In re 23ANDME, Customer Data Sec. Breach Litig.

Full title: IN RE 23ANDME, INC. CUSTOMER DATA SECURITY BREACH LITIGATION.

Court: United States District Court, Northern District of California

Date published: Dec 4, 2024

24-md-03098-EMC (N.D. Cal. Dec. 4, 2024)

Opinion

24-md-03098-EMC

12-04-2024

IN RE 23ANDME, INC. CUSTOMER DATA SECURITY BREACH LITIGATION.

EDWARD M. CHEN UNITED STATES DISTRICT JUDGE

ORDER CONDITIONALLY GRANTING MOTION FOR PRELIMINARY APPROVAL

DOCKET NO. 103

EDWARD M. CHEN UNITED STATES DISTRICT JUDGE

The case at bar is a multi-district litigation comprised of approximately forty federal lawsuits. Plaintiffs are customers of Defendant 23andMe, Inc., a genetic testing company. They have filed a class action against the company based on a data breach. According to Plaintiffs, in October 2023, 23andMe announced that there was a data breach at the company and, as a result, a wide range of sensitive personal information of customers was compromised, “including but not limited to name, sex, date of birth, genetic information, predicted relationships with genetic matches, ancestry reports, ancestors' birth locations and family names, family tree information, profile pictures, and geographic location.” CAC ¶ 1. Cybercriminals had specifically targeted 23andMe customers of Ashkenazi Jewish and Chinese descent, offering their data for sale on the dark web.

The Court appointed counsel for the putative class (hereinafter “Co-Lead Counsel”) in June 2024. Prior to appointment, Co-Lead Counsel - as well as other attorneys - had already engaged in settlement discussions with 23andMe because publicly available information¹ strongly suggested that the company was in dire financial straits. If the financial condition of 23andMe was weak, then, even assuming the putative class were to prevail on the merits of the lawsuit (an event that might not happen for several years), 23andMe might, as a practical matter, face insolvency and/or bankruptcy, and thus the putative class might ultimately obtain little or no relief.

1 23andMe is a publicly held company. As a result, significant information about the company is publicly available through SEC filings. 23andMe's stock price is also publicly available information.

After Co-Lead Counsel was appointed, Co-Lead Counsel continued settlement discussions with 23andMe. In mid-July 2024, a settlement in principle was reached, and, in early September 2024, a settlement agreement was signed.

Now pending before the Court is the Settling Parties'² motion for preliminary approval of a class action settlement. The Settling Parties ask that the Court certify a settlement class and approve the class action settlement as fair, reasonable, and adequate. Some 23andMe customers, through their own counsel, have raised objections to the settlement. There are five sets of objectors represented by the following firms: Edelson, Milberg, Levi, Labaton, and Potter. The Milberg, Levi, and Labaton firms represent individuals who have demanded arbitration from 23andMe or initiated arbitration against the company.³ The Potter firm represents individuals who have filed litigation against 23andMe in state court.⁴

2 Settling Parties are Named Plaintiffs, the settlement class (if certified), and 23andMe.

3 Previously, the Court denied the motions to intervene filed by the Milberg, Levi, and Labaton firms. However, the Court stated that it would still consider the substance of their filings as, in essence, objections. See Docket No. 147 (minutes).

4 Because the suits are in state court, they are not part of this federal action. The Settling Parties note that six of Potter's lawsuits were filed after the Settling Parties moved for preliminary approval.

Having considered all filings and submissions, as well as all other evidence of record, the Court hereby conditionally GRANTS the motion for preliminary approval.

I. BACKGROUND

A. Procedural History

As an initial matter, the Court provides a brief overview of the procedural history of this case.

In or about August 2023, “a threat actor began selling samples of 23andMe genetic user data on the dark web.” Docket No. 103-5 (Co-Lead Counsel Decl. ¶ 19). In early October 2023, “the stolen data again appeared for sale, this time containing the genetic data of one million 23andMe users of Jewish Ashkenazi descent, 100,000 users with Chinese DNA, and another 300,000 users with Chinese heritage.” Docket No. 103-5 (Co-Lead Counsel Decl. ¶ 19). Shortly thereafter, “23andMe [publicly] confirmed it was the source of the stolen genetic data, and after an investigation, determined the threat actor downloaded Personal Information without authorization relating to approximately [6.4] million natural persons in the United States.” Docket No. 103-5 (Co-Lead Counsel Decl. ¶¶ 19, 44); Sett. Agmt. ¶ 3.

After 23andMe publicly announced the data breach, more than forty cases were filed against the company, both in federal and state court. See Docket No. 103-5 (Co-Lead Counsel Decl. ¶ 20). Most, but not all, of the federal cases were filed in this District. In addition to the federal and state lawsuits, thousands of arbitrations have been demanded or initiated. See Docket No. 105 (Def.'s Br. at 1); Docket No. 105-2 (Guyon Decl. ¶ 11) (stating that, as of mid-September 2024, “nearly 16,000 individual arbitrations have been filed”).

In December 2023, 23andMe asked the Judicial Panel on Multidistrict Litigation (“JPML”) to create a multidistrict litigation (“MDL”) for the federal data breach cases.⁵ See Docket No. 103-5 (Co-Lead Counsel Decl. ¶ 21). Subsequently, in January 2024 - before the JPML rendered its decision - “a small group of Plaintiffs' counsel and 23andMe scheduled an early mediation for January 31, 2024, with Mr. Randall Wulff.” Docket No. 103-5 (Co-Lead Counsel Decl. ¶ 23). “Plaintiffs' lawyers representing nearly every case filed against 23andMe participated in the mediation.” Docket No. 103-5 (Co-Lead Counsel Decl. ¶ 23).

5 As explained on the JPML website, the JPML was created by an act of Congress, see 28 U.S. § 1407. The JPML states that

[t]he job of the Panel is to (1) determine whether civil actions pending in different federal districts involve one or more common questions of fact such that the actions should be transferred to one federal district for coordinated or consolidated pretrial proceedings; and (2) select the judge or judges and court assigned to conduct such proceedings.

https://www.jpml.uscourts.gov/about-panel (last visited 11/19/2024).

In March 2024, a second mediation was held with Mr. Wulff. This mediation, which also took place before the JPML rendered its decision, involved a smaller group of Plaintiffs' counsel. “Prior to [the] mediation, the group engaged an independent forensic accounting firm to advise it with respect to 23andMe's financial condition.” Docket No. 103-5 (Co-Lead Counsel Decl. ¶ 24). As discussed below, at that time, there were significant concerns about 23andMe's financial condition.

In April 2024, the JPML created the MDL, and the MDL was assigned to this Court. See Docket No. 1 (order). On June 5, 2024, the Court appointed Co-Lead Counsel to represent the putative class of 23andMe customers who had been subject to the data breach. See Docket No. 62 (order). In its order appointing counsel, the Court directed Co-Lead Counsel and 23andMe to immediately arrange for a further mediation with Mr. Wulff in recognition of the serious concerns about 23andMe's financial situation. See Docket No. 62 (Order at 4).

On June 26, 2024, a third mediation was held with Mr. Wulff, this time with Co-Lead Counsel advocating for the putative class. See Docket No. 103-5 (Co-Lead Counsel Decl. ¶ 26). In early July 2024, the parties reported back to the Court that they were considering a mediator's proposal. See Docket No. 79 (CMC St. at 2). On July 12, 2024, the parties accepted Mr. Wulff's mediator's proposal, see Docket No. 103-5 (Co-Lead Counsel Decl. ¶ 26); several days later the parties informed the Court that they had reached a settlement in principle. See Docket No. 103-5 (Co-Lead Counsel Decl. ¶ 28); Docket No. 85 (minutes) (stating that mediator's proposal was accepted and that parties were working on a term sheet). In late July 2024, the parties reported to the Court that they had signed a term sheet and were working on the settlement agreement. See Docket No. 90 (minutes). The settlement agreement was executed on September 5, 2024. See Docket No. 103-5 (Co-Lead Counsel Decl. ¶ 28).

B. Consolidated Class Action Complaint

In the operative complaint filed by Co-Lead Counsel, Plaintiffs allege as follows. 23andMe is a genetic testing company that possesses and stores private information for more than 14 million people in its databases. See CAC ¶¶ 9-10. Private information includes extremely sensitive personal information: “an individual's unique and immutable genetic information” that sheds light on, among other things, a person's ancestry and health. CAC ¶¶ 405-06. 23andMe “profits from the highly sensitive Private Information that it collects and maintains”; “recognizes [its] enormous responsibility to protect this highly sensitive Private Information”; and promises consumers (e.g., through its Privacy and Data Protection statement) to keep the information safe. See CAC ¶¶ 2, 9-10. However, in spite of such responsibilities and promises to keep customer personal information safe, 23andMe allegedly failed to do so. As alleged, 23andMe “failed to properly monitor the computer networks and systems in which the Private Information of Plaintiffs and Class Members was maintained, and failed to detect and prevent the Data Breach.” CAC ¶ 417.

Furthermore, as alleged, 23andMe could have provided better security to safeguard personal information but chose not to do so. See, e.g., CAC ¶ 412 (noting, e.g., that 23andMe could have required users to change their passwords frequently, to use “strong” passwords, to use multi-factor authentication, etc.); see also CAC ¶ 472 (alleging that 23andMe “fail[ed] to comply with state and federal laws and requirements as well as industry standards governing the protection of PII and PHI”). In addition, 23andMe failed to respond to the data breach appropriately and provided inadequate notice about the breach to its customers. See, e.g., CAC ¶ 419 (alleging that, “[f]or nearly two months, 23andMe did nothing in response to the August 11, 2023 Hydra and Reddit posts, leaving Plaintiffs and Class Members uninformed about the Data Breach”); CAC ¶ 445 (alleging that 23andMe “fail[ed] to provide basic details about the Data Breach, including but not limited to how unauthorized third parties were able to access Private Information, what Private Information was in fact compromised, and how many people were affected by the Data Breach”).

Plaintiffs maintain that, as a result of the data breach, harms include identity theft and financial fraud. See CAC ¶ 495. Furthermore, there is a risk that personal information could be used to target individuals who are members of particular ethnic groups. See CAC ¶ 496. A more fulsome list of injuries is provided in ¶ 510 of the operative pleading.⁶

6 See CAC ¶ 510 (“Plaintiffs and Class Members were injured as follows: (i) theft of their Private Information and the resulting loss of privacy rights in that information; (ii) improper disclosure of their Private Information; (iii) loss of value of their Private Information; (iv) the lost value of access to Plaintiffs' and Class Members' Private Information permitted by 23andMe; (v) the amount of the actuarial present value of ongoing high-quality identity defense, dark web, and credit monitoring services made necessary as mitigation measures because of 23andMe's Data Breach; (vi) 23andMe's retention of profits attributable to Plaintiffs' and Class Members' Private Information that 23andMe failed to adequately protect; (vii) the certain, imminent, and ongoing threat of identity theft, fraud, blackmail, harassment, intimidation, vandalism, assault, extortion, hate crimes, and other related harms, including the economic and non-economic impacts that flow therefrom; (viii) ascertainable out- of-pocket expenses and the value of their time allocated to fixing or mitigating the effects of the Data Breach; (ix) overpayments to 23andMe for services purchased, as Plaintiffs reasonably believed a portion of the sale price would fund reasonable security measures that would protect their PII, which was not the case; and (x) nominal damages.”).

Based on, inter alia, the above allegations, Plaintiffs have asserted forty causes of action.

The causes of action include, but are not limited to, negligence-related claims, contract-related claims, claims related to invasion of privacy, an unjust enrichment claim, and claims for violation of state statutes (related to genetic privacy, confidentiality of medical information, consumer protection, etc.).

Per the operative complaint, the class action includes both nationwide classes and statewide subclasses. The nationwide classes are defined as follows:

• “Nationwide Class: All natural persons residing in the United States whose Private Information was exfiltrated in the Data Breach.” CAC ¶ 511.

• “Nationwide Ethnically Targeted Persons Class: All natural persons of Chinese or Ashkenazi Jewish descent residing in the United States whose Private Information was exfiltrated in the Data Breach.” CAC ¶ 511.

The statewide classes are defined as follows (two subclasses per state):

• “Statewide Subclass: All natural persons residing in [name of state or territory] whose Private Information was exfiltrated in the Data Breach.” CAC ¶ 513.

• “Statewide Ethnically Targeted Persons Subclass: All natural persons of Chinese or Ashkenazi Jewish descent residing in [name of state or territory] whose Private Information was exfiltrated in the Data Breach.” CAC ¶ 513.

II. SETTLEMENT AGREEMENT

As noted above, the Settling Parties entered into a settlement agreement on September 5, 2024. The settlement agreement provides for both monetary relief (including the cost of a monitoring program) and injunctive relief. Below are the main terms.

A. Settlement Class Definition

The settlement class is defined as “all natural persons who were residents of the United States on August 11, 2023 and whose Personal Information was compromised in the Security Incident.” Sett. Agmt. ¶ 44.

There is a subclass consisting of “Settlement Class Members who were residents of Alaska, Oregon, California or Illinois as of August 11, 2023.” Sett. Agmt. ¶ 51. The subclass was carved out in recognition of the fact that these states have laws that specifically provide for statutory damages. See Mot. at 1 (noting that these four states have genetic privacy laws providing for statutory damages).⁷

7 Alaska: the Alaska Genetic Privacy Act. See Alaska Stat. § 18.13.010 et seq.

California: the California Confidentiality of Medical Information Act. See Cal. Civ. Code § 56 et seq.

Illinois: the Illinois Genetic Information Privacy Act. See 410 Ill. Comp. Stat. Ann. 513 et seq.

Oregon: the Oregon Genetic Privacy Law. See Or. Rev. Stat. § 192.531 et seq.

In their papers, Plaintiffs acknowledge that, on their face, the definitions of the settlement class and subclass differ from the definitions of the classes and subclasses in the operative complaint. But Plaintiffs explain that, substantively, there are no material differences⁸:

8 Thus, the Edelson firm, which represents some of the 23andMe customers who have objected, is incorrect in arguing that Plaintiffs did not provide an explanation for the different class definitions. See Docket No. 118 (Edelson Opp'n at 10-11).

The Settlement Class definition encompasses the same persons as the Nationwide Class in the Complaint. The “Nationwide Ethnically Targeted Persons Class” is subsumed within the Settlement Class definition. The proposed Statutory Subclass definition applies only to residents of the four states with genetic privacy statutes that provide statutory damages, as alleged in the Complaint, and here, the eligibility is defined as of August 11, 2023, the date the initial data appeared on the dark web.

Mot. at 8 n.7.

As Plaintiffs maintain, the class/subclass definitions used in the settlement agreement encompass all of the class members as defined in the CAC. To the extent there are potentially material differences because of the subclasses expressly recognized in the CAC, but not called out in the settlement class or subclass, those differences are discussed below.

The primary dispute between the Settling Parties and some of the objectors is whether the settlement class definition should be revised so as to exclude those individuals who have demanded or initiated arbitration with 23andMe.

B. Relief

1. Monetary Relief

Under the settlement agreement, 23andMe is to pay out a gross settlement amount of $30 million, none of which shall revert back to the company. See Sett. Agmt. ¶ 48.

Before any money will distributed to the class, certain deductions will be made from the gross settlement fund. See Sett. Agmt. ¶ 48; Sett. Ben. Plan ¶ 3. For example, there will be deductions for:

• Settlement administration costs, estimated to be between $727,000 to $1,038,000. See Docket No. 103-6 (Peak Decl. ¶ 49) (testifying that “Verita has agreed to cap the costs of notice and settlement administration at $727,000-$1,038,000 depending on the claims rate and primary method by which claims are filed”).

• Service awards of $500 for each Named Plaintiff (there are 31 individuals), which would total $15,500.⁹ See Docket No. 123 (Supp. Br. at 11).

• Attorneys' fees of no more than 25% of the gross settlement fund, i.e., no more than $7.5 million. See Sett. Agmt. ¶ 97.

• Litigation expenses, expected to be about $300,000. See Docket No. 123 (Supp. Br. at 11); see also Docket No. 103-5 (Co-Lead Counsel Decl. ¶ 59) (indicating that, as of mid-September 2024, expenses were approximately $183,000).

9 The Settlement Agreement provides that each Named Plaintiff could be awarded up to $1,000. See Sett. Agmt. ¶ 98. However, the actual request being made is limited to $500 each.

In addition, there will be a deduction from the gross settlement fund for the cost of Privacy & Medical Shield + Genetic Monitoring (“Privacy Shield”). See Sett. Ben. Plan. ¶ 3. Privacy Shield is a benefit for the class. Plaintiffs represent that it is one of the main benefits, if not the most important one.

Privacy Shield is a monitoring program, provided by the company CyEx. CyEx is one of four operating companies held by Pango Holdings, a privately held company with several large investors. See Docket No. 159-1 (Thompson Supp. Decl. ¶ 8). Because it is a privately held company, Pango Holdings' financial statements are not publicly available; however, it has provided a declaration from an officer testifying that the company's revenues in 2024 exceed $250 million. See Docket No. 159-1 (Thompson Supp. Decl. ¶ 8) (adding that “[e]ach of the four operating businesses held by Pango Holdings is profitable on a stand-alone basis”). CyEx is the second largest revenue generator in the Pango Holdings portfolio. See Docket No. 159-1 (Thompson Supp. Decl. ¶ 8).

The CyEx brand was not launched until 2023. However, the company has existed under other names since 1995. See Docket No. 159-1 (Thompson Supp. Decl. ¶ 8). CyEx's original predecessor “was one of the first companies to offer identity protection and remediation to consumers in the United States.” Docket No. 159-1 (Thomson Supp. Decl. ¶ 3). CyEx currently offers services in “two main areas: cyber incident response and data breach and privacy class action settlements.” Docket No. 159-1 (Thompson Supp. Decl. ¶ 4). “Since 2016, CyEx has provided services for more than 2,100 data breaches of all sizes and across multiple industries.” Docket No. 159-1 (Thompson Supp. Decl. ¶ 4); see also Docket No. 103-7 (Thompson Decl. ¶ 2) (noting that “CyEx has distributed its services through a focused distribution network of large U.S. financial institutions and large enterprise companies”). In the past two years, CyEx has been appointed to provide monitoring services in a number of large data breach class action settlements. See Docket No. 159-1 (Thompson Supp. Decl. ¶ 4). See, e.g., In re Capital One Inc. Customer Data Sec. Breach Litig., No. 1:19-md-2915 (AJT/JFA) (E.D. Va.) (97 million class members); In re T-Mobile Customer Data Security Breach Litig., No. 4:21-MD-03019-BCW (W.D. Mo.) (77 million class members); In re Morgan Stanley Data Security Litig., No. 1:20-cv-05914 (S.D.N.Y.) (15 million class members). Recently, in May 2024, CyEx acquired a well-known settlement administration company, Simpluris, Inc., in an all-cash transaction for about $100 million. See Docket No. 159-1 (Thompson Supp. Decl. ¶ 8).

CyEx designed and built Privacy Shield for the 23andMe settlement class specifically. See Docket No. 103-7 (Thompson Decl. ¶ 6); see also Docket No. 159-1 (Thompson Supp. Decl. ¶ 5) (noting that CyEx builds “monitoring solutions that focus on the specific type of data breach”). The monitoring provided through Privacy Shield includes monitoring of the dark web for customer sensitive data and monitoring of sites that traffic in stolen customer data. See Docket No. 103-7 (Thompson Decl. ¶ 7) (noting that data includes genetic-related data, medical records, and medical diagnoses). Monitoring also includes monitoring of high-risk financial transactions and monitoring to prevent the fraudulent use of health insurance plan IDs and medical identities.

At the preliminary approval hearing, the Court pressed the Settling Parties on whether CyEx would provide real assistance to a class member if monitoring should reveal a problem. The Settling Parties and CyEx thereafter executed an addendum to their existing contract. The addendum provides that, should a problem arise, CyEx has a call center

available to all enrollees [that] will be staffed as appropriate to handle the volume of calls, beginning with 20-40 agents, and overflow agents as CyEx determines needed, for the initial sixty days of service with 24/7 coverage and continuing for the remainder of the service period with 24/7 staffing at levels appropriate to ensure the quality of service to which CyEx has committed.

[The addendum] also includes confirmation that CyEx's assistance to Settlement Class Members will include actual engagement with the Settlement Class Members, and their insurance companies, medical providers, financial institutions or others to assist in taking measures to avoid or discontinue fraudulent use of the Settlement Class Members' PHI [protected health information] or PII [personally identifiable information]. The [contract] further specifies that as agreed, CyEx will work directly with the Settlement Class Members involved and will keep a case file open for 60 days on each call that involves an alert or a Settlement Class Member notification of an event that triggered the call.

Docket No. 155 (Br. at 2-3).

In addition to the above, Privacy Shield provides the settlement class with identity theft and fraud insurance (with no deductible). Other benefits provided by Privacy Shield are designed to reduce class members' digital footprint and thus protect and/or enhance their privacy - e.g., use of a Virtual Private Network and/or a private search engine, use of a “digital vault” that secures personal digital files, and opting out of known data broker sites.¹⁰ See Docket No. 103-7 (Thompson Decl. ¶ 7); see also Docket No. 159-1 (Thompson Supp. Decl. ¶ 5).

10 The Settling Parties' submission does not make clear whether there will be, in effect, some kind of monitoring of CyEx's work. The Court assumes that Co-Lead Counsel will engage in some kind of monitoring and expects post-distribution accounting (assuming final approval) will provide information about CyEx's work done to assist class members. The Court will likely withhold a portion of the attorneys' fees requested so that Co-Lead Counsel has an incentive to (1) obtain as high an enrollment in Privacy Shield as possible and (2) ensure that Privacy Shield is being used and/or providing the benefits promised.

Those who enroll in Privacy Shield will get the benefits provided for three years. Enrollment can be made at any time within the three-year period, but those “who enroll after the three-year monitoring period begins will only receive monitoring for the remainder of the three-year period.” Sett. Ben. Plan ¶ 12.d.i. The Privacy Shield benefit would retail at $375/person/year. See Thompson Decl. ¶ 8. However, the actual cost to the class is different: “Co-Lead Counsel negotiated a flat fee for purchasing Privacy Shield for all Settlement Class Members who enroll during the three-year service period. The flat fee is $2,097,000.” Docket No. 123 (Supp. Br. at 11). (CyEx has estimated that 20% of the settlement class will enroll in Privacy Shield, i.e., about 1.28 million people. See Docket No. 123 (Supp. Br. at 11).)

If the maximum deductions above are made from the gross settlement fund of $30 million (i.e., for settlement administration costs, service awards, attorneys' fees, litigation expenses, and the cost of Privacy Shield), this should leave a net settlement fund of about $19,049,500 for distribution to the class. See Docket No. 123 (Supp. Br. at 11). There are about 6.4 million people in the class. However, the plan of allocation does not simply split the net settlement fund among all class members. Plaintiffs considered that possibility but rejected it. Instead, there is a somewhat complicated plan of allocation which is memorialized in the Settlement Benefits Plan (available at Docket No. 103-3). See Sett. Agmt. ¶ 69; Sett. Ben. Plan ¶ 3.

Under the Settlement Benefits Plan, claims must be made in order for a class member to get money. There are three kinds of claims that can be made.

• Extraordinary Claims. Up to $5 million is set aside for “Extraordinary Claims.” See Sett. Ben. Plan ¶ 7.a. A person can make an Extraordinary Claim for

“unreimbursed costs or expenditures up to $10,000 that a Settlement Class Member actually incurred on or after August 11, 2023, . . . and that the Settlement Class Member establishes are related to the Security Incident.” Sett. Ben. Plan ¶ 4.a. Only certain kinds of costs can be claimed: to wit, (1) costs incurred “as a direct result of identity fraud or falsified tax returns”; (2) costs “associated with the purchase of a physical security or monitoring system”; and (3) costs “associated with seeking professional mental health counseling or treatment.” Sett. Ben. Plan ¶ 4. These categories represent the common injuries suffered by class members. Class members must submit proof to back up their claims. See Sett. Ben. Plan ¶ 12.a.i (requiring “Reasonable Documentation”). “If the total amount of valid Extraordinary Claims exceeds the Extraordinary Claims Fund [of $5 million], payment of the Extraordinary Claims will be reduced on a pro-rata basis. If the total amount of valid Extraordinary Claims is less than the Extraordinary Claims Fund, the balance of the Extraordinary Claims Fund will be added to the Statutory Cash Claim Fund [see below].” Sett. Ben. Plan ¶ 7.a. Plaintiffs expect the latter scenario, not the former. Specifically, Plaintiffs expect that there will be 500 or fewer valid Extraordinary Claims. See Docket No. 123 (Supp. Br. at 12). The settlement administrator roughly concurs, expecting a claims rate of 0.005% (i.e., 320 claims). See Docket No. 123 (Supp. Br. at 12) (stating that administrator expects this rate “based on its experiences with other data breach cases where claims could be made for out-of-pocket expenses incurred”). Plaintiffs also expect that the amount of each Extraordinary Claim will be a few hundred dollars only -e.g., “[t]he average cost of a security system is $490 in 2024, and an average therapy session in 2024 is $100-300 without insurance.” Docket No. 123 (Supp. Br. at 12). Thus, the Extraordinary Claims may total to only $200,000. See Docket No. 123 (Supp. Br. at 13) (“If only 500 claims are filed for $400, then only $200,000 of the Extraordinary Claims fund will be used.”). Plaintiffs explain that they still set aside $5 million for the fund “to ensure even an outlier claims rate for

Extraordinary Claims would be compensated.” Docket No. 123 (Supp. Br. at 13).

• Health Information Claims. A total of $750,000 is set aside for “Health Information Claims.” See Sett. Ben. Plan ¶ 7.b. “A ‘Health Information Claim' may be submitted by any Settlement Class Member who received notice from 23andMe that their health information including (i) uninterpreted raw genotype data, (ii) certain health reports derived from the processing of their genetic information, including health predisposition reports, wellness reports and carrier status reports, or (iii) self reported health condition information was involved in the Security Incident. Health Information Claims will be paid a fixed $100 cash payment from the Health Information Fund.” Sett. Ben. Plan ¶ 5 (emphasis added). Consistent with this figure, it appears that the number of people who can submit Health Information Claims is relatively small - about 7,500 people. See Docket No. 103-5 (Co-Lead Counsel Decl. ¶ 19) (“23andMe confirmed during negotiations that approximately 7,500 customers had some form of health information compromised in the Security Incident.”). If the number of people is about 7,500, that means the maximum payout here would be $750,000 (i.e., $100 x 7,500 people) - i.e., the maximum amount in the fund. “If the amount of valid Health Information Claims is less than the Health Information Claims Fund, the balance of the . . . Fund will be added to the Statutory Cash Claim Fund.” Sett. Ben. Fund ¶ 7.b.

• Statutory Cash Claims. “[A] ‘Statutory Cash Claim' may be claimed by any Settlement Class Member who was a resident of Alaska, California, Illinois, or Oregon on August 11, 2023.” Sett. Ben. Plan ¶ 6. There are about 1,288,589 people who are in this subclass. See Docket No. 123 (Supp. Br. at 8) (about 946,792 in California; 197,187 in Illinois; 125,069 in Oregon; and 19,541 in Alaska). In their claim forms, people must attest that they were residents of one of the states and further provide the addresses where they resided on August 11, 2023. See Sett. Ben. Plan ¶ 12.c.iii. In principle, the money available for the Statutory

Cash Claims should be about $13.3 million (i.e., $19,049,500 - $5,000,000 -$750,000). See also Sett. Ben. Plan ¶ 7 (providing that “Valid Statutory Cash Claims shall be paid on a pro-rata basis from the ‘Statutory Cash Claim Fund,' which shall be the Net Settlement Fund less valid claims paid from the Extraordinary Claims Fund and the Health Information Claims Fund”). However, because the Extraordinary Claims likely will not exceed the $5 million set aside, the Statutory Cash Claims fund should be bigger than $13.3 million. Plaintiffs estimate that there will be about $18,775,950 in the Statutory Cash Claims fund -assuming (1) a 10% claims rate for the Health Information Claims ($100 x 735 claimants = $73,550) and (2) a total of $200,000 for Extraordinary Claims (500 claims x $400 = $200,000). See Docket No. 123 (Supp. Br. at 13). If there is a 10% claims rate for the Statutory Cash Claims, that sum would be divided among about 130,000 people - resulting in about $144 per person. See Docket No. 123 (Supp. Br. at 13-14).

If the settlement administrator determines that any claim is deficient, the class member will have an opportunity to cure the deficiency or dispute the determination. See Sett. Ben. Plan. ¶ 14.a.

If any funds remain as a result of a class member not timely negotiating a settlement check or not timely providing required tax information (so that a settlement check may issue), then the funds will be used “to extend the active period for [Privacy Shield]. No funds may revert to 23andMe.” Sett. Ben. Plan ¶ 8.

2. Injunctive Relief

In addition to monetary relief, 23andMe agreed to injunctive relief - specifically, agreeing to adopt certain business practices. See generally Sett. Agmt. ¶ 70 (addressing Business Practice Commitments). “These commitments include: (1) enhanced password protection; (2) mandated multi-factor authentication; (3) annual security awareness training; (4) annual computer scans and cybersecurity audits; (5) information security program; (6) maintenance of data breach incidents response plan and threat management; and (7) limited retention of inactive Personal Information.”

Mot. at 7.

Furthermore, “the Class Notice will provide a link where Settlement Class Members can have their information deleted by 23andMe, subject to certain conditions such as legal record retention requirements.” Mot. at 7; see also Sett. Agmt. ¶ 71.

In a supplemental brief, the parties represent that the business practices above either differ from past practices or are enhanced from past practices. See Docket No. 123 (Supp. Br. at 19-20).

C. Release

In exchange for the monetary and injunctive relief above, class members will release claims that were “asserted, or could have been asserted, . . . based on, relating to, or arising out of the same factual predicate as the allegations in the Litigation.” Sett. Agmt. ¶ 37. The Settling Parties have expressly confirmed that the release does “not extend to the sale of customer information to GlaxoSmithKline.” Docket No. 155 (Jt. Rpt. at 1).

D. Preliminary Injunction

The settlement agreement includes a provision for a preliminary injunction. In essence, per the settlement agreement, the parties request that the Court issue a preliminary injunction barring

all Settlement Class Members and their representatives from filing, commencing, prosecuting, maintaining, intervening in, conducting, continuing, or participating in any other lawsuit or administrative, regulatory, arbitration or other proceeding based on the Released Claims, unless and until they personally submit a timely request for individual exclusion pursuant to the Settlement Agreement after receiving Notice.

Sett. Agmt. ¶ 73(h). As discussed below, the preliminary injunction is a major point of contention with objectors represented by the Milberg, Levi, and Labaton law firms (each of whom represent individuals who have demanded arbitration from 23andMe or initiated arbitration against it), as well as the Potter law firm (which represents individuals who have filed state court suits against 23andMe).

E. Settlement Administrator

After evaluating nine bids, Plaintiffs selected Verita (formally KCC) to conduct the settlement administration. See Docket No. 103-5 (Co-Lead Counsel Decl. ¶ 63). Verita will carry out, inter alia, notice to the class, evaluation of claims, distribution to the class, etc.

F. Notice to the Class

Notice to the class will be effected via email in the first instance and, if email is not successful, direct mail. See Sett. Agmt. ¶¶ 28, 75; see also Docket No. 103-6 (Peak Decl. ¶ 19) (testifying that “[t]he email campaign will return data regarding the number of emails successfully delivered and email bouncebacks”). “23andMe has reported that it received less than 1% in bounceback in response to its email notifying Settlement Class Members of the Security Incident.” Docket No. 123 (Supp. Br. at 23). This suggests that email notice should be fairly robust.

• Notice via email will be a short-form notice. (The short-form notice, as well as a long-form notice, will also be available on a settlement website. See Sett. Agmt. ¶ 78.)

• Notice via direct mail will be a postcard notice.

In addition to the above, notice to the class will be given through 23andMe's website and mobile app. See Sett. Agmt. ¶¶ 28, 75.

Finally, there will be a media campaign to promote notice to the class. The media campaign has two components:

• A “paid search campaign.” See Docket No. 103-6 (Peak Decl. ¶ 24). “Paid search ads are driven by the user's search activity, meaning that if someone searches for (or has recently searched for) terms related to the Litigation or Settlement, the user may be served with a paid search result directing them to the dedicated Settlement Website.” Docket No. 103-6 (Peak Decl. ¶ 24).

• A press release “to be issued nationwide to a variety of press outlets.” Docket No. 103-6 (Peak Decl. ¶ 26); see also Docket No. 103-6 (Peak Decl. ¶ 27) (noting that the “[t]he subject matter of this litigation has already received extensive news coverage”).

A reminder email notice will issue at some point “[p]rior to the claims filing deadline.” Docket No. 103-6 (Peak Decl. ¶ 28).

III. SETTLEMENT CLASS DEFINITION

The pending motion for preliminary approval requires that the Court assess (1) whether a settlement class should be certified and, if so, (2) whether the class action settlement should be approved as fair, reasonable, and adequate. Before it may consider those issues, however, the Court must address the issue of whether the settlement class is properly defined in the first place.

The settlement agreement defines the settlement class as “all natural persons who were residents of the United States on August 11, 2023 and whose Personal Information was compromised in the Security Incident.” Sett. Agmt. ¶ 44. In addition, there is the subclass consisting of “Settlement Class Members who were residents of Alaska, Oregon, California or Illinois as of August 11, 2023.” Sett. Agmt. ¶ 51.

Objectors represented by the Milberg, Levi, and Labaton firms contend that the settlement class definition is improper. These objectors are individuals who have demanded arbitration from or initiated arbitration against 23andMe pursuant to the company's Terms of Service (which contain an arbitration agreement). Collectively, these objectors shall be referred to as the “Arbitrating Objectors.” In addition to the Arbitrating Objectors, the three law firms represent thousands of other 23andMe customers who have demanded arbitration from or initiated arbitration against 23andMe. Collectively, these customers shall be referred to as the “Arbitrating Individuals.”

The Arbitrating Objectors argue that the settlement class definition is improper because it does not exclude the Arbitrating Objectors, the Arbitrating Individuals, and others who have sought arbitration from the settlement class. In the alternative, the Arbitrating Objectors contend that, if these groups are part of the settlement class, then they have already opted out by seeking arbitration, or all groups should be allowed to opt out immediately through their counsel (i.e., instead of individualized opt-outs, their counsel will opt them out “en masse”).

The Court agrees with the Arbitrating Objectors that the settlement class definition should be modified so as to exclude those who have demanded or initiated arbitration. There is a question whether those who are bound by an enforceable arbitration clause can be included in a certified class given potential concerns about typicality/adequacy. Cf. O'Connor v. Uber Techs., 904 F.3d 1087, 1094-95 (9th Cir. 2018) (reversing class certification orders because “[t]he class as certified includes drivers who entered into agreements to arbitrate their claims”); Eaton v. Ascent Resources-Utica, LLC, No. 2:19-cv-03412, 2024 U.S. Dist. LEXIS 62182, at *15-16 (S.D. Ohio Apr. 4, 2024) (noting that “[m]any courts have found that the presence of arbitration agreements in some, but not all, class member contracts may destroy the Rule 23(a) typicality and adequacy requirements for a class action”).¹¹ But see, e.g., In re Am. Exp. Fin. Advisors Sec. Litig., 672 F.3d 113, 133 (2d Cir. 2011) (concluding that class members could not pursue released claims in arbitration because they “failed to opt out of the class” and did not show excusable neglect for that failure); Zakikhani v. Hyundai Motor Co., No. 8:20-cv-01584-SB-JDE, 2022 U.S. Dist. LEXIS 215046, at *29 (C.D. Cal. Oct. 20, 2022) (granting preliminary approval of class action settlement and noting that any class member who failed to opt out would become “bound by all proceedings, orders, and judgments in the [l]itigation, even if . . . [they] ha[d] previously initiated or subsequently initiate[d] individual litigation or other proceedings encompassed by the [r]elease”); In re Herff Jones Data Breach Litig., No. 1:21-cv-1329-TWP-DLP, 20117 U.S. Dist. LEXIS 236459, at *29 (S.D. Ind. Jan. 12, 2022) (same); Carver v. Foresight Energy LP, No. 3:16-cv-3013, 2016 U.S. Dist. LEXIS 191144, at *5-6 (C.D. Ill. Oct. 24, 2016) (noting that any class member who failed to opt out of settlement would become “bound by all subsequent proceedings, orders and judgments in this [l]itigation, regardless of whether [they] currently [were], or subsequently bec[ame], a plaintiff or claimant in any other lawsuit, arbitration, administrative action or other proceeding”).

11 The Arbitrating Objectors cite additional cases in which a court was deciding a class certification-type motion and concluded that the class could not include those subject to an arbitration agreement - as argued by the defendant - because the named plaintiff was not subject to an arbitration agreement. See generally Docket No. 151 (supplemental brief).

Regardless, there is a basic problem with including those who have opted to arbitrate in the class. If an individual has chosen to arbitrate, they have chosen not to litigate; including the individual in the class amounts would force them into litigation in derogation of their right to arbitrate. Cf. O'Connor, 904 F.3d at 1094-95.

The Court is cognizant that, for some individuals, the decision to accede to arbitration was made before the settlement ever existed. Also, even if the settlement agreement was already executed, some individuals may not have known about its terms at the time they decided to arbitrate or this Court's assessment of the terms. For these individuals, there is a fair argument they should now be given an opportunity to waive their right to arbitrate and seek to join this this litigation so they can partake in the settlement, especially in light of 23andMe's dire financial condition which may make any arbitration ultimately unfruitful. The Court agrees that these individuals should be given that opportunity. However, that does not mean that the individuals should be defined as part of the class in the first instance.

Accordingly, the settlement class definition agreed to by the parties must be modified to exclude those 23andMe customers who have chosen to exercise their right to arbitrate, whether by making a mere demand for arbitration or by filing a formal complaint with the arbitral forum (but not, e.g., simply threatening to arbitrate).¹² The Court's granting of the motion for preliminary approval is conditioned on the Settling Parties' agreement to a modified definition.¹³

12 At this juncture at least, neither 23andMe nor Plaintiffs argue that the Arbitrating Individuals do not have a contractual right to arbitrate or that this right is not valid or otherwise unenforceable.

13 The Potter firm has also argued that its clients (in the state court suits) should likewise be excluded from the settlement class definition. The Court does not agree and addresses that issue below.

Assuming that the Settling Parties agree to modify the definition, the Court directs the Settling Parties to issue a notice to the Arbitrating Objectors, Arbitrating Individuals, and others who have sought arbitration, informing them of the settlement agreement, its terms and their ability to partake in the settlement by filing claims (which would mean a waiver of the right to arbitrate). See 28 U.S.C. § 1651(a) (providing that “all courts established by Act of Congress may issue all writs necessary or appropriate in aid of their respective jurisdictions and agreeable to the usages and principles of law”); see also Fed.R.Civ.P. 23(d) (providing that, in conducting a class action, a “court may issue orders that [inter alia] impose conditions on the representative parties or on intervenors” or “deal with similar procedural matters”); Moore's Fed. Prac. - Civ. § 23.140[2] (stating that “[t]he purpose of Rule 23(d) is to provide the court with the means for facilitating the ‘fair and efficient conduct of the action,'” and so “a district court has both a duty and the discretion to exercise control over a class action by issuing appropriate orders governing the conduct of counsel and parties”). The notice may be issued to the individuals directly (e.g., sent to their personal email addresses instead of being routed to their counsel), even if they are represented by counsel. The notice should either include a copy of this order as an attachment or include a link to a copy of this order. So as to prevent disputes, the Court orders the Settling Parties and the Arbitrating Objectors to meet and confer immediately on the language of a notice -which quite frankly should be modeled on the class notices that the Court is approving here. Any disputes about language should promptly be raised with the Court, as the Court's intent is that the notice to those seeking arbitration should be issued at or about the same time as the notices to the class.

IV. CERTIFICATION OF SETTLEMENT CLASS

A. Legal Standard

Where parties request certification of a class for settlement purposes only, a court must still consider whether certification is appropriate pursuant to Federal Rule of Civil Procedure 23(a) and (b). See Kim v. Allison, 87 F.4th 994, 999-1000 (9th Cir. 2023). Under Rule 23(a), [o]ne or more members of a class may sue . . . as representative parties on behalf of all members only if:

(1) the class is so numerous that joinder of all members is impracticable;

(2) there are questions of law or fact common to the class;

(3) the claims or defenses of the representative parties are typical of the claims or defenses of the class; and

(4) the representative parties will fairly and adequately protect the interests of the class.

Fed. R. Civ. P. 23(a).

Because Plaintiffs here seek, inter alia, monetary damages, Rule 23(b)(3) is applicable. See AA Suncoast Chiropractic Clinic, P.A. v. Progressive Am. Ins. Co., 938 F.3d 1170, 1174 (11th Cir. 2019) (noting that, while “[i]njunction classes can go forward under Rule 23(b)(2)[,] damages classes must satisfy Rule 23(b)(3)”). Under Rule 23(b)(3),

[a] class action may be maintained if Rule 23(a) is satisfied and if: ...

(3) the court finds that the questions of law or fact common to class members predominate over any questions affecting only individual members, and that a class action is superior to other available methods for fairly and efficiently adjudicating the controversy. The matters pertinent to these findings include:

(A) the class members' interests in individually controlling the prosecution or defense of separate actions;

(B) the extent and nature of any litigation concerning the controversy already begun by or against class members;

(C) the desirability or undesirability of concentrating the litigation of the claims in the particular forum; and

(D) the likely difficulties in managing a class action.

Fed. R. Civ. P. 23(b)(3). Manageability at trial is a consideration only where a court decides whether to certify a litigation class, not a settlement class. See In re Hyundai & Kia Fuel Econ. Litig., 926 F.3d 539, 557 (9th Cir. 2019) (noting that, where there is a settlement class, “by definition, there will be no trial”).

B. Rule 23(a) Requirements

The settlement class (as modified above) meets the requirements of Rule 23(a). There is no dispute that there are millions of 23andMe customers who were subject to the data breach, and therefore the numerosity requirement is satisfied. Common questions exist because the customers were subject to the same data breach; plus, there are common questions related to the breach such as whether 23andMe could have had better security policies to protect customer information and whether 23andMe responded to the data breach appropriately. See Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338, 349-50 (2011) (stating that “[c]ommonality requires the plaintiff to demonstrate that the class members ‘have suffered the same injury'” - with the common contention being capable of classwide resolution). The Named Plaintiffs' claims are typical of the class claims because they were subject to the same data breach as the other class members, as well as the same 23andMe security policies. Though the subclass consists of class members from only certain states (Alaska, California, Illinois, and Oregon), there are Named Plaintiffs from each of those states, and thus typicality is satisfied here as well. Finally, Named Plaintiffs (and their Co-Lead Counsel) satisfy the adequacy requirement as there are no apparent conflicts between the interests of Named Plaintiffs, Co-Lead Counsel, and those of the other class members, and Named Plaintiffs and CoLead Counsel share the other class members' interests in vigorously pursuing this case. All are equally interested in establishing 23andMe's liability.

C. Rule 23(b)(3) Requirements

The proposed settlement class also meets the predominance and superiority requirements in Rule 23(b). Common questions predominate over individual ones: the class claims, for instance, revolve around the data breach to which all class members were subject as well as 23andMe's security policies and response to the data breach. See In re Yahoo! Inc. Customer Data Sec. Breach Litig., No. 16-MD-02752-LHK, 2020 U.S. Dist. LEXIS 129939, at *37-38 (N.D. Cal. July 22, 2020) (stating that “the focus on a defendant's security measures in a data breach class action ‘is the precise type of predominant question that makes class-wide adjudication worthwhile'”). Admittedly, there may be some variation in class members' individual injuries, specifically, regarding damages; but even assuming such, that in and of itself does not negate predominance given the centrality of the common questions identified above to the resolution of the case. As the Ninth Circuit has noted, a district court may not

decline to certify a class that will require determination of some individualized questions at trial, so long as such questions do not predominate over the common questions. “When one or more of the central issues in the action are common to the class and can be said to predominate, the action may be considered proper under Rule 23(b)(3) even though other important matters will have to be tried separately, such as damages or some affirmative defenses peculiar to some individual class members.”

...[W]e have held that a district court is not precluded from certifying a class even if plaintiffs may have to prove individualized damages a trial, a conclusion implicitly based on the determination that such individualized issues do not predominate over common ones.

Olean Wholesale Groc. Coop., Inc. v. Bumble Bee Foods LLC, 31 F.4th 651, 668-69 (9th Cir. 2022) (quoting Tyson Foods, Inc. v. Bouaphakeo, 577 U.S. 442, 453 (2016)). “‘Class-wide proof is not required for all issues.'” Id. at 669 (emphasis added). Furthermore, individualized damages are questionable here given 23andMe's precarious financial status, and, putting damages aside, some relief sought is common to all class members, including the benefit of monitoring (Privacy Shield) and injunctive relief to change 23andMe's policies/practices.

Finally, the class device is a superior vehicle given the millions of 23andMe customers asserting claims and the limited relief available for each customer, particularly in light of 23andMe's financial status.

D. Summary

As reflected above, both Rule 23(a) and Rule 23(b)(3) have been satisfied, and therefore, certification of a settlement class is appropriate. The Court now turns to whether the Settling Parties' settlement of the class claims is fair, reasonable, and adequate.

V. PRELIMINARY APPROVAL OF CLASS ACTION SETTLEMENT

A. Legal Standard

Federal Rule of Civil Procedure 23(e) provides that "[t]he claims, issues, or defenses of a certified class - or a class proposed to be certified for purposes of settlement - may be settled . . . only with the court's approval." Fed.R.Civ.P. 23(e). If the proposed settlement “would bind class members, the court may approve it only after a hearing and only on finding that it is fair, reasonable, and adequate.” Fed.R.Civ.P. 23(e)(2). “These requirements are in place ‘[b]ecause of the unique due process concerns relating to absent class members and the inherent risk of collusion between class counsel and defense counsel.'” McKinney-Drobnis v. Oreshack, 16 F.4th 594, 606 (9th Cir. 2021); see also In re Syncor ERISA Litig., 516 F.3d 1095, 1100 (9th Cir. 2008) (noting that “[t]he purpose of Rule 23(e) is to protect the unnamed members of the class from unjust or unfair settlements affecting their rights”).

Where the parties reach a class action settlement prior to class certification, district courts apply "a higher standard of fairness and a more probing inquiry than may normally be required under Rule 23(e)." Dennis v. Kellogg Co., 697 F.3d 858, 864 (9th Cir. 2012) (internal quotation marks omitted); see also Roes v. SFBSC Mgmt., LLC, 944 F.3d 1035, 1048-49 (9th Cir. 2019) (noting that such settlement agreements "'must withstand an even higher level of scrutiny for evidence of collusion or other conflicts of interest than is ordinarily required under Rule 23(e) before securing the court's approval as fair'")). A more "exacting review is warranted to ensure that class representatives and their counsel do not secure a disproportionate benefit at the expense of the unnamed plaintiffs who class counsel had a duty to represent." Id. (internal quotation marks omitted).

“In 2018, Congress amended Rule 23(e)(2) to provide specific factors for a district court to consider in determining whether a settlement is ‘fair, reasonable, and adequate.'” McKinney-Drobnis v. Oreshack, 16 F.4th 594, 607 (9th Cir. 2021). Those factors are as follows:

(A) the class representatives and class counsel have adequately represented the class;

(B) the proposal was negotiated at arm's length;

(C) the relief provided for the class is adequate, taking into account:

(i) the costs, risks, and delay of trial and appeal;

(ii) the effectiveness of any proposed method of distributing relief to the class, including the method of processing class-member claims;

(iii) the terms of any proposed award of attorney's fees, including timing of payment; and

(iv) any agreement required to be identified under Rule 23(e)(3); and

(D) the proposal treats class members equitably relative to each other.

Fed. R. Civ. P. 23(e)(2).

Prior to Congress' 2018 codification of [the above] multifactor test . . ., [the Ninth Circuit] held that a district court "may consider some or all of the following factors" when assessing whether a proposed settlement meets [the fair, reasonable, and adequate] standard:

[1] the strength of plaintiffs' case; [2] the risk, expense, complexity, and likely duration of further litigation; [3] the risk of maintaining class action status throughout the trial; [4] the amount offered in settlement; [5] the extent of discovery completed, and the stage of the proceedings; [6] the experience and views of counsel; [7] the presence of a governmental participant; and [8] the reaction of the class members

to the proposed settlement.

Roes, 944 F.3d at 1048; see also Kim, 8 F.4th at 1178 (still considering these factors).

Finally, this District has adopted Procedural Guidance for Class Action Settlements, see https://cand.uscourts.gov/forms/procedural-guidance-for-class-action-settlements/ (last visited 11/25/2024), which addresses considerations for both preliminary and final approval of a class action settlement. For preliminary approval specifically, the Procedural Guidance informs settling parties to provide, inter alia, information about the settlement (e.g., the potential class recovery if plaintiffs had fully prevailed on their claims and a justification for the discount applied), settlement administration, class notice, attorneys' fees, and so forth. Preliminary approval

primarily evaluates whether "the proposed settlement appears to be the product of serious, informed, non-collusive negotiations, has no obvious deficiencies, does not improperly grant preferential treatment to class representatives or segments of the class, and falls within the range of possible approval. If preliminary approval is granted, notice is distributed to the class members and a final hearing is held to determine whether the settlement satisfies Rule 23(e)(2).

Lagunas v. Young Adult Inst., Inc., No. 23-cv-00654-RS, 2024 U.S. Dist. LEXIS 41242, at *6-7 (N.D. Cal. Mar. 8, 2024).

B. Application to Case at Bar

The Court has considered the Rule 23(e)(2), the Ninth Circuit factors identified above, and this District's Procedural Guidance in assessing whether preliminary approval should be granted in the case at bar. As stated in Lagunas, the ultimate question is whether the proposed settlement is sufficiently fair, reasonable, and adequate such that notice of the settlement should be issued to the class. The Court conditionally finds that the proposed settlement meets that threshold. Approval is conditioned on certain modifications identified below.

1. Strength of Class Claims and Litigation Risks

The Court begins its analysis of the settlement by considering what claims were asserted by Plaintiffs; what the maximum value of those claims would be if the class were to completely prevail at trial; and what litigation risks there were to the class's success. These considerations are clearly significant factors in assessing whether what Plaintiffs actually settled for falls within the range of fair, reasonable, and adequate.

As noted above, Plaintiffs have asserted a variety of claims: negligence-related claims, contract-related claims, claims related to invasion of privacy, an unjust enrichment claim, and claims for violation of state statutes (related to genetic privacy, confidentiality of medical information, consumer protection, etc.). Plaintiffs estimate that, if the class were to completely prevail at trial, then, in theory, it could be awarded almost $50 billion in damages, particularly because of (1) the size of the class (approximately 6.4 million members) and (2) statutory damages for certain claims. See Docket No. 123 (Supp. Br. at 10) (chart identifying maximum values).

However, the Settling Parties point out that each kind of claim has its own litigation risks. For example, on liability for the negligence-based claims, 23andMe could argue contributory negligence if a customer recycled login credentials or failed to use a unique password. See Prelim. App. Mot. at 15. And even if liability were not an issue, there are still notable litigation risks with respect damages. For example, if the class asserts that customers suffered losses as a result of the data breach, quantifying those losses - which could be both economic and noneconomic - could be difficult. In addition, variation in individual injuries suffered and potential damages claimable, while not necessarily preclusive of certification under Rule 23(b)(3) as noted above, poses challenges to establishing predominance and risk to class certification. Moreover, if the class contends that 23andMe has been unjustly enriched, “associating certain profits with 23andMe's broad misconduct in this case will likely be challenging.” Prelim. App. Mot. at 14. If the class seeks statutory damages, there could be due process concerns regarding the magnitude of statutory damages under the circumstances. See Wakefield v. ViSalus, Inc., 51 F.4th 1109, 1121-23 (9th Cir. 2022) (where defendant argued that due process required reduction of $925 million statutory damages award under the TCPA, holding that “aggregated statutory damages are, in certain extreme circumstances, subject to constitutional due process limitations,” “even where the prescribed per-violation award is constitutionally sound”; stating that, “where statutory damages no longer serve purely compensatory or deterrence goals, consideration of an award's reasonableness and proportionality to the violation and injury takes on heightened constitutional importance,” and then holding that aggregated statutory damages “are subject to constitutional limitation in extreme situations - that is, when they are ‘wholly disproportioned' and ‘obviously unreasonable' in relation to the goals of the statute and the conduct the statute prohibits”).

The biggest litigation risk in this case, however, is not related to either liability or damages but rather to 23andMe's financial condition - i.e., as a practical matter, whether the 23andMe would be able to pay the class if it were to succeed on the merits of the case. Even before the data breach was publicly announced in October 2023, 23andMe was in a precarious financial position. In September 2023, the company's stock started trading below $1.00. See Docket No. 103-5 (CoLead Counsel Decl. ¶ 29). By November 2023, about a month after the data breach was announced, “23andMe's stock was no longer in compliance with exchange regulations that require listed stock maintain a minimum bid price of $1 per share.” Docket No. 103-5 (Co-Lead Counsel Decl. ¶ 29).

By 2024, 23andMe's fortunes were not improving. This was confirmed by the forensic accounting firm that Plaintiffs' lawyers (including Co-Lead Counsel) hired prior to the second mediation with Mr. Wulff in March 2024.¹⁴ The firm summarized the company's financials as follows:

14 \At the direction of the Court, the Named Plaintiffs provided a copy of the report to the Court for in camera review. The Court has reviewed the report.

Operating Income had been negative, with losses between $185.2M [and] $234.8m in FY 2019 to 2022. These losses increased to $324.0m in FY 2023. For L9M 12/31/2023, losses are $189.0m. EBITDA has been negative, with losses between $161.1[]m and $211.1m in FY 2019 to 2022. These losses increased to $291.2[]m in FY 2023. For L9M 12/31/2023, losses are $243.3m. There was no analyst EBITDA estimate for FY 2024, but for FY 2025 and FY 2026, EBITDA is estimated by a single analyst at losses of $183.7m and $154.4m, respectively.

Docket No. 123 (Supp. Br. at 1).

The accounting firm also noted that 23andMe's cash position was not doing well as a result of operating losses, with recent data reflecting that 23andMe had about $242.4 million in cash as of December 2023 and an “average burn rate of approximately $45 million per quarter, [which would put the company] out of cash in the next 12 months, absent access to new capital.” Docket No. 123 (Supp. Br. at 2) (emphasis added). The firm added that there were “significant challenges raising new capital” in light of the above. Docket No. 123 (Supp. Br. at 2).

By the time of the settlement (as noted above, a settlement in principle was reached in midJuly 2024 and the agreement was signed in early September 2024), 23andMe's financial condition remained poor. For example, 23andMe's quarterly report from that period “revealed losses of $69.4 million on revenue of only $40.4 million.” Docket No. 103-5 (Co-Lead Counsel Decl. ¶ 30). In September 2024, the company's “stock was trading at an all-time low below $0.30 a share and the company had a market capitalization of roughly $150 million, having suffered a year over year loss of almost 33%.” Docket No. 103-5 (Co-Lead Counsel Decl. ¶ 31). In an attempt to keep the company afloat, 23andMe's CEO put forward a proposal to take the company private, but that proposal was rejected by a Special Committee of the Board of Directors. Subsequently, in midSeptember 2024, all seven of 23andMe's independent directors resigned. The independent Board members stated in a letter to the CEO that “we have yet to receive from you a fully financed, fully diligenced, actionable proposal that is in the best interests of the non-affiliated shareholders.” https://mvestors.23andme.com/news-releases/news-release-details/independent-directors-23andme-resign-board#:~:text=We%2C%20the%20independent%20directors%20of%20the%2023andMe%20Boar d%2C₁in%20the%20best%20interests%20of%20the%20non-affiliated%20shareholders (last visited 11/21/2024).

The hearing on the preliminary approval motion took place in late October 2024. Following the hearing, 23andMe released its 10-Q covering the period ending on September 30, 2024. The 10-Q confirmed that 23andMe's financial condition had deteriorated, stating as follows:

We incurred significant operating losses as reflected in our accumulated deficit and negative cash flows from operations. As of September 30, 2024, we had an accumulated deficit of $2.3 billion, and cash and cash equivalents of $126.6 million. We will need additional liquidity to fund our necessary expenditures and financial commitments for 12 months after the date that the unaudited condensed consolidated financial statements included in this Form 10-Q are issued. We have determined that, as of the

filing date of this report, there is substantial doubt about our ability to continue as a going concern.

To improve our financial condition and liquidity position, we are working to execute our business plan, manage ongoing operational expenses, and implement cost-cutting measures, as well as considering raising additional capital. Our ability to continue as a going concern, however, is contingent upon our ability to successfully implement our operational and financial plans, and if we fail to do so and/or are unable to raise sufficient capital or consummate a strategic transaction, we could be forced to modify or cease operations. While we believe in the viability of our strategy there are numerous risks and uncertainties may prevent, and there can be no assurances regarding, the successful implementation of our operational and financial plans and/or the consummation of any transactions.

Furthermore, the reaction of investors to our potential inability to continue as a going concern could also have a material and adverse impact on the price of our Class A common stock, which could negatively impact our ability to obtain stock-based financing or enter into strategic transactions. Additionally, the perception that we may not be able to continue as a going concern may cause prospective partners or collaborators to choose not to conduct business with us due to concerns about our ability to meet our contractual obligations and continue operating our business without interruption.

Docket No. 154-2 (Guyon Decl., Ex. 1, at 56) (emphasis added).

The 10-Q also provided new information:

• Effective October 16, 2024, the company “effected a one-for-twenty reverse stock split of all of our issued and outstanding shares of Class A common stock and Class B common stock, pursuant to which every twenty shares of our Class A common stock and Class B common stock were automatically combined into one issued and outstanding share of our respective Class A common stock and Class B common stock.” Docket No. 154-2 (Guyon Decl., Ex. 1, at 56). 23andMe took this action in response to its stock falling below $1 but, as noted in the 10-Q, the company “cannot assure you that the Reverse Stock Split will result in any or all of the expected benefits, including enabling us to maintain compliance with the Nasdaq listing standards for any meaningful period of time. While the reduction in the number of outstanding shares of our Class A common stock increased the market

price of our Class A common stock such that we were able to regain compliance with Nasdaq's Minimum Bid Requirement, we cannot assure you that the Reverse Stock Split will result in any permanent or sustained increase in the market price of our Class A common stock.” Docket No. 154-2 (Guyon Decl., Ex. 1, at 56). The Court takes judicial notice that 23andMe's stock price on November 21, 2024, was $3.23 per share and had fallen about 33% over the past month.

• The Board of Directors approved in November 2024 “a reduction in force involving 223 employees, representing approximately 40% of the Company's workforce,” and the reduction in force “includes ceasing additional development in the Company's two clinical trials and the closure of substantially all operations in the Company's Therapeutics business segment.” Docket No. 154-1 (Guyon Decl., Ex. 1, at 58).

Given 23andMe's dire financial situation, settling the case sooner rather than later was a reasonable approach by Class Counsel, and the amount of the settlement - though a fraction of the maximum value of the case - was also reasonable.

That the settlement falls within the range of reasonableness is also supported by the case comparison chart provided by Plaintiffs as part of their motion for preliminary approval. That chart details the results obtained in about a dozen other data breach or privacy cases involving large classes (most in the millions). See Prelim. App. Mot., Ex. C (chart). The settlement funds obtained in those cases ranged from $5-32 million (with small claims rates, as anticipated here). Though each case is different, and the instant case involves a potentially huge liability possibly worth billions if plaintiffs were to prevail, these statistics indicate that the settlement entered into by the Settling Parties is not patently unreasonable.

The reasonableness of the settlement is also supported by the fact that there were three rounds of mediation with Mr. Wulff, a respected and experienced mediator. Nothing about the mediation process suggests collusion or that discussions were anything but at arms' length.

The Court has considered the criticisms lodged by the Edelson firm which represents some of the objectors to the settlement. These criticisms, however, do not warrant rejection of the settlement.

For example, contrary to what the Edelson firm argues, Co-Lead Counsel did obtain 23andMe's insurance information in assessing the financial resources available to 23andMe; this information included the total coverage and what was left by the time the parties attended the first mediation in January 2024; the policy is a wasting policy.

As to criticism that Co-Lead Counsel relied exclusively on publicly available information about 23andMe, that is not patently unreasonable given that 23andMe is a public company with a strict legal duty to accurately report its finances.¹⁵ The Edelson firm points to nothing suggesting the information publicly filed by 23andMe was inaccurate or that there were any unreported assets or income.

15 The Court acknowledges that it does not appear Plaintiffs engaged in any discovery into the merits of the suit. However, given 23andMe's financial condition, it was reasonable to put priority into investigation of that status.

Edelson reminds the Court that, in conjunction with the motion to appoint counsel it filed (which the Court ultimately denied), it hired experts to conduct a survey of about 400 putative class members. Edelson suggests that those surveyed indicated that they valued monetary relief more than injunctive relief such as credit monitoring. But this is not an entirely accurate representation of the survey. The surveyed individuals did indicate that larger cash payments are important to them, but that does not mean that monitoring is not important, and the surveyed individuals clearly did not express any opinions on the kind of monitoring provided by Privacy Shield which involves more than just credit monitoring. In any event, even if the class valued monetary relief more than anything else, that is not the issue here. The issue here, is even if the class preferred substantial cash in settlement, the class must face the reality of 23andMe's precarious finances.

The Edelson firm suggests that more money could have been put on the table because there are other entities that could contribute money, i.e., not just 23andMe. But here, Edelson is not referring to an insurance company but rather 23andMe's alleged relationship with third parties such as GlaxoSmithKline. According to Edelson, 23andMe has a research partnership with GlaxoSmithKline which involves the former giving the latter genetic information about its customers without their informed consent. Edelson adds that, “just after [this] lawsuit was filed,” 23andMe stated that it planned to expand these efforts to other third parties. Docket No. 118 (Edelson Opp'n at 4). But nothing suggests there currently exists any real possibility of a real opportunity sufficient to turn 23andMe's finances; nothing has changed the public's evaluation of 23andMe as expressed in its stock prices. Furthermore, Edelson's suggestion that the release in the settlement agreement is too broad and covers the putative misconduct by 23andMe of giving genetic information without consent is wrong. The Settling Parties have now expressly made clear that the release does “not extend to the sale of customer information to GlaxoSmithKline.” Docket No. 155 (Jt. Rpt. at 1).

Finally, the Edelson firm suggests that more money could have been obtained had Co-Lead Counsel taken a more creative approach - e.g., payments could have been made to the class over time, or there could have been a “‘future-stakes settlement,' which would provide the Class the same upside the CEO expects to see when she takes the company private at a more than $229,000,000 valuation.” Docket No. 118 (Edelson Opp'n at 4). But given the current public reportage, any such pot at the end of the rainbow is speculative. As noted above, the most recent 10-Q states that there is a substantial risk that 23andMe will not continue as a going concern. Furthermore, the Special Committee for the 23andMe Board rejected the CEO's proposal to take the company private, and nothing concrete supports a valuation of $229 million, particularly at this time. Indeed, as noted above, all of 23andMe's independent Board members resigned en masse, indicating to the CEO that they were doing so because they could not see a clear path forward for the company. The failure of the Settling Parties to include a future stakes element is not unreasonable under the circumstances.¹⁶

16 Upon inquiry at the hearing by the Court on this point, Co-Class Counsel indicated 23andMe refused any such term.

2. Equitable Treatment of Class Members

The plan of allocation provided for in the settlement (i.e., the Settlement Benefits Plan) is also fair, reasonable, and adequate. It was not unreasonable for Plaintiffs to reject the option of giving all class members a portion of the $30 million gross settlement fund, as this would mean a very small monetary award for each class member. See Docket No. 123 (Supp. Br. at 15 (maintaining that it was more meaningful to get monitoring for the entire class and then tailoring the remaining funds to redress other specific injuries experienced). It was also reasonable for Plaintiffs to focus on addressing specific injuries such as common expenses incurred as a result of the data breach (Extraordinary Claims), to provide for damages based on the disclosure of particularly sensitive personal information (Health Information Claims), and to account for the “concrete” damages that could be obtained through claims providing for statutory damages (Statutory Cash Claims).

Plaintiffs also provided a fair explanation as to the Court's inquiry as to why those customers who are of Ashkenazi Jewish or Chinese descent - whose information was targeted for sale on the dark web - were not specifically addressed in the plan of allocation. See CAC ¶ 4 (“Among those specifically targeted for sale on the dark web are the 23andMe customers of Chinese and Ashkenazi Jewish descent, who face particularly acute dangers on account of being targeted because of antisemitism and anti-Asian ideologies.”). Plaintiffs noted that

Privacy & Medical Shield + Genetic Monitoring was designed to provide specific remedies to Settlement Class Members in the putatively-targeted groups, as it provides monitoring for genetic information on the dark web and will assist Settlement Class Members in remediation efforts if such information is located. Further, the types of out-of-pocket costs reimbursable under Extraordinary Claims were also designed with specific considerations for the putatively targeted groups as Plaintiffs of the targeted groups reported that after the Security Incident, they were fearful and therefore purchased security systems or went to counseling - reimbursable expenses under the Settlement.

Docket No. 123 (Supp. Br. at 18).

Furthermore, to address the concerns that those of Chinese or Ashkenazi Jewish descent whose data, as disclosed on the dark web, was exfiltrated, the Court directed the parties to give special notice to those class members to help insure they are made aware of that fact and the value of the Privacy Shield (which, as discussed above, provides benefits such as monitoring of the dark web and websites that traffic in stolen data). The email notice to these class members expressly states on the first page: “Your information is known to have been exposed to the dark web and you are entitled to benefits under the Settlement.” Docket No. 155 (Jt. Rpt., Ex. A (notice) (emphasis in original). To the extent any such class member incurred extraordinary expenses because of such disclosure, they have the right to make an Extraordinary Claim, for up to $10,000. No objector explained how or why these remedies afforded under the proposed settlement are less adequate for this group than as for the rest of the class, especially in view of the limited resources available to fund the settlement.

The objectors represented by the Edelson firm bring up one point that is worth some consideration - i.e., for the Statutory Cash Claims, why are all claimants treated the same when the statutory damages differ for the relevant states?

• Alaska: $5,000 or $100,000 if the violation resulted in monetary gain¹⁷;

• California: $1,000 in nominal damages plus $3,000 if punitives¹⁸;

• Illinois: $2,500 or $15,000 if the conduct is intentional or reckless¹⁹;

• Oregon: $100 or $150,000 if there is a knowing violation based on a fraudulent misrepresentation.²⁰

See also Supp. Br. at 10; Docket No. 118 (Edelson Opp'n at 7). But Plaintiffs²¹ have a sufficient explanation for their approach here as well. Plaintiffs acknowledge that the different states have different statutory damages, but it is not unfair to provide the same relief regardless of the state involved because: (1) due process would put a limit on statutory damages (collectively in the millions or billions) and (2) 23andMe's financial condition also essentially caps monetary relief. Plaintiffs assert: “In light of this effective cap on recovery resulting from due process and financial solvency considerations, the discounts applied to the statutory claims increase in proportion to the statutory damages available under each of these claims.” Docket No. 127 (Pls.' Opp'n at 19) (emphasis added). In other words, due process and the limited resources available to fund the settlement effectively compress the differences in statutory damages that can be claimed. In addition, it is not at all clear that, if litigated to conclusion, class members would actually receive the full limit of statutory damages, whether because of potential due process limits or because of the terms of the statute allowing for a range of statutory damages. Finally, as Plaintiffs note, even though the states provide for different relief, the individuals essentially suffered the same injury.

17 For the Alaska Genetic Privacy Act, see Alaska Stat. § 18.13.010 et seq. See id. § 18.13.020 (“In addition to the actual damages suffered by the person, a person violating this chapter shall be liable to the person for damages in the amount of $5,000 or, if the violation resulted in profit or monetary gain to the violator, $100,000.”).

18 For the California Confidentiality of Medical Information Act, see Cal. Civ. Code § 56 et seq. See id. § 56.35 (“In addition to any other remedies available at law, a patient whose medical information has been used or disclosed in violation of Section 56.10, 56.104, 56.107, or 56.20 or subdivision (a) of Section 56.26 and who has sustained economic loss or personal injury therefrom may recover compensatory damages, punitive damages not to exceed three thousand dollars ($3,000), attorney's fees not to exceed one thousand dollars ($1,000), and the costs of litigation.”).

19 For the Illinois Genetic Information Privacy Act, see 410 Ill. Comp. Stat. Ann. 513 et seq. See id. § 513/340(a) (“A prevailing party may recover for each violation: (1) Against any party who negligently violates a provision of this Act, liquidated damages of $2,500 or actual damages whichever is greater. (2) Against any party who intentionally or recklessly violates a provision of this Act, liquidated damages of $15,000 or actual damages, whichever is greater.”).

20 For the Oregon Genetic Privacy Law, see Or. Rev. Stat. § 192.531 et seq. See id. §§ 192.541 (providing for statutory damages as low as $100 and $1,000 for an inadvertent violation and as high as $25,000 or $250,000 for a knowing violation with intent to use for commercial advantage).

21 Plaintiffs include individuals from each of the above states. See CAC ¶¶ 13, 25 (two named plaintiffs from Alaska); CAC ¶¶ 37, 48, 59, 70 (three named plaintiffs from California); CAC ¶¶ 137, 149, 161 (three named plaintiffs from Illinois); CAC ¶¶ 288, 300 (two named plaintiffs from Oregon).

3. Distribution of Relief to the Class

The Court has considered the means of getting monetary relief to the class. It is reasonable to include a claims process even though it is expected that the claims rate will be small. A claims process is needed for Extraordinary Claims as, without a claim, it is not clear what a class member may be claiming as expenses incurred because of the data breach. Also, a claims process is reasonable for Statutory Cash Claims since affirmation is needed that an individual lived in one of the states with statutory damages claims during the relevant period.

The Court, however, is not persuaded that a claims process is needed for Health Information Claims when 23andMe already knows which individuals have such claims. True, these individuals can also make Extraordinary Claims and Statutory Cash Claims. But the notice(s) to the class can simply inform the class about the three types of claims and explain that checks will automatically be issued to those with Health Information Claims whereas claims must be submitted for Extraordinary Claims and Statutory Cash Claims. The checks issued for Health

Information Claims can include language on the back of each check reflecting that cashing the check means that the person is deciding to remain in the class and participate in the settlement instead of opting out. The Court leaves to the Settling Parties to determine with the settlement administrator whether it makes sense to issue separate checks for each type of claim.

The Court's granting of preliminary approval is conditioned on making this change to the settlement.

4. Attorneys' Fees

Where a settlement produces a common fund for the benefit of the entire class, courts have discretion to employ either the lodestar method or the percentage-of-recovery method. Because the benefit to the class is easily quantified in common-fund settlements, [the Ninth Circuit has] allowed courts to award attorneys a percentage of the common fund in lieu of the often more time-consuming task of calculating the lodestar. Applying this calculation method, courts typically calculate 25% of the fund as the "benchmark" for a reasonable fee award, providing adequate explanation in the record of any "special circumstances" justifying a departure.

Though courts have discretion to choose which calculation method they use, their discretion must be exercised so as to achieve a reasonable result. Thus, for example, where awarding 25% of a "mega-fund" would yield windfall profits for class counsel in light of the hours spent on the case, courts should adjust the bench-mark percentage or employ the lodestar method instead.

In re Bluetooth Headset Prods. Liab. Litig., 654 F.3d 935, 942 (9th Cir. 2011).

In the case at bar, Plaintiffs are asking for 25% of the gross settlement for attorneys' fees -i.e., $7.5 million. In their papers, Plaintiffs admit that the lodestar to date is notably less than $7.5 million:

• Though July 31, 2024, Co-Lead Counsel (three firms) incurred fees in the amount of $2,666,482. See Docket No. 103-5 (Co-Lead Counsel Decl. ¶ 51). This reflects work that was done both before the three firms were appointed Co-Lead Counsel and after. See Docket No. 123 (Supp. Br., Ex. 1) (1,112.1 preappointment hours); Docket No. 123 (Supp. Br., Ex. 2) (1,229.7 postappointment hours). The total hours are 2,341.8. See Docket No. 123 (Supp. Br., Ex. 3).

• After Co-Lead Counsel was appointed, they authorized some work to be done by attorneys at different firms. Fees incurred were $257,035, representing work done

by 22 firms. See Docket No. 103-5 (Co-Lead Counsel Decl. ¶ 54). The total hours are 399.4. See Docket No. 123 (Supp. Br., Ex. 2).

• Co-Lead Counsel also determined that some of the pre-appointment work that attorneys not selected as Co-Lead Counsel should be compensated. “Specifically, time associated with Settlement, Experts, and Discovery . . . should be compensable time because that time contributed to the Settlement.” Docket No. 103-5 (Co-Lead Counsel ¶ 53). Fees here amounted to $637,817. See Docket No. 103-5 (Co-Lead Counsel Decl. ¶ 53). The total hours are 610.8. See Docket No. 123 (Supp. Br., Ex. 1).

The three figures above total $3,361,333, representing 3,352 hours (1,722.9 preappointment hours and 1,629.1 postappointment hours). See Docket No. 103-5 (Co-Lead Counsel Decl. ¶ 55). (This represents a blended hourly rate of $1,002.78.) Thus, the lodestar is about half of the fee award requested.

Plaintiffs contend, however, that they also expect their attorneys to spend

thousands of hours of future work on the Settlement. That work includes briefing Plaintiffs' Motion for Final Approval of the Settlement and Motion for Attorneys' Fees, responding to any objections, appearing at the Final Approval Hearing, handling any appeals, and assisting Settlement Class Members in securing benefits available under the Settlement. The estimate is further informed by considering the time incurred after the submission of preliminary approval in similar cases, which typically exceeds 2,000 hours, and is often substantially more. Therefore, based on the average hourly rate on the time incurred to date, Interim Co-Lead Counsel expects to incur approximately $1,500,000 in additional lodestar.

....The total compensable lodestar incurred plus the expected future lodestar is approximately $5,060,000. Based on a fee request of 25% [of the gross settlement fund], the multiplier on such lodestar is just over 1.48.

Docket No. 103-5 (Co-Lead Counsel ¶¶ 56-57) (emphasis added).

The Court has serious concerns about the fee request, notwithstanding the fact that the 25% request is the benchmark. Plaintiffs are asking for $7.5 million for basically one year's work plus some work post-approval. This is a significant ask given that there was no real substantive litigation in the case and that the parties immediately went into settlement discussions.

Furthermore, there are numerous examples of questionable hours. For example:

• For preappointment work generally, the total hours are 1,722.9. Those hours may include duplicative work, especially since Co-Lead Counsel is counting all of the three firms' preappointment time. See Docket No. 123 (Supp. Br., Ex. 1). Why should all three firms' work preappointment count without some discount for duplicative work or inefficiencies?

• For preappointment work, how are there 126.2 hours for Court appearances? See Docket No. 123 (Supp. Br., Ex. 1) (column 5).

• For preappointment work, how are there 885 hours for settlement, even if attorneys outside of Co-Lead Counsel are getting credit? See Docket No. 123 (Supp. Br., Ex. 1) (column 13).

• For postappointment work, how are there 796.1 hours for pleadings and pretrial motions? See Docket No. 123 (Supp. Br., Ex. 2) (column 11). Out of those hours, Co-Lead Counsel accounted for 526.8 hours.

• For postappointment work, how are there 323.6 hours for settlement? See Supp. Br., Ex. 2 (column 13). The three firms making up Co-Lead Counsel spent 82 hours, 89.3 hours, and 131.2 hours. As a facial matter, there may be duplication. The Court also bears in mind that counsel were appointed in June 2024; the settlement agreement was signed in September 2024.

The Edelson firm contends that Co-Lead Counsel should now be removed because of the inadequate work that they did and the unreasonable fees being sought. That is a stretch. The Edelson firm also points out that it was willing to take the case for a 20% cut of any settlement fund, but given that this case settled without any substantive litigation, the Court need not accede to an after-the-fact low bidder in assessing the reasonableness of fees actually incurred by CoLead Counsel.

The Court's analysis above gives a preview for Plaintiffs of concerns that it has for final approval. The Court's concerns above, however, are not a reason to reject the settlement - at least for purposes of preliminary approval - because, if the full amount of fees requested is not awarded, no money reverts back to 23andMe. Rather, that money will be part of the distribution to the class. Though the Court has serious concerns about the amount of attorneys' fees, the Court does not find evidence suggesting collusion between Class Counsel and 23andMe, which would be a reason to deny preliminary approval. Cf. In re Bluetooth Headset Prods. Liab. Litig., 654 F.3d 935, 947 (9th Cir. 2011) (directing courts to be aware of “more subtle signs that class counsel have allowed pursuit of their own self-interests and that of certain class members to infect the negotiations”; such signs include, e.g., “‘when counsel receive a disproportionate distribution of the settlement,'” “when the parties negotiate a ‘clear sailing' arrangement providing for the payment of attorneys' fees separate and apart from class funds”; and “when the parties arrange for fees not awarded to revert to defendants rather than be added to the class fund”).

5. Preliminary Injunction

As noted above, as part of the settlement agreement, the Settling Parties ask the Court to approve a preliminary injunction barring

all Settlement Class Members and their representatives from filing, commencing, prosecuting, maintaining, intervening in, conducting, continuing, or participating in any other lawsuit or administrative, regulatory, arbitration or other proceeding based on the Released Claims, unless and until they personally submit a timely request for individual exclusion pursuant to the Settlement Agreement after receiving Notice.

Sett. Agmt. ¶ 73(h).

The preliminary injunction was vigorously contested by the Arbitrating Objectors represented by the Milberg, Levi, and Labaton law firms. However, because the settlement class certified by the Court excludes those who seek arbitration, any dispute here is moot.

That being said, after the hearing on preliminary approval, the Potter firm, which represents 23andMe customers who filed suit in state court, filed a motion to intervene in which its clients also contested the preliminary injunction provision. Although the Court could well strike that motion as untimely - there is no dispute that Potter has known about this suit - the Court shall still consider the motion in the interest of justice. The Court denies the motion to intervene, just as it denied the motion to intervene filed by the Arbitrating Objectors. There is no need for the Potter clients to intervene in order to make their views known; the Court is considering their arguments.

As to the substance of the objection, the Court declines to issue any preliminary injunction. A preliminary injunction requires a showing of irreparable injury; here, the Settling Parties have not shown that continuation of the state court proceedings would pose any immediate financial hardship on 23andMe (which might endanger the $30 million set aside for the settlement in this case). The Court also notes that the Settling Parties agreed that the preliminary injunction provision could be severed without upending the settlement. The Settling Parties suggest that they are not seeking a “traditional” preliminary injunction which turns on factors such as irreparable injury and likelihood of success on the merits; rather, they ask for a preliminary injunction pursuant to the All Writs Act and Anti-Injunction Act. See Sandpiper Vill. Condo. Ass'n, Inc. v. La.-Pac. Corp., 428 F.3d 831, 845 (9th Cir. 2005) (taking note of Ninth Circuit precedent holding that “a temporary stay pending settlement of the nationwide class action was appropriate under the All Writs Act and the Anti-Injunction Act because concurrent state proceedings at such a sensitive stage in the federal proceedings would have threatened the jurisdiction of the district court”; “a competing state class action covering a portion of the federal class posed a significant danger to the delicate and transitory process of approving a settlement agreement, and thereby threatened the district court's ability to resolve the litigation”). The Court acknowledges Sandpiper but notes that the record at this point does not suggest that the state court litigation is forging ahead in such a way that would disrupt the settlement process here. Indeed, the Settling Parties have reported that, on October 31, 2024, i.e., after the preliminary approval hearing before this Court, the state court presiding over the state court cases extended the stay of its cases until January 30, 2025, because of the proceedings in this case. See Docket No. 157 (Opp'n at 4). And, although at this juncture, the Court is not issuing a preliminary injunction to stay the state court suits, its ruling here does not bar the state court from continuing to stay its own proceedings should it so choose. The Settling Parties are also free to renew their request for relief should circumstances change.

The Court acknowledges the Potter clients' position that they, like those seeking arbitration, should actually be excluded from the definition of the class. However, exclusion of those individuals in arbitration was predicated on a contractual right to arbitration and the inability of this Court to adjudicate their rights in circumvention of their contractual right to arbitration, as recognized by the Federal Arbitration Act. There is no comparable right here. Though the Potter clients have a right to litigate in their chosen forum, that does not mean that they should be excluded from the class here in the first instance. Federal class settlements often sweep within its ambit class members who fall into putative classes in state class action lawsuits. Of course, in Rule 23(b)(3) class actions, those involved in state court suits may opt out of the federal class action settlement and continue to pursue their claims in state court.

The Potter clients suggest that, even if not excluded ab initio from the class herein, they should be deemed to have opted out of the settlement because they filed their own lawsuits in state court. The problem here is that, until the Court approves the Settling Parties' settlement, there is nothing for them to opt out of. Cf. In re Cathode Ray Tube (CRT) Antitrust Litig., No. C-07-5944-SC, 2014 U.S. Dist. LEXIS 117792, at *98 (N.D. Cal. Aug. 20, 2014) (“[T]he ‘mere pendency and continued prosecution of a separate suit, which the litigant instituted before commencement of the “opt-out” period in a related class action, neither registers nor preserves a litigant's “opt out” of the related class action.'”) (emphasis in original); Bowman v. UBS Fin. Servs., Inc., No. C 04 3525 MMC, 2007 WL 1456037, at *2 (N.D. Cal. May 17, 2007) (same).

Thus, the Potter clients and any other state court litigants appear to fall within the definition of the settlement class here and therefore will be directly issued the class notice(s) approved by the Court. The Potter clients may opt out of the settlement but en masse objections will not be permitted. See In re CenturyLink Sales Pracs. & Sec. Litig., MDL No. 17-2795 (MJD/KMM), 2020 U.S. Dist. LEXIS 114110, at *9-10 (D. Minn. June 29, 2020) (explaining that “the requirement that a class member must individually sign is vital, because it ensures that the class member is individually consenting to opt out, and avoids a third party or lawyer representing that they have that class member's authority, without the class member making an informed, individual decision”).

6. Class Notices

The final issue for the Court is the propriety of the class notices. The Settling Parties have revised some of the class notice documents. The revised documents are attached to the status report at Docket No. 155.

• Exhibits A and B: Email (Short-Form) Notice and redlined version. This email notice is for class members whose information was known to be on the dark web.

• Exhibits C and D: Email (Short-Form) Notice and redlined version. This email notice is for class members who may or may not have had their information displayed on the dark web.

• Exhibits E and F: Long-Form (Settlement Website) Notice and redlined version.

• Exhibits G and H: Claim Form and redlined version.

• Exhibits I and J: Opt-Out Form and redlined version.

Except for the opt-out form, all other documents above will need to be modified to reflect that persons with Health Information Claims do not need to submit claims but rather will be issued checks outright. If documents in addition to those above need to be modified for the same reason, the parties shall do so. Other modifications required by the Court are discussed below.

a. Exhibits G-H: Claim Form and Redlined Version

The Claim Form should be further modified.

• Page 1. Two sentences should be added to the end of the first paragraph: “Benefits include a three-year monitoring service and cash benefits. You must submit this Claim Form to get any of the benefits available under the Settlement, including the three-year monitoring service. You may ask to be enrolled in the monitoring service even if you do not qualify for any cash benefits.”

• Page 1. The second and third paragraphs should be modified to read as follows: “You may submit this Claim Form by (1) filling out the form and submitting it online at www.23andMeDataSettlement.com or (2) completing the form and mailing it to the mailing address above. If you are making a claim for cash benefits and want to receive an electronic payment, you must file your claim online. If you mail this Claim Form and make a claim for cash benefits, you will receive your payment via check.”

• Page 2. The bolded paragraph that has center placement should be modified. The following sentence should be added at the end: “Claims asking for enrollment in

the monitoring service may be submitted (online or via mail) at any time during the three-year period the service is being offered.” If specific dates can be added, that would be helpful.

b. Exhibits I-J: Opt-Out Forms

The settling parties have provided an online version and a mail version. Both are reasonable.

The Settling Parties have, as requested by the Court, dropped the requirement that an online opt out be verified by email.

In addition, the Settling Parties have agreed to extend the opt-out period by ten (10) days. So as to minimize the risk of confusion, the ten-day extension should be given to the filing of claims and objections as well - i.e., so that the response date for all three is the same.

c. Exhibits A-B and C-D: Email (Short-Form) Notice

As an initial matter, the Court shall require the Settling Parties and/or the settlement administrator to keep track of (1) whether any emails issued bounced back and (2) whether emails that were sent were actually opened. The Court acknowledges the Settling Parties' comment that information on (2) is “limited in its accuracy and reliability due to technological developments in privacy software.” Docket No. 123 (Supp. Br. at 23). Nevertheless, the information should still be maintained as it could be informative at final approval.

As requested by the Court, the parties have modified the Email Notice so that there are now two Email Notices - one for class members whose information was known to be available on the dark web and one for class members whose information may or may not have been. Both Email Notices also include new information about Privacy Shield.

Some further changes to the Email Notice should be made.

• Page 2. The section on “How to Get Benefits” should be modified. Item (4) should be modified so that it mimics items (1)-(3) - i.e., to enroll in Privacy Shield, a class member must submit a Claim Form (instead of “us[ing] the link below”). The Court suggests as follows: “To pre-enroll in this service, submit a Claim Form. You will receive an email containing instructions on how to begin

this service once the Settlement is approved and becomes final.”

• Page 2. The final paragraph in the same section above (“How to Get Benefits”) should be modified to read as follows: “Use your unique ClaimID and PIN (located at the top of this email) to file your Claim Form online at www.23andMeDataSettlement.com. You can also download a Claim Form from the Settlement Website or request one by calling toll free 1-888-726-1664, and then mail in the Claim Form. If you are asking for any cash benefits, you must submit or mail (postmark) your Claim Form by xxx. If you are asking only to enroll in the three-year monitoring service, you can submit or mail your Claim Form at any time during the three-year period the service is being offered.” If specific dates can be added, that would be helpful.

d. Exhibits E-F: Long-Form (Settlement Website) Notice

The revisions to the Long-Form Notice are generally reasonable. However, the section on objections should be modified (Question 32). Language should be added to clarify that information verifying one's status as a member of the class also includes a person's unique Claim ID located on the email notice.

VI. CONCLUSION

For the foregoing reasons, the Court conditionally grants preliminary approval to the proposed class action settlement. The Settling Parties shall report back within two weeks of the date of this order to confirm whether modifications have been made consistent with the Court's rulings herein. The Court also orders the Settling Parties and the Arbitrating Objectors to report back within two weeks on the language of a notice to be issued to those individuals seeking arbitration who have been excluded from the class definition.

This order disposes of Docket Nos. 103 and 152.

IT IS SO ORDERED.