## Facts

- Facebook provided free social-networking services, collected users’ real names and other profile data, and generated revenue through targeted advertising.
- Users alleged Facebook promised not to share users’ personally identifiable information (PII) with advertisers and represented that ad targeting was anonymous.
- Plaintiffs, long-time Facebook users, alleged Facebook transmitted HTTP “referer headers” to advertisers when users clicked ads, including URLs containing a user’s Facebook ID or username that could identify the user.
- Plaintiffs asserted breach of contract and fraud based on alleged privacy promises and alleged misrepresentations about PII non-disclosure.
- Facebook moved to dismiss under Rule 12(b)(1), arguing plaintiffs failed to allege an Article III injury in fact.

## Issues

1. Whether allegations that Facebook disclosed a user’s PII to advertisers via referer headers, contrary to privacy-related promises, constitute a concrete and particularized injury in fact for Article III standing.
2. Whether each named plaintiff pleaded sufficient facts showing that her own PII was actually disclosed, rather than alleging speculative or conclusory harm.
3. Whether asserted injuries such as invasion of privacy and loss of the benefit of the bargain (including the asserted economic value of personal data) can satisfy injury in fact at the pleading stage.

## Decision

- The court granted in part and denied in part Facebook’s motion to dismiss for lack of standing.
- The court dismissed all claims brought by Katherine Pohl for lack of Article III standing because she did not plead facts plausibly showing her PII was actually disclosed to advertisers.
- The court held Wendy Marféo adequately alleged injury in fact because her allegations supported a reasonable inference that her PII was disclosed to third-party advertisers through referer headers.
- The court treated the standing inquiry as distinct from the merits and accepted well-pleaded allegations as true with reasonable inferences in plaintiffs’ favor.

## Legal Principles

- Article III standing requires an injury in fact that is concrete and particularized and actual or imminent, not conjectural or hypothetical.
- Unauthorized disclosure of personal information may constitute a concrete injury where it invades a legally protected privacy interest, even without traditional out-of-pocket loss.
- “Benefit-of-the-bargain” allegations tied to privacy promises may constitute economic harm sufficient for standing when linked to a plausible allegation that the plaintiff’s data was actually disclosed or misused.
- Standing must be shown on a plaintiff-by-plaintiff basis; generalized allegations about a product or practice do not suffice without facts connecting the challenged conduct to the named plaintiff’s own information.

## Conclusion

The court allowed the action to proceed only as to the plaintiff who plausibly alleged that her PII was actually transmitted to advertisers via referer headers, holding that such alleged unauthorized disclosure and the resulting loss of promised privacy can constitute a concrete injury for Article III standing, while dismissing the other plaintiff for failing to plead disclosure of her own PII.


In re Facebook Privacy Litigation, 192 F. Supp. 3d 1053 (N.D. Cal. 2016)