LEE, Circuit Judge:

California Pizza Kitchen, Inc. (CPK) is a restaurant chain offering California-style pizza at about two-hundred locations across the country. But in November 2021, CPK was not in the news for its trademark Original BBQ Chicken Pizza or its underrated Thai Chicken Pizza. Rather, CPK revealed that a cyberattack had compromised the personal information of over 100,000 former and current employees. That disclosure spurred lawyers to race to the courthouse and file competing class action lawsuits against CPK to get a slice of the action. One group of plaintiffs’ lawyers quickly struck a settlement with CPK: the deal offered cash payments and credit monitoring services to class members but CPK would only be required to make payments to class members who submitted valid claims (i.e., a claims-made settlement). Given the low redemption rate for claims, the monetary value of the class’s claims is (at most) around $950,000—

6 IN RE: KIRSTEN V. CALIFORNIA PIZZA KITCHEN INC.

yet the attorneys sought $800,000 in fees. A competing group of plaintiffs’ lawyers challenged that settlement, contending that they could deliver a deal for the class that would top it. Despite expressing some reservations, the district court approved the settlement. We affirm the settlement approval but remand the attorneys’ fee award. District courts may approve claims- made settlements—even those that raise indicia of collusion—so long as they adhere to procedural requirements and find the settlement “fair, reasonable, and adequate” under Rule 23(e). Our review of the record shows that the district court neither procedurally erred nor abused its discretion in finding the settlement substantively acceptable. We thus affirm the approval of the class settlement. But we reverse the fee award because the district court did not assess the actual value of the settlement and compare it to the fees requested. BACKGROUND I. CPK suffers a cyberattack—and then a deluge of putative class actions. In September 2021, CPK fell prey to a cyberattack by Conti, a ransomware group. Conti’s business model is straightforward: it hacks into a company’s system, encrypts the company’s files, and leaves a ransom note. In exchange for payment, Conti provides its victims with a decryption key and promises not to leak the stolen data. Conti has an incentive to keep those promises—if it started releasing stolen data, then future victims would be disinclined to pay. Faced with this sticky dilemma, CPK chose to pay the ransom. Because the breach compromised employee data (including Social Security numbers), CPK notified 103,767

IN RE: KIRSTEN V. CALIFORNIA PIZZA KITCHEN INC. 7

of its former and current employees. Soon, numerous plaintiffs’ lawyers filed a flurry of lawsuits—five in a matter of weeks. ^[1] All these class action lawsuits alleged that CPK failed to safeguard its employees’ personally identifiable information, and brought claims for negligence, breach of implied contract, and violations of business and privacy statutes. Counsel for the first four cases filed (Gilleo, Morales, Wallace, and Rigas) quickly agreed to cooperate with each other in hopes of splitting the pie among themselves. They made overtures to the Kirsten plaintiffs, trying to bring them into the fold. But those attempts went nowhere: the Kirsten plaintiffs had little appetite for cooperation, as their counsel had divergent views on case strategy and jockeyed for the position of lead counsel. The district court eventually granted a stipulation consolidating Gilleo, Morales, Wallace, and Rigas into a single action—In re California Pizza Kitchen Data Breach Litigation. The Kirsten plaintiffs trundled on alone. II. CPK and the consolidated plaintiffs reach a deal. CPK and the consolidated plaintiffs proceeded straight into mediated settlement negotiations. In March 2022, they jointly requested that the district court stay the action Under the terms of the proposed settlement, the Settling Plaintiffs agreed that “every Settlement Class member (except those who timely opt out)” would “fully and finally release CPK . . . from any and all claims or causes of action, whether known or unknown, that concern, refer or relate to the Data Security Incident announced by CPK on or about November 15, 2021, and all other claims arising out of the Data Security Incident announced by CPK on or about November 21, 2021, that were asserted, or that could have been asserted, in the Consolidated Cases.” In return, CPK agreed to a claims-made settlement, i.e., one in which only those class members who submitted timely, valid claims could receive any payment. That claims-made settlement would provide the following relief:

• Up to $1,000 per claimant for “out-of- pocket expenses and lost time” incurred as a result of the data breach. • Up to $5,000 per claimant for “extraordinary losses,” i.e., “proven monetary loss as a result of actual identity theft.” • A $100 “statutory damages award” for “California Settlement Subclass members,” which could be combined with a claim for out-of-pocket expenses, but “subject to the $1,000 cap on compensation for ordinary losses and lost time.” • “24 months of 3[-]bureau credit monitoring to Settlement Class members

34 IN RE: KIRSTEN V. CALIFORNIA PIZZA KITCHEN INC. who enroll,” which the Settling Plaintiffs valued at $360 per claimant.

In the settlement, CPK also agreed to a clear-sailing provision whereby it “agree[d] not to object to [the Settling] Plaintiffs’ request for combined attorneys’ fees and costs to” their counsel “in an amount not to exceed a total of $800,000, inclusive of costs.” CPK further agreed to “maintain certain recently implemented business practices and remedial measures . . . for a period of three (3) years” to safeguard against future data breaches. Under the agreement, class members would receive notice of the settlement primarily through notices sent to the respective postal addresses or email addresses “associated with” each class member. There would also be a website and toll-free number for any inquiries regarding the settlement. The agreement provided for a specified class action settlement administrator to administer the claims, including providing notice to class members, with CPK being responsible for all costs of the settlement administration.

In their written opposition to the Settling Plaintiffs’ motion for preliminary approval, the Kirsten Plaintiffs raised six objections to the proposed settlement. First, the Kirsten Plaintiffs asserted that because the settlement is claims-based and allows any unclaimed funds to remain with CPK, the settlement is functionally reversionary, thereby presenting one of the “subtle signs” this court has identified of potential collusion between class counsel and defendant’s counsel. Allen, 787 F.3d at 1224. The Kirsten Plaintiffs argued that “[r]eversionary clauses are highly disfavored in the Ninth Circuit,” because they

IN RE: KIRSTEN V. CALIFORNIA PIZZA KITCHEN INC. 35

promote “perverse incentives” for “defendants to ensure as low a claims rate as possible” and because they “can benefit both defendants and class counsel, and thus raise the specter of their collusion, by (1) reducing the actual amount defendants are on the hook for . . . ; and (2) giving counsel an inflated common-fund value against which to base a fee motion.” 2 Roes, 1–2, 944 F.3d at 1058–59 (simplified). Second, the Kirsten Plaintiffs objected to the settlement’s inclusion of a “clear sailing agreement,” that is, a provision that CPK would “not object to an amount of $800,000 paid in attorney fees.” In doing so, the Kirsten Plaintiffs relied on caselaw holding that “clear sailing agreements on attorney’s fees are important warning signs of collusion because the very existence of a clear sailing provision increases the likelihood that class counsel will have bargained away something of value to the class.” Roes, 1– 2, 944 F.3d at 1051 (simplified). Third, the Kirsten Plaintiffs contended that CPK’s potential liability was $77 million, but that the proposed settlement’s ceiling for liability was approximately $38 million with “[t]he only guaranteed payment under the [s]ettlement [being] the $800,000 in attorney fees” to the Settling Plaintiffs’ counsel. As a result, the Kirsten Plaintiffs argued, “[t]he amount offered in [the] [s]ettlement is unfair, unreasonable and inadequate.” The Kirsten Plaintiffs also asserted that, because “[t]he CCPA claim is arguably the

2 The settlement here technically is not “reversionary” because it did not establish a common fund from which any unclaimed funds would revert to CPK. However, as the majority correctly recognizes, there is no functional difference between a formal reversion and a purely claims- made settlement structure, as both leave any unclaimed funds with the defendant. See Opin. at 18–19.

36 IN RE: KIRSTEN V. CALIFORNIA PIZZA KITCHEN INC.

most valuable claim in the litigation against CPK” and “[n]one of the Settling Plaintiffs asserted a CCPA claim,” the Settling Plaintiffs were “not adequate to negotiate and release the CCPA claims.” According to the Kirsten Plaintiffs, CPK “intentionally chose the weakest opponents in this litigation” with which to “negotiate . . . , while excluding the one [plaintiff group] that did assert CCPA claims,” i.e., the Kirsten Plaintiffs, “from the mediation.” Fourth, the Kirsten Plaintiffs criticized the settlement’s one-time mail/e-mail notice plan as inadequate. In their view, the notice plan should also have included “(1) a reminder notice program, (2) a targeted social media/internet advertising campaign, and (3) a publication of the notice through CPK’s employee intranet or other internal employee communication system.” According to the Kirsten Plaintiffs, option (3) would have been free, and the other two would have “cost very little.” Fifth, the Kirsten Plaintiffs argued that the settlement’s release was overbroad because it extended to any claims that “relate to” the data breach in question. Sixth, the Kirsten Plaintiffs also contended that additional circumstances surrounding the settlement talks underscored the potentially collusive nature of the settlement. The Kirsten Plaintiffs highlighted the facts that (1) they were not included in the stipulation for consolidation; and (2) CPK had avoided informing them of the ongoing settlement negotiations with the Settling Plaintiffs. The Kirsten Plaintiffs also observed that the settlement was reached the day before motions for the appointment of lead counsel would have been due and that they had previously rejected any claims-made settlement structure in their discussions with CPK. The Kirsten

IN RE: KIRSTEN V. CALIFORNIA PIZZA KITCHEN INC. 37

Plaintiffs further argued that the mere fact that a mediator had presided over the settlement negotiations was no guarantee of its compliance with Rule 23(e)(2). D At the preliminary approval hearing held on June 29, 2022, the mediator took the stand and answered questions from the court. The district court stated that, based on the Settling Plaintiffs’ representations, “the settlement ha[d] a conservative value [of] over $3.7 million,” and the $800,000 in attorney’s fees amounted to “approximately 21 percent of the value of the settlement.” Nonetheless, the district court discerned “some due process issues with” the fact that the settlement would resolve the claims in the Kirsten litigation, despite the Kirsten Plaintiffs’ lack of involvement in the mediation. Moreover, the district court stated that it had “a tremendous concern about these fees,” due to the “reversionary” nature of the settlement. After returning from a recess, the district court announced that it would preliminarily find that the settlement was “adequate, fair, and reasonable.” The court then expressly addressed only one of the Kirsten Plaintiffs’ objections, namely, the claims-made structure of the settlement. The district court declined to approve the $800,000 in attorney’s fees at that time, explaining that it would wait to see how many claims were made in order to “incentivize[]” the Settling Plaintiffs’ counsel “to get as much money for this class” during the claims process. The court indicated that it would “probably” approve the requested attorney’s fees if the total settlement value amounted to approximately $3.2 million “or even” $2.5 million. The district court offered no comment on any of the Kirsten Plaintiffs’ other written objections, nor did the court

38 IN RE: KIRSTEN V. CALIFORNIA PIZZA KITCHEN INC.

set forth on the record any express findings justifying its conclusions. On June 30, 2022, the district court issued a written order preliminarily approving the settlement and finding the settlement “to be fair, reasonable, and adequate, and the result of vigilant, informed, non-collusive arms’-length negotiations overseen by an experienced and neutral mediator.” The court stated, without further explanation, that it “considered . . . the briefs and arguments of counsel.” As the majority puts it, “the district court’s preliminary . . . order[] w[as] sparse—almost boilerplate and memorialized little of the district court’s rationale.” See Opin. at 16. E Following the preliminary approval of the settlement, the Settling Plaintiffs and the class administrator sent out 103,380 direct postcard notices and 4,349 email notices to potential class members. Thereafter, a follow-up email notice was sent to more than 60,500 class members. There was also a targeted social media campaign on Facebook, Instagram, and LinkedIn. Despite these efforts, which went beyond the minimum notice provisions to which the Kirsten Plaintiffs had objected, the class administrator ultimately received only 1,828 unvalidated claims for a claims rate of less than 1.8%. On October 6, 2022, the Settling Plaintiffs filed their motion for final approval of the settlement. The Kirsten Plaintiffs objected, essentially re-raising the same concerns they had voiced prior to the preliminary approval hearing. They also pointed out that, after the preliminary approval hearing, their CCPA claims had survived both a motion to

IN RE: KIRSTEN V. CALIFORNIA PIZZA KITCHEN INC. 39

dismiss and a motion for reconsideration. ^[3] The Kirsten Plaintiffs further argued that the low claims rate highlighted that CPK would be “securing a full release” from the class “for a very low dollar cost” and that the settlement’s “notice scheme was woefully inadequate.” At the final approval hearing on November 7, 2022, the Settling Plaintiffs confirmed that the claims rate was approximately 1.8%, and they asserted that the final settlement value, prior to claim validation, was $1,161,149. 4 According to the Settling Plaintiffs, the claims made were as follows:

• 176 claims for ordinary expenses, totaling $384,134.77; • 979 claims for lost time, totaling $50,320.00; • 45 claims for extraordinary losses, totaling $191,354.50; • 803 claims for CCPA statutory damages, totaling $80,300.00; and • 1,264 claims for credit monitoring, totaling $455,040.00.

The court then asked the Kirsten Plaintiffs to repeat their objections on the record. The Kirsten Plaintiffs recounted

3 CPK filed motions to dismiss only in the Kirsten case and not in the consolidated cases. ^[4] As the majority agrees, however, counsel’s representation as to this “final settlement value” was flatly inaccurate: the settlement’s final value is closer to $950,000. See Opin. at 11; see infra Section II.A.

40 IN RE: KIRSTEN V. CALIFORNIA PIZZA KITCHEN INC.

that the settlement includes a clear-sailing provision; that the settlement was reversionary and had ultimately gotten “nowhere near the suggested 3 million or in excess of that”; and that, consequently, the Settling Plaintiffs’ counsel were receiving “a disproportionate amount of the settlement”— approximately 40%—in attorney’s fees. The Kirsten Plaintiffs also pointed out that the Settling Plaintiffs had not undergone any motions practice at all, which, in the Kirsten Plaintiffs’ view, demonstrated that the Settling Plaintiffs “gave up . . . leverage” by settling with CPK. The district court responded that it had already “gone through the collusion arguments” and “rejected those.” With respect to the settlement’s final value at $1.16 million, the court merely stated that it could not “recall why” it had earlier expected the settlement to amount to $3 million. The district court also noted its “tremendous concern over these attorney’s fees” of up to $800,000. At the conclusion of the hearing, the district court requested additional briefing on the issue of attorney’s fees. The district court did not discuss the remainder of the Kirsten Plaintiffs’ objections, nor did it set forth on the record any of its findings. The district court received the requested briefing concerning the attorney’s fees and held another hearing on December 5, 2022. 5 Thereafter, the district court on February 22, 2023 approved the settlement and awarded the maximum $800,000 in attorney’s fees to the Settling Plaintiff’s counsel. The court’s order contains no explanation for its ruling and merely states that the court “reviewed . . . any objections filed with or presented to the

5 Oddly enough, there does not appear to be any transcript of the December 5, 2022 hearing in the record of the district court or of this court.

IN RE: KIRSTEN V. CALIFORNIA PIZZA KITCHEN INC. 41

Court” and the “oral argument of counsel and any objectors who appeared.” Like the preliminary approval order, as the majority puts it, “the district court’s . . . final approval order[] w[as] sparse—almost boilerplate—and memorialized little of the district court’s rationale.” See Opin. at 16. II Given these details in the record, it is clear that the district court contravened its duty to explain why the settlement complied with Rule 23(e). Accordingly, the settlement approval should be vacated, and the case should be remanded. A “To survive appellate review, the district court must show it has explored comprehensively all factors, and must give a reasoned response to all non-frivolous objections.” Allen, 787 F.3d at 1223–24 (emphasis added) (simplified). And because, as the majority correctly recognizes, the settlement has a claims-made structure that resulted in a claims rate of less than two percent, provides attorney’s fees equivalent to 84% of the settlement’s benefit to the class, and contains a clear-sailing provision for these fees, the settlement here “raises all three red flags of potential collusion under” our caselaw. See Opin. at 17. The district court therefore had a “heightened obligation” to scrutinize the settlement for “any evidence of collusion or other conflicts of interest.” See Opin. at 19 (simplified). The district court did not abide by this mandate. To begin with, the district court committed an obvious and critical error by assuming that the settlement was valued at $1.16 million when in fact it was worth no more than

42 IN RE: KIRSTEN V. CALIFORNIA PIZZA KITCHEN INC.

$950,000. See Opin. at 11 (referring to this as a “glaring error . . . apparent on [the settlement’s] face”). Because of the $1,000 cap on per-claimant out-of-pocket expenses, the 176 claimants who sought $384,134.77 are entitled, at most, to $176,000. Yet the district court relied on a patently incorrect valuation of the settlement in determining whether the attorney’s fees were disproportionate to the settlement’s benefit to the class. This error is starker still because, as recounted above, the district court’s chief concern at the settlement approval hearings was the size of the settlement vis-à-vis the attorney’s fees award. It cannot be inferred that the district court “explored comprehensively all factors,” Allen, 787 F.3d at 1223–24 (simplified), when the district court—contrary to its asserted concern—failed to notice an obvious issue with the valuation of the settlement and thus failed to notice that the attorney’s fees are equivalent to 84% of the final settlement’s benefit to the class. See Kim, 8 F.4th at 1180 (reversing the district court in part for relying on an “inflated settlement value” in approving a class action settlement). Moreover, the record is bereft of any discussion of Rule 23(e)’s factors and many of the Kirsten Plaintiffs’ detailed objections. In particular, the district court did not respond to the Kirsten Plaintiffs’ objection to the settlement’s clear- sailing provision. “[W]hen confronted with a clear sailing provision”—particularly when the fee request is large vis-à- vis the benefits to the class—“the district court ha[d] a heightened duty to peer into the provision and scrutinize closely the relationship between attorney’s fees and benefit to the class.” In re Bluetooth, 654 F.3d at 948. The district court, as I have explained, failed to do this. Moreover, the district court nowhere addressed the Kirsten Plaintiffs’ objections that the Settling Plaintiffs had engaged in no

IN RE: KIRSTEN V. CALIFORNIA PIZZA KITCHEN INC. 43

motions practice or formal discovery, that the Kirsten Plaintiffs had been excluded from consolidation and settlement talks, that the settlement’s release clause was arguably overbroad, and that the methods by which the Settling Plaintiffs and the claims administrator reached out to potential class members were assertedly inadequate. At best, the district court acknowledged that it had heard these objections. “In the pre-certification context,” however, “the district court must do more than acknowledge that warning- sign provisions exist and then conclude that they are not dispositive without further apparent scrutiny.” McKinney- Drobnis v. Oreshack, 16 F.4th 594, 611 (9th Cir. 2021). The district court’s silence on the record and in its orders was in direct contravention of our precedent. Furthermore, what little the district court did state on the record was internally contradictory, making the court’s reasoning all the more confounding and opaque. At the preliminary approval hearing, the district court expressed considerable concern about the potential that the settlement’s value would end up being much less than $3 million, particularly given that the claims-made nature of the settlement arguably rendered it “reversionary” in nature. In one of its few substantive comments, the court explained that in “incentiviz[ing]” the Settling Plaintiffs’ counsel “to get as much money for this class” during the claims process, the court sought to address its discomfort about “not knowing the amount of the claims” that would ultimately be made. Yet, at the final hearing, the district court heard that the settlement’s final value was no more than $1.16 million, with a claims rate of less than two percent, and that therefore the court’s hope that the Settling Plaintiffs’ counsel would achieve the previously hypothesized claims rate had failed. Nonetheless, the district court approved the settlement. The

44 IN RE: KIRSTEN V. CALIFORNIA PIZZA KITCHEN INC.

district court never explained in its written orders or on the record why it did so, in spite of its prior stated concerns about the claims-made nature of the settlement and the possibility of a low claims rate. This failure to properly address the low claims rate was independently an abuse of discretion. In Allen, we vacated and remanded a settlement because, after “class counsel said that he would consider it a success if even 10% or 15% of the class made claims,” the actual “claims rate was less than 8%,” and “the record g[ave] no assurance” that the district court made any further inquiry, in light of that development, “into why the parties had negotiated such a disproportionate distribution between fees and relief.” 787 F.3d at 1224 n.4. (simplified). Likewise, in Roes, 1–2, we held that, “in light of the” low claims rate of a settlement with reversionary features, the district court “should have done more to investigate whether [the settlement] was really worth $1 million and was not unfairly inflating attorneys’ fees.” 944 F.3d at 1054–55. The low claims rate here should have caused the district court to investigate further and make clear findings, not resort to a perfunctory order. Finally, the narrow gap between the maximum value of the settlement and the attorney’s fees award “ma[de] it all the more important for the district court to closely examine the claimed value of the non-cash portions of the settlement that were used to justify the requested attorneys’ fees.” Roes, 1–2, 944 F.3d at 1051. While the district court asked questions about the two-year credit monitoring program, it never made a finding attaching a monetary value to the program. Again, we have previously reversed district courts for precisely this reason. See, e.g., Kim, 8 F.4th at 1179 (reversing a settlement approval because we discerned “no basis for [the district court’s]” decision to “accept[] class

IN RE: KIRSTEN V. CALIFORNIA PIZZA KITCHEN INC. 45

counsel’s unsupported representation” of the settlement’s injunctive relief’s worth); Allen, 787 F.3d at 1225 (reversing a district court after it “did not make express findings about the value of the injunctive relief”). The foregoing errors plainly demonstrate that the district court failed to apply heightened scrutiny to the settlement and therefore abused its discretion in approving the settlement. The settlement should be vacated, and this matter remanded to the district court so that it can engage in “a more searching inquiry,” Roes 1–2, 944 F.3d at 1050 (citation omitted), and provide a “clear explanation of why the disproportionate fee is justified” and why this settlement was not the result of collusion, In re Bluetooth, 654 F.3d at 949. B The majority agrees with much of what I have said. Specifically, the majority agrees that the district court had a “heightened obligation to ferret out any evidence of collusion or other conflicts of interest” in the negotiation of the settlement. See Opin. at 19 (simplified). The majority also agrees that the settlement here “raises all three red flags of potential collusion under Bluetooth,” see Opin. at 17 (citation omitted), and that the district court missed at least “one glaring error . . . apparent on [the] face” of the settlement, see Opin. at 11. Further, the majority agrees that, despite these red flags and the district court’s heightened obligation, “the district court’s preliminary and final approval orders were sparse—almost boilerplate—and memorialized little of the district court’s rationale,” see Opin. at 16, and that it is impossible to “infer the district court’s rationale for its fee award from the record,” even though the court “approv[ed] fees that appear excessive of

46 IN RE: KIRSTEN V. CALIFORNIA PIZZA KITCHEN INC.

[the] settlement[’s] value,” see Opin. at 24. The majority nonetheless upholds the approval of the settlement, but its reasons for doing so are flawed. The majority contends that it “can reasonably infer the district court’s rationale from the record,” see Opin. at 16, and that “the district court gave the settlement provisions a hard look under the Bluetooth factors,” see Opin. at 20. But this conclusory assertion lacks support in the record. The district court expressly addressed only one of the Bluetooth factors—the disparity between the size of the settlement and the attorney’s fees—and even then, it missed what even the majority refers to as a “glaring error” concerning the settlement’s final value. There is thus no evidence in the record that the district court gave a proper hard look at any of the Bluetooth factors. Moreover, the district court’s rationale cannot be “reasonably” inferred when the district court initially expressed “tremendous concern” about the settlement’s fee provisions if the settlement’s final value fell below $2.5 million and then, in an unexplained about-face, approved the fees award and reaffirmed the settlement approval even though the settlement’s final value fell to less than $1.2 million (and, in reality, $950,000). And nowhere does the record show why the district court rejected the Kirsten Plaintiffs’ remaining objections. The majority is simply wrong in concluding that the record here provides a sufficient basis for affirming the district court. ^[6]