• by Wendy Davis  @wendyndavis, April 22, 2020

The fast-growing video chat app Houseparty has been hit with a class-action lawsuit for allegedly sharing data about users' devices with Facebook.

“Although Houseparty praises themselves on its application aiding in social distancing amid the coronavirus global pandemic and keeping customer data secure, Houseparty has failed to disclose to customers that it routinely discloses their personally identifiable information ... to unauthorized third parties, including social media network Facebook,” San Diego resident Heather Sweeney alleges in a class-action complaint filed last week against Houseparty parent company Epic Games.

The complaint, brought in U.S. District Court for the Southern District of California, centers on a feature that allows Houseparty users to connect their Facebook accounts to the Houseparty app.

Sweeney alleges that Facebook's connecting plugin enabled the social networking platform to gather device information about all Houseparty users, even ones without Facebook accounts.

Specifically, the plugin allegedly enabled Facebook to collect data including IP addresses, time zone details, and unique advertising identifiers. Sweeney's complaint refers to that data as “personally identifiable information.”

But some judges, including federal appellate judges in California, have ruled that device identifiers are not personally identifiable because they don't in themselves contain enough information to determine someone's name.

The complaint includes claims that Houseparty violated California's unfair competition law and the Consumer Privacy Act -- a new law that allows consumers to learn what personal information about them is held by businesses, request deletion of that information, and to opt out of its sale.

Claims related to the California Consumer Privacy Act may not get far in court.

That law, which took effect January 1, only authorizes consumers to bring private lawsuits over data breaches that result in the theft of especially sensitive information, including credit card numbers, social security numbers and medical information.

A Houseparty spokesperson says the company “recently changed its use of the Facebook (software development kit) to prevent it from sending advertising IDs of users that have not linked their Facebook accounts.”

The company adds that the use of Facebook's software development kit was disclosed in the historic Houseparty privacy policy; Houseparty revised its privacy policy on April 10.

"We believe the case is meritless and we will vigorously defend the suit," the spokesperson says.