Meta Platforms, Inc. v. BrandTotal Ltd.

Background

Facebook sued BrandTotal Ltd. and Unimania, Inc. over browser extensions called UpVoice and Ads Feed. Facebook alleged that the extensions used users’ browsers to send automated commands to Facebook and Instagram, collect public and nonpublic information, and transmit the data to BrandTotal. Facebook asserted claims including breach of contract, unauthorized access under the federal Computer Fraud and Abuse Act, violation of California Penal Code section 502, interference with contracts, unjust enrichment, and unfair competition.

BrandTotal described itself as an advertising consulting company that analyzed social-media advertising for clients. It alleged that users deliberately opted into the UpVoice program in exchange for gift cards and consented to the collection of information about advertisements and certain user data. BrandTotal said it anonymized and aggregated the information before providing it to clients. Its counterclaims alleged that Facebook interfered with BrandTotal’s contracts and prospective business relationships, violated California’s Unfair Competition Law, and should be barred from claiming that BrandTotal breached Facebook’s terms of service.

Facebook disabled BrandTotal’s accounts and took technological steps to block access. Google removed the UpVoice extension from its Chrome Web Store. BrandTotal requested a temporary restraining order, an emergency form of injunctive relief, requiring Facebook to withdraw its request that Google remove UpVoice, stop blocking the extension, and restore BrandTotal’s and its principals’ Facebook pages.

Legal standard

The court explained that the standard for a temporary restraining order is substantially the same as the standard for a preliminary injunction. BrandTotal had to show likely irreparable harm, meaning harm that could not adequately be repaired with money; a likelihood of success on the merits or serious questions about its claims; that the balance of hardships favored relief; and that the public interest supported an order. The court could consider serious questions instead of a strong likelihood of success only if the other requirements were also met.

Irreparable harm and hardship

The court found that BrandTotal had shown significant business disruption. It had lost access to most of the data it needed, a business partner had frozen its work, potential customers had suspended negotiations, and one customer had declined to renew its contract. The court concluded that the possible loss of prospective customers and goodwill was difficult to value and therefore qualified as irreparable harm for purposes of the motion.

The court did not find that BrandTotal had shown an imminent threat that the business would cease operating. BrandTotal had not provided a specific shutdown timeline, and its evidence suggested that it had enough funding to continue operating for perhaps up to a year, although possibly less. The court also declined to treat possible layoffs alone as sufficient proof of irreparable harm.

The balance of hardships favored BrandTotal. The court found that BrandTotal could not operate normally without access to Facebook’s products and faced lost customers, difficulty attracting investment, and a possible eventual shutdown. Facebook also had serious interests in protecting user privacy, maintaining public confidence, and avoiding potential liability, but the court concluded that, considering only the parties’ interests, BrandTotal faced greater consequences from denial of emergency relief.

Likelihood of success

The court focused on BrandTotal’s counterclaims because those claims would support the affirmative relief BrandTotal sought.

For intentional interference with contract, the court found that BrandTotal was likely able to show that Facebook knew BrandTotal sold services dependent on data collected from Facebook’s products and that Facebook’s blocking of access disrupted BrandTotal’s ability to perform its customer contracts. BrandTotal nevertheless showed only serious questions, not a likelihood of success, because Facebook had a potentially legitimate business purpose for blocking access.

That defense required balancing Facebook’s interests against the importance of BrandTotal’s contractual relationships and other social interests. The court recognized concerns that Facebook might be restricting a potential competitor in the advertising-analytics market, similar to concerns discussed by the Ninth Circuit in the case involving automated collection of publicly available LinkedIn profiles. But this case also involved password-protected portions of Facebook’s networks, privacy settings, nonpublic information, and an automated program that Facebook had not approved.

The court found that Facebook had a legitimate interest in protecting privacy and security, complying with an order from the Federal Trade Commission, avoiding possible liability for data breaches, and maintaining public confidence. Facebook’s evidence also indicated that UpVoice could collect information from other users who had not consented when they used a shared computer. The court concluded that BrandTotal had raised serious questions about Facebook’s intent and the possibility of competition-related motives, but had not shown a likelihood of success.

The court reached the same general conclusion for BrandTotal’s claim of interference with prospective economic advantage. That claim required an independently wrongful act, and BrandTotal showed no more than serious questions about whether Facebook’s conduct satisfied that requirement.

For BrandTotal’s unfair-competition claim, the court found serious questions but not a likelihood of success under the unlawful, unfair, or fraudulent theories. The court stated that Facebook’s enforcement efforts could be viewed as blocking a competitor, but Facebook also had substantial interests in enforcing its terms of service. The court rejected BrandTotal’s argument that Facebook’s conduct was clearly fraudulent merely because Facebook’s terms recognized users’ ownership of their data. Recognizing ownership did not necessarily prevent Facebook from restricting automated methods of extracting that data.

The court rejected BrandTotal’s argument that its access was not automated. After installation, UpVoice automatically collected and transmitted data, including information that the program itself requested from Facebook. The court held that BrandTotal had designed a computer program to systematically identify, capture, and transmit data without user intervention. Because BrandTotal used automated means without Facebook’s permission, it had not shown a likelihood of success or even serious questions on its request for a declaration that it had not breached Facebook’s terms of service. The court did not reach the parties’ arguments about the other contract terms.

Public interest

The court found that the public-interest factor controlled the motion. The public had competing interests in open access to information, competition, and innovation on one hand, and privacy, data security, and the ability of online platforms to police access on the other.

The court acknowledged that Facebook did not own the contents of advertisements displayed on its networks and that allowing competition in advertising analytics could promote the free flow of information. But the court was not persuaded that those interests prevented Facebook from reviewing and regulating third parties seeking to collect large amounts of user data automatically from nonpublic areas of its networks.

The court was particularly concerned that BrandTotal’s method operated outside Facebook’s platform and application programming interfaces. Users who consented through UpVoice would not see BrandTotal among the third parties listed in their Facebook privacy settings, and later changes to those settings would not necessarily limit the information shared with BrandTotal. The court also noted that Facebook was subject to a Federal Trade Commission order requiring it to enforce its terms of use and monitor third-party access to user information.

The court concluded that emergency judicial proceedings were not an efficient way to evaluate the technical privacy risks of an unapproved data-collection program. It stated that requiring companies seeking access to coordinate with Facebook and address concerns before receiving access would create a fuller record for any later judicial review.

Disposition

The court held that BrandTotal had shown a risk of irreparable harm, serious questions about some of its claims, and a balance of hardships favoring it. Nevertheless, the public interest weighed against the requested relief. The court therefore denied BrandTotal’s motion for a temporary restraining order. The court also separately denied BrandTotal’s request to require Facebook to restore BrandTotal’s and its principals’ Facebook pages.