## Facts

- Facebook users brought a putative class action for users with active Facebook accounts between May 27, 2010 and September 26, 2011.
- Plaintiffs alleged Facebook placed cookies on users’ browsers and used Facebook plug-ins (e.g., “Like” buttons) on third-party websites to receive cookie data and the full URLs of pages users visited.
- Plaintiffs alleged Facebook continued collecting this information even after users logged out, and used the data to compile user browsing histories into profiles used for targeted advertising revenue.
- Plaintiffs alleged Facebook’s public statements and policies suggested that logout would end such tracking, making the post-logout collection nonconsensual and undisclosed.
- Plaintiffs asserted federal claims under the Wiretap Act, Stored Communications Act (SCA), and Computer Fraud and Abuse Act (CFAA), plus California statutory and common-law claims (including CIPA, CDAFA, intrusion upon seclusion, trespass to chattels, and restitutionary disgorgement), and contract-based claims.
- The district court dismissed for lack of Article III standing and for failure to state a claim; plaintiffs appealed.

## Issues

1. Whether plaintiffs plausibly alleged a concrete, particularized injury sufficient for Article III standing based on alleged post-logout tracking and related economic gain to Facebook.
2. Whether plaintiffs plausibly stated claims under the Wiretap Act and CIPA, including whether full URLs can constitute “contents,” whether interception was contemporaneous, and whether defenses such as consent or “party to the communication” applied at the pleading stage.
3. Whether plaintiffs plausibly stated claims under the CFAA, CDAFA, and California tort theories (intrusion upon seclusion, trespass to chattels, and statutory larceny) based on alleged unauthorized tracking and use of users’ devices and data.
4. Whether plaintiffs stated an SCA claim based on Facebook’s acquisition of the communications at issue.
5. Whether plaintiffs stated breach of contract or breach of the implied covenant claims based on Facebook’s policies and user-facing documents.
6. Whether a restitutionary unjust-enrichment/disgorgement theory could proceed under California law.

## Decision

- The Ninth Circuit affirmed in part, reversed in part, and remanded.
- The court held plaintiffs had Article III standing based on alleged invasion of privacy interests and a claimed economic interest in profits allegedly derived from their data.
- The court reversed dismissal of, and allowed to proceed at the pleading stage, claims including the Wiretap Act, CIPA, intrusion upon seclusion, CFAA, CDAFA, trespass to chattels, statutory larceny, and restitutionary disgorgement.
- The court affirmed dismissal of the SCA claim.
- The court affirmed dismissal of breach of contract and breach of the implied covenant claims.

## Legal Principles

- Alleged nonconsensual tracking of a user’s web-browsing history can constitute a concrete privacy injury for Article III standing, including harm (or material risk of harm) to the interest in controlling personal information.
- A plaintiff may also establish standing through a claimed economic injury where state law recognizes an interest in recovering unjustly earned profits allegedly derived from misuse of the plaintiff’s data.
- Full URLs may qualify as “contents” of a communication under interception statutes when they reveal substantive information (such as specific page paths or search terms), not merely routing information.
- Interception may be plausibly alleged where third-party plug-in code collects communications in a separate but simultaneous channel during transmission.
- At the motion-to-dismiss stage, broad defenses that Facebook was a “party” to user–website communications, or that users consented through policies, may fail where plaintiffs plausibly allege Facebook acted as a third-party interceptor and that representations about logout undermined informed consent.
- SCA liability requires unauthorized access to communications in “electronic storage” as defined by statute; allegations failing to fit that definition do not state a claim.
- Contract and implied-covenant claims require enforceable promises and adequately alleged breach and damages; policy statements that do not create the alleged contractual commitments will not support liability.
- Under California law, “unjust enrichment” may proceed as a restitutionary theory seeking disgorgement of benefits unjustly obtained, even if not treated as a standalone cause of action.

## Conclusion

The Ninth Circuit held that alleged post-logout tracking of users’ browsing activity could support Article III standing and plausibly state multiple federal and California privacy, computer access, and restitutionary claims, while rejecting plaintiffs’ SCA and contract-based theories, and remanded for further proceedings on the surviving claims.


In re Facebook, Inc. Internet Tracking Litigation, 956 F.3d 589 (9th Cir. 2020)