Court allows class action related to Facebook's 2018 breach to proceed; says the 29M users, as a group, can ask for better security procedures, but not damages
Context & Ripple Effects
This ruling slots into a long line of privacy suits where Facebook loses on dismissal but keeps its money: in the private-message scanning case, a California court had already certified a class while ruling out monetary damages back in 2016, and in August 2019 an appeals court forced Facebook to face the Illinois biometric-privacy suit over facial recognition. Today's decision applies the same template to the 2018 breach — the 29M affected users get to sue as a group, but only for changed behavior, not checks.
What makes this round consequential is what came after it in the docket: within months Facebook agreed to improve its security procedures to settle, meaning the court's narrow framing — equitable relief only — turned out to be exactly the lever that produced binding security commitments rather than a cash payout.
First-order effects
- The 29M breach-affected users can now litigate as a single class demanding stronger security procedures, converting millions of individual grievances into one coordinated demand.
- Facebook avoids damages exposure on this theory entirely, but must defend — and ultimately remediate — its security practices under court supervision.
Second-order effects
- With money off the table, the realistic endgame is a procedural settlement, which is precisely how it resolved: Facebook committed to concrete security improvements instead of paying a class-wide sum.
- Plaintiffs' firms gain a repeatable playbook — pair a strong merits theory with an injunctive-only ask to clear the certification hurdle Facebook keeps contesting, as also seen in the logged-out tracking suit allowed to proceed in April 2020.
Third-order effects
- If the pattern holds across these cases, US courts effectively create a parallel enforcement channel for data security: no statutory payouts, but judge-approved engineering mandates that bypass both regulators and class-action economics.
- For platforms generally, the marginal cost of a breach shifts from potential damages toward mandated remediation — making pre-litigation security posture the cheaper option and quietly raising the industry's baseline.
The trend: Privacy litigation against Facebook is converging on injunctive-only class actions that trade cash settlements for court-supervised changes to security and data practices.