In re Facebook Internet Tracking Litig.

290 F.Supp.3d 916

IN RE FACEBOOK INTERNET TRACKING LITIGATION

Case No. 5:12–md–02314–EJD

United States District Court, N.D. California, San Jose Division.

Signed November 17, 2017

ORDER GRANTING DEFENDANT'S MOTION TO DISMISS

Re: Dkt. No. 162

EDWARD J. DAVILA, United States District Judge

Plaintiffs' third amended complaint alleges that Defendant Facebook, Inc. violated its contractual obligations by tracking logged-out Facebook users on third-party websites. Facebook now moves to dismiss for the third time. Facebook's motion will be granted.

I. BACKGROUND

In this putative class action, Plaintiffs allege that Facebook improperly tracked the web browsing activity of logged-out Facebook users on third-party websites.¹ Third Am. Compl. ("TAC"), Dkt. No. 157. Plaintiffs previously asserted a variety of common law claims and claims for violations of federal and state statutes. After two rounds of motions to dismiss, this Court dismissed the majority of Plaintiffs' claims with prejudice for lack of standing and for failure to state a claim. Order Granting Def.'s Mot. to Dismiss ("MTD Order"), Dkt. No. 148. This Court granted leave to amend only as to Plaintiffs' claims for breach of contract and breach of the duty of good faith and fair dealing. Id. Plaintiffs timely filed their third amended complaint. Facebook now moves to dismiss under Fed. R. Civ. P. 12(b)(6) and 15(c). Def.'s Mot. to Dismiss ("MTD"), Dkt. No. 162.

II. LEGAL STANDARD

A motion to dismiss under Fed. R. Civ. P. 12(b)(6) tests the legal sufficiency of claims alleged in the complaint. Parks Sch. of Bus., Inc. v. Symington, 51 F.3d 1480, 1484 (9th Cir. 1995). Dismissal "is proper only where there is no cognizable legal theory or an absence of sufficient facts alleged to support a cognizable legal theory." Navarro v. Block, 250 F.3d 729, 732 (9th Cir. 2001). The complaint "must contain sufficient factual matter, accepted as true, to 'state a claim to relief that is plausible on its face.' " Ashcroft v. Iqbal, 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007) ).

III. DISCUSSION

Plaintiffs' TAC asserts causes of action for (1) breach of contract (TAC ¶¶ 139–48) and (2) breach of the duty of good faith and fair dealing (TAC ¶¶ 149–61). Plaintiffs also seek to enlarge the scope of the proposed class.

A. Breach of Contract

Plaintiffs allege that each of them entered into a contract with Facebook that consisted of (1) Facebook's Statement of Rights and Responsibilities ("SRR"), (2) Facebook's Privacy Policy, and (3) relevant pages from Facebook's Help Center. TAC ¶ 140. According to Plaintiffs, Facebook promised in the contract that it would not track the web browsing activity of logged-out Facebook users on third-party websites. Id. ¶ 142. Plaintiffs allege that Facebook broke that promise by collecting data about logged-out users' browsing activity and using cookies to connect that activity to users' identities. Id.

To state a claim for breach of contract, Plaintiffs must allege that (1) they entered into a contract with Facebook, (2) Plaintiffs performed or were excused from performance under the contract, (3) Facebook breached the contract, and (4) Plaintiffs suffered damages from the breach. Oasis W. Realty, LLC. v. Goldman, 51 Cal.4th 811, 821, 124 Cal.Rptr.3d 256, 250 P.3d 1115 (2011) (citing Reichert v. General Ins. Co., 68 Cal.2d 822, 830, 69 Cal.Rptr. 321, 442 P.2d 377 (1968) ). "In an action for breach of a written contract, a plaintiff must allege the specific provisions in the contract creating the obligation the defendant is said to have breached."

Woods v. Google Inc., No. 05:11-cv-1263-JF, 2011 WL 3501403, at *3 (N.D. Cal. Aug. 10, 2011).

The parties agree that the SRR constitutes a contract. MTD 8; Pls.' Opp'n to Def.'s Mot. to Dismiss ("Opp'n"), Dkt. No. 163. However, the SRR itself does not contain a promise to not track logged-out users. Rather, Plaintiffs argue that the operative contract is a combination of provisions from Facebook's SRR, Facebook's Privacy Policy,² and Facebook's Help Center pages.³

i. The Data Use Policy was not incorporated by reference into the Statement of Rights and Responsibilities.

Plaintiffs cite the following language from Facebook's Data Use Policy (dated September 7, 2011):

We receive data whenever you visit a ... site with a Facebook feature (such as a social plugin). This may include the date and time you visit the site; the web address, or URL, you're on; technical information about the IP address, browser and the operating system you use; and, if you are logged in to Facebook, your User ID.

TAC ¶ 60 (emphasis added). Plaintiffs argue that this language "implicitly promises to the average user that Facebook will not receive [a user-identifying] cookie when the user is not logged in." Id.

Plaintiffs argue that this version of the Data Use Policy is part of the contract because it was incorporated by reference into the SRR. Opp'n 4–5. Under California law, for the terms of another document to be incorporated by reference into an executed document, "the reference must be (1) clear and unequivocal, the (2) reference must be called to the attention of the other party and he must consent thereto, and (3) the terms of the incorporated document must be known or easily available to the contracting parties." Woods, 2011 WL 3501403, at *3 (quoting Troyk v. Farmers Grp., Inc., 171 Cal.App.4th 1305, 1331, 90 Cal.Rptr.3d 589 (2009) ).

Here, Plaintiffs argue that the Privacy Policy was incorporated by reference into the SRR because of the following language in the SRR:

Your privacy is very important to us. We designed our Privacy Policy to make important disclosures about how you can use Facebook to share with others and how we collect and can use your content and information. We encourage you to read the Privacy Policy, and to use it to help make informed decisions.

TAC ¶¶ 24, 57.⁴ According to Plaintiffs, this language means that the Privacy Policy is incorporated by reference into the SRR because the "SRR expressly refers to the Privacy Policy, says that the Policy is important, links to that Policy and tells users to read it to make important decisions about their privacy." Opp'n 5.

Plaintiffs' complaint cites four versions of Facebook's SRR, dated April 22, 2010 (TAC Ex. A), August 25, 2010 (TAC Ex. B), October 4, 2010 (TAC Ex. C), and April 26, 2011 (TAC Ex. D). TAC ¶¶ 19–20. The excerpt quoted above appears in all four versions of the SRR.

As discussed above, Plaintiffs argue that Facebook's Data Use Policy promised that Facebook would not track logged-out users. However, the version of the Data Use Policy that contains this language was not published until September 7, 2011—more than four months after the latest version of the SRR (dated April 26, 2011) that Plaintiffs attach to their complaint. See TAC Ex. D (attaching the April 26, 2011, version of the SRR), Ex. H (attaching the September 7, 2011, version of the Data Use Policy). Earlier versions of the Privacy Policy did not contain the language that Plaintiffs allege constitutes a promise not to track logged-out users. Compare id. Ex. H (attaching the September 7, 2011, version of the Data Use Policy, which states that Facebook "receive[s] data whenever you visit a ... site with a Facebook feature (such as a social plugin) .... [including], if you are logged in to Facebook, your User ID") (emphasis added), with id. Ex. E (attaching the April 22, 2010, version of the Privacy Policy), Ex. F (attaching the October 5, 2010, version of the Privacy Policy), and Ex. G (attaching the December 22, 2010, version of the Privacy Policy).

As Facebook points out, the SRR does not use the term "Data Use Policy" and does not contain any other references to the Data Use Policy. MTD 11–12. Nor could it, since the Data Use Policy Plaintiffs cite and rely on did not exist until several months after Facebook published the most recent version of its SRR that Plaintiffs attach to their complaint. Plaintiffs do not address this deficiency in their opposition brief. Compare MTD 11–12 (noting that the Data Use Policy "was active starting on September 7, 2011," and that the policy "was not incorporated into any of the SRR versions attached to the TAC, and was therefore not a part of the contract"), with Opp'n 4–5 (arguing that the SRR "expressly refers to the Privacy Policy," but offering no response to Facebook's point that the Data Use Policy was not operative at the time the cited SRR was published). In addition, Plaintiffs do not allege that earlier versions of the Privacy Policy contained similar promises to not track logged-out users.⁵

As such, the Court finds that the Data Use Policy was not incorporated by reference into the SRR because the SRR did not "clearly and unequivocally" reference it. See Troyk, 171 Cal.App.4th at 1331, 90 Cal.Rptr.3d 589.

ii. The relevant Help Center pages were not incorporated by reference into the Statement of Rights and Responsibilities.

Plaintiffs also argue that various Help Center pages were incorporated by reference into the SRR. Opp'n 5–8. Facebook notes, and Plaintiffs do not dispute, that the SRR contains no direct references to any Help Center pages. See MTD 8–9 ("the SRR does not reference—or even hint at—a single one of the Help Center pages Plaintiffs quote from"); Opp'n 6 ("the Help Center pages are the third link in the contractual chain.... the Privacy Policy linked to the Help Center pages and directed users to them"). Rather, Plaintiffs' theory is that certain Help Center pages were incorporated by reference into the Privacy Policy, and that the Privacy Policy was in turn incorporated into the SRR. Opp'n 7 ("the SRR incorporates the Privacy Policy, and, in turn, the Help Center pages"); TAC ¶¶ 61 ("The Help Center pages are incorporated by reference into the Privacy Policy and are a part of the contract."), 135 (stating that two questions common...