In re Facebook, Inc., Consumer Privacy User Profile Litigation Document 1104: Order on Motion for Sanctions

Page 1

UNITED STATES DISTRICT COURT
NORTHERN DISTRICT OF CALIFORNIA
IN RE: FACEBOOK, INC. CONSUMER
PRIVACY USER PROFILE
LITIGATION,

Case No. 18-md-02843-VC This document relates to:

ORDER GRANTING IN PART
PLAINTIFFS’ MOTION FOR
SANCTIONS
ALL ACTIONS

Re: Dkt. Nos. 879, 1007-3 This case is an example of a wealthy client (Facebook) and its high-powered law firm (Gibson Dunn) using delay, misdirection, and frivolous arguments to make litigation unfairly difficult and expensive for their opponents. Unfortunately, this sort of conduct is not uncommon in our court system. But it was unusually egregious and persistent here. To give just a few examples:

• The central allegation in this case is that Facebook shared the plaintiffs’ private information with other companies. But Facebook insisted that: (1) it need not disclose to the plaintiffs what information it had collected about them unless it had shared that information with third parties; and (2) the plaintiffs were required to take at face value Facebook’s assertions about what information it had shared. Merely reciting this argument shows how ridiculous it is, but Facebook and Gibson Dunn repeated it over, and over, and over again—despite the presiding magistrate judge telling them many times that it made no sense.

• In the wake of the Cambridge Analytica scandal, Facebook investigated other apps that might have misused private user information. After the magistrate judge ruled that the investigation was not privileged as a blanket matter, Facebook and Gibson Dunn insisted that non-lawyer communications created in the course of that investigation (such as internal emails between Facebook employees) need not be produced. It was obvious at the time that these documents were likely to be probative, and that view has only been confirmed now that Facebook has finally been forced to produce them. Perhaps realizing

Page 2

they had no real argument for withholding these documents, Facebook and Gibson Dunn contorted various statements made by opposing counsel and the magistrate judge beyond recognition, using them to argue that everyone had already agreed that Facebook need not produce the communications—even as the plaintiffs continued to demand them. And again, after being told repeatedly that these arguments made no sense, Facebook and Gibson Dunn insisted on pressing them.

•

Facebook’s witnesses and lawyers deliberately prevented the plaintiffs from obtaining probative information during depositions. For example, during a deposition of one Facebook employee whom Facebook designated to testify about the company’s information-sharing practices, a Gibson Dunn lawyer instructed the witness not to answer at least 22 times, asserting that the questions were beyond the scope of the deposition notice. Many of these questions were obviously within the scope of the notice. But more to the point, as Facebook and Gibson Dunn now concede, it is improper to instruct a corporate witness not to answer a question based on scope. The witness herself emulated her lawyer’s belligerence, refusing to answer questions without even waiting for an objection. Eventually, the deposition became so hostile that the witness stated she would do her own “bitching and moaning” about the plaintiffs’ questions.

•

All the while, Facebook and Gibson Dunn had the audacity to accuse the plaintiffs’ lawyers of delaying the case, and to assert that the plaintiffs’ reasonable efforts to obtain obviously relevant discovery were frivolous. It’s almost as if Facebook and Gibson Dunn spent the better part of three years trying to gaslight their opponents, not to mention the Court.

Sometimes lawyers and their clients engage in conduct of this sort because they are

incompetent. Facebook and Gibson Dunn are not incompetent. Sometimes lawyers reflexively oppose the other side’s requests without giving any thought to their actions. That does not seem like Facebook and Gibson Dunn. Instead, the Court finds by clear and convincing evidence that Facebook and Gibson Dunn’s conduct reflected a sustained, concerted, bad-faith effort to throw obstacle after obstacle in front of the plaintiffs—all in an attempt to push the plaintiffs into settling the case for less than they would have gotten otherwise. The plaintiffs are entitled to recover $925,078.51 for the fees and costs they incurred responding to this misconduct. Facebook and Gibson Dunn are jointly liable for this amount.

I During the 2016 presidential election, Cambridge Analytica, a British consulting firm, sent targeted political ads to voters using personal information gleaned from millions of

Page 3

Facebook accounts. Cambridge Analytica had purchased the information from Aleksandr Kogan, a data scientist at the University of Cambridge. Kogan was able to collect this information through an app he launched on Facebook’s platform. The app interacted with Facebook users and gave Kogan access to their personal information, as well as the personal information of their Facebook friends. Through this process, Kogan was able to compile a dataset that included information on 87 million Facebook users—even though only around 300,000 users had downloaded the app.

Following the scandal, reports emerged suggesting that the ability of people like Kogan and entities like Cambridge Analytica to obtain sensitive information was the norm rather than the exception. In response, the Federal Trade Commission launched an investigation into whether Facebook’s practices violated a 2012 consent decree that required Facebook to maintain a reasonable privacy program and prohibited the company from making misrepresentations about the privacy and security of users’ information. Facebook ultimately settled the matter, agreeing to pay a $5 billion fine and to modify its corporate structure to better protect users’ privacy.1 Facebook and its executives also issued a number of public apologies. CEO Mark Zuckerberg acknowledged that the scandal was a “major breach of trust,” and he was “really sorry” that it happened.2 Zuckerberg and Facebook took out full-page ads in ten newspapers repeating that apology.3 Facebook’s then-COO Sheryl Sandberg echoed that message, saying that Facebook should have “taken…steps years ago” to prevent abuse on the platform and acknowledging that Facebook “made some really bad mistakes.”4 Dozens of private lawsuits were also filed by Facebook users against the company, and

FTC Imposes $5 Billion Penalty and Sweeping New Privacy Restrictions on Facebook, Federal Trade Commission (July 24, 2019), https://perma.cc/2WPY-JZNY.

Eli Meixler, ‘We Have a Basic Responsibility to Protect Peoples’ Data.’ Mark Zuckerberg Addresses Data Crisis, Time (March 21, 2018), https://perma.cc/35FL-SHJD. Nick Statt, Mark Zuckerberg Apologizes for Facebook’s Data Privacy Scandal in Full-Page Newspaper Ads, The Verge (March 25, 2018), https://perma.cc/9NUG-SGUQ.

Steve Inskeep, Full Transcript: Facebook COO Sheryl Sandberg on Protecting User Data, NPR (April 5, 2018), https://perma.cc/3SWC-LXUP.

Page 4

the cases were assigned to this Court for pretrial proceedings.5 The Court then appointed two attorneys to serve as lead plaintiffs’ counsel, and those attorneys filed a consolidated class action complaint, asserting a variety of claims under federal and state law. The complaint was filed on behalf of roughly three dozen individual Facebook users. These “named plaintiffs” proposed to represent a class of all Facebook users whose personal information was improperly disseminated or inadequately protected by Facebook from 2007 to the present.

The lawsuit alleged that Facebook allowed app developers operating on the company’s platform to ask users for permission to access their friends’ personal information, and that this practice allowed the apps to collect vast amounts of the friends’ information without their consent. Around 2014, Facebook decided to limit app developers’ ability to access users’ friends’ information, but the plaintiffs alleged that Facebook gave certain preferred apps— sometimes described as “whitelisted apps”—continued access based on concerns about Facebook’s bottom-line.

The plaintiffs also focused on another information-sharing program: Facebook’s relationship to its “business partners.” These business partners included companies hired to build Facebook’s platform on different devices and for different operating systems (like a Facebookbranded app for a Blackberry phone). According to the plaintiffs, Facebook shared information about users and their friends with these (and other) business partners in exchange for personal information collected by those business partners. As with the app developers, the plaintiffs alleged that Facebook did not adequately disclose to its users this practice of trading their personal information.

Finally, the plaintiffs alleged that Facebook failed to control and monitor app developers’ and business partners’ use of all this information. Although Facebook had a policy prohibiting app developers from using the information for any purpose other than improving their app, the 5

When multiple, similar lawsuits are filed in federal courts across the country, the cases may be referred to the Judicial Panel on Multidistrict Litigation. The panel then decides whether to transfer the suits to a single federal judge for pretrial proceedings. Here, the panel determined that such a transfer was warranted, and it assigned all the lawsuits to this Court.

Page 5

plaintiffs alleged that Facebook did nothing to enforce this policy. If Facebook had actually enforced this policy, the plaintiffs contended, Kogan would not have been able to sell his dataset to Cambridge Analytica, and countless other apps would not have been able to misuse the personal information they collected.

In 2019, Facebook moved to dismiss the complaint. Although this Court dismissed a few claims, it rejected the majority of Facebook’s arguments and allowed the case to proceed. See generally In re Facebook, Inc., Consumer Privacy User Profile Litigation, 402 F. Supp. 3d 767 (N.D. Cal. 2019).

The parties then began discovery, the process by which civil litigants can ask their adversaries (and sometimes third parties) to give them potentially relevant and non-privileged information. The basic philosophy underlying discovery is that claims should be litigated based on a complete record of the underlying facts. See Hickman v. Taylor, 329 U.S. 495, 507 (1947). By allowing litigants to access evidence prior to trial, discovery narrows the issues, eliminates the possibility of unfair surprise, and—most importantly—ensures that trials “achieve substantial justice.” Greyhound Lines, Inc. v. Miller, 402 F.2d 134, 143 (8th Cir. 1968). In November 2019, the plaintiffs sent Facebook various requests for discovery. See Dkt. No. 1087-10. For example, the plaintiffs (that is, the named plaintiffs) sought all the information Facebook had collected about them. The plaintiffs also sought information from Facebook’s investigation into apps that had potentially misused users’ information, which Facebook called the “App Developer Investigation” or “ADI.” Facebook produced some information in response to these requests. But in the following years, the parties fought over what else Facebook should be required to produce.

By March 2020, this Court determined that it was not in the best position to adjudicate the parties’ growing number of discovery disputes, and it referred the parties to then-Magistrate Judge Jacqueline Scott Corley for discovery. Before doing so, the Court expressed concern about

Page 6

Facebook’s “unduly narrow view” of discovery. Dkt. No. 1087-44 at 29–30.6 “This is a big case,” the Court explained, so Facebook should be careful before making any arguments that discovery was “just too expensive or difficult.” Dkt. No. 1087-44 at 30. Gibson Dunn attorney Orin Snyder sought to assuage the Court’s concerns: “If I was there, I would look you in the eyes. I’m telling you, Judge, we are not only acting in good-faith; we are eager to produce documents, whatever the expense, that are relevant to the issues in this case.” Dkt. No. 1087-44 at 30. He continued: “I am confident, Your Honor, that when you see our performance on the issues in this case in terms of our production of documents, you will have no basis for concern because we want to get on with it…[W]e think those documents actually are the key to us winning.” Dkt. No. 1087-44 at 31–32.

In the following months, however, discovery remained contentious. Facebook repeatedly insisted that it did not need to produce all the information it had collected about the named plaintiffs. In the fall of 2020, Judge Corley rejected Facebook’s view of discovery, holding that “discoverable” data included a wider set of information than Facebook had argued. But, as discussed more fully below, the fighting on this issue continued.

The parties also had an ongoing disagreement over whether Facebook should be required to produce materials related to its App Developer Investigation. Facebook argued that the documents were produced in anticipation of litigation and involved legal advice, and so they were protected by privilege. In the fall of 2021, Judge Corley held that the investigation was not privileged. But again, the fighting continued.

Eventually, Judge Corley suggested that the parties engage a discovery mediator to help resolve their ongoing disputes. See Dkt. No. 632. The parties selected retired Judge Gail Andler, and she then brought in her colleague Daniel Garrie, in part to address the technical aspects of discovery. Dkt. Nos. 646; 914 at 5. In July 2021, at the parties’ request, the Court appointed

6

When a document is e-filed, the Electronic Case Filing system adds page numbers to a header at the top of the document. All cites included in this opinion reference the pages as numbered in that header, rather than any page numbers native to the document.

Page 7

Garrie as a Special Master with the power to issue discovery orders appealable only to Judge Corley. Dkt. No. 709 at 1.

By February 2022—two and a half years into discovery—countless hours had been spent adjudicating discovery disputes, and the litigation appeared to be going nowhere. Based on a preliminary review of the record, it appeared to this Court that Facebook and Gibson Dunn were to blame. At a status conference that month, the Court had strong words for Facebook and Gibson Dunn. The plaintiffs had previously complained about Facebook and Gibson Dunn’s misconduct and asked for the deadlines for discovery to be continued. But the Court expressed concern that the litigation would go nowhere if it kept granting these continuances. The Court suggested instead that the plaintiffs move for sanctions. Dkt. No. 847. This motion followed. Then, in August 2022, the parties notified the Court that they had settled the lawsuit. The Court stayed the litigation in light of the settlement, but the sanctions motion remained pending. In their briefs, the plaintiffs complain of a wide range of misconduct by Facebook and Gibson Dunn. It is sufficient for purposes of this ruling to focus on the four areas where the record is clearest: (1) the plaintiffs’ attempts to obtain materials related to Facebook’s App Developer Investigation; (2) their attempts to identify the information Facebook had collected about them; (3) Facebook and Gibson Dunn’s conduct during depositions; and (4) Facebook and Gibson Dunn’s over-designation of documents as privileged.

A.

App Developer Investigation

To understand the dispute about the App Developer Investigation, it’s helpful to have some background about the evolution of Facebook’s relationship with third-party app developers. From 2010 to 2014, app developers used something called the “Graph Application Programming Interface,” also known as API, to receive data from Facebook users and to write to Facebook on those users’ behalf. Dkt. No. 326 at 4. Through this API, an app could access “friend permissions,” meaning the apps could access personal information about the app users’ Facebook friends (like a friend’s Facebook status or location or religion). Dkt. Nos. 1085-36 at 28; 1103-16 at 5–6.

Page 8

In 2014, in response to public criticism of its information-sharing practices, Facebook adopted a new API (version 2) to replace the earlier version. See Dkt. No. 326 at 5. To use Facebook’s language, it “deprecated use of Graph API v1” and adopted “Graph API v2.” Dkt. No. 326 at 5. According to Facebook, this new API did not allow apps to access friend permissions.7 Dkt. No. 326. But as discussed more fully below, Facebook now concedes that some apps were able to use the old API even after 2014, and so those apps continued to have access to friend permissions. Dkt. No. 326 at 5. These were known as “whitelisted” apps. In 2018, four years after the transition to the new API, the Cambridge Analytica scandal broke. Facebook responded by launching an investigation into apps that had access to large amounts of user data before the 2014 interface change. Dkt. No. 736 at 1. Gibson Dunn led the investigation with help from two forensic consulting firms. Overall, Facebook said, the investigation “involved hundreds of people: attorneys, external investigators, data scientists, engineers, policy specialists, platform partners and other teams across the company.” Dkt. No. 736 at 5. When it began, Facebook said the investigation would help it “better understand patterns of abuse in order to root out bad actors among developers” and restore trust in the company. Dkt. No 736 at 5.

The investigation was divided into three phases: (1) detection and identification, (2) enhanced examination, and (3) enforcement. Dkt. No. 736 at 2. During phase one, Facebook (and its consultants and attorneys hired to help) identified apps that posed a high-risk of data misuse and flagged those apps for further inquiry. Dkt. No. 699-5 at 6–8. In phase two, the ADI forensics team prepared reports analyzing the potential for data misuse, given factors like the sensitivity of the information that the apps could access. Dkt. No. 699-5 at 8. During the final phase, Facebook decided whether to take any enforcement actions against the identified apps, including possible suspension. Dkt. No. 699-5 at 8–9. To determine whether such action was To be precise, the new API did not entirely limit access to friends’ information more broadly. For instance, Graph API v2 still allowed apps to request access to things like “user_posts,” which would include access to friends’ likes and comments on those posts. Dkt. No. 1085-36 at 112.

7

Page 9

necessary, there could be additional investigations, including interviews and audits of the apps’ data security and storage infrastructure. Dkt. No. 699-5 at 9.

A few examples of the investigation documents are illustrative. Take one memo about an app called Sync.Me. See Dkt. No. 1103-16. The memo states that the app was “overpermissioned and had access to many ‘heavyweight’ permissions,” including the user’s entire newsfeed, friends’ likes, friends’ statuses, and friends’ hometowns. Dkt. No. 1103-16 at 3, 5–6. The memo also notes that around 9 million users may have granted the app permission to access “friends_location.” Dkt. No. 1103-16 at 5–6. These permissions “appear to be out of scope for the use case of the App.” Dkt. No. 1103-16 at 6. Furthermore, the memo notes, even after Facebook transitioned to the new developer interface (limiting access to friend permissions), the app used a method “that Facebook described as a potential workaround for accessing friend’s information despite the reduced set of permissions.” Dkt. No. 1103-16 at 3.

Or take another memo about the app developer Microstrategy, Inc. It states that Microstrategy’s apps “collected vast quantities of highly sensitive user and friends permissions,” including “highly valuable [data] with many parallels drawn between the data collected…and that of Cambridge Analytica.” Dkt. No. 1103-7 at 8. The memo includes estimates from news articles suggesting that, although only around 50,000 users had installed one of Microstrategy’s apps, the app could access data from 16 to 20 million people. Dkt. No. 1103-7 at 7. One of Microstrategy’s apps made “roughly 74 million API calls [requests for information from the interface] per month—a volume few apps achieve, even over years of operation.” Dkt. No. 11037 at 8. Another Microstrategy app was installed by only around 400 users, but it made “millions of API calls throughout its lifecycle,” likely “as a means of collecting additional data points” not handled through Microstrategy’s primary app. Dkt. No. 1103-7 at 8.

And one more memo about a Yahoo app. See Dkt. No. 1103-8 The memo explains that close to 150 million users installed the app, and that it made “billions of requests” for user information. Dkt. No. 1103-8 at 3. The app had access to personal information about those users’ friends, including the friends’ education histories, work histories, religions, politics, “about me”

Page 10

sections, relationship details, and check-in posts. Dkt. No. 1103-8 at 8. The app could also access a user’s inbox, thus accessing private messages between that user and their friends. Dkt. No. 1103-8 at 3. Because many of the API requests gave “no visibility into the endpoints accessed,” it was possible that the app “accessed more sensitive user or friends’ data than can be detected.” Dkt. No. 1103-8 at 3. The memo explains that the app was “whitelisted by Facebook and therefore was granted extended access” to the earlier developer interface “for an indeterminate period of time.” Dkt. No. 1103-8 at 3. Given this “whitelisted status,” the app was able to continue retrieving content from users’ newsfeeds, making “bulk” requests for information, and “leveraging” earlier permissions to access information, even after Facebook transitioned to API v2 in 2014. Dkt. No. 1103-8 at 3. The record is replete with other examples of these memos containing information that is highly probative of the plaintiffs’ claims. See, e.g., Dkt. Nos. 1103-15; 1103-16; 1103-17; 1103-18.

In November 2019, the plaintiffs asked for documents related to the investigation. Dkt. No. 1087-10 at 15. The parties fought over that request for years. Many of the parties’ disputes centered around two categories of documents. First, Facebook and Gibson Dunn refused to produce investigation materials, including memos, reports, audits, and developer interviews prepared during the last two phases of the investigation—the phases in which Facebook investigated the apps and decided whether to bring any enforcement actions against them. See Dkt. No. 736 at 2. The memos discussed above would fall into that category. And second, Facebook and Gibson Dunn refused to produce certain communications regarding those materials, including internal communications among Facebook’s employees and communications between those employees and Facebook’s forensic consultants. See Dkt. Nos. 699 at 5; 788-3 at 425–26.

Facebook and Gibson Dunn began by taking the position that the entire investigation was covered by attorney-client and work-product privilege. Attorney-client privilege protects certain communications between a client and their attorney. Upjohn Co. v. United States, 449 U.S. 383, 389 (1981). But a party cannot simply “cc” their attorney to privilege a document—they must be

Page 11

communicating with their attorney in order to receive legal advice. In re Avantel, S.A., 343 F.3d 311, 321 n.11 (5th Cir. 2003); Meade v. General Motors, LLC, 250 F. Supp. 3d 1387, 1391–93 (N.D. Ga. 2017). Work-product privilege, in turn, is not just limited to communications: it covers all documents “prepared by a party or [their] representative in anticipation of litigation.” United States v. Richey, 632 F.3d 559, 567 (9th Cir. 2011) (quoting Admiral Insurance Co. v. United States District Court, 881 F.2d 1486, 1494 (9th Cir. 1989)). Where a document is not “prepared exclusively for litigation”—meaning it has a “dual purpose”—it is protected by work-product privilege only if it “would not have been created in substantially similar form but for the prospect of litigation.” Id. at 568 (quoting In re Grand Jury Subpoena, Mark Torf/Torf Environmental Management, 357 F. 3d 900, 907 (2004)). That is to say, if the document would have been prepared even in the absence of litigation, then it is not protected by work-product privilege. After asserting that the documents were privileged, Facebook and Gibson Dunn asked to delay briefing on the issue. In the spring of 2020, the plaintiffs asked to set a schedule for briefing, but Facebook said “there [was] no urgent need…and [the issue] should be briefed (if at all) at a later date.” Dkt. No. 449 at 4. In a later status report, Facebook refused to take a position on exactly what documents it would produce. It stated that it did not “categorically object to producing materials from [the] investigation,” so long as those documents were “not privileged”—without clarifying which documents it believed were privileged. Dkt. No. 471 at 8. In July 2020, early on in discovery, Judge Corley expressed doubts that the investigation was privileged, but she noted there were “arguments both ways.” Dkt. No. 476 at 36. To analyze the question in context, Judge Corley decided to review a sample of investigation documents based on six “exemplar apps.” Dkt. No. 476 at 36–37; see generally Dkt. No. 533. Facebook then gathered documents related to those apps and gave the plaintiffs a log that identified all the documents it believed were privileged. Dkt. No. 914 at 10. Without the benefit of actually seeing the documents, the plaintiffs chose twenty from the log and submitted them to Judge Corley to review. Dkt. No. 914 at 10.

By April 2021, Judge Corley had reviewed the twenty documents and expressed her

Page 12

“tentative view” that the investigation as a whole was not privileged. Dkt. No. 657 at 16. As she put it, it was inconceivable that Facebook would not have launched the investigation even in the absence of litigation, and so the investigation as a whole was not protected by work-product privilege. Dkt. No. 657 at 16. She also alluded to Facebook and Gibson Dunn’s arguments about attorney-client privilege: while Gibson Dunn’s specific legal advice might be protected, the facts discovered in the investigation would not be. Dkt. No. 657 at 24.

That said, Judge Corley noted that the plaintiffs did not need “every single document.” Dkt. No. 657 at 17. For instance, as she explained, the plaintiffs did not need to know exactly when Facebook requested certain information from the app developers or when it received a response. Dkt. No. 657 at 18. The plaintiffs agreed: they were seeking information about the facts underlying the investigation. Dkt. No. 657 at 18. That included facts about Facebook’s “thought process” because that “relate[d] to whether or not [Facebook was] actually and accurately monitoring the disclosure of this information.” Dkt. No. 657 at 20. Judge Corley repeated that the plaintiffs did not need, for instance, scheduling emails among Facebook employees, but rather wanted “the facts…just…what’s in the report.” Dkt. No. 657 at 26. Given the discussion, Judge Corley decided to defer ruling on the privilege question so that the parties could meet and confer about narrowing the plaintiffs’ request for production (or, if they could not agree, submitting affidavits in support of their positions). Dkt. No. 655 at 1. After the hearing, the parties negotiated the scope of production, and the plaintiffs did narrow their requests. See Dkt. No. 915-1. But that negotiation was hampered by Facebook and Gibson Dunn’s continued assertion of attorney-client and work-product privilege. For instance, as part of their narrowed request, the plaintiffs sought information about the phase of ADI that each app fell under and the “reasons for elevation” (meaning the reasons Facebook chose to investigate the apps further). Dkt. No. 1087-15 at 1. Facebook continued to take the position that that information—and much of the other information the plaintiffs sought—was “categorically privileged.” Dkt. No. 1087-15 at 1.

After the parties could not come to an agreement on a narrower production, Judge Corley

Page 13

ordered them to submit a joint letter brief on the issue. Dkt. No. 693. Facebook argued that the plaintiffs were entitled only to the names of the apps that might have misused user data and the information the apps might have accessed. Dkt. No. 699 at 2. Facebook also pointed to the plaintiffs’ earlier statement that they wanted only the “facts” underlying Facebook’s investigation. Dkt. No. 699 at 2. Based on that statement, Facebook argued that the plaintiffs could not ask for the memos discussed above or for Facebook’s own internal deliberations about its investigation and enforcement decisions. And based on that same statement—as well as the plaintiffs’ statement that they did not want administrative emails—Facebook insisted that the plaintiffs had conceded that they did not need any “emails among Facebook employees” at all. Dkt. No. 699 at 2.

The plaintiffs argued that the investigation materials—including, potentially, internal communications—were directly relevant to their claims. To the plaintiffs, the information about app misuse was not useful without “proper context, including the discussions and actions taken in response to this gathered information.” Dkt. No. 699 at 6. They believed that the investigation documents and communications would reveal Facebook’s internal knowledge and deliberations about the threats that these apps posed to users’ privacy. Dkt. No. 699 at 6. And, the plaintiffs argued, these materials would shed light on Facebook’s decision to investigate suspicious apps— or not. Dkt. No. 699 at 6.

In September 2021, almost two years after the plaintiffs’ first request for ADI documents, Judge Corley held that the investigation was not covered by a blanket assertion of privilege. She found Facebook’s assertion of attorney-client privilege to be “unpersuasive given that Plaintiffs [were] not seeking documents created by counsel, counsel’s edits, or any communications with counsel.” Dkt. No. 736 at 6. “At best,” she explained, the ADI materials “would be attorney work product.” Dkt. No. 736 at 6. And, she held, they were not because they would have been created absent any litigation. Dkt. No. 736 at 5. She explained, “Facebook’s assertion that the ADI served only a litigation purpose…[was] patently implausible in light of Facebook’s public pronouncements.” Dkt. No. 736 at 5. Facebook’s “assertion could only be true if the Court found

Page 14

that Facebook was lying to the public when it stated that the purpose of the ADI was to root out bad apps and secure Facebook’s platform so that consumers could have faith in the company.” Dkt. No. 736 at 6. And, she noted, Facebook had not offered any evidence that “addresse[d] the repeated public proclamations as to the obvious business purpose of the ADI.” Dkt. No. 736 at 6. Judge Corley thus ordered Facebook to produce “the background and technical reports, audits and developer interviews” related to the six apps from the sampling exercise. Dkt. No. 736 at 7. She then ordered the parties to “work with the Special Master regarding production of additional materials consistent with the guidance offered by this Order.” Dkt. No. 736 at 7. After Judge Corley’s ruling, Facebook produced the materials specifically ordered by Judge Corley—which turned out to be just eleven documents—but it did not elaborate on what else it would produce. Dkt. Nos. 914 at 10–11; 1085-3 at 3. After the parties made no progress, Special Master Garrie scheduled a hearing to discuss ADI production. Facebook continued to avoid taking a position on what it would produce, and it then asked to delay the hearing for a month because of scheduling conflicts. Special Master Garrie gave Facebook “one final extension.” Dkt. No. 1087-18 at 1. He then “strongly encourage[d] Facebook to provide Plaintiffs with a written description of the materials they believe are required by the ADI Order by the end of tomorrow,” and to “either produce the memoranda [prepared by Facebook’s forensic consultants] or inform Plaintiffs in writing the reason for not providing these materials by Friday afternoon at the latest.” Dkt. No. 1087-18 at 1. Facebook failed to do either; it said it had already made its position clear. See Dkt. No. 1085-6 at 2.

At the (delayed) hearing before Special Master Garrie, Facebook acknowledged that the specific categories identified in Judge Corley’s order—background technical reports, audits, and interviews—were producible in theory, although it stated that they might still be protected by attorney-client or work-product privilege. Dkt. No. 1085-5 at 7–8. But Facebook and Gibson Dunn then took the position that all of Facebook’s internal, non-attorney communications about the investigation—communications among employees and between employees and Facebook’s outside consultants—were not discoverable because Judge Corley had determined that the

Page 15

communications were not relevant. Dkt. No. 1085-5 at 4; see also Dkt. No. 778 at 2. To Facebook, the demand for communications was “already litigated” and “rejected” by Judge Corley. Dkt. No. 1085-5 at 4.

According to Facebook, Judge Corley had reviewed these types of ADI communications in the sampling exercise, and because she had not explicitly ordered their production, her order implicitly “considered and disposed of the request for…communications” as a whole. Dkt. No. 1085-5 at 9–10. Gibson Dunn attorney Orin Snyder said this interpretation of the order was supported by “a lot of case law,” “from the Supreme Court cases on down.” Dkt. No. 1085-5 at 9–10, 11.

Special Master Garrie rejected this view, and he articulated a process by which Facebook would be required to produce the communications. First, he ordered Facebook to produce the background and technical reports, audits, interviews, and consultant memoranda on a rolling basis. Dkt. No. 788-3 at 4–6. Once Facebook produced these documents, the plaintiffs could then request a statistically significant sample of Facebook’s related internal communications and its communications with its outside consultants.8 Dkt. No. 788-3 at 6; 765-2 at 5. Facebook moved for reconsideration, and Special Master Garrie narrowed the order: rather than requiring Facebook to produce ADI communications upon the plaintiffs’ request, he ordered Facebook “to provide to Special Master Garrie for in camera review, all ADI related communications pertaining to the six exemplar applications.” Dkt. No. 788-5 at 6. He would review these communications to determine whether it was worthwhile for Facebook to produce them. Facebook then appealed that decision to Judge Corley. At the hearing, Facebook repeated its argument that she had already ruled that its internal communications and its communications with its outside consultants were not discoverable. Dkt. No. 809 at 9–10. A Gibson Dunn attorney argued that that interpretation of the order was based on “a general presumption that

Special Master Garrie also allowed the plaintiffs to request Facebook’s communications with the third-party app developers, but Facebook did not take issue with that aspect of his order. See Dkt. No. 778 at 2.

8

Page 16

when a party makes a request for specific materials and the Court resolves the request without ordering those materials produced, the request is denied.” Dkt. No. 809 at 11. Judge Corley responded: “I just want to say you should not litigate based on that presumption. That is not how it works. I wouldn’t do that. That’s a mistake.” Dkt. No. 809 at 11. The order was intended as a starting point, and it explicitly required the parties to work with the Special Master on future productions.9 In her order following the hearing, Judge Corley again rejected Facebook’s argument. She explained that she had not “rule[d] that communications are not discoverable and never need be produced.” Dkt. No. 806 at 2. Rather, her prior order held that ADI documents (including communications) were “not protected by the work-product or attorney-client privilege in the absence of specific showings of actual work-product, such as attorney edits, or the giving or seeking of legal advice.” Dkt. No. 806 at 2. While she had noted at the hearing after the sampling exercise that some of the documents from the exercise were not relevant, Judge Corley made those statements after reviewing twenty documents blindly picked off Facebook’s privilege log—documents like the scheduling emails discussed at the hearing. But her statements at the hearing were not part of her order: they were made “in the context of attempting to narrow the issues to determine if the parties could agree on what ADI materials to produce.” Dkt. No. 806 at

2. When the parties could not agree (in part because of Facebook’s continued assertion of a blanket privilege), Judge Corley adjudicated the privilege question—not the discoverability of communications as a whole. Dkt. No. 806 at 2.

Judge Corley additionally found Facebook’s specific objections to Special Master Garrie’s order to be “puzzling.” Dkt. No. 806 at 2. She explained that Special Master Garrie had taken a “common-sense approach”: he would review the communications to determine whether they were relevant and ought to be produced. Dkt. No. 806 at 3. But instead of just complying, Facebook appealed.

Judge Corley did observe that Facebook’s motion for reconsideration was not in bad faith to the extent that Special Master Garrie responded by narrowing the order. Dkt. No. 809 at 54. 9

Page 17

While Judge Corley was considering Facebook’s appeal, Special Master Garrie finished his review of the sample ADI communications. “After reviewing a substantial portion of the 6,000+ documents pertaining to the exemplar apps,” Special Master Garrie determined that “a substantial number of the documents [were] relevant to the case and not protected by privilege.” Dkt. No. 916-9 at 6. For instance, one 2019 email chain discussed apps that Facebook planned to suspend after the app developers failed to respond to Facebook’s requests for information. One Facebook employee wrote that she wanted to give “heads up to our business leads” before suspending the apps. Dkt. No. 1100-3 at 4. In response, another employee (presumably one of Facebook’s “business leads”) asked for a “revenue impact analysis” related to the apps. Dkt. No. 1100-3 at 3. That request would appear to support the plaintiffs’ contention that Facebook made enforcement decisions based on business concerns. Given the relevance of the communications (and Facebook’s failure to demonstrate that they were privileged), Special Master Garrie ordered Facebook to produce “all documents relating to the ADI,” with certain exceptions for attorney communications. Dkt. No. 916-9 at 7.

Facebook moved for reconsideration. In its motion, Facebook noted that it was unclear if the order required it to collect additional documents and use additional search strings to look for responsive materials. Dkt. No. 917-5 at 16–17. Facebook had already collected documents from the parties’ agreed-upon custodians (employees identified as having materials relevant to the case). Facebook suggested that set of documents was adequate, and it should only be required to look through that set for ADI materials. Dkt. No. 917-5 at 17. In response, Special Master Garrie narrowed the order to require production of “all documents relating to the ADI from all custodians that the parties have identified and collected,” with certain exceptions for attorney communications. Dkt. No. 917-8 at 7. The plaintiffs understood this to mean that Facebook would still search for all the ADI materials, but that Facebook would not need to identify any new custodians. And, for a brief period of time, it seemed like the matter was settled. Shortly thereafter, at the February 10, 2022 case management conference, this Court expressed concerns about stonewalling by Facebook and Gibson Dunn. At that conference, the

Page 18

Court invited the plaintiffs to move for sanctions rather than ask for the discovery deadlines to be continued yet again. The Court also ordered Facebook to complete its ADI production within 21 days. Dkt. No. 847.

Following that conference, Gibson Dunn assigned Rosemarie Ring to lead the litigation, replacing Orin Snyder. And Facebook and Gibson Dunn’s conduct slowly began to improve (at least in some areas). Later in February, Ring proactively emailed the plaintiffs to discuss Facebook’s previous understanding of the “limits” of Special Master Garrie’s order: “The goal here is to make sure we have a meeting of the minds on this and avoid any further ADI-related disputes.” Dkt. No. 1103-33 at 2, 5. Gibson Dunn explained that for ADI custodians, Facebook had only collected documents through a period that ended in 2019—although the investigation continued into 2020. Dkt. No. 1088 at 3–4. Facebook and Gibson Dunn had not told Special Master Garrie about this limitation when they argued Facebook’s collection was adequate. Indeed, as Ring later stated, it was unclear if “anyone was aware” of the limitation until she brought it to the plaintiffs’ attention. Dkt. No. 947 at 9. Gibson Dunn also explained that the search terms used to identify responsive documents were limited: Facebook did not use terms like “ADI” or “App Developer Investigation,” but instead searched by app ID and app name. Dkt. No. 1088 at 3. And even then, the search was not comprehensive: it did not include 1,700 apps that Facebook (rather than Gibson Dunn) had investigated. Dkt. No. 1088 at 4. The plaintiffs also learned that Facebook transitioned the App Developer Investigation to an “inhouse” operation at a certain point, meaning Gibson Dunn was not even involved in aspects of the purportedly privileged investigation. Dkt. No. 1088 at 4.

After the plaintiffs brought these issues to the Court’s attention, the Court ordered Facebook to produce all ADI documents through the present (not just through 2019). Dkt. No.

895. After additional back and forth, Facebook agreed to additional search terms and further collections to avoid any more discovery disputes. Dkt. No. 1052-2 at 19. In July 2022—nearly three years after the plaintiffs’ first request—Facebook was still producing ADI documents. Dkt. No. 1085-33 at 5.

Page 19

B.

Named Plaintiff Data

Another area of alleged discovery misconduct involved the information that Facebook had collected about the named plaintiffs. This “named plaintiff data” was a key component of the case: Facebook sought to poke holes in the plaintiffs’ claims by arguing that they had “not identified what information they believe[d] Facebook shared without consent,” nor how “they believe[d] they were harmed.” Dkt. No. 840 at 5. If the plaintiffs could not identify this information, Facebook argued, they lacked standing. See, e.g., Dkt. No. 261-1 at 20. To properly address these arguments, the plaintiffs needed to identify the universe of private information from which app developers and business partners might have drawn. The parties litigated the production of that information for years.

Early on in discovery, Facebook agreed to produce information from its “Download Your Information” tool. The DYI tool—accessible to all Facebook users—aggregates much of the information that Facebook collects on its users. But throughout discovery, Facebook and Gibson Dunn suggested that the DYI tool did not include all the personal information Facebook had collected. See, e.g., Dkt. Nos. 541 at 8; 1103-14 at 7–8; 793 at 6–7; 918-1 at 3. The parties’ discovery disputes centered around whether Facebook would need to produce anything else. Facebook and Gibson Dunn made two arguments against additional discovery. First, they argued that Facebook only needed to produce information that Facebook conceded had been shared with third parties—and the plaintiffs had to accept their representations about what had been shared. Second, Facebook and Gibson Dunn argued that any additional discovery would be costprohibitive and unnecessary. (Under the Federal Rules of Civil Procedure, discovery must be “proportional” to the needs of the case; Facebook and Gibson Dunn argued that any additional discovery on the named plaintiff data did not meet that standard.)

Part of the problem with identifying the information that Facebook kept on the named plaintiffs was that the company’s information about its users is not consolidated in one location; it’s spread across Facebook’s complex data storage system. In March 2020, the plaintiffs asked Facebook to produce developer manuals or other documents describing that system so that they

Page 20

could understand where other named plaintiff data might be stored. According to the plaintiffs, Gibson Dunn repeatedly told them to “Google” that information. Dkt. No. 1087-1 at 3. From late 2019 to mid-2020, the parties went back and forth about the named plaintiff data. After several months without progress, Judge Corley ordered the parties to meet to discuss the issue: “The parties’ next joint statement shall include information regarding the meet and confer efforts and discuss in detail each side[’s] understanding of what precisely has been produced and precisely what is the [named plaintiff] data that is being withheld as not relevant or not reasonably available. The statement should not argue why the unproduced data is or is not discoverable; the purpose of the statement is to precisely identify the data at issue.” Dkt. No. 487 at 1–2.

At the next discovery hearing, Gibson Dunn acknowledged that Facebook had not produced all the information it collected about the named plaintiffs. As Gibson Dunn attorney Russ Falconer explained: “There is other…Facebook-generated information, information generated by third parties, information received from third parties. We have not represented that that is comprehensively included in our production.” Dkt. No. 541 at 8. For instance, while Facebook’s production included the date and time that a named plaintiff may have accessed a certain website, it did not include the content the plaintiff had viewed on that website. Dkt. No. 541 at 7. According to Falconer, Facebook had access to that data in a “raw, disaggregated way” but producing that data about any given plaintiff would be a “multiweek endeavor.” Dkt. No. 541 at 7, 10. At the hearing, the parties ultimately agreed that they would submit briefs to Judge Corley, and she would determine what additional named plaintiff data should be produced. In its briefing, Facebook argued that the only named plaintiff data that was discoverable was data that “ar[ose] from user activity occurring on the Facebook platform” that the plaintiffs “overtly shared…with a limited audience.” See Dkt. No. 557 at 1. The plaintiffs argued that the universe of discoverable data was much larger. See Dkt. No. 557 at 1.

Judge Corley rejected Facebook’s “restrictive view of relevant discovery” in Discovery Order No. 9. Dkt. No. 557 at 1. Judge Corley held that “the discoverable user data at issue

Page 21

includes: Data collected from a user’s on-platform activity; Data obtained from third parties regarding a user’s off-platform activities; and Data inferred from a user’s on or off-platform activity.” Dkt. No. 557 at 2. Unless Facebook and Gibson Dunn could show that specific information was not discoverable for some other reason—for instance, the burden of producing it was disproportionate to the needs of the case—Facebook would have to give it to the plaintiffs. Shortly thereafter, in November 2020, the plaintiffs asked Facebook to identify the materials responsive to that order. Facebook responded that it was still “conducting an investigation to confirm the universe of data” that could be responsive. Dkt. No. 583 at 3, 10. Two months later, however, Facebook took the position that Discovery Order No. 9 “relate[d] only to data that was shared or otherwise made accessible” to third parties, and so no other information was discoverable. Dkt. No. 589 at 34. Judge Corley shot down this argument (or at least tried to), explaining that whether certain data was shared was an “open question.” Dkt. No. 588 at 1. Judge Corley pointed out that Facebook had previously argued that the third category of discoverable data identified in Discovery Order No. 9 (data inferred from a user’s on or off-platform activity) was not discoverable because it had never been shared. But Discovery Order No. 9 had clearly held that inferred data was discoverable—notwithstanding Facebook’s assertions that it had never been shared. Judge Corley explained: “If the Court were to accept Facebook’s arguments about the scope of production, it would eliminate” that entire category from discovery. Dkt. No. 588 at 1.

Given the lack of clarity on Facebook’s use of users’ data, Judge Corley ordered the parties to conduct a Rule 30(b)(6) deposition so that the plaintiffs could assess what data was shared with third parties. Dkt. No. 588 at 1. A 30(b)(6) deposition—a reference to Federal Rule of Civil Procedure 30(b)(6)—gives a litigant the opportunity to question an organization’s representative about a specified topic. The organization has “a duty to make a conscientious, good-faith effort to designate knowledgeable persons for Rule 30(b)(6) depositions and to prepare them to fully and unevasively answer questions about the designated subject matter.” Starlight International Inc. v. Herlihy, 186 F.R.D. 626, 639 (D. Kan. 1999). In a subsequent

Page 22

order, Judge Corley clarified that the scope of the deposition was limited to “discoverable user data as defined by Discovery Order No. 9,” and emphasized that “whether particular user data is not shared, not admissible, or not monetized, is not a valid reason to object to a particular…question” at the deposition. Dkt. No. 602 at 1–2.

After the 30(b)(6) deposition, there was no progress on the production of the named plaintiff data. Facebook did not produce any additional documents at all, and it accused the plaintiffs of “spinning in circles…for more than a year” on the issue. Dkt. No. 1085-9 at 7. By the fall of 2021, the parties declared an impasse, and they briefed the issue for Special Master Garrie. The plaintiffs argued that whether their information was shared “was a contested question on which [they were] entitled to evidence,” beyond just Facebook’s representations. Dkt. No. 916-4 at 5. And, the plaintiffs pointed out, “internal documents demonstrate that Facebook itself does not know what information may have been shared with third parties.” Dkt. No. 1103-2 at

13. But Facebook and Gibson Dunn persisted in the argument that the scope of discovery was limited to information that Facebook admitted had been shared, and that this limitation was consistent with Judge Corley’s order. Dkt. No. 916-4 at 5–6.

Special Master Garrie rejected Facebook and Gibson Dunn’s argument: he held that she had not limited discovery to data that Facebook admitted was shared with third parties. Dkt. No. 916-4 at 6–7. He then determined that Facebook had not produced all the data related to the named plaintiffs, so he ordered Facebook to “provide a list of data sources” containing that information, and then meet and confer with the plaintiffs to propose a protocol for producing the data. Dkt. No. 916-4 at 8. Facebook then moved for reconsideration. In response, Special Master Garrie revised his order and instead required Facebook to explain its practices for storing user data so that he could determine what additional data should be produced. Dkt. No. 793 at 7–8. Facebook appealed that order.

In considering that appeal, Judge Corley explained that the plaintiffs agreed the case was about data that was shared, but “the question” for discovery was how to determine “what was shared and what was made accessible.” Dkt. No. 809 at 30. But, she said, Facebook’s position

Page 23

was as follows: “The only data that is discoverable is that which Facebook contends was shared or made accessible, and if Facebook says it was not shared or made accessible, that’s the end of the matter.” Dkt. No. 809 at 29. Judge Corley (again) rejected that argument. Pointing (again) to Discovery Order No. 9, Judge Corley explained: “This Court did not rule that Facebook only had to produce data about the Named Plaintiffs that Facebook admits it shared with third parties.” Dkt. No. 807 at 1. And Judge Corley repeated her earlier point: Discovery Order No. 9 held that inferred data was discoverable (even though Facebook argued inferred data was never shared). Dkt. No. 807 at 1–2. That order would not make sense, she reiterated, if discovery were as limited as Facebook suggested. Dkt. No. 807 at 1–2. And “Facebook’s insistence that the Court somehow ruled that only data that Facebook admits were shared with third parties is discoverable is belied by the Court’s discovery ruling less than two months later,” which noted that what data was shared was an “open question.” Dkt. No. 807 at 2.

Judge Corley continued: “Apart from the Court not having limited discovery of each Named Plaintiff’s data to only data Facebook concedes it shared with third parties, the Court finds that such a limitation is not appropriate.” Dkt. No. 807 at 2. “As the Court previously noted, how Facebook uses the data it collects about its users is an ‘open question.’ The first step in answering that question is to identify the data it collects about its users and, specifically, what it has collected about the Named Plaintiffs.” Dkt. No. 807 at 2–3. Although the 30(b)(6) deposition was intended to “provide clarity as to what data Facebook collects and how it is used,” the 30(b)(6) witness was not “the final arbiter of whether data was shared.” Dkt. No. 807 at 3. “[T]here is nothing before the Court that suggests that the record is currently so undisputed as to what data Facebook collects and how it is used that the Court can say definitively that certain data were not shared and therefore not discoverable.” Dkt. No. 807 at 3. Judge Corley also noted that Facebook’s appeal misrepresented Special Master Garrie’s order. Facebook and Gibson Dunn argued that Special Master Garrie was requiring them to provide “detailed information” about the sources of data Facebook had identified—but Special Master Garrie’s order said only that Facebook had to provide a “high level description” of the

Page 24

information in those sources. Dkt. No. 807at 3–4. Once Special Master Garrie had a high-level description of Facebook’s data systems, he could determine which systems contained named plaintiff data, and whether production of “potentially shared” named plaintiff data was feasible and proportional to the needs of the case. Dkt. No. 807 at 4.

A week later, Special Master Garrie ordered Facebook to give him a “date certain” by which Facebook could tell him which systems had discoverable data and either produce that data or explain why it should not have to. Dkt. No. 1087-23 at 1. Special Master Garrie found Facebook’s response to be “nonsensical.” Dkt. No. 826 at 2. Facebook tried again. For the next six months, Special Master Garrie worked with the parties to determine what additional information should be produced; that process involved testimony from six Facebook witnesses, the submission of 14 explanations of 100 data systems, scrutiny of the identifiers used to store and track user data, and other highly technical analyses. At this point, Facebook and Gibson Dunn’s primary argument had been decisively rejected, and so they switched tack: They now emphasized that any additional discovery would be so burdensome that it would not be proportional to the needs of the case.

But this process revealed at least two new potential sources of named plaintiff data. First, throughout the litigation, the plaintiffs had asked Facebook to produce data from something called the Hive. The Hive is a data warehousing framework organized into tables and “partitions.” Facebook and Gibson Dunn consistently argued that it would be nearly impossible to look through the Hive for all the named plaintiff data because of the way the Hive was organized. For instance, in October 2021, Facebook and Gibson Dunn said Facebook could not produce named plaintiff data from the Hive because the information in the Hive is “not indexed by user, so there is no way to search across all tables at once for an individual user’s ID.” Dkt. No. 1085-11 at 7. Facebook and Gibson Dunn asserted that, to search the Hive for named plaintiff data, it would have to search “each of Hive’s 12 million tables…individually for any information relating back in any way to a Named Plaintiff, which would be nearly impossible, given both the volume of Hive data and the fact that much of the data in Hive is anonymized.”

Page 25

Dkt. No. 1085-11 at 7. In December 2021, Facebook again said that it would take “a full team of engineers” working for “more than a year” to develop tools necessary to identify specific information that could then be retrieved from the Hive. Dkt. No. 1103-12 at 8. From January 2022 on, the parties worked with the Special Master to inquire into the Hive tables to determine if and how they could be searched.

Months into this process, a Facebook representative revealed something that the company and its lawyers had not previously disclosed: Facebook had, much earlier on, identified and preserved a number of Hive tables that might include named plaintiff data. In June 2022, the plaintiffs deposed Michael Duffey, an e-discovery case manager in Facebook’s legal department. Facebook designated Duffey under Rule 30(b)(6) to testify about Facebook’s efforts to identify and preserve information associated with the case, including information about the named plaintiffs. Duffey said that Facebook had identified Hive tables related to Cambridge Analytica with the help of “outside counsel,” and it had placed 137 Hive tables on “legal hold,” likely starting in 2018. Dkt. No. 1103-23 at 70–71, 76. Facebook later admitted that the tables were preserved, at least in part, because they were related to the named plaintiffs. Dkt. No. 1085-35 at 4.

At the same deposition, Duffey revealed another potentially fruitful source of named plaintiff data: the Switchboard profiles. He explained that Switchboard was a tool created to respond to law enforcement subpoenas, and Facebook had preserved data from Switchboard in connection with the named plaintiffs. See Dkt. No. 1085-35 at 2. (Previously, a Facebook representative said that Facebook used the DYI tool to respond to law enforcement inquiries, making no mention of Switchboard. Dkt. No. 1103-9 at 95.) Duffey said that Switchboard was “very similar” to DYI, but it included additional information “pertaining to Facebook groups and advertising accounts.” Dkt. No. 1103-23 at 41. Later, Facebook and Gibson Dunn clarified that Switchboard also included additional information about a user’s privacy settings, the full alphanumeric code associated with certain cookies, information about who the user had blocked, as well as those who reported or blocked that user, and data created for law enforcement. Dkt.

Page 26

No. 1085-35 at 3. Indeed, when Facebook initially produced the named plaintiffs’ privacy settings in 2020, it found those settings by looking to the Switchboard profiles. Dkt. No. 1085-35 at 3. But Facebook and Gibson Dunn had never told the plaintiffs about Switchboard. Duffey also said that Switchboard provided information in a “more usable way” than DYI because the Switchboard profiles could be downloaded as a single PDF. Dkt. No. 1103-23 at 42–43. In contrast, Facebook produced the information from DYI in thousands of atomized files. See Dkt. No. 1050-3 at 20. According to the plaintiffs, many of those files were useless, “including documents consisting wholly of the Facebook [‘]like[’] graphic (a thumbs-up).” Dkt. No. 1050-3 at 20.

These revelations came almost three years after the plaintiffs asked for the data Facebook collected on them, and two years after Judge Corley had ordered the parties to meet and confer regarding the data Facebook was withholding. Facebook subsequently agreed to produce the Switchboard profiles and certain information from the Hive tables. Dkt. No. 1085-34 at 3. C.

Depositions

The plaintiffs also complain about Facebook and Gibson Dunn’s conduct during depositions. There is no need to describe all the conduct; a few examples will suffice. One example involves the depositions focusing on Facebook’s practice of “whitelisting.” Recall that in 2014, Facebook transitioned to a new app interface that limited access to friend permissions. But Facebook “whitelisted” certain apps, allowing them to continue to use the earlier app developer interface (and therefore access friend permissions) even after that transition.

Discovery had revealed documents that appeared to support the plaintiffs’ claims that Facebook whitelisted apps based on business concerns, rather than purely technical ones. For instance, a 2013 email appears to show employees from Facebook’s partnerships team discussing the impact of the new interface on apps and “integrations” (third parties that built Facebookbranded or “Facebook-like” experiences on third-party platforms, like a Facebook app for a phone). Dkt. No. 1103-21 at 29–31; see also Dkt. No. 1085-36 at 53, 57. In the first email in the

Page 27

chain, Facebook employee Jackie Chang identifies a category she calls “key integrations” that “drive value to FB” but use friend data or a user’s “read stream” (information from a user’s news feed). Dkt. No. 1103-21 at 30–31; see also Dkt. No. 1103-16 at 6. She contrasts this category with “key integrations that are competitive or drive little value to FB.” Dkt. No. 1103-21 at 30–

31. For the valuable integrations, Chang says, Facebook “should decide if we allow certain use cases that are of strategic value” to Facebook. Dkt. No. 1103-21 at 30–31. In contrast, for the low-value integrations, she suggests it is “good…we’re removing” access. Dkt. No. 1103-21 at 31.

Another Facebook employee then discusses the impact of the change on apps. He attaches a list of “40k+ apps that request and make use of the friends_permissions,” pulled together by “Simon” (presumably, Simon Cross, cc’ed on the email). Dkt. No. 1103-21 at 29. The employee then offers a recommendation for whether certain categories of apps should keep that access. Dkt. No. 1103-21 at 29. For “strategic partners,” he says, “we should use the framework developed by Jackie.” Dkt. No. 1103-21 at 29.

When the plaintiffs asked Facebook’s employees about this email chain, the employees were unwilling to acknowledge what it seemed to show—that Facebook was discussing whether to allow apps to access friends’ information based on the financial value of the app to the company.

Facebook designated Simon Cross (who was cc’ed on the email chain) to discuss whitelisting in a 30(b)(6) deposition. Cross first testified that Facebook allowed apps to continue to use the earlier interface and access friend permissions only when “the user experience would be significantly degraded if [the apps] weren’t given extra time or there was some form of legal and regulatory risk to the partner if the extension was not granted.” Dkt. No. 1085-36 at 193. The plaintiffs then asked Cross about the framework proposed in the email. Dkt. No. 1085-36 at 319–

323. Cross said that it was unclear what framework the email referred to, but he could not “confirm anything about the precise nature of a framework or if that was used in any way.” Dkt. No. 1085-36 at 321, 323. He later said that the framework was not used. Dkt. No. 1085-36 at

Page 28

326. He could not “recall” whether there was a “formal document or protocol” used when deciding what apps to whitelist, yet he had not asked Facebook’s employees whether such a document or protocol existed. Dkt. No. 1085-36 at 382–83. When asked whether “strategic value” was taken into account when deciding whether to continue to provide access to friend permissions, Cross said he could not answer the question because Facebook had no definition of strategic value. Dkt. No. 1085-36 at 333.

As noted, Cross was cc’ed on the email chain, and it seems as though he put together the list of impacted apps described in the email. Dkt. No. 1085-36 at 316. Yet Cross testified: “If you want to know what these people [on the email thread] meant, I would ask them.” Dkt. No. 108536 at 323. He later repeated: “If you want to understand precisely what the people in it meant, I would speak to them.” Dkt. No. 1085-36 at 325. At least nine times, Cross told the plaintiffs they should ask Chang specifically about certain aspects of whitelisting. Dkt. No. 1085-36 at 309, 311, 314, 321, 328, 379–80, 381, 383, 455.

Several months earlier, the plaintiffs had deposed Chang. When asked whether she was “making a recommendation [in the email]…for how to deal with integrations that involve strategic value,” Chang responded, “I don’t remember specifically, so I don’t know how to answer that.” Dkt. No. 1103-24 at 106. She didn’t “remember enough to say” that the email was about the loss of access to read stream and friend data permissions. Dkt. No. 1103-24 at 107. Indeed, she could not recall what it meant to use “read stream and friend data” at all. Dkt. No. 1103-24 at 108. When asked if she could offer her “best understanding” of what her email meant, she said she couldn’t “speculate.” Dkt. No. 1103-24 at 108. When asked, “Tell me everything you can remember about your involvement in figuring out which partners should continue to have access to friends permissions,” Chang responded, “So, again, I don’t remember.” Dkt. No. 1103-24 at 119.

Chang’s testimony about her email is representative of her deposition more broadly: Although Facebook’s internal documents suggest that Chang was extensively involved in the whitelisting process, she remembered almost nothing about it. See, e.g., Dkt. No. 1103-24 at

Page 29

170–71. At one point in the deposition, Chang testified that she could not remember what the term whitelisting meant at all. Dkt. No. 1103-24 at 220. She had no memory of the deprecation of friend permissions. Dkt. No. 1103-24 at 96. She did not remember that Facebook had ever allowed apps to access friends’ information. Dkt. No. 1103-24 at 70. Although she was being deposed in a case involving the Cambridge Analytica scandal and said she had met with Facebook’s lawyers for around nine hours to prepare, she claimed she did not know that the scandal was related to Facebook’s practice of sharing friends’ information. Dkt. No. 1103-24 at 17, 292–93.

Chang resisted other questions as well. When asked if the email was “the best evidence of what you were thinking at the time you wrote” it, Chang responded, “I don’t know.” Dkt. No. 1103-24 at 133. When asked if there was anything that could refresh her recollection, Chang responded, “I don’t know what I don’t know, so I can’t make that assumption that I would know.” Dkt. No. 1103-24 at 134. When asked if the email was a “good guide of what you were thinking about the topics discussed,” Chang said that would require her to “speculate.” Dkt. No. 1103-24 at 135. When asked again, Chang said she didn’t know what “good” meant. Dkt. No. 1103-24 at 136. At another point in the deposition, Chang said she didn’t know what the phrase “general understanding” meant. Dkt. No. 1103-24 at 76.

The plaintiffs also complain of Facebook and Gibson Dunn’s conduct during the deposition of Alison Hendrix, Facebook’s director of privacy and data policy. Facebook designated Hendrix to testify on several topics identified in the plaintiffs’ 30(b)(6) deposition notice, including: “The purposes for which…data or information was shared or made accessible” to third parties; “how Facebook ensured third parties’ use of such data or information was limited” to the purpose for which the third party was able to obtain it; and “an overview of the processes of developing privacy or app settings or other controls made available to users to prevent or limit their data or information from being accessed by third parties.” Dkt. No. 1085-22 at 22.

The plaintiffs began by asking Hendrix if those topics—how Facebook limited third

Page 30

parties’ use of users’ data and the controls Facebook had in place to help users limit third parties’ access to their data—seemed related. Hendrix twice asked what the plaintiffs meant by “related.” Dkt. No. 1085-22 at 18–19, 20–21. After five minutes of back-and-forth and multiple objections from Gibson Dunn, Hendrix agreed that the topics were “somewhat related.” Dkt. No 1085-22 at 18–23.

Tensions only escalated from there. At one point, for instance, the plaintiffs asked Hendrix if she could “unpack” one of her answers, and she responded, “No.” Dkt. No. 1085-22 at 132. The plaintiffs said, “I’m trying to figure out what you mean by [your answer,]” and Hendrix responded, “I mean[t] what I said. And I even gave an example.” Dkt. No. 1085-22 at 132.

Many of the disputes in the deposition centered around Gibson Dunn’s interpretation of the 30(b)(6) deposition notice. For instance, Hendrix was designated to testify about the process of developing privacy and app settings. The plaintiffs asked Hendrix whether there was a “tool or a setting [a user] can select in determining what to share with a third party.” Dkt. No. 1085-22 at

137. Gibson Dunn attorney Robert Blume objected that the question was outside the scope of the deposition notice. Dkt. No. 1085-22 at 136. Blume made the same objection when the plaintiffs asked whether a drop-down option in the privacy shortcuts menu said, “Who can see my stuff?” Dkt. No. 1085-22 at 177. To Blume, the question was “incredible” because it had “nothing to do with users’ privacy or app settings,” but rather was a “technological change.” Dkt. No. 1085-22 at 177–78.

The parties also disagreed about whether Hendrix was required to speak about actual instances of developer misconduct and enforcement, rather than just Facebook’s theoretical policies. To Blume, it was significant that the plaintiffs sought testimony on “how Facebook ensured third parties’ use of such data or information was limited to the use case.” Because the plaintiffs’ notice said “how” and “not when, not what, not which,” he said, the plaintiffs could not seek any testimony about third parties’ actual compliance. Dkt. No. 1085-22 at 320. For instance, at one point, Hendrix testified that developers “must comply” with

Page 31

Facebook’s terms, and there were “no exceptions.” Dkt. No 1085-22 at 327. The plaintiffs followed up by asking if Hendrix was aware of “the instances in which developers did or did not comply with [those] terms.” Dkt. No. 1085-22 at 327. Hendrix responded: “I will do my own bitching and moaning. I have already answered that question twice. So for the third time, I will let you know that I am not prepared to tell you every single violation that has been surfaced and confirmed from 2007 to 2022.” Dkt. No. 1085-22 at 327–28.

In all, Blume instructed Hendrix not to answer questions at least 22 times on the theory that the questions were outside the scope of the notice. While Blume initially allowed Hendrix to answer these questions in her personal capacity (rather than as Facebook’s designee), he eventually instructed Hendrix that she should not answer the questions at all. See Dkt. No. 108522 at 269. And Hendrix herself refused to answer certain questions based on her own interpretation of the deposition notice. See, e.g., Dkt. No. 1085-22 at 234, 245–46, 327–28. Throughout the deposition, Blume’s frequent objections and instructions not to answer cut off certain lines of questioning entirely. For instance, the plaintiffs asked if Hendrix was prepared to testify about “third-party app developers that actually continued to access friend information” after the deprecation of friend permissions. Dkt. No. 1085-22 at 228. Hendrix responded that, after the first version of the interface was “fully deprecated,” “friend permissions” were “no longer a thing from a product perspective.” Dkt. No. 1085-22 at 229. “If you didn’t move your app and build off of v2, from a technical standpoint at deprecation of v1, you could no longer call the Graph API and receive any friend permissions. There was no longer the ability to request friend permissions.” Dkt. No. 1085-22 at 228. The plaintiffs followed up by asking Hendrix if she was familiar with whitelisting. Dkt. No. 1085-22 at 229. When she said yes, they asked for her understanding of the term. Dkt. No. 1085-22 at 229. Blume objected. Dkt. No. 1085-22 at 229. That objection was followed by a 15-minute discussion about whether the question was outside the scope of the deposition notice—with Hendrix herself stating that she “struggle[d]” to see how the question was relevant to the topics she was prepared to discuss. Dkt. No. 1085-22 at 240, 229–244.

Page 32

That exchange is representative of the larger pattern: Blume would object, and the plaintiffs, Blume, Hendrix, and Special Master Garrie would spend a substantial amount of time debating the objection. One such dispute lasted 17 minutes. Dkt. No. 1085-22 at 292–310. After the deposition, the plaintiffs filed a motion with Special Master Garrie for sanctions based on Blume and Hendrix’s conduct. Dkt. No. 935. Among other things, the plaintiffs sought additional time for 30(b)(6) depositions on the topics for which Hendrix was a designated witness. Facebook did not oppose the motion, and it agreed to the relief requested. Dkt. No. 936. Facebook also agreed to pay the plaintiffs’ attorney’s fees for the time spent preparing for and conducting Hendrix’s deposition, as well as the fees for the time Special Master Garrie spent on the deposition and motion. Dkt. No. 936.

D.

Designation of Documents as Privileged

Another area of conflict involved Facebook and Gibson Dunn’s misdesignation of thousands of documents as privileged. Just before the February 2022 case management conference, Facebook’s privilege log listed around 15,000 documents (not including the ADI documents). This was the conference where this Court ripped into Facebook and Gibson Dunn for stonewalling.

Facebook responded to the threat of sanctions by accelerating its production, but in connection with that production it added over 180,000 documents to its privilege log. See Dkt. No. 1088-9 at 4. To the plaintiffs, this massive assertion of privilege seemed dubious, and they raised the issue with Facebook and Gibson Dunn. Facebook and Gibson Dunn ultimately agreed to re-review a sample of 3,062 documents. Dkt. No. 1050-3 at 28. After this review, Facebook withdrew privilege claims over 63% of those documents. Dkt. No. 1050-3 at 28. Given that significant rate of error, Facebook agreed to re-review all the documents it had withheld as privileged. Although it’s difficult to pinpoint the exact numbers, the plaintiffs estimate that Facebook dropped privilege claims for over 53,168 documents and offered redacted versions of an additional 7,482 documents that the company originally withheld. Dkt. No. 1050-3 at 28. The plaintiffs offer a few examples of documents initially designated as privileged. They

Page 33

point to an email chain from the fall of 2009 among non-attorneys discussing “what to do about friend data” and whether “apps get to store whatever friend data they get.” Dkt. No. 1041-3 at 2–

3. The plaintiffs also point to an April 2018 email between non-attorneys that discusses “a couple of docs” an employee put together for Mark Zuckerberg in mid-2015 about “the need to build a stronger and more centralized privacy & data use org.” Dkt. No. 1041-5 at 2. The employee observes, “I wonder how much of a better place we’d be in today if the proposal had been implemented three years ago.” Dkt. No. 1041-5 at 2.

Relatedly, internal documents from Facebook also suggest that its employees sought to shield communications from future discovery by “privileging” them. For instance, a 2015 email chain between Facebook employees discusses a credit score app that was mistakenly given access to certain sensitive user data like “user_posts.” Dkt. No. 1103-22 at 3. One employee responds, “Simon, can we discuss in person? Else we need to make this a/c priv and add a lawyer in the thread.” Dkt. No. 1103-22 at 2. Simon Cross replies, “You know what my answer will be here.” Dkt. No. 1103-22 at 2. And the employee responds, “:-).” Dkt. No. 1103-22 at 2. Another chat discusses “PR and regulatory inquiries.” Dkt. No. 1088-13 at 2. One of the employees shares something that has since been redacted. Dkt. No. 1088-13 at 2. Another responds, “Might be best not to share in this specific thread, rather one with priv.” Dkt. No. 1088-13 at 2 Later in the chat, an employee asks about using Quip (a collaborative tool for editing documents and spreadsheets) for sensitive information. Dkt. No. 1088-13 at 2. The following exchange occurs:

[Employee 1] (3/20/2018 16:43:39 PDT):

>Just ensure that if it’s very sensitive you ask a lawyer for guidance in the Quip and privilege it [Employee 2] (3/20/2018 16:44:53 PDT):

>How does one ‘privilege it’?

[Employee 3] (3/20/2018 16:45:22 PDT):

>With the presence and approval of an attorney[.]

Dkt. No. 1088-13 at 2.

Page 34

E. Facebook and Gibson Dunn’s Rhetoric Finally, throughout this period, Facebook and Gibson Dunn consistently argued that it was the plaintiffs who were delaying discovery. As early as 2020, Facebook and Gibson Dunn told Judge Corley that the plaintiffs “continue to undermine the Court’s well-considered orders (intended to bring structure to the case) by insisting on an unfocused whack-a-mole process that would unwind past agreements and work.” Dkt. No. 563 at 6. In 2021, Facebook and Gibson Dunn told the Court that the plaintiffs’ “scattershot approach to litigation continues to cause significant inefficiencies, unnecessary friction, wasteful motion practice, and a race to litigate (rather than resolve) disputes.” Dkt. No. 631-3 at 7 (under seal).

Recall Facebook and Gibson Dunn’s repeated pronouncements that discovery was limited to information Facebook admitted had been shared. When the plaintiffs brought that issue to Special Master Garrie’s attention, Facebook and Gibson Dunn described the plaintiffs’ motion as “an opportunistic, wasteful, and abusive attempt to erase the proceedings before Judge Corley, gain access to information Plaintiffs have conceded is irrelevant, and hunt for anything to stall this case before it finally reaches the merits.” Dkt. No. 1085-11 at 6.

By January 2022, just before the Court invited this sanctions motion, Gibson Dunn attorney Orin Snyder told Special Master Garrie that the “case [was] out of control” because “the plaintiffs will not stop.” Dkt. No. 1087-3 at 5. According to Snyder, the plaintiffs were raising new issues “coming from left field, right field, the dugout, the saloon down the street [from] the ballpark,” all just before discovery was set to end. Dkt. No. 1087-3 at 11. It was time for the plaintiffs to be told “no mas, no mas.” Dkt. No. 1087-3 at 6.

II A court may impose sanctions under its inherent powers “when a party has ‘acted in bad faith, vexatiously, wantonly, or for oppressive reasons.’” Chambers v. NASCO, Inc., 501 U.S. 32, 45–46 (1991) (quoting Alyeska Pipeline Service Co. v. Wilderness Society, 421 U.S. 240, 258–59 (1975)). A court may exercise this power by requiring the sanctioned party to pay the opposing party’s attorney’s fees. Id.

Page 35

Before imposing sanctions, the court must find that the conduct “constituted or was tantamount to bad faith.” Primus Automotive Financial Services, Inc. v. Batarse, 115 F.3d 644, 648 (9th Cir. 1997). That standard may be met when a party misrepresents the law or the facts to the court. See, e.g., Malhiot v. Southern California Retail Clerks Union, 735 F.2d 1133, 1138 (9th Cir. 1984); cf. Chambers, 421 U.S. at 35–41. It may also be met “when a party acts for an improper purpose—even if the act consists of making a truthful statement or a non-frivolous argument or objection.” Fink v. Gomez, 239 F.3d 989, 992 (9th Cir. 2001). Sanctions may be imposed for “delaying or disrupting the litigation or hampering enforcement of a court order.” Primus, 115 F.3d at 649. And they may be imposed for repeatedly making arguments that have been rejected. Wages v. I.R.S., 915 F.2d 1230, 1235 (9th Cir. 1990).

“To protect against abuse and to ensure parties receive due process, individuals subject to sanction are afforded procedural protections, the nature of which varies depending upon the violation, and the type and magnitude of the sanction.” F.J. Hanshaw Enterprises, Inc. v. Emerald River Development, Inc., 244 F.3d 1128, 1137 (9th Cir. 2001). The Ninth Circuit has distinguished between two types of sanctions: compensatory and punitive. The former is intended to compensate the opposing party for the expense incurred as a result of the misconduct. Id. at 1137–38. The latter is intended to “vindicate the court’s authority and the integrity of the judicial process.” Id. at 1138.

To impose compensatory sanctions, the court must give the sanctioned party notice and an opportunity to be heard. Id. at 1143. The Ninth Circuit has not addressed the burden of proof required for compensatory sanctions, but a finding of bad faith by clear and convincing evidence is sufficient. Lahiri v. Universal Music & Video Distribution Corp., 606 F.3d 1216, 1219 (9th Cir. 2010). To impose substantial punitive sanctions (at least for out-of-court conduct), the court “must provide the same due process protections that would be available in a criminal contempt proceeding.” F.J. Hanshaw Enterprises, Inc., 244 F.3d at 1139; cf. Goodyear Tire & Rubber Co. v. Haeger, 581 U.S. 101, 108 (2017). That process includes the right to an independent prosecutor, a jury trial, and a finding of misconduct beyond a reasonable doubt. F.J. Hanshaw

Page 36

Enterprises, Inc., 244 F.3d at 1139–40.

The sanctions requested in this case are compensatory. The parties have already reached a settlement in principle, and the settlement includes a total amount to be paid by Facebook into a settlement fund. Most of the settlement fund will be designated for members of the class; some of it will be designated to pay fees and costs to class counsel. Any fee award to the plaintiffs from this sanctions motion will cause a corresponding reduction in the amount of money designated to pay attorney’s fees from the settlement fund. In other words, a fee award here means the plaintiff class will need to use less of the settlement fund for attorney’s fees. And that is the point of compensatory sanctions—to protect one side from paying fees resulting from the opposing side’s misconduct. Cf. Restatement (Third) of the Law Governing Lawyers § 38(3)(b) (2000).

Relatedly, the amount of compensatory sanctions is limited to fees and costs “incurred solely because of the misconduct” at issue, meaning “fees that party would not have incurred but for the bad faith.” Goodyear, 581 U.S. at 104. A court has “broad discretion” in calculating that award. Id. As the Supreme Court has emphasized, the sanctioning court “need not, and indeed should not, become green-eyeshade accountants’ (or whatever the contemporary equivalent is).” Id. at 110 (quoting Fox v. Vice, 563 U.S. 826, 838 (2011)). “Accordingly, a district court may take into account [its] overall sense of a suit, and may use estimates in calculating and allocating an attorney’s time. The court may decide, for example, that all (or a set percentage) of a particular category of expenses—say, for expert discovery—were incurred solely because of a litigant’s bad-faith conduct.” Id. (quoting Fox, 563 U.S. at 838) (quotations and citations omitted).

A court may also award fees and costs incurred in moving for sanctions. These fees and costs are a result of the misconduct—“were there no sanctionable conduct, there would have been no proceeding to impose sanctions, and no fees incurred in that proceeding.” Blixseth v. Yellowstone Mountain Club, LLC, 854 F.3d 626, 631 (9th Cir. 2017); see also Harper v. Nevada Prop. 1, LLC, No. 219CV02069GMNVCF, 2021 WL 3418350 (D. Nev. Aug. 5, 2021).

Page 37

After a court estimates the amount of fees and costs incurred “because of” the misconduct, it then determines whether that amount is reasonable by looking to the number of hours reasonably expended on the case (deducting any unnecessary or duplicative expenses) multiplied by a reasonable hourly rate. Pennsylvania v. Delaware Valley Citizens’ Council for Clean Air, 478 U.S. 546, 564 (1986).

III

The Court finds by clear and convincing evidence that Facebook and Gibson Dunn acted in bad faith during much of this litigation, and their misconduct warrants sanctions pursuant to the Court’s inherent authority. Because a court’s inherent powers must be exercised with “restraint and discretion,” the Court will only sanction Facebook and Gibson Dunn for the worst of their consistently bad behavior: their handling of discovery related to the App Developer Investigation and the named plaintiff data.10 This misconduct would be sanctionable even if viewed in isolation, but their bad faith becomes even more obvious when viewed in the context of the entire litigation. It is also clear that the blame for this misconduct must be laid equally at the feet of both client and counsel—this sustained, brazen stonewalling campaign could only have occurred if everyone (or almost everyone) was on the same page.11

A. Sanctionable Conduct

1. App Developer Investigation First, Facebook and Gibson Dunn deserve to be sanctioned for their repeated use of frivolous legal arguments to delay the production of highly probative evidence related to the App

Orin Snyder, who served as lead counsel when Gibson Dunn’s conduct was at its worst, should consider himself lucky that he has not been sanctioned personally. Presumably this ruling will help ensure that he will not be so lucky if he acts this way again.

11 While a court should ordinarily rely on 28 U.S.C. § 1927 and the Federal Rules of Civil Procedure to impose sanctions, if neither is “up to the task, the court may safely rely on its inherent power.” Chambers, 501 U.S. at 50. Section 1927 does not allow the court to impose sanctions against parties or law firms, so it does not apply to the circumstances of this case. Kaass L. v. Wells Fargo Bank, N.A., 799 F.3d 1290, 1293–94 (9th Cir. 2015). And while some of the misconduct could potentially be sanctioned under the Federal Rules of Civil Procedure, that misconduct is “intertwined within conduct that only the inherent power [can] address,” so sanctions under the Court’s inherent powers are appropriate. Chambers, 501 U.S. at 51. 10

Page 38

Developer Investigation.

To be clear, the Court does not find bad faith in the initial argument that all materials related to the investigation were privileged. Judge Corley herself acknowledged (before reviewing the documents) that there were “arguments both ways,” and the Supreme Judicial Court of Massachusetts has held (albeit with thin analysis) that certain ADI documents were covered by work-product or attorney-client privilege. See Attorney General v. Facebook, Inc., 487 Mass. 109, 130–31 (2021).

But Facebook and Gibson Dunn’s conduct surrounding that assertion of privilege— particularly their conduct in the wake of Judge Corley’s rejection of their blanket privilege argument—is sanctionable. The ADI documents were highly probative. Recall the memos discussed in Section I.A of this opinion: they identified apps that had access to millions of users’ information, even after Facebook purported to limit that access. They also offered insight into what Facebook knew and when. Recall, too, the email chain from 2019 that appeared to show Facebook considering the impact of its enforcement decisions on its revenue stream. Had Facebook gotten its way, none of these documents ever would have been produced. After Judge Corley rejected their argument about privilege, Facebook and Gibson Dunn engaged in what can only be described as an effort to gaslight their opponents (and the Court) over the production of Facebook’s internal communications and the communications with Facebook’s consultants. Take, for example, the plaintiffs’ concession that they did not need administrative emails—emails requesting information from apps or discussing scheduling— because they were only looking to discover the “underlying facts.” Facebook and Gibson Dunn used this statement to argue that the plaintiffs had conceded that they were not entitled to discover any communications about the App Developer Investigation at all. Facebook and Gibson Dunn did not make this argument once; they made it repeatedly. One wonders if the lawyers on the other side began to question their own sanity.

The same is true of Facebook and Gibson Dunn’s argument that Judge Corley had held the communications were not discoverable. Her order explicitly required Facebook and Gibson

Page 39

Dunn to work with Special Master Garrie to identify what else should be produced from the universe of ADI materials. And Judge Corley had not reviewed a representative set of communications when deciding the parties’ dispute; she had reviewed twenty documents blindly picked from Facebook’s privilege log. Moreover, those documents were not the focus of her order. As she made clear, her order adjudicated the privilege question broadly—not the discoverability of the twenty documents from the sampling exercise. Instead of fairly reading that order, Facebook and Gibson Dunn seized on a few passing comments Judge Corley made at a hearing months prior. Relying on these out-of-context comments (comments not included in her ruling), Facebook and Gibson Dunn argued that Judge Corley had silently adjudicated the discoverability of all ADI communications. And Orin Snyder argued, with his typical bombast, that this interpretation was based on “a lot of case law”—none of which seems to exist. Those arguments were frivolous, and they did nothing but delay production and waste the plaintiffs’ and the Court’s time.

It’s worth stepping back to reflect on the position Facebook and Gibson Dunn took on Facebook’s communications about the investigation. This case is about Facebook’s alleged policy of sharing Facebook users’ personal information with third parties without permission. It is also about Facebook’s alleged failure to prevent third parties from misusing the personal information they received. Of course, the App Developer Investigation was about largely the same thing: the extent to which third parties obtained and misused the personal information of Facebook users. Any first-year civil procedure student would know that internal communications between Facebook employees about the investigation would be a prime source of information relevant to this lawsuit. It’s equally obvious that Facebook’s communications with its outside consultants hired to investigate these apps would be relevant. Indeed, Special Master Garrie found that a “substantial number” of the communications he reviewed were “relevant to the case and not protected by privilege.” Dkt. No. 916-9 at 6. Finally, no reasonable person could argue that these documents—given their significant probative value—were too burdensome to identify and produce as a categorical matter. It is the height of bad faith to repeatedly resist the disclosure

Page 40

of such probative information by twisting the words of opposing counsel and the magistrate judge.

Facebook and Gibson Dunn’s conduct after Special Master Garrie ordered them to produce additional ADI documents further supports this finding of bad faith. To recall, Special Master Garrie originally ordered Facebook to produce all documents related to the investigation (with some exceptions for attorney communications). Facebook then moved for reconsideration. In its motion for reconsideration, Facebook argued that it should only be required to search for relevant materials from the documents it had already collected—it should not be required to collect any new documents because its existing set was adequate. Only after this Court threatened sanctions did Facebook and Gibson Dunn reveal that the set of previously collected documents did not include anything from after 2019 (even though the App Developer Investigation continued into 2020). Gibson Dunn now argues that it was not “aware” of this fact. But if that’s true, it means Facebook and Gibson Dunn were comfortable telling Special Master Garrie their previous collection was adequate—without ever inquiring into what they had actually collected. This conduct is symptomatic of their larger strategy: object first, investigate later (and only when forced). And that strategy supports the finding of bad faith. The plaintiffs complain of other conduct by Facebook and Gibson Dunn related to ADI discovery. They complain, for example, about Facebook and Gibson Dunn’s failure to use search terms such as “ADI” and “App Developer Investigation” when searching for communications about the App Developer Investigation. And they complain about Facebook and Gibson Dunn’s failure to search for all the apps Facebook investigated. In isolation, this conduct is more susceptible to an innocent explanation. After all, the plaintiffs could have helped ensure that the proper search terms were being used, and the Special Master’s order could have been more precise. But given the context, this conduct also likely reflects bad faith.

2. Named Plaintiff Data Facebook and Gibson Dunn’s misconduct as it relates to the named plaintiff’s information is also sanctionable. As with the App Developer Investigation, Facebook and Gibson

Page 41

Dunn used frivolous arguments to delay the production of a key category of information. As Judge Corley and Special Master Garrie explained—at least three times over the course of two years—discovery was not limited to information that Facebook admitted it had shared. First, in Discovery Order No. 9, Judge Corley held that discoverable information included a category of data that Facebook said was never shared at all. There is no reasonable interpretation of that order that limits discovery to data Facebook admitted it shared. Whether the information was actually shared was, as Judge Corley explained, an “open question,” and the plaintiffs were entitled to seek evidence on that question—including evidence about the information Facebook collected about them. Even if there had been any ambiguity in Judge Corley’s order, that ambiguity would have been eliminated by her repeated rejection of Facebook and Gibson Dunn’s argument. But they persisted.

Judge Corley envisioned a process by which the parties would work together to determine what universe of data existed and, from there, determine what could have been shared. This was a highly technical question: in the end, it took Special Master Garrie and the parties six months to determine what else should be produced. By consistently arguing that discovery was limited to information Facebook admitted it shared, Facebook and Gibson Dunn short-circuited that process. Without knowing the universe of named plaintiff data that existed, it would be difficult (if not impossible) to verify Facebook’s representations.

Judge Corley and Special Master Garrie should never have needed to clarify (even once, much less multiple times) that Facebook could not avoid identifying and producing some subset of information simply by asserting that it never shared that subset of information with third parties. Again, this whole case involved accusations that Facebook disclosed personal information about users to third parties surreptitiously, indiscriminately, and without permission. The first step in getting to the bottom of those accusations was to figure out what information Facebook collected on the named plaintiffs, as a means to figuring out which pieces of information Facebook actually disclosed. The argument that “we didn’t share that information, so we don’t need to provide it in discovery” is obviously contrary to the right of the plaintiffs to

Page 42

test Facebook’s assertions in an adversarial litigation process.

Moreover, even if this argument were somehow not frivolous when Facebook and Gibson Dunn first made it, it’s clear that they were pressing the argument for an improper purpose: their actions were intended to obfuscate and delay the resolution of a major issue in the case. From the very beginning, Facebook and Gibson Dunn stonewalled, telling the plaintiffs to “Google” information about Facebook’s data architecture. From then on, they consistently failed to identify materials responsive to the plaintiffs’ requests and Judge Corley’s order. When pressed, Facebook and Gibson Dunn submitted a “nonsensical” response to Special Master Garrie. And then, on appeal, Facebook and Gibson Dunn misrepresented Special Master Garrie’s order to Judge Corley.

That improper purpose is also clear when one considers Facebook and Gibson Dunn’s other argument: that production of any additional named plaintiff data would create a major burden, and so it was not proportional to the needs of the case. Facebook and Gibson Dunn made this argument even though they had already preserved two additional sources of named plaintiff data: the Switchboard profiles and the identified Hive tables. As early as July 2020, Judge Corley ordered the parties to meet and confer to “discuss in detail each side[’s] understanding of what precisely has been produced and precisely what is the data that is being withheld as not relevant or not reasonably available.” Dkt. No. 487 at 1–2. At that meet and confer (at the latest), Facebook and Gibson Dunn should have told the plaintiffs about the Switchboard profiles and the Hive tables.

Facebook and Gibson Dunn now offer two explanations for their failure to disclose the Hive tables. First, they say the information in the tables was not relevant or had already been produced. Second, they say Facebook erred on the side of over-preserving information, and they weren’t required to disclose everything that was preserved. But neither explains why Facebook and Gibson Dunn didn’t just tell the plaintiffs that they had identified a subset of Hive tables, especially when the parties spent months litigating the production of information from the Hive. Perhaps Gibson Dunn’s attorneys were not aware of the Hive tables (although Facebook’s own

Page 43

witness stated that the materials were preserved with the help of “outside counsel”). If the attorneys were just ignorant, that is almost as bad: it is reflective of Gibson Dunn’s “object first, investigate later” strategy. Rather than determining whether Facebook could produce a small number of tables that were likely to contain probative information, Gibson Dunn consistently argued that Hive was totally inaccessible.

Equally troubling is the misconduct related to the Switchboard profiles. Facebook and Gibson Dunn chose to produce the plaintiffs’ information in a difficult and obscure format. Facebook’s own witness testified that Switchboard was “more usable”—and it contained additional information—but Facebook and Gibson Dunn failed to disclose its existence for years. Facebook and Gibson Dunn now assert that the Switchboard profiles are just as unwieldy as DYI. Indeed, when Facebook produced the named plaintiffs’ Switchboard profiles, they had to do so in multiple PDFs, including one that was 45,000 pages long. But that does not justify Facebook and Gibson Dunn’s lack of candor. The plaintiffs consistently complained about the difficulty in dealing with the DYI files, and they explicitly asked Facebook about the tools it used to provide information to law enforcement. Dkt. Nos. 1060 at 26; 1103-9 at 95. Facebook and Gibson Dunn never suggested there was another way to produce the plaintiffs’ information. Even if Switchboard was unwieldy for different reasons, Facebook and Gibson Dunn could not decide in secret that it was irrelevant.

More generally, Facebook and Gibson Dunn now argue that the plaintiffs elevate form over substance, and that the information in Hive and Switchboard is duplicative or insignificant. Even if that’s true, it was bad faith to argue that any additional discovery was not proportional to the needs of the case, while withholding the fact that certain Hive tables and Switchboard profiles were easily and readily accessible. It was not for Facebook and Gibson Dunn to unilaterally decide the scope and extent of discovery. Moreover, Facebook and Gibson Dunn’s arguments have always been a moving target. For every new deficiency in discovery, they’ve offered a new excuse—and that makes it hard to credit their assertions now.

Page 44

B. Other Evidence of Bad Faith 1.

Depositions

The plaintiffs have not sought sanctions for Facebook and Gibson Dunn’s conduct during depositions, but that conduct underscores the conclusion that both the client and its lawyers were operating in bad faith. There are a number of examples but suffice to highlight two. The first involves the testimony of Jackie Chang and Simon Cross. Facebook’s internal documents suggest that Chang was intimately involved in whitelisting, the process by which apps were given ongoing access to friends’ information despite Facebook’s ostensible decision to limit that access in 2014. When Facebook first developed the process of whitelisting, Chang was a “strategic partner manager,” working closely with Facebook’s business partners. See Dkt. No. 1103-24 at 25. Emails from the time period suggest that Chang had a say in the whitelisting process. Dkt. No. 1103-21 at 29–31; see also Dkt. No. 1103-24 at 169 (discussing an email thread stating, “Jackie leading on putting together a new whitelist process with Legal and Product”); Dkt. No. 1103-24 at 268–69 (discussing email thread stating that Chang was tasked with “PR messaging” and “maintain[ing] relationships” prior to the conference at which Facebook announced it would limit access to friends’ information). Chang also spent nine hours with Gibson Dunn preparing for the deposition, and she was being deposed in connection with a high-profile case involving data sharing. In that context, Chang’s statements that she did not remember basic facts about Facebook’s data-sharing practices demonstrate Facebook’s bad faith. Her demeanor throughout the deposition (which the Court watched) suggests that she did not want to discuss her decision-making process because she was afraid of getting into trouble (or getting Facebook into trouble).

But even if Chang miraculously remembered nothing about whitelisting—or the fact that Facebook allowed apps to access friends’ information at all—she resisted more basic questions. Although she was not a designated 30(b)(6) witness, she is still a Facebook employee. Her obvious hostility to the litigation—and Facebook and Gibson Dunn’s failure to ensure that she made a minimal effort to cooperate—is another example of the overall obstructionist approach.

Page 45

And after Chang’s deposition, Cross compounded this problem by repeatedly telling the plaintiffs to talk to Chang, even referring them to her to discuss an email thread he was included on.12 The conduct of Facebook witness Allison Hendrix and Gibson Dunn attorney Robert Blume was even worse. The Federal Rules of Civil Procedure require 30(b)(6) witnesses to give “complete, knowledgeable, and binding answers” on the corporation’s behalf. Ecclesiastes 9:1011-12, Inc. v. LMC Holding Co., 497 F.3d 1135, 1146 (10th Cir. 2007). The witnesses must be “unevasive.” Starlight International Inc. v. Herlihy, 186 F.R.D. 626, 639 (D. Kan. 1999). Instead, Hendrix and Blume worked in concert to evade the plaintiffs’ questions. For his part, Blume instructed Hendrix not to answer certain questions based on his view that the questions were outside the scope of the deposition notice. As Facebook now acknowledges, that’s an improper practice: if an attorney believes a question is outside the scope of a notice, the attorney “shall state the objection on the record and the witness shall answer the question, to the best of the witness’s ability.” Detoy v. City & County of San Francisco, 196 F.R.D. 362, 367 (N.D. Cal. 2000); see also Lykins v. CertainTeed Corp., 555 F. App’x 791, 797–98 (10th Cir. 2014); La Jolla Spa MD, Inc. v. Avidas Pharmaceuticals, LLC, No. 17-CV-1124-MMA(WVG), 2019 WL 4141237, at *7 (S.D. Cal. Aug. 30, 2019); Best Buddies Leasing, LLC v. Cabrillo Yacht Sales, No. 07CV1121 BTM (AJB), 2009 WL 10671517, at *2 (S.D. Cal. Apr. 23, 2009); Board of Trustees of Leland Stanford Junior University v. Tyco Int’l, Ltd., 253 F.R.D. 524, 527 (C.D. Cal. 2008); Dkt. No. 1052-2 at 40. But at the deposition, Blume instructed Hendrix not to answer at least 22 times.

Blume also violated the Federal Rules of Civil Procedure by arguing his objections on the

12

Unlike Chang (and, as discussed later in this ruling, Hendrix), Cross did not come across as openly hostile to the litigation, and much of his testimony seemed intended to be helpful. But he was designated to testify about whitelisting, and Facebook and Gibson Dunn should have ensured he was prepared to address Facebook’s internal communications about its decisionmaking process. That’s all the more true because the plaintiffs provided these documents in advance of the deposition, and Facebook and Gibson Dunn knew that Chang had refused to offer any insight into them.

Page 46

record. During a deposition, counsel should “note[]” their objections, “but the examination still proceeds; the testimony is taken subject to any objection.” Fed. R. Civ. P. 30(c)(2). And the objections “must be stated concisely in a nonargumentative and nonsuggestive manner.” Id. In blatant violation of this rule, Blume argued his objections, loudly and obnoxiously. This wasted the plaintiffs’ deposition time—time limited by Court order. Moreover, these objections were often frivolous. For instance, Hendrix was designated to discuss Facebook’s process of developing privacy settings and controls; it was not outside the scope for the plaintiffs to ask her about Facebook’s privacy shortcuts, especially when she had already testified about them. These objections seemed intended to make it difficult or impossible for the plaintiffs to obtain probative testimony about information that was obviously central to the case. For instance, Hendrix testified that “friend permissions”—the ability of apps to access friends’ information—were “no longer a thing from a product perspective” after the “deprecation” of the earlier developer interface. Dkt. No. 1085-22 at 228–29. It was reasonable for the plaintiffs to follow up by asking about whitelisting. After all, whitelisted apps were able to access friend permissions even after the transition to the new interface, and so the practice would seem to contradict Hendrix’s testimony. But Blume interrupted this line of questioning by objecting. Hendrix’s conduct, too, was totally inappropriate. Instead of testifying “unevasively,” as a Rule 30(b)(6) witness is required to do, Hendrix refused to cooperate, even telling the plaintiffs “no,” she would not unpack one of her answers. It seems that Blume used his objections to coach Hendrix about his narrow view of the deposition notice. Hendrix then refused to answer questions based on that narrow view—even in the absence of an objection. The tension in the deposition reached its peak when Hendrix felt that the plaintiffs were asking repetitive questions and responded that she would “do [her] own bitching and moaning” rather than waiting for her lawyer to do it for her.

It is true that the 30(b)(6) deposition notice was written broadly, and it might be difficult to prepare a witness given that breadth. And the plaintiffs’ questions were not always carefully crafted. For instance, the plaintiffs asked Hendrix if she was aware of “the instances” in which

Page 47

developers did not comply with Facebook’s terms, a question that could be interpreted as seeking testimony about every single instance of noncompliance. Dkt. No. 1085-22 at 327. But, in line with her duty to be cooperative, Hendrix could have offered representative examples—it was not appropriate for her to “bitch and moan” instead.

Towards the end of Hendrix’s deposition, Special Master Garrie appeared to condone Blume’s speaking objections by adjudicating them during the deposition. And he erroneously stated that it was appropriate for Gibson Dunn to instruct Hendrix not to answer certain questions as outside the scope of the notice. While this may have exacerbated the problems, it appears that Special Master Garrie stepped in only after the deposition became so heated that it would have otherwise fallen apart. The attorneys were already arguing over nearly every question; it seems that Special Master Garrie thought that adjudicating the issues on the spot might help move the deposition along. His actions—late in the deposition, after hours of argument—do not excuse Facebook and Gibson Dunn’s misconduct.

Of course, Facebook and Gibson Dunn agreed to pay the plaintiffs’ attorney’s fees and the Special Master’s fees associated with Hendrix’s deposition—presumably because it took place after this Court had taken Facebook and Gibson Dunn to task for their behavior in this case. And the plaintiffs have not sought sanctions for deposition misconduct more generally. But that does not shield it from scrutiny as it relates to this sanctions motion. To the extent there could be any doubt that Facebook and Gibson Dunn acted in bad faith with respect to discovery, their conduct during the depositions helps put that doubt to rest.

2. Designation of Documents as Privileged Finally, Facebook and Gibson Dunn’s over-designation of documents as privileged supports the Court’s finding of bad faith. First, Facebook’s internal communications—although not dispositive—suggest it has a culture hostile to litigation. It seems that Facebook employees are taught to improperly “privilege” documents based on their perceived sensitivity. Second, Gibson Dunn designated a massive number of documents as privileged, even though for many of them it’s difficult to imagine any conceivable argument in support of that

Page 48

assertion. Gibson Dunn’s only response is that nervous associates over-designated the documents to avoid waiving privilege. But Gibson Dunn has an obligation to ensure that even its nervous associates follow the law. The more likely explanation is that Facebook and Gibson Dunn had backed themselves into a corner: After delaying production for years, they were forced to meet this Court’s deadlines, and they took the shortcut of over-designating documents rather than reviewing them properly.

Although Facebook and Gibson Dunn revisited these privilege designations and produced a significant number of documents, they did so only after the plaintiffs requested it (and after the Court told the plaintiffs that their complaints should be made in a motion for sanctions). While the Court will not order payment of attorney’s fees for this conduct, it further supports the conclusion that Facebook and Gibson Dunn operated in bad faith.

IV Confronted with the totality of their conduct, Facebook and Gibson Dunn offer no convincing explanation. Predictably, they lead with the notion that the problems in this case were largely the fault of plaintiffs’ counsel. They say plaintiffs’ counsel asked for too much and refused to narrow their requests, engaging in dilatory discovery misconduct of their own. The Court will assume, solely for the sake of adjudicating this motion, that there is some truth to these assertions.

Even so, the alleged misconduct of plaintiffs’ counsel would not come close to excusing that of Facebook and Gibson Dunn. No matter the conduct of the opposing party, counsel cannot twist their words—not to mention the words of the Court—in support of frivolous arguments. They cannot resist the disclosure of obviously discoverable information. They cannot ignore potential sources of evidence, only for opposing counsel to learn about those sources at a 30(b)(6) deposition near the close of discovery. They cannot treat depositions like fighting matches. And they cannot encourage their client’s obstinance—no matter how difficult the subject matter, and no matter how imprecise the other side’s questions might be. It’s worth remembering that Facebook and Gibson Dunn had superior access to all the

Page 49

evidence needed in this case. How were the plaintiffs supposed to know what specific information Facebook collected about them or shared with third parties? How were they to know what apps their Facebook friends had downloaded, and what permissions those apps had requested? How were they to know about Facebook’s confidential relationships with its business partners? Through discovery, the plaintiffs were entitled to this evidence—that is the whole point of civil discovery.

Facebook and Gibson Dunn also nitpick Judge Corley and Special Master Garrie’s discovery orders, looking for any potential ambiguity to justify their conduct. As already discussed, Facebook and Gibson Dunn’s interpretations of these orders were often laughable. But their nitpicking is also part of a larger problem. Sometimes discovery violations are blatant: a client shreds a crucial document or threatens the opposing party. Much of the discovery misconduct here was more insidious. No court ruling can ever be completely clear, addressing every conceivable aspect of discovery. Discovery—and the court system as a whole—depend on the good faith of the parties. Counsel must reasonably interpret a court’s orders and seek clarification when needed. Facebook and Gibson Dunn did the opposite: they pounced on slight ambiguities (or fabricated ambiguities) and used them to obfuscate and obstruct discovery for years.

Facebook and Gibson Dunn also emphasize how difficult this case has been to litigate, given the technical complexities involved. It’s true that this was a complex case, and complexity will often result in mistakes and miscommunication. But that’s not what this sanctions ruling is about. It is about delay and unnecessary expense resulting from repeated frivolous arguments, obfuscation, and reflexive opposition.

Finally, Facebook and Gibson Dunn do some obligatory sword-falling, apologizing for their “role” in the combat and emphasizing that their behavior improved after this Court began threatening sanctions in February 2022. That argument warrants two responses. First, although their conduct did improve, it went from an F to perhaps a D. Facebook and Gibson Dunn became more responsive and proactive in handling document discovery. But much of their deposition

Page 50

misconduct occurred after February 2022, as did the massive privilege over-designation. Second, even accepting that their conduct changed, sanctions would still be warranted for their earlier behavior. In many cases, when attorneys and their clients improve after receiving a warning, leniency is warranted. This is not one of those cases.

The Court reaches this conclusion after reflecting (at considerable length) on what might have motivated Facebook and Gibson Dunn to conduct themselves as they did. There’s a small chance, of course, that Facebook and Gibson Dunn were just overly zealous. And perhaps there’s some minute chance that they were just incompetent. But when you consider the context, it’s far more likely that the misconduct was of a different, more nefarious sort. Recall that Facebook was being sued for conduct that was the subject of a major scandal, a scandal for which the company issued numerous public apologies. Recall that the Federal Trade Commission brought an action against Facebook in the wake of the scandal, and that Facebook paid $5 billion to settle the matter. In this case, Facebook sought dismissal at an early stage, but that attempt was unsuccessful. After publicly apologizing, paying a massive penalty to the FTC, and losing that early motion, does anyone really think that Facebook was planning on taking this case to trial? Or was Facebook, with the assistance of its lawyers, executing a different play from the playbook: resist discovery as long as possible, make things increasingly difficult and expensive and frustrating for the opposition, and hope that would drive down the case’s settlement value? This is, by far, the most likely explanation for Facebook and Gibson Dunn’s conduct. This is not to suggest that there necessarily was some back-room meeting at which Facebook and its lawyers said, “Ok, here’s the plan, let’s be as unreasonable and obstructionist as possible in the hope that we’ll frustrate the plaintiffs into settling for less than they could get if we were cooperative in discovery.” Unfortunately, this approach to litigation is common enough that no such meeting was necessary. Facebook and its lawyers fell into their roles with ease, and then they took things way too far. For the systematic, conscious, bad-faith approach they took to this litigation, Facebook and Gibson Dunn must be sanctioned.

Page 51

V The plaintiffs have complained of several categories of misconduct, but as explained, the Court will only sanction Facebook and Gibson Dunn for the most serious: the misconduct related to the App Developer Investigation and the named plaintiff data. The plaintiffs seek $2,037.540.28 in sanctions related only to those two categories.13 If the Court were to sanction Facebook and Gibson Dunn for everything else the plaintiffs point to, the amount would certainly be much higher.

The plaintiffs request $1,773,042.50 in fees, including the fees incurred in moving for sanctions.14 The plaintiffs also seek $264,497.78 in costs for the fees paid to mediator Judge Andler and Special Master Garrie.

As explained in Section II, a court may only award fees and costs “incurred because of the misconduct at issue.” Goodyear, 581 U.S. at 108; see also Blixseth, 854 F.3d at 631 (explaining that fees incurred in moving for sanctions necessarily meet that standard). But lower courts need not “become green-eyeshade accountants” when assessing sanctions. Goodyear, 581 U.S. at 110 (quoting Fox, 563 U.S. at 838). “The essential goal in shifting fees is to do rough justice, not to achieve auditing perfection.” Id. (quoting Fox, 563 U.S. at 838) (quotations omitted).

The only way to award sanctions here is with a rough-but-conservative estimate. First, the Court will deduct $187,383.27 in fees and costs associated with the App Developer Investigation that were incurred before Judge Corley rejected Facebook’s blanket assertion of privilege on September 9, 2021.15 Although the plaintiffs argue that Facebook and Gibson Dunn engaged in misconduct before September 9, 2021, this ruling focuses primarily on their behavior

The plaintiffs’ motion for leave to file a reply in support of the amount of sanctions is granted. See Dkt. No. 1090.

14 In all, the plaintiffs spent even more moving for sanctions—a whopping $1,156,127.50—but they estimate that $693,676.50 was related to ADI and the named plaintiff data specifically. 15 In their request for costs related to discovery mediation, the plaintiffs did not distinguish between costs related to the named plaintiff data and costs related to ADI. In an abundance of caution, the Court will assume all of the costs for discovery mediation incurred prior to September 9, 2021 were associated with ADI.

13

Page 52

afterwards, and so it would not be appropriate to impose sanctions for the ADI-related fees and costs incurred prior to Judge Corley’s decision.

Beyond that, given the pervasive nature of Facebook and Gibson Dunn’s misconduct, it is nearly impossible to disentangle the work that was caused by the misconduct from the work that would have been done anyway. In an abundance of caution (and after considering Facebook’s arguments regarding the reasonableness of the fees and costs), the Court will cut the plaintiffs’ remaining request in half. The plaintiffs are therefore awarded $800,217.38 in fees and $124,861.13 in costs for a total of $925,078.51. This amount likely represents just a portion of the fees and costs reasonably incurred because of Facebook and Gibson Dunn’s misconduct related to discovery on ADI and the named plaintiff data. While the amount is almost certainly under-compensatory, there is no chance that it’s over-compensatory. Given the limits on the authority of courts to impose sanctions, it is better to err on the side of caution. One more point: Facebook and Gibson Dunn argue that the plaintiffs’ supplemental brief on the amount of fees and costs raises “serious due process concerns.” They argue that they have not had “a full and fair opportunity to address the…question [of] whether Plaintiffs are even entitled to their newly requested fees and costs—for example, whether those fees are attributable to misconduct.” But the vast majority of Facebook and Gibson Dunn’s supplemental brief addressed that very question. Indeed, Sections I and II are entitled: “Plaintiffs Have Failed to Demonstrate That Any ADI Fees or Costs Resulted from the Alleged Misconduct,” and “Plaintiffs Have Failed to Demonstrate That Any Fees or Costs Associated with NP Data Resulted from Alleged Misconduct.” Facebook and Gibson Dunn also argue that the plaintiffs’ supplemental briefs include fees and costs not addressed in their original motion. But Facebook and Gibson Dunn’s due process rights are not violated merely because the Court allowed the parties to submit supplemental briefing. See, e.g., True Health Chiropractic Inc v. McKesson Corp., No. 13CV02219HSGDMR, 2015 WL 3453459, at *1–2 (N.D. Cal. May 29, 2015) (granting motion for sanctions and then allowing plaintiffs to file a motion substantiating the fees). Facebook and

Page 53

Gibson Dunn are entitled to notice and an opportunity to be heard on both the misconduct and the appropriate amount of sanctions. F.J. Hanshaw Enterprises, Inc., 244 F.3d at 1143. That standard is easily met here. In all, Facebook and Gibson Dunn have provided the Court with almost 150 pages of briefing in opposition to these sanctions. That doesn’t include the hundreds of pages of exhibits submitted in support of their briefs. In response to the plaintiffs’ supplemental submission on the amount of sanctions specifically, Facebook and Gibson Dunn provided a 27-page brief and a 488-page expert analysis of the requested fees. VI Facebook and Gibson Dunn are ordered to pay the plaintiffs $925,078.51 in sanctions. They are jointly and severally liable for this amount, and they must compensate the plaintiffs within 21 days of this ruling. To be sure, this amount is loose change for a company like Facebook, and even for a law firm like Gibson Dunn. But it’s important for courts to help protect litigants from suffering financial harm as a result of their opponents’ litigation misconduct. And hopefully, this ruling will create some incentive for Facebook and Gibson Dunn (and perhaps even others) to behave more honorably moving forward.

IT IS SO ORDERED.

Dated: February 9, 2023 ______________________________________ VINCE CHHABRIA United States District Judge