• by Wendy Davis  @wendyndavis, June 14, 2011

In the latest of a series of privacy lawsuits against Facebook, the company has been hit with a potential class-action for allegedly collecting information about Web users via the "Like" button -- a social widget that news organizations and other publishers began displaying last year.

"Unbeknownst to Internet users, Facebook uses the 'Like' button to track Internet users as they browse the Web and thereby collects private and, in some cases, sensitive information about them," California residents Ryan Ung, Chi Cheng and Alice Rosen allege in the complaint.

The lawsuit, which was quietly filed last month, was transferred to federal court in the Northern District of California late last week.

The complaint draws on the December research paper "Facebook tracks and traces everyone: Like this!" by Tilburg University researcher Arnold Roosendaal. In that piece, Roosendaal outlined how Facebook is able to track members -- and in some cases, non-members -- who visit sites with the "Like" widget, regardless of whether they click on the button.

The paper explained that when members visit sites with a Like button, Facebook ascertains their identities through cookies it previously placed on their computers, which contain their unique user IDs and are linked to their names.

For non-members, Facebook relies on a combination of Facebook Connect and the Like button for tracking, according to Roosendaal. When non-members visit sites with the Like widget, Facebook is able to track them if they have previously visited a site that participates in Facebook Connect -- an identity system that allows people to sign in to publishers' sites using their Facebook log-ins.

The sites that participate in the program set cookies regardless of whether users belong to Facebook, Roosendaal says. From that point forward, visits to sites with the Like button allegedly result in a Facebook cookie being set.

Although the lawsuit didn't refer to the piece, The Wall Street Journal reported last month that social widgets from Google and Twitter as well as Facebook collect browsing data about users even when they didn't click on the buttons. The companies said they weren't using the plug-in data to track users. Facebook and Google specifically said they "anonymize" the information.

The California consumers allege that Facebook violated their rights under their state's constitution, which provides for a right to privacy. "Plaintiffs had a legally protected interest in their personal Internet browsing history," the lawsuit alleges. "Plaintiffs reasonably expected that their browsing history would remain anonymous."

Facebook separately is defending another privacy class-action stemming from allegations that it transmits users' identities to advertisers via code in the referrer headers. U.S. District Court Judge James Ware in the Northern District of California recently dismissed the bulk of that case but without prejudice, meaning that the consumers could refile.

They did so on Monday, alleging that the social networking service violates its privacy policy by telling advertisers the identities of the people who click on their ads.

"When a Facebook advertiser receives a referrer header identifying the user who clicked an ad, the advertiser is essentially granted access to obtain substantial additional information about the user, such as the user's name, gender, picture, friends, networks, interests, photos and more," the consumers allege. "Facebook's systems send this information to advertisers, despite Facebook's privacy policy and its other representations as to users' privacy vis-à-vis advertisers."

Several years ago, Facebook agreed to create a privacy foundation to settle a class-action stemming from the Beacon program, which told users about their friends' e-commerce activity. But some users objected to that settlement and are now asking the 9th Circuit Court of Appeals to vacate it. That matter is still pending.