Features
Privacy settlements: the two tracks, and how to read them
Privacy settlements: the headline number is the least informative part. Two tracks, what a resolution establishes, and how to read the operative document.
The number in the headline is the least informative part of a privacy settlement. It is the figure that travels, it is the figure people remember, and it tells you almost nothing about what was alleged, what was established, or what will change.
This page is about the shape of these matters rather than any particular one. How an enforcement action gets from a complaint to a resolution, what a settlement does and does not establish, and how to read the documents rather than the coverage.
What to take away
- Privacy matters reach a resolution along two quite different routes, and reporting often merges them.
- Read the actual document before concluding anything.
- A monetary figure in one of these matters can be several different things, and they are not comparable.
- Authorities usually publish several documents about the same matter, and they are not interchangeable.
Two tracks that get confused
Privacy matters reach a resolution along two quite different routes, and reporting often merges them.
Regulatory enforcement action is brought by a public authority applying the rules it administers, starting with a complaint, referral, breach notification, or the authority's own initiative.
The authority investigates using its own powers, and the outcome is administrative: an order, undertaking, decision, or sometimes a monetary penalty.
The authority is the body that administers the rules where the matter is brought: in the United States, the Federal Trade Commission under Section 5 of the FTC Act, a state attorney general, or a state privacy regulator enforcing a law such as the California Consumer Privacy Act; in the United Kingdom, the Information Commissioner's Office under the UK GDPR; elsewhere in Europe, a national data protection authority under the GDPR. The labels differ, but the role is the same.
Private litigation is brought by people or organizations claiming harm. It starts with a filed claim, proceeds through the ordinary stages of civil procedure in that court system, and ends in a judgment or, far more often, a negotiated settlement approved by the court where approval is required.
The two can run in parallel over the same conduct and produce different outcomes, because they apply different standards and answer different questions. As a general matter a regulator's conclusion does not resolve a private claim, and a private settlement does not bind a regulator, though exactly how the two interact depends on the system you are in.
The stages, and what each one actually means
| Stage | What has happened | What has been established |
|---|---|---|
| Complaint or filing | Someone has made an allegation | Nothing |
| Investigation or discovery | Evidence is being gathered, often confidentially | Nothing publicly |
| Formal notice or charge | The authority or claimant has set out its case | An allegation, now specific |
| Response | The organization contests, explains or negotiates | Still contested |
| Negotiation | Both sides are trading certainty for concession | Nothing about the merits |
| Settlement or consent order | Terms agreed, often subject to approval | What the document says, and no more |
| Compliance period | Obligations run, sometimes with reporting or an auditor | Whether terms are being met |
The column on the right is the useful one. Coverage tends to describe a matter at stage three as though it were at stage six, and a matter at stage six as though a court had found the facts.
What a settlement establishes
Read the actual document before concluding anything. Many settlements are agreed expressly without any admission of liability, and where that is the case the document says so in terms. A settlement in that form resolves a dispute; it is not a finding that the allegations were true, and it does not carry the precedential weight of a contested judgment.
That cuts both ways. Settling is not proof of wrongdoing: organizations settle to end cost, distraction and uncertainty, and a well-advised organization may settle a case it believes it would win. Equally, "no admission of liability" is not proof of innocence; it is a term of the deal.
What a settlement does establish is obligation. If the document requires something, that requirement is real, enforceable on its own terms, and usually the part with the longest tail.
Why the money is the least interesting number
A monetary figure in one of these matters can be several different things, and they are not comparable.
- A civil penalty or fine paid to the authority, which goes to the public purse rather than to the people affected.
- Disgorgement or redress, returning money the organization is said to have obtained improperly.
- Costs and attorney fees, which in private litigation generally come out of any settlement fund rather than on top of it.
Even within one category the figure resists interpretation. A fund split among a very large group yields a small individual amount, and what people receive depends on how many claim.
A penalty says more about the ceiling in the relevant regime than about the severity of the conduct. A figure in one country's currency and legal system is not a scale you can apply to another's.
The consequential terms are non-monetary and rarely in the headline. They cover what must be deleted or stopped, built, assessed or audited, reported and to whom, and what the organization must tell affected people.
They also cover how long all of it runs, and shape behavior long after the payment clears.
How to read a regulator's own announcement
Authorities usually publish several documents about the same matter, and they are not interchangeable.
The press release is a summary written for a general audience. It is accurate but compressed, and compression is where nuance about what was alleged versus what was found goes missing.
The complaint, notice or statement of objections sets out the case. It is a description of allegations, and the word "alleged" in it is doing real work. It is not a finding.
The order, decision or settlement agreement is the operative document. It contains the terms, the scope, the duration, and any statement about admissions. If you only read one, read this.
Where published, a decision with reasons is the most valuable of all. It explains how the authority reached its conclusion, the only part that tells you how similar situations might be handled.
Names differ between systems. A general explanation of the consent decree from the Cornell Legal Information Institute shows how much one label carries, and how little it settles about the merits.
Check the date, the jurisdiction and whether the matter is final. Decisions can be appealed, stayed, varied or set aside, and an announcement is a snapshot of a moment. A matter under appeal is not settled law, and a summary written shortly after an announcement will not reflect what happened afterwards.
If you have received a class notice
A notice about a settlement is itself a document with legal effect, and it is the authority on your situation. News coverage and social media summaries are not.
The notice will state who is covered, what the settlement provides, what your options are and by when. Commonly those options include making a claim, excluding yourself, objecting, or doing nothing: each with different consequences, including on your ability to bring your own claim later. The deadlines are real and are rarely extended.
Two practical cautions. Read the notice and the official settlement website, not a third-party summary. Be skeptical of anyone who contacts you offering to file on your behalf for a share.
If the amount at stake matters, or you consider excluding yourself, decide with a qualified adviser in your jurisdiction, not a general article.
Criteria for judging one of these outcomes
If you want to assess whether a resolution amounted to anything, these are the questions that separate substance from announcement.
- Scopewhich conduct is covered, and which allegations were dropped or left out?
- Conduct termswhat must the organization stop, delete, build or change?
- Verificationis compliance assessed by anyone independent, and is the result published?
- Durationhow long do the obligations run, and what happens at the end?
- Reachdoes it apply to one product, one market, or the organization as a whole?
- Affected peopledo they get notice, a remedy, or anything at all?
- Finalityis it subject to approval or appeal, and has that concluded?
- Repeat exposurewhat happens if the same conduct recurs during the compliance period?
A resolution that scores well on the money and poorly on those eight is a payment. One that scores well on those eight changes how something works, whatever the number attached to it.
Rules, procedures and remedies in this area vary by jurisdiction and change, and none of it is legal advice. Which body could bring a matter depends on where you are: a trade commission, a data protection authority or an attorney general, applying the statute that gives it its powers.
What a service is permitted to do with your material in the first place is in the agreement you accepted; what it must change after a resolution is measured by the eight criteria above. Where the information concerns a young person, an extra layer applies — the Children's Online Privacy Protection Act in the United States, and the GDPR's rules on children's consent in Europe.
Common questions
Does settling mean the allegations were true?
No. Many resolutions are agreed expressly without any admission, and organizations settle matters they believe they would win, to end cost and uncertainty. The reverse reading is equally wrong: a no-admission clause is a term of the deal, not a finding of innocence.
Why is the headline number so uninformative?
Because it can be a penalty, a fund, disgorgement or costs, and those are not comparable quantities. A fund divided among a very large group produces a small individual amount, and a penalty says more about the ceiling in the applicable regime than about the conduct.
Which document should I read if I only read one?
The order, decision or settlement agreement. The press release is compressed and the complaint or notice describes allegations rather than findings.
I got a notice about one of these. What should I do first?
Read the notice and the official settlement site rather than a summary, note every deadline, and understand what doing nothing means in that particular arrangement, because it is frequently the option that gives up the most.
Is a resolution final once announced?
Not necessarily. Decisions can be appealed, stayed, varied or set aside, and an announcement is a snapshot of a moment rather than a settled position.
