As Facebook Inc.'s (FB) troubles related to its handling of user data continue to pile up, experts say the financial impact from lawsuits brought by users and shareholders is likely to be minimal -- at least compared to the reputational damage suffered by the company.
But it also appears that the social media giant's change to its terms of service back in 2009 may be compounding its legal problems.
Previously, Facebook had a binding arbitration agreement in its terms of service, which required users to settle legal disputes with the company outside of court (these terms can be seen in an archived version of the user agreement).
But in 2009, the company replaced that policy in its current terms of service with a "choice of forum" clause, which allows lawsuits but compels them to filed "exclusively in the U.S. District Court for the Northern District of California or in a state court in San Mateo County."
There are currently at least 16 lawsuits that have been filed against Facebook since last week in connection with data privacy issues, including several class action suits.
"If [companies] don't have a binding arbitration agreement, then they have to go through the class action slog," said Andrew Stoltmann, a securities fraud attorney based in Chicago. "It's long, it's expensive and companies hate it."
Facebook didn't immediately respond to requests for comment on why it had changed its terms of service in 2009. But the removal of the arbitration clause "may have been demonstrating goodwill with Facebook's customer base," said N. Cameron Russell, adjunct professor at Fordham Law School.
Marc Melzer, a lawyer at Hoguet Newman Regal & Kenney, LLP in New York who works with clients to draft such agreements, said he would be surprised if Facebook voluntarily chose to get rid of its arbitration clause.
"When we advise clients, we say that unless they will take a hit from a PR perspective, it makes more sense to have a binding arbitration agreement," Melzer said.
Going forward, Facebook is going to face a "tsunami" of private litigation and litigation from regulators, Stoltmann said, estimating that there will be least another 15 class action lawsuits in the next month. But Stoltmann and others say that at this point, it's too difficult for anyone to know the extent of Facebook's liability.
There are two main groups suing the company -- users claiming that Facebook violated privacy laws among other things, and investors accusing the company of failing to uphold its fiduciary duty to shareholders. Unfortunately, Stoltmann said proving liability or damages in either case won't be easy for the Facebook users.
"There's a jambalaya of statutes and regulations that were potentially violated," Stoltmann said, noting that some may are federal and some are at the state level.
Data breach class action settlements typically have relatively small payouts, given that it is hard to prove individual damages in cases like these. For instance, in 2015 retail giant Target (TGT) offered to settle a class action lawsuit for $10 million after a massive breach of customer data back in 2013. And while Equifax Inc. (EFX) faces a multi-billion dollar class action lawsuit after hackers obtained the personal data of 143 million users in 2017, Stoltmann said it's challenging to quantify and prove damages in cases of data breaches.
Shareholders suing Facebook have an easier time proving the company's fault and demonstrating damages, which can be seen in its plummeting share price.
"The officers of Facebook owed a fiduciary duty to investors to deal truthfully and honestly with them," Stoltmann said. "They may have given erroneous guidance on valuation of the company ... and they knew or should have known [that] those representations were false and immaterial."
But even if there are hundreds of millions of dollars of payouts, which is far from certain, Stoltmann said that's a "glorified rounding error for Facebook." "The real issue is the impact of the litigation and government investigations on public trust."