Facebook Defeats Lawsuit Over Tracking Logged-Out Users–In re Facebook Internet Tracking
Facebook allegedly improperly tracked the activity of logged-out Facebook users on third party websites. Plaintiffs asserted claims based on common law rights and based on federal and state statutes, but the court previously rejected those. In the latest ruling, the court dismisses Plaintiffs’ claims based on breach of contract and breach of the duty of good faith.
Plaintiffs argued that Facebook promised not to track logged out users, but these promises were contained in documents other than Facebook’s terms of service (its “Statement of Rights and Responsibilities”).
Plaintiffs cited to language from Facebook’s “data use policy” stating that Facebook receives data from the websites that users visit, including “if [a user is] logged into Facebook” the user ID. The key question was whether this language was incorporated by reference into the terms of use. The court says no, because the version of the privacy policy plaintiffs point to was not in existence at the time of the relevant versions of the terms of use plaintiffs allegedly relied on. In fact, Facebook changed the title of its privacy policy to a “data use policy,” and the terms of service plaintiffs relied on did not reference a “data use policy” at all.
Plaintiffs also pointed to certain “help center pages” but the court says none of those are referenced in the privacy policy. Even to the extent the terms incorporate the privacy policy, this doesn’t help plaintiffs. Plaintiffs in response argued that all of the various help center pages are part of a “single broader document” but the court says this argument has no factual basis. The various pages have different URLs and were attached by plaintiffs as different exhibits. Moreover:
[n]o evidence suggests that a Facebook user who reads one Help Center page has also read, or is even aware of, any of the others.
Plaintiffs also relied on a breach of the duty of good faith but the court says that this duty has to be anchored to a specific contractual provision and plaintiffs cannot point to one here.
__
Ouch. As the court notes, this lawsuit has been through several rounds of motion practice. It was whittled down until it was extinguished by the most recent order. Plaintiffs have yet to file a notice of appeal, although their appeal deadline has not yet run.
That websites have not given consumers meaningful choice on being tracked while logged out is one of the great failures of modern U.S. privacy laws. This seems like a basic privacy practice that a website should make obvious to a user and allow the user to opt-out from. Yet, as this case illustrates, no rule exists to force websites to do this.
Facebook’s terms of service and related documents are voluminous, and the court appears to employ a fairly technical reading in determining whether certain help page documents form a part of the contract. You should not need to be a lawyer to figure this stuff out.
Facebook is under a 20 year consent decree with the FTC. Perhaps this activity does not come under the scope of the consent decree, because it doesn’t involve any affirmative misrepresentations or over-riding of expressed consumer preferences? Either way, this seems like the type of thing a regulator may be well suited (or perhaps better suited than the plaintiffs’ bar) to address, and which may be falling through the cracks.
Case citation: In re Facebook Internet Tracking Litig., 2017 U.S. Dist. LEXIS 190819 (N.D. Cal. Nov. 17, 2017) [pdf]
Related posts:
Facebook Privacy Class Action Filed by Lanier Firm Voluntarily Dismissed — Melkonian v. Facebook
Facebook Beats Privacy Lawsuit Alleging Persistent Tracking
Facebook and Zynga Privacy Litigation Dismissed With Prejudice [Catch up Post]