32 ms·

U.S. Supreme Court rebuffs Facebook appeal in user tracking lawsuit

350 points by LinuxBender 6y ago

binarymax 6y ago
"The company stopped its nonconsensual tracking after it was exposed by a researcher in 2011, court papers said." Did Facebook stop tracking non-users though? Maybe that particular method was ceased but Facebook still slurps up all the data it can on anyone and everone. Case in point: the recent Facebook login SDK for mobile was tracking non-users.
- vmception 6y ago
  I think we need a new way to force original jurisdiction to the Supreme Court A ruling in 2021 about a 2011 incident is not useful in software
  - anticristi 6y ago
    Why not? Next time someone comes with the idea of tracking non-users, there will be a clear legal test to prove this is illegal. Also, pursuing a start-up after 10 years sends a clear message to VCs too: Don't invest in startup that grow via wiretapping.
  - rossdavidh 6y ago
    Well, the Supreme Court is the fallback method. In reality, Congress is the branch that's supposed to say, "whoa, that new technology opens some new questions about privacy and such, let's pass a law clarifying the situation". But, in practice, our fallback method appears to be resorted to at least as often as the intended method.
duxup 6y ago
>In its appeal to the Supreme Court, Facebook said it is not liable under the Wiretap Act because it is a party to the communications at issue by virtue of its plug-ins. That would be kinda scary if allowed. I would think / hope that as an individual that I would need to actually know that someone is a party to the conversation... the idea that Facebook could just say "well you logged in this one time so now we're party who god knows what ..." would be pretty horrible if legally accepted. Granted, from a tech standpoint, that's also kinda how it is :(
- ocdtrekkie 6y ago
  This is an incredible opportunity to set the legal precedent to make the tech standpoint no longer acceptable, and hence, compel it to change.
  - CobrastanJorji 6y ago
    This is a dangerous plan. The same logic applies to "Let's make sure that other party chooses the worst possible candidate, thus compeling everyone to vote for the candidate we prefer in the general election." Or "let's present our boss with two options, the correct one and also an absolutely awful one, thus ensuring that they will select the correct option."
    - duxup 6y ago
      In this case Facebook already is the worst possible candidate ... and is doing the thing and arguing they're a party to the conversation.
    - alistairSH 6y ago
      I'm not sure how telling Facebook (or Google) "you can't spy on people just because a page has a link to your widget" is even remotely the same as gaming an election?
      - anticristi 6y ago
        Would this have implications on Google Analytics? I didn't agree to them knowing what URLs I visit.
        alistairSH 6y ago
        Possibly. I'm ok with that too. If a site wants that info they can pay for it (vs trading their own visitor's data for the service). IANAL, IMO, etc.... in terms of how I feel personally about the use of my browsing data, a lot depends on the scope of what/where/who I'm visiting. I don't have much expectation of privacy for simply visiting a site - some unique tracking ID gets passed around, ok, I can live with that. To me, the meatspace equivalent is a neighbor telling another neighbor they saw me at the supermarket. But, once I start actively engaging on the site - buying things, entering PII for some reason, posting in a forum - my expectation of privacy is higher (even if the reality isn't the case). I don't want that info traded without my consent.
nerdponx 6y ago
“Facebook was not an uninvited interloper to a communication between two separate parties; it was a direct participant,” the company said in a legal filing. There's gotta be some existing legal doctrine on what constitutes a "direct participant", right? Suppose I visit the website of Company A intending to do business with them (perhaps this is the only way to contact them). Their website contains the Facebook "like" button somewhere on the page. Is Facebook really a "direct participant" if I have no way to know that their widget is even on the site until I visit it, at which point they have already participated and I have no way to avoid it? Likewise, does the law/precedent on "expectation of privacy" have anything to say about who specifically I should/shouldn't expect privacy from?
- fotbr 6y ago
  Some states allow "one party consent" to recordings of communications (ie, phone calls). Extending that, as long as Company A is aware of FB's practices, then your wishes are irrelevant as far as the law is concerned. I have no idea what California's laws are regarding the matter, or the laws governing any of the other participants. I'm just speaking in the general case, that some states allow it, and the argument that could be made.
  - TrinaryWorksToo 6y ago
    California is a two-party consent state for wiretapping laws.
  - rsstack 6y ago
    "California's wiretapping law is a "two-party consent" law. California makes it a crime to record or eavesdrop on any confidential communication, including a private conversation or telephone call, without the consent of all parties to the conversation."
    - nerdponx 6y ago
      Two-party consent is a funny thing. It's empowering to individuals in their interactions with corporations, but in this case it's clearly disempowering to individuals. Is "asymmetric" one-party consent a thing in any jurisdiction?
ChuckMcM 6y ago
Personally, I think the privacy cases that this Supreme court hears will probably be what it is most remembered for in the future. I suspect this particular lawsuit will be settled now for an undisclosed sum to the plaintiffs as it seems that it will be allowed to proceed in the lower courts and that means discovery and all sorts of things which Facebook would likely want to avoid.
legitster 6y ago
> Four individuals filed the proposed nationwide class action lawsuit in California federal court seeking $15 billion in damages for Menlo Park, California-based Facebook’s actions between April 2010 and September 2011. The company stopped its nonconsensual tracking after it was exposed by a researcher in 2011, court papers said. If I understand correctly, for over a year Facebook would track users to web services that had Facebook integrations installed. It's not super clear what was different for "consensual tracking", but I presume this coincided with their privacy center? > “Facebook’s user profiles would allegedly reveal an individual’s likes, dislikes, interests and habits over a significant amount of time, without affording users a meaningful opportunity to control or prevent the unauthorized exploration of their private lives,” The Wiretap act seems like a bad precedent here. The problem isn't that that data was unwillingly intercepted (otherwise even things as simple as server logs would count as a wiretap), it's that people object to the way their information is being collected and aggregated. And there's no good law to really apply here without making a new one.
- SimeVidas 6y ago
  > If I understand correctly, for over a year Facebook would track users to web services that had Facebook integrations installed. Facebook tracks users across websites. This is of course still happening. I thought this is common knowledge. This is happening because both Facebook and other websites benefit from this kind of tracking.
  - legitster 6y ago
    The suit only covers between 2010 and 2011. So unless their tracking opt-in dramatically changed, I believe the issue of the lawsuit was the lack of consumer privacy options in this period.
    - duxup 6y ago
      Possibly there is some EULA language or option to opt out now and the folks suing would rather sidestep that whole question for now.
1vuio0pswjnm7 6y ago
Here is the 9th Circuit opinion: https://cdn.ca9.uscourts.gov/datastore/opinions/2020/04/09/17-17486.pdf https://cdn.ca9.uscourts.gov/datastore/opinions/2020/04/09/1... Nice typo in the 2nd paragraph. Here is the orginal publication of Facebook's wiretapping, and the Facebook response where it denied the tracking was used for advertising. https://web.archive.org/web/20110929182141/http://nikcub.appspot.com/logging-out-of-facebook-is-not-enough https://web.archive.org/web/20110929182141/http://nikcub.app... https://web.archive.org/web/20110927040818/http://venturebeat.com:80/2011/09/25/facebook-tracking-logged-out/ https://web.archive.org/web/20110927040818/http://venturebea... https://web.archive.org/web/20110929182141/http://www.huffingtonpost.com:80/2011/09/26/facebook-logout-cookies-privacy-tracking_n_980838.html https://web.archive.org/web/20110929182141/http://www.huffin... This was first reported in 2011. Note how long it took to get to the point where Facebook is being legally compelled tell the truth. IMO, this also highlights the difference between tracking as one issue and what a company may do with collected data as another. Arguably the second issue is the most important. It is easy enough to discover the presence of tracking, but discovering what companies do with collected data is more difficult, and perhaps requires compelled discovery in the context of legal proceedings.
3xasperated 6y ago
Interesting read
prepend 6y ago
I think these kinds of data lawsuits are going to be the new tobacco/opioids lawsuits. People seem to be figuring out how to quantify harm and damages and remediations. Once a few of these start paying out, I can see some really massive class action lawsuits and then state lawsuits. I think it will be bigger than tobacco and opioid because of the ability for key insiders to be able to target lawsuits and highlight things that were illegal or caused some sort of harm.
lai-yin 6y ago
This article's webpage displayed a few rug ads. I was shopping for rugs a month ago. The rug ads haven't stopped since. I don't care though tbh.
- Y_Y 6y ago
  I've now collected that information about your consumer preferences and will use it for my own mysterious purposes at a later time.
scrose 6y ago
It seems like the only thing that separates what Facebook is doing from most other ad and tracker networks is just sheer volume. It’s insane how many trackers ‘modern’ websites embed that exist to track you around the web. A typical site may have several trackers doing the same thing depending on advertiser agreements and sanity checks if there’s discrepancies in volume. As someone whose transitioned to working more in media now, I still struggle to see the benefits many of these trackers promise. I’m at the point now where I only allow a few sites to set and store cookies, while I run a Pihole, Noscript and Ublock. Even then, stuff manages to leak through.
sloshnmosh 6y ago
I found hidden Facebook buttons and pixel on the portion of my apartments website where tenants were forced to pay rent. The apartment stopped accepting checks and/or money orders and the only other way of paying your monthly rent was to go to a Walmart and pay and extra fee. There was no mention of Facebook anywhere in the privacy policy of the website and an employee of the company that ran the website stated she also could not find any mention of Facebook in their privacy policy or terms and conditions.
- deleted 6y ago
  [deleted]
Ansil849 6y ago
When talking about Facebook, keep in mind that this is the company whose founder literally called its own userbase "dumbfucks" for trusting him with their data [1] That really sums everything up. [1] https://www.businessinsider.com/well-these-new-zuckerberg-ims-wont-help-facebooks-privacy-problems-2010-5 https://www.businessinsider.com/well-these-new-zuckerberg-im...
- mjburgess 6y ago
  It doesn't seem a very serious comment. I think it's just the obvious reaction to starting a website at your university where, mysteriously, you end up with thousands of your peer's details.
  - lavp 6y ago
    That’s not the text that’s concerning, it’s the first one: “Yeah so if you ever need info about anyone at Harvard just ask”

350 points by LinuxBender 6y ago

"The company stopped its nonconsensual tracking after it was exposed by a researcher in 2011, court papers said." Did Facebook stop tracking non-users though? Maybe that particular method was ceased but Facebook still slurps up all the data it can on anyone and everone. Case in point: the recent Facebook login SDK for mobile was tracking non-users.

vmception 6y ago
I think we need a new way to force original jurisdiction to the Supreme Court A ruling in 2021 about a 2011 incident is not useful in software
- anticristi 6y ago
  Why not? Next time someone comes with the idea of tracking non-users, there will be a clear legal test to prove this is illegal. Also, pursuing a start-up after 10 years sends a clear message to VCs too: Don't invest in startup that grow via wiretapping.
- rossdavidh 6y ago
  Well, the Supreme Court is the fallback method. In reality, Congress is the branch that's supposed to say, "whoa, that new technology opens some new questions about privacy and such, let's pass a law clarifying the situation". But, in practice, our fallback method appears to be resorted to at least as often as the intended method.

duxup 6y ago

>In its appeal to the Supreme Court, Facebook said it is not liable under the Wiretap Act because it is a party to the communications at issue by virtue of its plug-ins. That would be kinda scary if allowed. I would think / hope that as an individual that I would need to actually know that someone is a party to the conversation... the idea that Facebook could just say "well you logged in this one time so now we're party who god knows what ..." would be pretty horrible if legally accepted. Granted, from a tech standpoint, that's also kinda how it is :(

ocdtrekkie 6y ago
This is an incredible opportunity to set the legal precedent to make the tech standpoint no longer acceptable, and hence, compel it to change.
- CobrastanJorji 6y ago
  This is a dangerous plan. The same logic applies to "Let's make sure that other party chooses the worst possible candidate, thus compeling everyone to vote for the candidate we prefer in the general election." Or "let's present our boss with two options, the correct one and also an absolutely awful one, thus ensuring that they will select the correct option."
  - duxup 6y ago
    In this case Facebook already is the worst possible candidate ... and is doing the thing and arguing they're a party to the conversation.
  - alistairSH 6y ago
    I'm not sure how telling Facebook (or Google) "you can't spy on people just because a page has a link to your widget" is even remotely the same as gaming an election?
    - anticristi 6y ago
      Would this have implications on Google Analytics? I didn't agree to them knowing what URLs I visit.
      - alistairSH 6y ago
        Possibly. I'm ok with that too. If a site wants that info they can pay for it (vs trading their own visitor's data for the service). IANAL, IMO, etc.... in terms of how I feel personally about the use of my browsing data, a lot depends on the scope of what/where/who I'm visiting. I don't have much expectation of privacy for simply visiting a site - some unique tracking ID gets passed around, ok, I can live with that. To me, the meatspace equivalent is a neighbor telling another neighbor they saw me at the supermarket. But, once I start actively engaging on the site - buying things, entering PII for some reason, posting in a forum - my expectation of privacy is higher (even if the reality isn't the case). I don't want that info traded without my consent.

nerdponx 6y ago

“Facebook was not an uninvited interloper to a communication between two separate parties; it was a direct participant,” the company said in a legal filing. There's gotta be some existing legal doctrine on what constitutes a "direct participant", right? Suppose I visit the website of Company A intending to do business with them (perhaps this is the only way to contact them). Their website contains the Facebook "like" button somewhere on the page. Is Facebook really a "direct participant" if I have no way to know that their widget is even on the site until I visit it, at which point they have already participated and I have no way to avoid it? Likewise, does the law/precedent on "expectation of privacy" have anything to say about who specifically I should/shouldn't expect privacy from?

fotbr 6y ago
Some states allow "one party consent" to recordings of communications (ie, phone calls). Extending that, as long as Company A is aware of FB's practices, then your wishes are irrelevant as far as the law is concerned. I have no idea what California's laws are regarding the matter, or the laws governing any of the other participants. I'm just speaking in the general case, that some states allow it, and the argument that could be made.
- TrinaryWorksToo 6y ago
  California is a two-party consent state for wiretapping laws.
- rsstack 6y ago
  "California's wiretapping law is a "two-party consent" law. California makes it a crime to record or eavesdrop on any confidential communication, including a private conversation or telephone call, without the consent of all parties to the conversation."
  - nerdponx 6y ago
    Two-party consent is a funny thing. It's empowering to individuals in their interactions with corporations, but in this case it's clearly disempowering to individuals. Is "asymmetric" one-party consent a thing in any jurisdiction?

ChuckMcM 6y ago

Personally, I think the privacy cases that this Supreme court hears will probably be what it is most remembered for in the future. I suspect this particular lawsuit will be settled now for an undisclosed sum to the plaintiffs as it seems that it will be allowed to proceed in the lower courts and that means discovery and all sorts of things which Facebook would likely want to avoid.

legitster 6y ago

> Four individuals filed the proposed nationwide class action lawsuit in California federal court seeking $15 billion in damages for Menlo Park, California-based Facebook’s actions between April 2010 and September 2011. The company stopped its nonconsensual tracking after it was exposed by a researcher in 2011, court papers said. If I understand correctly, for over a year Facebook would track users to web services that had Facebook integrations installed. It's not super clear what was different for "consensual tracking", but I presume this coincided with their privacy center? > “Facebook’s user profiles would allegedly reveal an individual’s likes, dislikes, interests and habits over a significant amount of time, without affording users a meaningful opportunity to control or prevent the unauthorized exploration of their private lives,” The Wiretap act seems like a bad precedent here. The problem isn't that that data was unwillingly intercepted (otherwise even things as simple as server logs would count as a wiretap), it's that people object to the way their information is being collected and aggregated. And there's no good law to really apply here without making a new one.

SimeVidas 6y ago
> If I understand correctly, for over a year Facebook would track users to web services that had Facebook integrations installed. Facebook tracks users across websites. This is of course still happening. I thought this is common knowledge. This is happening because both Facebook and other websites benefit from this kind of tracking.
- legitster 6y ago
  The suit only covers between 2010 and 2011. So unless their tracking opt-in dramatically changed, I believe the issue of the lawsuit was the lack of consumer privacy options in this period.
  - duxup 6y ago
    Possibly there is some EULA language or option to opt out now and the folks suing would rather sidestep that whole question for now.

1vuio0pswjnm7 6y ago

Here is the 9th Circuit opinion: https://cdn.ca9.uscourts.gov/datastore/opinions/2020/04/09/17-17486.pdf https://cdn.ca9.uscourts.gov/datastore/opinions/2020/04/09/1... Nice typo in the 2nd paragraph. Here is the orginal publication of Facebook's wiretapping, and the Facebook response where it denied the tracking was used for advertising. https://web.archive.org/web/20110929182141/http://nikcub.appspot.com/logging-out-of-facebook-is-not-enough https://web.archive.org/web/20110929182141/http://nikcub.app... https://web.archive.org/web/20110927040818/http://venturebeat.com:80/2011/09/25/facebook-tracking-logged-out/ https://web.archive.org/web/20110927040818/http://venturebea... https://web.archive.org/web/20110929182141/http://www.huffingtonpost.com:80/2011/09/26/facebook-logout-cookies-privacy-tracking_n_980838.html https://web.archive.org/web/20110929182141/http://www.huffin... This was first reported in 2011. Note how long it took to get to the point where Facebook is being legally compelled tell the truth. IMO, this also highlights the difference between tracking as one issue and what a company may do with collected data as another. Arguably the second issue is the most important. It is easy enough to discover the presence of tracking, but discovering what companies do with collected data is more difficult, and perhaps requires compelled discovery in the context of legal proceedings.

3xasperated 6y ago

Interesting read

prepend 6y ago

I think these kinds of data lawsuits are going to be the new tobacco/opioids lawsuits. People seem to be figuring out how to quantify harm and damages and remediations. Once a few of these start paying out, I can see some really massive class action lawsuits and then state lawsuits. I think it will be bigger than tobacco and opioid because of the ability for key insiders to be able to target lawsuits and highlight things that were illegal or caused some sort of harm.

lai-yin 6y ago

This article's webpage displayed a few rug ads. I was shopping for rugs a month ago. The rug ads haven't stopped since. I don't care though tbh.

Y_Y 6y ago
I've now collected that information about your consumer preferences and will use it for my own mysterious purposes at a later time.

scrose 6y ago

It seems like the only thing that separates what Facebook is doing from most other ad and tracker networks is just sheer volume. It’s insane how many trackers ‘modern’ websites embed that exist to track you around the web. A typical site may have several trackers doing the same thing depending on advertiser agreements and sanity checks if there’s discrepancies in volume. As someone whose transitioned to working more in media now, I still struggle to see the benefits many of these trackers promise. I’m at the point now where I only allow a few sites to set and store cookies, while I run a Pihole, Noscript and Ublock. Even then, stuff manages to leak through.

sloshnmosh 6y ago

I found hidden Facebook buttons and pixel on the portion of my apartments website where tenants were forced to pay rent. The apartment stopped accepting checks and/or money orders and the only other way of paying your monthly rent was to go to a Walmart and pay and extra fee. There was no mention of Facebook anywhere in the privacy policy of the website and an employee of the company that ran the website stated she also could not find any mention of Facebook in their privacy policy or terms and conditions.

deleted 6y ago
[deleted]

Ansil849 6y ago

When talking about Facebook, keep in mind that this is the company whose founder literally called its own userbase "dumbfucks" for trusting him with their data [1] That really sums everything up. [1] https://www.businessinsider.com/well-these-new-zuckerberg-ims-wont-help-facebooks-privacy-problems-2010-5 https://www.businessinsider.com/well-these-new-zuckerberg-im...

mjburgess 6y ago
It doesn't seem a very serious comment. I think it's just the obvious reaction to starting a website at your university where, mysteriously, you end up with thousands of your peer's details.
- lavp 6y ago
  That’s not the text that’s concerning, it’s the first one: “Yeah so if you ever need info about anyone at Harvard just ask”