States Turn to Outside Firms to Generate Big Privacy Settlements

Attorneys general from Texas, Nebraska and other states are tapping outside law firms to bring data protection cases against the biggest tech companies—snagging a cut of multimillion-to-billion dollar settlements along the way—in a new approach to privacy enforcement.

The practice of state attorneys general using outside counsel for litigation is not new, taking off in the late 1990s as regulators sued the largest US tobacco companies. But its application to data privacy and online safety cases has grown in recent years in tandem with new state laws.

Just this year, Nebraska, Minnesota, Kentucky, Arkansas, and Utah used private law firms to sue tech platforms that serve US consumers.

The strategy gets mixed reactions. Some states say it would be difficult to bring certain cases without the resources and technical expertise of firm attorneys. Companies’ outside counsel, meanwhile, worry private firms are driving state enforcement against a select few Big Tech platforms as they seek big payouts.

“We’ve always treated AG litigation and civil plaintiff litigation differently—and they’re becoming the same,” said Marc Zwillinger, founder at ZwillGen PLLC.

At the heart of concerns are contingency agreements that have helped firms rake in millions of dollars from record-breaking settlements. In a 2022 settlement between the District of Columbia and Google, for example, Edelson PC netted $1.9 million of a $9.5 million settlement after working on contingency.

As enforcers become more aggressive, settlements and fees have skyrocketed. Norton Rose Fulbright stands to earn as much as $371 million in contingent fees from a record $1.38 billion proposed settlement it helped the Texas attorney general reach with Google in May.

Google declined to comment.

The shift to using outside firms also boosts companies’ risk profiles, allowing smaller states that might not have been on businesses’ radars to take on complex cases.

“One, don’t ignore the states that don’t necessarily have privacy laws because you’re not safe,” said Holly Melton, partner at Frankfurt Kurnit Klein & Selz. “And two, the sort of posture has already kind of ratcheted up when they come in with outside counsel who’s sort of running the show.”

Shopping Cases

The influence of outside counsel raises questions about what’s driving state priorities in data protection cases, attorneys said, and the extent to which firms are “shopping” ready-to-go lawsuits to regulators.

“It happens every day, all day,” said Douglas Gansler, head of Cadwalader, Wickersham & Taft LLP’s state AG practice and a former Maryland attorney general. Law firms “always shop cases to the AGs.”

Law firms often attend conferences packed with state attorneys—like the National Association of Attorneys General—to pitch potential litigation, he said.

“It’s typically the same law firms, the same sort of national plaintiff law firms, that will market sort of the case du jour that they’ve come up with, or the industry du jour that they feel that they want to go after,” Gansler added.

Some companies are pushing back.

After being hit with a lawsuit by the Oregon attorney general, Coinbase sued the regulator in July for records about its use of plaintiffs’ lawyers which it alleged drove the state’s “strategy of regulation-by-ambush.”

Coinbase and Oregon’s attorney general office didn’t immediately respond to requests for comment.

Contingency Effect

The law firms inking state contracts include regional players and national heavyweights.

“Seeing powerhouse litigation shops be retained by smaller states, with fewer consumers, really speaks to the monetary value of these cases,” said Tyler Bridegan, partner at Womble Bond Dickinson and former director of privacy enforcement at the Texas AG’s office.

Dallas-based Nachawati Law Group and Wade Kilpela Slade, for instance, have netted at least three contracts for lawsuits against Chinese shopping app Temu from Arkansas, Nebraska, and Kentucky. Motley Rice represents states suing Meta Platforms Inc. and Snap Inc. for allegedly endangering children with addictive design practices.

Illinois-based Edelson PC helped regulators in Minnesota and Utah bring kids’ privacy and safety cases against TikTok. It’s poised to potentially make millions off those cases, typically working on contingency fees of 20%, according to contracts obtained by Bloomberg Law through open records requests.

Wade didn’t respond to requests for comment. Nachawati and Edelson declined to comment.

The use of outside counsel, particularly on a contingency fee basis, allows states to bring cases they might not otherwise have the resources to pursue, giving them access to specialized expertise in complex matters.

Nebraska Attorney General Mike Hilgers (R) said that’s been the case for a small state like his. “I think you can take my entire office and fit it into a corner of one floor of the Texas’ AG or the California AG’s office,” Hilgers said. While some of these states have hundreds of attorneys, his consumer team has, “on any given day, six or seven lawyers.”

Not all states hire firms on contingency, but the model offers an advantage for attorneys general with smaller budgets.

“Small states are more likely to use contingency because they do not want to put general taxpayers’ dollars at risk,” Hilgers said.

A Different Incentive

Critics argue that the fees are creating different incentives for private firms—chasing settlements instead of pushing for change inside companies.

“Where I think it’s most problematic is in consumer protection cases, where they’re supposed to be exercising prosecutorial discretion and doing things that are in the interest of justice,” said Zwillinger, a privacy attorney who has represented tech companies against state attorneys general.

For instance, a proposed $1.4 billion biometric privacy settlement between Texas and Google, supported by Norton Rose Fulbright, did not require the tech giant to change its business practices.

“You always have to ask the question,” said John Gray, a former privacy team leader in the Arizona attorney general’s office and partner at Womble Bond Dickinson. “‘Are these private firms essentially wielding state power in a way that forces these companies to settle, even if the companies aren’t necessarily doing anything wrong?’”