By Nicholas Iovino

SAN FRANCISCO – A federal judge in California must consider whether personal information is a form of currency and determine whether to advance a class action over a massive Facebook data breach.

Fighting litigation over a September 2018 hack that affected 29 million users, Facebook argues a liability-limiting clause in its terms of service is particularly strong and enforceable for a company that provides a free service, as the Ninth Circuit held last year in Darnaa LLC v. Google.

But five named plaintiffs say they pay for access to Facebook’s social network in the form of valuable personal data, which the company uses for targeted advertising and sells to third parties to make more than $40 billion in 2017 alone.

“Is it a cost to the consumer that they hand over all this personal information which is used by Facebook to sell to other people?” U.S. District Judge William Alsup asked in court Thursday.

Last year, hackers managed to infiltrate millions of Facebook accounts by exploiting a vulnerability in its “View As” feature for user profiles. Facebook initially said the breach affected 50 million users but has since downgraded that estimate to 29 million users, including 4 million in the U.S.

Hackers swiped the names and contact information – such as phone numbers or email addresses – of 2.7 million U.S. users, and infiltrated the profiles of an additional 1.2 million U.S. users, gaining access to usernames, birthdates, workplaces, hometowns, schools attended and other personal information, including places where they recently “checked in” or were “tagged.”

In a hearing Thursday at the U.S. District Court for the Northern District of California, lawyers for a proposed class of hacked Facebook users urged Alsup to take a long, hard look at the social network’s business model as he decides whether the service is actually free of charge.

“The notion that this is a free service is a little outdated,” plaintiffs’ attorney Douglas McNamara said. “The currency is your information.”

McNamara, of Cohen Milstein Sellers Toll in New York, insisted that Facebook’s limitation-of-liability clause should be deemed “unconscionable” and “unenforceable” because it directly contradicts pledges the company has made about protecting user privacy.

Quoting the “Privacy Principles” posted on Facebook’s website, McNamara cited representations that the company “work[s] hard to keep your information secure” and is “accountable.”

Alsup did not seem particularly persuaded that such comments can be interpreted as promises to protect private user data.

“It says, ‘We work hard to keep your information secure,’” Alsup said. “That’s not quite the same as saying, ‘We guarantee it will always be secure.’”

After pressing both sides to identify an “on-point” court ruling on whether personal information can count as a “cost” of service, Alsup concluded he is in uncharted territory.

The judge asked Facebook’s legal team to explain why there should not be “bone-crushing discovery” to determine how valuable Facebook users’ information is and whether its social network can truly be considered a “free service.”

Facebook lawyer Andrew Clubok, of Latham & Watkins in Washington, D.C., insisted that courts have not recognized the type of information taken in the 2018 data breach as particularly valuable. He further argued that users voluntarily add that data to their profiles. The only information required to open an account is a name, birth date, gender and phone number or email address.

Given the nature of the online social network, Aslup did not put much weight on the fact that users volunteer to post personal information there.

“What’s the point of opening account other than sharing private information?” Alsup asked.

The judge also acknowledged his own personal discomfort with the Menlo Park-based company’s business model.

“For me, I would not like the places I like going on vacation being spread across the country so people can send me ads about it,” Alsup said.

After 90 minutes of debate, Alsup took the arguments under submission.

He also ordered plaintiffs’ lawyers to make their five clients available for depositions by May 10, and he asked Facebook to file supplemental briefs on any evidence uncovered in those interviews.

Started in 2004 by Harvard dropout Mark Zuckerberg, Facebook remains the world’s largest online social network with 1.56 billion daily active users and nearly 2.4 billion monthly active users as of March 31, 2019.