Filed: Dept. C11

1
Dana B. Taschner, State Bar No. 135494
LANIER LAW FIRM, PC
2
2029 Century Park East
FILED
SUPERIOR COURT OF CALIFOR IA
Suite 1400
COUNTY OF ORANGE
3
Los Angeles, CA 90067
CI!NTAAL JUSTICE CENTER
Phone: (310) 277-5100
4
Fax: (310) 277-5103
AUG 172009
dbt@1anierlawfirm.com
A~N CARLSON, Clerk of the Court
5
6
W. Mark Lanier
F. IBARRA ,DEPUTY
LANIER LAW FIRM, PC
7
6810 FM 1960 West
Houston, Texas 77069
8
Phone: (713) 659-5200
Fax: (713) 659-2204
Attorneys for Plaintiffs

10
11
SUPERIOR COURT OF THE STATE OF CALIFORNIA
12
COUNTY OF ORANGE
13
30-2009
14
ELISHA MELKONIAN, XAVIER 0., a ~ CASE NO.
00293755
15
minor by and through his guardian ad _
)) COMPLAINT FOR:
~
l
16
litem, CHRIS C., a minor by and through 1) VIOLATION OF CALIFORNIA CIVIL
CODE § 3344
17
his guardian ad litem, CATHERINE AIKO, 2) MISAPPROPRIATION OF NAME AND
18
and ELVINA BECK, ) LIKENESS
) 3) UNFAIR COMPETITION AND FALSE
19
Plaintiffs, ADVERTISING UNDER CALIFORNIA
BUSINESS AND PROFESSIONS
~
)
20
V.
CODE § 17200
21
4) VIOLATION OF CALIFORNIA
CONSTITUTIONAL RIGHT TO
22
FACEBOOK, INC., a Delaware ~) PRIVACY
5) VIOLATION OF CALIFORNIA
23
Corporation, and DOES 1-100, inclusive, ~
ONLINE PRIVACY ACT
24
Defendants, )
)
2S )
DEMAND FOR JURY TRIAL
26
)
27
--~~ -------~---------
) JUDGE l\;c~D;;7{EVI/ P. BANKS
DEPT. C11
28
Complaint for Damages and Injunctive Relief - 1

1
3 Plaintiffs ELISHA MELKONIAN, XAVIER O., a minor by and through his guardian
4 ad litem, CHRIS C., a minor by and through his guardian ad litem, CATHERINE AIKO,
5 and ELVINA BECK (collectively, “Plaintiffs’”), on behalf of themselves and the general
6 public, allege all on information and belief the following against Defendants,
7 FACEBOOK, INC., (hereinafter referred to as “Facebook”) and Does 1 through 100,
8 inclusive, for violations of California Civil Code Section 3344, California Constitutional
9 Rights of Privacy, the California Online Privacy Act, Consumer Legal Remedies Act
10 (CLRA), California Civil Code Section 1750, Unfair Competition and False Advertising
11 Under Business and Professions Code Section 17200, and other claims.
12
13 I. INTRODUCTION & SUMMARY OF ACTION

14
15 1. This is a private Attorney General action brought by on behalf of Plaintiffs

16 and the general public to remedy violations of California’s Civil Code Section 3344,
17 California Constitutional Rights of Privacy, the California Online Privacy Act, Consumer
18 Legal Remedies Act (CLRA), California Civil Code Sections 1750 et seq, and the Unfair
19 Trade Practices Act, California Business & Professions §17200, arising out of
20 Defendants’ commercial misappropriation of Plaintiff’s’ names, photographs, likenesses,
21 and private information. Plaintiffs relied on Defendant’s misrepresentations and
22 omissions of material facts, and violations of California’s privacy and right of publicity
23 laws.
24 2. Facebook is the nation’s foremost social networking website. It is owned
25 and operated by Facebook, Inc. Facebook markets itself as a social utility that connects
26 people with friends and others who work, study and live around them. Facebook has
27 become one of the fastest growing websites with reports of a million new Users signing
28 up each week. It is now one of the top websites in the U.S. with more than 250 million

1 Users. Much of that phenomenal growth can be attributed to Users’ trust in the
2 company’s privacy assurances. Users are led to believe that access to the data they
3 post is limited to other Users they have expressly authorized.
4 3. Facebook’s business model, however, has transformed from that of a
5 social network into that of a a data mining company. Facebook actively seeks to open
6 and/or disseminate private information to third parties for commercial purposes and
7 economic benefit.
8 4. Facebook’s interface and website architecture – whereby Users accept or
9 ignore “friend” requests with the expectation that personal data is shared only with
10 authorized “friends” – causes Users to believe and understand that personal information
11 and photos uploaded to Facebook are private. Users may be unaware that data they
12 submit, or that data others submit about them, may be extracted and then shared,
13 stored, licensed, or downloaded by other persons or third parties they have not
14 expressly authorized.
15 5. On information and belief, Plaintiffs allege that Facebook’s license
16 agreement amounts to effective ownership and perpetual title to all data uploaded to
17 Facebook by any source even if a Facebook User terminates service. On information
18 and belief, Plaintiffs allege that Facebook has ignored or failed to comply with User
19 requests to cease and desist posting of personal or private information including posting
20 of photographs or images owned by Users or depicting Users.
21 6. Original work, in the form of writings or photographs or other images in
22 any tangible medium including the Internet is protected by state and federal law upon
23 creation. Uploading or downloading of protected works without the authority of the
24 creator or owner is an infringement of that creator or owner’s exclusive right of
25 reproduction and distribution. State and federal laws protect publicity rights, as well as
26 ownership rights such as copyright.
27
28

1 7. Plaintiff Elisha Melkonian is a resident of Orange County and
2 accomplished photographer. She is a member of the Photo Laureates, Photographic
3 Society of America, the American Society of Picture Professionals, and Women in
4 Photography International. Plaintiff Melkonian specializes in digital photography and
5 has photographed people and landscapes throughout the United States and abroad.
6 Her exclusive ownership of her photographs is protected by federal copyright law, which
7 prohibits the uploading or downloading of her work without her permission. Plaintiff
8 Melkonian has observed her digital images posted on Facebook without her consent,
9 knowledge or compensation. Plaintiff Melkonian has sought to protect her images and
10 prevent the downloading and dissemination of her photographs on Facebook through
11 various efforts and the Facebook interface without success. Plaintiff Melkonian has
12 joined more than 150,000 Facebook Users in providing notice to Facebook to change
13 the unconscionable language of the Facebook Terms and Conditions and Policies
14 policies, in that that she owns the copyright and all rights concerning her photographs,
15 and demands that Facebook not sell or distribute her photographs and change the
16 Facebook Terms and Conditions.
17 8. Plaintiff Xavier O. is an 11-year-old minor residing with his parents in
18 Orange County, California. Plaintiff Xavier O. has a Facebook account that was opened
19 without the knowledge or consent of his parent or guardian. Plaintiff Xavier O. has
20 uploaded personal information, videos and photographs, including swimming and/or
21 partially clothed photographs of children ages 5 to11. On or about August 8, 2009,
22 Plaintiff Xavier O. posted “Xavier O. has swine flu…Please pray for me…God Bless.”
23 Upon learning of the Facebook account and the posting of an uncertain medical
24 condition, Plaintiff Xavier O’s parents removed the medical condition posting from
25 Facebook. Xavier O. and his parents have been unable to learn where the minor’s
26 medical information may have been stored, disseminated or sold by Facebook.
27 9. Plaintiff Chris C. is a 12-year-old minor residing with his parents in Orange
28 County, California. Plaintiff Chris C. has a Facebook account that was opened without

1 the knowledge or consent of his parent or guardian. Plaintiff Chris C. has uploaded
2 personal information including photographs.
3 10. Catherine Aiko is a college student. She joined “a Mark Zuckerberg
4 production” called “Thefacebook” in or about May 2005, and was required to have a
5 verified college email to join. Thefacebook of 2004 and/or 2005 states Thefacebook is
6 “an online directory that connects people through social networks at schools” that
7 “prides itself in being a positive environment for peers to safely interact.” Thefacebook
8 of 2004 and/or 2005 states it was “limited to your own college or university, and
9 “members” could “use Thefacebook to: Search for people at your school, Find out who
10 is in your classes, and Look up your friends' friends.” The Terms and Conditions of 2004
11 and 2005 changed over time and at various dates stated “You may remove your
12 Member Content from the site at any time. If you choose to remove your Member
13 Content, the license granted…will automatically expire.”
14 11. In 2004 and/or 2005, Facebook generally limited and grouped college
15 students into Facebook “networks” and limited User functions. “TheFacebook.com”
16 changed to Facebook.com during Plaintiffs Use. The Facebook Terms and Conditions
17 and User interface have changed several times and without notice to, or consent of,
18 Plaintiffs since 2004.
19 12. Plaintiff Elvina Beck is an accomplished actress and model residing in Los
20 Angeles, California. Plaintiff Beck has multiple commercial representatives/agents for
21 print, commercial and theatrical work. Plaintiff Beck’s name, likeness and photos are
22 highly valuable commercial assets. Plaintiff Beck appears in national print
23 advertisements, commercials and films, and she is compensated for such work. Beck’s
24 filmography includes Love Hurts, Privileged, CSI: New York, and ESPN 25. Plaintiff
25 Beck’s digital images have been disseminated by Facebook without her consent,
26 knowledge, or compensation.
27 13. Facebook has been changing its Terms of Service and privacy settings of
28 existing Users to make posted content – thought by Facebook Users to be private –

1 more broadly disseminated and available online without User consent or knowledge for
2 the purpose of increasing the use of the consumer data and the economic value of
3 Facebook.
4 14. On information and belief, Facebook is aware that consumers do not want
5 to have personal and private information disseminated without consent. On information
6 and belief, Plaintiffs assert that Facebook has received thousands of complaints from
7 consumers concerning unauthorized publication and use of private information and
8 photos.
9 15. On February 4, 2009, Facebook revised its Terms of Service, a document
10 Facebook asserts it is legally permitted to update “AT ANY TIME WITHOUT
11 INFORMING USERS.” On or about April 24, 2009, Facebook again revised the Terms
12 of Service. In response to Facebook’s changing Terms of Service, more than 2,500,000
13 Users joined the group MILLIONS AGAINST FACEBOOK’S NEW LAYOUT AND
14 TERMS OF SERVICE, and more than 130,000 Users have joined the group “People
15 Against the New Terms of Service.” Additionally, more than 150,000 Users have joined
16 the group “My Photos are MINE! Change the Terms and Conditions,” and more than
17 50,000 have joined the group “Facebook: Do Not Sell My Private Pictures: Change your
18 Terms of Use NOW!”
19 16. Based upon the obligations imposed upon Defendants and their
20 experience in the industry, Defendants either knew, recklessly disregarded, reasonably
21 should have known or were obligated under the law to understand that their systemic
22 personal and private data collection, harvesting, manipulation, distribution, and
23 commercialization activities violated state consumer protection, privacy, and right of
24 publicity laws.
25 17. Such conduct is of a continuing nature and requires prompt relief in order
26 to prevent further undisclosed or unauthorized harvesting, warehousing, dissemination,
27 and commercialization of private and personal data. The urgency of such relief is
28 underscored by the fact that once data is distributed to third parties and across

1 computer networks outside of Facebook’s control, such data becomes impossible to
2 retrieve or purge.
3 18. Facebook users face irreparable harm in terms of, inter alia, not being fully
4 informed of the true facts, not having the full value of any monies wrongfully received by
5 Facebook or third parties as a result of the unauthorized commercial use of their identity
6 or likeness, having their personal and private of data distributed or reproduced without
7 their informed consent, and having the offending materials still publicly available,
8 accessible and usable.
9 19. Damages and equitable relief are appropriate and required to protect
10 consumer, privacy, and publicity rights of millions of existing and prospective future
11 Users. Equitable relief is appropriate to ensure adequate and effective policies,
12 technologies, and controls are in place to ensure the wrongful acts, including
13 concealment and misrepresentation, infringement of privacy rights, and
14 misappropriation of publicity rights that occurred are remedied and do not recur, and
15 that the true facts are revealed to the public. In addition, any monies Defendants
16 wrongfully obtained as a result of these wrongful practices rightfully belong to the
17 Plaintiffs and other victims.
18
19 II. DEFENDANT PARTIES

20
21 20. Defendant Facebook, Inc. is a Delaware corporation with its principal

22 place of business in Palo Alto, California. Facebook’s web address is
23 www.facebook.com.
24 21. Plaintiff is informed and believes and based thereon alleges that each of
25 the fictitiously named Defendants is responsible in some manner for the occurrences,
26 acts and omissions alleged herein and that Plaintiff’s damages were proximately caused
27 by their conduct. For convenience, each reference to a named Defendant herein shall
28 refer to the Doe Defendants and each of them.

1
2 III. JURISDICTION AND VENUE

3
4 22. This Court has jurisdiction over all causes of action asserted herein
5 pursuant to the California Constitution, Article VI, §10, and California Civil Code § 3344,
6 and Consumer Legal Remedies Act (CLRA), California Civil Code Section 1750.
7 23. This Court has jurisdiction over the claims asserted and each of the
8 Defendants because each are individuals, associations or corporations that are either
9 based in, authorized or registered to conduct, or in fact do conduct, substantial business
10 in the State of California. Each of the defendants has sufficient minimum contacts with
11 California, or otherwise intentionally avail themselves of the markets within California,
12 through collecting monies, entering into contracts and/or distributing their products or
13 services in California to render the exercise of jurisdiction by the California courts
14 permissible under traditional notions of fair play and substantial justice. No state or
15 federal regulatory agency has primary, exclusive or any jurisdiction over the claims at
16 issue herein and/or is able to provide the complete relief prayed for in this matter.
17 24. Venue is proper in this County as the acts upon which this action is based
18 occurred in part in this County. Plaintiffs reside and/or work in this County, and one or
19 more of the Defendants received substantial compensation and profits from entering
20 into agreements and/or the sale of their products or services to persons located in this
21 County, caused misrepresentations to be disseminated, entered into transactions and/or
22 provided services in this County. Defendants’ liability arose in part in this County.
23
24 IV. BACKGROUND AND FACTS

25 A. FACEBOOK BACKGROUND AND FEATURES
26 25. Founded in 2004 as a social networking site for college students with a
27 web address of http://www.facebook.com, Facebook is operated and privately owned by
28 Facebook, Inc.

1 26. Facebook’s website allows members to communicate and share
2 information with friends, family, coworkers, classmates, and other people who share
3 similar interests or activities, or who are interested in exploring the interests and
4 activities of others. Facebook Users can create a personal profile, and post messages,
5 photos and videos. Users can add friends and send them messages, and update their
6 profiles to notify friends about themselves. Additionally, Users can join networks
7 organized by city, workplace, school, and region.
8 27. Facebook’s website states that, “Facebook is a social utility that helps
9 people communicate more efficiently with their friends, family and coworkers. The
10 company develops technologies that facilitate the sharing of information through the
11 social graph, the digital mapping of people’s real-world social connections. Anyone can
12 sign up for Facebook and interact with the people they know in a trusted environment.”
13 28. Facebook claims more than 250 million active Users and more than 120
14 million of those Users log on to Facebook at least once each day. Recent statistics
15 published by Facebook indicate that approximately 850 million photos are uploaded to
16 Facebook each day, more than one billion pieces of content (web links, news stories,
17 blog posts, notes, photos, etc.) are shared each week, and more than 2.5 million events
18 are created each month.
19 29. A person may join Facebook by signing up for an account on the
20 Facebook website. Registration is free and typically only takes a few minutes.
21 Registration requires the providing of a name, gender, date of birth and a valid email.
22 Registered Users are asked to provide the name of their high school, college, and
23 employer to create a User profile. Users can expand their profile by adding information
24 about various interests and hobbies. They can also add contact information including
25 address, website, email and phones numbers.
26 30. Users can find friends in several ways. A User can browse and join
27 networks, which are organized into four categories: regions, high schools, colleges, and
28 workplaces. Once a User joins a network, they are able to browse through the list of

1 members and search for people they know. In addition, Users can let Facebook pull
2 contacts from a Web-based email account. In order to do this, Users must give
3 Facebook their email address and password. Facebook uses a program that searches
4 through the User’s email contacts and compares the list against its membership
5 database. If Facebook discovers a match, it gives the User the option to add that person
6 as a friend. In addition, Users can type a person’s name into Facebook’s search engine,
7 and Facebook will display any profiles that match the name.
8 31. Facebook’s website incorporates various features, many of which provide
9 detailed deep data specific to each individual, data that is highly valuable to Facebook
10 and to third parties. One feature is a “wall,” which is a space on every User's profile
11 page that allows friends to post messages for the User to see. Another feature is a
12 “news feed” and "mini feed" section, which displays updates regarding information or
13 content (notes, photos, etc.) added to a User profile. Other features include a “photo”
14 application that allows Users to upload an unlimited number of photos and tag (or
15 associate) such photos with another Facebook User. A “video” application allows
16 members to upload videos. A “groups” application allows Users to join other members’
17 groups or create a group of their own. An “events” application allows Facebook Users to
18 invite other members to a real-life gathering. A “marketplace” application allows Users
19 to connect with other Users who want to buy or sell items, much like classified ads. A
20 “posted items” application allows Users to post or hyperlink almost any content from a
21 Web page to their profile. A “gifts” application, allows Users to send other Users a virtual
22 gift in the form of a small icon. A “status” application acts a mini blogging tool that allows
23 Users to inform their friends of their current whereabouts, actions, or thoughts. A “chat”
24 application is an instant messaging tool allowing one User to directly text messages to
25 another User. These are applications developed by Facebook and are available to all
26 members.
27 32. In addition to first-party applications developed by Facebook, Facebook
28 has also allowed third-party developers to create additional applications, such as

1 games, horoscopes, quizzes and other interactive features. These applications may
2 also provide valuable data. According to the Facebook website, there are “more than
3 one million developers and entrepreneurs from more than 180 countries” and more than
4 “350,000 active applications currently on Facebook Platform.” Every month, more than
5 70% of Facebook Users engage with Platform applications and “more than 200
6 applications have more than one million monthly active Users.” Third-party developers
7 generate income from such applications through built-in advertising for products or
8 services. According to a Facebook developer blog, applications “range from simple
9 applications created by single Users to share with their friends to impressive businesses
10 employing hundreds of people and reaching tens of millions of Users every month and
11 generating tens of millions of dollars of revenue.”
12 33. Facebook permits integration and exchange of data with third-party
13 websites through Facebook’s “Connect” service. Facebook Connect enables Users to
14 log in to affiliated sites using their Facebook account and share information from such
15 sites with their Facebook friends.
16 34. Facebook generates revenue primarily through various types of
17 advertisements which are targeted to Users based on User profiles, demographics, and
18 in some instances information culled from Users’ personal data and/or their friends’
19 data. Some advertisements may use a User’s likeness or name to market products or
20 services to other Facebook members in that Users’ friends’ list or network. Another
21 advertising technology developed by Facebook called “Beacon” allows the tracking and
22 capture of information from Facebook from external websites. Such information, which
23 may include purchase data or other actions taken by Facebook Users, are used to
24 target and advertise products to other Facebook Users.
25 35. On August 10, 2009, Facebook acquired FriendFeed, Inc., which provides
26 additional technologies to facilitate the capture and consolidation of information from
27 FriendFeed and Facebook Users across a wide range of websites, blogs, and other
28 online sources of information.

1
2 B. FACEBOOK VIOLATES THE PRIVACY RIGHTS OF FACEBOOK USERS

3 36. The right of privacy is a personal and fundamental right in the law of
4 California and the United States. The privacy of an individual is directly affected by the
5 collection, use, and dissemination of personal information. The opportunities for an
6 individual to secure employment, insurance, and credit, to obtain medical services, and
7 the rights of due process may be jeopardized by the misuse of certain personal
8 information. Further, the rapid growth and popularity of social networking sites has
9 facilitated and increased the likelihood of identity theft, cybercrime, and online sexual
10 predation.
11 37. Even as an increasing number of consumers rely on the Internet and new
12 technologies for communication, information, entertainment, and to perform
13 transactions, the vast majority of consumers are concerned about how their personal
14 information is being used and expect and desire greater privacy protections.
15 38. Several recent polls establish that most Americans are concerned about
16 what is being done with their personal information online. An April 2007 UPI-Zogby
17 International poll, found that 91% of respondents said they are concerned that their
18 identity might be stolen and used to make unauthorized purchases. In addition, 85% of
19 respondents said privacy of their personal information is important to them as
20 consumers.
21 39. A September 2008 poll by the Pew Research Center found that 90% of
22 respondents said that they “would be very concerned if the company at which their data
23 were stored sold it to another party” and 80% say “they would be very concerned if
24 companies used their photos or other data in marketing campaigns.”
25 40. A poll by the Consumer Reports National Research Center showed that
26 72% of respondents are concerned that their online behaviors were being tracked and
27 profiled by companies. The poll also found that while 68% percent of consumers have
28 provided personal information in order to access a website, 53% are uncomfortable with

1 internet companies using their email content or browsing history to send relevant ads,
2 and 54% are uncomfortable with third parties collecting information about their online
3 behavior. The poll also found that 93% of Americans think Internet companies should
4 always ask for permission before using personal information. According to one policy
5 analyst, “Americans are clearly concerned with how their personal information is being
6 collected and used by internet companies...The vast majority of consumers want more
7 control over their personal information online and want the ability to stop Internet
8 companies from tracking and profiling them.”
9 41. The interests of many Internet-based businesses are often in direct
10 conflict with consumers’ privacy rights. Personal consumer data is a highly valuable
11 commodity – it is used by businesses to profile consumers, predict consumer behavior
12 and to target and market to consumers more effectively. Such personal data is often
13 harvested, sold, or licensed to other businesses. The valuation of many companies is
14 based in no small part by the amount of useful data that they can compile and
15 effectively utilize. Thus, whereas consumers desire to limit the dissemination and use of
16 their private and personal data due to privacy concerns and fears of identity theft and
17 cybercrime, online businesses have a huge financial disincentive to satisfy consumer
18 privacy expectations and limit the collection and use of personal User data.
19 42. Plaintiffs and the general public desire and expect a level of privacy, which
20 Facebook has failed to satisfy under its current policies, procedures, practices, and
21 technology. Plaintiffs allege that all Facebook users have individual and valuable
22 property rights in their personal and private data which entitle them to make informed
23 decisions about what or which personal data may be revealed, disseminated, stored,
24 licensed, transferred, or sold, and to what businesses or firms, and for what purposes.
25 43. Facebook has been repeatedly condemned by Facebook Users, and
26 numerous consumer rights and privacy advocates for unclear or vastly overreaching
27 policies, practices, and technologies which jeopardize or compromise the safety of
28

1 personal and private User data, and which violate, infringe, and erode Users’ privacy
2 rights and expectations.
3 44. In November 2007, the non-profit public advocacy group MoveOn.org
4 denounced Facebook's tracking and advertising technology, which notified Facebook
5 Users about purchases made by people on their friends list.
6 45. On May 31, 2008, the Canadian Internet Policy and Public Interest Clinic,
7 filed a complaint with the Office of the Privacy Commissioner against Facebook, based
8 on 22 breaches of the Canadian Personal Information Protection and Electronic
9 Documents Act. On July 16, 2009, the Canadian Privacy Commissioner issued a report
10 concluding that several of the allegations were well founded and required action in order
11 to protect the privacy rights of Facebook Users. A true and correct copy of the Canadian
12 Internet Policy and Public Interest Clinic Facebook Complaint dated May 30, 2008 is
13 attached hereto as Exhibit A.
14 46. In February 2009, The Electronic Privacy Information Center (EPIC)
15 prepared a formal complaint with the Federal Trade Commission (FTC) over
16 Facebook’s new Terms of Use and Privacy Policy, which granted Facebook a perpetual
17 and irrevocable license over User content. In response to threat of a lawsuit and User
18 furor over the onerous new terms and policies, Facebook revised its Terms of Use.
19 47. In March 2009, the University of Cambridge issued a report criticizing the
20 misleading, contradictory, and unworkable nature of Facebook current revised policies.
21 The report also gained the support of the non-profit privacy advocate group Open
22 Rights Group. A true and correct copy of the University of Cambridge Computer
23 Laboratory Report dated March 29, 2009 is attached hereto as Exhibit B.
24 48. On June 12, 2009, the Data Protection Working Party, working under the
25 European Commission, Directorate General Justice, Freedom and Security adopted
26 Opinion 5/2009 on online social networking (EU Opinion) concerning emerging concern
27 over processing of sensitive personal information and images, retention of personal
28

1 information and images, and advertising and marketing of data collection on social
2 networks. A true and correct copy of the EU Opinion is attached hereto as Exhibit C
3 49. On July 16, 2009 the Assistant Privacy Commission of Canada issued the
4 Report of Findings Into the Complaint if Filed By the Canadian Internet Police and
5 Public Interest Clinic (CIPPIN) against Facebook Under the Personal Information
6 Protection and Electronic Documents Act (Canadian Findings). A true and correct copy
7 of the Canadian Findings is attached hereto as Exhibit D.
8 50. Many Facebook Users are under 18. Plaintiffs allege on information and
9 belief that millions of Facebook Users are under the age of 13, and that Facebook is
10 aware that many Users are underage. Minors do not have the legal or mental capacity,
11 bargaining ability or expertise in privacy issues to understand the significance of the
12 loss of control or dissemination or sale of their private and personal data, or to
13 understand the complex, misleading, confusing, and changing nature of the policies and
14 privacy settings of Facebook.
15 C. FACEBOOK IS A DATA MINING COMPANY THAT AGGRESIVELY SEEKS THE
16 ACQUISITION AND USE OF PRIVATE AND PERSONAL USER DATA WITHOUT
17 THE KNOWLEDGE OR CONSENT OF USERS
18 51. Data mining is a well established multi-billion dollar industry. Data mining
19 is the process of collecting, harvesting, refining, and selling the commodity of data and
20 information. Recent federal court decisions have determined that data mining is
21 “conduct.” At least 15 states have adopted some type of privacy law preventing
22 disclosure of personal data.
23 52. In 2007, the Facebook data processing infrastructure was created around
24 a data warehouse built using a commercial relational database management system
25 (RDBMS), which extracts, sorts, analyzes, and optimizes data. Collection of data was
26 accelerated and Facebook data grew from a 15TB (a terabyte is a unit of digital data
27 storage equal to 1000 gigabytes. A gigabyte is 1,000,000,000 bytes) in 2007 to a 2PB
28 (a petabyte is a unit of information or computer data storage equal to one quadrillion

1 bytes) as of July 2009, or +13,233.3% increase in digital data collection in the last two
2 years.
3 53. The Facebook infrastructure in 2007 was such that some daily data
4 processing jobs were taking more than a day to process. Facebook determined it would
5 create an infrastructure capable of collecting, harvesting, and mining data at an
6 unprecedented level.
7 54. Facebook created a Data Team and hired data analysts to enable the
8 collection, management, analysis, shaping and exploitation of User data. One of the
9 defined cores values of the Data Team is “Move Fast” to collect, analyze and mine data
10 to make Facebook decisions. The Facebook Data Team is seeking to hire people who
11 “move fast and want to be a data ninja.” The Facebook Data Infrastructure Team has
12 created sophisticated tools like Hive and HiPal to maximize data collection, extraction,
13 analysis and mining. Facebook has a 600 machine cluster with 4800 cores and more
14 than 2PB raw storage, and each node has 8 cores and 4TB of storage, to crunch data
15 and mine personal information provided by Users. Facebook uses Hadoop to store
16 copies of internal log and dimension data sources and use it as a source for
17 reporting/analytics and machine learning.
18 55. Facebook uses streaming and Java Application Programming Interface
19 (“apis”). Facebook has built a high level data warehousing framework using these
20 features called Hive (http://hadoop.apache.org/hive/). Facebook has also developed a
21 FUSE implementation over Hadoop Distributed File System (“hdfs”).
22 56. The Hive/Hadoop cluster at Facebook stores more than 2PB of
23 uncompressed data and routinely loads 15TB of data daily. Facebook is spending
24 approximately $20 million to $25 million a year on data center space, and approximately
25 $500,000 per month for bandwidth.
26 57. Facebook is now permitting third party data mining of personal information
27 with data extraction instruction publicly available over the Internet.
28 (http://programmaremobile.blogspot.com/2009/01/facebook-java-apieng.html).

1 58. Facebook is engaged in unprecedented high-volume, large-scale, data-
2 intensive data mining processing. Facebook is posturing to fully exploit its data mining
3 ability and marketing analytics.
4 59. Data mining businesses employ various technologies, techniques, and
5 practices in order to collect and analyze vast amounts of consumer data for the purpose
6 consumer surveillance, predicting consumer behavior, profiling consumers, and
7 increasing marketing effectiveness. Consumer data is a highly valuable product and
8 companies pay large sums to access and utilize such data. Many states are seeking to
9 ban or limit certain data mining practices using rights of privacy and confidentiality
10 rubrics.
11 60. Facebook presents itself as a social network service, and values itself as a
12 marketing and data mining company that values and collects enormous amounts of
13 personal consumer information and uses such data to increase and measure company
14 value. Facebook’s business model and technologies are intentionally designed to
15 collect maximum amounts of highly valuable and uniquely identifiable personal and
16 personal data.
17 61. Facebook intentionally and aggressively seeks to increase company value
18 and revenues by engaging in a pattern and practice of collecting, harvesting, storing,
19 mining, using, manipulating, disseminating, and commercializing highly valuable
20 personal, private, and uniquely identifiable information and data, including but not
21 limited to written content, photographs and other images, video, and other properties
22 such as names, phone numbers, birthdays, schools, relationships, health and activities,
23 without consumer consent, understanding or knowledge of such uses by Users.
24 62. The market and financial incentives for Facebook to collect, harvest, mine,
25 and process personal data are high. Facebook’s website and business architecture is
26 designed in significant part to collect User information and extract high value objects or
27 data that have commercial value. The data collected is a primary component of the
28

1 Facebook business model and comprises a significant part of the value of Facebook’s
2 assets.
3 63. On information and belief, data collected from Facebook Users is the key
4 commercial asset that Facebook uses for market valuation, internal marketing
5 purposes, and for licensing and/or direct or indirect sale of data to third parties.
6 64. Facebook has an enormous financial incentive to collect and manipulate
7 private and personal information. Facebook gains the full benefit and value of using the
8 private and personal information when company assets are valued, and when it
9 receives fees from, or directly or indirectly sells or provides the data to third parties.
10 Facebook rarely suffers losses from the disclosure of personal and private data as
11 Facebook customers are often not aware of the disclosure of their personal or private
12 data, and the Facebook User is unable to control or discipline Facebook for such
13 disclosure.
14 65. As a consequence of Facebook allowing Users to access use and upload
15 private and personal information on Facebook, Users are effectively assigning valuable
16 property and privacy rights to Facebook without consent, knowledge, understanding, or
17 consideration. Facebook Users, including minors, have unknowingly assigned valuable
18 property rights to Facebook and such rights, data, and information constitute the core
19 value of Facebook. Facebook has failed to compensate in any way Facebook Users for
20 such rights.
21 66. Facebook intentionally harvests and extracts personal information through
22 the hiring of employees and analysts skilled and committed to such enterprise. On
23 January 27, 2007, Facebook advertised on BlogSpot, seeking an expert is “data mining”
24 and other areas:
25
“Facebook is seeking a Data Analyst with strong communication skills and
26 a mild obsession with extracting useful information from data. The ideal
candidate will...be interested in the business and product of an online
27 social network while having a passion for data analysis and visualization.
28
Responsibilities

• Work closely with business Users and product managers to
1
determine how the data we collect could help solve their problems
2 • Apply your expertise in statistical inference, data mining, and the
presentation of data to help inform and support our business and
3 product decisions
• Work with the data infrastructure team to translate the business
4
requirements into technical specifications
5 • Possess a thorough understanding of our data collection methods
• Develop reports and monitor the validity of the data being reported
6
7
Requirements
8 • Data junkie
• The ability to communicate the results of your analyses in a clear
9 and effective manner
10
• Crazy Excel skills or experience with data reporting and analysis
tools such as Spotfire, Business Objects, Cognos, Tableau, et al.
11 • Experience with R, Matlab, SAS, SPSS, or a similar tool for data
analysis
12
• Understanding of the methodologies of the major internet audience
13 measurement firms: comScore Media Metrix, Nielsen//NetRatings,
Hitwise, Quantcast, Alexa, Compete
14 • Basic knowledge of relational databases and SQL
• Strong willingness to contribute to a small team”
15
16 (http://statjobs.blogspot.com/2007/01/data-analyst-data-insight-
group.html - accessed on August 12, 2009)
17
18 A true and correct copy of Facebook’s Analytic Talent/Data Analyst/Data Insight Group
19 job posting on www.DataShaping.com and accessed on www.blogspot.com is attached
20 hereto as Exhibit E.
21 E. FACEBOOK TERMS OF USE AND PRIVACY POLICIES ARE INCOMPLETE,
22 MISLEADING, DECEPTIVE, AND UNFAIR
23 67. Facebook has made numerous changes to it Terms of Use and Privacy
24 Policy, often in response to scathing criticism from privacy advocates, watchdog groups,
25 and Users wronged or harmed as a result of Facebook’s policies and practices.
26 68. On February 4, 2009, Facebook updated its Terms of Use granting
27 Facebook a perpetual, irrevocable license to use any type of User data in almost any
28 manner it wishes. The Terms of Use, in relevant part, stated:

1
2 “You hereby grant Facebook an irrevocable, perpetual, non-exclusive,

3 transferable, fully paid, worldwide license (with the right to sublicense) to (a) use,
4 copy, publish, stream, store, retain, publicly perform or display, transmit, scan,
5 reformat, modify, edit, frame, translate, excerpt, adapt, create derivative works
6 and distribute (through multiple tiers), any User Content you (i) Post on or in
7 connection with the Facebook Service or the promotion thereof subject only to
8 your privacy settings or (ii) enable a User to Post, including by offering a Share
9 Link on your website and (b) to use your name, likeness and image for any
10 purpose, including commercial or advertising, each of (a) and (b) on or in
11 connection with the Facebook Service or the promotion thereof.”
12
13 69. The revised Terms of Use temporarily deleted the following key language
14 which limited Facebook’s license over Users’ personal data: “You may remove your
15 User Content from the Site at any time. If you choose to remove your User Content, the
16 license granted above will automatically expire, however you acknowledge that the
17 Company may retain archived copies of your User Content.”
18 70. Facebook did not actively notify Facebook Users of this major policy
19 change. The changes went into effect on February 4, 2009, and went unnoticed until
20 Chris Walters, a blogger for the consumer-oriented blog, The Consumerist, noticed the
21 change on February 15, 2009.
22 71. Not surprisingly the change in terms created outraged response from
23 privacy advocates and millions of Facebook Users and the general public. The new
24 policies prompted The Electronic Privacy Information Center (EPIC) to prepare a formal
25 complaint with the Federal Trade. In response to the threat of mass Facebook User
26 revolt and litigation, Facebook changed its policies to something ostensibly less
27 invasive.
28

1 72. In spite of the change, the current Terms or Use (alternately referred to as
2 “Statement of Rights and Responsibilities”) and Privacy Policy remain confusing and
3 misleading to vast majority of users and fail to give users adequate information to make
4 an informed decision regarding the use, dissemination, and security of their valuable
5 personal and private data. Furthermore they continue to grant Facebook vast control
6 over the use, transfer, and retention of personal and private information.
7 73. Significant language regarding the licensing of personal User data to
8 Facebook has been subtly altered to the following:
9
10 “For content that is covered by intellectual property rights, like photos and videos
11 ("IP content"), you specifically give us the following permission, subject to your
12 privacy and application settings: you grant us a non-exclusive, transferable, sub-
13 licensable, royalty-free, worldwide license to use any IP content that you post on
14 or in connection with Facebook ("IP License"). This IP License ends when you
15 delete your IP content or your account (except to the extent your content has
16 been shared with others, and they have not deleted it).”
17
18 74. Facebook’s asserts the license to use content covered by intellectual

19 property rights such as photos and video (“IP content”) ends when the User deletes the
20 content or their account. However, both the Facebook Terms of Use and Privacy Policy
21 do not clearly specify how Facebook may retain or use other types of important
22 information not strictly defined as “IP content,” which presumably may include a
23 multitude of valuable and sensitive information such as a User’s name, contact
24 information, date of birth, email, gender, schools attended, occupation, addresses,
25 phone numbers, demographic information, hobbies, interests, groups, organizations,
26 and information about friends, family or coworkers. Furthermore, the term “IP content” is
27 ambiguous. There is no indication whether highly personal communications such as
28 messages, chats, activities, comments, and posts are subject to the limited “IP content”

1 license. Thus, under the current terms, Facebook does not specify the rights it asserts
2 over non “IP content” or other personal and private information.
3 75. The Facebook Privacy Policy in effect at time of the filing of this Action
4 also allows Facebook to collect, aggregate and use information about users from
5 virtually any source. The policy states in relevant part:
6
7 “We may use information about you that we collect from other sources, including
8 but not limited to newspapers and Internet sources such as blogs, instant
9 messaging services, Facebook Platform developers and other Users of
10 Facebook, to supplement your profile.”
11
12 76. The Facebook policy, in combination with Facebook’s sophisticated data

13 harvesting technologies, enables Facebook to compile unprecedented amounts of
14 information about individuals from various sources not disclosed or expressly allowed
15 by Users.
16 77. On August 10, 2009, Facebook, Inc. acquired FriendFeed, Inc., which
17 provides numerous data harvesting technologies including a real-time feed aggregator
18 that consolidates the updates from numerous social media and social networking
19 websites, social bookmarking websites, blogs and micro-blogging updates, as well as
20 other types of information feeds. The combined technologies of Facebook and
21 FriendFeed enable Facebook to collect unprecedented amounts of personal information
22 from millions of Internet Users across a broad spectrum of online sources. The
23 acquisition of FriendFeed enables to Facebook to greatly expand the breadth and value
24 of its personal data harvesting operations and further violates and threatens the privacy
25 rights and security of millions of Users.
26 78. The Facebook website represents that, “Facebook does not sell your
27 information” and “Facebook doesn’t sell your information to advertisers.” Tellingly, this
28

1 statement does not appear in either the Terms of Use or Privacy Policy, nor does the
2 statement establish that Facebook will never sell Users’ information.
3 79. The statement that “Facebook does not sell your information” is
4 misleading, and false. The company’s valuation, advertising revenue, and income is
5 fundamentally tied to Facebook’s unprecedented private and personal data collection
6 and harvesting practices and the distribution, licensing, and/or direct or indirect sale of
7 said data to advertisers, affiliates, and third party developers and content providers.
8 80. The representation that “Facebook does not sell your information” is false
9 and contradicts the provision in the Terms of Use directed at Developers and Operators
10 of Applications and Websites which states, “We do not guarantee that Platform will
11 always be free.” As discussed in greater detail below, third-party developers have
12 almost unlimited access to User data. Thus, should at any future time Facebook begin
13 to charge third-party developers or affiliates for their use of the Facebook website or
14 platform, they will essentially be profiting from the transfer and use of User data by
15 those third parties.
16 81. Facebook has misled Users with policies, statements and languages that
17 imply that Users have control over their personal data. Facebook has also misled
18 Facebook Users and the public by representing that the governance of Facebook and
19 policy changes are a democratic process dependent on Users’ comments, input, and
20 consent.
21 82. In response to the public outage caused by the February 2009 policy
22 language changes, Facebook has temporarily updated the “Amendments” section of
23 their Terms of Use (also called the “Statement of Rights and Responsibilities”). The
24 “Amendments” discusses Facebook Users’ participation in the adoption of new policies.
25 Plaintiffs allege that the language was created for the primary purpose of assuaging the
26 fears of privacy advocates and Facebook Users stemming from the highly disapproved
27 February 2009 Terms of Use. The section states:
28

1 “1. We can change this Statement so long as we provide you notice through
2 Facebook (unless you opt-out of such notice) and an opportunity to comment.
3 2. For changes to sections 7, 8, 9, and 11 (sections relating to payments,
4 application developers, website operators, and advertisers), we will give you a
5 minimum of three days notice. For all other changes we will give you a minimum
6 of seven days notice.
7 3. If more than 7,000 Users comment on the proposed change, we will also give
8 you the opportunity to participate in a vote in which you will be provided
9 alternatives. The vote shall be binding on us if more than 30% of all active
10 registered Users as of the date of the notice vote.
11 4. We can make changes for legal or administrative reasons upon notice without
12 opportunity to comment.”
13
14 83. Facebook’s most recent “Amendments” are misleading, disingenuous, and

15 unintelligible to most consumers. On information and belief, Plaintiffs allege that the
16 majority of Facebook Users under the age of 18 have never read, or cannot adequately
17 understand Facebook’s morphing Terms & Conditions, Privacy Policy and
18 Amendments. On information and belief, Plaintiffs also allege that Facebook has
19 designed and presented the Terms & Conditions, Privacy Policy and Amendments in a
20 manner and fashion to limit the reading of these materials by Facebook Users.
21 84. In March 2009 a group of computer scientists from the University of
22 Cambridge analyzed and condemned the proposed (and since adopted) “Amendments”
23 and “Terms of Use.” As one of the authors noted in a separate statement:
24
25 “The Statement of Rights and Responsibilities primarily assigns rights to

26 Facebook and responsibilities on Users, developers, and advertisers. Facebook
27 still demands a broad license to all User content, shifts all responsibility for
28 enforcing privacy onto developers, and sneakily disclaims itself of all liability. Yet

1 it demands an unrealistic set of obligations: a literal reading of the document
2 requires Users to get explicit permission from other Users before viewing their
3 content.”
4
5 “Users are free to comment on terms, but Facebook is under no obligation to

6 listen. Facebook’s official group for comments contains a disorganized jumble of
7 thousands of comments, some insightful and many inane. It is difficult to extract
8 intelligent analysis here. Under certain conditions a vote can be called, but this is
9 hopelessly weakened: it only applies to certain types of changes, the conditions
10 of the vote are poorly specified and subject to manipulation by Facebook, and in
11 fact they reserve the right to ignore the vote for “administrative reasons…”
12
13 “…The goal [of Facebook] is not to actually turn governance over to Users, but to
14 use the appearance of democracy and User involvement to ward off future
15 criticism.”
16
17 85. Facebook is continually attempting to bypass or obfuscate serious privacy

18 concerns of Users and the public through the adoption of newer but no less confusing,
19 misleading, deceptive, or ineffective policies. Facebook’s policies have changed several
20 times prior to the filing of this complaint, and will likely continue to change during the
21 pendency of this action. As such, Facebook Users require protections against future
22 changes to Facebook’s policies that may further mislead, deceive, and erode or violate
23 Users’ privacy rights.
24
25
26
27
28

1 F. FACEBOOK IS ENGAGED IN DECEPTVE AND MISLEADING PRACTICES IN
2 ORDER TO INCREASE THE NUMBER OF FACEBOOK USERS AND COLLECT
3 PRIVATE AND VALUABLE INFORMATION; AND FACEBOOK HAS FAILED TO
4 ADEQUATELY WARN CONSUMERS OF THE DANGERS OF PROVIDING
5 FACEBOOK AND FACEBOOK AFFILIATES WITH SUCH INFORMATION
6 86. Facebook has failed to provide adequate warnings to Users over the
7 dangers and risks of posting highly sensitive information, including but not limited to
8 addresses, phone numbers, passwords, social security numbers, family information,
9 information about minors, financial information, and health information. The release of
10 such data into cyberspace exposes Users to various risks and dangers including identity
11 theft, theft of password or account information, cybercrimes, stalking, child predation,
12 and misappropriation of legally protected financial and health information.
13 87. Facebook, through its website, Terms of Use, Privacy Policy, Privacy
14 setting tools, and public statements, has aggressively promoted the virtues and benefits
15 of facilitating and “sharing” information online, but has failed to educate or provide
16 adequate warnings to Users regarding the importance and value of such personal
17 information and the risks and dangers of disclosing such information to Facebook, to
18 Facebook Users, and Facebook third-party affiliates and developers.
19 88. Plaintiffs allege that Facebook is aware that the average Facebook User,
20 especially younger Users, do not understand or appreciate the risks and dangers of
21 disclosing personal information. Plaintiffs also allege that rather than potentially scare
22 Users away from Facebook with clear and effective warnings regarding the risks and
23 dangers of sharing personal information online, Facebook has instead purposely
24 downplayed, minimized, or omitted such important disclosures.
25 G. FACEBOOK TERMS OF USE AND PRIVACY POLICIES ARE NOT ADEQUATELY
26 DISCLOSED TO USERS DURING THE FACEBOOK SIGN-UP PROCESS
27 89. Plaintiffs allege that Facebook has created a business model and
28 apparatus designed to harvest as much personal and private information as possible in

1 the easiest, quickest, and most innocuous-looking manner possible. On information and
2 belief, Plaintiffs allege that Facebook created a User interface designed to limit the
3 number of Facebook Users actually reading the Facebook Terms of Use and Privacy
4 Policy. On information and belief, Plaintiffs allege Facebook has made the Terms of Use
5 and Privacy Policy hard to find with small font for the express purpose of maneuvering
6 Facebook Users into loading and or uploading personal and private information and
7 photos without first reviewing the Terms of Use and Privacy Policy.
8 90. Plaintiffs further allege that the majority of Facebook Users and
9 prospective new Users have never read the Facebook Terms of Use and Privacy Policy,
10 and that Facebook is aware of this fact. Furthermore, Facebook has not employed
11 effective measures to ensure that new prospective Users read and understand the
12 policies prior to signing up with Facebook or that existing members are notified when
13 the terms or policies are changed.
14 91. The Facebook sign-up or registration process is designed to obfuscate
15 review of the Terms of Use and Privacy Policy. Joining Facebook has been designed to
16 be both quick and easy. A person who wants to join Facebook simply needs to go to the
17 Facebook website and answer a few questions. An average person can typically
18 complete the entire sign-up process in less than three minutes. At no point in time
19 during the entire Facebook sign-up or registration process does Facebook automatically
20 display or require a prospective new User to scroll through and expressly accept
21 Facebook’s privacy policies or Terms of Use before joining Facebook. The current
22 Facebook sign-up webpage contains an innocuous statement in significantly smaller
23 font size than the rest of the webpage that states “By clicking Sign Up, you are
24 indicating that you have read and agree to the Terms of Use and Privacy Policy.” The
25 tiny statement is followed by equally small links to the Facebook Terms of Use and
26 Privacy Policy.
27 92. The sign-up process requires prospective Users to provide their first and
28 last name, date of birth, gender, and email address. Immediately after sign-up, newly

1 registered Users are then asked to provide their email account password, a photograph
2 of themselves, and the name of their high school, college, and employer. By the end of
3 the sign-up process, Facebook has already captured commercially valuable personal
4 and private information including the name, gender, date of birth, and email address of
5 Users, and has captured the photographs, high school, college, and company
6 information from a significant number of these Users. This private and personal
7 information is captured without ever receiving an express and informed consent from
8 the user that they have reviewed, understand, and agree to the Terms of Use and
9 Privacy Policy.
10 93. Facebook could easily implement controls to ensure that every
11 prospective new User is displayed the entire Privacy Policy and Terms of Use. For
12 example, many websites employ a pop-up box or window accompanied by a button or
13 link that the User must affirmatively press to confirm that they have read, understand
14 and agree to the policies before finalizing registration. Instead, Plaintiffs allege that
15 Facebook created and uses a sign-up process expressly designed to have the vast
16 majority of prospective new Users overlook or disregard the buried and hidden Privacy
17 Policy and Terms of Use while surrendering valuable private and personal information.
18 H. FACEBOOK PRIVACY TOOLS ARE CONFUSING, MISLEADING, DECEPTIVE,
19 AND INEFFECTIVE
20 94. Facebook has implemented privacy setting tools ostensibly designed to
21 allow consumers to restrict the use and dissemination of their data by other Users,
22 advertisers, and third-party affiliates and developers. Unfortunately for Facebook Users,
23 such tools are misleading, confusing, and ineffective.
24 95. Prospective Facebook Users are not required or even prompted to adjust
25 their privacy settings during the sign-up process or even following registration.
26 96. Furthermore, the privacy settings are not prominently displayed on the
27 Users’ Facebook pages and consequently, the average User may overlook the settings
28

1 and continue to post personal and private information without selecting the most secure
2 privacy settings.
3 97. Additionally, Users are not advised of the potential consequences of not
4 adjusting the privacy settings.
5 98. Even those Users that do seek out and find the privacy setting tools are
6 still faced with numerous confusing pages and privacy options. As it currently stands,
7 there are more than 40 individual privacy settings scattered over several web pages.
8 99. Privacy settings are not by default set to the maximum allowable privacy
9 setting. The current default privacy settings allow a User’s photos to be shared among
10 all Users in the Facebook and furthermore, allow a person’s profile to become
11 searchable on search engines such as Google.
12 100. Plaintiffs allege that the practical effect of Facebook’s interface and
13 privacy controls are to minimize, delay, or circumvent Users’ privacy concerns for the
14 purpose of aggregating as much personal and private information as possible without
15 consent, payment and/or consideration for such commercially valuable data and
16 information.
17 101. On information and belief, Facebook has admitted that the majority of
18 Facebook Users do not use the privacy setting tools.
19 102. Furthermore, the privacy setting tools are both ineffective and misleading
20 in that they falsely suggest to the average User that they present a technical safeguard
21 or barrier against unauthorized use of their personal data by third-party application
22 developers, when in fact, no such technological barriers exist. Whether or not a third
23 party developer honors a user’s individual privacy settings or the written policies of
24 Facebook is entirely within the discretion of the third-party developers, and not known or
25 disclosed to the consumer whose information is being used.
26
27
28

1 I. FACEBOOK’S POLCIES AND TECHNOLOGIES REGARDING THIRD-PARTY
2 DEVELOPER ACQUISITION AND USE OF PERSONAL USER DATA VIOLATE
3 USERS’ PRIVACY RIGHTS.
4 103. Facebook provides third-party developers with a platform, tools and
5 instructions that allow them to create Facebook applications, such as games or quizzes
6 or other interactive programs that users can add to their accounts. Such applications
7 reside on the developers’ servers and allow access to Facebook’s database and User
8 information, including name, picture, gender, birthday, hometown location (city/state/
9 country), current location (city/state/ country), political view, activities, interests, musical
10 preferences, television preferences, movie preferences, book interests, relationship
11 status, dating interests, relationship interests, summer plans, network affiliation,
12 educational history, employment history, photos posted on Facebook, meta-data
13 associated with the user (time of uploads, comments on user photos), usage
14 information concerning number of messages sent or received, User IDs mapped to
15 Users’ Facebook friends, social timelines, and events associated with User profiles.
16 104. Although Facebook has implemented written policies directed at third-
17 party developers that are intended to restrict their use of Facebook User data, in actual
18 practice there are no technical safeguards to prevent the misappropriation and misuse
19 of user data by the third-party developers. Most Facebook Users are not aware that
20 third party developers have access to their personal information.
21 105. According to the conclusions of a recent report by Office of Privacy
22 Commissioner of Canada, “with the exception of contact information, applications
23 technically can access virtually any personal information in a given User’s account,
24 including the list of friends, some information about the friends, and information that
25 could be considered sensitive outside the circle of friends.” The report also found that
26 although Facebook written policies contractually requires developers to respect Users’
27 privacy settings, Facebook has not provided “any evidence of any technological barrier
28 to a developer’s access to information precluded by the settings.” The reports also

1 stated that “there is no evidence that Facebook makes any significant sustained effort to
2 ensure that the information accessed by developers is only that which is truly needed to
3 run their applications.”
4 106. When a Facebook User decides to install a third-party application the
5 information that is submitted to the third-party developer also includes information about
6 every “friend” that appears in that User’s account or profile. Thus, a User who installs a
7 third-party application not only surrenders his or her information but also surrenders
8 information about his or her Facebook friends. Facebook Users may unknowingly and
9 without their consent have their personal information sent to a third party developer
10 based on the actions of one of their Facebook friends. Facebook has failed to warn
11 Users of such disclosures and has also failed implement controls to prevent third-party
12 developers from gaining access to such information.
13 107. Facebook has not provided users with adequate information to make a
14 meaningful and informed decision regarding the harvesting and use of their personal
15 data by third-party developers.
16 108. Although Facebook tells users in its Privacy Policy, that it “does not
17 screen or approve Platform Developers” and “cannot control how…Platform Developers
18 use any personal information that they may obtain in connection with Platform
19 Applications,” it fails to adequately disclose the dire ramifications and dangers of
20 allowing unscreened third-party developers almost complete, unrestricted access to a
21 User’s personal data. A third-party developer could copy Facebook User data onto to
22 their own servers, which are outside the control of Facebook, and retain the information
23 indefinitely and use it for any conceivable purpose.
24 109. As the custodian of User data, Facebook has the superior knowledge and
25 ability to develop technological safeguards to protect User data against unauthorized or
26 wrongful use by third parties. By allowing unscreened developers almost unrestricted
27 access and use of user data, Facebook has compromised the privacy, identity, and
28 safety of those Users.

1
2 J. FACEBOOK FAILS TO PROVIDE USERS WITH SIMPLE AND PERMANENT

3 MEANS TO DELETE THEIR ACCOUNT AND PERSONAL DATA AND MAY RETAIN
4 PERSONAL DATA INDEFINITELY
5 110. Facebook intentionally designed its site to make it impossible for Users to
6 delete their Facebook account and permanently purge all their data from Facebook
7 and/or third party databases. Facebook allows Users to “deactivate” their account, and
8 Users may believe that their data is then purged. However, deactivation does not result
9 in the automatic deletion and purging of all their data. Facebook recently implemented a
10 “delete my account” feature that allows the deletion (as opposed to mere deactivation)
11 of a User’s account. However, that option is currently not displayed in the account
12 options section of a Facebook User’s account, which is where the deactivation option is
13 located. Users must search for the “delete my account” option in order to find and use it.
14 Even if Users successfully locate the “delete my account” option, there is no indication
15 or guarantee by Facebook that the “delete my account” option will permanently purge all
16 User data. The statement accompanying the “delete my account” option merely states,
17 “If you do not think you will use Facebook again and would like your account deleted,
18 we can take care of this for you. Keep in mind that you will not be able to reactivate your
19 account or retrieve any of the content or information you have added.” Thus, the “delete
20 my account” option merely represents that the User will not be able to retrieve the data.
21 111. Facebook also does not inform Users as to the length of time that their
22 personal data may be stored by Facebook. Based on Facebook’s current ambiguous
23 policy, Facebook may conceivably store User data indefinitely.
24 112. Information shared with other Facebook Users is not affected by
25 deactivation of deletion and therefore such information may persist indefinitely on other
26 Users’ accounts.
27 113. Information released by Facebook to third parties is outside the control of
28 Facebook and therefore is not affected by deactivation or delete account features.

1 There are no technological controls in place to retrieve or destroy such data once it has
2 been transferred to a third party.
3 K. FACEBOOK ADVERTISING VIOLATES FACEBOOK USERS’ PRIVACY AND
4 PUBLICITY RIGHTS
5 114. Plaintiffs also allege that Facebook, through its technologically
6 sophisticated advertising practices, has violated the publicity rights of many Users.
7 California law prohibits the use of another’s name, photograph or likeness in advertising
8 or soliciting without prior consent. Facebook employs various forms of advertising in
9 order to generate revenue. Plaintiffs understand and appreciate the need for Facebook,
10 like any other business, to advertise in order to generate income, achieve profitability,
11 and provide its services to the public. However, Plaintiffs allege Facebook has used
12 specific types of invasive and targeted advertising technologies that violate or infringe
13 users privacy and publicity rights. Such advertising technologies include the generation
14 and transmission or display of customized advertisements that use users’ personal and
15 private data including name, photo or likeness in order to advertise products and
16 services to friends or other Users within that person’s network. Such practices and
17 technologies go beyond the usual, non-personally identifiable types of targeted
18 advertising that are prevalent on the Internet.
19 L. FACEBOOK TRACKING TECHNOLOGY
20 115. In November 2007 Facebook introduced a tracking technology called
21 Beacon. Facebook Users were automatically signed up for the Beacon system. The
22 Facebook tracking technology allows third-party affiliate websites to track and gather
23 information, such as purchases or other activities, from Facebook Users who visit their
24 websites. Furthermore, the Facebook tracking technology allows third-party affiliates to
25 publish the gathered information in the form of advertisements appearing in the “news
26 feed” sections of the Facebook User’s friends. The CA Research Threat Group
27 determined that the Facebook tracking technology tracks all Users at participating sites,
28 including logged off, former, and non Facebook members. The Facebook tracking

1 technology collects and returns data about Facebook Users and non Users to
2 Facebook. The Facebook tracking technology provides third-party affiliates with highly
3 personalized, targeted, and invasive ads.
4 116. Facebook fails to disclose tracking technologies to Facebook Users or
5 provide the necessary controls to prevent unwanted tracking. Many Facebook Users are
6 unwitting participants of Facebook tracking technologies and have had their purchases
7 and/or other online activities published to other Facebook Users without their express
8 consent. Facebook and participating affiliates thus profited from the misappropriation
9 and misuse of personal and private data.
10 M. FACEBOOK “SOCIAL ADS”
11 117. Facebook is engaged in displaying Users’ photographs to advertise
12 products or services without User knowledge or consent. These advertisements, which
13 display user photographs to tacitly endorse products or services, are referred to as
14 “social ads.” Default privacy settings for “social ads” allow “social ads” to be displayed to
15 any person designated as a user’s “friend.” Current privacy settings are confusing and
16 unlikely to be fully understood or used by a large number of Users. Additionally,
17 Facebook has commenced direct advertisements to Plaintiffs including sexually oriented
18 and provocative material.
19 N. FACEBOOK DOES NOT HAVE ADEQUATE SAFEGUARDS IN PLACE TO
20 PREVENT REGISTRATION OR USE OF PERSONS UNDER THE AGE OF 13
21 118. Plaintiffs allege that Facebook is aware that a significant number of
22 Facebook Users are under the age of 13. Facebook does not have adequate
23 safeguards and monitoring technology to prevent the registration and/or use of
24 Facebook by those under the age of 13.
25 119. On August 10, 2009, Plaintiff, Xavier O. who is 11 years old, posted
26 "Xavier O. has swine flu. Please pray 4 me. God Bless. Xavier O.”
27 120. Xavier O. did not seek approval from his parents to post health
28 information.

1
2 VI. CLAIMS FOR RELIEF

3
4 FIRST CAUSE OF ACTION

5 VIOLATION OF CALIFORNIA Civil Code § 3344
6
7 121. Plaintiffs reallege and incorporate by reference, as if fully set forth herein,
8 the allegations in paragraphs 1-116 above.
9 122. California Civil Code § 3344(a) provides:
10
11 “Any person who knowingly uses another’s name, voice, signature,

12 photograph, or likeness, in any manner on or in products, merchandise, or
13 goods, or for purposes of advertising or selling, or soliciting purchases of
14 products, merchandise, goods or services, without such person’s prior
15 consent, or, in the case of a minor, the prior consent of his parent or legal
16 guardian, shall be liable for any damages sustained by the person or
17 persons injured as a result thereof. In addition, in any action brought under
18 this section, the person who violated the section shall be liable to the
19 injured party or parties in an amount equal to the greater of seven hundred
20 fifty dollars ($750) or the actual damages suffered by him or her as a
21 result of the unauthorized use, and any profits from the unauthorized use
22 that are attributable to the use and are not taken into account in computing
23 the actual damages. In establishing such profits, the injured party or
24 parties are required to prove his or her deductible expenses. Punitive
25 damages may also be awarded to the injured party or parties. The
26 prevailing party in any action under this section shall also be entitled to
27 attorney’s fees and costs.”
28

1 123. Defendants and each of them used Plaintiffs’ names, photographs, and
2 likenesses knowingly and deliberately, without the prior consent of any of the Plaintiffs,
3 and in the case of minor Plaintiffs Xavier O. and Chris C., without the prior consent of
4 their parents or legal guardians, and
5 124. Each such use was unequivocally and directly for purposes of advertising
6 or selling, or soliciting purchases of products, merchandise, goods or services by
7 Facebook, such that prior consent was required.
8 125. Plaintiffs have suffered actual damages as a result of Defendants’
9 deliberate use of their names, photographs, and likenesses on advertisements and
10 other types of solicitations for goods or services.
11 126. Defendants engaged in outrageous conduct, carried on with willful and
12 conscious disregard of the rights of Plaintiffs. Plaintiffs are entitled to compensatory and
13 punitive damages. Plaintiffs are entitled to attorney fees and costs.
14
15 SECOND CAUSE OF ACTION

16 MISSAPROPRIATION OF NAME AND LIKENESS UNDER
17 CALIFORNIA COMMON LAW
18
19 127. Plaintiffs reallege and incorporates by reference, as if fully set forth herein,
21 128. Defendants have and are using Plaintiffs’ name, identity, likeness, and
22 personal information for commercial advantage without Plaintiff’s consent.
23 129. Defendants’ misappropriation of Plaintiffs’ names, identities, photographs,
24 likenesses, and personal information has resulted in injury to Plaintiffs and each of
25 them.
26 130. Plaintiffs are entitled to compensatory damages.
27
28

1 THIRD CAUSE OF ACTION
2 VIOLATIONS OF BUSINESS AND PROFESSIONS CODE § 17200
3 (UNFAIR COMPETITION)
4 131. Plaintiffs reallege and incorporates by reference, as if fully set forth herein,
6 132. Defendants promised and represented that User information would remain
7 private.
8 133. Plaintiffs relied on the promises and representations of Defendants.
9 134. Plaintiffs were injured by Defendants' concealment of their data mining
10 practices and wrongful use, dissemination, and sale of Users' personal and private
11 information and data as described above.
12 135. Plaintiffs have suffered injury in fact and lost money or property as a result
13 of such unfair business practices.
14 136. Defendants’ acts and conduct are unfair, unlawful and fraudulent business
15 practices. Defendants' acts and practices are also unlawful because they violate Civil
16 Code sections 1750 et seq (Consumer Legal Remedies Act); California Constitution Art.
17 1, section 1; and Business and Professions Code sections 22575-579 (Online Privacy
18 Protection Act).
19 137. Plaintiffs seek an order of this Court awarding damages, restitution,
20 disgorgement, injunctive relief and all other relief allowed under §17200, et seq.
21
22 FOURTH CAUSE OF ACTION

23 VIOLATION OF CALIFORNIA CONSTITUTIONAL RIGHT TO PRIVACY
26 139. Plaintiffs had and continue to have privacy rights in their personal
27 information, identities, data, photographs, and communications pursuant to Article One,
28 Section One of the California Constitution.

1 140. Defendants, through unlawful means, violated the California constitutional
2 privacy rights of Plaintiffs by Defendants’ unauthorized access, copying, distribution,
3 use, commercialization, and/or sale of Plaintiffs’ private and personal information,
4 identities, data, photographs, and communications.
5 141. Defendants had no authorization or privilege to gain access, copy,
6 distribute, use, commercialize, and/or sell Plaintiffs’ private and personal information,
7 identities, data, photographs, and communications.
8 142. As a consequence, Plaintiffs have suffered and will continue to suffer
9 damages.
10 143. Plaintiffs are entitled to compensatory damages, restitution, disgorgement,
11 and injunctive relief.
12 FIFTH CAUSE OF ACTION
13 VIOLATION OF THE CALIFORNIA ONLINE PRIVACY ACT
14 (CALIFORNIA BUSINESS AND PROFESSIONS CODE § 22575-22579)
17 145. The California Online Privacy Act, California Business and Professions
18 Code § 22575-22579 provides that operators of commercial websites that collect
19 personally identifiable information from California’s residents are required to
20 conspicuously post and comply with a privacy policy requirements as defined in the Act.
21 146. Plaintiffs are entitled to compensatory damages, restitution, disgorgement,
22 and injunctive relief.
23 SIXTH CAUSE OF ACTION
24 VIOLATION OF THE CALIFORNIA CONSUMER LEGAL REMEDIES ACT
25 (CALIFORNIA CIVIL CODE § 1750 et seq)
28

1 148. The Consumer Legal Remedies Act (CLRA), California Civil Code
2 sections 1750 et seq, applies to Defendants’ actions and conduct because such actions
3 and conduct pertain to consumer services.
4 149. Defendants have engaged in deceptive practices, unlawful methods of
5 competition and/or unfair acts as defined by Civ. Code §1770, to the detriment of
6 Plaintiffs.
7 150. Plaintiffs have suffered harm as a proximate result of the violations of law
8 and wrongful conduct of Defendants alleged herein.
9 151. Defendants intentionally and unlawfully perpetrated harm upon Plaintiffs
10 by the above described acts.
11 152. Defendants’ Terms of Use, Statement of Rights and Responsibilities, and
12 Privacy Policy are unconscionable and violate Civil Code section 1770(a)(19).
13 153. Defendants’ unilateral change of the Terms of Use, Statement of Rights
14 and Responsibilities, and Privacy Policy without notice to Users after Users have
15 commenced use of Facebook are unconscionable and violate Civil Code section
16 1770(a)(19).
17 154. In violation of Civil Code section 1770(a)(14), Facebook represented that
18 User information would remain private.
19 155. Defendants concealed material information regarding their data mining
20 activity, and the dissemination and sale of User data.
21 156. Users, including Plaintiffs, relied upon Facebook’s representations in
22 uploading and sharing personal information and data.
23 157. Defendant’s deceptive acts and omissions and unfair business practices
24 occurred in the course of providing a consumer service and violate Civil Code section
25 1770(a).
26 158. As a direct and proximate result of Defendant’s violations of the CLRA,
27 Plaintiffs and other class members have suffered harm.
28

1 159. Defendants’ policies and practices are unlawful, unethical, oppressive,
2 fraudulent and malicious. The gravity of the harm to all consumers from Defendants’
3 policies and practices far outweighs any purported utility those policies and practices
4 have.
5 160. Plaintiffs are entitled to (a) actual damages; (b) restitution of money to
6 Plaintiffs and Class members; (c) punitive damages; (d) attorneys’ fees and costs; and
7 (e) other relief that this Court deems proper
8 VII. PRAYER FOR RELIEF
9 WHEREFORE, Plaintiffs pray for the following relief:
10 A. For injunctive relief, as follows: An order enjoining Facebook from
11 uploading, downloading, disseminating, or selling identifiable information or
12 photographs of minors without consent of parents or guardians. ;
13 B. An order enjoining Facebook from uploading, downloading, disseminating,
14 or selling identifiable information or photographs or work of Users without their consent.
15 D. An order enjoining Facebook from permitting the unauthorized
16 downloading of copyrighted images (photographs);
17 E. An order enjoining Facebook from retaining, disseminating, and selling
18 private and personal information of Facebook Users who terminate their service;
19 F. For judgment in favor of Plaintiffs, and against the Defendants, for
20 damages in such amounts as may be proven at trial;
21 G. Pursuant to California Civil Code § 3344, for compensatory damages in an
22 amount equal to or greater of seven hundred fifty dollars ($750) for each unauthorized
23 use Plaintiffs’ names or photographs, or actual damages suffered by Plaintiffs. Cal. Civ.
24 Code § 3344(a);
25 H. Punitive damages;
26 I. For attorneys’ fees and costs;
27
28

1 J. For such other relief as the Court may deem just and proper.
2
3 _________________________________
4 Dana B. Taschner
5 THE LANIER LAW FIRM
6
8 JURY DEMAND
9 Plaintiffs demand a trial by jury.
10
11
12
13 _________________________________
14 Dana B. Taschner
15 THE LANIER LAW FIRM
16
17
18
19
20
21
22
23
24
25
26
27
28

Filed: Dept. C11

Transféré par

Informations du document

Titre original

Copyright

Formats disponibles

Partager ce document

Partager ou intégrer le document

Options de partage

Avez-vous trouvé ce document utile ?

Ce contenu est-il inapproprié ?

Droits d'auteur :

Formats disponibles

Filed: Dept. C11

Transféré par

Droits d'auteur :

Formats disponibles

1

Dana B. Taschner, State Bar No. 135494

LANIER LAW FIRM, PC

Houston, Texas 77069

Fax: (713) 659-2204

Attorneys for Plaintiffs

BUSINESS AND PROFESSIONS

Complaint for Damages and Injunctive Relief - 1

13 I. INTRODUCTION & SUMMARY OF ACTION

15 1. This is a private Attorney General action brought by on behalf of Plaintiffs

Complaint for Damages and Injunctive Relief - 2

Complaint for Damages and Injunctive Relief - 3

Complaint for Damages and Injunctive Relief - 4

Complaint for Damages and Injunctive Relief - 5

Complaint for Damages and Injunctive Relief - 6

19 II. DEFENDANT PARTIES

21 20. Defendant Facebook, Inc. is a Delaware corporation with its principal

Complaint for Damages and Injunctive Relief - 7

2 III. JURISDICTION AND VENUE

24 IV. BACKGROUND AND FACTS

Complaint for Damages and Injunctive Relief - 8

Complaint for Damages and Injunctive Relief - 9

Complaint for Damages and Injunctive Relief - 10

Complaint for Damages and Injunctive Relief - 11

2 B. FACEBOOK VIOLATES THE PRIVACY RIGHTS OF FACEBOOK USERS

Complaint for Damages and Injunctive Relief - 12

Complaint for Damages and Injunctive Relief - 13

Complaint for Damages and Injunctive Relief - 14

Complaint for Damages and Injunctive Relief - 15

Complaint for Damages and Injunctive Relief - 16

Complaint for Damages and Injunctive Relief - 17

Complaint for Damages and Injunctive Relief - 18

Complaint for Damages and Injunctive Relief - 19

2 “You hereby grant Facebook an irrevocable, perpetual, non-exclusive,

Complaint for Damages and Injunctive Relief - 20

18 74. Facebook’s asserts the license to use content covered by intellectual

Complaint for Damages and Injunctive Relief - 21

12 76. The Facebook policy, in combination with Facebook’s sophisticated data

Complaint for Damages and Injunctive Relief - 22

Complaint for Damages and Injunctive Relief - 23

14 83. Facebook’s most recent “Amendments” are misleading, disingenuous, and

25 “The Statement of Rights and Responsibilities primarily assigns rights to

Complaint for Damages and Injunctive Relief - 24

5 “Users are free to comment on terms, but Facebook is under no obligation to

17 85. Facebook is continually attempting to bypass or obfuscate serious privacy

Complaint for Damages and Injunctive Relief - 25

Complaint for Damages and Injunctive Relief - 26

Complaint for Damages and Injunctive Relief - 27

Complaint for Damages and Injunctive Relief - 28

Complaint for Damages and Injunctive Relief - 29

Complaint for Damages and Injunctive Relief - 30

Complaint for Damages and Injunctive Relief - 31

2 J. FACEBOOK FAILS TO PROVIDE USERS WITH SIMPLE AND PERMANENT

Complaint for Damages and Injunctive Relief - 32

Complaint for Damages and Injunctive Relief - 33

Complaint for Damages and Injunctive Relief - 34

2 VI. CLAIMS FOR RELIEF

4 FIRST CAUSE OF ACTION

11 “Any person who knowingly uses another’s name, voice, signature,

Complaint for Damages and Injunctive Relief - 35

15 SECOND CAUSE OF ACTION

Complaint for Damages and Injunctive Relief - 36

22 FOURTH CAUSE OF ACTION