Facebook, the world’s largest social network, is no stranger to litigation or criticism for its utilization of user data that has resulted in lawsuits. And one of those in particular complained about what happens when Facebook intercepts messages between users, compiles data, and shares that data with marketers. On Tuesday, November 3, U.S. District Judge Phyllis J. Hamilton ruled that Facebook, Inc., must disclose that market data.

The lawsuit, filed by Facebook users in 2013, accused Facebook of scanning private messages sent between users. The suit alleges that until October 2012, Facebook systematically scanned users’ private messages for URLs to allow targeted advertising. The users tagged Facebook’s practices as violating the Electronic Communications Privacy Act (also referred to as the Wiretap Act) and California’s privacy laws and ethical codes.

Facebook countered with a motion to dismiss, arguing that users consented to any alleged interception of messages, and if the alleged interceptions did happen, the interceptions fall under an exception to the Wiretap Act for interceptions by service providers occurring in the “ordinary course of business.”

Under the Wiretap Act, a party faces civil penalties if it “intentionally intercepts, endeavors to intercept, or procures any other person to intercept or endeavor to intercept, any wire, oral, or electronic communication.” 18 U.S.C. § 2511(1)(a). Judge Hamilton’s decision emphasized that it’s the interception that is important to the court’s analysis – meaning that if the interception is unlawful, then the use of the information gained through the interception is also unlawful. She then found that Facebook failed to show that its interception was lawful.

Judge Hamilton’s ruling on the issue of consent should prove helpful to provide guidelines on the issue of consent, an exception to the Wiretap Act. Facebook argued that its users consented to any alleged interception when they agreed to Facebook’s “Rights and Responsibilities” and its “Data Privacy Rules.” But the court found that any such consent was implicit, as Facebook failed to specify that it would monitor users’ messages and monetize them. The obvious result: full and specific disclosure – not generic terms of use – is enough to prevent the claim.

The case is Campbell et al. v. Facebook, Inc., No. 13-5996 (Dist. Cal. 2013).