The British Columbia Supreme Court has approved a $51-million settlement agreement in the class action lawsuit Douez v Facebook, Inc., 2022 BCSC 914.
The lawsuit arose from allegations that Facebook violated provincial privacy statutes through its "Sponsored Stories" advertising program. This case has significant implications on privacy laws in Canada, particularly for individuals in British Columbia, Saskatchewan, Manitoba, and Newfoundland and Labrador. The liability findings in this case were made by way of summary trial; however, damages could not be summarily assessed. Following the summary determination on the liability common issues, the parties entered into a settlement agreement rather than proceeding to trial to determine damages. The following details summarize important considerations of the case and its broader legal implications.
Sponsored Stories Violated Users' Privacy
At the heart of the class action were allegations that Facebook improperly used the names and images of class members in the Sponsored Stories advertising program without their consent. Sponsored Stories were advertisements that publicized a user's social actions alongside an advertiser's brand such as "Liking" a page, "Checking In" at a location or performing an "App Share." These ads appeared on the homepages of the user's Facebook friends, often with priority over other content, without notifying the user that their name and image were being used.
During the class period, which ran from January 1, 2011 to May 30, 2014, Facebook's Terms of Use indicated that users consented to the use of their information in connection with sponsored or commercial content. However, the class argued that the terms were ambiguous, and they failed to provide sufficient notice or failed to obtain informed consent. The governing privacy statutes in British Columbia, Saskatchewan, Manitoba, and Newfoundland and Labrador prohibit the use of an individual's name or likeness for commercial purposes without consent, forming the legal basis for the claims.
Facebook's Argument
The British Columbia Supreme Court rejected Facebook's arguments, finding that its use of user information in Sponsored Stories breached provincial privacy statutes. The bases for Facebook's argument were:
- Consent via Terms of Use: Facebook argued that users agreed to its Terms of Use, which allowed for the use of their names and images in Sponsored Stories. These standard form terms were presented during the registration process, either through a clickable hyperlink or a notification that signing up constituted agreement.
- Definition of "Give": Facebook claimed that it did not "give" user information to advertisers in the sense of transferring or allowing advertisers to store or alter the data. Instead, Facebook retained control and merely displayed the information as part of the Sponsored Story.
- Privacy Settings: Facebook asserted that its privacy settings allowed users to control how their information was used, including limiting the audience for their social actions.
The Court's Findings
The court rejected Facebook's arguments, finding that its use of user information in Sponsored Stories breached provincial privacy statutes. Its findings included:
- Ambiguity in Terms of Use: The court noted that Facebook's Terms of Use were ambiguous and failed to define critical terms like "give." In the context of a standard form contract with significant power imbalances, any ambiguity was construed against Facebook as the drafting party.
- Lack of Informed Consent: The evidence showed that reasonable users would not have understood that their social actions could be repurposed into Sponsored Stories. Users were not notified in advance, could not opt out and could not effectively limit their participation through privacy settings.
- Privacy Settings Were Ineffective: The court highlighted that users had no way of knowing which social actions would become Sponsored Stories. While users could delete their original actions, the Sponsored Stories would remain visible to friends, undermining users' ability to control the use of the personal information.
The Settlement Agreement
Without admitting liability, Facebook agreed to settle the class action for $51 million. This amount was distributed among the class members, bringing closure to a case that underscores the importance of clear consent and effective privacy protections. The settlement also includes a dismissal of the action. While Facebook maintains its position that its practices were lawful, the agreement represents a significant acknowledgement of the need for businesses to carefully navigate privacy laws in Canada.
Lessons for Businesses
The Douez case provides valuable insights for businesses operating in Canada, including:
- Clear and Informed Consent is Essential: Businesses must ensure that their terms of use and privacy policies are clear, transparent and easily understood by users. Consent must be informed and cannot rely on ambiguous or buried clauses, especially in the context of standard form contracts.
- Respect Provincial Privacy Laws: Companies must ensure they adhere to the privacy statutes in all jurisdictions where they operate, as these laws impose strict requirements for obtaining consent before using personal information.
- Effective Privacy Controls: Offering users robust and effective privacy controls is not just good practice, but may be a legal requirement. Users should be able to easily opt out of programs that involve the use of their personal information.
- Power imbalance in Standard Form Contract: Courts in Canada have consistently scrutinized standard form contracts, especially where there is a significant power imbalance between the parties. Businesses should have this front of mind when drafting their terms of use and other agreements.
The settlement agreement arising from Douez highlights the evolving landscape of privacy laws in Canada. As digital platforms and advertising models become more sophisticated, courts are likely to continue examining the balance between commercial interests and individual privacy rights. Businesses that fail to prioritize privacy compliance risk significant legal and reputational consequences. The leading Technology, Intellectual Property & Privacy (TIPP) team at MLT Aikins is happy to assist your business in navigating the privacy laws in Canada and beyond.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.