PRETRIAL ORDER NO. 19: GUIDANCE FOR HEARING ON MOTION TO DISMISS AMENDED COMPLAINT

VINCE CHHABRIA, District Judge.

At tomorrow's hearing, the parties should be prepared to focus primarily, if not exclusively, on the following issues:

Standing

1. The plaintiffs can take one more shot at explaining their theory of standing based on economic harm. However, the Court does not need further argument on the plaintiffs' theories of standing based on the risk of identity theft or the disclosure of private information. The parties should assume the Court will reject the former and accept the latter.

Consent

2. The plaintiffs should be prepared to identify and discuss their best cases in support of their contention that the data use policy is not incorporated into Facebook's contract with its users (focusing, presumably, on California law).

3. Assuming the data use policy is incorporated into the contract, what is the standard under California law for determining whether Facebook's practices are adequately disclosed in the contract, such that the user is assenting to them? Does the Court apply a "reasonable Facebook user" standard? If not, what cases support application of a different standard?

4. Assuming a "reasonable Facebook user" standard, can the Court conclude as a matter of law, at the Rule 12(b)(6) stage, that reasonable Facebook users would understand, based on the terms of service and the data use policy, that their data could be accessed and used on a scale described in the complaint by third party apps, "whitelisted" apps, and "business partners?"

5. With respect to third party apps, could a reasonable Facebook user understand the words "only be allowed" as describing a technological limitation on third party access to data as opposed to the scope of permission to use data?

6. The plaintiffs should be prepared to identify two or three "business partners" that they believe best illustrate their allegation that "business partners" don't fall within the language of the disclosures.

7. There is a reasonable argument that, notwithstanding the provision purporting to give Facebook the right to make changes to the terms of service unilaterally, a Facebook user is not bound by substantive provisions inserted into the terms of service after the user accepted those terms, unless Facebook provided far more robust notification of the change than what is alleged in the complaint. What authority can Facebook cite for the proposition that, under California law, a consumer is bound by subsequent changes to the terms of service when the company merely posts the revised contract on its website, as opposed to notifying the consumer more directly or requiring the consumer to affirmatively accept the revised terms?

The Severity of the Alleged Privacy Intrusion

8. Assume for sake of argument only that a hypothetical Facebook user configures her settings to make clear that only her "friends" will have access to messages, photographs, and location information. Further assume that Facebook says nothing in its disclosures to suggest that it will provide that information to anyone else. And assume that Facebook, in contravention of these settings and its disclosures, disseminates these messages, photographs, and location information to a long list of companies. How serious an invasion of privacy is that? Does Facebook really contend that this is not serious enough to give rise to a claim for invasion of privacy under California law? Or does Facebook merely contend that that's not what happened in this case?

IT IS SO ORDERED.