• by Wendy Davis  @wendyndavis, February 2, 2018

An influential privacy group is asking a federal appellate court to vacate Facebook's recent settlement of a lawsuit alleging that it scanned users' messages.

The Electronic Privacy Information Center says in new court papers that the class-action settlement is inadequate for several reasons, including that it doesn't prohibit Facebook from performing the scans.

The settlement, approved by U.S. District Court Judge Phyllis Hamilton in the Northern District of California, resolved a 2013 lawsuit brought by Arkansas resident Matthew Campbell and Oregon resident Michael Hurley. They alleged that Facebook violated the federal wiretap law by intercepting users' messages to each other and scanning them. The company reportedly did so to determine whether people were sending their friends links to outside sites.

Details about the scans emerged in 2012, when security researcher Ashkan Soltani reported that Facebook counts in-message links as "likes." Facebook said at the time that no private information is exposed, but confirmed that the like-counter "reflects the number of times people have clicked those buttons and also the number of times people have shared that page's link on Facebook."

Facebook has since changed that practice. The settlement agreement notes that Facebook revised its prior practice, but doesn't prevent the company from changing it back again.

The deal requires Facebook to pay up to almost $4 million to the class-action attorneys who brought the case, and $5,000 each to the two Facebook users who served as plaintiffs, but no monetary awards to the company's other users. Instead, users who want to pursue claims for monetary damages may bring new lawsuits.

The settlement also obligates Facebook to add the following sentence to its help site: “We use tools to identify and store links shared in messages, including a count of the number of times links are shared.”

Last month, the Center for Class Action Fairness, founded by activist Ted Frank, asked the 9th Circuit to vacate the deal on the grounds that it doesn't benefit users. EPIC is supporting that request.

"The settlement does not prevent Facebook from resuming the practices that provided the basis for this lawsuit," EPIC argues in papers submitted Thursday to the 9th Circuit Court of Appeals.

The privacy group also says the new sentence Facebook added to its help page doesn't adequately inform users about the company's practices. "Mere notice is especially inadequate here, given the degree of uncertainty, lack of transparency, and lack of information that Facebook users possess," the group writes.

EPIC also notes that the settlement doesn't require Facebook to take steps to make sure users will view the new sentence. "Facebook will merely post disclaimers buried in its Help Center and Data Policy without providing any notice to current Facebook users," the group writes.