Rule 23 Certification Standards in Privacy Class Actions

Rule 23 Applied to Privacy Claims

Certification is the stage at which most privacy litigation is effectively resolved, and the text that governs it is not privacy-specific. Federal Rule of Civil Procedure 23(a) permits representative litigation "only if" the class is so numerous that joinder is impracticable, there are questions of law or fact common to the class, the representatives' claims or defenses are typical, and the representatives will fairly and adequately protect the interests of the class. A class seeking damages must also satisfy Rule 23(b)(3), which requires the court to find "that the questions of law or fact common to class members predominate over any questions affecting only individual members, and that a class action is superior to other available methods for fairly and efficiently adjudicating the controversy."

In Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338 (2011), the Court held that Rule 23 "does not set forth a mere pleading standard" and that a party seeking certification "must affirmatively demonstrate his compliance" with it. On commonality, the Court framed the question as whether a common contention is "capable of classwide resolution," such that "its truth or falsity will resolve an issue that is central to the validity of each one of the claims in one stroke." Absent "some glue holding together the alleged reasons for those decisions," the Court reasoned, it would be impossible to say that examining all the class members' claims would produce a common answer.

That inquiry reaches the merits, but only so far. In Amgen Inc. v. Connecticut Retirement Plans and Trust Funds, 568 U.S. 455 (2013), the Court held that while the analysis is "rigorous" and may "entail some overlap with the merits of the plaintiff's underlying claim," Rule 23 "grants courts no license to engage in free-ranging merits inquiries at the certification stage. Merits questions may be considered to the extent — but only to the extent — that they are relevant to determining whether the Rule 23 prerequisites for class certification are satisfied."

Ascertainability and Device-Level Data

Privacy classes are frequently defined by conduct recorded against an identifier — a browser, a device, an account — rather than by a name on a purchase record. Whether Rule 23 requires a plaintiff to show at certification how those members will be identified is a question on which the courts of appeals have not agreed.

The Third Circuit requires it. In Byrd v. Aaron's Inc., 784 F.3d 154 (3d Cir. 2015), the court described a two-part test: a plaintiff must show that the class is "defined with reference to objective criteria" and that there is "a reliable and administratively feasible mechanism for determining whether putative class members fall within the class definition," proved by a preponderance of the evidence.

The Ninth Circuit declined to adopt that prerequisite. In Briseno v. ConAgra Foods, Inc., 844 F.3d 1121 (9th Cir. 2017), the court reasoned that Rule 23(a) enumerates "[p]rerequisites" and does not mention administrative feasibility, that the enumeration is properly read as exhaustive, and that imposing a separate feasibility requirement "would render that manageability criterion largely superfluous" given Rule 23(b)(3)(D)'s direction to consider "the likely difficulties in managing a class action." Citing Amchem Products, Inc. v. Windsor, the court added that federal courts "lack authority to substitute for Rule 23's certification criteria a standard never adopted."

The practical difference is where the identification problem is litigated rather than whether it matters. In the Third Circuit line it is a threshold showing; in the Ninth Circuit line the same concern is routed through predominance, manageability and superiority.

Predominance When Consent Varies

Consent is often the element that varies most across a privacy class, and it reaches certification through predominance rather than through the class definition. Cordoba v. DIRECTV, LLC, 942 F.3d 1259 (11th Cir. 2019), is the clearest illustration. The certified class covered people called after the defendant's telemarketer failed to maintain an internal do-not-call list. The court held that class members who had never asked to stop being called would lack Article III standing, because there is "no remotely plausible causal chain linking the failure to maintain an internal do-not-call list to the phone calls received by class members who never said" they did not want to be called again.

The court was careful about what followed from that. It agreed that "for a class action to be justiciable, 'all that the law requires' is that a named plaintiff have standing," and that its precedent required no more at certification. The difficulty was "not that this claim is not justiciable — plainly it is — but rather that many claims of the absent class members may not be." Quoting a treatise, the court described the issue as one "of Rule 23, not of Article III," directing district courts to consider "how the class will prove causation and injury and whether those elements will be subject to class-wide proof."

Where the contested threshold question can be answered once for everyone, predominance survives. In Patel v. Facebook, Inc., 932 F.3d 1264 (9th Cir. 2019), the defendant argued that determining whether each class member's photo was taken, uploaded or scanned "primarily and substantially within" Illinois would require "countless mini-trials." The court disagreed, holding that "[t]hese threshold questions of BIPA's applicability can be decided on a class-wide basis" and noting that a certification order "is not final or irrevocable" and may be altered or amended under Rule 23(c)(1)(C).

Uninjured Class Members

In TransUnion LLC v. Ramirez, 594 U.S. 413 (2021), the Court stated that "[e]very class member must have Article III standing in order to recover individual damages," quoting Chief Justice Roberts's concurrence in Tyson Foods that "Article III does not give federal courts the power to order relief to any uninjured plaintiff, class action or not." Footnote 4 then reserved the question that matters most at certification: "We do not here address the distinct question whether every class member must demonstrate standing before a court certifies a class," citing Cordoba.

The related question of whether uninjured members may recover was also left open. In Tyson Foods, Inc. v. Bouaphakeo, 577 U.S. 442 (2016), the Court acknowledged that "the question whether uninjured class members may recover is one of great importance" but held it "not, however, a question yet fairly presented by this case, because the damages award has not yet been disbursed, nor does the record indicate how it will be disbursed."

The courts of appeals have filled that space differently. Sitting en banc in Olean Wholesale Grocery Cooperative, Inc. v. Bumble Bee Foods, LLC, 31 F.4th 651 (9th Cir. 2022), the Ninth Circuit rejected the argument "that Rule 23 does not permit the certification of a class that potentially includes more than a de minimis number of uninjured class members," holding the position "inconsistent with Rule 23(b)(3), which requires only that the district court determine after rigorous analysis whether the common question predominates over any individual questions, including individualized questions about injury or entitlement to damages." A footnote tied the two lines together: because TransUnion requires standing to recover damages, "Rule 23 also requires a district court to determine whether individualized inquiries into this standing issue would predominate over common questions."

The en banc majority read the leading contrary decisions as fact-bound rather than categorical, describing the First Circuit's In re Asacol Antitrust Litigation, 907 F.3d 42 (1st Cir. 2018), and the D.C. Circuit's Rail Freight II as holding that predominance fails "when the need to identify uninjured class members 'will predominate and render an adjudication unmanageable.'" In Asacol itself, roughly ten percent of the class was presumed uninjured, and the court examined whether unrebutted affidavit testimony could serve as the mechanism for screening them out.

Damages Models

Comcast Corp. v. Behrend, 569 U.S. 27 (2013), governs the evidentiary showing on classwide damages. The district court there had accepted one of four liability theories, and the plaintiffs' expert conceded his regression model did not isolate damages resulting from any single theory. The Court held that "a model purporting to serve as evidence of damages in this class action must measure only those damages attributable to that theory," and that a model which "does not even attempt to do that" cannot establish that damages are "susceptible of measurement across the entire class for purposes of Rule 23(b)(3)."

Two qualifications travel with that holding. The Court stated that "[c]alculations need not be exact," and that the requirement is consistency between the damages case and the liability case. And individualized damages questions are not automatically fatal: Olean collected authority that "[t]he presence of individualized damages issues" does not preclude certification, because "[c]lass-wide proof is not required for all issues."

Statutory damages raise a distinct question, because the aggregate can be very large without any individualized calculation at all. In Patel, the defendant argued that the potential classwide award under the Illinois Biometric Information Privacy Act defeated superiority. The Ninth Circuit held that whether "the potential for enormous liability can justify a denial of class certification depends on [legislative] intent," and that because nothing in BIPA's text or history indicated the General Assembly intended a cap, denying certification on that basis would "subvert [legislative] intent."

Circuit Divergence

Settlement Class Practice

A class proposed for settlement is not exempt from Rule 23. In Amchem Products, Inc. v. Windsor, 521 U.S. 591 (1997), the Court held that a district court "need not inquire whether the case, if tried, would present intractable management problems . . . for the proposal is that there be no trial," but that "other specifications of the Rule — those designed to protect absentees by blocking unwarranted or overbroad class definitions — demand undiluted, even heightened, attention in the settlement context." The reason given was that a court certifying a settlement class "will lack the opportunity, present when a case is litigated, to adjust the class, informed by the proceedings as they unfold."

Rule 23(e) now sets out the procedure in detail. Under Rule 23(e)(1)(B) the court directs notice only if the parties' showing establishes that it "will likely be able to" both approve the proposal and certify the class. Rule 23(e)(2) permits approval "only after a hearing and only on finding that it is fair, reasonable, and adequate," after considering four enumerated matters:

• whether "the class representatives and class counsel have adequately represented the class"
• whether "the proposal was negotiated at arm's length"
• whether "the relief provided for the class is adequate," taking into account the costs, risks and delay of trial and appeal, the effectiveness of the proposed method of distributing relief and processing claims, the terms of any fee award including timing of payment, and any agreement identified under Rule 23(e)(3)
• whether "the proposal treats class members equitably relative to each other"

Rule 23(e)(5)(B) separately provides that no payment or other consideration may be given in connection with forgoing or withdrawing an objection, or abandoning an appeal from a judgment approving the proposal, unless the court approves it after a hearing.

What Remains Unresolved

Three questions are open on the face of the authorities. TransUnion reserved whether every class member must demonstrate standing before certification. Tyson Foods reserved whether uninjured class members may recover from a classwide award. And the courts of appeals continue to divide over whether ascertainability is a distinct certification requirement or an aspect of manageability. Each of those splits is being applied to privacy claims through the same Rule 23 text rather than through any privacy-specific standard.

Frequently Asked Questions