
Duane Morris Takeaway: This week’s episode features Duane Morris partner Jerry Maatman and special counsel Justin Donoho with their analysis of a $10 million preliminary settlement between a data aggregator and a group of plaintiffs from nine states alleging violations of their right to publicity.
Check out today’s episode and subscribe to our show from your preferred podcast platform: Spotify, Amazon Music, Apple Podcasts, Podcast Index, Tune In, Listen Notes, iHeartRadio, Deezer, and YouTube.
Episode Transcript
Jerry Maatman: Thank you for being here again for our next episode of the weekly podcast, the Class Action Weekly Wire. I’m Jerry Maatman of Duane Morris, and joining me today is my colleague Justin Donoho, who knows all things privacy. Thanks so much for being on the podcast today.
Justin Donoho: Great to be here, Jerry. Thanks for having me.
Jerry: Today, we’re discussing for our listeners a significant class action settlement involving data privacy, the right to publicity, and the use of personal information on online marketing purposes. The case is called Kellman v. Spokeo. There’s been a lot of interest in this case by our clients, and the parties have now reached a proposed settlement. So, we’re going to talk about what the case raises for companies, what the proposed settlement actually provides, and more importantly, what are the key takeaways for companies. Justin, let’s start with the basics – what’s the case about?
Justin: Yes, this case concerns Spokeo’s use of personal information in what the plaintiffs called “teaser profiles.” So, Spokeo operates a people search website. Users can search for information about individuals, and Spokeo provides information about those individuals through its website. Now, some of that information is available through a free search, while additional information is behind a paywall or requires a subscription. So, the plaintiffs allege that Spokeo used their personal information, including their names and home addresses in teaser profiles to market and sell subscriptions to the Spokeo website. The theory was that Spokeo wasn’t simply providing information about individuals. According to the plaintiffs, it was using individuals’ identities to promote a commercial service without obtaining their consent, and that distinction was important because the plaintiffs brought claims under a right of publicity laws in various states.
Jerry: So, as things go, this was not a traditional data breach case, right?
Justin: Correct. There was no allegation that Spokeo suffered a data breach that exposed information to any cybercriminals or anything like that. Instead, this case involved the commercial use of personal information, alleged commercial use. That’s an important distinction for companies because privacy risk isn’t limited to cybersecurity incidents. A company can face potential liability based on what it does with information that it lawfully possesses. Here, the plaintiffs alleged that Spokeo’s use of their identities in connection with marketing paid subscriptions violated state right of publicity laws.
Jerry: So, as I understand it, those laws can be particularly significant, and may provide pretty weighty statutory damages, even without proof of a pocketbook injury or actual economic loss.
Justin: Exactly. The proposed settlement filing explains that the relevant laws in Alabama and a lot of other states – California, Illinois, Indiana, Louisiana, Nevada, Ohio, South Dakota, and Washington – generally prohibit the unauthorized commercial use of an individual’s identity. The statutes differ from state to state, but they do provide statutory minimum damages. So, it ranged from $750,000 to $5,000 – in our home state of Illinois, I think it’s $1,000 – everything within that range among those states. So, that creates a potentially significant litigation risk when a company allegedly applies the same practice to large numbers of people.
Jerry: Let’s talk about the history of the case in terms of how the settlement occurred. As I understand it, the case had been ongoing for several years.
Justin: Yes, the original lawsuit was filed in November of 2021 by three plaintiffs asserting claims under California, Ohio, and Indiana law. Spokeo moved to dismiss, arguing, among other things, a lack of standing had not stated valid claims. In April of 2022, the court denied the motion to dismiss. There was permission sought for an interlocutory appeal, extensive discovery. According to the settlement filing, that included written discovery, document production, depositions, discovery disputes, expert work, motion practice. So, this was not a case that settled at the very beginning of the litigation.
Jerry: And as we have discussed many times on this podcast, pursuit and successful victory in the class certification context is all about gaining and obtaining class certification. That’s the holy grail that enables plaintiffs’ counsel to negotiate favorable settlements. In this case, was class certification a major pivot point in the case?
Justin: Absolutely, yes. The plaintiffs moved for class certification in 2023. Ultimately, they withdrew their request for a nationwide damages class, but the court certified California and Ohio classes with modifications to the proposed class definitions. Spokeo petitioned the Ninth Circuit for permission to appeal that order. The Ninth Circuit denied the petition, so that was an important point in the litigation because class certification significantly increased the stakes.
Jerry: If the settlement is ultimately approved by the court under Rule 23, let’s talk about the numbers in the settlement. The proposed settlement has the headline number of $10 million, is that correct?
Justin: Yes, that’s right. Spokeo would establish nine state-specific settlement funds totaling that $10 million, right? The funds are described as non-reversionary, also. That means the money if it’s not initially distributed to class members, it doesn’t simply go back to Spokeo. Instead, the settlement provides mechanisms for the remaining funds to be redistributed to claiming class members where practicable or otherwise handled as directed by the court. The actual amount each person receives will depend on a number of factors, including the number of valid claims submitted in that state and deductions for settlement administration expenses attorneys’ fees and costs, and any incentive awards approved by the court. So, the plaintiffs’ filing estimates that, assuming a 10% claims rate, individual recoveries could range from tens of dollars to more than $1,000, depending on the state.
Jerry: Was there any class-wide injunctive relief in the proposed settlement?
Justin: Yes, also a very important aspect of this settlement from a business perspective. Under the proposed settlement or agreement, when a user conducts a search that Spokeo’s algorithms interpret as a name search, Spokeo will modify the relevant purchase and payment pages so that the full name and home address of individuals in the injunction classes will no longer be displayed in that portion of the website flow. So, the proposed change is to be implemented within 30 days after entry of an order granting final approval. Gotta change all those business processes within 30 days.
Jerry: I think those aspects of the settlement tend to be more relevant to companies in terms of lessons learned. In terms of lessons learned, what are the takeaways for companies about the commercial use of data, and not just collection or security of that data?
Justin: Well, I think it means that a company might lawfully obtain information from public records or third-party data providers, but what this case teaches is that that doesn’t necessarily answer whether the company can use that information in every conceivable way. The question becomes, what is the company doing with this information? Is it displaying it, selling access to it, using it to generate leads? Using it to target advertising, using someone else’s name or likeness to promote a product, Incorporating somebody’s identity? Most importantly, is any of that violating any laws? So those are different uses, and they can present different legal risks.
Jerry: Let’s dig into that a little bit. What should a company do if it’s operating a business model involving the use of personal information like that?
Justin: Oh, boy, so many different uses of personal information. So, the first thing to do is to map the data lifecycle. Companies should know what personal information they collect, where it comes from, how it’s stored, who has access to it, how it’s ultimately used kind of a complex process there for many companies with a lot of personal information. Second, companies should specifically identify any uses of personal information that are commercial or promotional. Third, companies should conduct a state-by-state legal analysis where appropriate. Nationwide businesses shouldn’t assume that because a practice is permissible under one state’s law, it’s necessarily permissible everywhere. Fourth, companies should review their marketing and product design practices together. Sometimes legal risk is created not by a single marketing campaign, but by the design of the whole customer journey. And fifth, companies should think about class action exposure. If a company has a practice that is applied uniformly to thousands or millions of people, the aggregate litigation risk can be much greater than the potential exposure associated with any one individual claim.
Jerry: So, from a company’s perspective, I take it this means that a potential privacy or right of privacy issue should be evaluated early on before the business practice becomes the subject, obviously, of class action litigation.
Justin: Absolutely, and that’s particularly important as companies increasingly rely on data aggregation, AI, personalization, targeted advertising, automated marketing, all of that.
Jerry: So, the practical takeaway on the checklist should be know your data, know where it comes from, know how you’re using it, and understanding what laws apply to those uses.
Justin: Yes, absolutely. And also review practices that have become embedded in your products over time. Sometimes a feature was created years ago, when the legal environment was different, and no one’s revisited.
Jerry: Well, Justin, this has been a great tour of the privacy world, a super discussion. Thank you for your detailed analysis of the settlement and thank you for being here today. And thank you to our listeners for being here today, we’re glad you tuned in for another edition of the Class Action Weekly Wire.
Justin: Thanks, Jerry, and thank you to the listeners. It was a great time to be here. Appreciate it.











