A $27.5 million settlement involving Thomson Reuters Corporation (TR) highlights the risks behind the collection, use, and sale of personal information, even if sourced publicly, without providing adequate transparency and means for individual control. The case, Brooks v. Thomson Reuters, focused on TR’s Consolidated Lead Evaluation and Reporting (CLEAR) platform, which aggregated vast amounts of personal data into detailed profiles sold to third parties. The outcome underscores that compliance goes beyond prominent regulations like the California Consumer Privacy Act (CCPA); businesses must also navigate longstanding state laws prohibiting unfair business practices and unjust enrichment, making robust data governance and user control paramount. Brooks v. Thomson Reuters signals increasing scrutiny of how companies monetize personal data and emphasizes that even if information is “publicly available in disaggregated form,” compiling and selling it can create significant legal exposure.1
The Lawsuit
In this class action lawsuit initially filed in 2020,2 plaintiffs Cat Brooks and Rasheed Shabazz, representing a class of approximately 40 million Californians, alleged that TR, through its sophisticated CLEAR platform, compiled and sold comprehensive “cradle-to-grave dossiers” on individuals without their knowledge or consent.3 They claimed the platform aggregated not just public records but also non-public data from sources like the deep web, social networks, data brokers, and even live cell phone location data to create a “360-degree view” of residents’ lives. This vast collection of personal information—including photos, addresses, phone numbers, and details on relatives—was then packaged and sold to corporations, law enforcement, and government agencies, the plaintiffs alleged.
The lawsuit asserted that TR commercially exploited the personal information of Californians for profit, violating their rights and unjustly enriching the company. The plaintiffs’ initial complaint included causes of action for violation of California’s common law right of publicity, unjust enrichment, and violations of California’s Unfair Competition Law (UCL). However, the court dismissed the right of publicity claim early in the litigation,4 and the case ultimately proceeded and settled on the surviving claims for unjust enrichment and violation of the UCL’s prohibition on unfair business practices.5
The Settlement
Rather than proceed to trial, the parties reached a settlement agreement,6 which received final approval from Judge Edward M. Chen of the US District Court for the Northern District of California on February 21, 2025.7 TR, while not admitting liability, agreed to significant terms.8 The settlement established a $27.5 million non-reversionary fund to compensate eligible California residents whose information was available through CLEAR during the class period (December 3, 2016, to October 31, 2024).
Perhaps more impactful are the agreed-upon changes to TR’s business practice. For a period of four years, TR must: make it easier for Californians to request the deletion of their data from CLEAR, notably removing the requirement to provide a driver’s license for these requests (though still needed for review requests to adequately protect data against third-party disclosure);9 relay verified deletion requests to its third-party data licensors and ask them to honor the opt-out requests;10 and launch a public-facing website explaining what the CLEAR platform is, the data it contains, who uses it, and how residents can exercise control over the use of their information.11 The court approved the settlement as “fair, reasonable, and adequate,” awarding $6.875 million in attorneys’ fees, over $670,000 in litigation costs, and $10,000 in service awards to the class representatives.12
Key Takeaways for Businesses
The Brooks v. Thomson Reuters settlement provides cautionary lessons for data practices nationwide. Like California, most states have consumer protection laws aimed at unfair and deceptive practices (generally known as Unfair, Deceptive, and Abusive Practices (UDAP) statutes). Businesses should therefore exercise caution when monetizing the personal information of their users. Below are several notable takeaways from this settlement.
Reevaluate Use of Publicly Sourced Data
Practical Takeaway: Don’t assume “publicly available” means “free to use for any commercial purpose.” Aggregating publicly sourced data (e.g., social media posts, court records, and property records) into detailed profiles for sale can trigger consumer protection claims.
Relation to Case: TR’s CLEAR platform heavily relied on compiling data from various sources, many publicly accessible, into valuable dossiers sold commercially. The lawsuit challenged this practice directly.
Why It Matters: The compilation and monetization of data that is publicly accessible or procured from data sources can, depending upon the nature of the data, give rise to claims based on violations of UDAP statutes and consumer rights laws, even if this practice does not violate a specific privacy law like the CCPA.
Enhance Transparency and Control Mechanisms
Practical Takeaway: Provide clear, accessible information about your data collection, use, and sharing practices. Implement straightforward processes for individuals to exercise control over their personal information, especially regarding rights like opting out of data sales or requesting data deletion. Implement these processes in a user-friendly way.
Relation to Case: Key settlement terms required TR to create a public website about CLEAR for Californians and simplify the data deletion request process. TR specifically had to remove a burdensome verification step (driver’s license submission) for deletion.
Why It Matters: Providing accessible control mechanisms like opt-out and deletion options builds user trust and mitigates legal risks. This case demonstrates that even complex data platforms that rely on publicly sourced information should provide meaningful user control and making these processes burdensome (like requiring a driver’s license in the data deletion request process) can be viewed unfavorably.
Strengthen Vendor Management
Practical Takeaway: Know where your data comes from and where it goes. Put data processing agreements in place to bind vendors to obligations that align with privacy requirements, including the handling of deletion requests.
Relation to Case: The settlement required TR to forward deletion requests to its own data suppliers, acknowledging the interconnectedness of the data ecosystem.
Why It Matters: Your business can be held responsible for the data practices of your vendors or the downstream use of data you provide. Robust vendor due diligence and data processing agreements are important steps for risk mitigation.
Incorporate “Privacy by Design”
Practical Takeaway: Build privacy considerations into the development and operation of your products and services from the outset rather than treating compliance as an afterthought.
Relation to Case: The settlement explicitly required TR to incorporate “privacy by design” principles into CLEAR’s operations as part of the injunctive relief.
Why It Matters: Proactive privacy design minimizes risk, reduces the cost of compliance, enhances user trust, and can be a competitive differentiator.
Beyond CCPA: Other Legal Frameworks to Consider
While the CCPA dominates many data privacy discussions, Brooks is a potent reminder that other laws apply to data monetization. For example, businesses may be subject to the following laws of California or similar laws of other states.
California Common Law Right of Publicity
Explanation: This longstanding right protects individuals against the unauthorized commercial use of their name, likeness, or identity. It safeguards the inherent value tied to an individual’s public identity and persona.
Relation to Case: Although the plaintiffs’ initial complaint included a claim for violation of this right, the court dismissed it, finding that TR’s actions did not fit the legal requirements for this specific claim. While this theory failed here, it highlights how data monetization can trigger a wide range of legal challenges.
Why Businesses Should Care: Using someone’s photo, name, or other identifying information in a commercial context without consent may still lead to liability under this doctrine in other circumstances.
California Unfair Competition Law (UCL)
Explanation: The UCL is a broad statute prohibiting any unlawful, unfair, or fraudulent business act or practice. The “unfair” standard is flexible, prohibiting conduct that offends public policy or is unethical or harmful to consumers.
Relation to Case: The plaintiffs successfully argued that TR’s data practices were unfair and harmful to consumers. This claim formed a core basis for the settlement, which required significant changes to TR’s business practices—a form of injunctive relief commonly sought under the UCL.
Why Businesses Should Care: The UCL’s breadth makes it a powerful tool for plaintiffs challenging data practices. Its flexibility means businesses should consider the general fairness and ethical implications of their data handling not just technical compliance with specific rules.
For more information about data practices and compliance guidance, or if you have questions regarding the content of this blog, please contact Renato Smith-Bornfreedom, Data Security & Technology Practice Area co-chair, at rsmithbornfreedom@barclaydamon.com; Yassine Sahbani, associate, at ysahbani@barclaydamon.com; or another member of the firm’s Data Security & Technology Practice Area.
1Plaintiffs’ Motion for Preliminary Approval of Class Action Settlement and Certification of Settlement Class, Brooks v. Thomson Reuters Corp., No. 3:21-cv-01418-EMC (N.D. Cal. Aug. 29, 2024), ECF No. 241 at pg. 18.
2The plaintiffs initially filed the Class Action Complaint in California state court (Alameda County) on December 3, 2020; Thomson Reuters subsequently removed the action to the US District Court for the Northern District of California on February 26, 2021.
3First Amended Class Action Complaint, Brooks v. Thomson Reuters Corp., No. 3:21-cv-01418-EMC (N.D. Cal. Dec. 2, 2022), ECF No. 145 at pg. 2, ¶ 2.
4Court Order Granting and Denying in Part Thomson Reuters’ Motion to Dismiss, Brooks v. Thomson Reuters Corp., No. 3:21-cv-01418-EMC (N.D. Cal. Aug. 16, 2021), ECF No. 51 at pg. 4.
5Plaintiffs’ Motion for Preliminary Approval of Class Action Settlement, ECF No. 241-1 at pg. 3, ¶ 8; pg. 4, ¶ 11.
6Plaintiffs’ Motion for Preliminary Approval of Class Action Settlement, ECF No. 241-1.
7Court Order Granting Final Approval of Class Action Settlement, Brooks v. Thomson Reuters Corp., No. 3:21-cv-01418-EMC (N.D. Cal. Feb. 21, 2025), ECF No. 280.
8Thomson Reuters’ Statement of Non-Opposition to Plaintiffs’ Motion for Preliminary Approval of Class Action Settlement, Brooks v. Thomson Reuters Corp., No. 3:21-cv-01418-EMC (N.D. Cal. Sept. 10, 2024), ECF No. 245.
9Plaintiffs’ Motion for Preliminary Approval of Class Action Settlement, ECF No. 241-1 at pg. 22, § XI.1.a.iii.
10Id. at pg. 22, § XI.1.a.ii.
11Id. at pgs. 22 – 23, § XI.1.b.
12Court Order Granting Final Approval of Class Action Settlement , ECF No. 280 at pgs. 3, 8.