(Bloomberg) -- A federal judge ruled that 29 million Facebook Inc. users whose data was compromised by a hack into the platform can band together to try to force the company to improve its security measures, but they can’t seek money damages.

U.S. District Judge William Alsup in San Francisco said Tuesday he’s granting class-action status in the lawsuit because “Facebook’s repetitive losses of users’ privacy supplies a long-term need for supervision.” But the judge barred the user who filed the suit from pursuing damages on behalf of others for identity-theft credit monitoring because plaintiff Steven Adkins “has incurred zero out-of-pocket expenses as a result of this breach.”