Facebook faces nationwide class action tracking cookie lawsuit

Facebook faces nationwide class action tracking cookie lawsuit

Summary: Facebook is once again being sued for tracking its users even after they logged out of the service. This new nationwide class action lawsuit alleges the company violated federal wiretap laws.


Facebook users are suing the social networking giant over allegations that it violates federal wiretap laws. In addition to several lawsuits filed in multiple states, including Kansas, Kentucky, Louisiana, and Mississippi, the company is now facing a nationwide class action lawsuit. Law firms Murphy PA and Girard Gibbs have made their case in the U.S. District Court for the Northern District of California, accusing Facebook of continuing to ignore concerns over its tracking cookies. They argue the company violates its own privacy policy, which states post-log-out activity is not tracked by the social networking giant.

Facebook has been accused multiple times of using cookies to track users even after they log out of the service. Menlo Park has since twice denied the allegations, and has also twice fixed the issue. Nevertheless, the lawsuits just keep coming.

Like the previous lawsuits, Facebook is once again being accused of violating the Federal Wiretap Act. Additionally, this nationwide class action lawsuit says Facebook violates the California Internet Privacy Requirements Act and the California Unfair Competition Law. It's worth noting that similar cases against Facebook and others filed under the wiretap law have been thrown out because browser cookies are simply not considered wiretaps and plaintiffs have difficulty proving any harm.

"The days when online service providers can run roughshod over the privacy rights of their customers are over," William Murphy Jr., founding partner of Murphy PA, said in a statement. "Companies that operate commercial websites, such as Facebook, need to realize the public is increasingly concerned about its privacy rights. Perhaps even more importantly, there is a growing community of security experts and bloggers that is extremely savvy about internet technology and committed to ensuring that people’s privacy rights are respected and protected."

In September 2011, self-proclaimed hacker Nik Cubrilovic accused Facebook of tracking its users even if they log out of the social network. He explained that even after logging out of the service, whenever he visited a website that had a Facebook plugin, information including his account ID was still being sent to Palo Alto.

The company responded by denying the claims and offering an explanation as to why its cookies behave the way they do. Menlo Park explained that it does not track users across the Web and its cookies are used to personalize content. As for the logged-out cookies, Facebook said they are used for safety and protection.

After a long technical discussion, Cubrilovic confirmed Facebook made changes to the logout process, and that the cookies in question behave as they should. They still exist, but they no longer send back personally-identifiable information after you log out. The company also took the time to explain what each cookie is responsible for.

Later that month, 10 privacy groups and US congressmen sent letters asking the Federal Trade Commission (FTC) to investigate Facebook for these and other practices. Note that the FTC settlement from November 2011 was over charges that date back to December 2009, meaning the tracking cookie issue was never discussed.

In October 2011, the issue came back. It was discovered that the datr cookie, which can be used for tracking users, was once again being set on third-party websites with a Facebook social plugin – whether you are logged in or logged out of the service. Facebook confirmed the bug, said only some third-party websites were affected, and fixed it.

Also in September, Ireland's Data Protection Commissioner (DPC) agreed to conduct a privacy audit of Facebook. Since the social network giant's international headquarters is in Dublin, the larger majority of the site's users are affected by any of the DPC's decisions (see Europe versus Facebook). Thankfully for Facebook, when the DPC completed his three-month privacy audit of Facebook's activities in December 2011, he said Facebook makes "innovative use of cookies to identify unusual or suspicious activity" on an account.

All that being said, Facebook still needs to worry about this lawsuit and all the previous ones related to cookie tracking. I have contacted Facebook and will update you if I hear back.

Update 10:00 AM PST: "We believe that these cases are without merit and we will fight them vigorously," a Facebook spokesperson said in a statement.

See also:

Topics: Legal, Social Enterprise

Emil Protalinski

About Emil Protalinski

Emil is a freelance journalist writing for CNET and ZDNet. Over the years,
he has covered the tech industry for multiple publications, including Ars
Technica, Neowin, and TechSpot.

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.


Log in or register to join the discussion
  • Where's the class action for...

    People that aren't users of FB, yet FB still has their information?

    Ya know, because a person's friend who does use facebook haphazardly clicked ok to the "Import contacts" pop-up? And now my contact info is on FB's servers through NO opt-in of my own?

    Or as FB would say... "they're keeping my info in case I ever want to become a FB user"
    • Or as I am prone to say...

      F*** farcebook!
  • you can

    you can send messages to non existent users or users who deleted their facebook account. And in the event they open/re-open their facebook account, they will have the messages.

    In the past you would get 'message undeliverable'
  • Facebook

    Why is this "service" always seeming to be an accident waiting to happen?
  • Contact Facebook?

    How does one Contact Facebook? I need to discuss something with them about my FB account
    • you don't

      you don't - you're not their customer.
      • Product

        Your the product...lol...Facebook is selling you to vendors as ad exposure.
    • Call the government

      They run it.
      • facebook

        thats what I said! Are you tracking me?? lol
  • Delete cookies

    Should be an "app" that deletes cookies when you leave the site, also there should be NO facebook "buttons" on any pages not owned by them. Use NoScript to block this stuff, simply deny them access to your computer!
    • A Separate Browser

      People should get in the habit of having a separate browser (of a different brand) open for sites that know your real name: e.g. banks, Facebook, email, etc. The remainder of your internet activities ??? which no one has a need to know about ??? happen unlinked to your personal ID in another browser.
  • Facebook.....

    ..almost defines "Evil". They seem to think that anyone on the 'net is fair game for their dog and pony show.
  • facebook can

    do whatever the law allows in the end, they can do a lot more until the law forces them to stop.

    That said, I have no issue of Facebook tracking me as all Facebook communications are blocked on my network. This page alone made 196 attempts to connect to Facebook before it finally loaded without the Facebook plug-ins and cookies. Yes it slows down some websites, but at this point in the game I'm not willingly giving them any information about me. I rooted my phone primarily to get rid of Facebook, though many other benefits also came with rooting.

    I do know several of my friends have left invites and messages asking me to join Facebook, it'll never happen. Most of them accept that now, and those that don't get tired of me telling them how stupid they are for posting their entire life for the whole world to see. One of them was so stupid as to publicly post vacation plans and came back to a ransacked house and home office, despite multiple warnings from me and the various news outlets over the last few years about just that.
  • Facebook tracking

    I don't even subscribe to Facebook and they attempt to track me on almost all sites, including this one. I have a plug-in that blocks almost all tracking and this page has 12 sites, companies and social buttons trying to track me.
  • a piece of the action

    It seems to me that a lot of people see facebook as a cash cow that they can use frivolous lawsuits to extract a profit that they aren't smart enough to earn on their own.
    • huh?

      You don't know much about Class Action suits, do you? Everybody gets a dollar or two. The attorneys usually make bank, but that always happens.

      I see the situation being reversed. It seems to me that Facebook sees unwitting people as a cash cow that they can use deceptive measures to extract information that they can then sell for a profit.
      People getting on FB to talk to their grandkids don't know how to keep FB from tracking their every move after they log off. They don't even expect it.
      FB is nefarious. It started out as a nefarious project to gather info & screw with peers. It hasn't changed much.
      • OK

        Right. Not a lot of people. Same as any other class action, it is a way for a few lawyers to do community service....so long as they make millions performing the "service".
  • Do not use Facebook

    Never trusted the FB 'founder', never will...something just 'not right' with that one...reminded of the old lawyer joke-What's the difference between that one and a lawyer? Well, one is a blankity, blank, blank, blank and the other is a lawyer...
  • It's all a mystery until..

    You come to grips with the fact that these organizations (or the creation thereof) are funded by the same pot of CIA-NSA money that greases the skids for Google, YouTube and anyone else connected to them. That would include Twitter and perhaps down the road LinkedIn. Remember this term, "Total Information Awareness." The Pentagon considered the American public and all those who use the Internet as an enemy. False-flag terrorism is used to justify the cyber war budget. Facebook (and associated sites) is used as a surveillance device against the unwitting public. You see, there's a reason why they want you to volunteer your life details, phone lists, friends, etc. If the FBI knocked on your door demanding information, you'd demand a warrant. However, if they can make something sexy like Facebook, you'll gladly provide any and all details under circumstances that you normally wouldn't under police interrogation and without a lawyer. Don't be a fool. Either don't use it or don't provide true personal data.
  • Mark Zuckerberg believes he is above the law

    Like Leona Helmsley saying "Only the little people pay taxes", Zuckerberg, in his arrogance, believes he need not obey laws, they are only for "little people" -- meaning anyone but him.

    That philosophy -- I'm above the law -- has a name: Fascism. He should be hung by his feet from a lamppost, by us "little people".