Proposed settlement in Facebook Beacon case draws fire from advocacy groups

Just over two years ago now, Facebook began deploying a behavioral tracking service it called Beacon, which automatically enabled the tracking of Facebook users' behavior, but shared that data with advertising partners. It wasn't an "opt-in" service by anyone's definition, and after Facebook took down most of the service, customers filed a class-action suit against the social network.

In a proposed settlement last September, Facebook is opting to use its own money -- some $9.5 million -- to establish a fund for the creation of a foundation to help make Web users more aware of their privacy rights, and how they can improve their online safety. It's what the law calls a cy près settlement, named for an old French phrase that literally means, "the next best thing."

"Next best" isn't exactly a settlement, contends the advocacy group Public Knowledge, in a statement for the court in the Beacon case filed yesterday. Why, asks Public Citizen, should Facebook use its own money to pay its own people to do what it should have been paying its own people to do in the first place?

"Creating the Facebook foundation is an inappropriate cy pres-like remedy that provides no value to the class because (1) the foundation is unneeded -- numerous established organizations already advocate for improved online privacy, safety, and security by educating users, regulators, and businesses; and (2) Facebook, whose founder and CEO questions whether privacy rights should be safeguarded, retains unwarranted influence over the proposed foundation," reads Public Citizen's official objection to the proposed settlement (PDF available here). "In essence, Facebook is paying itself money to gain a broad release of its users' legal claims and to create an unneeded foundation over which it will have significant control. It is difficult to imagine a greater abuse of the cy pres remedy."

Public Citizen is seeking a legal award of at least $2,500 per member of the class action, the precedent for which it claims has already been established by the Video Privacy Protection Act. That law was originally created to prevent the misuse of data belonging to customers of video rental establishments.
But the group's plea is noteworthy also for what it's not asking for, or more accurately, what's it's asking to not receive: specifically, the creation of yet another policy group advising social networks to be more respectful, and users everywhere to be more careful. We get that already, the group argues.

"Numerous independent, non-profit groups already exist to do precisely that," writes Public Citizen. "A list of such organizations, although not comprehensive, includes the Electronic Privacy Information Center ("established in 1994 to focus public attention on emerging civil liberties issues and to protect privacy, the First Amendment, and constitutional values"), the Electronic Frontier Foundation ("educates the press and public" by "defending free speech, privacy, innovation, and consumer rights today"), Privacy Rights Clearinghouse ("two-part mission -- consumer information and consumer advocacy" with goals to "[r]aise consumers' awareness of how technology affects personal privacy, and to empower consumers to take action to control their own personal information"), the Center for Digital Democracy (addressing privacy issues while promoting "an electronic media system that fosters democratic expression and human rights"), and the World Privacy Forum ("focused on conducting in-depth research, analysis, and consumer education in the area of privacy"). In addition, the Rose Foundation's Consumer Privacy Rights Fund, created from a series of settlements in cases involving consumer privacy issues, awards grants to support privacy-related research, education, advocacy, and policy development...In addition to being well-established, these organizations have the advantage of not being controlled by Facebook."

Public Citizen's retort now joins that of the Electronic Privacy Information Center, the Center for Digital Democracy, and four other groups which jointly filed their own letter of opposition last month. In it, the groups' attorneys write, "Facebook is not accused of failing to effectively 'educate' users and regulators. Facebook is accused of inappropriately disclosing its users' personal information in direct violation of state and federal law. A foundation whose primary goal is the education of users regarding business practices is not an appropriate remedy where it is the business practices that caused the harm."

When the settlement was proposed last September, digital media attorney David Johnson of law firm Jeffer, Mangels, Butler & Marmaro LLP smelled a rat right away. In a blog post for his firm, Johnson wrote, "What a deal! Facebook is already required by law to promote the online privacy, safety and security of its users' information. For example, the FTC has mandated that all companies must 'maintain reasonable and appropriate measures to protect sensitive consumer information' and has already filed suit and obtained consent orders requiring a couple of dozen consumer-oriented businesses like Facebook to do so...So Facebook effectively gets most of its money back to fund projects that it is already has an obligation to perform. If the Court winds up cutting the fees paid to Plaintiffs' counsel, this just means that more money will go back to Facebook to pay for things it is already obligated to do."

For its part, Facebook declared the matter closed last September, and has had no further comment since then. The judge in the San Jose US District Court case already granted preliminary approval to the settlement in October, but final approval awaits the judge's review of comments received in the interim.

[A previous edition of this article incorrectly identified the intervenor in this case as Public Knowledge, not Public Citizen. Betanews regrets the error, has made corrections above, and apologizes to both groups for the misidentification.]