Facebook will pay $650 million and change its data privacy practices as part of a record-breaking settlement that will end a six-year legal battle over its alleged violations of an Illinois privacy law.
SAN FRANCISCO (CN) — A federal judge signaled Thursday that he will likely approve the largest known privacy settlement in U.S. history, despite arguments that the payout is far less than Facebook’s potential $47 billion in liability.
“The violations here did not extract a penny from the pockets of the victims, but this is real money that Facebook is paying to compensate them for the tangible privacy harms that they suffered,” U.S. District Judge James Donato said during a hearing on a motion for final approval of the deal.
The $650 million settlement resolves claims that Facebook mapped Illinois users’ faces for its “Photo Tag Suggest” function starting in 2011 without consent and without telling them how long their facial data would be stored in violation of the Illinois Biometric Information Privacy Act of 2008.
The Illinois privacy law carries civil penalties of $1,000 for each negligent violation and $5,000 for each knowing violation. With a class of at least 7 million Illinois Facebook users, damages could have reached as high as $47 billion.
Facebook first agreed to settle the case for $550 million nearly a year ago, but later boosted the award to $650 million after Judge Donato told lawyers this past June that he found the prior deal inadequate.
During a virtual court hearing Thursday, class counsel Paul Geller argued the deal far exceeds previous record-breaking data privacy settlements, including the $117 million Yahoo data breach settlement, the $195 million Home Depot data breach settlement and the Equifax data breach settlement, valued at $380 million mostly in credit monitoring services with only $31 million in cash.
“Anthem, Yahoo, Equifax all claimed to be the largest privacy settlements at the time they were settled,” Geller said. “Nowhere comes close to the settlement in this case.”
A lawyer for opponents of the deal insisted the settlement should not be viewed in comparison to prior deals but rather matched against the total amount of damages Facebook would have to pay if it lost at trial.
“Examine the settlement not in terms of its very impressive numbers in terms of gross dollars but the settlement value versus the potential value,” attorney Kendrick Jan said.
In defending the deal, Geller highlighted the risks plaintiffs would face if they brought the case to trial. He noted that Facebook had strong arguments that it did not use facial geometry to identify faces in photos, a prerequisite for the Illinois privacy law to apply. Facebook also planned to contend that an exception for photographs in the Illinois law means its collection of biometric data from digital pictures was not illegal.
Facebook intended to argue that because its servers are located outside of Illinois, it could not be held liable for alleged violations that occurred out of state. Another factor in Facebook’s favor was the popularity of its “photo tag suggest” function among users who knowingly uploaded photos to the platform.
One of the named plaintiffs even admitted in a deposition that he “loved the feature and would continue using it,” Geller said.
An additional risk looming over the case was an onslaught of big tech lobbyists descending on Illinois lawmakers. The lobbyists were aggressively fighting to change the statute retroactively and to make clear that the law’s photograph exception applies to digital photos, Geller said.
Facebook attorney Michael Rhodes said Facebook had another strong argument on its side — that the company told Facebook users about its “photo tag suggest” feature several months in advance and instructed them how to opt out of it.
“There was a real possibility in my mind that we either win on consent or we convince the jury even if we didn’t get consent right, we were trying to get consent,” Rhodes said.
Also on Thursday, Donato was asked to approve an attorneys’ fees award of $110 million, or 16.9% of the total settlement, for plaintiffs’ lawyers. The fees will be deducted from the $650 million settlement fund.
Geller said the requested fees award is far below the 25%-of-settlement benchmark, which the Ninth Circuit has approved in other cases. He added that attorneys took a big risk in fighting a six-year legal battle against one of the world’s largest technology companies.
Donato questioned why a somewhat smaller award would not suffice to reward the lawyers for their hard work and risk taking.
“I don’t think anybody would say getting $75 million above and beyond your actual fees is a small amount,” Donato said.
The judge said he will issue a written ruling on the settlement and fees award within the next few weeks.
About 1.6 million Illinois Facebook users submitted claims as part of the settlement. If approved, each claimant will receive about $342.
As part of the deal, Facebook also pledged to turn facial recognition off as the default setting for all users and to delete existing face templates unless it gets express consent from a user, with exceptions for those who turned facial recognition on or signed up after Sept. 23, 2019, when Facebook changed its privacy practices and policies.
The company will also delete face templates for users who are inactive on Facebook for three years.