Barnett v. Apple Inc.

225 N.E.3d 602

2022 IL App (1st) 220187

David BARNETT, Ethel Burr, and Michael Henderson, Plaintiffs-Appellants,

v.APPLE INC., Defendant-Appellee.

No. 1-22-0187

Appellate Court of Illinois, First District, SIXTH DIVISION.

Filed December 23, 2022

Appeal from the Circuit Court of Cook County. No. 21 CH 3119, The Honorable Neil H. Cohen, Judge, presiding.

William H. Beaumont, of Beaumont Costales LLC, of Chicago, and Philip L. Fraietta, of Bursor & Fisher, P.A., of New York, New York, for appellants.

Raj N. Shah, Eric M. Roberts, and Yan Grinblat, of DLA Piper LLP (US), and Joshua G. Vincent and Kimberly A. Jansen, of Hinshaw & Culbertson LLP, both of Chicago, and Isabelle Ord (pro hac vice), of DLA Piper LLP (US), of San Francisco, California, for appellee.

OPINION

JUSTICE ODEN JOHNSON delivered the judgment of the court, with opinion.

¶ 1 Plaintiffs, David Barnett, Ethel Burr, and Michael Henderson, appeal the dismissal of their putative class action suit. The trial court dismissed their complaint with prejudice, pursuant to section 2-615 of the Code of Civil Procedure (735 ILCS 5/2-615 (West 2020)), for failure to state a cause of action. The two-count complaint alleges that defendant Apple Inc. (Apple) violated the Biometric Information Privacy Act (Act) (740 ILCS 14/1 et seq. (West 2020)) by offering users of its phones and computers the option of utilizing face and fingerprint recognition features (1) without first instituting a written policy, regarding the retention and destruction of the users’ biometric information and (2) without first obtaining the users’ written consent. Plaintiffs claim that, under the Act, Apple was in "possession" of, and had "collected" and "captured," the users’ biometric information where Apple designed and owns the software that plaintiffs opted to use and where Apple has the ability to, and does, remotely update the software.

¶ 2 On this appeal, plaintiffs do not dispute that the user’s biometric information is stored on the user’s own device; that Apple does not collect or store this information on a separate server or device; that these features are completely optional; that the user is the sole entity deciding whether or not to use these features; that, to enable the features, the user employs his or her own device to capture and collect his or her own biometric information on that device; and that the user has the power to delete this biometric information from the device at any time without negatively impacting the device.

¶ 3 For the following reasons, we do not find plaintiffs’ claims persuasive and affirm the trial court’s dismissal.

¶ 4 BACKGROUND

¶ 5 I. The Complaint’s Allegations

¶ 6 Since, on a motion to dismiss, we accept as true all the well-pleaded allegations of the complaint, we provide below what the complaint does and does not allege. See infra ¶ 29.

¶ 7 A. The Parties

¶ 8 The three named plaintiffs are Barnett, Burr, and Henderson. The complaint alleges that "[t]his Court has personal jurisdiction over [Apple] because the biometrics that give rise to this lawsuit were captured from Plaintiff Barnett while he was residing and physically present in Cook County." There is no such similar allegation made with respect to the remaining two plaintiffs, Burr and Henderson. However, all three plaintiffs are, and have been "at all relevant times," residents and citizens of Illinois.

¶ 9 The defendant is Apple, a California corporation, with its principal place of business in California. Apple manufactures iPhones, iPads, and MacBooks with "Touch ID" and "Face ID" features, and it sells or distributes these products throughout Illinois.

¶ 10 B. "Touch ID" and "Face ID"

¶ 11 "Touch ID" is a "fingerprint recognition feature" that gives the user the option of allowing his or her device to "extract[ ]" his or her fingerprint. Similarly, "Face ID" is a "facial recognition feature" that gives the user the option of allowing his or her device to "extract[ ]" the user's "facial geometry." The user may then use Touch ID and Face ID to unlock the device and authorize purchases on Apple Pay, as well as purchases and downloads on the App Store. Both Apple Pay and the App Store are regulated and controlled by Apple, Users may also use Touch and Face ID "as direct log-in methods" for apps by other developers.

¶ 12 The Touch and Face ID features work by means of a mathematical representation. After the user has the device collect his or her fingerprint or facial image, the Touch or Face ID software on the device uses the image "to create a unique mathematical representation." "[T]his representation is stored on [the] user's device." If a user has "already enrolled" in the Touch or Face ID feature, then the device compares the representation "with the saved representation" already on the device.

¶ 13 After the user’s initial activation of Touch or Face ID, Apple "use[s]" subsequent Tog-in attempts "to augment [its] fingerprint and facial recognition technology." While the complaint does not allege how Apple "use[s]" the log-in attempts, the complaint cites in a footnote a 2017 article on Apple’s website that says that the Face ID software on the device may gather more information about the user's face during subsequent log-in attempts in order " ‘to augment ‘future matching.’ " "Apple also collects diagnostic data from users, like how many are using Touch ID and how often they unlock their device."

¶ 14 Apple is the sole owner of its software, while users are licensees. Users cannot "access their own biometrics" collected by and stored on their own devices without violating "Apple’s Software License Agreement." Apple regularly updates the software on its users’ devices.

¶ 15 The complaint provides the following quote from Apple’s website describing Touch ID:

"The [Touch ID] sensor uses advanced capacitive touch to take a high-resolution image from small sections from your fingerprint from the subepidermal layers of your skin. Touch ID then intelligently analyzes this information with a remarkable degree of detail and precision. It categorizes your fingerprint as one of three basic types—arch, loop, or whorl. It also maps out individual details in the ridges that are smaller than the human can see, and even inspects minor variations in ridge direction caused by pores and edge structures *** It then creates a mathematical representation of your fingerprint and compares this to your enrolled fingerprint data to identify a match and unlock your device."¹

¶ 16 The complaint provides the following quote from Apple’s website describing Face ID:

"The [Face ID] TrueDepth camera captures accurate face data by projecting and analyzing over 30,000 invisible dots to create a depth map of your face and also captures an infrared image of your face. A portion of the neural engine of the *** Bionic chip—protected with the Secure Enclave—transforms the depth map and infrared image into a mathematical representation and compares that representation to the enrolled facial data."

The Secure Enclave is on the user’s device. The complaint details all the steps, with photos, that a user must take in order to capture and collect his or her biometric information and store it in the Secure Enclave within the device.

¶ 17 C. Counts and Relief

¶ 18 As noted above, the two-count complaint alleges that Apple violated the Act (740 ILCS 14/1 et seq. (West 2020)) by offering users of its phones and computers the option of using face and fingerprint recognition features (1) without first instituting a written policy regarding the retention and destruction of the users’ biometric information and (2) without first obtaining the users’ written consent.

¶ 19 In relief, plaintiffs seek class certification, attorney fees and costs, and "statutory damages of $5,000.00 for each and every intentional and/or reckless violation of [the Act] pursuant to 740 ILCS 14/20(2), or alternatively statutory damages of $1,000.00 for each and every violation pursuant to 740 ILCS 14/20-1 if the Court finds that Defendant’s violations were negligent."

¶ 20 II. Motion to Dismiss

¶ 21 Plaintiffs filed their complaint on June 25, 2021, and served Apple on July 12, 2021. After an agreed-upon extension of time, Apple moved on October 8, 2021, to dismiss the complaint pursuant to section 2-615 (735 ILCS 5/2-615 (West 2020)) for failure to, state a cause of action. In its motion, Apple argued that plaintiffs elected to use the Touch and Face ID features and that plaintiffs’ biometric information is stored on their own devices. On November 12, 2021, plaintiffs filed a response that relied heavily on the cases of Hazlitt v. Apple Inc., 500 F. Supp. 3d 738 (S.D. Ill. 2020), and Zaluda v. Apple Inc., No. 2019-CH-11771 (Cir. Ct. Cook County, Oct. 29, 2020).²

¶ 22 As exhibits to their response, plaintiffs attached (1). the Zaluda complaint, (2) Apple’s section 2-619.1 motion to dismiss in the Zaluda case, and (3) the October 29, 2020, order by the Zaluda circuit court denying Apple’s motion to dismiss "[f]or the reasons stated on the record." As an exhibit to its reply, Apple attached, what appears to be, an excerpt from a transcript in the Zaluda case. The excerpt is preceded by a cover page entitled "Remote Zoom Motions Ruling[,] Thursday, October 22, 2020." The excerpt appears to be pages 9 and 10 from a 20-page transcript, and the excerpt both starts and ends in the middle of sentences. The excerpt states in full:

"different motion, but that motion is not before us.

Apple maintains that the user profile is not a voiceprint. The plaintiffs assert otherwise, specifically in the complaint citing to Paragraphs 49 through and inclusive of 51 in a factual way, at least what I’m viewing as a factual assertion, which is consistent with what the Code requires, they—plaintiffs have properly pled the existence of a voiceprint or that the user profile is a voiceprint, I think that’s a better way to put it.

So, the next issue is whether or not there has been, in a

...