More than 1.5 million Illinois Facebook users will receive at least $345 each under the terms of the landmark deal.
SAN FRANCISCO (CN) — A federal judge gave his final blessing Friday to a $650 million deal to resolve claims that Facebook illegally collected and stored users’ facial data without consent, making it one of the largest privacy-related settlements in U.S. history.
“Overall, the settlement is a major win for consumers in the hotly contested area of digital privacy,” U.S. District Judge James Donato wrote in a 21-page ruling.
The approval comes more than five years after lead plaintiff Nimesh Patel sued Facebook in one of three consolidated class actions in 2015, claiming the social network started mapping users’ faces for its “Photo Tag Suggest” function in 2011.
The plaintiffs say Facebook did so without their permission and failed to inform them how long their data would be stored as required by the Illinois Biometric Information Privacy Act of 2008.
The Illinois statute carries civil penalties of $1,000 for each negligent violation and $5,000 for each knowing violation. With a class of potentially 7 million Illinois Facebook users, damages could have reached up to $47 billion.
That high ceiling on Facebook’s potential liability was the focus of two objections arguing that the settlement amount is far too modest compared to what the company would have to pay if it lost at trial.
At a hearing last month, one objecting lawyer implored Donato not to focus on the “impressive” total but rather to look at the “settlement value versus the potential value.”
Donato considered those arguments in his ruling Friday, but found the objectors failed to account for major risks the plaintiffs would face if the case went on, including the possibility that the Supreme Court might overturn his prior finding that a privacy violation is a concrete injury that gives plaintiffs standing to sue in court.
Facebook and other technology companies recently filed a friend-of-the-court brief in a pending Supreme Court case, Trans Union LLC v. Ramirez, arguing that plaintiffs cannot sue a company for a mere violation of law unless it causes them to suffer concrete harm, such as a loss of money, property or a job opportunity.
“This underscores the considerable legal risks both sides would have faced had this case continued on,” Donato wrote.
The judge also identified other significant obstacles to winning at trial, including disputes over whether Facebook could be held liable because its servers are located outside of Illinois, whether its technology scans facial geometry to recognize faces, whether it obtained users’ consent to collect and store their data and whether it had a “good-faith belief that its actions were permissible” under the law.
“These would be major factual disputes for the jury to decide on the basis of highly contested evidence,” Donato wrote.
The judge added that a multibillion-dollar verdict also posed risks that a court might find the penalty out of proportion with the harm suffered by class members or the harm that Illinois lawmakers sought to remedy in passing the privacy law.
Donato also approved a $97.5 million attorneys’ fees award for plaintiffs’ class lawyers, less than the $110 million requested. Additionally, the judge approved reimbursing class lawyers $915,500 in litigation costs. That money will be deducted from the $650 million settlement fund.
Facebook first agreed to settle the case for $550 million in January 2020, but it later boosted the award to $650 million after Judge Donato told lawyers in June last year that he found the prior deal inadequate.
More than 1.5 million Illinois Facebook users filed settlement claims. Each claimant will receive at least $345.
As part of the deal, Facebook also pledged to turn facial recognition off as the default setting for all users and to delete existing face templates unless it gets express consent from a user, with exceptions for those who turned facial recognition on or signed up after Sept. 23, 2019, when Facebook changed its privacy practices and policies. The company will also delete face templates for users who are inactive on Facebook for three years.
Plaintiffs’ attorney Paul Geller echoed Donato’s comments that the settlement is a “major win for consumers” and digital privacy rights. He said Facebook fought the lawsuit at every turn, including in a Ninth Circuit appeal that was rejected in August 2019.
“Ultimately we achieved not only a landmark, record-breaking monetary result — it’s a much better settlement than any other privacy case in history, including cases like Equifax where the class was magnitudes larger but the cash was much less — but also of the record-breaking take rate by class members,” Geller said in an email. “We set a new bar for consumer class actions.”
Equifax settled claims over a 2017 data breach that exposed the private information of nearly 150 million people for $700 million, but only $425 million of that went to compensate consumers.
A Facebook spokesperson said the company is satisfied with Judge Donato’s decision to approve the deal.
“We are pleased to have reached a settlement so we can move past this matter, which is in the best interest of our community and our shareholders,” the company said in an emailed statement.