SAN FRANCISCO (CN) – Facebook did not convince a federal judge to toss a lawsuit brought by users who say the social media platform violated their privacy rights by selling their personal information to third-party vendors like Cambridge Analytica.
U.S. District Court Judge Vince Chhabria denied Facebook’s motion to dismiss Monday, rejecting the company’s argument that people who share personal data on a social media website have no reasonable expectation of privacy.
“Facebook’s argument could not be more wrong,” Chhabria wrote in the 71-page ruling.
“When you share sensitive information with a limited audience (especially when you’ve made clear that you intend your audience to be limited), you retain privacy rights and can sue someone for violating them,” he wrote.
However, Chhabria acknowledged the social media giant made at least one compelling legal argument: Facebook users agreed to terms of service that made it lawful for the company to widely disseminate their sensitive information.
However, the terms of service applied to users from 2009 to 2015, meaning customers who signed up for Facebook before 2009 never agreed to allow Facebook to sell their data to third-party vendors, some of whom used that accumulated data for nefarious political purposes.
To the extent that users from the time period in question did agree to a terms of service amenable to dissemination of their sensitive information, Chhabria isn’t sure tucking such disclosures amid voluminous terms of service agreements sufficiently indemnifies the company.
“Even though Facebook’s arguments regarding user consent have some legal force and will somewhat limit the scope of the lawsuit, they cannot defeat the lawsuit entirely, at least at the pleading stage,” the judge wrote.
The class of Facebook users not only contend Facebook sold their private information without their consent, but also failed to prevent the third-party groups from misusing or selling that information.
The most notorious case of privacy breach as it relates to Facebook involves Cambridge Analytica, a now defunct political consulting firm that used data collected from psychological profiles in various information warfare campaigns.
President Donald Trump enlisted the services of Cambridge Analytica during his 2016 presidential campaign and the architects of Brexit also used its services in the run-up to that decisive yet divisive vote.
The plaintiffs – all current and former Facebook users – say Cambridge Analytica is one of several to whom Facebook divulged their sensitive information to third parties without consent.
They say in addition to publicly available information like names, birthdates and phone numbers, Facebook made their religious and political persuasions, videos they created or liked, photographs, relationship information and other sensitive information available to third-party vendors.
Facebook argued users had no legitimate privacy interest because they willingly share their information through social media. Chhabria shot that argument down, saying the law firmly establishes an individuals’ right to privacy when sharing certain information with a limited audience.
The social media giant also argued plaintiffs lacked standing because they suffered no injury as a result of the disclosure. The judge countered that to the extent that is true, loss of privacy is injurious in of itself regardless of whether it results in economic loss or harm.
Finally, Facebook said its terms of service disclosed the potential for users’ information to be sold to third parties. If there is no settlement in the offing and the case makes it to trial, this is likely the area where the most contested fight will occur since users who signed up for Facebook after that could argue they didn’t know the extent to which their private information could be shared.
“The complaint adequately alleges that no users ever consented to Facebook’s other information-sharing practices,” Chhabria wrote.