Facebook sues two Chrome extension makers for scraping user data
zdnet.com
zdnet.com
A maker of extensions never agrees to Facebook's ToS in the first place, so there's no breach of contract.
It would seem that only individual users could in theory be sued, though obviously Facebook would never do that because of the PR nightmare.
IANAL, so I'm really curious if anyone thinks Facebook could win this in court? (Regardless of whether it works by threatening to drown the extension maker in legal costs.)
The Computer Fraud and Abuse Act (CFAA) allows for civil cases. The law prohibits accessing a computer without authorization, or in excess of authorization. This isn't a case of users knowingly using a tool to scrape data for their own use, the users installing the extension are, at most, mules, for the extension makers.
Alternately, maybe copyright infringement. Some of the data are considered facts, that are not copyrightable (even in aggregate, in the U.S.) but at minimum, the actual content of ads scraped is copyrightable. There might be a question of whether Facebook has standing to sue over infringement of ads for other businesses but their ToS may cover some non-exclusive copyright to shared
That seems to be an important difference, no?
These extensions are made by shitty companies using shitty practices to make money. If current legal frameworks aren't well suited to deal with it, that doesn't make them any less shitty.
Facebook is harmed through resource consumption by the scraping, the infringement of any copyrights they hold on what's scraped, and potentially harmed in their relationship with their advertising customers and their users.
How bad Facebook's own practices are is irrelevant to the issue of what these extension makers have done. Dirtbags have rights too.
You're just a pawn sitting in the middle while the parties to this fight over who gets to exploit you most effectively. The only positive outcome here would be if the courts hugely overstepped their mandate and told everyone involved that this data shouldn't be available at all, you have to destroy it now.
Not to sue Facebook or the extension author and definitely not for Facebook to sue the extension author.
I feel it's reasonable for the average person to figure that a plugin that pays them for using Facebook and Twitter is paying for the data generated from those sessions. There is already a case with LinkedIn where courts are allowing data scraping even though LinkedIn disallows it and forced LinkedIn to stop blocking it.
I feel like this is a case Facebook should lose. Facebook wants complete ownership of the data from Facebook for marketing purposes because obviously if they're the only ones that have the data they have a monopoly. But preventing others from gathering competing data seems to be a breach of Antitrust. And Facebook execs will openly admit this is what they're doing. They've shut down multiple influencer related companies who completely backed down from a cease and desist from Facebook. And they're refusing to allow anyone to grant influencer agencies access to their data. This is Facebook telling people who they can give their data to. As well as Facebook saying companies can't scrape public information and then sell the statistics. And statistics can't be copyrighted.
I suspect that, to date, you've mostly met above-average people.
The average person, in my experience, has no such expectation or understanding. All they know is "free money!"
Courts only said "If your server responds to an unauthenticated GET request, that's on you". Linkedin is free to stop providing that data or move it behind a login wall, they just don't want to because it helps them with SEO. Contrast that with these plugins that are absolutely accessing data behind the user's login.
Also with regards to the antitrust assertions you make, Facebook is absolutely not required to share their data with anyone. People give their data to FB, FB can do what they want with it (as long as it's within the ToS). Facebook can't stop me from also giving my data to someone else outside the platform, but they do not have to facilitate that process in any way.
Yes, exactly. Basically saying if LinkedIn was providing the data they couldn't block the data for specific people. In contrast, these plugins are collecting data that someone has chosen to make available to them. This is Facebook attempting to stop people from giving data to their competitors. This is anti-competitive. Overall the LinkedIn case said that if the user made that data available then that is on them. Not that it was an unauthenticated request, but that the data was made public and there was no attempt to bypass any privacy filters.
> Also with regards to the antitrust assertions you make, Facebook is absolutely not required to share their data with anyone. People give their data to FB, FB can do what they want with it (as long as it's within the ToS). Facebook can't stop me from also giving my data to someone else outside the platform, but they do not have to facilitate that process in any way.
One of Facebook's services is to provide that data to other services so you can use those services with that data. Saying no you can't share that data and not provide you that data in export is well, anti-competitive. This is saying "No, we don't want you to give those people that data." This is anti-competitiveness. Suing companies and preventing them from competing is predatory. You make claims that Facebook doesn't have to do these things, I feel like Facebook should be forced to allow these things. Just like we force Facebook to do other things like delete user data or make user data available (which it actually isn't doing completely last time I checked because you can't export your data and then have the exact same data on your own system.)
I agree but that's not happening in this case.
Facts aren't copyrightable, but a collection of facts might be if there was sufficient creativity involved in the selection and arrangement of the facts.
The big case on this was Feist Publications, Inc., v. Rural Telephone Service Co., 499 U.S. 340 (1991), where a company copying a telephone book was found not to be if infringing because the phone book was not be copyrighted.
The Court ruled that there is a constitutional requirement for at least some minimal degree of creativity in a work for it to be copyrighted. In the case of a phone book, neither the selection criteria (everyone in this region who has a phone) nor the arrangement (alphabetical order by name).
The Court also noted that if there is sufficient creativity in the selection or arrangement to support copyright, the copyright would be on that selection and arrangement. The underlying facts would still be uncopyrightable. In the case of the phone book, for example, that would mean that even if Rural had used a creative arrangement and could copyright that, Feist could still take all the names and phone numbers and produce its alphabetical phone book from them.
Applying this to Facebook, it may be that they do have copyright in the selection and arrangement of facts that were scraped. Whether or not the scraper is infringing would hinge on what they did with those facts.
The White Pages are not copyright-able, which is what your case describes. But the Yellow Pages are copyright-able (somewhat). This is because grouping the businesses into categories clears the bar of "minimal degree of creativity" that you mention. However, the individual listings are still not subject to copyright so there's no problem with taking them and re-arranging them.
I don't think the scraping companies could mount a successful fair use defense so they'd definitely be found to be infringing and could be ordered by a court to stop. What damages they might pay would depend on what they did with the data.
Even if the specific act of letting the extension run is the fault of each user and presumably means they each violated Facebook's ToS, they can probably sue the extension makers for bribing the users to violate the ToS.
That's an interesting thought. A ToS is just a (rather questionable, in many cases) contract. Can party A sue party C for bribing party B to violate a contract between A and B? Genuine question - I honestly don't know, but my guess is no.
https://www.scribd.com/document/478333898/Facebook-lawsuit-v...
Does deleting my account help? Or can they say in their tos that it’s perpetual? And oops I already agreed to that)l
EDIT: Also to be clear, I do think it is Facebooks job/responsibility/obligation
They are responsible for the activity that they directly facilitate on their own platform. They have legal authority over the interactions they directly engage in (ie with users). They have no say (legally or otherwise) over what goes on outside the bounds of their own platform and thus no responsibility for it.
Regulators, not individual actors, are the ones with authority over the broader ecosystem. GDPR and CCPA are examples of such.
What's next, should Google be permitted to publish a ToS forbidding access to their services with non-Chrome browsers and then legally pursue other browser makers for facilitating the violation of their ToS?
And there is a real trade-off here. 10 years ago everyone would be hating them for cracking down on the open web if they did this, and calling it anti-competitive to silo user data.
For those that installed the extension, one is Facebook, one gives free gift cards. Both are “okay.”
So I don’t see this as protecting users so much as ensuring no one else monetizes their data.
Its called "data abuse bounty program"
You find an app like this, rat them out to facebooks legal team, you get a small bounty and FB sues them for fame and profit.
When I think about decentralized open source solutions, the major example that comes to mind is email, with how Gmail can communicate with Hotmail can communicate with AOL Mail.
And this made me realize that these chrome extension are not too different from an extension that saves and archives your email history. Pure malware.
Also, I might want to read my friends' posts on a different client.
> same scheme with chrome extensions
These are very different things. One took place via Facebook's own platform while the other did not.
If their own platform officially allowed for third parties to collect user data, it is reasonable to complain about that being the case.
If their own platform explicitly forbid collecting user data in such a manner but they stood by and let it happen anyway, it seems reasonable to object to that.
I don't see how it's any of their business what a legitimate user does with their own data after it's been sent to them (ie the page loads). I suppose they could add a provision to their ToS disallowing such use; if a violation were discovered they could ban the user in question. But a third party almost certainly never agreed to such a ToS. It's not the existence of the program that violates the contract but rather a specific instance of its usage.
^_^
I hope that the judge will require Facebook to stop scraping themselves first, before they request others to stop it, too.
Apple does this too. Well, did - not sure if they still do.
This doesn't sound familiar. What case(s) are you referring to?
They were also caught a few years ago asking users to "verify their emails" by providing Facebook their email account password(2), after which FB's servers logged into the user's email account and scraped their contacts out without warning.
They also acquired a popular VPN app explicitly so they could comb through the users' traffic data and identify competing apps for acquisition.(3)
In my opinion it's core to how the company has always been. Facebook's predecessor, or perhaps first iteration, FaceMash, was a hot-or-not game based on student photos scraped from Harvard's internal websites(4).
[1] https://theoutline.com/post/4578/facebook-is-tracking-you-on...
[2] https://www.theverge.com/2019/4/18/18485089/facebook-email-p...
[3] https://techcrunch.com/2019/02/21/facebook-removes-onavo/
[4] https://www.thecrimson.com/article/2003/11/19/facemash-creat...
In the webpage case, the web developer is choosing to provide the user's data to Facebook or Google (without the user's consent). The vast majority of people don't even understand how this works and think that Facebook can only see activity performed on Facebook itself.
Why aren't developers in jail for this? Breaking into someone's email account and exfiltrating their data - disgusting. Clicking "OK" on a 500 page ToS doesn't get you out of this.
I'm so sick of this criminal behavior being brushed off as "growth hacking", "move fast and break things", or some other bullshit. The people creating this garbage should feel some shame and face real consequences.
If the user of the account consents to have the plugin installed on their computer and is made aware that the plugin will scrap this data, you could argue that there is nothing wrong here.
However, people post on Facebook under the idea that the information they share will only be viewable by their friend group (or as dictated by their privacy settings).
That's where this gets interesting... does the friend group of the person with the plugin have any rights to privacy that dictate what the person with the plugin can do with their data?
If I take a picture of a newsfeed, for example, that has information my friends have posted, and share that somehow - am I violating their privacy legally?
If not, how is this different?
Will be interesting to follow this one.
In other words, they are abusing the user's trust to access the user's private data for their own profit, hence defrauding the user, and engaging in unauthorized access to the data shared between the user and Facebook without either party's full informed consent.
Sure pulling info from PortalX that us public is on thing - but what if Amazaon starts adding coupon codes for logged in users only? or even if not logged in, but recognized user - adds special promo price for doing thing Y.. at that point they are scraping non-public data. They would also be using that data for other purposes than just the single user who is accessing it - most likely..
I find the lack of privacy discussing in the joinhoney ads I've heard to be a bit distressing personally.
Just looked at their privacy policy, and I wonder if "Honey does not track your search engine history, emails, or your browsing on any site that is not a retail website (a site where you can shop and make a purchase)"
Is purposefully trying put into user's mines, retail, you know like home depot, bed bath, etc.. but the way it's written can include online retail portals.. but with "(a site where you can shop and make a purchase)"" added as a qualifier - wouldn't this include pornhub and similar places?
Fingers crossed the browser makers will include on-off toggles for extensions soon - similar to how uBlock origin has - would be great to have a whitelist list of sites that I could have my browser remind me that I can turn on SpyShoppingExtensionToCheck - then auto turn off when leaving set list..
I avoided so many chrome extensions that said 'perms to view / change all web pages/ - even though I may have really wanted to use them on blankTube and yaddaTube - I didn't want them reading all web pages, and the current UI for turning off and on is not optimal imho.
UpVoice
> please visit our terms of service at: https://joinupvoice.com/tos
http://webcache.googleusercontent.com/search?q=cache:https:/...
> (i) we will collect and store data which includes a randomly generated device ID and user ID as well as data about sponsored campaigns, sponsored posts or advertisements that target you directly or that have been shared with you on specific mobile applications, social media and/or other websites, as applicable; and (ii) we will complement these data with general demographic and profile information, which we collect from you as part of your registration/qualification to the Panel App and/or from your Facebook profile, like your age, your gender, where you live (by region), your relationship status and your general interests. You may also provide us with, and we may collect, additional information when you answer certain survey questions.
https://www.joinupvoice.com/tos
It states clear what it does. If not it is problem of usability. Chrome Store should provide badge "Collects Data". People sell their data for discount both online and in real world. How can service provider sell my data and I can't? It may be interesting experience - create clean profile, watch guitar lessons on youtube, I can share it.
uBlock origin (basic) - blocks facebook tracking, does not track you, inserts non personalized ads.
uBlock origin (premium) - 1$ / mo. Blocks all ads.
As an example.
This is literally what ISPs do these days.
The users on the other hand, if they were unaware of what the extensions were doing in exchange for that money, might have a case against the extension manufacturers. But how could Facebook possibly have standing?
Not a lawyer, the above are feelings.
TL;DR; It was considered to be legal because HiQ were scraping public profiles.
This case may be a little bit different because these scrapers seem to target both public and private data.
Also see: https://medium.com/@tjwaterman99/web-scraping-is-now-legal-6... (which mentions a facebook example very similar to this)
Those individual users likely go against FBToS in doing so - but the browser extension maker is not a party to those ToS.
According to the article, it's the reverse, the individual users are acting as paid agents of the scrapers, a proxy giving scrapers access to data through the users' access to Facebook.
I wonder what legal principle gives Facebook standing to sue the makers of the extension.
Each user only chooses to install the extension, the extension makers choose what data to scrape and I'm sure at least some of what's scraped truly belongs to Facebook, not their users or customers.
If a Facebook account can be considered a technological barrier protecting intellectual property, they could sue under DMCA anti-circumvention provisions. The users installing the extension could be accomplices but they're not really the ones scraping and collecting the data.
It would also likely make screen readers, screenshots, and many other things illegal. I don't think it can be considered a "technological barrier", but who knows what courts will decide.
That said, I'd be surprised if that's the angle Facebook is taking - because they did (and still do) the same thing with their phone apps collecting ("scraping") address book records and uploading them to facebook servers -- and that would be an estopple-able admission of guilt if they do (even if the courts decide against them in THIS particular case).
I'll wait till more details come out.
Being a one-sided, no negotiation and with no "meeting of minds", most European jurisdictions won't consider this a contract -- facebook can kick any user out, but it is unlikely they could recover damages from anyone (or have standing). At least that's my impression -- though US courts, especially in states that have UCITA or similar, are more likely to consider this a contract.
edit: I've found two jurisdictions, and both of them require proof of actual economic harm for standing (among many other things). I'll wait for more specific details about Facebook's approache.....
https://techcrunch.com/2019/01/29/facebook-project-atlas/
That's where FB paid teens to install a root cert on phones that tracked every thing the users did for market research. And then paid them for it.
One is acquiring data on a large scale, the other one is throwing data in the trash.
For FB/Google and other data stewards privacy means keeping your data safe from others because they consider themselves a trusted party.
https://chrome.google.com/webstore/detail/alexa-traffic-rank...
700k users
"Measuring traffic" and "harvesting data" aren't the same.
Is there any evidence it is not?