In re Facebook, Inc., Consumer Privacy User Profile Litigation

In 2018 Facebook, Inc. (defendant) became the subject of a scandal regarding user privacy after a third-party app developer, Aleksandr Kogan, was able to access the personal information of 87 million Facebook users who were friends of the 300,000 Facebook users who used Kogan’s app. Kogan then sold this sensitive information to a political consulting firm in Britain, Cambridge Analytica, that used that information to influence the 2016 American presidential campaign by sending Facebook users targeted political content. Dozens of similar lawsuits were filed around the country; many were class actions in federal court, alleging various claims, including privacy-related torts and violation of two federal statutes. All such cases were assigned to a single federal court to handle pretrial issues before being returned to the originating courts. The federal district court grouped the various allegations of the current and former Facebook users (collectively, the litigants) (plaintiffs) into four categories. In the first category, the litigants alleged that Facebook gave app developers access to not only the personal information of users who interacted with the developers’ apps but the information of their Facebook friends as well. This information was accessed even if a person had used privacy settings to limit access to their friends only, which the litigants alleged Facebook failed to disclose. The second and third categories alleged that Facebook continued to allow certain whitelisted apps to access the information of an app user’s friends after announcing in 2014 this would no longer occur and with certain business partners during the subject time frame pursuant to data-reciprocity agreements with these companies that were allegedly not disclosed. The fourth category of alleged wrongdoing was that after allowing limitless developers and companies to access this sensitive information, Facebook took no steps to enforce its own policy prohibiting the use of the information for anything other than user interactions. Facebook moved for dismissal, mainly arguing that users had no expectation of privacy in information shared and no standing to sue in federal court. The federal district court found these arguments meritless and determined that litigants had plausibly alleged the privacy torts and the violation of two federal statutes. The federal district court considered Facebook’s argument that users had consented to information sharing when they created Facebook accounts. Information sharing with app developers was disclosed upon sign-up beginning in 2009. However, the litigants argued that users had not consented to sharing information with whitelisted apps, which did not begin until 2015, or with business partners or to misuse of that information by these companies.