Campbell v. Facebook: California District Judge Approves Final Class Action Settlement Over Facebook’s Use of URL Data

Digest Reports Privacy

Order Granting Final Approval to Class Action Settlement; Granting Motion for Attorneys’ Fees and Service Awards, Matthew Campbell, et al. v. Facebook, Inc., No. 13-cv-05996, (N.D. Cal. Aug. 18, 2017), hosted by JUSTIA.

On August 18, 2017, Judge Phyllis Hamilton of the Northern District of California granted final approval of a class action settlement in a lawsuit filed against Facebook for its use of information about URLs shared in Facebook private messages.

Two Facebook users initiated the lawsuit in December 2013 for violations of the Electronic Communications Privacy Act, 18 U.S.C. § 2510 et seq.; the California Invasion of Privacy Act, 15 Cal. Penal Code § 630 et seq.; and the California Business & Professions Code § 17200 et seq. The complaint asserted that Facebook scanned private messages without consent for URLs shared by users in order to (1) pass statistics and “Insights” about URL shares to third parties; (2) enable third-party targeted advertising; and (3) increase public tallies of websites’ “like” counts for each share of a website’s URL.

In May 2016, Judge Hamilton certified a national class of users in a Fed. R. Civ. P. 23(b)(2) injunctive class suit. The class was defined as all Facebook users in the United States who sent or received private messages including URLs, from which Facebook generated a “URL attachment,” between December 30, 2011 and March 1, 2017. Initial certification granted injunctive and declaratory relief for plaintiffs, noting that damages amongst plaintiffs across the nation varied too widely to warrant certification of a single nation-wide class for compensatory damages. The injunctive class certification and complaint amendment order spurred mediation and settlement dialogue between Facebook and the plaintiff class.

In April 2017, the court granted preliminary approval of a nonmonetary settlement between Facebook and plaintiffs. Then, in August 2017, the court granted final approval. The August 2017 final settlement approval signals the district court’s decision that the settlement is “fair, reasonable, adequate, and in the best interests of the class.”

The settlement includes declaratory relief, confirming that Facebook no longer (1) uses private message URL-shares to increment public tallies of website “likes”; (2) transmits URL-share data to third-parties via “Insights;” (3) uses URL-shares to generate Facebook feed recommendations; and (4) uses EntShare object data in certain contexts. EntShare objects are records briefly describing the website located at a URL. An EntShare is tied to the user who shared the URL in a private message and is used to target ads and content recommendations to that specific user. EntShares also enable the incrementing of public “like” counters. Facebook notes that it discontinued most practices named in the settlement in 2012 and 2014, but as of 2017, agreed to stop using EntShare objects to target advertising, share personally-identifying information with third-parties, and display lists of frequently-shared URLs as recommended webpages on external websites.  

The settlement also requires Facebook to update its Data Policy to disclose its collection of information from messages or other communications between Facebook users and to display for one year in its Help Center a message disclosing its practice of collecting information about shared links.

A single objecting class member appealed the final settlement approval to the U.S. Court of Appeals for the Ninth Circuit in January 2018. The appeal, supported by amici, asserts that the settlement does not deliver a fair, reasonable, and adequate outcome because it (1) permits Facebook to continue its privacy-violating practice of scanning private messages to collect information about URL-shares; (2) permits continuation of URL-share data collection with notice “buried” in Facebook’s Help Center for a one-year period; and (3) delivers no monetary compensation to absent class members.

While Facebook’s discontinued use of EntShares to disclose information about users to third parties and to target ads is a step towards enhanced protection of users’ privacy rights, Facebook continues to collect data about URL-shares and generate EntShares. Despite Facebook’s updated Data Policy and temporary Help Center disclosure, the 230 million U.S. Facebook users face an arduous path to collectively articulating the privacy rights they expect of Facebook and to seeing those expectations fulfilled.