I’d argue there’s even more resting on Judge Thrash’s shoulders, including whether companies can get away with abusing our data in the future. Metcalfe, who has steeped himself in the world of class-action suits, suggested that the settlements, initially a method for accountability, have become a mechanism for companies to knowingly skirt liability for not protecting consumers. “It’s becoming cheaper to say sorry after the fact than to obey the law in the first place,” he told me.

This feels especially true in the world of data privacy, where breaches are so frequent that a discovery last week of an open database containing the personal information of 1.2 billion people hardly made news. We seem locked in a vicious cycle: Companies that gather and trade data have few checks or regulations. This allows them to collect more, which means more money. And deeper pockets make it harder to impose meaningful penalties that might deter repeat and future offenders (see: the Federal Trade Commission’s $5 billion slap on the wrist of Facebook). Judge Thrash, then, has a unique opportunity to make a statement by objecting.

And he’d have many good reasons to do so. First, the cash payout to the actual victims is paltry — less than 5 percent of the total amount set aside for the entire settlement. The small set of lawyers, supposedly representing the interests of the class, stand to make double the entire victim payout (this ratio is not uncommon in class-action settlements). Perhaps most galling, the free credit monitoring service that Equifax is doling out as part of the settlement will be provided by fellow data broker Experian, which suffered its own data breach in 2015 (approximately 15 million Social Security numbers and other personal information were exposed).

To recap: Equifax is avoiding accountability by offloading millions of its users’ data to another party with a shoddy history of data security practices, which will then profit from the services.

Should Judge Thrash decide to approve the settlement (and if subsequent appeals are lost), three things are likely to happen. The minimal compensation for the 147 million Americans who had their data exposed would be more evidence that their data has little value, and those who took the time to file claims may not file after the next big breach. For future settlement lawyers, the ruling would set a precedent, namely that there’s a big fee to be had offering consumers very little restitution (also a common critique of class-action settlements). For data brokers, the Equifax lesson would be stark: Failing to invest in information security is not an irresponsible business decision. (The company’s total settlement was $700 million; last year it posted $3.41 billion in revenue; after the settlement, Equifax’s stock was higher than it was at the time of the breach.)