Headquarters for social networking company Facebook Inc. in Menlo Park, California. Photo: Jason Doiy/ALM

The federal judge overseeing litigation stemming from Facebook's Cambridge Analytica scandal spent nearly two hours of a marathon hearing Friday drilling down on the issue of consent.

U.S. District Judge Vince Chhabria seemed to conclude that the social media giant had disclosed to users that their information might be shared with third parties via their friends' use of apps on the site.

“It seems like from the disclosures that it didn't exactly conceal that, and [Facebook] didn't exactly mislead users on that point,” said Chhabria.

Still, given the nature of information that was shared in some instances—including political and religious affiliations—the judge said there was a case to be made that the disclosures “should have been much more prominent and much more clear, and should have brought this to the attention of their users in a louder more jarring way.”

Chhabria heard oral arguments in San Francisco on Facebook's motion to dismiss the multidistrict litigation in the Facebook's case. The lawsuit alleges that Facebook violated consumer fraud and privacy laws by allowing third parties to access user data without consent or disclosure. The multidistrict ligation was consolidated before Chhabria in June 2018 after revelations that the now-defunct Cambridge Analytica data analytics firm used data from 87 million Facebook users to develop targeted political ads. Facebook has conceded Cambridge Analytica, which worked with the campaign to elect President Donald Trump, obtained personal information about users through an Facebook app called “thisisyourdigitallife.” The social media company contends that Cambridge Analytica did so in violation of Facebook's terms of service.

Chhabria said Friday that the way the company handled the matter “was at a minimum providing terrible service to its customers.” But he added his job in the case is not to judge Facebook's customer service practices but to determine whether the plaintiffs had stated a viable claim against the company.

Facebook's lawyers, led by Orin Snyder of Gibson, Dunn & Crutcher, have argued in court papers that the lawsuit was “little more than a broadside against Facebook's business model.” On Friday, Snyder argued that users consented to share their information through their Facebook settings and that “negated any expectation of privacy here.”

“You can't have a concrete privacy injury when a user authorized Facebook to share their information with third-party apps,” said Snyder. “To the extent that information makes its way to third parties, as it did here, that is a product of consumer choice.”

Chhabria indicated in an order issued Thursday, prior to the hearing, that he thought plaintiffs had failed to adequately plead that Facebook's actions had caused economic harm or an increased risk of fraud or identity theft for users. He indicated that the claim to privacy injury was a closer call—but further questioned whether users who kept the default public settings on their account would have standing.

Plaintiffs co-lead counsel Derek Loeser of Keller Rohrback said Friday that Facebook's privacy disclosures mislead users about what third parties could access through their friends' app use.

“People have no idea what Facebook has done with their data,” Loeser said.