There was a problem locating the requested document.
Page 1 UNITED STATES DISTRICT COURT
NORTHERN DISTRICT OF CALIFORNIA
IN RE: FACEBOOK, INC. CONSUMER
PRIVACY USER PROFILE
LITIGATION,
Case No. 18-md-02843-VC
This document relates to:
ORDER GRANTING IN PART
PLAINTIFFS’ MOTION FOR
SANCTIONS
ALL ACTIONS
Re: Dkt. Nos. 879, 1007-3
This case is an example of a wealthy client (Facebook) and its high-powered law firm
(Gibson Dunn) using delay, misdirection, and frivolous arguments to make litigation unfairly
difficult and expensive for their opponents. Unfortunately, this sort of conduct is not uncommon
in our court system. But it was unusually egregious and persistent here. To give just a few
examples:
•
The central allegation in this case is that Facebook shared the plaintiffs’ private
information with other companies. But Facebook insisted that: (1) it need not disclose to
the plaintiffs what information it had collected about them unless it had shared that
information with third parties; and (2) the plaintiffs were required to take at face value
Facebook’s assertions about what information it had shared. Merely reciting this
argument shows how ridiculous it is, but Facebook and Gibson Dunn repeated it over,
and over, and over again—despite the presiding magistrate judge telling them many times
that it made no sense.
•
In the wake of the Cambridge Analytica scandal, Facebook investigated other apps that
might have misused private user information. After the magistrate judge ruled that the
investigation was not privileged as a blanket matter, Facebook and Gibson Dunn insisted
that non-lawyer communications created in the course of that investigation (such as
internal emails between Facebook employees) need not be produced. It was obvious at
the time that these documents were likely to be probative, and that view has only been
confirmed now that Facebook has finally been forced to produce them. Perhaps realizingPage 2 they had no real argument for withholding these documents, Facebook and Gibson Dunn
contorted various statements made by opposing counsel and the magistrate judge beyond
recognition, using them to argue that everyone had already agreed that Facebook need not
produce the communications—even as the plaintiffs continued to demand them. And
again, after being told repeatedly that these arguments made no sense, Facebook and
Gibson Dunn insisted on pressing them.
•
Facebook’s witnesses and lawyers deliberately prevented the plaintiffs from obtaining
probative information during depositions. For example, during a deposition of one
Facebook employee whom Facebook designated to testify about the company’s
information-sharing practices, a Gibson Dunn lawyer instructed the witness not to answer
at least 22 times, asserting that the questions were beyond the scope of the deposition
notice. Many of these questions were obviously within the scope of the notice. But more
to the point, as Facebook and Gibson Dunn now concede, it is improper to instruct a
corporate witness not to answer a question based on scope. The witness herself emulated
her lawyer’s belligerence, refusing to answer questions without even waiting for an
objection. Eventually, the deposition became so hostile that the witness stated she would
do her own “bitching and moaning” about the plaintiffs’ questions.
•
All the while, Facebook and Gibson Dunn had the audacity to accuse the plaintiffs’
lawyers of delaying the case, and to assert that the plaintiffs’ reasonable efforts to obtain
obviously relevant discovery were frivolous. It’s almost as if Facebook and Gibson Dunn
spent the better part of three years trying to gaslight their opponents, not to mention the
Court.
Sometimes lawyers and their clients engage in conduct of this sort because they are
incompetent. Facebook and Gibson Dunn are not incompetent. Sometimes lawyers reflexively
oppose the other side’s requests without giving any thought to their actions. That does not seem
like Facebook and Gibson Dunn. Instead, the Court finds by clear and convincing evidence that
Facebook and Gibson Dunn’s conduct reflected a sustained, concerted, bad-faith effort to throw
obstacle after obstacle in front of the plaintiffs—all in an attempt to push the plaintiffs into
settling the case for less than they would have gotten otherwise. The plaintiffs are entitled to
recover $925,078.51 for the fees and costs they incurred responding to this misconduct.
Facebook and Gibson Dunn are jointly liable for this amount.
I
During the 2016 presidential election, Cambridge Analytica, a British consulting firm,
sent targeted political ads to voters using personal information gleaned from millions of
2Page 3 Facebook accounts. Cambridge Analytica had purchased the information from Aleksandr Kogan,
a data scientist at the University of Cambridge. Kogan was able to collect this information
through an app he launched on Facebook’s platform. The app interacted with Facebook users and
gave Kogan access to their personal information, as well as the personal information of their
Facebook friends. Through this process, Kogan was able to compile a dataset that included
information on 87 million Facebook users—even though only around 300,000 users had
downloaded the app.
Following the scandal, reports emerged suggesting that the ability of people like Kogan
and entities like Cambridge Analytica to obtain sensitive information was the norm rather than
the exception. In response, the Federal Trade Commission launched an investigation into
whether Facebook’s practices violated a 2012 consent decree that required Facebook to maintain
a reasonable privacy program and prohibited the company from making misrepresentations about
the privacy and security of users’ information. Facebook ultimately settled the matter, agreeing
to pay a $5 billion fine and to modify its corporate structure to better protect users’ privacy.1
Facebook and its executives also issued a number of public apologies. CEO Mark
Zuckerberg acknowledged that the scandal was a “major breach of trust,” and he was “really
sorry” that it happened.2 Zuckerberg and Facebook took out full-page ads in ten newspapers
repeating that apology.3 Facebook’s then-COO Sheryl Sandberg echoed that message, saying
that Facebook should have “taken…steps years ago” to prevent abuse on the platform and
acknowledging that Facebook “made some really bad mistakes.”4
Dozens of private lawsuits were also filed by Facebook users against the company, and
1
FTC Imposes $5 Billion Penalty and Sweeping New Privacy Restrictions on Facebook, Federal
Trade Commission (July 24, 2019), https://perma.cc/2WPY-JZNY.
2
Eli Meixler, ‘We Have a Basic Responsibility to Protect Peoples’ Data.’ Mark Zuckerberg
Addresses Data Crisis, Time (March 21, 2018), https://perma.cc/35FL-SHJD.
3
Nick Statt, Mark Zuckerberg Apologizes for Facebook’s Data Privacy Scandal in Full-Page
Newspaper Ads, The Verge (March 25, 2018), https://perma.cc/9NUG-SGUQ.
4
Steve Inskeep, Full Transcript: Facebook COO Sheryl Sandberg on Protecting User Data,
NPR (April 5, 2018), https://perma.cc/3SWC-LXUP.
3Page 4 the cases were assigned to this Court for pretrial proceedings.5 The Court then appointed two
attorneys to serve as lead plaintiffs’ counsel, and those attorneys filed a consolidated class action
complaint, asserting a variety of claims under federal and state law. The complaint was filed on
behalf of roughly three dozen individual Facebook users. These “named plaintiffs” proposed to
represent a class of all Facebook users whose personal information was improperly disseminated
or inadequately protected by Facebook from 2007 to the present.
The lawsuit alleged that Facebook allowed app developers operating on the company’s
platform to ask users for permission to access their friends’ personal information, and that this
practice allowed the apps to collect vast amounts of the friends’ information without their
consent. Around 2014, Facebook decided to limit app developers’ ability to access users’
friends’ information, but the plaintiffs alleged that Facebook gave certain preferred apps—
sometimes described as “whitelisted apps”—continued access based on concerns about
Facebook’s bottom-line.
The plaintiffs also focused on another information-sharing program: Facebook’s
relationship to its “business partners.” These business partners included companies hired to build
Facebook’s platform on different devices and for different operating systems (like a Facebookbranded app for a Blackberry phone). According to the plaintiffs, Facebook shared information
about users and their friends with these (and other) business partners in exchange for personal
information collected by those business partners. As with the app developers, the plaintiffs
alleged that Facebook did not adequately disclose to its users this practice of trading their
personal information.
Finally, the plaintiffs alleged that Facebook failed to control and monitor app developers’
and business partners’ use of all this information. Although Facebook had a policy prohibiting
app developers from using the information for any purpose other than improving their app, the
5
When multiple, similar lawsuits are filed in federal courts across the country, the cases may be
referred to the Judicial Panel on Multidistrict Litigation. The panel then decides whether to
transfer the suits to a single federal judge for pretrial proceedings. Here, the panel determined
that such a transfer was warranted, and it assigned all the lawsuits to this Court.
4Page 5 plaintiffs alleged that Facebook did nothing to enforce this policy. If Facebook had actually
enforced this policy, the plaintiffs contended, Kogan would not have been able to sell his dataset
to Cambridge Analytica, and countless other apps would not have been able to misuse the
personal information they collected.
In 2019, Facebook moved to dismiss the complaint. Although this Court dismissed a few
claims, it rejected the majority of Facebook’s arguments and allowed the case to proceed. See
generally In re Facebook, Inc., Consumer Privacy User Profile Litigation, 402 F. Supp. 3d 767
(N.D. Cal. 2019).
The parties then began discovery, the process by which civil litigants can ask their
adversaries (and sometimes third parties) to give them potentially relevant and non-privileged
information. The basic philosophy underlying discovery is that claims should be litigated based
on a complete record of the underlying facts. See Hickman v. Taylor, 329 U.S. 495, 507 (1947).
By allowing litigants to access evidence prior to trial, discovery narrows the issues, eliminates
the possibility of unfair surprise, and—most importantly—ensures that trials “achieve substantial
justice.” Greyhound Lines, Inc. v. Miller, 402 F.2d 134, 143 (8th Cir. 1968).
In November 2019, the plaintiffs sent Facebook various requests for discovery. See Dkt.
No. 1087-10. For example, the plaintiffs (that is, the named plaintiffs) sought all the information
Facebook had collected about them. The plaintiffs also sought information from Facebook’s
investigation into apps that had potentially misused users’ information, which Facebook called
the “App Developer Investigation” or “ADI.” Facebook produced some information in response
to these requests. But in the following years, the parties fought over what else Facebook should
be required to produce.
By March 2020, this Court determined that it was not in the best position to adjudicate
the parties’ growing number of discovery disputes, and it referred the parties to then-Magistrate
Judge Jacqueline Scott Corley for discovery. Before doing so, the Court expressed concern about
5Page 6 Facebook’s “unduly narrow view” of discovery. Dkt. No. 1087-44 at 29–30.6 “This is a big
case,” the Court explained, so Facebook should be careful before making any arguments that
discovery was “just too expensive or difficult.” Dkt. No. 1087-44 at 30. Gibson Dunn attorney
Orin Snyder sought to assuage the Court’s concerns: “If I was there, I would look you in the
eyes. I’m telling you, Judge, we are not only acting in good-faith; we are eager to produce
documents, whatever the expense, that are relevant to the issues in this case.” Dkt. No. 1087-44
at 30. He continued: “I am confident, Your Honor, that when you see our performance on the
issues in this case in terms of our production of documents, you will have no basis for concern
because we want to get on with it…[W]e think those documents actually are the key to us
winning.” Dkt. No. 1087-44 at 31–32.
In the following months, however, discovery remained contentious. Facebook repeatedly
insisted that it did not need to produce all the information it had collected about the named
plaintiffs. In the fall of 2020, Judge Corley rejected Facebook’s view of discovery, holding that
“discoverable” data included a wider set of information than Facebook had argued. But, as
discussed more fully below, the fighting on this issue continued.
The parties also had an ongoing disagreement over whether Facebook should be required
to produce materials related to its App Developer Investigation. Facebook argued that the
documents were produced in anticipation of litigation and involved legal advice, and so they
were protected by privilege. In the fall of 2021, Judge Corley held that the investigation was not
privileged. But again, the fighting continued.
Eventually, Judge Corley suggested that the parties engage a discovery mediator to help
resolve their ongoing disputes. See Dkt. No. 632. The parties selected retired Judge Gail Andler,
and she then brought in her colleague Daniel Garrie, in part to address the technical aspects of
discovery. Dkt. Nos. 646; 914 at 5. In July 2021, at the parties’ request, the Court appointed
6
When a document is e-filed, the Electronic Case Filing system adds page numbers to a header
at the top of the document. All cites included in this opinion reference the pages as numbered in
that header, rather than any page numbers native to the document.
6Page 7 Garrie as a Special Master with the power to issue discovery orders appealable only to Judge
Corley. Dkt. No. 709 at 1.
By February 2022—two and a half years into discovery—countless hours had been spent
adjudicating discovery disputes, and the litigation appeared to be going nowhere. Based on a
preliminary review of the record, it appeared to this Court that Facebook and Gibson Dunn were
to blame. At a status conference that month, the Court had strong words for Facebook and
Gibson Dunn. The plaintiffs had previously complained about Facebook and Gibson Dunn’s
misconduct and asked for the deadlines for discovery to be continued. But the Court expressed
concern that the litigation would go nowhere if it kept granting these continuances. The Court
suggested instead that the plaintiffs move for sanctions. Dkt. No. 847. This motion followed.
Then, in August 2022, the parties notified the Court that they had settled the lawsuit. The
Court stayed the litigation in light of the settlement, but the sanctions motion remained pending.
In their briefs, the plaintiffs complain of a wide range of misconduct by Facebook and
Gibson Dunn. It is sufficient for purposes of this ruling to focus on the four areas where the
record is clearest: (1) the plaintiffs’ attempts to obtain materials related to Facebook’s App
Developer Investigation; (2) their attempts to identify the information Facebook had collected
about them; (3) Facebook and Gibson Dunn’s conduct during depositions; and (4) Facebook and
Gibson Dunn’s over-designation of documents as privileged.
A.
App Developer Investigation
To understand the dispute about the App Developer Investigation, it’s helpful to have
some background about the evolution of Facebook’s relationship with third-party app
developers. From 2010 to 2014, app developers used something called the “Graph Application
Programming Interface,” also known as API, to receive data from Facebook users and to write to
Facebook on those users’ behalf. Dkt. No. 326 at 4. Through this API, an app could access
“friend permissions,” meaning the apps could access personal information about the app users’
Facebook friends (like a friend’s Facebook status or location or religion). Dkt. Nos. 1085-36 at
28; 1103-16 at 5–6.
7Page 8 In 2014, in response to public criticism of its information-sharing practices, Facebook
adopted a new API (version 2) to replace the earlier version. See Dkt. No. 326 at 5. To use
Facebook’s language, it “deprecated use of Graph API v1” and adopted “Graph API v2.” Dkt.
No. 326 at 5. According to Facebook, this new API did not allow apps to access friend
permissions.7 Dkt. No. 326. But as discussed more fully below, Facebook now concedes that
some apps were able to use the old API even after 2014, and so those apps continued to have
access to friend permissions. Dkt. No. 326 at 5. These were known as “whitelisted” apps.
In 2018, four years after the transition to the new API, the Cambridge Analytica scandal
broke. Facebook responded by launching an investigation into apps that had access to large
amounts of user data before the 2014 interface change. Dkt. No. 736 at 1. Gibson Dunn led the
investigation with help from two forensic consulting firms. Overall, Facebook said, the
investigation “involved hundreds of people: attorneys, external investigators, data scientists,
engineers, policy specialists, platform partners and other teams across the company.” Dkt. No.
736 at 5. When it began, Facebook said the investigation would help it “better understand
patterns of abuse in order to root out bad actors among developers” and restore trust in the
company. Dkt. No 736 at 5.
The investigation was divided into three phases: (1) detection and identification, (2)
enhanced examination, and (3) enforcement. Dkt. No. 736 at 2. During phase one, Facebook (and
its consultants and attorneys hired to help) identified apps that posed a high-risk of data misuse
and flagged those apps for further inquiry. Dkt. No. 699-5 at 6–8. In phase two, the ADI
forensics team prepared reports analyzing the potential for data misuse, given factors like the
sensitivity of the information that the apps could access. Dkt. No. 699-5 at 8. During the final
phase, Facebook decided whether to take any enforcement actions against the identified apps,
including possible suspension. Dkt. No. 699-5 at 8–9. To determine whether such action was
To be precise, the new API did not entirely limit access to friends’ information more broadly.
For instance, Graph API v2 still allowed apps to request access to things like “user_posts,”
which would include access to friends’ likes and comments on those posts. Dkt. No. 1085-36 at
112.
7
8Page 9 necessary, there could be additional investigations, including interviews and audits of the apps’
data security and storage infrastructure. Dkt. No. 699-5 at 9.
A few examples of the investigation documents are illustrative. Take one memo about an
app called Sync.Me. See Dkt. No. 1103-16. The memo states that the app was “overpermissioned and had access to many ‘heavyweight’ permissions,” including the user’s entire
newsfeed, friends’ likes, friends’ statuses, and friends’ hometowns. Dkt. No. 1103-16 at 3, 5–6.
The memo also notes that around 9 million users may have granted the app permission to access
“friends_location.” Dkt. No. 1103-16 at 5–6. These permissions “appear to be out of scope for
the use case of the App.” Dkt. No. 1103-16 at 6. Furthermore, the memo notes, even after
Facebook transitioned to the new developer interface (limiting access to friend permissions), the
app used a method “that Facebook described as a potential workaround for accessing friend’s
information despite the reduced set of permissions.” Dkt. No. 1103-16 at 3.
Or take another memo about the app developer Microstrategy, Inc. It states that
Microstrategy’s apps “collected vast quantities of highly sensitive user and friends permissions,”
including “highly valuable [data] with many parallels drawn between the data collected…and
that of Cambridge Analytica.” Dkt. No. 1103-7 at 8. The memo includes estimates from news
articles suggesting that, although only around 50,000 users had installed one of Microstrategy’s
apps, the app could access data from 16 to 20 million people. Dkt. No. 1103-7 at 7. One of
Microstrategy’s apps made “roughly 74 million API calls [requests for information from the
interface] per month—a volume few apps achieve, even over years of operation.” Dkt. No. 11037 at 8. Another Microstrategy app was installed by only around 400 users, but it made “millions
of API calls throughout its lifecycle,” likely “as a means of collecting additional data points” not
handled through Microstrategy’s primary app. Dkt. No. 1103-7 at 8.
And one more memo about a Yahoo app. See Dkt. No. 1103-8 The memo explains that
close to 150 million users installed the app, and that it made “billions of requests” for user
information. Dkt. No. 1103-8 at 3. The app had access to personal information about those users’
friends, including the friends’ education histories, work histories, religions, politics, “about me”
9Page 10 sections, relationship details, and check-in posts. Dkt. No. 1103-8 at 8. The app could also access
a user’s inbox, thus accessing private messages between that user and their friends. Dkt. No.
1103-8 at 3. Because many of the API requests gave “no visibility into the endpoints accessed,”
it was possible that the app “accessed more sensitive user or friends’ data than can be detected.”
Dkt. No. 1103-8 at 3. The memo explains that the app was “whitelisted by Facebook and
therefore was granted extended access” to the earlier developer interface “for an indeterminate
period of time.” Dkt. No. 1103-8 at 3. Given this “whitelisted status,” the app was able to
continue retrieving content from users’ newsfeeds, making “bulk” requests for information, and
“leveraging” earlier permissions to access information, even after Facebook transitioned to API
v2 in 2014. Dkt. No. 1103-8 at 3. The record is replete with other examples of these memos
containing information that is highly probative of the plaintiffs’ claims. See, e.g., Dkt. Nos.
1103-15; 1103-16; 1103-17; 1103-18.
In November 2019, the plaintiffs asked for documents related to the investigation. Dkt.
No. 1087-10 at 15. The parties fought over that request for years. Many of the parties’ disputes
centered around two categories of documents. First, Facebook and Gibson Dunn refused to
produce investigation materials, including memos, reports, audits, and developer interviews
prepared during the last two phases of the investigation—the phases in which Facebook
investigated the apps and decided whether to bring any enforcement actions against them. See
Dkt. No. 736 at 2. The memos discussed above would fall into that category. And second,
Facebook and Gibson Dunn refused to produce certain communications regarding those
materials, including internal communications among Facebook’s employees and
communications between those employees and Facebook’s forensic consultants. See Dkt. Nos.
699 at 5; 788-3 at 425–26.
Facebook and Gibson Dunn began by taking the position that the entire investigation was
covered by attorney-client and work-product privilege. Attorney-client privilege protects certain
communications between a client and their attorney. Upjohn Co. v. United States, 449 U.S. 383,
389 (1981). But a party cannot simply “cc” their attorney to privilege a document—they must be
10Page 11 communicating with their attorney in order to receive legal advice. In re Avantel, S.A., 343 F.3d
311, 321 n.11 (5th Cir. 2003); Meade v. General Motors, LLC, 250 F. Supp. 3d 1387, 1391–93
(N.D. Ga. 2017). Work-product privilege, in turn, is not just limited to communications: it covers
all documents “prepared by a party or [their] representative in anticipation of litigation.” United
States v. Richey, 632 F.3d 559, 567 (9th Cir. 2011) (quoting Admiral Insurance Co. v. United
States District Court, 881 F.2d 1486, 1494 (9th Cir. 1989)). Where a document is not “prepared
exclusively for litigation”—meaning it has a “dual purpose”—it is protected by work-product
privilege only if it “would not have been created in substantially similar form but for the prospect
of litigation.” Id. at 568 (quoting In re Grand Jury Subpoena, Mark Torf/Torf Environmental
Management, 357 F. 3d 900, 907 (2004)). That is to say, if the document would have been
prepared even in the absence of litigation, then it is not protected by work-product privilege.
After asserting that the documents were privileged, Facebook and Gibson Dunn asked to
delay briefing on the issue. In the spring of 2020, the plaintiffs asked to set a schedule for
briefing, but Facebook said “there [was] no urgent need…and [the issue] should be briefed (if at
all) at a later date.” Dkt. No. 449 at 4. In a later status report, Facebook refused to take a position
on exactly what documents it would produce. It stated that it did not “categorically object to
producing materials from [the] investigation,” so long as those documents were “not
privileged”—without clarifying which documents it believed were privileged. Dkt. No. 471 at 8.
In July 2020, early on in discovery, Judge Corley expressed doubts that the investigation
was privileged, but she noted there were “arguments both ways.” Dkt. No. 476 at 36. To analyze
the question in context, Judge Corley decided to review a sample of investigation documents
based on six “exemplar apps.” Dkt. No. 476 at 36–37; see generally Dkt. No. 533. Facebook then
gathered documents related to those apps and gave the plaintiffs a log that identified all the
documents it believed were privileged. Dkt. No. 914 at 10. Without the benefit of actually seeing
the documents, the plaintiffs chose twenty from the log and submitted them to Judge Corley to
review. Dkt. No. 914 at 10.
By April 2021, Judge Corley had reviewed the twenty documents and expressed her
11Page 12 “tentative view” that the investigation as a whole was not privileged. Dkt. No. 657 at 16. As she
put it, it was inconceivable that Facebook would not have launched the investigation even in the
absence of litigation, and so the investigation as a whole was not protected by work-product
privilege. Dkt. No. 657 at 16. She also alluded to Facebook and Gibson Dunn’s arguments about
attorney-client privilege: while Gibson Dunn’s specific legal advice might be protected, the facts
discovered in the investigation would not be. Dkt. No. 657 at 24.
That said, Judge Corley noted that the plaintiffs did not need “every single document.”
Dkt. No. 657 at 17. For instance, as she explained, the plaintiffs did not need to know exactly
when Facebook requested certain information from the app developers or when it received a
response. Dkt. No. 657 at 18. The plaintiffs agreed: they were seeking information about the
facts underlying the investigation. Dkt. No. 657 at 18. That included facts about Facebook’s
“thought process” because that “relate[d] to whether or not [Facebook was] actually and
accurately monitoring the disclosure of this information.” Dkt. No. 657 at 20. Judge Corley
repeated that the plaintiffs did not need, for instance, scheduling emails among Facebook
employees, but rather wanted “the facts…just…what’s in the report.” Dkt. No. 657 at 26.
Given the discussion, Judge Corley decided to defer ruling on the privilege question so
that the parties could meet and confer about narrowing the plaintiffs’ request for production (or,
if they could not agree, submitting affidavits in support of their positions). Dkt. No. 655 at 1.
After the hearing, the parties negotiated the scope of production, and the plaintiffs did
narrow their requests. See Dkt. No. 915-1. But that negotiation was hampered by Facebook and
Gibson Dunn’s continued assertion of attorney-client and work-product privilege. For instance,
as part of their narrowed request, the plaintiffs sought information about the phase of ADI that
each app fell under and the “reasons for elevation” (meaning the reasons Facebook chose to
investigate the apps further). Dkt. No. 1087-15 at 1. Facebook continued to take the position that
that information—and much of the other information the plaintiffs sought—was “categorically
privileged.” Dkt. No. 1087-15 at 1.
After the parties could not come to an agreement on a narrower production, Judge Corley
12Page 13 ordered them to submit a joint letter brief on the issue. Dkt. No. 693. Facebook argued that the
plaintiffs were entitled only to the names of the apps that might have misused user data and the
information the apps might have accessed. Dkt. No. 699 at 2. Facebook also pointed to the
plaintiffs’ earlier statement that they wanted only the “facts” underlying Facebook’s
investigation. Dkt. No. 699 at 2. Based on that statement, Facebook argued that the plaintiffs
could not ask for the memos discussed above or for Facebook’s own internal deliberations about
its investigation and enforcement decisions. And based on that same statement—as well as the
plaintiffs’ statement that they did not want administrative emails—Facebook insisted that the
plaintiffs had conceded that they did not need any “emails among Facebook employees” at all.
Dkt. No. 699 at 2.
The plaintiffs argued that the investigation materials—including, potentially, internal
communications—were directly relevant to their claims. To the plaintiffs, the information about
app misuse was not useful without “proper context, including the discussions and actions taken
in response to this gathered information.” Dkt. No. 699 at 6. They believed that the investigation
documents and communications would reveal Facebook’s internal knowledge and deliberations
about the threats that these apps posed to users’ privacy. Dkt. No. 699 at 6. And, the plaintiffs
argued, these materials would shed light on Facebook’s decision to investigate suspicious apps—
or not. Dkt. No. 699 at 6.
In September 2021, almost two years after the plaintiffs’ first request for ADI documents,
Judge Corley held that the investigation was not covered by a blanket assertion of privilege. She
found Facebook’s assertion of attorney-client privilege to be “unpersuasive given that Plaintiffs
[were] not seeking documents created by counsel, counsel’s edits, or any communications with
counsel.” Dkt. No. 736 at 6. “At best,” she explained, the ADI materials “would be attorney
work product.” Dkt. No. 736 at 6. And, she held, they were not because they would have been
created absent any litigation. Dkt. No. 736 at 5. She explained, “Facebook’s assertion that the
ADI served only a litigation purpose…[was] patently implausible in light of Facebook’s public
pronouncements.” Dkt. No. 736 at 5. Facebook’s “assertion could only be true if the Court found
13Page 14 that Facebook was lying to the public when it stated that the purpose of the ADI was to root out
bad apps and secure Facebook’s platform so that consumers could have faith in the company.”
Dkt. No. 736 at 6. And, she noted, Facebook had not offered any evidence that “addresse[d] the
repeated public proclamations as to the obvious business purpose of the ADI.” Dkt. No. 736 at 6.
Judge Corley thus ordered Facebook to produce “the background and technical reports,
audits and developer interviews” related to the six apps from the sampling exercise. Dkt. No. 736
at 7. She then ordered the parties to “work with the Special Master regarding production of
additional materials consistent with the guidance offered by this Order.” Dkt. No. 736 at 7.
After Judge Corley’s ruling, Facebook produced the materials specifically ordered by
Judge Corley—which turned out to be just eleven documents—but it did not elaborate on what
else it would produce. Dkt. Nos. 914 at 10–11; 1085-3 at 3. After the parties made no progress,
Special Master Garrie scheduled a hearing to discuss ADI production. Facebook continued to
avoid taking a position on what it would produce, and it then asked to delay the hearing for a
month because of scheduling conflicts. Special Master Garrie gave Facebook “one final
extension.” Dkt. No. 1087-18 at 1. He then “strongly encourage[d] Facebook to provide
Plaintiffs with a written description of the materials they believe are required by the ADI Order
by the end of tomorrow,” and to “either produce the memoranda [prepared by Facebook’s
forensic consultants] or inform Plaintiffs in writing the reason for not providing these materials
by Friday afternoon at the latest.” Dkt. No. 1087-18 at 1. Facebook failed to do either; it said it
had already made its position clear. See Dkt. No. 1085-6 at 2.
At the (delayed) hearing before Special Master Garrie, Facebook acknowledged that the
specific categories identified in Judge Corley’s order—background technical reports, audits, and
interviews—were producible in theory, although it stated that they might still be protected by
attorney-client or work-product privilege. Dkt. No. 1085-5 at 7–8. But Facebook and Gibson
Dunn then took the position that all of Facebook’s internal, non-attorney communications about
the investigation—communications among employees and between employees and Facebook’s
outside consultants—were not discoverable because Judge Corley had determined that the
14Page 15 communications were not relevant. Dkt. No. 1085-5 at 4; see also Dkt. No. 778 at 2. To
Facebook, the demand for communications was “already litigated” and “rejected” by Judge
Corley. Dkt. No. 1085-5 at 4.
According to Facebook, Judge Corley had reviewed these types of ADI communications
in the sampling exercise, and because she had not explicitly ordered their production, her order
implicitly “considered and disposed of the request for…communications” as a whole. Dkt. No.
1085-5 at 9–10. Gibson Dunn attorney Orin Snyder said this interpretation of the order was
supported by “a lot of case law,” “from the Supreme Court cases on down.” Dkt. No. 1085-5 at
9–10, 11.
Special Master Garrie rejected this view, and he articulated a process by which Facebook
would be required to produce the communications. First, he ordered Facebook to produce the
background and technical reports, audits, interviews, and consultant memoranda on a rolling
basis. Dkt. No. 788-3 at 4–6. Once Facebook produced these documents, the plaintiffs could then
request a statistically significant sample of Facebook’s related internal communications and its
communications with its outside consultants.8 Dkt. No. 788-3 at 6; 765-2 at 5. Facebook moved
for reconsideration, and Special Master Garrie narrowed the order: rather than requiring
Facebook to produce ADI communications upon the plaintiffs’ request, he ordered Facebook “to
provide to Special Master Garrie for in camera review, all ADI related communications
pertaining to the six exemplar applications.” Dkt. No. 788-5 at 6. He would review these
communications to determine whether it was worthwhile for Facebook to produce them.
Facebook then appealed that decision to Judge Corley. At the hearing, Facebook repeated
its argument that she had already ruled that its internal communications and its communications
with its outside consultants were not discoverable. Dkt. No. 809 at 9–10. A Gibson Dunn
attorney argued that that interpretation of the order was based on “a general presumption that
Special Master Garrie also allowed the plaintiffs to request Facebook’s communications with
the third-party app developers, but Facebook did not take issue with that aspect of his order. See
Dkt. No. 778 at 2.
8
15Page 16 when a party makes a request for specific materials and the Court resolves the request without
ordering those materials produced, the request is denied.” Dkt. No. 809 at 11. Judge Corley
responded: “I just want to say you should not litigate based on that presumption. That is not how
it works. I wouldn’t do that. That’s a mistake.” Dkt. No. 809 at 11. The order was intended as a
starting point, and it explicitly required the parties to work with the Special Master on future
productions.9
In her order following the hearing, Judge Corley again rejected Facebook’s argument.
She explained that she had not “rule[d] that communications are not discoverable and never need
be produced.” Dkt. No. 806 at 2. Rather, her prior order held that ADI documents (including
communications) were “not protected by the work-product or attorney-client privilege in the
absence of specific showings of actual work-product, such as attorney edits, or the giving or
seeking of legal advice.” Dkt. No. 806 at 2. While she had noted at the hearing after the sampling
exercise that some of the documents from the exercise were not relevant, Judge Corley made
those statements after reviewing twenty documents blindly picked off Facebook’s privilege
log—documents like the scheduling emails discussed at the hearing. But her statements at the
hearing were not part of her order: they were made “in the context of attempting to narrow the
issues to determine if the parties could agree on what ADI materials to produce.” Dkt. No. 806 at
2. When the parties could not agree (in part because of Facebook’s continued assertion of a
blanket privilege), Judge Corley adjudicated the privilege question—not the discoverability of
communications as a whole. Dkt. No. 806 at 2.
Judge Corley additionally found Facebook’s specific objections to Special Master
Garrie’s order to be “puzzling.” Dkt. No. 806 at 2. She explained that Special Master Garrie had
taken a “common-sense approach”: he would review the communications to determine whether
they were relevant and ought to be produced. Dkt. No. 806 at 3. But instead of just complying,
Facebook appealed.
Judge Corley did observe that Facebook’s motion for reconsideration was not in bad faith to the
extent that Special Master Garrie responded by narrowing the order. Dkt. No. 809 at 54.
9
16Page 17 While Judge Corley was considering Facebook’s appeal, Special Master Garrie finished
his review of the sample ADI communications. “After reviewing a substantial portion of the
6,000+ documents pertaining to the exemplar apps,” Special Master Garrie determined that “a
substantial number of the documents [were] relevant to the case and not protected by privilege.”
Dkt. No. 916-9 at 6. For instance, one 2019 email chain discussed apps that Facebook planned to
suspend after the app developers failed to respond to Facebook’s requests for information. One
Facebook employee wrote that she wanted to give “heads up to our business leads” before
suspending the apps. Dkt. No. 1100-3 at 4. In response, another employee (presumably one of
Facebook’s “business leads”) asked for a “revenue impact analysis” related to the apps. Dkt. No.
1100-3 at 3. That request would appear to support the plaintiffs’ contention that Facebook made
enforcement decisions based on business concerns. Given the relevance of the communications
(and Facebook’s failure to demonstrate that they were privileged), Special Master Garrie ordered
Facebook to produce “all documents relating to the ADI,” with certain exceptions for attorney
communications. Dkt. No. 916-9 at 7.
Facebook moved for reconsideration. In its motion, Facebook noted that it was unclear if
the order required it to collect additional documents and use additional search strings to look for
responsive materials. Dkt. No. 917-5 at 16–17. Facebook had already collected documents from
the parties’ agreed-upon custodians (employees identified as having materials relevant to the
case). Facebook suggested that set of documents was adequate, and it should only be required to
look through that set for ADI materials. Dkt. No. 917-5 at 17. In response, Special Master Garrie
narrowed the order to require production of “all documents relating to the ADI from all
custodians that the parties have identified and collected,” with certain exceptions for attorney
communications. Dkt. No. 917-8 at 7. The plaintiffs understood this to mean that Facebook
would still search for all the ADI materials, but that Facebook would not need to identify any
new custodians. And, for a brief period of time, it seemed like the matter was settled.
Shortly thereafter, at the February 10, 2022 case management conference, this Court
expressed concerns about stonewalling by Facebook and Gibson Dunn. At that conference, the
17Page 18 Court invited the plaintiffs to move for sanctions rather than ask for the discovery deadlines to be
continued yet again. The Court also ordered Facebook to complete its ADI production within 21
days. Dkt. No. 847.
Following that conference, Gibson Dunn assigned Rosemarie Ring to lead the litigation,
replacing Orin Snyder. And Facebook and Gibson Dunn’s conduct slowly began to improve (at
least in some areas). Later in February, Ring proactively emailed the plaintiffs to discuss
Facebook’s previous understanding of the “limits” of Special Master Garrie’s order: “The goal
here is to make sure we have a meeting of the minds on this and avoid any further ADI-related
disputes.” Dkt. No. 1103-33 at 2, 5. Gibson Dunn explained that for ADI custodians, Facebook
had only collected documents through a period that ended in 2019—although the investigation
continued into 2020. Dkt. No. 1088 at 3–4. Facebook and Gibson Dunn had not told Special
Master Garrie about this limitation when they argued Facebook’s collection was adequate.
Indeed, as Ring later stated, it was unclear if “anyone was aware” of the limitation until she
brought it to the plaintiffs’ attention. Dkt. No. 947 at 9. Gibson Dunn also explained that the
search terms used to identify responsive documents were limited: Facebook did not use terms
like “ADI” or “App Developer Investigation,” but instead searched by app ID and app name.
Dkt. No. 1088 at 3. And even then, the search was not comprehensive: it did not include 1,700
apps that Facebook (rather than Gibson Dunn) had investigated. Dkt. No. 1088 at 4. The
plaintiffs also learned that Facebook transitioned the App Developer Investigation to an “inhouse” operation at a certain point, meaning Gibson Dunn was not even involved in aspects of
the purportedly privileged investigation. Dkt. No. 1088 at 4.
After the plaintiffs brought these issues to the Court’s attention, the Court ordered
Facebook to produce all ADI documents through the present (not just through 2019). Dkt. No.
895. After additional back and forth, Facebook agreed to additional search terms and further
collections to avoid any more discovery disputes. Dkt. No. 1052-2 at 19. In July 2022—nearly
three years after the plaintiffs’ first request—Facebook was still producing ADI documents. Dkt.
No. 1085-33 at 5.
18Page 19 B.
Named Plaintiff Data
Another area of alleged discovery misconduct involved the information that Facebook
had collected about the named plaintiffs. This “named plaintiff data” was a key component of the
case: Facebook sought to poke holes in the plaintiffs’ claims by arguing that they had “not
identified what information they believe[d] Facebook shared without consent,” nor how “they
believe[d] they were harmed.” Dkt. No. 840 at 5. If the plaintiffs could not identify this
information, Facebook argued, they lacked standing. See, e.g., Dkt. No. 261-1 at 20. To properly
address these arguments, the plaintiffs needed to identify the universe of private information
from which app developers and business partners might have drawn. The parties litigated the
production of that information for years.
Early on in discovery, Facebook agreed to produce information from its “Download Your
Information” tool. The DYI tool—accessible to all Facebook users—aggregates much of the
information that Facebook collects on its users. But throughout discovery, Facebook and Gibson
Dunn suggested that the DYI tool did not include all the personal information Facebook had
collected. See, e.g., Dkt. Nos. 541 at 8; 1103-14 at 7–8; 793 at 6–7; 918-1 at 3. The parties’
discovery disputes centered around whether Facebook would need to produce anything else.
Facebook and Gibson Dunn made two arguments against additional discovery. First, they argued
that Facebook only needed to produce information that Facebook conceded had been shared with
third parties—and the plaintiffs had to accept their representations about what had been shared.
Second, Facebook and Gibson Dunn argued that any additional discovery would be costprohibitive and unnecessary. (Under the Federal Rules of Civil Procedure, discovery must be
“proportional” to the needs of the case; Facebook and Gibson Dunn argued that any additional
discovery on the named plaintiff data did not meet that standard.)
Part of the problem with identifying the information that Facebook kept on the named
plaintiffs was that the company’s information about its users is not consolidated in one location;
it’s spread across Facebook’s complex data storage system. In March 2020, the plaintiffs asked
Facebook to produce developer manuals or other documents describing that system so that they
19Page 20 could understand where other named plaintiff data might be stored. According to the plaintiffs,
Gibson Dunn repeatedly told them to “Google” that information. Dkt. No. 1087-1 at 3. From late
2019 to mid-2020, the parties went back and forth about the named plaintiff data.
After several months without progress, Judge Corley ordered the parties to meet to
discuss the issue: “The parties’ next joint statement shall include information regarding the meet
and confer efforts and discuss in detail each side[’s] understanding of what precisely has been
produced and precisely what is the [named plaintiff] data that is being withheld as not relevant or
not reasonably available. The statement should not argue why the unproduced data is or is not
discoverable; the purpose of the statement is to precisely identify the data at issue.” Dkt. No. 487
at 1–2.
At the next discovery hearing, Gibson Dunn acknowledged that Facebook had not
produced all the information it collected about the named plaintiffs. As Gibson Dunn attorney
Russ Falconer explained: “There is other…Facebook-generated information, information
generated by third parties, information received from third parties. We have not represented that
that is comprehensively included in our production.” Dkt. No. 541 at 8. For instance, while
Facebook’s production included the date and time that a named plaintiff may have accessed a
certain website, it did not include the content the plaintiff had viewed on that website. Dkt. No.
541 at 7. According to Falconer, Facebook had access to that data in a “raw, disaggregated way”
but producing that data about any given plaintiff would be a “multiweek endeavor.” Dkt. No. 541
at 7, 10. At the hearing, the parties ultimately agreed that they would submit briefs to Judge
Corley, and she would determine what additional named plaintiff data should be produced.
In its briefing, Facebook argued that the only named plaintiff data that was discoverable
was data that “ar[ose] from user activity occurring on the Facebook platform” that the plaintiffs
“overtly shared…with a limited audience.” See Dkt. No. 557 at 1. The plaintiffs argued that the
universe of discoverable data was much larger. See Dkt. No. 557 at 1.
Judge Corley rejected Facebook’s “restrictive view of relevant discovery” in Discovery
Order No. 9. Dkt. No. 557 at 1. Judge Corley held that “the discoverable user data at issue
20Page 21 includes: Data collected from a user’s on-platform activity; Data obtained from third parties
regarding a user’s off-platform activities; and Data inferred from a user’s on or off-platform
activity.” Dkt. No. 557 at 2. Unless Facebook and Gibson Dunn could show that specific
information was not discoverable for some other reason—for instance, the burden of producing it
was disproportionate to the needs of the case—Facebook would have to give it to the plaintiffs.
Shortly thereafter, in November 2020, the plaintiffs asked Facebook to identify the
materials responsive to that order. Facebook responded that it was still “conducting an
investigation to confirm the universe of data” that could be responsive. Dkt. No. 583 at 3, 10.
Two months later, however, Facebook took the position that Discovery Order No. 9
“relate[d] only to data that was shared or otherwise made accessible” to third parties, and so no
other information was discoverable. Dkt. No. 589 at 34. Judge Corley shot down this argument
(or at least tried to), explaining that whether certain data was shared was an “open question.”
Dkt. No. 588 at 1. Judge Corley pointed out that Facebook had previously argued that the third
category of discoverable data identified in Discovery Order No. 9 (data inferred from a user’s on
or off-platform activity) was not discoverable because it had never been shared. But Discovery
Order No. 9 had clearly held that inferred data was discoverable—notwithstanding Facebook’s
assertions that it had never been shared. Judge Corley explained: “If the Court were to accept
Facebook’s arguments about the scope of production, it would eliminate” that entire category
from discovery. Dkt. No. 588 at 1.
Given the lack of clarity on Facebook’s use of users’ data, Judge Corley ordered the
parties to conduct a Rule 30(b)(6) deposition so that the plaintiffs could assess what data was
shared with third parties. Dkt. No. 588 at 1. A 30(b)(6) deposition—a reference to Federal Rule
of Civil Procedure 30(b)(6)—gives a litigant the opportunity to question an organization’s
representative about a specified topic. The organization has “a duty to make a conscientious,
good-faith effort to designate knowledgeable persons for Rule 30(b)(6) depositions and to
prepare them to fully and unevasively answer questions about the designated subject matter.”
Starlight International Inc. v. Herlihy, 186 F.R.D. 626, 639 (D. Kan. 1999). In a subsequent
21Page 22 order, Judge Corley clarified that the scope of the deposition was limited to “discoverable user
data as defined by Discovery Order No. 9,” and emphasized that “whether particular user data is
not shared, not admissible, or not monetized, is not a valid reason to object to a
particular…question” at the deposition. Dkt. No. 602 at 1–2.
After the 30(b)(6) deposition, there was no progress on the production of the named
plaintiff data. Facebook did not produce any additional documents at all, and it accused the
plaintiffs of “spinning in circles…for more than a year” on the issue. Dkt. No. 1085-9 at 7. By
the fall of 2021, the parties declared an impasse, and they briefed the issue for Special Master
Garrie. The plaintiffs argued that whether their information was shared “was a contested question
on which [they were] entitled to evidence,” beyond just Facebook’s representations. Dkt. No.
916-4 at 5. And, the plaintiffs pointed out, “internal documents demonstrate that Facebook itself
does not know what information may have been shared with third parties.” Dkt. No. 1103-2 at
13. But Facebook and Gibson Dunn persisted in the argument that the scope of discovery was
limited to information that Facebook admitted had been shared, and that this limitation was
consistent with Judge Corley’s order. Dkt. No. 916-4 at 5–6.
Special Master Garrie rejected Facebook and Gibson Dunn’s argument: he held that she
had not limited discovery to data that Facebook admitted was shared with third parties. Dkt. No.
916-4 at 6–7. He then determined that Facebook had not produced all the data related to the
named plaintiffs, so he ordered Facebook to “provide a list of data sources” containing that
information, and then meet and confer with the plaintiffs to propose a protocol for producing the
data. Dkt. No. 916-4 at 8. Facebook then moved for reconsideration. In response, Special Master
Garrie revised his order and instead required Facebook to explain its practices for storing user
data so that he could determine what additional data should be produced. Dkt. No. 793 at 7–8.
Facebook appealed that order.
In considering that appeal, Judge Corley explained that the plaintiffs agreed the case was
about data that was shared, but “the question” for discovery was how to determine “what was
shared and what was made accessible.” Dkt. No. 809 at 30. But, she said, Facebook’s position
22Page 23 was as follows: “The only data that is discoverable is that which Facebook contends was shared
or made accessible, and if Facebook says it was not shared or made accessible, that’s the end of
the matter.” Dkt. No. 809 at 29. Judge Corley (again) rejected that argument. Pointing (again) to
Discovery Order No. 9, Judge Corley explained: “This Court did not rule that Facebook only had
to produce data about the Named Plaintiffs that Facebook admits it shared with third parties.”
Dkt. No. 807 at 1. And Judge Corley repeated her earlier point: Discovery Order No. 9 held that
inferred data was discoverable (even though Facebook argued inferred data was never shared).
Dkt. No. 807 at 1–2. That order would not make sense, she reiterated, if discovery were as
limited as Facebook suggested. Dkt. No. 807 at 1–2. And “Facebook’s insistence that the Court
somehow ruled that only data that Facebook admits were shared with third parties is discoverable
is belied by the Court’s discovery ruling less than two months later,” which noted that what data
was shared was an “open question.” Dkt. No. 807 at 2.
Judge Corley continued: “Apart from the Court not having limited discovery of each
Named Plaintiff’s data to only data Facebook concedes it shared with third parties, the Court
finds that such a limitation is not appropriate.” Dkt. No. 807 at 2. “As the Court previously
noted, how Facebook uses the data it collects about its users is an ‘open question.’ The first step
in answering that question is to identify the data it collects about its users and, specifically, what
it has collected about the Named Plaintiffs.” Dkt. No. 807 at 2–3. Although the 30(b)(6)
deposition was intended to “provide clarity as to what data Facebook collects and how it is
used,” the 30(b)(6) witness was not “the final arbiter of whether data was shared.” Dkt. No. 807
at 3. “[T]here is nothing before the Court that suggests that the record is currently so undisputed
as to what data Facebook collects and how it is used that the Court can say definitively that
certain data were not shared and therefore not discoverable.” Dkt. No. 807 at 3.
Judge Corley also noted that Facebook’s appeal misrepresented Special Master Garrie’s
order. Facebook and Gibson Dunn argued that Special Master Garrie was requiring them to
provide “detailed information” about the sources of data Facebook had identified—but Special
Master Garrie’s order said only that Facebook had to provide a “high level description” of the
23Page 24 information in those sources. Dkt. No. 807at 3–4. Once Special Master Garrie had a high-level
description of Facebook’s data systems, he could determine which systems contained named
plaintiff data, and whether production of “potentially shared” named plaintiff data was feasible
and proportional to the needs of the case. Dkt. No. 807 at 4.
A week later, Special Master Garrie ordered Facebook to give him a “date certain” by
which Facebook could tell him which systems had discoverable data and either produce that data
or explain why it should not have to. Dkt. No. 1087-23 at 1. Special Master Garrie found
Facebook’s response to be “nonsensical.” Dkt. No. 826 at 2. Facebook tried again. For the next
six months, Special Master Garrie worked with the parties to determine what additional
information should be produced; that process involved testimony from six Facebook witnesses,
the submission of 14 explanations of 100 data systems, scrutiny of the identifiers used to store
and track user data, and other highly technical analyses. At this point, Facebook and Gibson
Dunn’s primary argument had been decisively rejected, and so they switched tack: They now
emphasized that any additional discovery would be so burdensome that it would not be
proportional to the needs of the case.
But this process revealed at least two new potential sources of named plaintiff data. First,
throughout the litigation, the plaintiffs had asked Facebook to produce data from something
called the Hive. The Hive is a data warehousing framework organized into tables and
“partitions.” Facebook and Gibson Dunn consistently argued that it would be nearly impossible
to look through the Hive for all the named plaintiff data because of the way the Hive was
organized. For instance, in October 2021, Facebook and Gibson Dunn said Facebook could not
produce named plaintiff data from the Hive because the information in the Hive is “not indexed
by user, so there is no way to search across all tables at once for an individual user’s ID.” Dkt.
No. 1085-11 at 7. Facebook and Gibson Dunn asserted that, to search the Hive for named
plaintiff data, it would have to search “each of Hive’s 12 million tables…individually for any
information relating back in any way to a Named Plaintiff, which would be nearly impossible,
given both the volume of Hive data and the fact that much of the data in Hive is anonymized.”
24Page 25 Dkt. No. 1085-11 at 7. In December 2021, Facebook again said that it would take “a full team of
engineers” working for “more than a year” to develop tools necessary to identify specific
information that could then be retrieved from the Hive. Dkt. No. 1103-12 at 8. From January
2022 on, the parties worked with the Special Master to inquire into the Hive tables to determine
if and how they could be searched.
Months into this process, a Facebook representative revealed something that the company
and its lawyers had not previously disclosed: Facebook had, much earlier on, identified and
preserved a number of Hive tables that might include named plaintiff data. In June 2022, the
plaintiffs deposed Michael Duffey, an e-discovery case manager in Facebook’s legal department.
Facebook designated Duffey under Rule 30(b)(6) to testify about Facebook’s efforts to identify
and preserve information associated with the case, including information about the named
plaintiffs. Duffey said that Facebook had identified Hive tables related to Cambridge Analytica
with the help of “outside counsel,” and it had placed 137 Hive tables on “legal hold,” likely
starting in 2018. Dkt. No. 1103-23 at 70–71, 76. Facebook later admitted that the tables were
preserved, at least in part, because they were related to the named plaintiffs. Dkt. No. 1085-35 at
4.
At the same deposition, Duffey revealed another potentially fruitful source of named
plaintiff data: the Switchboard profiles. He explained that Switchboard was a tool created to
respond to law enforcement subpoenas, and Facebook had preserved data from Switchboard in
connection with the named plaintiffs. See Dkt. No. 1085-35 at 2. (Previously, a Facebook
representative said that Facebook used the DYI tool to respond to law enforcement inquiries,
making no mention of Switchboard. Dkt. No. 1103-9 at 95.) Duffey said that Switchboard was
“very similar” to DYI, but it included additional information “pertaining to Facebook groups and
advertising accounts.” Dkt. No. 1103-23 at 41. Later, Facebook and Gibson Dunn clarified that
Switchboard also included additional information about a user’s privacy settings, the full
alphanumeric code associated with certain cookies, information about who the user had blocked,
as well as those who reported or blocked that user, and data created for law enforcement. Dkt.
25Page 26 No. 1085-35 at 3. Indeed, when Facebook initially produced the named plaintiffs’ privacy
settings in 2020, it found those settings by looking to the Switchboard profiles. Dkt. No. 1085-35
at 3. But Facebook and Gibson Dunn had never told the plaintiffs about Switchboard.
Duffey also said that Switchboard provided information in a “more usable way” than
DYI because the Switchboard profiles could be downloaded as a single PDF. Dkt. No. 1103-23
at 42–43. In contrast, Facebook produced the information from DYI in thousands of atomized
files. See Dkt. No. 1050-3 at 20. According to the plaintiffs, many of those files were useless,
“including documents consisting wholly of the Facebook [‘]like[’] graphic (a thumbs-up).” Dkt.
No. 1050-3 at 20.
These revelations came almost three years after the plaintiffs asked for the data Facebook
collected on them, and two years after Judge Corley had ordered the parties to meet and confer
regarding the data Facebook was withholding. Facebook subsequently agreed to produce the
Switchboard profiles and certain information from the Hive tables. Dkt. No. 1085-34 at 3.
C.
Depositions
The plaintiffs also complain about Facebook and Gibson Dunn’s conduct during
depositions. There is no need to describe all the conduct; a few examples will suffice.
One example involves the depositions focusing on Facebook’s practice of “whitelisting.”
Recall that in 2014, Facebook transitioned to a new app interface that limited access to friend
permissions. But Facebook “whitelisted” certain apps, allowing them to continue to use the
earlier app developer interface (and therefore access friend permissions) even after that
transition.
Discovery had revealed documents that appeared to support the plaintiffs’ claims that
Facebook whitelisted apps based on business concerns, rather than purely technical ones. For
instance, a 2013 email appears to show employees from Facebook’s partnerships team discussing
the impact of the new interface on apps and “integrations” (third parties that built Facebookbranded or “Facebook-like” experiences on third-party platforms, like a Facebook app for a
phone). Dkt. No. 1103-21 at 29–31; see also Dkt. No. 1085-36 at 53, 57. In the first email in the
26Page 27 chain, Facebook employee Jackie Chang identifies a category she calls “key integrations” that
“drive value to FB” but use friend data or a user’s “read stream” (information from a user’s news
feed). Dkt. No. 1103-21 at 30–31; see also Dkt. No. 1103-16 at 6. She contrasts this category
with “key integrations that are competitive or drive little value to FB.” Dkt. No. 1103-21 at 30–
31. For the valuable integrations, Chang says, Facebook “should decide if we allow certain use
cases that are of strategic value” to Facebook. Dkt. No. 1103-21 at 30–31. In contrast, for the
low-value integrations, she suggests it is “good…we’re removing” access. Dkt. No. 1103-21 at
31.
Another Facebook employee then discusses the impact of the change on apps. He
attaches a list of “40k+ apps that request and make use of the friends_permissions,” pulled
together by “Simon” (presumably, Simon Cross, cc’ed on the email). Dkt. No. 1103-21 at 29.
The employee then offers a recommendation for whether certain categories of apps should keep
that access. Dkt. No. 1103-21 at 29. For “strategic partners,” he says, “we should use the
framework developed by Jackie.” Dkt. No. 1103-21 at 29.
When the plaintiffs asked Facebook’s employees about this email chain, the employees
were unwilling to acknowledge what it seemed to show—that Facebook was discussing whether
to allow apps to access friends’ information based on the financial value of the app to the
company.
Facebook designated Simon Cross (who was cc’ed on the email chain) to discuss
whitelisting in a 30(b)(6) deposition. Cross first testified that Facebook allowed apps to continue
to use the earlier interface and access friend permissions only when “the user experience would
be significantly degraded if [the apps] weren’t given extra time or there was some form of legal
and regulatory risk to the partner if the extension was not granted.” Dkt. No. 1085-36 at 193. The
plaintiffs then asked Cross about the framework proposed in the email. Dkt. No. 1085-36 at 319–
323. Cross said that it was unclear what framework the email referred to, but he could not
“confirm anything about the precise nature of a framework or if that was used in any way.” Dkt.
No. 1085-36 at 321, 323. He later said that the framework was not used. Dkt. No. 1085-36 at
27Page 28 326. He could not “recall” whether there was a “formal document or protocol” used when
deciding what apps to whitelist, yet he had not asked Facebook’s employees whether such a
document or protocol existed. Dkt. No. 1085-36 at 382–83. When asked whether “strategic
value” was taken into account when deciding whether to continue to provide access to friend
permissions, Cross said he could not answer the question because Facebook had no definition of
strategic value. Dkt. No. 1085-36 at 333.
As noted, Cross was cc’ed on the email chain, and it seems as though he put together the
list of impacted apps described in the email. Dkt. No. 1085-36 at 316. Yet Cross testified: “If you
want to know what these people [on the email thread] meant, I would ask them.” Dkt. No. 108536 at 323. He later repeated: “If you want to understand precisely what the people in it meant, I
would speak to them.” Dkt. No. 1085-36 at 325. At least nine times, Cross told the plaintiffs they
should ask Chang specifically about certain aspects of whitelisting. Dkt. No. 1085-36 at 309,
311, 314, 321, 328, 379–80, 381, 383, 455.
Several months earlier, the plaintiffs had deposed Chang. When asked whether she was
“making a recommendation [in the email]…for how to deal with integrations that involve
strategic value,” Chang responded, “I don’t remember specifically, so I don’t know how to
answer that.” Dkt. No. 1103-24 at 106. She didn’t “remember enough to say” that the email was
about the loss of access to read stream and friend data permissions. Dkt. No. 1103-24 at 107.
Indeed, she could not recall what it meant to use “read stream and friend data” at all. Dkt. No.
1103-24 at 108. When asked if she could offer her “best understanding” of what her email meant,
she said she couldn’t “speculate.” Dkt. No. 1103-24 at 108. When asked, “Tell me everything
you can remember about your involvement in figuring out which partners should continue to
have access to friends permissions,” Chang responded, “So, again, I don’t remember.” Dkt. No.
1103-24 at 119.
Chang’s testimony about her email is representative of her deposition more broadly:
Although Facebook’s internal documents suggest that Chang was extensively involved in the
whitelisting process, she remembered almost nothing about it. See, e.g., Dkt. No. 1103-24 at
28Page 29 170–71. At one point in the deposition, Chang testified that she could not remember what the
term whitelisting meant at all. Dkt. No. 1103-24 at 220. She had no memory of the deprecation
of friend permissions. Dkt. No. 1103-24 at 96. She did not remember that Facebook had ever
allowed apps to access friends’ information. Dkt. No. 1103-24 at 70. Although she was being
deposed in a case involving the Cambridge Analytica scandal and said she had met with
Facebook’s lawyers for around nine hours to prepare, she claimed she did not know that the
scandal was related to Facebook’s practice of sharing friends’ information. Dkt. No. 1103-24 at
17, 292–93.
Chang resisted other questions as well. When asked if the email was “the best evidence of
what you were thinking at the time you wrote” it, Chang responded, “I don’t know.” Dkt. No.
1103-24 at 133. When asked if there was anything that could refresh her recollection, Chang
responded, “I don’t know what I don’t know, so I can’t make that assumption that I would
know.” Dkt. No. 1103-24 at 134. When asked if the email was a “good guide of what you were
thinking about the topics discussed,” Chang said that would require her to “speculate.” Dkt. No.
1103-24 at 135. When asked again, Chang said she didn’t know what “good” meant. Dkt. No.
1103-24 at 136. At another point in the deposition, Chang said she didn’t know what the phrase
“general understanding” meant. Dkt. No. 1103-24 at 76.
The plaintiffs also complain of Facebook and Gibson Dunn’s conduct during the
deposition of Alison Hendrix, Facebook’s director of privacy and data policy. Facebook
designated Hendrix to testify on several topics identified in the plaintiffs’ 30(b)(6) deposition
notice, including: “The purposes for which…data or information was shared or made accessible”
to third parties; “how Facebook ensured third parties’ use of such data or information was
limited” to the purpose for which the third party was able to obtain it; and “an overview of the
processes of developing privacy or app settings or other controls made available to users to
prevent or limit their data or information from being accessed by third parties.” Dkt. No. 1085-22
at 22.
The plaintiffs began by asking Hendrix if those topics—how Facebook limited third
29Page 30 parties’ use of users’ data and the controls Facebook had in place to help users limit third parties’
access to their data—seemed related. Hendrix twice asked what the plaintiffs meant by “related.”
Dkt. No. 1085-22 at 18–19, 20–21. After five minutes of back-and-forth and multiple objections
from Gibson Dunn, Hendrix agreed that the topics were “somewhat related.” Dkt. No 1085-22 at
18–23.
Tensions only escalated from there. At one point, for instance, the plaintiffs asked
Hendrix if she could “unpack” one of her answers, and she responded, “No.” Dkt. No. 1085-22
at 132. The plaintiffs said, “I’m trying to figure out what you mean by [your answer,]” and
Hendrix responded, “I mean[t] what I said. And I even gave an example.” Dkt. No. 1085-22 at
132.
Many of the disputes in the deposition centered around Gibson Dunn’s interpretation of
the 30(b)(6) deposition notice. For instance, Hendrix was designated to testify about the process
of developing privacy and app settings. The plaintiffs asked Hendrix whether there was a “tool or
a setting [a user] can select in determining what to share with a third party.” Dkt. No. 1085-22 at
137. Gibson Dunn attorney Robert Blume objected that the question was outside the scope of the
deposition notice. Dkt. No. 1085-22 at 136. Blume made the same objection when the plaintiffs
asked whether a drop-down option in the privacy shortcuts menu said, “Who can see my stuff?”
Dkt. No. 1085-22 at 177. To Blume, the question was “incredible” because it had “nothing to do
with users’ privacy or app settings,” but rather was a “technological change.” Dkt. No. 1085-22
at 177–78.
The parties also disagreed about whether Hendrix was required to speak about actual
instances of developer misconduct and enforcement, rather than just Facebook’s theoretical
policies. To Blume, it was significant that the plaintiffs sought testimony on “how Facebook
ensured third parties’ use of such data or information was limited to the use case.” Because the
plaintiffs’ notice said “how” and “not when, not what, not which,” he said, the plaintiffs could
not seek any testimony about third parties’ actual compliance. Dkt. No. 1085-22 at 320.
For instance, at one point, Hendrix testified that developers “must comply” with
30Page 31 Facebook’s terms, and there were “no exceptions.” Dkt. No 1085-22 at 327. The plaintiffs
followed up by asking if Hendrix was aware of “the instances in which developers did or did not
comply with [those] terms.” Dkt. No. 1085-22 at 327. Hendrix responded: “I will do my own
bitching and moaning. I have already answered that question twice. So for the third time, I will
let you know that I am not prepared to tell you every single violation that has been surfaced and
confirmed from 2007 to 2022.” Dkt. No. 1085-22 at 327–28.
In all, Blume instructed Hendrix not to answer questions at least 22 times on the theory
that the questions were outside the scope of the notice. While Blume initially allowed Hendrix to
answer these questions in her personal capacity (rather than as Facebook’s designee), he
eventually instructed Hendrix that she should not answer the questions at all. See Dkt. No. 108522 at 269. And Hendrix herself refused to answer certain questions based on her own
interpretation of the deposition notice. See, e.g., Dkt. No. 1085-22 at 234, 245–46, 327–28.
Throughout the deposition, Blume’s frequent objections and instructions not to answer
cut off certain lines of questioning entirely. For instance, the plaintiffs asked if Hendrix was
prepared to testify about “third-party app developers that actually continued to access friend
information” after the deprecation of friend permissions. Dkt. No. 1085-22 at 228. Hendrix
responded that, after the first version of the interface was “fully deprecated,” “friend
permissions” were “no longer a thing from a product perspective.” Dkt. No. 1085-22 at 229. “If
you didn’t move your app and build off of v2, from a technical standpoint at deprecation of v1,
you could no longer call the Graph API and receive any friend permissions. There was no longer
the ability to request friend permissions.” Dkt. No. 1085-22 at 228. The plaintiffs followed up by
asking Hendrix if she was familiar with whitelisting. Dkt. No. 1085-22 at 229. When she said
yes, they asked for her understanding of the term. Dkt. No. 1085-22 at 229. Blume objected. Dkt.
No. 1085-22 at 229. That objection was followed by a 15-minute discussion about whether the
question was outside the scope of the deposition notice—with Hendrix herself stating that she
“struggle[d]” to see how the question was relevant to the topics she was prepared to discuss. Dkt.
No. 1085-22 at 240, 229–244.
31Page 32 That exchange is representative of the larger pattern: Blume would object, and the
plaintiffs, Blume, Hendrix, and Special Master Garrie would spend a substantial amount of time
debating the objection. One such dispute lasted 17 minutes. Dkt. No. 1085-22 at 292–310.
After the deposition, the plaintiffs filed a motion with Special Master Garrie for sanctions
based on Blume and Hendrix’s conduct. Dkt. No. 935. Among other things, the plaintiffs sought
additional time for 30(b)(6) depositions on the topics for which Hendrix was a designated
witness. Facebook did not oppose the motion, and it agreed to the relief requested. Dkt. No. 936.
Facebook also agreed to pay the plaintiffs’ attorney’s fees for the time spent preparing for and
conducting Hendrix’s deposition, as well as the fees for the time Special Master Garrie spent on
the deposition and motion. Dkt. No. 936.
D.
Designation of Documents as Privileged
Another area of conflict involved Facebook and Gibson Dunn’s misdesignation of
thousands of documents as privileged. Just before the February 2022 case management
conference, Facebook’s privilege log listed around 15,000 documents (not including the ADI
documents). This was the conference where this Court ripped into Facebook and Gibson Dunn
for stonewalling.
Facebook responded to the threat of sanctions by accelerating its production, but in
connection with that production it added over 180,000 documents to its privilege log. See Dkt.
No. 1088-9 at 4. To the plaintiffs, this massive assertion of privilege seemed dubious, and they
raised the issue with Facebook and Gibson Dunn. Facebook and Gibson Dunn ultimately agreed
to re-review a sample of 3,062 documents. Dkt. No. 1050-3 at 28. After this review, Facebook
withdrew privilege claims over 63% of those documents. Dkt. No. 1050-3 at 28. Given that
significant rate of error, Facebook agreed to re-review all the documents it had withheld as
privileged. Although it’s difficult to pinpoint the exact numbers, the plaintiffs estimate that
Facebook dropped privilege claims for over 53,168 documents and offered redacted versions of
an additional 7,482 documents that the company originally withheld. Dkt. No. 1050-3 at 28.
The plaintiffs offer a few examples of documents initially designated as privileged. They
32Page 33 point to an email chain from the fall of 2009 among non-attorneys discussing “what to do about
friend data” and whether “apps get to store whatever friend data they get.” Dkt. No. 1041-3 at 2–
3. The plaintiffs also point to an April 2018 email between non-attorneys that discusses “a couple
of docs” an employee put together for Mark Zuckerberg in mid-2015 about “the need to build a
stronger and more centralized privacy & data use org.” Dkt. No. 1041-5 at 2. The employee
observes, “I wonder how much of a better place we’d be in today if the proposal had been
implemented three years ago.” Dkt. No. 1041-5 at 2.
Relatedly, internal documents from Facebook also suggest that its employees sought to
shield communications from future discovery by “privileging” them. For instance, a 2015 email
chain between Facebook employees discusses a credit score app that was mistakenly given
access to certain sensitive user data like “user_posts.” Dkt. No. 1103-22 at 3. One employee
responds, “Simon, can we discuss in person? Else we need to make this a/c priv and add a lawyer
in the thread.” Dkt. No. 1103-22 at 2. Simon Cross replies, “You know what my answer will be
here.” Dkt. No. 1103-22 at 2. And the employee responds, “:-).” Dkt. No. 1103-22 at 2.
Another chat discusses “PR and regulatory inquiries.” Dkt. No. 1088-13 at 2. One of the
employees shares something that has since been redacted. Dkt. No. 1088-13 at 2. Another
responds, “Might be best not to share in this specific thread, rather one with priv.” Dkt. No.
1088-13 at 2 Later in the chat, an employee asks about using Quip (a collaborative tool for
editing documents and spreadsheets) for sensitive information. Dkt. No. 1088-13 at 2. The
following exchange occurs:
[Employee 1] (3/20/2018 16:43:39 PDT):
>Just ensure that if it’s very sensitive you ask a lawyer for guidance in the Quip and
privilege it
[Employee 2] (3/20/2018 16:44:53 PDT):
>How does one ‘privilege it’?
[Employee 3] (3/20/2018 16:45:22 PDT):
>With the presence and approval of an attorney[.]
Dkt. No. 1088-13 at 2.
33Page 34 E. Facebook and Gibson Dunn’s Rhetoric
Finally, throughout this period, Facebook and Gibson Dunn consistently argued that it
was the plaintiffs who were delaying discovery. As early as 2020, Facebook and Gibson Dunn
told Judge Corley that the plaintiffs “continue to undermine the Court’s well-considered orders
(intended to bring structure to the case) by insisting on an unfocused whack-a-mole process that
would unwind past agreements and work.” Dkt. No. 563 at 6. In 2021, Facebook and Gibson
Dunn told the Court that the plaintiffs’ “scattershot approach to litigation continues to cause
significant inefficiencies, unnecessary friction, wasteful motion practice, and a race to litigate
(rather than resolve) disputes.” Dkt. No. 631-3 at 7 (under seal).
Recall Facebook and Gibson Dunn’s repeated pronouncements that discovery was limited
to information Facebook admitted had been shared. When the plaintiffs brought that issue to
Special Master Garrie’s attention, Facebook and Gibson Dunn described the plaintiffs’ motion as
“an opportunistic, wasteful, and abusive attempt to erase the proceedings before Judge Corley,
gain access to information Plaintiffs have conceded is irrelevant, and hunt for anything to stall
this case before it finally reaches the merits.” Dkt. No. 1085-11 at 6.
By January 2022, just before the Court invited this sanctions motion, Gibson Dunn
attorney Orin Snyder told Special Master Garrie that the “case [was] out of control” because “the
plaintiffs will not stop.” Dkt. No. 1087-3 at 5. According to Snyder, the plaintiffs were raising
new issues “coming from left field, right field, the dugout, the saloon down the street [from] the
ballpark,” all just before discovery was set to end. Dkt. No. 1087-3 at 11. It was time for the
plaintiffs to be told “no mas, no mas.” Dkt. No. 1087-3 at 6.
II
A court may impose sanctions under its inherent powers “when a party has ‘acted in bad
faith, vexatiously, wantonly, or for oppressive reasons.’” Chambers v. NASCO, Inc., 501 U.S. 32,
45–46 (1991) (quoting Alyeska Pipeline Service Co. v. Wilderness Society, 421 U.S. 240, 258–59
(1975)). A court may exercise this power by requiring the sanctioned party to pay the opposing
party’s attorney’s fees. Id.
34Page 35 Before imposing sanctions, the court must find that the conduct “constituted or was
tantamount to bad faith.” Primus Automotive Financial Services, Inc. v. Batarse, 115 F.3d 644,
648 (9th Cir. 1997). That standard may be met when a party misrepresents the law or the facts to
the court. See, e.g., Malhiot v. Southern California Retail Clerks Union, 735 F.2d 1133, 1138
(9th Cir. 1984); cf. Chambers, 421 U.S. at 35–41. It may also be met “when a party acts for an
improper purpose—even if the act consists of making a truthful statement or a non-frivolous
argument or objection.” Fink v. Gomez, 239 F.3d 989, 992 (9th Cir. 2001). Sanctions may be
imposed for “delaying or disrupting the litigation or hampering enforcement of a court order.”
Primus, 115 F.3d at 649. And they may be imposed for repeatedly making arguments that have
been rejected. Wages v. I.R.S., 915 F.2d 1230, 1235 (9th Cir. 1990).
“To protect against abuse and to ensure parties receive due process, individuals subject to
sanction are afforded procedural protections, the nature of which varies depending upon the
violation, and the type and magnitude of the sanction.” F.J. Hanshaw Enterprises, Inc. v.
Emerald River Development, Inc., 244 F.3d 1128, 1137 (9th Cir. 2001). The Ninth Circuit has
distinguished between two types of sanctions: compensatory and punitive. The former is
intended to compensate the opposing party for the expense incurred as a result of the misconduct.
Id. at 1137–38. The latter is intended to “vindicate the court’s authority and the integrity of the
judicial process.” Id. at 1138.
To impose compensatory sanctions, the court must give the sanctioned party notice and
an opportunity to be heard. Id. at 1143. The Ninth Circuit has not addressed the burden of proof
required for compensatory sanctions, but a finding of bad faith by clear and convincing evidence
is sufficient. Lahiri v. Universal Music & Video Distribution Corp., 606 F.3d 1216, 1219 (9th
Cir. 2010). To impose substantial punitive sanctions (at least for out-of-court conduct), the court
“must provide the same due process protections that would be available in a criminal contempt
proceeding.” F.J. Hanshaw Enterprises, Inc., 244 F.3d at 1139; cf. Goodyear Tire & Rubber Co.
v. Haeger, 581 U.S. 101, 108 (2017). That process includes the right to an independent
prosecutor, a jury trial, and a finding of misconduct beyond a reasonable doubt. F.J. Hanshaw
35Page 36 Enterprises, Inc., 244 F.3d at 1139–40.
The sanctions requested in this case are compensatory. The parties have already reached a
settlement in principle, and the settlement includes a total amount to be paid by Facebook into a
settlement fund. Most of the settlement fund will be designated for members of the class; some
of it will be designated to pay fees and costs to class counsel. Any fee award to the plaintiffs
from this sanctions motion will cause a corresponding reduction in the amount of money
designated to pay attorney’s fees from the settlement fund. In other words, a fee award here
means the plaintiff class will need to use less of the settlement fund for attorney’s fees. And that
is the point of compensatory sanctions—to protect one side from paying fees resulting from the
opposing side’s misconduct. Cf. Restatement (Third) of the Law Governing Lawyers § 38(3)(b)
(2000).
Relatedly, the amount of compensatory sanctions is limited to fees and costs “incurred
solely because of the misconduct” at issue, meaning “fees that party would not have incurred but
for the bad faith.” Goodyear, 581 U.S. at 104. A court has “broad discretion” in calculating that
award. Id. As the Supreme Court has emphasized, the sanctioning court “need not, and indeed
should not, become green-eyeshade accountants’ (or whatever the contemporary equivalent is).”
Id. at 110 (quoting Fox v. Vice, 563 U.S. 826, 838 (2011)). “Accordingly, a district court may
take into account [its] overall sense of a suit, and may use estimates in calculating and allocating
an attorney’s time. The court may decide, for example, that all (or a set percentage) of a
particular category of expenses—say, for expert discovery—were incurred solely because of a
litigant’s bad-faith conduct.” Id. (quoting Fox, 563 U.S. at 838) (quotations and citations
omitted).
A court may also award fees and costs incurred in moving for sanctions. These fees and
costs are a result of the misconduct—“were there no sanctionable conduct, there would have
been no proceeding to impose sanctions, and no fees incurred in that proceeding.” Blixseth v.
Yellowstone Mountain Club, LLC, 854 F.3d 626, 631 (9th Cir. 2017); see also Harper v. Nevada
Prop. 1, LLC, No. 219CV02069GMNVCF, 2021 WL 3418350 (D. Nev. Aug. 5, 2021).
36Page 37 After a court estimates the amount of fees and costs incurred “because of” the
misconduct, it then determines whether that amount is reasonable by looking to the number of
hours reasonably expended on the case (deducting any unnecessary or duplicative expenses)
multiplied by a reasonable hourly rate. Pennsylvania v. Delaware Valley Citizens’ Council for
Clean Air, 478 U.S. 546, 564 (1986).
III
The Court finds by clear and convincing evidence that Facebook and Gibson Dunn acted
in bad faith during much of this litigation, and their misconduct warrants sanctions pursuant to
the Court’s inherent authority. Because a court’s inherent powers must be exercised with
“restraint and discretion,” the Court will only sanction Facebook and Gibson Dunn for the worst
of their consistently bad behavior: their handling of discovery related to the App Developer
Investigation and the named plaintiff data.10 This misconduct would be sanctionable even if
viewed in isolation, but their bad faith becomes even more obvious when viewed in the context
of the entire litigation. It is also clear that the blame for this misconduct must be laid equally at
the feet of both client and counsel—this sustained, brazen stonewalling campaign could only
have occurred if everyone (or almost everyone) was on the same page.11
A. Sanctionable Conduct
1. App Developer Investigation
First, Facebook and Gibson Dunn deserve to be sanctioned for their repeated use of
frivolous legal arguments to delay the production of highly probative evidence related to the App
Orin Snyder, who served as lead counsel when Gibson Dunn’s conduct was at its worst, should
consider himself lucky that he has not been sanctioned personally. Presumably this ruling will
help ensure that he will not be so lucky if he acts this way again.
11
While a court should ordinarily rely on 28 U.S.C. § 1927 and the Federal Rules of Civil
Procedure to impose sanctions, if neither is “up to the task, the court may safely rely on its
inherent power.” Chambers, 501 U.S. at 50. Section 1927 does not allow the court to impose
sanctions against parties or law firms, so it does not apply to the circumstances of this case.
Kaass L. v. Wells Fargo Bank, N.A., 799 F.3d 1290, 1293–94 (9th Cir. 2015). And while some of
the misconduct could potentially be sanctioned under the Federal Rules of Civil Procedure, that
misconduct is “intertwined within conduct that only the inherent power [can] address,” so
sanctions under the Court’s inherent powers are appropriate. Chambers, 501 U.S. at 51.
10
37Page 38 Developer Investigation.
To be clear, the Court does not find bad faith in the initial argument that all materials
related to the investigation were privileged. Judge Corley herself acknowledged (before
reviewing the documents) that there were “arguments both ways,” and the Supreme Judicial
Court of Massachusetts has held (albeit with thin analysis) that certain ADI documents were
covered by work-product or attorney-client privilege. See Attorney General v. Facebook, Inc.,
487 Mass. 109, 130–31 (2021).
But Facebook and Gibson Dunn’s conduct surrounding that assertion of privilege—
particularly their conduct in the wake of Judge Corley’s rejection of their blanket privilege
argument—is sanctionable. The ADI documents were highly probative. Recall the memos
discussed in Section I.A of this opinion: they identified apps that had access to millions of users’
information, even after Facebook purported to limit that access. They also offered insight into
what Facebook knew and when. Recall, too, the email chain from 2019 that appeared to show
Facebook considering the impact of its enforcement decisions on its revenue stream. Had
Facebook gotten its way, none of these documents ever would have been produced.
After Judge Corley rejected their argument about privilege, Facebook and Gibson Dunn
engaged in what can only be described as an effort to gaslight their opponents (and the Court)
over the production of Facebook’s internal communications and the communications with
Facebook’s consultants. Take, for example, the plaintiffs’ concession that they did not need
administrative emails—emails requesting information from apps or discussing scheduling—
because they were only looking to discover the “underlying facts.” Facebook and Gibson Dunn
used this statement to argue that the plaintiffs had conceded that they were not entitled to
discover any communications about the App Developer Investigation at all. Facebook and
Gibson Dunn did not make this argument once; they made it repeatedly. One wonders if the
lawyers on the other side began to question their own sanity.
The same is true of Facebook and Gibson Dunn’s argument that Judge Corley had held
the communications were not discoverable. Her order explicitly required Facebook and Gibson
38Page 39 Dunn to work with Special Master Garrie to identify what else should be produced from the
universe of ADI materials. And Judge Corley had not reviewed a representative set of
communications when deciding the parties’ dispute; she had reviewed twenty documents blindly
picked from Facebook’s privilege log. Moreover, those documents were not the focus of her
order. As she made clear, her order adjudicated the privilege question broadly—not the
discoverability of the twenty documents from the sampling exercise. Instead of fairly reading
that order, Facebook and Gibson Dunn seized on a few passing comments Judge Corley made at
a hearing months prior. Relying on these out-of-context comments (comments not included in
her ruling), Facebook and Gibson Dunn argued that Judge Corley had silently adjudicated the
discoverability of all ADI communications. And Orin Snyder argued, with his typical bombast,
that this interpretation was based on “a lot of case law”—none of which seems to exist. Those
arguments were frivolous, and they did nothing but delay production and waste the plaintiffs’
and the Court’s time.
It’s worth stepping back to reflect on the position Facebook and Gibson Dunn took on
Facebook’s communications about the investigation. This case is about Facebook’s alleged
policy of sharing Facebook users’ personal information with third parties without permission. It
is also about Facebook’s alleged failure to prevent third parties from misusing the personal
information they received. Of course, the App Developer Investigation was about largely the
same thing: the extent to which third parties obtained and misused the personal information of
Facebook users. Any first-year civil procedure student would know that internal communications
between Facebook employees about the investigation would be a prime source of information
relevant to this lawsuit. It’s equally obvious that Facebook’s communications with its outside
consultants hired to investigate these apps would be relevant. Indeed, Special Master Garrie
found that a “substantial number” of the communications he reviewed were “relevant to the case
and not protected by privilege.” Dkt. No. 916-9 at 6. Finally, no reasonable person could argue
that these documents—given their significant probative value—were too burdensome to identify
and produce as a categorical matter. It is the height of bad faith to repeatedly resist the disclosure
39Page 40 of such probative information by twisting the words of opposing counsel and the magistrate
judge.
Facebook and Gibson Dunn’s conduct after Special Master Garrie ordered them to
produce additional ADI documents further supports this finding of bad faith. To recall, Special
Master Garrie originally ordered Facebook to produce all documents related to the investigation
(with some exceptions for attorney communications). Facebook then moved for reconsideration.
In its motion for reconsideration, Facebook argued that it should only be required to search for
relevant materials from the documents it had already collected—it should not be required to
collect any new documents because its existing set was adequate. Only after this Court
threatened sanctions did Facebook and Gibson Dunn reveal that the set of previously collected
documents did not include anything from after 2019 (even though the App Developer
Investigation continued into 2020). Gibson Dunn now argues that it was not “aware” of this fact.
But if that’s true, it means Facebook and Gibson Dunn were comfortable telling Special Master
Garrie their previous collection was adequate—without ever inquiring into what they had
actually collected. This conduct is symptomatic of their larger strategy: object first, investigate
later (and only when forced). And that strategy supports the finding of bad faith.
The plaintiffs complain of other conduct by Facebook and Gibson Dunn related to ADI
discovery. They complain, for example, about Facebook and Gibson Dunn’s failure to use search
terms such as “ADI” and “App Developer Investigation” when searching for communications
about the App Developer Investigation. And they complain about Facebook and Gibson Dunn’s
failure to search for all the apps Facebook investigated. In isolation, this conduct is more
susceptible to an innocent explanation. After all, the plaintiffs could have helped ensure that the
proper search terms were being used, and the Special Master’s order could have been more
precise. But given the context, this conduct also likely reflects bad faith.
2. Named Plaintiff Data
Facebook and Gibson Dunn’s misconduct as it relates to the named plaintiff’s
information is also sanctionable. As with the App Developer Investigation, Facebook and Gibson
40Page 41 Dunn used frivolous arguments to delay the production of a key category of information. As
Judge Corley and Special Master Garrie explained—at least three times over the course of two
years—discovery was not limited to information that Facebook admitted it had shared. First, in
Discovery Order No. 9, Judge Corley held that discoverable information included a category of
data that Facebook said was never shared at all. There is no reasonable interpretation of that
order that limits discovery to data Facebook admitted it shared. Whether the information was
actually shared was, as Judge Corley explained, an “open question,” and the plaintiffs were
entitled to seek evidence on that question—including evidence about the information Facebook
collected about them. Even if there had been any ambiguity in Judge Corley’s order, that
ambiguity would have been eliminated by her repeated rejection of Facebook and Gibson Dunn’s
argument. But they persisted.
Judge Corley envisioned a process by which the parties would work together to
determine what universe of data existed and, from there, determine what could have been shared.
This was a highly technical question: in the end, it took Special Master Garrie and the parties six
months to determine what else should be produced. By consistently arguing that discovery was
limited to information Facebook admitted it shared, Facebook and Gibson Dunn short-circuited
that process. Without knowing the universe of named plaintiff data that existed, it would be
difficult (if not impossible) to verify Facebook’s representations.
Judge Corley and Special Master Garrie should never have needed to clarify (even once,
much less multiple times) that Facebook could not avoid identifying and producing some subset
of information simply by asserting that it never shared that subset of information with third
parties. Again, this whole case involved accusations that Facebook disclosed personal
information about users to third parties surreptitiously, indiscriminately, and without permission.
The first step in getting to the bottom of those accusations was to figure out what information
Facebook collected on the named plaintiffs, as a means to figuring out which pieces of
information Facebook actually disclosed. The argument that “we didn’t share that information,
so we don’t need to provide it in discovery” is obviously contrary to the right of the plaintiffs to
41Page 42 test Facebook’s assertions in an adversarial litigation process.
Moreover, even if this argument were somehow not frivolous when Facebook and Gibson
Dunn first made it, it’s clear that they were pressing the argument for an improper purpose: their
actions were intended to obfuscate and delay the resolution of a major issue in the case. From the
very beginning, Facebook and Gibson Dunn stonewalled, telling the plaintiffs to “Google”
information about Facebook’s data architecture. From then on, they consistently failed to identify
materials responsive to the plaintiffs’ requests and Judge Corley’s order. When pressed,
Facebook and Gibson Dunn submitted a “nonsensical” response to Special Master Garrie. And
then, on appeal, Facebook and Gibson Dunn misrepresented Special Master Garrie’s order to
Judge Corley.
That improper purpose is also clear when one considers Facebook and Gibson Dunn’s
other argument: that production of any additional named plaintiff data would create a major
burden, and so it was not proportional to the needs of the case. Facebook and Gibson Dunn made
this argument even though they had already preserved two additional sources of named plaintiff
data: the Switchboard profiles and the identified Hive tables. As early as July 2020, Judge Corley
ordered the parties to meet and confer to “discuss in detail each side[’s] understanding of what
precisely has been produced and precisely what is the data that is being withheld as not relevant
or not reasonably available.” Dkt. No. 487 at 1–2. At that meet and confer (at the latest),
Facebook and Gibson Dunn should have told the plaintiffs about the Switchboard profiles and
the Hive tables.
Facebook and Gibson Dunn now offer two explanations for their failure to disclose the
Hive tables. First, they say the information in the tables was not relevant or had already been
produced. Second, they say Facebook erred on the side of over-preserving information, and they
weren’t required to disclose everything that was preserved. But neither explains why Facebook
and Gibson Dunn didn’t just tell the plaintiffs that they had identified a subset of Hive tables,
especially when the parties spent months litigating the production of information from the Hive.
Perhaps Gibson Dunn’s attorneys were not aware of the Hive tables (although Facebook’s own
42Page 43 witness stated that the materials were preserved with the help of “outside counsel”). If the
attorneys were just ignorant, that is almost as bad: it is reflective of Gibson Dunn’s “object first,
investigate later” strategy. Rather than determining whether Facebook could produce a small
number of tables that were likely to contain probative information, Gibson Dunn consistently
argued that Hive was totally inaccessible.
Equally troubling is the misconduct related to the Switchboard profiles. Facebook and
Gibson Dunn chose to produce the plaintiffs’ information in a difficult and obscure format.
Facebook’s own witness testified that Switchboard was “more usable”—and it contained
additional information—but Facebook and Gibson Dunn failed to disclose its existence for years.
Facebook and Gibson Dunn now assert that the Switchboard profiles are just as unwieldy
as DYI. Indeed, when Facebook produced the named plaintiffs’ Switchboard profiles, they had to
do so in multiple PDFs, including one that was 45,000 pages long. But that does not justify
Facebook and Gibson Dunn’s lack of candor. The plaintiffs consistently complained about the
difficulty in dealing with the DYI files, and they explicitly asked Facebook about the tools it
used to provide information to law enforcement. Dkt. Nos. 1060 at 26; 1103-9 at 95. Facebook
and Gibson Dunn never suggested there was another way to produce the plaintiffs’ information.
Even if Switchboard was unwieldy for different reasons, Facebook and Gibson Dunn could not
decide in secret that it was irrelevant.
More generally, Facebook and Gibson Dunn now argue that the plaintiffs elevate form
over substance, and that the information in Hive and Switchboard is duplicative or insignificant.
Even if that’s true, it was bad faith to argue that any additional discovery was not proportional to
the needs of the case, while withholding the fact that certain Hive tables and Switchboard
profiles were easily and readily accessible. It was not for Facebook and Gibson Dunn to
unilaterally decide the scope and extent of discovery. Moreover, Facebook and Gibson Dunn’s
arguments have always been a moving target. For every new deficiency in discovery, they’ve
offered a new excuse—and that makes it hard to credit their assertions now.
43Page 44 B. Other Evidence of Bad Faith
1.
Depositions
The plaintiffs have not sought sanctions for Facebook and Gibson Dunn’s conduct during
depositions, but that conduct underscores the conclusion that both the client and its lawyers were
operating in bad faith. There are a number of examples but suffice to highlight two.
The first involves the testimony of Jackie Chang and Simon Cross. Facebook’s internal
documents suggest that Chang was intimately involved in whitelisting, the process by which
apps were given ongoing access to friends’ information despite Facebook’s ostensible decision to
limit that access in 2014. When Facebook first developed the process of whitelisting, Chang was
a “strategic partner manager,” working closely with Facebook’s business partners. See Dkt. No.
1103-24 at 25. Emails from the time period suggest that Chang had a say in the whitelisting
process. Dkt. No. 1103-21 at 29–31; see also Dkt. No. 1103-24 at 169 (discussing an email
thread stating, “Jackie leading on putting together a new whitelist process with Legal and
Product”); Dkt. No. 1103-24 at 268–69 (discussing email thread stating that Chang was tasked
with “PR messaging” and “maintain[ing] relationships” prior to the conference at which
Facebook announced it would limit access to friends’ information). Chang also spent nine hours
with Gibson Dunn preparing for the deposition, and she was being deposed in connection with a
high-profile case involving data sharing. In that context, Chang’s statements that she did not
remember basic facts about Facebook’s data-sharing practices demonstrate Facebook’s bad faith.
Her demeanor throughout the deposition (which the Court watched) suggests that she did not
want to discuss her decision-making process because she was afraid of getting into trouble (or
getting Facebook into trouble).
But even if Chang miraculously remembered nothing about whitelisting—or the fact that
Facebook allowed apps to access friends’ information at all—she resisted more basic questions.
Although she was not a designated 30(b)(6) witness, she is still a Facebook employee. Her
obvious hostility to the litigation—and Facebook and Gibson Dunn’s failure to ensure that she
made a minimal effort to cooperate—is another example of the overall obstructionist approach.
44Page 45 And after Chang’s deposition, Cross compounded this problem by repeatedly telling the
plaintiffs to talk to Chang, even referring them to her to discuss an email thread he was included
on.12
The conduct of Facebook witness Allison Hendrix and Gibson Dunn attorney Robert
Blume was even worse. The Federal Rules of Civil Procedure require 30(b)(6) witnesses to give
“complete, knowledgeable, and binding answers” on the corporation’s behalf. Ecclesiastes 9:1011-12, Inc. v. LMC Holding Co., 497 F.3d 1135, 1146 (10th Cir. 2007). The witnesses must be
“unevasive.” Starlight International Inc. v. Herlihy, 186 F.R.D. 626, 639 (D. Kan. 1999).
Instead, Hendrix and Blume worked in concert to evade the plaintiffs’ questions. For his
part, Blume instructed Hendrix not to answer certain questions based on his view that the
questions were outside the scope of the deposition notice. As Facebook now acknowledges,
that’s an improper practice: if an attorney believes a question is outside the scope of a notice, the
attorney “shall state the objection on the record and the witness shall answer the question, to the
best of the witness’s ability.” Detoy v. City & County of San Francisco, 196 F.R.D. 362, 367
(N.D. Cal. 2000); see also Lykins v. CertainTeed Corp., 555 F. App’x 791, 797–98 (10th Cir.
2014); La Jolla Spa MD, Inc. v. Avidas Pharmaceuticals, LLC, No. 17-CV-1124-MMA(WVG), 2019 WL 4141237, at *7 (S.D. Cal. Aug. 30, 2019); Best Buddies Leasing, LLC v. Cabrillo
Yacht Sales, No. 07CV1121 BTM (AJB), 2009 WL 10671517, at *2 (S.D. Cal. Apr. 23, 2009);
Board of Trustees of Leland Stanford Junior University v. Tyco Int’l, Ltd., 253 F.R.D. 524, 527
(C.D. Cal. 2008); Dkt. No. 1052-2 at 40. But at the deposition, Blume instructed Hendrix not to
answer at least 22 times.
Blume also violated the Federal Rules of Civil Procedure by arguing his objections on the
12
Unlike Chang (and, as discussed later in this ruling, Hendrix), Cross did not come across as
openly hostile to the litigation, and much of his testimony seemed intended to be helpful. But he
was designated to testify about whitelisting, and Facebook and Gibson Dunn should have
ensured he was prepared to address Facebook’s internal communications about its decisionmaking process. That’s all the more true because the plaintiffs provided these documents in
advance of the deposition, and Facebook and Gibson Dunn knew that Chang had refused to offer
any insight into them.
45Page 46 record. During a deposition, counsel should “note[]” their objections, “but the examination still
proceeds; the testimony is taken subject to any objection.” Fed. R. Civ. P. 30(c)(2). And the
objections “must be stated concisely in a nonargumentative and nonsuggestive manner.” Id. In
blatant violation of this rule, Blume argued his objections, loudly and obnoxiously. This wasted
the plaintiffs’ deposition time—time limited by Court order. Moreover, these objections were
often frivolous. For instance, Hendrix was designated to discuss Facebook’s process of
developing privacy settings and controls; it was not outside the scope for the plaintiffs to ask her
about Facebook’s privacy shortcuts, especially when she had already testified about them.
These objections seemed intended to make it difficult or impossible for the plaintiffs to
obtain probative testimony about information that was obviously central to the case. For
instance, Hendrix testified that “friend permissions”—the ability of apps to access friends’
information—were “no longer a thing from a product perspective” after the “deprecation” of the
earlier developer interface. Dkt. No. 1085-22 at 228–29. It was reasonable for the plaintiffs to
follow up by asking about whitelisting. After all, whitelisted apps were able to access friend
permissions even after the transition to the new interface, and so the practice would seem to
contradict Hendrix’s testimony. But Blume interrupted this line of questioning by objecting.
Hendrix’s conduct, too, was totally inappropriate. Instead of testifying “unevasively,” as
a Rule 30(b)(6) witness is required to do, Hendrix refused to cooperate, even telling the plaintiffs
“no,” she would not unpack one of her answers. It seems that Blume used his objections to coach
Hendrix about his narrow view of the deposition notice. Hendrix then refused to answer
questions based on that narrow view—even in the absence of an objection. The tension in the
deposition reached its peak when Hendrix felt that the plaintiffs were asking repetitive questions
and responded that she would “do [her] own bitching and moaning” rather than waiting for her
lawyer to do it for her.
It is true that the 30(b)(6) deposition notice was written broadly, and it might be difficult
to prepare a witness given that breadth. And the plaintiffs’ questions were not always carefully
crafted. For instance, the plaintiffs asked Hendrix if she was aware of “the instances” in which
46Page 47 developers did not comply with Facebook’s terms, a question that could be interpreted as seeking
testimony about every single instance of noncompliance. Dkt. No. 1085-22 at 327. But, in line
with her duty to be cooperative, Hendrix could have offered representative examples—it was not
appropriate for her to “bitch and moan” instead.
Towards the end of Hendrix’s deposition, Special Master Garrie appeared to condone
Blume’s speaking objections by adjudicating them during the deposition. And he erroneously
stated that it was appropriate for Gibson Dunn to instruct Hendrix not to answer certain questions
as outside the scope of the notice. While this may have exacerbated the problems, it appears that
Special Master Garrie stepped in only after the deposition became so heated that it would have
otherwise fallen apart. The attorneys were already arguing over nearly every question; it seems
that Special Master Garrie thought that adjudicating the issues on the spot might help move the
deposition along. His actions—late in the deposition, after hours of argument—do not excuse
Facebook and Gibson Dunn’s misconduct.
Of course, Facebook and Gibson Dunn agreed to pay the plaintiffs’ attorney’s fees and
the Special Master’s fees associated with Hendrix’s deposition—presumably because it took
place after this Court had taken Facebook and Gibson Dunn to task for their behavior in this
case. And the plaintiffs have not sought sanctions for deposition misconduct more generally. But
that does not shield it from scrutiny as it relates to this sanctions motion. To the extent there
could be any doubt that Facebook and Gibson Dunn acted in bad faith with respect to discovery,
their conduct during the depositions helps put that doubt to rest.
2. Designation of Documents as Privileged
Finally, Facebook and Gibson Dunn’s over-designation of documents as privileged
supports the Court’s finding of bad faith. First, Facebook’s internal communications—although
not dispositive—suggest it has a culture hostile to litigation. It seems that Facebook employees
are taught to improperly “privilege” documents based on their perceived sensitivity.
Second, Gibson Dunn designated a massive number of documents as privileged, even
though for many of them it’s difficult to imagine any conceivable argument in support of that
47Page 48 assertion. Gibson Dunn’s only response is that nervous associates over-designated the documents
to avoid waiving privilege. But Gibson Dunn has an obligation to ensure that even its nervous
associates follow the law. The more likely explanation is that Facebook and Gibson Dunn had
backed themselves into a corner: After delaying production for years, they were forced to meet
this Court’s deadlines, and they took the shortcut of over-designating documents rather than
reviewing them properly.
Although Facebook and Gibson Dunn revisited these privilege designations and produced
a significant number of documents, they did so only after the plaintiffs requested it (and after the
Court told the plaintiffs that their complaints should be made in a motion for sanctions). While
the Court will not order payment of attorney’s fees for this conduct, it further supports the
conclusion that Facebook and Gibson Dunn operated in bad faith.
IV
Confronted with the totality of their conduct, Facebook and Gibson Dunn offer no
convincing explanation. Predictably, they lead with the notion that the problems in this case were
largely the fault of plaintiffs’ counsel. They say plaintiffs’ counsel asked for too much and
refused to narrow their requests, engaging in dilatory discovery misconduct of their own. The
Court will assume, solely for the sake of adjudicating this motion, that there is some truth to
these assertions.
Even so, the alleged misconduct of plaintiffs’ counsel would not come close to excusing
that of Facebook and Gibson Dunn. No matter the conduct of the opposing party, counsel cannot
twist their words—not to mention the words of the Court—in support of frivolous arguments.
They cannot resist the disclosure of obviously discoverable information. They cannot ignore
potential sources of evidence, only for opposing counsel to learn about those sources at a
30(b)(6) deposition near the close of discovery. They cannot treat depositions like fighting
matches. And they cannot encourage their client’s obstinance—no matter how difficult the
subject matter, and no matter how imprecise the other side’s questions might be.
It’s worth remembering that Facebook and Gibson Dunn had superior access to all the
48Page 49 evidence needed in this case. How were the plaintiffs supposed to know what specific
information Facebook collected about them or shared with third parties? How were they to know
what apps their Facebook friends had downloaded, and what permissions those apps had
requested? How were they to know about Facebook’s confidential relationships with its business
partners? Through discovery, the plaintiffs were entitled to this evidence—that is the whole point
of civil discovery.
Facebook and Gibson Dunn also nitpick Judge Corley and Special Master Garrie’s
discovery orders, looking for any potential ambiguity to justify their conduct. As already
discussed, Facebook and Gibson Dunn’s interpretations of these orders were often laughable. But
their nitpicking is also part of a larger problem. Sometimes discovery violations are blatant: a
client shreds a crucial document or threatens the opposing party. Much of the discovery
misconduct here was more insidious. No court ruling can ever be completely clear, addressing
every conceivable aspect of discovery. Discovery—and the court system as a whole—depend on
the good faith of the parties. Counsel must reasonably interpret a court’s orders and seek
clarification when needed. Facebook and Gibson Dunn did the opposite: they pounced on slight
ambiguities (or fabricated ambiguities) and used them to obfuscate and obstruct discovery for
years.
Facebook and Gibson Dunn also emphasize how difficult this case has been to litigate,
given the technical complexities involved. It’s true that this was a complex case, and complexity
will often result in mistakes and miscommunication. But that’s not what this sanctions ruling is
about. It is about delay and unnecessary expense resulting from repeated frivolous arguments,
obfuscation, and reflexive opposition.
Finally, Facebook and Gibson Dunn do some obligatory sword-falling, apologizing for
their “role” in the combat and emphasizing that their behavior improved after this Court began
threatening sanctions in February 2022. That argument warrants two responses. First, although
their conduct did improve, it went from an F to perhaps a D. Facebook and Gibson Dunn became
more responsive and proactive in handling document discovery. But much of their deposition
49Page 50 misconduct occurred after February 2022, as did the massive privilege over-designation. Second,
even accepting that their conduct changed, sanctions would still be warranted for their earlier
behavior. In many cases, when attorneys and their clients improve after receiving a warning,
leniency is warranted. This is not one of those cases.
The Court reaches this conclusion after reflecting (at considerable length) on what might
have motivated Facebook and Gibson Dunn to conduct themselves as they did. There’s a small
chance, of course, that Facebook and Gibson Dunn were just overly zealous. And perhaps there’s
some minute chance that they were just incompetent. But when you consider the context, it’s far
more likely that the misconduct was of a different, more nefarious sort. Recall that Facebook was
being sued for conduct that was the subject of a major scandal, a scandal for which the company
issued numerous public apologies. Recall that the Federal Trade Commission brought an action
against Facebook in the wake of the scandal, and that Facebook paid $5 billion to settle the
matter. In this case, Facebook sought dismissal at an early stage, but that attempt was
unsuccessful. After publicly apologizing, paying a massive penalty to the FTC, and losing that
early motion, does anyone really think that Facebook was planning on taking this case to trial?
Or was Facebook, with the assistance of its lawyers, executing a different play from the
playbook: resist discovery as long as possible, make things increasingly difficult and expensive
and frustrating for the opposition, and hope that would drive down the case’s settlement value?
This is, by far, the most likely explanation for Facebook and Gibson Dunn’s conduct.
This is not to suggest that there necessarily was some back-room meeting at which
Facebook and its lawyers said, “Ok, here’s the plan, let’s be as unreasonable and obstructionist
as possible in the hope that we’ll frustrate the plaintiffs into settling for less than they could get if
we were cooperative in discovery.” Unfortunately, this approach to litigation is common enough
that no such meeting was necessary. Facebook and its lawyers fell into their roles with ease, and
then they took things way too far. For the systematic, conscious, bad-faith approach they took to
this litigation, Facebook and Gibson Dunn must be sanctioned.
50Page 51 V
The plaintiffs have complained of several categories of misconduct, but as explained, the
Court will only sanction Facebook and Gibson Dunn for the most serious: the misconduct related
to the App Developer Investigation and the named plaintiff data. The plaintiffs seek
$2,037.540.28 in sanctions related only to those two categories.13 If the Court were to sanction
Facebook and Gibson Dunn for everything else the plaintiffs point to, the amount would
certainly be much higher.
The plaintiffs request $1,773,042.50 in fees, including the fees incurred in moving for
sanctions.14 The plaintiffs also seek $264,497.78 in costs for the fees paid to mediator Judge
Andler and Special Master Garrie.
As explained in Section II, a court may only award fees and costs “incurred because of
the misconduct at issue.” Goodyear, 581 U.S. at 108; see also Blixseth, 854 F.3d at 631
(explaining that fees incurred in moving for sanctions necessarily meet that standard). But lower
courts need not “become green-eyeshade accountants” when assessing sanctions. Goodyear, 581
U.S. at 110 (quoting Fox, 563 U.S. at 838). “The essential goal in shifting fees is to do rough
justice, not to achieve auditing perfection.” Id. (quoting Fox, 563 U.S. at 838) (quotations
omitted).
The only way to award sanctions here is with a rough-but-conservative estimate. First,
the Court will deduct $187,383.27 in fees and costs associated with the App Developer
Investigation that were incurred before Judge Corley rejected Facebook’s blanket assertion of
privilege on September 9, 2021.15 Although the plaintiffs argue that Facebook and Gibson Dunn
engaged in misconduct before September 9, 2021, this ruling focuses primarily on their behavior
The plaintiffs’ motion for leave to file a reply in support of the amount of sanctions is granted.
See Dkt. No. 1090.
14
In all, the plaintiffs spent even more moving for sanctions—a whopping $1,156,127.50—but
they estimate that $693,676.50 was related to ADI and the named plaintiff data specifically.
15
In their request for costs related to discovery mediation, the plaintiffs did not distinguish
between costs related to the named plaintiff data and costs related to ADI. In an abundance of
caution, the Court will assume all of the costs for discovery mediation incurred prior to
September 9, 2021 were associated with ADI.
13
51Page 52 afterwards, and so it would not be appropriate to impose sanctions for the ADI-related fees and
costs incurred prior to Judge Corley’s decision.
Beyond that, given the pervasive nature of Facebook and Gibson Dunn’s misconduct, it is
nearly impossible to disentangle the work that was caused by the misconduct from the work that
would have been done anyway. In an abundance of caution (and after considering Facebook’s
arguments regarding the reasonableness of the fees and costs), the Court will cut the plaintiffs’
remaining request in half. The plaintiffs are therefore awarded $800,217.38 in fees and
$124,861.13 in costs for a total of $925,078.51. This amount likely represents just a portion of
the fees and costs reasonably incurred because of Facebook and Gibson Dunn’s misconduct
related to discovery on ADI and the named plaintiff data. While the amount is almost certainly
under-compensatory, there is no chance that it’s over-compensatory. Given the limits on the
authority of courts to impose sanctions, it is better to err on the side of caution.
One more point: Facebook and Gibson Dunn argue that the plaintiffs’ supplemental brief
on the amount of fees and costs raises “serious due process concerns.” They argue that they have
not had “a full and fair opportunity to address the…question [of] whether Plaintiffs are even
entitled to their newly requested fees and costs—for example, whether those fees are attributable
to misconduct.” But the vast majority of Facebook and Gibson Dunn’s supplemental brief
addressed that very question. Indeed, Sections I and II are entitled: “Plaintiffs Have Failed to
Demonstrate That Any ADI Fees or Costs Resulted from the Alleged Misconduct,” and
“Plaintiffs Have Failed to Demonstrate That Any Fees or Costs Associated with NP Data
Resulted from Alleged Misconduct.”
Facebook and Gibson Dunn also argue that the plaintiffs’ supplemental briefs include
fees and costs not addressed in their original motion. But Facebook and Gibson Dunn’s due
process rights are not violated merely because the Court allowed the parties to submit
supplemental briefing. See, e.g., True Health Chiropractic Inc v. McKesson Corp., No.
13CV02219HSGDMR, 2015 WL 3453459, at *1–2 (N.D. Cal. May 29, 2015) (granting motion
for sanctions and then allowing plaintiffs to file a motion substantiating the fees). Facebook and
52Page 53 Gibson Dunn are entitled to notice and an opportunity to be heard on both the misconduct and
the appropriate amount of sanctions. F.J. Hanshaw Enterprises, Inc., 244 F.3d at 1143. That
standard is easily met here. In all, Facebook and Gibson Dunn have provided the Court with
almost 150 pages of briefing in opposition to these sanctions. That doesn’t include the hundreds
of pages of exhibits submitted in support of their briefs. In response to the plaintiffs’
supplemental submission on the amount of sanctions specifically, Facebook and Gibson Dunn
provided a 27-page brief and a 488-page expert analysis of the requested fees.
VI
Facebook and Gibson Dunn are ordered to pay the plaintiffs $925,078.51 in sanctions.
They are jointly and severally liable for this amount, and they must compensate the plaintiffs
within 21 days of this ruling. To be sure, this amount is loose change for a company like
Facebook, and even for a law firm like Gibson Dunn. But it’s important for courts to help protect
litigants from suffering financial harm as a result of their opponents’ litigation misconduct. And
hopefully, this ruling will create some incentive for Facebook and Gibson Dunn (and perhaps
even others) to behave more honorably moving forward.
IT IS SO ORDERED.
Dated: February 9, 2023
______________________________________
VINCE CHHABRIA
United States District Judge
53
PDF Page 1
PlainSite Cover Page
PDF Page 2
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 1 of 53
UNITED STATES DISTRICT COURT
NORTHERN DISTRICT OF CALIFORNIA
IN RE: FACEBOOK, INC. CONSUMER
PRIVACY USER PROFILE
LITIGATION,
Case No. 18-md-02843-VC
This document relates to:
ORDER GRANTING IN PART
PLAINTIFFS’ MOTION FOR
SANCTIONS
ALL ACTIONS
Re: Dkt. Nos. 879, 1007-3
This case is an example of a wealthy client (Facebook) and its high-powered law firm
(Gibson Dunn) using delay, misdirection, and frivolous arguments to make litigation unfairly
difficult and expensive for their opponents. Unfortunately, this sort of conduct is not uncommon
in our court system. But it was unusually egregious and persistent here. To give just a few
examples:
•
The central allegation in this case is that Facebook shared the plaintiffs’ private
information with other companies. But Facebook insisted that: (1) it need not disclose to
the plaintiffs what information it had collected about them unless it had shared that
information with third parties; and (2) the plaintiffs were required to take at face value
Facebook’s assertions about what information it had shared. Merely reciting this
argument shows how ridiculous it is, but Facebook and Gibson Dunn repeated it over,
and over, and over again—despite the presiding magistrate judge telling them many times
that it made no sense.
•
In the wake of the Cambridge Analytica scandal, Facebook investigated other apps that
might have misused private user information. After the magistrate judge ruled that the
investigation was not privileged as a blanket matter, Facebook and Gibson Dunn insisted
that non-lawyer communications created in the course of that investigation (such as
internal emails between Facebook employees) need not be produced. It was obvious at
the time that these documents were likely to be probative, and that view has only been
confirmed now that Facebook has finally been forced to produce them. Perhaps realizing
PDF Page 3
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 2 of 53
they had no real argument for withholding these documents, Facebook and Gibson Dunn
contorted various statements made by opposing counsel and the magistrate judge beyond
recognition, using them to argue that everyone had already agreed that Facebook need not
produce the communications—even as the plaintiffs continued to demand them. And
again, after being told repeatedly that these arguments made no sense, Facebook and
Gibson Dunn insisted on pressing them.
•
Facebook’s witnesses and lawyers deliberately prevented the plaintiffs from obtaining
probative information during depositions. For example, during a deposition of one
Facebook employee whom Facebook designated to testify about the company’s
information-sharing practices, a Gibson Dunn lawyer instructed the witness not to answer
at least 22 times, asserting that the questions were beyond the scope of the deposition
notice. Many of these questions were obviously within the scope of the notice. But more
to the point, as Facebook and Gibson Dunn now concede, it is improper to instruct a
corporate witness not to answer a question based on scope. The witness herself emulated
her lawyer’s belligerence, refusing to answer questions without even waiting for an
objection. Eventually, the deposition became so hostile that the witness stated she would
do her own “bitching and moaning” about the plaintiffs’ questions.
•
All the while, Facebook and Gibson Dunn had the audacity to accuse the plaintiffs’
lawyers of delaying the case, and to assert that the plaintiffs’ reasonable efforts to obtain
obviously relevant discovery were frivolous. It’s almost as if Facebook and Gibson Dunn
spent the better part of three years trying to gaslight their opponents, not to mention the
Court.
Sometimes lawyers and their clients engage in conduct of this sort because they are
incompetent. Facebook and Gibson Dunn are not incompetent. Sometimes lawyers reflexively
oppose the other side’s requests without giving any thought to their actions. That does not seem
like Facebook and Gibson Dunn. Instead, the Court finds by clear and convincing evidence that
Facebook and Gibson Dunn’s conduct reflected a sustained, concerted, bad-faith effort to throw
obstacle after obstacle in front of the plaintiffs—all in an attempt to push the plaintiffs into
settling the case for less than they would have gotten otherwise. The plaintiffs are entitled to
recover $925,078.51 for the fees and costs they incurred responding to this misconduct.
Facebook and Gibson Dunn are jointly liable for this amount.
I
During the 2016 presidential election, Cambridge Analytica, a British consulting firm,
sent targeted political ads to voters using personal information gleaned from millions of
2
PDF Page 4
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 3 of 53
Facebook accounts. Cambridge Analytica had purchased the information from Aleksandr Kogan,
a data scientist at the University of Cambridge. Kogan was able to collect this information
through an app he launched on Facebook’s platform. The app interacted with Facebook users and
gave Kogan access to their personal information, as well as the personal information of their
Facebook friends. Through this process, Kogan was able to compile a dataset that included
information on 87 million Facebook users—even though only around 300,000 users had
downloaded the app.
Following the scandal, reports emerged suggesting that the ability of people like Kogan
and entities like Cambridge Analytica to obtain sensitive information was the norm rather than
the exception. In response, the Federal Trade Commission launched an investigation into
whether Facebook’s practices violated a 2012 consent decree that required Facebook to maintain
a reasonable privacy program and prohibited the company from making misrepresentations about
the privacy and security of users’ information. Facebook ultimately settled the matter, agreeing
to pay a $5 billion fine and to modify its corporate structure to better protect users’ privacy.1
Facebook and its executives also issued a number of public apologies. CEO Mark
Zuckerberg acknowledged that the scandal was a “major breach of trust,” and he was “really
sorry” that it happened.2 Zuckerberg and Facebook took out full-page ads in ten newspapers
repeating that apology.3 Facebook’s then-COO Sheryl Sandberg echoed that message, saying
that Facebook should have “taken…steps years ago” to prevent abuse on the platform and
acknowledging that Facebook “made some really bad mistakes.”4
Dozens of private lawsuits were also filed by Facebook users against the company, and
1
FTC Imposes $5 Billion Penalty and Sweeping New Privacy Restrictions on Facebook, Federal
Trade Commission (July 24, 2019), https://perma.cc/2WPY-JZNY.
2
Eli Meixler, ‘We Have a Basic Responsibility to Protect Peoples’ Data.’ Mark Zuckerberg
Addresses Data Crisis, Time (March 21, 2018), https://perma.cc/35FL-SHJD.
3
Nick Statt, Mark Zuckerberg Apologizes for Facebook’s Data Privacy Scandal in Full-Page
Newspaper Ads, The Verge (March 25, 2018), https://perma.cc/9NUG-SGUQ.
4
Steve Inskeep, Full Transcript: Facebook COO Sheryl Sandberg on Protecting User Data,
NPR (April 5, 2018), https://perma.cc/3SWC-LXUP.
3
PDF Page 5
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 4 of 53
the cases were assigned to this Court for pretrial proceedings.5 The Court then appointed two
attorneys to serve as lead plaintiffs’ counsel, and those attorneys filed a consolidated class action
complaint, asserting a variety of claims under federal and state law. The complaint was filed on
behalf of roughly three dozen individual Facebook users. These “named plaintiffs” proposed to
represent a class of all Facebook users whose personal information was improperly disseminated
or inadequately protected by Facebook from 2007 to the present.
The lawsuit alleged that Facebook allowed app developers operating on the company’s
platform to ask users for permission to access their friends’ personal information, and that this
practice allowed the apps to collect vast amounts of the friends’ information without their
consent. Around 2014, Facebook decided to limit app developers’ ability to access users’
friends’ information, but the plaintiffs alleged that Facebook gave certain preferred apps—
sometimes described as “whitelisted apps”—continued access based on concerns about
Facebook’s bottom-line.
The plaintiffs also focused on another information-sharing program: Facebook’s
relationship to its “business partners.” These business partners included companies hired to build
Facebook’s platform on different devices and for different operating systems (like a Facebookbranded app for a Blackberry phone). According to the plaintiffs, Facebook shared information
about users and their friends with these (and other) business partners in exchange for personal
information collected by those business partners. As with the app developers, the plaintiffs
alleged that Facebook did not adequately disclose to its users this practice of trading their
personal information.
Finally, the plaintiffs alleged that Facebook failed to control and monitor app developers’
and business partners’ use of all this information. Although Facebook had a policy prohibiting
app developers from using the information for any purpose other than improving their app, the
5
When multiple, similar lawsuits are filed in federal courts across the country, the cases may be
referred to the Judicial Panel on Multidistrict Litigation. The panel then decides whether to
transfer the suits to a single federal judge for pretrial proceedings. Here, the panel determined
that such a transfer was warranted, and it assigned all the lawsuits to this Court.
4
PDF Page 6
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 5 of 53
plaintiffs alleged that Facebook did nothing to enforce this policy. If Facebook had actually
enforced this policy, the plaintiffs contended, Kogan would not have been able to sell his dataset
to Cambridge Analytica, and countless other apps would not have been able to misuse the
personal information they collected.
In 2019, Facebook moved to dismiss the complaint. Although this Court dismissed a few
claims, it rejected the majority of Facebook’s arguments and allowed the case to proceed. See
generally In re Facebook, Inc., Consumer Privacy User Profile Litigation, 402 F. Supp. 3d 767
(N.D. Cal. 2019).
The parties then began discovery, the process by which civil litigants can ask their
adversaries (and sometimes third parties) to give them potentially relevant and non-privileged
information. The basic philosophy underlying discovery is that claims should be litigated based
on a complete record of the underlying facts. See Hickman v. Taylor, 329 U.S. 495, 507 (1947).
By allowing litigants to access evidence prior to trial, discovery narrows the issues, eliminates
the possibility of unfair surprise, and—most importantly—ensures that trials “achieve substantial
justice.” Greyhound Lines, Inc. v. Miller, 402 F.2d 134, 143 (8th Cir. 1968).
In November 2019, the plaintiffs sent Facebook various requests for discovery. See Dkt.
No. 1087-10. For example, the plaintiffs (that is, the named plaintiffs) sought all the information
Facebook had collected about them. The plaintiffs also sought information from Facebook’s
investigation into apps that had potentially misused users’ information, which Facebook called
the “App Developer Investigation” or “ADI.” Facebook produced some information in response
to these requests. But in the following years, the parties fought over what else Facebook should
be required to produce.
By March 2020, this Court determined that it was not in the best position to adjudicate
the parties’ growing number of discovery disputes, and it referred the parties to then-Magistrate
Judge Jacqueline Scott Corley for discovery. Before doing so, the Court expressed concern about
5
PDF Page 7
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 6 of 53
Facebook’s “unduly narrow view” of discovery. Dkt. No. 1087-44 at 29–30.6 “This is a big
case,” the Court explained, so Facebook should be careful before making any arguments that
discovery was “just too expensive or difficult.” Dkt. No. 1087-44 at 30. Gibson Dunn attorney
Orin Snyder sought to assuage the Court’s concerns: “If I was there, I would look you in the
eyes. I’m telling you, Judge, we are not only acting in good-faith; we are eager to produce
documents, whatever the expense, that are relevant to the issues in this case.” Dkt. No. 1087-44
at 30. He continued: “I am confident, Your Honor, that when you see our performance on the
issues in this case in terms of our production of documents, you will have no basis for concern
because we want to get on with it…[W]e think those documents actually are the key to us
winning.” Dkt. No. 1087-44 at 31–32.
In the following months, however, discovery remained contentious. Facebook repeatedly
insisted that it did not need to produce all the information it had collected about the named
plaintiffs. In the fall of 2020, Judge Corley rejected Facebook’s view of discovery, holding that
“discoverable” data included a wider set of information than Facebook had argued. But, as
discussed more fully below, the fighting on this issue continued.
The parties also had an ongoing disagreement over whether Facebook should be required
to produce materials related to its App Developer Investigation. Facebook argued that the
documents were produced in anticipation of litigation and involved legal advice, and so they
were protected by privilege. In the fall of 2021, Judge Corley held that the investigation was not
privileged. But again, the fighting continued.
Eventually, Judge Corley suggested that the parties engage a discovery mediator to help
resolve their ongoing disputes. See Dkt. No. 632. The parties selected retired Judge Gail Andler,
and she then brought in her colleague Daniel Garrie, in part to address the technical aspects of
discovery. Dkt. Nos. 646; 914 at 5. In July 2021, at the parties’ request, the Court appointed
6
When a document is e-filed, the Electronic Case Filing system adds page numbers to a header
at the top of the document. All cites included in this opinion reference the pages as numbered in
that header, rather than any page numbers native to the document.
6
PDF Page 8
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 7 of 53
Garrie as a Special Master with the power to issue discovery orders appealable only to Judge
Corley. Dkt. No. 709 at 1.
By February 2022—two and a half years into discovery—countless hours had been spent
adjudicating discovery disputes, and the litigation appeared to be going nowhere. Based on a
preliminary review of the record, it appeared to this Court that Facebook and Gibson Dunn were
to blame. At a status conference that month, the Court had strong words for Facebook and
Gibson Dunn. The plaintiffs had previously complained about Facebook and Gibson Dunn’s
misconduct and asked for the deadlines for discovery to be continued. But the Court expressed
concern that the litigation would go nowhere if it kept granting these continuances. The Court
suggested instead that the plaintiffs move for sanctions. Dkt. No. 847. This motion followed.
Then, in August 2022, the parties notified the Court that they had settled the lawsuit. The
Court stayed the litigation in light of the settlement, but the sanctions motion remained pending.
In their briefs, the plaintiffs complain of a wide range of misconduct by Facebook and
Gibson Dunn. It is sufficient for purposes of this ruling to focus on the four areas where the
record is clearest: (1) the plaintiffs’ attempts to obtain materials related to Facebook’s App
Developer Investigation; (2) their attempts to identify the information Facebook had collected
about them; (3) Facebook and Gibson Dunn’s conduct during depositions; and (4) Facebook and
Gibson Dunn’s over-designation of documents as privileged.
A.
App Developer Investigation
To understand the dispute about the App Developer Investigation, it’s helpful to have
some background about the evolution of Facebook’s relationship with third-party app
developers. From 2010 to 2014, app developers used something called the “Graph Application
Programming Interface,” also known as API, to receive data from Facebook users and to write to
Facebook on those users’ behalf. Dkt. No. 326 at 4. Through this API, an app could access
“friend permissions,” meaning the apps could access personal information about the app users’
Facebook friends (like a friend’s Facebook status or location or religion). Dkt. Nos. 1085-36 at
28; 1103-16 at 5–6.
7
PDF Page 9
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 8 of 53
In 2014, in response to public criticism of its information-sharing practices, Facebook
adopted a new API (version 2) to replace the earlier version. See Dkt. No. 326 at 5. To use
Facebook’s language, it “deprecated use of Graph API v1” and adopted “Graph API v2.” Dkt.
No. 326 at 5. According to Facebook, this new API did not allow apps to access friend
permissions.7 Dkt. No. 326. But as discussed more fully below, Facebook now concedes that
some apps were able to use the old API even after 2014, and so those apps continued to have
access to friend permissions. Dkt. No. 326 at 5. These were known as “whitelisted” apps.
In 2018, four years after the transition to the new API, the Cambridge Analytica scandal
broke. Facebook responded by launching an investigation into apps that had access to large
amounts of user data before the 2014 interface change. Dkt. No. 736 at 1. Gibson Dunn led the
investigation with help from two forensic consulting firms. Overall, Facebook said, the
investigation “involved hundreds of people: attorneys, external investigators, data scientists,
engineers, policy specialists, platform partners and other teams across the company.” Dkt. No.
736 at 5. When it began, Facebook said the investigation would help it “better understand
patterns of abuse in order to root out bad actors among developers” and restore trust in the
company. Dkt. No 736 at 5.
The investigation was divided into three phases: (1) detection and identification, (2)
enhanced examination, and (3) enforcement. Dkt. No. 736 at 2. During phase one, Facebook (and
its consultants and attorneys hired to help) identified apps that posed a high-risk of data misuse
and flagged those apps for further inquiry. Dkt. No. 699-5 at 6–8. In phase two, the ADI
forensics team prepared reports analyzing the potential for data misuse, given factors like the
sensitivity of the information that the apps could access. Dkt. No. 699-5 at 8. During the final
phase, Facebook decided whether to take any enforcement actions against the identified apps,
including possible suspension. Dkt. No. 699-5 at 8–9. To determine whether such action was
To be precise, the new API did not entirely limit access to friends’ information more broadly.
For instance, Graph API v2 still allowed apps to request access to things like “user_posts,”
which would include access to friends’ likes and comments on those posts. Dkt. No. 1085-36 at
112.
7
8
PDF Page 10
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 9 of 53
necessary, there could be additional investigations, including interviews and audits of the apps’
data security and storage infrastructure. Dkt. No. 699-5 at 9.
A few examples of the investigation documents are illustrative. Take one memo about an
app called Sync.Me. See Dkt. No. 1103-16. The memo states that the app was “overpermissioned and had access to many ‘heavyweight’ permissions,” including the user’s entire
newsfeed, friends’ likes, friends’ statuses, and friends’ hometowns. Dkt. No. 1103-16 at 3, 5–6.
The memo also notes that around 9 million users may have granted the app permission to access
“friends_location.” Dkt. No. 1103-16 at 5–6. These permissions “appear to be out of scope for
the use case of the App.” Dkt. No. 1103-16 at 6. Furthermore, the memo notes, even after
Facebook transitioned to the new developer interface (limiting access to friend permissions), the
app used a method “that Facebook described as a potential workaround for accessing friend’s
information despite the reduced set of permissions.” Dkt. No. 1103-16 at 3.
Or take another memo about the app developer Microstrategy, Inc. It states that
Microstrategy’s apps “collected vast quantities of highly sensitive user and friends permissions,”
including “highly valuable [data] with many parallels drawn between the data collected…and
that of Cambridge Analytica.” Dkt. No. 1103-7 at 8. The memo includes estimates from news
articles suggesting that, although only around 50,000 users had installed one of Microstrategy’s
apps, the app could access data from 16 to 20 million people. Dkt. No. 1103-7 at 7. One of
Microstrategy’s apps made “roughly 74 million API calls [requests for information from the
interface] per month—a volume few apps achieve, even over years of operation.” Dkt. No. 11037 at 8. Another Microstrategy app was installed by only around 400 users, but it made “millions
of API calls throughout its lifecycle,” likely “as a means of collecting additional data points” not
handled through Microstrategy’s primary app. Dkt. No. 1103-7 at 8.
And one more memo about a Yahoo app. See Dkt. No. 1103-8 The memo explains that
close to 150 million users installed the app, and that it made “billions of requests” for user
information. Dkt. No. 1103-8 at 3. The app had access to personal information about those users’
friends, including the friends’ education histories, work histories, religions, politics, “about me”
9
PDF Page 11
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 10 of 53
sections, relationship details, and check-in posts. Dkt. No. 1103-8 at 8. The app could also access
a user’s inbox, thus accessing private messages between that user and their friends. Dkt. No.
1103-8 at 3. Because many of the API requests gave “no visibility into the endpoints accessed,”
it was possible that the app “accessed more sensitive user or friends’ data than can be detected.”
Dkt. No. 1103-8 at 3. The memo explains that the app was “whitelisted by Facebook and
therefore was granted extended access” to the earlier developer interface “for an indeterminate
period of time.” Dkt. No. 1103-8 at 3. Given this “whitelisted status,” the app was able to
continue retrieving content from users’ newsfeeds, making “bulk” requests for information, and
“leveraging” earlier permissions to access information, even after Facebook transitioned to API
v2 in 2014. Dkt. No. 1103-8 at 3. The record is replete with other examples of these memos
containing information that is highly probative of the plaintiffs’ claims. See, e.g., Dkt. Nos.
1103-15; 1103-16; 1103-17; 1103-18.
In November 2019, the plaintiffs asked for documents related to the investigation. Dkt.
No. 1087-10 at 15. The parties fought over that request for years. Many of the parties’ disputes
centered around two categories of documents. First, Facebook and Gibson Dunn refused to
produce investigation materials, including memos, reports, audits, and developer interviews
prepared during the last two phases of the investigation—the phases in which Facebook
investigated the apps and decided whether to bring any enforcement actions against them. See
Dkt. No. 736 at 2. The memos discussed above would fall into that category. And second,
Facebook and Gibson Dunn refused to produce certain communications regarding those
materials, including internal communications among Facebook’s employees and
communications between those employees and Facebook’s forensic consultants. See Dkt. Nos.
699 at 5; 788-3 at 425–26.
Facebook and Gibson Dunn began by taking the position that the entire investigation was
covered by attorney-client and work-product privilege. Attorney-client privilege protects certain
communications between a client and their attorney. Upjohn Co. v. United States, 449 U.S. 383,
389 (1981). But a party cannot simply “cc” their attorney to privilege a document—they must be
10
PDF Page 12
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 11 of 53
communicating with their attorney in order to receive legal advice. In re Avantel, S.A., 343 F.3d
311, 321 n.11 (5th Cir. 2003); Meade v. General Motors, LLC, 250 F. Supp. 3d 1387, 1391–93
(N.D. Ga. 2017). Work-product privilege, in turn, is not just limited to communications: it covers
all documents “prepared by a party or [their] representative in anticipation of litigation.” United
States v. Richey, 632 F.3d 559, 567 (9th Cir. 2011) (quoting Admiral Insurance Co. v. United
States District Court, 881 F.2d 1486, 1494 (9th Cir. 1989)). Where a document is not “prepared
exclusively for litigation”—meaning it has a “dual purpose”—it is protected by work-product
privilege only if it “would not have been created in substantially similar form but for the prospect
of litigation.” Id. at 568 (quoting In re Grand Jury Subpoena, Mark Torf/Torf Environmental
Management, 357 F. 3d 900, 907 (2004)). That is to say, if the document would have been
prepared even in the absence of litigation, then it is not protected by work-product privilege.
After asserting that the documents were privileged, Facebook and Gibson Dunn asked to
delay briefing on the issue. In the spring of 2020, the plaintiffs asked to set a schedule for
briefing, but Facebook said “there [was] no urgent need…and [the issue] should be briefed (if at
all) at a later date.” Dkt. No. 449 at 4. In a later status report, Facebook refused to take a position
on exactly what documents it would produce. It stated that it did not “categorically object to
producing materials from [the] investigation,” so long as those documents were “not
privileged”—without clarifying which documents it believed were privileged. Dkt. No. 471 at 8.
In July 2020, early on in discovery, Judge Corley expressed doubts that the investigation
was privileged, but she noted there were “arguments both ways.” Dkt. No. 476 at 36. To analyze
the question in context, Judge Corley decided to review a sample of investigation documents
based on six “exemplar apps.” Dkt. No. 476 at 36–37; see generally Dkt. No. 533. Facebook then
gathered documents related to those apps and gave the plaintiffs a log that identified all the
documents it believed were privileged. Dkt. No. 914 at 10. Without the benefit of actually seeing
the documents, the plaintiffs chose twenty from the log and submitted them to Judge Corley to
review. Dkt. No. 914 at 10.
By April 2021, Judge Corley had reviewed the twenty documents and expressed her
11
PDF Page 13
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 12 of 53
“tentative view” that the investigation as a whole was not privileged. Dkt. No. 657 at 16. As she
put it, it was inconceivable that Facebook would not have launched the investigation even in the
absence of litigation, and so the investigation as a whole was not protected by work-product
privilege. Dkt. No. 657 at 16. She also alluded to Facebook and Gibson Dunn’s arguments about
attorney-client privilege: while Gibson Dunn’s specific legal advice might be protected, the facts
discovered in the investigation would not be. Dkt. No. 657 at 24.
That said, Judge Corley noted that the plaintiffs did not need “every single document.”
Dkt. No. 657 at 17. For instance, as she explained, the plaintiffs did not need to know exactly
when Facebook requested certain information from the app developers or when it received a
response. Dkt. No. 657 at 18. The plaintiffs agreed: they were seeking information about the
facts underlying the investigation. Dkt. No. 657 at 18. That included facts about Facebook’s
“thought process” because that “relate[d] to whether or not [Facebook was] actually and
accurately monitoring the disclosure of this information.” Dkt. No. 657 at 20. Judge Corley
repeated that the plaintiffs did not need, for instance, scheduling emails among Facebook
employees, but rather wanted “the facts…just…what’s in the report.” Dkt. No. 657 at 26.
Given the discussion, Judge Corley decided to defer ruling on the privilege question so
that the parties could meet and confer about narrowing the plaintiffs’ request for production (or,
if they could not agree, submitting affidavits in support of their positions). Dkt. No. 655 at 1.
After the hearing, the parties negotiated the scope of production, and the plaintiffs did
narrow their requests. See Dkt. No. 915-1. But that negotiation was hampered by Facebook and
Gibson Dunn’s continued assertion of attorney-client and work-product privilege. For instance,
as part of their narrowed request, the plaintiffs sought information about the phase of ADI that
each app fell under and the “reasons for elevation” (meaning the reasons Facebook chose to
investigate the apps further). Dkt. No. 1087-15 at 1. Facebook continued to take the position that
that information—and much of the other information the plaintiffs sought—was “categorically
privileged.” Dkt. No. 1087-15 at 1.
After the parties could not come to an agreement on a narrower production, Judge Corley
12
PDF Page 14
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 13 of 53
ordered them to submit a joint letter brief on the issue. Dkt. No. 693. Facebook argued that the
plaintiffs were entitled only to the names of the apps that might have misused user data and the
information the apps might have accessed. Dkt. No. 699 at 2. Facebook also pointed to the
plaintiffs’ earlier statement that they wanted only the “facts” underlying Facebook’s
investigation. Dkt. No. 699 at 2. Based on that statement, Facebook argued that the plaintiffs
could not ask for the memos discussed above or for Facebook’s own internal deliberations about
its investigation and enforcement decisions. And based on that same statement—as well as the
plaintiffs’ statement that they did not want administrative emails—Facebook insisted that the
plaintiffs had conceded that they did not need any “emails among Facebook employees” at all.
Dkt. No. 699 at 2.
The plaintiffs argued that the investigation materials—including, potentially, internal
communications—were directly relevant to their claims. To the plaintiffs, the information about
app misuse was not useful without “proper context, including the discussions and actions taken
in response to this gathered information.” Dkt. No. 699 at 6. They believed that the investigation
documents and communications would reveal Facebook’s internal knowledge and deliberations
about the threats that these apps posed to users’ privacy. Dkt. No. 699 at 6. And, the plaintiffs
argued, these materials would shed light on Facebook’s decision to investigate suspicious apps—
or not. Dkt. No. 699 at 6.
In September 2021, almost two years after the plaintiffs’ first request for ADI documents,
Judge Corley held that the investigation was not covered by a blanket assertion of privilege. She
found Facebook’s assertion of attorney-client privilege to be “unpersuasive given that Plaintiffs
[were] not seeking documents created by counsel, counsel’s edits, or any communications with
counsel.” Dkt. No. 736 at 6. “At best,” she explained, the ADI materials “would be attorney
work product.” Dkt. No. 736 at 6. And, she held, they were not because they would have been
created absent any litigation. Dkt. No. 736 at 5. She explained, “Facebook’s assertion that the
ADI served only a litigation purpose…[was] patently implausible in light of Facebook’s public
pronouncements.” Dkt. No. 736 at 5. Facebook’s “assertion could only be true if the Court found
13
PDF Page 15
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 14 of 53
that Facebook was lying to the public when it stated that the purpose of the ADI was to root out
bad apps and secure Facebook’s platform so that consumers could have faith in the company.”
Dkt. No. 736 at 6. And, she noted, Facebook had not offered any evidence that “addresse[d] the
repeated public proclamations as to the obvious business purpose of the ADI.” Dkt. No. 736 at 6.
Judge Corley thus ordered Facebook to produce “the background and technical reports,
audits and developer interviews” related to the six apps from the sampling exercise. Dkt. No. 736
at 7. She then ordered the parties to “work with the Special Master regarding production of
additional materials consistent with the guidance offered by this Order.” Dkt. No. 736 at 7.
After Judge Corley’s ruling, Facebook produced the materials specifically ordered by
Judge Corley—which turned out to be just eleven documents—but it did not elaborate on what
else it would produce. Dkt. Nos. 914 at 10–11; 1085-3 at 3. After the parties made no progress,
Special Master Garrie scheduled a hearing to discuss ADI production. Facebook continued to
avoid taking a position on what it would produce, and it then asked to delay the hearing for a
month because of scheduling conflicts. Special Master Garrie gave Facebook “one final
extension.” Dkt. No. 1087-18 at 1. He then “strongly encourage[d] Facebook to provide
Plaintiffs with a written description of the materials they believe are required by the ADI Order
by the end of tomorrow,” and to “either produce the memoranda [prepared by Facebook’s
forensic consultants] or inform Plaintiffs in writing the reason for not providing these materials
by Friday afternoon at the latest.” Dkt. No. 1087-18 at 1. Facebook failed to do either; it said it
had already made its position clear. See Dkt. No. 1085-6 at 2.
At the (delayed) hearing before Special Master Garrie, Facebook acknowledged that the
specific categories identified in Judge Corley’s order—background technical reports, audits, and
interviews—were producible in theory, although it stated that they might still be protected by
attorney-client or work-product privilege. Dkt. No. 1085-5 at 7–8. But Facebook and Gibson
Dunn then took the position that all of Facebook’s internal, non-attorney communications about
the investigation—communications among employees and between employees and Facebook’s
outside consultants—were not discoverable because Judge Corley had determined that the
14
PDF Page 16
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 15 of 53
communications were not relevant. Dkt. No. 1085-5 at 4; see also Dkt. No. 778 at 2. To
Facebook, the demand for communications was “already litigated” and “rejected” by Judge
Corley. Dkt. No. 1085-5 at 4.
According to Facebook, Judge Corley had reviewed these types of ADI communications
in the sampling exercise, and because she had not explicitly ordered their production, her order
implicitly “considered and disposed of the request for…communications” as a whole. Dkt. No.
1085-5 at 9–10. Gibson Dunn attorney Orin Snyder said this interpretation of the order was
supported by “a lot of case law,” “from the Supreme Court cases on down.” Dkt. No. 1085-5 at
9–10, 11.
Special Master Garrie rejected this view, and he articulated a process by which Facebook
would be required to produce the communications. First, he ordered Facebook to produce the
background and technical reports, audits, interviews, and consultant memoranda on a rolling
basis. Dkt. No. 788-3 at 4–6. Once Facebook produced these documents, the plaintiffs could then
request a statistically significant sample of Facebook’s related internal communications and its
communications with its outside consultants.8 Dkt. No. 788-3 at 6; 765-2 at 5. Facebook moved
for reconsideration, and Special Master Garrie narrowed the order: rather than requiring
Facebook to produce ADI communications upon the plaintiffs’ request, he ordered Facebook “to
provide to Special Master Garrie for in camera review, all ADI related communications
pertaining to the six exemplar applications.” Dkt. No. 788-5 at 6. He would review these
communications to determine whether it was worthwhile for Facebook to produce them.
Facebook then appealed that decision to Judge Corley. At the hearing, Facebook repeated
its argument that she had already ruled that its internal communications and its communications
with its outside consultants were not discoverable. Dkt. No. 809 at 9–10. A Gibson Dunn
attorney argued that that interpretation of the order was based on “a general presumption that
Special Master Garrie also allowed the plaintiffs to request Facebook’s communications with
the third-party app developers, but Facebook did not take issue with that aspect of his order. See
Dkt. No. 778 at 2.
8
15
PDF Page 17
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 16 of 53
when a party makes a request for specific materials and the Court resolves the request without
ordering those materials produced, the request is denied.” Dkt. No. 809 at 11. Judge Corley
responded: “I just want to say you should not litigate based on that presumption. That is not how
it works. I wouldn’t do that. That’s a mistake.” Dkt. No. 809 at 11. The order was intended as a
starting point, and it explicitly required the parties to work with the Special Master on future
productions.9
In her order following the hearing, Judge Corley again rejected Facebook’s argument.
She explained that she had not “rule[d] that communications are not discoverable and never need
be produced.” Dkt. No. 806 at 2. Rather, her prior order held that ADI documents (including
communications) were “not protected by the work-product or attorney-client privilege in the
absence of specific showings of actual work-product, such as attorney edits, or the giving or
seeking of legal advice.” Dkt. No. 806 at 2. While she had noted at the hearing after the sampling
exercise that some of the documents from the exercise were not relevant, Judge Corley made
those statements after reviewing twenty documents blindly picked off Facebook’s privilege
log—documents like the scheduling emails discussed at the hearing. But her statements at the
hearing were not part of her order: they were made “in the context of attempting to narrow the
issues to determine if the parties could agree on what ADI materials to produce.” Dkt. No. 806 at
2. When the parties could not agree (in part because of Facebook’s continued assertion of a
blanket privilege), Judge Corley adjudicated the privilege question—not the discoverability of
communications as a whole. Dkt. No. 806 at 2.
Judge Corley additionally found Facebook’s specific objections to Special Master
Garrie’s order to be “puzzling.” Dkt. No. 806 at 2. She explained that Special Master Garrie had
taken a “common-sense approach”: he would review the communications to determine whether
they were relevant and ought to be produced. Dkt. No. 806 at 3. But instead of just complying,
Facebook appealed.
Judge Corley did observe that Facebook’s motion for reconsideration was not in bad faith to the
extent that Special Master Garrie responded by narrowing the order. Dkt. No. 809 at 54.
9
16
PDF Page 18
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 17 of 53
While Judge Corley was considering Facebook’s appeal, Special Master Garrie finished
his review of the sample ADI communications. “After reviewing a substantial portion of the
6,000+ documents pertaining to the exemplar apps,” Special Master Garrie determined that “a
substantial number of the documents [were] relevant to the case and not protected by privilege.”
Dkt. No. 916-9 at 6. For instance, one 2019 email chain discussed apps that Facebook planned to
suspend after the app developers failed to respond to Facebook’s requests for information. One
Facebook employee wrote that she wanted to give “heads up to our business leads” before
suspending the apps. Dkt. No. 1100-3 at 4. In response, another employee (presumably one of
Facebook’s “business leads”) asked for a “revenue impact analysis” related to the apps. Dkt. No.
1100-3 at 3. That request would appear to support the plaintiffs’ contention that Facebook made
enforcement decisions based on business concerns. Given the relevance of the communications
(and Facebook’s failure to demonstrate that they were privileged), Special Master Garrie ordered
Facebook to produce “all documents relating to the ADI,” with certain exceptions for attorney
communications. Dkt. No. 916-9 at 7.
Facebook moved for reconsideration. In its motion, Facebook noted that it was unclear if
the order required it to collect additional documents and use additional search strings to look for
responsive materials. Dkt. No. 917-5 at 16–17. Facebook had already collected documents from
the parties’ agreed-upon custodians (employees identified as having materials relevant to the
case). Facebook suggested that set of documents was adequate, and it should only be required to
look through that set for ADI materials. Dkt. No. 917-5 at 17. In response, Special Master Garrie
narrowed the order to require production of “all documents relating to the ADI from all
custodians that the parties have identified and collected,” with certain exceptions for attorney
communications. Dkt. No. 917-8 at 7. The plaintiffs understood this to mean that Facebook
would still search for all the ADI materials, but that Facebook would not need to identify any
new custodians. And, for a brief period of time, it seemed like the matter was settled.
Shortly thereafter, at the February 10, 2022 case management conference, this Court
expressed concerns about stonewalling by Facebook and Gibson Dunn. At that conference, the
17
PDF Page 19
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 18 of 53
Court invited the plaintiffs to move for sanctions rather than ask for the discovery deadlines to be
continued yet again. The Court also ordered Facebook to complete its ADI production within 21
days. Dkt. No. 847.
Following that conference, Gibson Dunn assigned Rosemarie Ring to lead the litigation,
replacing Orin Snyder. And Facebook and Gibson Dunn’s conduct slowly began to improve (at
least in some areas). Later in February, Ring proactively emailed the plaintiffs to discuss
Facebook’s previous understanding of the “limits” of Special Master Garrie’s order: “The goal
here is to make sure we have a meeting of the minds on this and avoid any further ADI-related
disputes.” Dkt. No. 1103-33 at 2, 5. Gibson Dunn explained that for ADI custodians, Facebook
had only collected documents through a period that ended in 2019—although the investigation
continued into 2020. Dkt. No. 1088 at 3–4. Facebook and Gibson Dunn had not told Special
Master Garrie about this limitation when they argued Facebook’s collection was adequate.
Indeed, as Ring later stated, it was unclear if “anyone was aware” of the limitation until she
brought it to the plaintiffs’ attention. Dkt. No. 947 at 9. Gibson Dunn also explained that the
search terms used to identify responsive documents were limited: Facebook did not use terms
like “ADI” or “App Developer Investigation,” but instead searched by app ID and app name.
Dkt. No. 1088 at 3. And even then, the search was not comprehensive: it did not include 1,700
apps that Facebook (rather than Gibson Dunn) had investigated. Dkt. No. 1088 at 4. The
plaintiffs also learned that Facebook transitioned the App Developer Investigation to an “inhouse” operation at a certain point, meaning Gibson Dunn was not even involved in aspects of
the purportedly privileged investigation. Dkt. No. 1088 at 4.
After the plaintiffs brought these issues to the Court’s attention, the Court ordered
Facebook to produce all ADI documents through the present (not just through 2019). Dkt. No.
895. After additional back and forth, Facebook agreed to additional search terms and further
collections to avoid any more discovery disputes. Dkt. No. 1052-2 at 19. In July 2022—nearly
three years after the plaintiffs’ first request—Facebook was still producing ADI documents. Dkt.
No. 1085-33 at 5.
18
PDF Page 20
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 19 of 53
B.
Named Plaintiff Data
Another area of alleged discovery misconduct involved the information that Facebook
had collected about the named plaintiffs. This “named plaintiff data” was a key component of the
case: Facebook sought to poke holes in the plaintiffs’ claims by arguing that they had “not
identified what information they believe[d] Facebook shared without consent,” nor how “they
believe[d] they were harmed.” Dkt. No. 840 at 5. If the plaintiffs could not identify this
information, Facebook argued, they lacked standing. See, e.g., Dkt. No. 261-1 at 20. To properly
address these arguments, the plaintiffs needed to identify the universe of private information
from which app developers and business partners might have drawn. The parties litigated the
production of that information for years.
Early on in discovery, Facebook agreed to produce information from its “Download Your
Information” tool. The DYI tool—accessible to all Facebook users—aggregates much of the
information that Facebook collects on its users. But throughout discovery, Facebook and Gibson
Dunn suggested that the DYI tool did not include all the personal information Facebook had
collected. See, e.g., Dkt. Nos. 541 at 8; 1103-14 at 7–8; 793 at 6–7; 918-1 at 3. The parties’
discovery disputes centered around whether Facebook would need to produce anything else.
Facebook and Gibson Dunn made two arguments against additional discovery. First, they argued
that Facebook only needed to produce information that Facebook conceded had been shared with
third parties—and the plaintiffs had to accept their representations about what had been shared.
Second, Facebook and Gibson Dunn argued that any additional discovery would be costprohibitive and unnecessary. (Under the Federal Rules of Civil Procedure, discovery must be
“proportional” to the needs of the case; Facebook and Gibson Dunn argued that any additional
discovery on the named plaintiff data did not meet that standard.)
Part of the problem with identifying the information that Facebook kept on the named
plaintiffs was that the company’s information about its users is not consolidated in one location;
it’s spread across Facebook’s complex data storage system. In March 2020, the plaintiffs asked
Facebook to produce developer manuals or other documents describing that system so that they
19
PDF Page 21
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 20 of 53
could understand where other named plaintiff data might be stored. According to the plaintiffs,
Gibson Dunn repeatedly told them to “Google” that information. Dkt. No. 1087-1 at 3. From late
2019 to mid-2020, the parties went back and forth about the named plaintiff data.
After several months without progress, Judge Corley ordered the parties to meet to
discuss the issue: “The parties’ next joint statement shall include information regarding the meet
and confer efforts and discuss in detail each side[’s] understanding of what precisely has been
produced and precisely what is the [named plaintiff] data that is being withheld as not relevant or
not reasonably available. The statement should not argue why the unproduced data is or is not
discoverable; the purpose of the statement is to precisely identify the data at issue.” Dkt. No. 487
at 1–2.
At the next discovery hearing, Gibson Dunn acknowledged that Facebook had not
produced all the information it collected about the named plaintiffs. As Gibson Dunn attorney
Russ Falconer explained: “There is other…Facebook-generated information, information
generated by third parties, information received from third parties. We have not represented that
that is comprehensively included in our production.” Dkt. No. 541 at 8. For instance, while
Facebook’s production included the date and time that a named plaintiff may have accessed a
certain website, it did not include the content the plaintiff had viewed on that website. Dkt. No.
541 at 7. According to Falconer, Facebook had access to that data in a “raw, disaggregated way”
but producing that data about any given plaintiff would be a “multiweek endeavor.” Dkt. No. 541
at 7, 10. At the hearing, the parties ultimately agreed that they would submit briefs to Judge
Corley, and she would determine what additional named plaintiff data should be produced.
In its briefing, Facebook argued that the only named plaintiff data that was discoverable
was data that “ar[ose] from user activity occurring on the Facebook platform” that the plaintiffs
“overtly shared…with a limited audience.” See Dkt. No. 557 at 1. The plaintiffs argued that the
universe of discoverable data was much larger. See Dkt. No. 557 at 1.
Judge Corley rejected Facebook’s “restrictive view of relevant discovery” in Discovery
Order No. 9. Dkt. No. 557 at 1. Judge Corley held that “the discoverable user data at issue
20
PDF Page 22
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 21 of 53
includes: Data collected from a user’s on-platform activity; Data obtained from third parties
regarding a user’s off-platform activities; and Data inferred from a user’s on or off-platform
activity.” Dkt. No. 557 at 2. Unless Facebook and Gibson Dunn could show that specific
information was not discoverable for some other reason—for instance, the burden of producing it
was disproportionate to the needs of the case—Facebook would have to give it to the plaintiffs.
Shortly thereafter, in November 2020, the plaintiffs asked Facebook to identify the
materials responsive to that order. Facebook responded that it was still “conducting an
investigation to confirm the universe of data” that could be responsive. Dkt. No. 583 at 3, 10.
Two months later, however, Facebook took the position that Discovery Order No. 9
“relate[d] only to data that was shared or otherwise made accessible” to third parties, and so no
other information was discoverable. Dkt. No. 589 at 34. Judge Corley shot down this argument
(or at least tried to), explaining that whether certain data was shared was an “open question.”
Dkt. No. 588 at 1. Judge Corley pointed out that Facebook had previously argued that the third
category of discoverable data identified in Discovery Order No. 9 (data inferred from a user’s on
or off-platform activity) was not discoverable because it had never been shared. But Discovery
Order No. 9 had clearly held that inferred data was discoverable—notwithstanding Facebook’s
assertions that it had never been shared. Judge Corley explained: “If the Court were to accept
Facebook’s arguments about the scope of production, it would eliminate” that entire category
from discovery. Dkt. No. 588 at 1.
Given the lack of clarity on Facebook’s use of users’ data, Judge Corley ordered the
parties to conduct a Rule 30(b)(6) deposition so that the plaintiffs could assess what data was
shared with third parties. Dkt. No. 588 at 1. A 30(b)(6) deposition—a reference to Federal Rule
of Civil Procedure 30(b)(6)—gives a litigant the opportunity to question an organization’s
representative about a specified topic. The organization has “a duty to make a conscientious,
good-faith effort to designate knowledgeable persons for Rule 30(b)(6) depositions and to
prepare them to fully and unevasively answer questions about the designated subject matter.”
Starlight International Inc. v. Herlihy, 186 F.R.D. 626, 639 (D. Kan. 1999). In a subsequent
21
PDF Page 23
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 22 of 53
order, Judge Corley clarified that the scope of the deposition was limited to “discoverable user
data as defined by Discovery Order No. 9,” and emphasized that “whether particular user data is
not shared, not admissible, or not monetized, is not a valid reason to object to a
particular…question” at the deposition. Dkt. No. 602 at 1–2.
After the 30(b)(6) deposition, there was no progress on the production of the named
plaintiff data. Facebook did not produce any additional documents at all, and it accused the
plaintiffs of “spinning in circles…for more than a year” on the issue. Dkt. No. 1085-9 at 7. By
the fall of 2021, the parties declared an impasse, and they briefed the issue for Special Master
Garrie. The plaintiffs argued that whether their information was shared “was a contested question
on which [they were] entitled to evidence,” beyond just Facebook’s representations. Dkt. No.
916-4 at 5. And, the plaintiffs pointed out, “internal documents demonstrate that Facebook itself
does not know what information may have been shared with third parties.” Dkt. No. 1103-2 at
13. But Facebook and Gibson Dunn persisted in the argument that the scope of discovery was
limited to information that Facebook admitted had been shared, and that this limitation was
consistent with Judge Corley’s order. Dkt. No. 916-4 at 5–6.
Special Master Garrie rejected Facebook and Gibson Dunn’s argument: he held that she
had not limited discovery to data that Facebook admitted was shared with third parties. Dkt. No.
916-4 at 6–7. He then determined that Facebook had not produced all the data related to the
named plaintiffs, so he ordered Facebook to “provide a list of data sources” containing that
information, and then meet and confer with the plaintiffs to propose a protocol for producing the
data. Dkt. No. 916-4 at 8. Facebook then moved for reconsideration. In response, Special Master
Garrie revised his order and instead required Facebook to explain its practices for storing user
data so that he could determine what additional data should be produced. Dkt. No. 793 at 7–8.
Facebook appealed that order.
In considering that appeal, Judge Corley explained that the plaintiffs agreed the case was
about data that was shared, but “the question” for discovery was how to determine “what was
shared and what was made accessible.” Dkt. No. 809 at 30. But, she said, Facebook’s position
22
PDF Page 24
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 23 of 53
was as follows: “The only data that is discoverable is that which Facebook contends was shared
or made accessible, and if Facebook says it was not shared or made accessible, that’s the end of
the matter.” Dkt. No. 809 at 29. Judge Corley (again) rejected that argument. Pointing (again) to
Discovery Order No. 9, Judge Corley explained: “This Court did not rule that Facebook only had
to produce data about the Named Plaintiffs that Facebook admits it shared with third parties.”
Dkt. No. 807 at 1. And Judge Corley repeated her earlier point: Discovery Order No. 9 held that
inferred data was discoverable (even though Facebook argued inferred data was never shared).
Dkt. No. 807 at 1–2. That order would not make sense, she reiterated, if discovery were as
limited as Facebook suggested. Dkt. No. 807 at 1–2. And “Facebook’s insistence that the Court
somehow ruled that only data that Facebook admits were shared with third parties is discoverable
is belied by the Court’s discovery ruling less than two months later,” which noted that what data
was shared was an “open question.” Dkt. No. 807 at 2.
Judge Corley continued: “Apart from the Court not having limited discovery of each
Named Plaintiff’s data to only data Facebook concedes it shared with third parties, the Court
finds that such a limitation is not appropriate.” Dkt. No. 807 at 2. “As the Court previously
noted, how Facebook uses the data it collects about its users is an ‘open question.’ The first step
in answering that question is to identify the data it collects about its users and, specifically, what
it has collected about the Named Plaintiffs.” Dkt. No. 807 at 2–3. Although the 30(b)(6)
deposition was intended to “provide clarity as to what data Facebook collects and how it is
used,” the 30(b)(6) witness was not “the final arbiter of whether data was shared.” Dkt. No. 807
at 3. “[T]here is nothing before the Court that suggests that the record is currently so undisputed
as to what data Facebook collects and how it is used that the Court can say definitively that
certain data were not shared and therefore not discoverable.” Dkt. No. 807 at 3.
Judge Corley also noted that Facebook’s appeal misrepresented Special Master Garrie’s
order. Facebook and Gibson Dunn argued that Special Master Garrie was requiring them to
provide “detailed information” about the sources of data Facebook had identified—but Special
Master Garrie’s order said only that Facebook had to provide a “high level description” of the
23
PDF Page 25
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 24 of 53
information in those sources. Dkt. No. 807at 3–4. Once Special Master Garrie had a high-level
description of Facebook’s data systems, he could determine which systems contained named
plaintiff data, and whether production of “potentially shared” named plaintiff data was feasible
and proportional to the needs of the case. Dkt. No. 807 at 4.
A week later, Special Master Garrie ordered Facebook to give him a “date certain” by
which Facebook could tell him which systems had discoverable data and either produce that data
or explain why it should not have to. Dkt. No. 1087-23 at 1. Special Master Garrie found
Facebook’s response to be “nonsensical.” Dkt. No. 826 at 2. Facebook tried again. For the next
six months, Special Master Garrie worked with the parties to determine what additional
information should be produced; that process involved testimony from six Facebook witnesses,
the submission of 14 explanations of 100 data systems, scrutiny of the identifiers used to store
and track user data, and other highly technical analyses. At this point, Facebook and Gibson
Dunn’s primary argument had been decisively rejected, and so they switched tack: They now
emphasized that any additional discovery would be so burdensome that it would not be
proportional to the needs of the case.
But this process revealed at least two new potential sources of named plaintiff data. First,
throughout the litigation, the plaintiffs had asked Facebook to produce data from something
called the Hive. The Hive is a data warehousing framework organized into tables and
“partitions.” Facebook and Gibson Dunn consistently argued that it would be nearly impossible
to look through the Hive for all the named plaintiff data because of the way the Hive was
organized. For instance, in October 2021, Facebook and Gibson Dunn said Facebook could not
produce named plaintiff data from the Hive because the information in the Hive is “not indexed
by user, so there is no way to search across all tables at once for an individual user’s ID.” Dkt.
No. 1085-11 at 7. Facebook and Gibson Dunn asserted that, to search the Hive for named
plaintiff data, it would have to search “each of Hive’s 12 million tables…individually for any
information relating back in any way to a Named Plaintiff, which would be nearly impossible,
given both the volume of Hive data and the fact that much of the data in Hive is anonymized.”
24
PDF Page 26
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 25 of 53
Dkt. No. 1085-11 at 7. In December 2021, Facebook again said that it would take “a full team of
engineers” working for “more than a year” to develop tools necessary to identify specific
information that could then be retrieved from the Hive. Dkt. No. 1103-12 at 8. From January
2022 on, the parties worked with the Special Master to inquire into the Hive tables to determine
if and how they could be searched.
Months into this process, a Facebook representative revealed something that the company
and its lawyers had not previously disclosed: Facebook had, much earlier on, identified and
preserved a number of Hive tables that might include named plaintiff data. In June 2022, the
plaintiffs deposed Michael Duffey, an e-discovery case manager in Facebook’s legal department.
Facebook designated Duffey under Rule 30(b)(6) to testify about Facebook’s efforts to identify
and preserve information associated with the case, including information about the named
plaintiffs. Duffey said that Facebook had identified Hive tables related to Cambridge Analytica
with the help of “outside counsel,” and it had placed 137 Hive tables on “legal hold,” likely
starting in 2018. Dkt. No. 1103-23 at 70–71, 76. Facebook later admitted that the tables were
preserved, at least in part, because they were related to the named plaintiffs. Dkt. No. 1085-35 at
4.
At the same deposition, Duffey revealed another potentially fruitful source of named
plaintiff data: the Switchboard profiles. He explained that Switchboard was a tool created to
respond to law enforcement subpoenas, and Facebook had preserved data from Switchboard in
connection with the named plaintiffs. See Dkt. No. 1085-35 at 2. (Previously, a Facebook
representative said that Facebook used the DYI tool to respond to law enforcement inquiries,
making no mention of Switchboard. Dkt. No. 1103-9 at 95.) Duffey said that Switchboard was
“very similar” to DYI, but it included additional information “pertaining to Facebook groups and
advertising accounts.” Dkt. No. 1103-23 at 41. Later, Facebook and Gibson Dunn clarified that
Switchboard also included additional information about a user’s privacy settings, the full
alphanumeric code associated with certain cookies, information about who the user had blocked,
as well as those who reported or blocked that user, and data created for law enforcement. Dkt.
25
PDF Page 27
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 26 of 53
No. 1085-35 at 3. Indeed, when Facebook initially produced the named plaintiffs’ privacy
settings in 2020, it found those settings by looking to the Switchboard profiles. Dkt. No. 1085-35
at 3. But Facebook and Gibson Dunn had never told the plaintiffs about Switchboard.
Duffey also said that Switchboard provided information in a “more usable way” than
DYI because the Switchboard profiles could be downloaded as a single PDF. Dkt. No. 1103-23
at 42–43. In contrast, Facebook produced the information from DYI in thousands of atomized
files. See Dkt. No. 1050-3 at 20. According to the plaintiffs, many of those files were useless,
“including documents consisting wholly of the Facebook [‘]like[’] graphic (a thumbs-up).” Dkt.
No. 1050-3 at 20.
These revelations came almost three years after the plaintiffs asked for the data Facebook
collected on them, and two years after Judge Corley had ordered the parties to meet and confer
regarding the data Facebook was withholding. Facebook subsequently agreed to produce the
Switchboard profiles and certain information from the Hive tables. Dkt. No. 1085-34 at 3.
C.
Depositions
The plaintiffs also complain about Facebook and Gibson Dunn’s conduct during
depositions. There is no need to describe all the conduct; a few examples will suffice.
One example involves the depositions focusing on Facebook’s practice of “whitelisting.”
Recall that in 2014, Facebook transitioned to a new app interface that limited access to friend
permissions. But Facebook “whitelisted” certain apps, allowing them to continue to use the
earlier app developer interface (and therefore access friend permissions) even after that
transition.
Discovery had revealed documents that appeared to support the plaintiffs’ claims that
Facebook whitelisted apps based on business concerns, rather than purely technical ones. For
instance, a 2013 email appears to show employees from Facebook’s partnerships team discussing
the impact of the new interface on apps and “integrations” (third parties that built Facebookbranded or “Facebook-like” experiences on third-party platforms, like a Facebook app for a
phone). Dkt. No. 1103-21 at 29–31; see also Dkt. No. 1085-36 at 53, 57. In the first email in the
26
PDF Page 28
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 27 of 53
chain, Facebook employee Jackie Chang identifies a category she calls “key integrations” that
“drive value to FB” but use friend data or a user’s “read stream” (information from a user’s news
feed). Dkt. No. 1103-21 at 30–31; see also Dkt. No. 1103-16 at 6. She contrasts this category
with “key integrations that are competitive or drive little value to FB.” Dkt. No. 1103-21 at 30–
31. For the valuable integrations, Chang says, Facebook “should decide if we allow certain use
cases that are of strategic value” to Facebook. Dkt. No. 1103-21 at 30–31. In contrast, for the
low-value integrations, she suggests it is “good…we’re removing” access. Dkt. No. 1103-21 at
31.
Another Facebook employee then discusses the impact of the change on apps. He
attaches a list of “40k+ apps that request and make use of the friends_permissions,” pulled
together by “Simon” (presumably, Simon Cross, cc’ed on the email). Dkt. No. 1103-21 at 29.
The employee then offers a recommendation for whether certain categories of apps should keep
that access. Dkt. No. 1103-21 at 29. For “strategic partners,” he says, “we should use the
framework developed by Jackie.” Dkt. No. 1103-21 at 29.
When the plaintiffs asked Facebook’s employees about this email chain, the employees
were unwilling to acknowledge what it seemed to show—that Facebook was discussing whether
to allow apps to access friends’ information based on the financial value of the app to the
company.
Facebook designated Simon Cross (who was cc’ed on the email chain) to discuss
whitelisting in a 30(b)(6) deposition. Cross first testified that Facebook allowed apps to continue
to use the earlier interface and access friend permissions only when “the user experience would
be significantly degraded if [the apps] weren’t given extra time or there was some form of legal
and regulatory risk to the partner if the extension was not granted.” Dkt. No. 1085-36 at 193. The
plaintiffs then asked Cross about the framework proposed in the email. Dkt. No. 1085-36 at 319–
323. Cross said that it was unclear what framework the email referred to, but he could not
“confirm anything about the precise nature of a framework or if that was used in any way.” Dkt.
No. 1085-36 at 321, 323. He later said that the framework was not used. Dkt. No. 1085-36 at
27
PDF Page 29
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 28 of 53
326. He could not “recall” whether there was a “formal document or protocol” used when
deciding what apps to whitelist, yet he had not asked Facebook’s employees whether such a
document or protocol existed. Dkt. No. 1085-36 at 382–83. When asked whether “strategic
value” was taken into account when deciding whether to continue to provide access to friend
permissions, Cross said he could not answer the question because Facebook had no definition of
strategic value. Dkt. No. 1085-36 at 333.
As noted, Cross was cc’ed on the email chain, and it seems as though he put together the
list of impacted apps described in the email. Dkt. No. 1085-36 at 316. Yet Cross testified: “If you
want to know what these people [on the email thread] meant, I would ask them.” Dkt. No. 108536 at 323. He later repeated: “If you want to understand precisely what the people in it meant, I
would speak to them.” Dkt. No. 1085-36 at 325. At least nine times, Cross told the plaintiffs they
should ask Chang specifically about certain aspects of whitelisting. Dkt. No. 1085-36 at 309,
311, 314, 321, 328, 379–80, 381, 383, 455.
Several months earlier, the plaintiffs had deposed Chang. When asked whether she was
“making a recommendation [in the email]…for how to deal with integrations that involve
strategic value,” Chang responded, “I don’t remember specifically, so I don’t know how to
answer that.” Dkt. No. 1103-24 at 106. She didn’t “remember enough to say” that the email was
about the loss of access to read stream and friend data permissions. Dkt. No. 1103-24 at 107.
Indeed, she could not recall what it meant to use “read stream and friend data” at all. Dkt. No.
1103-24 at 108. When asked if she could offer her “best understanding” of what her email meant,
she said she couldn’t “speculate.” Dkt. No. 1103-24 at 108. When asked, “Tell me everything
you can remember about your involvement in figuring out which partners should continue to
have access to friends permissions,” Chang responded, “So, again, I don’t remember.” Dkt. No.
1103-24 at 119.
Chang’s testimony about her email is representative of her deposition more broadly:
Although Facebook’s internal documents suggest that Chang was extensively involved in the
whitelisting process, she remembered almost nothing about it. See, e.g., Dkt. No. 1103-24 at
28
PDF Page 30
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 29 of 53
170–71. At one point in the deposition, Chang testified that she could not remember what the
term whitelisting meant at all. Dkt. No. 1103-24 at 220. She had no memory of the deprecation
of friend permissions. Dkt. No. 1103-24 at 96. She did not remember that Facebook had ever
allowed apps to access friends’ information. Dkt. No. 1103-24 at 70. Although she was being
deposed in a case involving the Cambridge Analytica scandal and said she had met with
Facebook’s lawyers for around nine hours to prepare, she claimed she did not know that the
scandal was related to Facebook’s practice of sharing friends’ information. Dkt. No. 1103-24 at
17, 292–93.
Chang resisted other questions as well. When asked if the email was “the best evidence of
what you were thinking at the time you wrote” it, Chang responded, “I don’t know.” Dkt. No.
1103-24 at 133. When asked if there was anything that could refresh her recollection, Chang
responded, “I don’t know what I don’t know, so I can’t make that assumption that I would
know.” Dkt. No. 1103-24 at 134. When asked if the email was a “good guide of what you were
thinking about the topics discussed,” Chang said that would require her to “speculate.” Dkt. No.
1103-24 at 135. When asked again, Chang said she didn’t know what “good” meant. Dkt. No.
1103-24 at 136. At another point in the deposition, Chang said she didn’t know what the phrase
“general understanding” meant. Dkt. No. 1103-24 at 76.
The plaintiffs also complain of Facebook and Gibson Dunn’s conduct during the
deposition of Alison Hendrix, Facebook’s director of privacy and data policy. Facebook
designated Hendrix to testify on several topics identified in the plaintiffs’ 30(b)(6) deposition
notice, including: “The purposes for which…data or information was shared or made accessible”
to third parties; “how Facebook ensured third parties’ use of such data or information was
limited” to the purpose for which the third party was able to obtain it; and “an overview of the
processes of developing privacy or app settings or other controls made available to users to
prevent or limit their data or information from being accessed by third parties.” Dkt. No. 1085-22
at 22.
The plaintiffs began by asking Hendrix if those topics—how Facebook limited third
29
PDF Page 31
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 30 of 53
parties’ use of users’ data and the controls Facebook had in place to help users limit third parties’
access to their data—seemed related. Hendrix twice asked what the plaintiffs meant by “related.”
Dkt. No. 1085-22 at 18–19, 20–21. After five minutes of back-and-forth and multiple objections
from Gibson Dunn, Hendrix agreed that the topics were “somewhat related.” Dkt. No 1085-22 at
18–23.
Tensions only escalated from there. At one point, for instance, the plaintiffs asked
Hendrix if she could “unpack” one of her answers, and she responded, “No.” Dkt. No. 1085-22
at 132. The plaintiffs said, “I’m trying to figure out what you mean by [your answer,]” and
Hendrix responded, “I mean[t] what I said. And I even gave an example.” Dkt. No. 1085-22 at
132.
Many of the disputes in the deposition centered around Gibson Dunn’s interpretation of
the 30(b)(6) deposition notice. For instance, Hendrix was designated to testify about the process
of developing privacy and app settings. The plaintiffs asked Hendrix whether there was a “tool or
a setting [a user] can select in determining what to share with a third party.” Dkt. No. 1085-22 at
137. Gibson Dunn attorney Robert Blume objected that the question was outside the scope of the
deposition notice. Dkt. No. 1085-22 at 136. Blume made the same objection when the plaintiffs
asked whether a drop-down option in the privacy shortcuts menu said, “Who can see my stuff?”
Dkt. No. 1085-22 at 177. To Blume, the question was “incredible” because it had “nothing to do
with users’ privacy or app settings,” but rather was a “technological change.” Dkt. No. 1085-22
at 177–78.
The parties also disagreed about whether Hendrix was required to speak about actual
instances of developer misconduct and enforcement, rather than just Facebook’s theoretical
policies. To Blume, it was significant that the plaintiffs sought testimony on “how Facebook
ensured third parties’ use of such data or information was limited to the use case.” Because the
plaintiffs’ notice said “how” and “not when, not what, not which,” he said, the plaintiffs could
not seek any testimony about third parties’ actual compliance. Dkt. No. 1085-22 at 320.
For instance, at one point, Hendrix testified that developers “must comply” with
30
PDF Page 32
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 31 of 53
Facebook’s terms, and there were “no exceptions.” Dkt. No 1085-22 at 327. The plaintiffs
followed up by asking if Hendrix was aware of “the instances in which developers did or did not
comply with [those] terms.” Dkt. No. 1085-22 at 327. Hendrix responded: “I will do my own
bitching and moaning. I have already answered that question twice. So for the third time, I will
let you know that I am not prepared to tell you every single violation that has been surfaced and
confirmed from 2007 to 2022.” Dkt. No. 1085-22 at 327–28.
In all, Blume instructed Hendrix not to answer questions at least 22 times on the theory
that the questions were outside the scope of the notice. While Blume initially allowed Hendrix to
answer these questions in her personal capacity (rather than as Facebook’s designee), he
eventually instructed Hendrix that she should not answer the questions at all. See Dkt. No. 108522 at 269. And Hendrix herself refused to answer certain questions based on her own
interpretation of the deposition notice. See, e.g., Dkt. No. 1085-22 at 234, 245–46, 327–28.
Throughout the deposition, Blume’s frequent objections and instructions not to answer
cut off certain lines of questioning entirely. For instance, the plaintiffs asked if Hendrix was
prepared to testify about “third-party app developers that actually continued to access friend
information” after the deprecation of friend permissions. Dkt. No. 1085-22 at 228. Hendrix
responded that, after the first version of the interface was “fully deprecated,” “friend
permissions” were “no longer a thing from a product perspective.” Dkt. No. 1085-22 at 229. “If
you didn’t move your app and build off of v2, from a technical standpoint at deprecation of v1,
you could no longer call the Graph API and receive any friend permissions. There was no longer
the ability to request friend permissions.” Dkt. No. 1085-22 at 228. The plaintiffs followed up by
asking Hendrix if she was familiar with whitelisting. Dkt. No. 1085-22 at 229. When she said
yes, they asked for her understanding of the term. Dkt. No. 1085-22 at 229. Blume objected. Dkt.
No. 1085-22 at 229. That objection was followed by a 15-minute discussion about whether the
question was outside the scope of the deposition notice—with Hendrix herself stating that she
“struggle[d]” to see how the question was relevant to the topics she was prepared to discuss. Dkt.
No. 1085-22 at 240, 229–244.
31
PDF Page 33
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 32 of 53
That exchange is representative of the larger pattern: Blume would object, and the
plaintiffs, Blume, Hendrix, and Special Master Garrie would spend a substantial amount of time
debating the objection. One such dispute lasted 17 minutes. Dkt. No. 1085-22 at 292–310.
After the deposition, the plaintiffs filed a motion with Special Master Garrie for sanctions
based on Blume and Hendrix’s conduct. Dkt. No. 935. Among other things, the plaintiffs sought
additional time for 30(b)(6) depositions on the topics for which Hendrix was a designated
witness. Facebook did not oppose the motion, and it agreed to the relief requested. Dkt. No. 936.
Facebook also agreed to pay the plaintiffs’ attorney’s fees for the time spent preparing for and
conducting Hendrix’s deposition, as well as the fees for the time Special Master Garrie spent on
the deposition and motion. Dkt. No. 936.
D.
Designation of Documents as Privileged
Another area of conflict involved Facebook and Gibson Dunn’s misdesignation of
thousands of documents as privileged. Just before the February 2022 case management
conference, Facebook’s privilege log listed around 15,000 documents (not including the ADI
documents). This was the conference where this Court ripped into Facebook and Gibson Dunn
for stonewalling.
Facebook responded to the threat of sanctions by accelerating its production, but in
connection with that production it added over 180,000 documents to its privilege log. See Dkt.
No. 1088-9 at 4. To the plaintiffs, this massive assertion of privilege seemed dubious, and they
raised the issue with Facebook and Gibson Dunn. Facebook and Gibson Dunn ultimately agreed
to re-review a sample of 3,062 documents. Dkt. No. 1050-3 at 28. After this review, Facebook
withdrew privilege claims over 63% of those documents. Dkt. No. 1050-3 at 28. Given that
significant rate of error, Facebook agreed to re-review all the documents it had withheld as
privileged. Although it’s difficult to pinpoint the exact numbers, the plaintiffs estimate that
Facebook dropped privilege claims for over 53,168 documents and offered redacted versions of
an additional 7,482 documents that the company originally withheld. Dkt. No. 1050-3 at 28.
The plaintiffs offer a few examples of documents initially designated as privileged. They
32
PDF Page 34
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 33 of 53
point to an email chain from the fall of 2009 among non-attorneys discussing “what to do about
friend data” and whether “apps get to store whatever friend data they get.” Dkt. No. 1041-3 at 2–
3. The plaintiffs also point to an April 2018 email between non-attorneys that discusses “a couple
of docs” an employee put together for Mark Zuckerberg in mid-2015 about “the need to build a
stronger and more centralized privacy & data use org.” Dkt. No. 1041-5 at 2. The employee
observes, “I wonder how much of a better place we’d be in today if the proposal had been
implemented three years ago.” Dkt. No. 1041-5 at 2.
Relatedly, internal documents from Facebook also suggest that its employees sought to
shield communications from future discovery by “privileging” them. For instance, a 2015 email
chain between Facebook employees discusses a credit score app that was mistakenly given
access to certain sensitive user data like “user_posts.” Dkt. No. 1103-22 at 3. One employee
responds, “Simon, can we discuss in person? Else we need to make this a/c priv and add a lawyer
in the thread.” Dkt. No. 1103-22 at 2. Simon Cross replies, “You know what my answer will be
here.” Dkt. No. 1103-22 at 2. And the employee responds, “:-).” Dkt. No. 1103-22 at 2.
Another chat discusses “PR and regulatory inquiries.” Dkt. No. 1088-13 at 2. One of the
employees shares something that has since been redacted. Dkt. No. 1088-13 at 2. Another
responds, “Might be best not to share in this specific thread, rather one with priv.” Dkt. No.
1088-13 at 2 Later in the chat, an employee asks about using Quip (a collaborative tool for
editing documents and spreadsheets) for sensitive information. Dkt. No. 1088-13 at 2. The
following exchange occurs:
[Employee 1] (3/20/2018 16:43:39 PDT):
>Just ensure that if it’s very sensitive you ask a lawyer for guidance in the Quip and
privilege it
[Employee 2] (3/20/2018 16:44:53 PDT):
>How does one ‘privilege it’?
[Employee 3] (3/20/2018 16:45:22 PDT):
>With the presence and approval of an attorney[.]
Dkt. No. 1088-13 at 2.
33
PDF Page 35
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 34 of 53
E. Facebook and Gibson Dunn’s Rhetoric
Finally, throughout this period, Facebook and Gibson Dunn consistently argued that it
was the plaintiffs who were delaying discovery. As early as 2020, Facebook and Gibson Dunn
told Judge Corley that the plaintiffs “continue to undermine the Court’s well-considered orders
(intended to bring structure to the case) by insisting on an unfocused whack-a-mole process that
would unwind past agreements and work.” Dkt. No. 563 at 6. In 2021, Facebook and Gibson
Dunn told the Court that the plaintiffs’ “scattershot approach to litigation continues to cause
significant inefficiencies, unnecessary friction, wasteful motion practice, and a race to litigate
(rather than resolve) disputes.” Dkt. No. 631-3 at 7 (under seal).
Recall Facebook and Gibson Dunn’s repeated pronouncements that discovery was limited
to information Facebook admitted had been shared. When the plaintiffs brought that issue to
Special Master Garrie’s attention, Facebook and Gibson Dunn described the plaintiffs’ motion as
“an opportunistic, wasteful, and abusive attempt to erase the proceedings before Judge Corley,
gain access to information Plaintiffs have conceded is irrelevant, and hunt for anything to stall
this case before it finally reaches the merits.” Dkt. No. 1085-11 at 6.
By January 2022, just before the Court invited this sanctions motion, Gibson Dunn
attorney Orin Snyder told Special Master Garrie that the “case [was] out of control” because “the
plaintiffs will not stop.” Dkt. No. 1087-3 at 5. According to Snyder, the plaintiffs were raising
new issues “coming from left field, right field, the dugout, the saloon down the street [from] the
ballpark,” all just before discovery was set to end. Dkt. No. 1087-3 at 11. It was time for the
plaintiffs to be told “no mas, no mas.” Dkt. No. 1087-3 at 6.
II
A court may impose sanctions under its inherent powers “when a party has ‘acted in bad
faith, vexatiously, wantonly, or for oppressive reasons.’” Chambers v. NASCO, Inc., 501 U.S. 32,
45–46 (1991) (quoting Alyeska Pipeline Service Co. v. Wilderness Society, 421 U.S. 240, 258–59
(1975)). A court may exercise this power by requiring the sanctioned party to pay the opposing
party’s attorney’s fees. Id.
34
PDF Page 36
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 35 of 53
Before imposing sanctions, the court must find that the conduct “constituted or was
tantamount to bad faith.” Primus Automotive Financial Services, Inc. v. Batarse, 115 F.3d 644,
648 (9th Cir. 1997). That standard may be met when a party misrepresents the law or the facts to
the court. See, e.g., Malhiot v. Southern California Retail Clerks Union, 735 F.2d 1133, 1138
(9th Cir. 1984); cf. Chambers, 421 U.S. at 35–41. It may also be met “when a party acts for an
improper purpose—even if the act consists of making a truthful statement or a non-frivolous
argument or objection.” Fink v. Gomez, 239 F.3d 989, 992 (9th Cir. 2001). Sanctions may be
imposed for “delaying or disrupting the litigation or hampering enforcement of a court order.”
Primus, 115 F.3d at 649. And they may be imposed for repeatedly making arguments that have
been rejected. Wages v. I.R.S., 915 F.2d 1230, 1235 (9th Cir. 1990).
“To protect against abuse and to ensure parties receive due process, individuals subject to
sanction are afforded procedural protections, the nature of which varies depending upon the
violation, and the type and magnitude of the sanction.” F.J. Hanshaw Enterprises, Inc. v.
Emerald River Development, Inc., 244 F.3d 1128, 1137 (9th Cir. 2001). The Ninth Circuit has
distinguished between two types of sanctions: compensatory and punitive. The former is
intended to compensate the opposing party for the expense incurred as a result of the misconduct.
Id. at 1137–38. The latter is intended to “vindicate the court’s authority and the integrity of the
judicial process.” Id. at 1138.
To impose compensatory sanctions, the court must give the sanctioned party notice and
an opportunity to be heard. Id. at 1143. The Ninth Circuit has not addressed the burden of proof
required for compensatory sanctions, but a finding of bad faith by clear and convincing evidence
is sufficient. Lahiri v. Universal Music & Video Distribution Corp., 606 F.3d 1216, 1219 (9th
Cir. 2010). To impose substantial punitive sanctions (at least for out-of-court conduct), the court
“must provide the same due process protections that would be available in a criminal contempt
proceeding.” F.J. Hanshaw Enterprises, Inc., 244 F.3d at 1139; cf. Goodyear Tire & Rubber Co.
v. Haeger, 581 U.S. 101, 108 (2017). That process includes the right to an independent
prosecutor, a jury trial, and a finding of misconduct beyond a reasonable doubt. F.J. Hanshaw
35
PDF Page 37
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 36 of 53
Enterprises, Inc., 244 F.3d at 1139–40.
The sanctions requested in this case are compensatory. The parties have already reached a
settlement in principle, and the settlement includes a total amount to be paid by Facebook into a
settlement fund. Most of the settlement fund will be designated for members of the class; some
of it will be designated to pay fees and costs to class counsel. Any fee award to the plaintiffs
from this sanctions motion will cause a corresponding reduction in the amount of money
designated to pay attorney’s fees from the settlement fund. In other words, a fee award here
means the plaintiff class will need to use less of the settlement fund for attorney’s fees. And that
is the point of compensatory sanctions—to protect one side from paying fees resulting from the
opposing side’s misconduct. Cf. Restatement (Third) of the Law Governing Lawyers § 38(3)(b)
(2000).
Relatedly, the amount of compensatory sanctions is limited to fees and costs “incurred
solely because of the misconduct” at issue, meaning “fees that party would not have incurred but
for the bad faith.” Goodyear, 581 U.S. at 104. A court has “broad discretion” in calculating that
award. Id. As the Supreme Court has emphasized, the sanctioning court “need not, and indeed
should not, become green-eyeshade accountants’ (or whatever the contemporary equivalent is).”
Id. at 110 (quoting Fox v. Vice, 563 U.S. 826, 838 (2011)). “Accordingly, a district court may
take into account [its] overall sense of a suit, and may use estimates in calculating and allocating
an attorney’s time. The court may decide, for example, that all (or a set percentage) of a
particular category of expenses—say, for expert discovery—were incurred solely because of a
litigant’s bad-faith conduct.” Id. (quoting Fox, 563 U.S. at 838) (quotations and citations
omitted).
A court may also award fees and costs incurred in moving for sanctions. These fees and
costs are a result of the misconduct—“were there no sanctionable conduct, there would have
been no proceeding to impose sanctions, and no fees incurred in that proceeding.” Blixseth v.
Yellowstone Mountain Club, LLC, 854 F.3d 626, 631 (9th Cir. 2017); see also Harper v. Nevada
Prop. 1, LLC, No. 219CV02069GMNVCF, 2021 WL 3418350 (D. Nev. Aug. 5, 2021).
36
PDF Page 38
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 37 of 53
After a court estimates the amount of fees and costs incurred “because of” the
misconduct, it then determines whether that amount is reasonable by looking to the number of
hours reasonably expended on the case (deducting any unnecessary or duplicative expenses)
multiplied by a reasonable hourly rate. Pennsylvania v. Delaware Valley Citizens’ Council for
Clean Air, 478 U.S. 546, 564 (1986).
III
The Court finds by clear and convincing evidence that Facebook and Gibson Dunn acted
in bad faith during much of this litigation, and their misconduct warrants sanctions pursuant to
the Court’s inherent authority. Because a court’s inherent powers must be exercised with
“restraint and discretion,” the Court will only sanction Facebook and Gibson Dunn for the worst
of their consistently bad behavior: their handling of discovery related to the App Developer
Investigation and the named plaintiff data.10 This misconduct would be sanctionable even if
viewed in isolation, but their bad faith becomes even more obvious when viewed in the context
of the entire litigation. It is also clear that the blame for this misconduct must be laid equally at
the feet of both client and counsel—this sustained, brazen stonewalling campaign could only
have occurred if everyone (or almost everyone) was on the same page.11
A. Sanctionable Conduct
1. App Developer Investigation
First, Facebook and Gibson Dunn deserve to be sanctioned for their repeated use of
frivolous legal arguments to delay the production of highly probative evidence related to the App
Orin Snyder, who served as lead counsel when Gibson Dunn’s conduct was at its worst, should
consider himself lucky that he has not been sanctioned personally. Presumably this ruling will
help ensure that he will not be so lucky if he acts this way again.
11
While a court should ordinarily rely on 28 U.S.C. § 1927 and the Federal Rules of Civil
Procedure to impose sanctions, if neither is “up to the task, the court may safely rely on its
inherent power.” Chambers, 501 U.S. at 50. Section 1927 does not allow the court to impose
sanctions against parties or law firms, so it does not apply to the circumstances of this case.
Kaass L. v. Wells Fargo Bank, N.A., 799 F.3d 1290, 1293–94 (9th Cir. 2015). And while some of
the misconduct could potentially be sanctioned under the Federal Rules of Civil Procedure, that
misconduct is “intertwined within conduct that only the inherent power [can] address,” so
sanctions under the Court’s inherent powers are appropriate. Chambers, 501 U.S. at 51.
10
37
PDF Page 39
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 38 of 53
Developer Investigation.
To be clear, the Court does not find bad faith in the initial argument that all materials
related to the investigation were privileged. Judge Corley herself acknowledged (before
reviewing the documents) that there were “arguments both ways,” and the Supreme Judicial
Court of Massachusetts has held (albeit with thin analysis) that certain ADI documents were
covered by work-product or attorney-client privilege. See Attorney General v. Facebook, Inc.,
487 Mass. 109, 130–31 (2021).
But Facebook and Gibson Dunn’s conduct surrounding that assertion of privilege—
particularly their conduct in the wake of Judge Corley’s rejection of their blanket privilege
argument—is sanctionable. The ADI documents were highly probative. Recall the memos
discussed in Section I.A of this opinion: they identified apps that had access to millions of users’
information, even after Facebook purported to limit that access. They also offered insight into
what Facebook knew and when. Recall, too, the email chain from 2019 that appeared to show
Facebook considering the impact of its enforcement decisions on its revenue stream. Had
Facebook gotten its way, none of these documents ever would have been produced.
After Judge Corley rejected their argument about privilege, Facebook and Gibson Dunn
engaged in what can only be described as an effort to gaslight their opponents (and the Court)
over the production of Facebook’s internal communications and the communications with
Facebook’s consultants. Take, for example, the plaintiffs’ concession that they did not need
administrative emails—emails requesting information from apps or discussing scheduling—
because they were only looking to discover the “underlying facts.” Facebook and Gibson Dunn
used this statement to argue that the plaintiffs had conceded that they were not entitled to
discover any communications about the App Developer Investigation at all. Facebook and
Gibson Dunn did not make this argument once; they made it repeatedly. One wonders if the
lawyers on the other side began to question their own sanity.
The same is true of Facebook and Gibson Dunn’s argument that Judge Corley had held
the communications were not discoverable. Her order explicitly required Facebook and Gibson
38
PDF Page 40
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 39 of 53
Dunn to work with Special Master Garrie to identify what else should be produced from the
universe of ADI materials. And Judge Corley had not reviewed a representative set of
communications when deciding the parties’ dispute; she had reviewed twenty documents blindly
picked from Facebook’s privilege log. Moreover, those documents were not the focus of her
order. As she made clear, her order adjudicated the privilege question broadly—not the
discoverability of the twenty documents from the sampling exercise. Instead of fairly reading
that order, Facebook and Gibson Dunn seized on a few passing comments Judge Corley made at
a hearing months prior. Relying on these out-of-context comments (comments not included in
her ruling), Facebook and Gibson Dunn argued that Judge Corley had silently adjudicated the
discoverability of all ADI communications. And Orin Snyder argued, with his typical bombast,
that this interpretation was based on “a lot of case law”—none of which seems to exist. Those
arguments were frivolous, and they did nothing but delay production and waste the plaintiffs’
and the Court’s time.
It’s worth stepping back to reflect on the position Facebook and Gibson Dunn took on
Facebook’s communications about the investigation. This case is about Facebook’s alleged
policy of sharing Facebook users’ personal information with third parties without permission. It
is also about Facebook’s alleged failure to prevent third parties from misusing the personal
information they received. Of course, the App Developer Investigation was about largely the
same thing: the extent to which third parties obtained and misused the personal information of
Facebook users. Any first-year civil procedure student would know that internal communications
between Facebook employees about the investigation would be a prime source of information
relevant to this lawsuit. It’s equally obvious that Facebook’s communications with its outside
consultants hired to investigate these apps would be relevant. Indeed, Special Master Garrie
found that a “substantial number” of the communications he reviewed were “relevant to the case
and not protected by privilege.” Dkt. No. 916-9 at 6. Finally, no reasonable person could argue
that these documents—given their significant probative value—were too burdensome to identify
and produce as a categorical matter. It is the height of bad faith to repeatedly resist the disclosure
39
PDF Page 41
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 40 of 53
of such probative information by twisting the words of opposing counsel and the magistrate
judge.
Facebook and Gibson Dunn’s conduct after Special Master Garrie ordered them to
produce additional ADI documents further supports this finding of bad faith. To recall, Special
Master Garrie originally ordered Facebook to produce all documents related to the investigation
(with some exceptions for attorney communications). Facebook then moved for reconsideration.
In its motion for reconsideration, Facebook argued that it should only be required to search for
relevant materials from the documents it had already collected—it should not be required to
collect any new documents because its existing set was adequate. Only after this Court
threatened sanctions did Facebook and Gibson Dunn reveal that the set of previously collected
documents did not include anything from after 2019 (even though the App Developer
Investigation continued into 2020). Gibson Dunn now argues that it was not “aware” of this fact.
But if that’s true, it means Facebook and Gibson Dunn were comfortable telling Special Master
Garrie their previous collection was adequate—without ever inquiring into what they had
actually collected. This conduct is symptomatic of their larger strategy: object first, investigate
later (and only when forced). And that strategy supports the finding of bad faith.
The plaintiffs complain of other conduct by Facebook and Gibson Dunn related to ADI
discovery. They complain, for example, about Facebook and Gibson Dunn’s failure to use search
terms such as “ADI” and “App Developer Investigation” when searching for communications
about the App Developer Investigation. And they complain about Facebook and Gibson Dunn’s
failure to search for all the apps Facebook investigated. In isolation, this conduct is more
susceptible to an innocent explanation. After all, the plaintiffs could have helped ensure that the
proper search terms were being used, and the Special Master’s order could have been more
precise. But given the context, this conduct also likely reflects bad faith.
2. Named Plaintiff Data
Facebook and Gibson Dunn’s misconduct as it relates to the named plaintiff’s
information is also sanctionable. As with the App Developer Investigation, Facebook and Gibson
40
PDF Page 42
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 41 of 53
Dunn used frivolous arguments to delay the production of a key category of information. As
Judge Corley and Special Master Garrie explained—at least three times over the course of two
years—discovery was not limited to information that Facebook admitted it had shared. First, in
Discovery Order No. 9, Judge Corley held that discoverable information included a category of
data that Facebook said was never shared at all. There is no reasonable interpretation of that
order that limits discovery to data Facebook admitted it shared. Whether the information was
actually shared was, as Judge Corley explained, an “open question,” and the plaintiffs were
entitled to seek evidence on that question—including evidence about the information Facebook
collected about them. Even if there had been any ambiguity in Judge Corley’s order, that
ambiguity would have been eliminated by her repeated rejection of Facebook and Gibson Dunn’s
argument. But they persisted.
Judge Corley envisioned a process by which the parties would work together to
determine what universe of data existed and, from there, determine what could have been shared.
This was a highly technical question: in the end, it took Special Master Garrie and the parties six
months to determine what else should be produced. By consistently arguing that discovery was
limited to information Facebook admitted it shared, Facebook and Gibson Dunn short-circuited
that process. Without knowing the universe of named plaintiff data that existed, it would be
difficult (if not impossible) to verify Facebook’s representations.
Judge Corley and Special Master Garrie should never have needed to clarify (even once,
much less multiple times) that Facebook could not avoid identifying and producing some subset
of information simply by asserting that it never shared that subset of information with third
parties. Again, this whole case involved accusations that Facebook disclosed personal
information about users to third parties surreptitiously, indiscriminately, and without permission.
The first step in getting to the bottom of those accusations was to figure out what information
Facebook collected on the named plaintiffs, as a means to figuring out which pieces of
information Facebook actually disclosed. The argument that “we didn’t share that information,
so we don’t need to provide it in discovery” is obviously contrary to the right of the plaintiffs to
41
PDF Page 43
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 42 of 53
test Facebook’s assertions in an adversarial litigation process.
Moreover, even if this argument were somehow not frivolous when Facebook and Gibson
Dunn first made it, it’s clear that they were pressing the argument for an improper purpose: their
actions were intended to obfuscate and delay the resolution of a major issue in the case. From the
very beginning, Facebook and Gibson Dunn stonewalled, telling the plaintiffs to “Google”
information about Facebook’s data architecture. From then on, they consistently failed to identify
materials responsive to the plaintiffs’ requests and Judge Corley’s order. When pressed,
Facebook and Gibson Dunn submitted a “nonsensical” response to Special Master Garrie. And
then, on appeal, Facebook and Gibson Dunn misrepresented Special Master Garrie’s order to
Judge Corley.
That improper purpose is also clear when one considers Facebook and Gibson Dunn’s
other argument: that production of any additional named plaintiff data would create a major
burden, and so it was not proportional to the needs of the case. Facebook and Gibson Dunn made
this argument even though they had already preserved two additional sources of named plaintiff
data: the Switchboard profiles and the identified Hive tables. As early as July 2020, Judge Corley
ordered the parties to meet and confer to “discuss in detail each side[’s] understanding of what
precisely has been produced and precisely what is the data that is being withheld as not relevant
or not reasonably available.” Dkt. No. 487 at 1–2. At that meet and confer (at the latest),
Facebook and Gibson Dunn should have told the plaintiffs about the Switchboard profiles and
the Hive tables.
Facebook and Gibson Dunn now offer two explanations for their failure to disclose the
Hive tables. First, they say the information in the tables was not relevant or had already been
produced. Second, they say Facebook erred on the side of over-preserving information, and they
weren’t required to disclose everything that was preserved. But neither explains why Facebook
and Gibson Dunn didn’t just tell the plaintiffs that they had identified a subset of Hive tables,
especially when the parties spent months litigating the production of information from the Hive.
Perhaps Gibson Dunn’s attorneys were not aware of the Hive tables (although Facebook’s own
42
PDF Page 44
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 43 of 53
witness stated that the materials were preserved with the help of “outside counsel”). If the
attorneys were just ignorant, that is almost as bad: it is reflective of Gibson Dunn’s “object first,
investigate later” strategy. Rather than determining whether Facebook could produce a small
number of tables that were likely to contain probative information, Gibson Dunn consistently
argued that Hive was totally inaccessible.
Equally troubling is the misconduct related to the Switchboard profiles. Facebook and
Gibson Dunn chose to produce the plaintiffs’ information in a difficult and obscure format.
Facebook’s own witness testified that Switchboard was “more usable”—and it contained
additional information—but Facebook and Gibson Dunn failed to disclose its existence for years.
Facebook and Gibson Dunn now assert that the Switchboard profiles are just as unwieldy
as DYI. Indeed, when Facebook produced the named plaintiffs’ Switchboard profiles, they had to
do so in multiple PDFs, including one that was 45,000 pages long. But that does not justify
Facebook and Gibson Dunn’s lack of candor. The plaintiffs consistently complained about the
difficulty in dealing with the DYI files, and they explicitly asked Facebook about the tools it
used to provide information to law enforcement. Dkt. Nos. 1060 at 26; 1103-9 at 95. Facebook
and Gibson Dunn never suggested there was another way to produce the plaintiffs’ information.
Even if Switchboard was unwieldy for different reasons, Facebook and Gibson Dunn could not
decide in secret that it was irrelevant.
More generally, Facebook and Gibson Dunn now argue that the plaintiffs elevate form
over substance, and that the information in Hive and Switchboard is duplicative or insignificant.
Even if that’s true, it was bad faith to argue that any additional discovery was not proportional to
the needs of the case, while withholding the fact that certain Hive tables and Switchboard
profiles were easily and readily accessible. It was not for Facebook and Gibson Dunn to
unilaterally decide the scope and extent of discovery. Moreover, Facebook and Gibson Dunn’s
arguments have always been a moving target. For every new deficiency in discovery, they’ve
offered a new excuse—and that makes it hard to credit their assertions now.
43
PDF Page 45
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 44 of 53
B. Other Evidence of Bad Faith
1.
Depositions
The plaintiffs have not sought sanctions for Facebook and Gibson Dunn’s conduct during
depositions, but that conduct underscores the conclusion that both the client and its lawyers were
operating in bad faith. There are a number of examples but suffice to highlight two.
The first involves the testimony of Jackie Chang and Simon Cross. Facebook’s internal
documents suggest that Chang was intimately involved in whitelisting, the process by which
apps were given ongoing access to friends’ information despite Facebook’s ostensible decision to
limit that access in 2014. When Facebook first developed the process of whitelisting, Chang was
a “strategic partner manager,” working closely with Facebook’s business partners. See Dkt. No.
1103-24 at 25. Emails from the time period suggest that Chang had a say in the whitelisting
process. Dkt. No. 1103-21 at 29–31; see also Dkt. No. 1103-24 at 169 (discussing an email
thread stating, “Jackie leading on putting together a new whitelist process with Legal and
Product”); Dkt. No. 1103-24 at 268–69 (discussing email thread stating that Chang was tasked
with “PR messaging” and “maintain[ing] relationships” prior to the conference at which
Facebook announced it would limit access to friends’ information). Chang also spent nine hours
with Gibson Dunn preparing for the deposition, and she was being deposed in connection with a
high-profile case involving data sharing. In that context, Chang’s statements that she did not
remember basic facts about Facebook’s data-sharing practices demonstrate Facebook’s bad faith.
Her demeanor throughout the deposition (which the Court watched) suggests that she did not
want to discuss her decision-making process because she was afraid of getting into trouble (or
getting Facebook into trouble).
But even if Chang miraculously remembered nothing about whitelisting—or the fact that
Facebook allowed apps to access friends’ information at all—she resisted more basic questions.
Although she was not a designated 30(b)(6) witness, she is still a Facebook employee. Her
obvious hostility to the litigation—and Facebook and Gibson Dunn’s failure to ensure that she
made a minimal effort to cooperate—is another example of the overall obstructionist approach.
44
PDF Page 46
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 45 of 53
And after Chang’s deposition, Cross compounded this problem by repeatedly telling the
plaintiffs to talk to Chang, even referring them to her to discuss an email thread he was included
on.12
The conduct of Facebook witness Allison Hendrix and Gibson Dunn attorney Robert
Blume was even worse. The Federal Rules of Civil Procedure require 30(b)(6) witnesses to give
“complete, knowledgeable, and binding answers” on the corporation’s behalf. Ecclesiastes 9:1011-12, Inc. v. LMC Holding Co., 497 F.3d 1135, 1146 (10th Cir. 2007). The witnesses must be
“unevasive.” Starlight International Inc. v. Herlihy, 186 F.R.D. 626, 639 (D. Kan. 1999).
Instead, Hendrix and Blume worked in concert to evade the plaintiffs’ questions. For his
part, Blume instructed Hendrix not to answer certain questions based on his view that the
questions were outside the scope of the deposition notice. As Facebook now acknowledges,
that’s an improper practice: if an attorney believes a question is outside the scope of a notice, the
attorney “shall state the objection on the record and the witness shall answer the question, to the
best of the witness’s ability.” Detoy v. City & County of San Francisco, 196 F.R.D. 362, 367
(N.D. Cal. 2000); see also Lykins v. CertainTeed Corp., 555 F. App’x 791, 797–98 (10th Cir.
2014); La Jolla Spa MD, Inc. v. Avidas Pharmaceuticals, LLC, No. 17-CV-1124-MMA(WVG),
2019 WL 4141237, at *7 (S.D. Cal. Aug. 30, 2019); Best Buddies Leasing, LLC v. Cabrillo
Yacht Sales, No. 07CV1121 BTM (AJB), 2009 WL 10671517, at *2 (S.D. Cal. Apr. 23, 2009);
Board of Trustees of Leland Stanford Junior University v. Tyco Int’l, Ltd., 253 F.R.D. 524, 527
(C.D. Cal. 2008); Dkt. No. 1052-2 at 40. But at the deposition, Blume instructed Hendrix not to
answer at least 22 times.
Blume also violated the Federal Rules of Civil Procedure by arguing his objections on the
12
Unlike Chang (and, as discussed later in this ruling, Hendrix), Cross did not come across as
openly hostile to the litigation, and much of his testimony seemed intended to be helpful. But he
was designated to testify about whitelisting, and Facebook and Gibson Dunn should have
ensured he was prepared to address Facebook’s internal communications about its decisionmaking process. That’s all the more true because the plaintiffs provided these documents in
advance of the deposition, and Facebook and Gibson Dunn knew that Chang had refused to offer
any insight into them.
45
PDF Page 47
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 46 of 53
record. During a deposition, counsel should “note[]” their objections, “but the examination still
proceeds; the testimony is taken subject to any objection.” Fed. R. Civ. P. 30(c)(2). And the
objections “must be stated concisely in a nonargumentative and nonsuggestive manner.” Id. In
blatant violation of this rule, Blume argued his objections, loudly and obnoxiously. This wasted
the plaintiffs’ deposition time—time limited by Court order. Moreover, these objections were
often frivolous. For instance, Hendrix was designated to discuss Facebook’s process of
developing privacy settings and controls; it was not outside the scope for the plaintiffs to ask her
about Facebook’s privacy shortcuts, especially when she had already testified about them.
These objections seemed intended to make it difficult or impossible for the plaintiffs to
obtain probative testimony about information that was obviously central to the case. For
instance, Hendrix testified that “friend permissions”—the ability of apps to access friends’
information—were “no longer a thing from a product perspective” after the “deprecation” of the
earlier developer interface. Dkt. No. 1085-22 at 228–29. It was reasonable for the plaintiffs to
follow up by asking about whitelisting. After all, whitelisted apps were able to access friend
permissions even after the transition to the new interface, and so the practice would seem to
contradict Hendrix’s testimony. But Blume interrupted this line of questioning by objecting.
Hendrix’s conduct, too, was totally inappropriate. Instead of testifying “unevasively,” as
a Rule 30(b)(6) witness is required to do, Hendrix refused to cooperate, even telling the plaintiffs
“no,” she would not unpack one of her answers. It seems that Blume used his objections to coach
Hendrix about his narrow view of the deposition notice. Hendrix then refused to answer
questions based on that narrow view—even in the absence of an objection. The tension in the
deposition reached its peak when Hendrix felt that the plaintiffs were asking repetitive questions
and responded that she would “do [her] own bitching and moaning” rather than waiting for her
lawyer to do it for her.
It is true that the 30(b)(6) deposition notice was written broadly, and it might be difficult
to prepare a witness given that breadth. And the plaintiffs’ questions were not always carefully
crafted. For instance, the plaintiffs asked Hendrix if she was aware of “the instances” in which
46
PDF Page 48
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 47 of 53
developers did not comply with Facebook’s terms, a question that could be interpreted as seeking
testimony about every single instance of noncompliance. Dkt. No. 1085-22 at 327. But, in line
with her duty to be cooperative, Hendrix could have offered representative examples—it was not
appropriate for her to “bitch and moan” instead.
Towards the end of Hendrix’s deposition, Special Master Garrie appeared to condone
Blume’s speaking objections by adjudicating them during the deposition. And he erroneously
stated that it was appropriate for Gibson Dunn to instruct Hendrix not to answer certain questions
as outside the scope of the notice. While this may have exacerbated the problems, it appears that
Special Master Garrie stepped in only after the deposition became so heated that it would have
otherwise fallen apart. The attorneys were already arguing over nearly every question; it seems
that Special Master Garrie thought that adjudicating the issues on the spot might help move the
deposition along. His actions—late in the deposition, after hours of argument—do not excuse
Facebook and Gibson Dunn’s misconduct.
Of course, Facebook and Gibson Dunn agreed to pay the plaintiffs’ attorney’s fees and
the Special Master’s fees associated with Hendrix’s deposition—presumably because it took
place after this Court had taken Facebook and Gibson Dunn to task for their behavior in this
case. And the plaintiffs have not sought sanctions for deposition misconduct more generally. But
that does not shield it from scrutiny as it relates to this sanctions motion. To the extent there
could be any doubt that Facebook and Gibson Dunn acted in bad faith with respect to discovery,
their conduct during the depositions helps put that doubt to rest.
2. Designation of Documents as Privileged
Finally, Facebook and Gibson Dunn’s over-designation of documents as privileged
supports the Court’s finding of bad faith. First, Facebook’s internal communications—although
not dispositive—suggest it has a culture hostile to litigation. It seems that Facebook employees
are taught to improperly “privilege” documents based on their perceived sensitivity.
Second, Gibson Dunn designated a massive number of documents as privileged, even
though for many of them it’s difficult to imagine any conceivable argument in support of that
47
PDF Page 49
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 48 of 53
assertion. Gibson Dunn’s only response is that nervous associates over-designated the documents
to avoid waiving privilege. But Gibson Dunn has an obligation to ensure that even its nervous
associates follow the law. The more likely explanation is that Facebook and Gibson Dunn had
backed themselves into a corner: After delaying production for years, they were forced to meet
this Court’s deadlines, and they took the shortcut of over-designating documents rather than
reviewing them properly.
Although Facebook and Gibson Dunn revisited these privilege designations and produced
a significant number of documents, they did so only after the plaintiffs requested it (and after the
Court told the plaintiffs that their complaints should be made in a motion for sanctions). While
the Court will not order payment of attorney’s fees for this conduct, it further supports the
conclusion that Facebook and Gibson Dunn operated in bad faith.
IV
Confronted with the totality of their conduct, Facebook and Gibson Dunn offer no
convincing explanation. Predictably, they lead with the notion that the problems in this case were
largely the fault of plaintiffs’ counsel. They say plaintiffs’ counsel asked for too much and
refused to narrow their requests, engaging in dilatory discovery misconduct of their own. The
Court will assume, solely for the sake of adjudicating this motion, that there is some truth to
these assertions.
Even so, the alleged misconduct of plaintiffs’ counsel would not come close to excusing
that of Facebook and Gibson Dunn. No matter the conduct of the opposing party, counsel cannot
twist their words—not to mention the words of the Court—in support of frivolous arguments.
They cannot resist the disclosure of obviously discoverable information. They cannot ignore
potential sources of evidence, only for opposing counsel to learn about those sources at a
30(b)(6) deposition near the close of discovery. They cannot treat depositions like fighting
matches. And they cannot encourage their client’s obstinance—no matter how difficult the
subject matter, and no matter how imprecise the other side’s questions might be.
It’s worth remembering that Facebook and Gibson Dunn had superior access to all the
48
PDF Page 50
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 49 of 53
evidence needed in this case. How were the plaintiffs supposed to know what specific
information Facebook collected about them or shared with third parties? How were they to know
what apps their Facebook friends had downloaded, and what permissions those apps had
requested? How were they to know about Facebook’s confidential relationships with its business
partners? Through discovery, the plaintiffs were entitled to this evidence—that is the whole point
of civil discovery.
Facebook and Gibson Dunn also nitpick Judge Corley and Special Master Garrie’s
discovery orders, looking for any potential ambiguity to justify their conduct. As already
discussed, Facebook and Gibson Dunn’s interpretations of these orders were often laughable. But
their nitpicking is also part of a larger problem. Sometimes discovery violations are blatant: a
client shreds a crucial document or threatens the opposing party. Much of the discovery
misconduct here was more insidious. No court ruling can ever be completely clear, addressing
every conceivable aspect of discovery. Discovery—and the court system as a whole—depend on
the good faith of the parties. Counsel must reasonably interpret a court’s orders and seek
clarification when needed. Facebook and Gibson Dunn did the opposite: they pounced on slight
ambiguities (or fabricated ambiguities) and used them to obfuscate and obstruct discovery for
years.
Facebook and Gibson Dunn also emphasize how difficult this case has been to litigate,
given the technical complexities involved. It’s true that this was a complex case, and complexity
will often result in mistakes and miscommunication. But that’s not what this sanctions ruling is
about. It is about delay and unnecessary expense resulting from repeated frivolous arguments,
obfuscation, and reflexive opposition.
Finally, Facebook and Gibson Dunn do some obligatory sword-falling, apologizing for
their “role” in the combat and emphasizing that their behavior improved after this Court began
threatening sanctions in February 2022. That argument warrants two responses. First, although
their conduct did improve, it went from an F to perhaps a D. Facebook and Gibson Dunn became
more responsive and proactive in handling document discovery. But much of their deposition
49
PDF Page 51
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 50 of 53
misconduct occurred after February 2022, as did the massive privilege over-designation. Second,
even accepting that their conduct changed, sanctions would still be warranted for their earlier
behavior. In many cases, when attorneys and their clients improve after receiving a warning,
leniency is warranted. This is not one of those cases.
The Court reaches this conclusion after reflecting (at considerable length) on what might
have motivated Facebook and Gibson Dunn to conduct themselves as they did. There’s a small
chance, of course, that Facebook and Gibson Dunn were just overly zealous. And perhaps there’s
some minute chance that they were just incompetent. But when you consider the context, it’s far
more likely that the misconduct was of a different, more nefarious sort. Recall that Facebook was
being sued for conduct that was the subject of a major scandal, a scandal for which the company
issued numerous public apologies. Recall that the Federal Trade Commission brought an action
against Facebook in the wake of the scandal, and that Facebook paid $5 billion to settle the
matter. In this case, Facebook sought dismissal at an early stage, but that attempt was
unsuccessful. After publicly apologizing, paying a massive penalty to the FTC, and losing that
early motion, does anyone really think that Facebook was planning on taking this case to trial?
Or was Facebook, with the assistance of its lawyers, executing a different play from the
playbook: resist discovery as long as possible, make things increasingly difficult and expensive
and frustrating for the opposition, and hope that would drive down the case’s settlement value?
This is, by far, the most likely explanation for Facebook and Gibson Dunn’s conduct.
This is not to suggest that there necessarily was some back-room meeting at which
Facebook and its lawyers said, “Ok, here’s the plan, let’s be as unreasonable and obstructionist
as possible in the hope that we’ll frustrate the plaintiffs into settling for less than they could get if
we were cooperative in discovery.” Unfortunately, this approach to litigation is common enough
that no such meeting was necessary. Facebook and its lawyers fell into their roles with ease, and
then they took things way too far. For the systematic, conscious, bad-faith approach they took to
this litigation, Facebook and Gibson Dunn must be sanctioned.
50
PDF Page 52
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 51 of 53
V
The plaintiffs have complained of several categories of misconduct, but as explained, the
Court will only sanction Facebook and Gibson Dunn for the most serious: the misconduct related
to the App Developer Investigation and the named plaintiff data. The plaintiffs seek
$2,037.540.28 in sanctions related only to those two categories.13 If the Court were to sanction
Facebook and Gibson Dunn for everything else the plaintiffs point to, the amount would
certainly be much higher.
The plaintiffs request $1,773,042.50 in fees, including the fees incurred in moving for
sanctions.14 The plaintiffs also seek $264,497.78 in costs for the fees paid to mediator Judge
Andler and Special Master Garrie.
As explained in Section II, a court may only award fees and costs “incurred because of
the misconduct at issue.” Goodyear, 581 U.S. at 108; see also Blixseth, 854 F.3d at 631
(explaining that fees incurred in moving for sanctions necessarily meet that standard). But lower
courts need not “become green-eyeshade accountants” when assessing sanctions. Goodyear, 581
U.S. at 110 (quoting Fox, 563 U.S. at 838). “The essential goal in shifting fees is to do rough
justice, not to achieve auditing perfection.” Id. (quoting Fox, 563 U.S. at 838) (quotations
omitted).
The only way to award sanctions here is with a rough-but-conservative estimate. First,
the Court will deduct $187,383.27 in fees and costs associated with the App Developer
Investigation that were incurred before Judge Corley rejected Facebook’s blanket assertion of
privilege on September 9, 2021.15 Although the plaintiffs argue that Facebook and Gibson Dunn
engaged in misconduct before September 9, 2021, this ruling focuses primarily on their behavior
The plaintiffs’ motion for leave to file a reply in support of the amount of sanctions is granted.
See Dkt. No. 1090.
14
In all, the plaintiffs spent even more moving for sanctions—a whopping $1,156,127.50—but
they estimate that $693,676.50 was related to ADI and the named plaintiff data specifically.
15
In their request for costs related to discovery mediation, the plaintiffs did not distinguish
between costs related to the named plaintiff data and costs related to ADI. In an abundance of
caution, the Court will assume all of the costs for discovery mediation incurred prior to
September 9, 2021 were associated with ADI.
13
51
PDF Page 53
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 52 of 53
afterwards, and so it would not be appropriate to impose sanctions for the ADI-related fees and
costs incurred prior to Judge Corley’s decision.
Beyond that, given the pervasive nature of Facebook and Gibson Dunn’s misconduct, it is
nearly impossible to disentangle the work that was caused by the misconduct from the work that
would have been done anyway. In an abundance of caution (and after considering Facebook’s
arguments regarding the reasonableness of the fees and costs), the Court will cut the plaintiffs’
remaining request in half. The plaintiffs are therefore awarded $800,217.38 in fees and
$124,861.13 in costs for a total of $925,078.51. This amount likely represents just a portion of
the fees and costs reasonably incurred because of Facebook and Gibson Dunn’s misconduct
related to discovery on ADI and the named plaintiff data. While the amount is almost certainly
under-compensatory, there is no chance that it’s over-compensatory. Given the limits on the
authority of courts to impose sanctions, it is better to err on the side of caution.
One more point: Facebook and Gibson Dunn argue that the plaintiffs’ supplemental brief
on the amount of fees and costs raises “serious due process concerns.” They argue that they have
not had “a full and fair opportunity to address the…question [of] whether Plaintiffs are even
entitled to their newly requested fees and costs—for example, whether those fees are attributable
to misconduct.” But the vast majority of Facebook and Gibson Dunn’s supplemental brief
addressed that very question. Indeed, Sections I and II are entitled: “Plaintiffs Have Failed to
Demonstrate That Any ADI Fees or Costs Resulted from the Alleged Misconduct,” and
“Plaintiffs Have Failed to Demonstrate That Any Fees or Costs Associated with NP Data
Resulted from Alleged Misconduct.”
Facebook and Gibson Dunn also argue that the plaintiffs’ supplemental briefs include
fees and costs not addressed in their original motion. But Facebook and Gibson Dunn’s due
process rights are not violated merely because the Court allowed the parties to submit
supplemental briefing. See, e.g., True Health Chiropractic Inc v. McKesson Corp., No.
13CV02219HSGDMR, 2015 WL 3453459, at *1–2 (N.D. Cal. May 29, 2015) (granting motion
for sanctions and then allowing plaintiffs to file a motion substantiating the fees). Facebook and
52
PDF Page 54
Case 3:18-md-02843-VC Document 1104 Filed 02/09/23 Page 53 of 53
Gibson Dunn are entitled to notice and an opportunity to be heard on both the misconduct and
the appropriate amount of sanctions. F.J. Hanshaw Enterprises, Inc., 244 F.3d at 1143. That
standard is easily met here. In all, Facebook and Gibson Dunn have provided the Court with
almost 150 pages of briefing in opposition to these sanctions. That doesn’t include the hundreds
of pages of exhibits submitted in support of their briefs. In response to the plaintiffs’
supplemental submission on the amount of sanctions specifically, Facebook and Gibson Dunn
provided a 27-page brief and a 488-page expert analysis of the requested fees.
VI
Facebook and Gibson Dunn are ordered to pay the plaintiffs $925,078.51 in sanctions.
They are jointly and severally liable for this amount, and they must compensate the plaintiffs
within 21 days of this ruling. To be sure, this amount is loose change for a company like
Facebook, and even for a law firm like Gibson Dunn. But it’s important for courts to help protect
litigants from suffering financial harm as a result of their opponents’ litigation misconduct. And
hopefully, this ruling will create some incentive for Facebook and Gibson Dunn (and perhaps
even others) to behave more honorably moving forward.
IT IS SO ORDERED.
Dated: February 9, 2023
______________________________________
VINCE CHHABRIA
United States District Judge
53
Back to 
