Katrina Carroll

Standing After a Breach

That month P.F. Chang’s announced that its computer system had been breached and that customers’ card data had been stolen. On June 30, 2014, Katrina Carroll and Kyle A. Shamberg, then at Lite DePalma Greenberg in Chicago, filed Kosner’s class action in federal court. It was consolidated with a suit by John Lewert, who had paid with a debit card at the same restaurant on April 3, found no fraudulent charges and spent time monitoring his card statements and credit report.

P.F. Chang’s argued that the two men could not trace an injury to its breach. Their information had never been compromised, it said; any fraudulent charges could not be attributed to the breach; and their efforts to protect themselves were unreasonable.

On April 14, 2016, the Seventh Circuit held that both men had alleged enough to support standing. Chief Judge Diane P. Wood, writing for a panel with Judges William J. Bauer and David F. Hamilton, found the increased risk of fraudulent charges and identity theft concrete because the data had already been stolen, and that risk immediate enough to make the men’s time and the $106.89 Kosner paid for credit monitoring injuries in their own right. The claim that their data had never been taken assumed the answer to a disputed fact, she wrote, and the company’s causation argument was “a theory of defense that P.F. Chang’s will be entitled to pursue at the merits phase.” She added: “Merely identifying potential alternative causes does not defeat standing.” The court sent the case back to the district court.

Inside TikTok’s Source Code

In September 2020 Judge John Z. Lee of the federal court in Chicago chose Carroll, Ekwan Rhow and Elizabeth Fegan as co-lead counsel in In re TikTok, Inc., Consumer Privacy Litigation, which gathered more than twenty privacy suits over the video app. The plaintiffs alleged that TikTok had collected and used its users’ personal information, including biometric data, without sufficient notice and consent.

Before asking the court to approve a settlement, the plaintiffs’ leadership tested it through confirmatory discovery: interrogatories, document requests, depositions by written question and an on-site inspection of the app’s source code. An expert retained by Carroll and another member of the leadership spent two weeks examining the iOS and Android code and the relevant server code, and the group used that work to prepare its written discovery and deposition questions. Carroll helped negotiate the settlement and presented the plaintiffs’ major oral arguments.

The settlement created a $92 million fund for a nationwide class of about 89 million users and an Illinois subclass of about 1.4 million residents who had used the app to create videos. Each Illinois claimant received six shares to a nationwide claimant’s one, reflecting the subclass’s claims under the Illinois Biometric Information Privacy Act.

Unless it disclosed the practice expressly in its privacy policy, TikTok agreed not to use the app to collect or store users’ biometric information, to collect GPS data or information in users’ clipboards, to send user data outside the United States or store it in databases abroad, or to upload users’ content to its servers before they chose to save or publish it. It also agreed to delete the pre-uploaded content already on its servers, to build a data-privacy training and compliance program for new employees and contractors, to give all employees annual privacy training, and to pay a third party to monitor that training for three years.

Judge Lee granted final approval on July 28, 2022. “These injunctive remedies confer substantial benefits to the class,” he wrote. He estimated payments of $27.19 to each nationwide claimant and $163.13 to each Illinois claimant, and the court entered final judgment the next month.

Photo Verification at Bumble

Bumble let users verify their accounts by submitting a photograph taken while mimicking a pose the app supplied; the app then confirmed or rejected the verification. In November 2021 Dario Dzananovic, an Illinois resident who had used the app since March of that year, sued in Cook County. He alleged that the app ran an artificial-intelligence scan of the photograph, extracted geometric data from the face and created a facial template without the notice, written consent, retention policy and deletion schedule that the Illinois Biometric Information Privacy Act requires.

Bumble removed the case to federal court in Chicago and moved to dismiss it, arguing that the companies lacked the connection to Illinois that personal jurisdiction requires. On July 7, 2023, Judge Andrea R. Wood denied the motion. The companies had purposefully availed themselves of the Illinois market, she found, with thousands of paying users and extensive marketing in the state, and the claim related to that activity because they promoted photo verification as a way to confirm that matches were who they claimed to be.

After mediation before two retired judges, Layn Phillips in December 2023 and Diane M. Welsh in January 2024, the Illinois claims were brought together in the Circuit Court of Winnebago County, with Dzananovic and Kemelle Howell as class representatives and Carroll, then at Lynch Carpenter, as one of three class counsel with Jonathan M. Jagher and Evan M. Meyers. The settlement created a non-reversionary $40 million fund for everyone who had used Bumble or Badoo while living in or located in Illinois from November 1, 2016, through December 31, 2021, and required the companies to confirm deletion of any biometric information obtained through photo verification or content moderation. Judge Ronald A. Barch approved it on October 24, 2024. Payments went out in August 2025, and supplemental payments followed on August 21, 2026.

Browsing Data in the Ad Auction

On February 19, 2026, Carroll Shamberg and co-counsel sued Google in federal court in San Francisco for Nicole McGrath, a New Hampshire resident. The complaint alleges that Google’s real-time-bidding and cookie-syncing systems sent Americans’ browsing data and identifiers, including health-related searches, to entities owned by, controlled by or subject to the jurisdiction of the People’s Republic of China, among them ByteDance’s Pangle, Baidu USA’s MediaGo and Temu, in violation of the Justice Department’s Bulk Sensitive Data Rule, which took effect on April 8, 2025, and of the federal Wiretap Act.

On June 23, 2026, Judge Charles R. Breyer consolidated McGrath’s suit with two related cases, now In re Google Bulk Sensitive Data Rule Litigation. On August 27 he appointed Milberg, Carroll Shamberg and Justice Jagher London & Millen interim co-lead class counsel, gave them responsibility for the consolidated complaint, discovery, expert retention and any settlement discussions, and allowed the plaintiffs thirty days to file the consolidated complaint.

Carroll earned a bachelor’s degree in political science with honors from Northwestern University in 1997 and her law degree from Seton Hall University School of Law in 2000. She founded Carroll Shamberg in Chicago with Kyle A. Shamberg, whose name follows hers on Lucas Kosner’s 2014 complaint.