Skip to main content

Facebook Sued Over Alleged Message-Scanning

By Jenny Tsay, Esq. on January 04, 2014 | Last updated on March 21, 2019

Facebook is being sued for allegedly scanning users' private messages to provide data to marketers -- without user consent.

The social media giant allegedly scanned plaintiffs' private messages that contained URLs in order to identify the website associated with the URL. This information was then sold to third parties, like advertisers and marketing companies, reports PCWorld.

The plaintiffs are now suing Facebook under the Electronic Communications Privacy Act for intentionally intercepting their private messages.

Electronic Communications Privacy Act (ECPA)

Matthew Campbell and Michael Hurley have sued Facebook for its alleged message scanning following a report from Swiss security firm, High-Tech Bridge. In their suit, Campbell and Hurley claim that Facebook violated the Electronic Communications Privacy Act (ECPA).

The ECPA protects the right to privacy in electronic communications by preventing social networking sites, email providers, cell phone companies, and other electronic messaging corporations from divulging personal data without legal process.

Electronic communications protected by ECPA include pretty much most forms of electronic communications we can think of -- text messages, instant messages, emails, and definitely Facebook private messages.

Did Facebook Violate the ECPA?

The plaintiffs allege that Facebook's privacy policy represented to users that the content of their Facebook messages are private to all other parties, including Facebook, reports CNET.

If this is true, then Facebook could be in violation of the ECPA if it never notified users that their private messages were being scanned for any purpose -- especially for profit.

Over the summer, Google was also hit with a class action data mining lawsuit. In that case, Google's lawyers argued that users can assume that any electronic communications that go through its servers can be accessed and used for advertising purposes. However, Google won't share "sensitive personal information" to third parties unless you opt in.

On the other hand, Facebook's privacy policy states that they don't share your information with third parties for direct marketing purposes unless you give them permission, unless Facebook notifies you, or unless it removes your name and other personally identifying information.

The plaintiffs in this case are seeking class action status from the courts. If certified as a class action, all U.S. users who sent or received private messages containing a URL may be covered by the lawsuit.

Copied to clipboard