Meta settles shareholder lawsuit for $190 million over privacy failures

A Delaware court filing on November 20, 2025 revealed that Meta Platforms reached a $190 million settlement with shareholders who accused the company's directors and officers of failing to prevent massive privacy violations. According to the stipulation agreement, the derivative lawsuit consolidates claims dating back to April 2018 when shareholders first challenged Meta's handling of the Cambridge Analytica scandal and subsequent Federal Trade Commission enforcement actions.

The settlement resolves seven years of litigation that began when Karen Sbriglio filed the initial derivative complaint on April 25, 2018. According to the court document, shareholders alleged that Meta's board of directors breached fiduciary duties by failing to implement adequate privacy controls, leading to violations of a 2012 FTC consent order and ultimately costing the company $5 billion in settlement payments to regulators.

Three institutional investors served as co-lead plaintiffs: California State Teachers' Retirement System, Construction and General Building Laborers' Local Union No. 79 General Fund, and City of Birmingham Retirement and Relief System. According to the filing, these plaintiffs obtained more than 1.7 million documents totaling over 9 million pages during discovery. The litigation included depositions of 27 fact witnesses, including Meta CEO Mark Zuckerberg, former COO Sheryl Sandberg, and multiple board members.

The $190 million represents the total settlement amount, including attorneys' fees. Plaintiffs' counsel plans to petition for fees up to 30% of the monetary settlement, according to the stipulation. The remaining funds will go directly to Meta rather than individual shareholders, consistent with derivative lawsuit structures where the corporation is considered the injured party.

Privacy enforcement triggered shareholder action

The FTC announced on March 26, 2018 that it was investigating Meta's privacy practices and compliance with the 2012 consent order. According to the court filing, this announcement came after revelations that Cambridge Analytica obtained personal data from approximately 87 million Facebook users without proper authorization. The scandal triggered congressional hearings and regulatory scrutiny across multiple jurisdictions.

Meta's board approved the $5 billion FTC settlement on June 12, 2019. According to the stipulation, this settlement included not only the monetary payment but also extensive corporate governance reforms and a 20-year consent order restricting Meta's business operations. The FTC and Department of Justice stipulated to this consent order on July 24, 2019.

Shareholders argued that these costs resulted from board failures rather than mere business risks. According to the consolidated complaint filed November 4, 2021, plaintiffs alleged three counts: breach of fiduciary duty against officers Zuckerberg, Sandberg, and Konstantinos Papamiltiadis; breach of fiduciary duty against the full board of directors; and insider trading claims under Brophy doctrine against executives who sold stock while allegedly aware of privacy violations.

The Delaware Court of Chancery denied defendants' motion to dismiss the fiduciary duty claims on May 10, 2023, allowing the case to proceed toward trial. According to the court's ruling, plaintiffs presented sufficient evidence to support claims that directors failed to implement proper oversight systems for privacy compliance. The court dismissed the insider trading claims against all defendants except Zuckerberg.

Extended discovery revealed internal communications

Discovery in the case proved extensive. Between September 24, 2024 and February 26, 2025, co-lead plaintiffs deposed 27 witnesses, according to the stipulation. The deposition list included current and former Meta executives, board members, and compliance officers. Defendants similarly deposed expert witnesses and the co-lead plaintiffs themselves.

The plaintiffs served Meta with four sets of document requests, four sets of interrogatories, and one set of requests for admissions between May 22, 2023 and November 4, 2024. According to the filing, plaintiffs also served subpoenas on over 30 third parties, including accounting firm PricewaterhouseCoopers, law firms representing Meta, and technology companies including Dropbox, Spotify, Netflix, Microsoft, Apple, Amazon, and Alphabet.

Meta initially produced 4,675 books and records totaling 33,888 pages in response to Section 220 inspection demands filed by shareholders in 2018 and 2019. According to the stipulation, three shareholders pursued separate Section 220 actions seeking access to corporate records before filing the consolidated derivative complaint. The Court of Chancery ordered Meta to produce these materials on June 24, 2019 after a trial in the consolidated books-and-records litigation.

Discovery disputes continued throughout the litigation. According to the court filing, co-lead plaintiffs filed a motion for sanctions against Sandberg and director Jeffrey Zients on September 25, 2024, alleging failures to preserve evidence. The court granted this motion in part on January 21, 2025. Plaintiffs also filed a motion on December 11, 2024 seeking to depose Zuckerberg in accordance with Chancery Court rules, which the court granted on January 15, 2025.

Settlement includes corporate governance reforms

Beyond the monetary payment, Meta agreed to implement corporate governance measures within 90 business days after the settlement becomes effective. According to Exhibit A of the stipulation, these measures address board oversight of privacy and data security. The specific reforms remain confidential in the publicly filed version of the settlement agreement.

The parties agreed that these governance measures "confer substantial benefits on Meta and its stockholders" and that plaintiffs' efforts "caused, or otherwise substantially and materially contributed to" these reforms. According to the stipulation, Meta further acknowledged that the litigation "was a significant factor in the Company appointing multiple new independent directors to the Board since April 2018."

Four mediation sessions preceded the final settlement. According to the court filing, parties engaged in unsuccessful all-day mediations on November 12, 2024, February 13, 2025, March 31, 2025, and June 3, 2025 under the Honorable Layn R. Phillips as mediator. Trial was originally scheduled for April 2025 but was rescheduled to July 16-25, 2025.

The settlement came after the first day of trial on July 16, 2025. According to the stipulation, on the morning of July 17, 2025, following receipt of a mediator's proposal, co-lead plaintiffs and defendants reached an agreement in principle to settle all claims. The formal stipulation was executed on November 20, 2025.

Significance for digital advertising accountability

The settlement reflects growing shareholder willingness to pursue derivative claims against technology company boards over privacy compliance failures. Federal regulators have intensified enforcement actions against major platforms, creating potential liability that shareholders may attribute to board oversight failures rather than business judgment.

Meta faces ongoing regulatory challenges across multiple jurisdictions. Spanish courts ordered Meta to pay €479 million to digital publishers for unfair competitive advantages gained through GDPR violations between 2018 and 2023. German courts awarded individual Facebook users €5,000 compensation for data protection violations involving Meta's Business Tools tracking infrastructure.

The European Commission found Meta in preliminary breach of Digital Services Act transparency requirements on October 24, 2025, potentially exposing the company to fines up to 6% of worldwide annual turnover. Italian competition authorities launched antitrust proceedings on November 26, 2025 alleging Meta abused dominant position by excluding rival AI chatbot providers from WhatsApp.

These parallel enforcement actions create cumulative legal exposure that shareholders may increasingly view as preventable through proper board oversight. The $190 million derivative settlement establishes precedent for holding technology company directors financially accountable when privacy compliance failures result in regulatory penalties.

For marketing professionals, the settlement underscores platform accountability risks surrounding data collection and advertising targeting practices. Meta's advertising revenue reached €50.1 billion in the third quarter of 2025, driven substantially by behavioral advertising models dependent on processing extensive user data. Regulatory enforcement targeting these practices continues intensifying across major markets.

The settlement requires court approval. According to the stipulation, Meta will provide notice to current stockholders through SEC Form 8-K filing and posting on the company's investor relations website. The Court of Chancery will hold a settlement hearing to consider final approval, at which point any Meta stockholder may object to the proposed terms.

Timeline

• July 27, 2012: FTC issues consent order against Facebook over privacy practices
• March 26, 2018: FTC announces investigation into Facebook's privacy compliance
• April 25, 2018: Shareholder Karen Sbriglio files initial derivative lawsuit
• June 12, 2019: Meta's board approves $5 billion FTC settlement
• July 24, 2019: Court enters 20-year FTC consent order against Meta
• November 4, 2021: Plaintiffs file consolidated complaint alleging board failures
• May 10, 2023: Delaware court denies defendants' dismissal motion on fiduciary claims
• September 25, 2024: Plaintiffs file sanctions motion against Sandberg and Zients
• January 21, 2025: Court grants sanctions motion in part
• July 16, 2025: Trial begins in Delaware Court of Chancery
• July 17, 2025: Parties reach settlement agreement following mediator proposal
• November 20, 2025: Settlement stipulation filed with Delaware court

Summary

Who: California State Teachers' Retirement System, Construction and General Building Laborers' Local Union No. 79, and City of Birmingham Retirement and Relief System served as co-lead plaintiffs suing Meta directors and officers including Mark Zuckerberg, Sheryl Sandberg, and board members for alleged breach of fiduciary duties.

What: Meta agreed to pay $190 million to settle derivative shareholder lawsuit alleging board failures led to Cambridge Analytica scandal and violations of FTC privacy consent orders. Settlement includes corporate governance reforms addressing board oversight of privacy and data security.

When: Initial lawsuit filed April 25, 2018 following FTC investigation announcement. Settlement reached July 17, 2025 after first day of trial. Formal stipulation executed November 20, 2025.

Where: Delaware Court of Chancery, where Meta is incorporated. Privacy violations affected users globally. FTC enforcement occurred in United States.

Why: Shareholders alleged directors breached fiduciary duties by failing to implement adequate privacy oversight systems, resulting in $5 billion FTC penalty and 20-year consent order restricting Meta's operations. Litigation sought to recover corporate damages and improve governance controls over data protection compliance.