Heeger v. Facebook, Inc.

Background

These were related proposed class actions by Facebook users concerning Facebook’s collection and use of location information. The Heeger amended complaint alleged claims under the California Invasion of Privacy Act, California’s constitutional privacy provision, the common-law tort of intrusion upon seclusion, and unjust enrichment. The proposed class consisted of Facebook users who had turned off Facebook’s “Location History” feature, the “Location Services” setting, or both.

The Lundy amended complaint alleged California constitutional privacy, intrusion upon seclusion, intentional misrepresentation and omission, deceit by concealment or omission, breach of contract, breach of the implied covenant of good faith and fair dealing, negligent misrepresentation, and unjust enrichment. The Lundy plaintiffs limited their claims to the period before April 19, 2018. They alleged that Facebook used Internet Protocol addresses and enhanced location-determination methods to identify their locations, despite their settings and Facebook’s privacy policy.

Facebook moved to dismiss both amended complaints under Federal Rule of Civil Procedure 12(b)(1), which concerns the court’s jurisdiction, and Rule 12(b)(6), which concerns whether a complaint adequately states a legal claim.

Heeger case

The court granted Facebook’s motion to dismiss the Heeger amended complaint. The court had previously allowed amendment after finding that the original complaint established constitutional standing, but required more specific facts about the precision of the location information allegedly collected.

The amended complaint did not provide those facts. After removing allegations based mainly on reports about what Facebook might be capable of doing, the court found that the complaint alleged only that Facebook collected the plaintiffs’ Internet Protocol addresses while they used the Facebook application or website. The complaint also alleged that Brett Heeger had found 104 pages of Internet Protocol addresses showing locations where he accessed his Facebook account.

The court concluded that the plaintiffs had not plausibly alleged a privacy injury. It distinguished Internet Protocol addresses from the more persistent and precise cell-site location information discussed by the Supreme Court in Carpenter v. United States. The court said that Internet users generally know that Internet Protocol address information is provided to internet service providers to route information, and that the Heeger complaint did not allege enough precision or detail to establish a legally protected privacy interest in the information collected.

Because the plaintiffs did not plausibly allege a privacy injury, the court held that they lacked constitutional standing for their California privacy, intrusion-upon-seclusion, and California Invasion of Privacy Act claims. The court also held that they lacked standing for unjust enrichment because they did not allege that they retained a stake in profits Facebook obtained from collecting their Internet Protocol addresses. The Heeger amended complaint was dismissed in its entirety for lack of constitutional standing. The court allowed the plaintiffs to attempt another amendment and indicated that it would likely be their final opportunity to amend.

Lundy case

The court denied Facebook’s motion in part and granted it in part in Lundy. Unlike the Heeger complaint, the Lundy complaint alleged that Facebook’s records included latitude and longitude at specific dates and times, and that Facebook used enhanced methods to refine locations inferred from Internet Protocol addresses. The complaint gave an example in which Facebook’s records allegedly identified a location in Prescott, Arizona, even though publicly available Internet Protocol location services produced less precise and materially different locations.

The court held that these allegations went beyond the mere collection of Internet Protocol addresses. It found that the Lundy plaintiffs plausibly alleged privacy harm and therefore had standing to pursue their California constitutional privacy, intrusion-upon-seclusion, breach-of-contract, and implied-covenant claims. The plaintiffs also alleged that their location data had financial value and that Facebook bundled and monetized it for targeted advertising. The court found those allegations sufficient at the pleading stage to establish the economic injury required for the fraud claims and the financial stake required for unjust enrichment.

The court nevertheless dismissed the Lundy privacy claims, with leave to amend. For intrusion upon seclusion and California constitutional privacy, the court found that the alleged tracking generally placed a plaintiff only in a city and state and occurred while the plaintiffs were using the Facebook application. The court concluded that the complaint did not plausibly allege a reasonable expectation of privacy in that data. The court expressed doubts about whether the alleged invasion was serious enough but did not decide that issue.

The court also dismissed the Lundy fraud claims, with leave to amend. The complaint plausibly alleged that Facebook’s policy could mislead a typical user about whether Facebook collected device locations or Internet Protocol addresses without permission, and it plausibly alleged that Facebook did not disclose its enhanced location methods. But the court found the reliance allegations inadequate, including because the plaintiffs did not explain how their continued use of Facebook after discovering the alleged conduct did not defeat reliance.

The court dismissed the breach-of-contract and implied-covenant claims, with leave to amend, because the allegations concerning the existence of a contract, breach, and damages were too thin. The court also dismissed the unjust-enrichment claim, with leave to amend, because the plaintiffs did not clearly respond to Facebook’s challenges to that claim.

Disposition

Facebook’s motion to dismiss the Heeger amended complaint was granted. Facebook’s motion to dismiss the Lundy amended complaint was denied in part and granted in part. In both cases, the plaintiffs were granted leave to amend by January 21, 2021. The court ordered that no new claims or defendants could be added without express permission from the court.