UNITED STATES DISTRICT COURT

NORTHERN DISTRICT OF CALIFORNIA

IN RE: FACEBOOK, INC. CONSUMER

Case No. 18-md-02843-VC

ORDER GRANTING IN PART

PLAINTIFFS’ MOTION FOR

SANCTIONS

Re: Dkt. Nos. 879, 1007-3

information with other companies. But Facebook insisted that: (1) it need not disclose to

the plaintiffs what information it had collected about them unless it had shared that

information with third parties; and (2) the plaintiffs were required to take at face value

Facebook’s assertions about what information it had shared. Merely reciting this

argument shows how ridiculous it is, but Facebook and Gibson Dunn repeated it over,

and over, and over again—despite the presiding magistrate judge telling them many times

that it made no sense.

• In the wake of the Cambridge Analytica scandal, Facebook investigated other apps that

might have misused private user information. After the magistrate judge ruled that the

investigation was not privileged as a blanket matter, Facebook and Gibson Dunn insisted

they had no real argument for withholding these documents, Facebook and Gibson Dunn

contorted various statements made by opposing counsel and the magistrate judge beyond

recognition, using them to argue that everyone had already agreed that Facebook need not

produce the communications—even as the plaintiffs continued to demand them. And

again, after being told repeatedly that these arguments made no sense, Facebook and

Gibson Dunn insisted on pressing them.

• Facebook’s witnesses and lawyers deliberately prevented the plaintiffs from obtaining

probative information during depositions. For example, during a deposition of one

Facebook employee whom Facebook designated to testify about the company’s

objection. Eventually, the deposition became so hostile that the witness stated she would

do her own “bitching and moaning” about the plaintiffs’ questions.

• All the while, Facebook and Gibson Dunn had the audacity to accuse the plaintiffs’

lawyers of delaying the case, and to assert that the plaintiffs’ reasonable efforts to obtain

obviously relevant discovery were frivolous. It’s almost as if Facebook and Gibson Dunn

spent the better part of three years trying to gaslight their opponents, not to mention the

Court.

Sometimes lawyers and their clients engage in conduct of this sort because they are

incompetent. Facebook and Gibson Dunn are not incompetent. Sometimes lawyers reflexively

oppose the other side’s requests without giving any thought to their actions. That does not seem

During the 2016 presidential election, Cambridge Analytica, a British consulting firm,

sent targeted political ads to voters using personal information gleaned from millions of

Facebook accounts. Cambridge Analytica had purchased the information from Aleksandr Kogan,

a data scientist at the University of Cambridge. Kogan was able to collect this information

through an app he launched on Facebook’s platform. The app interacted with Facebook users and

gave Kogan access to their personal information, as well as the personal information of their

Facebook friends. Through this process, Kogan was able to compile a dataset that included

information on 87 million Facebook users—even though only around 300,000 users had

downloaded the app.

Following the scandal, reports emerged suggesting that the ability of people like Kogan

and entities like Cambridge Analytica to obtain sensitive information was the norm rather than

the exception. In response, the Federal Trade Commission launched an investigation into

whether Facebook’s practices violated a 2012 consent decree that required Facebook to maintain

a reasonable privacy program and prohibited the company from making misrepresentations about

repeating that apology.

Facebook’s then-COO Sheryl Sandberg echoed that message, saying

that Facebook should have “taken…steps years ago” to prevent abuse on the platform and

acknowledging that Facebook “made some really bad mistakes.”

Dozens of private lawsuits were also filed by Facebook users against the company, and

FTC Imposes $5 Billion Penalty and Sweeping New Privacy Restrictions on Facebook, Federal

Trade Commission (July 24, 2019), https://perma.cc/2WPY-JZNY.

Steve Inskeep, Full Transcript: Facebook COO Sheryl Sandberg on Protecting User Data,

NPR (April 5, 2018), https://perma.cc/3SWC-LXUP.

the cases were assigned to this Court for pretrial proceedings.

The Court then appointed two

attorneys to serve as lead plaintiffs’ counsel, and those attorneys filed a consolidated class action

complaint, asserting a variety of claims under federal and state law. The complaint was filed on

behalf of roughly three dozen individual Facebook users. These “named plaintiffs” proposed to

represent a class of all Facebook users whose personal information was improperly disseminated

or inadequately protected by Facebook from 2007 to the present.

The lawsuit alleged that Facebook allowed app developers operating on the company’s

platform to ask users for permission to access their friends’ personal information, and that this

practice allowed the apps to collect vast amounts of the friends’ information without their

consent. Around 2014, Facebook decided to limit app developers’ ability to access users’

friends’ information, but the plaintiffs alleged that Facebook gave certain preferred apps—

sometimes described as “whitelisted apps”—continued access based on concerns about

about users and their friends with these (and other) business partners in exchange for personal

information collected by those business partners. As with the app developers, the plaintiffs

alleged that Facebook did not adequately disclose to its users this practice of trading their

personal information.

Finally, the plaintiffs alleged that Facebook failed to control and monitor app developers’

and business partners’ use of all this information. Although Facebook had a policy prohibiting

app developers from using the information for any purpose other than improving their app, the

transfer the suits to a single federal judge for pretrial proceedings. Here, the panel determined

that such a transfer was warranted, and it assigned all the lawsuits to this Court.

plaintiffs alleged that Facebook did nothing to enforce this policy. If Facebook had actually

enforced this policy, the plaintiffs contended, Kogan would not have been able to sell his dataset

to Cambridge Analytica, and countless other apps would not have been able to misuse the

personal information they collected.

In 2019, Facebook moved to dismiss the complaint. Although this Court dismissed a few

claims, it rejected the majority of Facebook’s arguments and allowed the case to proceed. See

generally In re Facebook, Inc., Consumer Privacy User Profile Litigation, 402 F. Supp. 3d 767

(N.D. Cal. 2019).

The parties then began discovery, the process by which civil litigants can ask their

adversaries (and sometimes third parties) to give them potentially relevant and non-privileged

information. The basic philosophy underlying discovery is that claims should be litigated based

on a complete record of the underlying facts. See Hickman v. Taylor, 329 U.S. 495, 507 (1947).

Facebook had collected about them. The plaintiffs also sought information from Facebook’s

investigation into apps that had potentially misused users’ information, which Facebook called

the “App Developer Investigation” or “ADI.” Facebook produced some information in response

to these requests. But in the following years, the parties fought over what else Facebook should

be required to produce.

By March 2020, this Court determined that it was not in the best position to adjudicate

the parties’ growing number of discovery disputes, and it referred the parties to then-Magistrate

Judge Jacqueline Scott Corley for discovery. Before doing so, the Court expressed concern about

Facebook’s “unduly narrow view” of discovery. Dkt. No. 1087-44 at 29–30.

“This is a big

case,” the Court explained, so Facebook should be careful before making any arguments that

discovery was “just too expensive or difficult.” Dkt. No. 1087-44 at 30. Gibson Dunn attorney

Orin Snyder sought to assuage the Court’s concerns: “If I was there, I would look you in the

eyes. I’m telling you, Judge, we are not only acting in good-faith; we are eager to produce

documents, whatever the expense, that are relevant to the issues in this case.” Dkt. No. 1087-44

at 30. He continued: “I am confident, Your Honor, that when you see our performance on the

issues in this case in terms of our production of documents, you will have no basis for concern

because we want to get on with it…[W]e think those documents actually are the key to us

winning.” Dkt. No. 1087-44 at 31–32.

In the following months, however, discovery remained contentious. Facebook repeatedly

insisted that it did not need to produce all the information it had collected about the named

documents were produced in anticipation of litigation and involved legal advice, and so they

were protected by privilege. In the fall of 2021, Judge Corley held that the investigation was not

privileged. But again, the fighting continued.

Eventually, Judge Corley suggested that the parties engage a discovery mediator to help

resolve their ongoing disputes. See Dkt. No. 632. The parties selected retired Judge Gail Andler,

and she then brought in her colleague Daniel Garrie, in part to address the technical aspects of

discovery. Dkt. Nos. 646; 914 at 5. In July 2021, at the parties’ request, the Court appointed

at the top of the document. All cites included in this opinion reference the pages as numbered in

that header, rather than any page numbers native to the document.

Garrie as a Special Master with the power to issue discovery orders appealable only to Judge

Corley. Dkt. No. 709 at 1.

By February 2022—two and a half years into discovery—countless hours had been spent

adjudicating discovery disputes, and the litigation appeared to be going nowhere. Based on a

preliminary review of the record, it appeared to this Court that Facebook and Gibson Dunn were

to blame. At a status conference that month, the Court had strong words for Facebook and

Gibson Dunn. The plaintiffs had previously complained about Facebook and Gibson Dunn’s

misconduct and asked for the deadlines for discovery to be continued. But the Court expressed

concern that the litigation would go nowhere if it kept granting these continuances. The Court

suggested instead that the plaintiffs move for sanctions. Dkt. No. 847. This motion followed.

Then, in August 2022, the parties notified the Court that they had settled the lawsuit. The

Court stayed the litigation in light of the settlement, but the sanctions motion remained pending.

Gibson Dunn’s over-designation of documents as privileged.

To understand the dispute about the App Developer Investigation, it’s helpful to have

some background about the evolution of Facebook’s relationship with third-party app

developers. From 2010 to 2014, app developers used something called the “Graph Application

Programming Interface,” also known as API, to receive data from Facebook users and to write to

Facebook on those users’ behalf. Dkt. No. 326 at 4. Through this API, an app could access

“friend permissions,” meaning the apps could access personal information about the app users’

In 2014, in response to public criticism of its information-sharing practices, Facebook

adopted a new API (version 2) to replace the earlier version. See Dkt. No. 326 at 5. To use

Facebook’s language, it “deprecated use of Graph API v1” and adopted “Graph API v2.” Dkt.

No. 326 at 5. According to Facebook, this new API did not allow apps to access friend

permissions.

some apps were able to use the old API even after 2014, and so those apps continued to have

access to friend permissions. Dkt. No. 326 at 5. These were known as “whitelisted” apps.

In 2018, four years after the transition to the new API, the Cambridge Analytica scandal

broke. Facebook responded by launching an investigation into apps that had access to large

amounts of user data before the 2014 interface change. Dkt. No. 736 at 1. Gibson Dunn led the

investigation with help from two forensic consulting firms. Overall, Facebook said, the

investigation “involved hundreds of people: attorneys, external investigators, data scientists,

enhanced examination, and (3) enforcement. Dkt. No. 736 at 2. During phase one, Facebook (and

its consultants and attorneys hired to help) identified apps that posed a high-risk of data misuse

and flagged those apps for further inquiry. Dkt. No. 699-5 at 6–8. In phase two, the ADI

forensics team prepared reports analyzing the potential for data misuse, given factors like the

sensitivity of the information that the apps could access. Dkt. No. 699-5 at 8. During the final

phase, Facebook decided whether to take any enforcement actions against the identified apps,

including possible suspension. Dkt. No. 699-5 at 8–9. To determine whether such action was

which would include access to friends’ likes and comments on those posts. Dkt. No. 1085-36 at

112.

necessary, there could be additional investigations, including interviews and audits of the apps’

data security and storage infrastructure. Dkt. No. 699-5 at 9.

A few examples of the investigation documents are illustrative. Take one memo about an

app called Sync.Me. See Dkt. No. 1103-16. The memo states that the app was “over-

permissioned and had access to many ‘heavyweight’ permissions,” including the user’s entire

newsfeed, friends’ likes, friends’ statuses, and friends’ hometowns. Dkt. No. 1103-16 at 3, 5–6.

The memo also notes that around 9 million users may have granted the app permission to access

“friends_location.” Dkt. No. 1103-16 at 5–6. These permissions “appear to be out of scope for

the use case of the App.” Dkt. No. 1103-16 at 6. Furthermore, the memo notes, even after

Facebook transitioned to the new developer interface (limiting access to friend permissions), the

app used a method “that Facebook described as a potential workaround for accessing friend’s

information despite the reduced set of permissions.” Dkt. No. 1103-16 at 3.

apps, the app could access data from 16 to 20 million people. Dkt. No. 1103-7 at 7. One of

Microstrategy’s apps made “roughly 74 million API calls [requests for information from the

interface] per month—a volume few apps achieve, even over years of operation.” Dkt. No. 1103-

7 at 8. Another Microstrategy app was installed by only around 400 users, but it made “millions

of API calls throughout its lifecycle,” likely “as a means of collecting additional data points” not

handled through Microstrategy’s primary app. Dkt. No. 1103-7 at 8.

And one more memo about a Yahoo app. See Dkt. No. 1103-8 The memo explains that

close to 150 million users installed the app, and that it made “billions of requests” for user

when a party makes a request for specific materials and the Court resolves the request without

ordering those materials produced, the request is denied.” Dkt. No. 809 at 11. Judge Corley

responded: “I just want to say you should not litigate based on that presumption. That is not how

it works. I wouldn’t do that. That’s a mistake.” Dkt. No. 809 at 11. The order was intended as a

starting point, and it explicitly required the parties to work with the Special Master on future

productions.

In her order following the hearing, Judge Corley again rejected Facebook’s argument.

She explained that she had not “rule[d] that communications are not discoverable and never need

be produced.” Dkt. No. 806 at 2. Rather, her prior order held that ADI documents (including

communications) were “not protected by the work-product or attorney-client privilege in the

absence of specific showings of actual work-product, such as attorney edits, or the giving or

seeking of legal advice.” Dkt. No. 806 at 2. While she had noted at the hearing after the sampling

2. When the parties could not agree (in part because of Facebook’s continued assertion of a

blanket privilege), Judge Corley adjudicated the privilege question—not the discoverability of

communications as a whole. Dkt. No. 806 at 2.

Judge Corley additionally found Facebook’s specific objections to Special Master

Garrie’s order to be “puzzling.” Dkt. No. 806 at 2. She explained that Special Master Garrie had

taken a “common-sense approach”: he would review the communications to determine whether

they were relevant and ought to be produced. Dkt. No. 806 at 3. But instead of just complying,

Facebook appealed.

Judge Corley did observe that Facebook’s motion for reconsideration was not in bad faith to the

extent that Special Master Garrie responded by narrowing the order. Dkt. No. 809 at 54.

While Judge Corley was considering Facebook’s appeal, Special Master Garrie finished

his review of the sample ADI communications. “After reviewing a substantial portion of the

6,000+ documents pertaining to the exemplar apps,” Special Master Garrie determined that “a

substantial number of the documents [were] relevant to the case and not protected by privilege.”

Dkt. No. 916-9 at 6. For instance, one 2019 email chain discussed apps that Facebook planned to

suspend after the app developers failed to respond to Facebook’s requests for information. One

Facebook employee wrote that she wanted to give “heads up to our business leads” before

suspending the apps. Dkt. No. 1100-3 at 4. In response, another employee (presumably one of

Facebook’s “business leads”) asked for a “revenue impact analysis” related to the apps. Dkt. No.

1100-3 at 3. That request would appear to support the plaintiffs’ contention that Facebook made

enforcement decisions based on business concerns. Given the relevance of the communications

(and Facebook’s failure to demonstrate that they were privileged), Special Master Garrie ordered

the parties’ agreed-upon custodians (employees identified as having materials relevant to the

case). Facebook suggested that set of documents was adequate, and it should only be required to

look through that set for ADI materials. Dkt. No. 917-5 at 17. In response, Special Master Garrie

narrowed the order to require production of “all documents relating to the ADI from all

custodians that the parties have identified and collected,” with certain exceptions for attorney

communications. Dkt. No. 917-8 at 7. The plaintiffs understood this to mean that Facebook

would still search for all the ADI materials, but that Facebook would not need to identify any

new custodians. And, for a brief period of time, it seemed like the matter was settled.

Court invited the plaintiffs to move for sanctions rather than ask for the discovery deadlines to be

continued yet again. The Court also ordered Facebook to complete its ADI production within 21

days. Dkt. No. 847.

Following that conference, Gibson Dunn assigned Rosemarie Ring to lead the litigation,

replacing Orin Snyder. And Facebook and Gibson Dunn’s conduct slowly began to improve (at

least in some areas). Later in February, Ring proactively emailed the plaintiffs to discuss

Facebook’s previous understanding of the “limits” of Special Master Garrie’s order: “The goal

here is to make sure we have a meeting of the minds on this and avoid any further ADI-related

disputes.” Dkt. No. 1103-33 at 2, 5. Gibson Dunn explained that for ADI custodians, Facebook

had only collected documents through a period that ended in 2019—although the investigation

continued into 2020. Dkt. No. 1088 at 3–4. Facebook and Gibson Dunn had not told Special

Master Garrie about this limitation when they argued Facebook’s collection was adequate.

apps that Facebook (rather than Gibson Dunn) had investigated. Dkt. No. 1088 at 4. The

plaintiffs also learned that Facebook transitioned the App Developer Investigation to an “in-

house” operation at a certain point, meaning Gibson Dunn was not even involved in aspects of

the purportedly privileged investigation. Dkt. No. 1088 at 4.

After the plaintiffs brought these issues to the Court’s attention, the Court ordered

Facebook to produce all ADI documents through the present (not just through 2019). Dkt. No.

895. After additional back and forth, Facebook agreed to additional search terms and further

collections to avoid any more discovery disputes. Dkt. No. 1052-2 at 19. In July 2022—nearly

B. Named Plaintiff Data

Another area of alleged discovery misconduct involved the information that Facebook

had collected about the named plaintiffs. This “named plaintiff data” was a key component of the

case: Facebook sought to poke holes in the plaintiffs’ claims by arguing that they had “not

identified what information they believe[d] Facebook shared without consent,” nor how “they

believe[d] they were harmed.” Dkt. No. 840 at 5. If the plaintiffs could not identify this

information, Facebook argued, they lacked standing. See, e.g., Dkt. No. 261-1 at 20. To properly

address these arguments, the plaintiffs needed to identify the universe of private information

collected. See, e.g., Dkt. Nos. 541 at 8; 1103-14 at 7–8; 793 at 6–7; 918-1 at 3. The parties’

discovery disputes centered around whether Facebook would need to produce anything else.

Facebook and Gibson Dunn made two arguments against additional discovery. First, they argued

that Facebook only needed to produce information that Facebook conceded had been shared with

third parties—and the plaintiffs had to accept their representations about what had been shared.

Second, Facebook and Gibson Dunn argued that any additional discovery would be cost-

prohibitive and unnecessary. (Under the Federal Rules of Civil Procedure, discovery must be

“proportional” to the needs of the case; Facebook and Gibson Dunn argued that any additional

discovery on the named plaintiff data did not meet that standard.)

Part of the problem with identifying the information that Facebook kept on the named

it’s spread across Facebook’s complex data storage system. In March 2020, the plaintiffs asked

could understand where other named plaintiff data might be stored. According to the plaintiffs,

Gibson Dunn repeatedly told them to “Google” that information. Dkt. No. 1087-1 at 3. From late

2019 to mid-2020, the parties went back and forth about the named plaintiff data.

After several months without progress, Judge Corley ordered the parties to meet to

discuss the issue: “The parties’ next joint statement shall include information regarding the meet

and confer efforts and discuss in detail each side[’s] understanding of what precisely has been

produced and precisely what is the [named plaintiff] data that is being withheld as not relevant or

not reasonably available. The statement should not argue why the unproduced data is or is not

discoverable; the purpose of the statement is to precisely identify the data at issue.” Dkt. No. 487

at 1–2.

At the next discovery hearing, Gibson Dunn acknowledged that Facebook had not

produced all the information it collected about the named plaintiffs. As Gibson Dunn attorney

541 at 7. According to Falconer, Facebook had access to that data in a “raw, disaggregated way”

but producing that data about any given plaintiff would be a “multiweek endeavor.” Dkt. No. 541

at 7, 10. At the hearing, the parties ultimately agreed that they would submit briefs to Judge

Corley, and she would determine what additional named plaintiff data should be produced.

In its briefing, Facebook argued that the only named plaintiff data that was discoverable

was data that “ar[ose] from user activity occurring on the Facebook platform” that the plaintiffs

“overtly shared…with a limited audience.” See Dkt. No. 557 at 1. The plaintiffs argued that the

universe of discoverable data was much larger. See Dkt. No. 557 at 1.

includes: Data collected from a user’s on-platform activity; Data obtained from third parties

regarding a user’s off-platform activities; and Data inferred from a user’s on or off-platform

activity.” Dkt. No. 557 at 2. Unless Facebook and Gibson Dunn could show that specific

information was not discoverable for some other reason—for instance, the burden of producing it

was disproportionate to the needs of the case—Facebook would have to give it to the plaintiffs.

Shortly thereafter, in November 2020, the plaintiffs asked Facebook to identify the

materials responsive to that order. Facebook responded that it was still “conducting an

investigation to confirm the universe of data” that could be responsive. Dkt. No. 583 at 3, 10.

Two months later, however, Facebook took the position that Discovery Order No. 9

“relate[d] only to data that was shared or otherwise made accessible” to third parties, and so no

other information was discoverable. Dkt. No. 589 at 34. Judge Corley shot down this argument

(or at least tried to), explaining that whether certain data was shared was an “open question.”

Facebook’s arguments about the scope of production, it would eliminate” that entire category

from discovery. Dkt. No. 588 at 1.

Given the lack of clarity on Facebook’s use of users’ data, Judge Corley ordered the

parties to conduct a Rule 30(b)(6) deposition so that the plaintiffs could assess what data was

shared with third parties. Dkt. No. 588 at 1. A 30(b)(6) deposition—a reference to Federal Rule

of Civil Procedure 30(b)(6)—gives a litigant the opportunity to question an organization’s

representative about a specified topic. The organization has “a duty to make a conscientious,

good-faith effort to designate knowledgeable persons for Rule 30(b)(6) depositions and to

order, Judge Corley clarified that the scope of the deposition was limited to “discoverable user

data as defined by Discovery Order No. 9,” and emphasized that “whether particular user data is

not shared, not admissible, or not monetized, is not a valid reason to object to a

particular…question” at the deposition. Dkt. No. 602 at 1–2.

After the 30(b)(6) deposition, there was no progress on the production of the named

plaintiff data. Facebook did not produce any additional documents at all, and it accused the

plaintiffs of “spinning in circles…for more than a year” on the issue. Dkt. No. 1085-9 at 7. By

the fall of 2021, the parties declared an impasse, and they briefed the issue for Special Master

Garrie. The plaintiffs argued that whether their information was shared “was a contested question

on which [they were] entitled to evidence,” beyond just Facebook’s representations. Dkt. No.

916-4 at 5. And, the plaintiffs pointed out, “internal documents demonstrate that Facebook itself

does not know what information may have been shared with third parties.” Dkt. No. 1103-2 at

916-4 at 6–7. He then determined that Facebook had not produced all the data related to the

named plaintiffs, so he ordered Facebook to “provide a list of data sources” containing that

information, and then meet and confer with the plaintiffs to propose a protocol for producing the

data. Dkt. No. 916-4 at 8. Facebook then moved for reconsideration. In response, Special Master

Garrie revised his order and instead required Facebook to explain its practices for storing user

data so that he could determine what additional data should be produced. Dkt. No. 793 at 7–8.

Facebook appealed that order.

In considering that appeal, Judge Corley explained that the plaintiffs agreed the case was

was as follows: “The only data that is discoverable is that which Facebook contends was shared

or made accessible, and if Facebook says it was not shared or made accessible, that’s the end of

the matter.” Dkt. No. 809 at 29. Judge Corley (again) rejected that argument. Pointing (again) to

Discovery Order No. 9, Judge Corley explained: “This Court did not rule that Facebook only had

to produce data about the Named Plaintiffs that Facebook admits it shared with third parties.”

Dkt. No. 807 at 1. And Judge Corley repeated her earlier point: Discovery Order No. 9 held that

inferred data was discoverable (even though Facebook argued inferred data was never shared).

Dkt. No. 807 at 1–2. That order would not make sense, she reiterated, if discovery were as

limited as Facebook suggested. Dkt. No. 807 at 1–2. And “Facebook’s insistence that the Court

somehow ruled that only data that Facebook admits were shared with third parties is discoverable

is belied by the Court’s discovery ruling less than two months later,” which noted that what data

was shared was an “open question.” Dkt. No. 807 at 2.

it has collected about the Named Plaintiffs.” Dkt. No. 807 at 2–3. Although the 30(b)(6)

deposition was intended to “provide clarity as to what data Facebook collects and how it is

used,” the 30(b)(6) witness was not “the final arbiter of whether data was shared.” Dkt. No. 807

at 3. “[T]here is nothing before the Court that suggests that the record is currently so undisputed

as to what data Facebook collects and how it is used that the Court can say definitively that

certain data were not shared and therefore not discoverable.” Dkt. No. 807 at 3.

Judge Corley also noted that Facebook’s appeal misrepresented Special Master Garrie’s

order. Facebook and Gibson Dunn argued that Special Master Garrie was requiring them to

information in those sources. Dkt. No. 807at 3–4. Once Special Master Garrie had a high-level

description of Facebook’s data systems, he could determine which systems contained named

plaintiff data, and whether production of “potentially shared” named plaintiff data was feasible

and proportional to the needs of the case. Dkt. No. 807 at 4.

A week later, Special Master Garrie ordered Facebook to give him a “date certain” by

which Facebook could tell him which systems had discoverable data and either produce that data

or explain why it should not have to. Dkt. No. 1087-23 at 1. Special Master Garrie found

Facebook’s response to be “nonsensical.” Dkt. No. 826 at 2. Facebook tried again. For the next

six months, Special Master Garrie worked with the parties to determine what additional

information should be produced; that process involved testimony from six Facebook witnesses,

the submission of 14 explanations of 100 data systems, scrutiny of the identifiers used to store

and track user data, and other highly technical analyses. At this point, Facebook and Gibson

called the Hive. The Hive is a data warehousing framework organized into tables and

“partitions.” Facebook and Gibson Dunn consistently argued that it would be nearly impossible

to look through the Hive for all the named plaintiff data because of the way the Hive was

organized. For instance, in October 2021, Facebook and Gibson Dunn said Facebook could not

produce named plaintiff data from the Hive because the information in the Hive is “not indexed

by user, so there is no way to search across all tables at once for an individual user’s ID.” Dkt.

No. 1085-11 at 7. Facebook and Gibson Dunn asserted that, to search the Hive for named

plaintiff data, it would have to search “each of Hive’s 12 million tables…individually for any

Dkt. No. 1085-11 at 7. In December 2021, Facebook again said that it would take “a full team of

engineers” working for “more than a year” to develop tools necessary to identify specific

information that could then be retrieved from the Hive. Dkt. No. 1103-12 at 8. From January

2022 on, the parties worked with the Special Master to inquire into the Hive tables to determine

if and how they could be searched.

Months into this process, a Facebook representative revealed something that the company

and its lawyers had not previously disclosed: Facebook had, much earlier on, identified and

preserved a number of Hive tables that might include named plaintiff data. In June 2022, the

plaintiffs deposed Michael Duffey, an e-discovery case manager in Facebook’s legal department.

Facebook designated Duffey under Rule 30(b)(6) to testify about Facebook’s efforts to identify

and preserve information associated with the case, including information about the named

plaintiffs. Duffey said that Facebook had identified Hive tables related to Cambridge Analytica

plaintiff data: the Switchboard profiles. He explained that Switchboard was a tool created to

respond to law enforcement subpoenas, and Facebook had preserved data from Switchboard in

connection with the named plaintiffs. See Dkt. No. 1085-35 at 2. (Previously, a Facebook

representative said that Facebook used the DYI tool to respond to law enforcement inquiries,

making no mention of Switchboard. Dkt. No. 1103-9 at 95.) Duffey said that Switchboard was

“very similar” to DYI, but it included additional information “pertaining to Facebook groups and

advertising accounts.” Dkt. No. 1103-23 at 41. Later, Facebook and Gibson Dunn clarified that

Switchboard also included additional information about a user’s privacy settings, the full

That exchange is representative of the larger pattern: Blume would object, and the

plaintiffs, Blume, Hendrix, and Special Master Garrie would spend a substantial amount of time

debating the objection. One such dispute lasted 17 minutes. Dkt. No. 1085-22 at 292–310.

After the deposition, the plaintiffs filed a motion with Special Master Garrie for sanctions

based on Blume and Hendrix’s conduct. Dkt. No. 935. Among other things, the plaintiffs sought

additional time for 30(b)(6) depositions on the topics for which Hendrix was a designated

witness. Facebook did not oppose the motion, and it agreed to the relief requested. Dkt. No. 936.

Facebook also agreed to pay the plaintiffs’ attorney’s fees for the time spent preparing for and

conducting Hendrix’s deposition, as well as the fees for the time Special Master Garrie spent on

the deposition and motion. Dkt. No. 936.

Another area of conflict involved Facebook and Gibson Dunn’s misdesignation of

connection with that production it added over 180,000 documents to its privilege log. See Dkt.

No. 1088-9 at 4. To the plaintiffs, this massive assertion of privilege seemed dubious, and they

raised the issue with Facebook and Gibson Dunn. Facebook and Gibson Dunn ultimately agreed

to re-review a sample of 3,062 documents. Dkt. No. 1050-3 at 28. After this review, Facebook

withdrew privilege claims over 63% of those documents. Dkt. No. 1050-3 at 28. Given that

significant rate of error, Facebook agreed to re-review all the documents it had withheld as

privileged. Although it’s difficult to pinpoint the exact numbers, the plaintiffs estimate that

Facebook dropped privilege claims for over 53,168 documents and offered redacted versions of

point to an email chain from the fall of 2009 among non-attorneys discussing “what to do about

friend data” and whether “apps get to store whatever friend data they get.” Dkt. No. 1041-3 at 2–

3. The plaintiffs also point to an April 2018 email between non-attorneys that discusses “a couple

of docs” an employee put together for Mark Zuckerberg in mid-2015 about “the need to build a

stronger and more centralized privacy & data use org.” Dkt. No. 1041-5 at 2. The employee

observes, “I wonder how much of a better place we’d be in today if the proposal had been

implemented three years ago.” Dkt. No. 1041-5 at 2.

Relatedly, internal documents from Facebook also suggest that its employees sought to

shield communications from future discovery by “privileging” them. For instance, a 2015 email

chain between Facebook employees discusses a credit score app that was mistakenly given

access to certain sensitive user data like “user_posts.” Dkt. No. 1103-22 at 3. One employee

responds, “Simon, can we discuss in person? Else we need to make this a/c priv and add a lawyer

1088-13 at 2 Later in the chat, an employee asks about using Quip (a collaborative tool for

editing documents and spreadsheets) for sensitive information. Dkt. No. 1088-13 at 2. The

following exchange occurs:

E. Facebook and Gibson Dunn’s Rhetoric

Finally, throughout this period, Facebook and Gibson Dunn consistently argued that it

was the plaintiffs who were delaying discovery. As early as 2020, Facebook and Gibson Dunn

told Judge Corley that the plaintiffs “continue to undermine the Court’s well-considered orders

(intended to bring structure to the case) by insisting on an unfocused whack-a-mole process that

would unwind past agreements and work.” Dkt. No. 563 at 6. In 2021, Facebook and Gibson

Dunn told the Court that the plaintiffs’ “scattershot approach to litigation continues to cause

significant inefficiencies, unnecessary friction, wasteful motion practice, and a race to litigate

this case before it finally reaches the merits.” Dkt. No. 1085-11 at 6.

By January 2022, just before the Court invited this sanctions motion, Gibson Dunn

attorney Orin Snyder told Special Master Garrie that the “case [was] out of control” because “the

plaintiffs will not stop.” Dkt. No. 1087-3 at 5. According to Snyder, the plaintiffs were raising

new issues “coming from left field, right field, the dugout, the saloon down the street [from] the

ballpark,” all just before discovery was set to end. Dkt. No. 1087-3 at 11. It was time for the

plaintiffs to be told “no mas, no mas.” Dkt. No. 1087-3 at 6.

A court may impose sanctions under its inherent powers “when a party has ‘acted in bad

faith, vexatiously, wantonly, or for oppressive reasons.’” Chambers v. NASCO, Inc., 501 U.S. 32,

(1975)). A court may exercise this power by requiring the sanctioned party to pay the opposing

Before imposing sanctions, the court must find that the conduct “constituted or was

tantamount to bad faith.” Primus Automotive Financial Services, Inc. v. Batarse, 115 F.3d 644,

648 (9th Cir. 1997). That standard may be met when a party misrepresents the law or the facts to

the court. See, e.g., Malhiot v. Southern California Retail Clerks Union, 735 F.2d 1133, 1138

(9th Cir. 1984); cf. Chambers, 421 U.S. at 35–41. It may also be met “when a party acts for an

improper purpose—even if the act consists of making a truthful statement or a non-frivolous

argument or objection.” Fink v. Gomez, 239 F.3d 989, 992 (9th Cir. 2001). Sanctions may be

imposed for “delaying or disrupting the litigation or hampering enforcement of a court order.”

Primus, 115 F.3d at 649. And they may be imposed for repeatedly making arguments that have

been rejected. Wages v. I.R.S., 915 F.2d 1230, 1235 (9th Cir. 1990).

“To protect against abuse and to ensure parties receive due process, individuals subject to

sanction are afforded procedural protections, the nature of which varies depending upon the

judicial process.” Id. at 1138.

To impose compensatory sanctions, the court must give the sanctioned party notice and

an opportunity to be heard. Id. at 1143. The Ninth Circuit has not addressed the burden of proof

required for compensatory sanctions, but a finding of bad faith by clear and convincing evidence

is sufficient. Lahiri v. Universal Music & Video Distribution Corp., 606 F.3d 1216, 1219 (9th

Cir. 2010). To impose substantial punitive sanctions (at least for out-of-court conduct), the court

“must provide the same due process protections that would be available in a criminal contempt

proceeding.” F.J. Hanshaw Enterprises, Inc., 244 F.3d at 1139; cf. Goodyear Tire & Rubber Co.

Enterprises, Inc., 244 F.3d at 1139–40.

The sanctions requested in this case are compensatory. The parties have already reached a

settlement in principle, and the settlement includes a total amount to be paid by Facebook into a

settlement fund. Most of the settlement fund will be designated for members of the class; some

of it will be designated to pay fees and costs to class counsel. Any fee award to the plaintiffs

from this sanctions motion will cause a corresponding reduction in the amount of money

designated to pay attorney’s fees from the settlement fund. In other words, a fee award here

means the plaintiff class will need to use less of the settlement fund for attorney’s fees. And that

is the point of compensatory sanctions—to protect one side from paying fees resulting from the

opposing side’s misconduct. Cf. Restatement (Third) of the Law Governing Lawyers § 38(3)(b)

(2000).

Relatedly, the amount of compensatory sanctions is limited to fees and costs “incurred

take into account [its] overall sense of a suit, and may use estimates in calculating and allocating

an attorney’s time. The court may decide, for example, that all (or a set percentage) of a

particular category of expenses—say, for expert discovery—were incurred solely because of a

litigant’s bad-faith conduct.” Id. (quoting Fox, 563 U.S. at 838) (quotations and citations

omitted).

A court may also award fees and costs incurred in moving for sanctions. These fees and

costs are a result of the misconduct—“were there no sanctionable conduct, there would have

After a court estimates the amount of fees and costs incurred “because of” the

misconduct, it then determines whether that amount is reasonable by looking to the number of

hours reasonably expended on the case (deducting any unnecessary or duplicative expenses)

multiplied by a reasonable hourly rate. Pennsylvania v. Delaware Valley Citizens’ Council for

Clean Air, 478 U.S. 546, 564 (1986).

The Court finds by clear and convincing evidence that Facebook and Gibson Dunn acted

in bad faith during much of this litigation, and their misconduct warrants sanctions pursuant to

the Court’s inherent authority. Because a court’s inherent powers must be exercised with

“restraint and discretion,” the Court will only sanction Facebook and Gibson Dunn for the worst

of their consistently bad behavior: their handling of discovery related to the App Developer

Investigation and the named plaintiff data.

This misconduct would be sanctionable even if

First, Facebook and Gibson Dunn deserve to be sanctioned for their repeated use of

frivolous legal arguments to delay the production of highly probative evidence related to the App

While a court should ordinarily rely on 28 U.S.C. § 1927 and the Federal Rules of Civil

Procedure to impose sanctions, if neither is “up to the task, the court may safely rely on its

misconduct is “intertwined within conduct that only the inherent power [can] address,” so

sanctions under the Court’s inherent powers are appropriate. Chambers, 501 U.S. at 51.

Developer Investigation.

To be clear, the Court does not find bad faith in the initial argument that all materials

related to the investigation were privileged. Judge Corley herself acknowledged (before

reviewing the documents) that there were “arguments both ways,” and the Supreme Judicial

Court of Massachusetts has held (albeit with thin analysis) that certain ADI documents were

covered by work-product or attorney-client privilege. See Attorney General v. Facebook, Inc.,

487 Mass. 109, 130–31 (2021).

But Facebook and Gibson Dunn’s conduct surrounding that assertion of privilege—

particularly their conduct in the wake of Judge Corley’s rejection of their blanket privilege

argument—is sanctionable. The ADI documents were highly probative. Recall the memos

discussed in Section I.A of this opinion: they identified apps that had access to millions of users’

information, even after Facebook purported to limit that access. They also offered insight into

over the production of Facebook’s internal communications and the communications with

Facebook’s consultants. Take, for example, the plaintiffs’ concession that they did not need

administrative emails—emails requesting information from apps or discussing scheduling—

because they were only looking to discover the “underlying facts.” Facebook and Gibson Dunn

used this statement to argue that the plaintiffs had conceded that they were not entitled to

discover any communications about the App Developer Investigation at all. Facebook and

Gibson Dunn did not make this argument once; they made it repeatedly. One wonders if the

lawyers on the other side began to question their own sanity.

Dunn to work with Special Master Garrie to identify what else should be produced from the

universe of ADI materials. And Judge Corley had not reviewed a representative set of

communications when deciding the parties’ dispute; she had reviewed twenty documents blindly

picked from Facebook’s privilege log. Moreover, those documents were not the focus of her

order. As she made clear, her order adjudicated the privilege question broadly—not the

discoverability of the twenty documents from the sampling exercise. Instead of fairly reading

that order, Facebook and Gibson Dunn seized on a few passing comments Judge Corley made at

a hearing months prior. Relying on these out-of-context comments (comments not included in

her ruling), Facebook and Gibson Dunn argued that Judge Corley had silently adjudicated the

discoverability of all ADI communications. And Orin Snyder argued, with his typical bombast,

that this interpretation was based on “a lot of case law”—none of which seems to exist. Those

arguments were frivolous, and they did nothing but delay production and waste the plaintiffs’

information they received. Of course, the App Developer Investigation was about largely the

same thing: the extent to which third parties obtained and misused the personal information of

Facebook users. Any first-year civil procedure student would know that internal communications

between Facebook employees about the investigation would be a prime source of information

relevant to this lawsuit. It’s equally obvious that Facebook’s communications with its outside

consultants hired to investigate these apps would be relevant. Indeed, Special Master Garrie

found that a “substantial number” of the communications he reviewed were “relevant to the case

and not protected by privilege.” Dkt. No. 916-9 at 6. Finally, no reasonable person could argue

of such probative information by twisting the words of opposing counsel and the magistrate

judge.

Facebook and Gibson Dunn’s conduct after Special Master Garrie ordered them to

produce additional ADI documents further supports this finding of bad faith. To recall, Special

Master Garrie originally ordered Facebook to produce all documents related to the investigation

(with some exceptions for attorney communications). Facebook then moved for reconsideration.

In its motion for reconsideration, Facebook argued that it should only be required to search for

relevant materials from the documents it had already collected—it should not be required to

collect any new documents because its existing set was adequate. Only after this Court

threatened sanctions did Facebook and Gibson Dunn reveal that the set of previously collected

documents did not include anything from after 2019 (even though the App Developer

Investigation continued into 2020). Gibson Dunn now argues that it was not “aware” of this fact.

discovery. They complain, for example, about Facebook and Gibson Dunn’s failure to use search

terms such as “ADI” and “App Developer Investigation” when searching for communications

about the App Developer Investigation. And they complain about Facebook and Gibson Dunn’s

failure to search for all the apps Facebook investigated. In isolation, this conduct is more

susceptible to an innocent explanation. After all, the plaintiffs could have helped ensure that the

proper search terms were being used, and the Special Master’s order could have been more

precise. But given the context, this conduct also likely reflects bad faith.

Dunn used frivolous arguments to delay the production of a key category of information. As

Judge Corley and Special Master Garrie explained—at least three times over the course of two

years—discovery was not limited to information that Facebook admitted it had shared. First, in

Discovery Order No. 9, Judge Corley held that discoverable information included a category of

data that Facebook said was never shared at all. There is no reasonable interpretation of that

order that limits discovery to data Facebook admitted it shared. Whether the information was

actually shared was, as Judge Corley explained, an “open question,” and the plaintiffs were

entitled to seek evidence on that question—including evidence about the information Facebook

collected about them. Even if there had been any ambiguity in Judge Corley’s order, that

ambiguity would have been eliminated by her repeated rejection of Facebook and Gibson Dunn’s

argument. But they persisted.

Judge Corley envisioned a process by which the parties would work together to

difficult (if not impossible) to verify Facebook’s representations.

Judge Corley and Special Master Garrie should never have needed to clarify (even once,

much less multiple times) that Facebook could not avoid identifying and producing some subset

of information simply by asserting that it never shared that subset of information with third

parties. Again, this whole case involved accusations that Facebook disclosed personal

information about users to third parties surreptitiously, indiscriminately, and without permission.

The first step in getting to the bottom of those accusations was to figure out what information

Facebook collected on the named plaintiffs, as a means to figuring out which pieces of

assertion. Gibson Dunn’s only response is that nervous associates over-designated the documents

to avoid waiving privilege. But Gibson Dunn has an obligation to ensure that even its nervous

associates follow the law. The more likely explanation is that Facebook and Gibson Dunn had

backed themselves into a corner: After delaying production for years, they were forced to meet

this Court’s deadlines, and they took the shortcut of over-designating documents rather than

reviewing them properly.

Although Facebook and Gibson Dunn revisited these privilege designations and produced

a significant number of documents, they did so only after the plaintiffs requested it (and after the

Court told the plaintiffs that their complaints should be made in a motion for sanctions). While

the Court will not order payment of attorney’s fees for this conduct, it further supports the

conclusion that Facebook and Gibson Dunn operated in bad faith.

these assertions.

Even so, the alleged misconduct of plaintiffs’ counsel would not come close to excusing

that of Facebook and Gibson Dunn. No matter the conduct of the opposing party, counsel cannot

twist their words—not to mention the words of the Court—in support of frivolous arguments.

They cannot resist the disclosure of obviously discoverable information. They cannot ignore

potential sources of evidence, only for opposing counsel to learn about those sources at a

30(b)(6) deposition near the close of discovery. They cannot treat depositions like fighting

matches. And they cannot encourage their client’s obstinance—no matter how difficult the

evidence needed in this case. How were the plaintiffs supposed to know what specific

information Facebook collected about them or shared with third parties? How were they to know

what apps their Facebook friends had downloaded, and what permissions those apps had

requested? How were they to know about Facebook’s confidential relationships with its business

partners? Through discovery, the plaintiffs were entitled to this evidence—that is the whole point

of civil discovery.

Facebook and Gibson Dunn also nitpick Judge Corley and Special Master Garrie’s

discovery orders, looking for any potential ambiguity to justify their conduct. As already

discussed, Facebook and Gibson Dunn’s interpretations of these orders were often laughable. But

their nitpicking is also part of a larger problem. Sometimes discovery violations are blatant: a

client shreds a crucial document or threatens the opposing party. Much of the discovery

misconduct here was more insidious. No court ruling can ever be completely clear, addressing

Facebook and Gibson Dunn also emphasize how difficult this case has been to litigate,

given the technical complexities involved. It’s true that this was a complex case, and complexity

will often result in mistakes and miscommunication. But that’s not what this sanctions ruling is

about. It is about delay and unnecessary expense resulting from repeated frivolous arguments,

obfuscation, and reflexive opposition.

Finally, Facebook and Gibson Dunn do some obligatory sword-falling, apologizing for

their “role” in the combat and emphasizing that their behavior improved after this Court began

threatening sanctions in February 2022. That argument warrants two responses. First, although

misconduct occurred after February 2022, as did the massive privilege over-designation. Second,

even accepting that their conduct changed, sanctions would still be warranted for their earlier

behavior. In many cases, when attorneys and their clients improve after receiving a warning,

leniency is warranted. This is not one of those cases.

The Court reaches this conclusion after reflecting (at considerable length) on what might

have motivated Facebook and Gibson Dunn to conduct themselves as they did. There’s a small

chance, of course, that Facebook and Gibson Dunn were just overly zealous. And perhaps there’s

some minute chance that they were just incompetent. But when you consider the context, it’s far

more likely that the misconduct was of a different, more nefarious sort. Recall that Facebook was

being sued for conduct that was the subject of a major scandal, a scandal for which the company

issued numerous public apologies. Recall that the Federal Trade Commission brought an action

against Facebook in the wake of the scandal, and that Facebook paid $5 billion to settle the

and frustrating for the opposition, and hope that would drive down the case’s settlement value?

This is, by far, the most likely explanation for Facebook and Gibson Dunn’s conduct.

This is not to suggest that there necessarily was some back-room meeting at which

Facebook and its lawyers said, “Ok, here’s the plan, let’s be as unreasonable and obstructionist

as possible in the hope that we’ll frustrate the plaintiffs into settling for less than they could get if

we were cooperative in discovery.” Unfortunately, this approach to litigation is common enough

that no such meeting was necessary. Facebook and its lawyers fell into their roles with ease, and

then they took things way too far. For the systematic, conscious, bad-faith approach they took to

V

The plaintiffs have complained of several categories of misconduct, but as explained, the

Court will only sanction Facebook and Gibson Dunn for the most serious: the misconduct related

to the App Developer Investigation and the named plaintiff data. The plaintiffs seek

$2,037.540.28 in sanctions related only to those two categories.

Facebook and Gibson Dunn for everything else the plaintiffs point to, the amount would

certainly be much higher.

The plaintiffs request $1,773,042.50 in fees, including the fees incurred in moving for

U.S. at 110 (quoting Fox, 563 U.S. at 838). “The essential goal in shifting fees is to do rough

justice, not to achieve auditing perfection.” Id. (quoting Fox, 563 U.S. at 838) (quotations

omitted).

The only way to award sanctions here is with a rough-but-conservative estimate. First,

the Court will deduct $187,383.27 in fees and costs associated with the App Developer

Investigation that were incurred before Judge Corley rejected Facebook’s blanket assertion of

privilege on September 9, 2021.

Although the plaintiffs argue that Facebook and Gibson Dunn

engaged in misconduct before September 9, 2021, this ruling focuses primarily on their behavior

The plaintiffs’ motion for leave to file a reply in support of the amount of sanctions is granted.

See Dkt. No. 1090.

caution, the Court will assume all of the costs for discovery mediation incurred prior to

September 9, 2021 were associated with ADI.

afterwards, and so it would not be appropriate to impose sanctions for the ADI-related fees and

costs incurred prior to Judge Corley’s decision.

Beyond that, given the pervasive nature of Facebook and Gibson Dunn’s misconduct, it is

nearly impossible to disentangle the work that was caused by the misconduct from the work that

would have been done anyway. In an abundance of caution (and after considering Facebook’s

arguments regarding the reasonableness of the fees and costs), the Court will cut the plaintiffs’

remaining request in half. The plaintiffs are therefore awarded $800,217.38 in fees and

$124,861.13 in costs for a total of $925,078.51. This amount likely represents just a portion of

the fees and costs reasonably incurred because of Facebook and Gibson Dunn’s misconduct

related to discovery on ADI and the named plaintiff data. While the amount is almost certainly

under-compensatory, there is no chance that it’s over-compensatory. Given the limits on the

authority of courts to impose sanctions, it is better to err on the side of caution.

addressed that very question. Indeed, Sections I and II are entitled: “Plaintiffs Have Failed to

Demonstrate That Any ADI Fees or Costs Resulted from the Alleged Misconduct,” and

“Plaintiffs Have Failed to Demonstrate That Any Fees or Costs Associated with NP Data

Resulted from Alleged Misconduct.”

Facebook and Gibson Dunn also argue that the plaintiffs’ supplemental briefs include

fees and costs not addressed in their original motion. But Facebook and Gibson Dunn’s due

process rights are not violated merely because the Court allowed the parties to submit

supplemental briefing. See, e.g., True Health Chiropractic Inc v. McKesson Corp., No.

Gibson Dunn are entitled to notice and an opportunity to be heard on both the misconduct and

the appropriate amount of sanctions. F.J. Hanshaw Enterprises, Inc., 244 F.3d at 1143. That

standard is easily met here. In all, Facebook and Gibson Dunn have provided the Court with

almost 150 pages of briefing in opposition to these sanctions. That doesn’t include the hundreds

of pages of exhibits submitted in support of their briefs. In response to the plaintiffs’

supplemental submission on the amount of sanctions specifically, Facebook and Gibson Dunn

provided a 27-page brief and a 488-page expert analysis of the requested fees.

Facebook and Gibson Dunn are ordered to pay the plaintiffs $925,078.51 in sanctions.

They are jointly and severally liable for this amount, and they must compensate the plaintiffs

within 21 days of this ruling. To be sure, this amount is loose change for a company like

Facebook, and even for a law firm like Gibson Dunn. But it’s important for courts to help protect