DiCello Levitt secures novel damages model for consumers; settlement is among the ten largest data privacy class action settlements in U.S. history.

On February 14, 2022, Meta Platforms, Inc., the parent company of Facebook, agreed to pay $90 million to settle high-profile, long-running data privacy litigation over its use of tracking “cookies” in 2010 and 2011 to track subscribers’ internet use even after they had logged off the Facebook platform. The settlement, preliminarily approved by the U.S. District Court for the Northern District of California on March 31, 2022, will rank as one of the ten-largest data privacy settlements in U.S. history, in a case that had already established important precedent for future data privacy litigation. As part of the settlement, Facebook also agreed to sequester and delete all the data at issue, which is believed to be unprecedented in a data privacy class action.

Filed in 2012, the case focuses on Facebook’s use of proprietary plug-ins to track users’ internet browsing on third-party sites. Facebook obtained consent to track subscribers while logged in but promised to stop the tracking once the subscriber logged out. The class action alleged that Facebook continued to track users’ browsing activity even after they had logged off the social media platform.

Even before the settlement, the case had already created significant law favoring consumers in future data privacy actions. In a 2020 opinion in this litigation, the U.S. Court of Appeals for the Ninth Circuit held that the unlawful copying and monetization of personal data creates “economic harm,” even if the value of the data in plaintiffs’ hands does not diminish as a result. The finding of economic harm is vital to plaintiffs seeking monetary damages. Lower federal courts had been split on the critical issue, with some requiring a showing that the value of the data in question diminished. The Ninth Circuit also ruled that Facebook was not a party to the communication that it allegedly intercepted for purposes of the Wiretap Act, meaning that its data collection required actual user consent. Facebook appealed the rulings to the U.S. Supreme Court, which, last year, declined to review the case, allowing the Ninth Circuit’s decision to stand.

The settlement sets a new bar for data privacy lawsuits. Plaintiffs believe the $90 million settlement fund, no part of which will revert to Facebook, represents at least 100% of any unjust profits earned on the data at issue. The injunctive relief, meanwhile, requires Facebook to sequester and eventually delete all data that the plaintiffs alleged was wrongfully collected during the class period. The agreement to delete data is the “gold standard” for non-monetary relief in data privacy class actions of this kind.

The deadline to submit claims is September 22, 2022, and the final approval hearing is set for October 27, 2022.