U.S. District Court Judge James Donato labeled Facebook’s $650 million class-action settlement over alleged Illinois’ Biometric Information Privacy Act violations a “landmark result,” while the plaintiffs' attorney, Jay Edelson, called it “a make-or-break moment for the privacy bar.”
“It is one of the largest settlements ever for a privacy violation, and it will put at least $345 into the hands of every class member interested in being compensated,” Donato wrote in his Feb. 26 order granting final approval of the settlement, which affects approximately 1.6 million Facebook users. “Overall, the settlement is a major win for consumers in the hotly contested area of digital privacy.”
Edelson, founder and CEO of Chicago-based Edelson PC — who filed the suit against the social media giant in 2015 and represented class members who alleged Facebook’s “tag suggestions” feature violated the Illinois law by collecting and storing digital scans of their faces without notice or consent — agreed.
“There’s essentially been a schism within the privacy bar about how to approach large privacy cases where a large group of attorneys has entered into settlements with large numbers attached, but the class members really end up getting little to nothing,” Edelson said. “We’ve been very critical of this part of the plaintiff’s bar and really are hoping that the Facebook settlement is a wake-up call and that the people who claim to believe in privacy rights will actually prove that by making sure they litigate cases fully and get good settlements.”
The approved $650 million settlement is $100 million higher than the original proposal, increased after Donato questioned whether $550 million was sufficient. In his order granting final approval, Donato said the “$650 million paid by Facebook is real money by any standard” that “sets a new high bar for privacy-related settlements.”
The case establishes “a new model” for settlements, said Edelson, who credited Donato for motivating efforts to reach as many class members as possible, getting “into the weeds, asking all the tough questions, and challenging us to come up with the best notice possible.” Using Facebook’s direct access to users and other methods resulted in a claims rate of approximately 22%. In his order, Donato said 4% to 9% is typical for consumer class actions, while Edelson said most privacy settlements see a claims rate of 1% to 2%.
“For someone fighting for consumer rights for so many years, it is really invigorating when you see a judge say what really matters at the end of the day is how many people are getting compensated and how much they are getting,” Edelson said. “It sounds obvious, but these are not things that judges were really focused on five or 10 years ago.”
Edelson compared the Facebook settlement to a $92 million settlement by TikTok over alleged BIPA allegations, raised objections to the TikTok settlement on behalf of a client during a hearing this week, in which Illinois Federal Judge John Lee declined to grant preliminary approval. Lee ordered a briefing to determine how the settlement amount was reached, how class members were addressed and why they can not be reached through the app itself.
“We feel optimistic about our objection, but it shows how much work still needs to be done to make sure that privacy settlements really benefit the class members,” Edelson said.
Under its settlement, Facebook will implement changes, including setting its “Face Recognition” default setting to “off” for those users who have not “affirmatively opted in or consented to biometric scans.” The company will also delete existing and stored face templates for class members unless it obtains members’ “express consent after a separate disclosure” about how they will be used and will delete templates of those who have not been active on Facebook for three years.
In a statement, Facebook said, “We are pleased to have reached a settlement so we can move past this matter, which is in the best interest of our community and our shareholders.”
The settlement is "one of the most significant major privacy settlements in recent years," said Electronic Privacy Information Center Executive Director Alan Butler, and shows the significance of Illinois’ Biometric Information Privacy Act as “a really powerful mechanism and enforcement tool.” The case and Illinois’ regulation highlight that private rights of action “are a tremendously important and powerful tool in ensuring enforcement of privacy regimes,” he said.
“The implications of BIPA, I think, could be huge. One area, in particular, that is hugely significant is the use and deployment of facial recognition technologies across many different sectors, including by third parties,” he said.
Whether consumers should be afforded a private right of action is a key debate over privacy legislation, said Edelson, who noted he has not seen regulatory enforcement of a biometric law.
"The real work that is being done is on behalf of private litigants and it's in Illinois because we’ve got this terrific statute," he said. "We’re really trying to talk to state legislators throughout the country and saying, 'This is the difference. The difference in giving consumers the right to litigate on their own is the difference between holding companies accountable and not.'"
Photo by Erik Mclean on Unsplash
