In re Facebook Biometric Information Privacy Litigation

4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA IN RE FACEBOOK BIOMETRIC Case No. 15-cv-03747-JD INFORMATION PRIVACY LITIGATION ORDER GRANTING PRELIMINARY 9 APPROVAL OF CLASS ACTION SETTLEMENT Re: Dkt. Nos. 445, 468 12 Plaintiffs Nimesh Patel, Adam Pezen and Carlo Licata brought this consolidated class action lawsuit against defendant Facebook, Inc., for violations of the Illinois Biometric Information Privacy Act (BIPA), 740 Ill. Comp. Stat. 14/1 et seq. (2008). On the eve of a trial setting conference in February 2020, the parties reported that a settlement in principle had been reached between the class and Facebook. After an extended hearing, the Court denied plaintiffs’ initial motion for preliminary approval of the class action settlement over serious concerns about the fairness of several terms to class members and the overall adequacy of proposed relief, including the amount of damages to be paid to the victims of Facebook’s conduct.

20 The parties filed supplemental briefs renewing their preliminary approval request, and negotiated revisions to the proposed settlement to address the Court’s concerns. The Court held another hearing in July 2020, and took live testimony from Facebook’s Face Recognition Product Manager on several issues related to the adequacy of the proposed notice to the class and the class definition. The revised settlement agreement and additional information presented by the parties have resolved the Court’s concerns. Consequently, preliminary approval of the class action settlement is granted.

1 BACKGROUND 2 The consolidated complaint in this case alleges that Facebook violated Sections 15(a) and 15(b) of BIPA by collecting and storing the class members’ biometric data in the form of scans of their faces without prior notice or consent. Dkt. No. 40. Facebook harvested the scans in connection with its “Tag Suggestions” program, which looks for and identifies people’s faces in photographs uploaded to Facebook to promote user tagging. Id. 7 The case was litigated fiercely for over five years, with no legal pebble left unturned.

8 Early on, Facebook sought to terminate the case on choice-of-law grounds, saying that California and not Illinois law applied to the class’s claims. Dkt. No. 69. After an evidentiary hearing, the Court determined that Illinois law applied and that plaintiffs had stated a claim under BIPA. Dkt.

11 No. 120. Facebook then sought to dismiss the case under Rule 12(b)(1) for lack of Article III standing under Robins v. Spokeo, Inc., 867 F.3d 1108, 1112 (9th Cir. 2017). Dkt. No. 227. The Court concluded that plaintiffs had alleged a concrete and actual injury in fact under BIPA that was sufficient to confer standing. Dkt. No. 294. After that, the parties vigorously contested plaintiffs’ motion to certify a class, which the Court resolved by granting certification. Dkt. No. 333. The Court then took up the parties’ cross-motions for summary judgment, which were denied pursuant to the Court’s previous interpretations of BIPA and other points of Illinois law, and the presence of multiple genuine disputes of material fact. Dkt. No. 372. After the Court ordered pre-trial notice to the certified class, Dkt. No. 402, but before the notice had gone out, the Ninth Circuit granted Facebook permission to appeal the class certification decision, and the district court proceedings were stayed in the interim. Dkt. No. 406. In August 2019, the Ninth Circuit published an opinion affirming the class certification order. Dkt. No. 416. While these events were unfolding, the Illinois Supreme Court published a decision interpreting BIPA that largely adopted the Court’s construction of the statute. See Rosenbach v. Six Flags Entm’t Corp., 129 N.E.3d 1197 (Ill. 2019).

26 Just as the case was about to be set for a jury trial, the parties advised the Court that a settlement in principle had been reached. Dkt. No. 427. A motion for preliminary approval of denied preliminary approval without prejudice for multiple reasons, including concerns about an unduly steep discount on statutory damages under the BIPA, a conduct remedy that did not appear to require any meaningful changes by Facebook, over-broad releases by the class, and the sufficiency of notice to class members. Dkt. No. 456. The parties went back to negotiations, which yielded a substantially revised proposed settlement agreement for which the parties now request preliminary approval. Dkt. Nos. 462, 465, 468. The Court held another approval hearing on July 23, 2020, which also featured live testimony by Gary McCoy, the current Product Manager of Facebook’s Face Recognition product team. See Dkt. No. 470.

9 In addition to other changes in the revised agreement, Facebook will pay $650,000,000.00 (six hundred and fifty million dollars) into a non-reversionary cash fund. Dkt. No. 468, Ex. A at 9 (¶ 1.30). From this fund, settlement administration expenses, taxes, and any class representative incentive awards and counsel fee awards will be paid, and then the balance will be distributed on a pro rata basis to each class member who submits an approved claim. Id. at 10 (¶ 1.31). The $650 million amount is $100 million more than the $550 million Facebook had previously agreed to pay. See Dkt. No. 445.

16 For a conduct remedy, Facebook has agreed to set the Face Recognition default user setting to “off” and to delete all existing and stored face templates for class members unless Facebook obtains a class member’s express consent after a separate disclosure about how Facebook will use the face templates. Dkt. No. 468, Ex. A at 13 (¶ 2.9). Facebook has proposed an exception to this for class members who signed up for Facebook after September 3, 2019, because it has already implemented these practices for such newer users. Id. at 14 (¶ 2.9(b)); Dkt.

22 No. 470 at 9:20-10:4. It also proposes to except users who have manually enabled Face Recognition for themselves, for obvious reasons. Dkt. No. 468, Ex. A at 14 (¶ 2.9(b)). Silence or inaction by the user will be deemed a withholding of consent, and the Face Recognition function will be set on “off,” and face templates deleted. Id. at 13 (¶ 2.9(a)). Facebook will also delete the face templates of any class members who have had no activity on Facebook for three years. Id. at 14 (¶ 2.9(c)).

1 DISCUSSION I. PRELIMINARY APPROVAL 3 Under Federal Rule of Civil Procedure 23(e), the claims of a certified class may be settled only with the Court’s approval. Rule 23(e)(2) states that a settlement proposal that would bind class members may be approved “only after a hearing and only on finding that it is fair, reasonable, and adequate.” The Court is to consider whether “(A) the class representatives and class counsel have adequately represented the class; (B) the proposal was negotiated at arm’s length; (C) the relief provided for the class is adequate, taking into account: (i) the costs, risks, and delay of trial and appeal; (ii) the effectiveness of any proposed method of distributing relief to the class, including the method of processing class-member claims; (iii) the terms of any proposed award of attorney’s fees, including timing of payment; and (iv) any agreement required to be identified under Rule 23(e)(3); and (D) the proposal treats class members equitably relative to each other.” Preliminary approval of a class settlement is appropriate when the proposed settlement “appears to be the product of serious, informed, noncollusive negotiations,” “has no obvious deficiencies,” “does not improperly grant preferential treatment to class representatives or segments of the class,” and “falls with the range of possible approval.” Stokes v. Interline Brands, Inc., No. 12-cv-05527-JD, 2014 WL 5826335, at *3 (N.D. Cal. Nov. 10, 2014) (citations omitted).

18 A. Class Definition, Representatives and Counsel 19 The Court certified a class of Facebook users located in Illinois for whom Facebook created and stored a face template after June 7, 2011, Dkt. No. 333, and the class definition is the same for purposes of settlement. Dkt. No. 468, Ex. A at 5-6 (¶ 1.7). The parties have in effect withdrawn some proposed modifications to the definition that gave the Court pause. Nothing has changed to require the Court to revisit the Rule 23 analysis in the class certification order, and the same is true of the adequacy of the class representatives and class counsel. Consequently, the Court approves the class definition in the settlement agreement, and the appointment of Nimesh Patel, Adam Pezen and Carlo Licata as class representatives, and Edelson PC, Robbins Geller Rudman & Dowd LLP, and Labaton Sucharow LLP as class counsel. The proposed exclusion of persons from the settlement class including judicial staff and other potentially interested persons is approved. Id. 3 B. Arm’s Length Negotiations 4 The Court is satisfied that the proposed settlement was the product of serious, informed and noncollusive negotiations. This was the parties’ third round of mediation, after working with a retired judge and a magistrate judge. This round was facilitated by former United States Ambassador Jeffrey L. Bleich, and involved considerable time and effort by the mediator and the parties, as evidenced by the parties’ multiple filings since the settlement in principle was first reported. The Court also notes that the settlement agreement does not contain a “clear sailing” provision, leaving Facebook free to oppose any attorney’s fees request class counsel makes.

11 C. Sufficiency of Relief to the Class 12 With the substantive revisions made by the parties, the Court finds on a preliminary basis that the settlement agreement appears to be fair, reasonable and adequate for the class. Facebook has increased the settlement fund by $100 million, which substantially allays the Court’s concern about the potential inadequacy of payments to class members in light of BIPA’s statutory penalties. The $650 million that will be awarded to the Illinois class is an impressive result both as an absolute number and relative to other class action settlements in privacy cases. This is all the more true in light of the risks for plaintiffs in going to trial. As the Court has noted, if the case were to proceed to trial, it would be “entirely possible that Facebook will prevail and that plaintiffs will take nothing, or win a damages award far smaller than Facebook fears.” Dkt. No. 404 at 3. In the filings in support of settlement approval, the parties cogently discussed specific disputes of fact, for example the location of Facebook’s servers vis-à-vis its Illinois users, the jury’s resolution of which was uncertain and could have had far-reaching impacts on Facebook’s liability under an Illinois statute. There also remained a dispute of fact about whether Facebook’s facial recognition technology collects a “scan of face geometry” as required under BIPA, and whether Facebook had a good-faith reason for acting as it did with respect to Illinois users. Given these and other risks at trial, the sizeable amount of money to be paid to the class is more than sufficiently fair, reasonable 1 The Court is also satisfied at this stage with the prospective relief offered by the settlement. At the hearing on July 23, 2020, Product Manager McCoy explained why the new relief agreed to in the settlement is not redundant of measures already required of Facebook under the consent decree entered into with the Federal Trade Commission in July 2019. Dkt. No. 470 at 6:18-9:16. He explained that a “large majority” of Illinois users would be newly covered, and that because of this settlement agreement, the facial recognition setting will be changed to an “opt-in” basis globally. Id. These are meaningful conduct remedies that will confer a benefit to the class.

8 D. Scope of Release and Opt-Out Period 9 The parties have addressed the Court’s concern that the scope of the initial release could be read to release BIPA and related privacy claims against Facebook’s affiliated companies that had nothing to do with this case. Dkt. No. 456. The definition of “released parties” has been revised to expressly exclude “any entities . . . that did not use the Tag Suggestions feature such as Instagram, Inc., WhatsApp Inc., and Oculus VR Inc.” Dkt. No. 468, Ex. A at 8 (¶ 1.26). This change removes this issue as a hurdle to preliminary approval.

15 The Court was also concerned about the original opt-out period of less than 60 days, which was too short. That too has been appropriately revised in the amended settlement. See id. (¶ 1.22) (objection/exclusion deadline to be set “no later than sixty (60) calendar days after the Notice Date”).

19 E. Notice and Claim Form Issues 20 The issues with the proposed claim form and notices to the class have also been remedied.

21 The notice to the class that was previously ordered (but never executed in light of the circuit proceedings) directed jewel notifications, notice via Facebook users’ newsfeed channel, direct email notice, and a web page dedicated to the lawsuit. Dkt. No. 402. The settlement agreement requires those forms of notice and more. See Dkt. No. 468, Ex. A at 15 (¶ 4.2) (requiring email notice, jewel and news feed notice, publication notice, settlement website, targeted internet ad campaign and CAFA notice). The Court approves the language and proposed forms of notice and claim form attached as Exhibits A to H to the settlement agreement; together they constitute the 1 As discussed at the July 2020 hearing, the ultimate goal is to achieve a high claims rate and payout to class members based on effective notice. This settlement is a golden opportunity to establish best practices for online notice. The case raises an issue of digital privacy, the alleged violations happened online, and the class is composed entirely of online users. It is safe to say that if any defendant can provide notice likely to reach online users, it is Facebook. These are ideal circumstances for determining how best to advise class members of the pendency of the litigation and their rights to monetary and conduct relief. To that end, the Court directs the parties to file a report every 14 days on the progress made in providing notice through the channels approved above. The parties should be prepared to propose improvements in the delivery of notice based on the data as it is collected. Status conferences will be set as needed.

11 II. SCHEDULE AND NEXT STEPS FOR FINAL APPROVAL 12 The Court sets the following schedule: 13 Event Deadline / Date Facebook to provide Class Notice List to Settlement September 2, 2020 14 Administrator 15 Notice Date September 23, 2020 Last day class counsel to file motion for attorney’s fees October 15, 2020 16 and costs, and any incentive awards for class representatives Claims Deadline November 23, 2020 Objection / Exclusion Deadline November 23, 2020 19 Last day to file motion for final approval of class December 3, 2020 settlement Final Approval Hearing January 7, 2021, at 10:00 a.m.

Gilardi & Co. LLC is appointed as the settlement administrator, and the American Civil Liberties Union of Illinois is preliminarily approved as the potential cy pres recipient. The parties are authorized to agree to and adopt further settlement-implementing measures so long as they are consistent in all material respects with the terms of the settlement agreement and do not limit or impair the rights of the class. The issues of any incentive awards to the named class representatives and any fees and costs to class counsel are reserved for the final approval hearing.

1 CONCLUSION 2 Preliminary approval of the amended stipulation of class action settlement, Dkt. No. 468, is || granted, and a final approval hearing is set for January 7, 2021. The parties are directed to follow || the schedule set out above and all other terms of their settlement agreement.

5 IT IS SO ORDERED.

6 || Dated: August 19, 2020 JAMES JPONATO 9 United Ptates District Judge a 12

© it 18