5 ms·

"...defendants made false or misleading statements and failed to disclose that Facebook violated its own data privacy policies by allowing third parties access

"...defendants made false or misleading statements and failed to disclose that Facebook violated its own data privacy policies by allowing third parties access to personal data of millions of Facebook users without their consent..." The "without their consent" part is BS, as is this lawsuit. When you use Facebook platform apps, you have to consent to the disclosure of your information to the developer, and have to agree to allow whatever special permissions the developer is asking for. As for friend data that apps may have access to, when you sign up for and use Facebook, you agree to the terms and conditions, which allow this behavior. Investors had the opportunity to view both the developer platform policies and Facebook TOS long before they ever bought shares. If they didn't like the possible implications of them, they should not have invested. My guess is that this case will go nowhere.

hashkb 9y ago
This seems super obvious to me too. The more important question, from which this is a distraction, is: what was The Donald's role?
oldcynic 9y ago
Correct me where I'm wrong but did it not used to be the case that facebook apps could access almost as much info about your friends as they could about you? So where is the consent? Fred gives consent to run a personality quiz and its associated data gathering - Fred's 180 friends didn't.
- downandout 9y ago
  That consent is contained in the TOS that you and all of your friends agreed to when you signed up for Facebook. Further, the access to friend data has always been more limited than you imply here, and more recently, it’s become so limited that using apps for data collection about friends is almost a pointless endeavor.
  - vkou 9y ago
    If you were to ask 30 Facebook users whether or not Fred taking a stupid personality quiz leaked all their info, 29 of them would say no. This is why we need informed consent for data collection.
    - downandout 9y ago
      The point is that Facebook disclosed to you that this might happen. Failing to read the TOS is not the same as not having been informed. If you fail to read your mortgage contract but sign it anyway, you’ll still lose your house if you don’t live up to the terms. And for the record, the friend data that Facebook makes available to apps is far from “all” of it, especially nowadays
      - oldcynic 9y ago
        Degree is irrelevant until sentencing is it not? Failing to read the TOS is not the same as being informed either. The judiciary seem aware of that too.
      - gambiting 9y ago
        In EU all sorts of EULAs are invalid almost by definition and have proven time and time again that they don't stand up in court. Terms of any contract have to be reasonable - if your mortgage has a clause that says "the bank can terminate your mortgage for displaying flower pots on the north side of the building" that would 100% not stand up in court. Yes, you agreed to it, but it's not a reasonable clause.
      - TheSpiceIsLife 9y ago
        In Australia, people who work for organisations that sell mortgages have a professional duty they're required to perform by explaining to you, to your face, in simple terms, what certain parts of the contract mean and what obligations each party has, and sign off that they are satisfied that you understand. I don't recall that ever happening when a TOS was displayed on any of my electronic devices. So I don't think it's a valid comparison.
    - 9y ago
- makomk 9y ago
  This is, of course, true but it's not clear why investors should have any grounds to sue over it. This wasn't actually a PR problem for Facebook until relatively recently - for instance, the 2012 Obama campaign harvested data about the Facebook friends of people who volunteered access to their accounts, those friends obviously didn't consent, and this mostly just lead to glowing articles about how clever this was and how commercial companies could copy it. What it took for this to be a problem for Facebook was Trump running for and winning the presidency, the press needing someone to blame other than themselves, and them being willing to bury minor details like the campaign probably not actually using the data in question in any form. That doesn't seem like something which could reasonably be predicted in advance.
kaeawc 9y ago
I am a developer of an app that makes use of Facebook friend permissions and have seen the various API changes they have made since 2014. Applications using Facebook Graph 2.+ (which is the only option since Spring 2015 or so) who access friend data may only access data of friends who have also given consent to your app. So if A and C log into a Facebook app, and A is friends with B and C, the app can only be aware that A and C exist. This is true of legacy and new Facebook applications. It used to be possible to get basically everything about B (name, age, gender, photo, etc), but that all got shut down when Graph API 1.0 was discontinued. If this is somehow not the case for some Facebook apps that got special permission or there is a hack to get at the data, that would be a huge breach of trust.
- downandout 9y ago
  That’s actually the point of my post. I have been developing Facebook apps since the very beginning of the developer platform, but stopped because the new rules were so restrictive that they made apps useless. There is no point to developing social network apps that can’t involve the user’s social network. Since all apps have these restrictions, I don’t believe that any apps at issue here had special permissions. However, it is possible that they scraped public data and were assisted in being pointed to which data to scrape by the direct profile data they obtained through the apps. Enough friends lists etc. are public to make this potentially beneficial. No specs have been released about CA’s “psychographic profiling”. We don’t know the extent of the data that they had access to, what data went into it (perhaps it was based on name and friends list only, which are mostly public etc.). So until we know more, we can only assume that these apps had the same constraints that all others do.
- IshKebab 9y ago
  They haven't got around that, it's just that this data "breach" happened before 2015 when the old API was removed.
  - manuelflara 9y ago
    Is this correct? Because all this time I was wondering about this scandal: apparently, this all started because someone had some app or website which got downloaded by a few hundred thousand FB users (who gave access to their info), and somehow they turned that into data of 50M users. And I also am well aware the current FB API doesn't allow you to get info about your friends if only you give permissions to an app. That this "breach" happened some time ago, when API permissions were different, would make a lot of sense to me.
bunderbunder 9y ago
The modern approach to consent in these things arguably immoral, and indisputably awful. Most adults simply don't have the ability to understand the dense legalese that these contracts are written in, so they don't. Asking people to take an hour or two to properly read and digest it just to sign up for a website is ridiculous, and expecting them to actually do so is like something out of a Terry Gilliam movie.
- abetlen 9y ago
  I get this argument for users but we're talking about investors, surely they should be taking an interest in the companies they put their money into.
- JimmyAustin 9y ago
  The provision that allows this is ~460 words into the TOS, and is written in pretty easy to understand english. At some point you need to hold yourself accountable for agreeing to this stuff.
  - TheOtherHobbes 9y ago
    Perhaps you can point to the clause which makes it explicit that the data you provided in a personality test app can be used to swing elections. Or was FB expecting users to be “accountable” enough to work out that part for themselves?
  - bunderbunder 9y ago
    From their TOS: "... you grant us a non-exclusive, transferable, sub-licensable, royalty-free, worldwide license to use any IP content that you post on or in connection with Facebook (IP License)" I would expect the implications of that provision to be inscrutable to someone who doesn't have at least some familiarity with IP law. Techies tend to have that background, because software licensing is such a big factor in open source software. But I would bet that if you go out and survey people off the street about what that's saying, very few would anticipate that it means, "We can sell your data to anyone we want, including exporting it to places where your local privacy laws may not apply, and they get to do whatever they want with it, including selling it to still other people." Especially in light of the (misleading, if you're interpreting it in terms of vernacular English instead of legalese) statement that, "You own all of the content and information you post on Facebook," that opens the section. Expecting most people I know to reliably all of the relevant implications for their privacy out of that saucer full of tea leaves is, to put it bluntly, bullshit.
OrganicMSG 9y ago
> The "without their consent" part is BS, as is this lawsuit. When you use Facebook platform apps, you have to consent to the disclosure of your information to the developer, and have to agree to allow whatever special permissions the developer is asking for. As for friend data that apps may have access to, when you sign up for and use Facebook, you agree to the terms and conditions, which allow this behavior. As far as I am aware, across the whole of Europe, pretty much none of those TOS click-through things hold up as informed contractual consent. They aren't really worth the pixels they are written on in many jurisdictions.
- underwater 9y ago
  For reference, here’s the permission dialog from 2010 (https://soundbid.files.wordpress.com/2012/05/fig_03.jpeg https://soundbid.files.wordpress.com/2012/05/fig_03.jpeg). Sharing data and friends lists is not hidden at all.
mankash666 9y ago
Disagree - your argument makes no legal point. This suit is by institutional investors who have access to the best lawyers in the country. They chose to sue fully aware of the TOC, they obviously know more
- downandout 9y ago
  they obviously know more Or they're just greedy and looking for a quick settlement, like all other class action securities attorneys do when the sue over large stock price drops. These types of suits are filed daily, many of them without merit. For a fascinating look at Bill Lerach, the lawyer who perfected this tactic, check out [1]. He squeezed so much money out of public companies and caused so many problems with these often ridiculous lawsuits, that Congress passed a bill limiting them that became known as the "Get Lerach Act". He eventually went to federal prison for paying kickbacks to plaintiffs. [1] https://www.youtube.com/watch?v=wYIC9GU9OeM https://www.youtube.com/watch?v=wYIC9GU9OeM
anonytrary 9y ago
> agree to allow whatever special permissions the developer is asking for You can't just write up an arbitrary contract and assume it will hold up in a court of law. For example, if I tried to rent out a unit by signing a lease that allowed the landlord to turn my water off if I posted a negative review about them, their lease would probably be found in violation of the corresponding state's landlord-tenant laws. Precedents are established all the time. In the case of Facebook, this is something that common law would not have addressed prior to the early 2000s. Never before have we had such an efficient data-mining machine in the hands of anyone. New technologies warrant new laws. Edit: One example of such a landlord, by the way, is Anne Kihagi who neglected many such tenants. I'm not sure if she did so through a faulty lease, however. It's late... https://www.modernluxury.com/san-francisco/story/home-invader-the-life-and-crimes-of-san-franciscos-cruelest-landlord https://www.modernluxury.com/san-francisco/story/home-invade...
rmc 9y ago
> When you use Facebook platform apps, you have to consent to the disclosure of your information to the developer, and have to agree to allow whatever special permissions the developer is asking for. As for friend data that apps may have access to, when you sign up for and use Facebook, you agree to the terms and conditions, which allow this behavior. So it depends on what you mean by consent, and whether you want to specify "informed consent". Lots of EU data protection law talks about "informed consent". If you asked 1,000 facebook users what they had consented to, they probably would not think that they had consented to that. One can make a case that the long legalese with a checkbox at the end isn't (informed) consent.
- dqv 9y ago
  >If you asked 1,000 facebook users what they had consented to, they probably would not think that they had consented to that. SomeFacebookApp is requesting permission to do the following: Access my basic information: Includes my name, profile picture, gender, networks, user ID, list of friends, and any other information I've shared with everyone. Access my contact information: Current Address and Mobile Phone Number I can't imagine how much more explicit this could be. I don't think the argument that it's behind legalese would hold. And it seems pretty informative about what information is going to be taken.
  - dozzie 9y ago
    > I can't imagine how much more explicit this could be. Ah yes, and what exactly are they doing with this information? I can't imagine how much less explicit this could be.
    - dqv 9y ago
      >Ah yes, and what exactly are they doing with this information? I can't imagine how much less explicit this could be. I would have appreciated less smugness, but I get your point. The permissions request should go further and say how the permissions will be used and what can happen if they are used.
  - pmlnr 9y ago

hashkb 9y ago

This seems super obvious to me too. The more important question, from which this is a distraction, is: what was The Donald's role?

oldcynic 9y ago

Correct me where I'm wrong but did it not used to be the case that facebook apps could access almost as much info about your friends as they could about you? So where is the consent? Fred gives consent to run a personality quiz and its associated data gathering - Fred's 180 friends didn't.

downandout 9y ago
That consent is contained in the TOS that you and all of your friends agreed to when you signed up for Facebook. Further, the access to friend data has always been more limited than you imply here, and more recently, it’s become so limited that using apps for data collection about friends is almost a pointless endeavor.
- vkou 9y ago
  If you were to ask 30 Facebook users whether or not Fred taking a stupid personality quiz leaked all their info, 29 of them would say no. This is why we need informed consent for data collection.
  - downandout 9y ago
    The point is that Facebook disclosed to you that this might happen. Failing to read the TOS is not the same as not having been informed. If you fail to read your mortgage contract but sign it anyway, you’ll still lose your house if you don’t live up to the terms. And for the record, the friend data that Facebook makes available to apps is far from “all” of it, especially nowadays
    - oldcynic 9y ago
      Degree is irrelevant until sentencing is it not? Failing to read the TOS is not the same as being informed either. The judiciary seem aware of that too.
    - gambiting 9y ago
      In EU all sorts of EULAs are invalid almost by definition and have proven time and time again that they don't stand up in court. Terms of any contract have to be reasonable - if your mortgage has a clause that says "the bank can terminate your mortgage for displaying flower pots on the north side of the building" that would 100% not stand up in court. Yes, you agreed to it, but it's not a reasonable clause.
    - TheSpiceIsLife 9y ago
      In Australia, people who work for organisations that sell mortgages have a professional duty they're required to perform by explaining to you, to your face, in simple terms, what certain parts of the contract mean and what obligations each party has, and sign off that they are satisfied that you understand. I don't recall that ever happening when a TOS was displayed on any of my electronic devices. So I don't think it's a valid comparison.
  - 9y ago
makomk 9y ago
This is, of course, true but it's not clear why investors should have any grounds to sue over it. This wasn't actually a PR problem for Facebook until relatively recently - for instance, the 2012 Obama campaign harvested data about the Facebook friends of people who volunteered access to their accounts, those friends obviously didn't consent, and this mostly just lead to glowing articles about how clever this was and how commercial companies could copy it. What it took for this to be a problem for Facebook was Trump running for and winning the presidency, the press needing someone to blame other than themselves, and them being willing to bury minor details like the campaign probably not actually using the data in question in any form. That doesn't seem like something which could reasonably be predicted in advance.

kaeawc 9y ago

I am a developer of an app that makes use of Facebook friend permissions and have seen the various API changes they have made since 2014. Applications using Facebook Graph 2.+ (which is the only option since Spring 2015 or so) who access friend data may only access data of friends who have also given consent to your app. So if A and C log into a Facebook app, and A is friends with B and C, the app can only be aware that A and C exist. This is true of legacy and new Facebook applications. It used to be possible to get basically everything about B (name, age, gender, photo, etc), but that all got shut down when Graph API 1.0 was discontinued. If this is somehow not the case for some Facebook apps that got special permission or there is a hack to get at the data, that would be a huge breach of trust.

downandout 9y ago
That’s actually the point of my post. I have been developing Facebook apps since the very beginning of the developer platform, but stopped because the new rules were so restrictive that they made apps useless. There is no point to developing social network apps that can’t involve the user’s social network. Since all apps have these restrictions, I don’t believe that any apps at issue here had special permissions. However, it is possible that they scraped public data and were assisted in being pointed to which data to scrape by the direct profile data they obtained through the apps. Enough friends lists etc. are public to make this potentially beneficial. No specs have been released about CA’s “psychographic profiling”. We don’t know the extent of the data that they had access to, what data went into it (perhaps it was based on name and friends list only, which are mostly public etc.). So until we know more, we can only assume that these apps had the same constraints that all others do.
IshKebab 9y ago
They haven't got around that, it's just that this data "breach" happened before 2015 when the old API was removed.
- manuelflara 9y ago
  Is this correct? Because all this time I was wondering about this scandal: apparently, this all started because someone had some app or website which got downloaded by a few hundred thousand FB users (who gave access to their info), and somehow they turned that into data of 50M users. And I also am well aware the current FB API doesn't allow you to get info about your friends if only you give permissions to an app. That this "breach" happened some time ago, when API permissions were different, would make a lot of sense to me.

bunderbunder 9y ago

The modern approach to consent in these things arguably immoral, and indisputably awful. Most adults simply don't have the ability to understand the dense legalese that these contracts are written in, so they don't. Asking people to take an hour or two to properly read and digest it just to sign up for a website is ridiculous, and expecting them to actually do so is like something out of a Terry Gilliam movie.

abetlen 9y ago
I get this argument for users but we're talking about investors, surely they should be taking an interest in the companies they put their money into.
JimmyAustin 9y ago
The provision that allows this is ~460 words into the TOS, and is written in pretty easy to understand english. At some point you need to hold yourself accountable for agreeing to this stuff.
- TheOtherHobbes 9y ago
  Perhaps you can point to the clause which makes it explicit that the data you provided in a personality test app can be used to swing elections. Or was FB expecting users to be “accountable” enough to work out that part for themselves?
- bunderbunder 9y ago
  From their TOS: "... you grant us a non-exclusive, transferable, sub-licensable, royalty-free, worldwide license to use any IP content that you post on or in connection with Facebook (IP License)" I would expect the implications of that provision to be inscrutable to someone who doesn't have at least some familiarity with IP law. Techies tend to have that background, because software licensing is such a big factor in open source software. But I would bet that if you go out and survey people off the street about what that's saying, very few would anticipate that it means, "We can sell your data to anyone we want, including exporting it to places where your local privacy laws may not apply, and they get to do whatever they want with it, including selling it to still other people." Especially in light of the (misleading, if you're interpreting it in terms of vernacular English instead of legalese) statement that, "You own all of the content and information you post on Facebook," that opens the section. Expecting most people I know to reliably all of the relevant implications for their privacy out of that saucer full of tea leaves is, to put it bluntly, bullshit.

OrganicMSG 9y ago

> The "without their consent" part is BS, as is this lawsuit. When you use Facebook platform apps, you have to consent to the disclosure of your information to the developer, and have to agree to allow whatever special permissions the developer is asking for. As for friend data that apps may have access to, when you sign up for and use Facebook, you agree to the terms and conditions, which allow this behavior. As far as I am aware, across the whole of Europe, pretty much none of those TOS click-through things hold up as informed contractual consent. They aren't really worth the pixels they are written on in many jurisdictions.

underwater 9y ago
For reference, here’s the permission dialog from 2010 (https://soundbid.files.wordpress.com/2012/05/fig_03.jpeg https://soundbid.files.wordpress.com/2012/05/fig_03.jpeg). Sharing data and friends lists is not hidden at all.

mankash666 9y ago

Disagree - your argument makes no legal point. This suit is by institutional investors who have access to the best lawyers in the country. They chose to sue fully aware of the TOC, they obviously know more

downandout 9y ago
they obviously know more Or they're just greedy and looking for a quick settlement, like all other class action securities attorneys do when the sue over large stock price drops. These types of suits are filed daily, many of them without merit. For a fascinating look at Bill Lerach, the lawyer who perfected this tactic, check out [1]. He squeezed so much money out of public companies and caused so many problems with these often ridiculous lawsuits, that Congress passed a bill limiting them that became known as the "Get Lerach Act". He eventually went to federal prison for paying kickbacks to plaintiffs. [1] https://www.youtube.com/watch?v=wYIC9GU9OeM https://www.youtube.com/watch?v=wYIC9GU9OeM

anonytrary 9y ago

> agree to allow whatever special permissions the developer is asking for You can't just write up an arbitrary contract and assume it will hold up in a court of law. For example, if I tried to rent out a unit by signing a lease that allowed the landlord to turn my water off if I posted a negative review about them, their lease would probably be found in violation of the corresponding state's landlord-tenant laws. Precedents are established all the time. In the case of Facebook, this is something that common law would not have addressed prior to the early 2000s. Never before have we had such an efficient data-mining machine in the hands of anyone. New technologies warrant new laws. Edit: One example of such a landlord, by the way, is Anne Kihagi who neglected many such tenants. I'm not sure if she did so through a faulty lease, however. It's late... https://www.modernluxury.com/san-francisco/story/home-invader-the-life-and-crimes-of-san-franciscos-cruelest-landlord https://www.modernluxury.com/san-francisco/story/home-invade...

rmc 9y ago

> When you use Facebook platform apps, you have to consent to the disclosure of your information to the developer, and have to agree to allow whatever special permissions the developer is asking for. As for friend data that apps may have access to, when you sign up for and use Facebook, you agree to the terms and conditions, which allow this behavior. So it depends on what you mean by consent, and whether you want to specify "informed consent". Lots of EU data protection law talks about "informed consent". If you asked 1,000 facebook users what they had consented to, they probably would not think that they had consented to that. One can make a case that the long legalese with a checkbox at the end isn't (informed) consent.

dqv 9y ago
>If you asked 1,000 facebook users what they had consented to, they probably would not think that they had consented to that. SomeFacebookApp is requesting permission to do the following: Access my basic information: Includes my name, profile picture, gender, networks, user ID, list of friends, and any other information I've shared with everyone. Access my contact information: Current Address and Mobile Phone Number I can't imagine how much more explicit this could be. I don't think the argument that it's behind legalese would hold. And it seems pretty informative about what information is going to be taken.
- dozzie 9y ago
  > I can't imagine how much more explicit this could be. Ah yes, and what exactly are they doing with this information? I can't imagine how much less explicit this could be.
  - dqv 9y ago
    >Ah yes, and what exactly are they doing with this information? I can't imagine how much less explicit this could be. I would have appreciated less smugness, but I get your point. The permissions request should go further and say how the permissions will be used and what can happen if they are used.
- pmlnr 9y ago