Searching over 5,500,000 cases.

Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.

Rivera v. Google, Inc.

United States District Court, N.D. Illinois, Eastern Division

February 27, 2017

LINDABETH RIVERA and JOSEPH WEISS, on behalf of themselves and all others similarly situated, Plaintiffs,
GOOGLE INC., Defendant.



         The Illinois Biometric Information Privacy Act forbids the unauthorized collection and storing of some types of biometric data. 740 ILCS 14/1 et seq. A private entity cannot gather and use someone's “biometric identifier”-defined as retinal or iris scans, fingerprints, voiceprints, or hand or face geometry scans- unless that person has consented. Id. § 14/10. The Act also bans the non-consensual collection and storage of information (the Act labels it “biometric information”) that is “based on” those biometric identifiers. Id.

         In the months leading up to March 2016, photographs of Lindabeth Rivera were allegedly taken by a “Google Droid device”[1] in Illinois and automatically uploaded to Google Photos, a cloud-based service. R. 40, Rivera First Am. Compl. ¶ 27.[2] From there, Rivera claims, Google immediately scanned her facial features to create a unique face “template.” Id. ¶ 28. Rivera brings suit against Google for a violation of the Biometric Information Privacy Act, arguing that the company took a scan of her facial geometry without her consent. Id. ¶¶ 45. Joseph Weiss alleges a violation of the same Act on the same grounds.[3] See R. 41, Weiss First Am. Compl. He claims that Google used photographs of him, taken from a Google Droid device in Illinois (in this case his own), to unlawfully create a face scan. Id. ¶¶ 27-29. Google now moves to dismiss Rivera's and Weiss's claims under Federal Rule of Civil Procedure 12(b)(6) for failure to state a claim.[4] See R. 48, Def.'s Mot. to Dismiss. For the reasons discussed below, Google's motion to dismiss is denied.

         I. Background

         For purposes of evaluating the dismissal motion, the Court must accept as true the allegations in the First Amended Complaints. Erickson v. Pardus, 551 U.S. 89, 94 (2007). Between around March 2015 and March 2016, “approximately eleven” photographs of Lindabeth Rivera were taken in Illinois by a Google Photos user on a Google Droid device. Rivera First Am. Compl. ¶ 27. The person who took the picture was an Illinois resident who had purchased the Droid device in Illinois. Id. As soon as the photographs of Rivera were taken, the Droid automatically uploaded them to the cloud-based Google Photos service. Id. According to the Complaint, Google immediately scanned each uploaded photograph of Rivera. Id. ¶ 28. The scans located her face and zeroed in on its unique contours to create a “template” that maps and records her distinct facial measurements. Id. At the time of the automatic upload and face-scan, the photographer's Droid device was still in Illinois and would have had an Illinois-based Internet Protocol (IP) address. Id. ¶ 27.

         Weiss's experience was similar, except that Weiss himself was a user of Google Droid and Google Photos (Rivera, on the other hand, neither had a Droid nor a Google Photos account). Weiss First Am. Compl. ¶¶ 26-27; Rivera First Am. Compl. ¶ 26. Between 2013 and 2016, Weiss took “approximately twenty-one” photos of himself while in Illinois on his Droid device. Weiss First Am. Compl. ¶¶ 26-27. These photos were automatically uploaded when they were taken, and then immediately scanned to create a custom face-template based on Weiss's features. Id. ¶¶ 28-29. At the time of uploading and scanning, Weiss's Droid was in Illinois and it would have had an Illinois-based Internet Protocol (IP) address. Id. ¶ 28.

         Both Rivera and Weiss contend that their face-templates were then used by Google to find and group together other photos of them. Rivera First Am. Compl. ¶ 29; Weiss First Am. Compl. ¶ 30. Google also used the templates to recognize their gender, age, race, and location. Rivera First Am. Compl. ¶ 30; Weiss First Am. Compl. ¶ 31. At no time was Rivera's or Weiss's consent sought by Google to create or use the face-templates. Rivera First Am. Compl. ¶¶ 32-33; Weiss First Am. Compl. ¶ 33-34. Nor did Rivera or Weiss give Google permission to collect or store the data derived from their faces. Rivera First Am. Compl. ¶ 31; Weiss First Am. Compl. ¶ 32.

         Based on these allegations, Rivera and Weiss, individually and on behalf of a proposed class, bring suit against Google for a violation of the Illinois Biometric Information Privacy Act. They argue that the face geometry templates created by Google are “biometric identifiers” within the definition of the Privacy Act, and accordingly cannot be collected without consent. Rivera First Am. Compl. ¶¶ 1, 21, 43-48; Weiss First Am. Compl. ¶¶ 1, 21, 44-49. Rivera and Weiss also contend that when the face templates are used to recognize gender, age, and location, Google is collecting “biometric information” within the definition of the Act, which is also forbidden without consent. Rivera First Am. Compl. ¶¶ 1, 23, 43-48; Weiss First Am. Compl. ¶¶ 1, 23, 44-49. Rivera and Weiss finally allege that Google did not make publicly available a biometric data retention and destruction schedule as required by the Act. Rivera First Am. Compl. ¶ 47; Weiss First Am. Compl. ¶ 48. Google now moves to dismiss Plaintiffs' suit for failure to state a claim. See Def.'s Mot. to Dismiss; R. 49, Def.'s Br.

         II. Standard

         Google brings its motion under Federal Rule of Civil Procedure 12(b)(6). A Rule 12(b)(6) motion tests the sufficiency of the complaint, Hallinan v. Fraternal Order of Police of Chi. Lodge No. 7, 570 F.3d 811, 820 (7th Cir. 2009); Gibson v. City of Chi., 910 F.2d 1510, 1520 (7th Cir. 1990). When deciding a motion to dismiss, the Court accepts as true all factual allegations in the complaint and draws all reasonable inferences in the plaintiff's favor. Killingsworth v. HSBC Bank Nev., N.A., 507 F.3d 614, 618 (7th Cir. 2007).

         Under Rule 8(a)(2), a complaint generally need only include “a short and plain statement of the claim showing that the pleader is entitled to relief.” Fed.R.Civ.P. 8(a)(2). The complaint must “give the defendant fair notice of what the ... claim is and the grounds upon which it rests.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007) (alteration in original) (internal quotation marks and citation omitted). These allegations “must be enough to raise a right to relief above the speculative level, ” id., and must “contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face, '” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Twombly, 550 U.S. at 570). Only factual allegations are entitled to the assumption of truth, not mere legal conclusions. Iqbal, 556 U.S. at 678-79.

         III. Analysis

         Google's primary argument is that Rivera and Weiss really are complaining about Google's use of their photographs, and the Illinois Biometric Information Privacy Act does not cover photographs or information derived from photographs. Def.'s Br. at 6-13. Google also offers a backup argument: even if what Google is doing would run afoul of the Privacy Act if done in Illinois, Google supposedly did not do anything in Illinois, so there is no violation of that Illinois law. Id. at 13-15. And Google offers a backup to the backup argument: if the Privacy Act does purport to cover what Google did outside of Illinois, then the state statute actually conflicts with the federal Constitution's Dormant Commerce Clause. Id. at 15-19. Each issue is addressed in turn below.

         A. Face Geometry Scans

         Google submits that Rivera's and Weiss's claims should be dismissed because the Privacy Act does not apply to photographs or information derived from photographs. Rivera and Weiss, however, argue that face geometry scans created from photographs are covered by the Act, and qualify as both “biometric identifiers” and “biometric information” within the Act. So the first question is whether the face geometry scan as described by Rivera and Weiss (a description that must be accepted as accurate at the dismissal-motion stage) fits the statutory definition of either “biometric identifier” or “biometric information.” To answer the question, the usual principles of statutory interpretation apply.

         Statutory interpretation starts with the plain meaning of the statute's text. Paris v. Feder, 688 N.E.2d 137, 139 (Ill. 1997) (“The cardinal rule of statutory construction is to ascertain and give effect to the true intent of the legislature … The best evidence of legislative intent is the language used in the statute itself, which must be given its plain and ordinary meaning.” (citations omitted)). If the text bears a plain meaning, then that is the end of the interpretive exercise, and no other interpretive aids should be used. People v. Fitzpatrick, 633 N.E.2d 685, 687 (Ill. 1994). When searching for the statutory text's plain meaning, the overall structure of the statute can provide guidance. Abrahamson v. Ill. Dep't of Prof'l Regulation, 606 N.E.2d 1111, 1118 (Ill. 1992). Illinois also follows the interpretive principle that identical words used in different parts of the same statute are generally presumed to have the same meaning. Baker v. Salomon, 334 N.E.2d 313, 316 (Ill. 1975). And, when possible, courts should avoid interpreting a statute in a way that renders a word or phrase redundant, meaningless, or superfluous. People v. Trainor, 752 N.E.2d 1055, 1063 (Ill. 2001).

         Start with the text. The Privacy Act forbids private entities from gathering and keeping a person's “biometric identifier” and “biometric information” without first giving notice and getting consent:

         No private entity may collect, capture, purchase, receive through trade, or otherwise obtain a person's or a customer's biometric identifier or biometric information, unless it first:

(1) informs the subject … in writing that a biometric identifier or biometric information is being collected or stored;
(2) informs the subject … in writing of the specific purpose and length of term for which a biometric identifier or biometric information is being collected, stored, and used; and
(3) receives a written release executed by the subject of the biometric identifier or biometric information … .

740 ILCS 14/15(b). Beyond the ban on non-consensual gathering and collecting, private entities that do obtain biometric identifiers and information must publish a “retention schedule” that details how the data will be kept and when it will eventually be destroyed.[5] Victims of a violation may bring a private right of action, with potential recovery set by a statutory damages provision. 740 ILCS 14/20. For a negligent violation, liquidated damages of $1, 000 or actual damages (whichever is greater) are available for each instance; for an intentional or reckless violation, the numbers ratchet up to liquidated damages of $5, 000 for each violation or actual damages (whichever is greater). Id.

         But what is a “biometric identifier” and what is “biometric information”? The latter is defined by reference to the former, so it makes sense to start with “biometric identifier.” The Act defines “biometric identifier” in a very specific way:

“Biometric identifier” means a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.

740 ILCS 14/10. One-by-one, this definition specifies each particular type of covered biometric identifier. This specific, one-by-one listing is different from the many statutory definitions that use general words, like “record, document, or tangible object, ” 18 U.S.C. § 1519 (interpreted by Yates v. United States, 135 S.Ct. 1074, 1086-88 (2015)), or the statutes that list out a set of specific items and then add a broader general word, like “moneys, funds, credits, securities or other things of value, ” 18 U.S.C. § 657. In contrast to those definitions, here the Privacy Act defines “biometric identifier” with the complete set of specific qualifying biometric identifiers. Each specific item on the list, not surprisingly, fits within ...

Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.