No. C 18-05982 WHA

STEPHEN ADKINS, Plaintiff, v. FACEBOOK, INC., Defendant.

United States District Court, N.D. California.

May 6, 2021.



Both sides seek final approval of a class action settlement and class counsel seek a large sum in fees and costs.


A coding error allowed hackers to break into the Facebook platform and pilfer the personal information of millions of users in the United States. This came to light in 2018, leading to a flurry of complaints. A prior order explained the coding vulnerability responsible for the data breach (Dkt. 153). In brief, if three particular features on the Facebook platform aligned simultaneously, "access tokens" became visible. Similar to a password, access tokens permitted access to accounts. The compromising of access tokens made millions of users accounts vulnerable to entry (Dkt. 193).

A consolidated complaint sought relief in the form of a credit monitoring service for the victims, in addition to compensatory, statutory, and punitive damages, and declaratory relief based on ten claims. To this end, counsel moved to certify a class of users whose information had been compromised. An order declined to certify a damages class but allowed an injunctive relief class. Users were left to pursue damages claims on their own but no one ever filed one (Dkt. 338 at 4). All but two of plaintiffs' claims were dismissed and by the time the case settled, only one named class representative remained out of the 11 plaintiffs involved in the case after consolidation. The terms of the settlement included commitments by Facebook to prevent future vulnerabilities related specifically to access tokens and consent to be independently monitored.

More specifically, Facebook's security commitments include (Dkt. 315-5 at 27-29):

1. Tools to run integrity checks on updates 2. Tools for the detection of suspicious patterns in the generation and use of access tokens 3. Procedures to contain security incidents related to improper issuance of access tokens 4. Automatic alerts for suspicious activity in user growth metrics and reporting on that activity 5. Five years of annual SOC2 Type II security assessments of certain products related to security and vulnerability management and an agreement to report the results to the Court and class counsel 6. Processes that give applications related to access tokens only the capabilities to perform intended functions, including internal guidance to software engineers for selecting capabilities of applications using access tokens and automatic removal of access token capabilities for applications that do not use those capabilities over a 90-day period 7. Certification by Facebook that it eliminated the type of authentication proofs which made user credentials vulnerable 8. Commitment to employing at least one senior security executive who reports to Facebook's Board of Directors 9. Logging issuance and receipt of access tokens to facilitate detection and investigation of compromised access tokens

Class counsel also move for attorney's fees in the amount of $10,700,000 (based on a 1.253 multiplier), $1,210,900.75 in costs, a reserve of $15,000 for a data security vendor to monitor compliance with the settlement terms (by way of the SOC2 Type II assessments), and a $5,000 service award for plaintiff Stephen Adkins (Br. at 2-3).


After the coding error in the Facebook platform exposed users to possible loss of personal information, at least ten civil actions were immediately filed in this district and consolidated. A previous order certified a class seeking injunctive relief but rejected certification of a damages class. A class settlement followed whereby Facebook agreed to maintain certain security fixes almost all of which Facebook would likely have maintained anyway. This order will approve the settlement as fair and adequate in light of the substantial risks of litigation. All damages claims have been preserved but none have been asserted anywhere by any of the millions potentially affected. This order will also grant reasonable attorney's fees and expenses for class counsel but not for other lawyers.


Under FRCP 23(e), the Court must approve any settlement agreement that will bind absent class members. In reviewing a proposed settlement agreement, the district court must perform two tasks: (1) direct notice in a reasonable manner to all class members who would be bound by the proposal; and (2) approve the settlement only after a hearing and on finding that the terms of the agreement are fair, reasonable, and adequate. In determining if a settlement is fair, reasonable, and adequate, district courts take into account (1) the strength of the plaintiffs' case; (2) the risk, expense, complexity, and likely duration of further litigation; (3) the risk of maintaining class action status throughout the trial; (4) the amount offered in settlement; (5) the extent of discovery completed and the stage of the proceedings; (6) the experience and view of counsel; (7) the presence of a governmental participant; and (8) the reaction of the class members to the proposed settlement. In re Online DVD-Rental Antitrust Litig., 779 F.3d 934, 944 (9th Cir. 2015).

A prior order approved the form, content, and planned distribution of the class notice. The claims administrator has fulfilled the notice plan. This order further finds that notice to class members was adequate. For the following reasons and for the reasons stated in the November 2020 order (Dkt. 314), the proposed class settlement is fair, reasonable, and adequate under FRCP 23(e).

In considering the strength of plaintiff's case, this order notes that what Facebook did wrong was not an intentional betrayal of its users for profit. At most Facebook was negligent in allowing a confluence of rare circumstances to open up access tokens to strangers and, arguably, being too slow to catch this vulnerability. The heart of this case was a software coding mistake. Given the many millions of lines of codes, Facebook cannot entirely rid its complex system of all risk of software coding errors. So, the relief obtained herein will not eliminate all future breaches or leaks. Though Facebook reports in supplemental briefing that no further breaches related to access tokens have occurred since putting the settlement measures into place, other intrusions of one sort or another will eventually recur.

Class counsel characterize their success achieved by settlement as "momentous." In the Court's view the success of the settlement seems modest as best and cosmetic at worst. This will be discussed further in connection with the motion for attorney's fees.

The benefit obtained, however, meets the threshold of adequacy in light of the above explained context, as well as the expense to the parties' and the drain on resources that would result from continued litigation.

These proceedings have been ongoing for more than two years and extensive discovery has been taken, including 20 depositions. There has been a motion to dismiss which was granted in part and denied in part, but no dispositive motions. This makes settlement appropriate given the limited relief that could be awarded even if the case were litigated all the way through trial.

One individual responded to the notice of class settlement. The objector claims her personal information was compromised and led to identity theft and phone malfunction. Facebook submitted a declaration stating the class notice administrator, Angeion Group, LLC, searched data provided by Facebook and could not verify that the objector was a class member (Dkt. 327-2 at 2). Angeion was unable to contact the objector with the email and phone number provided in the objection (Dkt. 327-2 at 2). The objection raises no points that warrant denial of settlement because the objector remains free under the settlement to independently pursue any claim for damages.


In the class settlement agreement, Facebook agreed to pay attorney's fees and costs awarded by the Court to "Class Counsel" (Dkt. 315-5 at § 7.4):

Facebook shall pay the attorneys' fees, costs, and expenses awarded by the Court to Class Counsel.

The agreement further defined "Class Counsel" as (Dkt. 315-5 at § 1.6):

"Class Counsel" and "Lead Settlement Class Counsel" mean John Yanchunis of Morgan & Morgan Complex Litigation Group, Ariana Tadler of Tadler Law LLP, and Andrew Friedman of Cohen Milstein Sellers & Toll PLLC.

This definition tracked the definition in the class certification order that had appointed these very lawyers, describing them as "class counsel" (Dkt. 260 at 16).

This order will, accordingly, award all reasonable attorney's fees, costs, and expenses to class counsel but will not do so for lawyers other than class counsel.

Although most of the work appears to have been done by class counsel, the application includes time and expenses for 17 law firms and over 100 timekeepers, including law firms that represented one or more early plaintiffs (all but one of whom eventually withdrew or were dismissed). None of these other firms were ever designated as class counsel.

Applicants, however, answer that the work of class counsel was farmed out to many of these other firms, and therefore seek to include them, albeit after the fact. At the recent hearing, Attorney de Bartolomeo stated (Tr.):

[Counsel] may not have done as clear a job as we would have liked. . . for the judge of advising that there were going to be additional lawyers and law firms working on this case in addition to the appointed, I see it's ECF Number 72 which [counsel] submitted to the Court at the appointment time, advising that there was going to be committee structure and other firms would be working under the guidance and direction of the co-leads. So I would just point that out. So if the Court wants to consider that, [counsel] did advise that there would be additional lawyers.

(Dkt. 348, Tr. at 35). Therefore, applicants say, Facebook should pay the committee members for their work.

This is not quite what the record shows.

Under Rule 23, there is a difference between "class counsel" versus "interim counsel." Class counsel refers to counsel appointed at the time of class certification by the district court to represent the certified class through discovery, pretrial, trial, and appeal and must, where there are more than one applicant, be the counsel "best able to represent the interests of the class." By contrast, "interim counsel" refers to counsel "to act on behalf of a putative class before determining whether to certify the action as a class action." Interim counsel are the exception and not the rule. (Class counsel are not only the rule but mandatory.) Interim counsel are usually helpful early on when a number of related actions are moving toward consolidation. Interim counsel can act as a coordinator for the jumble of cases. But once the cases are consolidated and class counsel expressly appointed, interim counsel disappear and there is no need for coordination.

During an early case management conference on January 12, 2019, counsel said they would move to be interim counsel to help coordinate the various cases. The Court replied:

But we do need a motion for interim counsel from the plaintiffs' side on this coordinated thing, and I want you all to come up with something . . . I'll give you my lecture on the plaintiffs' side. I like streamlined. One lawyer, one firm is the best. Now, maybe you don't want to give me that. Okay, I can maybe live with two, but what we can't have is a top-heavy structure that is going to rack up big fees, and I don't like that. That's just a waste of money. So you need to think of a good system, even for the interim counsel part, to avoid the problem of a top-heavy plaintiff counsel structure. Please take that to heart. I don't know enough about this case to tell you how that applies here, but . . . some just say, oh, whatever they want, give it to them. No, I'm not that way. I want to protect the class, potential class. So that's one thing. The other is, whoever is the lead counsel for interim counsel purposes is not necessarily who will wind up being the lead for the class on Rule 23. Some . . . could be, but I would be open to someone else taking that role as well. So you need to make that motion pronto. You can do that soon in order for us to be able to work out some of these problems that are probably going to come up in the next four weeks.

In response, Attorney McNamara of Cohen Milstein stated, "That is helpful guidance, and we will abide by it" (Dkt. 71, at 114-15).

Three days later, on January 15, 2019, counsel filed their motion to appoint John Yanchunis of Morgan & Morgan, Ariana Tadler of Milberg Tadler Phillips Grossman LLP, and Andrew Friedman of Cohen Milstein Sellers & Toll, PLLC as "interim counsel" (Dkt. 72). At the end of the attachments to that motion, counsel included a table depicting a committee structure for delegating work across 17 law firms and a protocol for time and expense reporting (Dkt 72, Exhs. 5, 6). The protocol included the statement "before you expend any time in this litigation for which you may seek compensation, you must obtain written approval in advance from Co-Lead Counsel" (Dkt. 72, Exh. 6) (emphasis in original). The full section read (Dkt. 72, Exh. 6):

As fiduciaries to the proposed Class, we are obligated to litigate this case effectively and efficiently, without unnecessary effort and duplication. Proposed Co-Lead Interim Counsel ("CoLead Counsel") have, therefore, prepared this protocol to ensure those goals. We will strictly adhere to these directives. Accordingly, before you expend any time in this litigation for which you may seek compensation, you must obtain written approval in advance from Co-Lead Counsel. Moreover, the written approval must clearly authorize all of the time for which you seek to be compensated. If you have any doubts about whether your time has been so authorized, please reach out to us for clarification. Simply reporting the time does not mean a firm will be paid for that time or that such time will be included in any fee application. We will not be able to include in any fee petition any time that is not expended and timely reported in accordance with this protocol. Further, CoLead Counsel will evaluate the propriety of all reported time to ensure that the tasks were efficiently handled and the time is reasonable.

On February 14, the Court approved the proposed interim counsel (Dkt. 79). That order acknowledged that (Dkt. 79 at 4):

[C]ounsel have committed to expending resources to represent the putative class. Counsel have already retained experts and have tentatively created and assigned committees with the existing firms involved in this action (each to be led and supervised by one of the proposed counsel), to meet the deadlines set by the case management order. To date, proposed counsel have managed this litigation with the unanimous support of all counsel in the consolidated cases. Counsel have also prepared protocols to govern timekeeping, monthly submission of time records, and other administrative tasks.

The order again "remind[ed] interim counsel that, as usual, duplicative or excessive requests for attorney's fees will be looked upon with disfavor" (Dkt. 79 at 4).

The committee structure made sense at the interim stage under Rule 23(g)(3) so as to allow more lawyers to have a shot at becoming class counsel and to give various contenders a role prior to selection of class counsel at the certification stage. All of the above occurred before any motion for class certification.

Many months later at the class certification stage, interim counsel moved to certify a damages class and argued for the adequacy of the existing interim counsel for the continued representation of the class (Dkt. 197-4). The motion for class certification simply stated, "Proposed class counsel, approved by this Court as interim counsel, are experienced class action attorneys and are committed to prosecuting this case," recited class counsel's work on the case up to that point, and concluded that "[p]laintiff and proposed Class Counsel meet the adequacy requirement" (Dkt. 197-4 at 14). No mention was made of any committee structure.

The Court's order certifying a class and appointing class counsel, unlike the interim order, did not approve or refer to any committee structure (Dkt. 260). That order stated (Dkt. 260 at 16):

Plaintiff's counsel Andrew Friedman of Cohen Milstein Sellers & Toll PLLC, John Yanchunis of Morgan & Morgan Complex Litigation Group, and Ariana Tadler of Tadler Law LLP are hereby APPOINTED as class counsel.

This definition is the very definition used in the settlement agreement — three firms and three firms only. Attorney de Bartolomeo was incorrect, therefore, in suggesting that the applications for class counsel informed the Court that a committee would assist class counsel. Although the committee structure surfaced in the interim motion (and resulting order appointing interim counsel), no references were made to a committee in the later motion for appointment of class counsel (or in the resulting order appointing class counsel). Class counsel were specifically called out as the three firm in the order.

It was therefore improper for class counsel to delegate class representation after appointment. Any work farmed out to lawyers other than class counsel shall not be included in the lodestar.

Turning to the work of class counsel, our review even for work by class counsel raises questions concerning reasonableness of time spent and costs requested. For example:

• Class counsel seeks compensation for the cost of flying 20 attorneys to a two-hour all-hands meeting in Chicago. Apparently, none of the attorneys or firms were already located there. Though there exists a real need to coordinate law firms before the appointment of class counsel, this meeting could have been conducted telephonically. • Class counsel seek reimbursement of $5,643.06 in hotel costs for a single attorney to attend a Case Management Conference, among other unexplained high hotel charges.

These are but two examples. The special master shall scrutinize the entire lodestar of class counsel to reduce it to a reasonable amount.

The benefit obtained for the class is of foremost importance in determining the reasonableness of fees so "where the plaintiff has achieved only limited success, counting all hours expended on the litigation — even those reasonably spent — may produce an excessive amount, and the Supreme Court has instructed district courts to instead award only that amount of fees that is reasonable in relation to the results obtained." In re Bluetooth Headset Prod. Liab. Litig., 654 F.3d 935, 942 (9th Cir. 2011). Here, the settlement is really little more than what Facebook would have done anyway. In the preliminary settlement approval and in their supplemental briefing, both parties explained that Facebook voluntarily adopted most of the security measures upon the recommendation of a working group created in 2018. Though many of the security measures came about after the filing of complaints related to the breach, class counsel do not state that these measures arose specifically from settlement discussions. In fact, two of the settlement terms were practices Facebook had been using even before the breach occurred (undergoing annual security assessments and board oversight of cybersecurity) (Dkt. 334 at 5, Dkt. at 7). The only truly novel element of the settlement agreement is the involvement of the Court, class counsel, and an independent monitor in ensuring that Facebook maintains the security measures they would have implemented anyway.

Again, what Facebook did wrong was a coding mistake, not an attempt to sell users' private information. Most claims got dismissed. No damages class got certified. What survived for trial was a negligence claim and a claim for declaratory and injunctive relief. The settlement implicates limited aspects of Facebook's overall data security responsibilities — those related to access tokens — and provides neither monetary damages nor individualized credit monitoring for class members. In light of the thinness of the surviving claims and limited class certification obtained, the settlement itself is understandably thin as well but acceptable in view of the probable merits, but the benefit achieved in this case for the class is modest. Class counsel waxed poetic about the complexity, technicality, and novelty of the data security issues presented in this case, but note well the settlement calls for only pocket change to the monitor who will ensure that Facebook abides by the settlement terms. That amount is merely $15,000 over five years. This is further evidence of a cosmetic settlement.

This order will allow recover for all of the reasonable time incurred by class counsel in the case (without reduction for limited success) because Facebook agreed to pay it in the settlement agreement. But no bonus or multiplier will be allowed in view of the limited success in this case (even if the agreement could be stretched to cover a bonus or multiplier).


Incentive awards pose the risk that a class representative has gone along with a settlement, not because it secures a good outcome for the class, but simply for the incentive award. Such awards should therefore be subject to careful scrutiny. This order finds the $5,000 incentive award for plaintiff Adkins unreasonably high. A reasonable amount is $500 in order to compensate plaintiff Adkins for the use of his vacation time from work to travel to San Francisco for proceedings and his role in discovery (including allowing his phone to be forensically examined).


The companion order appointing a special master gives further instruction on how billing entries must be organized. A review of the excel document submitted in camera suggests that the time keeping in this case was relatively thorough, but class counsel should resubmit their billing records to align the instructions set out in the companion order if needed.


The final settlement is APPROVED and class counsel's fees motion is GRANTED in part as to entitlement of class counsel (and class counsel only), but DENIED as to amount. The special master will recalculate fees and costs to a reasonable sum based on the foregoing considerations and the companion order.



A companion order found class counsel entitled to reasonable attorney's fees.

1. Under Rules 53 and 54, the Court appoints ATTORNEY ELLEN EAGEN as the special master to determine the reasonable value of services rendered herein by class counsel (and class counsel only). By special accommodation of the Court, Attorney Eagen has agreed to provide this service at the reduced rate of $300 per hour. By MAY 14 AT NOON, each side shall submit a statement with any objection to the appointment, including any suggestions for alternative candidates or other requests to be heard. If neither side objects, then the Court will proceed with the appointment described herein.

2. Plaintiff's counsel shall provide the special master with an itemized accounting for unreimbursed expenses listed as "Travel" and "Expert Witness Fees." Travel must be broken down into at least the following categories: air transportation, ground travel, meals, and lodging. Non-working travel time must be distinguished from working travel time. Counsel may include additional categories, if necessary. Within each category, each expense must be listed with the date, description, and cost. Professional fees may be broken down into separate categories if counsel deems appropriate. The date, description, and cost for each expense incurred, such as the fee paid to an expert to produce an expert report on a specific issue, must be listed for all professional fees.

3. Counsel must also provide the special master a detailed declaration, organized by discrete projects, breaking down all attorney and paralegal time sought to be recovered. For each project, there must be a detailed description of the work, giving the date, hours expended, attorney name, and task for each work entry, in chronological order. A "project" means a deposition, a motion, a witness interview, and so forth. It does not mean generalized statements like "trial preparation" or "attended trial." It includes discrete items like "prepare supplemental trial brief on issue X." The following is an example of time collected by a project.

PROJECT: ABC DEPOSITION (2 DAYS IN FRESNO) Date Time-keeper Description Hours x Rate = Fee 01-08-20 XYZ Assemble and photocopy exhibits for use in 2.0 $100 $200 deposition. 01-09-20 RST Review evidence and prepare to examine ABC 4.5 $200 $900 at deposition. 01-10-20 XYZ Research issue of work-product privilege asserted 1.5 $100 $150 by deponent. 01-11-20 RST Prepare for and take deposition. 8.5 $100 $1,700 01-12-20 RST Prepare for and take deposition. 7.0 $200 $1,400 Project Total: 23.5 $4,350

4. All entries for a given project must be presented chronologically one after the other, i.e., uninterrupted by other projects, so that the timeline for each project can be readily grasped. Entries can be rounded to the nearest quarter-hour and should be net of write-down for inefficiency or other cause. Please show the sub-totals for hours and fees per project, as in the example above, and show grand totals for all projects combined at the end. Include only entries for which compensation is sought, i.e., after application of "billing judgment." For each project, the declaration must further state, in percentage terms, the proportion of the project directed at issues for which fees are awardable and must justify the percentage. This percentage should then be applied against the project total to isolate the recoverable portion (a step not shown in the example above).

5. A separate summary chart of total time and fees sought per individual timekeeper (not broken down by project) should also be shown at the end of the declaration. This cross-tabulation will help illuminate all timekeepers' respective workloads and roles in the overall case.

6. The declaration must also set forth (a) the qualifications, experience and role of each attorney or paralegal for whom fees are sought; (b) the normal rate ordinarily charged for each in the relevant time period; (c) how the rates were comparable to prevailing rates in the community for like-skilled professionals; and (d) proof that "billing judgment" was exercised. On the latter point, as before, the declaration should describe adjustments made to eliminate duplication, excess, associate-turnover expense, and so forth. These adjustments need not be itemized but totals for the amount deleted per timekeeper should be stated. The declaration must identify the records used to compile the entries and, specifically, state whether and the extent to which the records were contemporaneous versus retroactively prepared. It must state the extent to which any entries include estimates (and what any estimates were based on). Estimates and/or use of retroactively-made records may or may not be allowed, depending on the facts and circumstances.

7. Ordinarily, no more than one attorney and one paralegal need be present at a deposition; more will normally be deemed excessive. Ordinarily, no more than one attorney need attend a law-and-motion hearing; more will normally be deemed excessive. To allow for symmetry, however, the award will take into account the staffing used by the opposing party.

8. The special master shall review the briefs and declarations by the parties, hear argument, and then determine a reasonable amount to award, including any fees on fees. The special master shall also determine the extent to which any discovery should be permitted — with the caution that further discovery should be the exception and not the rule.

9. Except for any supplementation allowed by the special master, the foregoing submissions shall be the entire record for this dispute. There will be no further briefing unless allowed by the special master. After the special master's appointment, any further submissions solely for the special master's use should not be filed with the Court.



1. By signing below, ATTORNEY EAGEN IS HEREBY ACCEPTS APPOINTMENT AS SPECIAL MASTER to determine, with all reasonable diligence, the reasonable amount of attorney's fees and costs which Facebook shall pay to class counsel. She shall have all powers set forth in Federal Rule of Civil Procedure 53(c) with respect to this dispute but shall not revisit prior rulings in this case.

2. The procedure set forth in the prior order is incorporated into and deemed a part of this order. Attorney Eagen may set a briefing and argument schedule as she deems appropriate. The parties shall provide the special master with electronic text searchable copies of all documents relevant to this dispute and shall provide print copies (such as a tabbed binder for attorney-billing records) to an appropriate address as Attorney Eagen shall request.

3. By AUGUST 27 AT NOON, the special master shall file a written report and recommendation that includes her proposed findings and the recommended award of attorney's fees and costs to which class counsel is entitled. Her report should identify all amounts disallowed and state whether the amounts disallowed qualify for treble deduction, per the order granting the motion for fees.

4. Any objections to or motions regarding the special master's report and recommendation must be filed by SEPTEMBER 10 AT NOON, to be heard on the normal 35-day track, and shall not exceed 25 PAGES in length. The response to any such objection or motion shall be due SEVEN DAYS from the filing thereof and shall also not exceed 25 PAGES in length. No reply briefing, please.

5. The Court will then review and consider any timely objections to or motions regarding the special master's report and recommendation pursuant to Rule 53(f). The objecting party must file a declaration submitting to the Court a complete appendix of relevant communications with the special master. An order will follow.

6. Ex parte communications with the special master should be avoided if possible. Any objection to an ex parte communication or motion to disqualify must be filed within SEVEN CALENDAR DAYS of discovery.

7. Objections to this order shall be filed by MAY 14 AT NOON. Any proposed modification to this order must be promptly raised in a joint letter brief, not to exceed THREE PAGES in length, to be filed only after the parties have met and conferred — either in person or telephonically — under the special master's supervision.

8. Attorney Eagen shall please indicate her acceptance of this appointment as special master by signing and filing the below statement:

I accept this appointment and reference:



1000 Characters Remaining reserves the right to edit or remove comments but is under no obligation to do so, or to explain individual moderation decisions.

User Comments

Listed below are the cases that are cited in this Featured Case. Click the citation to see the full text of the cited case. Citations are also linked in the body of the Featured Case.

Cited Cases

  • No Cases Found

Listed below are those cases in which this Featured Case is cited. Click on the case name to see the full text of the citing case.

Citing Cases