A federal appeals court ruled in San Francisco today that Facebook users can go ahead with breach-of-contract and fraud claims against the online social network for allegedly allowing advertisers to obtain their personal information in 2010.

A three-judge panel of the 9th U.S. Circuit Court of Appeals reinstated those claims in a lawsuit filed against Menlo Park-based Facebook Inc. in federal court in San Jose in 2010. It overruled a decision in which now-retired U.S. District Judge James Ware dismissed those claims in 2011.

The lawsuit alleges that at least between February and May of 2010, Facebook violated its privacy promises by providing advertisers with headers revealing the user information of people who clicked on Facebook ads.

The privacy policy at the time stated that Facebook gave advertisers “anonymized” or generic information about users, but did not provide personal information.

The appeals court said the allegations that users were harmed by the dissemination of their personal information were “sufficient to show the element of damages for their breach-of-contract and fraud claims” and thus allow a trial.

The court also ruled, however, that users could not pursue a related claim that Facebook and social game company Zynga Inc. of San Francisco violated the U.S. Electronic Communications Privacy Act.

The privacy law prohibits unauthorized disclosure of the contents of online communications, but the appeals court said the header information allegedly revealed by the two companies “does not constitute the contents of a communication.”

Unless either side appeals, the case will now go back to the federal trial court in San Jose, with a new judge to be assigned to replace Ware.

Kassra Nassiri, a lawyer for two Californians who sued Facebook, called the decision a victory for users.

“I think it is a great outcome for consumers. We will be able to pursue the claim that Facebook violated its privacy promises,” he said.

The lawsuit, originally filed by Facebook users Mike Robertson of Marin County and David Gould of South Lake Tahoe, seeks to be certified as a class action on behalf of an unspecified “millions” of users allegedly affected by the policy.

At the time the lawsuit was filed, Facebook had more than 500 million users worldwide. It now has 1.28 billion, according to its financial report for the first quarter of 2014.

Nassiri said no decision has been made on whether his clients will appeal the dismissal of the federal Electronic Communications Privacy Act claim.

He said that although the remaining breach-of-contract and fraud claims were made under state law, he expects the case to remain in federal court.

A spokesperson for Facebook was not immediately available for comment.

Facebook reportedly stopped giving advertisers user identification information after its practices were described in a Wall Street Journal article and in a posting on a Harvard Business School professor’s website in May 2010, according to the lawsuit.