Facebook's "Like" Button Plugin and User Tracking: Stretching Outdated and Ambiguous Laws to Protect User Privacy

Journal of Business & Technology Law Volume 17 Issue 1 Article 5 Facebook's "Like" Button Plugin and User Tracking: Stretching Outdated and Ambiguous Laws to Protect User Privacy David Brokaw Follow this and additional works at: https://digitalcommons.law.umaryland.edu/jbtl Part of the Internet Law Commons Recommended Citation David Brokaw, Facebook's "Like" Button Plugin and User Tracking: Stretching Outdated and Ambiguous Laws to Protect User Privacy, 17 J. Bus. & Tech. L. 88 (2022) Available at: https://digitalcommons.law.umaryland.edu/jbtl/vol17/iss1/5 This Notes & Comments is brought to you for free and open access by the Academic Journals at DigitalCommons@UM Carey Law. It has been accepted for inclusion in Journal of Business & Technology Law by an authorized editor of DigitalCommons@UM Carey Law. For more information, please contact . Brokaw (Do Not Delete) 8/8/2022 1:58 AM Facebook’s “Like” Button Plugin and User Tracking: Stretching Outdated and Ambiguous Laws to Protect User Privacy DAVID BROKAW * © Abstract With its 2020 decision in Davis v. Facebook, Inc. (In re Internet Tracking Litigation),1 the Federal Court of Appeals for the Ninth Circuit addressed the social media site’s ability to track its logged-out users’ internet history using browser “cookies.”2 Browser cookies are small bits of data that are transmitted between internet users and a website and in Davis, these cookies were sent to Facebook when the users accessed any website that had a Facebook browser extension “plugin,” even when the users were logged out of Facebook. 3 The data sent in those browser cookies gave Facebook unauthorized access to information about the internet history of its users.4 Facebook was able to match this information to user profiles and sold this user information to advertisers for a profit.5 In Davis, the Ninth Circuit held that the putative plaintiff class had standing to sue Facebook for unjustly profiting from the unauthorized use of their data, even if they did not show any actual economic injury. 6 Also, the Ninth Circuit endorsed one position in a circuit split, finding that the unauthorized tracking of user internet © David Brokaw, 1995-2021. * David Brokaw was a student at the University of Maryland Francis King Carey School of Law and an Editor for the Journal of Business and Technology Law. David passed away during the summer of 2021, following his second year of law school, and is survived by his parents, Peter and Laura Brokaw. This Case Note is being published in David’s honor and in recognition of his contributions to both the Journal and Maryland Carey Law community. 1. 956 F.3d 589 (9th Cir. 2020). 2. Id. at 595-96. 3. Id. at 596. 4. Id. at 596, 601. 5. Id. 6. Id. at 599. Journal of Business & Technology Law 88 4_MLB_Brokaw_jbtl (Do Not Delete) 8/8/2022 1:58 AM DAVID BROKAW usage with browser cookies, as Facebook was doing, could violate the Federal Wiretap Act.7 By recognizing that the unauthorized use of user internet data can give plaintiffs standing for economic claims and can implicate the Federal Wiretap Act,8 the Ninth Circuit’s decision in Davis could have broad ramifications on websites’ liability for using cookies or internet plugins.9 This note will begin with the factual background and procedural history of Davis, including a description of the technology Facebook used to track the internet usage of its users.10 Then, this note will set forth the Ninth Circuit’s analysis of the key issues raised by the plaintiff class on appeal, including whether they had standing to bring their claims, and whether they sufficiently pleaded their claims against Facebook for invasion of privacy, breach of contract, and violation of the Federal Wiretap Act.11 Finally, this note will discuss the legal impact of the decision in Davis and how it may affect future litigation over the unauthorized use of user data by websites and social media companies. 12 I. The Case “On April 22, 2010, Facebook launched [its] “Like” button [social plugin on websites] outside of the Facebook domain.”13 An internet “plugin” is a program that extends the functionality of an internet browser or other internet service. 14 Facebook’s “Like” button as well as other plugins extend the functionality of websites on the internet by allowing users who click the plugin to not only share content to Facebook from outside the Facebook website and indicate a “like” for products posted to Facebook, but to also allow Facebook to track users visits to these other websites with the Facebook widgets and plug-ins.15 The “Like” button plugin was launched as part of Facebook’s “Open Graph” initiative, which was an 7. Id. at 608 (noting that a court following the First and Seventh Circuit Courts would adopt an “understanding that simultaneous, unknown duplication and communication of GET requests do not exempt a defendant from liability under the party exception[,]” while a court following the Third Circuit would adopt an understanding that defendant website companies “were ‘the intended recipients’ of . . . duplicated GET requests, and thus ‘[party] to [disputed] transmissions[.]’”). 8. Electronic Communications Privacy Act of 1986, Pub. L. No. 99-508, 100 Stat. 1848 (1986). 9. See infra Section III. 10. See infra Section I. 11. See infra Section II. 12. See infra Section III. 13. Brief for Plaintiffs-Appellants at 2, Davis v. Facebook, Inc. (In re Internet Tracking Litig.), 956 F.3d 589 (9th Cir. 2020) (No. 17-17486). 14. Davis v. Facebook, Inc. (In re Internet Tracking Litig.), 956 F.3d 589, 596 n.1 (9th Cir. 2020). 15. Bill Goodwin & Sebastian Klovig Skelton, Facebook’s Privacy Game – How Zuckerbuerg Backtracked on Promises to Protect Personal Data, COMPUTERWEEKLY.COM (July 1, 2019), https://www.computerweekly.com/feature/Facebooks-privacy-U-turn-how-Zuckerberg-backtracked-onpromises-to-protect-personal-data. Journal of Business & Technology Law 89 Brokaw (DO NOT DELETE) 8/8/2022 1:58 AM Facebook’s “Like” Button Plugin and User Tracking effort by Facebook to connect the social media service with other, outside websites, envisioning a future where users could browse the web using their real identities and “everything [can] be more personalized.”16 During the 24-hour period after Facebook launched the “Like” button, over one billion internet users encountered the plugin online.17 By the end of April 2010, over 50,000 websites featured the “Like” button plugin, and that September Facebook announced that over 2 million different websites were using its’ plugin.18 The reach and ubiquity of the “Like” button plugin has only continued to grow, and less than a decade later, in 2018, Facebook claimed the “Like” button plugin appeared on over 8.4 million different websites.19 Browser cookies are simple text files shared between user web browsers and the websites they use which contain unique user identification information and share that information with the website.20 When Facebo (...truncated)