Campbell v. Facebook, Inc.

• Citation: 951 F.3d 1106
• Decision Date: 03 March 2020
• Docket Number: No. 17-16873,17-16873
• Parties: Matthew CAMPBELL ; Michael Hurley, on behalf of themselves and all others similarly situated, Plaintiffs-Appellees, v. FACEBOOK, INC., Defendant-Appellee, v. Anna W. St. John, Objector-Appellant.
• Court: United States Courts of Appeals. United States Court of Appeals (9th Circuit)

951 F.3d 1106

Matthew CAMPBELL ; Michael Hurley, on behalf of themselves and all others similarly situated, Plaintiffs-Appellees,

v.FACEBOOK, INC., Defendant-Appellee,

v.Anna W. St. John, Objector-Appellant.

No. 17-16873

United States Court of Appeals, Ninth Circuit.

Argued and Submitted January 18, 2019

Submission Vacated June 4, 2019

Resubmitted March 3, 2020 San Francisco, California

Filed March 3, 2020

Adam Ezra Schulman (argued), Anna St. John, and Theodore H. Frank, Center for Class Action Fairness, Washington, D.C.; for Objector-Appellant.

Hank Bates (argued), Allen Carney, and David Slade, Carney Bates & Pulliam PLLC, Little Rock, Arkansas; Michael W. Sobol, David T. Rudolph, and Melissa Gardner, Lieff Cabraser Heimann & Bernstein LLP, San Francisco, California; Rachel Geman and Nicholas Diamand, Lieff Cabraser Heimann & Bernstein LLP, New York, New York; for Plaintiffs-Appellees.

Christopher Chorba (argued), Joshua A. Jessen, Ashley M. Rogers, and Ryan S. Appleby, Gibson Dunn & Crutcher LLP, Los Angeles, California, for Defendant-Appellee.

Marc Rotenberg, Alan Butler, and Sam Lester, Electronic Privacy Information Center, Washington, D.C., for Amicus Curiae Electronic Privacy Information Center (EPIC).

Before: J. Clifford Wallace, Richard R. Clifton, and Michelle T. Friedland, Circuit Judges.

FRIEDLAND, Circuit Judge:

Objecting class member Anna St. John ("Objector") appeals from the district court's approval of a settlement between Facebook and a nationwide class of its users who alleged that Facebook routinely captured, read, and used for several purposes the website links included in users' private messages without their consent, and that these practices violated federal and California privacy laws. After years of litigation that included lengthy discovery, four mediation sessions, and Facebook's failed attempts to convince the district court to dismiss the case or deny class certification, the parties reached a settlement. Facebook acknowledged in the settlement agreement that it had already made several changes to the practices challenged in this action, and it agreed to add a disclosure to a Help Center page on its website for a year. The settlement agreement also provided that class counsel could apply for court approval of up to $3.89 million in attorney's fees and costs, and that Facebook would not take any position on that application. The district court, over Objector's challenge, found the settlement to be fair and approved it. The district court also granted in full class counsel's request for $3.89 million in fees and costs.

Addressing Objector's appeal from the district court's approval of the settlement, we first consider whether Plaintiffs had standing to bring this action and whether it later became moot. We conclude that the district court had jurisdiction, and, accordingly, that we have jurisdiction to evaluate the fairness of the settlement. Second, we reject on the merits Objector's contentions that the district court abused its discretion by approving the settlement.

I.

A.

"Facebook operates one of the largest social media platforms in the world, with over one billion active users. About seven in ten adults in the United States use Facebook." Patel v. Facebook, Inc. , 932 F.3d 1264, 1267 (9th Cir. 2019) (citations omitted), cert. denied , No. 19-706, ––– U.S. ––––, ––– S.Ct. ––––, ––– L.Ed.2d ––––, 2020 WL 283288 (U.S. Jan. 21, 2020). Facebook has a messaging function on its platform that allows users to send electronic messages to one or more other users. Facebook explains on its website that these messages are "private" because their contents and history are viewable only by the sender and his or her chosen recipients—in contrast to, for example, posts shared with a broader audience, such as all of the user's Facebook friends.

In December 2013, Matthew Campbell and Michael Hurley ("Plaintiffs") filed a putative class action against Facebook. Plaintiffs alleged that Facebook scanned their private messages looking for links to web pages, also known as URLs, contained in those messages. They alleged that if a message contained a URL, Facebook would collect that information and use it in a variety of ways without the user's consent.

The main allegations concerned how Facebook integrated these private message URL shares into a feature that enabled third parties to show on their own websites a count of how many Facebook users had "Liked" the pages on their sites—a proxy for those pages' popularity. Plaintiffs alleged that Facebook would increase a page's "Like" counter not only when a Facebook user affirmatively pressed a "Like" button, but also when the user sent a private message containing a URL corresponding to the page, regardless of what the message said about the URL.¹ Plaintiffs also alleged that Facebook used the private message URL data that it was collecting to help build profiles of individual users that could facilitate, among other things, targeted advertising on Facebook.

Plaintiffs contended that Facebook's handling of their messages amounted to interception and use of electronic communications in violation of Title I of the Electronic Communications Privacy Act ("ECPA"), 18 U.S.C. § 2510 et seq. ,² and the California Invasion of Privacy Act ("CIPA"), Cal. Penal Code § 630 et seq. They also alleged that it amounted to an unlawful, unfair, or fraudulent business practice under the California Unfair Competition Law ("UCL"), Cal. Bus. & Prof. Code § 17200 et seq. Plaintiffs sought damages as well as declaratory and injunctive relief.

Facebook filed a motion to dismiss, which the district court granted in part and denied in part. The district court dismissed the UCL claim and a portion of the CIPA claim, but it declined to dismiss the ECPA claim and the portion of the CIPA claim alleging interception and use of communications in violation of California Penal Code section 631. The district court also rejected Facebook's sole jurisdictional argument: that the prayer for injunctive relief should be stricken for failure to allege ongoing or future injury.³

The parties engaged in extensive discovery, which included the production of tens of thousands of pages of documents, depositions of eighteen fact and expert witnesses, hundreds of hours of analysis of Facebook's source code, and significant briefing about discovery disputes.

Plaintiffs moved for certification of a damages class under Federal Rule of Civil Procedure 23(b)(3), and in the alternative an injunctive and declaratory relief class under Rule 23(b)(2). Facebook opposed the motion, arguing that Plaintiffs failed to satisfy Rule 23's requirements—but not arguing that the court lacked jurisdiction.⁴ In May 2016, the district court granted the motion in part and denied it in part.

The court denied certification of a damages class. It explained that Plaintiffs had proposed two methods for calculating damages but that neither was acceptable. One of Plaintiffs' proposals was to measure Facebook's profits from intercepting and using URL data from messages. The court explained, however, that Plaintiffs' proposed methodology had unjustifiably assumed that all interceptions resulted in the same profit, which made the model too inaccurate. Plaintiffs' other proposal was to award statutory damages, which fared no better. The court reasoned that it would be required to either award the full statutory sum or nothing, but "many individual damages awards [of that full sum] would be disproportionate" to the small amount of harm suffered by many class members. It held that class treatment was inappropriate because "sorting out those disproportionate damages awards would require individualized analyses."

The district court granted certification of an injunctive and declaratory relief class. The certified class encompassed:

All natural-person Facebook users [aside from those excluded through standard carveout provisions] located within the United States who have sent, or received from a Facebook user, private messages that included URLs in their content (and from which Facebook generated a URL attachment), from [December 2011] up through the date of the certification of the class.

In the class certification order, the district court observed that Plaintiffs had focused their claims on three specific uses of the URL data that had been collected from private messages: (1) Facebook's counting URL shares as a "Like" of the relevant third-party web page; (2) Facebook's sharing data regarding URLs in messages with third parties, enabling those third parties to generate customized content and targeted advertising on their own websites informed by this data; and (3) Facebook's use of the URL data to generate recommendations for other Facebook users. The district court concluded that although Plaintiffs had made allegations in their complaint about the first of these uses and "arguably" about the third, they had not specifically alleged the predicate for the second use, "sharing of data with third parties." But the district court further concluded that Plaintiffs' decision to focus on all three of these uses of URL data was "based on a review of discovery that was not available at the time of the complaint's filing." The district court therefore permitted Plaintiffs to represent the class in challenging all three uses, and it directed them to file a conforming amended complaint (which they then did).

The parties expended significant effort to try to settle this case. Several months after the motion to dismiss ruling, they participated in a full-day mediation session. The parties returned to the negotiating table after the district court's May 2016 order certifying an injunctive and declaratory relief class. During the last several months of 2016, the parties attended a total of three mediation sessions and continued to negotiate informally. About a week before the fact discovery period was scheduled to close, the district court approved the parties' stipulation...