Facebook (now Meta Platforms) was created in 2004 to connect people to anyone who sought to be connected. Just two years later, privacy issues began to plague the young company. First, it was connecting users to News Feed, a service that told users what was new with their Facebook Friends, but without their Friend’s permission. Next, it got into trouble for telling people what their Friends had purchased. The Federal Trade Commission got involved in 2011 and settled with the company when it agreed to face an independent privacy review every other year.

(Note: This article will refer to the company as Facebook because much of the proceedings occurred before it was renamed Meta.)

Then there were charges against Facebook for “mood manipulation,” taking extensive data from users, and ignoring evidence of data theft. Consumers began to sue over Facebook’s less-than-vigilant handling of their data. Next came the class action suits that charged the company with violating users’ privacy by sharing their personal data with third parties. In 2011, for example, users sued Facebook for “tracking their online activities without their consent,” arguing the tracking violated statutory and common law tort and contract causes of action.

The latest class action suit, representing 124 million class members, led to a multi-million dollar settlement for Facebook users who used the internet service between 2007 and 2022. Presiding District Judge Edward J. Davila approved the settlement in October 2023. Facebook, which had originally agreed to the settlement, subsequently agreed to the payment, but three “Objectors” appealed, arguing that Davila abused his discretion by “using disgorgement as the measure of actual damages” when the damages should have been “aggregating statutory damages at $10,000 per violation under the Electronic Communications Privacy Act of 1986 (18 U.S.C. §§ 2510–2523). The Act “protects wire, oral, and electronic communications” while they are being made, and stored on computers.

In other words, Sarah Feldman, Hondo Jan, and Eric Alan Isaacson (collectively, the “Objectors”) disputed the way users were tracked on websites not owned and operated by Facebook, and the district court “failed to properly value the classes (sic) statutory claims,” as reported by Bloomberg Law News. The News quoted the Objector’s attorney who claimed that the “total value of the statutory damages available to the class members was $1.24 trillion” and “provided a recovery that was just .0073% of the maximum statutory damages, an inadequate result under the federal rules for approving class action settlements.”

The case, and several others involving privacy issues, were consolidated into a $90 million “multidistrict litigation proceeding” that went to the Ninth Circuit Court of Appeals. Three circuit judges, Danielle J. Forrest, Ryan D. Nelson, and Gabriel P. Sanchez rejected the challenges on February 21 and affirmed Judge Davila’s ruling, finding the $90 million figure to be “fair and reasonable.” The settlement is the seventh largest ever reached in a privacy class action settlement, according to the court transcript.

The memorandum opinion described various methods of calculation that could have been used and were used to determine the settlement amount. It approved of the “percentage of the fund” calculation method for assessing attorneys’ fees and a new Ninth Circuit law that allows “monetary and injunctive relief for the class as grounds for the upward departure of four percentage points above the 25-percent benchmark.” These and other calculations that were employed were “well within the permissible bounds of this Circuit’s decisions,” the opinion said. The opinion concluded that the higher amount advocated by the Objectors, “would have been constitutionally impermissible.”

A final argument from the Objectors regarded the notice of the settlement. They argued that their rights had been violated, but the Ninth Circuit disagreed, explaining it was proper under Rule 23 and constitutional due process. Rule 23 of the Federal Rules of Civil Procedure sets out four prerequisites for class actions, including that “the class is so numerous that joinder of all members is impracticable” and that “the representative parties will fairly and adequately protect the interests of the class.” The opinion concluded that all rules had been complied with and mentioned that the Objectors “never moved to unseal the complaints or exhibits, and … fail(ed) to explain why a class representative or absent class member would need to know this information to evaluate the settlement or “protect the interests of the class.”

Bloomberg Law News estimates that the victorious class action lawsuit should amount to an average of $30 per user. In addition to the now-approved settlement amount, Facebook is also required to delete all “cookie data” it improperly received from April 22, 2010, to September 26, 2011. Cookie data are small amounts of data created by a server while a user is browsing. It is placed on a device to allow it to access a website.

The opinion also pointed out that the fact that “The district court merely noted that the absence of a large number of objections…raises a strong presumption that the terms…are favorable to the class members.”

Want your $30? Although procedures have not yet been posted, a different multi-million dollar settlement required Facebook users who went online to its website between May 2007 and December 2022 to go to Meta’s website to learn how to file a claim. Presumably, similar procedures will be followed after the Ninth Circuit affirms the new settlement, so check the company’s website for information.

Meta could buy you lunch.