Way back in 2007, Facebook began its march towards what many consider uber-creepiness. Their "Beacon" program connected third-party sites to Facebook and transmitted users' activities to their Facebook profile. One example were rentals from Blockbuster.com - when Jimmy rented "Sex and the City", his entire friends list would find out.
It wasn't intended to broadcast users' private information -- there was a way to prevent broadcast of such information. However, there was no opt-in. That meant a lot of accidently disclosed private info on users' profiles. Beacon was eventually discontinued.
This class-action lawsuit resulted from the snafu. It eventually settled for $9.5 million. Unfortunately, none of the money went to members of the class. Three million went to the lawyers and administrative costs, and $6.5 million went to D.T.F.
No, “Jersey Shore” fans, not that D.T.F. No, the Digital Trust Foundation was a brand-new nonprofit created to “fund and sponsor programs designed to educate users, regulators, and enterprises regarding critical issues relating to protection of identity and personal information online through user control, and the protection of users from online threats.”
Last September, a panel of the Ninth Circuit upheld the cy pres award by a 2-1 decision. On Tuesday, the Ninth Circuit denied a rehearing of the case, despite the passionate dissent of six judges.
Judge Smith stated that the award fulfilled neither of the two requirements for a cy pres settlement of a class action lawsuit: “(1) be reasonably certain to benefit the class, and (2) advance the objectives of the statutes relied upon in bringing suit.”
He also warned that “the majority in this case creates a significant loophole in our case law that will confuse litigants and judges, while endorsing cy pres settlements that in no way benefit class members.”
The dissenting six took issue with the choice of charity, the D.T.F. Judge Smith referred to it as a “bespoke creation of this settlement.” In addressing the organization’s mission statement (see above), the dissent argues that D.T.F. “simply promises that [it] will do some ‘stuff’ regarding some more ‘critical stuff.’ If fashioning an open-ended, one-sentence mission statement is all it takes to earn cy pres settlement approval in our court, we have completely eviscerated the meaning of our previously controlling case law.”
D.T.F.’s mission also fails to benefit the class because it seeks to educate people on Internet privacy through “user control.” The issue in the case was unauthorized access to data and misconduct by Internet companies that exposes private information in unpredictable ways.
While the original lawsuit blamed Facebook for disclosing private information without consent, the charity aims to fix users’ habits and teach them how to use privacy controls. User control means nothing, however, when the company behind the software is leaking data through new features unfamiliar to the user. Or as the court put it:
“[It] can’t teach users how to protect themselves from Facebook’s deliberate misconduct. Unless of course the DTF teaches Facebook users not to use Facebook. That seems unlikely.”