The Class Action Weekly Wire – Episode 122: Data Breach Class Action Dismissed For Plaintiffs’ Failure To Allege Concrete Injury

Duane Morris Takeaway: This week’s episode of the Class Action Weekly Wire features Duane Morris partner Jerry Maatman and associates Ryan Garippo and Andrew Quay with their analysis of a North Carolina federal court decision dismissing a data breach class action.

Check out today’s episode and subscribe to our show from your preferred podcast platform: Spotify, Amazon Music, Apple Podcasts, Samsung Podcasts, Podcast Index, Tune In, Listen Notes, iHeartRadio, Deezer, and YouTube.

Episode Transcript

Jerry Maatman: Thank you, loyal blog listeners and readers, for joining us for this week’s episode of the Class Action Weekly Wire. I’m Jerry Maatman, a partner at Duane Morris, and joining me today are my colleagues Ryan Garippo and Andrew Quay. Thanks for being here.

Ryan Garippo: Thanks for having me, Jerry. Glad to be here.

Andrew Quay: Glad to be here, Jerry, thanks.

Jerry: Today, we’re going to dive into a ruling that came down in September from the Western District of North Carolina. The court dismissed a data breach class action in a lawsuit captioned Dougherty v. Bojangles Restaurants, Inc. What was this case about?

Ryan: Well, Jerry, this case stems from a data breach that allegedly hit Bojangles, the fast-food chain, in February of 2024. The company notified potentially affected individuals later that year. And in response, nine former employees filed a putative class action claiming that Bojangles failed to implement proper cybersecurity protections.

Andrew: The plaintiffs brought, really, a mixed bag of claims, including state tort claims, a claim under the North Carolina Unfair and Deceptive Trade Practices Act, others as well. The core issue at hand was whether they had standing under Article III of the Constitution to bring the lawsuit in federal court.

Jerry: In terms of harm, what were the plaintiffs alleging in terms of their so-called injury in fact?

Ryan: Well, that’s the key, Jerry. Alleging is the key fact there. Eight out of the nine plaintiffs did not allege that there was any actual misuse of their data. They claimed that they were harmed due to the possibility of future risks, such as identity theft, sales of their information on the dark web, increased spam calls, emotional distress, the value of their personal data going down in the future, but nothing that was actually affecting them right now.

Andrew: And the ninth plaintiff claimed he noticed fraudulent charges on his debit card, but crucially, he didn’t allege that he ever gave that card number to Bojangles as part of his employment. The court thereby determined that even if this fraudulent charge established an injury, that injury was not traceable to the data breach at hand.

Jerry: In terms of the analysis of the court, I know it leaned heavily on the U.S. Supreme Court’s seminal ruling in 2021 in TransUnion v. Ramirez, and that encapsulated a standing analysis. How did TransUnion impact the court in North Carolina in terms of its decision to ultimately dismiss this lawsuit?

Andrew: Well, in TransUnion, the named plaintiff on behalf of a putative class alleged that TransUnion, which is a credit reporting agency, violated the Fair Credit Reporting Act by failing to use reasonable procedures for placing a misleading alert in his credit file that labeled him as actually a potential terrorist, among other comparable threats. The Supreme Court held that only class members whose credit reports had actually been provided to third-party businesses had suffered concrete injury, that the mere existence of misleading alerts in one’s own credit file did not cause such an injury. So, if your data is compromised, but never actually used, maybe never even seen, you do not have a concrete injury.

Ryan: Yeah, and that’s exactly what happened here. The court said that the plaintiffs’ claims fell into the might-be-a-problem category, as opposed to the is already-a-problem category. So, in other words, if there wasn’t any actual type of misuse, such as someone attempting to open a credit card or steal their identity tied to the data breach. The court determined that the harm was just too speculative and dismissed the claims alleging fraudulent debt credit card usage as well, because as to that specific component, there was no allegation that it was actually traceable to Bojangles. So, either the plaintiffs had suffered no harm at all, or there was no traceability and failed on that prong in the alternative.

Jerry: It’s a very interesting outcome. Since the court never reached the underlying legal claims in terms of fault for the data breach, what does this mean for plaintiffs overall across the country in asserting injuries purportedly suffered in a data breach situation?

Andrew: The court ruled that every class member must show concrete injury, even at the pleading stage. And that’s a major procedural signal for future data breach class actions. Plaintiffs must show real-world harm, and if they can’t show actual misuse of data, or link that alleged misuse back to the defendant, courts should shut these cases down early, just like here.

Ryan: Yeah, and importantly, it gives defense counsel an important strategic roadmap – you can attack Article III standing. Now, here it was just for the named plaintiffs, but there’s language which suggests that this should be applied to the entire putative class, and which sort of harkens back to the Supreme Court’s dissent from denial of certiorari in LabCorp v. Davis, which hints at bigger questions about whether classes with uninjured class members can even be certified at all. Now, that issue was left for a different day, but here we’re not even going to get to see it because the court knocked this class action out at the pleading stage.

Jerry: Seems to me the Bojangles ruling certainly is a reminder that standing is anything but a formality and can be a very powerful tool by defense counsel and a corporation facing data breach class action litigation, a way to knock the socks off the lawsuit before you even get to the class certification issue, and gives the defendant, in these circumstances, a very strong argument for dismissal.

Well, those are great insights, Andrew and Ryan, and thanks for being with us today and breaking down the ruling, and thank you to our listeners for tuning in to this week’s episode of the Class Action Weekly Wire. As always, subscribe to our blog and stay tuned in for the latest trends in class action law.

Andrew: Thanks for having me on the podcast, Jerry, and thank you to our listeners.

Ryan: Thank you, everyone.

The NBA Sinks The Second Shot: New York Federal Court Grants Second Motion To Dismiss In Putative Privacy Class Action

By Gerald L. Maatman, Jr., Ryan T. Garippo, and Elizabeth G. Underwood

Duane Morris Takeaways: On October 6, 2025, in Salazar v. National Basketball Association, No. 22 Civ. 07935, 2025 WL 2830939 (S.D.N.Y. Oct. 6, 2025), Judge Jennifer L. Rochon of the U.S. District Court for the Southern District of New York dismissed a proposed digital privacy class action against the National Basketball Association (“NBA”) because the plaintiff failed to plausibly allege that the NBA disclosed personally identifiable information in violation of the Video Privacy Protection Act (“VPPA”).  The district court reasoned that, following Second Circuit precedent, an “ordinary person” would not be able to identify the plaintiff’s video-watching habits from the alleged Pixel transmissions.  Id. at *5.  This ruling illustrates that district courts in the Second Circuit continue to interpret the phrase “personally identifiable information” contained within the VPPA narrowly, and that the uphill burdens that plaintiffs carry on adtech and VPPA claims against corporate defendants are continuing to grow steeper.

Case Background

In Salazar v. NBA,  the plaintiff, Michael Salazar (“Plaintiff”) alleged that the NBA disclosed his personal information, including personal viewing information, to Meta, the owner of Facebook and Instagram, via Meta Pixel (a common form of advertising technology or “adtech”).  Id. at *1–3.  According to Plaintiff, Meta Pixel is “a snippet JavaScript code” that allows online businesses to “track visitor activity on their website.”  Id. at *1.  When Meta Pixel is activated, it supposedly tracks the visitors and the visitors’ actions, including the pages they visit and the buttons they click.  Id.  Plaintiff filed his suit against the NBA on September 16, 2022.  Id. at *2.  He claimed that he signed up for an online newsletter to register for NBA.com and then that he separately watched videos on the NBA’s website.  Id. at *1.  Plaintiff also alleged that after he watched videos on the NBA’s website, not in connection with his subscription to the newsletter, his video-watching history was sent to Meta without his permission via the undisclosed use of Meta Pixel on the NBA’s website.  Id. at *5.  In response, the NBA filed a motion to dismiss and argued that Plaintiff failed to plead that he was a consumer of goods and services within the meaning of the VPPA, because although he alleged that he viewed audio-visual content on the NBA’s website, he did not allege that he viewed the materials that he actually subscribed to but rather, separate, and free content that was offered elsewhere on the website.  So, put differently, the content containing adtech was not the content that created his statutory standing to sue under the VPPA.  Id. at *2. 

The district court agreed with the NBA and granted its first motion to dismiss under Rule 12(b)(6).  Plaintiff, however, appealed the decision to the U.S. Court of Appeals for the Second Circuit.  On appeal, the Second Circuit agreed with Plaintiff, vacated the district court’s judgment, and remanded the case, finding that the plaintiff had “plausibly pleaded” that he was a consumer under the VPPA by alleging that he had subscribed to the NBA’s digital newsletter.  Id.  The Second Circuit reasoned that as long as the plaintiff was a “subscriber” under the meaning of the VPPA, he only needed to allege that he separately viewed audio-visual content offered by the defendant in order to state a valid claim.  The Duane Morris summary of the Second Circuit’s decision is attached here which describes the opinion in more detail.

Notably, this decision was not the only time that Plaintiff raised these issues to an appellate court.  In April, the U.S. Court of Appeals for the Sixth Circuit ruled against this exact same Plaintiff on the same issue, based on the argument that a plaintiff needed to subscribe to the audio-visual content he or she alleges was actually disclosed in order to have statutory standing to sue under the VPPA.  Thus, the Sixth Circuit created the odd situation where this exact same Plaintiff, Michael Salazar, filed one lawsuit in New York where he had statutory standing and another in Tennessee where he did not.  The Duane Morris summary of the Sixth Circuit’s decision is attached here and also provides more detail.

Nonetheless, on remand from the Second Circuit, Plaintiff filed a First Amended Complaint and later filed a Second Amended Complaint.  Id.  In response, the NBA again moved to dismiss the claims under Rule 12(b)(6), this time arguing that (1) pursuant to binding Second Circuit precedent, there was no disclosure of personally identifiable information under the VPPA; and (2) the plaintiff did not allege knowing disclosure.  Id. at *3.

The Court’s Opinion

Judge Rochon agreed with the NBA and dismissed Plaintiff’s proposed VPPA class action.  Id. at *5.  In reaching its decision, the Court applied the Second Circuit’s “ordinary person” standard, which requires plaintiffs to show that the “personally identifiable information” includes information that would permit an “ordinary person” to identify a user’s video-watching habits.  Id. at *3.

Under the standard, the Court found that the personally identifiable information would not allow an ordinary person to identify Plaintiff’s video-watching habits, relying on other cases in which the Second Circuit rejected Pixel-based VPPA claims that “mirror” the allegations at issue.  Id. at *3, *5; see Soloman v. Flipps Media, Inc., 136 F.4th 41, 44 (2d Cir. 2025) (finding that the complaint did not “plausibly allege that an ordinary person could identify [the plaintiff]” because an ordinary person would not be able to decipher the “c_user” cookie and corresponding string of letters to be a person’s Facebook ID); see also Hughes v. National Football League, 24-2656, 2025 WL 1720295 (2d Cir. June 20, 2025) (rejecting the argument that a user’s Facebook ID could be identified based on lines of computer code because it was not plausible that an ordinary person would conclude that the phrase was a person’s Facebook ID).  The Court aligned with other district court rulings in finding the plaintiff’s argument — that a person could use internet-based tools like ChatGPT to understand the code communication — to be unpersuasive, reasoning that the argument was “insufficient to demonstrate that an ordinary person would know what to do with the c_user information to pinpoint an individual’s identity.”  Id. at *5. (citing Taino v. Bow Tie Cinemas, LLC, No. 23-CV-0537, 2025 WL 2652730, at *8 (S.D.N.Y. Sept. 16, 2025)).

Although Plaintiff asked the Court not to dismiss the complaint based on the holdings in Soloman and Hughes, claiming the Soloman and Hughes line of precedent was on unstable footing, the Court independently concluded that “[t]here is no basis for this Court to find that the Second Circuit’s decision in Soloman runs afoul of the statutory text of the VPPA, and thus Plaintiff’s reliance on these [alternative] cases does not convince the Court that Soloman is soon to be overruled.”  Id. at *4.  In other words, “[b]ecause an ordinary person would not plausibly be able to identify Plaintiff’s video-watching habits as a result of the Pixel transmissions, Plaintiff has not plausibly alleged that the NBA disclosed personally identifiable information in violation of the VPPA.”  Id. at *5.

Implications For Companies

This case is a success for defendants involved in other putative adtech class actions.  Indeed, Salazar is another example of a district court applying a narrow interpretation of “personally identifiable information” under the Second Circuit’s “ordinary person” standard and has broader implications outside of the VPPA to adtech class actions generally.

As a result, if corporate counsel is faced with an adtech class action, based on common-place technology installed on his or her organization’s website, he or she should consider raising these arguments in a motion to dismiss or shortly thereafter, as Salazar and its progeny may prove to be a powerful tool to exit a putative class action early in the litigation.. 

The Class Action Weekly Wire – Episode 121: You’re Invited! Our Year-End Review Of EEOC Litigation And Strategy

Duane Morris Takeaway: This week’s episode of the Class Action Weekly Wire features Duane Morris partners Jerry Maatman and Jennifer Riley discussing key highlights in our upcoming webinar: Year-End Review of EEOC Enforcement Litigation and Strategy.

Register and join us for the 30-minute panel on Wednesday, October 22, 2025, from 11:00 a.m. to 11:30 a.m. Central.

Check out today’s episode and subscribe to our show from your preferred podcast platform: Spotify, Amazon Music, Apple Podcasts, Samsung Podcasts, Podcast Index, Tune In, Listen Notes, iHeartRadio, Deezer, and YouTube.

Episode Transcript

Jerry Maatman: Thank you, loyal blog listeners and readers, for being here again to join us for the next episode of our regular podcast series, The Class Action Weekly Wire. I’m Jerry Maatman, a partner at Duane Morris, here with my partner, Jennifer Riley. Welcome.

Jennifer Riley: Great to be here. Thanks, Jerry. Thanks for having me.

Jerry: Today, we’re talking about a special webinar program coming up on Wednesday, October 22, from 11:00 to 11.30 a.m. Central Time. It’s a virtual program that we think our listeners shouldn’t miss. It’s our biannual EEOC developments briefing hosted by Duane Morris.

Jennifer: You’ll hear from me, Jerry, Alex Karasik, and Gregory Tsonis during this 30-minute segment. Heading into fiscal year 2026, we will talk about some significant changes implemented by the Trump administration. Employers’ compliance with federal workplace laws and agency guidance remains a corporate imperative.

Jerry: The theme of our webinar will be a scorecard. How is the EEOC doing? What does their enforcement program look like in terms of our tracking and analyzing all of the lawsuits that have been filed over fiscal year 2025, and what it teaches employers about the priorities of the EEOC’s Strategic Enforcement Program.

Jennifer: That’s right, Jerry. We will be covering a lot of ground in a very short time period, starting with the major shakeups at the EEOC, the EEOC’s new strategic priorities, lawsuit trends, as well as enforcement initiatives.

Jerry: We’ll also dig into the numbers on the scorecard to give our listeners an idea of what the EEOC has focused on in terms of their lawsuit filings around the country.

Jennifer: Whether you are a corporate counsel, an HR director, or a business leader, compliance with EEOC guidelines is essential, and this program will provide some strategies to stay compliant and avoid drawing scrutiny from the agency.

Jerry: So, the watchwords in this webinar will be how to be proactive rather than reactive. So please register for the event, save the date for, our analysis and practical insights on everything about the EEOC and what fiscal year 2026 has in store for companies.

Jennifer: Well, thanks for having me on the podcast today, Jerry, and thanks to the listeners for being here. As always, subscribe to stay updated on the latest trends in class action law, and register for the upcoming webinar on our blog.

The Class Action Weekly Wire – Episode 120: Florida Federal Court Approves $20 Million Settlement In Data Breach MDL

Duane Morris Takeaway: This week’s episode of the Class Action Weekly Wire features Duane Morris partner Jerry Maatman and associate Ryan Garippo and Andrew Quay with their discussion of a major settlement in the data breach class action space.  

Check out today’s episode and subscribe to our show from your preferred podcast platform: Spotify, Amazon Music, Apple Podcasts, Samsung Podcasts, Podcast Index, Tune In, Listen Notes, iHeartRadio, Deezer, and YouTube.

Episode Transcript

Jerry Maatman: Thank you, loyal blog readers, for being here again for our next episode of our podcast series entitled the Class Action Weekly Wire. I’m Jerry Maatman, a partner with Duane Morris, and joining me today are my colleagues Ryan Garippo and Andrew Quay. Thanks for being here.

Ryan Garippo: Thanks for having me, Jerry. Great to be here.

Andrew Quay: Glad to be here. Thanks, Jerry.

Jerry: Today, we’re going to dive into a ruling granting final settlement approval in litigation entitled In Re Fortra File Transfer Software Data Breach Security Litigation – certainly a mouthful. Ryan, can you give our podcast listeners some background on what this litigation was all about?

Ryan: Yeah, of course, Jerry. This case is one that stems from a massive data breach that occurred a couple years ago, back in January of 2023, linked to the Clop ransomware group, which is a Russian-based operation. They exploited a zero-day vulnerability in Fortra’s GoAnywhere MFT software, which a lot of health and financial institutions use to securely transfer files. As a result, the hackers allegedly used that vulnerability to access and steal the personal health information of at least 5 million people.

Jerry: Were there any organizations that were impacted, or strictly just individuals?

Andrew: There were. The breach also affected about 130 organizations, including big names like Aetna, Community Health Systems, and NationsBenefits, all of which ended up as defendants in the resulting lawsuits.

Jerry: So, for our listeners, this case ended up then in a multidistrict litigation proceeding venued in the U.S. District Court for the Southern District of Florida, is that right?

Ryan: Yeah, that’s right, Jerry. It’s common practice in these data breach cases where, several dozen lawsuits are filed across the country, at least here, two dozen were filed, and they ultimately get consolidated into a multidistrict litigation, which here was in February of 2024, before Judge Rodolfo Ruiz. Plaintiffs’ consolidated complaints allege that the defendants failed to adequately protect their private health information of the plaintiffs and the settlement class from the unauthorized access. They also assert multiple counts of common law and statutory violations, all of which seek relief coming from the same events.

Andrew: And to follow up with Ryan, after the parties settled the claims, Judge Ruiz just issued final approval of a $20 million global settlement, which followed a separate $7 million settlement that was reached earlier in the year with a subclass of plaintiffs who sued another big defendant, Brightline.

Jerry: Let’s talk a little bit about specifics and drill down. What was exactly encompassed within the $20 million settlement?

Ryan: Well, the settlement is a $20 million cash fund to cover class member benefits, attorneys’ fees, and administration costs. However, each member can choose between up to $5,000 in documented losses, or a flat $85 cash payment.

Jerry: What about non-monetary benefits? I understand that those can be determinative in data breach class action settlements.

Andrew: There’s the option for dark web monitoring, except for the Brightline subclass, as those class members had already elected credit monitoring under the earlier settlement. However, the settlement does not constitute any admission of fault or liability by the defendants. That’s standard language in these types of agreements, but it’s worth noting that the court also emphasized this was not a ruling on the validity of the claims or the defenses.

Jerry: What did the judge do with respect to the plaintiffs’ petition for an award of attorney’s fees and costs?

Ryan: Well, the plaintiffs’ attorneys, of course, needed their fees, and he awarded up to 33% of the $20 million, which comes out to $6.67 million for the class counsel. There was also $263,800 in litigation costs separately, so about $2.3 million in attorneys’ fees for the Brightline subclass counsel as well.

Andrew: And just to highlight this, following the settlement several defendants, including Fortra, NationsBenefits, Intellihartx, Imagine360, and Community Health Systems have provided attestations confirming they’ve enhanced their cybersecurity to prevent future breaches.

Jerry: We’ve seen several large and significant class action settlements in the data breach space so far in 2025, including a ruling granting preliminary settlement approval to a $177 million settlement in In Re AT&T Inc. Customer Data Security Breach Litigation. When you measure that against what occurred in Florida, what do you think with respect to the terms being fair, adequate, and reasonable to the settlement class here?

Ryan: Well, the court stated that “despite the risks involved with further litigation, the Settlement provides outstanding benefits, including Cash Payments, Dark Web Monitoring, injunctive relief, for all Settlement Class Members.” in which we just discussed. In light of those factors, the court found the settlement to be “fair, reasonable, and adequate,” and there were no objections filed, which, for a class of this size, is fairly significant. So, it usually means that the settlement terms were both well-structured and negotiated.

Jerry: So, at a 100,000-foot level, what would be the takeaways for corporate counsel with respect to this litigation?

Andrew: Well, it’s highly important for companies to monitor any vulnerabilities and proactively invest in cybersecurity. These attacks can happen fast and get more sophisticated by the day. And for companies holding sensitive data – particularly health data – regulators, plaintiffs’ attorneys, and courts are all watching, so make sure that you are in compliance and engaging in best practice cybersecurity measures.

Jerry: Well, thanks, Ryan and Andrew. These are great insights, and listeners, thanks for joining us today, and appreciate my colleagues breaking down this settlement and what it means for corporate counsel. So please, listeners, join us for future episodes of the Class Action Weekly Wire, and subscribe to stay updated to the latest trends in class action litigation.

Ryan: Thanks for having me on the podcast, Jerry, and as always, thanks to the listeners for joining us.

Andrew: Thanks, everyone.

Simon Says “No” – Again: Court Refuses To Approve Consent Decree For The Second Time In EEOC v. Support Center For Child Advocates

By Gerald L. Maatman, Jr., Bernadette M. Coyle, and Elizabeth G. Underwood

Duane Morris Takeaways: On September 12, 2025, in EEOC v. Support Center for Child Advocates, No. 2:25-CV-00310, (E.D. Pa. Sept. 12, 2025), Judge John F. Murray of the U.S. District Court for the Eastern District of Pennsylvania denied the EEOC’s second unopposed motion for approval of a consent decree between the EEOC and Support Center for Child Advocates.  The Court remained unsatisfied with the lack of information with which the Court could assess the appropriateness of the parties’ agreement. 

This ruling demonstrates that approval of an agreed upon consent decree is anything but a guaranteed rubber stamp. Instead, it shows the importance of providing a factual basis and thorough reasoning to justify gaining court approval, even when motions are unopposed.

Case Background

On January 17, 2025, the EEOC, on behalf of charging party Meghan Seitz, filed a lawsuit against Defendant Support Center for Child Advocates regarding allegations of pregnancy discrimination under Title VII of the Civil Rights Act of 1964.  (ECF 1.)  Specifically, the EEOC alleged that the child advocacy organization discriminated against Ms. Seitz, a former employee with a high-risk pregnancy, when the organization denied Ms. Seitz an accommodation to work remotely during the COVID-19 pandemic.  (Id. ¶¶ 21–24.)

On August 15, 2025, the EEOC first moved for approval of the proposed consent decree.  (ECF 29.)  The motion includes the consent decree as “Exhibit A,” which sets forth the parties’ agreed-upon plan for Support Center for Child Advocates to provide future accommodations to similar employees, adopt an Equal Employment and non-discrimination policy, implement human resources and management personnel training, inform workers about their rights to accommodations, and pay Seitz $30,000, among other provisions.  (ECF 29-1.)

The Court denied the EEOC’s initial motion for entry of the consent decree on August 18, 2025.  (ECF 30.)  The Court reasoned that the motion requested the consent decree be entered “for the reasons stated therein” but included no reasons stated therein.  (Id. at 1 n.1.) 

The Court opined that it had no way of knowing whether the agreement was appropriate or not.  As a solution, the Court invited the parties to either file a stipulated dismissal after agreeing amongst themselves to the terms of the proposed consent decree or refile the motion with additional information.

Most Recent Filings And Order

On September 8, 2025, the EEOC filed a supplemental motion for entry of the consent decree, which provided an overview of the procedural history of the case.  (ECF 31.)  The EEOC also filed an unopposed memorandum in support of its motion.  (ECF 31-1.)  In the memorandum, the EEOC further outlined the case history, labeled as the statement of the case, and argued that settlement through a consent decree is a regular and appropriate manner of resolution and that the proposed consent decree satisfies the legal standard for judicial review.

On September 12, 2025, the Court denied the EEOC’s second motion for entry of the consent decree, finding the motion did not provide an adequate factual basis from which the Court could assess the appropriateness of the consent order.  (ECF 32.)  To resolve this issue, the Court noted that it would be willing to conduct an evidentiary hearing to build a record if the parties were interested.  (Id. at 1 n.1.)

Implications For Employers

The Court’s denial of the second motion for entry of the proposed consent decree in EEOC v. Support Center for Child Advocates should serve as a cautionary reminder to litigants that courts will not merely rubber-stamp EEOC consent decrees where a sufficient factual basis justifying approval is not provided to courts. 

Litigants must provide courts with more information than mere conclusory statements that the proposed consent decree is fair and reasonable for courts to approve of consent decrees.  Otherwise, litigants may find themselves forced to backtrack in the settlement approval process.

The Class Action Weekly Wire – Episode 119: Landmark $1.5 Billion Class Action Settlement Addresses AI Copyright Claims

Duane Morris Takeaway: This week’s episode of the Class Action Weekly Wire features Duane Morris partner Jerry Maatman and special counsel Justin Donoho with their discussion of a historic settlement agreement in the intellectual property class action space that is paving the way for AI copyright infringement litigation.

Check out today’s episode and subscribe to our show from your preferred podcast platform: Spotify, Amazon Music, Apple Podcasts, Samsung Podcasts, Podcast Index, Tune In, Listen Notes, iHeartRadio, Deezer, and YouTube.

Episode Transcript

Jerry Maatman: Thank you to our loyal blog readers for joining us for this week’s edition of the Class Action Weekly Wire. I’m Jerry Maatman, a partner at Duane Morris, and joining me today is special counsel Justin Donoho. Thanks so much for being on the podcast.

Justin Donoho: Great to be here, Jerry. Thanks for having me.

Jerry: Today we’re here to discuss a massive class action case involving Anthropic and what could be one of the largest copyright settlements in the history of American jurisprudence at a staggering $1.5 billion. Let’s start with the basics. What is the case about, Justin?

Justin: Jerry, this case has everything – artificial intelligence, copyright law, alleged piracy, and a $1.5 billion settlement hanging in the balance. The plaintiffs allege that Anthropic, a leading developer of AI large language models, or LLMs, used copyrighted content from their books to train Anthropic’s Claude LLMs without obtaining consent. Part of that training included Anthropic allegedly downloading over 7 million digital copies of works acquired from pirating websites. The plaintiffs claimed that Anthropic’s practices violated copyright law and sought damages as well as injunctive relief. Anthropic maintained that its alleged conduct fell within the bounds of fair use and was essential for the development of competitive AI technologies. Judge William Alsup of the U.S. District Court for the Northern District of California ruled in June that while it was fair use for Anthropic to use the non-pirated copyrighted material to train Claude, at least in this case, the use of pirated works for training, if plaintiffs could prove piracy at trial, could still be copyright infringement.

Jerry: After that ruling, which I believe was one of the most few significant rulings we have seen this year to weigh in on fair use for training AI, the parties ultimately came to a settlement. And the judge issued a ruling on the plaintiff’s motion for preliminary approval of a class action settlement this past week. What did Judge Alsup decide in that ruling?

Justin: Judge Alsup denied preliminary settlement approval and had what he called a list of grievances regarding the settlement. One of his key concerns was that while the parties said they had an agreement in principle, the only thing that they seemed to agree on was the $1.5 billion price tag. He questioned whether that number had asterisks attached to it, because while Anthropic allegedly retained 7 million pirated books, the settlement list only included about 465,000.

Jerry: That’s quite a large gap between the parties. What would it qualify to be a book on the list?

Justin: The settlement only covers works that had ISBNs or ASINs and were registered with the Copyright Office before or shortly after Anthropic downloaded them. The judge questioned whether the list was final, and if there would be more works added. He did not want to see new claims coming out of the woodwork once Anthropic pays up. He emphasized that if Anthropic was settling for $1.5 billion, the company deserves certainty and closure. The judge also worried about other hangers-on joining the case and the impact that it would have on the posture of pending AI copyright litigation across the country.

Jerry: So where does that leave the parties and leave the lawsuit, given his ruling?

Justin: Judge Alsup denied preliminary approval but gave the parties a chance to amend the proposed settlement agreement. He ordered the parties to submit an updated list of qualified works by the 15th, a reworked claims process by September 22nd, and a new hearing is scheduled for September 25th.

Jerry: Let’s talk about the broader impact of the ruling. What does this suggest for other class actions in the copyright space involving AI?

Justin: A couple of things. First, in the context of allegedly training on pirated works, the action in these types of cases is likely to be on whether the plaintiffs can meet their evidentiary burden to actually show any piracy. And then outside the context of piracy, there’s still a fundamental legal question out there – can you train your AI on otherwise legally obtained copyrighted works without permission? Courts this year have been drawing different conclusions and saying, “maybe,” and it really depends on how the material was sourced and used, how much, and other factors, like nature of the copyrighted work and the effect on the market. And AI just makes the stakes higher. With respect to class actions involving piracy, for example, this $1.5 billion settlement is an exponential increase from the Napster and Grokster settlements in the early 2000s for $26 million, $50 million, and those kinds of digital distribution cases since then have been relatively sparse over the years. Compared with today, we are seeing many of these AI training class actions filed. So, given this legal landscape, the Anthropic settlement is likely to push more content creators to register their works with the Copyright Office, which is a requirement to be eligible for statutory damages in these types of cases.

Jerry: So, the big takeaway, maybe, to quote Yogi Berra, is “it’s not over till it’s over,” and there’s a chance this could become the largest class action copyright AI-related settlement in the history of American jurisprudence, but the court wants more precision, more fairness, more transparency. And even if this deal goes through, it’s certainly not going to be the last word in AI copyright law.

Justin: Not by a long shot. There are dozens of pending AI copyright cases. The rate of new complaints we are seeing this year seems to be increasing. Courts are coming out different ways on the fair use doctrine when there’s no issue of whether piracy is involved. And eventually, we could see the Supreme Court weigh in on AI and fair use.

Jerry: Well, thank you, Justin, for your thought leadership in this area, and for breaking things down for our listeners. This is one of those legal stories that really shows how quickly the law is advancing and trying to keep up with technology and the intersection of the law, IP, and AI. And thanks to all our loyal blog listeners for being here today. We’ll be watching this case closely, and bring you updates when things develop. Don’t forget to subscribe to our channel, and we’ll see you next time.

Justin: Thanks, Jerry, always a pleasure.

The Class Action Weekly Wire – Episode 118: Washington Supreme Court Adopts Broad Definition Of “Job Applicant” For Pay Transparency Class Actions

Duane Morris Takeaway: This week’s episode of the Class Action Weekly Wire features Duane Morris partner Jerry Maatman, special counsel Eden Anderson, and associate Caitlin Capriotti with their discussion of a highly anticipated ruling from the Washington Supreme Court holding that job applicants are not required to prove they are a “bona fide” or a “good faith” applicant to obtain remedies under the Equal Pay and Opportunities Act (“EPOA”) in class action litigation.

Check out today’s episode and subscribe to our show from your preferred podcast platform: Spotify, Amazon Music, Apple Podcasts, Samsung Podcasts, Podcast Index, Tune In, Listen Notes, iHeartRadio, Deezer, and YouTube.

Episode Transcript

Jerry Maatman: Thank you all for joining us for today’s Class Action Weekly Wire, our continuing podcast series. Joining me today are Eden Anderson and Caitlin Capriotti of our California offices. Welcome.

Eden Anderson: Great to be here, Jerry. Thanks for having me.

Caitlin Capriotti: Glad to be here, thanks for having me.

Jerry: Today, we wanted to dive into the recent decision of the Washington Supreme Court called Branson v. Washington Fine Wine and Spirits. Eden, could you give our listeners an overview of what was at issue in that ruling?

Eden: Absolutely. In 2022, the Washington legislature amended the state’s Equal Pay and Opportunities Act, the EPOA, to require employers to include wage or salary ranges in job postings. And if the employer did not comply, the statute – at least as it was then written, it’s since been amended – provided for $5,000 in statutory damages per applicant. That can add up to millions in exposure, depending on the volume of applicants to a job. So, of course, the plaintiffs’ bar seized on the new law and started filing class actions. Some of the lawsuits were filed by genuine job applicants. But many of the lawsuits were filed by what we call serial plaintiffs, people who had no interest in the job, and who were applying just to trigger a lawsuit and collect statutory damages and attorneys’ fees for their lawyers. The question presented in the Branson case was whether a plaintiff has to show that they applied to a position in good faith and are a “bona fide” job applicant.

Jerry: Thank you. Caitlin, who were the specific plaintiffs at issue in the decision before the Washington Supreme Court?

Caitlin: The lead plaintiffs were Lisa Branson and Cherie Burke. They both applied for retail positions at Washington Fine Wine & Spirits, but the job postings did not include the required pay range info. Branson even interviewed and discussed pay, however, she ultimately decided not to take the job. After the plaintiffs filed a class action, the federal court where the lawsuit was pending certified the question of what must a plaintiff prove to be deemed a job applicant under the EPOA to the Washington Supreme Court, and the Supreme Court accepted certification to resolve that question. It is a bit curious and possibly unfortunate for employers that this issue came up in this case, given that Branson herself was seemingly interested in the job she applied for.

Jerry: So, what did the Washington Supreme Court ultimately decide in its ruling?

Eden: The court held that job applicants do not have to prove they were “bona fide” or acting in good faith to recover the remedies that the EPOA provides. The court relied on the dictionary definition of applicant as essentially someone who applies to reach that conclusion.

Caitlin: They also noted that while the legislature used the phrase “bona fide” elsewhere in the EPOA, it didn’t use that term in reference to job applicants. That absence was important to the court’s reasoning. The court repeatedly noted in the decision that if the EPOA is to be limited to bona fide or good faith job applicants, the Washington Legislature will need to make that act and make this change.

Jerry: So, what would the takeaway be – you simply apply, and therefore you qualify as a plaintiff who is standing in a case like this?

Eden: Well, I guess yes and no, Jerry. Yes, in that you qualify for the remedies that are available under the statute. Even if an applicant never had any real interest in the job, they still can seek the remedies that are available under Branson. But I want to be clear in saying that the Branson opinion is limited to remedies available to applicants. Whether the EPOA confers a private right of action, the right to file a lawsuit on a job applicant, remains an open issue.

Jerry: Caitlin, I also understand there was a vigorous dissent in the ruling. What did the dissent have to say about these issues?

Caitlin: Yes, a dissent was issued by three of the nine justices. They argued that the EPOA was not meant to allow what they called “bounty seekers” to comb job boards just to file lawsuits. Their concern was that this decision opens the door to the abuse of the statute.

Jerry: Well, thanks for that. Is it fair to say, then, that there are remaining open issues that can be legitimately litigated by employers when it comes to liability under this statute?

Eden: That’s correct, Jerry. As I mentioned, the decision only holds that anyone applies for a job, irrespective of their motive in doing so, can seek to recover remedies available under the statute. There’s a footnote in the opinion that highlights that those remedies may only be available in administrative proceedings before Washington’s labor and industries. That’s a key legal issue that will soon, surely be addressed by the courts in these cases. And other issues left open by the decision include whether statutory damages under the EPOA are too severe and unconstitutional; whether a plaintiff has standing to pursue damages on behalf of job applicants who applied to other positions that the plaintiff never sought to fill; and whether the recent amendments to the EPOA, which create a new sliding scale of statutory damages of $100 up to $5,000, applies retroactively. It’s unfortunate that the Washington Supreme Court didn’t proactively resolve at least some of those issues and is leaving it to litigants and to the courts to figure this all out.

Jerry: Let’s pan out then and take a look from a 100,000-foot view. What are the big picture implications of the ruling for businesses that operate in Washington state?

Caitlin: So, the short version is that this decision was not what employers were hoping for. It means that serial plaintiffs have viable claims, although the form of those claims is an issue still to be addressed. And that creates real exposure, especially for companies with high-volume hiring.

Jerry: Well, thanks, Eden and Caitlin. This is a great analysis for our listeners with respect to compliance with Washington’s EPOA. It’s certainly more critical now than ever before to proactively manage these risks in terms of the amount of class action litigation ongoing in the Evergreen State. The bottom line is probably this is the first of many rulings that are going to emanate out of the state of Washington on the parameters of the statute, and this is probably chapter one of a long litigation book that will be written. So, we’ll be watching the lower courts as the next wave of EPOA litigation erupts and provide these developments on our blog and in our annual Duane Morris Class Action Review. So, thanks so much for joining us on this week’s podcast.

Eden: Thanks for having me on the podcast, Jerry, and thanks to the listeners for being here.

Caitlin: Yeah, thank you for everyone. Thank you for having me.

Cracking The Code On Data Breach Lawsuits: The Duane Morris Class Action Review Cited By The Wall Street Journal

A recent article in The Wall Street Journal profiled the rise in data breach litigation, citing the Duane Morris Class Action Review’s statistics on data breach class action filings. We tracked 1,488 new lawsuits filed in 2024; 1,320 in 2023; and 604 in 2022.

For more insights on trends in the data breach class action space, bookmark or download our Data Breach Class Action Review, follow our weekly podcast, and subscribe to our blog.

The Class Action Weekly Wire – Episode 117: Illinois Federal Courts Greenlight ECPA Claims In Adtech And Edtech Class Actions

Duane Morris Takeaway: This week’s episode of the Class Action Weekly Wire features Duane Morris partner Jerry Maatman and senior associate Hayley Ryan with their discussion of two major rulings issued by Illinois federal courts addressing privacy claims aimed at companies utilizing advertising technology (“adtech”) and education technology (“edtech”).

Check out today’s episode and subscribe to our show from your preferred podcast platform: Spotify, Amazon Music, Apple Podcasts, Samsung Podcasts, Podcast Index, Tune In, Listen Notes, iHeartRadio, Deezer, and YouTube.

Episode Transcript

Jerry Maatman: Thank you, loyal blog readers and listeners, for being here again for our next episode of our weekly podcast series entitled The Class Action Weekly Wire. I’m Jerry Maatman, a partner with Duane Morris, and joining me today for the first time is our senior associate, Hayley Ryan. Thanks so much for being on the podcast today.

Hayley Ryan: Great to be here, Jerry. Thanks for having me.

Jerry: Today, we’re diving into two major decisions out of the Northern and Central Districts of Illinois that are making waves in the adtech or internet-based technology litigation space. Let’s start with the basics. The two decisions came down on August 20 – Hannant v. Sarah D. Culbertson Memorial Hospital and Q.J. v. Powerschool Holdings. What’s the big picture here?

Hayley: These are both part of a much broader wave of class actions we’ve seen across the country involving adtech and edtech – things like the Meta Pixel, Google Analytics, and Heap Autocapture. These tools track user interactions on websites. The central claim in both actions is that these tools intercept users’ communications without consent and transmit them to third parties like Meta or Heap in violation of the Electronic Communications Privacy Act, or ECPA.

Jerry: Right, and that ECPA claim carries some serious weight and is worth a considerable amount of money because the potential statutory damages are $10,000 per user per violation. That’s pretty significant when you add up what occurs in a class action.

Hayley: Exactly. When you’re talking about websites with hundreds of thousands of visitors, those numbers add up fast. And while most of these lawsuits have targeted healthcare providers, we’re now seeing claims against education platforms, retailers, and more.

Jerry: So, let’s break down the rulings, and let’s start with the Hannant case. What happened here?

Hayley: So, in Hannant, the plaintiff sued a hospital, claiming that by embedding the Meta Pixel on its site, the hospital sent Meta a duplicate of her web-browsing data without her consent. Judge Sara Darrow dismissed the ECPA claim, but importantly, she allowed the plaintiff to re-plead. The court said the plaintiff might be able to survive dismissal by adding details about how the alleged data sharing violated HIPAA, which would support a claim that the hospital acted with a criminal or tortious purpose, which is a key requirement under the ECPA exception.

Jerry: And what about the Powerschool decision in terms of the court going the other way?

Hayley: Yes. In that case, the plaintiff sued the Chicago school board and its edtech provider over their use of a third-party tool called Heap Autocapture. Judge Jorge Alonzo denied the motion to dismiss, finding that the plaintiff had plausibly alleged violations of ISSRA, which stands for the Illinois School Student Records Act, and FERPA, which is the Federal education privacy statute. Both decisions leaned on plaintiff-friendly precedent from the Northern District of Illinois, but in Hannant, the court wanted more detail to support the theory of a criminal or tortious purpose. In Q.J., the court was satisfied that the allegations, as pleaded, crossed the threshold.

Jerry: Let’s talk about the implications of these two opinions. These are just two of hundreds of similar claims, but what are these rulings signaling to corporate counsel?

Hayley: We’re seeing a clear trend. Illinois federal courts are becoming outliers, more willing to let these ECPA claims proceed than courts in other jurisdictions. In most other states, courts are dismissing ECPA claims at the pleading stage, finding either no true interception or no criminal/tortious purpose when the use was for advertising or analytics.

Jerry: So, for companies operating in Illinois, is the big picture that pixels and cookies aren’t just marketing tools anymore, but can constitute legal landmines?

Hayley: Absolutely, Jerry. These decisions are making Illinois a hotbed for ECPA class actions. And while the Seventh Circuit hasn’t ruled on these issues yet, defendants need to preserve arguments now for a potential appeal later.

Jerry: So, if you’re a corporate counsel, what’s the big picture here in terms of things you should be doing to mitigate your risks?

Hayley: So there’s three key steps. Review your arbitration clauses, as making them airtight can help deter class actions or mitigate the risk of mass arbitration. Update your website privacy policies, terms of use, and vendor agreements. Audit your use of adtech and edtech tools – know what data is being collected, where it’s going, and whether it’s encrypted, anonymized, or otherwise protected.

Jerry: And I suppose the other issue is you’re dealing with a patchwork quilt of rulings, decisions going one way in Illinois and other ways in other jurisdictions. So, what’s a corporate counsel to do in the greater scheme of things?

Hayley: In other jurisdictions, defendants are still winning on motions to dismiss by arguing there’s no interception, or that there’s no criminal or tortious intent, when the purpose is legitimate business analytics.

Jerry: Seems to me the big takeaway, then, is that companies operating in Illinois need to be vigilant in compliance with these laws. So, Hayley, thanks so much for your thought leadership and for joining us for your maiden voyage on our podcast. Appreciate your expertise and your views of these two significant rulings. And for our listeners, please subscribe to our blog posts and sites, and listen in on our weekly podcasts. Thanks so much for being here.

Hayley: Thanks for having me on the podcast, and thanks to the listeners for being here.

The Class Action Weekly Wire – Episode 116: 42 State Attorneys General Can’t Object To $275 Million Antitrust Settlement, Pennsylvania Federal Judge Rules

Duane Morris Takeaway: This week’s episode of the Class Action Weekly Wire features Duane Morris partner Jerry Maatman and senior associate Daniel Selznick with their discussion of a key ruling issued by a Pennsylvania federal judge regarding intervenors to a $275 million settlement resolving pharmaceutical price-fixing claims.  

Check out today’s episode and subscribe to our show from your preferred podcast platform: Spotify, Amazon Music, Apple Podcasts, Samsung Podcasts, Podcast Index, Tune In, Listen Notes, iHeartRadio, Deezer, and YouTube.

Episode Transcript

Jerry Maatman: Thank you for being here again, loyal blog listeners and readers, for our weekly podcast series entitled The Class Action Weekly Wire. I’m Jerry Maatman, a partner at Duane Morris, and joining me today is senior associate Dan Selznick. Thanks so much for being on the podcast, Dan.

Daniel Selznick: Great to be here, Jerry. Thanks for having me.

Jerry: Today, our topic is discussing a ruling from the Eastern District of Pennsylvania called In Re Generic Pharmaceutical Pricing Antitrust Litigation. That’s a mouthful, but it involved a situation where 40 state attorneys general were blocked from intervening in a $275 million generic drug price-fixing antitrust settlement. Dan, what’s the hubbub about with respect to this case?

Dan: Yeah, so this is part of a massive multidistrict litigation involving allegations that Sandoz and other pharmaceutical companies conspired to fix prices on generic drugs. This $275 million settlement would resolve claims brought by consumers, insurers, and other so-called “end payers,” and it’s actually the largest settlement so far for any defendant in this MDL.

Jerry: Why was it that the state attorneys general were attempting to intervene in the settlement?

Dan: So, the states, which are collectively referred to as the “Movant States,” filed a motion to intervene because they were concerned the settlement might interfere with their own lawsuits against Sandoz that had been remanded to the District of Connecticut. They claimed they had a sovereign and statutory interest in ensuring a fair recovery for consumers in their states.

Jerry: So, the concern was the federal settlement approved by the Eastern District of Pennsylvania might impair or cut off their rights to pursue state-related claims?

Dan: Exactly, so they argued that the scope of the release in the federal settlement could overlap with or even undermine what they’re trying to recover in their own suits. But the states weren’t asserting any new claims in this case, they were just asking to intervene so they could protect what they saw as their interests.

Jerry: But the end result was the Federal District Court in the Eastern District of Pennsylvania said no – what was the reasoning behind that answer to the states’ request?

Dan: Sure, so the court was following a recommendation by the special master in the case, and ruled that the states did not have Article III standing to intervene. And essentially, the court agreed that the states’ interest here was nominal, and it didn’t rise to the level of a concrete, sovereign interest required for standing.

Jerry: When you say nominal, from a legal sense, what does that mean in terms of standing?

Dan: In legal terms, a nominal interest means the party, in this case the states, is not asserting a direct legal claim or injury. The court held that because the states weren’t asserting their own affirmative claims and were instead trying to weigh in on claims resolved between private plaintiffs and Sandoz, the states were more like bystanders. So, the court made it clear that the real parties in interest are the individual consumers, or the end payers, and the states weren’t acting in their sovereign authority, which is key when trying to establish standing under a parens patriae theory.

Jerry: But isn’t it true that states have that statutory authority to protect consumers and to recover damages on their behalf? Doesn’t that matter in terms of a standing analysis?

Dan: Right, so that’s a big part of the states’ argument, and they were pointing to their parens patriae authority under state law to say, “We’re not just speaking for private citizens – we, the states, have an independent role.” But the court said that was not enough, because the states weren’t bringing their own claims here, and all of their actions were pending elsewhere. In this MDL, they were just objecting to the settlement and trying to ensure it did not impact their separate litigation. The court concluded that this indirect interest was not sufficient to establish standing to intervene.

Jerry: So that’s no standing, no intervention under Rule 24(a). What about permissive intervention under Rule 24(b)? Did the states try that gambit?

Dan: Right, so that’s a good question. You know, under Rule 24(b), the court has more flexibility. But even there, the special master concluded, and the court agreed, that letting the states in at this stage would risk delaying or prejudicing the rights of existing parties. And notably, the states didn’t push back on that conclusion, so the court denied permissive intervention under 24(b) as well.

Jerry: I thought the ruling was interesting insofar as the states were not allowed to intervene, but were not totally silenced. The court still let them leave to file an amicus brief. Is that something that you see very often?

Dan: You know, it’s hard to say. I mean, in this case, the court said that the states’ objections could still be considered, but only as amici curiae. So, the court made a point to say it would give those objections the same weight it would have if the states had been permitted to intervene. But the key difference with this is that because the states don’t have formal party status, they can’t appeal the final ruling unless they can establish standing.

Jerry: I thought another interesting dynamic to the decision was the role of Florida, and what it did, in a unique way as compared to the other states. Could you explain that for our listeners?

Dan: Sure, and yeah, it is interesting. So, Florida actually was not part of the group trying to intervene, and instead it asked to file an amicus brief supporting the settlement. So, contrary to what the other states were doing, and the court granted that request. So, you know, you’ve got states on both sides of this issue, which highlights how divided even the public enforcers can be when it comes to evaluating the fairness of a settlement.

Jerry: In terms of the financial side of the equation, how are the costs for the intervention motions being split?

Dan: So, my understanding is that the court is treating this as a shared cost among the parties involved in the motion, and I think the special master fees for the motion will be 50% covered by the states, so the movants, and then the other 50% will be split between Sandoz and the end-payer plaintiffs, each having 25%.

Jerry: That’s quite interesting. Well, thanks, Dan, for lending your thought leadership here in this complicated arena in the Eastern District of Pennsylvania. I think the big takeaway here seems to be, as it is in many federal-related class action situations, that real standing is the key to opening the courthouse door and being able to intervene and having a clear legal interest in an Article III sense trumps everything else. So, thanks so much for being here, Dan, and for your insights and for explaining this ruling to our readers. And thanks, listeners, for tuning in.

Dan: Of course, thanks, Jerry, for having me on the podcast, and again, thanks to the listeners for being here.

© 2009- Duane Morris LLP. Duane Morris is a registered service mark of Duane Morris LLP.

The opinions expressed on this blog are those of the author and are not to be construed as legal advice.

Proudly powered by WordPress