Case 3:18-md-02843-VC Document 148 Filed 09/21/18 Page 1 of 267 Lesley E. Weaver (SBN 191305) Derek W. Loeser (admitted pro hac vice) BLEICHMAR FONTI & AULD LLP KELLER ROHRBACK L.L.P. 555 12th Street, Suite 1600 1201 Third Avenue, Suite 3200 Oakland, CA 94607 Seattle, WA 98101 Tel.: (415) 445-4003 Tel.: (206) 623-1900 Fax: (415) 445-4020 Fax: (206) 623-3384 [email protected] [email protected] Plaintiffs’ Co-Lead Counsel Additional counsel listed on signature page UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF CALIFORNIA IN RE: FACEBOOK, INC. CONSUMER MDL No. 2843 PRIVACY USER PROFILE LITIGATION Case No. 18-md-02843-VC This document relates to: CONSOLIDATED COMPLAINT ALL ACTIONS Judge: Hon. Vince Chhabria CONSOLIDATED COMPLAINT MDL NO. 2843 CASE NO. 18-MD-02843-VC Case 3:18-md-02843-VC Document 148 Filed 09/21/18 Page 2 of 267 TABLE OF CONTENTS I. INTRODUCTION --------------------------------------------------------------------------------- 1 II. JURISDICTION, VENUE, AND CHOICE OF LAW ---------------------------------------- 5 III. PARTIES ------------------------------------------------------------------------------------------- 6 A. Plaintiffs ----------------------------------------------------------------------------------- 6 B. Defendants and Co-Conspirators ------------------------------------------------------- 37 1. Prioritized Defendant and Doe Defendants: --------------------------------- 37 2. Non-Prioritized Defendants (Individual Defendants Named in Actions Consolidated in this MDL As to Whom Co-Lead Counsel Seek a Stay) ------------------------------------------------------------------------------ 38 C. Unnamed Co-Conspirators: Cambridge-Analytica-Related Entities --------------- 39 D. Other Non-Defendant Co-Conspirator ------------------------------------------------ 42 IV. FACTUAL BACKGROUND ------------------------------------------------------------------- 42 A. Facebook’s Transition from Social Media Company to Data Broker ------------------------------------------------------------------------------------- 42 B. Facebook Enables Apps, Websites, and Devices to Access Facebook Users’ Content and Information -------------------------------------------- 44 1. How Facebook Enabled Third Parties to Gather and Disseminate Users’ Content and Information -------------------------------- 44 2. Cambridge Analytica Used Facebook’s API to Take Users’ Content and Information Without Their Knowledge Or Consent --------------------------------------------------------------------------- 49 3. The Cambridge Analytica Scandal Has Triggered Seriatim Revelations by Facebook of Third Party Abuse of User Content and Information ------------------------------------------------------- 60 4. Facebook Also Enabled Device Makers and Other Business Partners to Access Users’ Content And Information Through Friends ----------------------------------------------------------------- 63 5. Facebook Disregarded Friends’ Privacy Settings When Transferring Data to Third Parties Through Graph API v. 1.0 --------------------------------------------------------------------------------- 65 CONSOLIDATED COMPLAINT i MDL NO. 2843 CASE NO. 18-MD-02843-VC Case 3:18-md-02843-VC Document 148 Filed 09/21/18 Page 3 of 267 C. Facebook Made It Unreasonably Confusing and Burdensome for Users to Prevent the Sharing of Their Content and Information with Third-party Applications. --------------------------------------------------------- 66 1. Facebook’s “Privacy Settings” Misled Users About How to Control the Information and Content That They Shared with Applications. --------------------------------------------------------------- 67 2. To Control Sharing with Applications, Facebook Required Users to Hunt for, Find, and Change the Default Preferences of Their App Settings -------------------------------------------- 71 3. Facebook Maintained the “Apps Others Use” Control Panel Until April 2018, Following the Cambridge Analytica Scandal --------------------------------------------------------------------------- 75 D. In the Documents That Purport to Govern the Relationship Between Facebook and Its Users, Facebook Made Promises About Privacy That It Broke, and Also Failed to Properly Disclose the Access to Users’ Content and Information That It Gave to Third Parties. ------------------------------------------------------------------------------------ 77 1. What the Statement of Rights and Responsibilities Promised ------------------------------------------------------------------------- 78 a. The Statement of Rights and Responsibilities Promised to Respect Users’ Privacy --------------------------------- 79 b. The Statement of Rights and Responsibilities Promised Users Throughout the Class Period That Facebook Would Not Share Content or Information With Advertisers Without Their Consent ---------------------------- 82 c. The Statement of Rights and Responsibilities Promised to Adequately Notify Users When It Was Amended ---------------------------------------------------------------- 84 2. The Statement of Rights and Responsibilities Did Not Incorporate or Make Binding Facebook’s Other Policies ------------------ 87 3. Facebook’s “Policies” Were Generally Difficult to Access, Confusing, and Constantly Changing Without Notice. --------------------- 89 a. To Access the Contents of the Privacy, the Data Use, and Data Policies, Users Were Forced to Navigate a Maze of Hyperlinks --------------------------------------- 89 CONSOLIDATED COMPLAINT ii MDL NO. 2843 CASE NO. 18-MD-02843-VC Case 3:18-md-02843-VC Document 148 Filed 09/21/18 Page 4 of 267 b. Users Often Were Not Required to Read the Contents of the Privacy, the Data Use, or Data Policies When They Signed Up--------------------------------------- 95 c. The Privacy, Data Use, and Data Policies Made It Difficult for Users to Understand How Facebook Made Their Content and Information Accessible to Third Parties ---------------------------------------------------------- 100 d. The Documents Were Constantly Changing ---------------------- 107 e. Facebook Failed to Adequately Notify Users of Changes to the Privacy Policy, Data Policy, and Data Use Policy ------------------------------------------------------ 110 E. The Cambridge Analytica Scandal and Subsequent Revelations of Facebook’s Agreements with Third Parties to Share User Content and Information with Third Parties Without Full Disclosure Show that Facebook Violated the 2012 Federal Trade Commission Consent Decree------------------------------------------------------------------------- 111 F. Even Prior to the Cambridge Analytica Scandal, Numerous Investigations Questioned Facebook’s Practices With Regard to User Privacy ---------------------------------------------------------------------------- 113 G. Despite Warnings, Facebook Failed to Take Reasonable Measures to Ensure That Third-Party Applications and Device Makers Would Not Access and Use Its Users’ Content and Information Without Their Consent. --------------------------------------------------------------- 115 1. Facebook Partnered With Kogan to Exploit Facebook User Data for Commercial Use ---------------------------------------------------- 115 2. Facebook Has Repeatedly Ignored Its Users’ Privacy Rights and Expectations ------------------------------------------------------ 116 3. Facebook’s Failure to Implement Reasonable Security Measures ----------------------------------------------------------------------- 119 4. Facebook’s Failure to Notify Plaintiffs and Class Members of the Misuse of Their Data Made Remedial Measures Impossible---------------------------------------------------------------------- 122 5. The Cambridge Analytica Scandal Has Triggered Additional Revelations About Misuse of User Data ---------------------- 123 H. Statements by Facebook’s CEO Give Rise to a Duty to Disclose and Admit to Injury From Lack of Disclosure -------------------------------------- 124 CONSOLIDATED COMPLAINT iii MDL NO. 2843 CASE NO. 18-MD-02843-VC Case 3:18-md-02843-VC Document 148 Filed 09/21/18 Page 5 of 267 I. Facebook’s Cultivation and Release of Its Users’ Data Were Part of a Lucrative Market for Big Data Where Users’ Content and Information is Valuable, Marketable Property ------------------------------------- 129 1. Facebook Has Generated Significant Revenue from Allowing Access to Its Users’ Content and Information ----------------- 129 2. Facebook Has Gained This Revenue by Acting as a Data Broker—and Partnering with Other Data Brokers ------------------------ 131 J. The Content and Information About Its Users That Facebook Has Shared With Third Parties Has Allowed Advertisers and Political Operatives to Harass and Discriminate Against Them ---------------------------- 133 1. Facebook Users Did Not Understand that Their Content and Information Would Be Used for Psychographic Marketing ---------------------------------------------------------------------- 133 2. The Features That Facebook Has Offered Advertisers Allow Extraordinarily Harmful and Invasive Forms of Psychographic Marketing ---------------------------------------------------- 135 3. The Aggregation of User Content Via Third Parties, Including Device Makers and App Developers, Has Greatly Accelerated the Potential for Data Abuse ---------------------------------- 142 V. PRIMA FACIE CASE OF INJURY AND DAMAGES ----------------------------------- 143 A. Plaintiffs Suffered Harm as a Direct Result of Facebook’s Conduct ------------ 143 VI. PLAINTIFFS COULD NOT HAVE DISCOVERED THEIR CLAIMS UNTIL 2018. ------------------------------------------------------------------------------------