The parties ask the Court to resolve their dispute regarding whether plaintiffs should be permitted to take the deposition of Mark Zuckerberg, Meta’s CEO. Dkt. No. 909.[1] The Court finds this dispute suitable for resolution without oral argument.[2] Civil L.R. 7-1(b).

Rule 30 of the Federal Rules of Civil Procedure permits “[a] party . . . [to] depose any person, including a party, without leave of court . . . .” Fed. R. Civ. P. 30(a)(1). However, under Rule 26(c)(1), “[t]he court may, for good cause, issue an order to protect a party or person from annoyance, embarrassment, oppression, or undue burden or expense,” including forbidding a deposition, or limiting its scope. Fed. R. Civ. P. 26(c)(1). The party seeking a protective order bears the burden of showing good cause for the order by “demonstrating harm or prejudice that will result from the discovery.” Rivera v. NIBCO, Inc., 364 F.3d 1057, 1063 (9th Cir. 2004).

A party’s request for the deposition of a high-level executive of an adverse party—a socalled “apex” deposition—may create a risk of abuse or harassment. Apple Inc. v. Samsung Elecs. Co., Ltd., 282 F.R.D. 259, 263 (N.D. Cal. 2012). A court may, in its discretion, disallow or limit such a deposition if the discovery “can be obtained from some other source that is more convenient, less burdensome, or less expensive.” Fed. R. Civ. P. 26(b)(2)(C)(i). In determining whether to permit or limit an apex deposition, a court should consider (1) whether the deponent has unique first-hand knowledge of the facts at issue in the case, and (2) whether the party seeking the deposition has exhausted other less intrusive means to obtain the discovery. Apple, 282 F.R.D. at 263.

According to plaintiffs, Mr. Zuckerberg has unique first-hand knowledge regarding several matters relevant to a claim or defense. Specifically, plaintiffs say that discovery obtained to date indicates that Mr. Zuckerberg was the “final decisionmaker on all consequential privacy decisions,” including those involving data collection, consent, and user privacy. See Dkt. No. 909 at 2, 3. By virtue of this role, plaintiffs argue, Mr. Zuckerberg’s decisions and the reasons for those decisions bear on questions of Meta’s intent, among other things. Plaintiffs claim that they have exhausted other discovery methods to obtain this information, including taking the deposition of Mr. Mudd, Meta’s Vice President of Business Product Marketing. Id. at 3, 4.

Meta objects to plaintiffs’ taking Mr. Zuckerberg’s deposition on several grounds. First, Meta contends that Mr. Zuckerberg has no unique first-hand knowledge of any relevant facts, as he did not design or implement the relevant business tools or the Meta filter. Id. at 4. Second, it argues that to the extent Mr. Zuckerberg was informed, together with many others, of allegations concerning Meta’s receipt of user health data, his information is, by definition, not unique. Id. at 4, 5. Third, Meta disputes that Mr. Zuckerberg was required by the FTC or otherwise to act as the final decisionmaker regarding any privacy matters, contending that he merely received reports and certified compliance with the FTC Consent Order by others charged with that responsibility. Id. at 5. As to other decisions, Meta argues that there is no indication from Mr. Mudd’s testimony or otherwise that Mr. Zuckerberg made any decisions pertinent to the pixel or this action. Id. Finally, Meta argues that plaintiffs have not attempted, let alone exhausted, other less intrusive means to obtain the discovery they seek from other sources. Id. at 6.

The Court has reviewed the pertinent portions of the FTC Consent Order. Dkt. No. 965. While nothing in that Order requires Mr. Zuckerberg to act as the “final decisionmaker” on consequential privacy decisions (as plaintiffs claim), the Order does require that he be informed of consequential privacy decisions and other privacy-related information and that he certify on a quarterly basis that Meta has (1) “established, implemented, and maintained a Privacy Program that complies in all material respects with” the mandatory privacy program requirements in the Order; and (2) “is not aware of any material noncompliance” with those requirements “that has not been corrected or disclosed to the [FTC].” Id. at sec. XI, A. While Meta is correct that Mr. Zuckerberg is permitted to rely on information, reports, and certifications provided to him by others, he also “shall rely” on “his . . . personal knowledge.” Id. The Court has also reviewed the pertinent portions of Mr. Mudd’s deposition transcript. Mr. Mudd described his understanding of Mr. Zuckerberg’s general approach to decisions making. Mudd dep. at 219:2-220:4. In addition, Mr. Mudd testified that a proposal was presented to Mr. Zuckerberg in 2021 to [REDACTED], and that Mr. Zuckerberg made a decision or gave directions regarding that proposal. Mudd dep. at 229:20-230:24, 233:24- 238:6, 241:19-242:18, 247:15-252:11. The proposal in question appears to be relevant to plaintiffs’ claims and/or Meta’s defenses.

Having considered the parties’ discovery dispute submission, as well as the FTC Consent Order and Mr. Mudd’s testimony, the Court finds that plaintiffs have shown Mr. Zuckerberg is likely to have at least some unique first-hand knowledge of facts relevant to a claim or defense by virtue of his role pursuant to the FTC Consent Order and as a decision maker regarding certain privacy-related matters at issue in this case. The circumstances presented here differ from those in Affinity Labs, in which the plaintiff demanded the deposition of Apple’s CEO regarding broad public statements with little relevance to the underlying litigation. See Affinity Labs v. Apple, Inc., No. 09-cv-4436 CW (JL), 2011 WL 1753982, at *16-*17 (N.D. Cal. May 9, 2011) (denying deposition request). They also differ materially from those in Frasco, in which the plaintiffs’ sole justification for deposing Mr. Zuckerberg was that he was “involved in” government investigations, “was apprised of” Meta’s collection of sensitive health data, and had knowledge that could be imputed to Meta for purposes of the “intent” element of the plaintiffs’ wiretapping claims. Frasco v. Flo Health Inc., No. 21-cv-00757-JD, Dkt. No. 264, Dkt. No. 269 (N.D. Cal. Feb. 8, 2023) (denying deposition request, subject to plaintiffs advising court if circumstances change at a later date). Finally, nothing in the record suggests that plaintiffs here seek Mr. Zuckerberg’s deposition based on his high-level, general management responsibilities, as in Doble v. Mega Life and Health Ins., No. 09-cv-1611-CRB (JL), 2010 WL 1998904, at *3 (N.D. Cal. May 18, 2010) (denying deposition request). However, to the extent, plaintiffs seek information about how Meta implemented the pixel, what data it obtained, how it used the data, and how it implemented privacy protections, they may not use Mr. Zuckerberg’s deposition to obtain information about these matters, as such information can be obtained from other witnesses and/or through other less intrusive means. Rather, plaintiffs’ deposition of Mr. Zuckerberg should be directed to facts known to him by virtue of his role pursuant to the FTC Consent Order and as a decision maker regarding privacy-related matters relevant to this case.

As Meta observes, a deposition notice directed to an official at the highest level of corporate management creates a “tremendous potential for abuse or harassment.” Celerity, Inc. v. Ultra Clean Holding, Inc., No. 05-cv-4374-MMC (JL), 2007 WL 205067, at *3 (N.D. Cal. Jan. 25, 2007). Considering the manner in which discovery has been conducted in this case, the Court agrees that such potential exists with respect to Mr. Zuckerberg’s deposition. Accordingly, the deposition will be subject to the following limitations: The parties must agree on a date and location for the deposition, which must occur no later than May 30, 2025 unless the parties stipulate otherwise. The deposition will be limited to no more than three hours, and it will count against plaintiffs’ allotment of 12 individual depositions.

IT IS SO ORDERED.