members are “consumers,” as defined by Cal. Civ. Code §§ 1761(d) 4 and 1770, and have engaged in a “transaction” with Facebook, as defined by Cal. Civ. Code §§ 1761(e) 5 and 1770. 6 91. Facebook’s acts and practices as alleged herein were intended to and did result in the 7 sales of products and services to Plaintiff and Class members in violation of Cal. Civil Code § 1770, 8 including: a. Representing that goods or services have characteristics that they do not have in violation of subsection 1770(a)(5); 9 10 11 12 13 14 15 16 17 18 19 b. Representing that goods or services are of a particular standard, quality, or grade when they were not in violation of subsection 1770(a)(7); c. Advertising goods or services with intent not to sell them as advertised in violation of subsection 1770(a)(9); d. Representing that a transaction conferred or involved rights which it did not involve in violation of subsection 1770(a)(14); and e. Representing that the subject of a transaction has been supplied in accordance with a previous representation when it has not in violation of subsection 1770(a)(16). 92. Facebook’s unfair or deceptive acts and practices were capable of deceiving a substantial portion of the purchasing public. 93. Facebook’s misrepresentations and omissions as alleged herein were material because 20 they were likely to deceive reasonable consumers about Facebook’s practice of surreptitiously tracking 21 and compiling the location of consumers’ mobile phones, even when those consumers affirmatively 22 disabled Location History, an option provided (in fact, touted and emphasized) by Facebook. 23 94. Facebook was under a duty to disclose that it would continue to track Plaintiff’s and 24 Class members’ locations regardless of whether they disabled Location History because: Facebook was 25 in a superior position to know and understand its deployment of its own location-tracking technology 26 and practices; Plaintiff and Class members could reasonably not have been expected to learn or 27 discover that Facebook continued to track their location; and Facebook knew that Plaintiff and Class 28 -22CLASS ACTION COMPLAINT Case 3:18-cv-06399-LB Document 1 Filed 10/19/18 Page 23 of 25 1 members could not reasonably be expected to learn of or discover Facebook’s concealed tracking 2 practices. 3 95. By failing to disclose its surreptitious and unauthorized tracking of Plaintiff’s and Class 4 members’ locations through their mobile phones, Facebook knowingly and intentionally concealed 5 material facts and breached its duty to Plaintiff and Class members. 6 96. Plaintiff and Class members also acted reasonably in relying on Facebook’s 7 misrepresentations regarding its location tracking practices. A reasonable consumer would expect that 8 their location would not be tracked after turning “off” Location Tracking, particularly after Facebook’s 9 many representations to that effect as identified herein. 10 11 12 97. If Plaintiff and Class members had known the truth about Facebook’s location tracking practices, they would not have used Facebook or would have used it on materially different terms. 98. As a direct and proximate result of Facebook’s violations of Cal. Civ. Code § 1770, 13 Plaintiff and Class members have suffered and will continue to suffer injury and ascertainable loss of 14 money or property. 15 99. Plaintiff and Class members seek injunctive relief under the CLRA, including but not 16 limited to, an order enjoining Facebook from tracking, recording, and storing the location of Plaintiff 17 and Class members without their consent; requiring Facebook to destroy all data created or otherwise 18 obtained from its collection and storage of the location of Plaintiff and Class members and their mobile 19 phones; and requiring Facebook to provide Plaintiff and Class members with prompt notice of what 20 improper location data collection has taken place. 21 100. Plaintiff and Class members seek attorney’s fees and costs of litigation under all 22 applicable law, including but not limited to California’s private attorney general jurisprudence, Cal. Civ. 23 Code § 1021.5, and the CLRA. 24 25 101. Plaintiff and Class members reserve the right to give statutory written notice of this claim via certified mail, and to thereafter seek damages via an amended complaint. 26 27 28 -23CLASS ACTION COMPLAINT Case 3:18-cv-06399-LB Document 1 Filed 10/19/18 Page 24 of 25 PRAYER FOR RELIEF 1 2 3 WHEREFORE, Plaintiff, individually and on behalf of the other Class members, respectfully requests that this Court enter a Judgment: 4 (a) Certifying the Class and appointing Plaintiff as Class Representative; 5 (b) Finding that Facebook’s conduct was unlawful as alleged herein; 6 (c) Enjoining Facebook from engaging in further unlawful conduct as alleged herein; 7 (d) Awarding Plaintiff and the Class members nominal, actual, compensatory, consequential, and punitive damages; 8 9 (e) Awarding Plaintiff and the Class members statutory damages and penalties, as allowed by law; 10 11 (f) Awarding Plaintiff and the Class members pre-judgment and post-judgment interest; 12 (g) Awarding Plaintiff and the Class members reasonable attorneys’ fees, costs, and expenses; and 13 14 (h) Granting such other relief as the Court deems just and proper. 15 JURY DEMAND 16 17 Plaintiff demands trial by jury on all counts for which a jury trial is permitted. 18 19 Dated: October 19, 2018 Respectfully submitted, /s/ Sabita Soneji Sabita J. Soneji (SBN 224262) Katherine M. Aizpuru (to be admitted pro hac vice) TYCKO & ZAVAREEI LLP The Tower Building 1970 Broadway, Suite 1070 Oakland, California 94612 Telephone: (510) 254-6808 Facsimile: (202) 973-0950 Email: ssoneji@tzlegal.com kaizpuru@tzlegal.com 20 21 22 23 24 25 26 Norman E. Siegel (to be admitted pro hac vice) Barrett J. Vahle (to be admitted pro hac vice) STUEVE SIEGEL HANSON LLP 27 28 -24- CLASS ACTION COMPLAINT Case 3:18-cv-06399-LB Document 1 Filed 10/19/18 Page 25 of 25 460 Nichols Road, Suite 200 Kansas City, Missouri 64112 Telephone: (816) 714-7100 Facsimile: (816) 714-7101 Email: siegel@stuevesiegel.com vahle@stuevesiegel.com 1 2 3 4 Counsel for Plaintiff 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 -25- CLASS ACTION COMPLAINT