United States District Court, N.D. California, San Jose Division
ORDER GRANTING IN PART AND DENYING IN PART
FACEBOOK’S MOTION TO DISMISS RE: DKT. NO. 243,
293
Ronald
M. Whyte United States District Judge
Plaintiffs
Katherine Pohl and Wendy Marfeo bring this putative class
action against Facebook, Inc. for breach of contract and
fraud. Facebook moves to dismiss for lack of Article III
standing. Dkt. No. 243. Plaintiffs oppose the motion. Dkt.
No. 270. Facebook filed a reply, and plaintiffs filed a
surreply.[1] Dkt. Nos. 281, 293-1. A hearing was held
on December 18, 2015. Having considered the parties’
arguments, the court grants Facebook’s motion to
dismiss for lack of standing as to Ms. Pohl and denies
Facebook’s motion to dismiss for lack of standing as to
Ms. Marfeo.
I.
BACKGROUND
Facebook
provides social networking services to its users free of
charge. Dkt. No. 227, TAC ¶¶ 10, 11. Facebook users
must register on the website using their real names.
Id. ¶ 12. After registering, users may then
post other personal information to a Facebook profile page.
Id. ¶ 13. Facebook generates revenue through
advertising. Id. ¶ 18. Facebook is able to
target ads to particular demographics using the personal
information provided by its registered users. Id.
¶¶ 26-27. Targeted advertising is valuable to
Facebook’s advertisers. Id. ¶¶
26-27, 63, 65. According to Facebook, the “ad targeting
is done entirely anonymously. If advertisers select
demographic targeting for their ads, Facebook automatically
matches those ads to the appropriate audience. Advertisers
only receive anonymous data reports.” Id.
¶ 28 (quoting Facebook’s Privacy Guide).
Plaintiffs allege that Facebook has “consistently and
adamantly promised” not to share any user’s
specific identity or personally identifiable information
(“PII”) with its advertising partners.
Id. ¶¶ 32, 27-31.
According
to plaintiffs, Facebook’s business model represents a
bargain between Facebook and its users: “Facebook users
provide their valuable PII to Facebook in exchange for access
to facebook.com and for Facebook’s promises not to
disclose their PII to third parties without consent.”
Id. ¶¶ 16, 62, 67. Named plaintiffs
Katherine Pohl and Wendy Marfeo have been registered Facebook
users since at least 2008. Id. ¶¶ 4-5. Ms.
Pohl and Ms. Marfeo claim that Facebook violated its own
policies and promises by disclosing their “sensitive
personally identifiable information” to advertisers.
Id. ¶¶ 1-5. Specifically, plaintiffs
allege that when they clicked on Facebook ads, Facebook sent
“referer headers” to the advertisers that would
allow the advertiser to identify the user who clicked the ad.
Id. ¶¶ 34-39.
When an
Internet user navigates to a website by clicking a link, the
user’s browser may send a “referer header”
to the destination website’s server. Dkt. No. 245,
Jones Decl. ¶ 2. A “referer header”
typically contains the URL of the website the user was
visiting when he or she clicked the link. Id. Each
Facebook user account is tied to a unique user ID number or
username. TAC ¶ 14. Before July 2010, “if a
Facebook user navigated the Facebook website in a particular
way and clicked on a third-party advertisement linked to an
external page, the resulting referer header may have included
a user’s Facebook username or user ID.” Jones
Decl. ¶ 5. A referer header containing a user ID or
username from a referring Facebook profile page is not enough
to identify the Facebook user who clicked on the ad; the same
referer header would be generated for any user visiting that
particular profile page, not just a user visiting his or her
own profile page. Id. ¶ 5.
During
the same timeframe, however, Facebook may have
“included a particular string of characters in
users’ profile page URLs
(‘ref=profile’)” if a “user took
certain steps to navigate to his or her own profile
page.” Id. ¶ 6 (emphasis added). As
a result, some referer headers sent to external advertisers
included “both the ‘ref=profile’ string and
the user ID or username of the user who clicked the
ad.” Id. ¶ 7; see also TAC
¶¶ 35-39. Facebook acknowledges that “in
theory, ” a recipient of both the
“ref=profile” string and a user ID or username
would be able to identify the Facebook user who clicked on
the ad. Id. ¶ 7; see also TAC ¶
14. Plaintiffs assert two causes of action based on the
transmission of these referer headers-breach of contract and
fraud. TAC ¶¶ 58-73.
Several
separate actions were originally filed against Facebook, and
the cases were consolidated on August 10, 2010 under the
caption In re Facebook Privacy Litigation. Dkt. No.
23. The consolidated class action complaint named David Gould
and Mike Robertson as putative class representatives. Dkt.
No. 36. The court dismissed plaintiffs’ federal and
state law claims and entered final judgment on November 22,
2011. Dkt. No. 106, 107. Plaintiff Mike Robertson appealed
the dismissal. Dkt. No. 116. The Ninth Circuit reversed on
two of the eight dismissed claims, finding plaintiffs’
damages allegations sufficient to support their breach of
contract and fraud claims. Dkt. No. 122 at 2. Specifically,
the Ninth Circuit cited plaintiffs’ allegations that
“the information disclosed by Facebook can be used to
obtain personal information about plaintiffs, ” and
that plaintiffs were harmed by both “the dissemination
of their personal information and by losing the sales value
of that information.” Id. The case was
remanded with Mr. Robertson as the sole named plaintiff.
Mr.
Robertson moved for leave to amend the FAC to add Katherine
Pohl as named plaintiff and to seek nominal damages and
disgorgement. Dkt. No. 138. The court granted leave to amend
on February 13, 2015. See Dkt. No. 142. The parties
then stipulated to Mr. Robertson’s voluntary dismissal
on March 20, 2015. Dkt No. 146. On March 27, 2015, Ms. Pohl
moved for leave to file a third amended complaint adding
Wendy Marfeo as a named plaintiff. Dkt. No. 148. The court
granted leave to add Ms. Marfeo on May 22, 2015, treating the
motion as a request for substitution of a named plaintiff
following the mooting of a prior plaintiff’s claims.
See Dkt. No. 226.
Facebook
moves to dismiss pursuant to Federal Rule of Civil Procedure
12(b)(1), arguing that Ms. Pohl and Ms. Marfeo lack Article
III standing to bring this suit because they are unable to
demonstrate that they have suffered injury in fact. Facebook
further argues that the court should dismiss this case for
lack of standing because neither Mr. Robertson nor Ms. Pohl
had standing at the time Ms. Marfeo was added as a named
plaintiff.
II.
ANALYSIS
Plaintiffs
have the burden to establish standing. See WildEarth
Guardians v. U.S. Dep’t of Agric., 795 F.3d 1148,
1154 (9th Cir. 2015). “To establish standing, a
plaintiff must show that (1) he or she has suffered an injury
in fact that is concrete and particularized, and actual or
imminent; (2) the injury is fairly traceable to the
challenged conduct; and (3) the injury is likely to be
redressed by a favorable court decision.” Id.
(quoting Salmon Spawning & Recovery Alliance v.
Gutierrez, 545 F.3d 1220, 1225 (9th Cir. 2008) (citing
Lujan v. Defender. of Wildlife, 504 U.S. 555, 560-61
(1992))). Facebook argues that neither Ms. Pohl nor Ms.
Marfeo can establish the first of these requirements-injury
in fact.
To
establish injury in fact, a plaintiff must show that he or
she suffered “an invasion of a legally protected
interest” that is “concrete and
particularized” and “actual or imminent, not
conjectural or hypothetical.” Lujan, 504 U.S.
at 560 (internal quotations omitted). “In class
actions, the named representatives must allege and show that
they personally have been injured, not that injury has been
suffered by other, unidentified members of the class to which
they belong and which they purport to represent.”
Lierboe v. State Farm Mut. Auto. Ins. Co., 350 F.3d
1018, 1022 (9th Cir. 2003) (quoting Pence v. Andrus,
586 F.2d 733, 736-37 (9th Cir. 1978)).
Because
standing is “an indispensable part” of a
plaintiff’s case, “each element must be supported
in the same way as any other matter on which the plaintiff
bears the burden of proof, i.e., with the manner and
degree of evidence required at the successive stages of the
litigation.” Lujan, 504 U.S. at 561. Class
discovery is closed, and plaintiffs have moved to certify the
class. See Dkt. Nos. 236, 261. At this stage,
plaintiffs “must show standing ‘through
evidentiary proof.’” Moore v. Apple
Inc., 309 F.R.D. 532, 539 (N.D. Cal. 2015) (quoting
Comcast Corp. v. Behrend, 133 S.Ct. 1426, 1432
(2013)); see also Evans v. Linden Research, Inc.,
No. C 11-01078 DMR, 2012 WL 5877579, at *6 (N.D. Cal. Nov.
20, 2012) (“On a motion for class certification,
Plaintiffs must demonstrate, not merely allege, that they
have suffered an ...