XAVIER BECERRA Attorney General of California NICKLAS A. AKERS (SBN 211222) Senior Assistant Attorney General STACEY D. SCHESSER (SBN 245735) San Francisco County Superior Court Supervising Deputy Attorney General NOV 0 5 2019 LISA B. KIM (SBN 229369) MICAH C.E. (SBN 255239) CLERK OF THE COURT SUSAN SAYLOR (SBN 154592) Deputy mark - MANEESH SHARMA (SBN 280084) ANGELICA SUNGA Deputy Attorneys General 455 Golden Gate Ave. Suite 11000 San Francisco, CA 94102 Telephone: (415) 510-3500 mike.osgood@doj .ca. gov Attorneys for People of the State of California SUPERIOR COURT OF THE STATE OF CALIFORNIA COUNTY OF SAN FRANCISCO EXEMPT FROM FILING FEES PER GOV. CODE 6103 amt? '516 91-6 PEOPLE OF THE STATE OF CALIFORNIA EX REL. XAVIER BECERRA, ATTORNEY GENERAL, Petitioner, v. PETITION TO ENFORCE INVESTIGATIVE SUBPOENA AND FACEBOOK, INC., INVESTIGATIVE Respondent. (GOV. CODE, 11180 et seq.) 1. In 2018, California Attorney General Xavier Becerra launched an investigation into the business practices of Facebook Inc., following widespread reports that Facebook allowed third parties to harvest Facebook users? private information. What initially began as an inquiry into the Cambridge Analytica scandal expanded over time to become an investigation into whether Facebook has violated California law by, among other things, deceiving users and ignoring its own policies in allowing third parties broad access to user data. 1 Pet. to Enf. Subp. Early in the investigation, the Attorney General used his pre-litigation investigatory powers granted by section 11180 61? seq. of the Government Code to issue an investigative subpoena requiring Facebook to produce documents relating to the Cambridge Analytica matter. A year passed before Facebook completed its drawn?out response to the subpoena, during which time the Attorney General also issued a ?rst set of investigative interrogatories. 3. On June 17, 2019, the Attorney General served a second set of interrogatories and a further subpoena to delve deeper into matters disclosed in Facebook?s initial responses and later news reports concerning other claims of wrongdoing by Facebook over users? privacy. Facebook?s responses to this second subpoena and set of interrogatories is patently de?cient. Despite repeated entreaties, Facebook has provided no answers for nineteen interrogatories and produced no new documents in response to six document requests. Facebook has also wholly to search communications involving senior executives for responsive materials. Thus, Facebook is not just continuing to drag its feet in response to the Attorney General?s investigation, it is failing to comply with lawfully issued subpoenas and interrogatories. 4. Accordingly, the People of the State of California, acting through Attorney General Xavier Becerra, petition this Court pursuant to section 11188 of the Government Code to enforce compliance with the Attorney General?s investigative subpoena and interrogatories. This investigation involves serious allegations of unlawful business practices by one of the richest companies in the world, prompting inquiries by Congress, European and US. regulators at? the state and federal level. Indeed, the Federal Trade Commission recently announced a $5 billion settlement after the company violated an existing consent decree. Facebook?s delays and re?isals to comply with the Attorney General?s interrogatories and subpoena should not thwart this important and independent investigation into whether the company violated its users? privacy and California law. THE PARTIES 5. Petitioner Xavier Becerra is the Attorney General of the State of California. He brings this action solely in his official capacity on behalf of the PeOple of the State of California. As the chief law of?cer of the State of California, the Attorney General is responsible for enforcing the 2 Pet. to Enf. Subp. state?s consumer protection laws, among others. In order to carry out these duties effectively, California law gives the Attorney General broad investigative powers. Speci?cally,?Govemment Code sections 11180 et seq. grant the Attorney General, as head of the Department of Justice, the authority to issue subpoenas and promulgate interrogatories. The Attorney General may use these powers for various reasons, including assisting him in considering possible prosecutorial actions, proposing legislation, and formulating enforcement policies with other agencies. These investigative powers are not dependent on the initiation of a civil lawsuit or an administrative proceeding. If a party disobeys a subpoena, the Attorney General may petition the Superior Court for enforcement. 6. Facebook needs no introduction. The Silicon Valley-based social media giant, which has grown to include the Facebook, WhatsApp, and Instagram platforms, is the ?fth largest company in the United States by market capitalization, sixth most pro?table, and boasts nearly 40,000 employees. Most adults with intemet access use Facebook, many of them to share the intimate details of their lives with friends and family. Facebook gathers and maintains personal information of billions of users throughout the world and millions in California. This data gathering occurs both on acebook?s own platforms and through widespread surveillance that Facebook conducts on other websites and online activities. The company then monetizes the data through the provision of highly targeted advertisements to customized audiences on acebook?s products, making the company billions in revenue. JURISDICTION AND VENUE 7. Jurisdiction and venue are proper in the Superior Court of the State of California in the City and County of San Francisco under Government Code section 11186. The Attorney General primarily conducts the investigation into Facebook in the City and County of San Francisco, with some work performed in other parts of the State. BACKGROUND 1. THE FACEBOOK PLATFORM 8. Among other endeavors, Facebookoperates a social media platform that allows individuals and organizations to create personalized online pro?le pages about themselves, ?lled 3 Pet. to Enf. Subp. with biographical details, photos, and a scrollable record of chronological ?posts? about the user. Facebook also lets users connect with other users as ?Friends,? and as relevant here, purports to allow users to restrict access to their information using various privacy settings. 9. In 2007, Facebook launched a developer portal that let third-party software developers create applications that interacted with Facebook users. These ?Facebook apps,? like apps on a mobile phone, were small programs that operated on Facebook?s website or mobile app. acebook apps included popular games or quizzes that allowed a user to post serious or humorous results, such as what ?ctional character a user?s personality resembles. To make them personalized, Facebook granted apps the ability to access data about users from Facebook?s database. For example, a horoscope app might capture a user?s birthdate to provide the horoscope. Facebook made millions of apps available to users, opening the door for millions of apps to collect user data. 10. Facebook also allowed apps to access non-public data?information that users thought they had restricted?about both themselves and their Friends. Some app providers, appear to have exploited this access to collect other user data, build pro?les on users, and sell those to third parties. This includes apps af?liated with Cambridge Analytica, which obtained data on 87 million Americans that was allegedly used to conduct election-related disinformation Campaigns. Questions have arisen as to what Facebook knew about this conduct, Why it failed to prevent app providers from misusing user data, and whether this behavior violated California law. 11. In addition, Facebook told users that the company had safeguards in place to protect their data, and it offered controls that purported to allow users to decide whether and how their data was shared. However, the Cambridge Analytica, scandal, combined with reports that Facebook allowed its business partners to access user data, even when those users had opted out of such sharing, suggests that Facebook may not have honored its obligations to its users, or complied with California?s privacy or consumer protection laws. 11. THE ATTORNEY INVESTIGATION 12. California law grants the Attorney General the authority to investigate reports of unlawful, unfair, deceptive, or otherwise improper business practices, including 4 Pet. to Enf. Subp. 10misrepresentations to consumers, failures to make adequate disclosures in connection with personal information and online services, and violations of individuals? privacy. Using this authority, the Attorney General initiated an investigation and continues to investigate acebook?s compliance with California?s privacy and consumer protection laws, including but not limited to the allegations set forth above. 13. On June 4, 2018, the Attorney General, acting through of?cers of the Department of Justice to whom he had delegated investigative authority under section 11182 of the Government Code, served Facebook with a subpoena for documents based on the allegations involving Facebook and Cambridge Analytica. Facebook accepted service of the subpoena and acknowledged its receipt. Facebook made its last production of documents in response to this ?rst subpoena on April 17, 2019, but the company wrote that it planned to make?additional productions ?on a rolling basis.? On June 5, 2019, a year and a day after the subpoena issued, Facebook?nally admitted that it had actually completed its production of documents. 14. On June 17, 2019, the Attorney General, acting through of?cers of the Department of Justice exercising delegated authority, properly served Facebook with a second set of investigative interrogatories and a second investigative subpoena, requesting additional information and documents. Copies of the investigative interrogatories and subpoena are attached as Exhibit A and and are incorporated into this petition. Facebook was subpoenaed and required to answer interrogatories in the manner prescribed in section 11180 et seq. of the Government Code; The interrogatories and the subpoena, respectively, provided notice of the time and place for answering the interrogatories and for production of the papers. (Gov. Code, 11187, subd. By agreement, Facebook?s attorneys accepted service of the interrogatories and subpoena. 15. The Attorney General?s interrogatories and subpoena were regularly issued, and they relate to the Attorney General?s ongoing investigation into Facebook?s compliance with consumer protection and privacy laws. The investigatory interrogatories seek the following relevant information: The number of California users and rates at which they activated privacy settings to 5 Pet. to Enf. Subp. 2'8 prevent apps from accessing data; 0 The effects of the various privacy settings on third parties? access to data, including which apps Facebook granted access to user data despite users restricting access to their information; 0 Information about Facebook?s enforcement of its policies against developers; 0 An explanation of the technical workings of Facebook?s software that allowed various entities to access user data. The Attorney General?s subpoena seeks the following materials: 0 Communications among executives regarding: 1) any consideration of the need to audit developers? access to user data; 2) third parties granted expanded access to user data; 3) the relationship between ad spending and access to data; 4) significant privacy-related news stories; and 5) the introduction of new privacy features. 0 Documentation regarding the changes to and user testing of Facebook?s privacy settings; 0 Communications regarding a user?s likely response to privacy settings; 0 Documents regarding Facebook?s privacy program, which was mandated by the Federal Trade Commission in 2012 pursuant to a consent decree, yet failed to prevent the Cambridge Analytica scandal. FACEBOOK HAS FAILED T0 ADEQUATELY AND RESPOND. 16. Facebook broadly refuses to answer the interrogatories or comply with the subpoena as required. Facebook will not provide a direct answer to 19 out of 27 interrogatories (Nos. 26- 37, 40-42, 47?50) and has only provided a partial response to 6"(Nos. 24, 25, 43, 44, 45, 46). Facebook has produced no new documents for six document requests (Nos. 19-21 26?28), and appears to have conducted an insuf?cient search for request no. 25. 17. Facebook has also refused to conduct a complete search for responsive documents. Facebook has, for example, refused to search for communications among senior executives regarding terminating developers? access to user data, various privacy-related news stories, and Facebook?s public responses. On information and belief, Facebook has not searched the emails of the company?s Chief Executive and Chief Operating Of?cers for documents responsive to the 6. P?e?t. to Enf. Subp. 10 11 12 13 14 15subpoena. 18. This lack of cooperation, particularly with respect to communications among senior executives, is not unique to the Attorney General?s investigation. A member of the Federal Trade Commission recently wrote to express serious concerns over acebook?s candor with federal regulators: Based on the material presented to me, I was very concerned about Facebook?s . cooperation and candor in its dealings with the Commission and its staff. In my view, there were multiple inconsistencies and de?ciencies in Facebook?s responses to questions. I questioned Whether the company?s document productions were truly complete. I believe that Facebook struggled to answer many requests for data, and ascertained that the company was resistant to providing documents from Zuckerberg?s ?les. (Dissenting Statement of Commissioner Rohit Chopra, In re Facebook, Inc. Federal Trade Commission File No. 1823109, July 24, 2019, at page 6.) Pet. to Enf. Subp. 28- PRAYER FOR RELIEF Pursuant to Government Code sections 11186-11188, the Attorney General prays that this Court: 1. Issue an order directing Respondent to appear before this Court and to Show cause why it has refused to comply with the Subpoena and Interrogatories, and, upon Respondent?s failure to show cause; i 2.. Enter an order directing Respondent to provide full responses to Interrogatories Nos. 26 37, 4O 42, and 47?50; complete its response to Interrogatories Nos. 24, 25, 43, 44, 45, 46; and produce documents for Requests for Production Nos. 19-21 and 25?28; and 3. All other relief to which the people are legally entitled. Dated: November 6, 2019 Respect?ally Submitted, XAVIER BECERRA Attorney General of California NICKLAS A. AKERS Senior Assistant'Attorney General STACEY D. SCHESSER Supervising Deputy Attorney General MICAH C. E. OSGOOD LISA B. KIM SUSAN SAYLOR MANEESH SHARMA Deputy Attorneys General Attorneys for the People of the State of California SF2018400570/14237593.docx Pet. to Enf. Subp. EXHIBIT A Ame-XAVIER BECERRA (SBN 1 18517) Attorney General of California NICKLAS A. AKERs (SBN 211222) Senior Assistant Attorney General STACEY D. SCHESSER (SBN 24573 5) Supervising Deputy Attorney General LISA B. KIM (SBN 229369) SUSAN SAYLOR (SBN 154592) MICAH C.E. OSGOOD (SBN 25523 9) MANEESH SHARMA (SBN 280084) Deputy'Attorneys General 300 South Spring Street, Suite 1702 Los Angeles, CA 90013 Telephone: (213) 269?6369 lisa.kim@doj.ca.gov BEFORE THE DEPARTMENT OF JUSTICE OFFICE OF THE ATTORNEY GENERAL STATE OF CALIFORNIA In the Matter of the Investigation of: FACEBOOK, INC. INVESTIGATIVE SUBPOENA FOR DOCUMENTS GOVTCODE 11180, ET SEQ. NOTICE to Benjamin A. Powell, Esq.: You are hereby served on behalf of Facebook, Inc. pursuant to your agreement to accept service on your client?s behalf. FACEB OOK, INC. INVESTIGATIVE SUBPOENA FOR DOCUMENTS 2.5- 26 27 28 Pursuant to the powers conferred by Article 2 of Chapter 2 of Division 3 of Title 2 of the Government Code of. California (Cal. Gov. Code, 11180 et seq.) on the Attorney General, as head of the California Department of Justice, which powers and authority to conduct the above entitled investigation have been delegated to the undersigned, an officer-of that Department, FACEBOOK, INC. (hereinafter IS HEREBY COMMANDED to produce the documents, books, records, papers and other items (collectively ?Items?i) described in Attachment A to this Investigative Subpoena which are in custody, control, or the custody, possession or control of subsidiaries, af?liates, parents, predecessors, successors, employees, partners, of?cers, agents or representatives, whether or not the present location of any of the Items designated is in California, at the California Department of Justice, Of?ce of the Attorney General, 1300 Street, Sacramento, CA 95814-2919, ATTN: Deputy Attorney General Lisa B. Kim, within thirty days of service hereof. INSTRUCTIONS FOR COMPLIANCE 1. If FACEB OOK claims that an item or a portion of an item is privileged and FACEBOOK withholds it from production for that reason, FACEBOOK must create and submit a privilege 10 which lists: (1) the authors and their capacities; (2) the recipients (including 00?s and bcc?s) and their capacities; (3) other individuals with access to the document and their capacities; (4) the type of document; (5) the subject matter of the document; (6) the purpose(s) for the creation of the document; (7) the date on the document; and (8) a detailed explanation setting forth the factual and legal basis for your claim that the document is privileged or otherwise immune from production. I 1 2. I To the extent responsive items exist in an electronic or computerized format, please contact the of?cer issuing this subpoena to discuss the manner and format in which the, items are to be produced so as to facilitate the production of full and complete copies in a usable? format. In the absence of an agreement regarding the manner and format of production, the following instructions shall apply: FACEBOOK, INC. INVESTIGATIVE SUBPOENA FOR DOCUMENTS oo?mm-hmw The information shall be provided in accordance with the California Attorney General?s Of?ce Production Format as outlined in Attachment below. I . b. The response shall. include all DOCUMENTS and computer programs necessary to the accurate conversion, analysis, and review of the electronic data, including but not limited to operating instructions, manuals and user guides, keys, legends, and codes for systems, programs, ?les, and data ?elds. 3. This Investigative Subpoena has been issued in connection with an investigation within the scope of section 131 of the California Penal Code. 4. No item requested herein shall be destroyed or discarded by FACEBOOK until the Attorney General has made a written determination that the item in question is not necessary for furtherance of this investigation. 5. When producing items, identify by number the request('s) to which the Item is responsive. 6. As used herein, the past tense includes the present and future tenses, the present tense includes the past and future tenses, and the future tense includes the past and present tenses; tenses must be construed in the manner that would include, rather than exclude, information. 7. As 'used herein, the singular includes the plural and the plural includes the singular, .and must be construed in the manner that would include, rather than exclude, information. DEFINITIONS For purposes of this investigative subpoena, the terms set forth below are de?ned as follows: l. OTHERS means the setting used to limit data SHARED through THIRD PARTY APPLICATIONS as set out on page 19 et seq. of the March 15, 2019 letter from Benjamin A. PoWell to Stacey D. Schesser and Lisa B. Kim. I 2. means every disclosure, transfer, exchange, OR transmission of information, Whether oral, written, OR electronic, and whether face-to-face, by telecommunications, telephone, computer, mail, e-mail, text message, instant message, 3 FACEBOOK, INC. INVESTIGATIVE SUBPOENA FOR DOCUMENTS ?122 23 24 2.5 26 27 .287 FACEBOOK Messenger, screenshot, picture, facsimile (fax) machine, OR otherwise, including . any and all attachment(s). 3. means the settings that a user can alter or accept to limit the sharing of USER INFORMATION with third parties, including audience selectors, GRANULAR DATA PERMISSIONS, PLATFORM OPT OUT, APPS OTHERS USE, and-the like. I 4. - means any natural or corporate person that develops an application, software experience, game, or website, that accesses information from APIs or other FACEB 60K software. 5. a ?writing? as defined in section 250 of the California Evidence Code, and includes COMMUNICATIONS, computer files, text messages, instantlmessages, word processing documents, spreadsheets, databases, calendars, and all other forms of ?electronically stored information? as de?ned in section 2016.020 of the California Code of Civil Procedure. I 6. API ACCESS means the entity or entities with whom FACEBOOK partnered with for EXTENDED API 7. API ACCESS means a partnership formed by agreement between FACEBOOK and a DEVELOPER that allowed the DEVELOPER access to certain FACEBOOK APIs on terms speci?ed within the agreement, such as 0002916, and beyond those terms offered to typical THIRD PARTY APPLICATIONS on the FACEBOOK Platform. This de?nition includes agreements performing the same general function, even if not titled as an ?EXtended API Addendum.? I 8. means the social networking online service operated by FACEBOOK, Inc. where USERS access content, including THIRD PARTY APPLICATIONS, websites, and games. For purposes of this subpoena, FACEBOOK PRODUCT means content accessed online at and mobile application, but does not include acquired properties, such as Instagram and WhatsApp. 4 FACEBOOK, INC. INVESTIGATIVE SUBPOENA-FOR DOCUMENTS 4:28' wood-Chm 9. I means a USER who is connected to another USER on the FACEBOOK PRODUCT. 10. DATA refers to the setting used to limit data SHARED with THIRD PARTY APPLICATIONS as set out at page 4 et seq. of the March 15, 2019 letter from Benjamin A. Powell to Stacey D. Schesser and Lisa B. Kim. 11. means the product that FACEBOOK offered that used FACEBOOK USER provide personalized experiences on select partners? websites, as described by FACEBOOK in its December 18, 208 Newsroom post found online at 12. PERSONALIZATION means the entity in entities with whom FACEBOOK partnered for INSTANT PERS ONALIZATION. 13. PERSONALIZATION means the relationship FACEBOOK had with INSTANT PERS ONALIZATION PARTNERS. 14. . means the entity or entities with whom FACEBOOK has an INTEGRATION PARTNERSHIP. I 15. - means the relationship FACEBOOK has with companies that built integrationsfor a variety of devices, operating systems, and other products, as deScribed by FACEBO'OK'inAppendix A of the July 20, 2018 letter Anj an Sahni sent to Stacey D.'Schesser and Lisa B. Kim. 16. OPT means the setting used to disable platform as set out at page 10 et seq. of the March 15, 2019 letter from Benjamin A. Powell to Stacey D. Schesser and Lisa B. Kim.- 17. or mean any formal or informal policy, procedure, rule, guideline, collaborative document, directive, instruction, OR practice, whether written or unwritten, that YOU expect YOUR employees to follow in performing their jobs. 18. means the settings that control what information in a pro?le is SHARED with other USERS through audience selectors, such as phone number, email, current city, birthday, relationship status, work, and education. I 5 FACEBOOK, INC. INVESTIGATIVE SUBPOENA FOR DOCUMENTS means to provide, communicate, transfer, release, disclose, disseminate, sell, rent, trade, OR otherwise make aeoessible cr'available in writing, electronically, or by other means. I 20. PARTY shall have the same meaning as the terms ?Platform and ?app? used in policies produced to, the California Attorney General bearing the Bates Labels FB-AG-O 0000001 through I 21. means the individuals who maintain an account and can generally access the typical FACEBOOK experience via website or mobile application ina personal capacity. 22. means any information related to the FACEEOOK PRODUCT that identi?es, relates to, describes, or is capable of being associated with, a particular individual, including, but not limited to, the following information: name; physical address, including street name and name of a city or town; telephone number; email address;'online contact information, including a screen name, username, or social network pro?le that functions as online contact information; user account credentials; a persistent identi?er such as a user number held in a cookie or a processor serial number; a unique device identi?er or a universally unique identi?er, including geolocation information, including GPS?based location information and network-based or cell-based location information; longitude and latitude data; education; employment; employment history; and any other social media content generated by OR associated with a particular individual; including status updates, likes, OR group af?liations. 23. or or means FACEBOOK, Inc. and its past or present officers, agents, employees, attorneys, predecessors, affiliates, subsidiaries, parent 6 FACEBOOK, INC. INVESTIGATIVE SUBPOENA FOR DOCUMENTS companies, former business names: and dbas, and anyone acting on YOUR behalf 01: at YOUR direction. FAILURE: TO COMPLY WITH THIS SUBPOENA WILL SUBJECT YOU TO THE PROCEEDINGS AND PENALTIES PROVIDED BY Dated: June. 17., 2-019 XAVIER- BECERRA Attomey? General of California NICKLAS A. AKERS Senior Assistant Attorney General STACEY D. Supervising Deputy Attorney General LISA B. KIM SUSAN SAYLOR MICAH MANEESH SHARMA- Deputy Attorneys General LISA B. KIM Depufy A?Ol?ney General ACEBOOK, INC. INVESTIGATIVE SUBPOENA, FOR DOCUMENTS gnaw ATTACHMENT A 18. Records tracking the USER DATA access permissions grantedto DEVELOPERS pursuant to an EXTENDED API ACCESS PARTNERSHIP. 19. All YOUR internal COMMUNICATIONS from 2013 to 2018 re?ecting the contemplation, planning, or performance of a general audit of access to USER INFORMATION, including through THIRD PARTY APPLICATIONS, INTEGRATION PARTNERSHIPS, INSTANT and EXTENDED API ACCESS PARTNERSHIPS. i 20. All COMMUNICATIONS concerning the negotiation of, entrance into, or termination. of, an EXTENDED API ACCESS PARTNERSHIP. 21. All COMMUNICATIONS from 2012 to 2015 regarding conditioning access to USER INFORMATION on advertising spending or other payment. 22. All DOCUMENTS that support YOUR contention that FACEBOOK ?never implemented, let alone seriously considered? (emphasis in the original) ?charging developers for access to user data,? as stated on page 6 of the April 17, 2019 letter from Benjamin A. Powell to Stacey D. Schesser and Lisa B. Kim. I 23. All DOCUMENTS re?ecting the study, testing, or analvsis of understanding of, or reaction to, a DATA CONTROL in effect during 2013 to present, or any proposed change to a DATA CONTROLS during that time frame, including any AJB testing, or studies on user experience or usabilitv of DATA CONTROLS. 24. All COMMUNICATIONS regarding a potential reaction to or understanding of DATA CONTROLS. . i 25. All YOUR internal COMMUNICATIONS, involving a Director, Vice President, or above, about the development of the ?privacy tour,? ?privacy basics,? or ?privacy as those terms were used by in the March 15, 2019 letter from Benjamin A. Powell to Stacey D. Schesser and. Lisa B. Kim. 26. A. All YOUR internal COMMUNICATIONS, involving a Director, ViceP-resident, or above, about the termination of a access to USER INFORMATION. 8. FACEBOOK, INC. INVESTIGATIVE SUBPOENA FOR DOCUMENTS 27. A11 YOUR internal COMMUNICATIONS, involving a Director, Vice President, or above, that occurred within one week of a request for comment regarding, or the publication of, the following news reports: 0 The Guardian 15' reporting on December 11, 2015, that ?Ted Cruz us [ed] firm that harvested data on millions of unwitting Facebook users?; I 0 Various news outlets reporting on March 17, 2018, about Facebock and Cambridge Analytica; . The New York Times reporting on June 3, 2018,that ?Facebook gave device makers deep access to data on users and friends?; - The Wall Street Journal reporting on November 28, 2018, that ?Facebook considered charging for access to user data?; . I The Washington Post reporting on December 5, 2018, that ?Facebook [allegedly] offered advertisers special access to users? data. and activities?; and 'o The New York Times reporting on December 18,. 2018, that ?Facebook gave some of the world?s largest technology companies more intrusive access to users? personal data.? I 28. All YOUR internal COMMUNICATIONS, involving a Director, Vice President, or above, regarding approval of the following Facebook Newsroom items: Why We Disagree with the New York Times, dated June 3, 2018; 0 Response to Six4Three Documents, dated December 5, 2018 0 Let?s Clear Up a Few Things About Facebook?s Partners, dated December 18,8 2018. a acts About Pacebook?s Mess-aging Partnerships, dated December 19, 2018; Cracking on Platform Abuse, dated March 21, 2018; 29. YOUR internal POLICIES on the enforcement of Platform Policy, Data Policy, Terms of Service, or Statement of Rights and Responsibilities, on THIRD PARTY APPLICATIONS, INTEGRATION PARTNERSHIPS, INSTANT PERSONALIZATION PARTNERSHIPS, and EXTENDED API ACCESS PARTNERSHIPS. . 30. a All ?Enforcement Rubric[s]? used by FACEBOOK, as that term is used on page 4 of the April 17, 2019 letter from Benjamin A. Powell to Stacey D. Schesser and Lisa B. Kim. 31. A11 ?cease and desist letters? sent by FACEBOOK to DEVELOPERS, between January 1, 2013, and March 1, 2018, as that term is used on page 12 of the July 20, 2018 letter from Anjan Sahm' to Stacey D. Schesser and Lisa B. Kim. 9 FACEBOOK, INC. INVESTIGATIVE SUBPOENA FOR DOCUMENTS p?l 32. All ?letter agreements? resolving an enforcement concern as that term is used on page 12 of the. July 20, 2018 letter from Anjan Sahni to Stacey D. Schesser and Lisa B. Kim. 33. logs documenting any code changes made to DATA CONTROLS, sometimes referred to as ?Commit Logs.? 34. All ?Privacy Risk and notes or agenda relating to ?focused subject?matter?speci?c meetings,? ?weekly intra- and inter-team meetings,? and - ?Privacy as detailed in ?Facebcck?s Privacy Program Overview?. at page 9 of the . ?Independent Assessor?s Report on Facebook?s Privacy Program? at 35. Alltranscripts of deposition or other testimony by PACEBOOK former and current employees in the litigation titled, Six4Three, LLC v. Facebook, No. CIV 533328), Superior Court of the State of California, county of San Mateo, ?led on April 10, 2015. 36. I discovery responses, excluding documents produced, in the - litigation titled, Six4Three, LLC v. Faceboiok, Inc. (Case No. CIV 533328), Superior Court of the .State of California, County of San Mateo, ?led on April 10, 2015. 37. responses to any formal or informal reducsts for information, interrogatories, or other discovery, excluding documents produced, to the Federal. Trade Commission regarding its investigation into privacy practices, after entry of the Federal Trade Commission?s July 27, 2012 Decision and Order, in its action titled In the Matter of Facebook, Inc. Doc. No. 0923 l-84. . 10 FACEBOOK, INC. INVESTIGATIVE SUBPOENA FOR DOCUMENTS anemones) ATTACHMENT California Attorney General.?s foice PRODUCTION FORMAT I. PRODUCTION on m: STORED- (sen A. Load files. Except where noted in section (K) below, all E51 is- to be Inoduced in electronic format With file suitable for loading into- a Concordance compatible litigation support resienr database. All productions will include both image and: inetadata load ??r-less as ?dESC?b-Etfl in Appendix A: Load File Fomtat. B. Met-adata Fields and Paocessing? Each of the-nietaclata and coding ?elds set forth in Appendix that can be extra cted from a document shall beprodnced for that document. The parties are-not obligated to populate manually any of the ?elds in Appendix if such, fields cannot be extracted??om a document. C. System, Files. Common system and program ?les used not be gn?ocessed, reviewed or produced. The producing party shall keep an inventory of the system ?les not being prochiced and the criteria (85.3.1 non? . human readable file, etc.) for not processing the file's- D. Email. ?monsoon: possible, email shall. he collected the producing party?s entail? store or server MS Exchange, Lotus Notes) because this is the most reliable source from Which'to produce and - maintain email metaclata Metadata and "header ?elds" shall be: extracted :?tom email messages. Email ges,. meeting notices, calendar items, contacts and tasks shall all be extracted from the. email archives. E. Da?Duplication. Removal of duplicate documents shall onle" be done on exact duplicate documents (based on NIB-5 or hash values at the document levelling-ass all custodians (global), and. the Custodian. ?eld will list. each separated 1331a semicolon who was a source of that docm?nent prior to dednplication If a party is mla?hl?e to provide such information within the Custodian ?eld, or if global. dednpli-cation could otlienviselinnt "the. ability to provide that a particular doctnnent was possessed by a custodian, then removal of duplicate documents shall only be done on exact duplicate documents {based on MES or hash values- at? the document: level} within a source (custodian). F. Group IV TIFF images shall he provided using at least 300 33331 print setting. Each image shall. horse a unique file- name. warn. is the Bates number ofthe document Origime document orientation shall he maintained (in, portrait to portrait. and landscape to landscape). will show any and all text and images which would be visible to the reader using the native software that created the document. Documents containing color need not be produced initially,r in color. However, if an original docmnent contains color neceSsa?ry to Wide-astound the meaning or content of. the docmnent, the. producing party will honor reasonable requests her a col-or image of the document. If color images are to be produced, they will be. presided in EEG format G. Embedded Objects. Obj ects. emb edded'in, Microsoft _Word and .RTF documents. which have can embedded with the ?Display as Icon" feature, will be. extracted as separate docmnents and treated like attaclmients to: the. document. Other objects embedded in documents shall be produced as native files. 11 FACEBOOK, INC. INVESTIGATIVE SUBPOBNA FOR DOCUMENTS Compressed ?les. Coingn'ession ?le types (cg, .CAB, .TAR, .3, .ZIP) shallhe deconqnessed a reiterative manner to ensure-that a zip within- a Zip is decompress ed into the lowest possible compression resulting in individual folders and? or ?les. Text Files. For each document, a single text file shall be provided along with the image ?les and inetadatn. The text ?le mole shall he the same as the page Batesr'control number of the ?rst page of. the document. Filenomes shall not have any special characters or embedded. spaces. Electronic text nmst; be extracted directly from the native electronic ?le unless the document was reda cred, an hing-e ?le or a physical file. In. these imtances a text file enacted-using OCR will he produced in lieu of extracted text. See Section 11.0 for OCR requirements. Under no circumstances shall the receiving party he required to rely upon less accurate version of the text than the producing party. For if the producing party has access to extractecl?text ?rom (electronic document files, the. receiving: party shall receive extracted text instead of text generated ?'omnn image ?le. J. Re?ection. If a ?le. flint originates in ESI needs to he redacted before production, the file- will be rendered in, TIFF, and the TIFF will he redacted and giroduced However, to the extent that the text is searchable in the native lemma-t, the 1n?oducing party will provide searchahle text for those poitions of the do-cmne or that. imve not: been redacted. K. Spreadsheets and Presentations. varioustypes of ?les, including but not; limited to MS Excel spreadsheets, MS PowerPoint. prcseiitarions, media. lose signi?cant infornmtion and mowing when-produced as an image. zany native files that are produced shall he produced with a Eatesr-mnnhered TIFF image. slipusheet stating the document has been produced in im'tive fonnat- Any .IlElliVE: files that are produced shall be produced with the :Somce File Path gnoridcd, as well. 'as: all extracted text and applicable 1' - metadata ?elds set? forth in. Appendix. - I Spreadsheets. Excel. spree dsheets shall be produced native document ?le-along with the extracted text: and relevant meta-data identi?ed in Appendix for. the entire spreadsheet, plus a Betcs-mmrberod TIFF image shy-sheet stating the document has been produced in imtisre fornnit; I Presentations. Pourerpoint presentations slrall'be produced as a motive docmnent ?le along with the extracted text and relevant ?inetndata identified in Appendix for the entire presentation, plus a Bates-numberedTIEF hung-e slip?sheet. stating the do-cmnent has been produced in. imtive forum. L. Other E31 that is: Impractlcal to Pro dune in Traditional Furl-mater The parties understand. and acknowledge that. certain categories of ESI are structurally complex and do not lend them: elves to production as 1Hiif?l'6' format or other Harlin-01ml formats. To the extent response to discovery requires production of discoverable electronic information contained in adatahase, the producing part-3? shall consider methods of prorhiction host providing all relevant information including but not limited to duplication of. databases or limited access for-the purpose of generating regaorts. Parties should coin-ides whether all relevanrinformarion maybe: provided by quewmg the database ?irt discm'erahle infornmtion and generating a. report in a reasonably usable and exportahle electronic file Excel, CSV or SQL format). The parties- agree- to confer to obtain an appropriate resolution so such requests. 12 FACEBOOK, INC. INVESTIGATIVE SUBPOENA FOR DOCUMENTS 'Endorsements. The producing party will brand, all TIFF images in the lower right?hand comer with . its corresponding bates numb er, using a consistent font type and size. The bat-es numb er must not obs-cure any part of the wider-lying date. The producmg 'IJertywi'H brand all TIFF images inthe lower corner with all .confidentielitjgr designations, as needed, in accordance with cou?dentialibr de?nitions agreed "to by the parties- N. Exception Report. The producing pelty shall compile an exception report enumerating any unprocessed or Linproc-essable documents, their ?le type and the ?le location. - O. Clewbeck procedure. Any document's recalled due to mutuallynegreed up on clawbeck provision shall 1121\78?3' specific protocol followed to ensure all copies of each'euch docmnentere appropriately? removed from the review database, backup and disaster. recovery system nmintained by the opposing party. 13 FACEBOOK, INC. INVESTIGATIVE SUBPOENA FOR DOCUMENTS II. PRODUCTION OF PHYSICALLY STORED INFORMATION (HARD COPY DOCUMENTS) 113) 2 A. TIFFs. Hard copy paper documents shall be as single-pa gc, Group IV compression TIFF 3 imn gas 113ng pn'nt setting of at least 300 dots per inch (DPD. Each image shall have a unique .file name, which is the Bates number 05111:: document. Original document be maintained 4 pomnit to portmit and landscape to landscape). 13. Marat] atn Flelids. The followin infomtation shall hard on documents and n'ovitlcd I . 5 in the data load file at the same time-that the TIFF images and the Optical Character Recognition (OCR) 6 acqun?ctl text ?les one produced. Each. metatlata?cid shall be la?bc?lcd as listed below; I ,r L?E?any fir? I. .d?Iv 7 73% .- (NTD CID ABCOO 001 The Docun .ed witl page 8 (Unique ID Pm'e?f' parent document (this field will only be populated in child 9 Child Relationships) records), . '1 0 GROUPID The Document ID number associated with. the ?rst page oftlne (Unique ID Parent" parent document (in most cases, this will be (into in the 1 1 Child Relationships) ?eld; I - 12 BE GBATES (Unique The Document ID number associated with the ?rst pa go ofa document. 13 momma .ABC0000003 (Unique ID) The Docun'icnt ID number associated with the last page of a document. - (Unique The Document ID numbo' associated with the: ?rst" page of the parent 15 ID Parent-Child document (if applicable). (Unique The-'Documcnt'lD number associated with the last pa gc ofthc last 1 7 ID attachment (if applicable). Relationships) 18 PGCOUNT 3 (Numeric) . The number ofpagcs for a document. 19 VOLUME VOLOOI The name of CD, DVD or Hard Drive (vendor assigns). 20 CUSTODIAN The custodiuu f-nmu'ce of 1] document. Note: If the docmuenls 11H: tic-duped on a global level, this ?eld will contain the name of cock custodian. from which the. document. originatcd. 14 FACEBOOK, INC. INVESTIGATIVE SUBPOENA FOR DOCUMENTS ~Acqt?red Text Files. 1When. subjecting physical {laminate to an OCR proceas, 1.1m settingsthe OCR 51m11111mxmuza'text quahty oven: process speacl. Any settings such. as ?'autoarota?on? and the. like should. be tuned 011 when (10511111311125.1116 mu thmugh the process. D, Database Least} Documents 311211113135 pwvided with 21? delimitati matadaT-a ?le 01' .txf) and (11) an 11m 33 10nd file as dem?ecl 111 Appendix A. Unitizing 11f 'Du cmnents. In scam?ngpaper clocunmms, distinct 3111111 110?s 153 mergedinto a single record, and single dccumenfs 511::11 not 1365th mm nml?pie record-s- ipazpea dommamts Should be logically amazed), 111-3 case cf an organized. c0111p1121tio11 far example, a binder contahmg 3611317511 separate documents 13611111121 nm?bm'e? tabs the behind each tab should be Scanned saparatehr, but the nieL'ttiomi?p among the domu?ents 1111113 131111131? 5110111411136 re?eizted, in prop ea: coding" 017-1116: baginning a11c1ending (106111116111: and attachment fiEIds.? The- pzmties wi? make their ?best efforts to m?fize do [211111311123 correctly. 15 . INVESTIGATIVE SUBPOENA FOR DOCUMENTS . FACEBOOK, INC. APPENDIX A: REQUESTED LOAD FILE FORNIAT FOR- E31 1. Image File Format: All images, paper documents scanned to images or rendered ESL shall be produced as 300 dpi single?page CCITT Group 1V TIFF images (for black/white] or JPG images (for color), Documents uniquely and sequentially Bates inunberecl with an endorsement bumed into each image. All TIFFIJPG image ?le names shall inelude the unique Bates number burned into the image. i a Each Bates number shall be a Standard. length, melude leading zeros in the number and be unique for each produced-pa ge. 0- All TIFFIJPG- image ?les shall be named with .a ?.fif? or ?.j13g"" extension. n- Images should be able to be using standard COTS products, such as LexisNex?is LAW PreDis eovery, Ipro, etc. Concordance Image Cross?Re?nance ?le: Images shall be: accompanied by a. Concordance Inrage Cross-Reference file that associates each Bates runnber wi??l'l its correspondmg single-page image ?le. The Cross?Reference ?le should also contain the 'nnage ?le path for each. Bafes numbered. page. 0 Image Cross-Reference ample Format: AB C00000 1 OLS :lDat?ab aseNameUmage?lOG1\ABCO 0001 AB atabaseNamelImage?xOO 00022 .TIF, AB (25000003 alabaseName?iImagelOD AB . 3. Concordance Lea-d File: Images shall also be accompanied by a. ?text load file? containing: delimited text (DAT ?le) that Will populate ?elds in a seal-eligible, flat database enviromnent. The delimiters for the load file should be Concordance defar?ts. 0 0011111121: 13' ASCII character (020) Quote: ASCII character (2.54) I Newline: ASCII character (174} 16 FACEBOOK, INC. INVESTIGATIVE SUBPOENA FOR DOCUMENTS APPEMLK B: REQUESTED NIETADATA FIELDS ?11 p, 3'PARENTDOCD) ABCU 000001 The Document ID ?ounder associated wi 11 (Unique ID Parent-Child. the ?rst: page of a parent document (this field will 93.11;; be populated in child records). 7 GROUPID 000001 The Document ID 1111111115]: associated with. (Unique ID Parent-?Child the first page of the parent documontiin Relationships) most cases, this. will he data in. the . BEGATTACH ?eld). BE-GBATES ABCDOD 0001 (Unique ID) The Document ID number associated with the. ?rst page of a. documout. ABCGOU 0603 (Unique ID) The Document ID number associated with the lost: page-of a document. - BEGATTACH 0001 (Unique ID Parent- The? Document ID number associated with the . Child Relationships) ?rst page of the purwt documcnt. 4NDATTACH {Unique ID Parent:- ID number associated with the lg - Child Relationships} last. page of the last. attachment. 3 CNumcric) The number of pages fora docnm?g VOLUME VDLUOI The name of?CD, DVD or Hard Drive (vendor I assigns}. - SENTDAT The date the otnail was sent. For . attachments to ?ca-mails, this ?eld. should be populated with the data sent of the. email transmitting the SENTTIME The time the email was sent. CREATEDIXTE The date the document was created. CREATETIME The time the document was created. Tho datc the document was .iasm'modi?cd. HHMNESS The time the document was last modified The date the document was received. The time the document was rec civcd. i.c. Joe Smitth-maila?hlbox Location of the original document. The sourcc Joe Sn?t?i?i-mailiD :16th Items. should be tho. start of the full path. Joe Simti?ooso - Joe SniitlnlooseLFilesiDoccmieins and Settingsi .. APPLICATION MS Word, MS Execl, etc. Type ofdocumcnt by application. HIDDENTYPE Options: Track Changes, Hidden The type of?hiddon modi?cation. of the Very Hidden documcnt g. Track: Changes, Hidden. Spreadsheot, Etc. Sol-on dchoet, Very-Hidden. Spreadshcot. out) AUTHOR jsmi'lh The an?mr of :1 document from colored - metodato. 17 FACEBOOK, INC. . INVESTIGATIVE SUBPOENA FOR DOCUMENTS 'FROM .. ?1 5. 47.21;. 34,25?er "la :3 7-15., . 7455*; at ier' cg.? ., ?l?eesnn? in i .esg'emtm Joe Smith The rclisplag,r name a 1d e-mail of the- author of" an e?nm?il. If only email is given, tilcnjust list'fhe csmail address. An should always be provided for every document. TD Joe Smith The display name and e-mail of the recipien?s) of an email. If only,r email. is given, then just list the e?ma'il Au mail address should always be provided for may document. CC Joe Smith 'tj'onesfgeumil. com. The name and en'uinii of the ofnn e-nmil. If only email is given, then just list the e?mail addresu. A11 e?umiladdzress should always be provided. for every document. BCC 'Joe Smith The display name and e-mnil of the blind eopyee(s) of no e?mnil. If onlj,r e-mail is given, thenjusl: ?st the e?mni?l address. An e- mail address should always be provided for every document. neonmcn Re: Scheduling Meet and Confer The email subject line. OCTITLE The extracted document title or subject of a. document. CUSTODIAN The custodian} source of a decument. Nola: IfIhc documents are deadupcd on a global. level, this ?eld will contain the name of en c1: custodian ??om which the document orignm'ted. ATTACH COUNT Numeric. The number of attachments to a domunent. mun-EXT XLS The file extension of a document. ELENAME Document Namexls. The ?le name of documelu. innsu The nms. or SEA-I Hush value. NATIVELINK The full path to a native copy of a document. FULLTE-XT The path to the. full exn'acted text of the document. There should be a folder. 0111111: deliverable, conminiog a. separate Unicode text ?le yet do cluncnt. These text files should be named with their hates number-s. Note: E- mails should include hench .nneimution: author, recipient, cc, bcc, dale, subject, etc. If the or c??le does not any text". 111131100wa the do eminent should be wrided. 18 FACEBOOK, INC. INVESTIGATIVE SUBPOENA FOR DOCUNHENTS DECLARATION OF SERVICE BY EMAIL Matter Name: In the Matter of the Investigation of: FACEBOOK, INC. I declare: Lam employed in the Of?ce of the Attorney General, which is the of?ce of a member of the California State Bar, at which member?s direction this service is made. I am 18 years of age or older and not a party to this matter; my business address is 300 South Spring Street, Suite 1702, Los Angeles, CA 90013. - On June 17 2019, I served the attached INVESTIGATIVE SUBPOENA FOR DOCUMENTS by placing a true copy thereof enclosed in a sealed envelope with postage thereon . fully prepaid, in the United States Mail at Los Angeles, California, addressed as follows: Benjamin A. Powell Maury Riggan WilmerI-Iale 1875 Ayenue NW Washington, DC 20006 Maury.Riggan@wilmerhale.com I declare under penalty of perjury under the laws of the State of California the foregoing is true and correct and that this declaration was executed on June 17, 2019, at Los Angeles, CalifOrnia. Carol Chow WW Declarant Signatuire/ . SF2015400570 5350463 9.docx Exhibit (XAVIER BECERRA (SBN 1 18517) Attorney General of California NICKLAS A. AKERS (SBN 211222) Senior Assistant Attorney General STACEY D. SCHESSER (SBN 24573 5) Supervising Deputy Attorney General LISA B. KIM (SBN 229369) SUSAN SAYLOR (SBN 154592) MICAH OE. OSGOOD (SBN 25 5239) MANEESH SHARMA (SBN 280084) Deputy Attorneys General 300 South Spring Street, Suite 1702 Los Angeles, CA 90013 - Telephone: (213) 269-6369 Lisa.Kim@doj .ca. gov BEFORE THE DEPARTMENT OF JUSTICE OFFICE OF THE ATTORNEY GENERAL STATE OF CALIFORNIA In the Matter of the Investigation of FACEBOOK, INC. INVESTIGATIVE INTERROGATORIES GOV. CODE 11180 ET SEQ. To Benjamin A. Powell, Esq.: You are hereby served on behalf of Facebook, Incj pursuant to your?agreement to accept service on your client?s behalf. FACEB 00K, INC. 1 INVESTIGATIVE INTERROGATORIES oo'xioxm-Pursuant to the powers conferred by Article 2 of Chapter 2 of Division 3 of Title 2 of the' Government Code of California (Cal. Gov. Code, 11180 et seq.) on the Attorney General, as head of the California Department of Justice, which powers and authority to conduct the above entitled investigation have been delegated to the undersigned, an of?cer of that Department, FACEBOOK, INC. IS HEREBY COMMANDED to answer separately and fully in writing, under oath, within thirty days of service hereof, each of the following interrogatories. INSTRUCTIONS FOR COMPLIANCE l. The RELEVANT PERIOD for these investigatory interrogatories is January 1, 2013 through December 31, 2018, unless otherwise expressly stated herein. 2. Each answer must be as completeand straightforward as the information reasonably available to Facebook, Inc. (hereafter including the information . possessed by attorneys or agents, permits. If an interrogatory cannot be answered completely,answer it to the extent possible, specifying the reasons for inability to answer the remainder of the interrogatory and stating whatever information, knowledge, ?or belief that FACEBOOK has concerning the unanswered portion thereof. 3. As used herein, the past tense includesthe present and future tenses, the present tense includes the past and future tenses, and the future tense includes the past and present tense-s; tenses must be construed in the manner that would include, rather than exclude, information. . 4. As used herein, the singular includes the plural and the plural includes the singular, and must be construed in the manner that would include, rather than exclude, information. 5. If FACEBOOK is asserting a privilege or making an objection to an interrogatory, FACEBOOK must speci?cally assert the privilege or state the objection in written response, and set forth in detail the basis for objection or assertion of the privilege. If an objection pertains .to only a portion of an interrogatory, or a word, phrase, or I clause contained in it, ACEBOOK must respond to the remainder of the Interrogatory.- . 2 FACEBOOK, INVESTIGATIVE INTERROGATORIES These Investigative Interrogatories have been issued in connection with an investigation within the scope of section 13 1 pot the California Penal Code. 7. written responses shall be delivered to the'California Department of Justice, Of?ce of the Attorney General, 1300 Street, Sacramento, CA 958142919, ATTN: DEFINITIONS Deputy Attorney General Lisa B. Kim. For purposes of this set of investigatory interrogatories, the terms set forth below'are de?ned as follows: . 8.. has the same meaning used at and?sdks/ and liked webpages,? and the similar software thatexisted in the past. 9. - OTHERS means the settings used to limit data accessible to THIRD PARTY APPLICATIONS that FMENDS installed, as set out on page 19 et seq. of the March 15, 2019 letter from Benjamin A. Powell to Stacey D. Schesser and Lisa B. Kim. 10. SELECTOR means the setting used to set the audience for ?status updates, photos and other thingsyou share,? as explained at 11. means the settings that USER can use to govern the sharing of USER INFORMATION with third parties, including AUDIENCE SELECTOR TOOLS, GRANULAR DATA PERMISSIONS, PLATFORM APPS OTHERS USE, and the like. I 12. means all of the POLICIES that FACEBOOK expected DEVELOPERS to abide by, including Statement of Rights and Responsibilities, Terms of Service, Date Use Policy, Platform Policy, and /or Data Policy. 13. means any natural or corporate person that develops an application, game, or website, that accesses information from APIs or other software. I 14. API ACCESS means a partnership formed by agreement between FACEBOOK and a DEVELOPER that allowed access to certain 3 FACEBOOK, INC. INVESTIGATIVE INTERROGATORIES g?ga??wHoomqmmamNp??o FACEBOOK, INC. FACEBOOK APIs on terms speci?ed within the agreement, such as A and beyond those terms offered to typical THIRD PARTY APPLICATIONS on the FACEBOOK . Platform. This de?nition includes agreements performing the same general function, even if not titled as an ?Extended Addendum.? 15. API ACCESS means the entity or entities with whom FACEBOOK has an EXTENDED API ACCESS PARTNERSHIP. 16. means the social networking online service operated by ACEBOOK, Inc. where USERS access content, including through THIRD PARTY APPLICATIONS, websites, and games. For purposes of these interrogatories, FACEBOOK PRODUCT means content accessed online at and mobile application, but does not include acquired properties, such as Instagram and WhatsAp'p. 17, means a USER who is connected to another USER on the FACEBOOK PRODUCT. I i A 18. DATA refers to the setting used to limit data shared with THIRD PARTY APPLICATIONS as set out at page 4 er seq. of the March 15, 2019 letter from Benjamin A. Powell to Stacey D. Schesser and Lisa B. Kim. 19. means the product that FACEBOOK offered that used FACEBOOK USER INFORMATION to provide tailored and integrated USER A experiences on select partiiers? websites, as described by FACEBOOK in its December 18, 2018 Newsroom post found online at 20. PERSONALIZATION means the entity or entities I with Whom FACEBO OK partnered for INSTANT PERSONALIZATION. 21. PERS ONALIZATION means the relationship FACEBOOK had with INSTANT PERSONALIZATION PARTNERS. 22L means the entity or entities with whom FACEBOOK has as INTEGRATION PARTNERSHIP. 23. I 'means the relationship FACEBOOK has with companies that built integrations for a variety of devices, operating systems, and other . . 4 INVESTIGATIVE INTERROGATORIES LUJN products, as described by FACEBOOK in Appendix A of the July 20, 2018 letter Aiijan Sahni sent to Stacey D. Schesser and Lisa B. Kim. 1 24. means the setting used to disable the FACEBOOK platform as set out at page 10 et seq. of the March 15, 2019 letter from Benjamin A. Powell to Stacey D. Schesser and Lisa B. Kim. 7 I 25. or mean any formal or informal policy, procedure, rule, guideline, collaborative document, directive, instruction, OR practice, whether written or unwritten, that YOU expect YOUR employees to follow in performing their jobs. 26. means the settings that control what information in a pro?le is shared with other USERS through AUDIENCE SELECTOR TOOLS, such as i phone number, email, current city, birthday, relationship status, work, and education. 27. or or or means to provide, communicate, transfer, release, disclose, disseminate, sell, rent, trade, OR otherwise make accessible or available in writing, electronically, or by other means. 28. PARTY shall have the same meaning as the terms ?Platform and ?app? used in policies produced to the California Attorney General bearing the Bates Labels through 29. means the individuals who maintain an account and can generally access the typical FACEBOOK experience via website or mobile application in a personal capacity. 30. - means any information related to the FACEBOOK PRODUCT that identi?es, relates to, describes, or is capable of being associated with, a particular individual, including, but not limited to, the following information: name; physical address, including street name and name of a city or town; telephone number; emailaddress; online contact information, including a screen name, username, or social network pro?le that functions as online contact information; user account credentials; a persistent identifier such as a user number held in a cookie or a processor serial number; a unique device identifier or a universally 5. . FACEBOOK, INC. INVESTIGATIVE INTERROGATORIES unique identi?er, including PB geolocation in'fOrmation, including OPS-based location information and network?based or cell~based location information; longitude and latitude data; education; employment; employment history; and any other social media content generated by OR associated with a particular individual, including statusiupdates, likes, OR group af?liations. 31. or or means FACEBOOK, Inc. and its past or present Of?cers, agents, employees, attorneys, predecessors, af?liates, subsidiaries, parent companies, former business names, and dbas, and anyone acting on YOUR behalf or at YOUR direction. - INT ERRO GATORIES . INTERRO GATORY NO. 24 Provide, for each year. during the RELEVANT PERIOD, the number of FACEBOOK USERS that indicated that they currently resided in California.- . I .1 NO. 25 Provide, for each year during the RELEVANT PERIOD, the default settings for each of the following DATA CONTROLS: i AUDIENCE SELECTOR TOOL for status updates ?Who can see your futme posts??); AUDIENCE SELECTOR TOOL for birthday; (0) AUDIENCE SELECTOR TOOL for friends-list; AUDIENCE SELECTOR for email; AUDIENCE SELECTOR TOOL for who could search for and ?nd a person?s pro?le by contact information; I I GRANULAR DATA PLATFORM OPT and, APPS OTHERS USE. 6 FACBBOOK, INC. INVESTIGATIVE INTERROGATORIES INTERROGATORY NO. 26 Provide, for each year during the RELEVANT PERIOD, the number of FACEBOOK USERS in California, expreSsed as a total number and percent of total USERS (or in the United States, if California data is' not available), who changed their default settings for each of the following DATA CONTROLS: AUDIENCE SELECTOR TOOL for status updates ?Who can see your future. posts??); AUDIENCE SELECTOR TOOL for Birthday; (0) AUDIENCE SELECTOR TOOL for Friends List; AUDIENCE SELECTOR TOOL for email; AUDIENCE SELECTOR TOOL for iwho could look?up a person?s pro?le by contact information; i I I i GRANULAR DATA PLATFORM OPT and, I APPS OTHERS USE. INTERROGATORY No. 27 If a USER set their PROFILE CONTROLS to ?Friends,? ?Friends of Friends,? or ?Only What, if any, non?public USER INFORMATION the following entities could access during the RELEVANT PERIOD: A THIRD PARTY An experience provided by an INTEGRATION . A Website using information under an INSTANT PERSONALIZATION . An application subject to an EXTENDED API ACCESS and, Any third party entity not cOvered in the responses to subparts through 7 FACEBOOK, INC. INVESTIGATIVE INTERROGATORIES 42.INTERROGATORY NO, 28 If a USER disabled platform for THIRD PARTY APPLICATIONS by using the PLATFORM setting, explain what, if any, non?public USER INFORMATION the following entities could access during the RELEVANT PERIOD: A THIRD PARTY A An experience provided by an INTEGRATION A Website using information under an INSTANT PERSONALIZATION An application subject to an EXTENDED API ACCESS and, Any third party not covered in the responses to subparts through I INTERRO GATORY No. 29 I 1 If a USER sets their APPS OTHERS USE settings-to minimize or eliminate data being Ishared about a USER through FRIENDS, explain what, if any, non?public USER following entities could access about a USER through FRIENDS that had, installed the entity?s relevant app, website, game, or experience during the RELEVANT PERIOD: 1 A THIRD PARTY An experience provided by an INTEGRATION A website using information under an INSTANT PERS ONALIZATION . An application subject to an EXTENDED API ACCESS and, Any third party not covered in the responses to subparts through INTERROGATORY NO. 3 0 If a USER implemented DATA CONTROLS to minimize the USER INFORMATION that is SHARED with others, including setting all PROFILE CONTROLS to ?Friends,? disabling Platform through the PLATFORM OPT-OUT, and restricting all data sharing under the APPS OTHERS USE, describe what USER INFORMATION each of the following could adcess during the RELEVANT PERIOD: - 8 FACEBOOK, INC. INVESTIGATIVE INTERROGATORIES THIRD PARTY I An experience provided by an INTEGRATION A website using information under an INSTANT PERS ONALIZATION . An application subject to an EXTENDED API ACCESS and, Any third party not covered in the responses to subparts through INTERROGATORY NO. 3.1 I Provide the following information about any DEVELOPERS that could access non?public USER INFORMATION through the FRIEND, despite the USER engaging the APPS OTHERS USE contrOl: Identity of the third party; What USER INFORMATION it could access; (0) Whether the third party could access data through FRIENDS Of When the access began and ended; I I The reasOns FACEBOOK allowed acceSS to USER and, What disclosures provided hotice to USERS that their data could be shared in this way. INTERROGATORY NO. 32 Describe the process by which FACEBOOK reviewed, developed, and approved changes to DATA CONTROLS during the RELEVANT PERIOD. INTERROGATORY NO. 3 3 Identify, by name and team assignment; all the individuals at FACEBOOK who developed and approved changes to Facebook?s DATA CONTROLS during the RELEVANT PERIOD. INTERROGATORY NO. 34 Describe the review; evaluation, and testing of any new or modified DATA CONTROL during the RELEVANT PERIOD, including how FACEBOOK tested or evaluated a 9 FACEB 00K, INC. INVESTIGATIVE INTERROGATORIES - response or understanding of a new or modified DATA CONTROL through usability or . testing. INTERROGATORY NO. 35 Describe the ?coding rules? that ?automatically identify and review apps that engage in acts that signal potentially abusive behavior? identi?ed on page 11 of the July 20, 2018 letter from Anj an Sahni to Stacey D. Schesser and Lisa B. Kim. INTERRO GATORY NO. 3 6 State the number of times that the ?coding rules? identi?ed on page 11 of the July 20, 2018 letter from Anj an Sahni to Stacey D. Schesser and Lisa Kim, detected a potential abuse of DEVELOPER POLICIES during the RELEVANT PERIOD, broken down by year and for each instance explain who the DEVELOPER was and what coding rule was implicated. INTERROGATORY NO. 37 For each! year during the RELEVANT PERIOD, state the number of times that FACEBOOK received a report of a potential violation of its DEVELOPER POLICIES by a DEVELOPER from each of the following sources: ACEB OOK employees; the press; and security or white?hat researchers. - I INTERROGATORV-NO. 3 8 I Explain the term ?shielded app,? as that term is used in the document bearing the Bates label 7551. INTERROGATORY NO. 39 . Describe the manner in which YOU enforced DEVELOPER POLICIES on DEVELOPERS ?of ?shielded apps,? as that term is used in the document bearing the Bates label 00037551. Please identify any differences in the manner in which YOU enforced DEVELOPER I - POLICIES, Or any other applicable POLICIES, against ?shielded apps? as compared to other THIRD PARTY APPLICATIONS. 10 FACEBOOK, INC. INVESTIGATIVE INTERROGATORIES NOLA-libs 10 11 12 l3_INTERRO GATORY NO. 40 For each year during the RELEVANT PERIOD, specify how many enforcement actions YOU undertook in each? of the following categories identified in the enforcement rubric set forth in the document bearing the Bates label FB-CA-CAAG-00019954: Surface or escalate to point of contact; Warning (of any length); (0) Moratorium; Removal from approVed advertiser list; Disable credits; Disable; and, Escalate to Legal for a cease and desist letter. INTERROGATORY No. 41 Identify all instances when FACEBOOK deviated its response from the ?recommended action? for each perceived violation of DEVELOPER POLICIES, as set forth in the document bearing the Bates label For each instance, state the action taken, and the reason why .FACEBOOK deviated its response. INTERRO GATORY NO. 42 I Describe what 'steps FACEBOOK took, if any, to ensure that applications created pursuant to an INTEGRATED PARTNERSHIP or an EXTENDED API ACCESS PARTNERSHIP did not access or use data for any purpose other than what was authorized by agreements with the partner. INTERROGATORY NO. 43 For each year during 20l3 to 2017, state how many times FACEBOOK has suspended or disabled access to USER INFORMATION by THIRD PARTY APPLICATIONS, or their DEVELOPERS, for violation of the following DEVELOPER POLICIES requirements: I Developers shall only request the data needed to operate their appliCatton; only use the data received from Facebookfor their application; obtain explicit consent 11 FACEBOOK, INC. INVESTIGATIVE INTERROGATORIES 10from the user who provided the data to Facebook before using it for any purpose other than diSplaying it back to the user; . - Developers shall not; transfer any data that they receive ??om Facebook; sell user data; use Facehook user IDs for any purpose outside of their applications; use a user ?s?'iend list outside of their application; access a user ?s?iend list when a ?iend connects with that app; if a friend grants specific permission, use that content and information other than in connection with that friend. INTERROGATORY No. 44 i I I Has FACEBOOK ever suspended or disabled access to USER INFORMATION by an INTEGRATED PARTNER, EXTENDED API ACCESS PARTNER, or INSTANT PERS ONALIZATION PARTNER because the DEVELOPER appeared to have violated either 1 DEVELOPER POLICIES regarding USER INFORMATION or the parties? agreement regarding USER If so, please identify the DEVELOPER, the details of the suspected violation, and how FACEBOOK learned of'the suspected violation. INTERROGATORY NO. 45 Excluding l) USERS, 2) INTEGRATED INSTANT PERSONALIZATION PARTNERS, and 4) THIRD PARTY APPLICATION DEVELOPERS operating under FACEBO 8 DEVELOPER POLICIES, identify any other persons or entities to Whom FACEBOOK granted access to USER INFORMATION, by: I - The name of the third party; 1 The USER INFORMATION available to the third party; (0) The reason the third party was granted access; and, The dates that access began and ended. INTERRO GATORY NO. 46 Describe the different FACEBOOK APIs that DEVELOPERS could use to access USER INFORMATION during the RELEVANT PERIOD. I 12 FACEBOOK, INC. INVESTIGATIVE INTERROGATORIES 28' INTERRO GATORY NO. 47 Identify the APIs that each of the following entities could use to access USER INFORMATION during the RELEVANT PERIOD: DEVELOPER of a THIRD PARTY An INTEGRATION An INSTANT PERSONALIZAT-ION and, An EXTENDED API ACCESS PARTNER. INTERROGATORY NO. 448 Did FACEBOOK ever factor a DEV advertising purchase history or amount spent into the decision to enter into, continue, or terminate an EXTENDEDAPI ACCESS If so, please describe'the. circumstances. INTERROGATORY NO. 49 Did FACEBOOK ever factor a advertising purchase history or amount spent into the decisions asto what capabilities or access to USER INFORMATION to grant pursuant to an EXTENDED API ACCESS If so, please describe the circumstances. INTERROGATORY NO. 50 Describe history of auditing the use or handling of USER INFORMATION by DEVELOPERS, including Whether FACEBOOK ever considered conducting audits, actually conducted any audits, and, if so, what it found. Please exclude: (A) information regarding an 13- FACEBOOK, INC. INVESTIGATIVE INTERROGATORIES - p?n p?n 0? individual investigation into a particular use of data, and (B) information about the ADI process previously disclosed 'by FACEBOOK. FAILURE TO COMPLY WITH THIS SUBPOENA WILL SUBJECT YOU TO THE PROCEEDINGS AND PENALTIES PROVIDED BY LAW. Dated: "June 17, 2019 XAVIER. Attorney General of California NICKLAS A. AKERS Senior Assistant Attorney General STACEY D. SCHESSER Supervising Deputy Attorney General LISA B. KIM SUSAN MICAH MANEESH SHARMA Deputy Attorneys General ?i LISQELKIM Deputy Attorney General FACEBOOK, INC. INVESTIGATIVE DECLARATION OF SERVICE BY E-MAIL Matter Name: In the Matter of the Investigation. of: FACEBOQK, INC. I declare: I am employed. in the Of?ce of the Attorney General, which is the of?ce of a member of the California State Bar, at which member?s direct-i011 this service is made. I am 18 years of age or Older and not a party to thismatter; my business address is 300 South Spring Street, Suite 1702, Los Angeles, CA 90013. On June 17 2019? I served the attaehed INVESTIGATIVE INTERROGATORIES hy'pl?acing a'true copy thereof enclosed in a sealed envelope with postage thereon fully prepaid, in the United States Mail at Los Angeles, California, addressed as follows: Benjamin A. Powell Maury Riggan WilmerHa'le 187-5 Avenue NW Washington, DC 20006 I declare under penalty ofperj ury under the laws of the State of California the, foregoing is true and correct and that this declaration was exeCUted On June 17, 2019, at Los Angeles, California. Carol Chow Declarant SF2018400570 53504613.doc'x' CM-010 OR PARTY ATTORNEY (Name, State Bar number, and address): FOR COURT use ONLY ?M1cah C.E. Osgood (SBN 255239) Of?ce of the Attorney General 455 Golden Gate Ave. Suite 11000 San Francisco, CA 94102 TELEPHONE NO.: 5 1 N01: I San Francisco County Sape?'or can? ATTORNEY FOR (Name): 601316 of the State Of California, Petltloner SUPERIOR COURT OF CALIFORNIA, COUNTY OF San Francisco 01g STREET ADDRESS: 400 MCAllister Avenue 0 6 MAILING ADDRESS: CITYANDZIP CODE: Sanfrancisco CA 94102 CLEWTHE I BRANCH Civ1c Center Courthouse Billw ., x" Cl?rk CASE NAME. SUNGA 9?3 People of the State of California V. Facebook, Inc. CIVIL CASE COVER SHEET Complex Case Designation CASE NUMBER: Unlimited El Limited Counter JOInder (Amount (Amount JUDGE demanded demanded is Filed with first appearance by defendant exceeds $25,000) $25,000 or less) (Cal. Rules of Court, rule 3.402) DEPT: Items 1H6 below must be completed (see instructions on page 2). 1. Check one box below for the case type that best describes this case: Auto Tort Contract Provisionally Complex Civil Litigation Auto (22) Breach of contract/warranty (06) (Cal. Rules of Court, rules 3.400?3.403) Uninsured motorist (46) Rule 3.740 collections (09) Antitrust/Trade regulation (03) Other (Personal Other collections (09) Construction defect (10) Damage/Wrongful Death) Tort Insurance coverage (18) Mass tort (40) DEEDS Asbestos (04) Other contract (37) Securities litigation (28) Product liability (24) Real property Environmental/Toxic tort (30) Medical malpraCtice (45) El Eminent domain/anerse Insurance coverage claims arising from the Other (23) condemnation (14) above listed provisionally complex case (Other) Tort Wrongful (33) types (41) I: Business tort/unfair business practice (07) El Other real property (26) Enforcement of Judgment I: Civil rights (08) Unlawful Detainer Enforcement of judgment (20) Defamation (13) '3 CommerCiai (31) Miscellaneous Civil Complaint Fraud (is) l:l Residential (32) Rico (27) t: Intellectual property (19) El Drugs (38) CI Other complaint (not speci?ed above) (42) El Professional negligence (25) Judicial Review Mieceiianeous-Civii Petition El Other tort (35) '3 Asset forfeiture (05) Partnership and corporate governance (21) Employment Petition re: arbitration award (11) Other petition (not Speci?ed above) (43) Wrongful termination (36) Writ of mandate (02) Other employment (15) El Otherjudicial review (39) 2. This case is is not complex under rule 3.400 of the California Rules Of Court. If the case is complex, mark the factors requiring exceptIOnaI judicial management: a. :1 Large number of separately represented parties d. I: Large number of witnesses b. Extensive motion practice raising difficult or novel e. Coordination with related actions pending in one or more courts issues that will be time?consuming to resolve in other counties, states, or countries, or in a federal court c. Substantial amount Of documentary evidence f. Substantial postjudgmentjudicial supervision 3. Remedies sought (Check all that apply): monetary biZl nonmonetary; declaratory orinjunctive relief C. I:ipunitive 4. Number Of causes of action (specify): 5. This case i: is is not a Class action suit. 6. If there are any known related cases, file and serve a notice of related case; (You may use form Gilli-015.) Date: NOV. 4, 2019 1 Micah C.E. Osgood (TYPE 0R PRINT NAME) (SIGNATURE FOR PARTY) NOTICE 0 Plaintiff must file this cover sheet with the first paper filed in the action or proceeding (except small claims cases or cases filed under the Probate Code, Family Code, or Welfare and Institutions Code). (Cal. Rules of Court, rule 3.220.) Failure to file may result in sanctions. 0 File this cover sheet in addition to any cover sheet required by local court rule. 0 If this case is complex under rule 3.400 et seq. of the California Rules of Court, you must serve a copy of this cover sheet on all other parties to the action or proceeding. 0 Unless this is a collections case 'under rule 3.740 or a complex case, this cover sheet will be used for statistical purposes onl . age 1 of 2 Form Adopted for Mandatory Use i Cal. Rules of Court, rules 2.30, 3.220, 3.400?3.403, 3.740; Judicial Council of California SHEET Cal. Standards of Judicial Administration. std. 3.10 CM-010 [Rev. July 1, 2007]