On August 19, 2020, the United States District Court for the Northern District of California granted preliminary approval of the class action settlement in In re Facebook Biometric Information Privacy Litigation, 3:15-cv-03747-JD. If the settlement receives final approval, Facebook would pay $650 million to Illinois class members as compensation for violations of the Illinois Biometric Information Privacy Act (“BIPA”)—a $100 million increase from the settlement proposal that the District Court denied earlier this year.
The case arose from allegations that Facebook violated BIPA by collecting and storing class members’ biometric data in the form of scans of their faces without prior notice or consent. Facebook harvested the scans in connection with its “Tag Suggestions” program, which looks for and identifies people’s faces in photographs uploaded to Facebook to promote user tagging. BIPA provides statutory damages of up to $1,000 per negligent violation and up to $5,000 per intentional or reckless violation. Plaintiffs estimated that millions of Illinois residents were Facebook users whose biometric data had been collected in violation of BIPA.
As the Court recognized, the case was “fiercely litigated” for over five years, with fights on standing, summary judgment, and class certification. Notably, during the pendency of an interlocutory appeal to the Ninth Circuit, the Illinois Supreme Court largely adopted the District Court’s pro-plaintiff interpretation of BIPA in its 2019 Rosenbach v. Six Flags Entm’t Corp. decision. Just as the case was about to be set for a jury trial, the parties advised the District Court that a settlement in principle had been reached, pursuant to which Facebook would pay $550 million. However, on June 4, 2020, the District Court denied the parties’ request for preliminary approval, citing concerns about an unduly steep discount on statutory damages under BIPA and the sufficiency of notice to class members.
After renegotiating, the parties asked the District Court to grant preliminary approval for a new agreement, pursuant to which Facebook agreed to pay $650 million into a non-reversionary cash fund. The District Court conducted an evidentiary hearing on July 23, 2020, and thereafter granted preliminary approval. In doing so, the District Court noted that the additional $100 million “substantially allays the Court’s concerns about the potential inadequacy of payments to class members in light of BIPA’s statutory penalties.” The District Court also approved the notice to class members, which includes email notice, Facebook news feed notice, publication notice, a settlement website, targeted internet ad campaigns, and CAFA notice. A final approval hearing is set for January 7, 2021.
The Facebook settlement should serve as a reminder to take BIPA compliance seriously. While the scale of Facebook’s users makes the settlement newsworthy, the lessons apply to businesses of all sizes—if you collect biometric data from Illinois consumers or employees, you must obtain written consent prior to collection and comply with other obligations. Failure to do so renders you at risk of a class action for statutory damages and attorneys’ fees.