Perrin Davis v. Facebook, Inc.

Summary

The Ninth Circuit held that Facebook users had Article III standing to assert privacy and economic injury claims based on Facebook's surreptitious tracking of their browsing histories after logout, as the alleged invasion of privacy and unjust enrichment from data use constituted concrete injuries. On the merits, the court reversed dismissal of claims for intrusion upon seclusion, invasion of privacy, and violations of the Wiretap Act and California Invasion of Privacy Act (CIPA), adopting the First and Seventh Circuits' view that the "party" exception does not shield Facebook from liability for simultaneously duplicating and forwarding users' GET requests without consent. However, the court affirmed dismissal of Stored Communications Act claims because the URL data was not in "electronic storage," and dismissed breach of contract and implied covenant claims for failure to allege an enforceable promise not to track logged-out users.

Holdings

1. Plaintiffs have standing because they adequately alleged an invasion of a legally protected interest that is concrete and particularized.
2. Plaintiffs have standing because California law recognizes a legal interest in unjustly earned profits, and plaintiffs adequately alleged an entitlement to Facebook's profits from their data.
3. Plaintiffs adequately alleged a reasonable expectation of privacy and that the intrusion could be highly offensive to a reasonable person.
4. Simultaneous unknown duplication and communication of GET requests does not exempt Facebook from liability under the party exception.
5. Plaintiffs' SCA claims were properly dismissed because the URLs in the toolbar are not in electronic storage under the SCA.
6. Plaintiffs failed to allege the existence of a contract that was subject to breach.

Questions Presented

1. Whether plaintiffs have standing to bring privacy-related claims against Facebook
2. Whether plaintiffs adequately stated claims for common law and statutory privacy violations, including intrusion upon seclusion, invasion of privacy, Wiretap Act, CIPA, SCA, breach of contract, and implied covenant

Disposition

other