Last week, the plaintiffs in three related children’s privacy class actions sought preliminary approval of proposed settlements with sixteen defendants in those coordinated actions.  The matters—known as the Kiloo Action, the Disney Action, and the Viacom Action—are pending in the Northern District of California, case numbers 3:17-CV-04344-JD; 3:17-CV-4419-JD; 3:17-CV-4492-JD.  The motion, which can be found here, will be heard on September 10, 2020.  The district court will have to decide whether to approve these settlements, which seek equitable relief and no damages, and which may have significant implications on the mobile app providers that cater or appeal to children. 

The proposed settlements address children’s personal data, as defined by the Children’s Online Privacy Protection Act (“COPPA”) Rule, 16 C.F.R. §312.2.  They aim to provide protections that exceed existing regulatory requirements relating to the collection, use, and monetization of children’s personal data.  The settlements seek sweeping changes and conduct from defendants and also from non-parties.  Specifically, some of these mandates—if approved by the court—will apply not only in the apps identified in the lawsuits but also in thousands of other child-directed and mixed-audience apps. 

The proposed settlements seek to resolve children’s privacy claims on the eve of briefing class certification and following three years of highly contested litigation, substantial motion practice, and vigorous fact and expert discovery.  Privacy class actions are notoriously expensive, and these coordinated actions are no exception.  The plaintiffs are requesting over $9 million in attorneys’ fees and costs for their work to date. 

In these three cases, Plaintiffs ultimately were allowed to proceed on the following claims: (1) intrusion upon seclusion and claims under the California Constitutional Right to Privacy in all three actions; (2) a claim under the New York General Business Law, Section 349, in the Kiloo and Disney matters, and (3) claims under the California Unfair Competition Law and Massachusetts’s statutory right to privacy in the Disney Action.  According to the motion, the claims asserted in these actions are admittedly “novel,” and based on issues and law “still undeveloped,” including “the extent to which the personal data collected from Plaintiffs’ devices constitutes ‘children’s personal data,’ and whether Defendants’ conduct is considered ‘highly offensive’ to a reasonable person (particularly in light of the unique nature of each Defendant’s data collection practices), whether Defendants engaged in any ‘deceptive’ or ‘misleading’ business practices, and whether Plaintiffs have suffered sufficient injury.”  The proposed settlements promise to resolve all these claims and to provide stringent privacy protections beyond the current federal limitations on how children’s personal data may be collected and used.  What is striking is that the settlement may impact not only the defendants but many other businesses that were not a part of these lawsuits.

What further makes this proposed settlement notable is the fact that the class plaintiffs are not seeking any damages (aside from the nominal amounts for the named plaintiffs).  Rather, they seek only injunctive relief—which is simultaneously a victory for plaintiffs and somewhat of a windfall for defendants.  The use of class actions to seek only injunctive or declaratory relief is infrequent. 

The proposed settlements can therefore be viewed as a victory for both sides because the plaintiffs are not waiving their individual damages claims and are set to receive significant privacy safeguards in the future.  At the same time, however, the defendants recognize that future individual lawsuits for damages are unlikely, and this settlement can bring finality to a long and protracted litigation, without significant payments to the class members.  

These proposed settlements promise to provide far-reaching injunctive relief for class members, not only with respect to the gaming apps at issue in these lawsuits but also across thousands of apps embedded with the defendants’ technology.  All in all, the settlements thus extend to thousands of other apps (namely, over 16,000 unique apps and over 63,000 app versions).  Specifically, they place strict limitations on child-directed apps so that only contextual advertising is served to children under thirteen.  They have three common components: (1) a prohibition on behavioral advertising to children; (2) a limitation on advertising services to contextual advertising for children under thirteen; and (3) enrollment-process requirements for app developers aimed at educating and enabling them to screen apps for child-directed content.

Under the settlement terms, the defendants and others will no longer be able to track children over time and across apps for commercial purposes.  Additionally, the settlement will protect children from advertising that is based on any of their past online activities or on any of their previously collected data—regardless of whether it was collected in the subject app or anywhere else online.  The defendants and others also will not be able to use the children’s personal data collected from a current app session in any manner that further targets a specific user in future sessions in the same app, across other apps, or elsewhere online.  If approved, the settlements will necessitate business practices that, in some cases, exceed prevailing industry standards and federal requirements.  Finally, the bulk of the injunctive relief obtained through these settlements will apply industry-wide and will extend to thousands of apps that are popular with children.

Injunction-only class actions are less common.  Rule 23(b)(2) of the Federal Rules of Civil Procedure allows a court to certify a class action in cases in which “final injunctive relief or corresponding declaratory relief is appropriate respecting the class as a whole.”  Yet most class actions typically focus on damages, and most class action settlements ultimately offer class members both compensatory and injunctive relief.  Previously, plaintiffs bringing cases seeking equitable relief did so in consumer fraud, civil rights, and product liability medical-monitoring cases.  A new trend may be emerging, however, making such actions especially attractive in privacy class actions where damages are difficult to prove or may defeat class-action prerequisites.  Additionally, since the U.S. Supreme Court has tightened the certification requirements in class actions seeking damages, and since injunctive relief cases do not center on predominance or superiority, an injunctive class is easier to certify and is therefore a more attractive option in privacy cases. 

Another useful feature of injunction-only class actions is that they do not require notice to the class—the single biggest procedural impediment to class certification, as well as an expensive tool.  See Fed. R. Civ. P. 23(c)(2); Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338, 362 (2011).  Thus notice was not required in the Kiloo Action, the Disney Action, and the Viacom Action.  The parties, nevertheless, agreed to provide notice to the settlement classes in accordance with an agreed-upon (presumably, less costly) plan.