In November 2017, Judge Edward J. Davila dismissed a major multidistrict litigation accusing Facebook of unlawfully tracking users’ browsing activity across websites while they were signed out of their accounts.¹ The plaintiffs originally asserted several common law, tort, and statutory claims. Judge Davila dismissed most of those claims pursuant to earlier motions, leaving only the plaintiffs’ breach of contract claims intact.

The plaintiffs’ Third Amended Complaint, the subject of Judge Davila’s latest ruling, alleged that Facebook’s Statement of Rights and Responsibilities (SRR) constituted a contract between the parties. They also alleged that a version of Facebook’s Privacy Policy called the Data Use Policy promised that Facebook would not track users across third-party websites using their Facebook User IDs unless they were logged into Facebook. The plaintiffs argued that the Data Use Policy, including promises about user tracking, was incorporated into the SRR because the SRR states: “Your privacy is very important to us. We designed our Privacy Policy to make important disclosures about … how we collect and can use your content and information. We encourage you to read the Privacy Policy, and to use it to help you make informed decisions.”² But because Facebook posted the Data Use Policy four months after it posted the relevant version of the SRR, Judge Davila held that the SRR could not refer to the Data Use Policy, and the privacy promises in the Data Use Policy were not incorporated by reference into the SRR.

The plaintiffs also argued that Facebook’s Help Center pages, including those that state Facebook will not track users while they are signed off, constitute a single “broader document” that is incorporated by reference into the Data Use Policy, which is part of the SRR.³ Judge Davila rejected this argument because, while the Data Use Policy links to some Help Center pages, it does not link to or directly reference any pages containing promises that Facebook will not track users who are logged-out: “[t]he Help Center pages exist independently at different URLs” and “[n]o evidence suggests that a Facebook user who reads one Help Center page has also read, or is even aware of, any of the others.”⁴ Given the plaintiffs’ failure to identify any contractual promise that Facebook may have violated, Judge Davila dismissed the plaintiffs’ remaining breach of contract claims. Because the plaintiffs failed to adequately revise their complaint after multiple leaves to amend, Judge Davila dismissed the case with prejudice.

Judge Davila’s decision in the Facebook tracking litigation turned on straightforward principles of contract law related to incorporation by reference. His decision is similar to those in numerous consumer class action cases based on alleged misrepresentations about companies’ privacy practices. These cases serve as a reminder that consumer-facing businesses should carefully review help center pages and FAQs that describe their data handling practices and be aware of how user agreements, terms, and policies refer and link to these pages.

¹ In re Facebook Internet Tracking Litigation, 2017 U.S. Dist. LEXIS 190819 (N.D. Cal. Nov. 17, 2017).

² Id. at *17-*18.

³ Id. at *22.

⁴ Id.