• by Wendy Davis  @wendyndavis, March 3, 2020

A federal appeals court has upheld a Facebook's settlement of a class-action privacy lawsuit centered on allegations that the company scans users' private messages.

The settlement -- which requires Facebook to add a single, 22-word sentence to its help site -- faced a challenge by an activist who argued the deal doesn't benefit users.

On Tuesday, the 9th Circuit Court of Appeals rejected that challenge, writing that the new disclaimer mandated by the deal is valuable.

The new disclosure “provides information to users about Facebook’s message monitoring practices, making it less likely that users will unwittingly divulge private information to Facebook or third parties in the course of using Facebook’s messaging platform,” Circuit Judge Michelle Friedland wrote in an opinion joined by Clifford Wallace and Richard Clifton.

The deal also requires Facebook to pay around $4 million to the class-action attorneys who brought the case, and $5,000 each to the two Facebook users who served as plaintiffs, but doesn't provide any monetary awards to the company's other users. Instead, users who want to pursue claims for monetary damages may pursue new lawsuits.

The settlement, approved by U.S. District Court Judge Phyllis Hamilton in the Northern District of California, resolved a 2013 lawsuit brought by Arkansas resident Matthew Campbell and Oregon resident Michael Hurley. They alleged that Facebook violated the federal wiretap law by intercepting users' messages to each other and scanning them. The company reportedly did so to determine whether people were sending their friends links to outside sites.

Details about the scans emerged in 2012, when security researcher Ashkan Soltani reported that Facebook counts in-message links as "likes." Facebook said at the time that no private information was exposed, but confirmed that the like-counter number incorporated shares within private messages.

Facebook subsequently changed that practice. The settlement agreement acknowledges the change, but doesn't prevent the company from changing it back again.

The deal requires Facebook to pay up to almost $4 million to the class-action attorneys who brought the case, and $5,000 each to the two Facebook users who served as plaintiffs, but no monetary awards to the company's other users. Instead, users who want to pursue claims for monetary damages may bring new lawsuits.

The settlement also obligates Facebook to add the following sentence to its help site: “We use tools to identify and store links shared in messages, including a count of the number of times links are shared.”

A lawyer with the Center for Class Action Fairness objected to the deal and asked the 9th Circuit to vacate it.

That request was supported by the Electronic Privacy Information Center, which argued in a friend-of-the-court brief that the deal was inadequate because it doesn't prohibit Facebook from resuming the message scans. EPIC also argued the new sentence doesn't adequately inform users about the company's practices.

For its part, Facebook argued to the 9th Circuit that the lawsuit should have been dismissed by Hamilton on the grounds that the alleged message scans didn't cause any concrete harm.

“This is not a case of an unauthorized third party tapping a phone line or hacking into a computer system and stealing confidential communications,” Facebook argued in papers filed with the 9th Circuit last June. “Rather, Plaintiffs voluntarily shared messages containing URL preview attachments on a platform that they knew would receive and store them.”

The appellate judges rejected that argument. “Our precedent confirms that plaintiffs have asserted a concrete harm,” the opinion states.