Gary E. Mason

On February 9, 2010, Google built a social network called Buzz into Gmail. Eva Hibnick, a 24-year-old second-year student at Harvard Law School, signed into her email that day without realizing that she had also signed up for the new network. She found that she was “following,” and being “followed” by, people Google had chosen for her. Some of them were people she had not spoken to in months.

A classmate, Benjamin Osborn, a third-year student and research assistant to Professor William Rubenstein, suggested a lawsuit, and Hibnick agreed to bring it. Osborn consulted Rubenstein, who specializes in class-action law, and Rubenstein contacted Gary E. Mason, a class-action lawyer in Washington. Mason took charge of the case; Rubenstein and Osborn stayed on as consultants. “The most important thing about this case to me is the initiative my students have shown,” Rubenstein told The Harvard Crimson.

On February 17, eight days after the launch, law firms in Washington and San Francisco filed Hibnick’s class-action complaint in federal court in San Jose. “I feel like they did something wrong,” Hibnick told ABC News. “They opted me into this social network and I didn’t want it.” The complaint carried her name. “I feel really deeply about this issue and that’s why I decided to step forward,” she said.

Mason spoke to ABC News that week. “We take issue with the way it was launched,” he said. Google had already begun changing Buzz. “It was a violation originally,” Mason said, and he tied the claim to the privacy statutes the complaint invoked: “This is not the kind of behavior that people expect from electronic media and that’s why these laws are in place.” He also described the relief he was after. “It’s not so much that we’re expecting to get millions of people hundreds of dollars,” he said. What he wanted, he said, was “a commitment from Google that they’re not going to do this again the next time they launch a product.”

Fifteen months later, Judge James Ware of the Northern District of California gave final approval to the settlement Mason had negotiated and confirmed him as lead class counsel. The settlement created an $8.5 million fund, committed Google to educate the public about the privacy aspects of Buzz, and required Google to email notice of the settlement to Gmail users in the United States. From the fund, Ware approved $6,065,000 for fourteen organizations working on internet privacy, and the payments began that year.

Follower Lists Built From the Inbox

Buzz let Gmail users post updates and follow one another, and Google filled each user’s network from the inbox. In the motion Mason later signed asking Judge Ware to approve the settlement, class counsel described the problem: Buzz suggested whom a user should follow and be followed by “based in part upon who they email and chat with the most,” those lists could be viewed publicly through the user’s Google profile, and public knowledge of how the lists were built “appeared to divulge a Gmail user’s most frequent email contacts without sufficient consent.”

The consolidated complaint Mason filed in July 2010 alleged that Gmail had 31.2 million users in the United States in January 2009 and that Google added Buzz to most or all of those accounts. At launch, it alleged, users who opened their mail were offered two options—set up Buzz or continue to the inbox—and Google activated Buzz whichever option they chose. The complaint described a woman whose contact information was made available to her abusive ex-boyfriend because Buzz automatically selected him as one of her followers, and a mother who discovered that Buzz had shared messages posted by her 9-year-old daughter with an anonymous stranger who had adopted a sexually explicit username. It also alleged that Buzz made public the follower and following lists of Andrew McLaughlin, the Obama administration’s deputy chief technology officer for internet policy, and that the lists revealed his continuing close connections with many higher-ups at Google.

Google changed Buzz within days. Todd Jackson, Google’s product manager for Gmail and Buzz, apologized on the official Gmail blog. “We’re very sorry for the concern we’ve caused and have been working hard ever since to improve things based on your feedback,” he wrote. Google made the option to hide a user’s followers more visible, added links for blocking people, and replaced automatic following with automatic suggestions. Mason said in February that those changes, including the end of auto-follow, still left the program as a whole opt-out, which he called “an unfair and generally deceptive practice.” In April Google added a confirmation page that displayed each user’s Buzz choices.

Four Counts Against Google and the Damages Question

The consolidated complaint pleaded four counts: violations of the Stored Communications Act, the federal Wiretap Act, and the Computer Fraud and Abuse Act, and a California common-law claim for public disclosure. It asked for an injunction barring Google from operating Buzz “without appropriate safeguards,” along with actual damages, statutory damages, and Google’s profits.

Google’s lawyers previewed the motion to dismiss the company intended to file, and class counsel debated the legal issues with them for several hours. In the motion for preliminary approval, filed over his signature on September 3, 2010, Mason identified the questions that would have required “novel and extensive litigation”: whether the information at issue was protected by the Stored Communications Act, whether anything had been “intercepted” within the meaning of the Wiretap Act, and whether Google’s use of its own computer servers could create liability under the Computer Fraud and Abuse Act. The claims rested, the motion said, “primarily upon federal privacy statutes that have not been specifically applied by courts to internet-based social networks.”

Damages were the second problem. “Of all consumer feedback sent to Google about Buzz,” the motion told the court, “Class Counsel could identify no class members who allege that they suffered out-of-pocket damages.” The harms the complaint described—an abusive ex-boyfriend added to a woman’s network, a child’s messages shown to a stranger, a public official’s contacts put on display—produced no bill or bank charge that a claims administrator could reimburse one claimant at a time. Mason later said that the $9.5 million Facebook had paid to settle a similar privacy case served as a benchmark in the negotiations with Google; he would not disclose how much the plaintiffs had sought.

The settlement resolved the claims without a ruling on them. “Google denies [opt-out] was a privacy breach. There isn’t a legal resolution to that,” Mason told The Harvard Crimson after the settlement was filed. “But it’s fair to say it was a strong enough of a claim that they were willing to settle it.”

Fourteen Hours Before Judge Fern Smith

Mason and his co-counsel interviewed class members and the class representatives, studied how Buzz worked, and followed the changes Google kept making to it. On April 21, 2010, at the San Francisco office of Google’s counsel, Google’s vice president for product management, whose responsibilities included the Buzz launch, spent several hours with them. He explained how Buzz worked and how it had been launched, and he answered questions from class counsel in the room and on the telephone.

Class counsel then gave Google and the mediator a 73-page mediation statement, with exhibits, that included a 31-page legal brief. On June 2, 2010, the parties met at the JAMS office in San Francisco before Fern Smith, a retired federal district judge with extensive class-action experience. The session lasted about fourteen hours and ended with a term sheet, which became the settlement agreement. In confirmatory discovery, Google made available all the consumer feedback it had received about Buzz from users throughout the world, and class counsel reviewed those thousands of pages.

Judge Ware’s Appointment Under Rule 23(g)

Other Gmail users filed their own complaints in March, April, May, and June 2010. On June 30, 2010, Judge Ware consolidated three of the actions under the caption In re Google Buzz Privacy Litigation, finding that they raised “virtually identical factual and legal issues” about a service alleged to have made Gmail users’ private data public without authorization. Applying the factors in Federal Rule of Civil Procedure 23(g), he appointed Mason, of Mason LLP, interim lead class counsel and Michael Ram, of Ram & Olson LLP, interim liaison counsel. Mason filed the consolidated amended complaint in July.

Hibnick later withdrew her name from the lawsuit for personal reasons, Mason said. Seven Gmail users—Andrew Souvalian, Katherine C. Wagner, Mark Neyer, Barry Feldman, John H. Case, Lauren Maytin, and Rochelle Williams—became the class representatives for a class defined as all persons in the United States who were Gmail users presented with the opportunity to use Buzz through the date of notice.

An $8.5 Million Fund for Internet-Privacy Work

The parties filed the settlement on September 3, 2010. Google agreed to pay $8.5 million into a common fund, and the fund’s distributions would be paid “in its entirety” to cy pres recipients, which the agreement limited to existing organizations focused on internet privacy policy or privacy education. The agreement recognized the changes Google had made to Buzz since the suits began and required Google to undertake wider public education about the privacy aspects of Buzz. Google would consider the plaintiffs’ recommendations on the content, choose the final content itself, and report to class counsel within 90 days of final judgment on what it had done.

The settlement used Gmail itself for notice. It provided for a neutral settlement website, a joint announcement of the settlement, and an individual email, sent by Google to every Gmail user it could identify through reasonable efforts as living in the United States, with a link to the website. Class members released claims arising from the facts alleged in the consolidated complaint.

October 4, 2010: Cy Pres as the Main Relief

Judge Ware heard the motion for preliminary approval in San Jose on October 4, 2010. Mason appeared for the plaintiffs with Michael Ram and Rubenstein, and Susan Fahringer of Perkins Coie appeared for Google. “I’m going to be sharing the argument this morning with Professor Rubenstein,” Mason told the court. He gave his co-counsel the questions of fairness and class certification and kept the notice plan and the proposed order for himself.

Ware started with the form of the class. “I was thinking this was more appropriately a (b)(2) class,” he said—the kind of class that seeks relief applying to everyone at once and ordinarily gives members no right to leave. Class counsel had proposed a (b)(3) class, and Ware took their reason to be the right of class members to exclude themselves: “The primary reason, then, as I hear it, for certifying it under (b)(3) is to provide for opt outs.” Then he turned to the money. “Cy pres is what I used to understand to be as sort of the left over,” he said. “This is like the main part.”

Rubenstein answered that the fund was small for a class that size and that no class member had described actual damages, which left statutory damages, a remedy meant to deter and to make suits like this one possible. “Statutory damages are exemplary to encourage people to pursue litigation and the class action has served that function here,” he said. Giving the money to internet-privacy organizations, he argued, would be a better use of it than spreading it thinly among class members. “I actually think that’s well thought out,” Ware said.

Fahringer told the court that Google did not “necessarily agree with the factual recitations and the allegations made by the plaintiffs” but supported the motion. “We do believe that the settlement should be preliminarily approved today,” she said. Mason then took up notice. “It’s basically e-mail notification to upwards of millions, tens of millions of individuals,” he said, and he assured Ware that the notice covered the litigation history and the terms of the settlement agreement. “Very well,” Ware said. “The Court will issue an order preliminarily approving this settlement.”

Nominations, Budgets, and Fourteen Awards

Judge Ware held the final approval hearing on February 7, 2011. Rubenstein told him that of some 37 million class members, 570 had opted out and 47 had objected. On February 16 Ware set the rules for choosing who would receive the money. Nominations were due to class counsel by March 14, and class counsel had to submit them to the court for approval by March 28. Each nominee had to show an established program “currently undertaking policy or education efforts directed specifically at Internet privacy,” state how long the program had done that work and how it would benefit the class, disclose its organizational and program budgets, and list any money it had received from Google in 2010 outside the settlement. Judge Ware reserved the power to designate recipients himself. Seventy-seven organizations applied.

Class counsel nominated twelve organizations for a total of $6,065,000. In the final order, entered May 31, 2011, and amended June 2, Judge Ware approved that total for fourteen recipients, adding the Electronic Privacy Information Center, which he called “a well-established and respected organization within the field of internet privacy,” and the Markkula Center for Applied Ethics at Santa Clara University. The awards ranged from $1,000,000 for the Electronic Frontier Foundation and $700,000 for the American Civil Liberties Union to $50,000 for Youth Radio. University centers at Harvard, Stanford, Berkeley, Carnegie Mellon, and Indiana were on the list, along with the Center for Democracy & Technology, the Brookings Institution, and the YMCA of Greater Long Beach.

Judge Ware found that the class faced significant risks if the litigation continued, that any greater recovery would come only after considerable delay, and that the settlement terms provided “substantial and meaningful benefits to the Settlement Class.” He found the negotiations “extensive, arms-length, under the direction of the Hon. Fern Smith, and without any collusion,” noted the small number of opt-outs and objections, and held that the notice had been reasonably calculated to tell class members about the case, the settlement terms, and their right to object or exclude themselves. He awarded each class representative $2,500.

Payments began in 2011. Google transferred $1 million to the Electronic Frontier Foundation that year, and the Center for Democracy & Technology received $500,000 from the award; Stanford’s Center for Internet and Society received $500,000 as well. Indiana University’s Center for Applied Cybersecurity Research, awarded $300,000, said it would put the money toward continuing production of Security Matters, its video and radio series on online privacy and security for consumers.

The FTC Charges and the End of Buzz

Between the hearing and the final order, on March 30, 2011, the Federal Trade Commission charged Google with deceptive privacy practices in the Buzz launch. The Commission alleged that Google had led Gmail users to believe they could choose whether to join the network while giving them ineffective ways to decline or leave it, and that “Google received thousands of complaints from consumers who were concerned about public disclosure of their email contacts which included, in some cases, ex-spouses, patients, students, employers, or competitors.” The proposed consent order would bar Google from misrepresenting how it protected the privacy and confidentiality of users’ information and would require a comprehensive privacy program and independent audits every two years for the next 20 years. The FTC said it was the first time one of its settlement orders had required a company to implement a comprehensive privacy program. The Commission gave the settlement final approval by a 4–0 vote in October 2011.

On October 14, 2011, Bradley Horowitz, Google’s vice president of product, announced: “In a few weeks we’ll shut down Google Buzz and the Buzz API, and focus instead on Google+.” Users could still view their old posts on their Google profiles and download them.

Building Products, Veterans’ Records, and Issue Classes

Mason came to the Buzz case after two decades of class-action work. He graduated magna cum laude from Brown University, was an editor of Law & Contemporary Problems at Duke University School of Law, and clerked for Judge Andrew J. Kleinfeld of the United States District Court in Anchorage, Alaska. He practiced at Skadden Arps, became a partner at Cohen Milstein Sellers & Toll, and was admitted to the District of Columbia Bar in 1989. Much of his consumer work has involved building products in people’s homes—Chinese drywall, fire-retardant plywood, polybutylene pipe, high-temperature plastic venting, hardboard siding—along with pharmaceuticals, consumer electronics, and automobiles.

One of his Chinese-drywall cases was part of the multidistrict litigation that Judge Eldon E. Fallon managed in New Orleans. Owners of residences at Villa Lago at Renaissance Commons, in Boynton Beach, Florida, alleged that RCR Holdings II had sold them homes built with Chinese drywall and had failed to disclose the unsafe materials used in construction. On November 16, 2012, Fallon appointed Mason and Daniel R. Bryson of Whitfield Bryson & Mason, with Joel R. Rhine and Adam Linkhorst, as settlement class counsel and approved the class settlement with RCR as “fair, reasonable and adequate.” No owner had asked to be excluded. The plan for dividing the settlement fund, to be proposed at the end of the case, could pay for remediation, cash compensation, or both.

His data-breach work before Buzz included the class litigation that followed a May 2006 burglary at the home of a Department of Veterans Affairs employee, where burglars took a laptop and an external hard drive; the drive held the names, dates of birth, and Social Security numbers of some 26.5 million veterans and their spouses. That work continued after Buzz. The federal Office of Personnel Management announced in 2015 that intrusions into its systems had compromised the personal information of about 22 million people. In June 2022 Judge Amy Berman Jackson of the federal district court in Washington preliminarily approved a class settlement in the litigation that followed, appointing Daniel C. Girard lead class counsel and Mason liaison counsel. On October 14, 2022, she gave the $63 million settlement final approval, calling the figure fair. The class covered people who had spent money or time on credit monitoring, credit freezes, or identity theft after the breaches, and each valid claim would be paid at least $700 and as much as $10,000.

In a March 19, 2015, letter to the federal judiciary’s Committee on Rules of Practice and Procedure, written from Whitfield Bryson & Mason LLP, Mason drew on what he called his “25 years of experience practicing law exclusively in the area of class actions” and on his service as a past co-chair of the American Association for Justice’s Class Action Litigation Group. He asked the committee to amend Rule 23(c)(4) to make clear that a court may certify a class on particular issues even when the action as a whole could not be certified. “By enabling courts to certify classes with respect to a particular issue, Rule 23(c)(4) is an especially useful tool to effectively manage class actions,” he wrote.

He set the Fifth Circuit’s 1996 decision in Castano v. American Tobacco Co. against the Second Circuit’s 2006 decision in In re Nassau County Strip Search Cases and objected that district courts continued to cite Castano as a reason to consider issue certification separately from certification of the entire action. For support he cited Helmer v. Goodyear Tire & Rubber Co., a 2014 decision certifying a liability-only class in a product-defect case. Common issues, he wrote, “can resolve the entirety of the litigation ‘in one fell swoop.’”