Category: Duane Morris Class Action Review – 2025

By Jennifer A. Riley

Duane Morris Takeaway: Data breach litigation remained expansive in 2024 as plaintiffs filed more data breach class actions than in any other year and double the number filed in 2022. As the number of data breaches has accelerated, such events have provided the fuel for a surge of class actions. Despite the significant increase in filings, courts issued few (only four) class certification decisions in 2024, suggesting that many motions are in the pipeline or that, observing the difficulty that plaintiffs have faced in certifying such cases over the past two years, plaintiffs are electing to monetize their data breach claims prior to reaching that crucial juncture. So long as defendants continue to play ball on the settlement front, we are likely to see settlement payouts continue to lure plaintiffs to this space and fuel those filing numbers.

Watch the video below to learn more about this trend from Review co-editor Jennifer Riley:

1. Filing Numbers Continue Their Upward Trajectory

The volume of data breach class actions continued to proliferate in 2024. Data breach has emerged as one of the fastest growing areas of class action litigation. After every major (and not-so-major) report of a data breach, companies now can expect the resulting negative publicity to prompt one or more class action lawsuits, saddling companies with the significant costs of responding to the data breach as well as the significant costs of dealing with high-stakes class action lawsuits, often on multiple fronts.

Companies that are unfortunate enough to fall victim to data breaches in 2024 faced class actions at an increasing rate. In 2024, we tallied 1,488 class action filings in the data breach area, compared with 1,320 in 2023, and 604 in 2022.

As the graphic depicts, the growth of filings in the data breach area has been extraordinary, from 108 class action filings in 2018 to 1,488 class action filings in 2024, an increase of more than 1,265% over six years.

Several factors likely contributed to this continued surge in data breach class actions in 2024. First, data breaches have continued to increase at a rate that roughly tracks the shape of the curve depicted above. Second, whereas data breach actions pursued a decade ago faced little prospect of success, recent court decisions have provided a roadmap for plaintiffs to attempt to show standing and successfully plead duty, causation, and damages, thereby providing additional momentum for the plaintiffs’ class action bar. Third, settlement numbers have fueled filings, as plaintiffs are succeeding in monetarizing claims early before facing the investment or risk of class certification, making data breach claims a continued area of popularity for the plaintiffs’ bar.

2.           Plaintiffs Continue To Face Hurdles In The Courthouse

The U.S. Supreme Court’s decision in TransUnion LLC v. Ramirez, et al., 141 S.Ct. 2190 (2021), presents a fundamental threshold challenge for many data breach class action plaintiffs in terms of whether the plaintiff can show that he or she suffered a concrete injury such that he or she has standing to assert a claim. In TransUnion, the Supreme Court ruled that certain putative class members, who did not have their credit reports shared with third parties, did not suffer concrete harm and, therefore, lacked standing to sue. Since the TransUnion decision, standing has emerged as a key defense to data breach litigation because the plaintiffs often have difficulty demonstrating that they suffered concrete harm.

Courts, however, have continued to disagree over the application of TransUnion in the data breach context and have handed down a kaleidoscope of decisions. For instance, in cases where plaintiffs fail to assert plausible allegations of present injury that are fairly traceable to the data breach and rely instead on an asserted risk of future harm, some courts have found that mere public disclosure of private facts is sufficiently “concrete” to establish standing, whereas others have required allegations showing that the risk of future harm is substantial.

In Logan, et al. v. Marker Group, Inc., 2024 WL 3489208 (S.D. Tex. July 18, 2024), for example, plaintiffs alleged that the defendant failed to properly secure their protected health information and personally identifiable information (PII), thus leaving them to “face a lifetime of heightened risk of identity theft and fraud” as a result of the data breach. Id. at *6. The court granted the defendant’s motion to dismiss on the basis of lack of standing, finding that “the mere risk of future harm, standing alone, cannot qualify as a concrete harm.” Id. (citing TransUnion).

In Jones, et al. v. Sturm, Ruger & Co.,2024 WL 1307148 (D. Conn. Mar. 27, 2024), by contrast, plaintiff alleged that a breach compromised customers’ PII and payment card data (PCD). The court denied the defendant’s motion to dismiss for lack of standing. The court concluded that, under TransUnion, the plaintiff’s alleged injury was sufficiently “concrete” for standing purposes because “exposure of Plaintiffs’ PII to unauthorized third parties ‘bears some relationship’ to the ‘well-established common-law analog: public disclosure of private facts.’” Id. at *3 (quoting Bohnak v. Marsh & McLennan Companies, Inc., 79 F.4th 276, 285 (2d Cir. 2023)).

Plaintiffs who clear the standing hurdle face another key inflection point at the class certification phase. Despite the significant increase in filings, however, courts issued only five rulings on motions for class certification in 2024. This suggests that hundreds of motions are in the pipeline or that, observing the difficulty that plaintiffs have faced in certifying data breach such cases over the past two years, plaintiffs are electing to monetize their data breach claims prior to reaching that crucial juncture.

In Baker, et al. v. Parkmobile, LLC, 21-CV-2182, ECF No. 243 at 23 (N.D. Ga. Apr. 8, 2024), for example, a plaintiff’s expert conceded in detail at his deposition that, to resolve plaintiff’s claims, the court would need to undertake highly individualized inquiries as to whether the plaintiff was subject to a credential stuffing attack and whether such attack caused any injury. The parties reached a settlement while the motion for class certification was fully briefed and a decision was pending.

The certification rate, however, improved somewhat for plaintiffs in 2024. Courts issued five rulings on motions for class certification, and plaintiffs prevailed on two, a success rate of 40%. By comparison, in 2023, courts issued seven rulings on motions for class certification, and plaintiff prevailed in one, for a success rate of 14%.

Despite the increase in success rate, the recipe for successfully certifying a data breach class remains a work in progress, as unsuccessful plaintiffs encountered both new and old issues in 2024. For instance, in In Re Blackbaud, Inc. Customer Data Breach Litigation, 2024 WL 2155221 (D.S.C. May 14, 2024), the court denied class certification because plaintiffs failed to identify any administratively feasible way for the court to ascertain the identities of about 1.5 billion putative class members whose data was stored in 90,000 backup files.

In Vest Monroe, LLC, et al. v. Doe, No. S-23-G-1224, 2024 Ga. LEXIS 187 (Ga. Sept. 4, 2024), the Georgia Supreme Court upheld the denial of class certification because variation in the materials allegedly disclosed prevented plaintiff from showing commonality or typicality. The plaintiff’s claim arose from the conduct of an ex-employee who disclosed digital copies of documents and recordings. In finding a lack of commonality, the trial court noted the differences in the type of documents allegedly disclosed with respect to members of the proposed class, as some contained diagnosis and treatment information, while others did not. Id. at *4. Relatedly, some members of the proposed class had clinical information revealed, while plaintiff did not. The Georgia Supreme Court determined that the trial court did not err in its determination.

Although plaintiffs continue to search for a road map to reliably certify data breach class actions, defendants are continuing to fund settlements, allowing plaintiffs to monetize their claims without clearing the certification hurdle. Such circumstances are apt to continue to draw plaintiffs’ class action lawyers to the data breach space and to continue to generate filings.

By: Gerald L. Maatman, Jr.

Duane Morris Takeaway: Despite another tumultuous year of rulings, the arbitration defense remained one of the most powerful weapons in the class action defense toolkit. A defendant’s ability to enforce an arbitration agreement containing a class or collective action waiver continues to reign as one of the most impactful defenses in terms of shifting the pendulum of class action litigation. The U.S. Supreme Court cleared the last hurdle to widespread adoption of such agreements with its decision in Epic Systems Corp. v. Lewis, et al., 138 S. Ct. 1612 (2018). In response, more companies of all types and sizes updated their onboarding systems, terms of use, and other types of agreements to require that employees and consumers resolve any disputes in arbitration on an individual basis.

Watch Review Editor Jerry Maatman explain this trend below:

To date, companies have enjoyed a high rate of success enforcing those agreements and using them to thwart class actions out of the gate. In 2024, although defendants continued to win most motions to compel arbitration filed, their margin of victory dwindled. Across substantive areas of class action litigation, courts issued rulings on approximately 167 motions to compel arbitration over the past year. Defendants prevailed in 91 of those rulings, a success rate of approximately 54%. These numbers are lower than the numbers we saw in 2023, where courts issued rulings on 187 motions to compel arbitration, and defendants prevailed on 123 motions, which translated into a success rate of 66%.

Given the potency of the arbitration defense, the plaintiffs’ class action bar has continued to press potential exceptions to its coverage, including the Ending Forced Arbitration of Sexual Assault and Sexual Harassment Act (the Ending Forced Arbitration Act or EFAA) and the transportation worker exemption to the FAA. Over the past year, plaintiffs made significant strides on both fronts as courts issued a mixed bag of rulings. Plaintiffs continued to assert the EFAA to avoid arbitration of cases containing claims for alleged sexual harassment. And, despite the U.S. Supreme Court’s guidance, many lower federal courts continued to apply the transportation worker exemption in a broad manner to workers who handled goods that moved in interstate commerce, irrespective of whether they played a direct role in transporting the goods across borders, such as last-mile delivery drivers, warehouse workers, and local distributors.

1. The Continued Impact Of The EFAA

The EFAA amended the FAA and provided plaintiffs the discretion to avoid pre-dispute arbitration provisions in cases where they allege conduct constituting “a sexual harassment dispute or a sexual assault dispute” or are the named representatives in “a class or in a collective action alleging such conduct.” In other words, the Act does not render arbitration agreements invalid but allows plaintiffs bringing sexual assault or sexual harassment claims to elect to avoid the agreements and to bring their cases in court instead of arbitration.

In 2024, plaintiffs asserted the EFAA as a defense to approximately 47 motions to compel arbitration. Plaintiffs succeeded in enforcing the EFAA and keeping claims in court, in whole or in part, in approximately 27 of those rulings, or 57.4%. More than two years after the law’s effective date, courts are continuing to define its parameters, and rules regarding the law’s application are taking shape in multiple areas, the majority of which are coming out in favor of a broad application of the EFAA, making it easier for plaintiffs to avoid arbitration.

When Do Claims Arise?

Although by its terms the EFAA applies to any “dispute or claim that arises or accrues” on or after its enactment on March 3, 2022, courts have adopted varying interpretations of this language. Multiple decisions in 2024 showed that courts are receptive to arguments that the EFAA applies to conduct that occurred prior to the effective date of the Act so long as the plaintiffs file their charges or lawsuits after March 3, 2022.

In Famuyide, et al. v. Chipotle Mexican Grill Inc., 2024 U.S. App. LEXIS 19449 (8th Cir. Aug. 5, 2024), for example, the Eighth Circuit took a broad view as to when a dispute “arises” for purposes of the Act. A former employee claimed that a co-worker raped her at work in 2021, months before the EFAA took effect. The Eighth Circuit, however, held that the dispute arose when the plaintiff filed her lawsuit in court in July 2022 and not when the sexual assault occurred in 2021 or even when her attorneys sent a demand letter to the defendant in February 2022 because the demand letter was not a “conflict or controversy between the parties.” Id. at *6.

Similarly, in Kader, et al. v. Southern California Medical Center Inc., 2024 Cal. App. LEXIS 50 (Cal. App. 2d Dist. Jan. 29, 2024), the Second Appellate District for the California Court of Appeal found that a dispute arose when the plaintiff filed charges with the Department of Fair Employment and Housing. An executive brought claims for sexual misconduct, as well as discrimination, retaliation, and defamation against a medical center alleging that it employed a doctor who sexually assaulted him. The defendant moved to compel arbitration based on an agreement that the plaintiff signed in 2019. The Court of Appeal concluded that the date a dispute arises “depends on the unique facts of each case” but that “a dispute does not arise merely from the fact of injury.” Rather, “[f]or a dispute to arise, a party must first assert a right, claim, or demand.” Id. at *5.

What About Allegedly Continuing Violations?

In 2024, the Second Circuit weighed in on the impact of plaintiffs’ alleging “continuing violations,” again in a way consistent with a broad interpretation of the EFAA. In Olivieri, et al. v. Stifel, Nicolaus & Company, 112 F.4th 74 (2d Cir. 2024), the Second Circuit held that the EFAA shields claims from arbitration where the plaintiff alleges that the misconduct continued past the effective date of the law. Although the plaintiff alleged that she began experiencing a retaliatory hostile work environment before the effective date of the Act, and filed suit in January 2021, she claimed that the continuing course of conduct persisted after enactment of the EFAA, and, therefore, her claims were covered under the EFAA through the continuing violation doctrine. The Second Circuit agreed. The Second Circuit held that, while the plaintiff’s claim did accrue before the EFAA went into effect given that she filed suit in January 2021, her claims continued to accrue again with each act she alleged added to the hostile work environment. The Second Circuit reasoned that, “[i]f Congress wanted the EFAA to apply only to claims that ‘first’ accrue after its enactment, it could have said so.” Id. at 89.

Does The EFAA Shield Tag-Along Claims?

The scope of the EFAA has been a hotly contested issue in terms of the breadth of its arbitration shield and whether it applies to all claims asserted by a plaintiff or only the sexual assault or sexual harassment claims. In October 2024, California’s Second Appellate District held in Yongtong Liu, et al. v. Miniso Depot CA Inc., 105 Cal. App. 5th 791 (Cal. App. 2d Dist. 2024), that the EFAA extends to a plaintiff’s entire employment case, including a plaintiff’s wage claims, shielding them from arbitration. A human resources employee brought suit against an employer alleging that the CEO made inappropriate comments regarding her appearance and sexual orientation. The employee also asserted wage & hour claims for alleged misclassification, unpaid overtime, and minimum wage violations. The EFAA states, in relevant part, that “no predispute arbitration agreement . . . shall be valid or enforceable with respect to a case which is filed under Federal, Tribal, or State law and relates to the . . . sexual harassment dispute.” 9 U.S.C. § 402(a) (emphasis added). Focusing on the statute’s use of the word “case,” the appellate court ruled that the EFAA “makes the parties’ arbitration agreement unenforceable as to [plaintiff’s] entire case.” Such ruling runs counter to others, including the June 2023 decision in Mera v. SA Hospitality Group LLC, 675 F. Supp. 3d 442, 448 (S.D.N.Y. 2023), wherein a federal magistrate judge ruled that, although a restaurant chain could not force a plaintiff to arbitrate his sexual harassment claims, it could force him to arbitrate his wage & hour overtime claims because they “do not relate in any way to the sexual harassment dispute.”

Companies should anticipate continued development of these and other novel issues as we continue further past the enactment date and plaintiffs continue to shift their interest toward the EFAA’s arbitration shield.

#2. The Impact Of The Transportation Worker Exemption

In one of the largest door-openers to the courthouse for the plaintiffs’ class action bar, courts have issued a runaway train of rulings that position the transportation worker exemption to swallow up the FAA for workers who move or contribute to the movement of goods. Section 1 of the FAA exempts from arbitration “contracts of employment of seamen, railroad employees, or any other class of workers engaged in foreign or interstate commerce.” The third category commonly is called the “transportation worker” exemption. Although the U.S. Supreme Court has instructed lower courts to interpret the transportation worker exemption “narrowly,” its parameters have carved a slippery slope for lower courts.

In Southwest Airlines Co. v. Saxon, et al., 142 S.Ct. 1783 (2022), the U.S. Supreme Court applied the transportation worker exemption to an airport ramp supervisor. Although it held that the exemption requires direct involvement in the transportation of goods across state or international borders, it had no problem finding the plaintiff part of such a class: “We have said that it is ‘too plain to require discussion that the loading or unloading of an interstate shipment by the employees of a carrier is so closely related to interstate transportation as to be practically a part of it.’ . . . We think it equally plain that airline employees who physically load and unload cargo on and off planes traveling in interstate commerce are, as a practical matter, part of the interstate transportation of goods.” Id. at 1789.

This ruling set off a barrage of decisions finding individuals who touch goods that move in interstate commerce, or the means of transport for such goods, subject to the exemption. As a result, in April 2024, the U.S. Supreme Court took up Bissonnette, et al. v. LePage Bakeries Park Street, LLC, 61 U.S. 246 (2024). As in Saxon, the U.S. Supreme Court emphasized that the test for application of the transportation worker exemption focuses on the work performed by the plaintiff and not the employer’s industry. Addressing the employer’s argument that its test would fold virtually all workers who load or unload goods, such as pet shop employees and grocery store clerks, into the exemption, the Supreme Court stated that the exemption has “never” been interpreted to apply in “such limitless terms.” Id. at 256. For the exemption to apply, the worker “must at least play a direct and necessary role in the free flow of goods across borders.” Id.

The Bissonnette decision appears to have had a smaller impact on the lower courts, which issued opinions before and after Bissonette that broadly construe the transportation worker exemption.

In May, for example, the California Court of Appeal in Peters, et al. v. SDLA Courier Services, 2024 Cal. App. Unpub. LEXIS 2954 (Cal. App. 2d Dist. May 14, 2024), found the plaintiff, a delivery driver who made only local deliveries of Amazon products, an exempt transportation worker. The plaintiff filed a class action alleging that the defendant violated various provisions of the California Labor Code, and the defendant moved to compel arbitration of the plaintiff’s individual claims and to dismiss the class claims. The trial court denied the motion, finding the FAA inapplicable because the plaintiff was a “last-leg delivery driver” and “engaged in interstate commerce.” Id. at *2. The Court of Appeal affirmed, reasoning that, but for the plaintiff and those like her, the packages would not get delivered to customers.

The Ninth Circuit also applied the transportation worker exemption broadly in three of its decisions this past year, both before and after Bissonette.

On March 12, 2024, in perhaps the most aggressive application to date, the Ninth Circuit ruled in Ortiz, et al. v. Randstad Inhouse Services, LLC, 95 F.4th 1152 (9th Cir. 2024), that the plaintiff, a warehouse equipment operator responsible for moving packages to and from warehouse racks, qualified as a transportation worker. After plaintiff filed a class action for alleged wage & hour violations, the defendant moved to compel arbitration, and the district court denied the motion. The Ninth Circuit affirmed. It found that the plaintiff “actively engaged” in transportation because he “ensured that goods would reach their final destination by processing and storing them while they awaited further interstate transport.” Id. at 1162. Further, it found that the plaintiff “actively engaged” with transportation because he handled goods “as they went through the process of entering, temporarily occupying, and subsequently leaving the warehouse.” Id.

On July 19, 2024, the Ninth Circuit affirmed the district court’s ruling in Lopez, et al. v. Aircraft Service International, Inc., 107 F.4th 1096 (9th Cir. 2024). The plaintiff, a fueling technician at Los Angeles International Airport, initiated a wage and hour class action against his employer, who moved to compel arbitration. The district court denied the motion. It reasoned that, although the plaintiff did not handle goods in commerce, he was directly involved in the maintenance of the means by which the goods were transported. The Ninth Circuit affirmed. Although the plaintiff did not have any hands-on contact with goods or any direct participation in their movement, the Ninth Circuit reasoned that the plaintiff’s work fueling airplanes was a “vital component” of the plane’s ability to fly. Id. at 1101.

On September 11, 2024, the Ninth Circuit issued another broad ruling in Nair, et al. v. Medline Industries, LP, 2024 WL 4144070 (9th Cir. Sept. 11, 2024). There, the plaintiff was a California warehouse operator who worked on a shipping dock stacking pallets and wrapping them in saran wrap. The plaintiff alleged that a driver told her that he made out-of-state deliveries and that a training video showed her employer shipping medical supplies throughout the country. The Ninth Circuit affirmed the district court’s order denying a motion to compel arbitration, noting that the employer had done nothing to rebut the plaintiff’s evidentiary showing that she packaged and loaded goods that traveled in interstate commerce. Justice Ryan Nelson’s concurrence cautioned that the Ninth Circuit needed to ground its decisions in the statutory text of the transportation worker exemption rather than through “judicially created tests [that] risk taking on a life of their own.” Id. at *2.

The U.S. District Court for the District of Colorado followed this line of reasoning and issued a similar ruling in Rietheimer, et al. v. United Parcel Service Inc., No. 23-CV-477 (D. Colo. Nov. 13, 2024). The plaintiff, a last-mile delivery driver, filed a class action, and the defendant moved to dismiss the class claims and compel individual arbitration. The court ruled that the plaintiff and other last-mile delivery drivers like him were engaged in interstate commerce within the meaning of the transportation worker exemption. The court explained that, although the plaintiff did not directly transport goods across state lines, a significant portion of the packages he handled came from out of state, and his role was integral to the final step in the interstate delivery process. It reasoned that the packages the plaintiff delivered were part of an ongoing interstate transaction and thus concluded that he was directly involved in the free flow of goods across state borders. Given the enduring impact that the arbitration defense has in class action litigation, companies are apt to face additional hurdles from creative workarounds from the plaintiffs’ class action bar as courts continue to push the boundaries of the transportation worker exemption.

By Jennifer A. Riley

Duane Morris Takeaway: The plaintiffs’ class action bar has continued to invest in the privacy class action space and, over the past year, has generated a multitude of filings, making privacy one of the hottest areas of growth in terms of activity by the plaintiffs’ class action bar. As technology continues to infiltrate our everyday lives, it provides ongoing inspiration for novel claims. Two of the most active areas of privacy litigation over the past year include: (1) litigation regarding “biometric” technologies under the Illinois Biometric Privacy Act (BIPA); and (2) claims regarding website advertising technologies (adtech) asserted under a variety of federal and state statutory and common laws.

Watch DMCAR co-editor Jennifer Riley explain this trend in the following video:

Additionally, in the absence of a federal comprehensive privacy law, states have been enacting their own patchwork of laws. There are currently 19 states that have passed comprehensive privacy laws. The following chart shows new laws that will become effective in 2025:

1. Illinois Biometric Information Privacy Act Claims

On August 2, 2024, the Illinois Governor signed a long-awaited amendment to the BIPA, the most popular and heavily litigated privacy law in the U.S. The amendments eliminated per-scan damages, granting defendants a reprieve from potentially crushing penalties allowed under pre-amendment version of the law that inspired thousands of class action lawsuits over the past seven years.

Enacted in 2008, the BIPA regulates the collection, use, and handling of biometric information and biometric identifiers by private entities. Subject to certain exceptions, the BIPA prohibits collection or use of an individual’s biometric information and biometric identifiers without notice, written consent, and a publicly available retention and destruction schedule.

In terms of lawsuit filings, for nearly a decade following enactment of the BIPA, activity under the statute remained largely dormant. The plaintiffs’ bar filed approximately two total lawsuits per year from 2008 through 2016 before filings increased in 2017 and then skyrocketed in 2019. In 2020, plaintiffs filed more than six times as many class action lawsuits for alleged violations of the BIPA than they filed in 2017 and more than the number of class action lawsuits they filed from 2008 through 2016 combined.

Filings continued to accelerate in 2023, prompted by two rulings from the Illinois Supreme Court that increased the opportunity for recovery of damages under the BIPA. On February 2, 2023, the Illinois Supreme Court held that a five-year statute of limitations applies to claims under the BIPA, and, on February 17, 2023, the Illinois Supreme Court held that a claim accrues under the BIPA each time a company collects or discloses biometric information. See Tims v. Black Horse Carriers, 2023 IL 127801 (Feb. 2, 2023); Cothron, et al. v. White Castle System, Inc., 2023 IL 1280004 (Feb. 17, 2023).

In 2024, the Illinois General Assembly dealt a significant blow to plaintiffs’ pursuit of these claims. On August 2, 2024, the Illinois Governor signed SB 2979 into law, amending the BIPA and limiting plaintiffs to one recovery per person under §§ 15(b) and 15(d). In other words, a private entity that, in more than one instance, collects, captures, or otherwise obtains the same biometric identifier or biometric information from the same person using the same method of collection “has committed a single violation” for which an aggrieved person is entitled, at most, to one recovery. See 740 ILCS 14/20 (b), (c). Courts to date have disagreed as to whether the amendment and its new “per person” damages regime applies retroactively, see Edwards v. Central Transport LLC, No. 24-CV-1925 (N.D. Ill. Nov. 13, 2024), or whether it applies only on a go-forward basis. We anticipate that parties will continue to litigate this question in 2025.

While a welcome relief to defendants, the BIPA’s new “per person” damages regime remains sizable and on a par with other privacy statutes that remain popular with the plaintiffs’ class action bar, such as the Electronic Communications Privacy Act (ECPA), which provides for damages up to $10,000 per claimant, or the Video Privacy Protection Act (VPPA), which provides for damages up to $2,500 per claimant.

Thus, whereas their rate of growth slowed in 2024, BIPA filings remained robust in comparison with prior years. Indeed, plaintiffs filed 427 lawsuits invoking the BIPA in 2024, compared with 417 in 2023, and 362 in 2022. The graphic shows the year over year growth in BIPA filings over the past eight years:

In terms of substance, 2024 saw the emergence of two significant trends in BIPA litigation that illustrate plaintiffs’ continued creativity when it comes to applying the BIPA to new technologies.

First, plaintiffs filed a significant number of BIPA cases targeting technologies that perform functions other than biometric identification. These include virtual try-on technologies, efforts to measure affects or emotions, attempts to verify conformance with pornography restrictions or passport photo requirements, and other functions. Basically, if a company’s technology performs any function at all involving a face, the company was a potential target of BIPA litigation in 2024. Although no courts have ruled definitively as to whether such technologies obtain “biometric identifiers” or “biometric information” within the meaning of the BIPA, some courts have found allegations regarding their use sufficiently plausible to survive motions to dismiss.

In Davis v. e.l.f. Cosmetics, Inc., 2024 U.S. Dist. LEXIS 94318 (N.D. Ill. May 28, 2024), for example, plaintiffs filed a class action alleging that the defendant’s virtual try-on technology used facial recognition technology without proper consent in violation of § 15(b). The defendant moved to dismiss on the ground that virtual try-on involves only facial detection (i.e., whether there is a face), not facial recognition or identification. The court rejected the argument, concluding that the plaintiffs’ allegations that the virtual try-on tool obtained biometric identifiers was “enough” at the pleading stage to overcome a motion to dismiss. Id. at *2.

In Martell, et al. v. X Corp., 2024 U.S. Dist. LEXIS 105610 (N.D. Ill. June 13, 2024), by contrast, plaintiff alleged that he uploaded a photograph containing his face to the social media platform X and that X then analyzed the photograph for nudity and other inappropriate content using a product called PhotoDNA. Id. at *1. According to the plaintiff, PhotoDNA created a unique digital signature of his face-containing photograph known as a “hash” and, therefore, necessarily obtained a “scan of . . . face geometry” in violation of the BIPA. Id. at *1-2. X Corp. moved to dismiss arguing, among other things, that plaintiff failed to allege that PhotoDNA obtained a scan of face geometry because PhotoDNA does not perform facial recognition. The court granted the motion finding no plausible allegations of a scan of face geometry because “PhotoDNA is not facial recognition software.” Id. at *5. As the court explained, the “plaintiff does not allege that the hash process takes a scan of face geometry, rather he summarily concludes that it must. The court cannot accept such conclusions as facts adequate to state a plausible claim.” Id. at *9.

Second, plaintiffs have filed a significant number of BIPA cases over the use of AI‑based facial recognition systems that transform photographs into numerical expressions that can be compared to determine their similarity. These modern systems are different than older, non-AI facial recognition systems in place at the time of the BIPA’s enactment in 2008 that attempt to identify individuals by using measurements of face geometry. The older systems construct a facial graph from many key landmarks such as the corners of the eyes, tip of the nose, and corners of the mouth. Courts have disagreed as to whether the BIPA, which defines biometric identifiers to include a “scan of face geometry,” applies to AI machine-learning systems for facial analysis or recognition that do not construct such geometric graphs.

One court previously found that this question is one for a jury, see In Re Facebook Biometric Information Privacy Litigation, 2018 WL 2197546, at *2-3 (N.D. Cal. May 14, 2018), but at least one other court, Zellmer, et al. v. Meta Platforms, Inc., 104 F.4th 1117 (9th Cir. 2024), held to the contrary.

In Zellmer, a plaintiff who never used Facebook sued Meta for alleged violations of the BIPA after his friends uploaded photographs of him to Facebook. He alleged that Facebook collected or captured his biometric identifiers when its tag suggestion feature created what Facebook calls a “face signature” from those uploaded photos. Id. at 1120. The district court granted summary judgment to Facebook, and the Ninth Circuit affirmed. As the Ninth Circuit explained, “[n]o one – not even [defendant, the creator of the face signature] – can reverse-engineer the numbers comprising a given face signature to derive information about a person.” Id. at 1121. For this reason, the face signature “cannot identify an individual” and, therefore, is not subject to the BIPA. Id. at 1123.

We expect continued litigation in 2025 over whether the BIPA regulates only those technologies capable of identification and whether AI-based facial recognition systems implicate the BIPA will remain a hotly litigated topic in 2025.

2. Website Advertising Technology And Other Privacy Claims

Although website activity tracking tools are nothing new, and appear on most websites, this past year they continued to fuel a wave of lawsuits alleging that such tools caused companies in various industries to share users’ private information. While some of these cases and claims met an early dismissal, others inspired sizable settlements, signaling that corporations should expect continued investment in this area by the plaintiffs’ bar in 2025.

In 2024, for the second time in as many years, plaintiffs filed more than two hundred class action complaints alleging that Meta Pixel, Google Analytics, and other similar software code embedded in websites secretly captured plaintiffs’ web browsing data and sent it to Meta, Google, and other online advertising agencies. This software, often called “adtech,” is a popular feature on many websites today. More than ten million companies and governmental organizations use it. Adtech works by collecting information about a person’s web-browsing behavior, using AI to analyze the collected data, and then serving targeted advertisements based on the analysis.

Plaintiffs have asserted claims attacking adtech based on one or more of a wide variety of legal theories, including federal and state wiretapping statutes, eavesdropping statutes, the VPPA, unfair and deceptive practices statutes, various common laws, and other legal theories. Plaintiffs typically seek to invoke a statute that provides for statutory damages, asserting that hundreds of thousands of website visitors, times $10,000 per claimant in statutory damages under the Federal Wiretap Act, for example, equals billions of dollars. Several of these cases have led to multi-million-dollar settlements, but the vast majority remain undecided.

The courts reviewing these claims have been tasked with applying statutes, many of which were passed decades ago, in novel ways to new technologies that the drafters of those laws could not have envisioned. As a result, courts issued an assortment of rulings on motions to dismiss adtech class actions in 2024, resulting in a mixed bag of outcomes. Court rulings on these inventive theories varied widely in 2024, presaging continued battles in 2025 as these issues bubble up to appellate courts.

One of this year’s largest adtech class action led to a victory for defendants in T.D. v. Piedmont Healthcare, Inc., Case No. 23-CV-5416 (N.D. Ga. Aug. 24, 2024). The plaintiffs sued Piedmont alleging that it installed the Meta Pixel on its public-facing website and its secure patient portal and transmitted the plaintiffs’ “personally identifiable information (PII) and protected health information (PHI) [to Meta] without their consent.” Id. at 1-2.

The plaintiffs asserted claims for invasion of privacy, breach of fiduciary duty, negligence, breach of contract, unjust enrichment, and violation of the ECPA. The court granted Piedmont’s motion to dismiss.

First, the court found no invasion of privacy because “[t]here is no intrusion upon privacy when a patient voluntarily provides personally identifiable information and protected health information to his or her healthcare provider.” Id. at 5-6. Second, the court rejected all seven of plaintiffs’ alleged damages theories and, accordingly, dismissed plaintiffs’ breach of fiduciary duty, negligence, breach of contract, and unjust enrichment, all of which required the plaintiffs to plausibly allege damages or, relatedly, enrichment, as an element of these claims. Id. at 7-10. Finally, the court dismissed the plaintiffs’ ECPA claim, which required plaintiffs to plausibly allege an intentional interception of the contents of an electronic communication. Id. at 11.

By contrast, in Kane, et al. v. University Of Rochester, 2024 WL 1178340 (W.D.N.Y. Mar. 19, 2024), a New York federal court denied a motion to dismiss finding that adtech plaintiffs sufficiently alleged that defendant disclosed information they entered on defendant’s website in the form of appointment scheduling information that identified the user who scheduled the appointment, the provider, and the provider’s specialty. Id. at *5-7.

The court declined to dismiss plaintiffs’ claims for breach of express contract, unjust enrichment, bailment, and violation of New York’s deceptive trade practices statute, and found that plaintiffs sufficiently invoked the crime-tort exception under ECPA. Id. at *7-8. The court acknowledged that it joined the “[a]t least one [other] . . . court” by finding an adtech plaintiff sufficiently invoked the crime-tort exception under ECPA with allegations that the website owner’s purpose was to “enhance its marketing efforts.” Id. at *7.

In cases where websites containing video and adtech allegedly transmit video viewing information, plaintiffs often assert claims for alleged violations of the federal VPPA. It prohibits a “video tape service provider” from knowingly disclosing “personally identifiable information concerning any consumer of such provider.” 18 U.S.C. § 2710(b)(1).

The statute defines a “video tape service provider” to include any person “engaged in business, or affecting interstate or foreign commerce, of rental, sale, or delivery of prerecorded video cassette tapes or similar audio-visual materials.” 18 U.S.C. § 2710(a)(4).

The VPPA provides for damages up to $2,500 per violation in addition to costs and attorneys’ fees for successful litigants, making it an attractive source of filings for the plaintiffs’ class action bar.

Indeed, plaintiffs initiated more than 250 VPPA class actions in 2024, compared to 137 in 2023, reflecting continued growth of VPPA class actions fueled in large part by adtech claims.

In 2024, courts issued a mixed bag of rulings on motions to dismiss claims for alleged violation of the VPPA. Compare, e.g., Brown, et al. v. Learfield Communications, LLC, 2024 U.S. Dist. LEXIS 15587 (W.D. Tex. Jan. 29, 2024) (dismissing VPPA claim because the plaintiff failed to allege a nexus between plaintiff’s newsletter subscription and access to video content), with Salazar, et al. v. National Basketball Association, 2024 U.S. App. LEXIS 25902 (2d Cir. Oct. 15, 2024) (rejecting defendant’s argument that the VPPA applies only to subscribers of audiovisual services and finding that it also applies to subscribers of an email newsletter).

These rulings illustrate the vast and growing patchwork quilt of differing approaches to adtech claims asserted under a variety of legal theories. A more expansive discussion of these rulings appears in Chapter 14 regarding Privacy Class Actions. The initial decisions concerning class certification of adtech claims issued in 2024, however, came out in favor of defendants as both courts denied class certification. See Griffith, et al. v. TikTok, Inc., 2024 U.S. Dist. LEXIS 176403 (C.D. Cal. Sept. 9, 2024); Martinez, et al. v. D2C, LLC, 2024 U.S. Dist. LEXIS 178570 (S.D. Fla. Oct. 1, 2024).

In 2025, we anticipate that the patchwork quilt will expand as more courts confront these novel claims and decisions start making their way toward resolution at the appellate level.

By: Jennifer A. Riley

Duane Morris Takeaway: Although courts issued fewer decisions on motions for class certification in 2024 as compared to 2023, the plaintiffs’ class action bar obtained certification at a more consistent rate across all substantive areas, suggesting that plaintiffs are being more selective in their investments and the cases they pursue through class certification.

Watch Duane Morris partner Jennifer Riley discuss the consistent certification rates in 2024 and what it means for 2025 in the video below:

In 2024, courts issued rulings on 432 motions for class certification, a decrease from 2023, when courts issued rulings on 451 motions for class certification. Of those, courts granted motions for class certification at a lower rate. Courts granted 272 of those motions, for a certification rate of approximately 63%. In 2023, by contrast, courts granted 324 motions for class certification, for a certification rate of approximately 72%.

Although the certification rate overall was lower, plaintiffs obtained certification at a more consistent rate across substantive areas, from a low of 33% in the RICO area, to a high of approximately 86% in the WARN areas. By contrast, in 2023, the numbers varied more substantially across substantive areas, from a low of 14% in the data breach area, to a high of 97% for securities fraud.

Plaintiffs Continued To Certify Cases At High Rates

In 2024, plaintiffs succeeded in certifying class actions at a high rate. Across all major types of class actions, courts issued rulings on 432 motions to grant or to deny class certification in 2024. Of these, plaintiffs succeeded in obtaining or maintaining certification in 272 rulings, an overall success rate of approximately 63%.

The numbers show that, when compared to 2023, plaintiffs filed fewer motions for class certification in 2024, and succeeded in certifying fewer classes in 2024.

By comparison, in 2023, courts issued rulings on 451 motions to grant or deny class certification, and plaintiffs succeeded in obtaining or maintaining certification in 324 rulings, with an overall success rate of 72%. In 2022, courts issued rulings on 335 motions to grant or to deny class certification, and plaintiffs succeeded in obtaining or maintaining certification in 247 rulings, an overall success rate of nearly 74%.

In 2024, the number of motions that courts considered varied significantly by subject matter area, and the number of rulings varied across substantive areas. The below chart summarizes these results in each of the key areas of class action litigation (sorted by plaintiffs’ success rate).

The plaintiffs’ bar obtained the highest rates of success in WARN Act, wage & hour, securities fraud, and antitrust class actions. In cases alleging claims for violation of the WARN Act, plaintiffs succeeded in obtaining orders certifying classes in six of seven rulings issued during 2024, a success rate of 85.7%. In wage & hour class and collective actions, plaintiffs succeeded in obtaining first-stage certification orders in 124 of 156 rulings issued during 2024, a success rate of 79.5%. In cases alleging antitrust violations, plaintiffs succeeded in obtaining orders certifying classes in 15 of 21 rulings issued during 2024, a success rate of 71.4%.

Although the certification rate overall was lower, as discussed above, moving down to 63% in 2024 from 72% in 2023, plaintiffs obtained certification at a more consistent rate across substantive areas. In 2024, plaintiffs succeeded in certifying cases alleging WARN Act violations at a rate of 85.7%, their highest rate of success among substantive areas. Plaintiffs succeeded in certifying cases alleging RICO violations at a rate of 33.3%, their lowest rate of success across substantive areas. Compared to 2023, these numbers reflect less variance across substantive areas.

In 2023, plaintiffs succeeded in certifying cases alleging securities fraud at a rate of 97.2%, their highest rate of success among substantive areas. Plaintiffs succeeded in certifying cases alleging data breach claims at a rate of 14.3%, their lowest rate of success across substantive areas.

The year over year compression suggests that plaintiffs were more selective during 2024 relative to the cases in which they sought class certification, particularly at the low end.

In 2024, for example, the number of rulings on motions for class certification in the data breach area dropped to four, a decrease of 42.9%, but plaintiffs fared better on those four, going two for four, for a success rate of 50.0%.

Courts Issues More Rulings In FLSA Collective Actions Than In Any Other Area Of Law

In 2024, courts issued more certification rulings in FLSA collective actions than in any other type of case. Many courts historically have applied a more lenient standard to such motions, allowing plaintiffs to increase the size of their cases with comparatively low investment, contributing to the number of filings in this area.

Overall, courts issued 171 rulings. Of these, 156 addressed motions for conditional certification of collective actions under 29 U.S.C. § 216(b), and 18 addressed second-stage motions for decertification of collective actions. Of the 167 rulings that courts issued on motions for conditional certification, 125 rulings favored plaintiffs, for a success rate of nearly 75%.

Plaintiffs’ success rate at the conditional certification stage outpaced their performance from 2023. In 2023, courts issued 183 rulings. Of these, 165 addressed motions for conditional certification of collective actions under 29 U.S.C. § 216(b), and 18 addressed second-stage motions for decertification of collective actions. Of the 167 rulings that courts issued on motions for conditional certification, 125 rulings favored plaintiffs, for a success rate of nearly 75%.

The results plaintiffs achieved in 2024 are more similar to the results they obtained in 2022, during which courts issued rulings on 236 motions. Of these, 219 addressed motions for conditional certification of collective actions, and 18 addressed motions for decertification of collective actions. Of the 219 rulings that courts issued on motions for conditional certification, 180 rulings favored plaintiffs, for a success rate of 82%.

Although success rates stayed high, and climbed closer to the rate observed in 2022, the overall number of rulings declined. This phenomenon likely reflects the impact of the so-called Swales-Clark movement. Until 2021, courts almost universally applied a two-step process to certification of FLSA collective actions. At the first stage, courts required a plaintiff only to make a “modest factual showing” that he or she was similarly-situated to others, and plaintiffs often met such burden at the outset of litigation by submitting declarations from a limited number of potential collective action members.

At the second stage, courts conducted a more thorough examination of the evidence to determine whether in fact the plaintiff was similarly-situated to others and the court manageably could try the case on a collective basis.

Over the past few years, however, courts have started taking a fresh look at the two-step process and whether it comports with the FLSA. Federal appellate courts in two circuits – the Fifth Circuit and Sixth Circuit – along with various district courts answered that question in the negative.

In 2021, the Fifth Circuit in Swales, et al. v. KLLM Transport Services, LLC, 985 F.3d 430, 436 (5th Cir. 2021), rejected the two-step approach to evaluating collective action certification, holding instead that district courts should “rigorously scrutinize the realm of ‘similarly-situated’ workers … at the outset of the case.”

In 2023, the Sixth Circuit in Clark v. A&L Homecare & Training Center, LLC, 68 F.4th 1003 (6th Cir. 2023), likewise jettisoned the two-step approach but expressly declined to adopt the standard approved by the Fifth Circuit. Instead, the Sixth Circuit introduced a new standard that requires the plaintiff to demonstrate a “strong likelihood” that other employees are “similarly-situated” to the plaintiff.

Although different, both Swales and Clark require plaintiffs to make a more substantial showing than the first-step approach requires, thereby requiring more factual development and, as a result, more investment on the part of the plaintiffs’ bar. As a result, we have seen fewer motions filed in these two circuits over the past two years, as plaintiffs progress further into discovery before filing their motions for conditional certification and as plaintiffs shift their efforts away from pursuing collective actions in the Fifth and Sixth Circuits.

Indeed, once a hotbed of filings, the number of rulings in the Fifth and Sixth Circuits were muted in 2024. In the Fifth Circuit, courts issued rulings on six motions for conditional certification, and plaintiffs prevailed on five, for a success rate of 83%, and, in the Sixth Circuit, courts issued rulings on ten motions for conditional certification, and plaintiffs prevailed on eight, for a success rate of 80%. While the results are solid for plaintiff’s side lawyers, the investment of time and effort to secure certification and thereafter monetize their cases shows a far longer track than in other federal circuits

These numbers illustrate the impact of Clark. Whereas courts in the Sixth Circuit issued rulings on ten motions for conditional certification this year, in 2023, as Clark began to take hold, courts in the Sixth Circuit issued 22 decisions on motions for conditional certification.

In 2022, the last full year before Clark, courts in the Sixth Circuits issued 36 decisions on motions for conditional certification. These numbers show a decrease of 14 rulings in each of the past two years. These numbers may continue to decline as plaintiffs shift their case filings to other circuits that have retained the lenient two-step approach or to other areas.

The distribution of conditional certification rulings over the past years shows that a disproportionate number emanated from traditionally pro-plaintiff jurisdictions, including the judicial districts within the Second Circuit (33 decisions) and Ninth Circuit (21 decisions), which include New York and California, respectively. The following map illustrates these variations:

At the decertification stage, courts generally have conducted a closer examination of the evidence and, as a result, defendants historically have enjoyed an equal if not higher rate of success on these second-stage motions as compared to plaintiffs. The results in 2024, however, were less favorable for defendants. Courts issued 15 rulings on motions for decertification. Of these, five rulings favored defendants, for a success rate of only 33.3%, and 10 rulings favored plaintiffs, for a success rate of 66.6%.

By comparison, in 2023, courts issued 18 rulings on motions for decertification of collective actions. Of these, eight favored defendants, for a success rate of 44.4%, and ten rulings favored plaintiffs, for a success rate of 55.6%. Such a rate aligns with the success rate defendants enjoyed in 2022. In 2022, courts similarly issued 18 rulings on motions for decertification of collective actions. Of these, defendants prevailed in nine, for a success rate of 50%, and plaintiffs prevailed in nine, for a success rate of 50%.

The variation in numbers across federal circuits no doubt flows from the different standards and approaches that different courts take in evaluating motions for conditional certification and decertification and, in turn, the likelihood of plaintiffs’ success on such motions. If more courts join the Fifth and Sixth Circuits in abandoning the traditional two-step certification process, and thereby increase the time and expense of gaining a conditional certification order, it may lead to a reshuffling of the deck in terms of the types of cases plaintiffs pursue and where plaintiffs choose to file them.

By Gerald L. Maatman, Jr.

Duane Morris Takeaway:  As authors and editors of our firm’s our Class Action Review, we identified ten (10) key trends in class action litigation over the past year. Trend # 1 focuses on the unprecedented number of massive class action settlements reached in the last 12 months. Aside from the Big Tobacco settlements nearly two decades ago, 2022, 2023, and 2024 have marked the most extensive set of billion-dollar class action settlements in the history of the American court system.

In today’s video blog, Duane Morris partner Jerry Maatman discusses how the aggregate monetary value of class action settlements continued to reach incredible highs in 2024, as plaintiffs’ lawyers and government enforcement agencies monetarized their claims into enormous settlement values. In 2024, the plaintiffs’ bar was successful in converting case filings into significant settlement numbers again. Tune in below to hear all about this or read the blog post blow for more information.

In 2024, settlements reached the $40 billion mark for the third year in a row. The cumulative value of the highest ten settlements across all substantive areas of class action litigation totaled $42 billion. That number is the third highest value we have tallied in the last two decades, trailing only the settlement numbers from 2023 and 2022. In 2023 settlements totaled $51.4 billion, and in 2022, settlements totaled $66.0 billion. Combined, the past three years of $159.4 billion reflect use of the class action mechanism to redistribute wealth at an unprecedented level.

These gargantuan settlements yielded extraordinary and record-setting attorneys’ fee awards. On April 23, 2024, U.S. District Judge Richard Gergel of the U.S. District Court for the District of South Carolina awarded more than $956 million in attorneys’ fees to plaintiffs’ lawyers who secured two settlements worth more than $11 billion with four manufacturers of “forever chemicals” that allegedly polluted drinking water in the United States with per- and polyfluoroalkyl substances, or PFAS. Numbers like this explain at least in part why we are continuing to see the plaintiffs’ class action bar grow in numbers and expand its reach as lawyers clamor to identify the next “tort of the day.”

On an aggregate basis, across all areas of litigation, class actions and government enforcement lawsuits garnered more than $42 billion in settlements in 2024. The largest 20 settlements during 2024 are in the chart below. The total for the top 20 settlements in 2024 was $34.6 billion.

Such numbers fall slightly short only of the numbers we tallied in 2022 and 2023. The value of class actions and government enforcement settlements in 2022 topped $66 billion, and the value in 2023 topped $51 billion. Combined, the three-year settlement total eclipses any other three-year period in the history of American jurisprudence.

As to settlements of one billion dollars or more, in 2024, parties agreed to resolve ten class actions for $1 billion or more. These settlements include the following:

The number of billion dollar settlements in 2024 surpassed the number in 2023, falling short only of the number of billion-dollar settlements in 2022. In 2023, parties resolved nine class actions for $1 billion or more. In 2022, parties resolved 15 class actions for $1 billion or more in settlement dollars. Together, corporations have seen 34 settlements of one billion dollars or more in three years. This string of settlements marks the most extensive set of billion-dollar class action settlements in the history of the American court system.

In 2024, rich settlement numbers spanned nearly every area of class action litigation. The following shows the cumulative value of the ten highest settlements in each key area of class action litigation:

The value of the ten highest settlements in the privacy, data breach, and labor areas increased in 2024, reflecting the growth of class action litigation in these areas, as they account for a higher percentage of the overall total. By contrast, the value of the ten highest settlements in antitrust, discrimination, civil rights, and FCRA class actions decreased to less than 50% of their 2023 totals.

Particularly when viewed in conjunction with the settlement values observed in 2022 and 2023, the settlement numbers in 2024 confirm that we have entered and are operating in a new era of enhanced class action risks. Corporations should expect these numbers to continue to incentivize the plaintiffs’ class action bar to be equally if not more aggressive with their case filings and settlement positions in 2025.

While settlements have been particularly robust over the past three years, the number of class action filings have been relatively stable and are down slightly overall in 2024.

There has been a steady increase in areas such as data privacy, with heightened concerns about cybersecurity and consumer data protection driving lawsuits. Additionally, the COVID-19 pandemic sparked a rise in class actions related to health and safety protocols, insurance claims, and employee rights. Overall, the legal landscape has grown more complex, with plaintiffs and defendants navigating a more dynamic and often contentious environment, and often leading to massive settlement opportunities for plaintiffs.

Duane Morris Takeaway: Corporations should expect such numbers to incentivize the plaintiffs’ class action bar to be equally if not more aggressive with their case filings and settlement positions in 2025.