Locke Lord QuickStudy: When Half a Billion Dollars is Not Enough: What the Facebook Settlement Can Teach Us

On August 19, 2020, the U.S. District Court for the Northern District of California granted ‎preliminary approval to a $650 million settlement ‎of claims against Facebook, Inc. for alleged ‎violations of the Illinois Biometric Information ‎Privacy Act (“BIPA”). This came two months ‎after the judge strongly rejected a proposed $550 million settlement as insufficient. The ‎settlement – estimated to pay each class member between $200 and $400 – is record-breaking in ‎amount even though it is still significantly below the statutory damages of $1,000 and $5,000 ‎provided by BIPA. In addition to the settlement amount, the ‎Facebook litigation, and the court’s ‎rejection of the original half-billion dollar proposed settlement, will likely provide a roadmap for ‎other consumer-privacy class actions in the future, whether under BIPA, the California Consumer ‎Privacy Act (“CCPA”) or other similar statutes.

Plaintiffs claimed Facebook violated BIPA by creating facial templates from scanned photos.

The plaintiffs’ claims arose from Facebook’s use of the “Tag Suggestions” feature, which used facial recognition software to scan uploaded photos and create a template of people’s faces. Facebook used the templates to identify individuals in other photos and suggest that a user “tag” that person, i.e., create a link to their Facebook profile.

The complaint, filed in 2015, alleged that the “Tag Suggestions” program violated BIPA’s notice-and-consent requirement. See 740 ILCS 14/15(a) and (b) (prohibiting private entities from obtaining or using an individual’s biometric information without providing notice and obtaining written consent). The plaintiffs did not allege any actual harm, like the theft or misuse of their personal information by a third-party, but instead claimed that they were entitled to BIPA’s statutory damages of $1,000 or $5,000. See 740 ILCS 14/20.

The parties exhaustively litigated, leaving few legal questions unresolved. 

Multiple class actions against Facebook were eventually consolidated in the Northern District of California, where the parties vigorously litigated the case for over five years. In that time, the district court denied Facebook’s motions to dismiss and for summary judgment and granted plaintiffs’ motion for class certification, specifically finding that a statutory violation is an invasion of privacy sufficient to create standing to sue under both Article III and BIPA.

Facebook appealed the class certification decision to the Ninth Circuit under Rule 23(f), and the Ninth Circuit affirmed the district court’s finding of standing and order certifying a class. Patel v. Facebook, Inc., 932 F.3d 1264, 1267 (9th Cir. 2019), cert. denied, 140 S. Ct. 937, 205 L. Ed. 2d 524 (2020). The Ninth Circuit agreed that BIPA did not require a plaintiff or class member to show any concrete injury beyond a statutory violation, either to establish Article-III standing or to recover under the statute. Facebook, 932 F.3d at 1274–75. 

Facebook petitioned the U.S. Supreme Court for a writ of certiorari, but the Supreme Court denied the petition on January 21, 2020. Eight days later, on January 29, 2020, the New York Times reported that the parties entered into a settlement that requires Facebook to pay $550 million to eligible Illinois users as well as for the plaintiffs’ legal fees. See Natasha Singer and Mike Isaac, Facebook to Pay $550 Million to Settle Facial Recognition Suit, N.Y. Times, Jan. 29, 2020.

The court rejected the initial settlement, leading to an extra $100 million.

On June 4, 2020, the court held the first hearing on preliminary approval of the $550 million settlement, which would have resulted in a payout of $150 and $300 per class member. While the parties praised the agreement at the time, the court plainly stated that the settlement amount was insufficient as it would only give class member 1.25% of the maximum damages prescribed by BIPA. The court also focused on other elements of the settlement, like the form of the notice, the scope of the release, and the contemplated conduct remedy.

The court scheduled a second hearing for July 23, 2020 so that a Facebook employee could testify on some of the technical aspects of the settlement. On the night before the hearing, the parties filed a notice of an amended settlement. In addition to addressing the court’s concerns on the non-monetary elements of the agreement, the parties stated that the settlement fund would be increased by $100 million to a total of $650 million. The settlement fund was also augmented by the plaintiffs’ counsel agreement to reduce their attorney fees from 25% to 20% of the $550 million settlement fund and 0% of the additional $100 million.  As a result, the parties anticipate that each class member would receive between $200 and $400.

The parties’ efforts were enough, leading the court to preliminarily approve the settlement on ‎August 19, 2020. At the July 23 hearing, the court noted that most of its initial concerns were ‎addressed by the changes, including the monetary component of the agreement. The court spent ‎most of the hearing asking questions about another outstanding concern: the claims rate or the ‎number of people who ask for money from the settlement. Most class settlements have a claims ‎rate of less than 5% of the total class. The court specifically stated that he wanted the parties to ‎get to a “record-breaking” claims rate, through “splashy,” attention-grabbing notices. 

The Facebook settlement will likely lead to increased scrutiny of data privacy settlements.

Although the Facebook litigation is unique in several respects (high statutory damages; exhaustive litigation and appeals before settlement), the court’s initial rejection of a half-billion dollar settlement and demand for a “record-breaking” claims rate will almost certainly lead to increased scrutiny in data-privacy class action settlements, as well any class action involving claims for statutory damages. For instance, it may signify an upward trend of settlement values and insistence on higher claims rates. 

Class-action claims processes are often cumbersome, often asking for a claimant to respond to a confusing and lengthy questionnaire and provide information that may be entirely irrelevant. The Facebook litigants came up with a new process that can be completed in a matter of seconds instead of minutes.  

Parties and courts will likely try different and more attention-grabbing class-settlement notices than have historically been used. While the Facebook notice is unique due to Facebook’s ability to use its own platform in order to reach potential claimants, class-action notices in other cases will likely continue the trend towards more electronic notice.

Regardless of the court’s ultimate decision on the motion for preliminary or final approval, future ‎litigants will likely look to the Facebook litigation for guidance before filing their own motion for ‎preliminary approval of the class action settlement.