• by Wendy Davis  @wendyndavis, July 5, 2018

Weighing in against Facebook, the advocacy group Electronic Privacy Information Center says a group of consumers should be allowed to pursue a privacy class-action against Facebook over allegations that the company tracked logged-out users.

"Users expect that their web browsing history will remain private -- no one imagines a marketing executive standing over their shoulder and taking notes as they use the Internet -- but the lower court improperly assumed otherwise," EPIC writes in a friend-of-the-court brief filed late last month with the 9th Circuit Court of Appeals.

The organization argues that U.S. District Court Judge Edward Davila in San Jose, California, who dismissed the consumers' case last year, "misunderstood" privacy law.

The battle dates to 2011, when users alleged in a class-action complaint that Facebook violated federal and state privacy laws -- as well as its own privacy policy -- by collecting data about people through its social widget. The consumers said Facebook gathered data about its users whenever they visited sites with a "Like" button, even if the users were logged out of the service.

The lawsuit came soon after Australian developer Nic Cubrilovic reported that Facebook was able to identify users via the "Like" button. At the time, Facebook said that a "bug" allowed the company to receive data about logged-out users. The company also promised to fix the bug, and said it never retained data that tied users' IDs to the sites they visited. (Facebook's practices subsequently changed. Currently, the company intentionally collects some information from logged-out users.)

Davila granted Facebook's request to dismiss the lawsuit. Among other reasons for his decision, he said that Facebook's users could have taken steps to prevent the tracking, such as by blocking cookies, using ""incognito mode" browser settings, or installing plug-in "browser enhancements."

"Facebook’s intrusion could have been easily blocked, but Plaintiffs chose not to do so," Davila wrote last year.

EPIC takes issue with that conclusion. "The court also misunderstood the purpose of privacy law, theorizing that users have an obligation to adopt complex, technological measures to assert privacy claims," EPIC writes. "That is what people do in the absence of law. That is why laws are enacted."