United States District Court, N.D. Illinois, Eastern Division
LINDABETH RIVERA and JOSEPH WEISS, on behalf of themselves and all others similarly situated, Plaintiffs,
GOOGLE INC., Defendant.
MEMORANDUM OPINION AND ORDER
HONORABLE EDMOND E. CHANG UNITED STATES DISTRICT JUDGE.
Illinois Biometric Information Privacy Act forbids the
unauthorized collection and storing of some types of
biometric data. 740 ILCS 14/1 et seq. A private
entity cannot gather and use someone's “biometric
identifier”-defined as retinal or iris scans,
fingerprints, voiceprints, or hand or face geometry scans-
unless that person has consented. Id. § 14/10.
The Act also bans the non-consensual collection and storage
of information (the Act labels it “biometric
information”) that is “based on” those
biometric identifiers. Id.
months leading up to March 2016, photographs of Lindabeth
Rivera were allegedly taken by a “Google Droid
device” in Illinois and automatically uploaded to
Google Photos, a cloud-based service. R. 40, Rivera First Am.
Compl. ¶ 27. From there, Rivera claims, Google
immediately scanned her facial features to create a unique
face “template.” Id. ¶ 28. Rivera
brings suit against Google for a violation of the Biometric
Information Privacy Act, arguing that the company took a scan
of her facial geometry without her consent. Id.
¶¶ 45. Joseph Weiss alleges a violation of the same
Act on the same grounds. See R. 41, Weiss First Am.
Compl. He claims that Google used photographs of him, taken
from a Google Droid device in Illinois (in this case his
own), to unlawfully create a face scan. Id.
¶¶ 27-29. Google now moves to dismiss Rivera's
and Weiss's claims under Federal Rule of Civil Procedure
12(b)(6) for failure to state a claim. See R.
48, Def.'s Mot. to Dismiss. For the reasons discussed
below, Google's motion to dismiss is denied.
purposes of evaluating the dismissal motion, the Court must
accept as true the allegations in the First Amended
Complaints. Erickson v. Pardus, 551 U.S. 89, 94
(2007). Between around March 2015 and March 2016,
“approximately eleven” photographs of Lindabeth
Rivera were taken in Illinois by a Google Photos user on a
Google Droid device. Rivera First Am. Compl. ¶ 27. The
person who took the picture was an Illinois resident who had
purchased the Droid device in Illinois. Id. As soon
as the photographs of Rivera were taken, the Droid
automatically uploaded them to the cloud-based Google Photos
service. Id. According to the Complaint, Google
immediately scanned each uploaded photograph of Rivera.
Id. ¶ 28. The scans located her face and zeroed
in on its unique contours to create a “template”
that maps and records her distinct facial measurements.
Id. At the time of the automatic upload and
face-scan, the photographer's Droid device was still in
Illinois and would have had an Illinois-based Internet
Protocol (IP) address. Id. ¶ 27.
experience was similar, except that Weiss himself was a user
of Google Droid and Google Photos (Rivera, on the other hand,
neither had a Droid nor a Google Photos account). Weiss First
Am. Compl. ¶¶ 26-27; Rivera First Am. Compl. ¶
26. Between 2013 and 2016, Weiss took “approximately
twenty-one” photos of himself while in Illinois on his
Droid device. Weiss First Am. Compl. ¶¶ 26-27.
These photos were automatically uploaded when they were
taken, and then immediately scanned to create a custom
face-template based on Weiss's features. Id.
¶¶ 28-29. At the time of uploading and scanning,
Weiss's Droid was in Illinois and it would have had an
Illinois-based Internet Protocol (IP) address. Id.
Rivera and Weiss contend that their face-templates were then
used by Google to find and group together other photos of
them. Rivera First Am. Compl. ¶ 29; Weiss First Am.
Compl. ¶ 30. Google also used the templates to recognize
their gender, age, race, and location. Rivera First Am.
Compl. ¶ 30; Weiss First Am. Compl. ¶ 31. At no
time was Rivera's or Weiss's consent sought by Google
to create or use the face-templates. Rivera First Am. Compl.
¶¶ 32-33; Weiss First Am. Compl. ¶ 33-34. Nor
did Rivera or Weiss give Google permission to collect or
store the data derived from their faces. Rivera First Am.
Compl. ¶ 31; Weiss First Am. Compl. ¶ 32.
on these allegations, Rivera and Weiss, individually and on
behalf of a proposed class, bring suit against Google for a
violation of the Illinois Biometric Information Privacy Act.
They argue that the face geometry templates created by Google
are “biometric identifiers” within the definition
of the Privacy Act, and accordingly cannot be collected
without consent. Rivera First Am. Compl. ¶¶ 1, 21,
43-48; Weiss First Am. Compl. ¶¶ 1, 21, 44-49.
Rivera and Weiss also contend that when the face templates
are used to recognize gender, age, and location, Google is
collecting “biometric information” within the
definition of the Act, which is also forbidden without
consent. Rivera First Am. Compl. ¶¶ 1, 23, 43-48;
Weiss First Am. Compl. ¶¶ 1, 23, 44-49. Rivera and
Weiss finally allege that Google did not make publicly
available a biometric data retention and destruction schedule
as required by the Act. Rivera First Am. Compl. ¶ 47;
Weiss First Am. Compl. ¶ 48. Google now moves to dismiss
Plaintiffs' suit for failure to state a claim.
See Def.'s Mot. to Dismiss; R. 49, Def.'s
brings its motion under Federal Rule of Civil Procedure
12(b)(6). A Rule 12(b)(6) motion tests the sufficiency of the
complaint, Hallinan v. Fraternal Order of Police of Chi.
Lodge No. 7, 570 F.3d 811, 820 (7th Cir. 2009);
Gibson v. City of Chi., 910 F.2d 1510, 1520 (7th
Cir. 1990). When deciding a motion to dismiss, the Court
accepts as true all factual allegations in the complaint and
draws all reasonable inferences in the plaintiff's favor.
Killingsworth v. HSBC Bank Nev., N.A., 507 F.3d 614,
618 (7th Cir. 2007).
Rule 8(a)(2), a complaint generally need only include
“a short and plain statement of the claim showing that
the pleader is entitled to relief.” Fed.R.Civ.P.
8(a)(2). The complaint must “give the defendant fair
notice of what the ... claim is and the grounds upon which it
rests.” Bell Atl. Corp. v. Twombly, 550 U.S.
544, 555 (2007) (alteration in original) (internal quotation
marks and citation omitted). These allegations “must be
enough to raise a right to relief above the speculative
level, ” id., and must “contain
sufficient factual matter, accepted as true, to ‘state
a claim to relief that is plausible on its face, '”
Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting
Twombly, 550 U.S. at 570). Only factual allegations
are entitled to the assumption of truth, not mere legal
conclusions. Iqbal, 556 U.S. at 678-79.
primary argument is that Rivera and Weiss really are
complaining about Google's use of their
photographs, and the Illinois Biometric Information
Privacy Act does not cover photographs or information derived
from photographs. Def.'s Br. at 6-13. Google also offers
a backup argument: even if what Google is doing would run
afoul of the Privacy Act if done in Illinois, Google
supposedly did not do anything in Illinois, so there is no
violation of that Illinois law. Id. at 13-15. And
Google offers a backup to the backup argument: if the Privacy
Act does purport to cover what Google did outside of
Illinois, then the state statute actually conflicts with the
federal Constitution's Dormant Commerce Clause.
Id. at 15-19. Each issue is addressed in turn below.
Face Geometry Scans
submits that Rivera's and Weiss's claims should be
dismissed because the Privacy Act does not apply to
photographs or information derived from photographs. Rivera
and Weiss, however, argue that face geometry scans created
from photographs are covered by the Act, and qualify
as both “biometric identifiers” and
“biometric information” within the Act. So the
first question is whether the face geometry scan as described
by Rivera and Weiss (a description that must be accepted as
accurate at the dismissal-motion stage) fits the statutory
definition of either “biometric identifier” or
“biometric information.” To answer the question,
the usual principles of statutory interpretation apply.
interpretation starts with the plain meaning of the
statute's text. Paris v. Feder, 688 N.E.2d 137,
139 (Ill. 1997) (“The cardinal rule of statutory
construction is to ascertain and give effect to the true
intent of the legislature … The best evidence of
legislative intent is the language used in the statute
itself, which must be given its plain and ordinary
meaning.” (citations omitted)). If the text bears a
plain meaning, then that is the end of the interpretive
exercise, and no other interpretive aids should be used.
People v. Fitzpatrick, 633 N.E.2d 685, 687 (Ill.
1994). When searching for the statutory text's plain
meaning, the overall structure of the statute can provide
guidance. Abrahamson v. Ill. Dep't of Prof'l
Regulation, 606 N.E.2d 1111, 1118 (Ill. 1992).
Illinois also follows the interpretive principle that
identical words used in different parts of the same statute
are generally presumed to have the same meaning. Baker v.
Salomon, 334 N.E.2d 313, 316 (Ill. 1975). And, when
possible, courts should avoid interpreting a statute in a way
that renders a word or phrase redundant, meaningless, or
superfluous. People v. Trainor, 752 N.E.2d
1055, 1063 (Ill. 2001).
with the text. The Privacy Act forbids private entities from
gathering and keeping a person's “biometric
identifier” and “biometric information”
without first giving notice and getting consent:
private entity may collect, capture, purchase, receive
through trade, or otherwise obtain a person's or a
customer's biometric identifier or biometric information,
unless it first:
(1) informs the subject … in writing that a biometric
identifier or biometric information is being collected or
(2) informs the subject … in writing of the specific
purpose and length of term for which a biometric identifier
or biometric information is being collected, stored, and
(3) receives a written release executed by the subject of the
biometric identifier or biometric information … .
740 ILCS 14/15(b). Beyond the ban on non-consensual gathering
and collecting, private entities that do obtain biometric
identifiers and information must publish a “retention
schedule” that details how the data will be kept and
when it will eventually be destroyed. Victims of a violation may
bring a private right of action, with potential recovery set
by a statutory damages provision. 740 ILCS 14/20. For a
negligent violation, liquidated damages of $1, 000 or actual
damages (whichever is greater) are available for each
instance; for an intentional or reckless violation, the
numbers ratchet up to liquidated damages of $5, 000 for each
violation or actual damages (whichever is greater).
what is a “biometric identifier” and what is
“biometric information”? The latter is defined by
reference to the former, so it makes sense to start with
“biometric identifier.” The Act defines
“biometric identifier” in a very specific way:
“Biometric identifier” means a retina or iris
scan, fingerprint, voiceprint, or scan of hand or face
740 ILCS 14/10. One-by-one, this definition specifies each
particular type of covered biometric identifier. This
specific, one-by-one listing is different from the many
statutory definitions that use general words, like
“record, document, or tangible object, ” 18
U.S.C. § 1519 (interpreted by Yates v. United
States, 135 S.Ct. 1074, 1086-88 (2015)), or the statutes
that list out a set of specific items and then add a broader
general word, like “moneys, funds, credits, securities
or other things of value, ” 18 U.S.C. § 657. In
contrast to those definitions, here the Privacy Act defines
“biometric identifier” with the complete
set of specific qualifying biometric identifiers.
Each specific item on the list, not surprisingly, fits within