## Facts

- Facebook operated a free social-networking service requiring users to register using their real names and assigning each user a unique user ID.
- Users maintained profile pages containing identifying and personal information accessible through URLs incorporating the user ID or username.
- Facebook generated revenue through targeted advertising and allegedly represented in its policies that it would not disclose users’ identifying information to advertisers.
- Plaintiffs alleged that from February to May 2010, when users clicked Facebook ads, browsers transmitted “referrer headers” to advertisers.
- The referrer headers allegedly included the URL of the Facebook page the user was viewing, which contained the user ID, enabling advertisers to connect the ad click to a specific Facebook profile and real-world identity.
- Plaintiffs, on behalf of a putative class, alleged these disclosures occurred without consent and violated federal privacy statutes, California’s Unfair Competition Law (UCL), and Facebook’s contractual promises.

## Issues

1. Whether the alleged transmission of Facebook user IDs to advertisers via referrer headers stated claims under the Electronic Communications Privacy Act (including the Wiretap Act) and the Stored Communications Act, considering statutory definitions and provider/consent exceptions.
2. Whether plaintiffs plausibly alleged standing and cognizable injury, including the UCL requirement of “lost money or property.”
3. Whether Facebook’s terms of use and privacy policy plausibly created enforceable promises, and whether plaintiffs adequately alleged breach based on the asserted disclosures.
4. Whether § 230 of the Communications Decency Act barred any claims premised on Facebook’s challenged conduct.

## Decision

- The court granted Facebook’s Rule 12(b)(6) motion in part and denied it in part.
- Some ECPA/SCA theories were dismissed for failure to fit the statutory framework as pleaded, with leave to amend on certain points.
- Certain UCL theories were dismissed where alleged injury was too abstract or conclusory to satisfy “lost money or property.”
- Contract-based claims and portions of UCL claims tied to Facebook’s own alleged promises and site configuration survived the motion to dismiss.
- § 230 did not warrant dismissal at the pleading stage to the extent claims targeted Facebook’s own conduct and representations rather than liability for third-party content.

## Legal Principles

- At the pleading stage, claims under federal electronic privacy statutes require allegations that fit statutory elements (including “interception” or unauthorized access) and are not defeated by applicable provider or consent exceptions.
- Under California’s UCL, a plaintiff must plead injury in fact and loss of money or property; allegations that personal data has economic value may be insufficient without a concrete, particularized loss theory.
- Website terms of use and privacy policies may support breach-of-contract claims where plaintiffs plausibly allege assent, enforceable promises, and conduct inconsistent with those promises.
- Communications Decency Act § 230 generally does not immunize a service provider from claims based on its own conduct or representations, as distinct from publishing or distributing third-party content.

## Conclusion

The court narrowed the case on a motion to dismiss, rejecting several statutory and UCL injury theories as pleaded, while permitting contract and related UCL claims to proceed where the alleged wrongdoing was Facebook’s own transmission practices and policy-based representations to users.


In re Facebook Privacy Litig., 791 F. Supp. 2d 705 (N.D. Cal. 2011)