In re Facebook Privacy Litigation

          ORDER GRANTING IN PART AND DENYING IN PART FACEBOOK’S MOTION TO DISMISS RE: DKT. NO. 243, 293

          Ronald M. Whyte United States District Judge

         Plaintiffs Katherine Pohl and Wendy Marfeo bring this putative class action against Facebook, Inc. for breach of contract and fraud. Facebook moves to dismiss for lack of Article III standing. Dkt. No. 243. Plaintiffs oppose the motion. Dkt. No. 270. Facebook filed a reply, and plaintiffs filed a surreply.^[1] Dkt. Nos. 281, 293-1. A hearing was held on December 18, 2015. Having considered the parties’ arguments, the court grants Facebook’s motion to dismiss for lack of standing as to Ms. Pohl and denies Facebook’s motion to dismiss for lack of standing as to Ms. Marfeo.

         I. BACKGROUND

         Facebook provides social networking services to its users free of charge. Dkt. No. 227, TAC ¶¶ 10, 11. Facebook users must register on the website using their real names. Id. ¶ 12. After registering, users may then post other personal information to a Facebook profile page. Id. ¶ 13. Facebook generates revenue through advertising. Id. ¶ 18. Facebook is able to target ads to particular demographics using the personal information provided by its registered users. Id. ¶¶ 26-27. Targeted advertising is valuable to Facebook’s advertisers. Id. ¶¶ 26-27, 63, 65. According to Facebook, the “ad targeting is done entirely anonymously. If advertisers select demographic targeting for their ads, Facebook automatically matches those ads to the appropriate audience. Advertisers only receive anonymous data reports.” Id. ¶ 28 (quoting Facebook’s Privacy Guide). Plaintiffs allege that Facebook has “consistently and adamantly promised” not to share any user’s specific identity or personally identifiable information (“PII”) with its advertising partners. Id. ¶¶ 32, 27-31.

         According to plaintiffs, Facebook’s business model represents a bargain between Facebook and its users: “Facebook users provide their valuable PII to Facebook in exchange for access to facebook.com and for Facebook’s promises not to disclose their PII to third parties without consent.” Id. ¶¶ 16, 62, 67. Named plaintiffs Katherine Pohl and Wendy Marfeo have been registered Facebook users since at least 2008. Id. ¶¶ 4-5. Ms. Pohl and Ms. Marfeo claim that Facebook violated its own policies and promises by disclosing their “sensitive personally identifiable information” to advertisers. Id. ¶¶ 1-5. Specifically, plaintiffs allege that when they clicked on Facebook ads, Facebook sent “referer headers” to the advertisers that would allow the advertiser to identify the user who clicked the ad. Id. ¶¶ 34-39.

         When an Internet user navigates to a website by clicking a link, the user’s browser may send a “referer header” to the destination website’s server. Dkt. No. 245, Jones Decl. ¶ 2. A “referer header” typically contains the URL of the website the user was visiting when he or she clicked the link. Id. Each Facebook user account is tied to a unique user ID number or username. TAC ¶ 14. Before July 2010, “if a Facebook user navigated the Facebook website in a particular way and clicked on a third-party advertisement linked to an external page, the resulting referer header may have included a user’s Facebook username or user ID.” Jones Decl. ¶ 5. A referer header containing a user ID or username from a referring Facebook profile page is not enough to identify the Facebook user who clicked on the ad; the same referer header would be generated for any user visiting that particular profile page, not just a user visiting his or her own profile page. Id. ¶ 5.

         During the same timeframe, however, Facebook may have “included a particular string of characters in users’ profile page URLs (‘ref=profile’)” if a “user took certain steps to navigate to his or her own profile page.” Id. ¶ 6 (emphasis added). As a result, some referer headers sent to external advertisers included “both the ‘ref=profile’ string and the user ID or username of the user who clicked the ad.” Id. ¶ 7; see also TAC ¶¶ 35-39. Facebook acknowledges that “in theory, ” a recipient of both the “ref=profile” string and a user ID or username would be able to identify the Facebook user who clicked on the ad. Id. ¶ 7; see also TAC ¶ 14. Plaintiffs assert two causes of action based on the transmission of these referer headers-breach of contract and fraud. TAC ¶¶ 58-73.

         Several separate actions were originally filed against Facebook, and the cases were consolidated on August 10, 2010 under the caption In re Facebook Privacy Litigation. Dkt. No. 23. The consolidated class action complaint named David Gould and Mike Robertson as putative class representatives. Dkt. No. 36. The court dismissed plaintiffs’ federal and state law claims and entered final judgment on November 22, 2011. Dkt. No. 106, 107. Plaintiff Mike Robertson appealed the dismissal. Dkt. No. 116. The Ninth Circuit reversed on two of the eight dismissed claims, finding plaintiffs’ damages allegations sufficient to support their breach of contract and fraud claims. Dkt. No. 122 at 2. Specifically, the Ninth Circuit cited plaintiffs’ allegations that “the information disclosed by Facebook can be used to obtain personal information about plaintiffs, ” and that plaintiffs were harmed by both “the dissemination of their personal information and by losing the sales value of that information.” Id. The case was remanded with Mr. Robertson as the sole named plaintiff.

         Mr. Robertson moved for leave to amend the FAC to add Katherine Pohl as named plaintiff and to seek nominal damages and disgorgement. Dkt. No. 138. The court granted leave to amend on February 13, 2015. See Dkt. No. 142. The parties then stipulated to Mr. Robertson’s voluntary dismissal on March 20, 2015. Dkt No. 146. On March 27, 2015, Ms. Pohl moved for leave to file a third amended complaint adding Wendy Marfeo as a named plaintiff. Dkt. No. 148. The court granted leave to add Ms. Marfeo on May 22, 2015, treating the motion as a request for substitution of a named plaintiff following the mooting of a prior plaintiff’s claims. See Dkt. No. 226.

         Facebook moves to dismiss pursuant to Federal Rule of Civil Procedure 12(b)(1), arguing that Ms. Pohl and Ms. Marfeo lack Article III standing to bring this suit because they are unable to demonstrate that they have suffered injury in fact. Facebook further argues that the court should dismiss this case for lack of standing because neither Mr. Robertson nor Ms. Pohl had standing at the time Ms. Marfeo was added as a named plaintiff.

         II. ANALYSIS

         Plaintiffs have the burden to establish standing. See WildEarth Guardians v. U.S. Dep’t of Agric., 795 F.3d 1148, 1154 (9th Cir. 2015). “To establish standing, a plaintiff must show that (1) he or she has suffered an injury in fact that is concrete and particularized, and actual or imminent; (2) the injury is fairly traceable to the challenged conduct; and (3) the injury is likely to be redressed by a favorable court decision.” Id. (quoting Salmon Spawning & Recovery Alliance v. Gutierrez, 545 F.3d 1220, 1225 (9th Cir. 2008) (citing Lujan v. Defender. of Wildlife, 504 U.S. 555, 560-61 (1992))). Facebook argues that neither Ms. Pohl nor Ms. Marfeo can establish the first of these requirements-injury in fact.

         To establish injury in fact, a plaintiff must show that he or she suffered “an invasion of a legally protected interest” that is “concrete and particularized” and “actual or imminent, not conjectural or hypothetical.” Lujan, 504 U.S. at 560 (internal quotations omitted). “In class actions, the named representatives must allege and show that they personally have been injured, not that injury has been suffered by other, unidentified members of the class to which they belong and which they purport to represent.” Lierboe v. State Farm Mut. Auto. Ins. Co., 350 F.3d 1018, 1022 (9th Cir. 2003) (quoting Pence v. Andrus, 586 F.2d 733, 736-37 (9th Cir. 1978)).

         Because standing is “an indispensable part” of a plaintiff’s case, “each element must be supported in the same way as any other matter on which the plaintiff bears the burden of proof, i.e., with the manner and degree of evidence required at the successive stages of the litigation.” Lujan, 504 U.S. at 561. Class discovery is closed, and plaintiffs have moved to certify the class. See Dkt. Nos. 236, 261. At this stage, plaintiffs “must show standing ‘through evidentiary proof.’” Moore v. Apple Inc., 309 F.R.D. 532, 539 (N.D. Cal. 2015) (quoting Comcast Corp. v. Behrend, 133 S.Ct. 1426, 1432 (2013)); see also Evans v. Linden Research, Inc., No. C 11-01078 DMR, 2012 WL 5877579, at *6 (N.D. Cal. Nov. 20, 2012) (“On a motion for class certification, Plaintiffs must demonstrate, not merely allege, that they have suffered an ...