Weighing in against Facebook, the
advocacy group Electronic Privacy Information Center says a group of consumers should be allowed to pursue a privacy class-action against Facebook over allegations that the company tracked logged-out
users.
"Users expect that their web browsing history will remain private -- no one imagines a marketing executive standing over their shoulder and taking notes as they use the Internet -- but
the lower court improperly assumed otherwise," EPIC writes in a friend-of-the-court brief filed late last month with the 9th Circuit Court of Appeals.
The organization argues that U.S.
District Court Judge Edward Davila in San Jose, California, who dismissed the consumers' case last year, "misunderstood" privacy law.
The battle dates to 2011, when users alleged in a class-action complaint that Facebook violated federal and state
privacy laws -- as well as its own privacy policy -- by collecting data about people through its social widget. The consumers said Facebook gathered data about its users whenever they visited sites
with a "Like" button, even if the users were logged out of the service.
The lawsuit came soon after Australian developer Nic Cubrilovic reported that Facebook was able to identify users via
the "Like" button. At the time, Facebook said that a "bug" allowed the company to receive data about logged-out users. The company also promised to fix the bug, and said it never retained data that
tied users' IDs to the sites they visited. (Facebook's practices subsequently changed. Currently, the company intentionally
collects some information from logged-out users.)
Davila granted Facebook's request to dismiss the lawsuit. Among other reasons for his decision, he said that Facebook's users could have taken steps to prevent the tracking, such
as by blocking cookies, using ""incognito mode" browser settings, or installing plug-in "browser enhancements."
"Facebook’s intrusion could have been easily blocked, but Plaintiffs chose
not to do so," Davila wrote last year.
EPIC takes issue with that conclusion. "The court also misunderstood the purpose of privacy law, theorizing that users have an obligation to adopt
complex, technological measures to assert privacy claims," EPIC writes. "That is what people do in the absence of law. That is why laws are enacted."