Meta Platforms, Inc. v. BrandTotal Ltd.

1

2

3

4 UNITED STATES DISTRICT COURT

5 NORTHERN DISTRICT OF CALIFORNIA

6

7 FACEBOOK, INC., Case No. 20-cv-07182-JCS

8 Plaintiff,

ORDER REGARDING MOTION FOR

9 v. TEMPORARY RESTRAINING ORDER

10 BRANDTOTAL LTD., et al., Provisionally Filed Under Seal

11 Defendants. Re: Dkt. No. 27

12

13 I. INTRODUCTION

14 Plaintiff Facebook, Inc. brings this action asserting breach of contract, violation of the

15 Computer Fraud and Abuse Act (“CFAA”), and other claims against Defendants BrandTotal Ltd.

16 and Unimania, Inc. (collectively, “BrandTotal”1) based on BrandTotal’s collection and marketing

17 of data from Facebook’s websites—specifically, its eponymous social network (hereinafter the

18 “Facebook Network,” in order to distinguish that product from the corporate entity) and

19 Instagram. BrandTotal asserts counterclaims based on Facebook blocking its access to those

20 products, and now moves for a temporary restraining order (“TRO”). The Court held a hearing on

21 October 26, 2020.

22 BrandTotal has shown serious issues going to the merits of its counterclaims, which

23 implicate difficult questions of balancing—among other considerations—Facebook’s interests in

24 limiting access to its networks, BrandTotal’s interests in maintaining its business, the public

25 interest in competition, and individual users’ potentially conflicting interests in both the privacy of

26 their data and choosing how to share that data. Nevertheless, for the reasons discussed below, the

27

1 Court DENIES BrandTotal’s motion.2

2 II. BACKGROUND

3 A. The Parties’ Allegations and Claims

4 The following subsections summarize the parties’ factual allegations as context for their

5 respective claims and positions. Nothing in these subsections should be construed as resolving

6 any disputed issue of fact, or as addressing whether any allegation has evidentiary support in the

7 current record. The evidentiary record is addressed in the context of the Court’s analysis.

8 1. Facebook’s Allegations and Claims

9 Facebook is a social networking company with billions of individual users across multiple

10 products, including the Facebook Network and the Instagram social network.3 See Compl. (dkt. 1)

11 ¶ 13. All users of the Facebook Network agree to contractual terms including that users will not

12 do anything that would “impair the proper working or appearance” of Facebook’s products, will

13 not access or collect data from Facebook’s products “using automated means” without Facebook’s

14 permission, and will not attempt to access data that the particular user lacks permission to access.

15 Id. ¶¶ 21, 24, 26. All Instagram users similarly agree not to do “anything to interfere with or

16 impair the intended operation” of Instagram, not to “collect[] information in an automated way

17 without [Facebook’s] express permission,” not to access information “in unauthorized ways,” and

18 not to violate anyone else’s rights, including intellectual property rights. Id. ¶¶ 22, 25, 27. Users

19 of both networks agree not to do anything unlawful, misleading, or fraudulent, or to facilitate such

20 activity. Id. ¶ 23. According to Facebook, BrandTotal agreed to these terms when it created

21 accounts on the Facebook Network and Instagram. See id. ¶¶ 35–39.

22 Facebook employs various measures to prevent “scraping”—bulk automated collection—

23 of content from its products, including monitoring usage patterns, using “CAPTCHA” tests to

24 determine whether users are human as opposed to automated programs, and disabling accounts

25

26

2 The parties have consented to the jurisdiction of the undersigned magistrate judge for all

purposes pursuant to 28 U.S.C. § 636(c).

27

3 This case concerns only the Facebook and Instagram social networks. References herein to

1 that violate its rules. Id. ¶ 29.

2 BrandTotal offered programs called UpVoice and Ads Feed that users could install as

3 extensions for the Google Chrome internet browser, which Facebook alleges worked as follows:

4 Once installed by the users . . . [BrandTotal] used the users’ browsers

as a proxy to access Facebook computers, without Facebook’s

5 authorization, meanwhile pretending to be a legitimate Facebook or

Instagram user. The malicious extensions contained JavaScript files

6 designed to web scrape the user’s profile information, user

advertisement interest information, and advertisements and

7 advertising metrics from ads appearing on a user’s account, while the

user visited the Facebook or Instagram websites. The data scraped by

8 [BrandTotal] included both public and non-publicly viewable data

about the users.

9

[BrandTotal’s] malicious extensions were designed to web scrape

10 Facebook and Instagram user profile information, regardless of the

account’s privacy settings. The malicious extensions were

11 programmed to send unauthorized, automated commands to

Facebook and Instagram servers purporting to originate from the user

12 (instead of [BrandTotal]), web scrape the information, and send the

scraped data to the user’s computer, and then to servers that

13 [BrandTotal] controlled.

14 Id. ¶¶ 45–46. Facebook alleges that BrandTotal collected information including “the user’s ID,

15 gender, date of birth, relationship status, and location information,” users’ “Ad Preferences”

16 information that Facebook used to determine what ads to show them, and—with respect to

17 advertisements that users viewed while using the extension—“information about the advertiser,

18 the image and text of the advertisement, and user interaction and reaction metrics (e.g., number of

19 views, comments, likes) associated with an advertisement.” Id. ¶ 54. According to Facebook, the

20 UpVoice and Ads Feed extensions used nearly identical code and functioned materially the same

21 way. See id. ¶ 57.

22 Facebook provides a searchable public library of all advertisements published on its

23 networks, which includes data such as the “Page” responsible for running the ad, the geographic

24 region it is directed to, and the number of users that viewed the ad on a particular day. See id.

25 ¶¶ 17–19. Facebook’s public library does not include demographic information about users that

26 viewed a particular ad, or information regarding how users interacted with an ad (e.g., “likes” and

27 comments). Id. ¶ 20.

1 payment for UpVoice users, by allowing Ads Feed users to review lists of ads they had seen in the

2 last ninety days so that users could return to ads that interested them, and by telling users that they

3 would serve as “panelists” to influence corporate marketing decisions. Id. ¶¶ 43–44, 49, 56.

4 BrandTotal analyzed and sold the data that it obtained from users to corporate clients. Id. ¶ 37.

5 BrandTotal used different trade names for its browser extensions (which gathered data) and its

6 marketing intelligence product (which incorporated that data), and advertised its products to both

7 potential individual users (who might install the browser extensions and provide data) and

8 potential corporate clients (who might purchase data) on the Facebook Network. Id. ¶¶ 39–40, 42,

9 47.

10 According to Facebook, BrandTotal made misleading representations to users of its

11 browser extensions, both by including the Facebook Network in a list of “participating sites” when

12 Facebook had not agreed to work with BrandTotal or authorized it to access Facebook’s data, and

13 by failing to include Instagram in the list of “participating sites” even though the browser

14 extension scraped data from Instagram. Id. ¶ 50.

15 On September 30, 2020, Facebook disabled BrandTotal’s accounts on Instagram and the

16 Facebook Network and instated other technological measures to block BrandTotal’s access to

17 Facebook’s products. Id. ¶ 58. On October 1, 2020, Facebook filed a civil action against

18 BrandTotal in California state court alleging that the browser extensions breached Facebook’s

19 terms of service. Id. ¶ 59.4 Later that day, Google removed the browser extensions from its

20 Chrome Web Store, which disabled their functionality. Id. ¶ 60. On October 3, 2020,

21 BrandTotal’s chief product officer created accounts on Instagram and the Facebook Network using

22 false names. Id. ¶ 61. On October 12, 2020, BrandTotal introduced a new UpVoice browser

23 extension on the Chrome Web Store, listing the developer of the extension as “UpVoice Team.”

24 Id. ¶ 62. According to Facebook, the new UpVoice extension—like its predecessors—collected

25 data when users accessed the Facebook Network and returned that data to BrandTotal, including

26

27

4 Facebook voluntarily dismissed its state court action before bringing the present action in this

1 data that was, “in some cases, not even viewed by the user.” Id. Around thirty users installed this

2 new extension. Id.

3 Facebook asserts the following claims: (1) breach of contract, based on the Facebook

4 Network and Instagram terms of service, id. ¶¶ 67–73; (2) unjust enrichment, id. ¶¶ 74–80;

5 (3) unauthorized access in violation of the CFAA, id. ¶¶ 81–86; (4) unauthorized access in

6 violation of California Penal Code § 502, id. ¶¶ 87–95; (5) interference with contractual relations

7 by inducing Facebook’s users to share their login credentials with BrandTotal, in violation of

8 Facebook’s terms of service, id. ¶¶ 96–102; and (6) unlawful, unfair, or fraudulent business

9 practices in violation of California’s Unfair Competition Law, Cal. Bus. & Prof. Code § 17200

10 (the “UCL”), Compl. ¶¶ 103–10. Facebook seeks both injunctive and compensatory relief. See id.

11 at 21–22, ¶¶ (a)–(h) (Prayer for Relief).

12 2. BrandTotal’s Allegations and Claims

13 BrandTotal is an advertising consulting company that offers its clients analysis of the

14 clients’ own advertising and their competitor’s advertising on social media, including Instagram

15 and the Facebook Network. Counterclaim (dkt. 23) ¶ 8.5 BrandTotal alleges that it collects

16 information only after receiving “informed consent and deliberate opt-in” from its users, which

17 users grant in exchange for gift cards. Id. ¶ 10. BrandTotal’s users must “confirm they have read

18 the privacy policy which details the demographic and advertising . . . information BrandTotal

19 collects” before they install the UpVoice browser extension. Id. ¶ 11.

20 According to BrandTotal, the UpVoice extension “allows BrandTotal to collect data the

21 user either owns or has a right to access and certain public information about the websites the user

22 visits,” including “the ads they see and interact with on social media sites like Facebook, as they

23 browse as usual on those sites,” and “deidentified information about the user by using hashed

24 values for the user’s device and user IDs.” Id. ¶¶ 13–14, 16.

25 BrandTotal does not collect the user’s names or email addresses,

although the user provides that when they sign up. BrandTotal does

26

27

5 BrandTotal’s Answer and Counterclaim is filed as a single docket entry. Citations herein to the

not keep or compile participants’ private postings, photos, or web

1 history, nor does BrandTotal mine “friend” information, or otherwise

take data not expressly authorized. Rather, the information collected

2 relates to who is seeing what advertisement, where and at what times.

3 Id. ¶ 17. BrandTotal anonymizes the information it collects and provides aggregated data, broken

4 out by demographic information (“age, gender, high level location, marital status, interests”) to its

5 clients. Id. ¶ 18.

6 BrandTotal acknowledges the provision in Facebook’s terms of service prohibiting data

7 collection by automated means without Facebook’s permission, but implies that Facebook’s

8 claimed ability “to pick and choose who . . . will be allowed to access the information” conflicts

9 with other provisions of the terms of service “acknowledg[ing] that users own the rights in their

10 own information.” Id. ¶ 21. BrandTotal also alleges that Facebook itself aggregates and sells user

11 data as part of its own advertising consulting service. Id. ¶ 22.

12 According to BrandTotal, Facebook’s actions to cut off BrandTotal’s access to Facebook

13 products and block BrandTotal’s browser extensions from appearing in Google’s Chrome Web

14 Store prevent BrandTotal from compiling advertising analytics for its customers, prevent

15 BrandTotal’s users from logging in “to collect any rewards they have earned,” and prevent

16 BrandTotal from recruiting new participants. Id. ¶ 28. BrandTotal customers, including

17 “reputable large companies,” are questioning their relationship, prospective customers that were in

18 negotiations are walking away, and BrandTotal cannot secure receivables, lending, or venture

19 capital investment while it lacks access to Facebook’s networks. Id. ¶¶ 29–30. As a result,

20 BrandTotal is “in jeopardy of being insolvent.” Id. 31.

21 BrandTotal asserts the following counterclaims: (1) intentional interference with contract,

22 based on contracts with its corporate customers, id. ¶¶ 32–41; (2) intentional interference with

23 prospective economic advantage, id. ¶¶ 42–48; (3) unlawful, unfair, and fraudulent conduct in

24 violation of the UCL, id. ¶¶ 49–63; and (4) declaratory judgment that BrandTotal has not breached

25 any contract with Facebook because its access “has never been unlawful, misleading, or

26 fraudulent,” because its products “have never impaired the proper working appearance or the

27 intended operation of any Facebook product” or “accessed any Facebook product using automated

1 whether to share it with BrandTotal, id. ¶¶ 64–73. BrandTotal seeks both injunctive and

2 compensatory relief. Id. at 23, ¶¶ A–E (Prayer for Relief).

3 B. Procedural History

4 Facebook initially filed state law claims against BrandTotal in the California Superior

5 Court for San Mateo County, case number 20-CIV-04526, on October 1, 2020. Telscher Decl.

6 (dkt. 27-4) ¶ 2; Kim Decl. (dkt. 44) ¶ 2. BrandTotal informed Facebook on October 8, 2020 of its

7 intent to move for a TRO on October 13th or 14th. Telscher Decl. ¶ 4; Kim Del. ¶ 3 & Ex. 1.

8 Facebook’s counsel asked BrandTotal to delay its TRO application, and BrandTotal asked, in

9 exchange for such delay, for Facebook to agree to discuss the issues in the case and see if a

10 resolution could be reached. Telscher Decl. ¶ 5; Kim Decl. ¶ 4 & Ex. 2. On the morning of that

11 settlement conference, BrandTotal provided formal notice of its intent to move for a TRO.

12 Telscher Decl. ¶ 6; Kim Dec. ¶ 5 & Ex. 3. According to BrandTotal’s attorney Rudolph Telscher,

13 Facebook’s representatives at the settlement conference lacked authority to settle the case or

14 provide assurances that would moot the need for a TRO. Telscher Decl. ¶ 7.

15 The same day, Facebook voluntarily dismissed its state court action and filed a complaint

16 in this Court, adding new claims including its sole federal claim under the CFAA, before

17 BrandTotal could move for a TRO in state court the following day. Telscher Decl. ¶ 8; Kim Decl.

18 ¶ 8. According to Facebook’s attorney Jason Kim, the decision to add a CFAA claim was based

19 on Facebook’s discovery that that BrandTotal’s browser extension had been relisted in the Chrome

20 Web Store after Google had taken down an earlier version. Kim Decl. ¶ 8.

21 BrandTotal filed its present application two days later, on October 16, 2020. See Mot.

22 (dkt. 27).

23 C. The Parties’ Arguments

24 1. BrandTotal’s Motion

25 BrandTotal seeks a TRO requiring Facebook to rescind its request that Google remove the

26 UpVoice browser extension,6 reverse any technological measures that Facebook has used to block

27

1 UpVoice from accessing its website, and restore BrandTotal’s and its principals’ pages on

2 Facebook. See Proposed Order (dkt. 27-5). BrandTotal contends that this case is analogous to a

3 recent Ninth Circuit decision affirming injunctive relief in favor of a company that collected data

4 from publicly available LinkedIn profiles, hiQ Labs, Inc. v. LinkedIn Corporation, 938 F.3d 985

5 (2019). Mot. at 2. According to BrandTotal, any argument Facebook might make that it is

6 protecting users’ privacy is belied by a history of privacy violations on Facebook’s part, including

7 a five-billion-dollar Federal Trade Commission fine and a large class action settlement, thus

8 supporting an inference that Facebook’s true motivation in this case is harming a potential

9 competitor. Id.; see also id. at 6–7 (discussing congressional findings of monopolization and

10 anticompetitive conduct by Facebook). BrandTotal contends that denying a TRO would “lead[] to

11 the destruction of the business,” id. at 3, and that it meets the Ninth Circuit’s test for such relief

12 based on a likelihood of immediate irreparable harm, the public interest favoring an injunction, the

13 balance of equities tipping in BrandTotal’s favor, and a likelihood of success on (or at least serious

14 questions going to) the merits of the case, id. at 8–9.

15 a. Success on the Merits

16 BrandTotal argues that it is likely to successfully defend against Facebook’s breach of

17 contract claim because its product does not use the type of “automated” means that the terms of

18 service are intended to prohibit—programs that scrape as much data as possible from an entire

19 website. Id. at 9–10. According to BrandTotal, its browser extension operates only with a user’s

20 consent and relies on the user’s deliberate conduct of browsing the Facebook Network,

21 distinguishing it from malicious and more-fully-automated “scraper” programs like those used by

22 Cambridge Analytica for purposes related to the 2016 election. Id. at 10.

23 Even if the Court construes Facebook’s prohibition of “automated means” (without

24 Facebook’s permission) as encompassing BrandTotal’s product, BrandTotal argues that the

25 prohibition is unenforceable because it purports to control users’ choices to share information they

26 own. Id. at 10–11. BrandTotal cites intellectual property doctrines stemming from Lear, Inc. v.

27 Adkins, 395 U.S. 653, 674–75 (1969), as well as California law providing that contracts may not

1 Code § 1667(2), as supporting its view that contractual provisions preventing users from sharing

2 their own data are unenforceable because impair competition and the free flow of information.

3 Mot. at 11–12. BrandTotal also cites the California Consumer Privacy Act (“CCPA”) as

4 recognizing consumers’ ownership of their personal information, allowing businesses to offer

5 consumers compensation for using that information, and prohibiting contracts that waive users’

6 rights under the statute. Id. at 12–13. BrandTotal contends that “[m]uch of what [it] collects are

7 basic facts in the public domain,” and that courts have recognized that such facts cannot be

8 restricted by copyright or a right of publicity. Id. at 13–14. BrandTotal also cites the Ninth

9 Circuit’s concerns in hiQ regarding companies that host “‘vast amounts of public data’”

10 selectively excluding potential competitors, and thus potentially suppressing innovation. Id. at 14.

11 Along the same lines, BrandTotal argues that Facebook’s exclusion of a competitor that seeks to

12 compensate users for their information, while Facebook aggregates the same information for its

13 own products and services that it sells to advertisers, violates the public policies underlying state

14 and federal antitrust law. Id. at 14–17 (citing Telscher Decl. Ex. H, Facebook’s data policy, which

15 permits such conduct by Facebook).

16 BrandTotal contends that it will likely prevail on Facebook’s claims under the CFAA and

17 section 502(c) of the Penal Code, and for unjust enrichment, because it acted with users’

18 authorization—who in turn were authorized to access Facebook’s servers—and thus “has done

19 nothing improper.” Id. at 17–18. BrandTotal argues that it will prevail on Facebook’s claim for

20 interference with contract because it has not collected users’ login credentials, and thus did not

21 induce users to breach the terms of service’s prohibition on sharing that information. Id. at 20.

22 With respect to its own counterclaims, BrandTotal argues that it is likely to prevail on its

23 claims for intentional interference with contract and with prospective economic advantage

24 because, by blocking access, Facebook interfered with BrandTotal’s contracts to provide analytics

25 services to its customers. Id. at 18–19. BrandTotal contends that it will prevail on the “unlawful”

26 prong of its UCL claim based on that intentional interference, and that Facebook’s conduct is also

27 “unfair” because it is anticompetitive an “fraudulent” because it conflicts with representations in

1 b. Irreparable Injury, Balance of Equities, and Public Interest

2 BrandTotal asserts that it faces irreparable injury because it might be forced to close its

3 business without access to data from Facebook’s products. Id. at 23–24. According to

4 BrandTotal, Facebook would not face any significant harm if it were required to allow BrandTotal

5 to continue operating during litigation in the same manner that it has already operated for years,

6 which favors not only granting a TRO, but doing so without requiring any bond. Id. at 24–25.

7 BrandTotal also contends that the public interest favors granting relief “[f]or the same reasons that

8 make Facebook’s terms of service unenforceable.” Id. at 25.

9 2. Facebook’s Opposition

10 Facebook contends that BrandTotal has not met the requirement of irreparable injury

11 because any risk of the demise of its business is speculative, and because the relief that it seeks

12 would not actually redress its harm, which requires independent action by Google to reinstate the

13 UpVoice browser extension. Opp’n at 9–12. Facebook also argues that the proposed TRO is

14 insufficiently precise and would not be enforceable, id. at 10, and that BrandTotal’s delay of

15 around two weeks in filing its present motion undermines its argument that immediate relief is

16 critical, id. at 12–13.

17 Facebook contends that BrandTotal is unlikely to succeed on its intentional interference

18 counterclaim because there is no evidence Facebook knew of any particular contracts affected by

19 its denial of access, BrandTotal has not shown actual breach of a contract, Facebook acted with a

20 legitimate business purpose of protecting user privacy and securing its platform, and any harm was

21 caused by Google’s independent decision to remove UpVoice from its store. Id. at 13–15.

22 Facebook argues that BrandTotal will not succeed on its UCL counterclaim because Facebook did

23 not act unlawfully, has not violated the antitrust laws, and did not deceive users where its terms of

24 use specifically provided that unauthorized automated access was prohibited. Id. at 15–17.

25 Facebook also argues that it will likely succeed on its own claims against BrandTotal based on

26 BrandTotal’s use of automated means to access password-protected data from Facebook’s

27 products without Facebook’s permission, and based on BrandTotal inducing users to breach

1 Facebook contends that to “force Facebook to allow a non-compliant developer back on its

2 platform” would be inequitable both with respect to the balance of equities between the parties,

3 and with respect to the public interest. Id. at 23–24.

4 3. BrandTotal’s Reply

5 BrandTotal argues again in its reply that it faces imminent collapse as a business without a

6 TRO allowing it access to data from Facebook’s platforms, among other intangible harm, and

7 contends that the injury would likely be redressed by Facebook withdrawing any objection to

8 Google allowing UpVoice in the Chrome Web Store. Reply (dkt. 50) at 3–7. BrandTotal also

9 argues that it acted promptly in light of the complexity of the case and the parties’ discussions. Id.

10 at 7–8.

11 BrandTotal contends that it is likely to prevail on both Facebook’s claims and its own

12 counterclaims because its services do not constitute “automated means” as that term is used in

13 Facebook’s terms of use, it obtained users’ permission to access their data, and allowing Facebook

14 to restrict access to the data at issue under those circumstances would be anticompetitive and

15 harmful to consumers’ rights to their own information. Id. at 9–14. In light of those concerns, and

16 the degree of “power that companies like Facebook wield,” BrandTotal contends that the balance

17 of equities and the public interest favor granting its request for a TRO. Id. at 14–15.

18 III. ANALYSIS

19 A. Legal Standard

20 The legal standard for a TRO is substantially identical to the standard for a preliminary

21 injunction. See Stuhlbarg Int’l Sales Co., Inc. v. John D. Brush & Co., Inc., 240 F.3d 832, 839 n.7

22 (9th Cir. 2001).7 “A preliminary injunction is an extraordinary remedy never awarded as of right.”

23 Winter v. Nat. Res. Defense Council, Inc., 555 U.S. 7, 24 (2008). “A plaintiff seeking a

24 preliminary injunction must establish that he is likely to succeed on the merits, that he is likely to

25 suffer irreparable harm in the absence of preliminary relief, that the balance of equities tips in his

26

27

7 A TRO issued “without written or oral notice to the adverse party or its attorney” is subject to

1 favor, and that an injunction is in the public interest.” Id. at 20. Irreparable harm must be likely—

2 it is no longer sufficient to grant a preliminary injunction upon a mere showing of a “possibility”

3 of irreparable harm when the other factors weigh heavily in favor of the plaintiff. Alliance for the

4 Wild Rockies v. Cottrell, 632 F.3d 1127, 1132 (9th Cir. 2011). Nonetheless, the Ninth Circuit still

5 evaluates the likelihood of success on a “sliding scale.” Id. A TRO or preliminary injunction may

6 be warranted upon a showing of “serious questions going to the merits” as well as “a hardship

7 balance that tips sharply toward the plaintiff,” so long as the plaintiff is likely to suffer irreparable

8 harm and the injunction or restraining order is in the public interest. Id.

9 B. HiQ v. LinkedIn

10 BrandTotal contends that this case is analogous to the Ninth Circuit’s decision affirming

11 injunctive relief in hiQ Labs, Inc. v. LinkedIn Corporation, 938 F.3d 985 (2019). The plaintiff in

12 that case, hiQ, used automated computer programs to “scrape[] information that LinkedIn users

13 have included on public LinkedIn profiles, including name, job title, work history, and skills,” and

14 “then use[d] that information, along with a proprietary predictive algorithm, to yield ‘people

15 analytics,’ which it [sold] to business clients.” Id. at 991. The access at issue concerned only

16 profiles that LinkedIn users elected to “ma[ke] visible to the general public.” Id. at 990.

17 LinkedIn, which competed with hiQ to sell products derived from information its users included in

18 their profiles, sent hiQ a cease-and-desist letter asserting violations of the CFAA and other laws,

19 and claiming to have implemented technical measures to block hiQ’s access to LinkedIn’s

20 website. Id. at 991–92.

21 HiQ brought suit for declaratory judgment that LinkedIn could not invoke the CFAA or

22 other authority on which it relied, and for injunctive relief on a number of claims under California

23 law, and sought a TRO. See id. at 992. The parties agreed to convert hiQ’s request for a TRO into

24 a motion for a preliminary injunction. Id. The district court—the Honorable Edward Chen, of this

25 district—“granted hiQ a preliminary injunction, concluding that the balance of hardships tips

26 sharply in hiQ’s favor and that hiQ raised serious questions on the merits.” Id. at 992–93. The

27 Ninth Circuit affirmed, focusing on hiQ’s claim for intentional interference with contract and

1 The Ninth Circuit first affirmed the determination that hiQ showed a threat of irreparable

2 injury based threats to “the survival of its business”—including contracts it would not be able to

3 honor, loss of interest in an ongoing financing round, and the departure of employees—because

4 hiQ’s business model was based entirely on access to LinkedIn profile data. Id. at 993–94. The

5 court noted that although a threat of monetary injury generally is not sufficient to support a

6 preliminary injunction, longstanding Ninth Circuit precedent has recognized that “showing a

7 threat of ‘extinction’ is enough to establish irreparable harm, even when damages may be

8 available and the amount of direct financial harm is ascertainable.” Id. at 993 (citing Am. Passage

9 Media Corp. v. Cass Commc’ns, Inc., 750 F.2d 1470, 1474 (9th Cir. 1985)).

10 Next, the Ninth Circuit “conclude[d] that the district court’s determination that the balance

11 of hardships tips sharply in hiQ’s favor [was] not ‘illogical, implausible, or without support in the

12 record,’” because neither LinkedIn nor its users had a strong privacy interest in profile data that

13 was made available to the public. Id. at 994–95. The court noted concerns that even users who

14 made their profiles available for public viewing might not wish for others (such as their

15 employers) to have easy methods of knowing when the users changed information in their

16 profiles, but held that such interests were not particularly strong where nothing prevented

17 employers from monitoring employees’ profiles for changes, and LinkedIn itself offered products

18 that could be used for that sort of monitoring. Id.

19 Turning hiQ’s likelihood of success on the merits, the panel held that hiQ made a sufficient

20 showing of each element of a claim for intentional interference with contract under California law:

21 (1) “a valid contract between plaintiff and a third party,” by showing several contracts with

22 customers that paid for hiQ’s data analytics services; (2) “defendant’s knowledge of this contract,”

23 by showing that hiQ publicly advertised its business model and responded to LinkedIn’s cease-

24 and-desist letter by identifying specific customers; (3) “defendant’s intentional acts designed to

25 induce a breach or disruption of the contractual relationship,” based on LinkedIn’s threats to

26 invoke federal law and technological measures to block hiQ’s access; (4) “actual breach or

27 disruption of the contractual relationship,” by preventing hiQ from accessing the LinkedIn data on

1 could not sell its products. Id. at 996–97 (citation and internal quotation marks omitted).

2 In response to LinkedIn’s assertion of legitimate business purpose as a defense to that

3 claim, the court applied a broad balancing test, based in precedent from California courts,

4 weighing the legitimate interests furthered by the defendant’s conduct against “the importance of

5 the interest interfered with,” looking to factors including harm to competition, good faith, and

6 whether the conduct is a “recognized trade practice.” Id. at 997–98. The court determined that

7 hiQ had a strong interest in honoring its existing contracts, LinkedIn had a “relatively weak”

8 interest in preventing hiQ’s use of public profile data, LinkedIn’s selective blocking of access was

9 not a recognized trade practice, and there was some evidence to suggest that LinkedIn blocked

10 hiQ’s access in order to introduce a new data analytics product that competed with hiQ. Id. The

11 Ninth Circuit therefore agreed with the district court that hiQ had shown serious questions going

12 to the merits of its tortious interference claim.

13 Based on a thorough review of precedent interpreting the CFAA, the Ninth Circuit held

14 that “it appears that the CFAA’s prohibition on accessing a computer ‘without authorization’ is

15 violated when a person circumvents a computer’s generally applicable rules regarding access

16 permissions, such as username and password requirements, to gain access to a computer,” and

17 conversely, that it “is likely that when a computer network generally permits public access to its

18 data, a user’s accessing that publicly available data will not constitute access without authorization

19 under the CFAA.” Id. at 1003. The court concluded that hiQ “raised serious questions about

20 whether LinkedIn may invoke the CFAA” with respect to data from public profiles, and thus

21 found no basis to reverse the preliminary injunction on account of that statute. Id. at 1004.

22 Finally, the Ninth Circuit concluded that although “there are significant public interests on

23 both sides, the district court properly determined that, on balance, the public interest favors hiQ’s

24 position,” because “giving companies like LinkedIn free rein to decide, on any basis, who can

25 collect and use data—data that the companies do not own, that they otherwise make publicly

26 available to viewers, and that the companies themselves collect and use—risks the possible

27 creation of information monopolies that would disserve the public interest.” Id. at 1005.

1 before the Supreme Court. See LinkedIn Corp. v. hiQ Labs, Inc., No. 19-1116 (U.S.). The district

2 court recently granted a motion by LinkedIn to dismiss hiQ’s antitrust claims (but granted leave to

3 amend on “theories of unilateral refusal to deal and the essential facilities doctrine”) and denied

4 the motion as to hiQ’s interference claims, holding that those claims were not barred by the Noerr-

5 Pennington doctrine. See hiQ Labs, Inc. v. LinkedIn Corp., No. 17-cv-03301-EMC, 2020 WL

6 5408210 (N.D. Cal. Sept. 9, 2020).

7 C. Irreparable Harm

8 Monetary injury alone cannot generally establish the irreparable harm necessary to support

9 preliminary injunctive relief, but a “threat of ‘extinction’”—i.e., a party being driven out of

10 business—can meet that standard. HiQ, 938 F.3d at 993 (quoting Am. Passage, 750 F.2d at 1474;

11 and citing L.A. Mem’l Coliseum Comm’n v. Nat’l Football League, 634 F.2d 1197, 1202 (9th Cir.

12 1980)). “[I]ntangible injuries, such as damage to ongoing recruitment efforts and goodwill,

13 qualify as irreparable harm.” Rent-A-Ctr., Inc. v. Canyon Television & Appliance Rental, Inc., 944

14 F.2d 597, 603 (9th Cir. 1991). The Ninth Circuit has held that a district court does not abuse its

15 discretion in finding irreparable harm where damages from such injuries “would be difficult to

16 valuate.” Id.

17 Facebook contends that BrandTotal’s purported evidence of a threat to its ongoing

18 business is conclusory, speculative, and insufficiently precise as to how long BrandTotal could

19 continue to operate without access to data from Facebook’s products. Opp’n at 11. Last year,

20 Chief Judge Hamilton denied a TRO under similar circumstances, holding that a CEO’s

21 declaration that the plaintiffs would “soon reach a tipping point where [they] can no longer

22 operate” was “inherently speculative” because the plaintiffs failed to “offer any indication about

23 their financial strength or the likelihood that they will dissolve as going concerns at any particular

24 point in time.” Stackla, Inc. v. Facebook Inc., No. 19-cv-05849-PJH, 2019 WL 4738288, at *5

25 (N.D. Cal. Sept. 27, 2019).8 Judge Hamilton also noted that the plaintiffs failed to identify

26

8 Facebook cites a press release as evidence that BrandTotal recently raised $12 million in venture

27

capital funding, providing a URL for a PR Newswire website but no evidence in the record.

1 specific customers they had lost or were likely to lose in the absence of relief. Id. She concluded

2 that in the absence of clear evidence of imminent failure of their business, the plaintiffs had not

3 met their burden to obtain a “temporary restraining order, the purpose of which is to address only

4 harms caused by actions likely to occur between the time of its filing and a preliminary injunction

5 hearing.” Id. at *3, *5.

6 BrandTotal’s evidence here is stronger than in Stackla, in that BrandTotal presents

7 communications from specific existing customers expressing concern about Facebook’s

8 allegations, and from specific potential customers suspending or postponing their negotiations

9 with BrandTotal, as well as some information about lost venture capital investment. Leibovich

10 Decl. (dkt. 27-3) ¶¶ 33–35, 39–43, 52–55 & Exs. B–D.

11 Other aspects of the record here are more similar to Stackla. BrandTotal’s CEO Alon

12 Leibovich states that although “BrandTotal has some investment funds in reserve, without the

13 ability to conduct business, BrandTotal will be forced to immediately lay off employees,” and its

14 “inability to raise any new capital will irreparably impact [its] growth trajectory and viability.” Id.

15 ¶ 56. Leibovich concludes that BrandTotal “cannot long survive” without data collected from

16 Facebook using UpVoice. Id. ¶¶ 61–62.

17 Like in Stackla, Leibovich has not addressed any timeline under which BrandTotal would

18 be forced to cease operations. Even assuming for the sake of argument that Liebovich’s

19 declaration might show likely irreparable harm in the absence of relief before trial—itself not

20 entirely clear, absent evidence of how long BrandTotal could survive—the Court cannot say

21 whether expedited relief in the form of a TRO, as opposed to a preliminary injunction considered

22 in the normal course, is necessary to prevent such harm. See Stackla, 2019 WL 4738288, at *3–5;

23 see also AboveGEM, Inc. v. Organo Gold Mgmt., Ltd., No. 19-cv-04789-PJH, 2019 WL 3859012,

24 at *5 (N.D. Cal. Aug. 16, 2019) (denying a TRO where the plaintiff did “not offer any indication

25

26

v. Norton Simon Museum of Art at Pasadena, 592 F.3d 954, 960 (9th Cir. 2009). A press release

might warrant different analysis if it is a statement of a party opponent, but in the absence of any

27

evidence in the record regarding this purported press release, the Court cannot determine whether

1 of when it would be driven out of business, or underlying financial information that would

2 demonstrate imminent, irreparable harm” (emphasis added)); Int’l Medcom, Inc. v. S.E. Int’l, Inc.,

3 No. 15-cv-03839-HSG, 2015 WL 7753267, at *5 (N.D. Cal. Dec. 2, 2015) (denying a preliminary

4 injunction where the plaintiff failed to show that its “survival [was] a matter of weeks or months”).

5 Even after Facebook raised this issue in its opposition brief, Leibovich’s reply declaration states

6 only that BrandTotal “cannot long survive without a TRO,” and that its board of directors might

7 determine that continued operations are not worthwhile. Leibovich Reply Decl. (dkt. 50-2) ¶ 9.

8 Beyond that speculative statement, there is no evidence that any member of the board has actually

9 resolved to shut down BrandTotal in the absence of relief, much less on any particular schedule.

10 To the extent that Leibovich’s reply declaration addresses BrandTotal’s financial circumstances,

11 he suggests that it currently has sufficient funding to continue operations for perhaps up to a

12 year—or potentially less in light of reductions in revenue and the resources required to litigate this

13 case, but BrandTotal is not at risk of immediately depleting its reserves. Id. ¶ 8.

14 Leibovich states that layoffs would be immediate without relief. Although the Court is

15 aware of no authority specifically holding that layoffs alone constitute irreparable injury sufficient

16 to support a TRO or preliminary injunction, they are comparable to intangible injuries such as

17 harm to recruitment that courts have held sufficient. See, e.g., Regents of Univ. of Cal. v. Am.

18 Broad. Cos., Inc., 747 F.2d 511, 520 (9th Cir. 1984). Without better evidence of BrandTotal’s

19 financial condition, however, it is not clear whether such layoffs would be based on BrandTotal’s

20 business judgment that its available funds are better spend elsewhere while operations are

21 disrupted—and thus merely a choice that BrandTotal might make in response to monetary harm—

22 or if BrandTotal would lack the resources to continue to pay those employees and remain a going

23 concern. In the absence of authority so holding, the Court declines to endorse a rule that any

24 monetary loss that might induce a party to lay off employees constitutes irreparable harm, which

25 would threaten to swallow the rule that monetary damages are not sufficient to support preliminary

26 injunctive relief. See Am. Passage, 750 F.2d at 1473 (holding that a plaintiff failed to show

27 irreparable injury despite losing “a substantial amount of business,” sustaining “large losses,” and

1 While BrandTotal has not shown that it falls within the rule addressing threats of

2 extinction, it has shown massive disruption of its business. According to Leibovich, BrandTotal

3 has lost access to “95% of the data necessary . . . to provide [its] services to [its] customers.”

4 Leibovich Decl. ¶ 37. Leibovich also states that a particular “well renowned market research firm,

5 whom [BrandTotal has] a longstanding business partnership with, has frozen all work.” Id. ¶ 42.

6 Leibovich’s declaration further identifies a number of large potential customers that were in

7 negotiations with BrandTotal but have suspended talks. Id. ¶¶ 39–40. Evidence submitted with

8 BrandTotal’s reply shows that one customer declined to renew its contract on short notice, shortly

9 after Facebook brought its state court action and Google removed UpVoice from its store.

10 Leibovich Reply Decl. Ex. P.

11 The Ninth Circuit has recognized, separately from cases dealing with the potential demise

12 of a business, that “[e]vidence of threatened loss of prospective customers or goodwill certainly

13 supports a finding of the possibility of irreparable harm.” Stuhlbarg Int’l Sales Co. v. John D.

14 Brush & Co., 240 F.3d 832, 841 (9th Cir. 2001). Some district court decisions have nevertheless

15 found such harms insufficient where a value could be placed on the lost relationships. See Int’l

16 Medcom, 2015 WL 7753267, at *5 (citing Telephia Inc. v. Cuppy, No. C 04-03508 SI, 2005 WL

17 588441, at *4 (N.D. Cal. Mar. 11, 2005)). Under the circumstances of this case, where

18 BrandTotal is a small and growing business that has been forced to suspend a major portion of its

19 operations, the Court concludes that the potential harms from “loss of prospective customers or

20 goodwill,” Stuhlbarg Int’l, 240 F.3d at 841, are sufficiently “difficult to valuate,” Rent-A-Ctr.,

21 944 F.2d at 603, to establish irreparable harm.

22 Some courts have held that, as a corollary to the rule that a party seeking an injunction

23 must show irreparable harm in the absence of relief—and related to the issue of Article III

24 standing—the moving party must also show that granting relief would prevent such harm. See

25 Sierra Club v. U.S. Dep’t of Energy, 825 F. Supp. 2d 142, 153 (D.D.C. 2011). Facebook argues

26 that even if BrandTotal has shown irreparable harm, it has not shown that the relief it seeks would

27 remedy that harm, because allowing the UpVoice extension on the Chrome Web Store is

1 only removed UpVoice from its Chrome Web Store after Facebook filed its state court action

2 against BrandTotal. See Karve Decl. (dkt. 42) ¶ 14. Facebook alleged in that complaint that it had

3 asked Google multiple times in the preceding month to remove BrandTotal’s browser extensions.

4 See Mehta Decl. (dkt. 40) Ex. 2 (state court complaint) ¶ 56. After initially removing the

5 extension from its store, Google approved the listing of another version of UpVoice on October

6 14, 2020—which BrandTotal’s vice president Oren Dor states was not meant to go live, but only

7 submitted for approval so that BrandTotal could quickly return to service if its TRO were granted,

8 and which BrandTotal changed to “unlisted” when it realized the error more than a day later. Dor

9 Decl. (dkt. 27-2) ¶¶ 24–28.9 Given that Google has already approved that new instance of

10 UpVoice for listing on the Chrome Web Store at least once, it is reasonable to infer that Google

11 would allow it to remain if Facebook withdrew any objection or request for its removal. See Utah

12 v. Evans, 536 U.S. 452, 464 (2002) (holding that a plaintiff has standing where an injunction

13 “would amount to a significant increase in the likelihood that the plaintiff would obtain relief that

14 directly redresses the injury suffered”).

15 Facebook also argues that BrandTotal’s delay of around two weeks in seeking a TRO after

16 Facebook filed its state court complaint and Google removed the UpVoice extension belies any

17 need for emergency belief. Opp’n at 12–13. In light of the complexity of the issues implicated, as

18 well as the parties’ efforts to discuss potential resolutions, the Court does not fault BrandTotal for

19 that delay.

20 BrandTotal’s arguments for irreparable harm are limited to the effects of losing access to

21 data collected from Facebook’s products, which resulted from Google taking down the UpVoice

22 browser extension. See Mot. at 23–24. BrandTotal has not specifically addressed any irreparable

23 harm resulting from Facebook’s removal of BrandTotal’s and its principals’ pages on Facebook.

24 See id.; see also id. at 25 (asking to “reinstate the status quo so that BrandTotal has access to

25 UpVoice user-authorized content”). In the absence of any argument that irreparable harm resulted

26

9 Dor’s declaration does not account for another period when, according to Facebook researcher

27

Sanchit Karve, a version of UpVoice was available on the Chrome Web Store from October 12,

1 from that removal, BrandTotal’s request for an order requiring Facebook to restore those pages is

2 DENIED. See id. at 25; Proposed Order ¶ 1(c).10 The remainder of this order addresses only

3 Facebook’s efforts to block the use of UpVoice, including requesting that Google remove it from

4 the Chrome Web Store, and BrandTotal’s request that it be restored.

5 D. Likelihood of Success

6 Each party argues that it is likely to succeed on each of the claims and counterclaims in the

7 case. The Court focuses on BrandTotal’s counterclaims, as those would be the basis for

8 BrandTotal obtaining affirmative relief in this case, although Facebook’s claims are relevant to the

9 extent that they could serve as affirmative defenses to BrandTotal’s claims.

10 1. BrandTotal’s Counterclaim for Interference with Contract

11 BrandTotal asserts counterclaims for intentional interference with contract, and intentional

12 interference with prospective economic advantage. “‘The elements which a plaintiff must plead to

13 state the cause of action for intentional interference with contractual relations are (1) a valid

14 contract between plaintiff and a third party; (2) defendant’s knowledge of this contract;

15 (3) defendant’s intentional acts designed to induce a breach or disruption of the contractual

16 relationship; (4) actual breach or disruption of the contractual relationship; and (5) resulting

17 damage.’” HiQ, 938 F.3d at 995–96 (quoting Pac. Gas & Elec. Co. v. Bear Stearns & Co., 50

18 Cal. 3d 1118, 1126 (1990)). While the typical case involves actual breach, the element of

19 “disruption” of a contract can also be satisfied “where the plaintiff’s performance has been

20 prevented or rendered more expensive or burdensome.” Id. at 996 n.8 (citation and internal

21 quotation marks omitted).

22 BrandTotal argues that, like in hiQ, it has established a likelihood of success on those

23 elements based on Facebook blocking BrandTotal’s access to the data it would need to fulfill its

24 contracts with existing customers of its advertising analytics product. See Mot. at 18–19.

25 Facebook argues that BrandTotal cannot show knowledge, or actual breach or disruption. Opp’n

26

10 Thus far, BrandTotal also has not specifically addressed or attempted to justify its vice president

27

Dor’s purported creation of accounts using false names, in apparent violation of Facebook’s terms

1 at 13–14. With respect to disruption, Leibovich’s states that BrandTotal can no longer access the

2 data on which it relies for the analysis it contracted to sell to its customers. Leibovich Decl. ¶ 37

3 (stating that due to lack of access, BrandTotal “cannot provide the promised content”).

4 BrandTotal is therefore likely able to show that its “performance has been prevented or rendered

5 more expensive or burdensome.” See hiQ, 938 F.3d at 996 n.8.

6 On the element of knowledge, BrandTotal cites no evidence that Facebook knew of a

7 particular contract with a particular customer. But under California law, “the defendant need not

8 know exactly who is a party to the contract, so long as he knows he is interfering with a

9 contractual relationship.” Altera Corp. v. Clear Logic, Inc., 424 F.3d 1079, 1092 (9th Cir. 2005).

10 As BrandTotal notes, Facebook included the following allegation in its complaint evincing

11 knowledge that BrandTotal sold services based on the data it collected:

12 [BrandTotal] used the data collected by the malicious extensions to

sell “marketing intelligence,” and other services through the website

13 brandtotal.com. BrandTotal publicly stated that it used the data

obtained through the malicious extensions to provide marketing

14 insights about users and advertisers. Exs. 5 and 11.

15 Compl. ¶ 47; see also Mehta Decl. Ex. 2 (state court complaint) ¶ 45. Exhibit 5 to Facebook’s

16 complaint is a screenshot of BrandTotal’s website, which includes the statement that “[m]any of

17 the most recognizable consumer brands use our competitive marketing intelligence platform to

18 discover marketing threats and opportunities in real time.” Compl. Ex. 5; see also Mehta Decl.

19 Ex. 2 (state court complaint, which includes the same exhibit). BrandTotal is therefore likely to

20 succeed in showing that Facebook knew BrandTotal had entered contracts where its performance

21 depended on the data it collected.

22 The more significant issue with respect to this claim is Facebook’s argument that it acted

23 with a “legitimate business purpose,” which can serve as a defense to interference. See Mot. at 14.

24 “Under California law, a legitimate business purpose can indeed justify interference with contract,

25 but not just any such purpose suffices.” HiQ, 938 F.3d at 997. Courts must determine whether the

26 defendant’s interest outweighs societal interests in stability of contracts (the defendant’s mere

27 pursuit of economic advantage generally does not), “whether the means of interference involve no

1 competition,” and—most importantly—“whether the business interest is pretextual or asserted in

2 good faith.” Id. (citations and internal quotation marks omitted).

3 BrandTotal raises serious questions as to this defense for largely the same reasons

4 addressed in hiQ. Facebook’s data policy suggests that it sells marketing intelligence services

5 potentially in competition with BrandTotal’s product. See Telscher Decl. Ex. H (data policy);

6 Mot. at 16 (quoting provisions of the policy indicating that, among other things, Facebook

7 “provide[s] advertisers with reports about the kinds of people seeing their ads” and “share[s]

8 information about [users] with companies that aggregate it to provide analytics and measurement

9 reports to [Facebook’s] partners”). To the extent that Facebook’s efforts to restrict BrandTotal’s

10 access might be motivated to stifle competition, it would raise some of the same concerns as in

11 hiQ, where the Ninth Circuit determined that for companies “whose servers hold vast amounts of

12 public data” to “selectively . . . ban only potential competitors from accessing and using that

13 otherwise public data” . . . “may well be considered unfair competition under California law.”

14 HiQ, 938 F.3d at 998. This case differs in that some of the information at issue is not “public,”

15 but BrandTotal is likely correct that the advertisements themselves are essentially public, see

16 Compl. ¶¶ 17–19 (Facebook’s allegations discussing its public library of all ads on its services),

17 that the users who consent to use BrandTotal’s browser extension have the most significant

18 interest in the data in their own profiles,11 and that Facebook has not articulated a significant

19 privacy or intellectual property interest in any data outside of those categories, such as the

20 “advertising interests” that Facebook generates for (and shares with) its users, and the metrics of

21 engagement (likes, comments, etc.) on particular advertisements. So long as BrandTotal’s

22 browser extension works as intended and represented, it threatens interests at most only

23

24

11 Despite the CCPA’s general purpose of granting consumers greater control over how their

personal information is used, BrandTotal has not cited any provision of that statute that

25

specifically requires Facebook to provide the sort of access at issue here. See Mot. at 12–13

(addressing provisions of the statute defining “personal information,” providing that companies

26

may compensate users for their personal information, and providing that any contract purporting

to waive a right under the statute is unenforceable). The fact that the statute allows companies to

27

provide financial compensation to consumers for collection of their personal information, Cal.

1 marginally greater than those the Ninth Circuit found “relatively weak” in hiQ. See 938 F.3d at

2 998.

3 On the other hand, Facebook’s general interest in policing access to the password-

4 protected portions of its networks is far greater than LinkedIn’s interest in restricting access to

5 otherwise public pages in hiQ. See Stackla, 2019 WL 4738288, at *6 (concluding that

6 “Facebook’s ability to decisively police the integrity of its platforms is without question a pressing

7 public interest”); cf. hiQ, 938 F.3d at 992 (rejecting an argument that the plaintiff could collect

8 suitable data from sources other than LinkedIn, because “Facebook data, by contrast, is not

9 generally accessible”). Users on Facebook’s networks choose share information with specific

10 people, and could reasonably be expected to rely on Facebook’s privacy settings and terms of use

11 to prevent automated collection of that information by third parties. See, e.g., Clark Decl. (dkt.

12 41) ¶¶ 5(b)–(d).

13 Facebook is bound by an order from an FTC enforcement action requiring it to enforce its

14 terms of use against third parties that have access to users’ information. Clark Decl. Ex. 1.

15 Among other things, the FTC order requires Facebook to take the following measures:

16 Specifically with respect to any Covered Third Party that obtains or

otherwise has access to Covered Information from Respondent for use

17 in an independent, third-party consumer application or website, such

safeguards shall include:

18

a. Requiring an annual self-certification by each Covered Third Party

19 that certifies: (i) its compliance with each of Respondent’s Platform

Terms; and (ii) the purpose(s) or use(s) for each type of Covered

20 Information to which it requests or continues to have access, and that

each specified purpose or use complies with Respondent’s Platform

21 Terms;

22 b. Denying or terminating access to any type of Covered Information

that the Covered Third Party fails to certify pursuant to Part

23 VII.E.1.a.(ii) above, or, if the Covered Third Party fails to complete

the annual self-certification, denying or terminating access to all

24 Covered Information unless the Covered Third Party cures such

failure within a reasonable time, not to exceed thirty (30) days;

25

c. Monitoring Covered Third Party compliance with Respondent’s

26 Platform Terms through measures including, but not limited to,

ongoing manual reviews and automated scans, and regular

27 assessments, audits, or other technical and operational testing at least

d. Enforcing against any Covered Third Party violations of

1 Respondent’s Platform Terms based solely on the severity, nature,

and impact of the violation; the Covered Third Party’s malicious

2 conduct or history of violations; and applicable law;

3 Id. at 9. For the purpose of that order, “Covered Third Party” is defined as:

4 any individual or entity that uses or receives Covered Information

obtained by or on behalf of Respondent outside of a User-initiated

5 transfer of Covered Information as part of a data portability protocol

or standard, other than:

6

(1) a service provider of Respondent that (i) uses the Covered

7 Information for and at the direction of Respondent and no other

individual or entity and for no other purpose; and (ii) does not disclose

8 the Covered Information, or any individually identifiable information

derived from such Covered Information, except for, and at the

9 direction of, Respondent, for the purpose of providing services

requested by a User and for no other purpose; or

10

(2) any entity that uses the Covered Information only as reasonably

11 necessary: (i) to comply with applicable law, regulation, or legal

process, or (ii) to enforce Respondent’s terms of use, or (iii) to detect,

12 prevent, or mitigate fraud or security vulnerabilities.

13 Id. at 3, ¶ E (line breaks added).

14 As BrandTotal tentatively agreed at the hearing, see Hearing Tr. (dkt. 57) at 8:19–9:1, it

15 appears to meet that definition, and there is no evidence that it has certified compliance as required

16 under the FTC’s order. Facebook therefore had a legitimate business interest—i.e., complying

17 with its legal obligations—in preventing BrandTotal’s access. Facebook also believes that it was

18 required to report BrandTotal’s access to the FTC as a “scraping incident,” and its Director of

19 Product Management states in a declaration that Facebook will submit such a report. Clark Decl.

20 ¶ 12. Clark is unaware of any request from BrandTotal to access Facebook’s data with

21 Facebook’s permission. Id. ¶ 14.

22 Facebook’s interest in securing its platform to comply with legal obligations and protect

23 users’ privacy is further supported by evidence that BrandTotal’s products have posed risks to

24 privacy. According to a third party report addressing a number of BrandTotal products other than

25 UpVoice, which Facebook researcher Sanchit Karve reviewed while investigating BrandTotal’s

26 products, the technique that BrandTotal used to anonymize user’s profile ID numbers (which

27 could be used to link the collected data to a particular user) was “very weak” and “could be

1 personnel determined that another BrandTotal product, “Anonymous Story Viewer for Instagram,”

2 collected a wide range of data and transmitted it to a third-party server in plain text, without

3 anonymization. Id. ¶ 22. That product also collected and transmitted the user’s “session token”

4 and “session ID,” which a third party could use to access Instagram as if they were the user. Id.

5 ¶ 23. Although those issues do not specifically pertain to the UpVoice product, Facebook’s

6 perception that BrandTotal had a history of collecting user data in ways that posed risks to security

7 and privacy supports a legitimate business interest in policing BrandTotal’s access to Facebook’s

8 platforms.

9 As for UpVoice specifically, while users of that extension generally consented to sharing

10 their own demographic information with BrandTotal, the extension could collect information from

11 other users who did not know of or consent to that collection if it was installed on a shared

12 computer. See Clark Decl. ¶ 5(c). Despite Facebook raising that concern in its opposition brief,

13 Opp’n at 6, BrandTotal does not address the issue in its reply.12 Facebook’s Director of Product

14 Management also states in his declaration that Facebook has a practice of “enforce[ing] its anti-

15 scraping policies regardless of who is doing it or how they are using the scraped information,”

16 because “it can be difficult to determine whether scraping is engaged in for benign or malicious

17 purposes.” Id. ¶ 9.

18 The Court concludes that Facebook likely has at least some degree of legitimate business

19 interest in safeguarding user privacy and security by preventing unapproved programs from

20 automatically collecting data after users have logged into Facebook’s social networks, in order to

21 comply with its obligations under the FTC order, avoid other potential liability for data breaches,

22 and maintain public confidence in its products. See Clark Decl. ¶¶ 5(a), 11–12. That interest

23 supports requiring companies like BrandTotal who seek to collect such data to coordinate with

24 Facebook and obtain approval, even when those companies have no malicious intent and have

25 endeavored to protect users’ privacy and obtain their consent. Facebook provides application

26

12 At the hearing, BrandTotal’s attorney did not dispute that UpVoice could capture information

27

from non-consenting users of shared computers, but asserted that BrandTotal is “not aware of this

1 programming interfaces (“APIs”) and other “approved means” for users to share their data with

2 third parties. Clark Decl. ¶ 4. The record indicates that, thus far, BrandTotal has not requested

3 access through those means. Id. ¶ 14.

4 “‘Whether an intentional interference by a third party is justifiable depends upon a

5 balancing of the importance, social and private, of the objective advanced by the interference

6 against the importance of the interest interfered with, considering all circumstances including the

7 nature of the actor’s conduct and the relationship between the parties.’” HiQ, 938 F.3d at 997

8 (quoting Herron v. State Farm Mut. Ins. Co., 56 Cal. 2d 202, 206 (1961)). To the extent that

9 Facebook’s denial of access to BrandTotal was based on BrandTotal’s failure to coordinate with

10 Facebook and seek approval through established channels, and on Facebook’s perception that

11 BrandTotal had a history of collecting user data in irresponsible ways, the balance tips in favor of

12 allowing Facebook to enforce its prohibition against unapproved automated access. On the other

13 hand, to the extent that Facebook might have been motivated by a desire to prevent BrandTotal

14 from competing against Facebook in the market for advertising analytics, the balance would favor

15 granting relief in order to foster competition and innovation, and allow BrandTotal to honor its

16 contracts with its customers. See hiQ, 938 F.3d at 997–98. The apparent failure of either party to

17 initiate dialog as to how BrandTotal might obtain approval from Facebook to conduct that

18 business leaves an open question of Facebook’s intent, and whether Facebook would approve

19 access by BrandTotal if it worked within Facebook’s protocols for authorizing access. The Court

20 concludes that BrandTotal has raised serious questions as to the merits of this claim, but on the

21 current record, it has not established a likelihood of success.13

22

13 Facebook also argues that any potential interference with BrandTotal’s contracts had a

23

legitimate business purpose because “Facebook was entirely justified in incidentally interfering

with a contract that threatened ‘a prior contract of [its] own.’” Opp’n at 14 (quoting Richardson v.

24

La Rancherita, 98 Cal. App. 3d 73, 81 (1979)) (alteration in original). As discussed below in the

context of BrandTotal’s claim for declaratory judgment, the UpVoice extension very likely

25

breached Facebook’s terms of use. Facebook’s interest in enforcing its own terms reinforces the

conclusion that BrandTotal has not shown a likelihood of success. Richardson recognized,

26

however, that even where a defendant seeks to enforce its own contract, the “determinative

question” is the defendant’s good faith. 98 Cal. App. 3d at 81. BrandTotal has also raised real

27

issues of the extent to which Facebook can enforce its terms of use in a manner that stifles

1 2. BrandTotal’s Counterclaim for Interference with Advantage

2 The parties do not draw any significant distinctions between BrandTotal’s claims for

3 intentional interference with contract and intentional interference with prospective economic

4 advantage, except that the latter claim requires showing “‘an independently wrongful act.’” Mot.

5 at 18 (quoting Reeves v. Hanlon, 33 Cal. 4th 1140, 1145 (2004)); see Opp’n at 13–15 (addressing

6 these claims together); Reply at 13 (same). The Court concludes that, for the reasons discussed

7 above in the context of interference with contract, BrandTotal has shown at most serious issues

8 going to the merits of its claim for interference with advantage.

9 3. BrandTotal’s Counterclaim for Unfair Competition

10 California’s UCL broadly prohibits unlawful, unfair, and fraudulent business acts. Kor.

11 Supply Co. v. Lockheed Martin Corp., 29 Cal.4th 1134, 1143 (2003). “Unlawful acts are anything

12 that can properly be called a business practice and that at the same time is forbidden by law . . . be

13 it civil, criminal, federal, state, or municipal, statutory, regulatory, or court-made, where court-

14 made law is, for example a violation of a prior court order.” Sybersound Records, Inc. v. UAV

15 Corp., 517 F.3d 1137, 1151 (9th Cir. 2008) (ellipsis in original) (citations and internal quotation

16 marks omitted). “Unfair acts among competitors means ‘conduct that threatens an incipient

17 violation of an antitrust law, or violates the spirit or policy of those laws because its effects are

18 comparable to or the same as a violation of the law, or otherwise significantly threatens or harms

19 competition.’” Id. at 1152 (quoting Cel-Tech Commc’ns, Inc. v. L.A. Cellular Tel. Co., 20 Cal. 4th

20 163, 187 (1999)). “Finally, fraudulent acts are ones where members of the public are likely to be

21 deceived.” Id.

22 With respect to the “unlawful” prong, BrandTotal rests this claim on its intentional

23 interference with contract claim discussed above. BrandTotal has shown serious issues going to

24 the merits of that claim, but not a likelihood of success. With respect to the “unfair” prong,

25 BrandTotal has again shown no more than serious issues, because although Facebook’s

26 enforcement efforts could be seen as intended to block a potential competitor from the market for

27 advertising analytics, Facebook has significant countervailing interests in enforcing its terms of

1 services.

2 BrandTotal argues that Facebook blocking its access is “fraudulent” because, according to

3 BrandTotal, Facebook’s terms of service recognize that users retain ownership of their own data.

4 Mot. at 22–23; Reply at 14. Assuming for the sake of argument that BrandTotal’s characterization

5 of the terms of service is accurate, restricting the means that users may engage in to extract that

6 data from Facebook’s servers does not clearly conflict with recognizing ownership of the data.

7 Facebook’s clear prohibition of automated means without permission also tends to negate any

8 potential reliance on broad statements of user ownership as suggesting the contrary, that

9 automated means could be used without permission. BrandTotal has shown at most serious issues

10 going to this claim, not a likelihood of success.

11 4. BrandTotal’s Counterclaim for Declaratory Judgment

12 BrandTotal seeks declaratory judgment that it has not breached Facebook’s terms of

13 service because its process of obtaining data is not “automated,” its access has never been

14 “unlawful, misleading, or fraudulent,” and it has not “impaired the proper working appearance or

15 the intended operation of any Facebook product.” Counterclaim ¶¶ 64–73. Although BrandTotal

16 has argued in the context of other claims that Facebook’s terms of service are unenforceable, this

17 counterclaim does not seek such a declaration. See id.

18 BrandTotal’s position that its access is not “automated” defies any reasonable meaning of

19 that term. BrandTotal suggests that an earlier version of the terms of service suggests a narrower

20 meaning of the term by including the parenthetical “(such as harvesting bots, robots, spiders, or

21 scrapers)” after the term “automated means.” Mot. at 10 (quoting Telscher Decl. Ex. I).

22 Regardless of whether BrandTotal’s product would fall outside of those examples—which is not

23 clear on the current record—BrandTotal is not accused of breaching the 2017 terms; it is accused

24 of breaching the current terms, which do not include the parenthetical at issue and instead refer

25 only to “automated means.” See Compl. ¶ 26; Duffey Decl. (dkt. 43) Ex. 1 § 3.2.3 (“You may not

26 access or collect data from our Products using automated means (without our prior permission)

27

1 . . . .”).14 After users install the UpVoice browser extension, it automatically collects data while

2 the users browse the Facebook Network and certain other websites, including not only information

3 that users see on their screens, but also information that the browser extension itself automatically

4 requests from the website. See Dor Decl. ¶¶ 14–20; Karve Decl. ¶ 17 (addressing the particular

5 categories of information that UpVoice automatically collected as a user browsed the Facebook

6 Network). BrandTotal also collects data regarding the “number of likes, shares, and comments”

7 on advertisements “separate from [its] panelist [i.e., user] collection,” belying the implication in

8 BrandTotal’s briefs that all data collection derives from user activity. Dor Decl. ¶ 21 (emphasis

9 added); cf., e.g., Mot. at 10 (“If these deliberate steps [by users] are not taken, no information is

10 collected.”). The fact that BrandTotal does not attempt to “survey[] Facebook’s entire site” does

11 not make its access any less automated. Cf. Mot. at 10.

12 BrandTotal asserts that any practical method of collecting data from Facebook’s products

13 requires “some degree of automation,” thus conceding “some degree of automation” in its own

14 products that perform that service. See id. at 11. There might be edge cases where it would be

15 difficult to determine if a particular method of accessing an inherently technological product like

16 the Facebook Network was “automated”—for example, a user recording video of their screen

17 while browsing the website. This is not such a case. BrandTotal designed a computer program to

18 systematically identify, capture, and transmit certain types of data from Facebook’s products

19 without user intervention. Because BrandTotal used “automated means” to access and collect data

20 from Facebook’s website without obtaining Facebook’s permission as required by the terms of

21 service, the Court concludes that BrandTotal has not shown a likelihood of success, or even

22 serious issues, on its claim for declaratory judgment that it did not breach those terms. Because

23 the record tends to suggest that BrandTotal breached at least the provision regarding automated

24 access, the Court does not reach the parties’ arguments as to other contract terms at issue.

25 To the extent BrandTotal’s declaratory judgment counterclaim could be construed as

26

14 Some of the exhibits to Michael Duffey’s declaration compress what should be many pages of

27

text to a single column on a single letter-sized page. Those exhibits would be unusable in hard

1 seeking a declaration that Facebook’s terms of service are unenforceable as against public policy,

2 BrandTotal has not shown a likelihood of success because, as discussed above in the context of

3 Facebook’s “legitimate business purpose” defense to BrandTotal’s intentional interference claim,

4 a significant public policy supports allowing Facebook to police automated access to its password-

5 protected platforms. BrandTotal has therefore shown at most significant issues going to whether

6 Facebook’s terms are enforceable, which does not add to the analysis of the present motion

7 beyond the significant issues BrandTotal has shown for intentional interference.

8 E. Balance of Equities

9 The balance of equities requires a court to consider “the interests of all parties and weigh

10 the damage to each.” CTIA - The Wireless Ass’n v. City of Berkeley, 928 F.3d 832, 852 (9th Cir.

11 2019) (citation and internal quotation marks omitted).

12 Facebook has legitimate interests in maintaining public confidence in its products and

13 avoiding potential liability for data privacy breaches. Ordering Facebook to allow access by

14 BrandTotal, without BrandTotal completing Facebook’s usual vetting process and using the

15 standard APIs for obtaining users’ permission to access their personal data, risks some degree of

16 harm to public confidence in Facebook’s data protection. As for potential liability for a breach,

17 the current record does not indicate major vulnerabilities that would result from the UpVoice

18 product specifically—except perhaps as to the users who have installed UpVoice, and others who

19 might share their computers—and Facebook is unlikely to face liability for complying with an

20 order of this Court requiring it to grant access. The Court also notes that Facebook has endured

21 unauthorized access by BrandTotal for some time, including the several-month period since it

22 began its investigation of BrandTotal in April of this year, without suffering any significant harm

23 that it has identified in the current record.15 Nevertheless, the potential harm to Facebook’s

24 reputation that could result from granting BrandTotal’s motion—and ordering Facebook to

25 tolerate automated data collection from password-protected portions of its network, by a third

26

15 As perhaps a countervailing consideration to any harm it might suffer, Facebook could stand to

27

benefit if BrandTotal’s products incentive users to frequently interact with Facebook’s networks,

1 party Facebook has not vetted and approved—is serious.

2 On the other hand, BrandTotal is not able to operate its business while it lacks access to

3 Facebook’s products. As discussed above in the context of irreparable injury, BrandTotal is losing

4 customers, faces new difficulty attracting investment, and is at risk of eventually shutting down.

5 Weighing the potential harm to only the parties to this case,16 BrandTotal faces far greater

6 consequences from the denial of a TRO than Facebook would suffer if the TRO were granted and

7 BrandTotal’s access restored pending the conclusion of litigation. The balance of equities

8 therefore tips in favor of BrandTotal. The Court assumes for the sake of argument that it tips

9 “sharply.”

10 F. Public Interest

11 “‘The public interest inquiry primarily addresses impact on non-parties rather than

12 parties,’” and “embodies the Supreme Court’s direction that ‘in exercising their sound discretion,

13 courts of equity should pay particular regard for the public consequences in employing the

14 extraordinary remedy of injunction.’” Bernhardt v. Los Angeles Cty., 339 F.3d 920, 931–32 (9th

15 Cir. 2003) (quoting Weinberger v. Romero-Barcelo, 456 U.S. 305, 312 (1982)). The public

16 interest in this case requires a balancing of the interests addressed by the Ninth Circuit in hiQ,

17 favoring open access to information and competition for data analytics services, and those

18 identified by Judge Hamilton in Stackla, favoring proactive data and privacy protection by

19 companies like Facebook. On balance, the Court is not persuaded that the public interest favors

20 the relief that BrandTotal seeks, requiring Facebook to provide immediate access to an automated

21 data collection program that Facebook has not vetted.

22 Addressing similar issues in Stackla, Judge Hamilton held as follows:

23 Awarding injunctive relief at this stage would compel Facebook to

permit a suspected abuser of its platform and its users’ privacy to

24 continue to access its platform and users’ data for weeks longer, until

a preliminary injunction motion could be resolved. Moreover, as

25 precedent within Facebook’s policy-setting organization and

potentially with other courts, issuing an injunction at this stage could

26

27

16 Public interest—including, here, the interests of individual Facebook and BrandTotal users, who

handicap Facebook’s ability to decisively police its social-media

1 platforms in the first instance. Facebook’s enforcement activities

would be compromised if judicial review were expected to precede

2 rather than follow its enforcement actions.

3 Although the public certainly has some interest in avoiding the

dissolution of companies and the accompanying loss of employment,

4 Facebook’s ability to decisively police the integrity of its platforms is

without question a pressing public interest. In particular, the public

5 has a strong interest in the integrity of Facebook’s platforms,

Facebook’s policing of those platforms for abuses, and Facebook's

6 protection of its users’ privacy. Congress’s ample attention to such

abuse is more than enough to demonstrate the importance of those

7 interests to the public, as are Facebook’s recent interactions with the

FTC. . . .

8

9 Stackla, 2019 WL 4738288, at *6.17 As Judge Hamilton noted, Facebook’s FTC violation

10 stemmed from allegations of “‘[1] maintaining deceptive settings that misled users about how to

11 protect their information from being shared by Facebook with third-party developers of apps . . .

12 [2] promising to stop giving app developers access to the data of app users’ Friends starting in

13 2014, when in fact many app developers continued to have such access past that date . . . [and 3]

14 inconsistently enforcing its privacy policies against app developers who violated those policies.’”

15 Id. (quoting United States v. Facebook, Inc., No. 19-cv-02184-TJK, ECF Doc. No. 4 (D.D.C. July

16 25, 2019)) (alterations in original).

17 BrandTotal’s access to Facebook users’ data circumvents Facebook’s privacy settings.

18 Although users separately consent to sharing most if not all of the data at issue when they install

19 the UpVoice browser extension, BrandTotal’s method of operating outside of Facebook’s platform

20 and APIs means that users who later review their Facebook privacy settings will not see

21 BrandTotal among the third parties with whom they have agreed to share information, and any

22 subsequent changes that users make to their Facebook privacy settings will not limit the

23 information that is shared with BrandTotal. Such circumstances could render Facebook’s privacy

24 settings “deceptive” and create risk of users being “misled”—some of the concerns that spurred

25

17 Another decision from this district, on a motion for default judgment, recently granted Facebook

26

a permanent injunction forbidding access by defendants accused of scraping user data from

Facebook using browser extensions, citing Stackla’s analysis of Facebook’s interest in securing its

27

platform. Facebook, Inc. v. Sluchevsky, No. 19-cv-01277-JSC, 2020 WL 5823277, at *9 (N.D.

1 the FTC’s enforcement action.18 Moreover, requiring Facebook to set aside in this instance its

2 normal requirement that third parties seek and obtain Facebook’s permission before collecting data

3 using automated means would mandate the sort of inconsistent enforcement of Facebook’s

4 policies that also concerned the FTC.

5 When it comes to advertising data—as opposed to user data—there are significant

6 countervailing concerns. As the Ninth Circuit noted in hiQ, “giving [social networking]

7 companies . . . free rein to decide, on any basis, who can collect and use data—data that the

8 companies do not own, that they otherwise make publicly available to viewers, and that the

9 companies themselves collect and use—risks the possible creation of information monopolies that

10 would disserve the public interest.” HiQ, 938 F.3d at 1005. Facebook does not own the contents

11 of advertisements placed on its networks, and already makes all such ads available for public

12 viewing. See Compl. ¶ 17. While Facebook notes that its advertisers maintain intellectual

13 property rights to the content of their ads, it has not suggested that BrandTotal’s use of that

14 content is anything but fair use. Facebook also has not suggested that it “owns” the related

15 information that BrandTotal collects about advertisements, such as the number of likes and

16 comments, or which users are presented with a given ad. Allowing a third party like BrandTotal

17 to compete with Facebook to provide data analytics services about advertising campaigns on

18 Facebook’s networks—advertising for which Facebook is already compensated by the

19 advertisers—would be consistent with a strong public interest in “maximizing the free flow of

20 information on the Internet” and fostering competition and innovation. See hiQ, 938 F.3d at 1004.

21 On balance, however, the Court is not satisfied that those interests wholly prevent Facebook from

22 vetting or regulating third parties that seek to automatically collect large quantities of user data

23 from nonpublic portions of Facebook’s networks.

24

18 UpVoice’s apparent ability to collect data from other users of shared computers who have not

25

themselves consented to sharing data with BrandTotal raises even greater concerns about

deception. BrandTotal argued at the hearing that such collection is “innocuous” because it

26

includes only “deidentified demographic information,” Hearing Tr. at 24:22–25:8, but the fact

remains that Facebook users have at least some interest in preventing the surreptitious collection

27

of personal information that, using Facebook’s privacy settings, they may have chosen to share

1 Expedited judicial proceedings are not an efficient mechanism to adjudicate in the first

2 instance potential data privacy risks from products that automatically collect Facebook users’ data.

3 The record suggests that BrandTotal has operated, at least for the most part, in good faith, and

4 likely poses no greater risk than described above, but courts generally lack the technical expertise

5 to evaluate such risks on a blank slate. And if Facebook could not take steps to block access by

6 third party developers unless it first builds a strong case of actual harm to its users—without the

7 benefit of the developer working with Facebook to explain its product’s operation and

8 safeguards—malicious actors would likely enjoy longer periods of access to users’ data before

9 facing any enforcement. Requiring a company seeking such access to coordinate with Facebook

10 and address potential concerns before obtaining access ensures that, if such a company believes

11 Facebook’s denial of access is impermissible, a court evaluating such a claim will benefit from a

12 fuller evidentiary record, presented by parties who understand each other’s products and positions.

13 Under the circumstances of this case, where BrandTotal built its business on ignoring

14 Facebook’s prohibition on automated access without permission, created separate architecture to

15 collect users’ Facebook profile data in ways not reflected in those users’ Facebook privacy

16 settings, and now requests an immediate order preventing Facebook from taking any steps to limit

17 its access despite an FTC order requiring Facebook to enforce its terms of use and police such

18 access, the Court concludes that the public interest requires denying the extraordinary relief

19 BrandTotal seeks.

20 IV. CONCLUSION

21 BrandTotal has shown a risk of irreparable harm in the absence of relief, serious issues

22 going to the merits of its claims, and a balance of hardships that tips in its favor, perhaps sharply

23 so. The public interest, however, weighs against granting the relief that BrandTotal seeks.19

24 / / /

25

26

19 Because the Court denies BrandTotal’s motion based on public interest, the Court does not

reach Facebook’s argument that the order BrandTotal seeks—compelling Facebook to “take other

27

reasonable actions in communication with Google” to ensure reinstatement of the UpVoice

] BrandTotal’s motion for a TRO is therefore DENIED.

2 IT IS SO ORDERED.

3 Dated: November 2, 2020

4 CZ

J PH C. SPERO

5 ief Magistrate Judge

6

7

8

9

10

11

«4

©

15

A 16

17

Zz 18

19

20

21

22

23

24

25

26

27

28