ENDORSEDFILED

Francisco County SuperiorCourt

XAVIER BECERRAAttorney General ofCaliforniaNICKLAS A . AKERS (SBN 211222)Senior Assistant Attorney GeneralSTACEY D . SCHESSER (SBN 245735 )Supervising Deputy Attorney GeneralLISA B KIM ( SBN 229369)

MICAH C . E . OSGOOD (SBN 255239 )

SUSAN SAYLOR (SBN 154592)MANEESH SHARMA (SBN 280084)Deputy AttorneysGeneral

455 Golden Gate Ave. Suite 11000San Francisco, CA 94102Telephone: (415) 510- 3500

mike.osgood @ doj.ca. gov

Attorneys for Peopleof the State ofCalifornia

NOV 2019

CLERK OF THE COURTANGELICA SUNGA

DeputyClerkBY:

SUPERIOR COURTOF THE STATE OF CALIFORNIA

COUNTY OF SAN FRANCISCO

PEOPLE OF THE STATE OFCALIFORNIA EX REL. XAVIERBECERRA, ATTORNEYGENERAL,

EXEMPT FROM FILING FEESPER GOV. CODE 6103

PetitionerCase No.

OPF 916

PETITION TO ENFORCEINVESTIGATIVESUBPOENA ANDINVESTIGATIVEINTERROGATORIESFACEBOOK, INC. ,

Respondent. (GOV. CODE, $ 11180 et seq.)

1. In 2018, California AttorneyGeneralXavier Becerra launched an investigation into the

business practices of Facebook Inc., following widespread reports thatFacebook allowed third

parties to harvest Facebook users' private information . Whatinitially began as an inquiry into theCambridge Analytica scandal expanded over time to become an investigation into whetherFacebook has violated California law by, among other things, deceiving users and ignoring itsown policies in allowing third parties broad access to user data.

Pet to Enf. Subp

2. Early in the investigation , the Attorney Generalusedhis pre-litigation investigatorypowers granted by section 11180 et seq .of theGovernment Code to issue an investigativesubpoena requiringFacebook to produce documents relating to the Cambridge Analytica matter.A year passed before Facebook completed its drawn out response to the subpoena,during whichtime the Attorney Generalalso issued a first set of investigative interrogatories .

3 . On June 17, 2019, the Attorney General served a second set of interrogatories and afurther subpoena to delvedeeper into matters disclosed in Facebook s initial responses and laternewsreports concerning other claims ofwrongdoing by Facebook over users' privacy .Facebook sresponses to this second subpoena and set of interrogatories is patently deficient.Despite repeated entreaties, Facebook has provided no answers for nineteen interrogatories andproduced nonew documents in response to six document requests. Facebook has also whollyrefused to search communications involving senior executives for responsive materials. Thus,Facebook is notjust continuingto drag its feet in responseto the Attorney General' s

investigation ,itis failing to comply with lawfully issued subpoenas and interrogatories .4 . Accordingly , the People of the State of California , acting through Attorney General

Xavier Becerra, petition this Court pursuant to section 11188 ofthe Government Code to enforcecompliance with the Attorney General 's investigative subpoena and interrogatories . Thisinvestigation involves serious allegations of unlawfulbusiness practices by one of the richestcompanies in theworld, prompting inquiries by Congress, European and U .S . regulators thestate and federal level. Indeed, the FederalTrade Commission recently announced a $ 5 billionsettlement after the company violated an existing consentdecree . Facebook s delays and refusalsto comply with the Attorney General s interrogatoriesand subpoena should notthwart thisimportant and independent investigation into whether the company violated its users' privacyandCalifornia law

THE PARTIES5. Petitioner Xavier Becerra is the Attorney of the State ofCalifornia. Hebrings

this action solely in his official capacity on behalf of thePeople ofthe State ofCalifornia. As thechief law officer of the State ofCalifornia , the Attorney General is responsible for enforcing the

2

Pet to Enf. Subp

state s consumer protection laws, among others. In order to carry out thesedutieseffectively,California law givesthe Attorney Generalbroad investigativepowers. Specifically,GovernmentCode sections 11180 et seq. grant the Attorney General, as head ofthe Departmentof Justice, theauthority to issue subpoenas and promulgate interrogatories. The AttorneyGeneralmay usethesepowers for various reasons, includingassisting him in considering possible prosecutorial actions,proposing legislation,and formulating enforcement policies with other agencies. Theseinvestigative powers are not dependenton the initiation ofa civil lawsuitor an administrativeproceeding. Ifa party disobeys a subpoena, the Attorney Generalmay petition the Superior Courtfor enforcement

6 . Facebookneeds no introduction. The Silicon Valley-based socialmedia giant, which

has grownto includethe Facebook, WhatsApp, and Instagram platforms, is the fifth largest

company in the United States bymarket capitalization , sixth most profitable , andboasts nearly

40,000 employees. Mostadults with internet access use Facebook,manyofthem to share the

intimatedetailsoftheir lives with friends and family. Facebook gathersandmaintainspersonal

information ofbillionsof users throughout the world andmillions in California. This data

gathering occurs both on Facebook s own platforms and through widespread surveillance thatFacebook conducts on other websites and online activities. The company then monetizes thedata

through the provision ofhighly targeted advertisements to customized audiences on Facebook sproducts,making the company billions in revenue.

JURISDICTION AND VENUE

7. Jurisdiction and venue are proper in the Superior Court ofthe State of California in the

City and County ofSan Francisco under Government Code section 11186. The AttorneyGeneral

primarily conducts the investigation into Facebook in the City and County of San Francisco,with

somework performed in other parts of the State.

.

BACKGROUND

THE FACEBOOK PLATFORM. Among other endeavors, Facebook operates a socialmedia platform that allows

28 individualsand organizationsto createpersonalized online profilepages about themselves, filled3

Pet. to Enf. Subp.

with biographicaldetails, photos, and a scrollable record of chronological posts aboutthe user.Facebook also lets users connect with other users as “Friends, relevanthere, purports toallow users to restrict access to their information usingvarious privacy settings.

9. In 2007, Facebook launched a developer portalthat let third -party software developerscreate applications that interacted with Facebook users. These “Facebook apps, likeapps on amobile phone,were smallprogramsthat operated on Facebook'swebsite ormobileapp.Facebook apps includedpopular games or quizzes thatallowed a userto postserious or humorousresults, such as what fictional character a user'spersonality resembles. Tomakethempersonalized, Facebook granted appsthe ability to accessdata about users from Facebook sdatabase. For example, a horoscope appmightcapture a user sbirthdate to providethehoroscope. Facebookmademillions of appsavailable to users, opening thedoor formillionsofapps to collect user data.

10. Facebook also allowed apps to access non-public data information that users thoughtthey had restricted — aboutboth themselves and their Friends. Someapp providers, appear tohave exploited this access to collect other userdata ,build profiles on users, and sell to thirdparties. This includes apps affiliated with Cambridge Analytica , obtained data on 87million Americans that was allegedly used to conduct election-related disinformation campaigns.Questionshave arisen as to what Facebook knew about this conduct, why it failed to prevent appproviders from misusing user data, andwhether thisbehaviorviolated California law .

11. In addition , Facebook told users that the company had safeguards in place to protecttheir data , and itoffered controls that purported to allow users to decidewhether and how theirdata was shared. However, the Cambridge Analytica scandal, combined with reports thatFacebook allowed itsbusiness partners to access user data, even when those users had opted outof such sharing, suggests that Facebookmay nothave honored itsobligationsto itsusers, or

complied with California s privacy or consumer protection laws.

26 II. THE ATTORNEY GENERAL INVESTIGATION

12. California law grants the AttorneyGeneralthe authority to investigate reports ofunlawful, unfair, deceptive, orotherwiseimproperbusiness practices,including28

Pet. to Enf. Subp .

misrepresentations to consumers, failures to make adequate disclosures in connection withpersonal information and online services, and violations ofindividuals' privacy. Using thisauthority, the Attorney General initiated an investigation and continues to investigate Facebook scompliance with California s privacy and consumer protection laws, includingbutnotlimited tothe allegations set forth above.

June 4 , 2018 the Attorney General,acting through officers of the Department ofJustice to whom he had delegated investigative authority under section 11182 of the GovernmentCode, served Facebook with a subpoena for documents based on the allegations involvingFacebook and Cambridge Analytica . Facebook accepted service ofthe subpoena andacknowledgeditsreceipt. Facebookmadeits lastproductionof documents in response to this

first subpoena on April 17 , 2019,but the company wrote that it planned to make additionalproductions on a rolling basis.” On June 5 , 2019 , a year and a day after the subpoena issued ,Facebook finally admitted that it had actually completed its production of documents .

14. On June 17, 2019, the Attorney General, acting through officers of the Department ofJustice exercising delegated authority, properly served Facebook with a second set ofinvestigative interrogatories and a second investigative subpoena, requesting additionalinformation and documents. Copies of the investigative interrogatories and subpoena are attachedas Exhibit A and B and are incorporated into this petition. Facebook was subpoenaed and

required to answer interrogatories in themanner prescribed in section 11180 etseq .of theGovernmentCode. The interrogatories and the subpoena, respectively, provided notice of thetimeand place for answering the interrogatories and for production of the papers. (Gov. Code,11187, subd.(b)(1).) By agreement,Facebook s attorneys accepted service of the interrogatoriesand subpoena.

15 . The Attorney General s interrogatories and subpoena wereregularly issued , and theyrelate to the Attorney General' s ongoing investigation into Facebook s compliance with consumerprotection and privacy laws. The investigatory interrogatories seek the following relevantinformation:

The number ofCalifornia users and rates at which they activated privacy settings to

Pet. to Enf. Subp.

prevent apps from accessing data;

The effects of the various privacy settings on third parties access to data, including whichapps Facebook granted access to user data despite users restricting access to theirinformation;

Information about Facebook s enforcement of its policies againstdevelopers ;An explanation of the technical workings of Facebook s software that allowed various

entities to access userdata .

The AttorneyGeneral s subpoena seeks the followingmaterials:

Communicationsamong executives regarding: 1) any consideration of theneed to auditdevelopers access to user data; 2) third parties granted expanded access to user data; 3)the relationship between ad spending and access to data ; 4) significantprivacy-related

stories; and 5 )the introduction ofnew privacy features.Documentation regarding the changes to and user testingof Facebook s privacy settings;

Communicationsregarding a user s likely response to privacy settings;DocumentsregardingFacebook privacy program ,which wasmandated by theFederalTrade Commission in 2012 pursuantto a consent decree, yet failed to preventthe

•

Cambridge Analytica scandal.

III. FACEBOOK HAS FAILED TO ADEQUATELY AND SUBSTANTIVELY RESPOND.

16 . Facebook broadly refuses to answer the interrogatories or comply with the subpoenaas required . Facebook willnot provide a direct answer to 19 out of 27 interrogatories (Nos.2637,40 -42 , & 47 50 ) and has only provided a partialresponse to 6 (Nos.24,25 ,43,44 ,45, & 46).Facebookhasproducednonew documents for six document requests (Nos. 19-21& 26-28), and

appears to have conducted an insufficient search for request no . 25.

17. Facebook has also refused to conduct a complete search for responsive documents.

Facebook has, for example, refused to search for communicationsamong senior executives

regardingterminatingdevelopers to userdata, variousprivacy-relatednews stories, and

Facebook s publicresponses. On information and belief, Facebookhasnotsearched the emails

of the company' s Chief Executive and ChiefOperating Officers for documents responsive to the6

Pet. to Enf. Subp.

subpoena

18. This lack of cooperation , particularly with respectto communications among seniorexecutives, is not unique to the Attorney General's investigation . A member of the Federal TradeCommission recently wrote to express serious concerns over Facebook ’s candor with federalregulators:

Based on the materialpresentedto me, I wasvery concerned aboutFacebook ' scooperation and candor in its dealingswith the Commission and its staff. Inmy view ,thereweremultipleinconsistenciesand deficienciesin Facebook s responsestoquestions. I questionedwhether the company' s documentproductionswere trulycomplete. I believe that Facebook struggled to answermanyrequests for data, and Iascertained thatthe companywas resistant to providingdocumentsfromZuckerberg' s files.

(Dissenting Statement of Commissioner Rohit Chopra , In re Facebook, Inc., Federal Trade

Commission File No. 1823109 , July 24, 2019, at page 6. )

Pet. to Enf. Subp

PRAYER FOR RELIEF

Pursuantto Government Code sections 11186 -11188, the Attorney General prays that this

Court:

. Issuean order directingRespondent to appear before this Court and to show causewhy it has refused to comply with the Subpoenaand Interrogatories, and upon Respondent'sfailure to show cause;

2 . Enter an order directing Respondent to provide fullresponses to InterrogatoriesNos.

26 – 37 40 – 42, and 47-50; complete its response to Interrogatories Nos. 24 , 25 43, 44,45, &

46; and produce documents for Requests for Production Nos. 19-21and 25-28; and

3. Allotherreliefto which the people are legally entitled.

Dated: November 6, 2019 Respectfully Submitted ,

XAVIER BECERRAAttorney General of CaliforniaNICKLASA . AKERSSenior Assistant Attorney GeneralSTACEY D . SCHESSER

SupervisingDeputy AttorneyGeneral

MICAH C . E . OSGOODB . KIM

SUSAN SAYLOR

MANEESH SHARMA

Deputy Attorneys GeneralAttorneys for the People of theState ofCalifornia

SF2018400570/ 14237593.docx

Pet. to Enf. Subp .

EXHIBIT A

XAVIER BECERRA (SBN 118517)Attorney General of CaliforniaNICKLAS AKERS ( SBN 211222)Senior Assistant Attorney GeneralSTACEY D . SCHESSER ( SBN 245735)Supervising Deputy Attorney GeneralLISA B, KIM 229369)SUSAN SAYLOR (SBN 154592)

C . E . OSGOOD ( SBN 255239)MANEESH SHARMA ( SBN 280084 )Deputy Attorneys General

South Spring Street, Suite 1702Los Angeles , CA 90013Telephone : (213) 269-6369lisa.kim @ doj. ca .gov

BEFORE THEDEPARTMENT OF JUSTICEOFFICE OF THE ATTORNEY GENERAL

STATE OF CALIFORNIA

In theMatter of the Investigation of: INVESTIGATIVE SUBPOENA FORDOCUMENTS (SET TWOFACEBOOK INCGOV. CODE 11180, ETSEQ.

NOTICE to Benjamin A . Powell, Esq. You are hereby served on behalf of Facebook , Inc.pursuant to your agreement to accept service on your client 's behalf

FACEBOOK , INC. INVESTIGATIVESUBPOENA FOR DOCUMENTS TWO

8

Pursuant to the powers conferred by Article 2 ofChapter 2 ofDivision 3 of Title 2 of theGovernment Code of California (Cal. Gov. Code, 11180 et seq.) on the Attorney General, asheadof the California Department ofJustice ,which powers and authority to conduct the aboveentitled investigation have been delegated to the undersigned ; an officer of that Department,

FACEBOOK, INC.(hereinafter “FACEBOOK IS HEREBY COMMANDED to produce thedocuments, books,records, papers and other items(collectively Items described in Attachment A to thisInvestigativeSubpoena which are in FACEBOOK 's custody, possession or control, or thecustody, possession or control of FACEBOOK 's subsidiaries, affiliates,parents, predecessors,successors, employees,partners, officers, agents orrepresentatives, whether or notthe presentlocation ofanyofthe Items designated isin California, at the California Departmentof Justice,Office of the Attorney General, 1300 ” Street, Sacramento, CA 95814-2919,ATTN: DeputyAttorney General Lisa B.Kim ,within thirty days of service hereof.

INSTRUCTIONS FOR COMPLIANCEIfFACEBOOK claimsthat an item or a portion ofan item is privileged and

FACEBOOK withholds it from production for that reason, FACEBOOK must create and submit aprivilege log which lists: (1) the authors and their capacities; ( ) the recipients (including cc sand s their capacities;(3) other individuals with access to thedocument and theircapacities;(4)the type of document;(5)the subjectmatter ofthe document; ( )the purpose(s) forthe creation of the document; (7) the date on the document; and ( ) a detailed explanation settingforth the factual and legalbasis for your claim thatthe documentis privileged or otherwiseimmune from production .

2. To the extent responsive itemsexist in an electronic or computerized format,please contact the officer issuing this subpoena to discuss the manner and format in which theitemsare to be produced so as to facilitate the production offull and complete copies in a usableformat Inthe absence of an agreement regardingthemanner and format ofproduction, thefollowing instructions shall apply :

2

FACEBOOK, INC . INVESTIGATIVE SUBPOENA FOR DOCUMENTS TWO

a. The information shallbe provided in accordance with the CaliforniaAttorney General' s Office Production Format as outlined in Attachment B below .

b The response shallinclude allDOCUMENTS and computer programsnecessary to the accurate conversion,analysis, and review of the electronic data, including butnotlimited to operating instructions,manuals and user guides, keys, legends, and codes for systems,programs, files,and data fields.

71 This Investigative Subpoena has been issued in connection with an investigationwithin the scope ofsection 131of the California PenalCode.

4. No item requested herein shallbe destroyed ordiscarded byFACEBOOK until theAttorney Generalhasmade a written determination that the item in question is notnecessary for

11 furtherance of this investigation.5 . When producing items, identify by number the request(s) to which the Item is

responsive6 . As used herein , the past tense includes thepresentand future tenses, the present

tense the past and future tenses ,and the future tense includes the pastand present tenses ;tensesmust be construed in themanner that would include, rather than exclude, information .

7. As usedherein, the singular includes the plural and the pluralincludes the singular,andmustbeconstrued in themanner that would include, rather than exclude, information.

DEFINITIONS

For purposes of this investigativesubpoena, the terms set forth below aredefined asfollows:

APPS OTHERSUSE” means the settingused to limit data SHARED throughFRIENDS with THIRD PARTY APPLICATIONS asset outon page 19 et seq. of theMarch 15,2019 letter from Benjamin A.Powell to Stacey D .Schesser and Lisa B. Kim .

2. “COMMUNICATION(S)”meansevery disclosure, transfer, exchange, ORtransmission of information,whether oral,written ,OR electronic,and whether face-to-face,bytelecommunications, telephone,computer,mail, e-mail, textmessage, instantmessage,

FACEBOOK, INC INVESTIGATIVE SUBPOENA FOR DOCUMENTS SET TWO]

FACEBOOK Messenger,screenshot, picture, facsimile (fax)machine, OR otherwise, includingany and all attachment(s)

DATA CONTROLS”meansthe settingsthata user can alteror acceptto limitthe sharingofUSER INFORMATION with third parties,includingaudience selectors,

3

GRANULAR DATA PERMISSIONS,PLATFORM OPT OUT, APPS OTHERS USE, and thelike.

4. DEVELOPER (S)”meansany naturalorcorporate person thatdevelops anapplication, software experience, game, orwebsite , thataccesses information fromFACEBOOK 's or other FACEBOOK software.

5. DOCUMENT(S)” meansa“writing” asdefined in section 250 of the CaliforniaEvidence Code, and includes COMMUNICATIONS, e-mails, voicemails, computer files, textmessages, instantmessages,word processing documents,spreadsheets,databases, calendars andallother formsof“electronically stored information” asdefined in section 2016.020 of theCalifornia Code ofCivilProcedure.

6. "EXTENDED APIACCESS PARTNER(S)”means the entity or entities withwhom FACEBOOK partnered with for EXTENDED APIACCESS PARTNERSHIPS.

7. “EXTENDED APIACCESS PARTNERSHIP”meansa partnership formed byagreementbetween FACEBOOK and a DEVELOPER thatallowed the DEVELOPER access tocertain FACEBOOK APIs on terms specified within theagreement,such as FB -CA-CAAG0002916, andbeyond those termsoffered to typical THIRD PARTY APPLICATIONS on theFACEBOOK Platform . This definition includes agreementsperforming the same generalfunction, even ifnottitled as an “Extended APIAddendum .”

8. "FACEBOOK PRODUCT means the socialnetworking online service operatedby FACEBOOK, Inc. where USERS access content , including THIRD PARTY

16

APPLICATIONS,websites, and games. Forpurposesofthis subpoena, FACEBOOKPRODUCT means content accessed online atwww.facebook .com and FACEBOOK ' smobileapplication , but does not include acquired properties , such as Instagram and WhatsApp.

FACEBOOK , INC. INVESTIGATIVESUBPOENA DOCUMENTS TWOJ

9. “FRIEND”means a USER who is connected to another USER on theFACEBOOKPRODUCT

10. “GRANULAR DATA PERMISSIONS” refers to the setting used to limit dataSHARED with THIRD PARTY APPLICATIONS as set out at page 4 et seq.of the March 15,2019 letter from Benjamin A . Powell to Stacey D. Schesser and Lisa B.Kim .

11. INSTANTPERSONALIZATION” meansthe product thatFACEBOOK offeredthat used FACEBOOK USER INFORMATION to providepersonalized experiences on selectpartners' websites, as described by FACEBOOK in its December 18, 2018 Newsroom post foundonline at https://newsroom .fb.com /news/2018 / / facebooks-partners/ .

12. INSTANTPERSONALIZATION PARTNER(S )” means the entity or entities11 with whom FACEBOOK partnered for INSTANTPERSONALIZATION .

13 INSTANT PERSONALIZATION PARTNERSHIP means the relationship13 FACEBOOK had with INSTANT PERSONALIZATION PARTNERS.

14. INTEGRATION PARTNER (S)”means the entity or entities with whomFACEBOOK has an INTEGRATION PARTNERSHIP .

15. INTEGRATION PARTNERSHIP(S)”meansthe relationship FACEBOOK haswith companies that built integrations for a variety of devices,operating systems, and otherproducts, as described by FACEBOOK in Appendix A of the July 20 , 2018 letter Anjan Sahnisent to Stacey D . Schesser and Lisa B.Kim .

16. PLATFORM OPT OUT” the setting used to disable platform as set outatpage 10 et seq.of theMarch 15,2019 letter from Benjamin A Powellto Stacey D. Schesser andLisa B. Kim .

. POLICY” “ POLICIES” mean any formal or informal policy,procedure, rule,guideline, collaborative document,directive, instruction , OR practice,whether written orunwritten ,that YOU expect YOUR employees to follow in performing their jobs.

18. “PROFILE CONTROLS”means the settings thatcontrol what information in aUSER 'sprofile is SHARED with other USERSthrough audience selectors, such as phone

28 number,email, current city, birthday, relationship status,work , and education.

FACEBOOK , INC . INVESTIGATIVE SUBPOENA FOR DOCUMENTS(SET TWO

19. “ ” or “SHARES” or “SHARING” or “ SHARED ” means to provide,communicate , transfer, release, disclose, disseminate , sell,rent, trade,OR otherwise makeaccessible or available in writing,electronically , or by other means.

20 . THIRD PARTY APPLICATION (S)”shall have the samemeaning as the termsPlatform Application (s), application (s),” and “app in FACEBOOK s policies produced

to the California Attorney General bearing the Bates Labels FB- AG -00000001 through FB -CACAAG -00000305.

21. USER(S)”meansthe individuals whomaintain an accountand can generallyaccess the typical FACEBOOK experiencevia website ormobile application in a personalcapacity

22 USER INFORMATION” meansany information related to the FACEBOOKPRODUCTthat identifies,relates to describes,or is capable ofbeing associated with, a particularindividual, including, but not limited to the following information :name;physical address,including street name and name of a city or town;telephone number; email address;onlinecontact information, includinga screen name,username,or socialnetwork profile that functionsas online contact information ; user account credentials; a persistent identifier such as a usernumberheld in a cookie or a processor serialnumber;a unique device identifier or a universallyunique identifier, including FBID ; geolocation information,includingGPS-based locationinformation and network -based or cell-based location information ;longitude and latitudedata;education; employment;employment history; and other socialmedia content generated byOR associated with a particular individual, including status updates, likes,OR group affiliations

23. “ YOU ” “ YOUR” “FACEBOOK” meansFACEBOOK, Inc and its past orpresent officers, agents , employees, attorneys, predecessors, affiliates, subsidiaries, parent

FACEBOOK , INC. INVESTIGATIVE SUBPOENA FOR DOCUMENTS (SET

companies, former businessnames, anddbas, and anyone actingon YOUR behalfor at YOURdirection

FAILURE TO COMPLY WITH THIS SUBPOENA WILL SUBJECT YOU TO THE

PROCEEDINGS AND PENALTIESPROVIDED BY LAW .

Dated: June 17, 2019 XAVIER BECERRA

Attorney General of CaliforniaNICKLAS A . AKERSSenior Assistant Attorney GeneralSTACEY D . SCHESSER

Supervising Deputy Attorney GeneralLISA B . KIMSUSAN SAYLORMICAH C . E .

MANEESH SHARMA

Deputy Attorneys General

B . KIMDeputy AttorneyGeneral

SF2017402454

13780166. docx

FACEBOOK, INC. INVESTIGATIVESUBPOENAFOR DOCUMENTS TWO ]

ATTACHMENT A

18. Recordstracking the USER DATA accesspermissionsgranted to DEVELOPERSpursuant to an EXTENDED APIACCESS PARTNERSHIP

. All YOUR internal COMMUNICATIONS from 2013 to 2018 reflecting thecontemplation, planning, or performance of a generalaudit of DEVELOPERS to USERINFORMATION, includingthrough THIRD PARTY APPLICATIONS, INTEGRATIONPARTNERSHIPS, INSTANT PERSONALIZATION PARTNERSHIPS and EXTENDED APIACCESS PARTNERSHIPS.

20. COMMUNICATIONS concerning the negotiation of, entrance into, ortermination of, an EXTENDED APIACCESS PARTNERSHIP.

21. COMMUNICATIONS from 2012 to 2015 regarding conditioningDEVELOPERS access to USER INFORMATION on advertising spending or other payment.

22 All DOCUMENTS that support YOUR contention that FACEBOOK neverimplemented , letalone seriously considered ” (emphasis in the original) chargingdevelopers foraccess to user data, stated on page 6of the April 17, 2019 letter from Benjamin A . PowelltoStacey D . Schesser and Lisa B . Kim .

DOCUMENTS reflecting the study, testing, or analysis of a USER'Sunderstanding of, or reaction to, a DATA CONTROL in effect during 2013 to present, anyproposed change to aDATA CONTROLS during that time frame, including any A / B testing, orstudies on user experience or usability ofDATA CONTROLS.

24. All COMMUNICATIONS regarding a USER 'spotential reaction to orunderstanding of DATA CONTROLS .

25. YOUR internal COMMUNICATIONS, involving a Director, Vice President,or above, about the development of the"privacy tour, basics, or privacy check-up,"as those terms were used by in the March 15, 2019 letter from Benjamin A .Powell to Stacey D .Schesser and.Lisa B.Kim .

26. YOUR internal COMMUNICATIONS, involving a Director, Vice President,28 or above,about thetermination of a DEVELOPER S access to USER INFORMATION

18

FACEBOOK , INC INVESTIGATIVE SUBPOENA FOR DOCUMENTS (SET TWO

27. YOUR internalCOMMUNICATIONS, involvinga Director, Vice President,orabove, that occurred within oneweek of arequest for commentregarding, or thepublicationof, the following newsreports:

TheGuardian's reportingonDecember 11, 2015, that" Cruz us[ed] [ a ] firmthat harvested data onmillions ofunwitting Facebook users

news outlets reporting onMarch 17, 2018 ,about Facebook andCambridge Analytica ;The New York Timesreporting on June 3 , 2018 , that"Facebook gavedevice

makers deep access to data on usersand friends” ;The Wall Street Journal reportingonNovember 28, 2018, that“ Facebookconsidered charging for access to user data" ;The Washington Postreporting on December 5 , 2018 , that Facebook allegedly ]offered advertisers special access to users' data and activities andThe New York Times reporting on December 18, 2018, that “ Facebook gave someof the world 's largest technology companiesmore intrusive access to userspersonal data."

28. All YOUR internal COMMUNICATIONS involving a Director, Vice President,or above, regarding approval of the following Facebook Newsroom items:

WeDisagree with the New York Times, dated June 3, 2018 ;Response to Six4 Three Documents, dated December 5 , 2018

' s Clear Up a Few Things AboutFacebook ' s Partners, dated December 18,2018.

Facts About Facebook sMessagingPartnerships, dated December19, 2018• Cracking Downon Platform Abuse, datedMarch21, 2018;

29. All YOUR internalPOLICIES on the enforcementof FACEBOOK ' s Platform

Policy, Data Policy, Terms of Service, or Statement of Rights and Responsibilities, on THIRDPARTY APPLICATIONS , INTEGRATION PARTNERSHIPS , INSTANTPERSONALIZATION PARTNERSHIPS , and EXTENDED APIACCESS PARTNERSHIPS

30. EnforcementRubric[s]” used by FACEBOOK , as that term is used on page 4of the April 17, 2019 letter from Benjamin A .Powell to Stacey D. Schesser and Lisa B.Kim .

31. All“ cease anddesist letters” sentby FACEBOOK DEVELOPERS,betweenJanuary 1,2013, and March 1, 2018,as that term is used on page 12of the July 20, 2018 letterfrom Anjan Sahnito Stacey D. Schesser and Lisa B. Kim .

FACEBOOK , INC . INVESTIGATIVESUBPOENAFORDOCUMENTS SET

32. All letter agreements” resolving an enforcement concern as that term is used onpage theJuly 20, 2018 letter from Anjan Sahnito Stacey D. Schesser and LisaB .Kim .

33 FACEBOOK S logsdocumenting any code changesmade to DATA CONTROLS,sometimes referred to as“ CommitLogs.”

34. All Privacy Risk Assessment[s],” andnotes or agendarelatingto FACEBOOK' s" focused subject-matter-specific meetings," weekly intra- and inter-team meetings,

Privacy Summit[s],” as detailed in “Facebook’s Privacy Program Overview page 9oftheIndependent Assessor's Reporton Facebook 's Privacy Program ” atFB-CA-CAAG-00131372 .

35. All transcripts of deposition or other testimony by FACEBOOK former andcurrent employees in the litigation titled , Six4Three, LLC Facebook, Inc. (Case No. CIV533328), Superior Court of the State of California,County ofSanMateo, filed on April 10, 2015

36 . FACEBOOK s discovery responses, excluding documents produced , in thelitigation titled , Six4Three, LLC Facebook, Inc. (Case No. CIV 533328), Superior Courtof theStateofCalifornia,County of San Mateo, filed on April 10, 2015 .

FACEBOOK s responses to any formal or informalrequests for information,interrogatories,or other discovery , excluding documents produced, to theFederalTradeCommission regarding itsinvestigation into FACEBOOK s privacy practices, after entry of theFederal Trade Commission s July 27, 2012 Decision and Order,in its action titled IntheMatterofFacebook, Inc.Doc.No. 0923184.

10

FACEBOOK, INC. INVESTIGATIVESUBPOENAFOR DOCUMENTS SET

ATTACHMENTB

California AttorneyGeneral' s Office

PRODUCTIONFORMAT

. PRODUCTION OFELECTRONICALLY STORED INFORMATION ( )

A . Load files. Exceptwhere noted in section (K ) below all ESIis to be produced in electronic format,with file suitable for loading into a Concordance compatible litigation support review database. Allproductionswill both imageand load files, asdescribed in Appendix A : Load File

B .Metadata FieldsandProcessing Each of themetadata and coding set forth in Appendix B thatcan be extracted from a document shall be produced for that document. parties are not obligated topopulate manually any of the fields in Appendix B ifsuch fields cannot be extracted from a document.

C. Files, system and program files need not be processed ,reviewed or produced . Theproducingparty shall keep an inventory ofthe system files not being produced and the criteria (readable file , etc.) for notprocessing the files.D. Email.Wlieneverpossible, emailshallbe collected from the party' s emailstoreor server(eg Exchange LotusNotes) becausethis is themostreliable source from which to produceandmaintain emailmetadataand structure.Metadataand "header fields" shallbeextracted from emailmessages. Emailmessages, ineetingnotices, calendaritems, contactsand tasksshall allbe extracted fromthe email archives

E . De-Duplication.Removalofduplicatedocuments shall only bedoneon exactduplicatedocuments(based on MD5or SHA- 1 liash values at the documentlevel) acrossallcustodians(global), and theCustodian fieldwill each Custodian, separatedby a semicolon,whowas a sourceof that documentprior deduplication. Ifa isunable to providesuch informationwithin theCustodian field, or ifglobaldeduplicationcould otherwiselimit theability to providethat a particulardocumentwas possessedbya custodian, then removalofduplicate documentsshallonly bedoneon exact duplicatedocuments( based onMDS SHA-1 hash values the documentlevel)within a source( custodian).

F . TIFFs/ JPGs Single-page Group IV TIFF shallbeprovidedusingat least 300 DPIsetting. Each image shallhavea unique filename, which is theBatesnumberof the . Originaldocumentorientation shall bemaintained ( portmit to portraitand landscapeto landscape). TIFFswillsliow and alltextand imageswhichwould be visible to the reader using the nativesoftwarecreated the document. Documents containing color need notbeproduced initiallyin color. However, ifanoriginaldocument contains color necessary to anderstand themeaning or content of the document theproducing party will honor reasonable requests for a color image ofthe document. If color imagesare tobeproduced willbeprovidedin JPG format.

G . Objects. Objects embeddedinMicrosoft and documents,whichhavebeenembeddedwith the Display as Icon" feature, will extractedasseparate documentsandtreated likeattachmentsto the document. Other objectsembeddedin documentsshallbeproducedasnative files.

FACEBOOK, INC. INVESTIGATIVESUBPOENA FORDOCUMENTS

H . Compressed files. Compression file types eg, , TAR , Z ZIP shall be ina reiterative manner to ensure that a zip within a zip is decompressed into the lowest possiblecompression resulting in individual folders and/or files.

I. TextFiles For each document, a single text file shallbeprovided alongwith the image files and. The text file name shallbe the sameas the page Bates/controlnumber ofthe first page of the

document. File names shallnot any special characters or embedded spaces. Electronic textextracted directly from the native electronic fileunless the documentwas redacted an file apliysical file. In these instances a text file created using OCR will be produced in lieu of extracted text.See Section II. C for OCR requirements. Under no circumstancesshall the receivingparty be required torely upon a less accurateversion ofthe text the producing party.For , if theproducing partyhas access to extracted text froin electronic document files, the receiving party shallreceive extracted textinsteadofOCR' d text generated from an imagefile .

J. Redaction. Ifa file that originates in ESIneeds to be redacted before production , the file will berendered in TIFF and the TIFF will beredacted and produced However, to the extent that thetext issearchable in the native format, the producing party will still provide searchable text for those portions ofthe document that lavenot been redacted.

K . Spreaclsheets and Presentations. Various types of files, includingbutnot limited to MS Excelspreadsheets, MSPowerPoint presentations,media files, etc ., lose significant information andmeaningwhen produced as an image. Any native files that are produced shallbeproduced with a Bates-umberedTIFF image slip -sheet stating the document hasbeen produced in native format. Any native thatareproduced shallbeproduced with the Source File Path provided well as all extracted text andapplicable

fields set forth in Appendix B .

. Excelspreadsheets shallbe produced as a native document file alongwith theextractedtextandrelevantnieta data identified in Appendix B for the entire spreadsheet, plus aBates- TIFF image slip -sheet statingthe documenthas been produced in native format

Presentations . PowerPoint presentations shallbe produced as a native document file along withthe extracted text and relevantmetadata identified in Appendix B for the entire presentation , plusa Bates - slip -sheet the clocument hasbeen produced in nativeformat.

L . Other ESIthat is Impracticalto Produce in Traditional Formats. Theparties understand andaclonowledge that certain categories of ESIare structurally complex and donot lend themselves toproduction asnative format or other traditional formats. To the extent a response to discovery requiresproduction ofdiscoverable electronic information contained in a database, the producing party shallconsidermethodsof production bestprovidingallrelevant information, including butnot limited toduplication of databases or limited access for purposeof generating reports. Parties considerwliether all relevant information may be provided by querying the database for discoverable informationand generatinga report in a reasonably usable and exportable electronic file ( , Excel, CSV SQLformat). Thepartiesagree to confer to obtain an appropriate resolution to such requests.

12

INVESTIGATIVESUBPOENAFOR DOCUMENTS[SET TWO]FACEBOOK , INC.

M . Endorsements. producing party willbrand all TIFF images in the lower right-hand withitscorresponding bates number, a type and size. The bates must obscureany partof the underlying The producing party will brand all TIFF images in the lower left-handcorner with all confidentiality designations asneeded , in accordance with confidentiality definitionsasagreed to by the parties.

N. Exception Report. The producingparty shall compile an exception report enumerating anyunprocessed or unprocessable documents, their file type and the file location .

. procedure. Any documents recalled due to a agreed upon clawback provisionshall liave a specific protocol followed to ensure all copies of each such documentare appropriatelyremoved from the review database, backup and disaster recovery systems maintained by theopposingparty

13

FACEBOOK INC INVESTIGATIVESUBPOENA FOR DOCUMENTS

II. PRODUCTIONOFPHYSICALLY STORED INFORMATION (HARD COPY DOCUMENTS)

. TIFFs copy paper documents shall bescanned as single-page, Group IV compression TIFFimages usinga print of at least300 dots per ( . image shall a file name,which is the Bates number of the document. Originaldocument orientation shallbe (i.e.,portrait to portrait and landscape to landscape)

.Metadata Fields. The following informationshallbeproduced for hard copy and providedin the data loadfileat the same time that the TIFF images and theOpticalCharacterRecognition(OCR)acquired text files are produced. Eachmetadata field shallbe labeledaslisted below :

FieldName Example Description

PARENTDOCID ABC0000001(UniqneID Parent

Relationships)

The Document ID number associated with the first page of aparent document (this field will only be populated in childrecords)

GROUPID ABC0000001(UniqueID ParentChild Relationships)

The DocumentID associatedwith the first page of theparentdocument in most cases, this willbedata in theBEGATTACH field ) .

ABC0000001(UniqueID )

The Document ID number associated with first page of adocument

ENDBATES ABC0000003(UniqueID )

TheDocument ID numberassociatedwith the last page ofdocument.

BEGATTACH ABC0000001 (UniqueID Parent- Child

Relationships )

The Document ID with the firstpage of theparentdocument ( if applicable )

ABC0000008 (UniqueID Parent-Child

Relationships )

TheDocument mmberassociated with the last page of the lastattachment ( if applicable)

PGCOUNT 3 ( ) Thenumber of pages for a

VOLUME VOL001 Thenameof CD , DVD or HardDrive (vendor assigns).

USTODIAN The custodinn / source of . Note: If thedocuments arede-duped on a global level, this field will the name of eachcustodian the document originated .

14

FACEBOOK, INC. INVESTIGATIVE SUBPOENA FOR DOCUMENTS SET

C . OCR Acquired Text Files. When subjectingphysicaldocuments to an OCR process, thesettings ofthe OCR softwareshallmaximize text quality over process speed Any settings such as" auto- skewing"," auto-rotation" and the likeshouldbe turned on when documents are run through the process.

D Database Load Files/Cross-Reference Files. Documents shall be provided with (a) afile ( or )and ( ) an image load file ( opt), as detailed in Appendix A .

F . Unitizing ofDocuments. In scanning paper documents, documents shall notbemergedinto asingle record and singledocuments shallnotbesplit records (e , paper documents shouldbe logically unitized). In the case of an organized compilation of separate documents - for example, a

binder containing severalseparate documents numbered tabs - the documentbeluind tabshouldbe scanned separately, butthe relationship among the documents in thebinder should be reflectedin proper codingof the beginningand endingdocument and attachmentfields. Theparties willmake theirbest to unitize documents correctly.

15

FACEBOOK, INC. INVESTIGATIVESUBPOENA FOR DOCUMENTS( TWO]

APPENDIX A REQUESTED LOAD FILE FORMATFOR ESI

1 Image File All images, paper documents scanned to iniages rendered ESI, shallbe produced as 300 dpisingle -page, CCITT IV TIFF images (for black /white ) or JPGimages (for color) . Documents be uniquely and sequentially Bates numbered withendorsement burned into each image.

TIFF/JPG image file names shall includethe unique Bates burned into theimageEach Bates number shallbe a standard length , include leading zeros in the number and beunique for each produced page

TIFF/ JPG filesshall be named with a " or extensionshould be able to be OCR' d using standard COTS products, such asLexisNexis

LAW , Ipro, .

2 . Concordance Image Cross-Reference file Images shall be accompanied by a ConcordanceImage Cross-Reference file that associates each Bates number with its corresponding single-pageTIFF/JPG image file. The Cross Reference file should also contain the image file path for eachBates page.

Image Cross-ReferenceSampleFormat:ABC000001, OLS, \DatabaseName\ Image001ABC000001. TIF,ABC000002,OLS, D :\DatabaseName ABC000002. TIFABC000003 D : Image001ABC000003.ABC000004 DatabaseName ABC000004. TIF, Y

3 Concordance Load File: Images shall also be accompanied by a " text load file" containingtext (DAT file) that will populate fields in a searchable , flat database environment The

delimiters for the load file should be defaults .

Comma : ASCII ( ): character 254)

: ASCII character (174)

16

FACEBOOK , INC INVESTIGATIVESUBPOENA FOR DOCUMENTS SET TWO

APPENDIX B :REQUESTEDMETADATA FIELDS FOR ESI

PARENTDOCID ABC0000001 TheDocument ID number associated with(Unique ID Parent- Child the first page ofa parentdocument thisRelationships) field will only be populated in child

records) .ROUPID ABC0000001 TheDocument ID numberassociated with(Unique Parent-Child the page ofthe parentdocument (in

Relationships) most cases, thiswillbe data in theBEGATTACH field )

BEGBATES ABC0000001 (Unique ) The Document ID number associated with thefirstpageofa document

ENDBATES ABC0000003(Unique ) TheDocumentID numberassociatedwith thelastpageof document.

BEGATTACH ABC0000001(Unique Parent The DocumentID numberassociatedwith theChild ) pageofthe parentdocument.ENDATTACH ABC0000008 (Unique The Document numberassociatedwith the

ChildRelationsluips) last page of the lastattachment.PGCOUNT 3 (Numeric ) Thenumberofpages for a document.VOLUME The nameof CD ,DVD or Hard Drive (vendor

assigus)SENTDATE MM/DD/ YYYY The clate the emailwas sent. NOTE:

attachmentsto e- , field should bepopulatedwith the datesentofthetransmittingthe attachment.

SENTTIME HH:MM:SS The time the emailwas sentCREATEDATE MM /DD / YYYY The date the document was created .CREATETIME HH:MM :SS Thetime the document was created.LASTMODDATE /DD/ YYYY Thedate the was last modifiedLASTMODTIME MM :SS The time the document was lastmodifiedRECEIVEDDATE MM / DD /YYYY The date the docuinentwas received.RECEIVEDTIME HH:MM :SS documentwas received.FILEPATH / -mailInbox of the originaldocument. The source

JoeSmith E - /DeletedItems shouldbe the startofthe full pathJoe SmithLooseFiles/Accounting ..Joe Smith Files/ Documentsand Settings/ ..

APPLICATION Word,MS Excel, etc Type ofdocumentby applicationHIDDENTYPE Options: Track Changes, Hidden The type ofhiddenmodificationoftheSpreadsheet, Very Hidden document (eg. Changes, HiddenSpreadsheet, etc. Spreadsheet , Very Hidden Spreadsheet etc)

AUTHOR jsmith The authorofa documentfrom enteredmetadata.

17

FACEBOOK , INC INVESTIGATIVE SUBPOENA FOR DOCUMENTS SET TWO ]

Field Naine

FROM

Format

Joe Smith @ email. com >

TO Joe Smith @ email.com >tjones @ email. com

�� Joe emailcom

tjones @ email.

Description

The cisplaynameand e-mailof the authorofan e-mail. Ifonly e-mailisgiven, then justlist address. An e addressshould alwaysbeprovidedforeverydocument.

The displaynameand e-mailoftherecipient( s) of an e-mail. If only e-mailisgiven , then just list the e-mailaddress.mailaddress should alwaysbe provided for

document

The clisplaynameand e-mailofthe copyee(s)ofan e-mail. If only e-mail is given, then justlist the e-mailaddress. An e- mailaddressshould alwaysbeprovided for everydocument.The display and e-mail theblindcopyee(s) ofan e -mail. Ifonly e- isgiven , then just list the e- address. An

address always be provided forevery document.

The emailsubject line.The extracted document title orsubjectof adocumentThecustodian / sourceofa document. Note:If the documents are de-duped a globallevel, this fieldwillcontain thenameof eachcustodian which thedocumentoriginated.The of attachments to a document.

BCC Joe @ .comtjones@ email.com

Re: SchedulingMeetand ConferESUBJECT

DOCTITLE

CUSTODIAN

NumericATTACH

COUNTFILEEXTFILENAMEHASH

NATIVELINKFULLTEXT

XLS

DocumentName. xls

NATIVES ABC000001.xlsD :\ TEXT ABC000001 txt

| The extensionofa document.The filenameof a documentTheMD5 SHA- Hash value.The to a native copy of a document.The path to the fullextractedtextofthedocument. There should be a folder on thedeliverable, containinga separateUnicodetextfile perdocument. These text files shouldbenamedwith their batesnumbers. Note: Emails should includeheader information:

,recipient, cc bcc, date , subject, etc. Ifthe attachmentore -file doesnotextractanytext, then OCR for thedocument beprovided

18

FACEBOOK , INC. INVESTIGATIVE SUBPOENA FOR DOCUMENTS SET TWO ]

DECLARATIONOF SERVICE BY E -MAIL

Matter Name: In theMatter of the Investigation of: FACEBOOK , INC.

I declare:

I am employed in the Office of the Attorney General, which is the office of a member of theCalifornia State Bar, atwhichmember s direction this service ismade. I am 18 years of age orolder and not a party to this matter;my business address is 300 South Spring Street, Suite 1702,LosAngeles, CA .

On June 17 , 2019 I served the attached INVESTIGATIVE SUBPOENA FOR DOCUMENTS[ SET TWO ] by placinga true copy thereof enclosed in a sealed envelope with postage thereonfully prepaid, in the United States Mail atLos Angeles, California, addressed as follows:

Benjamin A. PowellMaury RigganWilmerHale

1875 Pennsylvania Avenue NW

Washington , DC20006Benjamin .Powell wilmerhale . com

Maury .Riggan @ wilmerhale . com

I declare under penalty ofperjuryunderthe lawsofthe State ofCalifornia the foregoingis trueand correctand thatthisdeclaration was executed on June 17, 2019, at Los Angeles, California

Carol Chow

Declarant Signature

SF2018400570

53504639 .docx

Exhibit B

BECERRA (SBN 118517 )Attorney General of CaliforniaNICKLAS A (SBN 211222 )Senior Assistant Attorney GeneralSTACEY D . SCHESSER (SBN 245735 )Supervising Deputy Attorney GeneralLISA B SBN 229369 )SUSAN SAYLOR ( 154592)

C . E . OSGOOD( SBN 255239)MANEESH SHARMA(SBN 280084)Deputy AttorneysGeneral

South Spring Street, Suite 1702LosAngeles, CA 90013Telephone: (213) 269-6369Lisa.Kim @ doj.ca. gov

BEFORE THEDEPARTMENTOF JUSTICE

OFFICE OF THEATTORNEYGENERALSTATE OF CALIFORNIA

In theMatter of the Investigation of:

FACEBOOK INC.INVESTIGATIVE INTERROGATORIES(SET TWO

GOV. CODE 11180 ET SEQ .

To Benjamin A . Powell, Esq.: You are hereby served on behalf of Facebook, Inc. pursuantto your agreement to accept service on your client sbehalf.

FACEBOOK, INC. INVESTIGATIVE INTERROGATORIES

Pursuant to thepowers conferred by Article 2 ofChapter 2 ofDivision 3 of Title 2 of the

Government Code of California (Cal. Gov. Code, 11180 et seq.)on the Attorney General, as

head of the California Departmentof Justice, which powers and authority to conduct the above

entitled investigation havebeen delegated to the undersigned, an officer of that Department,

FACEBOOK , INC.

IS HEREBY COMMANDED to answerseparately and fully in writing, underoath , within thirty

days of service hereof, each of the following interrogatories.

INSTRUCTIONS FOR COMPLIANCE

1. The RELEVANT PERIOD for these investigatory interrogatories is January 1,

2013 through December31, 2018, unlessotherwise expressly stated herein.

2. Each answermust be as complete and straightforward as the informationreasonably available to Facebook , Inc. (hereafter “FACEBOOK ), including the informationpossessed by FACEBOOK s attorneys or agents, permits. Ifan interrogatory cannot be answeredcompletely , answer itto the extent possible , specifying the reasons for FACEBOOK ' s inability toanswer the remainder of the interrogatory and stating whatever information , knowledge, or beliefthat FACEBOOK has concerning the unanswered portion thereof.

As used herein, the past tense includes the present and future tenses, the present

tense includes the past and future tenses, and the future tense includes the past and present tenses ;

tenses must beconstrued in the manner that would include, rather than exclude, information .

4. As used herein, the singular includes the plural and the plural includesthe singular,

and mustbe construed in themanner that would include, rather than exclude, information.

5. IfFACEBOOK is asserting a privilege or making an objection to an interrogatoryFACEBOOK mustspecifically assert theprivilege or state theobjection in FACEBOOK' swritten response, and set forth in detail thebasis for FACEBOOK s objection or assertion of the

privilege. If an objection pertains to only a portion ofan interrogatory, or a word ,phrase, orclause contained in it,FACEBOOK must respond to the remainder of the Interrogatory

FACEBOOK , INC . INVESTIGATIVEINTERROGATORIESSET TWO]

6. These Investigative Interrogatories have been issued in connection with aninvestigation within the scope ofsection 131ofthe California Penal Code

7 FACEBOOK's written responses shall be delivered to the California DepartmentofJustice,Office ofthe Attorney General, 1300 I” Street, Sacramento, CA 95814- 2919, ATTN:Deputy Attorney General Lisa B. Kim .

DEFINITIONS

For purposes ofthis set of investigatory interrogatories , the terms set forth below aredefined as follows:

8 has the samemeaning used athttps://developers.facebook.com /docs/apisand-sdks/ and liked webpages,and the similar software that existed in the past.

9. OTHERS USE” means the settings used to limit data accessible to THIRDPARTY APPLICATIONS that USERS' FRIENDS installed , as set out on page 19 et seq.oftheMarch 15 , 2019 letter from Benjamin A . Powellto Stacey D . Schesserand Lisa B . Kim .

10. “ AUDIENCE SELECTOR TOOL” means the settingusedto set the audience for" status updates, photosand other things you share," as explained athttps://www .facebook.com /help/120939471321735.

11. DATA CONTROLS” means thesettingsthat a USER can use to govern thesharingofUSER INFORMATION with third parties, including AUDIENCE SELECTORTOOLS,GRANULAR DATA PERMISSIONS, PLATFORM OPT-OUT, APPS OTHERS ,and the like.

. DEVELOPER POLICIES” means all of the POLICIES that FACEBOOKexpected DEVELOPERS to abide by, including FACEBOOK s Statement of Rights andResponsibilities , Termsof Service , Date Use Policy ,Platform Policy , and / or Data Policy .

13. “DEVELOPERS”meansanynatural or corporate personthat develops anapplication, game,orwebsite, that accesses information from FACEBOOK' s APIs or othersoftware .

14. EXTENDED APIACCESS PARTNERSHIP” means a partnership formed byagreementbetween FACEBOOK and a DEVELOPER that allowed access to certain

3

FACEBOOK , INC INVESTIGATIVE INTERROGATORIES SET TWO ]

1 FACEBOOK APIs on termsspecified within the agreement,such as FB-CA-CAAG -0002916,and beyond those termsoffered to typical THIRD PARTY APPLICATIONS on the FACEBOOKPlatform . This definition includes agreements performing the samegeneral function ,even ifnottitled as an Extended APIAddendum .

15. "EXTENDED API ACCESS PARTNER (S )”means the entity or entities withwhom FACEBOOK has an EXTENDED APIACCESS PARTNERSHIP

16. FACEBOOK PRODUCT" the socialnetworkingonlineservice operatedbyFACEBOOK, Inc. where USERS access content,including through THIRD PARTYAPPLICATIONS,websites,and games. Forpurposesof these interrogatories,FACEBOOKPRODUCTmeans contentaccessed onlineatwww.facebook .com and FACEBOOK 'smobileapplication,butdoesnot include acquired properties, such as Instagram and WhatsApp.

17. FRIEND”meansa USER who is connected to another USER on theFACEBOOK PRODUCT.

18. GRANULAR DATA PERMISSIONS” refers to the setting used to limit datashared with THIRD PARTY APPLICATIONS as set outat page4 etseq of the March 15, 2019letter from Benjamin A .Powell to Stacey D .Schesser and Lisa B. Kim .

19. “ INSTANTPERSONALIZATION”meansthe product that FACEBOOK offeredthatused FACEBOOK USER INFORMATION to providetailored andintegrated USERexperiences on select partners 'websites,as described by FACEBOOK in its December 18, 2018Newsroom post found online athttps://newsroom.fb .com /news/2018/12/facebooks-partners/,

20. INSTANTPERSONALIZATION PARTNER(S)”meansthe entity orentitieswith whom FACEBOOK partnered for INSTANTPERSONALIZATION

21. INSTANT PERSONALIZATION PARTNERSHIP ”meanstherelationshipFACEBOOK had with INSTANT PERSONALIZATION PARTNERS

22. “ INTEGRATION PARTNER (S)”means the entity or entities with whomFACEBOOK has an INTEGRATION PARTNERSHIP

23. INTEGRATION PARTNERSHIP(S)”means the relationship FACEBOOK haswith companies that built integrations for a variety ofdevices,operating systems,and otherFACEBOOK, INC. INVESTIGATIVE INTERROGATORIES SET TWO

1 products, as described by FACEBOOK in Appendix A of the July 20, 2018 letter Anjan Sahnisentto Stacey D . Schesser and Lisa B Kim .

24 . PLATFORM OPT-OUT” means the settingused to disable the FACEBOOKplatform as set out at page 10 et seq of the March 15, 2019 letter from Benjamin A . Powell toStacey D . Schesser and Lisa B Kim

25. “POLICY” “POLICIES” mean any formal or informal policy, procedure, rule,guideline ,collaborative document ,directive, instruction ,OR practice,whether written orunwritten, that YOU expect YOUR employees to follow in performing their jobs.

26 . “PROFILE CONTROLS” meansthe settings that control what information in aUSER s profile is shared with other USERS through AUDIENCE SELECTOR TOOLS, such asphonenumber, email, currentcity, birthday, relationship status,work, and education.

27. SHARE” or“SHARES” or “SHARING” “ SHARED”means to provide,communicate, transfer, release, disclose,disseminate, sell,rent,trade,OR otherwisemakeaccessible oravailable in writing, electronically, orby other means.

28. THIRD PARTY APPLICATION (S)” shall have the samemeaning as the termsPlatform Application(s)," application(s)" and " used in FACEBOOK 's policies produced

to the California Attorney General bearing the Bates Labels FB-AG -00000001 through FB -CACAAG -00000305.

29. USER (S)”meansthe individuals who maintain an account and can generallyaccess the typicalFACEBOOK experience via website or mobile application in a personalcapacity.

30. USER INFORMATION” meansany information related to the FACEBOOK

PRODUCTthat identifies, relates to describes, or is capable of being associated with , a particular

individual, including,but not limited to ,the following information :name;physical address ,including streetname and name of a city or town;telephone number; email address ;contact information , including a screen name,username, or social network profile that functionsasonline contact information ;user account credentials ; a persistent identifier such as a usernumberheld in a cookie or a processor serialnumber ; a unique device identifier or a universally

FACEBOOK, INC. INVESTIGATIVEINTERROGATORIESSET TWO]

uniqueidentifier,including FBID ; geolocation information, including GPS-based locationinformation and network -based or cell-based location information;longitude and latitudedata;education ;employment ;employment history and any other socialmedia content generated byOR associated with a particular individual, including statusupdates, likes,OR group affiliations.

31 YOU or “YOUR ” “ FACEBOOK ”means FACEBOOK , Inc and its past orpresent officers, agents , employees,attorneys, predecessors affiliates, subsidiaries ,parentcompanies ,former business names,and dbas, and anyone acting on YOUR behalfor at YOURdirection

INTERROGATORIES

INTERROGATORYNO. 24

Provide, for each year during the RELEVANT PERIOD,the number of FACEBOOKUSERSthat indicated that they currently resided in California.INTERROGATORY NO 25

Provide, for each year during the RELEVANT PERIOD, the default settings for each of the| following DATA CONTROLS:

AUDIENCE SELECTOR TOOL for status updates (e.g.,“Who can see yourfuture posts ? ;

(b) AUDIENCE SELECTOR TOOL for birthday ;( ) AUDIENCE SELECTOR TOOL for friends list;(d) AUDIENCE SELECTOR TOOL for email ;( AUDIENCE SELECTOR TOOL for who could search for and find a person s

profileby contact information;( ) GRANULAR DATA PERMISSIONS;(g) PLATFORM OPTOUT; and,(h) APPS OTHERSUSE.

FACEBOOK , INC. INVESTIGATIVE INTERROGATORIES TWO

INTERROGATORY NO . 26

Provide, for each year during the RELEVANT PERIOD the number of FACEBOOKUSERS in California , expressed as a total number and percentof totalUSERS (or in the UnitedStates, if California data not available ), who changed their default settings for each of thefollowing DATA CONTROLS:

(a ) AUDIENCE SELECTOR TOOL for status updates (e.g. “Who can seeyourfuture posts?

(b) AUDIENCE SELECTOR TOOL for Birthday ;( AUDIENCE SELECTOR TOOL for Friends List(d) AUDIENCE SELECTOR TOOL for email;( ) AUDIENCE SELECTOR TOOL for who could look -up a person ' s profileby

contactinformation;

(f) GRANULARDATA PERMISSIONS;

( g) PLATFORM OPT OUT; and,

(h) APPS OTHERSUSE.

INTERROGATORY NO 27

If a USER set their PROFILE CONTROLSto Friends Friends of Friends, OnlyMe,” explain what,ifany,non-public USER INFORMATION the followingentities could accessduring the RELEVANTPERIOD:

(a) A THIRD PARTY APPLICATION ;(b) An experience provided by an INTEGRATION PARTNERSHIP ;(c) A website using information under an INSTANT PERSONALIZATION

PARTNERSHIP

(d ) An application subject to an EXTENDED APIACCESS PARTNERSHIP ; and ,

(e) Any third party entity notcovered in the responses to subparts a ) through (d).

FACEBOOK, INC INVESTIGATIVE INTERROGATORIES (SET TWO]

INTERROGATORYNO . 28

Ifa USER disabled FACEBOOK' S platform for THIRD PARTY APPLICATIONSby

using the PLATFORM OPT-OUT setting, explain what, if any, non-public USER

INFORMATION the following entities could access during the RELEVANT PERIOD :

(a ) A THIRD PARTY APPLICATION ;

(b) An experience provided by an INTEGRATION PARTNERSHIP ;(c) A website using information under an INSTANT PERSONALIZATION

PARTNERSHIP;

(d) An application subjectto an EXTENDED APIACCESS PARTNERSHIP; and,( ) Any third party notcovered in the responses to subparts (a) through (d).

INTERROGATORY NO. 29If a USER sets their APPS OTHERS USE settings to minimize or eliminate data being

shared about a USER through FRIENDS, explain what, if any, non -public USERINFORMATION the following entities could access about a USER through FRIENDS thathadinstalled the entity 's relevant app ,website , game, or experience during the RELEVANTPERIOD:

(a ) A THIRD PARTY APPLICATION ;

(b) An experience provided by an INTEGRATION PARTNERSHIP ;( ) A website using information under an INSTANT PERSONALIZATION

PARTNERSHIP ;

(d) Anapplication subject to an EXTENDED APIACCESS PARTNERSHIP ; and ,(e) Any third party not covered in the responses to subparts (a) through (d).

INTERROGATORY NO 30

If USER implemented FACEBOOK 's DATA CONTROLS minimize the USERINFORMATION that is SHARED with others, including setting all PROFILE CONTROLS"Friends, disabling Platform through the PLATFORM OPT-OUT, and restricting all datasharing under the APPS OTHERS USE describe whatUSER INFORMATION each of thefollowing could access during the RELEVANT PERIOD:

8

FACEBOOK , INC INVESTIGATIVEINTERROGATORIES[SET TWO]

(a ) A THIRD PARTY APPLICATION ;

(b) An experience provided by an INTEGRATION PARTNERSHIP(c) A website using information under an INSTANT PERSONALIZATION

PARTNERSHIP

(d ) An application subject to an EXTENDED APIACCESS PARTNERSHIP ; and,

( ) Any third party not covered in the responses to subparts (a) through (d).INTERROGATORY NO 31

Provide the following information about any DEVELOPERS that could access non-publicUSER INFORMATION through theUSER despite the USER engaging the APPSOTHERS USE control:

Identity of the third party ;) What USER INFORMATION itcould access;

( ) Whether the third party could access data through FRIENDSofFRIENDS;(d) When the access began and ended ;

( ) The reasonsFACEBOOK allowed access to USER INFORMATION ; and,( disclosures provided noticetoUSERSthat their data could be shared in this

way

INTERROGATORY NO 32

Describethe process bywhich FACEBOOK reviewed ,developed, and approved changesto DATA CONTROLS during the RELEVANT PERIOD

INTERROGATORY NO. 33

Identify, by nameand team assignment, all the individuals at FACEBOOK whodeveloped and approved changes to Facebook DATA CONTROLS duringthe RELEVANTPERIOD .

INTERROGATORYNO. 34

Describe the review , evaluation, and testing of any new ormodified DATA CONTROLduring the RELEVANT PERIOD including how FACEBOOK tested or evaluated aUSER'

FACEBOOK, INC. INVESTIGATIVE INTERROGATORIES SET

response or understanding of a new ormodified DATA CONTROL through usability or A /Btesting.

INTERROGATORY NO.

Describe the coding rules that automatically identify and review apps that engage inacts that signal potentially abusive behavior identified on page 11of the July 20 , 2018 letterfrom Anjan Sahni to Stacey D . Schesser and Lisa B . Kim .INTERROGATORY NO . 36

State the number oftimes that the coding rules identified on page 11 of the July 20 ,2018 letter from Anjan Sahnito Stacey D . Schesser and Lisa B.Kim , detected a potential abuseofFACEBOOK DEVELOPER POLICIES during the RELEVANT PERIOD, broken down byyear and for each instance explain who the DEVELOPER was and what coding rule wasimplicated

INTERROGATORY NO 37

For each year during the RELEVANTPERIOD, state the number oftimes thatFACEBOOK received a report of a potential violation of itsDEVELOPER POLICIES by aDEVELOPER from each of the following sources: (a)USERS; (b) FACEBOOK employees ; (c)the press; and (d) security or white-hat researchers.INTERROGATORY NO 38

Explain the term “ shielded app, that term is used in the documentbearing the BateslabelFB-CA- CAAG-00037551

INTERROGATORYNO . 39

Describe themanner in which YOU enforced DEVELOPER POLICIES on DEVELOPERSof“ shielded apps, as that term is used in the document bearing the Bates labelFB-CA -CAAG00037551. Please identify any differences in the manner in which YOU enforced DEVELOPERPOLICIES,or any other applicable POLICIES,against shielded apps”as compared to otherTHIRD PARTY APPLICATIONS.

10

INVESTIGATIVE INTERROGATORIES SET TWO]FACEBOOK, INC

INTERROGATORYNO 40

For each year during the RELEVANT PERIOD , specify how many enforcement actionsYOU undertook in each ofthe following categories identified in the enforcement rubric set forthin the documentbearing the Bates labelFB-CA-CAAG -00019954

(a ) Surface or escalate to point of contact;(b) Warning of any length );( ) Moratorium ;

( ) Removal from approved advertiser list;( Disable credits(f) Disable; and( ) Escalate to Legal for a cease and desist letter.

INTERROGATORYNO. 41

Identify all instances when FACEBOOK deviated itsresponse from the recommended

14 action ” for each perceived violation ofDEVELOPER POLICIES , as set forth in the documentbearing the Bates label FB-CA -CAAG -00019954 . For each instance , state the action taken ,andthe reason why FACEBOOK deviated itsresponse .INTERROGATORY NO .42

Describewhat steps FACEBOOK took, ifany, to ensure that applications created pursuantINTEGRATED PARTNERSHIP or an EXTENDED APIACCESS PARTNERSHIP did

notaccess or use data for any purpose other than what was authorized byFACEBOOK ' sagreements with the partner

INTERROGATORY NO 43

For each year during 2013 to 2017, state how many timesFACEBOOK has suspended ordisabled access to USER INFORMATION by THIRD PARTY APPLICATIONS ,ortheirDEVELOPERS , for violation of the following DEVELOPER POLICIES requirements :

Developers shall: only request the data needed to operate their application; onlyuse the data received from Facebook for their application;obtain explicit consent

FACEBOOK, INC. INVESTIGATIVE INTERROGATORIES SET TWO]

from the userwho provided thedata to Facebook beforeusing it for any purposeother than displaying back to the user;Developers shallnot: transfer any data that they receive from Facebook; sell userdata; use Facebook user IDs for any purpose outside of their applications use auser 's friend list outside of their application ; access a user 's friend list when afriend connects with that app; if friend grants specific permission, use thatcontentand information other than in connection with that friend.

INTERROGATÓRY 44

· Has FACEBOOK ever suspended or disabled access to USER INFORMATION by an

INTEGRATED PARTNER, EXTENDED API ACCESS PARTNER, or INSTANTPERSONALIZATION PARTNER because the DEVELOPER appeared to haveviolated eitherFACEBOOK ' DEVELOPER POLICIES regarding USER INFORMATION or the partiesagreementregarding USER INFORMATION? If so, please identify the DEVELOPER,thedetailsof the suspected violation ,and how FACEBOOK learned of the suspected violation .INTERROGATORY NO 45

Excluding 1) USERS , 2) INTEGRATED PARTNERS, 3) INSTANTPERSONALIZATION PARTNERS, and 4 ) THIRD PARTY APPLICATION DEVELOPERSoperating under FACEBOOK ' s DEVELOPER POLICIES, identify any other persons entities

to FACEBOOK granted access to USER INFORMATION ,by:

(a) The name of the third party ;(b) The USER INFORMATION available to the third party ;(c) The reason the third party was granted access; and,(d) The dates that access began and ended .

INTERROGATORY NO 46

Describe the different FACEBOOK APIs that DEVELOPERS could use to access USER

| INFORMATION during theRELEVANT PERIOD.

12

FACEBOOK, INC. INVESTIGATIVEINTERROGATORIES SET

INTERROGATORYNO . 47

Identifythe APIs thateach ofthefollowingentities coulduse to accessUSERINFORMATION during the RELEVANT PERIOD:

(a ) A DEVELOPER of a THIRD PARTY APPLICATION ;

(b) An INTEGRATION PARTNER ;

) An INSTANTPERSONALIZATION PARTNER; and,(d) An EXTENDED API ACCESS PARTNER .

INTERROGATORYNO. 48

Did FACEBOOK ever factor a DEVELOPER advertising purchase history or amountspent into thedecision to enter into, continue,or terminate an EXTENDED ACCESSPARTNERSHIP ? Ifso ,please describe the circumstancesINTERROGATORY NO 49

Did FACEBOOK ever factor a DEVELOPER ' s advertising purchase history or amountspent into the decisions as to what capabilities or access to USER INFORMATION to grantpursuant to an EXTENDED APIACCESS PARTNERSHIP ? If so, please describe thecircumstances

INTERROGATORYNO. 50

Describe FACEBOOK s history of auditing the use orhandling ofUSER INFORMATIONby DEVELOPERS, including whether FACEBOOK ever considered conducting audits , actuallyconducted any audits ,and , ifso ,what it found. Please exclude: (A )information regarding an

13

FACEBOOK , INC. INVESTIGATIVE INTERROGATORIES ( TWO]

individual investigation into a particular DEVELOPER S ofdata, and (B ) information abouttheADIprocess previously disclosed byFACEBOOK

FAILURE TO COMPLY WITH THIS SUBPOENA WILL SUBJECT YOU TO THEPROCEEDINGS AND PENALTIES PROVIDED BY LAW .

Dated: June 17, 2019XAVIER BECERRAAttorney General of CaliforniaNICKLAS A . AKERSSenior Assistant Attorney GeneralSTACEY D . SCHESSERSupervising Deputy Attorney GeneralLISA B . KIMSUSAN SAYLOR

C . E . OSGOODMANEESH SHARMADeputy Attorneys General

DeputyAttorneyGeneral

14

FACEBOOK , INC. INVESTIGATIVEINTERROGATORIES

DECLARATION OF SERVICE BY E-MAIL

Matter Name: In theMatter of the Investigation of: FACEBOOK, INC.I declare:

I am employed in the Office of the Attorney General, which is the office ofamember of theCalifornia State Bar, at which member s direction this service ismade. I am 18 years of age orolder andnot a party to thismatter mybusiness address is 300 South Spring Street, Suite 1702,LosAngeles, CA 90013.

On June 17, 2019, I served the attached INVESTIGATIVEINTERROGATORIESTWO] by placinga true copy thereofenclosed in a sealed envelopewith postage thereon fullyprepaid, in the United StatesMailat LosAngeles, California, addressedas follows:

Benjamin A . PowellMaury RigganWilmerHale1875 Pennsylvania AvenueNWWashington, DC 20006Benjamin.Powell @ wilmerhale. comMaury.Riggan @ wilmerhale.com

I declare under penalty ofperjury under the lawsof the State of California the foregoing is trueand correct and that this declaration was executed on June 17, 2019, atLos Angeles, California .

CarolChow

DeclarantSignature

SF2018400570

53504613. docx