Williams v. Facebook, Inc., Case No. 18-cv-01881-RS

384 F.Supp.3d 1043

Anthony WILLIAMS, et al., Plaintiffs,

v.FACEBOOK, INC., Defendant.

Case No. 18-cv-01881-RS

United States District Court, N.D. California.

Signed December 18, 2018

Lawrence Timothy Fisher, Bursor & Fisher, P.A., Walnut Creek, CA, John A. Yanchunis, Pro Hac Vice, Patrick A. Barthle, II, Pro Hac Vice, Ryan McGee, Pro Hac Vice, Morgan and Morgan Complex Litigation Group, Tampa, FL, Scott Bursor, Pro Hac Vice, Neal J. Deckant, Bursor & Fisher, P.A., New York, NY, Sabita J. Soneji, Tycko & Zavareei LLP, Oakland, CA, for Plaintiffs Anthony Williams, Tyoka Brumfield, Wendy Burnett.

John A. Yanchunis, Pro Hac Vice, Patrick A. Barthle, II, Pro Hac Vice, Ryan McGee, Pro Hac Vice, Morgan and Morgan Complex Litigation Group, Tampa, FL, Joshua Haakon Watson, Clayeo C. Arnold, a Professional Law Corporation, Sacramento, CA, Sabita J. Soneji, Tycko & Zavareei LLP, Oakland, CA, for Plaintiffs Lisa Renken, Sean Mannion.

Lawrence Timothy Fisher, Bursor & Fisher, P.A., Walnut Creek, CA, Scott Bursor, Pro Hac Vice, Neal J. Deckant, Bursor & Fisher, P.A., New York, NY, Sabita J. Soneji, Tycko & Zavareei LLP, Oakland, CA, for Plaintiffs Lawrence Olin, Janice Vega-Latker, Harold Nyanjom, Sheron Smith-Jackson.

Francis J. Flynn, Jr., Law Offices of Francis J. Flynn, Jr., Los Angeles, CA, Kevin Scott Hannon, Pro Hac Vice, The Hannon Law Firm, LLC, Denver, CO, Sabita J. Soneji, Tycko & Zavareei LLP, Oakland, CA, for Plaintiff Leland Tracy.

Kevin Francis Ruf, Glancy Prongay & Murray LLP, Los Angeles, CA, Sabita J. Soneji, Tycko & Zavareei LLP, Oakland, CA, for Plaintiffs Nicole Sternemann, Phyllis Sternemann.

Kristen Law Sagafi, Sabita J. Soneji, Tycko & Zavareei LLP, Oakland, CA, Diana Janik Zinser, Pro Hac Vice, Spector Roseman and Kodroff, P.C., Philadelphia, PA, Hassan Ali Zavareei, Tycko & Zavareei LLP, Washington, DC, for Plaintiff John Condelles, III.

Elizabeth L. Deeley, Nicole Charlene Valco, Latham & Watkins LLP, San Francisco, CA, Matthew J. Peters, Susan E. Engel, Latham and Watkins LLP, Washington, DC, for Defendant.

ORDER GRANTING MOTION TO DISMISS

RICHARD SEEBORG, United States District Judge

I. INTRODUCTION

Defendant Facebook, Inc. ("Facebook") is a global social media and networking company. It owns and operates a website and smartphone applications for Android and iOS such as Facebook Messenger and Facebook Lite. In March 2018, the news website Ars Technica reported Facebook apps for Android were programmed to scrape user call and text data to monetize the information for advertising purposes. Facebook allegedly scraped data by exploiting a software vulnerability in the permission settings of older versions of the Android OS. When users installed older versions of Facebook Messenger or Facebook Lite on their Android smartphones a contact upload prompt to grant Facebook access to contact lists surreptitiously also granted access to user call and text logs. Facebook stopped data scraping once the Android OS eventually closed the vulnerability.

Plaintiffs are consumers from the states of California, Florida, Kansas, New York and Texas who bring claims for violations of California's Consumers Legal Remedies Act ("CLRA"), Cal. Civ. Code §§ 1750, et seq. ; California's Unfair Competition Law ("UCL"), Cal. Bus. & Prof. Code §§ 17200 –10; California's Computer Data Access and Fraud Act ("CDAFA"), Cal. Penal Code § 502 ; California's constitutional right to privacy; intrusion upon seclusion; trespass to personal property; New York's General Business Law ("GBL"), Gen. Bus. Law § 349; and unjust enrichment. Plaintiffs' theory of liability is Facebook failed to represent accurately or disclose it was collecting user data in violation of user privacy, and deprived users of any income generated from the use or sale of the data. Facebook's present motion seeks to dismiss all the claims without leave to amend.

Because plaintiffs do not identify in the complaint an omission or a specific misleading contact upload prompt, they fail to state their fraud-based claims with sufficient particularity. The complaint also lacks factual averments supporting an injury in fact to establish standing for the CDAFA and GBL § 349 claims. Furthermore, the GBL claim is barred by Facebook's enforceable choice of law provision. Accordingly, the motion to dismiss is granted and plaintiffs are given 21 days leave to amend.

II. FACTUAL ALLEGATIONS¹

In March 2018, Ars Technica reported Facebook was discretely collecting call and text data by exploiting a vulnerability in prior versions of the Android OS permission settings. Facebook Messenger and Facebook Lite users would receive a prompt during installation requesting permission to access their contact list. Prior to Android version 4.1, granting Facebook such access also surreptitiously granted the apps access to the user's call and text logs by default. Call logs appear to show years of incoming, outgoing, or missed calls, the date and time of each call, the number dialed, the individual called, and the duration of each call. Text logs contain similar sorts of data.

Plaintiffs aver Facebook failed to disclose its data scraping practices. Rather than granting the access solely for its friend recommendation algorithm, as a Facebook spokesperson represented, plaintiffs aver Facebook incorporated call and text logs into its user profiles to be monetized for advertising purposes. The advertising space on Facebook platforms attracts potential advertisers with the possibility to target specific demographic and interest groups based in part on the user data Facebook collects. Additionally, Facebook has entered agreements to share its user data with 61 different entities including Apple, UPS, Microsoft, Blackberry, and Samsung.

Even as the vulnerability was identified and patched in later Android versions, applications like Facebook Messenger and Facebook Lite could bypass the patch by specifying they were using an older pre-patched version of the Android Software Development Kit. It was not until October 2017 that the Android operating system fully deprecated this function in all its versions, which coincided with Facebook ceasing this means of data scraping. Recently, the Open Handset Alliance, the group responsible for developing the Android OS, also announced plans to change the permission settings in the next Android version so users will need to opt-in to share their call and text logs.

III. LEGAL STANDARD

A complaint must contain "a short and plain statement of the claim showing that the pleader is entitled to relief." FED. R. CIV. P. 8(a)(2). While "detailed factual allegations" are not required, a complaint must have sufficient factual allegations to "state a claim to relief that is plausible on its face." Ashcroft v. Iqbal , 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009) (citing Bell Atlantic v. Twombly , 550 U.S. 544, 570, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007) ). In addition, "in allegations of fraud or mistake, a party must state with particularity the circumstances constituting fraud and mistake." FED. R. CIV. P. 9(b). To satisfy this requirement, a plaintiff must plead "the who, what, when, where, and how that would suggest fraud." Cooper v. Pickett , 137 F.3d 616, 627 (9th Cir. 1997) (internal quotation marks omitted).

"A plaintiff must set forth more than the neutral facts necessary to identify the transaction. The plaintiff must set forth what is false or misleading about a statement, and why it is false." Vess v. Ciba-Geigy Corp. USA , 317 F.3d 1097, 1106 (9th Cir. 2003) (internal quotation marks and alteration omitted).

A motion to dismiss a complaint under Rule 12(b)(6) of the Federal Rules of Civil Procedure tests the legal sufficiency of the claims alleged in the complaint. See Parks Sch. of Bus., Inc. v. Symington , 51 F.3d 1480, 1484 (9th Cir. 1995). Dismissal under Rule 12(b)(6) may be based either on the "lack of a cognizable legal theory" or on "the absence of sufficient facts alleged under a cognizable legal theory." Balistreri v. Pacifica Police Dep't , 901 F.2d 696, 699 (9th Cir. 1990). When evaluating such a motion, the court must accept all material allegations in the complaint as true, even if doubtful, and construe them in the light most favorable to the non-moving party. Twombly , 550 U.S. at 570, 127 S.Ct. 1955. "[C]onclusory allegations of law and unwarranted inferences," however, "are insufficient to defeat a motion to dismiss for failure to state a claim." Epstein v. Wash. Energy Co. , 83 F.3d 1136, 1140 (9th Cir. 1996) ; see also Iqbal , 556 U.S. at 678, 129 S.Ct. 1937 ("threadbare recitals of the elements of the claim for relief, supported by mere conclusory statements," are not taken as true). A claim is facially plausible "when the pleaded factual content allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Iqbal , 556 U.S. at 678, 129 S.Ct. 1937. This standard asks for "more than a sheer possibility that a defendant acted unlawfully." Id. When plaintiffs have failed to state a claim upon which relief can be granted, leave to amend should be granted unless "the complaint could not be saved by any amendment." Gompper v. VISX, Inc. , 298 F.3d 893, 898 (9th Cir. 2002).

To establish Article III standing, a plaintiff must satisfy three requirements: (1) "the plaintiff must have suffered an injury in fact," which is concrete and particularized as well as actual or imminent; (2) "there must be a causal connection between the injury and the conduct complained of," which is fairly traceable to defendant's actions; and (3) "it must be likely, as opposed to merely speculative, that the injury will be redressed by a favorable decision." Lujan v. Defs. of Wildlife , 504 U.S. 555, 560–61, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992) (citations and internal quotation marks omitted). An injury is particularized when it "affect[s] the plaintiff in a personal and individual way," and is concrete when it is "real" as opposed...