Photo credit: PixieMe – stock.adobe.com.
In Facebook, Inc. v. BrandTotal Ltd., ad consulting company and browser extension provider, BrandTotal, failed to obtain a temporary restraining order against Facebook, which would have enabled it to continue scraping Facebook’s platform while the parties address the merits of their dispute.
This case echoes hiQ Labs, Inc. v. LinkedIn Corporation, although with a different early outcome. The court’s decision here suggests that privacy concerns are beginning to loom larger in the webscraping debate, at least in the 9th Circuit. Specifically, it suggests that courts might be more receptive to a webscraping target’s efforts to stop scraping that would be counter to its privacy policy or settings, or pose a risk to the privacy or security of its users. The ruling also informs considerations around data collection through third party extensions or other integrations.
Background
BrandTotal is an ad consulting company that provides insights into social media ad performance, obtained in part through consumer-downloaded browser extensions. BrandTotal offered gift cards to Facebook users who installed its extensions on their browsers. The extensions allowed BrandTotal to automatically gather data from a user’s profile when they browsed Facebook – including demographic information on the user, the ads they see, and the amount of overall engagement with ads. BrandTotal claimed that it did not collect profile data on a user’s friends.
Facebook alleges that it employs various protocols to prevent scraping of its platform. Believing BrandTotal to be operating in violation of Facebook’s terms as well as potentially deceiving users by misrepresenting BrandTotal’s affiliation with Facebook, Facebook blocked BrandTotal’s accounts and successfully asked Google to remove the browser extension from its web store. Facebook then sued BrandTotal, alleging that BrandTotal violated Facebook’s terms of service, misled users, unlawfully scraped Facebook’s website, including in violation of the Computer Fraud and Abuse Act, and unlawfully induced Facebook users to violate their own terms of service by allowing scraping.
BrandTotal counter claimed for intentional interference with contract, intentional interference with prospective economic advantage, and violation of California’s Unfair Competition Law. Claiming that Facebook’s blocking threatened BrandTotal’s viability, BrandTotal sought a TRO requiring Facebook to rescind its request that Google remove the browser extension, reverse any blocking from Facebook, and restore BrandTotal’s Facebook pages. The court applied the traditional TRO test to BrandTotal’s motion, evaluating its likelihood of success on the merits of its counterclaims, whether it would suffer irreparable harm without the TRO, whether the balance of equities tipped in its favor, and whether the TRO was in the public interest.
Likelihood of Success on the Merits
The Court found that BrandTotal raised serious questions but did not establish a likelihood of success on the merits on any of its claims. In evaluating the merits of BrandTotal’s interference with contract claim, the court concluded that BrandTotal was likely to succeed in showing that Facebook knew BrandTotal entered into contracts that depended on the data it collected from Facebook. But the more significant issue was whether Facebook had a “legitimate business purpose” for its actions, which can serve as a defense to interference. There, the court found that BrandTotal raised serious questions about whether Facebook’s actions were motivated by an attempt to block a potential competitor’s access to ad information that was “essentially public.” But the court also found that:
“Facebook likely has at least some degree of legitimate business interest in safeguarding user privacy and security by preventing unapproved programs from automatically collecting data after users have logged into Facebook’s social networks, in order to comply with its obligations under the FTC order, avoid other potential liability for data breaches, and maintain public confidence in its products.”
The court also concluded that Facebook’s general interest in policing access to password-protected portions of its network (like demographic information on users who installed the browser extension in the first place) was “marginally greater” than LinkedIn’s interest in restricting access to otherwise public pages in hiQ. The Court nonetheless concluded that although BrandTotal raised serious questions as to the merits of its contractual interference claim, it did not establish a likelihood of success.
The court reached the same conclusion with respect to BrandTotal’s other claims. The court found the same reasoning that applied to BrandTotal’s contractual interference claim applied to its interference with advantage and unfair competition claims. It also found that BrandTotal was not likely to succeed on its claim for declaratory judgment that it had not breached Facebook’s terms of service because the record suggested that BrandTotal breached at least the provision of Facebook’s terms prohibiting obtaining data by automated means.
Irreparable Harm, Balance of Equities, and Public Interest
The Court found that BrandTotal established irreparable harm because it showed that being blocked created a “massive disruption in its business.” The company noted that it lost access to 95 percent of the data that it normally provides, one customer froze all work, and other potential customers suspended negotiations. The court likewise found that the balance of equities tipped in favor of BrandTotal because it risked shutting down while, according to the court, Facebook faced only reputational harm. The Court assumed, without deciding, that the balance tipped “sharply” in BrandTotal’s favor – a distinction that made the decision hinge on a balancing of public interests.
Finally, the court concluded that the public interest did not favor requiring Facebook to provide immediate access to an automated data collection program it had not vetted. The court found that the interests of competition and the free flow of information were “consistent with” allowing third parties to obtain more granular information about the performance of ad campaigns on Facebook. But that interest did not outweigh privacy, especially in light of Facebook’s obligations to the FTC that included requirements that third parties certify and comply with Facebook’s terms – something BrandTotal avoided since it operated without Facebook’s permission. The court also expressed concern that BrandTotal’s access to Facebook user data could circumvent Facebook’s privacy settings. According to the court, such circumstances could render Facebook’s privacy settings deceptive and create a risk of users being misled, some of the concerns that led to the FTC’s enforcement action in the first instance. The court considered this a concern even though “users separately consent to sharing most if not all of the data at issue” when they install the browser extension.
The case is ongoing and the court could come to a different conclusion at a later stage in the case. But in the interim, Facebook remains free to block BrandTotal’s ability to scrape Facebook.
