But U.S. District Court Judge Phyllis Hamilton in the Northern District of California also ruled that the users can’t seek monetary damages on a class-wide basis, because assessing damages requires case-by-case decisions. Instead, they can seek to obtain a declaratory judgment that Facebook violated privacy rules, and potentially obtain an injunction requiring the company to revise its practices or disclosures.

The ruling, issued last week, stems from a lawsuit initially brought in late 2013 by Matthew Campbell and Michael Hurley. They alleged that Facebook scans users’ messages to each other, in order to determine whether people are sending their friends links to outside sites.

Campbell, an Arkansas resident, and Hurley, of Oregon, said Facebook interprets links within users’ messages to each other as “Likes,” then includes them in the total number of “Likes” that appear on the publishers’ pages via social plug-ins.

The lawsuit also alleges that Facebook scans messages for URLs and then draws on that information in order to personalize the service. Facebook also allegedly shares data about in-message URLs with third parties for ad purposes.

Some of the allegations in the lawsuit first emerged in 2012, when security researcher Ashkan Soltani reported that Facebook interprets links within users’ messages to each other as “likes,” and includes them in like-counters that appear on publishers’ pages.

Facebook told The Wall Street Journal at the time that no private information is exposed, but confirmed that the Like-counter “reflects the number of times people have clicked those buttons and also the number of times people have shared that page’s link on Facebook.”

Facebook argued to Hamilton that the case shouldn’t move forward as a class-action for several reasons, including that some users implicitly consented to the company’s practices.

But Hamilton rejected that argument. “Individual issues of implied consent do not predominate over common ones,” she wrote.