Melkonian v. Facebook: New Privacy Suit against Facebook Faces Challenges

ct-facebook-lawsuit-20160510Digital media law update: News has just broken about a suit filed by five individuals against Facebook for alleged privacy violations. While the ink has barely dried on the court filings, in my view, the plaintiffs face significant legal hurdles to recovery of significant damages. Here is an initial analysis of the claims in the complaint — Melkonian, et al., v. Facebook, Inc., et al., Superior Court of the State of California, County of Orange, Case No. 30-2009-00293755:

The plaintiffs and their allegations

This is not a class action, but a joint suit by a rather mixed bag of plaintiffs:

• The lead plaintiff, Melkonian, is a photographer who claims that images she took have been posted on Facebook without her consent.
• Two plaintiffs are minors under age 13 who created Facebook accounts without their parents’ consent and uploaded personal information and photographs onto the site.
• The fourth plaintiff is a college student who joined the original form of Facebook, “Thefacebook,” in 03germanfacebook2-master768May 2005 and uploaded personal information when the site operated under an allegedly more privacy-protective set of terms and conditions.
• The fifth plaintiff is an actress who claims that digital images of her have been uploaded onto the site without her consent.

Much of the 41-page complaint is devoted to a history of Facebook’s changing policies on user privacy, its interactions with groups such as “People Against the New Terms of Service,” discussions about public attitudes toward privacy, and various private and public investigations into Facebook’s privacy practices. The primary factual allegations in the complaint are:

(1) Facebook data mines personal information posted on its site and exploits this by providing it to facebook-marketplaceadvertisers who use it to target ads to users;

(2) Facebook’s posted privacy policies are incomplete, misleading and unfair. For example, on February 4, 2009, Facebook unilaterally changed its terms of service to include, inter alia, a grant by users of “an irrevocable, perpetual, non-exclusive, transferable, fully paid, worldwide license to use, copy, publish, stream, store, retain, publicly perform or display, transmit, scan, reformat, edit, frame, translate, excerpt, adapt, create derivative works and distribute User Content . . . and to use your name or likeness and image for any purpose, including commercial or advertising . . .” According to the Complaint, this is an outrageous extension of Facebook’s rights over its user’s data;

(3) Facebook fails to adequately warn users about the dangers of posting sensitive personal information online;

(4) Facebook fails to prominently disclose its privacy policies and terms of use at sign-up and employs confusing and ineffective privacy protection tools;

(5) Facebook has no technical safeguards to prevent misappropriation of user data by third-party developers who have access to the site;

(6) Facebook fails to provide users with a simple and permanent means to delete their accounts and personal data;

(7) Facebook’s uses “social ads” — customized advertisements that use private data, such as a user’s name and photo — to advertise products and services to the user’s “friends” and others users within that person’s network;

(8) Facebook uses tracking technology called “Beacon” that allows third parties to gather information about user’s purchase activities and then create social ads regarding such purchases;

(9) Facebook lacks adequate safeguards to prevent registration or use by children under age 13.

Analysis of the causes of action

_76780127_76780126Based on these wide-ranging allegations, the complaint states six separate causes of action against Facebook, including: (i) and (ii) statutory and common law misappropriation of the right of publicity for its use of the plaintiffs’ names and photographs without consent for advertising purposes; (iii) violation of the California unfair competition law for its data mining practices and dissemination of the plaintiffs’ personal information, (iv) violation of the California Constitutional Right to Privacy for its commercialization of plaintiffs’ personal information; (v) violation of the California Online Privacy Act for failing to “conspicuously post and comply” with the privacy policies required under the Act, and (vi) violation of the California Consumer Legal Remedies Act for unconscionably changing its Terms of Use and privacy policies without notice, and representing that user information would remain private, but then providing it to third party advertisers.

_76780123_1d5251c2-a507-449a-a910-a79f7448e2e2The claims of the lead plaintiff, Melkonian, appear to be claims for copyright infringement. As such, some or all of her claims here could be preempted by the Copyright Act. Putting this issue aside, the remaining four plaintiffs’ claims are based on allegations that their names, personal information and/or photos were used commercially without their consent.

So do these claims have any legs?

Causes of action 1 & 2: misappropriation of name and likeness

To make out a valid claim of common law misappropriation of name or likeness, a plaintiff must show that (1) the defendant used his/her name or likeness; (2) the use was to the defendant’s advantage, commercially or otherwise; (3) lack of consent; and (4) resulting injury. Eastwood v. Superior Ct. (1983) 149 Cal.App.3d 409, 417. To make out a valid claim under the California privacy statutes, a plaintiff must prove the same elements, however the defendant must have used the plaintiff’s name directly in connection with the advertising or sale of goods. California Civil Code § 3344.

facebook-ceo-mark-zuckerberg-san-francisco-april-12-2016Here, the plaintiffs appear to adequately plead that their names and likenesses were used by Facebook to its advantage, and specifically in advertising — via data mining and social ads. Plaintiffs also appear to adequately plead that this use was without their consent — although Facebook will surely argue that the plaintiffs consented by agreeing to submit to its Terms of Use. While none of the privacy plaintiffs appear to claim that they suffered economic damages, economic damages are not required to make out a privacy cause of action. Under California law, emotional damages are sufficient. See Abdul-Jabbar v. General Motors Corp., 85 F.3d 407 (9th Cir. 1996).

In defense, Facebook will doubtless claim that the plaintiffs consented to its use of their personal data by agreeing to its Terms of Use when they signed up on the site. While Facebook changed its Terms of Use over time, this does not necessarily mean that new terms are invalid. (See our blog post of March 31, 2009). Facebook may have more difficulty in showing that the minor plaintiffs gave consent to the use of their personal data, but the resolution of that issue awaits further discovery.

Facebook might also argue that its use of the plaintiffs’ names and likenesses did not constitute “publicity” and hence is not actionable as a violation of the plaintiffs’ rights to privacy. It is a basic principle of California law that the right of privacy is only violated by “publicity” — a communication to the public in general, or to a large number of people, as opposed from communication to an individual or a few persons. See Schwartz v. Theile (1966) 242 Cal.App.2d 799, 805; 5 Witkin, Summary of California Law, 10th ed., Torts, § 654 (2005). The typical misappropriation of name or likeness case involves public advertising in which the name or the picture of the plaintiff is used to tout the product. Use of a plaintiffs’ name or likeness in data mining, or even social advertising, may not expose it to a large enough number of people to be considered publicity.

Privacy setting shortcuts are displayed on Apple Inc. iPhone 6 smartphone screen as a FaceBook Inc. logo is seen in this arranged photograph taken in London, U.K., on Friday, May, 15, 2015. Facebook reached a deal with New York Times Co. and eight other media outlets to post stories directly to the social network's mobile news feeds, as publishers strive for new ways to expand their reach. Photographer: Chris Ratcliffe/Bloomberg via Getty Images

Facebook might also consider arguing that the common interest privilege applies to its practices because the data mining information and social ads were only distributed to a small number of interested parties.

Even if plaintiffs are successful in these claims, the complaint does not plead much of a case for a large damage award. There are no claims of monetary losses, and a jury may wonder how much emotional damage could be caused by plaintiffs’ knowledge of Facebook’s data mining practices, or the use of plaintiffs’ pictures in a social ad. While minimum damages are also available, the statutory amount is rather low — $750. On the other hand, an injunction prohibiting data mining or social ads could create significant lost revenue for Facebook.

Cause of action 3: breach of the California unfair competition law

The third cause of action, for breach of California’s unfair competition law (Business & Professions Code § 17200 et seq.), is based on plaintiffs’ misappropriation of name and likeness allegations in the 1st and 2nd causes of action, and the statutory violations stated in the 4th-6th causes of action. As such, it will stand or fall based on the result of the litigation of those claims.

Cause of action 4: violation of the California constitutional right to privacy

The fourth cause of action, for violation of California’s constitutional right to privacy, is a cognizable claim. However, to succeed, a plaintiff must show: (1) a legally protected privacy interest, such as an interest in precluding the dissemination of sensitive or confidential information, (2) a reasonable expectation of privacy, and (3) invasions of privacy that are sufficiently serious to constitute an egregious violation of the social norms underlying privacy rights. See Hill v. National Collegiate Athletic Assn. (1994) 7 Cal. 4th 1.

rtx1z0ssPlaintiffs may face a tougher time in meeting these high standards. Facebook could argue that the plaintiffs had no expectation of privacy regarding information provided to their “friends,” because the plaintiffs consented to have these persons to join their network and to obtain sensitive personal information about them. On the other hand, the plaintiffs would likely respond that they never consented to have information about their purchasing habits divulged to members of their network. However, Facebook could respond that even if this is true, providing social ads that disclose a user’s purchase habits is simply not an egregious violation of privacy rights, especially considering the level of personal disclosure that is often present on Facebook.

Cause of action 5: violation of the California Online Privacy Act

The fifth cause of action is for violation of the California Online Privacy Act. Business & Professions Code §§ 22575-79. The Act requires commercial web sites that collect personally identifying information (i.e., interactive web sites like Facebook) to create and “conspicuously post” a privacy policy. While the Act creates no public or private right of action, violations would be actionable under California’s unfair competition law.

However, remedies under the California unfair competition law are primarily limited to restitution and injunctive relief. Unless the plaintiffs actually paid money to Facebook, they would be unlikely to recover any money for breaches of the Act. I would expect Facebook to defend against this claim by attempting to show that it complied with the Act.

Cause of action 6: violation of the California Consumer Legal Remedies Act

The sixth cause of action, for violation of the California Consumer Legal Remedies Act (California Civil Code § 1750) is based on two theories: (i) that Facebook’s unilateral changes in its Terms of Use, Statement of Rights and Responsibilities and Privacy Policy were unconscionable, and (ii) that Facebook represented that user information would remain private, but then began data mining and sharing it with third parties.

However, as we have previously blogged, California courts have upheld clauses permitting unilateral alterations in a contract — under limited circumstances. See our blog posts of March 31 and April 22, 2009. Facebook may argue that such circumstances apply here, making any change in its change in policies not unfair.

This is an important suit that could prove to be a significant test of data mining and social advertising. While the plaintiffs’ potential damage awards do not appear to be high, the suit does have the potential to cause expensive damage to Facebook’s business, if it is required to scale back its data mining and advertising.

Civil enforcement, Copyright, Digital Millennium Copyright Act, Litigation