Top Privacy Class Action Law Firms and the Statutes They Use

Privacy class action law firms are a small, specialized group of plaintiffs’ practices — led by Edelson PC, Robbins Geller Rudman & Dowd, Stueve Siegel Hanson, Lieff Cabraser Heimann & Bernstein, Hagens Berman, Milberg, and Loevy & Loevy — that bring suits over data breaches, biometric collection, robocalls, and website tracking under a patchwork of federal and state statutes. A parallel set of defense firms, including Venable and Perkins Coie, works the other side. Filings have more than tripled since 2022, with roughly 1,822 federal data privacy class actions filed in 2025.{¹}

The Leading Plaintiffs’ Firms

Edelson PC

Chicago-based Edelson is widely regarded as the pioneer of electronic privacy class actions. The firm holds what it describes as the largest privacy jury verdict in U.S. history, a $925 million verdict in Wakefield v. Visalus under the Telephone Consumer Protection Act.{²} It also played a central role in the $650 million In re Facebook Biometric Information Privacy Litigation settlement, the largest single-state privacy settlement on record, which challenged Facebook’s facial recognition under the Illinois Biometric Information Privacy Act.{³} Edelson has secured over $150 million in additional BIPA relief and won a $76 million TCPA settlement against Caribbean Cruise Line.{⁴}

The firm was lead counsel in Spokeo, Inc. v. Robins, the 2016 Supreme Court case addressing whether intangible harms satisfy the constitutional standing requirement in federal court.{} More recently, Edelson represented the ACLU against Clearview AI, securing a consent decree barring the facial recognition company from selling access to its database to private entities.{²}

Robbins Geller Rudman and Dowd

Robbins Geller served as lead counsel alongside Edelson and Labaton Keller Sucharow on the Facebook biometric settlement, which covered up to six million Illinois users whose facial geometry had been extracted without written consent.{} Judge James Donato, approving the deal on February 26, 2021, said it would put “at least $345 into the hands of every class member interested in being compensated.”{⁵}

The firm also joined Hagens Berman in the 2017 class action against Equifax over the breach that exposed the personal data of an estimated 143 million consumers.{⁶} Its broader docket includes co-lead counsel roles in the AMCA data breach MDL and a class action alleging Amazon’s Alexa devices violated state wiretapping statutes.{⁷}

Stueve Siegel Hanson

Kansas City-based Stueve Siegel Hanson has built its reputation on data breach settlements. The firm claims involvement in the three largest data breach settlements in history: the $1.5 billion Equifax settlement, the $500 million T-Mobile settlement, and the $190 million Capital One settlement.{} Law360 named it Cybersecurity and Privacy Group of the Year in both 2020 and 2023.{⁸}

Lieff Cabraser Heimann and Bernstein

Lieff Cabraser has accumulated over $440 million in TCPA settlements alone, including $95 million with Wells Fargo and $38.5 million with National Grid.{⁹} The firm’s privacy work extends well beyond robocall cases. It secured a $115 million settlement in the Anthem data breach litigation and a $115 million settlement against Oracle over alleged data brokering.{} It currently sits on the steering committee for the Snowflake data breach MDL, where settlements with Neiman Marcus, Advance Auto Parts, and AT&T have already exceeded $40 million.{¹⁰}

Hagens Berman, Milberg, and Loevy & Loevy

Hagens Berman Sobol Shapiro keeps active privacy class actions against Amazon (Ring cameras), AT&T, and Meta on top of its role in the Equifax litigation.{¹¹}

Milberg, ranked fifth nationally in total class action filings between 2021 and 2023, has leaned heavily on mass arbitration in privacy cases, securing a $64.5 million settlement against Meta and a $35 million settlement against Snap through tens of thousands of individual arbitration demands.{¹²}

Loevy & Loevy served as class counsel in the $47.5 million Simmons v. Motorola Solutions settlement, a BIPA case challenging the company’s FaceSearch facial recognition technology used on police booking photos.{¹³}

The Firms Defending Companies

Companies sued in privacy class actions typically retain large national firms with specialized defense practices. Venable LLP is ranked Tier 1 nationally for mass tort and class action defense by U.S. News – Best Lawyers. In the Google cookie-tracking MDL, Venable won dismissal of federal statutory claims by arguing plaintiffs lacked constitutional standing, and it defeated class certification in a multi-state case where plaintiffs sought several hundred million dollars over magazine subscription continuity programs.{¹⁴}

Perkins Coie, recognized by Chambers USA, has defended Google in landmark BIPA litigation. In Rivera/Weiss v. Google, the firm secured a full dismissal of claims involving face-clustering technology by establishing that the plaintiffs had suffered no Article III injury. Perkins Coie also defended Twitter in a nationwide wiretap class action and represented Sprint in the Carrier IQ consumer privacy MDL.{¹⁵}

The Statutes These Firms Use

Privacy class actions rely on a patchwork of federal and state laws, many written long before the technology they are now applied to existed. Which firm fits a given case often depends on which statute the facts support.

Illinois Biometric Information Privacy Act

BIPA, enacted in 2008, has generated more privacy class action activity than perhaps any other single statute. It requires written consent before a company collects biometric identifiers like fingerprints or facial geometry, and it provides a private right of action with statutory damages.

The pace of BIPA filings slowed in 2025 after the Illinois legislature amended the law in 2024 to restrict “per scan” damages, effectively capping claims at $1,000 to $5,000 per victim. New filings dropped from 427 in 2024 to 150 in 2025, and settlement totals fell 34% to $136.6 million.{¹⁶} Significant settlements continued to be approved, including $12 million against Speedway, $8.75 million against Google over Chromebook education software, and $6 million against YouTube.{¹⁷}

Telephone Consumer Protection Act

The TCPA, a 1991 federal law targeting robocalls and unsolicited faxes, provides statutory damages of up to $1,500 per call. Capital One paid $75.5 million, Caribbean Cruise Line paid $76 million, and AT&T paid $45 million to resolve TCPA class actions. Filing volume hit a record 161 TCPA complaints in October 2024 alone.{¹⁸}

Courts have pushed back on some TCPA settlements. In Drazen v. GoDaddy, the Eleventh Circuit reversed approval of a $35 million settlement in May 2024, finding that a $7 million fee award to plaintiffs’ counsel was more than four times the value of actual relief delivered to class members.{¹⁹}

Video Privacy Protection Act

The VPPA, a 1988 law originally written to prevent video store clerks from disclosing rental histories, has experienced a dramatic revival. Plaintiffs’ firms have filed roughly 200 VPPA class actions per year in recent years, targeting companies that use tracking pixels — particularly the Meta Pixel — on websites that host video content.{²⁰} The statute provides a minimum of $2,500 per violation, plus punitive damages and attorneys’ fees.{²¹}

A deep circuit split has emerged over who counts as a VPPA “consumer.” The Second Circuit has held that anyone who signs up for any service from a video provider, even a newsletter, qualifies.{²²} The Sixth and D.C. Circuits disagree, limiting protection to people who subscribe to audiovisual services specifically.{²¹} The Supreme Court granted certiorari in Salazar v. Paramount Global on January 26, 2026, and will resolve the question during its October 2026 term.{²³} Meanwhile, the Second Circuit effectively shut the door on pixel-based VPPA claims within its jurisdiction in 2025, ruling in Solomon v. Flipps Media that character strings transmitted by tracking pixels do not constitute personally identifiable information; Hughes v. NFL confirmed that ruling shortly afterward.{}

California Consumer Privacy Act and California Invasion of Privacy Act

The CCPA provides a limited private right of action for consumers whose unencrypted personal information is exposed through a data breach caused by a business’s failure to maintain reasonable security. Statutory damages range from $100 to $750 per consumer per incident.{²⁴} In May 2026, a Northern District of California court allowed a CCPA claim to proceed against a mortgage lender for using Google Analytics and Meta Pixel tracking code, treating the data transmission as an unauthorized “disclosure.”{} Whether browsing history and IP addresses qualify as “personal information” under the CCPA’s narrow definition remains an open question.{²⁵}

California’s Invasion of Privacy Act (CIPA), a criminal wiretapping statute that carries $5,000 per violation in statutory damages, has become a favored vehicle for class actions targeting website session-replay tools and chat features. The Ninth Circuit revived one such case in Mikulsky v. Bloomingdale’s, ruling that the plaintiff adequately alleged the retailer conspired with a session-replay provider to intercept communications in real time.{} Other courts have been more skeptical: in Torres v. Prudential Financial, the Northern District of California dismissed CIPA claims on the ground that session-replay software does not intercept data in real time, and in Thomas v. Papa John’s, the Ninth Circuit held that a company cannot eavesdrop on its own conversation.{²⁶}

Newer State Laws

Most state privacy laws enacted in recent years do not include a private right of action, leaving enforcement to regulators.{²⁷} Washington’s My Health My Data Act, which took effect in March 2024, is a notable exception. The first class action under the law, Maxwell v. Amazon.com, Inc., was filed in February 2025. It alleges Amazon used software development kits embedded in third-party apps like The Weather Channel and Truecaller to harvest geolocation and biometric data that could reveal health-related activities.{²⁸} Where the statute lacks a direct damages provision, plaintiffs can pursue claims under the Washington Consumer Protection Act, which provides up to $25,000 per person in statutory damages.{²⁹}

How Often Plaintiffs Actually Win

Headline settlements can obscure how often privacy class actions fail. The single biggest obstacle is proving constitutional standing. The Supreme Court’s 2021 decision in TransUnion LLC v. Ramirez held that a violation of a statutory right does not automatically confer standing; plaintiffs must demonstrate “concrete harm.”{³⁰} For intangible injuries like privacy violations, courts require a “close historical or common-law analog” such as reputational harm, disclosure of private information, or intrusion upon seclusion.{³¹}

In 2025, federal courts granted motions to dismiss in 67.5% of data privacy cases where they reached the question, with 54% of those resulting in full dismissal.{¹} Courts have rejected claims that the mere theft of personal data confers standing without evidence of actual misuse, and have held that collection of IP addresses does not implicate a legally protected privacy interest.{³¹}

Even when plaintiffs clear standing, class certification is its own hurdle. Defendants argue that class members suffered different downstream effects from the same breach — some experienced identity theft, others did not — making individual questions predominate. Very few privacy cases reached a certification ruling in 2025: Duane Morris recorded just three, with plaintiffs prevailing in one, because most cases either settled or were dismissed before the question arose.{¹} No data breach class action has ever gone to a jury verdict; all have resolved through settlement.{³²}

Mass Arbitration as an Alternative

Many companies responded to the class action threat by adding mandatory arbitration clauses to their terms of service. Plaintiffs’ firms have adapted with mass arbitration, filing hundreds or thousands of individual arbitration demands against a single company at once, forcing the company to pay administrative fees for each one. The American Arbitration Association received 92 mass arbitrations involving roughly 280,000 individual claims in 2024, with gaming, telecommunications, and healthcare leading by volume.{¹²}{³³}

Milberg describes itself as a trailblazer in the approach and used it to secure $64.5 million from Meta and $35 million from Snap.{¹²} Companies have started fighting back. In 2025, the Ninth Circuit approved JAMS’s authority to consolidate over 100,000 identical privacy claims into a single proceeding, eliminating fee pressure that would have cost the defendant $12 million in upfront filing costs.{} The AAA also revised its rules in May 2025 to allow administrative consolidation of multiple claims arising from the same contract.{³⁴}

What’s Changing

Several near-term developments will shape which firms take which cases and how they fare. The Supreme Court’s decision in Salazar v. Paramount Global could dramatically expand or contract the universe of VPPA plaintiffs, with implications for hundreds of pending cases.{²³} The 2024 BIPA amendments have already cut Illinois biometric filings by roughly two-thirds. Plaintiffs’ firms continue to push older statutes into new territory, applying wiretap laws to website chatbots and the CCPA to cookie-based tracking, with mixed results.{³⁵}

Corporations paid more than $70 billion to resolve class actions of all types in 2025, the highest figure in American legal history.{³⁵} With over 1,800 federal data privacy filings in 2025 and settlements running into the billions, the economic incentives on both sides remain powerful. Defense firms point to rising dismissal rates as evidence that courts are tightening the screws on speculative claims. Plaintiffs’ firms point to settlement totals as evidence that the claims have real value.

1
Duane Morris LLP. Duane Morris Class Action Review 2026
2
Edelson PC. Privacy and Technology
3
Labaton Keller Sucharow LLP. Record-Breaking $650 Million Settlement
4
Edelson PC. Class Actions
5
Robbins Geller Rudman & Dowd LLP. In Re Facebook Biometric Information Privacy Litigation
6
Robbins Geller Rudman & Dowd LLP. Comprehensive Multi-State Class Action Against Equifax
7
Robbins Geller Rudman & Dowd LLP. Consumer Cases
8
Stueve Siegel Hanson LLP. Privacy and Data Breach
9
Lieff Cabraser Heimann & Bernstein, LLP. TCPA Cases
10
Lieff Cabraser Heimann & Bernstein, LLP. Privacy
11
Hagens Berman Sobol Shapiro LLP. High-Tech Litigation
12
Milberg. Mass Arbitration
13
Loevy + Loevy. Motorola Class Action
14
Venable LLP. Privacy Class Action Defense
15
Perkins Coie. Class Action Defense
16
Legal Newsline. Reforms Sliced BIPA Class Actions in 2025
17
ClassAction.org. Illinois Biometric Information Privacy Act
18
The Lyon Firm. TCPA
19
Husch Blackwell. Eleventh Circuit Eviscerates TCPA Class Action Settlement
20
Business Law Today. Pixel Tools Spur a New Wave of Class Action Litigation Under the VPPA
21
WilmerHale. 2025 Year in Review: VPPA Litigation Trends
22
Morrison & Foerster. Recent Developments in VPPA Litigation
23
Thompson Coburn. Supreme Court Takes Up VPPA Consumer Question
24
IAPP. CCPA Litigation: Shaping the Contours of the Private Right of Action
25
Troutman Pepper. Courts Expand CCPAs Private Right of Action
26
Proskauer Rose LLP. CIPA Website Tracking Cases
27
Stinson LLP. A New Era of Comprehensive Privacy Laws
28
WilmerHale. First Lawsuit Filed Under Washington’s My Health My Data Act
29
Womble Bond Dickinson. First Class Action Filed Under WA My Health My Data Act
30
EPIC. Article III Standing
31
Faegre Drinker. Courts Reject Theoretical Privacy Violations
32
Edgeworth Economics. Value of Personal Information in Data Breach Class Actions
33
Proskauer Rose LLP. Trends in Mass Arbitration
34
Proskauer Rose LLP. 2025 Mass Arbitration Year in Review
35
Duane Morris LLP. Duane Morris Class Action Review 2026