Seyfarth Synopsis: On January 29, 2020, Facebook announced that it had reached a settlement with plaintiffs in a class action brought under the Illinois Biometric Information Privacy Act (the “BIPA”) in the U.S. District Court for the Northern District of California. The settlement represents one of the largest payouts in a case brought under the BIPA since the law was passed in 2008. However, as the case against Facebook was not reflective of typical litigation brought under the BIPA, companies and their counsel should not be used it as a yardstick to value the majority of BIPA settlements moving forward.
Wednesday’s settlement puts an end to the largest BIPA case filed to date. Though the settlement included a hefty price tag, the Facebook litigation was an unusual case filed under the BIPA in both class size and subject matter and should not necessarily serve a guidepost for BIPA settlements in the future.
Case Background
In In Re Facebook, plaintiffs alleged that Facebook violated the BIPA when it unlawfully collected and stored biometric data on Facebook users without prior notice or consent. Plaintiffs’ claims arose out of Facebook’s “Tag Suggestions” function, which identifies other Facebook users through scanning uploaded photographs. Plaintiffs alleged that Facebook created and stored digital representations of people’s faces based on the geometric relationship of facial features unique to each individual.
The case was originally filed as three separate lawsuits in the U.S. District Court for the Northern District of Illinois. After the parties stipulated to transfer the cases to the Northern District of California, the Court consolidated the three suits into one class action complaint and Facebook moved to dismiss, asserting that the plaintiffs lacked standing under Article III to bring the suit because the collection of biometric information without notice or consent did not result in “real-world harms,” “such as adverse employment or even just anxiety.” Facebook’s motion to dismiss was denied. The District Court held that the plaintiffs had standing because they were never offered the opportunity to withhold consent from the storage of biometric data. The District Court also certified a class of “Facebook users located in Illinois for whom Facebook created and stored a face template after June 7, 2011.” Patel v. Facebook, Inc., 932 F.3d 1264, 1269 (9th Cir. 2019).
Facebook subsequently appealed the denial of the motion to dismiss and the class certification order to the U.S. Court of Appeals for the Ninth Circuit. In Patel v. Facebook, Inc., 932 F.3d at 1277, the Ninth Circuit affirmed the District Court’s decision in August 2019, holding that plaintiffs had alleged a harm sufficient to confer standing and that the class had been appropriately certified. Facebook then appealed the decision up to the U.S. Supreme Court, which denied certiorari last week on January 22, 2020. See Facebook, Inc. v. Patel, No. 19-706, 2020 WL 283288 (Jan. 21, 2020).
The Settlement
Facebook disclosed the settlement of the In Re Facebook case in conjunction with its quarterly financial results on January 29, 2020. Facebook’s disclosure indicated that, under the settlement agreement, Facebook will pay $550 million to eligible class members and plaintiffs’ attorneys. The parties have not yet released any additional information about the settlement, which follows closely on the heels of the Supreme Court’s decision last week not to hear Facebook’s appeal.
Implications For Illinois Companies
While the size of this settlement should certainly be noteworthy to companies doing business in Illinois, it is not reflective of the typical value of settlements for BIPA cases. The class certified in In Re Facebook included all Facebook users located in Illinois for whom Facebook created or stored a face template after June 2011. Extrapolating from the Plaintiffs’ allegations, the class could have presumably included millions of members, each of whom may have been awarded statutory damages ranging from $1,000 to $5,000 under the BIPA had Facebook proceeded to trial. Further, Facebook’s alleged use of the biometric information was much different than the typical BIPA case, which usually involves fingerprint or retina scans for payroll or security purposes.
However, despite the unique posture of the Facebook lawsuit, this significant settlement amount may exacerbate an already growing trend in privacy lawsuits being filed across the nation, with Illinois serving as a hotbed for such litigation under the BIPA (we have previously discussed the rise in BIPA lawsuits and the onset of other biometric privacy legislation here). Companies conducting business in Illinois and utilizing biometric information (such as fingerprint scans, retina scans, or, like Facebook, facial mapping or imaging, among other types) should be mindful that they are aware of and compliant with the requirements of the BIPA.
