In In re Facebook, Inc., No. MDL No. 2843, 2019 U.S. Dist. LEXIS 153505 (N.D. Cal. Sep. 9, 2019), Judge Chhabria allowed some claims to proceed against Facebook arising out of the Cambridge Analytica scandal.
Facebook’s motion to dismiss is littered with assumptions about the degree to which social media users can reasonably expect their personal information and communications to remain private. Because Facebook’s view of this issue pervades so many of its individual legal arguments — and because Facebook’s view is so wrong — it is addressed at the outset. Facebook’s view is that once you make information available to your friends on social media, you completely relinquish any privacy interest in that information. For this reason, Facebook insists, it does not matter whether Facebook users consented to the company’s information-sharing practices. Facebook asserts that even if users didn’t consent, and even if users intended to restrict access to friends only, and even if Facebook had explicitly promised not to share their information with anyone else, the users would have no right to complain that their privacy was invaded by the disclosure or misuse [*34] of their sensitive information. Although this argument was implicit in Facebook’s papers, it became explicit at the hearing on the motion to dismiss. Dkt. No. 287 at 7 (hearing transcript).2 The problem with Facebook’s argument is that it treats privacy as an all-or-nothing proposition — either you retain a full privacy interest by not sharing information with anyone, or you have no privacy interest whatsoever by virtue of sharing it even in a limited fashion. In reality, there can be “degrees and nuances to societal recognition of our expectations of privacy: the fact that the privacy one expects in a given setting is not complete or absolute does not render the expectation unreasonable as a matter of law.” Sanders v. American Broadcasting Companies, Inc., 20 Cal. 4th 907, 915, 85 Cal. Rptr. 2d 909, 978 P.2d 67 (1999); see also Opperman v. Path, Inc., 84 F. Supp. 3d 962, 991-93 (N.D. Cal. 2015). Thus, as the U.S. Supreme Court has explained, “information may be classified as private if it is intended for or restricted to the use of a particular person or group or class of persons” rather than being “freely available to the public.” U.S. Department of Justice v. Reporters Committee for Freedom of the Press, 489 U.S. 749, 763-64, 109 S. Ct. 1468, 103 L. Ed. 2d 774 (1989) (emphasis added) (quoting Webster’s Third New International Dictionary 1804 (1976)); see also id. at 763 (“Thus the extent of the protection accorded a privacy right at common law rested in part on the degree of dissemination of [*35] the allegedly private fact . . . .”). So, for example, if you are diagnosed with a medical condition, you can expect to conceal it completely only if you keep it between you and your doctor. But it does not follow that if you send an email to selected colleagues and friends explaining why you’ll be out of commission for a while, you’ve relinquished any privacy interest in your medical condition, such that the email provider could disseminate your diagnosis to anyone who might be interested in your health status. Similarly, social media users can have their privacy invaded if sensitive information meant only for a few dozen friends is shared more widely.3 Although Facebook refuses in this case to acknowledge its users’ privacy interests, it has done so in other court cases. For example, in a brief filed with the California Supreme Court, for a case where Facebook fought against the compelled disclosure of a user’s posts, Facebook compared information kept on social media to information kept on a smartphone: “The data on a smartphone — like the data maintained in a social media account — can reveal an individual’s private interests and concerns and where a person has been, which in turn [*36] reflects a wealth of detail about a person’s familial, political, professional, religious, and sexual associations.” Answer Brief on the Merits, Facebook, Inc. v. Superior Court, 2016 WL 684072 (Cal.), at *29 (brackets and internal quotations omitted) (quoting Riley v. California, 573 U.S. 373, 396, 134 S. Ct. 2473, 189 L. Ed. 2d 430 (2014)). For this reason, Facebook continued, “communications content of the kind maintained by [social media] providers” carries with it such a significant expectation of privacy that even law enforcement must get a warrant before accessing it from those providers. Id. In a different California Supreme Court brief, Facebook took pains to juxtapose users who share communications with the general public against users who share communications only with friends: “These settings cannot be overridden by others; if a post is set to be viewable only by a certain audience, it may not then be shared or forwarded through the Facebook platform to someone outside that audience.” Answering Brief on the Merits, Facebook, Inc. v. Superior Court, 2018 WL 2060039 (Cal.), at *16. Facebook added that even if users designate their communications to be viewed by the general public, they can later “regain” their expectation of privacy in that information by switching their settings back to a more restricted audience. See id. at *28 n.4. Perhaps Facebook’s argument that social media accounts are [*37] like smartphones is an exaggeration in the other direction. But it’s closer to the truth than the company’s assertions in this case. Sharing information with your social media friends does not categorically eliminate your privacy interest in that information, and the plaintiffs’ claims in this lawsuit must be analyzed against that backdrop, rather than the backdrop Facebook attempts to paint in its motion to dismiss.