Adkins v. Facebook, Inc.

Background

This data-breach class action arose from a September 2018 hack of Facebook. Access tokens allowed access to user accounts, and an unknown vulnerability sometimes made those tokens visible to strangers. Hackers used the vulnerability to access 300,000 accounts. Searches then produced names, telephone numbers, and email addresses for 15 million users worldwide, including 2.7 million in the United States, and more sensitive information for 14 million users worldwide, including 1.2 million in the United States.

After consolidation and motion practice, Stephen Adkins and two claims remained. The court certified a class for injunctive relief—that is, court-ordered measures to prevent future harm—consisting of current Facebook users residing in the United States whose personal information was compromised in the breach. The parties later reached a settlement in principle under the supervision of Chief Magistrate Judge Joseph Spero and negotiated final security commitments with assistance from a plaintiff-selected expert.

Proposed Settlement

Facebook agreed to certify that the vulnerability had been eliminated, that access tokens could no longer be generated in the way used in the breach, and that tokens generated through the vulnerability had been invalidated. For five years, Facebook would also increase integrity checks, add tools to detect suspicious access-token activity, improve incident containment, use automatic alerts, undergo annual SOC2 Type II security assessments, limit applications’ access-token capabilities, eliminate “NoConfidence authentication proofs,” require cryptographic proofs for valid logins before generating credentials, and expand logging of access-token generation and use.

An independent third-party vendor selected by Facebook, with class counsel’s approval, would assess compliance annually. The assessment results would be shared with class counsel, a retained expert, and the court, while otherwise being kept confidential by class counsel. The proposed settlement waived the class’s injunctive and declaratory-relief claims in this case but preserved damages claims. Adkins would release all claims in exchange for a service award. The court reserved decisions on attorneys’ fees, costs, and Adkins’s service award for final approval.

Court’s Analysis

The court explained that preliminary approval is appropriate when a proposed class settlement appears to result from serious, informed, non-collusive negotiations, has no obvious deficiencies, does not improperly favor some class members, and falls within the range of fair, reasonable, and adequate relief. The court found that the proposed security measures addressed the suit’s primary injunctive objective, that five years of outside review provided value to the class, and that the negotiations appeared serious and non-collusive.

The court also found the notice plan reasonably calculated to inform class members and give them an opportunity to object. It required minor changes clarifying where objections could be mailed and addressing the possibility of a telephone final-approval hearing and changed Clerk’s Office hours due to COVID-19.

The parties also sought to seal portions of settlement-related documents. The court stated that public access to court records is generally favored but found that narrow redactions concerning specific testing parameters and triggering events were warranted to protect the information at issue. The motions were granted to that extent, and the court approved the specified redactions to Facebook’s security commitments, a sub-exhibit to plaintiffs’ supplemental brief, and the Bream declaration.

Disposition

The court GRANTED preliminary approval of the proposed settlement. It APPROVED the settlement administrator and notice plan. Class notice was to be disseminated by December 30; class member objections were due March 8, 2021; and the final approval hearing was set for April 8, 2021, at 11:00 a.m. The court also GRANTED the sealing motions to the extent stated and approved the listed redactions. The order did not grant final settlement approval.