• by Wendy Davis  @wendyndavis, August 15, 2008

Late last year, when Massachusetts resident Sean Lane bought a diamond ring for his wife on Overstock.com, it didn't remain a secret for long. News of the purchase--meant to be a surprise--was sent to more than 700 of his Facebook friends, thanks to the new Beacon ad platform.

At the time, Lane complained to the press that his Christmas had been ruined. Now, he's complaining to a judge.

Lane this week became one of 19 plaintiffs to file a potential class-action lawsuit against Facebook stemming from its much-maligned Beacon program, which told members about their friends' purchases on retail sites.

But whether Facebook is on the hook legally is not at all clear. That's because there are few U.S. laws that specifically protect people's right to privacy.

Lane's lawsuit, filed in federal district court in San Jose, Calif., relies on several statutes--including federal laws against electronic eavesdropping and computer fraud. But those are at best imperfect fits with Beacon, says privacy expert Bill McGeveran, a law professor at the University of Minnesota.

"What people objected to was that this program told your friends stuff about you without your permission," McGeveran said. "The lawyers have had to be pretty creative in assembling theories about why this might be unlawful."

He added that laws aimed at preventing eavesdropping or fraud are, at best, an "awkward fit" with actions such as disclosing that a Facebook member saw a particular movie.

Lane and the others charge that the Beacon program disclosed their purchases without their permission. Beacon originally operated on an opt-out basis, but the members allege that they did not have an adequate chance to decline to participate. The original opt-out mechanism was "wholly inadequate, uninformed, misleading, untimely, and deceptive," the complaint alleges. "The Beacon program was designed to be difficult, cumbersome, and time-consuming to block."

In early December, Facebook revised Beacon so that it would not operate unless users explicitly consented to share information. The lawsuit concerns only the period from Nov. 7 to Dec. 5, before the program became opt-in.

In addition to Facebook, Lane and the other plaintiffs also sued seven marketers that partnered with the company for the Beacon program: Blockbuster, Fandango, Hitwire, STA Travel, Overstock.com, Zappos.com, and Gamefly.

One of the specific laws mentioned in the complaint is the Electronic Communications and Privacy Act, which protects the privacy of e-mail and other electronic communications. But that law allows one party to the communication to authorize its disclosure. In the Beacon context, Facebook can argue that the users' consent was not required because the Web sites it partnered with authorized the spread of the information, McGeveran said.

Marc Rotenberg, executive director of the Electronic Privacy Information Center, argues that it's the consumer, and not the marketer, that must consent to disclosure under the Electronic Communications and Privacy Act. But at least one federal court has disagreed with that interpretation. In 2001, a court dismissed a privacy lawsuit against DoubleClick based on its collection of information about Web users. There, the court found that the Web sites affiliated with DoubleClick were authorized to consent to disclosure.

In the Facebook lawsuit, even if the court allows the case to go forward, there's the additional question of damages. Generally, damages for breach of privacy depend on the sensitivity of the disclosed information. Revealing someone's medical history might yield high damages, but the disclosures that occurred via Beacon seem more innocuous. "That you bought a particular sweater is probably not particularly sensitive," McGeveran said.

The plaintiffs might get further with one relatively narrow aspect of the lawsuit against Facebook--the alleged violations of the Video Privacy Protection Act. That statute, passed in 1988 after a newspaper obtained the video rental records of U.S. Supreme Court nominee Robert Bork, bans companies from sharing information about movie rentals and sales without first obtaining written consent. It also provides for damages of at least $2,500 for each violation.

Blockbuster is already facing a separate Beacon-related lawsuit accusing it of violating the federal video privacy law. That case is currently pending in federal district court in Texas. Facebook declined to comment on the new lawsuit other than to state that it had not yet been served with the complaint.