Meta Platforms, Inc., formerly known as Facebook, has agreed to a substantial $725 million settlement in a class action lawsuit addressing long-standing concerns over data privacy practices. The resolution was reached last autumn, but some administrative hurdles have delayed the payouts to later this year. The case has set a new bar for holding tech companies accountable for their handling of user information.
Let’s refresh the facts of the case before we discuss how the payouts to come could affect Facebook users.
Laws on Biometric Privacy
Texas is one of the few states that have enacted specific laws to protect biometric privacy, the second to do so after Illinois. CUBI was enacted in 2009, but it does not provide a private right of action. A private right of action means that individuals can sue for a violation of the law. In Texas, however, the Texas Attorney General must enforce the law. The recent lawsuit by Paxton marked the first time a Texas Attorney General had accused a violation of CUBI in court.
Illinois law does allow a private right of action. As a result, in 2016, a class-action lawsuit was filed by Illinois residents against Meta for its facial recognition system. This lawsuit led to a settlement of $650 million in 2021, although Meta did not admit to violating any state or federal privacy laws. While this win might have encouraged Paxton to file his lawsuit, the difference is that since Texas residents can’t sue, the suit had to come from the government.
Data Privacy Concerns Mount
For more than ten years, Facebook/Meta used user-uploaded photographs in a facial recognition system. This data was employed to assist in identifying and tagging other users, as well as to enhance its own AI research.
But many had been worried about the security of this kind of personal data. Concerns escalated following a series of prominent data leaks, most notably the Cambridge Analytica scandal of 2018. That incident involved the personal information of countless users being collected without their permission.
In 2019, the Federal Trade Commission imposed a $5 billion fine on Facebook for misleading users about their control over personal, private information. Facebook has already paid this fine. Despite a decline in daily usage, Facebook reported a net income of $10.29 billion in Q4 of 2021.
The Lone Star Lawsuit
Meta terminated their facial recognition system in 2021, but that wasn’t good enough for Texas Attorney General Ken Paxton. In 2022, Paxton’s office initiated a lawsuit against Meta in a Texas district court, demanding billions in compensation for breaching Texas's Capture or Use of Biometric Identifier Act (CUBI) and the Deceptive Trade Practices Act (DCTP).
The Consumer Privacy User Profile Lawsuit, as it’s known, claimed that Facebook improperly managed user information, enabling unapproved external entities to gain access to confidential user details. The complaint filed by Texas alleges that Facebook collected biometric data without proper consent. The Attorney General claims that the company then shared this data with third parties without consent and neglected to delete the gathered information within a reasonable timeframe, as mandated by Texas law.
The state pursued the maximum penalty of $25,000 for each CUBI infringement and $10,000 for each DCTP violation. With approximately 20.5 million Texans having a Facebook account in 2021, it’s not surprising that the total amount sought in statutory damages was in the billions.
The Case Settles
Last October, the case settled with a $725 million agreement, marking a pivotal moment in the legal battle to keep social media companies accountable.
The settlement aims to compensate American users affected by the alleged data mismanagement. As such, only people in the U.S. who had an active Facebook between May 24, 2007, and December 22, 2022, will be eligible for receiving a portion of that settlement. It's also worth noting that the window for submitting claims closed in August 2023, leaving those who missed the deadline ineligible for compensation.
The payout was initially slated for distribution in early 2024. However, the complex process of claim verification and potential legal hurdles have pushed the expected payout timeline to later in the year. Experts now anticipate that affected users may receive their compensation in the latter half of 2024, likely by the fall. As the payout date approaches, claimants are advised to remain vigilant against potential scams, with all legitimate communications expected to come directly from the designated settlement administrators.
Small Payouts, Big Impact
Settlement administrators are overseeing the distribution process, offering various payment options to claimants. These include popular digital platforms such as PayPal and Venmo, as well as traditional methods like paper checks. With an estimated 17 million claims filed, individual payouts are projected to be approximately $30, though this figure may fluctuate based on the final tally of validated claims.
While the individual payouts may be modest, the case has further-reaching consequences. Although there was no legal precedent as the parties did not go through trial, the settlement sets a kind of precedent of its own: it sends a big message to tech giants about the consequences of mishandling user data.
Related Resources:
- Social Media Privacy Laws (FindLaw's Learn About the Law)
- Think of the Children: Meta in Court (FindLaw's Courtside)
- Protecting Customer Data (FindLaw's Learn About the Law)
