Patel v. Facebook, Inc.

MOTION to Dismiss For Lack of Subject Matter Jurisdiction

N.D. Cal.June 29, 2016

FACEBOOK, INC.’S MOTION TO DISMISS FOR LACK OF SUBJECT-MATTER JURISDICTION; MASTER CASE NO. 3:15-CV-03747-JD 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 MAYER BROWN LLP John Nadolenco (SBN 181128) 350 South Grand Avenue 25th Floor Los Angeles, CA 90071-1503 Telephone: (213) 229-9500 jnadolenco@mayerbrown.com Lauren R. Goldman (pro hac vice) 1221 Avenue of the Americas New York, NY 10020 Telephone: (212) 506-2647 lrgoldman@mayerbrown.com Archis A. Parasharami (pro hac vice) 1999 K Street, N.W. Washington, D.C. 20006-1101 Telephone: (202) 263-3328 aparasharami@mayerbrown.com Counsel for Defendant Facebook, Inc. UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF CALIFORNIA SAN FRANCISCO DIVISION IN RE FACEBOOK BIOMETRIC INFORMATION PRIVACY LITIGATION THIS DOCUMENT RELATES TO: ALL ACTIONS Master Docket No.: 3:15-CV-03747-JD DEFENDANT FACEBOOK, INC.’S MOTION TO DISMISS UNDER RULE 12(b)(1) AND RULE 12(h)(3) FOR LACK OF SUBJECT MATTER JURISDICTION; MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT Date: September 14, 2016 Time: 10:00 a.m. Location: Courtroom 11 Hon. James Donato [Proposed Order filed concurrently herewith] Case 3:15-cv-03747-JD Document 129 Filed 06/29/16 Page 1 of 21 TABLE OF CONTENTS Page i FACEBOOK, INC.’S MOTION TO DISMISS FOR LACK OF SUBJECT-MATTER JURISDICTION; MASTER CASE NO. 3:15-CV-03747-JD 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 INTRODUCTION ......................................................................................................................... 1 STATEMENT OF THE ISSUE TO BE DECIDED...................................................................... 1 BACKGROUND ........................................................................................................................... 1 ARGUMENT................................................................................................................................. 3 I. UNDER SPOKEO, PLAINTIFFS’ ALLEGATIONS OF BARE STATUTORY VIOLATIONS ARE INSUFFICIENT TO ESTABLISH STANDING. ........................... 3 II. PLAINTIFFS’ CONCLUSORY ASSERTIONS ABOUT THE VALUE OF THEIR ALLEGED BIOMETRIC IDENTIFIERS DO NOT PLAUSIBLY ALLEGE A CONCRETE HARM..................................................................................... 6 III. PLAINTIFFS CANNOT SALVAGE THEIR COMPLAINT BY ASSERTING THAT THE ALLEGED STATUTORY VIOLATIONS HAVE CAUSED THEM INTANGIBLE HARM. ..................................................................................................... 8 A. A BIPA Violation Does Not Resemble A Claim Historically Recognized At Common Law.................................................................................................. 10 B. There Is No Evidence That The Illinois General Assembly Made A Determination That A BIPA Violation Always Constitutes Concrete Injury.................................................................................................................... 13 CONCLUSION............................................................................................................................ 15 Case 3:15-cv-03747-JD Document 129 Filed 06/29/16 Page 2 of 21 ii FACEBOOK, INC.’S MOTION TO DISMISS FOR LACK OF SUBJECT-MATTER JURISDICTION; MASTER CASE NO. 3:15-CV-03747-JD 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 TABLE OF AUTHORITIES Page(s) Cases Church of Lukumi Babalu Aye, Inc. v. City of Hialeah, 508 U.S. 520 (1993) ..................................................................................................................4 Clapper v. Amnesty Int’l, USA, 133 S. Ct. 1138 (2013)...............................................................................................................8 Douglas v. Cunningham, 294 U.S. 207 (1935).................................................................................................................14 Doe v. Chao, 540 U.S. 614 (2004).................................................................................................................14 Dwyer v. Am. Exp. Co., 273 Ill.App.3d 742 (1995) .......................................................................................................12 Edwards v. First Am. Corp., 610 F.3d 514 (9th Cir. 2010) .....................................................................................................3 Gubala v. Time Warner Cable, Inc., 2016 WL 3390415 (E.D. Wis. June 17, 2016)...........................................................................9 In re Barnes & Noble Pin Pad Litig., 2013 WL 4759588 (N.D. Ill. Sept. 3, 2013) ..............................................................................7 In re Doubleclick, Inc. Privacy Litig., 154 F. Supp. 2d 497 (S.D.N.Y. 2001)........................................................................................7 In re Facebook Internet Tracking Litig., 140 F. Supp. 3d 922 (N.D. Cal. 2015) .................................................................................6, 12 In re Google, Inc. Privacy Policy Litig., 2013 WL 6248499 (N.D. Cal. Dec. 3, 2013).......................................................................7, 13 In re iPhone Application Litig., 2011 WL 4403963 (N.D. Cal. Sept. 20, 2011) ....................................................................7, 12 In re JetBlue Airways Corp. Privacy Litig., 379 F. Supp. 2d 299 (E.D.N.Y. 2005) ......................................................................................7 In re Zappos.com, 108 F. Supp. 3d 949 (D. Nev. 2015)................................................................................6, 7, 13 Khan v. Children’s Nat’l Health Sys., 2016 WL 2946165 (D. Md. May 19, 2016)...................................................................7, 10, 13 LaCourt v. Specific Media, Inc., 2011 WL 1661532 (C.D. Cal. Apr. 28, 2011) .....................................................................7, 12 Case 3:15-cv-03747-JD Document 129 Filed 06/29/16 Page 3 of 21 iii FACEBOOK, INC.’S MOTION TO DISMISS FOR LACK OF SUBJECT-MATTER JURISDICTION; MASTER CASE NO. 3:15-CV-03747-JD 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Lee v. Am. Nat’l Ins. Co., 260 F.3d 997 (9th Cir. 2001) ...................................................................................................10 Lovgren v. Citizens First Nat’l Bank of Princeton, 126 Ill.2d 411 (1989) ...............................................................................................................11 Low v. LinkedIn Corp., 2011 WL 5509848 (N.D. Cal. Nov. 11, 2011) ...................................................................7, 12 Lujan v. Defenders of Wildlife, 504 U.S. 555 (1992)...................................................................................................................3 Machlan v. Procter & Gamble Co., 77 F. Supp. 3d 954 (N.D. Cal. 2015) .....................................................................................3, 6 Maglio v. Advocate Health & Hosps. Corp., 40 N.E.3d 746 (Ill. Ct. App. 2015) ..........................................................................................13 Pleasant Grove City v. Summum, 555 U.S. 460 (2009)...................................................................................................................4 Sandoval v. Pharmacare US, Inc., No. 15-cv-738 (S.D. Cal. June 10, 2016).................................................................................10 Smith v. Ohio State Univ., 2016 WL 3182675 (S.D. Ohio June 8, 2016) ............................................................................9 Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016)..................................................................................................... passim Sprint Commc’ns Co. v. APCC Servs., Inc., 554 U.S. 269 (2008) ................................................................................................................10 Vermont Agency of Natural Res. v. United States ex rel. Stevens, 529 U.S. 765 (2000).................................................................................................................10 Statutes and Rules 15 U.S.C. § 1681(a)(4)...................................................................................................................14 740 ILCS 14/15(a) ...................................................................................................................1, 2, 5 740 ILCS 14/15(b) ...................................................................................................................1, 2, 5 740 ILCS 14/20..........................................................................................................................3, 14 Fed. R. Civ. P. 12(b)(1)....................................................................................................................1 Fed. R. Civ. P. 12(h)(3)....................................................................................................................1 Other Authorities Restatement (Second) of Torts § 652A..........................................................................................11 Case 3:15-cv-03747-JD Document 129 Filed 06/29/16 Page 4 of 21 iv FACEBOOK, INC.’S MOTION TO DISMISS FOR LACK OF SUBJECT-MATTER JURISDICTION; MASTER CASE NO. 3:15-CV-03747-JD 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Restatement (Second) of Torts § 652B..........................................................................................11 Restatement (Second) of Torts § 652C..........................................................................................12 Restatement (Second) of Torts § 652D..........................................................................................12 Restatement (Second) of Torts § 652E ..........................................................................................12 William L. Prosser, Privacy, 48 Cal. L. Rev. 383 (1960) ......................................................................................................11 Samuel D. Warren and Louis D. Brandeis, The Right to Privacy, 4 Harv. L. Rev. 193 (1890) ......................................................................................................11 Case 3:15-cv-03747-JD Document 129 Filed 06/29/16 Page 5 of 21 1 FACEBOOK, INC.’S MOTION TO DISMISS FOR LACK OF SUBJECT-MATTER JURISDICTION; MASTER CASE NO. 3:15-CV-03747-JD 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 NOTICE OF MOTION & MOTION TO DISMISS TO ALL PARTIES AND THEIR COUNSEL OF RECORD: PLEASE TAKE NOTICE THAT, on September 14, 2016, at 10:00 a.m., before the Honorable James Donato, defendant Facebook, Inc. (“Facebook”) will and hereby does move under Federal Rules of Civil Procedure 12(b)(1) and 12(h)(3) for an order dismissing the consolidated complaint (Dkt. No. 40) for lack of subject matter jurisdiction. Under the Supreme Court’s recent decision in Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016), plaintiffs lack standing to sue. Spokeo has changed the law, overturning the Ninth Circuit’s prior rule that a plaintiff who alleges a bare statutory violation that relates to him or her in some way has satisfied the injury-in-fact requirement for Article III standing. The Supreme Court held in Spokeo that “Article III standing requires a concrete injury even in the context of a statutory violation.” Id. at 1549. Because plaintiffs have not alleged that they have suffered a concrete injury, they lack Article III standing to sue, and the consolidated complaint accordingly must be dismissed. Facebook’s motion is based on this notice of motion and motion, the accompanying memorandum of points and authorities, any reply memorandum that Facebook may file, the pleadings, papers and other documents on file in this action, and such other evidence and argument presented to the Court at or prior to the hearing in this matter. Case 3:15-cv-03747-JD Document 129 Filed 06/29/16 Page 6 of 21 1 FACEBOOK, INC.’S MOTION TO DISMISS FOR LACK OF SUBJECT-MATTER JURISDICTION; MASTER CASE NO. 3:15-CV-03747-JD 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 MEMORANDUM OF POINTS AND AUTHORITIES INTRODUCTION In Spokeo, Inc. v. Robins, the Supreme Court held that a plaintiff must allege “concrete” harm—which the Court described as harm that is “real” and “not abstract”—to establish Article III standing. 136 S. Ct. 1540, 1548 (2016). Reversing the Ninth Circuit’s “statutory violation automatically establishes standing” rule, the Court held that the allegation of a statutory violation does not by itself suffice to meet the “real” harm standard: “Article III standing requires a concrete injury even in the context of a statutory violation.” Id. at 1549. Plaintiffs’ amended complaint was drafted under the Ninth Circuit’s rule, and must be dismissed under Spokeo: Plaintiffs allege merely bare violations of the Illinois Biometric Information Privacy Act (BIPA). Specifically, they allege that Facebook failed to follow two of the BIPA’s procedural requirements: (i) to develop and publish a written policy governing the retention and destruction of biometric identifiers and biometric information (740 ILCS 14/15(a)); and (ii) to notify individuals of Facebook’s purported collection of biometric identifiers or information and obtain those individuals’ informed written consent (740 ILCS 14/15(b)). Compl. (Dkt. No. 40) ¶¶ 60-71. Plaintiffs do not allege that they suffered any “concrete injury” (Spokeo, 136 S. Ct. at 1549) as a result of these claimed statutory violations. Under Spokeo, that failure requires dismissal of plaintiffs’ claims for lack of subject matter jurisdiction under Rules 12(b)(1) and 12(h)(3). STATEMENT OF THE ISSUE TO BE DECIDED Whether plaintiffs have Article III standing to pursue their claims for alleged violations of the BIPA. BACKGROUND Facebook makes sharing photos more personal and social by allowing people to “tag” their friends in photos. Compl. ¶ 2. In 2010, Facebook launched a feature called “Tag Suggestions” as an alternative to manual tagging. Id. ¶¶ 3, 21. Plaintiffs allege that Tag Suggestions uses “facial recognition technology” to scan “user-uploaded photographs” and to derive from those photographs various information “about the geometry of [a person’s] face,” Case 3:15-cv-03747-JD Document 129 Filed 06/29/16 Page 7 of 21 2 FACEBOOK, INC.’S MOTION TO DISMISS FOR LACK OF SUBJECT-MATTER JURISDICTION; MASTER CASE NO. 3:15-CV-03747-JD 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 such as “the distance between their eyes, nose, and ears.” Id. ¶¶ 22-24. That information is then saved as a “template.” Id. ¶ 24. The feature can be turned off at any time (id. ¶¶ 27, 29), in which case Facebook will delete the template (“Tag Suggestions,” https://www.facebook.com/ help/463455293673370). If the tagged person leaves the feature enabled, Facebook uses the template data to simplify the tagging process by suggesting that the person be tagged when his or her Facebook friends upload other photos that feature him or her. Compl. ¶¶ 3, 21. Plaintiffs allege that by “extract[ing] . . . from user-uploaded photographs” “information about the geometry” of individuals’ faces, Facebook is collecting and retaining “biometric identifiers” within the meaning of the BIPA. Compl. ¶¶ 23-24, 63. Their claims rest on allegations that Facebook has violated the statute by failing to make the requisite disclosures to, and obtain adequate releases from, these individuals. Id. ¶¶ 60-71. Specifically, they allege that Facebook has violated two sections of the BIPA: • Section 15(a), which requires private entities in possession of biometric identifiers or biometric information to “develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information” (740 ILCS 14/15(a); Compl. ¶¶ 68-71); and • Section 15(b), which requires private entities to give notice and obtain consent before obtaining a person’s biometric identifier or biometric information (740 ILCS 14/15(b); Compl. ¶¶ 60-67). The complaint does not specify how any plaintiff was harmed by the alleged statutory violations, and instead offers only two abstract theories that relate in any way to injury. First, each plaintiff asserts that “Facebook misappropriated the value of his biometric identifiers” and that he has “suffered damages in the diminution in value of his sensitive biometric identifiers.” Id. ¶¶ 37-38, 44-45, 51-52. And second, in a number of places, plaintiffs assert that Facebook “disregard[ed]” or “violated” their “privacy rights.” Id. ¶¶ 5, 31, 66; see also id. ¶ 28. Case 3:15-cv-03747-JD Document 129 Filed 06/29/16 Page 8 of 21 3 FACEBOOK, INC.’S MOTION TO DISMISS FOR LACK OF SUBJECT-MATTER JURISDICTION; MASTER CASE NO. 3:15-CV-03747-JD 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Plaintiffs seek statutory damages of $5,000 per allegedly intentional and reckless violation (see 740 ILCS 14/20(2)) or (alternatively) statutory damages of $1,000 per allegedly negligent violation (see 740 ILCS 14/20(1)); plus declaratory and injunctive relief, litigation expenses and attorneys’ fees, and interest. See Compl. at 15-16 (Prayer for Relief). ARGUMENT In order to satisfy the “irreducible constitutional minimum” of Article III standing, “[t]he plaintiff must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.” Spokeo, 136 S. Ct. at 1547 (citing Lujan v. Defenders of Wildlife, 504 U.S. 555, 560-61 (1992)). The plaintiff “bears the burden of establishing these elements,” and “[w]here, as here, a case is at the pleading stage, the plaintiff must clearly allege facts demonstrating each element.” Id. (emphasis added) (quotation marks and ellipsis omitted); see also Machlan v. Procter & Gamble Co., 77 F. Supp. 3d 954, 959 (N.D. Cal. 2015) (“[A]t the motion to dismiss stage, Article III standing is adequately demonstrated through allegations of specific facts plausibly explaining why the standing requirements are met.”) (quotation marks omitted). Plaintiffs have failed to establish the first element: injury in fact. I. UNDER SPOKEO, PLAINTIFFS’ ALLEGATIONS OF BARE STATUTORY VIOLATIONS ARE INSUFFICIENT TO ESTABLISH STANDING. Until recently, the rule in the Ninth Circuit was that the allegation of a statutory violation that related to the plaintiff in some way was sufficient to establish injury in fact at the pleadings stage. See Edwards v. First Am. Corp., 610 F.3d 514, 517 (9th Cir. 2010), cert. granted sub nom. First Am. Fin. Corp. v. Edwards, 564 U.S. 1018 (2011), cert. dismissed as improvidently granted, 132 S. Ct. 2536 (2012) (per curiam). Plaintiffs’ amended complaint clearly was drafted with the Edwards standard in mind. But in Spokeo, the Supreme Court rejected that rule. Spokeo is a web-based search engine that retrieves publicly available information about individuals. The plaintiff in Spokeo brought a putative class action under the Fair Credit Reporting Act (FCRA), alleging that some of the information that Spokeo had disseminated Case 3:15-cv-03747-JD Document 129 Filed 06/29/16 Page 9 of 21 4 FACEBOOK, INC.’S MOTION TO DISMISS FOR LACK OF SUBJECT-MATTER JURISDICTION; MASTER CASE NO. 3:15-CV-03747-JD 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 about him was inaccurate. Spokeo, 136 S. Ct. at 1544. The Ninth Circuit held that the plaintiff had standing to sue under Edwards because the plaintiff’s allegation that Spokeo disseminated inaccurate information about him constituted a claim that “Spokeo violated his statutory rights [under FCRA], not just the statutory rights of other people,” and that nothing more was required. Id. at 1546 (quotation marks omitted). The Supreme Court reversed, explaining that the court of appeals had erred by focusing exclusively on whether the injury was “particularized” and ignoring the “concreteness” requirement of injury in fact. To satisfy this requirement, the plaintiff must demonstrate that the injury “actually exist[s]” and that it is “‘real,’ and not ‘abstract.’” Id. at 1548 (emphasis added). “[T]angible injuries”—such as physical harm, or the loss of money or property—of course qualify as “concrete.” Id. at 1549. And, the Supreme Court pointed out, prior decisions of the Court identified particular types of intangible injuries that are concrete—such as depriving someone of the ability to engage in free speech or the free exercise of religion. Id. (citing Pleasant Grove City v. Summum, 555 U.S. 460 (2009) (free speech); Church of Lukumi Babalu Aye, Inc. v. City of Hialeah, 508 U.S. 520 (1993) (free exercise)). The Court then went on to explain that an alleged statutory violation that affects the plaintiff, standing alone, is not sufficient to qualify as a concrete harm. A plaintiff does not “automatically satisf[y] the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right. Article III standing requires a concrete injury even in the context of a statutory violation.” Spokeo, 136 S. Ct. at 1549. Spokeo thus holds that a plaintiff has standing to bring a statutory claim only when the asserted violation encompasses an allegation of concrete harm—either because (1) an element of the cause of action requires proof of such a harm, and the plaintiff alleges facts sufficient to establish that element (see id. at 1549-50); or (2) the plaintiff separately alleges facts establishing a concrete harm (see id. at 1549). Plaintiffs satisfy neither of these requirements. Neither of the statutory provisions invoked by plaintiffs in the complaint requires proof of concrete harm to establish a violation: Case 3:15-cv-03747-JD Document 129 Filed 06/29/16 Page 10 of 21 5 FACEBOOK, INC.’S MOTION TO DISMISS FOR LACK OF SUBJECT-MATTER JURISDICTION; MASTER CASE NO. 3:15-CV-03747-JD 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Section 15(a). Section 15(a) of BIPA requires the development and publication of a written policy governing the retention and destruction of biometric identifiers or biometric information (740 ILCS 14/15(a)); it does not require any proof of injury to establish a violation. Plaintiffs agree: they allege that Section 15(a) was violated because, “[f]or users who do not opt- out of Tag Suggestions, Facebook does not publicly provide a retention schedule or guidelines for permanently destroying their biometric identifiers as specified by the BIPA.” Compl. ¶ 70. Plaintiffs do not allege that Facebook’s purported failure to adopt a written policy with the precise details required under the BIPA has affected them in any way—much less that it caused them to suffer a “real harm.” Spokeo, 136 S. Ct. at 1549. Section 15(b). Concrete harm similarly is not an element of the notice-and-consent provision of BIPA, Section 15(b): that section requires a private entity that obtains a person’s biometric identifier or biometric information to inform the person in writing that the data is being collected or stored; disclose the purpose and length of time of the collection, storage, and use; and obtain a written release. 740 ILCS 14/15(b). After marching through these statutory elements, plaintiffs allege only that the statute was violated because Facebook failed to “properly inform Plaintiffs . . . in writing that their biometric identifiers were being collected and stored” and to “obtain[] the specific written release required by 740 ILCS 14/15(b)(3)” before doing so. Compl. ¶¶ 64-65. They do not suggest that this provision requires proof of concrete harm; nor do they allege any such harm. Plaintiffs’ bare allegations of BIPA violations are insufficient to support standing, because the statutory provisions do not require proof of concrete harm. Accordingly, Article III would be satisfied only if the other allegations in the complaint were sufficient to establish that plaintiffs have suffered a concrete harm. Spokeo, 136 S. Ct. at 1549; p. 4, supra. As we next discuss, they are not. Case 3:15-cv-03747-JD Document 129 Filed 06/29/16 Page 11 of 21 6 FACEBOOK, INC.’S MOTION TO DISMISS FOR LACK OF SUBJECT-MATTER JURISDICTION; MASTER CASE NO. 3:15-CV-03747-JD 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 II. PLAINTIFFS’ CONCLUSORY ASSERTIONS ABOUT THE VALUE OF THEIR ALLEGED BIOMETRIC IDENTIFIERS DO NOT PLAUSIBLY ALLEGE A CONCRETE HARM. Each of the three plaintiffs asserts that “Facebook misappropriated the value of his biometric identifiers” and that he has “suffered damages in the diminution in value of his sensitive biometric identifiers.” Compl. ¶¶ 37-38, 44-45, 51-52. Even before Spokeo, it was clear that these assertions—apparently attempts to allege tangible harm—do not satisfy the requirement of concrete injury. Plaintiffs’ assertions are entirely conclusory, and are unaccompanied by any allegations of “specific facts plausibly explaining” how their biometric identifiers have diminished in value as a result of Facebook’s alleged conduct. Machlan, 77 F. Supp. 3d at 959 (quotation marks omitted). Many courts have repeatedly and specifically rejected “generalized assertions of economic harm based solely on the alleged value of personal information.” In re Facebook Internet Tracking Litig., 140 F. Supp. 3d 922, 930 (N.D. Cal. 2015) (“Facebook Internet”). In Facebook Internet, the plaintiffs alleged that “Facebook intentionally intercepted Plaintiffs’ personally identifiable data without consent. Thus, . . . Plaintiffs have also suffered damages as a result of the decreased value of their data in the marketplace.” Corrected First Amended Consolidated Class Action Complaint, ¶ 125, In re Facebook Internet Tracking Litig., No. 12- md-2314 (N.D. Cal. May 23, 2012), Dkt. No. 35. Judge Davila explained that this was insufficient to establish Article III standing, because the plaintiffs had not alleged “that they personally lost the opportunity to sell their information or that the value of their information was somehow diminished after it was collected by Facebook.” 140 F. Supp. 3d at 931-32. Judge Davila’s opinion is in accord with numerous other decisions from district courts in this Circuit. Even where—unlike in this case—a plaintiff alleges that his personal information has been disclosed to or accessed by third parties, courts have found no standing in the absence of factual allegations demonstrating that the plaintiff suffered concrete harm as a result of that breach. In In re Zappos.com, for instance, the court held that the plaintiffs lacked standing based on assertions “that [a] data breach resulted in a devaluation of their personal information” and Case 3:15-cv-03747-JD Document 129 Filed 06/29/16 Page 12 of 21 7 FACEBOOK, INC.’S MOTION TO DISMISS FOR LACK OF SUBJECT-MATTER JURISDICTION; MASTER CASE NO. 3:15-CV-03747-JD 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 “that a ‘robust market’ exists for the sale and purchase of consumer data such as the personal information that was stolen during the breach.” 108 F. Supp. 3d 949, 954 (D. Nev. 2015) (citing the complaint). The court did “not buy this argument,” because “[e]ven assuming that Plaintiffs’ data has value,” they “d[id] not allege any facts explaining how their personal information became less valuable . . . or that they attempted to sell their information and were rebuffed because of” the breach. Id.1 Likewise, Judge Koh held in Low v. LinkedIn Corp. that the plaintiff lacked standing based on his allegations that LinkedIn had disclosed his browsing history to third party advertisers and that “his browsing history is personal property with market value.” 2011 WL 5509848, at *4 (N.D. Cal. Nov. 11, 2011). These allegations were “too abstract and hypothetical to support Article III standing,” because the plaintiff failed to explain “how he was ‘deprived of the economic value of [his] personal information simply because [it] was purportedly collected by a third party.’” Id. at *4-5 (emphasis added; quoting LaCourt v. Specific Media, Inc., 2011 WL 1661532, at *5 (C.D. Cal. Apr. 28, 2011)). The court noted that its conclusion was in accord with “[o]ther cases, analyzing similar legal issues, [that] have held that unauthorized collection of personal information does not create an economic loss.” Id. at *5 (citing In re iPhone Application Litig., 2011 WL 4403963, at *5 (N.D. Cal. Sept. 20, 2011); In re Doubleclick, Inc. Privacy Litig., 154 F. Supp. 2d 497, 525 (S.D.N.Y. 2001); In re JetBlue Airways Corp. Privacy Litig., 379 F. Supp. 2d 299, 327 (E.D.N.Y. 2005)). Finally, in In re Google, Inc. Privacy Policy Litigation, 2013 WL 6248499 (N.D. Cal. Dec. 3, 2013), the court rejected the argument that standing was satisfied because Google “profited from” using and combining the personal information collected from the plaintiffs’ 1 Data breach cases from other circuits are in accord as well. See, e.g., Khan v. Children’s Nat’l Health Sys., 2016 WL 2946165, at *6 (D. Md. May 19, 2016) (“[Plaintiff] alleges that the value of her personally identifiable information has been diminished by the data breach. She does not, however, explain how the hackers’ possession of that information has diminished its value, nor does she assert that she would ever actually sell her own personal information.”); In re Barnes & Noble Pin Pad Litig., 2013 WL 4759588, at *5 (N.D. Ill. Sept. 3, 2013) (“Plaintiffs’ claim of injury in the form of deprivation of the value of their PII” is “insufficient to establish standing,” because “Plaintiffs do not allege their personal information was sold, nor do they allege the information could be sold by Plaintiffs for value.”). Case 3:15-cv-03747-JD Document 129 Filed 06/29/16 Page 13 of 21 8 FACEBOOK, INC.’S MOTION TO DISMISS FOR LACK OF SUBJECT-MATTER JURISDICTION; MASTER CASE NO. 3:15-CV-03747-JD 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Google accounts and search queries. Id. at *5-6. “[I]njury-in-fact in this context requires more than an allegation that a defendant profited from a plaintiff’s personal identification information. Rather, a plaintiff must allege how the defendant’s use of the information deprived the plaintiff of the information’s economic value.” Id. at *5. Because the plaintiffs had “not alleged how Google’s use of PII in any way deprives them of the ability to profit from the same information,” they lacked standing on the basis of this theory. Id. at *6. The reasoning in the above cases confirms that plaintiffs’ generalized allegation of injury here is far too abstract and speculative to support standing, because it relies on a chain of unfounded (and unalleged) assumptions: (a) that plaintiffs’ alleged biometric identifiers have inherent value; (b) that plaintiffs have the ability to sell their biometric identifiers to unspecified third-party buyers; (c) that plaintiffs would actually choose to sell their biometric identifiers to those buyers; and (d) that those buyers would pay less for those identifiers than they would have absent Facebook’s alleged conduct. This “highly attenuated chain of possibilities” falls far short of the concrete injury Article III demands. Clapper v. Amnesty Int’l, USA, 133 S. Ct. 1138, 1148 (2013). Indeed, the Court in Clapper—which the Spokeo Court specifically cited—“decline[d] to abandon [its] usual reluctance to endorse standing theories that rest on speculation about the decisions of independent actors,” like the unknown individuals or entities who plaintiffs hypothesize would be interested in purchasing their biometric identifiers. Id. at 1150. That reasoning controls and applies with equal force here. III. PLAINTIFFS CANNOT SALVAGE THEIR COMPLAINT BY ASSERTING THAT THE ALLEGED STATUTORY VIOLATIONS HAVE CAUSED THEM INTANGIBLE HARM. The complaint contains a handful of allegations that Facebook’s conduct violates unspecified “privacy rights” possessed by plaintiffs. Compl. ¶¶ 5, 31, 66; see also id. ¶ 28. But plaintiffs’ vague incantation of “privacy rights” is just a restatement of their statutory claim: they claim their privacy rights were violated because BIPA was violated. Plaintiffs allege that the Tag Suggestions feature collects and stores information about their faces from user-uploaded photographs. But plaintiffs have offered no specific or coherent allegations explaining how this Case 3:15-cv-03747-JD Document 129 Filed 06/29/16 Page 14 of 21 9 FACEBOOK, INC.’S MOTION TO DISMISS FOR LACK OF SUBJECT-MATTER JURISDICTION; MASTER CASE NO. 3:15-CV-03747-JD 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 collection and storage actually affects their privacy—much less causes them concrete harm. They have not alleged, for example, that as a direct result of Tag Suggestions, they were identified in an embarrassing photo and therefore fired from their jobs; that they were victims of identity theft; or that they were caught in a compromising situation that adversely—and concretely—affected their relationships. Plaintiffs cannot avoid Spokeo’s requirement of “real” and “not abstract” harm simply by substituting the phrase “violation of privacy rights” for “violation of statutory rights.” Nevertheless, they may attempt to salvage their complaint by arguing that a BIPA violation causes an intangible injury to “privacy rights” that, standing alone, is sufficient to qualify as a concrete harm. See Spokeo, 136 S. Ct. at 1549. The Court should reject any such attempt.2 In Spokeo, the Court observed that in determining whether an intangible injury that gives rise to a statutory claim “constitutes injury in fact, both history and the judgment of Congress play important roles,” and went on to describe these two inquiries. 136 S. Ct. at 1549. First, “[b]ecause the doctrine of standing derives from the case-or-controversy requirement, and because that requirement in turn is grounded in historical practice, it is instructive to consider whether an alleged intangible harm has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts.” Id. Second, “because Congress is well positioned to identify intangible harms that meet minimum Article III 2 Federal district courts are already applying Spokeo to hold that similar allegations do not establish standing. In one case, the court dismissed for lack of standing a complaint alleging that the defendant “collected personal information” from consumers and failed to destroy it in violation of the Cable Communications Policy Act. Gubala v. Time Warner Cable, Inc., 2016 WL 3390415, at *1 (E.D. Wis. June 17, 2016). The plaintiff alleged that “consumers value their personally identifiable information—and the privacy of that information—very highly.” Id. at *4. That did not suffice, the court explained, because the allegations “do[] not demonstrate that the plaintiff has suffered a concrete injury.” Id. Indeed, the allegations suffered from several fatal flaws, all of which are equally present here: the plaintiff “d[id] not allege that the defendant has disclosed his information to a third party,” and “[e]ven if he had alleged such a disclosure, he d[id] not allege that the disclosure caused him any harm.” Id. Nor did the plaintiff “allege that he has been contacted by marketers who obtained his information from the defendant, or that he has been the victim of fraud or identity theft.” Id. In light of these deficiencies, the court dismissed the plaintiff’s claim under “the clear directive in Spokeo.” Id. at *5; see also Smith v. Ohio State Univ., 2016 WL 3182675, at *4 (S.D. Ohio June 8, 2016) (allegations that the plaintiffs “suffered harm when their ‘privacy was invaded and they were misled as to their rights under the FCRA’” failed to establish standing, because the plaintiffs “did not suffer a concrete consequential damage as a result of [defendant’s] alleged breach of the FCRA”). Case 3:15-cv-03747-JD Document 129 Filed 06/29/16 Page 15 of 21 10 FACEBOOK, INC.’S MOTION TO DISMISS FOR LACK OF SUBJECT-MATTER JURISDICTION; MASTER CASE NO. 3:15-CV-03747-JD 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 requirements, its judgment is also instructive and important.” Id. The ultimate question, of course, is one to be “determin[ed]” by the court. Id. Here, neither of these factors supports a finding of standing.3 A. A BIPA Violation Does Not Resemble A Claim Historically Recognized At Common Law. Privacy concerns based on the collection and storage of information from uploaded photographs do not bear “a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts.” Spokeo, 136 S. Ct. at 1549. That is because “the doctrine of standing derives from the case-or-controversy requirement” and “that requirement in turn is grounded in historical practice” at the time the Constitution was adopted. Id. In discussing the importance of “historical practice” (id.), the Court in Spokeo cited its opinion in Vermont Agency of Natural Resources v. United States ex rel. Stevens, 529 U.S. 765, 774-77 (2000), which examined “the long tradition of qui tam actions in England and the American Colonies,” including “in the period immediately before and after the framing of the Constitution” (emphasis added). See also id. at 774 (“[T]he Constitution established that ‘judicial power could come into play only in matters that were the traditional concern of the courts at Westminster . . . .”) (alterations omitted); Sprint Commc’ns Co. v. APCC Servs., Inc., 3 Spokeo involved a federal statute, but the Court’s reasoning necessarily applies to cases involving state statutes. One federal district court has already reached that conclusion, applying Spokeo to hold that the plaintiff lacked Article III standing in a data breach case alleging state statutory and common-law violations. Khan, 2016 WL 2946165, at *7 (noting that the plaintiff had “advance[d] no authority for the proposition that a state legislature or court, through a state statute or cause of action, can manufacture Article III standing for a litigant who has not suffered a concrete injury”); see also Order Denying Motion For Class Certification, at 14, Sandoval v. Pharmacare US, Inc., No. 15-cv-738 (S.D. Cal. June 10, 2016), Dkt. No. 56 (applying Spokeo in holding that plaintiffs could not certify a class for alleged violations of both federal and state statutes as well as common-law claims in connection with the marketing and labeling of the defendant’s product, in part because “the class includes consumers who have no cognizable injury, including those who obtained full refunds”) (citing Spokeo, 136 S. Ct. at 1549). Certainly a state legislature’s authority to confer standing could not be greater than Congress’s. As the Ninth Circuit held in a case brought under a California statute, “a plaintiff whose cause of action is perfectly viable in state court under state law may nonetheless be foreclosed from litigating the same cause of action in federal court, if he cannot demonstrate the requisite injury” required by Article III. Lee v. Am. Nat’l Ins. Co., 260 F.3d 997, 1001-02 (9th Cir. 2001). Case 3:15-cv-03747-JD Document 129 Filed 06/29/16 Page 16 of 21 11 FACEBOOK, INC.’S MOTION TO DISMISS FOR LACK OF SUBJECT-MATTER JURISDICTION; MASTER CASE NO. 3:15-CV-03747-JD 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 554 U.S. 269, 274-75 (2008) (“[I]n crafting Article III, the framers gave merely the outlines of what were to them the familiar operations of the English judicial system and its manifestations on this side of the ocean before the Union.”) (emphasis added; alterations and quotation marks omitted). Thus, the reference to “historical practice” in Spokeo refers to the types of harms that at the time of the founding would have been recognized as forming the basis of a lawsuit. In contrast to the qui tam actions at issue in Vermont Agency, a claim based on privacy concerns would have been unrecognizable to the Framers of the Constitution or even throughout most of the nineteenth century, because “[p]rior to 1890 no English or American court had ever expressly recognized the existence of the right [to privacy].” Restatement (Second) of Torts § 652A cmt. a. Rather, common-law privacy claims have their origins in a law review article published in 1890—over a century after the founding. See id. (citing Samuel D. Warren and Louis D. Brandeis, The Right to Privacy, 4 Harv. L. Rev. 193 (1890)). Nor does plaintiffs’ cause of action resemble any of the dignitary and emotional privacy harms first recognized in the nineteenth century, which fit into four carefully delineated categories: (1) “unreasonable intrusion upon the seclusion of another”; (2) “appropriation of the other’s name or likeness”; (3) “unreasonable publicity given to the other’s private life”; and (4) “publicity that unreasonably places the other in a false light before the public.” Restatement (Second) of Torts § 652A; accord William L. Prosser, Privacy, 48 Cal. L. Rev. 383, 389 (1960) (articulating same four categories). Plaintiffs’ BIPA claim does not bear a “close relationship” to any of these torts, each of which requires a showing of far more serious and concrete injury than plaintiffs have alleged here. Plaintiffs have not alleged, for example, that Facebook has engaged in the kinds of “highly offensive” prying that are required for an intrusion upon seclusion claim—such as “physical intrusion” into a plaintiff’s home or hotel room; peering into the plaintiff’s windows or tapping his phones; “searching his safe or his wallet”; or “examining his private bank account.” Restatement (Second) of Torts § 652B & cmts. b, d; accord Lovgren v. Citizens First Nat’l Bank Case 3:15-cv-03747-JD Document 129 Filed 06/29/16 Page 17 of 21 12 FACEBOOK, INC.’S MOTION TO DISMISS FOR LACK OF SUBJECT-MATTER JURISDICTION; MASTER CASE NO. 3:15-CV-03747-JD 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 of Princeton, 126 Ill.2d 411, 416-17 (1989).4 Nor have plaintiffs alleged specific facts plausibly explaining how Facebook’s alleged BIPA violations deprived them of the “value” of their identities, as required for a misappropriation claim. Restatement (Second) of Torts § 652C cmt. c (emphasis added); accord Dwyer v. Am. Exp. Co., 273 Ill.App.3d 742, 749 (1995); Part II, supra. Plaintiffs have not alleged that Facebook has disclosed information about them to the public, an indispensable element of an unreasonable publicity claim and a false light claim. Restatement (Second) Torts §§ 652D & cmt. a, 652E & cmt. a. Quite the contrary: Tag Suggestions are displayed only to a person’s Facebook friends: people they know and have chosen to connect with. Plaintiffs could not bring a common-law privacy claim in the twentieth or twenty-first centuries either: modern precedents confirm that privacy concerns of the kind plaintiffs allege here fall far short of satisfying Article III standing. Courts in this Circuit have routinely dismissed, for lack of standing, common-law claims based upon privacy concerns about the alleged collection of personal information. The courts have imposed two prerequisites for a finding of standing in such cases. First, the plaintiff must offer specific allegations showing that sensitive information was disclosed to or stolen by third parties.5 Second, even where that 4 The complaint’s lack of allegations amounting to a highly offensive intrusion on plaintiffs’ solitude is further confirmed by plaintiffs’ acknowledgement (Compl. ¶¶ 29, 70) that they (and other individuals with Facebook accounts) can “opt-out” of the Tag Suggestions feature altogether. 5 See, e.g., Facebook Internet, 140 F. Supp. 3d at 929-32 (no standing for “data privacy” claims that Facebook collected and tracked plaintiffs’ Internet browsing histories without their consent); Low, 2011 WL 5509848, at *1, *6 (same for allegations that LinkedIn tracked its “users’ personally identifiable browsing history and other personal information” and transmitted it to third party advertisers through the use of “cookies” or “beacons”; the plaintiff had not “alleged that his sensitive personal information has been exposed to the public” and “failed to put forth a coherent theory of how his personal information was disclosed or transferred to third parties, and how it has harmed him”); In re iPhone Application Litig., 2011 WL 4403963, at *1, 4-6 (same for allegations that “Defendants violated [plaintiffs’] privacy rights by unlawfully allowing third party applications” on their iPhones and iPads “to collect and make use of, for commercial purposes, personal information without user consent or knowledge”; plaintiffs “d[id] not identify what harm (if any) resulted from the access or tracking of their personal information” or “articulate[] a coherent and factually supported theory of injury” based on “the alleged collection and tracking of their personal information”); LaCourt, 2011 WL 1661532, at *3-6 (same for allegations that the defendant harmed plaintiffs by using their personal information for targeted advertising). Case 3:15-cv-03747-JD Document 129 Filed 06/29/16 Page 18 of 21 13 FACEBOOK, INC.’S MOTION TO DISMISS FOR LACK OF SUBJECT-MATTER JURISDICTION; MASTER CASE NO. 3:15-CV-03747-JD 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 requirement is met, the courts have demanded specific allegations of actual harm arising from those disclosures. 6 Plaintiffs have not satisfied—and cannot satisfy—these requirements, because they allege only that Facebook has collected information without complying with BIPA’s notice-and-consent requirements. In sum, the injury-in-fact requirement is “a significant barrier to entry” to common-law “data privacy claims.” In re Google, Inc. Privacy Policy Litig., 2013 WL 6248499, at *4. Under Spokeo, the same barrier now applies to claimed statutory violations—and plaintiffs cannot hurdle it here. B. There Is No Evidence That The Illinois General Assembly Made A Determination That A BIPA Violation Always Constitutes Concrete Injury. There is no evidence that in enacting BIPA the Illinois General Assembly determined that a violation of that statute’s requirements, standing alone, should constitute an intangible but concrete injury that would “meet minimum Article III requirements.” Spokeo, 136 S. Ct. at 1549.7 The General Assembly’s intent to regulate biometric technologies, and its consequent imposition of procedural requirements on entities that employ those technologies, standing alone, cannot be equated with a determination that a violation of those requirements “work[s] any concrete harm.” Id. at 1550.8 6 See, e.g., In re Zappos.com, 108 F. Supp. 3d at 951, 962 n.5 (no standing to sue for privacy violations where hackers stole the data of “24 million Zappos customers,” including their “names, account numbers, passwords, email addresses, billing and shipping addresses, phone numbers, and the last four digits of their credit cards”; plaintiffs failed to show that alleged loss of privacy “amount[ed] to a concrete and particularized injury”); see also Khan, 2016 WL 2946165, at *1, *6 (no standing to sue for privacy violations where hackers had obtained “patient information” from the defendant’s hospital, “such as names, addresses, dates of birth, Social Security numbers, and telephone numbers, as well as private health care information”; the plaintiff “argu[ed] that the data breach has caused a loss of privacy that constitutes an injury in fact,” but “ha[d] not identified any potential damages arising from such a loss and thus fail[ed] to allege a concrete and particularized injury”) (quotation marks omitted). 7 Because BIPA does not embody the requisite legislative determination, there is no occasion for this Court to determine whether a state legislature is entitled to the same deference as Congress with respect to identifying intangible injuries that may be sufficient to institute an action in federal court. 8 Illinois follows federal principles of standing. Under Illinois law, like under Article III, “[s]tanding requires some injury in fact to a legally cognizable interest.” Maglio v. Advocate Health & Hosps. Corp., 40 N.E.3d 746, 752-53 (Ill. Ct. App. 2015) (citing Greer v. Ill. Hous. Dev. Auth., 122 Ill.2d 462, 492-93 (1988)). “Federal standing principles are similar to those in Case 3:15-cv-03747-JD Document 129 Filed 06/29/16 Page 19 of 21 14 FACEBOOK, INC.’S MOTION TO DISMISS FOR LACK OF SUBJECT-MATTER JURISDICTION; MASTER CASE NO. 3:15-CV-03747-JD 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Again, plaintiffs do not “automatically satisf[y] the injury-in-fact requirement” simply because a legislature created “a statutory right and purport[ed] to authorize [a] person to sue to vindicate that right.” Id. at 1549. Thus, as the Supreme Court explained, even though the FCRA’s procedural requirements are designed “to curb the dissemination of false information”—a legislative policy interest just as strong as the protection of biometric information—“[a] violation of one of the FCRA’s procedural requirements may result in no [concrete] harm” and thus no standing. Id. at 1550. That is so even though Congress expressly found in enacting FCRA that “[t]here is a need to insure that consumer reporting agencies exercise their grave responsibilities with fairness, impartiality, and a respect for the consumer’s right to privacy.” 15 U.S.C. § 1681(a)(4). This Court’s conclusion that BIPA has a “broad purpose of protecting privacy in the face of emerging biometric technology” similarly does not advance plaintiffs’ position on standing. Dkt. No. 120, at 22.9 Nothing in the text or history of BIPA suggests an intent to open the courthouse doors to individuals who have not suffered any real harm. The existence of a private right of action (also present in the FCRA) cannot be enough to demonstrate such an intent: if it were, that would completely eviscerate the Supreme Court’s holding that a plaintiff does not “automatically satisf[y] the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right.” Spokeo, 136 S. Ct. at 1549. Nor does the fact that the Illinois General Assembly authorized statutory damages (740 ILCS 14/20) mean that the legislature intended to eliminate or relax the concrete-injury requirement. The availability of statutory damages does not serve as a substitute for proof of injury; the provision simply relieves plaintiffs of the problem of quantifying damages. See Doe v. Chao, 540 U.S. 614, 625 (2004) (statutory damages serve “as a form of presumed damages not requiring proof of amount”); see also, e.g., Douglas v. Cunningham, 294 U.S. 207, 209 (1935). Illinois, and the case law is instructive.” Id. at 753. Accordingly, the Illinois General Assembly was legislating against the backdrop of the injury-in-fact requirement, and if it had intended to make a determination that any violation of the BIPA’s requirements automatically causes concrete harm, it would have said so expressly. 9 Facebook respectfully disagrees with that view of the statute for the reasons explained in its prior briefing (see Dkt. No. 69, at 13-15; Dkt. No. 76, at 9-10). Case 3:15-cv-03747-JD Document 129 Filed 06/29/16 Page 20 of 21 15 FACEBOOK, INC.’S MOTION TO DISMISS FOR LACK OF SUBJECT-MATTER JURISDICTION; MASTER CASE NO. 3:15-CV-03747-JD 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 No member of the Spokeo Court suggested that the availability of statutory damages under the FCRA, without more, satisfies Article III. The same is necessarily true of the availability of statutory damages under BIPA. CONCLUSION The consolidated amended complaint should be dismissed for lack of subject matter jurisdiction. Dated: June 29, 2016 MAYER BROWN LLP By: /s/ John Nadolenco John Nadolenco Lauren R. Goldman Archis A. Parasharami Counsel for Defendant Facebook, Inc. Case 3:15-cv-03747-JD Document 129 Filed 06/29/16 Page 21 of 21