Facebook User Privacy Lawsuits Over Cambridge Analytica Have Legs

There’s no shortage of claims Facebook Inc. violates users’ privacy for profit. Far less common are rulings from U.S. courts finding the company’s practices illegal.

A San Francisco federal judge was leaning in that direction Wednesday by indicating he won’t dismiss lawsuits brought on behalf of tens of millions of users who blame the company for allowing their private information mined from their friends’ accounts to be shared with a British political consultancy tied to Donald Trump’s 2016 presidential campaign.

U.S. District Judge Vince Chhabria is overseeing dozens of suits alleging users have no real control over their personal information, and that the company has repeatedly misled users to continue mining it.

The suits have a long way to go before users stand a chance of claiming billions of dollars in damages. Chhabria isn’t addressing the merits of the complaints, only deciding whether the allegations are legally sufficient to proceed. The next step will be for users to seek internal information from the company to back up their claims.

The suits stem from revelations last year that Cambridge Analytica, the consultancy, obtained data on as many as 87 million Facebook users without their knowledge. Facebook has said it expects the Federal Trade Commission to slap it with a fine of as much as $5 billion as part of a settlement over its privacy practices.

Users contend intrusions on their privacy have continued despite a 2011 agreement with the FTC barring the social network from extracting personal data without their knowledge. The lawsuits filed in San Francisco federal court identify one practice described as particularly deceptive: extracting information from users who adjusted their privacy settings to share information with “Friends Only” by collecting it from those friends.

“Cambridge Analytica’s abuse of user content and information was neither isolated nor unusual,” according to one of the suits before the judge. “Facebook allowed tens of thousands of third-party apps to download user content and information, and was willfully indifferent to monitoring them.”

Facebook deliberately stripped the privacy settings so app developers and as many as 150 business partners — from Apple to Warner Brothers — could use the rich data of videos, photos, comments and viewing history, according to the complaint. The information shared with Cambridge Analytica yielded so-called “psychographic” marketing, targeting voters, for example, with hyper-specific appeals based on users’ fears, feelings and values.

“Users were not aware, and to a large extent are still not aware, that if a friend interacts on a website with whom Facebook has an undisclosed business relationship, all of the content and information shared with that friend, even if shared with nonpublic settings between a few people, falls unrestricted into the hands of those companies,” according to the complaint.

Chhabria signaled he’ll let the case go forward based on users’ claim that Facebook illegally disclosed their private information. Facebook is mistakenly treating its users’ expectation of privacy as a “binary,” or all-or-nothing proposition, Chhabria told the company’s lawyers.

“If I don’t share a certain something with anybody, I have a full expectation of privacy,” Chhabria said. “If I share it with ten people it doesn’t eliminate my expectation of privacy. It may diminish it, but it doesn’t eliminate it.”

Just because Facebook is helping users share information with each other, Chhabria added, doesn’t mean they understand they’re also taking on the risk that the company “will then turn around and disseminate it to a thousand different corporations,” Chhabria said.

To beat back other user privacy suits Facebook has successfully relied on a two-prong attack. First, it argues users have consented to its use of their information. And even if they haven’t, the company says, users didn’t suffer any real harm -– a requirement for such cases to advance.

Facebook says its documents detailing how data is shared warn that third-party apps may access information not only from users but also from friends who download those apps — “if the user’s settings allowed for such re-sharing,” according to a court filing.

In the case of Cambridge Analytica, it was app developer Aleksandr Kogan, not the social network, who improperly shared user data with the consultants who were advising the Trump campaign, Facebook said in a court filing.

“Facebook does not guarantee that apps won’t be able to misuse user data in some way,” according to the filing. “Kogan violating his own agreement with Facebook does not make Facebook liable” to its users.

Suits over alleged misuse of personal data have often failed under an ambiguous 2016 U.S. Supreme Court ruling requiring consumers to suffer a “concrete injury.” Again, Facebook argues the users haven’t suffered any economic harm from the data sharing, or that they’ve been the victims of identity theft.

“What they’re really complaining about,” Facebook lawyer Orin Snyder told Chhabria at a previous hearing, “is that they don’t like the rules of the road on Facebook.”

“They have a lot of options for redress in that event,” Snyder added. “They can petition Facebook to change the rules. They can turn off Facebook and never use it. They can petition their Congress people to pass laws.”

The case is In Re Facebook Consumer Privacy User Profile Litigation, 18-MD-02843, U.S. District Court, Northern District of California (San Francisco).