Gary M. Klinger

All Web Leads claimed permission to call about two million people on their cell phones from a line of fine print beneath the Submit button of a health-insurance quote form. The line told visitors to www.affordable-health-insurance-plans.org that by submitting the form they agreed to be contacted “by up to eight insurance companies or their agents or partner companies” through prerecorded or autodialed calls. The company conceded in its answer that the consent language sat below the button. Alexander Young, a website designer retained by the consumers who sued, tested the page in emulated browsers and concluded that typical users do not scroll below a Submit button. The company replied that some visitors might have had screens large enough to display the whole page, disclosure included, and that research showed consumers do scroll.

Gary M. Klinger, then a partner at the Chicago firm Kozonis & Klinger, represented the consumers with Lieff Cabraser Heimann & Bernstein. On June 25, 2018, U.S. District Judge Harry D. Leinenweber of the Northern District of Illinois refused to exclude Young’s testimony, certified a class of everyone who had submitted the form and then received an autodialed or prerecorded call on a cell phone, and found Lieff Cabraser and Klinger’s firm adequate to represent it. He held that whether the disclosure was clear and conspicuous depended on what a reasonable consumer would see, a question that could be answered once for what he called “two million basically identical lawsuits.” All Web Leads settled the next year for $6.5 million, a sum the parties told the court it could not pay at once, and the claims administrator issued distributions to claimants from October 2019 through December 2025.

The Quote Form and the Calls That Followed

All Web Leads, a Delaware corporation based in Austin, Texas, generated leads for insurance agents. Its site greeted visitors with “Compare Affordable Health Insurance Plans Right Now!” and, the plaintiffs alleged, was designed to resemble the government’s Healthcare.gov marketplace. A visitor entered a zip code, clicked “Start Now,” and moved to a quote form headed “The Fastest Way to Get Free Health Insurance Quotes!” There the visitor filled in a name, address, and phone number and clicked Submit. No quotes followed, the plaintiffs alleged. All Web Leads admitted that people who completed the form were then contacted at the number they had given, by its own representatives or by its customers. The plaintiffs described the call: a representative of All Web Leads dialed the number the visitor had just typed, using an autodialer, asked questions to learn whether the person wanted to buy insurance, and tried to transfer the call to an insurance agent. By the plaintiffs’ count, the company placed tens of thousands of autodialed telemarketing calls a day. Each call made without the required consent carried statutory damages of $500, and up to $1,500 if the violation was knowing or willful.

William Sullivan filed the case on February 21, 2017. He had gone to the site on January 13, looking for quotes on plans that complied with the Affordable Care Act, entered his zip code, and filled in the form, including a “Day phone” number, before clicking Submit. The consent language sat in small print at the bottom of the page, and he did not see it. When All Web Leads called, he heard a pause and a click before a representative came on the line, and he was transferred to an agent who tried to sell him a limited-benefit plan instead. Sullivan ended the call when it became clear that the agent would not let him compare plans that met the law’s requirements. Similar calls followed over the next several days. In March 2017, the company moved to dismiss and to strike the class allegations. It argued that its consent language, together with the click on Submit, gave it prior express written consent, and that its calls fell under the Federal Communications Commission’s health care rule, which requires only prior express consent, rather than written consent, for certain calls delivering health-care messages.

Judge Leinenweber denied both motions on June 1, 2017. Because All Web Leads was not a health-care provider, had no treatment relationship with the people it called, and placed calls that promoted insurance products, the health care rule did not reach those calls. The calls were telemarketing, which required prior express written consent and a clear and conspicuous disclosure. Taking Sullivan’s account as true at that stage, the judge described a man who clicked the Submit button at the end of the form without scrolling further down the page to read All Web Leads’ “Lilliputian consent language.” Applying the contract-law principles courts use for online agreements, he held that the complaint plausibly alleged a lack of reasonable notice: a user could reasonably assume that clicking Submit only authorized sending personal information to obtain quotes. “By clicking ‘Submit,’ users would likely expect quotes to be displayed on an ensuing webpage once their information was processed,” he wrote, all the more because the site promised speed. Consent was an affirmative defense on which All Web Leads bore the burden of proof, and because every visitor had gone through the same procedure, its validity could be decided for all of them together. All Web Leads also argued that Sullivan’s allegation that he had been tricked turned the case into a fraud claim requiring a mini-trial for each visitor. The judge rejected it: “Simply put, this argument strains credulity.”

On July 25, 2017, after Sullivan withdrew and Judge Leinenweber allowed new named plaintiffs to take his place, Klinger signed the amended complaint filed for John Karpilovsky and Jimmie Criollo Jr., with Jonathan D. Selbin and Daniel M. Hutchinson of Lieff Cabraser.

Karpilovsky, of Wheeling, Illinois, visited the site on June 23, 2017, entered his cell number, and clicked Submit “in anticipation of being directed to health insurance quotes.” He alleged that a call came shortly afterward, with “an immediate pause on the other end, followed by a distinct ‘clicking’ noise before the connection with the representative was made.” The representative asked whether he was interested in buying insurance and tried to transfer him to an agent, and more calls followed. Criollo, of San Antonio, had filled out the same form around January 2017; nearly seven months later, he alleged, the autodialed calls had not stopped. Both men alleged that they never knew submitting the form would bring autodialed calls to their cell phones, and that the disclosure was “inconspicuously hidden in tiny white font at the bottom of the webpage beneath the ‘Submit’ button.” The page had no box to check and no “I Agree” button, and, they alleged, the Terms of Use linked from the homepage said nothing about an autodialer.

All Web Leads answered on August 8, 2017. It admitted that Karpilovsky had visited the site on June 23, typed in his name, address, and cell phone number, and clicked Submit, and that it had called him. It admitted that the consent language appeared on the quote page below the Submit button. It would not admit that its calls were autodialed, a term it said the TCPA does not define, and it pleaded consent as a defense: the plaintiffs, it said, had given prior express written consent, or prior express consent to calls delivering a health-care message. From then on, the fight was over whether a person filling out the form would ever see the disclosure.

Call Data, Website Files, and a Designer’s Browser Tests

In a sworn declaration filed in June 2019, Klinger described his own work on the case as “developing case strategy, discovery work, taking depositions, review and analysis of data and documents,” along with the mediation and settlement negotiations. In September 2017, All Web Leads subpoenaed Sullivan, the former plaintiff; the plaintiffs moved to quash, and the court granted the motion. The plaintiffs filed two motions to compel in October and November 2017, and the court granted both. Over several months, All Web Leads produced more than 9,000 pages of documents and answered the plaintiffs’ interrogatories. The production included the company’s call list, giving the cell phone number, name, and email address of each person it had called, and call data drawn from its databases for every person on that list. The plaintiffs deposed two corporate representatives whom All Web Leads designated under Rule 30(b)(6). All Web Leads, in turn, deposed Karpilovsky and Criollo.

The plaintiffs retained two experts, and disclosed their reports on December 1, 2017. Jeffrey Hansen analyzed the call data. Alexander Young, a co-founder of the web-design firm ePageCity who had written more than 3,000 webpages, analyzed the website files. Young concluded that the site had not changed in any material way during the class period, that every user went through the same consent procedure, that typical users do not scroll below a Submit button, and that the page did not follow industry best practices for giving users notice of terms. All Web Leads never challenged the first of those conclusions; Leirer, one of its designated witnesses, had agreed under oath that the site had not materially changed since 2013. Young tested the page with the Browserstack emulator, across browsers that accounted for 93 to 94 percent of web visits at the start and the end of the class period, and the screenshots came back substantially the same. At his deposition he testified that a typical user of a generic website will “stop scrolling” once she sees the Submit button. Good practice, in his account, put the terms where a user would see them before reaching the Submit button, or required the user to check a box acknowledging them first. Using All Web Leads’ own call data, the plaintiffs identified the roughly two million people who made up the proposed class.

Consent Measured Against the Reasonable Consumer

The plaintiffs moved for class certification on January 12, 2018. All Web Leads fought certification on consent; in the judge’s words, the company “mainly wields a single weapon: consent.” Autodialed telemarketing calls to cell phones are lawful under the TCPA with prior express written consent, and the company argued that some class members must have seen the disclosure and agreed, which would force the court to ask, person by person, what each visitor saw and intended. Some visitors might have used screens large enough to show the disclosure without scrolling, it argued; consumers do scroll; and 2.3 percent of the country’s population was visually impaired, so screen readers might have surfaced the fine print. From those premises it built its other objections: a class that included people who had consented could not be ascertained, those people suffered no injury and lacked standing, and the named plaintiffs faced defenses peculiar to themselves. The judge summed up the approach: “AWL swings its consent defense as a cudgel against nearly all of the Rule 23 requirements.”

The company also moved to exclude Young, arguing that his testing could not cover every combination of browser and device and that his best-practices opinion rested on no standard drawn from the TCPA. Young had acknowledged at his deposition that he knew of no TCPA-specific consent standard and had run no empirical test of how visitors to the All Web Leads site actually behaved. Asked why he had chosen two particular websites as examples of good practice, he said the choice made no difference because “[t]hey all have the same story.” All Web Leads retained no expert of its own.

Judge Leinenweber answered with the regulation. TCPA disclosures must be “clear and conspicuous,” he wrote, and “[t]hat standard is not a user-dependent inquiry, but rather asks whether a notice would be ‘apparent to the reasonable consumer.’” Screen sizes and screen readers did nothing for All Web Leads’ position: “AWL can spin its wheels about screen sizes and hearing aids all it likes, but those unsupported suppositions do not help their class certification rejoinder one whit.” Nor had the company offered evidence that any class member actually consented, though it had known the court’s view since June 2017 and, he wrote, “took no steps to shore up its argument.” “Rather than produce any specific evidence, AWL serves up a banquet of lawyerly free association,” the judge wrote. The claim about large screens came without evidence, and the proof that consumers scroll consisted of two online articles. The company was trying, he wrote, “to fashion an escape hatch for itself from little more than legal brainstorming. That will not do.” When a defendant offers only vague assertions about consent, he held, individual consent questions do not predominate. Whether the disclosure was clear and conspicuous was a question common to every class member, and the claims of the whole class could rise or fall on the answer.

He refused to exclude Young, finding that hands-on testing by personal observation could be a reasonable methodology under the liberal standard for admitting expert testimony. He wrote: “Personal observation of the kind Young made here is often deemed to be the most reliable source of information.” The complaint that Young could not have tested every combination of browser and device went to weight, not reliability. If All Web Leads doubted Young’s account of best practices, the judge added, it could have produced a competing expert, and it had not. He found the named plaintiffs typical, because typicality is measured by the defendant’s conduct rather than by defenses it might raise against particular class members, and adequate, because Criollo’s deposition showed he was seeking damages and because named plaintiffs need not understand the legal intricacies that are counsel’s job. All Web Leads had cited Criollo’s deposition as proof that he was not seeking damages and ignored the very next lines of the transcript, in which he confirmed that he was. The judge wrote: “That is what adequate counsel is for. Criollo will not be faulted nor the proposed class penalized because the named Plaintiff does not happen to have a law degree.”

All Web Leads did not contest the plaintiffs’ showing that Lieff Cabraser and Klinger’s firm were experienced class-action practitioners who had litigated dozens of TCPA cases and had been appointed to lead many such cases in the district, and the court found them capable; the two firms served as court-appointed class counsel, and Karpilovsky and Criollo became the class representatives. The class, defined by the website, the submission, and the calls, could be identified from All Web Leads’ records. Trying those claims together in one representative action, the judge wrote, would be an efficient use of judicial and party resources.

Financial Statements, Loan Documents, and a Mediator’s Proposal

Fifteen days after certification, All Web Leads retained new counsel. The new lawyers opposed the plaintiffs’ plan for notifying the class and moved to stay the case, pointing to the D.C. Circuit’s 2018 decision in ACA International v. FCC, which had set aside the FCC’s earlier ruling on what counts as an automatic telephone dialing system, and to a promised FCC rulemaking on the same question. Notice went out to the certified class around October 2, 2018, and Judge Leinenweber denied the stay on October 3. Class counsel began preparing for summary judgment and a class trial.

The parties mediated on August 21, 2018, before retired judge Wayne R. Andersen at JAMS in Chicago, without an agreement. All Web Leads had given the plaintiffs informal information about its finances before that session; before the next one, it produced updated financial statements, loan documents, and financial forecasts. At a second day-long session on February 11, 2019, Andersen made a mediator’s proposal, and the parties reached a settlement in principle. They executed the written agreement in April 2019. All Web Leads denied any wrongdoing, including that it had used autodialers or prerecorded messages without prior express written consent, and agreed to settle because of the risks, uncertainties, burden, and expense of continued litigation.

At $500 a call, and assuming a single call to each of the more than 500,000 people in the eventual settlement class, class counsel calculated that All Web Leads would owe more than $250 million, and more than $750 million if a jury found the violations knowing or willful. The company’s financial records showed that $6.5 million was the most it could pay while still covering its operating expenses and its obligations to its lender group. In a June 2019 filing that Klinger signed with Selbin and Hutchinson, class counsel told the court: “Had AWL declared bankruptcy, Plaintiffs, Class Members, and Class Counsel very likely would have received nothing.” They also pointed to a Missouri TCPA case in which a federal judge had cut a jury’s award of $500 a call to $10 a call; All Web Leads’ lead counsel had represented the defendant there.

A $6.5 Million Fund Payable in Installments

On April 9, 2019, Judge Leinenweber preliminarily approved the settlement and found that certification of a limited-fund class under Rule 23(b)(1)(B) was likely appropriate, a class reserved for cases in which the defendant’s money cannot cover all the claims against it and the whole of it goes to the claimants. All Web Leads agreed to pay $6.5 million into a non-reversionary fund. The parties told the court the company did not have the money to pay that sum at once, and the agreement required it to give the court financial information under seal. The agreement spread the payments over six years: $1.5 million at the start, $2 million by January 7, 2021, $1 million by January 9, 2023, and $2 million by January 7, 2025, a schedule that let the company keep paying its operating expenses and its lenders. The settlement class was drawn from the certified class: it included about 534,852 people whom the notice administrator’s records showed had received, opened, and read the notice sent after certification. Every class member who filed a valid claim would receive an equal cash award.

The settlement also reached the company’s conduct. For the life of the agreement, All Web Leads had to keep in place the changes it made after the suit was filed to obtain prior express written consent, first among them a new method of obtaining consent on the website at the center of the case. It also had to provide information for investigating TCPA violations, including call and lead-generation data and sworn written testimony, among other things about the calling platforms it used. In confirmatory discovery in May 2019, it produced call or lead-generation data for nine other companies, which class counsel described as companies that had used leads All Web Leads developed. The agreement allowed those answers to be used only to pursue TCPA claims against the companies All Web Leads identified.

Notice of the settlement went out by email beginning May 1, 2019. The addresses came from All Web Leads’ own records, which the company had collected through the web forms the class members had filled out. Of the 534,852 emails, 49,233 bounced; the administrator traced those people and sent postcards, and notice reached 532,616 class members, 99.58 percent of the class. The notice estimated at least $70 per claim. By the time the plaintiffs moved for final approval, 7,780 valid claims had come in, about 1.45 percent of the class, and the projected payment had grown to about $502 per valid claim. Class counsel set that figure beside other TCPA settlements approved in the same district, where class members would receive $39.66 each in the Capital One litigation and $30 each in a case against Walgreens. Twenty-one people opted out. No class member had objected to the settlement or to the fee request, which sought no more than $2,275,000, 35 percent of the fund, along with $10,000 service awards for Karpilovsky and Criollo.

Klinger’s declaration credited the two named plaintiffs: “In addition to lending their names to this matter, and thus subjecting themselves to public attention, Plaintiffs were actively engaged in this Action.” They had supplied information for the complaint, reviewed the pleadings, kept in regular contact with counsel, and approved the settlement, and, most significantly in his account, they had submitted to extensive discovery, including their depositions. Klinger gave the court his own assessment in his declaration: “In my view, the proposed Settlement is fair and reasonable, and in the best interest of the Class Members.” On August 8, 2019, Judge Leinenweber granted final approval, finding that the agreement came out of arm’s-length negotiations and was fair, reasonable, and adequate to every member of the settlement class.

Defense-Side Training, Then Kozonis & Klinger

Klinger studied economics at the University of Illinois and graduated cum laude from its College of Law in 2010. At the law school he became executive editor of the Illinois Business Law Journal, which published his 2009 article asking whether legislation was the right response to the financial crisis. He spent his first years of practice on complex and class-action litigation at Schiff Hardin, Riley Safer Holmes & Cancila, and Cozen O’Connor, in consumer, insurance, product-liability, and privacy matters, including the defense of large corporate clients. In early 2017 he moved to Kozonis & Klinger and built its class-action practice. In his 2019 declaration, he told the court: “This firm concentrates on class action work on the plaintiff-side.” The firm’s cases, he wrote, involved consumer fraud, breach of contract, and privacy violations. By June 2019 he was co-lead counsel in at least twenty federal TCPA class actions pending around the country.

From Autodialed Calls to Exposed Records

Klinger’s later work centered on personal data that companies collected and then exposed or shared. He practiced next at Mason Lietz & Klinger and then joined Milberg Coleman Bryson Phillips Grossman, where he is a senior partner in Chicago, a practice leader of the firm’s information technology litigation practice group, and co-chair of its mass arbitration practice group. He holds the Certified Information Privacy Professional credential and is studying for an LL.M. in data privacy and cybersecurity at the University of Southern California’s Gould School of Law.

In Carrera Aguallo v. Kemper Corp., in the Northern District of Illinois, he was appointed co-lead counsel in a data-breach class action involving more than six million class members and obtained court approval of a $17.6 million settlement. Kemper’s auto-insurance unit, Infinity Insurance, had been the target of two security incidents, on December 14, 2020, and March 25, 2021, and Kemper sent notices to 6,151,872 people. The plaintiffs alleged that an unauthorized user had reached their names, addresses, Social Security numbers, driver’s license numbers, medical leave information, and workers’ compensation claim information. Irma Carrera Aguallo and others sued in April 2021. After two full-day mediations in July 2021, the parties agreed on terms, and on October 27, 2021, U.S. District Judge Martha M. Pacold preliminarily approved the settlement and appointed Klinger, Rachele R. Byrd, and Jean S. Martin class counsel. Klinger signed the motion that asked for that approval.

The settlement had no common fund. Every class member received 18 months of an identity-protection service, Aura Financial Shield, automatically, without filing a claim. Class members could also claim up to $10,000 each for out-of-pocket losses, with no cap on the total, and payment for up to six hours of lost time; California residents could claim an additional $50. The plaintiffs valued the package at $17.6 million, $12.1 million of it for the automatic protection, which they put at $202 a person. On March 15, 2022, after a hearing held by telephone, Judge Pacold granted final approval, finding the settlement fair, reasonable, and adequate. Klinger was also among the appointed class counsel in Jackson-Battle v. Navicent Health, a Georgia state-court data-breach case involving 360,000 patients.

In January 2022, U.S. District Judge Lynn Adelman in Wisconsin appointed Klinger co-lead counsel in In re Forefront Data Breach, pointing to the firm’s earlier data-breach settlements, the Kemper case among them. Forefront Dermatology, which operated 195 care sites in 22 states, had found and stopped an intrusion into its network on June 4, 2021; the attackers had reportedly entered on May 28, and the breach was attributed to a hacking group called Cuba. About 2.41 million patients and employees were affected. The patients who sued alleged that Forefront had failed to secure and monitor its network.

In May 2023, a federal court in California appointed him interim co-lead counsel in In re Cerebral, Inc. Privacy Practices. Cerebral had announced that it “determined that it had disclosed certain information that may be regulated as protected health information (‘PHI’) under HIPAA” to third-party platforms and some subcontractors without obtaining the assurances HIPAA requires. It acknowledged using tracking technologies from Google, Meta, TikTok, and other companies since 2019. The information of 3,179,835 people may have been disclosed, including names, phone numbers, email addresses, dates of birth, IP addresses, client ID numbers, insurance information, and data from the mental-health self-assessment tests people took to book counseling appointments.

In April 2026, Milberg began a mass arbitration against Yahoo on behalf of account holders who allege that its ConnectID system generated persistent identifiers tied to their email addresses, letting Yahoo and its advertising partners follow them across websites, apps, and devices even after third-party cookies were blocked or deleted, and that they were not clearly told their account identifiers could be used that way. Klinger explained the approach: “Mass arbitration gives consumers a real path to accountability even when companies rely on arbitration clauses to block traditional class actions.”

Paying Out the All Web Leads Fund

Through those years, the 2019 settlement was still on its installment schedule. The claims administrator, Postlethwaite & Netterville, made the first distribution on October 18, 2019, and the second on January 5, 2021. On April 18, 2023, on All Web Leads’ agreed motion, Judge Leinenweber amended the final approval order and the settlement agreement to reset the remaining schedule: nine monthly deposits from April through December 2023, ranging from $75,000 to $157,061.34, followed by $2 million due by January 7, 2025. The same order left the timing and number of distributions to claimants to class counsel’s discretion. Payments on the combined third and fourth distributions began on February 24, 2025. Claimants could take their money by Zelle, PayPal, Venmo, ACH transfer, digital Mastercard, or paper check.

Under the 2019 agreement, money from checks left uncashed for 180 days is redistributed among participating claimants, as long as each would receive at least $2. When another distribution is no longer possible, the remainder goes to Doctors Without Borders, St. Jude Children’s Research Hospital, or another nonprofit the parties agree on and the court approves. An additional pro rata payment went out to claimants in December 2025, nearly nine years after William Sullivan filled out the quote form and the calls began.