Digital media law update: News has just broken about a suit filed by five individuals against Facebook for alleged privacy violations. While the ink has barely dried on the court filings, in my view, the plaintiffs face significant legal hurdles to recovery of significant damages. Here is an initial analysis of the claims in the complaint — Melkonian, et al., v. Facebook, Inc., et al., Superior Court of the State of California, County of Orange, Case No. 30-2009-00293755:
The plaintiffs and their allegations
This is not a class action, but a joint suit by a rather mixed bag of plaintiffs:
• The lead plaintiff, Melkonian, is a photographer who claims that images she took have been posted on Facebook without her consent.
• Two plaintiffs are minors under age 13 who created Facebook accounts without their parents’ consent and uploaded personal information and photographs onto the site.
• The fourth plaintiff is a college student who joined the original form of Facebook, “Thefacebook,” in May 2005 and uploaded personal information when the site operated under an allegedly more privacy-protective set of terms and conditions.
• The fifth plaintiff is an actress who claims that digital images of her have been uploaded onto the site without her consent.
Much of the 41-page complaint is devoted to a history of Facebook’s changing policies on user privacy, its interactions with groups such as “People Against the New Terms of Service,” discussions about public attitudes toward privacy, and various private and public investigations into Facebook’s privacy practices. The primary factual allegations in the complaint are:
(1) Facebook data mines personal information posted on its site and exploits this by providing it to advertisers who use it to target ads to users;
(2) Facebook’s posted privacy policies are incomplete, misleading and unfair. For example, on February 4, 2009, Facebook unilaterally changed its terms of service to include, inter alia, a grant by users of “an irrevocable, perpetual, non-exclusive, transferable, fully paid, worldwide license to use, copy, publish, stream, store, retain, publicly perform or display, transmit, scan, reformat, edit, frame, translate, excerpt, adapt, create derivative works and distribute User Content . . . and to use your name or likeness and image for any purpose, including commercial or advertising . . .” According to the Complaint, this is an outrageous extension of Facebook’s rights over its user’s data;
(3) Facebook fails to adequately warn users about the dangers of posting sensitive personal information online;
(5) Facebook has no technical safeguards to prevent misappropriation of user data by third-party developers who have access to the site;
(6) Facebook fails to provide users with a simple and permanent means to delete their accounts and personal data;
(7) Facebook’s uses “social ads” — customized advertisements that use private data, such as a user’s name and photo — to advertise products and services to the user’s “friends” and others users within that person’s network;
(8) Facebook uses tracking technology called “Beacon” that allows third parties to gather information about user’s purchase activities and then create social ads regarding such purchases;
(9) Facebook lacks adequate safeguards to prevent registration or use by children under age 13.
Analysis of the causes of action
The claims of the lead plaintiff, Melkonian, appear to be claims for copyright infringement. As such, some or all of her claims here could be preempted by the Copyright Act. Putting this issue aside, the remaining four plaintiffs’ claims are based on allegations that their names, personal information and/or photos were used commercially without their consent.
So do these claims have any legs?
Causes of action 1 & 2: misappropriation of name and likeness
To make out a valid claim of common law misappropriation of name or likeness, a plaintiff must show that (1) the defendant used his/her name or likeness; (2) the use was to the defendant’s advantage, commercially or otherwise; (3) lack of consent; and (4) resulting injury. Eastwood v. Superior Ct. (1983) 149 Cal.App.3d 409, 417. To make out a valid claim under the California privacy statutes, a plaintiff must prove the same elements, however the defendant must have used the plaintiff’s name directly in connection with the advertising or sale of goods. California Civil Code § 3344.
Facebook might also argue that its use of the plaintiffs’ names and likenesses did not constitute “publicity” and hence is not actionable as a violation of the plaintiffs’ rights to privacy. It is a basic principle of California law that the right of privacy is only violated by “publicity” — a communication to the public in general, or to a large number of people, as opposed from communication to an individual or a few persons. See Schwartz v. Theile (1966) 242 Cal.App.2d 799, 805; 5 Witkin, Summary of California Law, 10th ed., Torts, § 654 (2005). The typical misappropriation of name or likeness case involves public advertising in which the name or the picture of the plaintiff is used to tout the product. Use of a plaintiffs’ name or likeness in data mining, or even social advertising, may not expose it to a large enough number of people to be considered publicity.
Facebook might also consider arguing that the common interest privilege applies to its practices because the data mining information and social ads were only distributed to a small number of interested parties.
Even if plaintiffs are successful in these claims, the complaint does not plead much of a case for a large damage award. There are no claims of monetary losses, and a jury may wonder how much emotional damage could be caused by plaintiffs’ knowledge of Facebook’s data mining practices, or the use of plaintiffs’ pictures in a social ad. While minimum damages are also available, the statutory amount is rather low — $750. On the other hand, an injunction prohibiting data mining or social ads could create significant lost revenue for Facebook.
Cause of action 3: breach of the California unfair competition law
The third cause of action, for breach of California’s unfair competition law (Business & Professions Code § 17200 et seq.), is based on plaintiffs’ misappropriation of name and likeness allegations in the 1st and 2nd causes of action, and the statutory violations stated in the 4th-6th causes of action. As such, it will stand or fall based on the result of the litigation of those claims.
Cause of action 4: violation of the California constitutional right to privacy
The fourth cause of action, for violation of California’s constitutional right to privacy, is a cognizable claim. However, to succeed, a plaintiff must show: (1) a legally protected privacy interest, such as an interest in precluding the dissemination of sensitive or confidential information, (2) a reasonable expectation of privacy, and (3) invasions of privacy that are sufficiently serious to constitute an egregious violation of the social norms underlying privacy rights. See Hill v. National Collegiate Athletic Assn. (1994) 7 Cal. 4th 1.
Plaintiffs may face a tougher time in meeting these high standards. Facebook could argue that the plaintiffs had no expectation of privacy regarding information provided to their “friends,” because the plaintiffs consented to have these persons to join their network and to obtain sensitive personal information about them. On the other hand, the plaintiffs would likely respond that they never consented to have information about their purchasing habits divulged to members of their network. However, Facebook could respond that even if this is true, providing social ads that disclose a user’s purchase habits is simply not an egregious violation of privacy rights, especially considering the level of personal disclosure that is often present on Facebook.
Cause of action 5: violation of the California Online Privacy Act
However, remedies under the California unfair competition law are primarily limited to restitution and injunctive relief. Unless the plaintiffs actually paid money to Facebook, they would be unlikely to recover any money for breaches of the Act. I would expect Facebook to defend against this claim by attempting to show that it complied with the Act.
Cause of action 6: violation of the California Consumer Legal Remedies Act
However, as we have previously blogged, California courts have upheld clauses permitting unilateral alterations in a contract — under limited circumstances. See our blog posts of March 31 and April 22, 2009. Facebook may argue that such circumstances apply here, making any change in its change in policies not unfair.
This is an important suit that could prove to be a significant test of data mining and social advertising. While the plaintiffs’ potential damage awards do not appear to be high, the suit does have the potential to cause expensive damage to Facebook’s business, if it is required to scale back its data mining and advertising.