05/28/2010 11:16 am ET | Updated May 25, 2011

Suing Facebook

Starting around April 18, 2010, Facebook began sharing users' information with certain third-party websites, including, Yelp, Pandora, and These relationships are mutually profitable for the companies involved, but users have little say in whether they wish to partake in the business plans of these Internet giants.

On Friday, May 21st, my law office filed a class action lawsuit against Facebook in the U.S. District Court for the District of Rhode Island, on behalf of Derrick Rose of East Providence that seeks to represent a national class of Facebook users, over privacy concerns relating to Facebook's "Instant Personalization." (Rose v. Facebook, U.S. District Court District of Rhode Island, C.A. 10-232-S). Instant Personalization is a social networking tool that allows third-party websites to access users' personal information when users visit those third-party sites. As the first lawsuit of its kind in the nation, it cuts straight to the heart of the increasingly critical, complicated, and robust debate about online privacy rights.

The lawsuit alleges that Facebook's "Instant Personalization" feature has violated users' reasonable expectations of privacy and seeks to certify a national class of Facebook users. Facebook automatically added the Instant Personalization feature to all users of Facebook's service. Unless users affirmatively chose to opt-out, personal information was shared with third-party websites and applications. In doing so, it effectively changed privacy settings without users' affirmation. Facebook received no informed consent or permission to publicize interests or to adjust its users' privacy settings, as it shared information about its users with unrelated third-party sites. Only through a complicated, confirmatory, opt-out procedure can users avoid such sharing.

As the lawsuit asserts, "The activation of Instant Personalization and the sharing of information about users with unrelated third party websites violated users' reasonable expectations of privacy."

We allege also that Facebook has violated the Stored Communications Act, which provides that "an offense is committed by anyone who intentionally accesses without authorization a facility through which electronic communication service is provided, or intentionally exceeds an authorization to access that facility; and thereby obtains... an electronic communication while it is in electronic storage in such system."

The lawsuit also claims that Facebook breached its contract's implied covenant of good faith and fair dealing, by exercising bad faith in using its discretionary rights to deliberately, routinely, and systematically make its users' personal profile information public by default. Boiled down, the implied covenant of good faith and fair dealing obligates the social networking site to refrain from opportunistic behavior, which Facebook's actions clearly violate.

As social networking sites, like Facebook, continue to place profits before privacy, users have become increasingly attuned to privacy violations and have demanded better control over the use of their personal information on the Internet. Opt-in information sharing is the only acceptable means of personal information dissemination: Users want to decide their own online destinies; default distribution of private information is both unreasonable and irresponsible, and a violation of users' good faith.

Facing increased privacy concerns from its users, from privacy interest groups, federal elected officials, and this litigation, Facebook responded on May 26th by announcing the adoption of a new privacy regime that will be rolled out in the coming weeks. These new privacy tools are but a small step in the right direction: It remains to be seen how clearly the new privacy tools will be disclosed to users wanting to opt-out of defaulted settings, so that users can with fully informed disclosure choose the fate of their own privacy.

Facebook has not retreated from its practice of automatically, by default, requiring users to participate in the Instant Personalization tool over which Derrick Rose has filed a class action lawsuit. Those new privacy tools would even still force users to opt-out of Instant Personalization in order to prevent information sharing with third parties.

An opt-in policy would best serve users. Facebook could have decided to turn off Instant Personalization and other third party information sharing by default and require users desiring such sharing to knowingly take action to opt into it.

Ever more gentle, Facebook increasingly claims that it really cares about users' privacy. Users' message must remain clear: We'll believe it when we see it.