## Facts

- Numerous lawsuits by Facebook users were consolidated in an MDL in the Northern District of California after public reporting that third parties obtained and used Facebook user data without proper authorization.
- Plaintiffs alleged Facebook made users’ sensitive information available to third parties without adequate consent and failed to prevent misuse or resale.
- The alleged incident involved a third-party app that collected data from users who installed it and, through platform features, also obtained data about many of those users’ “friends” who did not install the app.
- Plaintiffs alleged the data included not only basic profile details but also more revealing content, including photos and videos, viewed content, political and religious views, relationship information, and message content.
- Plaintiffs grouped the alleged misconduct into four categories:
  - enabling app developers to access friends’ data despite “friends-only” privacy settings and without adequate disclosure;
  - continuing “whitelisted” developer access after public statements that such access would be curtailed;
  - sharing data with business partners through reciprocity agreements allegedly not clearly disclosed; and
  - failing to police third-party misuse after making data broadly accessible.
- Lead plaintiffs filed a consolidated amended complaint asserting federal and state claims; Facebook moved to dismiss under Rule 12(b)(6).

## Issues

1. Whether users who share information with a limited audience on a social network retain a legally protected privacy interest against substantially broader, undisclosed dissemination.
2. Whether alleged invasion of privacy and misuse of personal data constitutes a concrete injury sufficient for Article III standing absent conventional economic loss.
3. Whether users’ agreement to Facebook’s terms and disclosures established consent that barred claims at the pleading stage.
4. Whether the complaint plausibly stated claims under California privacy tort law, federal privacy statutes (including the Stored Communications Act and Wiretap Act), and contract and misrepresentation theories.

## Decision

- The court granted in part and denied in part Facebook’s motion to dismiss.
- The court rejected the argument that users categorically lack a privacy interest in information shared with “friends” on social media.
- The court held plaintiffs plausibly alleged Article III standing based on unauthorized dissemination and exploitation of sensitive personal information.
- The court found consent could not be resolved broadly on a motion to dismiss because plaintiffs plausibly alleged non-consent as to several challenged practices (including certain post-announcement access for “whitelisted” apps, partner-sharing arrangements, and inadequate policing of misuse).
- The court allowed core privacy-based claims and certain federal statutory, contract, and misrepresentation claims to proceed, while dismissing other claims or narrowing theories (often with leave to amend).

## Legal Principles

- A reasonable expectation of privacy may exist in information shared with a limited audience; privacy is not an all-or-nothing concept, and significantly wider dissemination can support privacy-based claims.
- Unauthorized disclosure or misuse of sensitive personal data can constitute a concrete injury for Article III standing, even without identity theft or financial loss.
- Consent based on platform terms and disclosures is context-specific; where plaintiffs plausibly allege disclosures did not clearly cover the challenged data-sharing practices, dismissal on consent grounds may be improper at the pleading stage.
- Privacy tort claims (including intrusion upon seclusion) may be plausibly stated where a defendant allegedly enabled access to highly sensitive information beyond the user’s intended audience in a manner that could be highly offensive to a reasonable person.
- Claims under federal privacy statutes may proceed where plaintiffs plausibly allege access to or disclosure of communications or stored content without authorization or in excess of authorization, subject to claim-specific limitations.

## Conclusion

The court permitted substantial portions of users’ privacy, statutory, and related contract and misrepresentation claims to proceed, holding that limited-audience social-media sharing can still carry protectable privacy interests and that alleged unauthorized dissemination of sensitive data can establish standing, while dismissing or narrowing other theories that were inadequately pleaded or legally barred.


In re Facebook, Inc., Consumer Privacy User Profile Litig., 402 F. Supp. 3d 767 (N.D. Cal. 2019)