Intellectual Property Law

Third Party Websites Collecting User Information from Facebook

By Martha L. Arias

Social networks are a great way to communicate and share events and experiences.  Yet, as many other innovative Websites, social networks comprise features that may facilitate identity theft, invasion of privacy, copyright violations, online defamation among others. For this reason, must social networks have terms of use that seek to protect users' information as well as the social network's copyrights. An individual that misuses information obtained from Facebook's profiles may face criminal and civil liability, depending on the specific facts, if the victim seeks legal readdress. Hence, if a third party Website collects user information from Facebook, what would be the possible cause of action against that company?

Ideas are unbounded and so are e-commerce models.  Every day new Websites are created and many of these are business models that use existing ones to produce novel online services.  An interesting case arose in California when Facebook filed a lawsuit against a third party Website that utilized user information from Facebook and incorporated it in its site.  This article informs on the cause of action Facebook claimed and the court's holding when the defendant moved to dismiss.

Facebook has become one of the most popular social networks. It allows users to upload their profile and pictures, share information, and communicate internally with other users. Power.com is a Website designed to integrate several social networks and e-mail accounts into one single portal. Power.com extracted user information from Facebook and placed it in its site. Facebook filed a lawsuit against Power.com in the United States District Court of the Northern District of California (Case Number C 08-5780 JF (RS)) alleging violation of (1) the Controlling the Assault of Non-Solicited Pornography and Marketing Act (CAN-SPAM), 15 U.S.C. § 7701, et seq.; (2) the Computer Fraud and Abuse Act (CFAA), 18 U.S.C. § 1030 et seq.; and (3) the California Penal Code § 502; (4) the Digital Millennium Copyright Act (DMCA), 17 U.S.C. § 1201, et seq.; (5) the U.S. Copyright Act when Power.com made copies of Facebook Website when extracting user information; and (6)the California's Unfair Competition Law (UCL), Cal. Bus. & Prof. Code § 17200, et seq.

Facebook terms of use were decisive when assessing the viability of these causes of action. Facebook users must agree to the terms of use set by this Website and have limited license to access and use its services. Also, regarding third parties, Facebook's terms of use include limited license for third parties that intend to create applications that interact with Facebook's network.  Facebook allows third parties to integrate their sites with Facebook and exchange proprietary data provided that the third parties use the "Facebook Connect" service.  This service enables users to connect their Facebook identity and friends to those third party Websites. No exchange is allowed outside the Facebook Connect service.

Power.com offers its users to integrate social networking and e-mail accounts into a single portal. Users determine which account they want to aggregate and provide user names and passwords to Power.com. Power.com uses this access information to scrape user data from Facebook and any other network site or e-mail provider.  Then, users can log on to Power.com and view data culled from Facebook and other social networks or e-mail accounts provided. Power.com took this data from Facebook without using Facebook Connect service.

Power.com moved to dismiss the copyright claim, the DMCA charge, the trademark violation, and the UCL charge.  The court denied motion to dismiss the copyright claim. The court held that Power.com's access of Facebook's information constituted authorized access because Power.com had to copy the entire Facebook profile in order to extract user information. The court denied the motion to dismiss the DMCA charge arguing that Facebook's terms of use strictly prohibited unauthorized access by automated programs.  The court provided Facebook thirty days to clarify its claim under the UCL.   

This decision, rendered on May 2009, means the case will proceed to trial.  This is a very interesting case that will set the standard for those new Websites that become an aggregator of other sites without proper authorization to access or extract data.   

Full post as published by IBLS Internet Law Blog on November 22, 2009 (boomark / email).