SAN FRANCISCO (CN) – A federal judge on Friday rejected Facebook’s argument that it cannot be sued for letting third parties, such as Cambridge Analytica, access users’ private data because no “real world” harm has resulted from the conduct.
“The injury is the disclosure of private information,” U.S. District Judge Vince Chhabria declared during a marathon four-and-a-half-hour motion-to-dismiss hearing Friday.
Facebook urged Chhabria to toss out a 267-page consolidated complaint filed in a multidistrict case seeking billions of dollars in damages for Facebook’s alleged violations of 50 state and federal laws.
Facebook attorney Orin Snyder, of Gibson Dunn and Crutcher in New York, insisted that his client did nothing unlawful because Facebook users volunteered to let third parties harvest their personal data through their privacy controls.
“Facebook respects the privacy of its users by honoring scrupulously the choices they make through their privacy settings,” Snyder told the judge.
But Chhabria found the wording Facebook used to alert users that their data would be shared with third parties unclear and conspicuous.
“Those disclosures are quite vague,” the judge said.
The claims against Facebook stem from a series of data privacy scandals that have rocked the social media giant over the last year. Those scandals include revelations that Cambridge Analytica obtained 87 million users’ private data through a quiz app, that Facebook-associated apps can obtain the personal data of a user’s friends without their express permission and that Facebook also shared user data with device makers and business partners without making the arrangement obvious to users.
Representing a proposed class of Facebook users, attorney Derek Loeser, of Keller Rohrback in Seattle, argued that in order to give consent, people must be adequately informed in a way that makes the agreement lawful and binding.
Loeser noted that between 2012 and 2014, Facebook didn’t even use the words “agree” or “agreement” when asking users if they read and understood their terms of service. Chhabria did not appear particularly impressed with that argument, noting that an informed user can give “implied consent.”
The plaintiffs’ lawyer also cited a number of public statements delivered by Facebook executives last year after the Cambridge Analytica scandal started capturing headlines.
Facebook CEO Mark Zuckerberg called it a “breach of trust” in a March 2018 Facebook post, the same month the company acknowledged in another blog post that “privacy settings and other important tools are too hard to find.”
But Chhabria did not interpret those comments as Facebook admitting it deceived its users about data privacy.
“The real complaint here is not that Facebook said anything misleading, but that the disclosures should have been much more prominent and clear,” Chhabria said.
Snyder protested that the plaintiffs failed to clearly identify in their lawsuit if 34 named plaintiffs had trouble finding, reading or understanding Facebook’s data policies.
At one point, Chhabria asked if a user could sue for a privacy violation if that user chose to make their account publicly accessible. Plaintiffs’ lawyer Lesley Weaver, of Bleichmar Fonti & Auld in Oakland, answered there would still be privacy claims because Facebook also made photos shared in users’ private Facebook messages available to third parties.
Before the hearing ended, Chhabria offered to let the plaintiffs file an amended complaint within 21 days instead of following the customary path of issuing a ruling first. Chhabria said it could help move the litigation along more quickly instead of waiting for a ruling. The plaintiffs agreed to take the judge up on his offer.
Weaver said her team would add new facts to the complaint about when Facebook made its default privacy setting “friends only” instead of “public” from 2012 to 2014, when the named plaintiffs switched their account settings to “friends only,” and other details on how the named plaintiffs read and interpreted Facebook’s data privacy policies.
An amended complaint is due on Feb. 22.