Ius Omnibus v Meta (≥13)

What is the object of this action?

This is a class action for the protection of consumer relations, privacy and the protection of personal data, the protection of the free development of personality, the defence of the moral, psychological and physical integrity and health of consumers, and the homogeneous individual interests of consumers, brought by Ius Omnibus.

This is a class action brought to defend consumer rights under Articles 52(3) and 60(3) of the Constitution of the Portuguese Republic, Articles 2, 5, 6 and 12 of the Collective Action Act (Decree-Law 114-A/2023 of 5 December), and Articles 31 and 546(2) of the Portuguese Code of Civil Procedure.

What unlawful conduct by Meta is at stake in this lawsuit?

At issue is the adoption of a set of misleading commercial practices, the violation of privacy and the improper processing of the personal data of users of the Facebook service, resident in Portugal, who, after 1 April 2010, and who, on their first use of the Facebook service or at a later date, were at least 13 (thirteen) years of age.

Also at issue is the adoption of a set of misleading commercial practices, the violation of privacy and the improper processing of the personal data of users of the Instagram service, resident in Portugal, who, after 25 May 2018, and who, on their first use of the Instagram service or at a later date, were at least 13 (thirteen) years of age.

With regard to the provision of its Facebook services since 1 April 2010 and Instagram services since 25 May 2018, Meta processes the personal data of Facebook and Instagram users residing in Portugal who are at least 13 (thirteen) years of age without obtaining their consent, without a contractual necessity and without a proportionate legitimate interest, in accordance with lawful purposes.

Meta collects and processes sensitive personal data of Facebook and Instagram users residing in Portugal who are at least 13 (thirteen) years of age without their explicit consent and without any other valid legal basis for the processing of personal data. The processing of personal data of Facebook and Instagram users carried out by Meta is intrusive.

Meta does not process the personal data of Facebook and Instagram users aged 13 (thirteen) or over, residing in Portugal, in accordance with personal data protection rules, including under conditions that ensure the adequate protection of personal data against unauthorised or unlawful processing.

Until 9 July 2023, Meta transferred the personal data of Facebook and Instagram users aged 13 or over, resident in Portugal, to the US, without a valid legal basis and without adopting adequate safeguards to ensure that the personal data of these users enjoyed the same level of protection as in the EU, thereby subjecting these users and their personal data to unauthorised surveillance by US public authorities.

Meta employs terms and conditions that are difficult to understand, failing to provide adequate and sufficient clarification regarding the amount and scope of the personal data of Facebook and Instagram users aged 13 or over that it collects and processes, including the processing of their personal data for the purposes of personalised advertising and for the creation and development of artificial intelligence models, and disseminates false and misleading information about its Facebook and Instagram services, exploiting the information asymmetry in relation to its users.

Meta has placed and continues to place cookies and other tracking technologies on the devices used by Facebook and Instagram users aged 13 (thirteen) or over, resident in Portugal, without obtaining their consent, and without many of these cookies and/or other tracking technologies being strictly necessary for the provision of Facebook and Instagram services.

Through these practices, Meta exposes and creates risks of compromising the privacy of consumers aged 13 (thirteen) or over, subjecting them to excessive surveillance, used to significantly influence their decisions and behaviour, manipulating their digital and non-digital conduct, and restricting the ability of Facebook and Instagram users to make free and independent decisions.

Who is represented in this action?

This class action represents all consumers resident in Portugal who, on or after 1 April 2010, upon their first use of the Facebook service or at a later date, were aged 13 (thirteen) years or older. They will only be represented in this action in respect of the period during which were users of the Facebook service aged 13 (thirteen) years or older.

Also represented in this class action are all consumers residing in Portugal who, on or after 25 May 2018, on their first use of the Instagram service or at a later date, were aged 13 (thirteen) years or older. They will only be represented in this action in respect of the period during which they were users of the Instagram service aged 13 (thirteen) years or older.

Consumers do not need to do anything to be represented in the action and to be entitled to compensation should the action be successful (they will only need to claim their compensation at that time).

Any consumer who does not wish to be represented in this action may exercise their right to opt out by notifying the court of their intention. Consumers may also decide to intervene in the proceedings in support of Ius Omnibus within the time limit to be set by the Court.

What is being asked in this action?

In summary, Ius Omnibus is asking the Court to:

a) It is hereby declared that the Defendants, since 1 April 2010 in relation to the consumers represented by Facebook, and since 25 May 2018 in relation to the consumers represented by Instagram, have breached regulations on the protection of privacy and personal data and the defence of consumer rights, by adopting misleading commercial practices that infringe on privacy, by unlawfully processing personal data without obtaining the free, informed, specific and unambiguous consent of the consumers represented by Facebook and Instagram, expressed through a positive and clear act, and by failing to process the personal data and information of the consumers represented by Facebook and Instagram on the basis of contractual necessity and legitimate interest, or on the basis of any other valid legal ground for processing; by processing sensitive personal data without a legal basis for processing; by failing to provide information in a transparent, comprehensible and easily accessible manner, in clear and plain language, regarding the nature, scope, limits and extent of personal data processing operations, in particular the scope and quantity of their personal data collected and processed, as well as the processing of sensitive personal data, thereby confusing the purposes and legal bases for processing, in particular, failing to sufficiently and adequately inform the consumers represented on Facebook and Instagram about the processing of their personal data for advertising purposes, and failing to adequately inform them about the transfer of personal data to the United States of America, and of course, in pursuit of its objective of generating profits, exposing and creating risks of exposure of the privacy of their private and family lives, subjecting and exposing the consumers represented on Facebook and Instagram to excessive surveillance, without consent, contractual necessity or legitimate interest, and without any other valid legal basis for the processing, used to influence their decisions and behaviour in a significant manner, manipulating their digital and non-digital conduct, restricting free and independent decision-making, and distorting or risking the distortion of the choices of the consumers represented by Facebook and Instagram; by failing to ensure the security of the processing of the personal data of the consumers represented by Facebook and Instagram;

b) The Defendants are ordered to cease the unlawful practices in question:

i. Refraining from continuing to process the personal data of the consumers represented by Facebook and Instagram without a valid legal basis and in accordance with lawful purposes and to the extent necessary for those purposes;

ii. Implementing mechanisms to ensure that cookies or other tracking technologies are placed on the devices of consumers represented by Facebook and Instagram only where there is valid consent or strict contractual necessity;

c) That the Defendants be ordered to refrain from processing the personal data of consumers represented by Facebook and Instagram for the purpose of training the Defendants’ Artificial Intelligence systems, without a valid legal basis and for purposes that are not specific, explicit and legitimate, and to delete such personal data collected and processed unlawfully, including data inferred from and/or derived from the personal data collected;

d) A declaration that the Defendants’ practices have caused harm to the diffuse and/or collective interests of freedom, self-determination and the free development of personality, moral integrity, the protection of personal data, the protection of consumer relations and the protection of privacy;

e) A declaration that the Defendants’ practices have caused harm to the homogeneous individual interests of the consumers represented by Facebook and Instagram;

f) That the Defendants be ordered, jointly and severally, to fully compensate all consumers represented by Facebook and Instagram in this action for the damages caused to them by the unlawful practices in question.

How do class actions and consumer redress work?

The mechanism for mass consumer compensation used here, as provided for in the Portuguese rules on class actions, has not yet been tested in practice through to the final stage. However, according to the law, the following will occur if the court rules in favour of Ius Omnibus:

1) The court will set the total amount of compensation to be paid by Meta to Facebook and Instagram consumers, and will determine how individual compensation is to be distributed to each consumer (for example, direct payment by a defendant, or distribution by an entity appointed by the court);

2) The court will set the method and deadline for represented Facebook and Instagram consumers to claim their share of the compensation (not distributed directly), and this information will be publicised in various ways;

3) Consumers (who do not receive compensation directly from a Defendant) will need to contact the entity responsible for managing the compensation fund, as well as submit the evidence required by the court and payment instructions, in order to receive their share of the compensation;

4) At the end of the period set by the Court, if any part of the total compensation amount remains unclaimed by consumers:

(i) This amount will be used to pay the costs incurred by Ius Omnibus in connection with the proceedings;

(ii) Any remaining amount will be handed over to the State, with 60% going to the Fund for the Promotion of Consumer Rights and 40% to the Institute for Financial Management and Judicial Equipment, I.P. (Instituto de Gestão Financeira e Equipamentos da Justiça, I.P.).Consumers do not have to contact the Court or Ius Omnibus, but it may be in their interest to do so.

All consumers resident in Portugal who, after 1 April 2010 in relation to the Facebook service, and/or after 25 May 2018 in relation to the Instagram service, were at least 13 (thirteen) years old at the time of their first use of the Facebook and/or Instagram services or at a later date, are automatically represented in this class action.

If you do not wish to be represented, you will need to exercise your right to opt out.

If you wish to be represented, you do not need to do anything further at this stage to be entitled to compensation should Ius Omnibus win this case.

At the end of the proceedings, should the action be successful, you may contact the entity designated by the Court (where applicable) to claim your compensation.

However, if you wish to intervene in the case in support of Ius Omnibus, you may do so within the time limit to be set by the Court.

All consumers represented in this case are invited to contact Ius Omnibus immediately so that their details can be recorded and they can be kept informed by Ius Omnibus of all developments in the case, ensuring they do not miss the opportunity to claim their compensation when the time comes. They can do so using the form available on this page.

Do consumers need to contact the Court or Ius Omnibus?

Consumers do not have to contact the Court or Ius Omnibus, but it may be in their interest to do so.

All consumers residing in Portugal who, after March 1, 2012, on their first use of Google products and services or at a later date, were not yet 13 (thirteen) years old, are automatically represented in this collective action.

If they do not wish to be represented, they will have to exercise their right to opt out, through their legal representatives if the consumer is a minor

If they want to be represented, they don’t need to do anything else for now to be entitled to compensation if Ius Omnibus wins this case.

At the end of the process, if the action is successful, they can contact the entity designated by the Court (if applicable) to request their compensation, through their legal representatives if the consumer is a minor.

However, if they wish to intervene in the action in support of Ius Omnibus, they can do so, within the time limit to be set by the Court, through their legal representatives if the consumer is a minor.

All consumers represented in this action are invited to contact Ius Omnibus now, through their legal representatives if the consumer is a minor, so that their details can be registered and they can be informed by Ius Omnibus of all developments in the case, ensuring that they do not miss the opportunity to claim their compensation when the time comes. You can do this using the form available on this page.

How is this case funded?

Properly preparing a claim of this nature, in a way that ensures its success, is extremely costly, requiring the engagement of specialist lawyers and consultants. The success of the claim depends on the proper handling of extensive and technical facts within an extremely complex field of legal, economic and technological knowledge. An effective response also depends on the vast financial and human resources that will be mobilised by the opposing parties.

However, consumers will never have to pay any money, bear any costs or waive any part of the compensation to which they are entitled. The case is funded by a foreign law firm specialising in consumer protection actions, Lieff Cabraser Heimann & Bernstein.

The funding agreement is subject to court scrutiny, and the funder cannot interfere with or determine how Ius Omnibus manages the case.

The funder bears all the risk and costs. If Ius Omnibus loses the case, the funder is not entitled to any compensation. If Ius Omnibus wins the case, the funder will receive the amount that the Court deems appropriate and fair.

The funder will only receive this amount if part of the total compensation paid by the Defendants remains after the deadline for consumers to claim individual compensation has expired. The remaining amount is then allocated in accordance with the applicable legal provisions.