Meta recently agreed to settle one of the longest-running data privacy lawsuits in the United States.[1] The lawsuit challenged the company’s use of cookies to track users, including after they have logged out of their Facebook accounts. The significance of In re Facebook, Inc. Internet Tracking Litigation, however, is not so much the decade-long litigation in the Ninth Circuit as the proposed settlement, which would require Facebook to “sequester and delete” all user data that was allegedly collected unlawfully during the class period.[2] This form of non-monetary relief seems unprecedented in private privacy class actions in the U.S. If approved, such relief could be adopted in future actions alleging unlawful data collection. In this article, we explore some of the corresponding implications.
Although novel in U.S. private privacy class cases, the “sequester and delete” requirement is not without recent precedent in regulatory enforcement actions. The Federal Trade Commission recently announced a settlement requiring a weight loss company to delete not only the unlawfully collected data, but also any algorithms or other work product derived from that data.[3] This was not the first time that deletion was part of a settlement involving the FTC: in January 2021, the same was required in a settlement between the FTC and a photo app.[4] Other varieties of private class action have long resulted in similar relief; for example, under the Fair Debt Collection Practices Act, a debt collector that fails to verify an individual’s debts can be required to contact credit reporting agencies and have the debt deleted from the individual’s credit report.
Retaining the subject data following a data privacy lawsuit settlement can have ongoing liability risk with respect to the ongoing use of that data and, as is true in most jurisdictions, it is difficult, if not impossible, to enforce a release covering future liability. But once the subject data is destroyed, there is no longer a risk of future liability stemming from the use of that data. For this reason, deletion can be a preventative measure that reduces the likelihood of exposure to future liability. By the same token, deletion is one way for the defendant to add value to the settlement without incurring additional out-of-pocket costs.
Requiring deletion pursuant to a settlement agreement would also provide plaintiffs with a form of relief that may not have been available at trial. Privacy class actions usually involve statutory claims, in which case the relief sought and granted is limited to what is provided for in the statute (often statutory damages), or claims in contract and tort law. The relief in those cases is also usually monetary relief and/or an injunction to prevent the defendant from continuing the allegedly unlawful act[5] or from disseminating—but not keeping—the inappropriately collected information.[6] An agreement that the defendant will not benefit from the data that has already been taken, however, has not been a common remedy either sought or granted in trial courts.
Overall, including deletion as part of a class action settlement concerning unlawful data collection may be trending in the U.S. and for good reason: it may reduce risks and costs to defendants, add value to the settlement, and provide plaintiffs with meaningful forms of relief.
Morrison & Foerster law clerk Sophie Barnett contributed to the writing of this post.
[1] Motion for Certification of Settlement Class and Preliminary Approval of Class Action Settlement, In re Facebook Internet Tracking Litigation, No. 5:20-MD-2314-EJD (N. D. Cal.), Dkt. No. 232.
[2] Id. at 12.
[3] Federal Trade Commission, FTC Takes Action Against Company Formerly Known as Weight Watchers for Illegally Collecting Kids’ Sensitive Health Data (March 4, 2022), https://www.ftc.gov/news-events/press-releases/2022/03/ftc-takes-action-against-company-formerly-known-weight-watchers.
[4] Federal Trade Commission, FTC Finalizes Settlement with Photo App Developer Related to Misuse of Facial Recognition Technology (May 7, 2021), https://www.ftc.gov/news-events/press-releases/2021/05/ftc-finalizes-settlement-photo-app-developer-related-misuse.
[5] See, e.g., Wolfson v. Lewis, 924 F. Supp. 1413, 1435 (E.D. Pa. 1996).
[6] See, e.g., Michaels v. Internet Ent. Grp., Inc., 5 F. Supp. 2d 823, 842 (C.D. Cal. 1998).