Complaint

Case 3:22-cv-03173 Document 1 Filed 05/31/22 Page 1 of 25 1 MICHAEL F. RAM (SBN 104805) MORGAN & MORGAN COMPLEX 2 LITIGATION GROUP 711 Van Ness Avenue, Suite 500 3 San Francisco, CA 94102 Telephone: (415) 358-6913 4 Facsimile: (415) 358-6923 mram@ForThePeople.com 5 JOHN A. YANCHUNIS 6 (Pro Hac Vice application forthcoming) 7 JEAN SUTTON MARTIN (Pro Hac Vice application forthcoming) 8 PATRICK A. BARTHLE II (Pro Hac Vice application forthcoming) 9 MORGAN & MORGAN COMPLEX LITIGATION GROUP 10 201 N. Franklin Street, 7th Floor 11 Tampa, Florida 33602 Telephone: (813) 559-4908 12 Facsimile: (813) 222-4795 jyanchunis@forthepeople.com 13 jeanmartin@ForThePeople.com pbarthle@ForThePeople.com 14 15 Attorneys for Plaintiff and the Proposed Class 16 UNITED STATES DISTRICT COURT 17 NORTHERN DISTRICT OF CALIFORNIA 18 19 LAUREN PRICE, individually and on behalf Case No. of all other similarly situated, 20 CLASS ACTION COMPLAINT Plaintiff, 21 CLASS ACTION FOR v. (1) BREACH OF CONTRACT; 22 (2) BREACH OF IMPLIED CONTRACT; TWITTER, INC., a corporation, (3) VIOLATION OF UCL, CAL BUS. & 23 PROF. CODE §§ 17200, ET. SEQ., and Defendant. (4) UNJUST ENRICHMENT 24 DEMAND FOR JURY TRIAL 25 26 27 28 CLASS ACTION COMPLAINT  Case 3:22-cv-03173 Document 1 Filed 05/31/22 Page 2 of 25 1 CLASS ACTION COMPLAINT 2 Plaintiff Lauren Price, individually and on behalf of all others similarly situated, files this 3 Class Action Complaint against defendant Twitter, Inc. (“Twitter” or “Defendant”), and in support 4 states the following. 5 INTRODUCTION 6 1. Twitter operates an online communication service through its website, 7 www.twitter.com, and through text messaging and mobile applications. The service allows 8 registered users to communicate with one another by posting “tweets,” or short messages currently 9 limited to 280 characters or less, with which other users may interact through a “like,” reply, or 10 “retweet.” 11 2. In order to follow other accounts, or post, like, and retweet tweets, users must register 12 for a Twitter account. 13 3. This lawsuit concerns Twitter’s surreptitious and undisclosed use of Plaintiff’s and 14 Class Members’ telephone numbers and email addresses (hereinafter “Personal Information”) for 15 advertising and marketing purposes, and, ultimately, its own unjust enrichment. 16 4. Twitter solicited and collected Plaintiff’s and Class Members’ telephone numbers 17 and email addresses under the guise that they were to be used for various account security related 18 functions, including two-factor authentication, account recovery, and account re-authentication, as 19 further described below. 20 5. In reality, Twitter was also using this Personal Information of Plaintiff and Class 21 Members to line its own pockets—specifically, it utilized the provided telephone numbers and email 22 addresses in its “Tailored Audiences” and “Partner Audiences” marketing products, thereby 23 permitting advertisers to target specific groups of Twitter users by matching the telephone numbers 24 and email addresses that Twitter collected to the advertisers’ existing (or purchased) lists of 25 telephone numbers and email addresses. 26 6. On May 25, 2022, the Attorney General by the Federal Trade Commission (“FTC” 27 or “Commission”) filed a complaint concerning this conduct and likewise announced that Twitter 28 will pay a $150 million fine to settle the allegations. See United States of America v. Twitter, Inc., 2 CLASS ACTION COMPLAINT  Case 3:22-cv-03173 Document 1 Filed 05/31/22 Page 3 of 25 1 Case No. 3:22-cv-3070. ECF. No. 1 (N.D. Cal.) (“2022 FTC Complaint”); Federal Trade Comm. 2 Twitter to pay $150 million penalty for allegedly breaking its privacy promises – again (May 25, 3 2022), available at https://www.ftc.gov/business-guidance/blog/2022/05/twitter-pay-150-million- 4 penalty-allegedly-breaking-its-privacy-promises-again. 5 7. This case seeks vindication and recompense on behalf of the individual consumers 6 whose personal information was connivingly collected and deployed. 7 THE PARTIES 8 8. Plaintiff Lauren Price is an adult domiciled in Maryland and has an active Twitter 9 account and had an active account during the entire Class Period. 10 9. Plaintiff Lauren Price is a Twitter user who between May 2013 and September 2019 11 provided her telephone numbers and/or email addresses (hereinafter “Personal Information”) to 12 Twitter regarding two-factor authentication, account recovery, and/or account re-authentication. She 13 brings claims on behalf of other similarly-situated Twitter users in the United States (the “Class” 14 defined in Paragraph 73, hereinafter the members of the Class are referred to as “Class Members”) 15 arising from Twitter’s knowing, unauthorized, and undisclosed use of their Personal Information for 16 advertising and/or marketing purposes. 17 12. Twitter is a Delaware corporation with its principal place of business at 1355 Market 18 Street, Suite 900, San Francisco, California, 94103. Twitter transacts or has transacted business in 19 this District and throughout the United States. At all times material to this Complaint, Twitter has 20 operated its online communication service through its website, www.twitter.com, and through its 21 mobile applications. 22 JURISDICTION AND VENUE 23 13. This Court has personal jurisdiction over Defendant because Twitter’s principal 24 place of business is in California. Additionally, Defendant is subject to specific personal 25 jurisdiction in this State because a substantial part of the events and conduct giving rise to Plaintiff’s 26 and Class members’ claims occurred in this State, including Google servers in California receiving 27 the intercepted communications and data at issue, and because of how employees of Google in 28 California reuse the communications and data collected. 3 CLASS ACTION COMPLAINT  Case 3:22-cv-03173 Document 1 Filed 05/31/22 Page 4 of 25 1 14. This Court has subject matter jurisdiction over this entire action pursuant to the Class 2 Action Fairness Act (“CAFA”), 28 U.S.C. § 1332(d), because this is a class action in which the 3 amount in controversy exceeds $5,000,000, and at least one Class member is a citizen of a state 4 other than California or Delaware. 5 15. Venue is proper in this District because a substantial portion of the events and actions 6 giving rise to the claims in this matter took place in this judicial District. Furthermore, Twitter is 7 headquartered in this District and subject to personal jurisdiction in this District. 8 FACTUAL ALLEGATIONS CONCERNING TWITTER 9 I. Twitter’s History of Privacy Violations & Its Agreement with the FTC 10 16. Twitter’s violation of consumers’ privacy rights is not new – it has been persistent 11 and pervasive for at least a decade. 12 17. In 2011, the FTC charged Twitter with engaging in deceptive acts or practices in 13 violation of Section 5(a) of the FTC Act, 15 U.S.C. § 45(a), for its failures to provide reasonable 14 security measures to prevent unauthorized access to nonpublic user information and to honor the 15 privacy choices exercised by Twitter users. See, In re Twitter, Inc., C-4316, 151 F.T.C. 162 (Mar. 16 11, 2011) (Administrative Complaint) at ¶¶ 13-17. 1 17 18. Specifically, the Administrative Complaint asserted that Twitter had engaged in 18 deceptive acts or practices by misrepresenting that users could control who had access to their tweets 19 through a “protected account” or could send private “direct messages” that could only be viewed 20 by the recipient when, in fact, Twitter lacked reasonable safeguards to ensure those choices were 21 honored, such as restricting employee access to nonpublic user information based on a person’s job 22 requirements. See Administrative Complaint at ¶¶ 6, 11-12. 23 19. The Administrative Complaint also alleged that Twitter had misrepresented the 24 controls it implemented to keep user accounts secure, when, in fact, Twitter lacked reasonable 25 safeguards to limit or prevent unauthorized access to nonpublic user information, such as secure 26 27 1 The 2011 Administrative Complaint is also available at: https://www.ftc.gov/sites/default/files/documents/cases/2011/03/110311twittercmpt.pdf (last 28 visited May 27, 2022). 4 CLASS ACTION COMPLAINT  Case 3:22-cv-03173 Document 1 Filed 05/31/22 Page 5 of 25 1 password requirements and other administrative, technical, or physical safeguards. See 2 Administrative Complaint at ¶¶ 10-12. 3 20. Twitter entered a consent settlement to resolve the Commission’s Administrative 4 Complaint for alleged violations of Section 5(a) of the FTC Act which was memorialized in a 2011 5 order issued by the FTC. See In re Twitter, Inc., C-4316, 151 F.T.C. 162 (Mar. 11, 2011) (Decision 6 and Order) (“Commission Order” or “2011 Order”).2 The Commission Order became final in March 7 2011 and remains in effect. See Commission Order, Provision VIII. 8 21. Provision I of the Commission Order, in relevant part, states: 9 IT IS ORDERED that respondent, directly or through any corporation, subsidiary, division, website, or other device, in 10 connection with the offering of any product or service, in or affecting 11 commerce, shall not misrepresent in any manner, expressly or by implication, the extent to which respondent maintains and 12 protects the security, privacy, confidentiality, or integrity of any nonpublic consumer information, including, but not limited to, 13 misrepresentations related to its security measures to: (a) prevent 14 unauthorized access to nonpublic consumer information; or (b) honor the privacy choices exercised by users. 15 See Commission Order, Provision I (emphasis added). The Commission Order required Twitter to 16 refrain from such misrepresentations for a period of 20 years from the date of the Order (at least 17 March 2, 2031). See Commission Order, Provision VIII. 18 22. Importantly, the Commission Order defines “nonpublic consumer information” as, 19 in relevant part, “an individual consumer’s: (a) email address… [and] (c) mobile telephone 20 number[.]” See Commission Order, Definition 3. 21 II. Twitter Misrepresented the Purposes for Which it Collected Plaintiff’s and Class 22 Members’ Telephone Numbers and Email Addresses 23 23. Twitter’s platform is widely used. As of September 2019, Twitter had more than 330 24 million monthly active users worldwide, which included journalists, celebrities, commercial brands, 25 and government officials. 26 2 The 2011 Commission Order is also available at: 27 https://www.ftc.gov/sites/default/files/documents/cases/2011/03/110311twitterdo.pdf (last visited May 27, 2022). 28 5 CLASS ACTION COMPLAINT  Case 3:22-cv-03173 Document 1 Filed 05/31/22 Page 6 of 25 1 24. Commercial entities regularly use Twitter to advertise to consumers. Indeed, 2 Twitter’s core business model monetizes user information by using it for advertising. In fact, of the 3 $3.4 billion in revenue that Twitter earned in 2019, $2.99 billion flowed from advertising. 4 25. Twitter primarily allows companies to advertise on its service through “Promoted 5 Products,” which can take one of three forms: (1) Promoted Tweets, which appear within a user’s 6 timeline, search results, or profile pages, similar to an ordinary tweet; (2) Promoted Accounts, which 7 typically appear in the same format and place as other recommended accounts; and (3) Promoted 8 Trends, which appear at the top of the list of trending topics for an entire day. 9 26. Twitter offers various services that advertisers can use to reach their existing 10 marketing lists on Twitter, including “Tailored Audiences” and “Partner Audiences.” Tailored 11 Audiences allows advertisers to target specific groups of Twitter users by matching the telephone 12 numbers and email addresses that Twitter collects to the advertisers’ existing lists of telephone 13 numbers and email addresses. Partner Audiences allows advertisers to import marketing lists from 14 data brokers like Acxiom and Datalogix to match against the telephone numbers and email 15 addresses collected by Twitter. Twitter has provided advertisers the ability to match against lists of 16 email addresses since January 2014 and against lists of telephone numbers since September 2014. 17 27. Twitter has prompted users to provide a telephone number or email address for the 18 express purpose of securing or authenticating their Twitter accounts. However, through at least 19 September 2019, Twitter also used this information to serve targeted advertising and further its own 20 business interests through its Tailored Audiences and Partner Audiences services. For example, 21 from at least May 2013 until at least September 2019, Twitter collected telephone numbers and 22 email addresses from users specifically for purposes of allowing users to enable two-factor 23 authentication, to assist with account recovery (e.g., to provide access to accounts when users have 24 forgotten their passwords), and to re-authenticate users (e.g., to re-enable full access to an account 25 after Twitter has detected suspicious or malicious activity). From at least May 2013 through at least 26 September 2019, Twitter did not disclose, or did not disclose adequately, that it used these telephone 27 numbers and email addresses to target advertisements to those users through its Tailored Audiences 28 and Partner Audiences services. 6 CLASS ACTION COMPLAINT  Case 3:22-cv-03173 Document 1 Filed 05/31/22 Page 7 of 25 1 28. As noted above, the 2011 Commission Order, among other things, prohibited Twitter 2 from misrepresenting the extent to which Twitter maintains and protects the security, privacy, 3 confidentiality, or integrity of any nonpublic consumer information. 4 29. Yet, from at least May 2013 until at least September 2019, Twitter misrepresented 5 to users of its online communication service the extent to which it maintained and protected the 6 security and privacy of their Personal Information. Specifically, while Twitter represented to users 7 that it collected their telephone numbers and email addresses to secure their accounts, Twitter failed 8 to disclose that it also used user’s Personal Information to aid advertisers in reaching their preferred 9 audiences. Twitter’s misrepresentations violate the FTC Act and the 2011 Order, which specifically 10 prohibited the company from making misrepresentations regarding the security of nonpublic 11 consumer information like the Personal Information 12 30. According to the 2022 FTC Complaint, more than 140 million Twitter users 13 provided email addresses or telephone numbers to Twitter based on Twitter’s deceptive statements 14 that their information would be used for specific purposes related to account security. Twitter knew 15 or should have known that its conduct violated the 2011 Order, which prohibits misrepresentations 16 concerning how Twitter maintains email addresses and telephone numbers collected from users. 17 31. Technology companies like Twitter recognize the monetary value of users’ personal 18 information, insofar as they encourage users to install applications explicitly for the purpose of 19 selling that information to technology companies in exchange for monetary benefits.3 20 32. Through its deceptive information collection techniques and misrepresentations, 21 Twitter is unjustly enriching itself at the cost of consumer choice, when the consumer would 22 23 3 Kari Paul, Google launches app that will pay users for their data, The Guardian (June 11, 24 2019), https://www.theguardian.com/technology/2019/jun/11/facebook-user-data-app-privacy- study (last visited May 27, 2022); Saheli Roy Choudhury and Ryan Browne, Facebook pays 25 teens to install an app that could collect all kinds of data, CNBC (Jan. 30, 2019), 26 https://www.cnbc.com/2019/01/29/facebook-paying-users-to-install-app-to-collect-data- techcrunch.html (last visited May 27, 2022);; Jay Peters, Facebook will now pay you for your 27 voice recordings, The Verge (Feb. 20, 2020), https://www.theverge.com/2020/2/20/21145584/facebook-pay-record-voice-speech-recognition- 28 viewpoints-proununciations-app (last visited May 27, 2022);. 7 CLASS ACTION COMPLAINT  Case 3:22-cv-03173 Document 1 Filed 05/31/22 Page 8 of 25 1 otherwise have the ability to choose how they would monetize their own data. 2 A. Twitter’s Deceptive Collection of Personal Information for Two-Factor Authentication 3 4 33. Since May 2013, Twitter has allowed users to log into Twitter with two-factor 5 authentication using their telephone numbers. Users who enable this security feature log into their 6 Twitter accounts with their usernames, passwords, and a code texted to their telephone numbers 7 whenever they log in from a new or unrecognized device. 8 34. Twitter prompts users to enable two-factor authentication through notices on their 9 timelines and after users reset their passwords. Twitter also encourages users to turn on two-factor 10 authentication in tweets from Twitter-operated accounts, Help Center documentation, and blog 11 posts. 12 35. To enable two-factor authentication, Twitter users must navigate to an account 13 settings page. After clicking on “Security,” users see a screen similar to the one depicted below 14 15 16 17 18 19 20 36. When users click on the “Learn more” link, they see a webpage that says, “How to 21 use two-factor authentication.” This page states, in relevant part 22 Two-factor authentication is an extra layer of security for your 23 Twitter account. Instead of only entering a password to log in, you’ll 24 also enter a code or use a security key. This additional step helps 25 make sure that you, and only you, can access your account. 26 37. After clicking on the “Login Verification” checkbox above, users see additional 27 instructions about how to enable two-factor authentication. The last screen in the user flow related 28 to two-factor authentication using a telephone number is similar to the one depicted below: 8 CLASS ACTION COMPLAINT  Case 3:22-cv-03173 Document 1 Filed 05/31/22 Page 9 of 25 1 2 3 4 5 6 7 8 9 10 11 38. Since at least September 2018, Twitter has prompted users to enable two-factor 12 authentication directly on users’ timelines through a prompt similar to the screen depicted below: 13 14 15 16 17 18 19 39. According to the 2022 FTC Complaint, until September 2019, Twitter did not 20 disclose at any point in the two-factor authentication pathway or in any of the associated links 21 described above that it was using the telephone numbers users provided for two-factor 22 authentication to target advertisements to those users. 23 40. According to the 2022 FTC Complaint, from May 2013, approximately two million 24 users provided a telephone number to enable two-factor authentication. 25 41. The fact that Twitter used the telephone numbers provided for two-factor 26 authentication for advertising would be material to users when deciding whether to provide a 27 telephone number for two-factor authentication. 28 9 CLASS ACTION COMPLAINT  Case 3:22-cv-03173 Document 1 Filed 05/31/22 Page 10 of 25 1 B. Twitter’s Deceptive Collection of Personal Information for Account 2 Recovery 3 42. In June 2015, Twitter began prompting users to add a telephone number to their 4 Twitter accounts as a safeguard in the event of a lost password. Then, in April 2018, Twitter also 5 began prompting users to add an email address. 6 43. Since June 2015, if users do not have a telephone number associated with their 7 accounts, Twitter may prompt the users to add a telephone number through a message similar to the 8 one depicted below: 9 10 11 12 13 14 15 44. Similarly, since April 2018, if a user does not have an email address associated with 16 their account, Twitter may prompt the user to add an email address through a message similar to 17 the one depicted below: 18 19 20 21 22 23 24 45. Through September 2019, Twitter did not disclose at any point in the account 25 recovery pathway or any of the messages described above that it was using the telephone numbers 26 or email addresses users provided for account recovery to target advertisements to those users. 27 46. According to the 2022 FTC Complaint, from June 2015, approximately 37 million 28 10 CLASS ACTION COMPLAINT  Case 3:22-cv-03173 Document 1 Filed 05/31/22 Page 11 of 25 1 users provided a telephone number or email address for account recovery purposes. 2 47. The fact that Twitter used the telephone numbers and email addresses provided by 3 users for the purpose of safeguarding their accounts for advertising would be material to users when 4 deciding whether to provide their information for account recovery purposes. 5 C. Twitter’s Deceptive Collection of Personal Information for Re- Authentication 6 7 48. In December 2013, Twitter began requiring users to provide a telephone number or 8 email address for re-authentication (e.g., to re-enable full access to an account after Twitter has 9 detected suspicious or malicious activity). 10 49. If Twitter detects suspicious or malicious activity on a user’s account, or suspects 11 that the account may belong to a previously-banned user, Twitter may require the user to re- 12 authenticate by providing a telephone number through a prompt similar to the one depicted below: 13 14 15 16 17 18 19 20 21 22 23 24 50. If users click the “Start” button pictured above, they are instructed to enter a 25 telephone number through a prompt similar to the one depicted below: 26 27 28 11 CLASS ACTION COMPLAINT  Case 3:22-cv-03173 Document 1 Filed 05/31/22 Page 12 of 25 1 2 3 4 5 6 7 8 9 10 11 12 51. Similarly, Twitter may require users to provide an email address to re-enable full 13 access to their accounts with a prompt similar to the one depicted below: 14 15 16 17 18 19 20 21 22 23 52. Through September 2019, Twitter did not disclose at any point in the re- 24 authentication pathway described above that it was using the telephone numbers or email addresses 25 users provided for re-authentication to target advertisements to those users. 26 53. According to the 2022 FTC Complaint, from September 2014, approximately 104 27 million users provided a telephone number or email address in response to a prompt for re- 28 12 CLASS ACTION COMPLAINT  Case 3:22-cv-03173 Document 1 Filed 05/31/22 Page 13 of 25 1 authentication. 2 54. The fact that Twitter used the telephone numbers and email addresses provided for 3 re-authentication for advertising would be material to users when deciding whether to provide their 4 information in response to a prompt for re-authentication. 5 III. Twitter Misrepresented that it Processed Personal Data in Accordance with the EU- U.S. and Swiss-U.S. Privacy Shield Frameworks 6 7 55. The European Union and Switzerland have each established regulatory regimes to 8 protect individuals’ right to privacy with respect to the processing of their personal data. Both 9 privacy regimes generally prohibit businesses from transferring personal data to third countries 10 unless the recipient jurisdiction’s laws are deemed to adequately protect personal data. 11 56. To ensure adequate privacy protections for commercial data transfers, the 12 International Trade Administration of the U.S. Department of Commerce (“Commerce”) 13 coordinated with the European Commission and the Swiss Administration to craft the EU-U.S. and 14 Swiss-U.S. Privacy Shield Frameworks (“Privacy Shield” or “Frameworks”). The Frameworks are 15 materially identical. 16 57. To rely on the Privacy Shield for data transfers, a company needed to self-certify 17 and annually affirm to Commerce that it complied with the Privacy Shield Principles (the 18 “Principles”). Of note, Principle 5(a) provided that “[a]n organization may not process personal 19 information in a way that is incompatible with the purposes for which it has been collected or 20 subsequently authorized by the individual.” The Frameworks defined “processing” to include “any 21 operation or set of operations which is performed upon personal data, whether or not by automated 22 means” and includes, among other things, “collection,” “storage,” and “use” of personal 23 information. 24 58. Companies under the enforcement jurisdiction of the FTC, as well as the U.S. 25 Department of Transportation, were eligible to join the EU-U.S. and Swiss-U.S. Privacy Shield 26 Frameworks. A company under the FTC’s jurisdiction that self-certified to the Privacy Shield 27 Principles, but failed to comply with the Privacy Shield, may be subject to an enforcement action 28 based on the FTC’s deception authority under Section 5 of the FTC Act. 13 CLASS ACTION COMPLAINT  Case 3:22-cv-03173 Document 1 Filed 05/31/22 Page 14 of 25 1 59. Commerce maintains a public website, https://www.privacyshield.gov, where it 2 posts the names of companies that have self-certified to the Privacy Shield. The listing of 3 companies, found at https://www.privacyshield.gov/list, indicates whether the company’s self- 4 certification is current. 5 60. On November 16, 2016, Twitter self-certified its participation in the Privacy Shield. 6 Twitter has reaffirmed its participation in the Privacy Shield to Commerce each year thereafter. 7 61. As described above, through at least September 2019, Twitter deceptively used 8 personal information collected for specific security-related purposes for advertising. 9 62. Twitter’s use of such personal information for advertising purposes was not 10 compatible with the purposes for which the information was collected, and Twitter did not obtain 11 subsequent authorization from any individual to use such information for advertising. 12 63. As a company under the jurisdiction of the FTC, Twitter’s failure to comply with the 13 Privacy Shield, is a violation of Section 5 of the FTC Act. 14 IV. Twitter Violated Its Privacy Policy and Cal. Bus. & Prof. Code § 22576 15 64. Pursuant to its Terms of Service, Twitter’s “ Privacy 16 Policy (https://www.twitter.com/privacy) describes how we handle the information you provide to 17 us when you use our Services. You understand that through your use of the Services you consent to 18 the collection and use (as set forth in the Privacy Policy) of this information . . .”4 19 65. Twitter’s Privacy Policy—as set out at https://twitter.com/en/privacy—repeatedly 20 touts how it respects its users privacy, and does not disclose user’s information without their 21 consent. 22 66. For example, it states: 23 • “We believe you should always know what data we collect from you and how we 24 25 4 Twitter Terms of Service, effective May 25, 2018, at § 2, available at https://twitter.com/en/tos/previous/version_13. Prior versions of the Terms of Service are 26 virtually identical in this respect. See, e.g., Twitter Terms of Service, effective June 25, 2012, at § 2, available at https://twitter.com/en/tos/previous/version_7 (“Any information that you 27 provide to Twitter is subject to our Privacy Policy, which governs our collection and use of your information. You understand that through your use of the Services you consent to the collection 28 and use (as set forth in the Privacy Policy) of this information . . ..”. 14 CLASS ACTION COMPLAINT  Case 3:22-cv-03173 Document 1 Filed 05/31/22 Page 15 of 25 1 use it, and that you should have meaningful control over both. We want to empower 2 you to make the best decisions about the information that you share with us.” Privacy 3 Policy, p. 1. 4 • “We give you control through your settings to limit the data we collect from you and 5 how we use it, and to control things like account security, marketing preferences, 6 apps that can access your account, and address book contacts you’ve uploaded to 7 Twitter. You can also download information you have shared on Twitter.” Privacy 8 Policy, p. 2. 9 67. Most notably, § 3.1 of the Privacy Policy promises that: 10 We share or disclose your personal data with your consent or at your direction, such as when you authorize a third-party web client 11 or application to access your account or when you direct us to share 12 your feedback with a business. . . . 13 Subject to your settings, we also provide certain third parties with personal data to help us offer or operate our services. You can learn 14 more about these partnerships in our Help Center, and you can 15 control whether Twitter shares your personal data in this way by using the “Allow additional information sharing with 16 business partners” option in your Personalization and Data settings. (This setting does not control sharing described elsewhere 17 in our Privacy Policy, such as when we share data with our service providers, or through partnerships other than as described in our 18 Help Center.) 19 68. As described herein, Twitter did not abide by its Privacy Policy in that Plaintiff and 20 Class Members did not “know what data” Twitter “collect[ed] from [them] and how we use[d] it,” 21 nor did Plaintiff and Class Members “have meaningful control over both”; Twitter did not give its 22 users “control through your settings to limit the data we collect from you and how we use”; and 23 most importantly Twitter did “share or disclose [users] personal data” without their “consent or at 24 [users’] direction; all contrary to the their Privacy Policy. 25 69. Importantly, Cal. Bus. & Prof. Code § 22576, prohibits an “operator of a commercial 26 Web site or online service that collects personally identifiable information through the Web site or 27 online service from individual consumers who use or visit the commercial Web site or online 28 15 CLASS ACTION COMPLAINT  Case 3:22-cv-03173 Document 1 Filed 05/31/22 Page 16 of 25 1 service” from “knowingly and willfully” or “negligently and materially” failing “to comply with” 2 the “provisions of its posted privacy policy.” 3 70. Here, Twitter either “knowingly and willfully” or “negligently and materially” failed 4 “to comply with” the “provisions of its posted privacy policy,” in violation of Cal. Bus. & Prof. 5 Code § 22576. 6 V. Tolling of the Statute of Limitations 7 71. Any applicable statutes of limitations have been tolled under (1) the fraudulent 8 concealment doctrine, based on Twitter’s knowing and active concealment and denial of the facts 9 alleged herein and (2) the delayed discovery doctrine, as Plaintiff did not and could not reasonably 10 have discovered Twitter’s conduct alleged herein until shortly before the Complaint was filed. 11 72. Twitter never disclosed, or adequately disclosed, that it would use the collected 12 Personal Information of Plaintiff and Class Members for advertising purposes. 13 CLASS ACTION ALLEGATIONS 14 15 73. Plaintiff seeks relief on behalf of herself and as representative of all others who are 16 similarly situated. Pursuant to Fed. R. Civ. P. Rule 23(a), (b)(2), (b)(3) and (c)(4), Plaintiff seeks 17 certification of a nationwide class defined as follows: 18 All individuals residing in the United States who between May 2013 and September 2019 provided his or her telephone 19 number(s) and/or email address(es) (“Personal Information”) to 20 Twitter for purposes of two-factor authentication, account recovery, and/or account re-authentication (the “Nationwide 21 Class”). 22 74. Excluded from the Class are the following individuals and/or entities: Defendant and 23 Defendant’s parents, subsidiaries, affiliates, officers and directors, and any entity in which 24 Defendant has a controlling interest; all individuals who make a timely election to be excluded from 25 this proceeding using the correct protocol for opting out; any and all federal, state or local 26 governments, including but not limited to their departments, agencies, divisions, bureaus, boards, 27 sections, groups, counsels and/or subdivisions; and all judges assigned to hear any aspect of this 28 litigation, as well as their immediate family members and staff. 16 CLASS ACTION COMPLAINT  Case 3:22-cv-03173 Document 1 Filed 05/31/22 Page 17 of 25 1 75. Plaintiff reserves the right to modify or amend the definition of the proposed classes 2 before the Court determines whether certification is appropriate. 3 76. The proposed Class meets the criteria for certification under Rule 23(a), (b)(2), (b)(3) 4 and (c)(4). 5 77. Ascertainability: Membership of the Class is defined based on objective criteria and 6 individual members will be identifiable from Twitter’s records, including from Twitter’s massive 7 data storage, consumer accounts, and enterprise services. Based on information readily accessible 8 to it, Twitter can identify members of the Class who were victims of Twitter’s impermissible 9 collection and use of the Personal Information as alleged herein. 10 78. Numerosity: The Class consists of millions of individuals. Specifically, as noted 11 above, according to the 2022 FTC Complaint, from May 2013, approximately two million users 12 provided a telephone number to enable two-factor authentication; from June 2015, approximately 37 13 million users provided a telephone number or email address for account recovery purposes; and from 14 September 2014, approximately 104 million users provided a telephone number or email address in 15 response to a prompt for re-authentication. Accordingly, members of the Class are so numerous that 16 joinder of all members is impracticable. Class members may be identified from Defendant’s 17 records, including from Twitter’s consumer accounts and enterprise services. 18 79. Predominant Common Questions: Common questions of law and fact exist as to 19 all members of the Class and predominate over any questions affecting solely individual members 20 of the Class. Common questions for the Class include, but are not limited to, the following: 21 a. Whether, during the class period, Twitter disclosed, or adequately disclosed, 22 the purposes for which it was collecting and using the Personal Information; 23 b. Whether, during the class period, Twitter used the collected Personal 24 Information for purposes other than for two-factor authentication, account 25 recovery, and/or account re-authentication, and, specifically whether Twitter 26 used the Personal Information for marketing and/or advertising purposes; 27 c. Whether Twitter’s practice of collecting and utilizing the Personal 28 Information violated the 2011 Commission Order and/or the FTC Act; 17 CLASS ACTION COMPLAINT  Case 3:22-cv-03173 Document 1 Filed 05/31/22 Page 18 of 25 1 d. Whether Twitter’s practice of collecting and utilizing the Personal 2 Information violated state and federal privacy laws; 3 e. Whether Twitter’s practice of collecting and utilizing the Personal 4 Information violated tort laws; 5 f. Whether Twitter has been unjustly enriched by its practice of collecting and 6 utilizing the Personal Information; 7 g. Whether Plaintiff and Class Members are entitled to declaratory and/or 8 injunctive relief to enjoin the unlawful conduct alleged herein; and 9 h. Whether Plaintiff and Class members have sustained damages as a result of 10 Twitter’s conduct and if so, what is the appropriate measure of damages or 11 restitution. 12 80. Typicality: Plaintiff’s claims are typical of the claims of other Class members, as all 13 members of the Class were uniformly affected by Twitter’s wrongful conduct in violation of law as 14 complained of herein. 15 81. Adequacy of Representation: Plaintiff will fairly and adequately protect the interests 16 of the members of the Class and has retained counsel that is competent and experienced in class action 17 litigation, including nationwide class actions and privacy violations. Plaintiff and her counsel have 18 no interest that is in conflict with, or otherwise antagonistic to the interests of the other Class 19 members. Plaintiff and her counsel are committed to vigorously prosecuting this action on behalf 20 of the members of the Class, and they have the resources to do so. 21 82. Superiority: A class action is superior to all other available methods for the fair and 22 efficient adjudication of this controversy since joinder of all members is impracticable. This proposed 23 class action presents fewer management difficulties than individual litigation and provides the benefits 24 of a single adjudication, economies of scale and comprehensive supervision by a single, able court. 25 Furthermore, as the damages individual Class members have suffered may be relatively small, the 26 expense and burden of individual litigation make it impossible for members of the Class to individually 27 redress the wrongs done to them. There will be no difficulty in management of this action as a class 28 action. 18 CLASS ACTION COMPLAINT  Case 3:22-cv-03173 Document 1 Filed 05/31/22 Page 19 of 25 1 83. California Law Applies to the Entirety of the Class: California’s substantive laws 2 apply to every member of the Class, regardless of where in the United States the Class member resides. 3 Defendant’s own Terms of Service explicitly states “The laws of the State of California, excluding its 4 choice of law provisions, will govern these Terms and any dispute that arises between you and Twitter. 5 All disputes related to these Terms or the Services will be brought solely in the federal or state courts 6 located in San Francisco County, California, United States, and you consent to personal jurisdiction 7 and waive any objection as to inconvenient forum.”5 By choosing California law for the resolution of 8 disputes covered by its Terms of Service, Twitter concedes that it is appropriate for this Court to apply 9 California law to the instant dispute to all Class members. Further, California’s substantive laws may 10 be constitutionally applied to the claims of Plaintiff and the Class members under the Due Process 11 Clause, see U.S. CONST. amend. XIV, § 1, and the Full Faith and Credit Clause, see U.S. CONST. art. 12 IV, § 1, of the U.S. Constitution. California has significant contact, or significant aggregation of 13 contacts, to the claims asserted by the Plaintiff and all Class members, thereby creating state interests 14 that ensure that the choice of California state law is not arbitrary or unfair. Defendant’s decision to 15 reside in California and avail itself of California’s laws, and to engage in the challenged conduct from 16 and emanating out of California, renders the application of California law to the claims herein 17 constitutionally permissible. The application of California laws to the Class is also appropriate under 18 California’s choice of law rules because California has significant contacts to the claims of Plaintiff 19 and the proposed Class and California has the greatest interest in applying its laws here. 20 84. Plaintiff reserves the right to revise the foregoing class allegations and definitions based 21 on facts learned and legal developments following additional investigation, discovery, or otherwise. 22 23 24 5 See Twitter Terms of Service, effective May 25, 2018, at § 6, available at https://twitter.com/en/tos/previous/version_1. Prior versions of the Terms of Service are virtually 25 identical in this respect. See, e.g., Twitter Terms of Service, effective June 25, 2012, at § 12.B, available at https://twitter.com/en/tos/previous/version_7 (“These Terms and any action related 26 thereto will be governed by the laws of the State of California without regard to or application of its conflict of law provisions or your state or country of residence. All claims, legal proceedings 27 or litigation arising in connection with the Services will be brought solely in the federal or state courts located in San Francisco County, California, United States, and you consent to the 28 jurisdiction of and venue in such courts and waive any objection as to inconvenient forum.”). 19 CLASS ACTION COMPLAINT  Case 3:22-cv-03173 Document 1 Filed 05/31/22 Page 20 of 25 COUNTS 1 COUNT ONE: BREACH OF CONTRACT 2 (On Behalf of Plaintiff and the Nationwide Class) 3 85. Plaintiff hereby incorporates Paragraphs 1 through 84 as if fully stated herein. 4 86. Twitter’s relationship with its users is governed by the Twitter Terms of Service, 5 the Twitter Privacy Policy. 6 87. The Twitter Privacy Policy repeatedly promises Plaintiff and Class members that 7 Twitter respects their information and discloses such information only with users’ consent. 8 88. Specifically, Twitter’s Privacy Policy states: 9 • “We believe you should always know what data we collect from you and how we 10 use it, and that you should have meaningful control over both. We want to empower 11 you to make the best decisions about the information that you share with us.” Privacy 12 Policy, p. 1. 13 • “We give you control through your settings to limit the data we collect from you and 14 how we use it, and to control things like account security, marketing preferences, 15 apps that can access your account, and address book contacts you’ve uploaded to 16 Twitter. You can also download information you have shared on Twitter.” Privacy 17 Policy, p. 2. 18 89. Most notably, § 3.1 of the Privacy Policy promises that: 19 We share or disclose your personal data with your consent or at 20 your direction, such as when you authorize a third-party web client 21 or application to access your account or when you direct us to share your feedback with a business. . . . 22 Subject to your settings, we also provide certain third parties with 23 personal data to help us offer or operate our services. You can learn more about these partnerships in our Help Center, and you can 24 control whether Twitter shares your personal data in this way 25 by using the “Allow additional information sharing with business partners” option in your Personalization and Data 26 settings. (This setting does not control sharing described elsewhere in our Privacy Policy, such as when we share data with our service 27 providers, or through partnerships other than as described in our Help Center.) 28 20 CLASS ACTION COMPLAINT  Case 3:22-cv-03173 Document 1 Filed 05/31/22 Page 21 of 25 1 90. Twitter breached these promises. 2 91. As described herein, Plaintiff and Class Members did not “know what data” Twitter 3 “collect[ed] from [them] and how [Twitter] use[d] it,” nor did Plaintiff and Class Members “have 4 meaningful control over both”; Twitter did not give its users “control through your settings to limit 5 the data we collect from you and how we use”; and most importantly Twitter did “share or disclose 6 [users] personal data” without their “consent or at [users’] direction”; all contrary to the their 7 Privacy Policy. 8 92. Plaintiff and Class members fulfilled their obligations under the relevant contracts 9 and are not in breach of any. 10 93. As a result of Twitter’s breach(es), Twitter was able to obtain the personal property 11 of Plaintiff and Class members and earn unjust profits. 12 94. Plaintiff and Class Members also did not receive the benefit of the bargain for 13 which they contracted and for which they paid valuable consideration in the form of the personal 14 information they agreed to share, which has ascertainable value to be proven at trial. 15 95. Plaintiff, on behalf of themselves and Class members, seek compensatory damages, 16 consequential damages, nominal damages, and/or non-restitutionary disgorgement in an amount to 17 be proven at trial, and declarative, injunctive, or other equitable relief. 18 COUNT TWO: BREACH OF IMPLIED CONTRACT 19 (Alleged In the Alternative to Count I) 20 (On Behalf of Plaintiff and the Nationwide Class) 21 96. Plaintiff hereby incorporates Paragraphs 1 through 844 as if fully stated herein. 22 97. Defendant solicited and collected the Personal Information of Plaintiff and Class 23 Members with the express representation that it would be used for two-factor authentication, 24 account recovery, and/or account re-authentication. 25 98. In so doing, Plaintiff and the Class entered into implied contracts with Defendant 26 by which Defendant agreed to utilize the Personal Information solely for the purposes expressed: 27 two-factor authentication, account recovery, and/or account re-authentication, and no other purposes 28 such as marketing and/or advertising. 21 CLASS ACTION COMPLAINT  Case 3:22-cv-03173 Document 1 Filed 05/31/22 Page 22 of 25 1 99. A meeting of the minds occurred when Plaintiff and Class Members agreed to, and 2 did, provide their Personal Information to Defendant. 3 100. Plaintiff and the Class fully performed their obligations under the implied contracts 4 with Defendant. 5 101. Defendant breached the implied contracts it made with Plaintiff and the Class by 6 utilizing and profiting from their Personal Information via the marketing and advertising purposes 7 the information was put to. 8 102. As a result of Defendant’s breach of implied contract, Plaintiff and the Class are 9 entitled to and demand actual, consequential, and nominal damages. 10 COUNT THREE: UNFAIR COMPETITION LAW (“UCL”), 11 CAL. BUS. & PROF. CODE § 17200 ET SEQ. (On Behalf of Plaintiff and the Nationwide Class) 12 103. Plaintiff hereby incorporates Paragraphs 1 through 844 as if fully stated herein. 13 104. The UCL prohibits any “unlawful, unfair, or fraudulent business act or practice and 14 unfair, deceptive, untrue or misleading advertising.” Cal. Bus. & Prof. Code § 17200 (UCL). By 15 engaging in the practices aforementioned, Twitter has violated the UCL. 16 105. Twitter’s “unlawful” acts and practices include its violation of the 2011 Commission 17 Order and Section 5 of FTC Act, violation of the Privacy Shield and Frameworks, and violation of 18 Cal. Bus. & Prof. Code § 22576. 19 106. Twitter’s conduct violated the spirit and letter of these laws, which prohibit 20 unauthorized disclosure and collection of personal information. 21 107. Twitter’s “unfair” acts and practices include its misrepresentations regarding, and 22 failure to disclose the purposes for which it was collecting and utilizing, the Personal Information, 23 as described above, and its subsequent use of that information for profit. 24 108. Plaintiff and Class members have suffered injury-in-fact, including the loss of money 25 and/or property as a result of Twitter’s unfair and/or unlawful practices, to wit, the unauthorized 26 disclosure and use of their Personal Information which has value as demonstrated by its use for 27 targeted advertising by Twitter. Plaintiff and Class Members have suffered harm in the form of 28 22 CLASS ACTION COMPLAINT  Case 3:22-cv-03173 Document 1 Filed 05/31/22 Page 23 of 25 1 diminution of the value of their private and personally identifiable data and content. 2 109. Twitter’s actions caused damage to and loss of Plaintiff’s and Class Members’ 3 property right to control the dissemination and use of their personal information. 4 110. Twitter reaped unjust profits and revenues in violation of the UCL. This includes 5 Twitter’s profits and revenues from their targeted-advertising. Plaintiff and the Class seek 6 restitution and disgorgement of these unjust profits and revenues. 7 COUNT FOUR: UNJUST ENRICHMENT (Alleged In the Alternative to Counts 1 & 2) 8 (On Behalf of Plaintiff and the Nationwide Class) 9 111. Plaintiff hereby incorporates Paragraphs 1 through 84 as if fully stated herein. 10 112. Plaintiff and Class members conferred a benefit on Twitter. Specifically, they 11 provided Twitter with their Personal Information. In exchange, Plaintiff and Class Members 12 should have received from Twitter the services that were the subject of the transaction—two- 13 factor authentication, account recovery, and/or account re-authentication services—and should have 14 been entitled to have Twitter not disclose and use their Personal Information for targeted 15 advertising and/or marketing purposes. 16 113. Twitter knew that Plaintiff and Class members conferred a benefit on Twitter and 17 has accepted or retained that benefit. Twitter profited from the Personal Information of Plaintiff 18 and Class Members for business purposes, without disclosing to, or authorization from, Plaintiff 19 and Class members to so use the Personal Information. 20 114. Thus, Twitter acquired the Personal Information through inequitable means in that 21 it failed to disclose all the purposes for which it would use the Personal Information, and 22 misrepresented those uses. 23 115. Plaintiff and Class members have no adequate remedy at law. 24 116. Under the circumstances, it would be unjust for Twitter to be permitted to retain 25 any of the benefits that Plaintiff and Class members conferred on it. 26 117. Twitter should be compelled to disgorge into a common fund or constructive trust, 27 for the benefit of Plaintiff and Class members, proceeds that it unjustly received—specifically all 28 23 CLASS ACTION COMPLAINT  Case 3:22-cv-03173 Document 1 Filed 05/31/22 Page 24 of 25 1 revenue related to the targeted advertising and/or marketing that utilized the improperly obtained 2 Personal Information. 3 PRAYER FOR RELIEF 4 WHEREFORE, Plaintiff respectfully requests that this Court: 5 A. Certify this action is a class action pursuant to Rule 23 of the Federal Rules of Civil 6 Procedure; 7 B. Appoint Plaintiff to represent the Class; 8 C. Appoint undersigned counsel to represent the Class; 9 D. Award compensatory damages, including statutory damages where available, to 10 Plaintiff and the Class members against Defendant for all damages sustained as a result of 11 Defendant’s wrongdoing, in an amount to be proven at trial, including interest thereon; 12 E. Award nominal damages to Plaintiff and the Class members against Defendant; 13 F. Non-restitutionary disgorgement of all of Defendant’s profits that were derived, in 14 whole or in part, from Twitter’s collection and subsequent use of Plaintiff’s Personal Information; 15 G. Ordering Defendant to disgorge revenues and profits wrongfully obtained; 16 H. Award Plaintiff and the Class members their reasonable costs and expenses 17 incurred in this action, including attorneys’ fees and expert fees; and 18 I. Grant Plaintiff and the Class members such further relief as the Court deems 19 appropriate. 20 JURY TRIAL DEMAND 21 The Plaintiff demands a trial by jury of all issues so triable. 22 Date: May 31, 2022 Respectfully Submitted, 23 24 Michael F. Ram 25 MICHAEL F. RAM (SBN 104805) MORGAN & MORGAN COMPLEX 26 LITIGATION GROUP 711 Van Ness Avenue, Suite 500 27 San Francisco, CA 94102 28 Telephone: (415) 358-6913 24 CLASS ACTION COMPLAINT  Case 3:22-cv-03173 Document 1 Filed 05/31/22 Page 25 of 25 Facsimile: (415) 358-6923 1 mram@ForThePeople.com 2 JOHN A. YANCHUNIS 3 (Pro Hac Vice application forthcoming) JEAN SUTTON MARTIN 4 (Pro Hac Vice application forthcoming) PATRICK BARTHLE 5 (Pro Hac Vice application forthcoming) 6 MORGAN & MORGAN COMPLEX LITIGATION GROUP 7 201 N. Franklin Street, 7th Floor Tampa, Florida 33602 8 Telephone: (813) 559-4908 Facsimile: (813) 222-4795 9 jyanchunis@ ForThePeople.com 10 jeanmartin@ForThePeople.com pbarthle@ForThePeople.com 11 12 Attorneys for Plaintiff and the Putative Class 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 25 CLASS ACTION COMPLAINT