California court certifies lawsuit against Facebook over private message scanning as a class action, but rules out any monetary damages
Russell Brandom / The Verge :
Context & Ripple Effects
This ruling is the second life of a case Facebook tried to kill at the outset: after a California judge denied Facebook's motion to dismiss in late 2014, the private message-scanning claims have now cleared class certification — meaning users who allege their messages were read to target ads can proceed as a group rather than as individual plaintiffs.
The no-damages carve-out fits an emerging template in Facebook's litigation docket. A week earlier, the judge let the Illinois facial-recognition suit under BIPA move forward, and in 2019 a court allowed the class action over the 2018 breach to seek better security procedures but not damages — a pattern where plaintiffs win collective standing while losing the monetary remedy that makes class actions economically worthwhile.
First-order effects
- Facebook now faces a certified class of users over message scanning, but because monetary damages are ruled out, its exposure narrows to injunctive relief — changing how it scans messages or how it discloses the practice, not writing checks.
- Plaintiffs gain collective bargaining power in court but lose the per-user payout model; the class's leverage shifts entirely toward forcing procedural change.
Second-order effects
- With damages off the table in this channel, pressure migrates to state-level enforcement — the path California itself later took when it reached a $50M settlement with Meta over user-visibility claims, showing regulators extracting money where private classes cannot.
- Rival platforms watching this case get a pricing signal: content-scanning practices carry certification risk even without payout risk, lowering the deterrent value of the suit for competitors considering similar ad-targeting techniques.
Third-order effects
- If courts keep certifying privacy classes while barring damages, class actions become instruments for forcing disclosure and design changes rather than compensation — pushing financial accountability toward state settlements and regulatory fines instead of plaintiff payouts.
- The split between collective standing and collective remedy points toward a structural gap in US privacy law: statutory regimes like Illinois' biometric act, which does attach penalties, become the more valuable battleground than common-law classes.
The trend: US privacy litigation is splitting into two tracks — injunctive-only class actions that force practice changes, and state-led settlements that recover money — with platform data-scanning practices caught between them.