Exhibit 1 in the Circuit Court of Cook County, Illinois County Department, Chancery Division

Courtroom Number: Location: FILED 6/24/2019 9:23 PM DOROTHY BROWN CIRCUIT CLERK COOK COUNTY, IL 2018CH03868

5534882 FILED DATE: 6/24/2019 9:23 PM 2018CH03868 Hearing Date: 7/15/2019 9:30 AM - 9:30 AM EXHIBIT 1 IN THE CIRCUIT COURT OF COOK COUNTY, ILLINOIS COUNTY DEPARTMENT, CHANCERY DIVISION

PEOPLE OF THE STATE OF ILLINOIS, ex rel. Case No. 2018 CH 03868 Kimberly M. Foxx, State’s Attorney of Cook County, Illinois, Calendar 3

Plaintiff,

FACEBOOK, INC., a Delaware corporation, SCL GROUP LIMITED, a United Kingdom private limited company, and CAMBRIDGE ANALYTICA LLC, a Delaware limited liability FILED DATE: 6/24/2019 9:23 PM 2018CH03868 company,

Defendants.

PLAINTIFF’S OPPOSITION TO DEFENDANT’S MOTION TO DISMISS TABLE OF CONTENTS

BACKGROUND ...... 3

I. Facebook decides to make all of its user information available to any third-party developer ...... 4

II. Cambridge Analytica takes user information ...... 6

III. Facebook finds out, but tells no one ...... 7

IV. The lawsuit on behalf of the People of the State of Illinois ...... 8

ARGUMENT ...... 9

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 I. This Court has specific personal jurisdiction over Facebook ...... 9

A. Facebook has waived any personal jurisdiction argument ...... 10

B. Facebook expressly aimed its tortious conduct at Illinois...... 10

C. Facebook has engaged in systematic business contacts in Illinois ...... 13

D. Facebook’s flawed arguments against jurisdiction fail ...... 16

E. In the event the Court is inclined to agree with Facebook, the State requests leave to take jurisdictional discovery ...... 18

II. The State sufficiently alleges its ICFA claim, including that Facebook hid the fact that it was doing nothing to protect users when it opened up their data to developers, and then covered up the Cambridge Analytica scandal for years ...... 18

A. Facebook did not disclose to users that it took no responsibility for the system of sharing it had set up with third-party application developers ...... 20

B. Regardless, Facebook’s disclosures do not permit it to hide the Cambridge Analytica breach ...... 23

III. Facebook should fail (again) to delay the State’s case with the MDL proceedings ...26

CONCLUSION ...... 27

i TABLE OF AUTHORITIES

United States Supreme Court Cases

Burger King Corp. v. Rudzewicz, 471 U.S. 462 (1985 ...... 9, 11, 18

Calder v. Jones, 465 U.S. 783 (1984) ...... 10

Keeton v. Hustler Magazine, Inc., 465 U.S. 770 (1984) ...... 17

Walden v. Fiore, 571 U.S. 277 (2014) ...... 10, 11, 18 FILED DATE: 6/24/2019 9:23 PM 2018CH03868 United States Circuit Court of Appeals Cases

Acorda Therapeutics Inc. v. Mylan Pharm. Inc., 817 F.3d 755 (Fed. Cir. 2016)...... 17

Haywood v. Massage Envy Franchising, LLC, 887 F.3d 329 (7th Cir. 2018) ...... 22

Mavrix Photo, Inc. v. Brand Techs., Inc., 647. F.3d 1218 (9th Cir. 2011) ...... 14

Smith v. Facebook, Inc., 745 F. App’x 8 (9th Cir. 2018) ...... 22

Tamburo v. Dworkin, 601 F.3d 693 (7th Cir. 2010) ...... 10

uBID, Inc. v. GoDaddy Grp., 623 F.3d 421 (7th Cir. 2010) ...... 14, 17

United States District Court Cases

Corley v. Vance, 365 F. Supp. 3d 407 (S.D.N.Y. 2019) ...... 16, 17

Georgalis v. Facebook, Inc., 324 F. Supp. 3d 955 (N.D. Ohio 2018) ...... 17

Greene v. Karpeles, No. 14 C 1437, 2019 WL 1125796, (N.D. Ill. Mar. 12, 2019) ...... 13

Greene v. Mizuho Bank, Ltd., 169 F. Supp. 3d 855 (N.D. Ill. 2016) ...... 2, 13

Gullen v. Facebook.com, Inc., No. 15 C 7681, 2016 WL 245910 (N.D. Ill. Jan. 21, 2016) ...... 16

In re Chrysler-Dodge-Jeep Ecodiesel Mktg., Sales Practices, & Prod. Liab. Litig., No. 17-MD-02777-EMC, 2018 WL 1335901, (N.D. Cal. Mar. 15, 2018) ...... 12

In re Facebook, Inc. Consumer Privacy User Profile Litig., No. 18-md-2843 (N.D. Cal.) ...... 9

In re Facebook, Inc., Consumer Privacy User Profile Litig., 354 F. Supp. 3d 1122 (N.D. Cal. 2019) ...... 9, 27 FILED DATE: 6/24/2019 9:23 PM 2018CH03868 Lack v. Mizuho Bank, No. 18-cv-00617, 2018 WL 5906849 (C.D. Cal. June 19, 2018) ...... 13

Payton v. Kale Realty, No. 13 C 8002, 2014 WL 4214917 (N.D. Ill. Aug. 26, 2014) ...... 17

People ex rel. Foxx v. Facebook, Inc., et al., No. 1:18-cv-02667 (N.D. Ill. Apr. 17, 2018) ...... 10

Ralls v. Facebook, 221 F. Supp. 3d 1237 (W.D. Wash. 2016) ...... 17

Ratliff v. Venture Express, Inc., No. 17 C 7214, 2019 WL 1125820 (N.D. Ill. Mar. 12, 2019) ...... 14, 17

State Court Cases

Aliano v. Ferriss, 2013 IL App (1st) 120242 ...... 22

Bulldog Inv’rs Gen. P’ship v. Sec’y of Com., 457 Mass. 210, 218, 929 N.E.2d 293 (2010) ...... 9, 10

Certain Underwriters at Lloyd’s, London v. Boeing Co., 385 Ill. App. 3d 23 (1st Dist. 2008) ...... 26

Connick v. Suzuki Motor Co., 174 Ill. 2d 482 (1996) ...... 2, 19

iii Covarrubias v. Bancomer, S.A., 351 Ill. App. 3d 737 (1st Dist. 2004) ...... 19

Deutsche Bank Nat. Tr. Co. v. Hall-Pilate, 2011 IL App (1st) 102632 ...... 10

District of Columbia v. Facebook, Inc., 2018 CA 8715 B (D.C. Sup. Ct. May 31, 2019) ...... 2

Dwyer v. Am. Exp. Co., 273 Ill. App. 3d 742 (1st Dist. 1995) ...... 19

Elder v. Coronet Ins. Co., 201 Ill. App. 3d 733 (1st Dist. 1990) ...... 19, 25

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 Krause v. GE Capital Mortg. Serv., Inc., 314 Ill. App. 3d 376 (1st Dist. 2000) ...... 22

Innovative Garage Door Co. v. High Ranking Domains, LLC, 2012 IL App (2d) 120117 ...... 14

In re Jarquan B., 2016 IL App (1st) 161180 ...... 24

In re Org. of Greater Algonquin Park Dist., 103 Ill. App. 3d 1056 (2d Dist. 1982) ...... 25

Khan v. Gramercy Advisors, LLC, 2016 IL App (4th) 150435 ...... 11

Oldendorf v. Gen. Motors Corp., 322 Ill. App. 3d 825 (2d Dist. 2001) ...... 21

Oliveira v. Amoco Oil Co., 201 Ill. 2d 134 (2002) ...... 19

Phillips v. DePaul Univ., 2014 IL App (1st) 122817 ...... 22

Russell v. SNFA, 2013 IL 113909 ...... 10

Walsh v. Barry-Harlem Corp., 272 Ill. App. 3d 418 (1st Dist. 1995) ...... 24

iv Warren v. LeMay, 142 Ill. App. 3d 550 (5th Dist. 1986)...... 23

Rules and Statutory Provisions

28 U.S.C. § 1332 ...... 9

735 ILCS 5 ...... passim

815 ILCS 505 ...... passim

Ill. Sup. Ct. R. 201 ...... 18

Miscellaneous Authority

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 Anita Balakrishnan, Sara Salinas, & Matt Hunter, Mark Zuckerberg has been talking about privacy for 15 years – here’s almost everything he’s said, CNBC (Apr. 9, 2019), https://www.cnbc.com/2018/03/21/facebook-ceo-mark- zuckerbergs-statements-on-privacy-2003-2018.html ...... 4

Garrett Schaffel, It’s Official: Facebook Is Becoming the Platform For You, AARP (Feb. 20, 2018), https://www.aarp.org/home-family/personal-technology/info-2018/facebook-users-age- fd.html ...... 4

Issie Lapowsky, 15 Moments that Defined Facebook’s First 15 Years WIRED (Feb. 04, 2019), https://www.wired.com/story/facebook-15-defining-moments/ ...... 3

Issie Lapowsky, Facebook Exposed 87 Million Users to Cambridge Analytica, WIRED (Apr. 4, 2019), https://www.wired.com/story/facebook-exposed-87-million-users-to-cambridge- analytica/ ...... 5

Karis Hustad, Look Inside Facebook’s Growing Chicago Office, Chi. Bus. J., https://bit.ly/30XvtYq (Mar. 10, 2017) ...... 18

Kashmir Hill, Turning Off Facebook Location Tracking Doesn’t Stop It From Tracking Your Location, Gizmodo, https://bit.ly/2UY7Iwv (Dec. 18, 2018) ...... 11

Kurt Wagner and Rani Molla, Facebook’s first 15 years were defined by user growth, VOX (Feb. 5, 2019), https://www.vox.com/2019/2/4/18203992/facebook-15-year-anniversary- user-growth ...... 3

v Lesley Stahl, Aleksandr Kogan: The Link Between Cambridge Analytica and Facebook, CBS News (Apr. 22, 2018) ...... 7

Matthew Rosenberg, Nicholas Confessore and Carole Cadwalladr, How Trump Consultants Exploited the Data of Millions, NEW YORK TIMES (March 17, 2018), https://www.nytimes.com/2018/03/17/us/politics/cambridge-analytica-trump- campaign.html#click=https://t.co/UAg1Q5t1BG ...... 8

FILED DATE: 6/24/2019 9:23 PM 2018CH03868

vi The People of the State of Illinois, by and through Cook County State’s Attorney

Kimberly M. Foxx, brought this case to hold Facebook accountable for the Cambridge Analytica

scandal, which resulted in the sensitive personal information of millions of Illinoisans being

compromised. Facebook, in its relentless pursuit of user growth to procure more data to sell,

decided that social networks had been “closed platforms” for too long. To bring in more users

without driving up costs, Facebook opened up its platform to third-party developers, who would

build applications that relied on Facebook. In exchange, Facebook gave developers the skeleton

key to its trove of user data: developers could access the Facebook data for any user that used the FILED DATE: 6/24/2019 9:23 PM 2018CH03868

developer’s application, along with the entire data set for all of that users’ Facebook “friends.”

This included every user’s name, address, age, gender, education, hometown, and dozens of

other categories of information; in short, the dream information set for the many companies that

want to know a lot about a lot of people. Although Facebook claimed—among other things—that

it would protect user information from unscrupulous developers, that users would be able to

control what information was available to developers, that Facebook would limit what

developers could do with user data, and that Facebook would police developers by auditing those

it suspected of using information improperly, Facebook ultimately did none of those things.

Cambridge Analytica was the natural consequence of letting the fox into the henhouse.

The company used Facebook’s developer loophole—along with the ill-considered permission of

270,000 users—to obtain all of the data from all of those users’ friends, extracting the Facebook

information of 87 million people. When Facebook found out about this in 2015, it did little more

than ask Cambridge Analytica to delete the data, but never attempted to confirm that the

company did so. Worse, Facebook kept the breach a secret from the public for fear that it would

lead to a public relations crisis (which has in fact resulted), or worse, an exodus of users.

1 Facebook now moves to dismiss this case, pressing the very same arguments that were

rejected wholesale by another court considering another, near-identical enforcement action. See

District of Columbia v. Facebook, Inc., 2018 CA 8715 B (D.C. Super. Ct. May 31, 2019),

attached as Exhibit 1 (hereinafter “D.C. Court Op.”). Specifically, Facebook argues that (i)

Illinois courts lack jurisdiction over it because it does little more than operate a passive website

that Illinoisans may access, and (ii) that the State has failed to state a consumer fraud claim.

On the former, there is no doubt that jurisdiction over Facebook exists in Illinois for this

case. Facebook does a lot more in this State than just running a website: it operates a FILED DATE: 6/24/2019 9:23 PM 2018CH03868

sophisticated data mining operation, through which it knows precisely who its users are, and its

misrepresentations at issue here were directed to those users in Illinois. See Greene v. Mizuho

Bank, Ltd., 169 F. Supp. 3d 855, 860–62 (N.D. Ill. 2016). Facebook’s primary complaint is that it

might be subject to jurisdiction in many states for this activity, but this argument is irrelevant.

Facebook put the millions of Illinois users from whom it mines information in harm’s way and

lied to them about how safe it had kept them. That subjects Facebook to personal jurisdiction

here, even if it did the same in many other states.

The State also alleges more than enough to state its claim under the Illinois Consumer

Fraud and Deceptive Trade Practices Act (ICFA). The ICFA prohibits any entity that engages in

consumer transactions, like Facebook, from withholding information that a reasonable consumer

would consider material. Connick v. Suzuki Motor Co., 174 Ill. 2d 482, 504–05 (1996).

Facebook’s primary contention here is that everyone knew what Facebook was doing with its

user data, and that everyone knew about Cambridge Analytica in 2015 when Facebook found out

about it. But that position isn’t consistent with the State’s allegations, nor what the public record

makes clear actually happened. If Facebook is right that everyone knew and didn’t care, the

2 sudden backlash—from users, the public, and governments here and abroad—three years later

when a former Cambridge Analytica employee came forward is inexplicable. Facebook’s claim

that the Cambridge Analytica scandal was known to its users and was immaterial to them is a

bold argument indeed, but one that must fail.

For all of these reasons and as explained further below, this Court can appropriately go

the way of the D.C. Superior Court and deny Facebook’s motion in its entirety.

BACKGROUND

Founded in 2004 in a dorm room, Facebook has become the world’s largest social FILED DATE: 6/24/2019 9:23 PM 2018CH03868

networking platform, with more than 2.3 billion monthly users worldwide, and more than 200

million in the United States alone. (See Compl. ¶ 28.)1 Facebook’s core functionality has always

been the creation of a Facebook “profile;” essentially, a personal website containing your photo

and some information about yourself that you could share with other people by selecting them as

your “friends” on the website.2 Over the years, Facebook has added more and more types of

content that you can post on your profile, which includes text posts (originally known as the

Facebook “Wall”) as well as photos and videos.3 In this way, Facebook replicates your real-life

social network: you can quickly and easily share material that has general interest within your

friend group; for instance, photos of your wedding or a vacation. Competing technology for

communicating with friends and family simply couldn’t hack it in the face of this sleek and easy-

to-use form of social networking: forwarding photos of your child to Grandma by e-mail, or

hosting a personal website elsewhere on the web, today seems almost comically inefficient.

1 See also Kurt Wagner and Rani Molla, Facebook’s First 15 Years Were Defined by User Growth, VOX (Feb. 5, 2019), https://www.vox.com/2019/2/4/18203992/facebook-15-year-anniversary-user-growth. 2 See Friending, FACEBOOK HELP CENTER, https://www.facebook.com/help/1540345696275090/?helpref=hc_fnav; Issie Lapowsky, 15 Moments that Defined Facebook’s First 15 Years, WIRED (Feb. 04, 2019), https://www.wired.com/story/facebook-15-defining-moments/. 3 See generally Using Facebook, FACEBOOK HELP CENTER, https://www.facebook.com/help/1041553655923544/?helpref=hc_fnav.

3 As Facebook exponentially grew,4 it crowded out other ways of sharing information

online and brought people into the fold—like Grandma—that might otherwise never have been

involved in an online social network.5 In short, Facebook convinced billions of people to lead

their social lives on the Internet, either as an addition to real-world connectivity or as a

replacement for it.

I. Facebook decides to make all of its user information available to any third-party developer.

To support this mission, Facebook’s public-facing statements focus on connecting

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 individuals with one another and protecting their information when doing so.6 So do its promises

to users in the relevant user and developer agreements, described below. (Compl. ¶ 79.) But

besides acting as a hub for sharing information with your friends and family, Facebook has a

second face: as one of the most successful data mining operations in existence. (Id. ¶ 28.) That’s

because the ad industry is powered by consumer information, and the one thing Facebook has is

a lot of consumer information. (Id. ¶ 29.) Facebook’s ability to convince users to provide so

much information about themselves has, in turn, made the company a digital-age goldmine.

In other words, the product that Facebook sells is not actually the consumer-facing

Facebook platform, but Facebook’s users themselves. The consumer-facing website is just the

medium by which it persuades users to stay on the platform and provide more information about

themselves. To further that mission, Facebook decided that it would open up its website to third-

party developers to create applications—like quizzes and games—for the Facebook website, or

that would be hosted on other websites but which would be linked back to Facebook through the

4 See supra n.1. 5 Garrett Schaffel, It’s Official: Facebook Is Becoming the Platform For You, AARP (Feb. 20, 2018), https://www.aarp.org/home-family/personal-technology/info-2018/facebook-users-age-fd.html. 6 Anita Balakrishnan, Sara Salinas, & Matt Hunter, Mark Zuckerberg Has Been Talking about Privacy for 15 Years – Here’s Almost Everything He’s Said, CNBC (Apr. 9, 2019), https://www.cnbc.com/2018/03/21/facebook- ceo-mark-zuckerbergs-statements-on-privacy-2003-2018.html.

4 Facebook Software Development Kit (“SDK”). (Compl. ¶¶ 29–30.) By using the SDK in their

applications, developers were able to let a user log into the developer’s application with the

user’s Facebook log-in credentials, which made log-in easier for users. (Id. ¶¶ 30.) Facebook, in

turn, received even more information about those users when they logged into an application

developed with the SDK toolkit. (Id. ¶¶ 30–31.) During the relevant period here—between 2010

and 2015—developers also got something else entirely in the deal.

Under the operative version of Facebook’s software, called “Graph API v1.0,” once a

user logged into an application on the web and clicked through the appropriate permissions, the FILED DATE: 6/24/2019 9:23 PM 2018CH03868

application’s developer was able to collect not only that user’s Facebook data, but also the data

of every person in that person’s friend group—often hundreds or thousands of individuals. (Id. ¶

36–37.) This included substantially everything the user or their friends produced on the

Facebook site, including their posts, photos, and videos. (Id. ¶¶ 37, 40.) It also provided an

incredible menu of demographic information, including a user’s full name, address, age,

interests, hometown, education level, religious affiliation, political affiliation, relationship status,

and all of the pages the user had “liked.” (Id.) In effect, Facebook had popped the lid off every

social network on its site for any developer to peer in, provided they could get one individual to

use that developer’s application and give the necessary permissions.

This is how Cambridge Analytica turned 270,000 unwary clicks into a heist of 87 million

Facebook profiles of American voters; what it hoped would be a nuclear weapon in the

electioneering business in which Cambridge Analytica was engaged. (Compl. ¶¶ 33–41.)7

Loosely formed in 2013 as an entity within a larger company—SCL Group Limited—Cambridge

7 At the time of the Complaint’s filing, this was estimated at just 50 million. (See Compl. ¶ 39.) Facebook revised that number upward shortly afterward. Issie Lapowsky, Facebook Exposed 87 Million Users to Cambridge Analytica, WIRED (Apr. 4, 2019), https://www.wired.com/story/facebook-exposed-87-million-users-to-cambridge- analytica/.

5 Analytica’s then-director Alexander Nix set out to create a team of data analysts, psychologists,

and political operatives that could successfully use data analytics to model U.S. voter behavior,

and assess how to influence voters using their inherent psychological traits. (Id. ¶ 20.) Called

“psychographic profiles,” these assessments combined various data points about a voters’

interests, activities, opinions, and motivations. (Id. ¶ 58.) The profiles would then predict voter

behavior, and also help to determine how best to manipulate it. (Id. ¶ 59.) What Cambridge

Analytica needed—and what Facebook was able to provide—was those data points.

II. Cambridge Analytica takes user information. FILED DATE: 6/24/2019 9:23 PM 2018CH03868

In June 2014, Cambridge Analytica hired a Cambridge University researcher named

Aleksandr Kogan to collect the data they needed to power their electioneering firm. (Id. ¶ 25.)

Kogan and Cambridge Analytica knew that Facebook data was available for the taking even with

rudimentary applications; all that was needed was a Facebook user to log into it and click the

right permissions button. (Id. ¶¶ 26–27.) So Kogan designed an application called

“thisisyourdigitallife,” and paid 270,000 Facebook users between $1 and $2 to take it. (Id. ¶¶ 33–

34.) Kogan got the data of those 270,000 people. (Id. ¶ 36.) But because Kogan was able to use

Facebook’s code to access those user’s friends’ data as well, he was able to multiply that

permission three hundred times over. (Compl. ¶ 36–39.) That’s how Cambridge Analytica got

access to everything that nearly 90 million people put on Facebook.

Cambridge Analytica went on to try and use the data to establish individual’s

personalities on a personality metric known as OCEAN: Openness, Conscientiousness,

Extraversion, Agreeableness, and Neuroticism. (Id. ¶ 60.) According to Cambridge Analytica,

this allowed its clients to bypass individuals’ cognitive defenses by appealing directly to their

emotions, using increasingly segmented and sub-grouped personality type designations and

6 precisely targeted messaging based on those designations. (Id. ¶ 61.) For example, it used this

data to assist Senator Ted Cruz’s campaign for president, and may have used it to help the 2016

Trump campaign as well. (Id. ¶¶ 62–63.)

III. Facebook finds out, but tells no one.

To be clear, Kogan’s handing information over to Cambridge Analytica violated what

developers like him agreed to with Facebook. A developer was allowed to access everything that

a user and a user’s friends put on Facebook, but they weren’t supposed to use it for purposes

outside the application like advertising. (Compl. ¶ 69.) But as Kogan later described it, FILED DATE: 6/24/2019 9:23 PM 2018CH03868

Facebook’s policies made this more or less an inevitability:

The idea that we stole the data, I think, is technically incorrect. I mean, they created these great tools for developers to collect the data. And they made it very easy. I mean, this was not a hack. This was, “Here’s the door. It’s open. We’re giving away the groceries. Please collect them.”

Lesley Stahl, Aleksandr Kogan: The Link Between Cambridge Analytica and Facebook, CBS

NEWS (Apr. 22, 2018), https://www.cbsnews.com/news/aleksandr-kogan-the-link-between-

cambridge-analytica-and-facebook/. Even Facebook—perhaps realizing that it had left the

groceries out for the taking—made a number of representations about what it would do to control

developers. Particularly, Facebook told users that user privacy “was very important to”

Facebook, and Facebook assured users that they “own[ed] all of the content and information

[users] post on Facebook, and [users] can control how it is shared through [users’] privacy and

application settings.” (Statement of Rights and Responsibilities, June 8, 2012, attached hereto as

Exhibit 2, at 1.) Facebook also notified users that it would “require applications to respect your

privacy,” and represented in the same document that developers could be audited, that Facebook

could require them to delete data, and that Facebook could limit their access to data. (Id. at 1–5.)

Facebook had a separate agreement with developers, called its “Platform Policies,” which

7 reiterated these policies and prohibited developers from using user’s friends data outside the

application. (Platform Policies, Aug. 3, 2013, attached hereto as Exhibit 3, at § II ¶ 4.)8

Facebook in fact investigated Kogan and Cambridge Analytica for violating its user

agreements in 2015. (Compl. ¶ 39 n. 27.) It was then that it learned the truth about what Kogan

and Cambridge Analytica were doing. (Id.) But all Facebook did in response was to make

Cambridge Analytica promise it had deleted the data. (Id.) Facebook did not, however, verify

that the data had been destroyed, despite the fact that this promise had been made by an entity

that already violated Facebook’s policies. (Id.) FILED DATE: 6/24/2019 9:23 PM 2018CH03868

Worse, Facebook concealed the fact that any of this had occurred. It never told any of the

users that their profiles had been harvested by Cambridge Analytica in violation of the terms. (Id.

¶ 82.) That is, until March 2018, when a New York Times article made public what Facebook

had tried to hide. (Id. ¶¶ 81–85).9 A few days later, Mark Zuckerberg, Facebook’s CEO, issued a

public statement conceding that Facebook had breached the trust of “the people who share their

data with us and expect us to protect it.” (Compl. ¶ 85.) Sheryl Sandberg, Facebook’s Chief

Operating Officer, also acknowledged that Facebook committed “a major violation of people’s

trust” when it allowed Cambridge Analytica to collect user data and that she “deeply regret[ted]

that [Facebook] didn’t do enough to deal with it.” (Id.)

IV. The lawsuit on behalf of the People of the State of Illinois.

The State’s Attorney of Cook County, Kimberly M. Foxx, brought this suit on May 23,

2018 in the name of the People of the State of Illinois, pursuant to her enforcement powers under

8 These two policies were updated over the time period that Cambridge Analytica was taking data from Facebook, but not with respect to this language. This group of policies is referred in the complaint, which were also identified by Facebook in its response brief. (Compl. ¶¶ 69, 79.) 9 See Matthew Rosenberg, Nicholas Confessore and Carole Cadwalladr, How Trump Consultants Exploited the Data of Millions, NEW YORK TIMES (March 17, 2018), https://www.nytimes.com/2018/03/17/us/politics/cambridge-analytica-trump- campaign html#click=https://t.co/UAg1Q5t1BG.

8 the Illinois Consumer Fraud and Deceptive Business Practices Act, 815 ILCS 505/1 et seq.,

seeking civil penalties and injunctive relief to vindicate the rights of Illinois residents who had

been defrauded. Facebook initially removed the case to federal court and sought to consolidate it

into the pending multidistrict litigation, along with a number of putative consumer class action

cases that had been filed and consolidated in the Northern District of California. See In re

Facebook, Inc. Consumer Privacy User Profile Litig., 18-md-2843 (N.D. Cal.) (Chhabria, J.).

The State immediately moved to remand, pointing out that litigation brought by a State is

not removable under the diversity statute, 28 USC § 1332, which was Facebook’s purported FILED DATE: 6/24/2019 9:23 PM 2018CH03868

ground for federal jurisdiction. The Judicial Panel on Multidistrict Litigation nevertheless opted

to transfer the case to the Northern District of California, where the MDL court could (and did)

consider the request for remand. The MDL court ultimately granted the State’s motion, citing,

among things, concerns about the MDL’s intrusion into this action’s efforts to “vindicate a

state’s sovereign interests.” In re Facebook, Inc., Consumer Privacy User Profile Litig., 354 F.

Supp. 3d 1122, 1125 (N.D. Cal. 2019).

ARGUMENT

I. This Court has specific personal jurisdiction over Facebook.

Facebook argues first that this Court lacks specific personal jurisdiction over it,10

ignoring key aspects of the Complaint and relevant case law. Illinois is undeniably the proper

place for this dispute, given the State’s “manifest interest” in enforcing violations of its own laws

in its home forum. See Burger King Corp. v. Rudzewicz, 471 U.S. 462, 473 (1985); see also, e.g.,

10 Facebook also argues that the Court lacks general personal jurisdiction over it. For purposes of the instant brief, the State concedes that Facebook is neither incorporated in nor has its principal place of business in Illinois. As a result, general personal jurisdiction is unlikely to exist, and the State focuses its argument here on the fact that Illinois courts can appropriately exercise specific personal jurisdiction over Facebook.

9 Bulldog Inv’rs Gen. P’ship v. Sec’y of Com., 457 Mass. 210, 217–18 (2010). The Court should

reject Facebook’s flawed arguments on jurisdiction, just as the D.C. Superior Court did.

A. Facebook has waived any personal jurisdiction argument.

Facebook has waived any objection to personal jurisdiction. 735 ILCS 5/2-301(a-6)

provides that a party waives this objection if they file “any other motion” other than those

enumerated in the statute. Facebook moved to stay proceedings after removing this case to

federal court,11 see No. 1:18-cv-02667, dkt. 13 (N.D. Ill. Apr. 17, 2018), and moved to transfer

the case to the federal MDL. Neither motion is exempt under § 2-301(a-6). See Deutsche Bank FILED DATE: 6/24/2019 9:23 PM 2018CH03868

Nat. Tr. Co. v. Hall-Pilate, 2011 IL App (1st) 102632, ¶¶ 15–16 (holding that motion to stay

waives jurisdiction). Facebook has waived jurisdiction.

B. Facebook expressly aimed its tortious conduct at Illinois.

Even without waiver, this Court may exercise jurisdiction over Facebook. In Illinois,

personal jurisdiction may be exercised to the extent federal due process allows. Russell v. SNFA,

2013 IL 113909, ¶¶ 30–32. Specific personal jurisdiction lies where a defendant has “minimum

contacts” with the forum state, and exercising jurisdiction would be reasonable; i.e., consistent

with notions of fair play and substantial justice.12 Id. at ¶ 34. For actions sounding in tort, the

exercise of specific personal jurisdiction is appropriate where there is (1) intentional conduct, (2)

expressly aimed at the forum state, (3) with a party’s knowledge that the effects would be felt in

the forum state. Tamburo v. Dworkin, 601 F.3d 693, 703 (7th Cir. 2010); Walden v. Fiore, 571

U.S. 277, 287–88 (2014) (discussing Calder v. Jones, 465 U.S. 783 (1984), noting that effects of

tortious act felt in forum state produce minimum contacts). A “single act” can support

11 The fact that this motion was made in Illinois federal court, not state court, is irrelevant, as the personal jurisdiction analysis would be the same in either case, and Facebook could—and should—have raised the issue of personal jurisdiction at the outset in either forum. 12 Facebook has waived any “reasonableness” argument by not raising it in its opening brief.

10 jurisdiction; however, the nature of any contacts must be considered in light of the particular

claim at issue. Burger King, 471 U.S. at 475 n.18.

The nature of the State’s ICFA claim is key to the purposeful direction analysis. Walden,

571 U.S. at 287–88. The claim involves Facebook’s “misrepresentation or the concealment . . .

of any material fact” to its users. 815 ILCS 505/2. Thus, the relevant question for the personal

jurisdiction analysis is who Facebook was deceiving. See, e.g., Khan v. Gramercy Advisors,

LLC, 2016 IL App (4th) 150435, ¶ 193 (“[R]esident’s detrimental reliance on a

misrepresentation that a nonresident, from outside the forum state, purposefully directed at the FILED DATE: 6/24/2019 9:23 PM 2018CH03868

resident within the forum state, with the intention that the resident rely on” it supports

jurisdiction). Illinois users were an undeniable target of this deception, given Facebook’s more

than 7 million users in the State and its choice to hide the substantial effects of the Cambridge

Analytica breach within the State. As such, Facebook’s misrepresentations had direct, known,

and intended effects in Illinois.

At bottom, this case sits at the intersection of Facebook’s two faces: a public-facing

social network that envisions users generating data about themselves to consensually share with

others; and a secretive data mining operation that provides vast quantities of user data (including

Illinoisans’ data) to third parties, and allows other third parties to similarly mine that data. (See

Compl. ¶¶ 8, 28–31.) Through this data collection, Facebook has the ability to—and does—

“predict the home location of users,” and does so as part of its “course of business.” (See Hr’g

Tr., In re Facebook Biometric Info. Privacy Litig., No. C 15-3747-JD, at 10:1–3, 12:21–13:2,

18:18–21) (N.D. Cal. May 21, 2018), attached hereto as Exhibit 4.)13 Of course Facebook knows

that it has more than 7 million users in Illinois, (see Decl. of Alan Vasquez, In re Facebook

13 Facebook openly admits to “us[ing] IP [address] and other information such as check-ins and current city from your profile” to determine users’ locations. See Kashmir Hill, Turning Off Facebook Location Tracking Doesn’t Stop It From Tracking Your Location, GIZMODO (Dec. 18, 2018), https://bit.ly/2UY7Iwv.

11 Biometric Info. Privacy Litig., No. C 15-cv-3747-JD, dkt. 370-2, at ¶ 8, attached hereto as

Exhibit 5), and has accordingly maintained a continuous business registration in Illinois for more

than ten years, (see Facebook, Inc., Corporation File Detail Report, Illinois Secretary of State,

attached hereto as Exhibit 6). Facebook also knows—and has known—precisely which users

were affected by the Cambridge Analytica breach, in which Facebook knowingly allowed

Cambridge Analytica to “secretly harvest its users’ data” via users’ Facebook friends without

their knowledge or consent—some 2,949,469 Illinois users.14 (Compl. ¶¶ 30–39, 79–84.)

Facebook did not reveal this to the users it knew were located in Illinois—a significant source of FILED DATE: 6/24/2019 9:23 PM 2018CH03868

the company’s American user base. (See Ex. 5 at ¶ 8.) Thus, Facebook intentionally deceived

Illinoisans about who it was sharing information with in hopes that they would continue using its

platform. (Compl. ¶¶ 79–84.) This is sufficient to give rise to personal jurisdiction. E.g., In re

Chrysler-Dodge-Jeep Ecodiesel Mktg., Sales Practices, & Prod. Liab. Litig., 295 F. Supp. 3d

927, 1028–1029 (N.D. Cal. Mar. 15, 2018) (engaging in plan to purposefully conceal product

defects from forum residents supports jurisdiction).

Indeed, this is precisely what the Superior Court of the District of Columbia found,

holding that Facebook purposefully intended to acquire District of Columbia users—as

evidenced by Facebook’s filings with DC’s Department of Consumer and Regulatory Affairs—

and that “Facebook’s practices clearly had an ‘effect’ in this jurisdiction when over 340,000

District of Columbia residents’ personal data was collected by Cambridge Analytica from 2013-

2015.” DC Court Op. at 21. This Court can apply the same analysis here.

14 Tom Warren, Facebook Starts Notifying Millions of Users That Their Data Was ‘Improperly Obtained,’ THE VERGE, https://bit.ly/2IHVqBp (Apr. 9, 2018); State by State Breakdown of People Whose Facebook Information May Have Been Improperly Shared with Cambridge Analytica, https://fbnewsroomus files.wordpress.com/2018/05/state-by-state-breakdown.pdf.

12 In two other similar cases, Judge Feinerman of the Northern District of Illinois found

personal jurisdiction over two foreign entities. See Mizuho Bank, Ltd., 169 F. Supp. 3d 855;

Greene v. Karpeles, No. 14-cv-1437, 2019 WL 1125796 (N.D. Ill. Mar. 12, 2019); see also Lack

v. Mizuho Bank, No. 18-cv-00617, 2018 WL 5906849, at *3 (C.D. Cal. June 19, 2018). There,

former customers of an online bitcoin exchange sued the owner (Karpeles) and Japanese banking

partner (Mizuho Bank) for concealing the bank’s refusal to process withdrawals for months prior

to the exchange’s collapse (i.e., users could not withdraw their money and lost it ). Mizuho and

Karpeles moved to dismiss for lack of personal jurisdiction, and both attempts failed. As the FILED DATE: 6/24/2019 9:23 PM 2018CH03868

court noted, Mizuho Bank’s awareness of plaintiff’s home state via wire transfer information

gave rise to jurisdiction, given the nature of the tort at issue (fraudulent concealment) and

Mizuho’s knowing failure to make disclosures to the plaintiff. Mizuho, 169 F. Supp. at 860–62.

The same was true for Karpeles, based on a similar possession of user address information.

Karpeles, 2019 WL 1125796, at *7–8.

And the same is true here: “Facebook engaged in [] deceptive conduct by making

representations to consumers that were knowingly false,” allowing “third parties . . . to collect

and harvest its [Illinois] users’ personal data” that resulted in third parties profiling and targeting

them. (Compl. ¶¶ 79–80.) Further, when Facebook learned of this, it “did not put a stop to it” and

“conceal[ed] the breach from its users” known to reside in Illinois, while they continued to

generate data. (Id. ¶¶ 81–82.) This is the functional equivalent of allowing known forum

residents to believe they would be able to retrieve money from a bank. Facebook’s acts and

omissions create contacts that necessarily support personal jurisdiction.

C. Facebook has engaged in systematic business contacts in Illinois.

Facebook is also subject to this Court’s jurisdiction through its exploitation of the Illinois

13 market. In the Internet context, a party’s “deliberate and continuous” exploitation of a market

through an interactive website may give rise to personal jurisdiction. See uBID, Inc. v. GoDaddy

Grp., 623 F.3d 421, 428–29 (7th Cir. 2010). Of course, the nature of the exploitation must still

relate to the claims at issue. Id. Jurisdiction will lie when a party regularly reaches into a forum

to do business through its website, stands willing to accept business from forum users, contracts

with those users, and profits from their relationship. See, e.g., Innovative Garage Door Co. v.

High Ranking Domains, LLC, 2012 IL App (2d) 120117, ¶ 21 (“[J]urisdiction attaches to a

nonresident defendant where it transacts business . . . via an interactive website where contracts FILED DATE: 6/24/2019 9:23 PM 2018CH03868

are completed online and defendant derives profit [] from web-related activity.”) (internal

quotations omitted); Ratliff v. Venture Express, Inc., No. 17 C 7214, 2019 WL 1125820, at *8

(N.D. Ill. Mar. 12, 2019) (company’s actions in relation to an Illinois user’s use of website

supports jurisdiction); Mavrix Photo, Inc. v. Brand Techs., Inc., 647. F.3d 1218, 1221–22 (9th

Cir. 2011) (conduct purposefully directed at forum where website “sought and attracted [a]

nationwide audience[]” for “commercial gain,” making in-forum effects a “predictable

consequence of their business model[]”); uBID, Inc., 623 F.3d at 428–29 (despite “no evidence”

nonresident internet domain registration company “specifically targets Illinois customers,” its

“hundreds of thousands” of Illinois customers demonstrated it had engaged in “deliberate and

continuous” exploitation of the market and established personal jurisdiction).

Facebook’s business model is based on deriving data from its users, requiring it to reach

into nearly 7 million Illinoisans’ pockets on a constant basis—or to allow third-parties like

Cambridge Analytica to do so. In service of this business, it entered into user agreements with

millions of Illinoisans; agreements providing how, where, when and what data they create

through the use of Facebook can be used by Facebook or third-parties. (See Ex. 5 at ¶ 8.)

14 Facebook has also maintained a continuous business registration in Illinois, and has an office in

Chicago involved in selling advertisements based on the very data-generation and collection

implicated by this suit. (See Ex. 6; infra n. 17.) Thus, as described in the Complaint, Facebook

engages in continuous business in Illinois with its users by which it gathers user data and sells it

for profit, and has allowed third parties like Cambridge Analytica to do the same. This also

suffices to allow the Court to exercise personal jurisdiction over Facebook.

Facebook may reply that this only implicates its users’ Illinois residency, and is

insufficient for jurisdiction. Not so; it is Facebook’s continuous reaching into Illinois that creates FILED DATE: 6/24/2019 9:23 PM 2018CH03868

jurisdiction. Imagine a lawsuit against a Company A arising from the company’s continuous

operation of a coal mine in Illinois, and allowance of Company B to use that mine; it is

inconceivable that jurisdiction would not lie against Company A. The same would hold true here.

The mine is Facebook’s Illinois user base—Facebook is Company A and Cambridge Analytica is

Company B. Facebook’s extraction activities just happen to involve mining data, not coal. There

is no reason that Facebook shouldn’t expect to be haled into an Illinois court.

Again, the D.C. Superior Court relied on the same reasoning to find that Facebook was

subject to jurisdiction. The court held that Facebook did more than operate a website, instead

serially engaging in “transactions” with users, ones that “involve Facebook users freely sharing

their personal data with other users, which Facebook then allegedly collects and sells to third

parties.” D.C. Court Op. at 20. Even in D.C., which has a smaller user population than Illinois,

the profits derived by Facebook exceeded $10 million in the single last quarter of 2018; the

Court accordingly found “Facebook’s distribution of District of Columbia users’ personal data

for profit” qualified as a systematic and continuous transaction. Id. The situation is the same

here.

15 D. Facebook’s flawed arguments against jurisdiction fail.

Facebook makes three sets of arguments against personal jurisdiction, all of which were

similarly rejected by the D.C. court, and which this Court can appropriately reject as well. First,

Facebook contends the Complaint’s only jurisdictionally relevant allegation is that there are

Facebook users in Illinois, (Def.’s Mem. at 5), that no alleged “specific relevant conduct []

occurred within Illinois” and no alleged business transactions took place in Illinois, (id. at 6.) Yet

the Court should look beyond the complaint in assessing personal jurisdiction. See 735 ILCS 5/2-

301(b) (courts “shall consider” “papers on file in the case, affidavits . . . and any evidence FILED DATE: 6/24/2019 9:23 PM 2018CH03868

adduced upon contested issues of fact.”). And this misses a more fundamental point: it is

Facebook’s misrepresentations to those users and knowing silence about Cambridge Analytica’s

conduct that connects Facebook to Illinois, along with Facebook’s ongoing business here.

Second, Facebook’s citation to cases holding that merely being able to access a website is

insufficient to support jurisdiction are irrelevant. (Def.’s Mem. at 6–7.) In particular, its reliance

on Gullen is flawed, as the case involved no Facebook users at all, no argument that Facebook

knew its conduct would have effects in Illinois, and no duty to make disclosures. Gullen v.

Facebook.com, Inc., No. 15 C 7681, 2016 WL 245910, at *1, 3 (N.D. Ill. Jan. 21, 2016). And

Gullen, unlike this case, was about the collection of biometric data as part of Facebook’s photo-

tagging feature, which the Court found was unrelated to the data mining and brokering at the

core of the company’s business model. See id. Facebook cites a few other cases rejecting

jurisdiction over Facebook, but even a cursory reading demonstrates the frailty of Facebook’s

jurisdictional arguments: the allegations in those cases have nothing to do with the allegations of

the State’s Complaint and, it must be noted, were brought by individuals pro se who failed to

make colorable jurisdictional arguments. Corley v. Vance, 365 F. Supp. 3d 407, 427 (S.D.N.Y.

16 2019) (in case brought by pro se prisoner where prisoner failed to make specific jurisdiction

argument, nevertheless finding no jurisdiction over Facebook for Facebook’s compliance with

subpoena); Georgalis v. Facebook, Inc., 324 F. Supp. 3d 955, 961 (N.D. Ohio 2018) (in case

brought by pro se sovereign citizen for Facebook’s deleting his comments on the website,

finding specific jurisdiction lacking because allegations were unrelated to Facebook’s business

of “targeted marketing”); Ralls v. Facebook, 221 F. Supp. 3d 1237, 1240 (W.D. Wash. 2016)

(similar to Georgalis—a pro se litigant suing Facebook for removing hate speech from the site).

Last, Facebook argues its website’s nationwide uniformity makes “purposeful” direction FILED DATE: 6/24/2019 9:23 PM 2018CH03868

impossible, because its conduct affected users everywhere (and the State must allege “Facebook

misrepresented or omitted [] facts only to Illinois[ans]”). (Def.’s Mem. at 6.) That is, of course,

wrong as a matter of law. Facebook’s “purposefully direct[ing] its business activities toward

[Illinois] just as it had toward all other states” is sufficient to give rise to personal jurisdiction in

Illinois. uBid, 623 F.3d at 428 (discussing Keeton v. Hustler Magazine, Inc., 465 U.S. 770, 774

(1984)). That Facebook’s conduct affected users in other states does not detract from its contacts

with Illinois—accepting Facebook’s argument would lead to the “absurd result” of allowing a

massive company that purposefully directs its activities to numerous states to be sued only in its

home state(s). Ratliff, 2019 WL 1125820, at *8; see also, e.g., Acorda Therapeutics Inc. v. Mylan

Pharm. Inc., 817 F.3d 755, 759–60 (Fed. Cir. 2016), cert. denied sub nom. Mylan Pharm. v.

Acorda Therapeutics, 137 S. Ct. 625 (2017) (fact drug marketing would also be directed at other

states does not defeat jurisdiction); Payton v. Kale Realty, No. 13 C 8002, 2014 WL 4214917, at

*4 (N.D. Ill. Aug. 26, 2014) (fact defendants aimed tortious products to residents in all fifty

states did not render subsequent sales to Illinois residents merely fortuitous contacts).

17 Facebook effectuated its plan of purposeful silence and misrepresentation knowing that it

would affect its substantial Illinois user base, making its relevant contacts anything but “random,

fortuitous, or attenuated.” Burger King, 471 U.S. at 475. Rather, jurisdiction is derived here from

Facebook’s tortious conduct, and is necessarily “intertwined with [its] transactions or

interactions” with Illinois users. Walden, 571 U.S. at 286; Lack, 2018 WL 5906849, at *3.

E. In the event the Court is inclined to agree with Facebook, the State requests leave to take jurisdictional discovery.

Facebook maintains a substantial business presence in Chicago focused on advertising

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 and sales, i.e., the private-facing parts of its massive data mining business.15 In the event that the

Court is inclined to agree that personal jurisdiction is lacking on the current record, the State

respectfully requests leave to take additional jurisdictional discovery on (i) the activities of this

office and their relationship to Facebook’s and other third-parties’ collection of user data,

including the Cambridge Analytica breach, and (ii) Facebook’s Illinois user base and revenues

derived from this activity. Ill. Sup. Ct. R. 201(l); see also D.C. Court Op. at 19–20 (relying on

these factors). Plaintiff nevertheless does not wish to delay the case any further if it can be

avoided: personal jurisdiction lies with the information readily available to the State and the

Court described above—Facebook has purposefully availed itself of this forum by deriving

information from and selling advertising on Illinois residents’ data for years.

Facebook’s motion, as it relates to personal jurisdiction, must be denied.

The Illinois Consumer Fraud Act prohibits entities from defrauding consumers, either by

telling falsehoods or by withholding information that a reasonable consumer would consider

15 Karis Hustad, Look Inside Facebook’s Growing Chicago Office, CHI. BUS. J. (Mar. 10, 2017), https://bit.ly/30XvtYq.

18 material. Connick, 174 Ill. 2d at 504 (“An omission or concealment of a material fact in the

conduct of trade or commerce constitutes consumer fraud.”). Thus, to succeed on an ICFA

deceptive-omission claim, a plaintiff must establish that defendant has engaged in a transaction

with a consumer, and has failed to adequately disclose facts or practices that a reasonable

consumer would deem material to the transaction. See Dwyer v. Am. Exp. Co., 273 Ill. App. 3d

742, 750 (1st Dist. 1995); Elder v. Coronet Ins. Co., 201 Ill. App. 3d 733, 751 (1st Dist. 1990).

At the motion to dismiss stage, however, all facts must be taken in light most favorable to the

State; Facebook must accordingly demonstrate that no reading of these facts would be material to FILED DATE: 6/24/2019 9:23 PM 2018CH03868

a reasonable consumer. See Covarrubias v. Bancomer, S.A., 351 Ill. App. 3d 737, 739–40 (1st

Dist. 2004). Finally, this is an enforcement action brought to punish Facebook for its

wrongdoing, not to recover for consumer damages. The People accordingly need not allege—or

prove—that a consumer relied on the omission. See 815 ILCS 505/2; Oliveira v. Amoco Oil Co.,

201 Ill. 2d 134, 149 (2002) (noting that enforcement actions do not require consumer reliance).

The State alleges that Facebook’s failure to take reasonable steps to protect consumer

data, and its failure to disclose the breach once it found out that it occurred, are actionable under

the ICFA. Facebook’s response, at base, is that everybody knew that it was doing nothing to

protect user data, and that it had disclaimed any responsibility that might arise from that

decision. (Def.’s Mem. at 9 (“An ICFA claim fails when consumers ‘know the truth.’”)

Facebook’s view does little to explain the fallout that has followed the revelation of the

Cambridge Analytica scandal, including a Congressional investigation, an FTC investigation,

and a year of above-the-fold headlines. Facebook’s argument that its absolute failure to protect

and police the data entrusted to it is not news to anyone is somewhat betrayed by all of the news.

19 Regardless, both of Facebook’s omissions are material, and both substantiate the State’s claim

under ICFA.

A. Facebook did not disclose to users that it took no responsibility for the system of sharing it had set up with third-party application developers.

As Facebook sees it, its disclosures are adequate to put any reasonable user on notice that

it would do nothing to deal with rogue developers, despite the fact that it had opened its users up

to widespread sharing with applications. (Def.’s Mem. at 9–10.) This argument derives from

Facebook’s general disclaimer, limitation of liability, and purported release of all liability; that

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 is, a wall of text that it pinned at the end of its Statement of Rights and Responsibilities

document. (See Ex. 2 at ¶ 16.)16 Facebook doesn’t contend that any of this—the release,

limitation of liability, etc.—is actually enforceable, but does believe that it warned consumers

that it broadly disclaimed responsibility for the actions of any third party on the platform.

But this boilerplate is in sharp contrast to the other things that Facebook says at the front

end of this document. The very first words of the very first paragraph are that “Your privacy is

very important to us.” (Ex. 2 at ¶ 1.) Facebook goes on to make a number of representations to

users about their data and about developers:

You [users] own all of the content and information you post on Facebook, and you can control how it is shared through your privacy and application settings. . . . We require applications to respect your privacy, and your agreement with that application will control how the application can use, store, and transfer that content and information.

(Id. at ¶ 2 (emphasis added).) In the same document, Facebook claims to regulate developers:

16 Facebook takes a broadside against the Complaint, arguing that these documents must be attached in order to state a claim, or that Facebook does not know with particularity what statements constitute the fraud. (Def.’s Mem. at 8.) The Complaint alleges that “Facebook represented to its users that their personal data would be protected in accordance with its user and developer agreements.” (Compl. ¶ 79.) Facebook evidently knows precisely what Plaintiff is referring to, as it produced those agreements in full in support of this motion to dismiss. Nor does 735 ILCS 5/2-606 require Plaintiff to attach them; that provision is for contractual actions “founded upon a written instrument.” Plaintiff’s claims do not derive from the written instrument, but from Facebook’s fraud. Regardless, Plaintiff would request leave to amend should the Court choose to dismiss on this basis.

20 If you are a developer or operator of a Platform application or website, the following additional terms apply to you: You [developers] will only request data you need to operate your application . . . . You will not directly or indirectly transfer any data you receive from us to (or use such data in connection with) any ad network, ad exchange, data broker, or other advertising related toolset, even if a user consents to that transfer or use. You will not sell user data . . . . We can require you to delete user data if you use it in a way that we determine is inconsistent with users’ expectations. We can limit your access to data. . . . To ensure your application is safe for users, we can audit it.

(Id. at ¶ 9.) FILED DATE: 6/24/2019 9:23 PM 2018CH03868

This language does not inform consumers that Facebook actually did nothing to protect

its users from developers like Kogan who intended solely to harvest user information for other,

outside-of-the-app purposes. (Compl. ¶¶ 80, 81.) Facebook’s position—that anyone reading this

language would understand that Facebook had taken a laissez-faire approach to its otherwise

closed social network—is facially untenable, because this language contains conflicting

information about how safe Facebook would keep user data. Taking the facts in the light most

favorable to Plaintiff at this stage, this language must be read for the mixed messaging that it is:

of course Facebook didn’t want consumers to actually believe that it had opened up the data

honeypot to any developer with an application, and that Facebook would do nothing to protect

those users. Instead, Facebook stuck in a disclaimer clause hoping to avoid any responsibility for

keeping consumers safe, while convincing them that precisely the opposite was occurring. See

Oldendorf v. Gen. Motors Corp., 322 Ill. App. 3d 825, 830 (2d Dist. 2001) (“While poor drafting

and design of a legal document do not constitute fraud, deliberate obfuscation of the truth with

vague, misleading, and contradictory language and concealed clauses may be fraudulent.”).

That’s exactly what the D.C. Superior Court held, where it found that this same language “failed

21 to provide consumers with a clear explanation of how much responsibility Facebook undertook

to protect consumers’ personal data from third parties.” D.C. Court Op. at 27.

Defendant’s few cases cited to support this argument beg the question: the consumer

plaintiffs in those cases knew the contents of the supposed omission. See Haywood v. Massage

Envy Franchising, LLC, 887 F.3d 329, 333 (7th Cir. 2018) (plaintiff could not allege fraud for

second visit to massage parlor for “60 minute” massage, where she knew from previous visit that

massage was only 50 minutes); Krause v. GE Capital Mortg. Serv., Inc., 314 Ill. App. 3d 376,

388 (1st Dist. 2000) (at summary judgment, finding “[t]he undisputed evidence in the record FILED DATE: 6/24/2019 9:23 PM 2018CH03868

established that defendant disclosed to plaintiffs the fees at issue before plaintiffs chose the

additional services provided and before charging plaintiffs for these services. Defendant

disclosed these fees through its automated phone system, through its customer service

representatives, and through its payoff statements, which stated that any request for an additional

quote would be subject to a fee.”). Otherwise, the plaintiffs in those cases failed to identify any

inconsistency between the purported omission and the affirmative representations made in the

transaction. See Phillips v. DePaul Univ., 2014 IL App (1st) 122817, ¶ 40 (dismissing consumer

class action against law school for failing to disclose that employment statistics included non-

legal jobs); Aliano v. Ferriss, 2013 IL App (1st) 120242, ¶ 27 (dismissing consumer class action

against book’s author for providing bonus material free—without purchase of the book—where

advertising declared that content was available on free message boards).17 No such reading is

available to Facebook here. Taking these disclosures in the light most favorable to plaintiffs, a

reasonable consumer would be hard-pressed to understand that Facebook had abandoned all

17 Facebook also cites Smith v. Facebook, Inc., 745 F. App’x 8 (9th Cir. 2018), where the Ninth Circuit found that Facebook had adequately disclosed that it collected information from other websites about its users. This holding has nothing to do with collection going the other way—third parties’ collection of information from Facebook about Facebook’s users—or whether Facebook hid the fact that it wouldn’t police that collection.

22 responsibilities for regulating third-party developers. At the motion to dismiss stage, this

language is not the exit strategy that Defendant hopes for.

Defendant also argues that the State failed to plead intent, because Cambridge Analytica

violated Facebook’s stated policies. For one, the State’s Attorney need not demonstrate intent in

pleading, or winning, an ICFA claim. The statute creates separate penalties where a court finds

the “method, act, or practice to have been entered into with the intent to defraud,” 815 ILCS

505/7, but an enforcement claim need not, as a pleading matter, establish as much, see id. As

courts have explained, “[u]nder the statute, state of mind is immaterial, and a defendant need not FILED DATE: 6/24/2019 9:23 PM 2018CH03868

be motivated by an intent to deceive.” Warren v. LeMay, 142 Ill. App. 3d 550, 566 (5th Dist.

1986). Instead, “[a] party is considered to intend the necessary consequences of his own acts or

conduct.” Id. Facebook did fully intend for consumers to rely on its omission of the fact that

Facebook was doing nothing to protect their data; furthermore, the consequences of those

actions—that data was stolen—are not a surprise to Facebook. Intent is not lacking.

B. Regardless, Facebook’s disclosures do not permit it to hide the Cambridge Analytica breach.

Facebook’s disclosures certainly do not permit Facebook to hide an enormous breach of

its users’ data from those users. Cambridge Analytica violated Facebook’s user agreements by

absconding with the contents of more than 50 million accounts. (Compl. ¶ 39.)18 Facebook tried

to keep that a secret for more than three years. (Id. at ¶ 39 & n.27; ¶ 82.) Only when the New

York Times and Guardian broke the story did Facebook fess up about what it knew and let the

affected users know. (Id. at ¶ 85.) And Facebook’s CEO and COO admitted that they had not met

users’ reasonable expectations, acknowledging that they had breached users’ trust and “didn’t do

enough to deal with [the breach].” (Id. ¶ 85.) Even if the disclaimer gave Facebook a pass on the

18 The Complaint refers only to 50 million, but as discussed above, discovery will reveal that number is closer to 87 million or more. See supra n. 8.

23 breach itself—which it does not—it gives Facebook no cover on hiding the breach. Recognizing

this straightforward set of facts, the District of Columbia court denied Facebook’s motion on

these grounds as well. D.C. Court Op. at 28.

Facebook has only a few responses to this. First, it asserts that a separate act—the

Personal Information Protection Act (“PIPA”)—operates to the exclusion of ICFA for any duty

to report a breach of any kind of data. (Def.’s Mem. at 10.) Facebook’s argument here is hard to

track: first, Facebook argues that “Only the Protection Act could apply to Facebook’s alleged

failure to notify Illinois consumers about the Cambridge Analytica incident because it covers the FILED DATE: 6/24/2019 9:23 PM 2018CH03868

particular subject of consumer notifications when data is shared,19 so it applies to the exclusion

of the ICFA.” (Id.) But then Facebook goes on to explain that PIPA does not apply here, because

the data that was stolen does not fall into the categories laid out in PIPA. (Id.) Facebook might

have an argument that PIPA applies to the exclusion of ICFA if PIPA applied, but given that it

does not, its argument is entirely groundless. It is black-letter Illinois law that two statutes must

be in conflict for one to take precedence over the other. In re Jarquan B., 2016 IL App (1st)

161180, ¶ 23 (“[G]enerally when two statutes are in conflict, the more specific should take

precedence over the more general and the more recently enacted statute should be applied over

the earlier enacted statute.”) (emphasis added). Yet again, the D.C. Court rejected the same

argument for the same reason. D.C. Court Op. at 29 (“Facebook also admits that [the narrower

statute] does not apply in this context.”). Facebook’s cases do not remotely support it, and

instead stand for the proposition that where a narrower statute applies, it applies to the exclusion

of a more general one with which it conflicts. Walsh v. Barry-Harlem Corp., 272 Ill. App. 3d

418, 423 (1st Dist. 1995) (where plaintiff brought medical malpractice claim masquerading as

19 The use of the word “shared” here is the least confounding part of this sentence, but reflects the extent to which Facebook values consumer privacy—a person with a common understanding of privacy would not describe a data breach as “sharing” that data.

24 ICFA claim, medical malpractice statute of limitations applied); In re Org. of Greater Algonquin

Park Dist., 103 Ill. App. 3d 1056, 1063 (2d Dist. 1982) (where park district-specific election

statute did not require a petition to be certified, it controlled over the more general election

statute that did require such certifications).

Second, Facebook incredibly contends that the fact of the Cambridge Analytica data

breach was immaterial to a reasonable user as a matter of law. The First District requires, in

evaluating whether a fact would be material to a reasonable consumer, the application of

common sense. See Elder, 201 Ill. App. 3d at 751 (in case asserting consumer fraud claim for FILED DATE: 6/24/2019 9:23 PM 2018CH03868

insurer’s failure to disclose that it required polygraph tests to make claims, finding that

“[c]ommon sense dictates that any prospective purchaser of insurance would be less likely to

purchase insurance from a carrier that, as a matter of policy and general practice, would hire a

polygraph operator [to test the insured’s claim.]”). It defies all reason to accept Facebook’s

argument that—taking the facts in the light most favorable to Plaintiff—no reasonable user

would have thought that the hijacking of their entire Facebook profile by an electioneering firm

in an effort to “psychographically profile” them and influence their votes (and the outcome of a

Presidential election) would be immaterial for that user. Furthermore, the allegations of the

Complaint explain that Facebook hid this information so that it would not lose users (Compl.

¶ 83); the State accordingly did allege that Facebook would have lost users if it had come clean.20

Last, Facebook contends that it cannot be held liable for omitting this information

because everyone knew about the Cambridge Analytica scandal when the Guardian published an

article in 2015, and Fortune’s follow-on article a day or two later. (Def.’s Mem. at 13.) The

Complaint makes no mention of these articles, so this argument must fail as a matter of law. Nor

20 This turned out to be true, as Facebook knows. But as Facebook also knows, Plaintiff does not need to plead that for this motion: instead, the question is whether as a matter of law a reasonable user would consider the Cambridge Analytica scandal “material.”

25 does it make sense that the happenstance of a single publication (or two) would be effective to

make Facebook’s disclosures to its users for it, such that a reasonable user must—as a matter of

law—have been aware of this omission. Finally, the argument simply defies reality: If Facebook

desires to reach beyond the pleadings to assert that everyone was on notice of the Cambridge

Analytica breach because of the Guardian article, it must acknowledge as well the tsunami of

news coverage and investigations that followed the revelations about Facebook’s role in 2018.

Facebook assertion that every reasonable user knew about Cambridge Analytica after 2015 is

difficult to take seriously. FILED DATE: 6/24/2019 9:23 PM 2018CH03868

Facebook’s attempt to evade ICFA liability on the allegations of the State’s Complaint

must fail: Facebook withheld the fact of the Cambridge Analytica breach from its users for

nearly three years. The State’s allegations are sufficient to establish the materiality of that fact, at

the very least at the pleading stage. Accordingly, Facebook’s motion should be denied.

III. Facebook should fail (again) to delay the State’s case with the MDL proceedings.

Facebook takes another hail-mary shot at the State’s case, hoping to delay it along with

the MDL proceeding. In Illinois, a party seeking a stay must “make out a clear case of hardship

or inequity in being required to go forward, if there is even a fair possibility that the stay for

which he prays will work damage to someone else.” Certain Underwriters at Lloyd’s, London v.

Boeing Co., 385 Ill. App. 3d 23, 36 (1st Dist. 2008) (internal quotations omitted). Facebook

argues that a dismissal or stay is appropriate because “there is another action pending between

the same parties for the same cause.” 735 ILCS 5/2-619(a)(3). This is a truly remarkable

assertion: that the State’s Attorney’s case should be dismissed, or stayed, because a set of

consumer plaintiffs have filed a case. Suffice to say, these cases are far from the same. The

State’s Attorney’s case is a regulatory action seeking civil penalties to punish Facebook and

26 deter bad actors like it. Accordingly, the State’s Attorney does not need to establish Article III

standing or actual damages, issues that the consumer plaintiffs in the MDL must surmount. More

importantly, Facebook already tried to wrap this case into the MDL, and it failed. As Judge

Chhabria observed when he remanded this case from the MDL:

When a case is folded into multidistrict litigation, it will almost inevitably be delayed. Its fate will be bound up in the fates of many others. The transferee judge may decide that certain claims should be prioritized or addressed first. The plaintiff may thus lose control over the direction of the lawsuit. And this is a serious concern if the plaintiff is a government entity or official – the multidistrict litigation process would intrude on state or local sovereignty. Therefore, where a case is originally filed in state court to vindicate a state’s sovereign interests, federal courts should FILED DATE: 6/24/2019 9:23 PM 2018CH03868 exercise the greatest possible caution before asserting jurisdiction. The purpose of the multidistrict litigation process is to make the adjudication of federal cases more efficient and fair, not to interfere with the ability of state courts to adjudicate claims brought under state law by state or local officials.

In re Facebook, 354 F. Supp. 3d at 1125. What Facebook is asking the Court to do is “fold” this

case back into the MDL in a way far more prejudicial to the State’s interests: if the case is stayed

or dismissed, the State will have no voice in any proceedings whatsoever, here or in the MDL.

Facebook’s request must accordingly be denied, and it has demonstrated no prejudice that it will

suffer in being required to go forward. The District of Columbia court relied on Judge Chhabria’s

opinion to deny the same request, D.C. Court Op. at 31, which this Court should as well.

CONCLUSION

The State respectfully requests that the Facebook’s motion to dismiss be denied in its

entirety, or in the alternative, that the State be granted leave to amend, and that the Court grant

any further relief as may be appropriate and just.

Respectfully submitted,

PEOPLE OF THE STATE OF ILLINOIS ex rel. KIMBERLY M. FOXX,

Dated: June 24, 2019 By: /s/ J. Eli Wade-Scott One of Plaintiff’s Attorneys

27 Jay Edelson [email protected] Benjamin H. Richman [email protected] Ari J. Scharg [email protected] Alfred K. Murray II [email protected] J. Eli Wade-Scott EDELSON PC 350 N. LaSalle Street, 14th Floor Chicago, Illinois 60654 Tel: 312.589.6370 Fax: 312.589.6378

Rafey S. Balabanian [email protected] FILED DATE: 6/24/2019 9:23 PM 2018CH03868 Todd Logan [email protected] EDELSON PC 123 Townsend Street, Suite 100 San Francisco, California 94107 Tel: 415.212.9300 Fax: 415.373.9435

Special Assistant State’s Attorneys

28 CERTIFICATE OF SERVICE

I, J. Eli Wade-Scott, an attorney, hereby certify that I caused to be served the above and foregoing Plaintiff’s Opposition to Defendant’s Motion to Dismiss by causing a true and accurate copy of such paper to be filed and transmitted to all counsel of record via the Court’s CM/ECF electronic filing system, on this the 24th day of June, 2019.

/s/ J. Eli Wade-Scott

FILED DATE: 6/24/2019 9:23 PM 2018CH03868

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 Exhibit 1

FILED DATE: 6/24/2019 9:23 PM 2018CH03868

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 FILED DATE: 6/24/2019 9:23 PM 2018CH03868 FILED DATE: 6/24/2019 9:23 PM 2018CH03868

FILED DATE: 6/24/2019 9:23 PM 2018CH03868

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 FILED DATE: 6/24/2019 9:23 PM 2018CH03868

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 Exhibit 2 This agreement was written in English (US). To the extent any translated version of this agreement conflicts with the English version, the English version controls. Please note that Section 16 contains certain changes to the general terms for users outside the United States. Date of Last Revision: June 8, 2012.

Statement of Rights and Responsibilities

This Statement of Rights and Responsibilities ("Statement," "Terms," or "SRR") derives from the Facebook Principles, and is our terms of service that governs our relationship with users and others who interact with Facebook. By using or accessing Facebook, you agree to this Statement, as updated from time to time in accordance with Section 14 below. Additionally, you will find resources at the end of this document that help you understand how Facebook works. FILED DATE: 4/19/2019 3:29 PM 2018ch03868 FILED DATE: 6/24/2019 9:23 PM 2018CH03868 1. Privacy Your privacy is very important to us. We designed our Data Use Policy to make important disclosures about how you can use Facebook to share with others and how we collect and can use your content and information. We encourage you to read the Data Use Policy, and to use it to help you make informed decisions.

2. Sharing Your Content and Information You own all of the content and information you post on Facebook, and you can control how it is shared through your privacy and application settings. In addition: 1. For content that is covered by intellectual property rights, like photos and videos (IP content), you specifically give us the following permission, subject to your privacy and application settings: you grant us a non-exclusive, transferable, sub- licensable, royalty-free, worldwide license to use any IP content that you post on or in connection with Facebook (IP License). This IP License ends when you delete your IP content or your account unless your content has been shared with others, and they have not deleted it. 2. When you delete IP content, it is deleted in a manner similar to emptying the recycle bin on a computer. However, you understand that removed content may persist in backup copies for a reasonable period of time (but will not be available to others). 3. When you use an application, the application may ask for your permission to access your content and information as well as content and information that others have shared with you. We require applications to respect your privacy, and your agreement with that application will control how the application can use, store, and transfer that content and information. (To learn more about Platform, including how you can control what information other people may share with applications, read our Data Use Policy and Platform Page.) 4. When you publish content or information using the Public setting, it means that you are allowing everyone, including people off of Facebook, to access and use that information, and to associate it with you (i.e., your name and profile picture). 5. We always appreciate your feedback or other suggestions about Facebook, but you understand that we may use them without any obligation to compensate you for them (just as you have no obligation to offer them).

3. Safety We do our best to keep Facebook safe, but we cannot guarantee it. We need your help to keep Facebook safe, which includes the following commitments by you: 1. You will not post unauthorized commercial communications (such as spam) on Facebook. 2. You will not collect users' content or information, or otherwise access Facebook, using automated means (such as harvesting bots, robots, spiders, or scrapers) without our prior permission. 3. You will not engage in unlawful multi-level marketing, such as

FILED DATE: 4/19/2019 3:29 PM 2018ch03868 a pyramid scheme, on Facebook. FILED DATE: 6/24/2019 9:23 PM 2018CH03868 4. You will not upload viruses or other malicious code. 5. You will not solicit login information or access an account belonging to someone else. 6. You will not bully, intimidate, or harass any user. 7. You will not post content that: is hate speech, threatening, or pornographic; incites violence; or contains nudity or graphic or gratuitous violence. 8. You will not develop or operate a third-party application containing alcohol-related, dating or other mature content (including advertisements) without appropriate age-based restrictions. 9. You will follow our Promotions Guidelines and all applicable laws if you publicize or offer any contest, giveaway, or sweepstakes (“promotion”) on Facebook. 10. You will not use Facebook to do anything unlawful, misleading, malicious, or discriminatory. 11. You will not do anything that could disable, overburden, or impair the proper working or appearance of Facebook, such as a denial of service attack or interference with page rendering or other Facebook functionality. 12. You will not facilitate or encourage any violations of this Statement or our policies.

4. Registration and Account Security Facebook users provide their real names and information, and we need your help to keep it that way. Here are some commitments you make to us relating to registering and maintaining the security of your account: 1. You will not provide any false personal information on Facebook, or create an account for anyone other than yourself without permission. 2. You will not create more than one personal account. 3. If we disable your account, you will not create another one without our permission. 4. You will not use your personal timeline for your own commercial gain (such as selling your status update to an advertiser). 5. You will not use Facebook if you are under 13. 6. You will not use Facebook if you are a convicted sex offender. 7. You will keep your contact information accurate and up-to- date. 8. You will not share your password (or in the case of developers, your secret key), let anyone else access your account, or do anything else that might jeopardize the security of your account. 9. You will not transfer your account (including any Page or application you administer) to anyone without first getting our written permission. 10. If you select a username or similar identifier for your account or Page, we reserve the right to remove or reclaim it if we believe it is appropriate (such as when a trademark owner complains about a username that does not closely relate to a user's actual name).

5. Protecting Other People's Rights

FILED DATE: 4/19/2019 3:29 PM 2018ch03868 We respect other people's rights, and expect you to do the same. FILED DATE: 6/24/2019 9:23 PM 2018CH03868 1. You will not post content or take any action on Facebook that infringes or violates someone else's rights or otherwise violates the law. 2. We can remove any content or information you post on Facebook if we believe that it violates this Statement or our policies. 3. We provide you with tools to help you protect your intellectual property rights. To learn more, visit our How to Report Claims of Intellectual Property Infringement page. 4. If we remove your content for infringing someone else's copyright, and you believe we removed it by mistake, we will provide you with an opportunity to appeal. 5. If you repeatedly infringe other people's intellectual property rights, we will disable your account when appropriate. 6. You will not use our copyrights or trademarks (including Facebook, the Facebook and F Logos, FB, Face, Poke, Book and Wall), or any confusingly similar marks, except as expressly permitted by our Brand Usage Guidelines or with our prior written permission. 7. If you collect information from users, you will: obtain their consent, make it clear you (and not Facebook) are the one collecting their information, and post a privacy policy explaining what information you collect and how you will use it. 8. You will not post anyone's identification documents or sensitive financial information on Facebook. 9. You will not tag users or send email invitations to non-users without their consent. Facebook offers social reporting tools to enable users to provide feedback about tagging.

6. Mobile and Other Devices 1. We currently provide our mobile services for free, but please be aware that your carrier's normal rates and fees, such as text messaging fees, will still apply. 2. In the event you change or deactivate your mobile telephone number, you will update your account information on Facebook within 48 hours to ensure that your messages are not sent to the person who acquires your old number. 3. You provide consent and all rights necessary to enable users to sync (including through an application) their devices with any information that is visible to them on Facebook.

7. Payments If you make a payment on Facebook or use Facebook Credits, you agree to our Payments Terms.

8. Special Provisions Applicable to Social Plugins If you include our Social Plugins, such as the Share or Like buttons on your website, the following additional terms apply to you: 1. We give you permission to use Facebook's Social Plugins so that users can post links or content from your website on Facebook. 2. You give us permission to use and allow others to use such

FILED DATE: 4/19/2019 3:29 PM 2018ch03868 links and content on Facebook. FILED DATE: 6/24/2019 9:23 PM 2018CH03868 3. You will not place a Social Plugin on any page containing content that would violate this Statement if posted on Facebook.

9. Special Provisions Applicable to Developers/Operators of Applications and Websites If you are a developer or operator of a Platform application or website, the following additional terms apply to you: 1. You are responsible for your application and its content and all uses you make of Platform. This includes ensuring your application or use of Platform meets our Facebook Platform Policies and our Advertising Guidelines. 2. Your access to and use of data you receive from Facebook, will be limited as follows: 1. You will only request data you need to operate your application. 2. You will have a privacy policy that tells users what user data you are going to use and how you will use, display, share, or transfer that data and you will include your privacy policy URL in the Developer Application. 3. You will not use, display, share, or transfer a user’s data in a manner inconsistent with your privacy policy. 4. You will delete all data you receive from us concerning a user if the user asks you to do so, and will provide a mechanism for users to make such a request. 5. You will not include data you receive from us concerning a user in any advertising creative. 6. You will not directly or indirectly transfer any data you receive from us to (or use such data in connection with) any ad network, ad exchange, data broker, or other advertising related toolset, even if a user consents to that transfer or use. 7. You will not sell user data. If you are acquired by or merge with a third party, you can continue to use user data within your application, but you cannot transfer user data outside of your application. 8. We can require you to delete user data if you use it in a way that we determine is inconsistent with users’ expectations. 9. We can limit your access to data. 10. You will comply with all other restrictions contained in our Facebook Platform Policies. 3. You will not give us information that you independently collect from a user or a user's content without that user's consent. 4. You will make it easy for users to remove or disconnect from your application. 5. You will make it easy for users to contact you. We can also share your email address with users and others claiming that you have infringed or otherwise violated their rights. 6. You will provide customer support for your application. 7. You will not show third party ads or web search boxes on www.facebook.com. 8. We give you all rights necessary to use the code, APIs, data, and tools you receive from us. 9. You will not sell, transfer, or sublicense our code, APIs, or tools to anyone.

FILED DATE: 4/19/2019 3:29 PM 2018ch03868 10. You will not misrepresent your relationship with Facebook to FILED DATE: 6/24/2019 9:23 PM 2018CH03868 others. 11. You may use the logos we make available to developers or issue a press release or other public statement so long as you follow our Facebook Platform Policies. 12. We can issue a press release describing our relationship with you. 13. You will comply with all applicable laws. In particular you will (if applicable): 1. have a policy for removing infringing content and terminating repeat infringers that complies with the Digital Millennium Copyright Act. 2. comply with the Video Privacy Protection Act (VPPA), and obtain any opt-in consent necessary from users so that user data subject to the VPPA may be shared on Facebook. You represent that any disclosure to us will not be incidental to the ordinary course of your business. 14. We do not guarantee that Platform will always be free. 15. You give us all rights necessary to enable your application to work with Facebook, including the right to incorporate content and information you provide to us into streams, timelines, and user action stories. 16. You give us the right to link to or frame your application, and place content, including ads, around your application. 17. We can analyze your application, content, and data for any purpose, including commercial (such as for targeting the delivery of advertisements and indexing content for search). 18. To ensure your application is safe for users, we can audit it. 19. We can create applications that offer similar features and services to, or otherwise compete with, your application.

10. About Advertisements and Other Commercial Content Served or Enhanced by Facebook Our goal is to deliver ads and commercial content that are valuable to our users and advertisers. In order to help us do that, you agree to the following: 1. You can use your privacy settings to limit how your name and profile picture may be associated with commercial, sponsored, or related content (such as a brand you like) served or enhanced by us. You give us permission to use your name and profile picture in connection with that content, subject to the limits you place. 2. We do not give your content or information to advertisers without your consent. 3. You understand that we may not always identify paid services and communications as such.

11. Special Provisions Applicable to Advertisers You can target your desired audience by buying ads on Facebook or our publisher network. The following additional terms apply to you if you place an order through our online advertising portal (Order): 1. When you place an Order, you will tell us the type of advertising you want to buy, the amount you want to spend, and your bid. If we accept your Order, we will deliver your ads as inventory becomes available. When serving your ad,

FILED DATE: 4/19/2019 3:29 PM 2018ch03868 we do our best to deliver the ads to the audience you specify, FILED DATE: 6/24/2019 9:23 PM 2018CH03868 although we cannot guarantee in every instance that your ad will reach its intended target. 2. In instances where we believe doing so will enhance the effectiveness of your advertising campaign, we may broaden the targeting criteria you specify. 3. You will pay for your Orders in accordance with our Payments Terms. The amount you owe will be calculated based on our tracking mechanisms. 4. Your ads will comply with our Advertising Guidelines. 5. We will determine the size, placement, and positioning of your ads. 6. We do not guarantee the activity that your ads will receive, such as the number of clicks your ads will get. 7. We cannot control how clicks are generated on your ads. We have systems that attempt to detect and filter certain click activity, but we are not responsible for click fraud, technological issues, or other potentially invalid click activity that may affect the cost of running ads. 8. You can cancel your Order at any time through our online portal, but it may take up to 24 hours before the ad stops running. You are responsible for paying for all ads that run. 9. Our license to run your ad will end when we have completed your Order. You understand, however, that if users have interacted with your ad, your ad may remain until the users delete it. 10. We can use your ads and related content and information for marketing or promotional purposes. 11. You will not issue any press release or make public statements about your relationship with Facebook without our prior written permission. 12. We may reject or remove any ad for any reason. 13. If you are placing ads on someone else's behalf, you must have permission to place those ads, including the following: 1. You warrant that you have the legal authority to bind the advertiser to this Statement. 2. You agree that if the advertiser you represent violates this Statement, we may hold you responsible for that violation. 12. Special Provisions Applicable to Pages If you create or administer a Page on Facebook, you agree to our Pages Terms.

13. Special Provisions Applicable to Software 1. If you download our software, such as a stand-alone software product or a browser plugin, you agree that from time to time, the software may download upgrades, updates and additional features from us in order to improve, enhance and further develop the software. 2. You will not modify, create derivative works of, decompile or otherwise attempt to extract source code from us, unless you are expressly permitted to do so under an open source license or we give you express written permission.

14. Amendments FILED DATE: 4/19/2019 3:29 PM 2018ch03868 FILED DATE: 6/24/2019 9:23 PM 2018CH03868 1. We can change this Statement if we provide you notice (by posting the change on the Facebook Site Governance Page) and an opportunity to comment. To get notice of any future changes to this Statement, visit our Facebook Site Governance Page and "like" the Page. 2. For changes to sections 7, 8, 9, and 11 (sections relating to payments, application developers, website operators, and advertisers), we will give you a minimum of three days notice. For all other changes we will give you a minimum of seven days notice. Comments to proposed changes will be made on the Facebook Site Governance Page. 3. If more than 7,000 users post a substantive comment on a particular proposed change, we will also give you the opportunity to participate in a vote in which you will be provided alternatives. The vote shall be binding on us if more than 30% of all active registered users as of the date of the notice vote. 4. If we make changes to policies referenced in or incorporated by this Statement, we may provide notice on the Site Governance Page. 5. We can make changes for legal or administrative reasons, or to correct an inaccurate statement, upon notice without opportunity to comment. 6. Your continued use of Facebook following changes to our terms constitutes your acceptance of our amended terms.

15. Termination If you violate the letter or spirit of this Statement, or otherwise create risk or possible legal exposure for us, we can stop providing all or part of Facebook to you. We will notify you by email or at the next time you attempt to access your account. You may also delete your account or disable your application at any time. In all such cases, this Statement shall terminate, but the following provisions will still apply: 2.2, 2.4, 3-5, 8.2, 9.1-9.3, 9.9, 9.10, 9.13, 9.15, 9.18, 10.3, 11.2, 11.5, 11.6, 11.9, 11.12, 11.13, and 15-19. 16. Disputes 1. You will resolve any claim, cause of action or dispute (claim) you have with us arising out of or relating to this Statement or Facebook exclusively in a state or federal court located in Santa Clara County. The laws of the State of California will govern this Statement, as well as any claim that might arise between you and us, without regard to conflict of law provisions. You agree to submit to the personal jurisdiction of the courts located in Santa Clara County, California for the purpose of litigating all such claims. 2. If anyone brings a claim against us related to your actions, content or information on Facebook, you will indemnify and hold us harmless from and against all damages, losses, and expenses of any kind (including reasonable legal fees and costs) related to such claim. Although we provide rules for user conduct, we do not control or direct users' actions on Facebook and are not responsible for the content or information users transmit or share on Facebook. We are not responsible for any offensive, inappropriate, obscene,

FILED DATE: 4/19/2019 3:29 PM 2018ch03868 unlawful or otherwise objectionable content or information FILED DATE: 6/24/2019 9:23 PM 2018CH03868 you may encounter on Facebook. We are not responsible for the conduct, whether online or offline, or any user of Facebook. 3. WE TRY TO KEEP FACEBOOK UP, BUG-FREE, AND SAFE, BUT YOU USE IT AT YOUR OWN RISK. WE ARE PROVIDING FACEBOOK AS IS WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES INCLUDING, BUT NOT LIMITED TO, IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. WE DO NOT GUARANTEE THAT FACEBOOK WILL ALWAYS BE SAFE, SECURE OR ERROR-FREE OR THAT FACEBOOK WILL ALWAYS FUNCTION WITHOUT DISRUPTIONS, DELAYS OR IMPERFECTIONS. FACEBOOK IS NOT RESPONSIBLE FOR THE ACTIONS, CONTENT, INFORMATION, OR DATA OF THIRD PARTIES, AND YOU RELEASE US, OUR DIRECTORS, OFFICERS, EMPLOYEES, AND AGENTS FROM ANY CLAIMS AND DAMAGES, KNOWN AND UNKNOWN, ARISING OUT OF OR IN ANY WAY CONNECTED WITH ANY CLAIM YOU HAVE AGAINST ANY SUCH THIRD PARTIES. IF YOU ARE A CALIFORNIA RESIDENT, YOU WAIVE CALIFORNIA CIVIL CODE §1542, WHICH SAYS: A GENERAL RELEASE DOES NOT EXTEND TO CLAIMS WHICH THE CREDITOR DOES NOT KNOW OR SUSPECT TO EXIST IN HIS FAVOR AT THE TIME OF EXECUTING THE RELEASE, WHICH IF KNOWN BY HIM MUST HAVE MATERIALLY AFFECTED HIS SETTLEMENT WITH THE DEBTOR. WE WILL NOT BE LIABLE TO YOU FOR ANY LOST PROFITS OR OTHER CONSEQUENTIAL, SPECIAL, INDIRECT, OR INCIDENTAL DAMAGES ARISING OUT OF OR IN CONNECTION WITH THIS STATEMENT OR FACEBOOK, EVEN IF WE HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. OUR AGGREGATE LIABILITY ARISING OUT OF THIS STATEMENT OR FACEBOOK WILL NOT EXCEED THE GREATER OF ONE HUNDRED DOLLARS ($100) OR THE AMOUNT YOU HAVE PAID US IN THE PAST TWELVE MONTHS. APPLICABLE LAW MAY NOT ALLOW THE LIMITATION OR EXCLUSION OF LIABILITY OR INCIDENTAL OR CONSEQUENTIAL DAMAGES, SO THE ABOVE LIMITATION OR EXCLUSION MAY NOT APPLY TO YOU. IN SUCH CASES, FACEBOOK'S LIABILITY WILL BE LIMITED TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW.

17. Special Provisions Applicable to Users Outside the United States We strive to create a global community with consistent standards for everyone, but we also strive to respect local laws. The following provisions apply to users and non-users who interact with Facebook outside the United States: 1. You consent to having your personal data transferred to and processed in the United States. 2. If you are located in a country embargoed by the United States, or are on the U.S. Treasury Department's list of Specially

FILED DATE: 4/19/2019 3:29 PM 2018ch03868 Designated Nationals you will not engage in commercial FILED DATE: 6/24/2019 9:23 PM 2018CH03868 activities on Facebook (such as advertising or payments) or operate a Platform application or website. 3. Certain specific terms that apply only for German users are available here. 18. Definitions 1. By "Facebook" we mean the features and services we make available, including through (a) our website at www.facebook.com and any other Facebook branded or co- branded websites (including sub-domains, international versions, widgets, and mobile versions); (b) our Platform; (c) social plugins such as the Like button, the Share button and other similar offerings and (d) other media, software (such as a toolbar), devices, or networks now existing or later developed. 2. By "Platform" we mean a set of APIs and services (such as content) that enable others, including application developers and website operators, to retrieve data from Facebook or provide data to us. 3. By "information" we mean facts and other information about you, including actions taken by users and non-users who interact with Facebook. 4. By "content" we mean anything you or other users post on Facebook that would not be included in the definition of information. 5. By "data" or "user data" or "user's data" we mean any data, including a user's content or information that you or third parties can retrieve from Facebook or provide to Facebook through Platform. 6. By "post" we mean post on Facebook or otherwise make available by using Facebook. 7. By "use" we mean use, copy, publicly perform or display, distribute, modify, translate, and create derivative works of. 8. By "active registered user" we mean a user who has logged into Facebook at least once in the previous 30 days. 9. By "application" we mean any application or website that uses or accesses Platform, as well as anything else that receives or has received data from us. If you no longer access Platform but have not deleted all data from us, the term application will apply until you delete the data.

19. Other 1. If you are a resident of or have your principal place of business in the US or Canada, this Statement is an agreement between you and Facebook, Inc. Otherwise, this Statement is an agreement between you and Facebook Ireland Limited. References to “us,” “we,” and “our” mean either Facebook, Inc. or Facebook Ireland Limited, as appropriate. 2. This Statement makes up the entire agreement between the parties regarding Facebook, and supersedes any prior agreements. 3. If any portion of this Statement is found to be unenforceable, the remaining portion will remain in full force and effect. 4. If we fail to enforce any of this Statement, it will not be considered a waiver. 5. Any amendment to or waiver of this Statement must be made

FILED DATE: 4/19/2019 3:29 PM 2018ch03868 in writing and signed by us. FILED DATE: 6/24/2019 9:23 PM 2018CH03868 6. You will not transfer any of your rights or obligations under this Statement to anyone else without our consent. 7. All of our rights and obligations under this Statement are freely assignable by us in connection with a merger, acquisition, or sale of assets, or by operation of law or otherwise. 8. Nothing in this Statement shall prevent us from complying with the law. 9. This Statement does not confer any third party beneficiary rights. 10. We reserve all rights not expressly granted to you. 11. You will comply with all applicable laws when using or accessing Facebook.

You may also want to review the following documents, which provide additional information about your use of Facebook: Data Use Policy: The Data Use Policy contains information to help you understand how we collect and use information. Payment Terms: These additional terms apply to all payments made on or through Facebook. Platform Page: This page helps you better understand what happens when you add a third-party application or use Facebook Connect, including how they may access and use your data. Facebook Platform Policies: These guidelines outline the policies that apply to applications, including Connect sites. Advertising Guidelines: These guidelines outline the policies that apply to advertisements placed on Facebook. Promotions Guidelines: These guidelines outline the policies that apply if you offer contests, sweepstakes, and other types of promotions on Facebook. Brand Permissions Center: These guidelines outline the policies that apply to use of Facebook trademarks, logos and screenshots. How to Report Claims of Intellectual Property Infringement Pages Terms: These guidelines apply to your use of Facebook Pages. Community Standards: These guidelines outline our expectations regarding the content you post to Facebook and your activity on Facebook. To access the Statement of Rights and Responsibilities in several different languages, change the language setting for your Facebook session by clicking on the language link in the left corner of most pages. If the Statement is not available in the language you select, we will default to the English version. FILED DATE: 4/19/2019 3:29 PM 2018ch03868 FILED DATE: 6/24/2019 9:23 PM 2018CH03868

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 Exhibit 3 FILED DATE: 6/24/2019 9:23 PM 2018CH03868 FILED DATE: 6/24/2019 9:23 PM 2018CH03868 FILED DATE: 6/24/2019 9:23 PM 2018CH03868 FILED DATE: 6/24/2019 9:23 PM 2018CH03868 FILED DATE: 6/24/2019 9:23 PM 2018CH03868

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 Exhibit 4 Pages 1 - 60

UNITED STATES DISTRICT COURT

NORTHERN DISTRICT OF CALIFORNIA

BEFORE THE HONORABLE JAMES DONATO

) IN RE FACEBOOK BIOMETRIC ) No. C 15-3747 JD INFORMATION PRIVACY LITIGATION ) ) San Francisco, California ) May 21 2018 ______) 10:00 a.m.

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 TRANSCRIPT OF PROCEEDINGS

APPEARANCES:

For Plaintiff: ROBBINS GELLER RUDMAN & DOWD, LLP One Montgomery Street Suite 1800 San Francisco, California 94104 BY: SHAWN WILLIAMS, ESQ. JOHN GEORGE, ESQ.

ROBBINS GELLER RUDMAN & DOWD, LLP 655 West Broadway Suite 1900 San Diego, California 92101 BY: PATRICK J. COUGHLIN, ESQ.

LABATON AND SUCHAROW, LLP 140 Broadway 34th Floor New York, New York 10005 BY: LAWRENCE A. SUCHAROW, ESQ.

(APPEARANCES CONTINUED ON FOLLOWING PAGE)

Reporteded By:B : Debra a L. Pas,P CSRCS 119161 1 , CRCRR, RMR, RPR P Official Reporter - US District Court Computerized Transcription By Eclipse Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 2

APPEARANCES: (CONTINUED)

For Defendant: MAYER BROWN, LLP 1221 Avenue of the Americas New York, New York 10020 BY: LAUREN R. GOLDMAN, ESQ.

MAYER BROWN, LLP 1909 K Street, NW Washington, DC 20006 BY: ARCHIS PARASHARAMI, ESQ.

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 MAYER BROWN, LLP 71 South Wacker Drive Chicago, Illinois 60606 BY: VINCENT J. CONNELLY, ESQ.

Also Present: Nikki Stitt Sokol Associate General Counsel - Facebook

- - -

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 3

1 Monday - May 21, 2018 10:02 a.m.

2 P R O C E E D I N G S

3 ---000---

5 THE CLERK: Calling Case No. 15-3747, In Re Facebook

6 Biometric Information Privacy Litigation.

7 Counsel?

8 MR. WILLIAMS: Good morning, your Honor. Shawn

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 Williams, Robbins Geller Rudman and Dowd.

10 I'm also here with my colleagues Patrick Coughlin and John

11 George from my firm, and Corban Rhodes from the Labaton firm,

12 on behalf of plaintiff.

13 THE COURT: Okay.

14 MS. GOLDMAN: Good morning, your Honor. Lauren

15 Goldman of Mayer Brown on behalf of Facebook.

16 I'm here today with Archis Parasharami, who I think you

17 met before, who will be covering the class action notice

18 issues; with my partner Vincent Connelly, who is one of the

19 people who will be trying the case; and with Nikki Sokol from

20 Facebook.

21 THE COURT: All right. Okay. We're going to power

22 through the notice issue. Why don't you both -- both come on

23 up.

24 All right. Now, let's talk about a couple of things

25 first. Who is going to do what?

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 4

1 My sense is, after reviewing everybody's papers, I think

2 the class administrator should send the email, okay? So they

3 can send the email notice. We're going to work out the back

4 office part of this in a moment.

5 And then, Facebook, I want you to do one of those jewel

6 notifications that I learned about earlier in the case, and,

7 also, a news feed insert. Okay?

8 MR. PARASHARAMI: Your Honor, may I be heard on those

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 issues?

10 THE COURT: Yes.

11 MR. PARASHARAMI: So in light of the fact that your

12 Honor is ordering email notice, which we think is appropriate,

13 the jewel notifications and news feed notices --

14 THE COURT: I think you need to get a little bit

15 closer to the mic.

16 MR. PARASHARAMI: I'm sorry.

17 THE COURT: Just slide it towards you. Slide the

18 thing -- yeah, okay.

19 All right. Go ahead.

20 MR. PARASHARAMI: So the news feed notifications and

21 the jewel notifications would be duplicative, unnecessarily

22 duplicative.

23 THE COURT: They may be duplicative, but our goal

24 here is to give notice. And it's reasonable, in my view, for

25 you anow to do that.

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 5

1 So we will do a jewel notice, or whatever you call it, the

2 jewel thing with the little red light that flashes and the news

3 feed insert.

4 I'm going to decline Messenger. I don't think that --

5 that's necessary. I think that seems to be the least likely to

6 get everybody, so Messenger will be declined.

7 MR. PARASHARAMI: Your Honor, may I be heard on the

8 -- just a little further on the jewel notification?

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 THE COURT: Yes.

10 MR. PARASHARAMI: So the Manual for Complex

11 Litigation says using essentially communications processes of a

12 business should be essentially the last resort, only if there

13 are no other feasible alternatives because of the way that it

14 interferes with --

15 THE COURT: I don't agree with that. We're trying to

16 give the best reasonable notice.

17 In my view, given your business and your platform, email

18 is just not going to cut it. You need to get the jewel

19 notifications and the news feed. So those will happen.

20 Now, tell me a little bit about what you did with

21 Cambridge Analytica. So that looks to me -- now maybe I'm

22 wrong because I do not use Facebook. I never have, because I'm

23 a federal judge. I don't use any social media. It's not just

24 Facebook. I don't Tweet. I don't do anything. Now,

25 nevertheless, I understand what you do because people around me

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 6

1 use it.

2 So my understanding is your postings about Cambridge

3 Analytica were not in news feed and not in jewel. You did

4 something special for that; is that right?

5 MR. PARASHARAMI: Your Honor, I don't know the

6 details of it, but let me try and address that question.

7 Cambridge Analytica is a totally different situation, your

8 Honor, because it is a communication between the company and

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 its customers. It is not a Court ordered class notice. It's

10 just a different fit.

11 I mean, I think to the extent that your Honor is raising

12 the possibility of a jewel notification and -- you know, and a

13 news feed, that probably is enough to describe what we would

14 have to do here.

15 THE COURT: Well, that may be, but what did you all

16 do with -- I'm looking at screenshots and they're not -- they

17 don't look like news feed or jewel.

18 Is there something else you did? Was there something else

19 Facebook did for Cambridge?

20 MR. WILLIAMS: Your Honor, I can talk about the news

21 feed piece, at least briefly, because they did do that --

22 THE COURT: They did do a news feed for Cambridge?

23 MR. WILLIAMS: -- with Cambridge Analytica. And in

24 our view it's something that is sufficient. It seems cheaper

25 than some other forms of notice.

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 7

1 It is a -- a notice that goes directly to a user's news

2 feed so when they open Facebook, it's the first thing that

3 they see.

4 THE COURT: No, I understand that and it's ordered.

5 We're -- what I want to know is do you know, maybe -- if you

6 don't know, that's fine.

7 But, Mr. Williams, for example, do you know, did they do

8 something special for Cambridge?

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 MR. WILLIAMS: When you say "special" in terms of the

10 news feed?

11 THE COURT: Was it -- outside of the news feed and

12 outside of jewel, did they have a separate push that they used?

13 MR. WILLIAMS: I don't know that. I don't know the

14 answer to that. I do know that it was through news feed at

15 least.

16 THE COURT: At least through news feed. Okay.

17 And, Mr. Parasharami -- did I get that right?

18 MR. PARASHARAMI: Yes. Thank you.

19 THE COURT: You don't know whether they did

20 something?

21 MR. PARASHARAMI: My understanding is that it's not

22 something special or different outside of its normal channels

23 for communicating with its own users.

24 THE COURT: Okay. Well, I just happened to see one

25 this morning that is on a mobile phone. It says Facebook, and

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 8

1 it's from Facebook, and it says "Sarah," personalized to the

2 user, and then it goes on from there.

3 But you don't know whether there was a news feed or

4 something else.

5 MR. PARASHARAMI: No, I don't. This is something not

6 in the record, your Honor.

7 THE COURT: All right. Well, it will be news feed,

8 jewel and the emails.

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 Now, the emails you all are going to do, Mr. Williams.

10 Okay?

11 Now, my next question is when can we get all of this done?

12 It looked to me like -- can we get it out by May 30th? That's

13 40 days before trial.

14 MR. WILLIAMS: I think that's right, your Honor. The

15 papers -- defendant's papers made clear that they could get at

16 least all of the email in a form that could be communicated to

17 the administrator by next Friday, which is May 25th.

18 THE COURT: Is that right?

19 MR. WILLIAMS: Assume it goes over to Monday, you're

20 at the 28th, which is at least two days before that.

21 THE COURT: Maybe you can have them work on the

22 weekend.

23 MR. WILLIAMS: Oh, that's Facebook.

24 THE COURT: Okay.

25 MR. WILLIAMS: They are compiling all the email to

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 9

1 send and will have it all compiled by the end of next week. At

2 least that's what's in their papers.

3 THE COURT: All right. So May 25th, unless something

4 dramatic happens, will be a bankable date.

5 Yes.

6 MR. PARASHARAMI: Your Honor, just to be clear --

7 THE COURT: I really need you to move the microphone.

8 Just put it right in front of you. Don't bend down. Just move

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 it towards you, so you can stay upright and still speak.

10 MR. PARASHARAMI: Is this better?

11 THE COURT: No. Move it closer.

12 MR. PARASHARAMI: All right. Thanks. Thank you,

13 your Honor.

14 I just wanted to --

15 THE COURT: That's better. Go ahead.

16 MR. PARASHARAMI: Okay. Just on the question of

17 timing. You know, our declarant testified to what we could do

18 under essentially the proposal that we had made, and so I just

19 want to make clear that if -- you know, if it is some different

20 set of people that we're supposed to identify, then this Friday

21 date could never hold.

22 THE COURT: All right. Well, we can talk with that.

23 So it looked to me that, Facebook, you can go back -- so

24 you have the IP address and some kind of advertising placement

25 technology to find people, right?

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 10

1 MR. PARASHARAMI: Essentially we have something that

2 we use to predict the home location of users, and that's what

3 we use in our advertising processes.

4 THE COURT: All right. So you can use both

5 techniques back to January of 2012 and then IP addresses only

6 for 2011 and 2012.

7 MR. PARASHARAMI: That's essentially right, your

8 Honor.

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 THE COURT: Seems fine.

10 Any problem with that, Mr. Williams?

11 MR. WILLIAMS: Not for locating the email address,

12 no.

13 THE COURT: Okay.

14 MR. WILLIAMS: And if --

15 MR. PARASHARAMI: And -- oh, I'm sorry, Sean.

16 MR. WILLIAMS: Go ahead.

17 MR. PARASHARAMI: Just to be clear, your Honor, the

18 idea would be to try to identify individuals who are -- who are

19 users that are residents of Illinois for purposes of

20 identifying and are an over-inclusive, but appropriately

21 tailored group of notice recipients.

22 THE COURT: Yes. Now, let's talk about what I'm

23 going to call the O'Hare problem. Okay?

24 So you're living in Colorado. You are a Facebook user.

25 You're connecting through O'Hare. You're there for two hours.

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 11

1 As users often do, you check your Facebook to see what's

2 happening in the 90 minutes that you are, you know, unavailable

3 and then you leave.

4 Now, that will show an IP address for Illinois, but they

5 are not going to be members of the class. They are residents

6 of Colorado. So how are we going to deal with that?

7 MR. WILLIAMS: Well, two points there. On the

8 residency issue, I do want to discuss that a little bit. It

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 was one of the things that me and my colleagues and Facebook

10 talked about over the weekend with respect to the content of

11 the notice.

12 THE COURT: Okay.

13 MR. WILLIAMS: I think that is a difficult problem.

14 I don't think it's a difficult -- well, let me back up.

15 I think that if that person who landed in Illinois for an

16 hour, checks their Facebook page, maybe even opened up, took a

17 selfie and uploaded it onto Facebook, that person is going to

18 have a scan of their face geometry done and possibly a template

19 created.

20 I think your Honor was very, very clear in its class

21 certification order about the class definition being limited to

22 people who had a template created and stored in Illinois. What

23 the Court did not do was -- what the Court did not do was limit

24 it to -- to residents.

25 THE COURT: It doesn't have to be stored in Illinois.

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 12

1 MR. WILLIAMS: Correct.

2 THE COURT: It just has to be people who had

3 templates harvested from data.

4 MR. WILLIAMS: I misspoke.

5 THE COURT: Yes.

6 MR. WILLIAMS: I think that the Court did not limit

7 it to people who were, quote/unquote, residents.

8 We don't really have a -- an issue with the term

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 "resident" unless it becomes a requirement later that -- you

10 know, in a proof of claim that a person must show that they

11 were a legal resident in Illinois at the time that this

12 violation occurred. So we just need to work through that.

13 THE COURT: I don't think we need to sort through

14 that now. Let's be common-sensical about this. This is an

15 Illinois state law for Illinois people. Okay?

16 So if you're passing through O'Hare or driving through

17 Peoria, you're not an Illinois person subject to BIPA. That's

18 all we're talking about. So how are you going to sort that

19 out?

20 Facebook, can you do something?

21 MR. PARASHARAMI: Yes. Our proposal is to -- in

22 coming up with this list of potential notice recipients, which

23 we believe is over-inclusive, but appropriately tailored for

24 purposes of notice, but our proposal is to look for people who

25 have a predicted home location in the State of Illinois for a

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 13

1 substantial portion of a year. And to us that was a good way

2 to come close to assessing residents. I mean --

3 THE COURT: Well, just let me jump in.

4 I don't want to have any game playing with "substantial

5 portion." If they are there, they are there.

6 Now, I'm only talking about the O'Hare problem. I've

7 intentionally called -- that's my term. I've intentionally

8 called it that so you get the gist of what I'm trying to

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 communicate.

10 If you are just passing through, you're not in the class.

11 If you have lived there for a month, if you have lived there

12 for two months, if you've lived there for any period of time

13 and you're not just passing through, although you're not a

14 lifetime resident, you are potentially part of the class.

15 Okay?

16 So I don't want to find out that, you know, you all built

17 in some eight-month limit, so that -- Facebook, you know, if

18 you ran your parameters and if you aren't there for eight

19 months, you're kicked out of the list. That I don't want to

20 have happen.

21 So how are you going to define that substantial -- can

22 you -- like a -- a week or less. How about that, Mr. Williams?

23 MR. WILLIAMS: That's fine. And that was the problem

24 I was worried about.

25 THE COURT: We have to have some -- you need some

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 14

1 gatekeeping time; right?

2 MR. PARASHARAMI: Yeah. I wonder if that is,

3 unfortunately, way too small just because of the --

4 THE COURT: Let's talk about that.

5 How about -- you know, it's possible you could be on a

6 business trip or maybe a trial in the Northern District for two

7 months. How about --

8 MR. WILLIAMS: I think it's fair to say just a month.

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 If you're in Illinois for a month, that means that you have at

10 least some business or social issue that requires you to be

11 there, use the services of, you know, the state or city that

12 are available to you. And even if you don't have a plan to

13 stay forever or a year, that a month, I think, puts you in a

14 position where you're actually -- you're there and it's a

15 meaningful period of time.

16 MR. PARASHARAMI: There is sort of an indeterminacy

17 to that that I think is problematic.

18 And I guess the other point I would make is that this a

19 predicted home location. It's not as though we know for sure;

20 right?

21 So I guess my take is that if it's a relatively short

22 time, it's really not enough to know if they are there.

23 You know, I'm not trying to play games or anything like

24 that. I think it makes sense to have something that is, you

25 know, tied to other standards in the law.

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 15

1 So one example might be residency for tax purposes, which

2 is --

3 THE COURT: That's a year, though. That's too long.

4 MR. PARASHARAMI: Well, often they say 100- -- you

5 know, let's say over six months. 183 days is the IRS

6 requirement, just as an example.

7 I mean, I think, to me, that might be better than the

8 alternative of, like, one week or one month. There is --

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 THE COURT: Let's just think this through. Now, this

10 is notice. Okay? This is not writing checks. There is -- a

11 lot of things have to happen before that ever happens.

12 Now, it's okay to be -- throw a wider net, cast a wider

13 net for notice. It may be that we use a shorter time period

14 for notice, but should the day come -- and who knows, maybe it

15 won't, but should the day come that claim forms get submitted,

16 we tighten it up. And, you know, you -- if it's less than

17 three months, we'll just presume you were a transient and

18 you're not going to be eligible to get any of the damages that

19 might be awarded.

20 MR. WILLIAMS: I think that makes sense.

21 THE COURT: We could do it that way.

22 MR. WILLIAMS: I think it makes sense. Wider in the

23 beginning and narrow it later.

24 THE COURT: Okay. So -- yes.

25 MR. PARASHARAMI: I guess the other thing I would say

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 16

1 is that if we change the parameters, we just do need to have

2 more time in order to effectuate that. I mean, you know, we --

3 THE COURT: You just push a different date in. I

4 mean --

5 MR. PARASHARAMI: It's not just like pressing

6 buttons. I think it would take a lot.

7 THE COURT: It's not just like pressing buttons?

8 MR. PARASHARAMI: Well, it might be like pressing a

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 lot and lot and lot of buttons.

10 THE COURT: What else could it be but pressing

11 buttons? You're Facebook.

12 MR. PARASHARAMI: Your Honor, I appreciate that. I

13 guess maybe I should have been more -- more apt. It's not like

14 pressing one button.

15 THE COURT: Fine. You have to change the algorithm

16 or whatever.

17 MR. PARASHARAMI: So then I would, your Honor, ask

18 for enough time to effectuate that. You know, I obviously will

19 warrant that we will work with alacrity, but this is being

20 developed for the first time --

21 THE COURT: We'll come back to timing at the end.

22 Let's work out all these little things first.

23 So I'll tell you what. We'll reserve the claimant

24 eligibility issue on location until we get to the claim stage,

25 should that happen. Who knows? It may not.

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 17

1 And for notice purposes, let's just -- I think two months

2 or less is not -- is presumptively transient. So, you know,

3 more than 60 days will be the notice cut-off.

4 MR. PARASHARAMI: And, your Honor, so my take would

5 be that that should be 60 continuous days, because otherwise if

6 it's --

7 THE COURT: That's fine. I don't have a problem with

8 that.

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 MR. WILLIAMS: Well, I guess one thing that we need

10 to know is what -- what are the manners in which they are

11 actually putting parameters around the search now.

12 THE COURT: You anticipated my next question.

13 So, Mr. Parasharami, just tell me, just generally, how is

14 all this going to happen? How is that list going to get

15 populated?

16 MR. PARASHARAMI: Well, so we attempt to look for

17 what's called predicted home location, which is essentially

18 this method that we use for advertising to try and predict, you

19 know, for advertisers where somebody will be. What their home

20 location is on a specific day. Right? And so I guess we would

21 look for the number of hits, you know, for a number of days per

22 person.

23 So it requires a complicated search. I'm no engineer, so

24 I can't, you know, begin to understand what they do to get

25 there, but I do understand --

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 18

1 THE COURT: Somehow I'm confident Facebook can do it.

2 But let me just ask this. This is all the existing

3 technology. There is nothing different. For example, you'll

4 just take what Facebook normally uses and just adapt it for

5 this purpose.

6 MR. PARASHARAMI: Right. I guess the -- the

7 predicted home location technology is existing technology. The

8 process of searching for this, obviously, is not something it

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 ordinarily has to do --

10 THE COURT: I understand. You're just tailoring

11 existing search protocols for this project. Just like if I

12 were Procter and Gamble, you would be tailoring it for Procter

13 and Gamble.

14 You're just using pre-existing -- I want your assurance

15 this is not a new, different or unusual software. This is what

16 Facebook does in the ordinary course of business to get this

17 information.

18 MR. PARASHARAMI: I understand your question, your

19 Honor. I think it is accurate to say that the underlying

20 information of predicted home location is part of our course of

21 business.

22 The searching of it. The substantial engineering time

23 needed to actually get this information pulled, the pulling of

24 an email list, is not part of our ordinary course of business.

25 THE COURT: I understand. Of course not. This is

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 19

1 litigation. This isn't -- class action trials don't happen

2 every day, even for Facebook.

3 Now, for the IP addresses, how are you going to harvest

4 those?

5 MR. PARASHARAMI: That specific of how to do it is

6 beyond my knowledge, but my understanding --

7 THE COURT: Just generally. What do you understand

8 is going to happen?

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 MR. PARASHARAMI: I think we have data and we are

10 going to look at that data. I mean, at that level -- the

11 engineers understand it and, as I say, I think we can do it

12 with reasonable speed.

13 THE COURT: All right. Okay. So we're going to set

14 a target date of May 25th for this. All right?

15 Now, if there is any extraordinary problem, you can let me

16 know, like, the day before and we'll see what we can do.

17 MR. PARASHARAMI: Your Honor, just to try and -- I

18 think that given this time frame of the two months, I -- that

19 has been -- you know, we're going to have to start on it. I

20 just do not know that starting today, we can get it done by the

21 25th.

22 I would ask, rather than us coming back to you on the 24th

23 or 25th -- the 24th is three days from now, and saying --

24 THE COURT: Well, your declarant says they -- we're

25 talking about what was in the declaration. He said he could do

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 20

1 it by the 25th. What's the problem?

2 MR. WILLIAMS: I think they said they already

3 started.

4 MR. PARASHARAMI: Yeah. Started on, I think, a

5 different time frame. So I just don't know. I think, your

6 Honor, if we --

7 THE COURT: It's a mildly longer one. I mean, if you

8 were doing six months, this is just now three months shorter.

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 MR. PARASHARAMI: Yeah. If we have to restart our

10 work in order to do it, then that might expand the time.

11 THE COURT: I will be surprised, but you ask and

12 figure that out. But all we're doing is the -- literally the

13 only thing we're doing is, apparently, starting a little bit

14 earlier than you might have. That's all. Maybe they did start

15 earlier. Who knows?

16 MR. PARASHARAMI: Right. So I'm saying we would have

17 to start the search now, as opposed to having already tried to

18 start work on this.

19 THE COURT: All right. May 25th is going to be the

20 target date. You let me know if there is any problem with

21 that. We're going to shoot to get everything out by May 30th.

22 Okay? That will give us 40 days before trial.

23 All right. Now, I do want to -- then you all can raise

24 any other issues you want to, but let's just go over the long

25 form notice as amended in the, what is it, reply filing,

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 21

1 Mr. Williams?

2 MR. WILLIAMS: We filed a declaration on Friday

3 afternoon.

4 THE COURT: Yes, that one. I want to use that one.

5 Okay.

6 MR. WILLIAMS: I think it's docket -- the red line is

7 381-2, if that's helpful.

8 THE COURT: Let's actually take the original un-red

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 lined one, 381-1, which is plaintiff's revised long form

10 notice. Let's just go through it.

11 There are a couple of changes I'm going to make and then

12 we can discuss whether other changes need to be made as well.

13 So on Page 1, that all looked fine to me.

14 Mr. Parasharami, any problems with that?

15 MR. PARASHARAMI: I'm sorry. You're looking at

16 380 --

17 THE COURT: 381-1, the long form notice, called

18 Exhibit A.

19 MR. WILLIAMS: 381-1 was filed on May 18.

20 THE COURT: May 18.

21 Maybe you two can share?

22 MR. WILLIAMS: That's fine. I don't have my winning

23 case notes here.

24 THE COURT: Exhibit A.

25 MR. WILLIAMS: 381-1 is the clean version. 381-2 is

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 22

1 the red line.

2 (Whereupon document was tendered to counsel.)

3 MR. PARASHARAMI: Oh, thanks. Appreciate it.

4 THE COURT: Okay. Page 1 seems fine.

5 Any problem with that, Mr. Parasharami?

6 MR. PARASHARAMI: Your Honor, we -- we do, you know,

7 for -- you know, I guess -- I think an appropriate --

8 especially since we have some time, but what I would propose is

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 that we submit --

10 THE COURT: No, we're just going to do it now. Let's

11 get this thing done.

12 Look, this is one of my oldest cases. Okay? We can't

13 keep pushing things down the road. The time for trial has

14 come. You're here. I'm here. I've got a million other things

15 to do. Trust me, I have a lot more than you do. Let's just

16 finish this now. Okay?

17 MR. PARASHARAMI: I appreciate, your Honor --

18 THE COURT: So any problems that are not in your

19 brief? Any objections to Page 1?

20 MR. PARASHARAMI: Yeah. Our concern is that the use

21 of the phrase "biometric data" is inaccurate because it doesn't

22 appear in the statute. It's not what the claims are --

23 THE COURT: What do you want, "biometric

24 information"?

25 MR. PARASHARAMI: "Identifiers," your Honor. That's

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 23

1 the phrase in the statute and that's the -- that's the phrase

2 that they are -- that the plaintiffs are actually litigating.

3 THE COURT: This has no legal interpretive effect.

4 You understand that? So this is just telling people in the

5 world in a practical and reasonable way what the case is about.

6 I think that idea of identifiers, it's not going to tie

7 your hands. It's not going to tie anybody's hands. It's

8 certainly not going to tie my hands. We just want to

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 communicate to people in a way that they understand.

10 I'm going to overrule that. "Data" is fine. That is not

11 an interpretation of BIPA. It is not meant to be a statement

12 of law. You know that. This is just telling folks in the

13 world: Hey, maybe I should do something. Okay?

14 MR. PARASHARAMI: I think that the problem is it

15 misstates the claims, and Rule 23(c)(2) requires an accurate

16 statement of --

17 THE COURT: It is accurate, Mr. Parasharami. Trust

18 me. I have been writing Facebook order after Facebook order

19 for the last two months. All right? This thing is going to

20 get done.

21 So if you want to say "information" because you don't like

22 the word "data," that's fine. It does not have to slavishly

23 follow the statute to be accurate and informative.

24 Now, what do you want to say if you don't like the word

25 "data"? Would you prefer to say "information"?

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 24

1 MR. PARASHARAMI: Umm --

2 THE COURT: "Materials"?

3 I don't know why the word "data" is objectionable, but if

4 you don't like it, I will entertain a substitute.

5 MR. PARASHARAMI: Yeah. I --

6 THE COURT: "Stuff."

7 MR. PARASHARAMI: Oh, no. I --

8 THE COURT: "Your face," how about that? "Stored

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 your face."

10 MR. PARASHARAMI: Yeah, I don't think that's quite

11 right. I think -- do we prefer "information"?

12 MS. GOLDMAN: Yes.

13 MR. PARASHARAMI: "Information."

14 THE COURT: "Information," okay.

15 Mr. Williams, do you have any problem with that?

16 MR. WILLIAMS: No.

17 THE COURT: That will be changed to "information."

18 Okay. Anything else on Page 1, Mr. Parasharami?

19 MR. PARASHARAMI: Yeah. I think -- I think

20 throughout where there are references to "in Illinois," and

21 this is a global problem with the notice, it should refer to

22 "residents."

23 I think that, you know, the Court has said in its class

24 certification order, the order granting class certification,

25 that the class consists of Illinois residents; that it is not a

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 25

1 class of Illinois non-residents.

2 MR. WILLIAMS: That's inaccurate.

3 MR. PARASHARAMI: Well, on Page 13 it says -- the

4 order says that this is not a class of Illinois non-residents.

5 MR. WILLIAMS: Your Honor, what he's referring to on

6 Page 13 of the order -- first, the class definition is:

7 "Facebook users located in Illinois for whom

8 Facebook created and stored a face template after

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 June 7, 2011."

10 That's on Page 15.

11 Page 13, that Mr. Parasharami is referring to, is a page

12 where your Honor was discussing the extraterritoriality issue

13 and actually -- and the Avery case, which -- in which case the

14 issue was plaintiffs who brought suit under an Illinois

15 statute, but lived outside of Illinois. And you are

16 distinguishing that set of circumstances --

17 THE COURT: I remember that all quite clearly.

18 Why don't we do this? I did say "located." Why don't we

19 say, "If you are a Facebook user located in Illinois"?

20 MR. WILLIAMS: That's fine.

21 THE COURT: Okay? Make that change throughout.

22 Okay? So, for example, starting in that bold language at the

23 top and then elsewhere. Okay?

24 MR. PARASHARAMI: Your Honor, just on that point. It

25 does seem like based -- the order said none of the class

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 26

1 members are non-residents, and I just think that it could be

2 misleading to people, to the extent that if they believe

3 that -- that there is some sort of broader criteria, you know,

4 located in what captured your O'Hare example. And I think that

5 would be very confusing to potential recipients of this.

6 THE COURT: I think that's -- I'm not worried that

7 that's going to be confusing.

8 So we'll -- we'll meet you halfway there, Mr. Parasharami.

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 We will say "located in." Mainly to stay consistent with the

10 definition that's in the next paragraph.

11 Okay. Any other concerns about Page 1?

12 Mr. Williams, you need to just take notes or have somebody

13 on your team take notes so we can make all this good. Okay?

14 All right. Anything else?

15 (No response.)

16 THE COURT: Page 2 is just the Table of Contents.

17 Anything there?

18 MR. PARASHARAMI: So, no, we don't have a problem

19 with that.

20 THE COURT: Okay. Page 3. I am changing Section 1

21 to -- we're going to delete entirely the sentence, "The trial

22 will decide." Okay?

23 So it should go from bracket date to my name. Take that

24 middle sentence out.

25 And then in the second line "You have legal rights," say

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 27

1 "Before the Court holds a jury trial." All right? So add

2 "jury" there and take out "the trial will decide" line.

3 Mr. Parasharami, any concerns about Page 3?

4 MR. PARASHARAMI: So I guess globally we've covered

5 the change from "data" to "information"?

6 THE COURT: All right, yes. That will be made

7 throughout, along with the "located."

8 Okay. Anything else?

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 MR. PARASHARAMI: Yeah. I think in the last sentence

10 of 2, we think it's --

11 THE COURT: 2? Okay.

12 MR. WILLIAMS: Section 2.

13 THE COURT: Yes.

14 MR. PARASHARAMI: Section 2.

15 THE COURT: Yes.

16 MR. PARASHARAMI: We think it's important to instead

17 of repeating the phrase about the "stored biometric data

18 without prior consent," to identify the statutory requirement,

19 which I'll agree is part of the requirement of being aggrieved

20 by a violation of the statute.

21 THE COURT: All right. So what are you asking?

22 MR. PARASHARAMI: To delete -- where it says "any

23 person in Illinois," and then delete "from" through "consent to

24 aggrieved by a violation of the statute."

25 MR. WILLIAMS: I'm not sure I understand.

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 28

1 THE COURT: I don't see the word "from." Where is

2 that? This is Paragraph 2, "What is this lawsuit about?"

3 MR. PARASHARAMI: So we would change after "BIPA

4 allows any person in Illinois from."

5 THE COURT: The last sentence, I see. "BIPA allows

6 any person in Illinois."

7 MR. PARASHARAMI: "Aggrieved by a violation of the

8 statute," is what we would say in place of "from" through

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 "without prior consent."

10 THE COURT: Can we just drop that last sentence

11 entirely? Do we really need it? It seems a little duplicative

12 of anything else.

13 MR. WILLIAMS: The reason we had it in there is

14 because we felt we needed to actually explain the damages, the

15 potential. But if that's out, we're comfortable with it.

16 MR. PARASHARAMI: We're fine with deleting the

17 sentence.

18 THE COURT: All right. That last sentence will be

19 deleted. Let's take that whole thing out and make it shorter

20 anyway.

21 Okay. Anything else on Page 3?

22 MR. PARASHARAMI: I think -- I think in the first

23 bullet on the response to -- the response No. 4, where it says,

24 "who have been tagged in photographs and, thus, had face

25 templates created."

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 29

1 I'm not sure that's entirely clear that that's right. And

2 I would just cut "who have been tagged" --

3 THE COURT: How about if we drop all those bullet

4 points? For notice purposes, do they really need --

5 MR. PARASHARAMI: That's fine.

6 MR. WILLIAMS: Don't need them.

7 THE COURT: All right. All the bullet points are

8 out. All the little dot things will be out. Okay. That's

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 good. All right. So that takes care of that.

10 Page 4. Any concerns, Mr. Parasharami?

11 MR. PARASHARAMI: So, again, the -- I think we're

12 replacing "biometric data" with --

13 THE COURT: That's going to happen universally. So

14 don't worry about that.

15 (Brief pause.)

16 THE COURT: All right. Nothing this?

17 MR. PARASHARAMI: Yeah. I -- we would like to

18 supplement, and I just don't have language here, but six

19 with -- you know, because I think if I understand right --

20 THE COURT: Six, okay. Yes.

21 MR. PARASHARAMI: Mr. Williams and I are probably

22 going to submit after this a joint document that contains

23 our -- our views of what this should look like for the Court's

24 approval. So just -- you know, I think that might be a good

25 way to proceed.

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 30

1 But with that, we want to provide a --

2 THE COURT: Can I tell you what I used to do when I

3 was on your side of the case? I would just say: We disagree

4 entirely and consider ourselves to be as innocent as the new

5 lambs. I mean, how much more do you need to say?

6 MR. PARASHARAMI: I think with respect, I appreciate

7 that, but we would like to communicate our point of view.

8 Can I -- I guess I can read into the record what our view

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 would be for -- for six and --

10 THE COURT: I'll tell you what. Just work it out

11 today.

12 MR. PARASHARAMI: Is that all right, your Honor --

13 THE COURT: Any reasonable statement. They can say

14 whatever they want.

15 MR. WILLIAMS: One point I'd like to make there.

16 THE COURT: Yes.

17 MR. WILLIAMS: It's their position they want to say

18 whatever they want, that's fine.

19 What they do want to add, though, which we talked about

20 yesterday, which was that they have a current petition with the

21 Ninth Circuit pending under 23(f). And I explained that, look,

22 it's not in the Ninth Circuit. It's a petition and it's not --

23 have relevance to any person that is going to be reading this

24 for notice purposes.

25 And so we didn't think that that had any role in --

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 31

1 THE COURT: Well, I agree with that. You can just

2 say -- we're talking about the merits here, okay, not

3 procedural things. So just whatever you want to say on the

4 merits.

5 MR. WILLIAMS: They can say whatever they want to

6 say.

7 THE COURT: They can do whatever they like. If you

8 have any objections, let me know. Okay?

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 Let's get that done by tomorrow -- I would like to have

10 this back first thing tomorrow morning.

11 MR. PARASHARAMI: Your Honor, with that in mind, I

12 think -- and we have been negotiating over the weekend. I

13 think there might be some value in -- and I think we agreed on

14 a lot of things, Sean, I think it's fair to say.

15 MR. WILLIAMS: Except last night wasn't quite an

16 agreement.

17 THE COURT: Just talk to the Court not to each other.

18 Talk to me.

19 What's the issue?

20 MR. PARASHARAMI: Your Honor, I think it might be

21 appropriate for us to -- you know, if we can agree on certain

22 other changes to this, we would put in it a red line for your

23 Honor --

24 THE COURT: You can do whatever you want, but this is

25 the baseline. Okay?

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 32

1 MR. PARASHARAMI: Sure.

2 THE COURT: If you want to riff on it some more,

3 that's fine, as long as everybody agrees.

4 MR. WILLIAMS: And the changes that your Honor has

5 suggested right now, we're fine with those.

6 THE COURT: Those are all mandatory. Okay? They're

7 not to be negotiated.

8 Now, I do not want to see 15 other topics of this

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 agreement. This is your time. So don't go home and think:

10 I'm going to add 20 more points. We're getting this done now.

11 Now, I will let you negotiate your insert. That's fine.

12 Okay? Now, if there is anything else you both agree on, that's

13 fine, too.

14 MR. PARASHARAMI: And is that true throughout the

15 document?

16 THE COURT: That's through for the entire notice.

17 Okay? This is it. This is your show time.

18 MR. PARASHARAMI: Appreciate it, your Honor.

19 THE COURT: Okay. Anything else on Page 4?

20 (No response.)

21 THE COURT: All right. Page 5?

22 (Brief pause.)

23 THE COURT: Now, I have to say for number ten, I

24 understand there is not going to be a website that

25 automatically tells you. That's fine.

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 33

1 But I think the wording of this properly captures the fact

2 that they will be notified later after all of the checking

3 mechanisms are put into place and it's determined. So I don't

4 have a problem with that.

5 MR. PARASHARAMI: Your Honor, on this we feel very --

6 there is not going to be some process by which -- that can

7 inform potential class members accurately whether they are

8 class members or not. So that's a pretty important point.

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 THE COURT: I agree with that. But I think this

10 notification just says go to this website, type your name in

11 and we'll get back to you.

12 It doesn't say we're going to instantaneously determine

13 whether you're a class member or not.

14 MR. PARASHARAMI: I think that -- at least if I were

15 a class member reading that, I would think that by putting my

16 information in, I would get some return at some point on

17 whether I'm a class member or not. And that is typically --

18 THE COURT: It says you will be notified.

19 MR. PARASHARAMI: So that -- that essentially almost

20 never happens in class actions. To my mind -- and I do a lot

21 of class actions and class action notices. To me, this is both

22 unheard of and, frankly, totally impractical. I don't think

23 it's necessary to -- for purposes of understanding whether

24 somebody should opt in or opt out.

25 I think the other problem with that is that if somebody is

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 34

1 choosing whether to exercise their due process right to opt out

2 of the class, they might believe they could go to a website and

3 actually provide that information.

4 This is -- at the end of the day if there is a trial in

5 the case and, you know, a final resolution, there would always

6 need to be a claims process in order to determine who is in the

7 class. So I think this is wholly misleading.

8 I think striking it is -- would be useful. And, you know,

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 I think we have --

10 THE COURT: Well, all right. I don't agree with any

11 of that, but in the interests of expediency, can we just drop

12 it?

13 MR. WILLIAMS: I don't think that it's misleading at

14 all. I think it's helpful.

15 THE COURT: Why do we need it? Why do we need it?

16 MR. WILLIAMS: The only reason that we need it is so

17 that class members or potential class members can go to the

18 website and find out more about the case and whether or not

19 they may be part of the class. It's more informative than

20 anything else.

21 MR. PARASHARAMI: But I think throughout this

22 document you're going to have places where you say: For more

23 information about the class action, you know, look at this web

24 page. This is specific about class membership.

25 MR. WILLIAMS: Your Honor, if you think -- if you

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 35

1 think it's --

2 THE COURT: Hold on, everybody. We've got plenty of

3 time here.

4 Now, let me ask you this. Are you looking to harvest

5 something from this cite that you need?

6 MR. WILLIAMS: No.

7 THE COURT: Any data or anything like that?

8 MR. WILLIAMS: No.

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 THE COURT: Okay. I thought maybe this was an effort

10 to get extra clarity on who might be -- but it's not.

11 MR. WILLIAMS: Well, the -- the website and people

12 logging in or putting their name and information in there and

13 getting info about whether or not they may be in the class,

14 that it's more helpful to the notice recipient than to us.

15 MR. PARASHARAMI: This is a website that can never

16 really exist because there won't be a process for checking them

17 against -- there is no class membership list to check against.

18 And that's why I say I think it was -- and 11 is kind of the

19 same way. They say "you will be notified" --

20 THE COURT: Slow down here. We are going to

21 determine who has a face template. There is just no question.

22 That is going to happen. It may not happen now for the notice

23 period, but it is going to happen when we get to the claim

24 stage should that day ever arise.

25 MR. PARASHARAMI: So I think that's a totally

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 36

1 different process and that including language about some -- you

2 know, about some website now would be misleading because it

3 would imply that you could find out before the claim is

4 processed.

5 I agree that, you know, at the end of the day there will

6 be a claims process. That should be delineated later, not in

7 this notice.

8 It would be misleading to tell people -- I assume that the

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 blank is a -- so if I may? That the blank is going to be the

10 class notice website. That's typically what the blank refers

11 to.

12 But that notice website, as -- you know, when somebody

13 gets an email, if they click on this link, there is not going

14 to be anything on that website that allows them to actually get

15 information about whether they are in the class or not during

16 the opt-out period.

17 And the whole purpose of notice is for people to be able

18 to decide whether or not to opt out. That's sort of the

19 touchstone of due process. So this is not just kind of a side

20 issue. This is actually pretty important.

21 And, you know, I -- I think if we're going to, you know,

22 take this seriously, we have to got to not include misleading

23 information like this.

24 MR. WILLIAMS: I think I understand the issue now,

25 your Honor. I had not heard this before.

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 37

1 I think that what Mr. Parasharami is suggesting is that --

2 that this -- this suggests that you can go to a website now and

3 determine if your name is going to be among those.

4 And I agree, that that's not -- I don't think that that's

5 necessary. There won't be any information populated in there,

6 in that website now about whether or not your name is --

7 THE COURT: I started off by saying yes. It says,

8 we'll let you know later. But I thought it was to help define

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 specifically people who might get missed otherwise, but you

10 said no. So if you want to put in a general, "for more

11 information, see..."

12 MR. WILLIAMS: "For more information." We can do

13 that.

14 THE COURT: How about that?

15 MR. WILLIAMS: Yes.

16 MR. PARASHARAMI: I think that's the kind of thing

17 that we could readily negotiate.

18 THE COURT: All right. So why don't you just redo 10

19 and 11 and just make it: For more information, please see your

20 cite. Okay?

21 MR. PARASHARAMI: Your Honor, I do think in 11 there

22 is the potential to mislead people. And 10 as well, for that

23 matter. But certainly in 11, in talking about whether you're

24 in the class or not.

25 Just uploading one photograph might not be enough to put

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 38

1 you in the class. I think there should be some -- some

2 qualifier, like, enough photographs just to make it clear.

3 THE COURT: You two try to work something out. I

4 mean, I think 10 and 11 could probably just be one item.

5 MR. WILLIAMS: Can I be heard on this point, because

6 it's one that we discussed yesterday.

7 THE COURT: Sure. Okay.

8 MR. WILLIAMS: Whether or not a person uploads enough

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 photographs for a template to be created is an issue that a

10 notice recipient is not going to understand. Frankly, it is --

11 I don't even know that it's accurate.

12 So what defendants are suggesting is that in some

13 instances you may have to upload more than one photograph or

14 there needs to be more than one photograph of you in order for

15 a template to be created.

16 That issue is going to come out at trial in one way or

17 another. It's not necessary here at all.

18 THE COURT: I agree. Look. The way to approach

19 notice is you have to have had at least one photo uploaded.

20 That may not be enough. We'll see. Have to dispute this at

21 trial maybe.

22 MR. WILLIAMS: Right.

23 THE COURT: But let's not -- we're not going to get

24 into that now. Okay.

25 I think all of this can probably just be for more

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 39

1 information and to help you think about your rights, you know,

2 something along those lines, and whether you want to stay in or

3 stay out, you can go to this website or call you.

4 MR. WILLIAMS: That's right.

5 THE COURT: Not me. Call you. Okay? I'm not sure

6 we say that enough actually. I know it's at the end, but think

7 about maybe in the beginning when you mention my name, "Please

8 do not call the Court." Ms. Clark and I would be very happy.

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 Okay.

10 MR. WILLIAMS: Will do, your Honor.

11 THE COURT: All right.

12 MR. PARASHARAMI: This is something we can probably

13 work out with Mr. Williams, but for -- if we're on number 12, I

14 think that would be a good place to say "Do not contact

15 Facebook or the Court."

16 THE COURT: That's fine. You can put that in, too.

17 That's perfectly fine.

18 In fact, that probably is not a bad idea. Why don't you

19 say, "Please do not email or do anything to Facebook because it

20 will not be seen. You need to go through this process."

21 All right?

22 MR. PARASHARAMI: Right.

23 THE COURT: All right. Page 6. Oh, I do have -- the

24 exclusion process, I think, is not adequate. We'll get to that

25 in a moment.

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 40

1 Anything up to -- in the first paragraph or Paragraph 14

2 on Page 6?

3 MR. PARASHARAMI: I don't believe so, in the first

4 paragraph.

5 THE COURT: Nothing, okay. Paragraph 14.

6 MR. PARASHARAMI: Are we on the second paragraph?

7 THE COURT: Yeah, the one that's numbered 14.

8 MR. PARASHARAMI: Yeah. So we didn't have an issue

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 in the first paragraph.

10 I guess on the second paragraph, I think that the last

11 sentence of that paragraph is a little bit confusing.

12 THE COURT: "If you exclude."

13 MR. PARASHARAMI: It sort of presumes why somebody

14 might exclude themselves, and it seems to give them, you know,

15 legal advice, which I think is probably not the function of a

16 class notice.

17 THE COURT: Why don't we just do this, "If you

18 exclude yourself, you should talk to your own lawyer soon."

19 How about that?

20 MR. WILLIAMS: That's fine with us, your Honor.

21 THE COURT: Let's just do that.

22 MR. PARASHARAMI: I think that's fine.

23 THE COURT: Okay? All right. So, "If you exclude

24 yourself, you should talk..."

25 Now, 15, Mr. Williams, you went from the 21st century to

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 41

1 the 19th when you want to opt. I think U.S. mail is just

2 not -- not the right technique. You need to have a click "opt

3 me out," a -- you know, something easy. Do not go to a

4 different website. Just something that can say, "Please

5 exclude."

6 MR. WILLIAMS: We talked about that with the claims

7 administrator over the weekend and this morning and that can be

8 electronic.

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 THE COURT: All right. I think U.S. mail should be a

10 last resort, if there at all. Okay? Because it's just -- in

11 this day and age, and particularly for this case, it's not that

12 suited. All right?

13 MR. WILLIAMS: Yes.

14 THE COURT: All right. You work that out.

15 Okay. Page 7? Anything on Page 7, Mr. Parasharami?

16 MR. PARASHARAMI: Yeah. My understanding is that

17 plaintiff's counsel had some changes on their communications

18 issues on Page -- on 16.

19 THE COURT: On which one?

20 MR. PARASHARAMI: On number 16, but I suspect we can

21 work that all out.

22 MR. WILLIAMS: Oh, on 16 we're just going to change

23 the telephone numbers. We have an 800 number that we would

24 like to --

25 THE COURT: Oh, okay. Good. 1-800 number.

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 42

1 MR. WILLIAMS: Each firm has an 800 number that is --

2 has people trained to answer questions related to the notice or

3 questions from potential class members.

4 THE COURT: All right. Okay.

5 All right. Anything on Page 7? I do -- I'm going to

6 change the trial section, but we'll -- anything before that,

7 Mr. Parasharami?

8 MR. PARASHARAMI: No, not -- no.

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 THE COURT: On the trial, just -- let's have that

10 entry sentence read, "The Court has scheduled a jury trial to

11 begin on July 9, 2018."

12 Just take out the rest. End after 2018.

13 Okay. Anything else on Page 7, Mr. Parasharami?

14 MR. PARASHARAMI: No, not on -- not on the -- one

15 second.

16 THE COURT: Anything on Page 8?

17 MR. PARASHARAMI: Sorry. I'm just comparing.

18 THE COURT: Yes, that's fine.

19 MR. PARASHARAMI: No.

20 THE COURT: Okay. Now, you two finish those little

21 things you're going to work out. Get it to me by tomorrow

22 morning and then tailor the short form to correspond to all the

23 changes we made to this one. Okay?

24 MR. WILLIAMS: Will do.

25 THE COURT: All right. Anything else I can help you

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 43

1 with on notice?

2 MR. PARASHARAMI: I think we do want to talk about

3 timing again, your Honor.

4 You know, we made -- I mean, first of all, obviously, we

5 will do our best and we will keep the Court informed about

6 creating the list of notice recipients. Obviously, as your

7 Honor said, we will target the 25th.

8 We make clear in the declarations that we filed that a --

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 that the news feed would take a week longer than that after the

10 list is completed and that the jewel notifications would take

11 two weeks longer than that. Just so your Honor is aware of

12 that.

13 THE COURT: Why is that?

14 MR. PARASHARAMI: That was -- that was for the

15 computing time and resources, engineering resources that would

16 take to do it. We asked how long would that take, and that's

17 what we were told.

18 THE COURT: Two weeks to post something on a jewel?

19 MR. PARASHARAMI: Yeah, because this isn't -- it's

20 not something that we have just set up. It's not -- again,

21 it's not like you press one button.

22 I appreciate that buttons are pressed, but lots and lots

23 of buttons are pressed here.

24 THE COURT: How can it take two weeks to do that? I

25 mean...

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 44

1 MR. PARASHARAMI: I mean, that is --

2 THE COURT: I didn't get that. I find it little

3 counter-intuitive, to be honest.

4 But why does it take -- the jewel mechanism is set up.

5 You've just got to populate the text box. Why does that take

6 two weeks?

7 MR. PARASHARAMI: I just don't think that's how it

8 works. And we can talk to the engineers and get you more

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 detail. In the -- we had, as you know, almost no time to deal

10 with these issues.

11 THE COURT: I really disagree with that

12 characterization. It's just not right. You had plenty of

13 time. We can take it down to 30 days and you still have plenty

14 of time. So this is not -- and particularly for an online

15 company that moves with alacrity when it chooses to in other

16 circumstances, I find the time protestations to be a bit

17 hollow.

18 Now, what I would like to do is understand why it takes

19 two weeks to populate a jewel content. I don't get that. Do

20 you know?

21 MR. PARASHARAMI: No. We talked to our engineers and

22 asked them what would it take and that is what we were told.

23 THE COURT: I need more detail on that. I am

24 skeptical, quite skeptical that Facebook cannot turn on less

25 than two week's notice to post a jewel. That's what you're

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 45

1 telling me.

2 I'm going to hold you to that. And I'm finding it very,

3 very hard to believe that there is an iron-clad algorithmic

4 online law that Facebook cannot do a notice on less than two

5 week's prep time. I'm very skeptical.

6 Now, maybe that's right, but I'm going to need to see some

7 proof. I am going to remember that you told me that,

8 Mr. Parasharami.

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 MR. PARASHARAMI: I appreciate that, your Honor. I

10 wouldn't tell you that if I did not think --

11 THE COURT: You're not able to tell me the details

12 why, which makes me concerned.

13 MR. PARASHARAMI: Yeah. Again, in sort of the time

14 frame for trying to brief these issues in the last two to three

15 days, or whatever it's been, we tried to get quick answers to

16 how to accomplish this task.

17 THE COURT: All right. I want to see a detailed

18 declaration from the engineer who does this explaining to me

19 that it is literally impossible for Facebook under any

20 circumstances to post a jewel notification on less than 14 days

21 notice. That's what I expect to see. You get that to me by

22 tomorrow at 5:00 p.m.

23 Now, what about the -- you said it took a week for what?

24 MR. PARASHARAMI: For the news feed.

25 THE COURT: I want the same declaration for the news

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 46

1 feed. I do not want generalities. I want specific

2 understandings. And I want that person to say that they have

3 never been able to do this before and it's literally impossible

4 for Facebook to post anything in a jewel notice on less than

5 two week's notice no matter what. And it is impossible for

6 Facebook to post anything in the news feed on, what is it, less

7 than seven days. That's what I expect to see.

8 MR. PARASHARAMI: I think that that's a -- I'll just

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 be direct. I think that's a bit unfair. We asked for the best

10 estimate of the time it would take and --

11 THE COURT: We're not talking about that. I'm

12 talking about your representations to the Court,

13 Mr. Parasharami, that Facebook could not do this on less than

14 two week's time. I want to see the evidence for that.

15 That's what we're talking about, not the overall time in

16 the case. I want to see the data behind that representation.

17 MR. PARASHARAMI: I just want to be clear --

18 THE COURT: I want to have an engineer tell me, under

19 penalty of perjury, that it is literally impossible for

20 Facebook to do that on less than two week's notice, because I

21 am deeply skeptical.

22 MR. PARASHARAMI: So I want to be clear. I don't

23 think I'm representing the words "literally impossible." What

24 I was representing is what I understood is the time that they

25 forecast it will take.

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 47

1 Do they -- I think it's not like it's been -- I just don't

2 know the answer to that. I think that --

3 THE COURT: You told me two weeks. Now --

4 MR. PARASHARAMI: That's our best estimate. I think

5 it's a legitimate --

6 THE COURT: I'm not going to accept a best estimate.

7 When you tell me, as you did, that you cannot do it, no way, no

8 how, on less than two week's notice, I want to see the evidence

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 for that. I don't believe that's true. Now, it may be, and I

10 may learn something, but I'm skeptical that that's true.

11 You get that to me tomorrow at 5:00, and you get the news

12 feed one at the same time.

13 Anything else I can help you with?

14 MR. PARASHARAMI: On that issue, your Honor, i would

15 just ask if I turns out -- and I'm not trying to be difficult

16 here. If it turns out we can do it quicker, we will try, but I

17 -- and then -- and we'll learn that.

18 But we gave the Court the best information we had at the

19 time we filed these declarations, you know, at the Friday

20 5:00 p.m. deadline.

21 THE COURT: We shall see, Mr. Parasharami.

22 Anything else I can help you with, Mr. Williams?

23 MR. WILLIAMS: Just one point, your Honor.

24 THE COURT: Yes.

25 MR. WILLIAMS: Actually two.

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 48

1 To the extent that you're satisfied with whatever you get

2 from Facebook on those issues, it shouldn't stop whatever they

3 can do quickly should get out. We can stagger some of those

4 issues, to the extent the Court is willing to do that.

5 THE COURT: I will take a keen eye to the timeline.

6 MR. WILLIAMS: And the next issue is just one I'm

7 anticipating due to correspondence I have had with defendants

8 over the last few days.

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 So when we were here last a few weeks ago, we asked you

10 about your standing order on civil trials and the timing of the

11 obligations of the parties in exchanging information so that

12 you had the information that you needed within, I think it's 14

13 days of the pretrial conference.

14 THE COURT: Let me -- remind me when that is?

15 MR. WILLIAMS: It's June 14th. Pretrial conference

16 is June 14th.

17 THE COURT: Oh, okay. Yes.

18 MR. WILLIAMS: So that requires you to have the

19 documents that you need by May 31st.

20 THE COURT: Yes.

21 MR. WILLIAMS: We met-and-conferred on May 2nd or 3rd

22 regarding, you know, Exhibit Lists, Witness Lists, things that

23 are going to require us to really talk about to get the

24 documents before you in the form that you need them.

25 Last week we -- we agreed to exchange that information on

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 49

1 May 17th or 18th at the latest and plaintiffs have served their

2 Motions in Limine, the Exhibit List, the Witness List and other

3 materials to invite correspondence and discussion on those

4 matters so that we can get them, you know, together.

5 We got a response from Facebook saying that they needed

6 another five or six business days to do their exchange. So we

7 haven't received anything other than Motions in Limine from

8 them yet and so there is no work that can get done.

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 Last night I got an email from Facebook saying that they

10 may raise this issue with you to get more time to do the

11 exchanges, but they would like to do it in a way that doesn't

12 affect the trial date, but it might affect the date on which

13 you get the materials in order to make decisions about

14 admissibility and things of that nature.

15 THE COURT: How many do you have? For example, how

16 many Motions in Limine do you have?

17 MR. WILLIAMS: Well, your limit was eight. We

18 served --

19 THE COURT: You hit the limit?

20 MR. WILLIAMS: Yeah. We served --

21 THE COURT: You hit the limit.

22 MR. WILLIAMS: We hit the limit. They served six. I

23 think there are probably three of those that we'll work out.

24 THE COURT: I know you know, because you're an

25 experienced trial lawyer, you both are, it's just evidentiary

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 50

1 objections. Okay? It's not -- they are not mini summary

2 judgments. We are not covert Daubert motions. It's just:

3 This category of documents or this type of testimony should be

4 excluded because --

5 MR. WILLIAMS: We're true to that.

6 THE COURT: -- it's character evidence, or something

7 like that. You had eight of those.

8 MR. WILLIAMS: We were true to that. I think that

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 once --

10 THE COURT: Can you give me a sample? Just a high

11 level -- what are some of the issues that's your evidentiary

12 problems?

13 MR. WILLIAMS: One of the issues is, for example, the

14 admissibility of documents related to the Irish Data Protection

15 Commission, which had audited Facebook in 2011 and 2012,

16 particularly about the privacy issues and the way they were

17 collecting biometric data.

18 THE COURT: All right.

19 MR. WILLIAMS: That's one thing we expect to be an

20 issue.

21 THE COURT: Okay.

22 MR. WILLIAMS: The next issue is the acquisition of

23 face.com, and issues around that. They have taken the position

24 in pleadings that the facial recognition data --

25 THE COURT: I just wanted a flavor. That's good.

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 51

1 Okay. Sounds like you did the right thing on the motions.

2 You'll have plenty of time to argue that.

3 MR. WILLIAMS: But I think -- we did hit the limit of

4 eight, but I do think that we will be able to work out some of

5 them so that it comes down to maybe five --

6 THE COURT: All right.

7 MR. WILLIAMS: -- or six.

8 THE COURT: Okay.

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 MR. WILLIAMS: But the Motions in Limine are not the

10 issue. It's the other things that have to be done. The Jury

11 Instructions, the -- the proposed Jury Instructions, you know,

12 the Exhibit Lists on negotiating admissibility and what that's

13 going to look like.

14 If we're not getting the exchanges from Facebook, we're,

15 you know, negotiating with ourselves and the time frame for us

16 to reach those agreements is going to get much shorter.

17 THE COURT: Well, let me just jump in. I have been

18 thinking about Jury Instructions. Now, I'm presuming Illinois

19 does not have a model instruction for BIPA.

20 MR. WILLIAMS: No.

21 THE COURT: So this will be one of those rare

22 circumstances where we're going to craft one. I don't think

23 that will be terribly hard. I think that can be done in a page

24 or two, maybe, and maybe some terms defined, as we do in the

25 Jury Instructions. I'm not sure that's necessary, but I think

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 52

1 we could do that.

2 And then there will be an issue on damages. Zero damages,

3 1,000 or 5,000. And I presume no one is attempting to prove

4 actual damages.

5 MR. WILLIAMS: That's right.

6 THE COURT: Okay. So it's going to be statutory

7 damages.

8 MR. WILLIAMS: That's right.

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 THE COURT: Okay. All right. So that's not an

10 insurmountable task between now and June 14th.

11 MR. WILLIAMS: Between now and May 31st, because

12 that's the date that we have to submit all the pretrial

13 materials --

14 THE COURT: Ten days from today.

15 MR. WILLIAMS: -- including the trial brief.

16 There is a lot to be done. And unless it's a two-way

17 street, it's not going to get done. And we don't want to be

18 jammed in making those decisions, as they now have all of our

19 materials to just sit on and sort of evaluate and provide us

20 with their responses or their positions whenever they get

21 comfortable with it.

22 THE COURT: All right. Let's hear from Facebook.

23 Mr. Connelly.

24 MR. CONNELLY: Judge, I'm going to accentuate the

25 positives. We're getting closer to trial, as you might expect.

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 53

1 You know, that's --

2 THE COURT: These things happen.

3 MR. CONNELLY: You have to search a little bit for

4 the positive, but there have been good faith communications

5 between the parties trying to narrow the issues.

6 The -- and the deadline for both parties is May 31st to be

7 done with it. That would then let you have all of the

8 materials two weeks in advance of June 14th.

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 THE COURT: Yes.

10 MR. CONNELLY: What Facebook has been suggesting is,

11 look, let's keep talking, but we're getting crunched. We'll

12 all do a better job if rather than -- rather than submitting

13 everything to the Court on May 31st, give us three extra

14 business days, which would push it out til June 5th.

15 Now, full disclosure, Judge --

16 THE COURT: Three actual business days.

17 MR. CONNELLY: Yeah. We would like to have the

18 filing on June 5th. Full disclosure that the Court can easily

19 back into itself. That tightens it up a little bit in terms of

20 when the Court gets everything filed on June 5th for the

21 June 14th hearing, but that's our suggestion.

22 Again, not for purposes of delay, but really, frankly, so

23 that we can -- as you can understand, a case of this magnitude,

24 there are certain layers of review and getting client approval,

25 so that we can continue to talk with the Plaintiffs -- I'm

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 54

1 sorry, with the other side in total, as far as let's see how

2 much we can hit common ground on.

3 THE COURT: And this would be to make my life easier.

4 MR. CONNELLY: Yours and ours both.

5 THE COURT: All right. June 5th?

6 MR. CONNELLY: That's our suggestion.

7 THE COURT: All right. I can accept that, 5:00 p.m.

8 California time June 5th. Just have it all in by 5:00 p.m.

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 California time on June 5th. And this is with an eye towards

10 streamlining the issues, the extra time.

11 MR. CONNELLY: One last point, Judge, unrelated to

12 this issue, but as long as I'm up here.

13 THE COURT: Yes.

14 MR. CONNELLY: And I think it's pretty clear that the

15 Court has denied or plans to deny Facebook's request to stay

16 the proceedings while we have the petition before the Ninth

17 Circuit. I just --

18 THE COURT: I haven't even gotten the opposition to

19 that yet.

20 MR. WILLIAMS: The opposition is due today.

21 THE COURT: I have not taken a look at it.

22 MR. CONNELLY: I'm sorry.

23 THE COURT: I have so much to do. Until things are

24 submitted, I really don't -- I just -- I wish I had time to

25 kind of read the things as they come in. I don't. It's just

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 55

1 not practical for a district judge.

2 MR. WILLIAMS: Can I make one more point, your Honor,

3 because there is one expectation.

4 THE COURT: Yes.

5 MR. WILLIAMS: You know, your class certification

6 order, obviously, focuses on the face templates. And the --

7 the number of face templates that Facebook has either created

8 in Illinois is obviously going to be at issue in the case, one

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 of the primary issues, a number of them.

10 We asked for that number in discovery many times. We

11 actually came to the Court at one point to -- on a Motion to

12 Compel and the Court ordered to us meet-and-confer, and the

13 promise was they would get something to us in the form of a

14 stipulation what the number of face templates are. They have

15 the number. We think it's somewhere around 7 million, maybe

16 slightly less than that.

17 But I don't see how we can go forward until they produce

18 that number. And it doesn't have to be today, but your Honor

19 is going to need it. We're going to need it.

20 We've asked for it. We're entitled to it. They have it.

21 It may come up in papers before you, but I don't see any reason

22 why it's not something that hasn't been provided, you know,

23 forthwith.

24 THE COURT: So it's not subject to some fact disputes

25 at trial?

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 56

1 MR. WILLIAMS: How many face templates they have?

2 THE COURT: Yes.

3 MR. WILLIAMS: I don't think so. I don't think

4 it's -- the number is really going to be a fact dispute, but

5 because we asked for the number, they have it. It's kind of a

6 discovery issue that never got resolved.

7 THE COURT: I take it you want to say in opening

8 statement -- you want to use the number in opening statement?

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 Is that the issue?

10 MR. WILLIAMS: I may.

11 THE COURT: Okay. I thought it was disputed, the

12 number of templates.

13 Is that right, Mr. Connelly?

14 MR. CONNELLY: Well, yes. I think -- that's a fair

15 statement.

16 THE COURT: All right. Well --

17 MR. CONNELLY: Although I appreciate what counsel is

18 saying.

19 Again, I haven't been personally engaged in this process.

20 I will take a deep dive into it to find out whether or not that

21 number can be made available and if not, why it can't be made

22 available.

23 THE COURT: To be honest, it actually -- as you have

24 suggested with an eye towards streamlining pretrial prep, if

25 that's something you can just stipulate to, you can just make

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 57

1 it a stipulation of fact. Okay? That would -- if it's not

2 controversial and you all are happy with it, let's just do

3 that.

4 MR. WILLIAMS: It will be controversial because the

5 number will have some impact on the damages issue, which is why

6 they haven't -- in my view, why they haven't produced the

7 number even though we've asked for it a number of times.

8 Ultimately what you'll hear from us, your Honor, is that

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 to the extent that they are unwilling to provide the number of

10 face templates, then our position will be that they should not

11 be able to present evidence to the Court or to a jury that it's

12 anything less than the number of users in Illinois.

13 THE COURT: Well, I think that's going a little far

14 now. Why don't you two see what you can work out?

15 I was under the impression that the -- populating the

16 exact count of templates was something that may turn on the

17 evidence at trial. If that's wrong, you can tell me. If it's

18 right, you can certainly say "we believe it's millions" in the

19 opening and go from there. Whatever you want.

20 You can make your argument. There may be a consequence if

21 you overstate, but that's up to you.

22 MR. WILLIAMS: Which is why we asked for the number

23 in discovery and they haven't produced it.

24 THE COURT: Okay. Well, you two will -- why don't

25 you address that? If you can't resolve it in the next couple

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 58

1 days, just let me know.

2 MR. CONNELLY: Two other, hopefully, quick items from

3 Facebook, one from me and one from Archis.

4 THE COURT: Yes.

5 MR. CONNELLY: I think that the hearing on the

6 request for a stay is set for June 21st. And I would suggest

7 in order for everybody to keep that July 9th date, if it's

8 possible, if it's convenient for everyone, to try to move that

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 hearing a little up, have it sooner than June 21st, if that's

10 possible.

11 I appreciate that the Court hasn't had a chance to take a

12 look at all the papers, so I'm just -- I'm raising that as a

13 possibility.

14 THE COURT: I haven't looked at them all. I

15 certainly haven't gotten an opposition.

16 If you two want to propose an earlier date, I will

17 consider it. I have another trial coming up -- actually, I

18 have two other trials coming up.

19 THE CLERK: June 14th.

20 MR. WILLIAMS: I thought it with as June 14 as well,

21 which is --

22 THE CLERK: It is.

23 THE COURT: Oh, June 14th.

24 MR. WILLIAMS: Which is when --

25 THE COURT: I really doubt -- well, I mean, if you

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 59

1 want to work it out, I will see if I can do it. June 14th is,

2 what, two weeks away now, three weeks away?

3 If you want to do it, see what you can work out. Okay?

4 MR. CONNELLY: Very good.

5 THE COURT: Now, one other thing. I -- I have

6 forgotten. Okay. Anything else?

7 MR. WILLIAMS: Nothing, your Honor.

8 THE COURT: Mr. Connelly?

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9 MR. CONNELLY: I think the last question on notice.

10 THE COURT: Yes.

11 MR. PARASHARAMI: Just one last point. We had

12 addressed it in the briefs, but had not gotten to it here,

13 which is that the rules are basically that the plaintiff has to

14 pay for the cost of class notice. That's under Eisen and

15 Oppenheimer.

16 So we would like the Court to clarify that the cost of

17 notice that we experience in putting together this information

18 has to --

19 THE COURT: Generally, the plaintiff pays the class

20 notice. If the cost is insubstantial and it's not worth the

21 time and effort, then you typically don't. I will have to see

22 some firm documentation on what the extra expenses will be and

23 then we'll talk about it.

24 MR. PARASHARAMI: Okay. Thank you, your Honor.

25 THE COURT: Okay? You get those declarations to me

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 60

1 by 5:00 p.m. tomorrow.

2 Okay. Thank you.

3 MR. WILLIAMS: Thank you, your Honor.

4 THE CLERK: All rise. Court is in recess.

5 (Proceedings adjourned.)

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 9

Debra L. Pas, CSR, RPR, RMR, CRR Official Reporter - U.S. District Court - San Francisco (415) 431-1477 FILED DATE: 6/24/2019 9:23 PM 2018CH03868

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 Exhibit 5 Case 3:15-cv-03747-JD Document 370-2 Filed 05/11/18 Page 2 of 40

8 UNITED STATES DISTRICT COURT

9 NORTHERN DISTRICT OF CALIFORNIA FILED DATE: 6/24/2019 9:23 PM 2018CH03868 10 SAN FRANCISCO DIVISION

11 IN RE FACEBOOK BIOMETRIC Case No. 3:15-cv-03747-JD 12 INFORMATION PRIVACY LITIGATION

13 DECLARATION OF ALAN VASQUEZ 14 REGARDING CLASS NOTICE PLAN

17 18 19 20 21 22 23 24 25 26 27 28

Case 3:15-cv-03747-JD Document 370-2 Filed 05/11/18 Page 3 of 40

1 INTRODUCTION

2 1. I am a Vice President of Legal Notification Services at Gilardi & Co. LLC 3 (“Gilardi”). In my role, I oversee Gilardi’s in-house advertising division that specializes in the 4 design and implementation of legal notice plans to reach unknown class members in class action 5 litigation.

6 2. Gilardi was established in 1984 and is one of the largest full service class action

7 notice and claims administrators in the United States. The in-house advertising division has 8 specialized in designing, developing and implementing legal notification plans for more than 30 9 FILED DATE: 6/24/2019 9:23 PM 2018CH03868 years. As such, we are familiar with, and guided by, Constitutional due process provisions, rules of 10 states and local jurisdictions, and the relevant case law relating to legal notification. Media plans 11 designed and implemented by our group have included both domestic and international newspapers 12 13 and magazines, Internet-based banners, notices and websites, wire service, radio, television, point

14 of purchase displays and direct mail. As V.P. of Legal Notification Services, I oversee all of the

15 advertising group’s activities as they relate to these notice services. 16 3. I have been involved in the development and implementation of media plans for 17 class action notification for more than fourteen years. For several years, courts have accepted my 18 expert testimony regarding our firm’s quantitative and qualitative evaluation of judicially approved 19 notice plans. I have also testified in person and was acknowledged as an expert in Larson v. Sprint 20 Nextel Corp., No. 07-cv-5325 (D. N.J.). Media campaigns for which I have been directly 21 responsible include, but are not limited to, In Re: National Collegiate Athletic Association Student- 22 Athlete Concussion Litigation, No. 1:13-cv-09116 (N.D. Ill.), In Re: National Collegiate Athletic 23 Association Athletic Grant-In-Aid Cap Antitrust Litigation, No. 4:14-md-02541-CW (N.D. Cal.), 24 Pappas v. Naked Juice, No. 11-cv-08276-JAK (C.D. Cal.), Mattel, Inc., Toy Lead Paint Prods. 25 Liab. Litig., No. 07-ML-01897 (S.D. Cal.), Pecover, et al. v. Electronic Arts Inc., No. 08-cv-02820 26 (N.D. Cal.), New Motor Vehicles Canadian Export Antitrust Litig., No. MDL 03‐1532 (D. Me.), 27 and SRAM Antitrust Litig., No. 07-MD-01819 (N.D. Cal.). A more comprehensive list of notable 28 DECLARATION OF ALAN VASQUEZ - 1 -

Case 3:15-cv-03747-JD Document 370-2 Filed 05/11/18 Page 4 of 40

1 matters for which I have been personally responsible for the notice planning and implementation 2 services is attached as Exhibit 1. I have also spoken as faculty on various CLE panels related to 3 class action notice and related trends.

4 4. I submit this declaration at the request of Class Counsel in order to describe the 5 proposed Notice Plan and notice services in the above-captioned litigation. I have personal 6 knowledge of the matters set forth in this declaration and, if called as a witness, could and would 7 testify competently thereto.

8 LITIGATION BACKGROUND

9 5. Plaintiffs allege that Facebook violated an Illinois statute known as the “the Illinois FILED DATE: 6/24/2019 9:23 PM 2018CH03868 10 Biometric Information Privacy Act” (“BIPA”), by collecting and storing Illinois Facebook users’ 11 biometric data, through its “Tag Suggestions” feature, without prior notice or consent. More 12 specifically, it is alleged that Facebook, through its Tag Suggestions technology, automatically 13 extracted biometric identifiers from their users’ uploaded photographs and previously tagged 14 pictures, and stored these biometric identifiers in a database without the consent of the users. The 15 database was used for a Facebook tool that lets people tag friends by name on the social network 16 and is commonly known as the “Tag Suggestions” feature. The feature was rolled out in 2011. 17 Facebook denies these allegations.

18 CLASS DEFINITION

19 6. The Court certified a class defined as “All Facebook users located in Illinois for 20 whom Facebook created and stored a face template after June 7, 2011.”

21 OBJECTIVE

22 7. The objective of the proposed Notice Plan is to provide the best notice practicable to 23 the defined Class, consistent with the requirements set forth in Rule 23 of the Federal Rules of 24 Civil Procedure and all applicable state laws and Court rules. The methods and tools used in 25 developing this Notice Plan have been employed in many other court-approved notice programs.

26 CLASS SIZE

27 8. Based on information provided by counsel and Gilardi’s research using national 28 DECLARATION OF ALAN VASQUEZ - 2 -

Case 3:15-cv-03747-JD Document 370-2 Filed 05/11/18 Page 5 of 40

1 consumer survey data, up to 7 million current and former Illinois residents may be part of the 2 defined Class.

3 NOTICE PLAN

4 9. Direct Notice. Whenever practicable, direct notice is the preferred form of notice to 5 class members. In January 2018, the Rule 23 Subcommittee of the Advisory Committee on Rules 6 of Civil Procedure updated Rule 23(c)(2) to recognize contemporary means of providing notice to 7 individual class members in Rule 23(b)(3) class actions. The updates suggest a court should not 8 hesitate to find that the best notice practicable include dissemination by email, social media 9 accounts, text or instant messaging, in the appropriate circumstances.1 FILED DATE: 6/24/2019 9:23 PM 2018CH03868 10 10. In most notice programs for class action matters, the most preferable form of direct 11 notice is the form that has been used by the defendant to communicate with customers during the 12 business relationship. In this case, the defendant manages the most popular social media platform 13 in the world with a core feature of that platform being the ability to facilitate communication 14 between individuals, businesses, and other organizations or causes.

15 11. While Facebook has not traditionally been a fundamental means to disseminate 16 direct notice, it is often used as supplemental notice in other actions and has been accepted in at 17 least one case as direct notice.2 Given that the Class is defined by usage of a Facebook service and 18 Facebook has the ability to identify the Class Members, it is more than reasonable to assume the 19 most effective approach to providing direct notice would be to utilize Facebook itself. Gilardi 20 believes that Facebook has multiple vehicles for communicating to users and can provide direct

21 1 “Thus, if the subcommittee’s proposal is adopted, a court should not hesitate to find—in the appropriate circumstances—that the best individual notice practicable under the circumstances can and should be sent via email, 22 social media accounts, or text or instant messaging (or a combination of some or all of these methods). Think about the cost of sending an email compared with the cost of mailing a letter, multiplied by the thousands (or millions): For a 23 class of any significant size, the cost savings to the litigants will be substantial. Also, perhaps counterintuitively, the likelihood of class members actually reading and reacting to the notice may be higher if it is sent by one or more 24 electronic methods rather than by “snail mail”—for better or worse, many of us now prioritize messages we get in a virtual inbox or on our phones over those waiting for us in our mailboxes at home.” 25 http://apps.americanbar.org/litigation/committees/classactions/articles/winter2016-0216-class-notice-revising-rule-23- for-the-internet-age html 26 2 Law360, New York (April 13, 2015, 3:53 PM ET) A New York federal judge on Friday approved a plan by 27 former Gawker Media LLC interns to use social media to notify potential class members of their opt-in rights in an unpaid wages collective action http://www.law360.com/articles/642415/gawker-interns-can-notify-class-of-lawsuit- 28 via-social-media DECLARATION OF ALAN VASQUEZ - 3 -

Case 3:15-cv-03747-JD Document 370-2 Filed 05/11/18 Page 6 of 40

1 notice to the vast majority of the Class with multiple frequency (i.e., user exposed multiple times to 2 the notice content) and in a cost effective manner. In addition, because an email address is 3 required for a Facebook account, Facebook also has the ability to provide a notice directly to those 4 email accounts in order to disseminate notice outside of the Facebook platform.

5 12. Gilardi believes the foundation of the Notice Plan should be to disseminate the 6 summary Notice directly via the following channels:

7 i. Email, 8 ii. Facebook Newsfeed post3, and 9 iii. Facebook Messenger inboxes. FILED DATE: 6/24/2019 9:23 PM 2018CH03868 10 13. Supplemental Notice. Direct notice using the Facebook channels described above 11 will form the foundation of the Notice Plan and provided direct notice to nearly all Class Members. 12 To supplement the direct notice efforts and potentially reach individuals who no longer have 13 Facebook accounts or who have moved outside of Illinois, Gilardi suggests implementing 14 additional online advertising to provide alternative channels for Class Members to be directed to 15 the case website. Specifically, Gilardi suggests the following options:

16 i. Press release optimized for online distribution, 17 ii. Twitter Promoted Tweet Advertising, and 18 iii. Staff outreach through Twitter and Facebook. 19 NOTICE CONTENT

20 14. Gilardi believes that both the full Notice and Summary Notice are drafted in the 21 “plain language” format preferred by federal courts and provide the information required by Rule 22 23. Both formats ensure compliance with the guidelines outlined on the Federal Judicial Center’s 23 Class Action Notice page at www.fjc.com. Gilardi believes that the full Notice and the Summary 24 Notice are understandable for members of the settlement Class and comply with due process. A 25 copy of the long-form Notice is attached as Exhibit 2. A copy of the short-form Notice is attached 26 as Exhibit 3. 27

3 28 Facebook utilized Newsfeed to provide information to users regarding Cambridge Analytica. DECLARATION OF ALAN VASQUEZ - 4 -

Case 3:15-cv-03747-JD Document 370-2 Filed 05/11/18 Page 7 of 40

1 NOTICE PLAN DETAIL

2 15. Facebook Newsfeed. It is important to note that in January of 2018, Facebook 3 announced that it would be changing its Newsfeed algorithm to prioritize posts from friends and 4 family over public content, meaning fewer advertisements and sponsored stories. Because of 5 recent public trust issues and content policing concerns, Facebook is now highly focused on 6 reassuring the public and delivering a better user experience. Gilardi believes these recent changes 7 and new focus create an opportunity for Facebook to build user trust by providing direct notice on 8 the social media platform itself.

9 16. Based on information provided by counsel, Gilardi understands that Facebook will FILED DATE: 6/24/2019 9:23 PM 2018CH03868 10 pin the Notice message to the top position in the Class Members’ Newsfeed to ensure it stays 11 visible whenever the user logs into Facebook to view their page. Given that the Newsfeed 12 placement will be pinned to the top of the feed, it is more likely that users will see the posted 13 Notice content and have an opportunity to click and review the details of the litigation by visiting 14 the case website. Examples of Facebook’s Newsfeed post regarding the Cambridge Analytica 15 issue as it would be viewed on a mobile device or desktop is attached as Exhibit 4.

16 17. Facebook Messenger Inbox. Facebook user pages actually have two inboxes. 17 Facebook Messenger brings messages from friends to the front of your inbox while a second inbox 18 for messages from users who are not Facebook friends is somewhat hidden. Gilardi suggests 19 providing content from the short-form Notice with a link to the case website, to the inbox of all 20 known Class Members. An example of the Messenger inbox is attached as Exhibit 5.

21 18. Email. Direct notice via email is one of the most effective means to provide class 22 action notice in cases where the defined class members are known to be internet users. In this 23 matter, Gilardi believes the most secure and effective means to provide email Notice would be for 24 Facebook to handle dissemination. This avoids the transfer of email records to a third party while 25 also having the emails go out from a known domain (Facebook), increasing the likelihood of 26 deliverability.

27 19. As an alternative, Gilardi could also handle email dissemination. After secure 28 DECLARATION OF ALAN VASQUEZ - 5 -

Case 3:15-cv-03747-JD Document 370-2 Filed 05/11/18 Page 8 of 40

1 transfer of the records provided, Gilardi would de-duplicate the list and perform deliverability and 2 spam trap analysis on the addresses. After emails are determined to be deliverable, Gilardi would 3 execute an email blast to each address included on the list.

4 20. An example of the email Notice content is attached as Exhibit 6.

5 21. Press Release. Gilardi will release a party-neutral press release about the case 6 through either PR Newswire or Businesswire.

7 22. A press release is still one of the most cost effective ways to supplement notice 8 efforts and provide an opportunity for media outlets to pick up the story and post it both to print 9 publications as well as websites. Gilardi will disseminate the release with digital optimization to FILED DATE: 6/24/2019 9:23 PM 2018CH03868 10 not only reach newspapers, wire services, television and radio, business journals, select national 11 media, individual reporters, and select trade media from a variety of industries, but also full-text 12 Internet posting to information and news sites, portals, search engines, content syndicates, wireless 13 providers, and research databases. A sample of the short-form Notice formatted as a press release 14 is attached as Exhibit 7.

15 23. Twitter Promoted Tweets. Gilardi maintains a database of social media accounts 16 and is in the process of collecting a list of handles related to online privacy issues that we believe 17 would be appropriate for targeting potential Class Members in data security related matters.

18 24. Promoted tweets are ordinary tweets purchased by advertisers who want to reach a 19 specific group of users or to spark engagement and drive traffic to a website. Twitter’s promoted 20 tweet platform allows for usage of collected handles for targeting purposes. By inputting the 21 collected handles into the targeting for a paid tweet campaign, tweets will not only reach followers 22 of those accounts, but also reach others with similar interests to followers of those accounts. In 23 addition, this targeting can be limited to Illinois.

24 25. Gilardi’s experience has been that this is not only a cost effective approach to reach 25 likely Class Members, but also very effective at driving appropriate traffic to the litigation website. 26 In promoted tweet programs Gilardi has implemented for other matters, we typically see 5-10% of 27 individuals exposed to the tweet, clicking through to the case website. Samples of promoted tweets 28 DECLARATION OF ALAN VASQUEZ - 6 -

Case 3:15-cv-03747-JD Document 370-2 Filed 05/11/18 Page 9 of 40

1 implemented for other matters are attached as Exhibit 8. The format and content would be similar 2 for this matter.

3 26. Staff Outreach. In addition to the supplemental efforts described above, Gilardi 4 staff would employ Social Media Monitoring (“SMM”) to identify individuals on Twitter or 5 Facebook who might be discussing the case. Our staff uses software that allows for tracking of 6 keywords and handles across multiple social media platforms. The messages are aggregated onto a 7 screen in “stream” format where Gilardi can either interact directly with the individual or use that 8 individual’s handle for targeting other users with similar interests, providing them with a link to the 9 case website where they can view their due process rights in the litigation. In addition, the FILED DATE: 6/24/2019 9:23 PM 2018CH03868 10 platform also allows for Gilardi to schedule staff generated tweets to go out at regular intervals 11 daily. These tweets would utilize hashtags related to online privacy and would include a link to the 12 case website. A visual example of the SMM stream setup and tweet scheduling is attached as 13 Exhibit 9.

14 27. Earned Media. Because of the current media spotlight on issues related both to 15 privacy generally and Facebook specifically, we would expect earned media coverage of the matter 16 to be significant. In fact, within a few days of the announcement of Class certification, numerous 17 websites and blogs picked up the story of the lawsuit. A quick Google search of any terms related 18 to the case returns pages of results dedicated to this lawsuit specifically. An example of these 19 search results is attached as Exhibit 10.

20 28. In Gilardi’s experience, the earned media often fades at the time the administrator 21 begins to implement notice. Search results at the time of implementation bring up articles that 22 were written prior to preliminary approval and rarely do the outlets follow up on their articles to 23 provide a link to the case website. Gilardi believes the suggested supplemental Notice efforts will 24 not only help to keep the case active in media articles, but also help keep the website link ranked 25 high in search results using terms related to the case.

26 29. Case Website. Gilardi will establish a case-dedicated website, which will be a 27 source of reliable and accurate information for the Class Members, the media, and the general 28 DECLARATION OF ALAN VASQUEZ - 7 -

Case 3:15-cv-03747-JD Document 370-2 Filed 05/11/18 Page 10 of 40

1 public. The site will include all relevant Court documents, the full-length Notice content in a 2 downloadable PDF format, and other features as directed by the parties. In addition, a dedicated 3 case postal address and toll-free phone number will be made available should a Class Member 4 want to use those avenues for communication.

5 30. The website will be the primary source of information about the case while also 6 serving as an important means of measuring audience engagement with the campaign. Both the 7 direct notice and paid media will direct individuals to the case website. Codes placed on the case 8 website allows Gilardi to measure the amount of traffic, how long people are staying on the site 9 and what actions they are taking to be directed to the site. Gilardi staff will use the report data to FILED DATE: 6/24/2019 9:23 PM 2018CH03868 10 optimize the online advertising vehicles during the supplemental Notice campaign, to ensure that 11 ad units driving the most traffic are leveraged to the fullest.

12 CONCLUSION

13 31. It is Gilardi’s opinion that the Notice Plan set forth herein more than comports with 14 the requirements of due process and of Fed. R. Civ. P. 23. The Notice Plan provides for a robust 15 direct Notice program that specifically leverages the notice vehicles included in the Rule 23 16 Advisory Committee’s recent updates, supplemented by an array of effective, cost efficient and 17 well-recognized indirect notice vehicles.

18 32. Many courts have held that notice plans estimated to reach a minimum of 70% of 19 the class are adequate and sufficient and thus comply with Fed. R. Civ. P. 23. With Facebook 20 providing direct Notice through the multiple channels, the Notice Plan would exceed the standard 21 for reach through direct Notice while allowing for Class Members to view the Notice multiple 22 times from a trusted source. The additional supplemental Notice efforts would provide former 23 Facebook users outside the state with an opportunity to be directed to the case website and in 24 Gilardi’s opinion, would result in the best Notice practicable for a case of this type. A summary of 25 the suggested Notice Plan is attached as Exhibit 11. 26 I declare under penalty of perjury under the laws of the United States of America that the 27 foregoing is true and correct. 28 DECLARATION OF ALAN VASQUEZ - 8 -

Case 3:15-cv-03747-JD Document 370-2 Filed 05/11/18 Page 11 of 40

1 Executed on this 11th day of May, 2018, at San Rafael, California. 2 3

4 ALAN VASQUEZ

5 6 7 8 9 FILED DATE: 6/24/2019 9:23 PM 2018CH03868 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 DECLARATION OF ALAN VASQUEZ - 9 -

FILED DATE: 6/24/2019 9:23 PM 2018CH03868 Exhibit 6 FILED DATE: 6/24/2019 9:23 PM 2018CH03868