A federal appeals court on Thursday revived nationwide litigation accusing Facebook Inc of violating users’ privacy rights by tracking their internet activity even after they logged out of the social media website.

The 9th U.S. Circuit Court of Appeals in San Francisco said Facebook users could pursue several claims under federal and California privacy and wiretapping laws.

A spokeswoman for Facebook said the proposed class action was without merit, and the Menlo Park, California-based company will continue defending itself.

Facebook users had accused the company of quietly storing cookies on their browsers that tracked when they visited outside websites containing “like” buttons, and then selling personal profiles based on their browsing histories to advertisers.

U.S. District Judge Edward Davila in San Jose, California had dismissed the lawsuit in 2017, including claims under the federal Wiretap Act, and said the users lacked legal standing to pursue economic damages claims.

But in Thursday’s decision, Chief Judge Sidney Thomas wrote for a three-judge panel that users had a reasonable expectation of privacy, and had sufficiently alleged a “clear invasion” of their right to privacy.

The panel also said California law recognized a right to recoup unjustly earned profits, regardless of whether a defendant’s conduct directly caused economic harm.

“Facebook’s user profiles would allegedly reveal an individual’s likes, dislikes, interests, and habits over a significant amount of time, without affording users meaningful opportunity to control or prevent the unauthorized exploration of their private lives,” Thomas wrote.

Citing Facebook’s data use policy, he also said the plaintiffs “plausibly alleged that Facebook set an expectation that logged-out user data would not be collected, but then collected it anyway.”