Meta Platforms, Inc. v. BrandTotal Ltd.

• Court: District Court, N.D. California
• Decided: November 9, 2020
• Docket: 3:20-cv-07182
• Status: Unknown

Opinion

1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 7 FACEBOOK, INC., Case No. 20-cv-07182-JCS

8 Plaintiff, ORDER REGARDING MOTION FOR 9 v. TEMPORARY RESTRAINING ORDER

10 BRANDTOTAL LTD., et al., Provisionally Filed Under Seal 11 Defendants. Re: Dkt. No. 27

12 13 I. INTRODUCTION 14 Plaintiff Facebook, Inc. brings this action asserting breach of contract, violation of the 15 Computer Fraud and Abuse Act (“CFAA”), and other claims against Defendants BrandTotal Ltd. 16 and Unimania, Inc. (collectively, “BrandTotal”1) based on BrandTotal’s collection and marketing 17 of data from Facebook’s websites—specifically, its eponymous social network (hereinafter the 18 “Facebook Network,” in order to distinguish that product from the corporate entity) and 19 Instagram. BrandTotal asserts counterclaims based on Facebook blocking its access to those 20 products, and now moves for a temporary restraining order (“TRO”). The Court held a hearing on 21 October 26, 2020. 22 BrandTotal has shown serious issues going to the merits of its counterclaims, which 23 implicate difficult questions of balancing—among other considerations—Facebook’s interests in 24 limiting access to its networks, BrandTotal’s interests in maintaining its business, the public 25 interest in competition, and individual users’ potentially conflicting interests in both the privacy of 26 their data and choosing how to share that data. Nevertheless, for the reasons discussed below, the 27 1 Court DENIES BrandTotal’s motion.2 2 II. BACKGROUND 3 A. The Parties’ Allegations and Claims 4 The following subsections summarize the parties’ factual allegations as context for their 5 respective claims and positions. Nothing in these subsections should be construed as resolving 6 any disputed issue of fact, or as addressing whether any allegation has evidentiary support in the 7 current record. The evidentiary record is addressed in the context of the Court’s analysis. 8 1. Facebook’s Allegations and Claims 9 Facebook is a social networking company with billions of individual users across multiple 10 products, including the Facebook Network and the Instagram social network.3 See Compl. (dkt. 1) 11 ¶ 13. All users of the Facebook Network agree to contractual terms including that users will not 12 do anything that would “impair the proper working or appearance” of Facebook’s products, will 13 not access or collect data from Facebook’s products “using automated means” without Facebook’s 14 permission, and will not attempt to access data that the particular user lacks permission to access. 15 Id. ¶¶ 21, 24, 26. All Instagram users similarly agree not to do “anything to interfere with or 16 impair the intended operation” of Instagram, not to “collect[] information in an automated way 17 without [Facebook’s] express permission,” not to access information “in unauthorized ways,” and 18 not to violate anyone else’s rights, including intellectual property rights. Id. ¶¶ 22, 25, 27. Users 19 of both networks agree not to do anything unlawful, misleading, or fraudulent, or to facilitate such 20 activity. Id. ¶ 23. According to Facebook, BrandTotal agreed to these terms when it created 21 accounts on the Facebook Network and Instagram. See id. ¶¶ 35–39. 22 Facebook employs various measures to prevent “scraping”—bulk automated collection— 23 of content from its products, including monitoring usage patterns, using “CAPTCHA” tests to 24 determine whether users are human as opposed to automated programs, and disabling accounts 25

26 2 The parties have consented to the jurisdiction of the undersigned magistrate judge for all purposes pursuant to 28 U.S.C. § 636(c). 27 3 This case concerns only the Facebook and Instagram social networks. References herein to 1 that violate its rules. Id. ¶ 29. 2 BrandTotal offered programs called UpVoice and Ads Feed that users could install as 3 extensions for the Google Chrome internet browser, which Facebook alleges worked as follows:

4 Once installed by the users . . . [BrandTotal] used the users’ browsers as a proxy to access Facebook computers, without Facebook’s 5 authorization, meanwhile pretending to be a legitimate Facebook or Instagram user. The malicious extensions contained JavaScript files 6 designed to web scrape the user’s profile information, user advertisement interest information, and advertisements and 7 advertising metrics from ads appearing on a user’s account, while the user visited the Facebook or Instagram websites. The data scraped by 8 [BrandTotal] included both public and non-publicly viewable data about the users. 9 [BrandTotal’s] malicious extensions were designed to web scrape 10 Facebook and Instagram user profile information, regardless of the account’s privacy settings. The malicious extensions were 11 programmed to send unauthorized, automated commands to Facebook and Instagram servers purporting to originate from the user 12 (instead of [BrandTotal]), web scrape the information, and send the scraped data to the user’s computer, and then to servers that 13 [BrandTotal] controlled. 14 Id. ¶¶ 45–46. Facebook alleges that BrandTotal collected information including “the user’s ID, 15 gender, date of birth, relationship status, and location information,” users’ “Ad Preferences” 16 information that Facebook used to determine what ads to show them, and—with respect to 17 advertisements that users viewed while using the extension—“information about the advertiser, 18 the image and text of the advertisement, and user interaction and reaction metrics (e.g., number of 19 views, comments, likes) associated with an advertisement.” Id. ¶ 54. According to Facebook, the 20 UpVoice and Ads Feed extensions used nearly identical code and functioned materially the same 21 way. See id. ¶ 57. 22 Facebook provides a searchable public library of all advertisements published on its 23 networks, which includes data such as the “Page” responsible for running the ad, the geographic 24 region it is directed to, and the number of users that viewed the ad on a particular day. See id. 25 ¶¶ 17–19. Facebook’s public library does not include demographic information about users that 26 viewed a particular ad, or information regarding how users interacted with an ad (e.g., “likes” and 27 comments). Id. ¶ 20. 1 payment for UpVoice users, by allowing Ads Feed users to review lists of ads they had seen in the 2 last ninety days so that users could return to ads that interested them, and by telling users that they 3 would serve as “panelists” to influence corporate marketing decisions. Id. ¶¶ 43–44, 49, 56. 4 BrandTotal analyzed and sold the data that it obtained from users to corporate clients. Id. ¶ 37. 5 BrandTotal used different trade names for its browser extensions (which gathered data) and its 6 marketing intelligence product (which incorporated that data), and advertised its products to both 7 potential individual users (who might install the browser extensions and provide data) and 8 potential corporate clients (who might purchase data) on the Facebook Network. Id. ¶¶ 39–40, 42, 9 47. 10 According to Facebook, BrandTotal made misleading representations to users of its 11 browser extensions, both by including the Facebook Network in a list of “participating sites” when 12 Facebook had not agreed to work with BrandTotal or authorized it to access Facebook’s data, and 13 by failing to include Instagram in the list of “participating sites” even though the browser 14 extension scraped data from Instagram. Id. ¶ 50. 15 On September 30, 2020, Facebook disabled BrandTotal’s accounts on Instagram and the 16 Facebook Network and instated other technological measures to block BrandTotal’s access to 17 Facebook’s products. Id. ¶ 58. On October 1, 2020, Facebook filed a civil action against 18 BrandTotal in California state court alleging that the browser extensions breached Facebook’s 19 terms of service. Id. ¶ 59.4 Later that day, Google removed the browser extensions from its 20 Chrome Web Store, which disabled their functionality. Id. ¶ 60. On October 3, 2020, 21 BrandTotal’s chief product officer created accounts on Instagram and the Facebook Network using 22 false names. Id. ¶ 61. On October 12, 2020, BrandTotal introduced a new UpVoice browser 23 extension on the Chrome Web Store, listing the developer of the extension as “UpVoice Team.” 24 Id. ¶ 62. According to Facebook, the new UpVoice extension—like its predecessors—collected 25 data when users accessed the Facebook Network and returned that data to BrandTotal, including 26

27 4 Facebook voluntarily dismissed its state court action before bringing the present action in this 1 data that was, “in some cases, not even viewed by the user.” Id. Around thirty users installed this 2 new extension. Id. 3 Facebook asserts the following claims: (1) breach of contract, based on the Facebook 4 Network and Instagram terms of service, id. ¶¶ 67–73; (2) unjust enrichment, id. ¶¶ 74–80; 5 (3) unauthorized access in violation of the CFAA, id. ¶¶ 81–86; (4) unauthorized access in 6 violation of California Penal Code § 502, id. ¶¶ 87–95; (5) interference with contractual relations 7 by inducing Facebook’s users to share their login credentials with BrandTotal, in violation of 8 Facebook’s terms of service, id. ¶¶ 96–102; and (6) unlawful, unfair, or fraudulent business 9 practices in violation of California’s Unfair Competition Law, Cal. Bus. & Prof. Code § 17200 10 (the “UCL”), Compl. ¶¶ 103–10. Facebook seeks both injunctive and compensatory relief. See id. 11 at 21–22, ¶¶ (a)–(h) (Prayer for Relief). 12 2. BrandTotal’s Allegations and Claims 13 BrandTotal is an advertising consulting company that offers its clients analysis of the 14 clients’ own advertising and their competitor’s advertising on social media, including Instagram 15 and the Facebook Network. Counterclaim (dkt. 23) ¶ 8.5 BrandTotal alleges that it collects 16 information only after receiving “informed consent and deliberate opt-in” from its users, which 17 users grant in exchange for gift cards. Id. ¶ 10. BrandTotal’s users must “confirm they have read 18 the privacy policy which details the demographic and advertising . . . information BrandTotal 19 collects” before they install the UpVoice browser extension. Id. ¶ 11. 20 According to BrandTotal, the UpVoice extension “allows BrandTotal to collect data the 21 user either owns or has a right to access and certain public information about the websites the user 22 visits,” including “the ads they see and interact with on social media sites like Facebook, as they 23 browse as usual on those sites,” and “deidentified information about the user by using hashed 24 values for the user’s device and user IDs.” Id. ¶¶ 13–14, 16.

25 BrandTotal does not collect the user’s names or email addresses, although the user provides that when they sign up. BrandTotal does 26

27 5 BrandTotal’s Answer and Counterclaim is filed as a single docket entry. Citations herein to the not keep or compile participants’ private postings, photos, or web 1 history, nor does BrandTotal mine “friend” information, or otherwise take data not expressly authorized. Rather, the information collected 2 relates to who is seeing what advertisement, where and at what times. 3 Id. ¶ 17. BrandTotal anonymizes the information it collects and provides aggregated data, broken 4 out by demographic information (“age, gender, high level location, marital status, interests”) to its 5 clients. Id. ¶ 18. 6 BrandTotal acknowledges the provision in Facebook’s terms of service prohibiting data 7 collection by automated means without Facebook’s permission, but implies that Facebook’s 8 claimed ability “to pick and choose who . . . will be allowed to access the information” conflicts 9 with other provisions of the terms of service “acknowledg[ing] that users own the rights in their 10 own information.” Id. ¶ 21. BrandTotal also alleges that Facebook itself aggregates and sells user 11 data as part of its own advertising consulting service. Id. ¶ 22. 12 According to BrandTotal, Facebook’s actions to cut off BrandTotal’s access to Facebook 13 products and block BrandTotal’s browser extensions from appearing in Google’s Chrome Web 14 Store prevent BrandTotal from compiling advertising analytics for its customers, prevent 15 BrandTotal’s users from logging in “to collect any rewards they have earned,” and prevent 16 BrandTotal from recruiting new participants. Id. ¶ 28. BrandTotal customers, including 17 “reputable large companies,” are questioning their relationship, prospective customers that were in 18 negotiations are walking away, and BrandTotal cannot secure receivables, lending, or venture 19 capital investment while it lacks access to Facebook’s networks. Id. ¶¶ 29–30. As a result, 20 BrandTotal is “in jeopardy of being insolvent.” Id. 31. 21 BrandTotal asserts the following counterclaims: (1) intentional interference with contract, 22 based on contracts with its corporate customers, id. ¶¶ 32–41; (2) intentional interference with 23 prospective economic advantage, id. ¶¶ 42–48; (3) unlawful, unfair, and fraudulent conduct in 24 violation of the UCL, id. ¶¶ 49–63; and (4) declaratory judgment that BrandTotal has not breached 25 any contract with Facebook because its access “has never been unlawful, misleading, or 26 fraudulent,” because its products “have never impaired the proper working appearance or the 27 intended operation of any Facebook product” or “accessed any Facebook product using automated 1 whether to share it with BrandTotal, id. ¶¶ 64–73. BrandTotal seeks both injunctive and 2 compensatory relief. Id. at 23, ¶¶ A–E (Prayer for Relief). 3 B. Procedural History 4 Facebook initially filed state law claims against BrandTotal in the California Superior 5 Court for San Mateo County, case number 20-CIV-04526, on October 1, 2020. Telscher Decl. 6 (dkt. 27-4) ¶ 2; Kim Decl. (dkt. 44) ¶ 2. BrandTotal informed Facebook on October 8, 2020 of its 7 intent to move for a TRO on October 13th or 14th. Telscher Decl. ¶ 4; Kim Del. ¶ 3 & Ex. 1. 8 Facebook’s counsel asked BrandTotal to delay its TRO application, and BrandTotal asked, in 9 exchange for such delay, for Facebook to agree to discuss the issues in the case and see if a 10 resolution could be reached. Telscher Decl. ¶ 5; Kim Decl. ¶ 4 & Ex. 2. On the morning of that 11 settlement conference, BrandTotal provided formal notice of its intent to move for a TRO. 12 Telscher Decl. ¶ 6; Kim Dec. ¶ 5 & Ex. 3. According to BrandTotal’s attorney Rudolph Telscher, 13 Facebook’s representatives at the settlement conference lacked authority to settle the case or 14 provide assurances that would moot the need for a TRO. Telscher Decl. ¶ 7. 15 The same day, Facebook voluntarily dismissed its state court action and filed a complaint 16 in this Court, adding new claims including its sole federal claim under the CFAA, before 17 BrandTotal could move for a TRO in state court the following day. Telscher Decl. ¶ 8; Kim Decl. 18 ¶ 8. According to Facebook’s attorney Jason Kim, the decision to add a CFAA claim was based 19 on Facebook’s discovery that that BrandTotal’s browser extension had been relisted in the Chrome 20 Web Store after Google had taken down an earlier version. Kim Decl. ¶ 8. 21 BrandTotal filed its present application two days later, on October 16, 2020. See Mot. 22 (dkt. 27). 23 C. The Parties’ Arguments 24 1. BrandTotal’s Motion 25 BrandTotal seeks a TRO requiring Facebook to rescind its request that Google remove the 26 UpVoice browser extension,6 reverse any technological measures that Facebook has used to block 27 1 UpVoice from accessing its website, and restore BrandTotal’s and its principals’ pages on 2 Facebook. See Proposed Order (dkt. 27-5). BrandTotal contends that this case is analogous to a 3 recent Ninth Circuit decision affirming injunctive relief in favor of a company that collected data 4 from publicly available LinkedIn profiles, hiQ Labs, Inc. v. LinkedIn Corporation, 938 F.3d 985 5 (2019). Mot. at 2. According to BrandTotal, any argument Facebook might make that it is 6 protecting users’ privacy is belied by a history of privacy violations on Facebook’s part, including 7 a five-billion-dollar Federal Trade Commission fine and a large class action settlement, thus 8 supporting an inference that Facebook’s true motivation in this case is harming a potential 9 competitor. Id.; see also id. at 6–7 (discussing congressional findings of monopolization and 10 anticompetitive conduct by Facebook). BrandTotal contends that denying a TRO would “lead[] to 11 the destruction of the business,” id. at 3, and that it meets the Ninth Circuit’s test for such relief 12 based on a likelihood of immediate irreparable harm, the public interest favoring an injunction, the 13 balance of equities tipping in BrandTotal’s favor, and a likelihood of success on (or at least serious 14 questions going to) the merits of the case, id. at 8–9. 15 a. Success on the Merits 16 BrandTotal argues that it is likely to successfully defend against Facebook’s breach of 17 contract claim because its product does not use the type of “automated” means that the terms of 18 service are intended to prohibit—programs that scrape as much data as possible from an entire 19 website. Id. at 9–10. According to BrandTotal, its browser extension operates only with a user’s 20 consent and relies on the user’s deliberate conduct of browsing the Facebook Network, 21 distinguishing it from malicious and more-fully-automated “scraper” programs like those used by 22 Cambridge Analytica for purposes related to the 2016 election. Id. at 10. 23 Even if the Court construes Facebook’s prohibition of “automated means” (without 24 Facebook’s permission) as encompassing BrandTotal’s product, BrandTotal argues that the 25 prohibition is unenforceable because it purports to control users’ choices to share information they 26 own. Id. at 10–11. BrandTotal cites intellectual property doctrines stemming from Lear, Inc. v. 27 Adkins, 395 U.S. 653, 674–75 (1969), as well as California law providing that contracts may not 1 Code § 1667(2), as supporting its view that contractual provisions preventing users from sharing 2 their own data are unenforceable because impair competition and the free flow of information. 3 Mot. at 11–12. BrandTotal also cites the California Consumer Privacy Act (“CCPA”) as 4 recognizing consumers’ ownership of their personal information, allowing businesses to offer 5 consumers compensation for using that information, and prohibiting contracts that waive users’ 6 rights under the statute. Id. at 12–13. BrandTotal contends that “[m]uch of what [it] collects are 7 basic facts in the public domain,” and that courts have recognized that such facts cannot be 8 restricted by copyright or a right of publicity. Id. at 13–14. BrandTotal also cites the Ninth 9 Circuit’s concerns in hiQ regarding companies that host “‘vast amounts of public data’” 10 selectively excluding potential competitors, and thus potentially suppressing innovation. Id. at 14. 11 Along the same lines, BrandTotal argues that Facebook’s exclusion of a competitor that seeks to 12 compensate users for their information, while Facebook aggregates the same information for its 13 own products and services that it sells to advertisers, violates the public policies underlying state 14 and federal antitrust law. Id. at 14–17 (citing Telscher Decl. Ex. H, Facebook’s data policy, which 15 permits such conduct by Facebook). 16 BrandTotal contends that it will likely prevail on Facebook’s claims under the CFAA and 17 section 502(c) of the Penal Code, and for unjust enrichment, because it acted with users’ 18 authorization—who in turn were authorized to access Facebook’s servers—and thus “has done 19 nothing improper.” Id. at 17–18. BrandTotal argues that it will prevail on Facebook’s claim for 20 interference with contract because it has not collected users’ login credentials, and thus did not 21 induce users to breach the terms of service’s prohibition on sharing that information. Id. at 20. 22 With respect to its own counterclaims, BrandTotal argues that it is likely to prevail on its 23 claims for intentional interference with contract and with prospective economic advantage 24 because, by blocking access, Facebook interfered with BrandTotal’s contracts to provide analytics 25 services to its customers. Id. at 18–19. BrandTotal contends that it will prevail on the “unlawful” 26 prong of its UCL claim based on that intentional interference, and that Facebook’s conduct is also 27 “unfair” because it is anticompetitive an “fraudulent” because it conflicts with representations in 1 b. Irreparable Injury, Balance of Equities, and Public Interest 2 BrandTotal asserts that it faces irreparable injury because it might be forced to close its 3 business without access to data from Facebook’s products. Id. at 23–24. According to 4 BrandTotal, Facebook would not face any significant harm if it were required to allow BrandTotal 5 to continue operating during litigation in the same manner that it has already operated for years, 6 which favors not only granting a TRO, but doing so without requiring any bond. Id. at 24–25. 7 BrandTotal also contends that the public interest favors granting relief “[f]or the same reasons that 8 make Facebook’s terms of service unenforceable.” Id. at 25. 9 2. Facebook’s Opposition 10 Facebook contends that BrandTotal has not met the requirement of irreparable injury 11 because any risk of the demise of its business is speculative, and because the relief that it seeks 12 would not actually redress its harm, which requires independent action by Google to reinstate the 13 UpVoice browser extension. Opp’n at 9–12. Facebook also argues that the proposed TRO is 14 insufficiently precise and would not be enforceable, id. at 10, and that BrandTotal’s delay of 15 around two weeks in filing its present motion undermines its argument that immediate relief is 16 critical, id. at 12–13. 17 Facebook contends that BrandTotal is unlikely to succeed on its intentional interference 18 counterclaim because there is no evidence Facebook knew of any particular contracts affected by 19 its denial of access, BrandTotal has not shown actual breach of a contract, Facebook acted with a 20 legitimate business purpose of protecting user privacy and securing its platform, and any harm was 21 caused by Google’s independent decision to remove UpVoice from its store. Id. at 13–15. 22 Facebook argues that BrandTotal will not succeed on its UCL counterclaim because Facebook did 23 not act unlawfully, has not violated the antitrust laws, and did not deceive users where its terms of 24 use specifically provided that unauthorized automated access was prohibited. Id. at 15–17. 25 Facebook also argues that it will likely succeed on its own claims against BrandTotal based on 26 BrandTotal’s use of automated means to access password-protected data from Facebook’s 27 products without Facebook’s permission, and based on BrandTotal inducing users to breach 1 Facebook contends that to “force Facebook to allow a non-compliant developer back on its 2 platform” would be inequitable both with respect to the balance of equities between the parties, 3 and with respect to the public interest. Id. at 23–24. 4 3. BrandTotal’s Reply 5 BrandTotal argues again in its reply that it faces imminent collapse as a business without a 6 TRO allowing it access to data from Facebook’s platforms, among other intangible harm, and 7 contends that the injury would likely be redressed by Facebook withdrawing any objection to 8 Google allowing UpVoice in the Chrome Web Store. Reply (dkt. 50) at 3–7. BrandTotal also 9 argues that it acted promptly in light of the complexity of the case and the parties’ discussions. Id. 10 at 7–8. 11 BrandTotal contends that it is likely to prevail on both Facebook’s claims and its own 12 counterclaims because its services do not constitute “automated means” as that term is used in 13 Facebook’s terms of use, it obtained users’ permission to access their data, and allowing Facebook 14 to restrict access to the data at issue under those circumstances would be anticompetitive and 15 harmful to consumers’ rights to their own information. Id. at 9–14. In light of those concerns, and 16 the degree of “power that companies like Facebook wield,” BrandTotal contends that the balance 17 of equities and the public interest favor granting its request for a TRO. Id. at 14–15. 18 III. ANALYSIS 19 A. Legal Standard 20 The legal standard for a TRO is substantially identical to the standard for a preliminary 21 injunction. See Stuhlbarg Int’l Sales Co., Inc. v. John D. Brush & Co., Inc., 240 F.3d 832, 839 n.7 22 (9th Cir. 2001).7 “A preliminary injunction is an extraordinary remedy never awarded as of right.” 23 Winter v. Nat. Res. Defense Council, Inc., 555 U.S. 7, 24 (2008). “A plaintiff seeking a 24 preliminary injunction must establish that he is likely to succeed on the merits, that he is likely to 25 suffer irreparable harm in the absence of preliminary relief, that the balance of equities tips in his 26

27 7 A TRO issued “without written or oral notice to the adverse party or its attorney” is subject to 1 favor, and that an injunction is in the public interest.” Id. at 20. Irreparable harm must be likely— 2 it is no longer sufficient to grant a preliminary injunction upon a mere showing of a “possibility” 3 of irreparable harm when the other factors weigh heavily in favor of the plaintiff. Alliance for the 4 Wild Rockies v. Cottrell, 632 F.3d 1127, 1132 (9th Cir. 2011). Nonetheless, the Ninth Circuit still 5 evaluates the likelihood of success on a “sliding scale.” Id. A TRO or preliminary injunction may 6 be warranted upon a showing of “serious questions going to the merits” as well as “a hardship 7 balance that tips sharply toward the plaintiff,” so long as the plaintiff is likely to suffer irreparable 8 harm and the injunction or restraining order is in the public interest. Id. 9 B. HiQ v. LinkedIn 10 BrandTotal contends that this case is analogous to the Ninth Circuit’s decision affirming 11 injunctive relief in hiQ Labs, Inc. v. LinkedIn Corporation, 938 F.3d 985 (2019). The plaintiff in 12 that case, hiQ, used automated computer programs to “scrape[] information that LinkedIn users 13 have included on public LinkedIn profiles, including name, job title, work history, and skills,” and 14 “then use[d] that information, along with a proprietary predictive algorithm, to yield ‘people 15 analytics,’ which it [sold] to business clients.” Id. at 991. The access at issue concerned only 16 profiles that LinkedIn users elected to “ma[ke] visible to the general public.” Id. at 990. 17 LinkedIn, which competed with hiQ to sell products derived from information its users included in 18 their profiles, sent hiQ a cease-and-desist letter asserting violations of the CFAA and other laws, 19 and claiming to have implemented technical measures to block hiQ’s access to LinkedIn’s 20 website. Id. at 991–92. 21 HiQ brought suit for declaratory judgment that LinkedIn could not invoke the CFAA or 22 other authority on which it relied, and for injunctive relief on a number of claims under California 23 law, and sought a TRO. See id. at 992. The parties agreed to convert hiQ’s request for a TRO into 24 a motion for a preliminary injunction. Id. The district court—the Honorable Edward Chen, of this 25 district—“granted hiQ a preliminary injunction, concluding that the balance of hardships tips 26 sharply in hiQ’s favor and that hiQ raised serious questions on the merits.” Id. at 992–93. The 27 Ninth Circuit affirmed, focusing on hiQ’s claim for intentional interference with contract and 1 The Ninth Circuit first affirmed the determination that hiQ showed a threat of irreparable 2 injury based threats to “the survival of its business”—including contracts it would not be able to 3 honor, loss of interest in an ongoing financing round, and the departure of employees—because 4 hiQ’s business model was based entirely on access to LinkedIn profile data. Id. at 993–94. The 5 court noted that although a threat of monetary injury generally is not sufficient to support a 6 preliminary injunction, longstanding Ninth Circuit precedent has recognized that “showing a 7 threat of ‘extinction’ is enough to establish irreparable harm, even when damages may be 8 available and the amount of direct financial harm is ascertainable.” Id. at 993 (citing Am. Passage 9 Media Corp. v. Cass Commc’ns, Inc., 750 F.2d 1470, 1474 (9th Cir. 1985)). 10 Next, the Ninth Circuit “conclude[d] that the district court’s determination that the balance 11 of hardships tips sharply in hiQ’s favor [was] not ‘illogical, implausible, or without support in the 12 record,’” because neither LinkedIn nor its users had a strong privacy interest in profile data that 13 was made available to the public. Id. at 994–95. The court noted concerns that even users who 14 made their profiles available for public viewing might not wish for others (such as their 15 employers) to have easy methods of knowing when the users changed information in their 16 profiles, but held that such interests were not particularly strong where nothing prevented 17 employers from monitoring employees’ profiles for changes, and LinkedIn itself offered products 18 that could be used for that sort of monitoring. Id. 19 Turning hiQ’s likelihood of success on the merits, the panel held that hiQ made a sufficient 20 showing of each element of a claim for intentional interference with contract under California law: 21 (1) “a valid contract between plaintiff and a third party,” by showing several contracts with 22 customers that paid for hiQ’s data analytics services; (2) “defendant’s knowledge of this contract,” 23 by showing that hiQ publicly advertised its business model and responded to LinkedIn’s cease- 24 and-desist letter by identifying specific customers; (3) “defendant’s intentional acts designed to 25 induce a breach or disruption of the contractual relationship,” based on LinkedIn’s threats to 26 invoke federal law and technological measures to block hiQ’s access; (4) “actual breach or 27 disruption of the contractual relationship,” by preventing hiQ from accessing the LinkedIn data on 1 could not sell its products. Id. at 996–97 (citation and internal quotation marks omitted). 2 In response to LinkedIn’s assertion of legitimate business purpose as a defense to that 3 claim, the court applied a broad balancing test, based in precedent from California courts, 4 weighing the legitimate interests furthered by the defendant’s conduct against “the importance of 5 the interest interfered with,” looking to factors including harm to competition, good faith, and 6 whether the conduct is a “recognized trade practice.” Id. at 997–98. The court determined that 7 hiQ had a strong interest in honoring its existing contracts, LinkedIn had a “relatively weak” 8 interest in preventing hiQ’s use of public profile data, LinkedIn’s selective blocking of access was 9 not a recognized trade practice, and there was some evidence to suggest that LinkedIn blocked 10 hiQ’s access in order to introduce a new data analytics product that competed with hiQ. Id. The 11 Ninth Circuit therefore agreed with the district court that hiQ had shown serious questions going 12 to the merits of its tortious interference claim. 13 Based on a thorough review of precedent interpreting the CFAA, the Ninth Circuit held 14 that “it appears that the CFAA’s prohibition on accessing a computer ‘without authorization’ is 15 violated when a person circumvents a computer’s generally applicable rules regarding access 16 permissions, such as username and password requirements, to gain access to a computer,” and 17 conversely, that it “is likely that when a computer network generally permits public access to its 18 data, a user’s accessing that publicly available data will not constitute access without authorization 19 under the CFAA.” Id. at 1003. The court concluded that hiQ “raised serious questions about 20 whether LinkedIn may invoke the CFAA” with respect to data from public profiles, and thus 21 found no basis to reverse the preliminary injunction on account of that statute. Id. at 1004. 22 Finally, the Ninth Circuit concluded that although “there are significant public interests on 23 both sides, the district court properly determined that, on balance, the public interest favors hiQ’s 24 position,” because “giving companies like LinkedIn free rein to decide, on any basis, who can 25 collect and use data—data that the companies do not own, that they otherwise make publicly 26 available to viewers, and that the companies themselves collect and use—risks the possible 27 creation of information monopolies that would disserve the public interest.” Id. at 1005. 1 before the Supreme Court. See LinkedIn Corp. v. hiQ Labs, Inc., No. 19-1116 (U.S.). The district 2 court recently granted a motion by LinkedIn to dismiss hiQ’s antitrust claims (but granted leave to 3 amend on “theories of unilateral refusal to deal and the essential facilities doctrine”) and denied 4 the motion as to hiQ’s interference claims, holding that those claims were not barred by the Noerr- 5 Pennington doctrine. See hiQ Labs, Inc. v. LinkedIn Corp., No. 17-cv-03301-EMC, 2020 WL 6 5408210 (N.D. Cal. Sept. 9, 2020). 7 C. Irreparable Harm 8 Monetary injury alone cannot generally establish the irreparable harm necessary to support 9 preliminary injunctive relief, but a “threat of ‘extinction’”—i.e., a party being driven out of 10 business—can meet that standard. HiQ, 938 F.3d at 993 (quoting Am. Passage, 750 F.2d at 1474; 11 and citing L.A. Mem’l Coliseum Comm’n v. Nat’l Football League, 634 F.2d 1197, 1202 (9th Cir. 12 1980)). “[I]ntangible injuries, such as damage to ongoing recruitment efforts and goodwill, 13 qualify as irreparable harm.” Rent-A-Ctr., Inc. v. Canyon Television & Appliance Rental, Inc., 944 14 F.2d 597, 603 (9th Cir. 1991). The Ninth Circuit has held that a district court does not abuse its 15 discretion in finding irreparable harm where damages from such injuries “would be difficult to 16 valuate.” Id. 17 Facebook contends that BrandTotal’s purported evidence of a threat to its ongoing 18 business is conclusory, speculative, and insufficiently precise as to how long BrandTotal could 19 continue to operate without access to data from Facebook’s products. Opp’n at 11. Last year, 20 Chief Judge Hamilton denied a TRO under similar circumstances, holding that a CEO’s 21 declaration that the plaintiffs would “soon reach a tipping point where [they] can no longer 22 operate” was “inherently speculative” because the plaintiffs failed to “offer any indication about 23 their financial strength or the likelihood that they will dissolve as going concerns at any particular 24 point in time.” Stackla, Inc. v. Facebook Inc., No. 19-cv-05849-PJH, 2019 WL 4738288, at *5 25 (N.D. Cal. Sept. 27, 2019).8 Judge Hamilton also noted that the plaintiffs failed to identify 26 8 Facebook cites a press release as evidence that BrandTotal recently raised $12 million in venture 27 capital funding, providing a URL for a PR Newswire website but no evidence in the record. 1 specific customers they had lost or were likely to lose in the absence of relief. Id. She concluded 2 that in the absence of clear evidence of imminent failure of their business, the plaintiffs had not 3 met their burden to obtain a “temporary restraining order, the purpose of which is to address only 4 harms caused by actions likely to occur between the time of its filing and a preliminary injunction 5 hearing.” Id. at *3, *5. 6 BrandTotal’s evidence here is stronger than in Stackla, in that BrandTotal presents 7 communications from specific existing customers expressing concern about Facebook’s 8 allegations, and from specific potential customers suspending or postponing their negotiations 9 with BrandTotal, as well as some information about lost venture capital investment. Leibovich 10 Decl. (dkt. 27-3) ¶¶ 33–35, 39–43, 52–55 & Exs. B–D. 11 Other aspects of the record here are more similar to Stackla. BrandTotal’s CEO Alon 12 Leibovich states that although “BrandTotal has some investment funds in reserve, without the 13 ability to conduct business, BrandTotal will be forced to immediately lay off employees,” and its 14 “inability to raise any new capital will irreparably impact [its] growth trajectory and viability.” Id. 15 ¶ 56. Leibovich concludes that BrandTotal “cannot long survive” without data collected from 16 Facebook using UpVoice. Id. ¶¶ 61–62. 17 Like in Stackla, Leibovich has not addressed any timeline under which BrandTotal would 18 be forced to cease operations. Even assuming for the sake of argument that Liebovich’s 19 declaration might show likely irreparable harm in the absence of relief before trial—itself not 20 entirely clear, absent evidence of how long BrandTotal could survive—the Court cannot say 21 whether expedited relief in the form of a TRO, as opposed to a preliminary injunction considered 22 in the normal course, is necessary to prevent such harm. See Stackla, 2019 WL 4738288, at *3–5; 23 see also AboveGEM, Inc. v. Organo Gold Mgmt., Ltd., No. 19-cv-04789-PJH, 2019 WL 3859012, 24 at *5 (N.D. Cal. Aug. 16, 2019) (denying a TRO where the plaintiff did “not offer any indication 25

26 v. Norton Simon Museum of Art at Pasadena, 592 F.3d 954, 960 (9th Cir. 2009). A press release might warrant different analysis if it is a statement of a party opponent, but in the absence of any 27 evidence in the record regarding this purported press release, the Court cannot determine whether 1 of when it would be driven out of business, or underlying financial information that would 2 demonstrate imminent, irreparable harm” (emphasis added)); Int’l Medcom, Inc. v. S.E. Int’l, Inc., 3 No. 15-cv-03839-HSG, 2015 WL 7753267, at *5 (N.D. Cal. Dec. 2, 2015) (denying a preliminary 4 injunction where the plaintiff failed to show that its “survival [was] a matter of weeks or months”). 5 Even after Facebook raised this issue in its opposition brief, Leibovich’s reply declaration states 6 only that BrandTotal “cannot long survive without a TRO,” and that its board of directors might 7 determine that continued operations are not worthwhile. Leibovich Reply Decl. (dkt. 50-2) ¶ 9. 8 Beyond that speculative statement, there is no evidence that any member of the board has actually 9 resolved to shut down BrandTotal in the absence of relief, much less on any particular schedule. 10 To the extent that Leibovich’s reply declaration addresses BrandTotal’s financial circumstances, 11 he suggests that it currently has sufficient funding to continue operations for perhaps up to a 12 year—or potentially less in light of reductions in revenue and the resources required to litigate this 13 case, but BrandTotal is not at risk of immediately depleting its reserves. Id. ¶ 8. 14 Leibovich states that layoffs would be immediate without relief. Although the Court is 15 aware of no authority specifically holding that layoffs alone constitute irreparable injury sufficient 16 to support a TRO or preliminary injunction, they are comparable to intangible injuries such as 17 harm to recruitment that courts have held sufficient. See, e.g., Regents of Univ. of Cal. v. Am. 18 Broad. Cos., Inc., 747 F.2d 511, 520 (9th Cir. 1984). Without better evidence of BrandTotal’s 19 financial condition, however, it is not clear whether such layoffs would be based on BrandTotal’s 20 business judgment that its available funds are better spend elsewhere while operations are 21 disrupted—and thus merely a choice that BrandTotal might make in response to monetary harm— 22 or if BrandTotal would lack the resources to continue to pay those employees and remain a going 23 concern. In the absence of authority so holding, the Court declines to endorse a rule that any 24 monetary loss that might induce a party to lay off employees constitutes irreparable harm, which 25 would threaten to swallow the rule that monetary damages are not sufficient to support preliminary 26 injunctive relief. See Am. Passage, 750 F.2d at 1473 (holding that a plaintiff failed to show 27 irreparable injury despite losing “a substantial amount of business,” sustaining “large losses,” and 1 While BrandTotal has not shown that it falls within the rule addressing threats of 2 extinction, it has shown massive disruption of its business. According to Leibovich, BrandTotal 3 has lost access to “95% of the data necessary . . . to provide [its] services to [its] customers.” 4 Leibovich Decl. ¶ 37. Leibovich also states that a particular “well renowned market research firm, 5 whom [BrandTotal has] a longstanding business partnership with, has frozen all work.” Id. ¶ 42. 6 Leibovich’s declaration further identifies a number of large potential customers that were in 7 negotiations with BrandTotal but have suspended talks. Id. ¶¶ 39–40. Evidence submitted with 8 BrandTotal’s reply shows that one customer declined to renew its contract on short notice, shortly 9 after Facebook brought its state court action and Google removed UpVoice from its store. 10 Leibovich Reply Decl. Ex. P. 11 The Ninth Circuit has recognized, separately from cases dealing with the potential demise 12 of a business, that “[e]vidence of threatened loss of prospective customers or goodwill certainly 13 supports a finding of the possibility of irreparable harm.” Stuhlbarg Int’l Sales Co. v. John D. 14 Brush & Co., 240 F.3d 832, 841 (9th Cir. 2001). Some district court decisions have nevertheless 15 found such harms insufficient where a value could be placed on the lost relationships. See Int’l 16 Medcom, 2015 WL 7753267, at *5 (citing Telephia Inc. v. Cuppy, No. C 04-03508 SI, 2005 WL 17 588441, at *4 (N.D. Cal. Mar. 11, 2005)). Under the circumstances of this case, where 18 BrandTotal is a small and growing business that has been forced to suspend a major portion of its 19 operations, the Court concludes that the potential harms from “loss of prospective customers or 20 goodwill,” Stuhlbarg Int’l, 240 F.3d at 841, are sufficiently “difficult to valuate,” Rent-A-Ctr., 21 944 F.2d at 603, to establish irreparable harm. 22 Some courts have held that, as a corollary to the rule that a party seeking an injunction 23 must show irreparable harm in the absence of relief—and related to the issue of Article III 24 standing—the moving party must also show that granting relief would prevent such harm. See 25 Sierra Club v. U.S. Dep’t of Energy, 825 F. Supp. 2d 142, 153 (D.D.C. 2011). Facebook argues 26 that even if BrandTotal has shown irreparable harm, it has not shown that the relief it seeks would 27 remedy that harm, because allowing the UpVoice extension on the Chrome Web Store is 1 only removed UpVoice from its Chrome Web Store after Facebook filed its state court action 2 against BrandTotal. See Karve Decl. (dkt. 42) ¶ 14. Facebook alleged in that complaint that it had 3 asked Google multiple times in the preceding month to remove BrandTotal’s browser extensions. 4 See Mehta Decl. (dkt. 40) Ex. 2 (state court complaint) ¶ 56. After initially removing the 5 extension from its store, Google approved the listing of another version of UpVoice on October 6 14, 2020—which BrandTotal’s vice president Oren Dor states was not meant to go live, but only 7 submitted for approval so that BrandTotal could quickly return to service if its TRO were granted, 8 and which BrandTotal changed to “unlisted” when it realized the error more than a day later. Dor 9 Decl. (dkt. 27-2) ¶¶ 24–28.9 Given that Google has already approved that new instance of 10 UpVoice for listing on the Chrome Web Store at least once, it is reasonable to infer that Google 11 would allow it to remain if Facebook withdrew any objection or request for its removal. See Utah 12 v. Evans, 536 U.S. 452, 464 (2002) (holding that a plaintiff has standing where an injunction 13 “would amount to a significant increase in the likelihood that the plaintiff would obtain relief that 14 directly redresses the injury suffered”). 15 Facebook also argues that BrandTotal’s delay of around two weeks in seeking a TRO after 16 Facebook filed its state court complaint and Google removed the UpVoice extension belies any 17 need for emergency belief. Opp’n at 12–13. In light of the complexity of the issues implicated, as 18 well as the parties’ efforts to discuss potential resolutions, the Court does not fault BrandTotal for 19 that delay. 20 BrandTotal’s arguments for irreparable harm are limited to the effects of losing access to 21 data collected from Facebook’s products, which resulted from Google taking down the UpVoice 22 browser extension. See Mot. at 23–24. BrandTotal has not specifically addressed any irreparable 23 harm resulting from Facebook’s removal of BrandTotal’s and its principals’ pages on Facebook. 24 See id.; see also id. at 25 (asking to “reinstate the status quo so that BrandTotal has access to 25 UpVoice user-authorized content”). In the absence of any argument that irreparable harm resulted 26 9 Dor’s declaration does not account for another period when, according to Facebook researcher 27 Sanchit Karve, a version of UpVoice was available on the Chrome Web Store from October 12, 1 from that removal, BrandTotal’s request for an order requiring Facebook to restore those pages is 2 DENIED. See id. at 25; Proposed Order ¶ 1(c).10 The remainder of this order addresses only 3 Facebook’s efforts to block the use of UpVoice, including requesting that Google remove it from 4 the Chrome Web Store, and BrandTotal’s request that it be restored. 5 D. Likelihood of Success 6 Each party argues that it is likely to succeed on each of the claims and counterclaims in the 7 case. The Court focuses on BrandTotal’s counterclaims, as those would be the basis for 8 BrandTotal obtaining affirmative relief in this case, although Facebook’s claims are relevant to the 9 extent that they could serve as affirmative defenses to BrandTotal’s claims. 10 1. BrandTotal’s Counterclaim for Interference with Contract 11 BrandTotal asserts counterclaims for intentional interference with contract, and intentional 12 interference with prospective economic advantage. “‘The elements which a plaintiff must plead to 13 state the cause of action for intentional interference with contractual relations are (1) a valid 14 contract between plaintiff and a third party; (2) defendant’s knowledge of this contract; 15 (3) defendant’s intentional acts designed to induce a breach or disruption of the contractual 16 relationship; (4) actual breach or disruption of the contractual relationship; and (5) resulting 17 damage.’” HiQ, 938 F.3d at 995–96 (quoting Pac. Gas & Elec. Co. v. Bear Stearns & Co., 50 18 Cal. 3d 1118, 1126 (1990)). While the typical case involves actual breach, the element of 19 “disruption” of a contract can also be satisfied “where the plaintiff’s performance has been 20 prevented or rendered more expensive or burdensome.” Id. at 996 n.8 (citation and internal 21 quotation marks omitted). 22 BrandTotal argues that, like in hiQ, it has established a likelihood of success on those 23 elements based on Facebook blocking BrandTotal’s access to the data it would need to fulfill its 24 contracts with existing customers of its advertising analytics product. See Mot. at 18–19. 25 Facebook argues that BrandTotal cannot show knowledge, or actual breach or disruption. Opp’n 26 10 Thus far, BrandTotal also has not specifically addressed or attempted to justify its vice president 27 Dor’s purported creation of accounts using false names, in apparent violation of Facebook’s terms 1 at 13–14. With respect to disruption, Leibovich’s states that BrandTotal can no longer access the 2 data on which it relies for the analysis it contracted to sell to its customers. Leibovich Decl. ¶ 37 3 (stating that due to lack of access, BrandTotal “cannot provide the promised content”). 4 BrandTotal is therefore likely able to show that its “performance has been prevented or rendered 5 more expensive or burdensome.” See hiQ, 938 F.3d at 996 n.8. 6 On the element of knowledge, BrandTotal cites no evidence that Facebook knew of a 7 particular contract with a particular customer. But under California law, “the defendant need not 8 know exactly who is a party to the contract, so long as he knows he is interfering with a 9 contractual relationship.” Altera Corp. v. Clear Logic, Inc., 424 F.3d 1079, 1092 (9th Cir. 2005). 10 As BrandTotal notes, Facebook included the following allegation in its complaint evincing 11 knowledge that BrandTotal sold services based on the data it collected:

12 [BrandTotal] used the data collected by the malicious extensions to sell “marketing intelligence,” and other services through the website 13 brandtotal.com. BrandTotal publicly stated that it used the data obtained through the malicious extensions to provide marketing 14 insights about users and advertisers. Exs. 5 and 11. 15 Compl. ¶ 47; see also Mehta Decl. Ex. 2 (state court complaint) ¶ 45. Exhibit 5 to Facebook’s 16 complaint is a screenshot of BrandTotal’s website, which includes the statement that “[m]any of 17 the most recognizable consumer brands use our competitive marketing intelligence platform to 18 discover marketing threats and opportunities in real time.” Compl. Ex. 5; see also Mehta Decl. 19 Ex. 2 (state court complaint, which includes the same exhibit). BrandTotal is therefore likely to 20 succeed in showing that Facebook knew BrandTotal had entered contracts where its performance 21 depended on the data it collected. 22 The more significant issue with respect to this claim is Facebook’s argument that it acted 23 with a “legitimate business purpose,” which can serve as a defense to interference. See Mot. at 14. 24 “Under California law, a legitimate business purpose can indeed justify interference with contract, 25 but not just any such purpose suffices.” HiQ, 938 F.3d at 997. Courts must determine whether the 26 defendant’s interest outweighs societal interests in stability of contracts (the defendant’s mere 27 pursuit of economic advantage generally does not), “whether the means of interference involve no 1 competition,” and—most importantly—“whether the business interest is pretextual or asserted in 2 good faith.” Id. (citations and internal quotation marks omitted). 3 BrandTotal raises serious questions as to this defense for largely the same reasons 4 addressed in hiQ. Facebook’s data policy suggests that it sells marketing intelligence services 5 potentially in competition with BrandTotal’s product. See Telscher Decl. Ex. H (data policy); 6 Mot. at 16 (quoting provisions of the policy indicating that, among other things, Facebook 7 “provide[s] advertisers with reports about the kinds of people seeing their ads” and “share[s] 8 information about [users] with companies that aggregate it to provide analytics and measurement 9 reports to [Facebook’s] partners”). To the extent that Facebook’s efforts to restrict BrandTotal’s 10 access might be motivated to stifle competition, it would raise some of the same concerns as in 11 hiQ, where the Ninth Circuit determined that for companies “whose servers hold vast amounts of 12 public data” to “selectively . . . ban only potential competitors from accessing and using that 13 otherwise public data” . . . “may well be considered unfair competition under California law.” 14 HiQ, 938 F.3d at 998. This case differs in that some of the information at issue is not “public,” 15 but BrandTotal is likely correct that the advertisements themselves are essentially public, see 16 Compl. ¶¶ 17–19 (Facebook’s allegations discussing its public library of all ads on its services), 17 that the users who consent to use BrandTotal’s browser extension have the most significant 18 interest in the data in their own profiles,11 and that Facebook has not articulated a significant 19 privacy or intellectual property interest in any data outside of those categories, such as the 20 “advertising interests” that Facebook generates for (and shares with) its users, and the metrics of 21 engagement (likes, comments, etc.) on particular advertisements. So long as BrandTotal’s 22 browser extension works as intended and represented, it threatens interests at most only 23

24 11 Despite the CCPA’s general purpose of granting consumers greater control over how their personal information is used, BrandTotal has not cited any provision of that statute that 25 specifically requires Facebook to provide the sort of access at issue here. See Mot. at 12–13 (addressing provisions of the statute defining “personal information,” providing that companies 26 may compensate users for their personal information, and providing that any contract purporting to waive a right under the statute is unenforceable). The fact that the statute allows companies to 27 provide financial compensation to consumers for collection of their personal information, Cal. 1 marginally greater than those the Ninth Circuit found “relatively weak” in hiQ. See 938 F.3d at 2 998. 3 On the other hand, Facebook’s general interest in policing access to the password- 4 protected portions of its networks is far greater than LinkedIn’s interest in restricting access to 5 otherwise public pages in hiQ. See Stackla, 2019 WL 4738288, at *6 (concluding that 6 “Facebook’s ability to decisively police the integrity of its platforms is without question a pressing 7 public interest”); cf. hiQ, 938 F.3d at 992 (rejecting an argument that the plaintiff could collect 8 suitable data from sources other than LinkedIn, because “Facebook data, by contrast, is not 9 generally accessible”). Users on Facebook’s networks choose share information with specific 10 people, and could reasonably be expected to rely on Facebook’s privacy settings and terms of use 11 to prevent automated collection of that information by third parties. See, e.g., Clark Decl. (dkt. 12 41) ¶¶ 5(b)–(d). 13 Facebook is bound by an order from an FTC enforcement action requiring it to enforce its 14 terms of use against third parties that have access to users’ information. Clark Decl. Ex. 1. 15 Among other things, the FTC order requires Facebook to take the following measures:

16 Specifically with respect to any Covered Third Party that obtains or otherwise has access to Covered Information from Respondent for use 17 in an independent, third-party consumer application or website, such safeguards shall include: 18 a. Requiring an annual self-certification by each Covered Third Party 19 that certifies: (i) its compliance with each of Respondent’s Platform Terms; and (ii) the purpose(s) or use(s) for each type of Covered 20 Information to which it requests or continues to have access, and that each specified purpose or use complies with Respondent’s Platform 21 Terms;

22 b. Denying or terminating access to any type of Covered Information that the Covered Third Party fails to certify pursuant to Part 23 VII.E.1.a.(ii) above, or, if the Covered Third Party fails to complete the annual self-certification, denying or terminating access to all 24 Covered Information unless the Covered Third Party cures such failure within a reasonable time, not to exceed thirty (30) days; 25 c. Monitoring Covered Third Party compliance with Respondent’s 26 Platform Terms through measures including, but not limited to, ongoing manual reviews and automated scans, and regular 27 assessments, audits, or other technical and operational testing at least d. Enforcing against any Covered Third Party violations of 1 Respondent’s Platform Terms based solely on the severity, nature, and impact of the violation; the Covered Third Party’s malicious 2 conduct or history of violations; and applicable law; 3 Id. at 9. For the purpose of that order, “Covered Third Party” is defined as:

4 any individual or entity that uses or receives Covered Information obtained by or on behalf of Respondent outside of a User-initiated 5 transfer of Covered Information as part of a data portability protocol or standard, other than: 6 (1) a service provider of Respondent that (i) uses the Covered 7 Information for and at the direction of Respondent and no other individual or entity and for no other purpose; and (ii) does not disclose 8 the Covered Information, or any individually identifiable information derived from such Covered Information, except for, and at the 9 direction of, Respondent, for the purpose of providing services requested by a User and for no other purpose; or 10 (2) any entity that uses the Covered Information only as reasonably 11 necessary: (i) to comply with applicable law, regulation, or legal process, or (ii) to enforce Respondent’s terms of use, or (iii) to detect, 12 prevent, or mitigate fraud or security vulnerabilities. 13 Id. at 3, ¶ E (line breaks added). 14 As BrandTotal tentatively agreed at the hearing, see Hearing Tr. (dkt. 57) at 8:19–9:1, it 15 appears to meet that definition, and there is no evidence that it has certified compliance as required 16 under the FTC’s order. Facebook therefore had a legitimate business interest—i.e., complying 17 with its legal obligations—in preventing BrandTotal’s access. Facebook also believes that it was 18 required to report BrandTotal’s access to the FTC as a “scraping incident,” and its Director of 19 Product Management states in a declaration that Facebook will submit such a report. Clark Decl. 20 ¶ 12. Clark is unaware of any request from BrandTotal to access Facebook’s data with 21 Facebook’s permission. Id. ¶ 14. 22 Facebook’s interest in securing its platform to comply with legal obligations and protect 23 users’ privacy is further supported by evidence that BrandTotal’s products have posed risks to 24 privacy. According to a third party report addressing a number of BrandTotal products other than 25 UpVoice, which Facebook researcher Sanchit Karve reviewed while investigating BrandTotal’s 26 products, the technique that BrandTotal used to anonymize user’s profile ID numbers (which 27 could be used to link the collected data to a particular user) was “very weak” and “could be 1 personnel determined that another BrandTotal product, “Anonymous Story Viewer for Instagram,” 2 collected a wide range of data and transmitted it to a third-party server in plain text, without 3 anonymization. Id. ¶ 22. That product also collected and transmitted the user’s “session token” 4 and “session ID,” which a third party could use to access Instagram as if they were the user. Id. 5 ¶ 23. Although those issues do not specifically pertain to the UpVoice product, Facebook’s 6 perception that BrandTotal had a history of collecting user data in ways that posed risks to security 7 and privacy supports a legitimate business interest in policing BrandTotal’s access to Facebook’s 8 platforms. 9 As for UpVoice specifically, while users of that extension generally consented to sharing 10 their own demographic information with BrandTotal, the extension could collect information from 11 other users who did not know of or consent to that collection if it was installed on a shared 12 computer. See Clark Decl. ¶ 5(c). Despite Facebook raising that concern in its opposition brief, 13 Opp’n at 6, BrandTotal does not address the issue in its reply.12 Facebook’s Director of Product 14 Management also states in his declaration that Facebook has a practice of “enforce[ing] its anti- 15 scraping policies regardless of who is doing it or how they are using the scraped information,” 16 because “it can be difficult to determine whether scraping is engaged in for benign or malicious 17 purposes.” Id. ¶ 9. 18 The Court concludes that Facebook likely has at least some degree of legitimate business 19 interest in safeguarding user privacy and security by preventing unapproved programs from 20 automatically collecting data after users have logged into Facebook’s social networks, in order to 21 comply with its obligations under the FTC order, avoid other potential liability for data breaches, 22 and maintain public confidence in its products. See Clark Decl. ¶¶ 5(a), 11–12. That interest 23 supports requiring companies like BrandTotal who seek to collect such data to coordinate with 24 Facebook and obtain approval, even when those companies have no malicious intent and have 25 endeavored to protect users’ privacy and obtain their consent. Facebook provides application 26 12 At the hearing, BrandTotal’s attorney did not dispute that UpVoice could capture information 27 from non-consenting users of shared computers, but asserted that BrandTotal is “not aware of this 1 programming interfaces (“APIs”) and other “approved means” for users to share their data with 2 third parties. Clark Decl. ¶ 4. The record indicates that, thus far, BrandTotal has not requested 3 access through those means. Id. ¶ 14. 4 “‘Whether an intentional interference by a third party is justifiable depends upon a 5 balancing of the importance, social and private, of the objective advanced by the interference 6 against the importance of the interest interfered with, considering all circumstances including the 7 nature of the actor’s conduct and the relationship between the parties.’” HiQ, 938 F.3d at 997 8 (quoting Herron v. State Farm Mut. Ins. Co., 56 Cal. 2d 202, 206 (1961)). To the extent that 9 Facebook’s denial of access to BrandTotal was based on BrandTotal’s failure to coordinate with 10 Facebook and seek approval through established channels, and on Facebook’s perception that 11 BrandTotal had a history of collecting user data in irresponsible ways, the balance tips in favor of 12 allowing Facebook to enforce its prohibition against unapproved automated access. On the other 13 hand, to the extent that Facebook might have been motivated by a desire to prevent BrandTotal 14 from competing against Facebook in the market for advertising analytics, the balance would favor 15 granting relief in order to foster competition and innovation, and allow BrandTotal to honor its 16 contracts with its customers. See hiQ, 938 F.3d at 997–98. The apparent failure of either party to 17 initiate dialog as to how BrandTotal might obtain approval from Facebook to conduct that 18 business leaves an open question of Facebook’s intent, and whether Facebook would approve 19 access by BrandTotal if it worked within Facebook’s protocols for authorizing access. The Court 20 concludes that BrandTotal has raised serious questions as to the merits of this claim, but on the 21 current record, it has not established a likelihood of success.13 22 13 Facebook also argues that any potential interference with BrandTotal’s contracts had a 23 legitimate business purpose because “Facebook was entirely justified in incidentally interfering with a contract that threatened ‘a prior contract of [its] own.’” Opp’n at 14 (quoting Richardson v. 24 La Rancherita, 98 Cal. App. 3d 73, 81 (1979)) (alteration in original). As discussed below in the context of BrandTotal’s claim for declaratory judgment, the UpVoice extension very likely 25 breached Facebook’s terms of use. Facebook’s interest in enforcing its own terms reinforces the conclusion that BrandTotal has not shown a likelihood of success. Richardson recognized, 26 however, that even where a defendant seeks to enforce its own contract, the “determinative question” is the defendant’s good faith. 98 Cal. App. 3d at 81. BrandTotal has also raised real 27 issues of the extent to which Facebook can enforce its terms of use in a manner that stifles 1 2. BrandTotal’s Counterclaim for Interference with Advantage 2 The parties do not draw any significant distinctions between BrandTotal’s claims for 3 intentional interference with contract and intentional interference with prospective economic 4 advantage, except that the latter claim requires showing “‘an independently wrongful act.’” Mot. 5 at 18 (quoting Reeves v. Hanlon, 33 Cal. 4th 1140, 1145 (2004)); see Opp’n at 13–15 (addressing 6 these claims together); Reply at 13 (same). The Court concludes that, for the reasons discussed 7 above in the context of interference with contract, BrandTotal has shown at most serious issues 8 going to the merits of its claim for interference with advantage. 9 3. BrandTotal’s Counterclaim for Unfair Competition 10 California’s UCL broadly prohibits unlawful, unfair, and fraudulent business acts. Kor. 11 Supply Co. v. Lockheed Martin Corp., 29 Cal.4th 1134, 1143 (2003). “Unlawful acts are anything 12 that can properly be called a business practice and that at the same time is forbidden by law . . . be 13 it civil, criminal, federal, state, or municipal, statutory, regulatory, or court-made, where court- 14 made law is, for example a violation of a prior court order.” Sybersound Records, Inc. v. UAV 15 Corp., 517 F.3d 1137, 1151 (9th Cir. 2008) (ellipsis in original) (citations and internal quotation 16 marks omitted). “Unfair acts among competitors means ‘conduct that threatens an incipient 17 violation of an antitrust law, or violates the spirit or policy of those laws because its effects are 18 comparable to or the same as a violation of the law, or otherwise significantly threatens or harms 19 competition.’” Id. at 1152 (quoting Cel-Tech Commc’ns, Inc. v. L.A. Cellular Tel. Co., 20 Cal. 4th 20 163, 187 (1999)). “Finally, fraudulent acts are ones where members of the public are likely to be 21 deceived.” Id. 22 With respect to the “unlawful” prong, BrandTotal rests this claim on its intentional 23 interference with contract claim discussed above. BrandTotal has shown serious issues going to 24 the merits of that claim, but not a likelihood of success. With respect to the “unfair” prong, 25 BrandTotal has again shown no more than serious issues, because although Facebook’s 26 enforcement efforts could be seen as intended to block a potential competitor from the market for 27 advertising analytics, Facebook has significant countervailing interests in enforcing its terms of 1 services. 2 BrandTotal argues that Facebook blocking its access is “fraudulent” because, according to 3 BrandTotal, Facebook’s terms of service recognize that users retain ownership of their own data. 4 Mot. at 22–23; Reply at 14. Assuming for the sake of argument that BrandTotal’s characterization 5 of the terms of service is accurate, restricting the means that users may engage in to extract that 6 data from Facebook’s servers does not clearly conflict with recognizing ownership of the data. 7 Facebook’s clear prohibition of automated means without permission also tends to negate any 8 potential reliance on broad statements of user ownership as suggesting the contrary, that 9 automated means could be used without permission. BrandTotal has shown at most serious issues 10 going to this claim, not a likelihood of success. 11 4. BrandTotal’s Counterclaim for Declaratory Judgment 12 BrandTotal seeks declaratory judgment that it has not breached Facebook’s terms of 13 service because its process of obtaining data is not “automated,” its access has never been 14 “unlawful, misleading, or fraudulent,” and it has not “impaired the proper working appearance or 15 the intended operation of any Facebook product.” Counterclaim ¶¶ 64–73. Although BrandTotal 16 has argued in the context of other claims that Facebook’s terms of service are unenforceable, this 17 counterclaim does not seek such a declaration. See id. 18 BrandTotal’s position that its access is not “automated” defies any reasonable meaning of 19 that term. BrandTotal suggests that an earlier version of the terms of service suggests a narrower 20 meaning of the term by including the parenthetical “(such as harvesting bots, robots, spiders, or 21 scrapers)” after the term “automated means.” Mot. at 10 (quoting Telscher Decl. Ex. I). 22 Regardless of whether BrandTotal’s product would fall outside of those examples—which is not 23 clear on the current record—BrandTotal is not accused of breaching the 2017 terms; it is accused 24 of breaching the current terms, which do not include the parenthetical at issue and instead refer 25 only to “automated means.” See Compl. ¶ 26; Duffey Decl. (dkt. 43) Ex. 1 § 3.2.3 (“You may not 26 access or collect data from our Products using automated means (without our prior permission) 27 1 . . . .”).14 After users install the UpVoice browser extension, it automatically collects data while 2 the users browse the Facebook Network and certain other websites, including not only information 3 that users see on their screens, but also information that the browser extension itself automatically 4 requests from the website. See Dor Decl. ¶¶ 14–20; Karve Decl. ¶ 17 (addressing the particular 5 categories of information that UpVoice automatically collected as a user browsed the Facebook 6 Network). BrandTotal also collects data regarding the “number of likes, shares, and comments” 7 on advertisements “separate from [its] panelist [i.e., user] collection,” belying the implication in 8 BrandTotal’s briefs that all data collection derives from user activity. Dor Decl. ¶ 21 (emphasis 9 added); cf., e.g., Mot. at 10 (“If these deliberate steps [by users] are not taken, no information is 10 collected.”). The fact that BrandTotal does not attempt to “survey[] Facebook’s entire site” does 11 not make its access any less automated. Cf. Mot. at 10. 12 BrandTotal asserts that any practical method of collecting data from Facebook’s products 13 requires “some degree of automation,” thus conceding “some degree of automation” in its own 14 products that perform that service. See id. at 11. There might be edge cases where it would be 15 difficult to determine if a particular method of accessing an inherently technological product like 16 the Facebook Network was “automated”—for example, a user recording video of their screen 17 while browsing the website. This is not such a case. BrandTotal designed a computer program to 18 systematically identify, capture, and transmit certain types of data from Facebook’s products 19 without user intervention. Because BrandTotal used “automated means” to access and collect data 20 from Facebook’s website without obtaining Facebook’s permission as required by the terms of 21 service, the Court concludes that BrandTotal has not shown a likelihood of success, or even 22 serious issues, on its claim for declaratory judgment that it did not breach those terms. Because 23 the record tends to suggest that BrandTotal breached at least the provision regarding automated 24 access, the Court does not reach the parties’ arguments as to other contract terms at issue. 25 To the extent BrandTotal’s declaratory judgment counterclaim could be construed as 26 14 Some of the exhibits to Michael Duffey’s declaration compress what should be many pages of 27 text to a single column on a single letter-sized page. Those exhibits would be unusable in hard 1 seeking a declaration that Facebook’s terms of service are unenforceable as against public policy, 2 BrandTotal has not shown a likelihood of success because, as discussed above in the context of 3 Facebook’s “legitimate business purpose” defense to BrandTotal’s intentional interference claim, 4 a significant public policy supports allowing Facebook to police automated access to its password- 5 protected platforms. BrandTotal has therefore shown at most significant issues going to whether 6 Facebook’s terms are enforceable, which does not add to the analysis of the present motion 7 beyond the significant issues BrandTotal has shown for intentional interference. 8 E. Balance of Equities 9 The balance of equities requires a court to consider “the interests of all parties and weigh 10 the damage to each.” CTIA - The Wireless Ass’n v. City of Berkeley, 928 F.3d 832, 852 (9th Cir. 11 2019) (citation and internal quotation marks omitted). 12 Facebook has legitimate interests in maintaining public confidence in its products and 13 avoiding potential liability for data privacy breaches. Ordering Facebook to allow access by 14 BrandTotal, without BrandTotal completing Facebook’s usual vetting process and using the 15 standard APIs for obtaining users’ permission to access their personal data, risks some degree of 16 harm to public confidence in Facebook’s data protection. As for potential liability for a breach, 17 the current record does not indicate major vulnerabilities that would result from the UpVoice 18 product specifically—except perhaps as to the users who have installed UpVoice, and others who 19 might share their computers—and Facebook is unlikely to face liability for complying with an 20 order of this Court requiring it to grant access. The Court also notes that Facebook has endured 21 unauthorized access by BrandTotal for some time, including the several-month period since it 22 began its investigation of BrandTotal in April of this year, without suffering any significant harm 23 that it has identified in the current record.15 Nevertheless, the potential harm to Facebook’s 24 reputation that could result from granting BrandTotal’s motion—and ordering Facebook to 25 tolerate automated data collection from password-protected portions of its network, by a third 26 15 As perhaps a countervailing consideration to any harm it might suffer, Facebook could stand to 27 benefit if BrandTotal’s products incentive users to frequently interact with Facebook’s networks, 1 party Facebook has not vetted and approved—is serious. 2 On the other hand, BrandTotal is not able to operate its business while it lacks access to 3 Facebook’s products. As discussed above in the context of irreparable injury, BrandTotal is losing 4 customers, faces new difficulty attracting investment, and is at risk of eventually shutting down. 5 Weighing the potential harm to only the parties to this case,16 BrandTotal faces far greater 6 consequences from the denial of a TRO than Facebook would suffer if the TRO were granted and 7 BrandTotal’s access restored pending the conclusion of litigation. The balance of equities 8 therefore tips in favor of BrandTotal. The Court assumes for the sake of argument that it tips 9 “sharply.” 10 F. Public Interest 11 “‘The public interest inquiry primarily addresses impact on non-parties rather than 12 parties,’” and “embodies the Supreme Court’s direction that ‘in exercising their sound discretion, 13 courts of equity should pay particular regard for the public consequences in employing the 14 extraordinary remedy of injunction.’” Bernhardt v. Los Angeles Cty., 339 F.3d 920, 931–32 (9th 15 Cir. 2003) (quoting Weinberger v. Romero-Barcelo, 456 U.S. 305, 312 (1982)). The public 16 interest in this case requires a balancing of the interests addressed by the Ninth Circuit in hiQ, 17 favoring open access to information and competition for data analytics services, and those 18 identified by Judge Hamilton in Stackla, favoring proactive data and privacy protection by 19 companies like Facebook. On balance, the Court is not persuaded that the public interest favors 20 the relief that BrandTotal seeks, requiring Facebook to provide immediate access to an automated 21 data collection program that Facebook has not vetted. 22 Addressing similar issues in Stackla, Judge Hamilton held as follows:

23 Awarding injunctive relief at this stage would compel Facebook to permit a suspected abuser of its platform and its users’ privacy to 24 continue to access its platform and users’ data for weeks longer, until a preliminary injunction motion could be resolved. Moreover, as 25 precedent within Facebook’s policy-setting organization and potentially with other courts, issuing an injunction at this stage could 26

27 16 Public interest—including, here, the interests of individual Facebook and BrandTotal users, who handicap Facebook’s ability to decisively police its social-media 1 platforms in the first instance. Facebook’s enforcement activities would be compromised if judicial review were expected to precede 2 rather than follow its enforcement actions.

3 Although the public certainly has some interest in avoiding the dissolution of companies and the accompanying loss of employment, 4 Facebook’s ability to decisively police the integrity of its platforms is without question a pressing public interest. In particular, the public 5 has a strong interest in the integrity of Facebook’s platforms, Facebook’s policing of those platforms for abuses, and Facebook's 6 protection of its users’ privacy. Congress’s ample attention to such abuse is more than enough to demonstrate the importance of those 7 interests to the public, as are Facebook’s recent interactions with the FTC. . . . 8 9 Stackla, 2019 WL 4738288, at *6.17 As Judge Hamilton noted, Facebook’s FTC violation 10 stemmed from allegations of “‘[1] maintaining deceptive settings that misled users about how to 11 protect their information from being shared by Facebook with third-party developers of apps . . . 12 [2] promising to stop giving app developers access to the data of app users’ Friends starting in 13 2014, when in fact many app developers continued to have such access past that date . . . [and 3] 14 inconsistently enforcing its privacy policies against app developers who violated those policies.’” 15 Id. (quoting United States v. Facebook, Inc., No. 19-cv-02184-TJK, ECF Doc. No. 4 (D.D.C. July 16 25, 2019)) (alterations in original). 17 BrandTotal’s access to Facebook users’ data circumvents Facebook’s privacy settings. 18 Although users separately consent to sharing most if not all of the data at issue when they install 19 the UpVoice browser extension, BrandTotal’s method of operating outside of Facebook’s platform 20 and APIs means that users who later review their Facebook privacy settings will not see 21 BrandTotal among the third parties with whom they have agreed to share information, and any 22 subsequent changes that users make to their Facebook privacy settings will not limit the 23 information that is shared with BrandTotal. Such circumstances could render Facebook’s privacy 24 settings “deceptive” and create risk of users being “misled”—some of the concerns that spurred 25 17 Another decision from this district, on a motion for default judgment, recently granted Facebook 26 a permanent injunction forbidding access by defendants accused of scraping user data from Facebook using browser extensions, citing Stackla’s analysis of Facebook’s interest in securing its 27 platform. Facebook, Inc. v. Sluchevsky, No. 19-cv-01277-JSC, 2020 WL 5823277, at *9 (N.D. 1 the FTC’s enforcement action.18 Moreover, requiring Facebook to set aside in this instance its 2 normal requirement that third parties seek and obtain Facebook’s permission before collecting data 3 using automated means would mandate the sort of inconsistent enforcement of Facebook’s 4 policies that also concerned the FTC. 5 When it comes to advertising data—as opposed to user data—there are significant 6 countervailing concerns. As the Ninth Circuit noted in hiQ, “giving [social networking] 7 companies . . . free rein to decide, on any basis, who can collect and use data—data that the 8 companies do not own, that they otherwise make publicly available to viewers, and that the 9 companies themselves collect and use—risks the possible creation of information monopolies that 10 would disserve the public interest.” HiQ, 938 F.3d at 1005. Facebook does not own the contents 11 of advertisements placed on its networks, and already makes all such ads available for public 12 viewing. See Compl. ¶ 17. While Facebook notes that its advertisers maintain intellectual 13 property rights to the content of their ads, it has not suggested that BrandTotal’s use of that 14 content is anything but fair use. Facebook also has not suggested that it “owns” the related 15 information that BrandTotal collects about advertisements, such as the number of likes and 16 comments, or which users are presented with a given ad. Allowing a third party like BrandTotal 17 to compete with Facebook to provide data analytics services about advertising campaigns on 18 Facebook’s networks—advertising for which Facebook is already compensated by the 19 advertisers—would be consistent with a strong public interest in “maximizing the free flow of 20 information on the Internet” and fostering competition and innovation. See hiQ, 938 F.3d at 1004. 21 On balance, however, the Court is not satisfied that those interests wholly prevent Facebook from 22 vetting or regulating third parties that seek to automatically collect large quantities of user data 23 from nonpublic portions of Facebook’s networks. 24 18 UpVoice’s apparent ability to collect data from other users of shared computers who have not 25 themselves consented to sharing data with BrandTotal raises even greater concerns about deception. BrandTotal argued at the hearing that such collection is “innocuous” because it 26 includes only “deidentified demographic information,” Hearing Tr. at 24:22–25:8, but the fact remains that Facebook users have at least some interest in preventing the surreptitious collection 27 of personal information that, using Facebook’s privacy settings, they may have chosen to share 1 Expedited judicial proceedings are not an efficient mechanism to adjudicate in the first 2 instance potential data privacy risks from products that automatically collect Facebook users’ data. 3 The record suggests that BrandTotal has operated, at least for the most part, in good faith, and 4 likely poses no greater risk than described above, but courts generally lack the technical expertise 5 to evaluate such risks on a blank slate. And if Facebook could not take steps to block access by 6 third party developers unless it first builds a strong case of actual harm to its users—without the 7 benefit of the developer working with Facebook to explain its product’s operation and 8 safeguards—malicious actors would likely enjoy longer periods of access to users’ data before 9 facing any enforcement. Requiring a company seeking such access to coordinate with Facebook 10 and address potential concerns before obtaining access ensures that, if such a company believes 11 Facebook’s denial of access is impermissible, a court evaluating such a claim will benefit from a 12 fuller evidentiary record, presented by parties who understand each other’s products and positions. 13 Under the circumstances of this case, where BrandTotal built its business on ignoring 14 Facebook’s prohibition on automated access without permission, created separate architecture to 15 collect users’ Facebook profile data in ways not reflected in those users’ Facebook privacy 16 settings, and now requests an immediate order preventing Facebook from taking any steps to limit 17 its access despite an FTC order requiring Facebook to enforce its terms of use and police such 18 access, the Court concludes that the public interest requires denying the extraordinary relief 19 BrandTotal seeks. 20 IV. CONCLUSION 21 BrandTotal has shown a risk of irreparable harm in the absence of relief, serious issues 22 going to the merits of its claims, and a balance of hardships that tips in its favor, perhaps sharply 23 so. The public interest, however, weighs against granting the relief that BrandTotal seeks.19 24 / / / 25

26 19 Because the Court denies BrandTotal’s motion based on public interest, the Court does not reach Facebook’s argument that the order BrandTotal seeks—compelling Facebook to “take other 27 reasonable actions in communication with Google” to ensure reinstatement of the UpVoice ] BrandTotal’s motion for a TRO is therefore DENIED. 2 IT IS SO ORDERED. 3 Dated: November 2, 2020 4 CZ J PH C. SPERO 5 ief Magistrate Judge 6 7 8 9 10 11

«4 © 15

A 16

Zz 18 19 20 21 22 23 24 25 26 27 28