Facebook agrees to pay $100M more for privacy violations

SAN FRANCISCO -- Facebook agreed to pay an additional $100 million to secure approval of what was already the largest settlement of a class action alleging online privacy violations, attorneys told a federal judge Thursday.

Plaintiffs suing the tech giant claiming it abused facial recognition technology now stand to recover a total of $650 million. Users in Illinois whose pictures appeared on the site after 2011 can expect to receive $200 to $400 depending on the number of claims submitted.

After refusing to sign off on the deal in June, U.S. District Judge James Donato was receptive to the changes. He directed both sides to think of creative ways to notify millions of class members.

"I need to do more reflection, but it's incrementally better than the one I turned down last month," he said.

The revised agreement also carries the possibility of additional legal action against Facebook affiliates Instagram, WhatsApp and Oculus for potential violations of the Illinois Biometric Information Privacy Act. The release was changed to exclude those companies.

Representing the plaintiffs, Paul Geller emphasized the judge's role in arriving at the new terms. In re Facebook Biometric Information Privacy Litigation, 15-cv-03747 (N.D. Cal., filed Aug. 17, 2015).

"The changes we made were in large part because of your honor's comments," the Robbins Geller Rudman & Dowd LLP partner said. "It's a record breaking privacy result. Privacy cases just don't pay this money."

Donato initially balked at the settlement at a preliminary approval hearing, questioning why plaintiffs accepted such a steep discount on $47 billion in potential damages if they went to trial. He ordered both sides to address his concerns, including whether the deal mandates Facebook to do anything it's not already obligated to do from a 2012 settlement with the Federal Trade Commission over allegedly deceiving users about their control of private information.

Testifying for Facebook via a Zoom video feed Thursday, Gary McCoy, who runs its facial recognition program, clarified this deal protects significantly more users who were not included in the FTC settlement. He said the default privacy setting will now assume that users do not want to participate in the data collection and storage.

"You're set for 'no' for granting permission for facial recognition use unless the user affirmatively says 'OK,'" he said.

Before the settlement, users had facial recognition enabled without turning it on themselves.

The deal, McCoy continued, essentially ensures that no face templates will be created or retained for Facebook users in Illinois unless they choose to turn the feature on after being notified of how it uses the data. He qualified that some people may decide to opt into the service because they like being told when photos of them appear on the site.

In addition to the supplemental $100 million Facebook is contributing to the settlement, plaintiffs' attorneys will also be requesting substantially less in fees. Geller said they will likely seek no more than 20% of the original $550 million settlement.

They initially stated they would move for no more than 25% in attorney fees.

Due to the scope of the potential class, Donato ordered both sides to regularly check in with him on their notice program. He said the case might "move the marker" in the way the success of larger settlements, particularly those for online entities, is measured.

"Success rates are determined by participation," he emphasized.

The landmark settlement is a result of a unique Illinois state law requiring companies to get permission from people if they want to use facial recognition technology.

Facebook was hit in 2015 with three class actions accusing it of illegally collecting and storing users' biometric data, including face templates, for its "tag suggestions" feature in violation of the Illinois Biometric Information Privacy Act. The statute is considered the strongest and most comprehensive data privacy law in the nation, carrying fines of $1,000 for negligent violations and $5,000 for intentional violations.