In a case over Facebook's alleged use of plug-ins to catalog users' browsing histories in order to sell that data, the U.S. Court of Appeals for the Ninth Circuit ruled that plaintiffs have standing to sue over an alleged infringement of privacy rights covered in the Wiretap Act, Stored Communications Act and the California Invasion of Privacy Act.

But what might be more interesting is the court finding the plaintiffs also have standing to sue the tech giant for unjust enrichment. Bernard Chao, a law professor at University of Denver Sturm College of Law, said he's noticed lawyers often drop their unjust enrichment argument shortly after raising it. That could change after this decision.

Answers have been edited for length and clarity.

What has happened when lawyers raised unjust enrichment arguments in past privacy cases?

It's not so much that courts have not found standing with unjust enrichment. For most of these claims, people don't raise it. I think they don't realize that they can save standing through the use of unjust enrichment claims. The law of restitution and unjust enrichment is sort of forgotten. There's actually a bunch of scholars that argue that's because of the way law school curriculums have changed.

Contracts used to be a two-semester course, and it's now a one-semester course, and the part that got dropped is unjust enrichment and restitution. Some of these scholars argue that we have courts, attorneys and even law professors that don't really understand unjust enrichment, because it actually originates from the principles of equity, as opposed to the courts of law.

What would unjust enrichment solve?

One of the big problems in privacy law for victims is the inability to bring forth lawsuits even if they have otherwise meritorious claims. Even if it's indisputable that a company broke their promise or otherwise had terrible cybersecurity, there are a variety of problems with bringing a claim, because the claim doesn't fit with the classic legal doctrines.

So one of the problems is that privacy policies aren't always considered part of the contract. If you look at this Facebook case, they say you can't bring a breach of contract claim here because even though they have a privacy policy, it's not clear that's part of the contract between the customer and Facebook. The biggest problem, however, is it's often unclear what damages, or injury in fact, the plaintiffs have suffered.

For more on the future of law, sign up for the weekly briefing What's Next.

Why do you think the court granted standing for unjust enrichment?

Just making the argument is a big deal. Professor Douglas Laycock of the University of Virginia School of Law submitted an amicus brief in the case. Professor Laycock is sort of the dean of remedies law in the United States. Laycock weighing in on this particular thing probably highlighted the unjust enrichment argument.

If plaintiffs attorneys themselves raised it, I think the argument is analytically pretty strong. I don't see a meaningfully good response to it. I almost feel it's more about public awareness for attorneys, the bar and the court, and not the soundness of the idea. This is a new context to recognize it in, but it has provided standing previously, without showing concrete injury to the victim.

What are some types of cases that are prime for unjust enrichment claims?

One of the requirements of the Cable Communications Policy Act is that cable companies don't store your data after they no longer need it, and if they fail to do that, then there's statutory damages of $100 a day for each violation. A number of plaintiffs have sued over the statute and lost, and they didn't lose because the cable companies complied with the law. They didn't get to go that far. They lost because of standing. Even if everything they said was true, the court said they don't have an injury in fact, and that's a requirement of constitutional standing. Both the Seventh and Eighth circuits dismissed these cases.

Here, we have this theory that says unjust enrichment doesn't focus on the injury that plaintiffs suffer—in fact, there might be some cases plaintiffs suffer no injury—what we suffer is on how much gain a defendant made by violating their duty. What's interesting about privacy laws is there are all sorts of situations where companies are doing things that we think are harmful to privacy or cybersecurity, and it's hard for the consumer to prove that they've been injured. But we can show pretty easily that the companies made money. If that's the case, and we recognize that for standing purposes, a lot more consumers will be able to have their day in court.

What do you think the broader impact of this ruling could be?

I think it can open the door for more privacy plaintiffs. If you just talk about fairness, I think it's really appealing to folks to say you made a lot of money for something you shouldn't have done, and the fact that I can't point to some concrete injury should not let you off totally. If we measure the damages by how much a company made by doing something wrong, then I think that's something we would innately think is fair. Statutory damages could be huge if we allow unjust enrichment to serve as the basis for unrecognizable statutory damages. I think that's sort of Congress' fault when they write statutory damages in a way that the calculation can be sort of crazy.

This case deals with Facebook taking and using data in a way that we think was a violation of their duty. And they made money off of it, and that should provide a basis for a lawsuit. I would say a variation that could be important for data security is what I would call wrongful savings, so not just how much money you made wrongfully but how much money you save wrongfully.

Pretty much every company out there promises to use reasonable data security. They made a promise about the level of service they are going to provide, and provided a much less level of service, also known as a skimped service. The value of their savings could go to the class of people who did not receive the benefit of higher cybersecurity. Of course if you start giving away the money you should've spent on cybersecurity that sort of incentivizes companies to spend the money on security. Why give it to a bunch of plaintiffs attorneys?