Hartman v. Meta Platforms, Inc.

1

REBECCA HARTMAN, JOSEPH TURNER, R.H., a Minor, by and through her Guardian and Next of Friend REBECCA HARTMAN, and E.T., a Minor, by and through his Guardian and Next of Friend JOSEPH TURNER, on behalf of themselves and all other persons similarly situated known and unknown, Plaintiffs, v. META PLATFORMS, INC., Defendant.

No. 3:23-CV-02995-NJR

United States District Court, S.D. Illinois

September 17, 2024

MEMORANDUM AND ORDER

NANCY J. ROSENSTENGEL, Chief U.S. District Judge

In this putative class action lawsuit, Plaintiffs allege that Defendant Meta Platforms, Inc. (“Meta” or “Defendant”) violated the Illinois Biometric Information Privacy Act, 740 ILCS 14/1, et seq. (“BIPA”), by improperly collecting and possessing biometric identifiers and information through its Facebook Messenger and Messenger Kids applications (collectively “Messenger Applications”). (Doc. 23-2). Plaintiffs' theory is that Meta collects peoples' “face geometries” when they use the Messenger Applications' filters and effects (e.g., bunny ears and flower crowns), and that this practice fails to comply with BIPA's requirements. Id. Plaintiffs bring this action on behalf of themselves and other Illinois citizens whose face geometries were allegedly collected between June 28, 2018, and the date of judgment in this case.^[1]

Background

Meta released Facebook Messenger in August 2011 and Messenger Kids in December 2017. Compl. at ¶ 2 (Doc. 23-2). The Messenger Applications are widely available in popular app stores such as the Google Play App Store and the Apple App Store. Id. The named Plaintiffs are long-time users of the Messenger Applications: Rebecca Hartman and Joseph Turner have used Facebook Messenger for “ten-plus years,” whereas their minor children, including R.H and E.T., have used Messenger Kids for “several years.” Id. at ¶¶ 121, 122.

Until May 2022, the Messenger Applications included facial recognition technology known as “augmented reality” or “AR.” Id. at ¶¶ 64, 65. AR, as shown below, enabled users to superimpose filters, masks, emojis, and other effects while communicating with their contacts. Id. at ¶¶ 66, 76.

(Image Omitted)

This technology allegedly used “scans of face geometry to identify individuals' location[s], expressions, and movements” in real time so that filters and effects could be applied. Id. at ¶¶ 73, 74. The resulting facial geometry scans “model[ed] users [sic] faces and track[ed] [their] expressions” based on an “estimation of the location of parts of users' faces.” Id. at ¶¶ 72, 73. Meta then “collect[ed] the Biometric Data of each child and adult user who utilize[d] an effect or filter,” and stored it locally on a user's operating device and on its own servers. Id. at ¶¶ 74, 78, & 82.

Meta retains control over the data it collects, regardless of where it is stored. Id. at ¶¶ 92, 93. It controls data stored on its servers because it “owns operates, and controls” them. Id. at ¶ 92. This, in turn, gives Meta “exclusive control over the process by which Biometric Data is harvested and stored on its servers.” Id. In addition, Meta “possesses data stored locally on [Plaintiffs'] devices because it has complete and exclusive control” over it through its operation of the Messenger Applications. Id. at ¶ 93.

All of this happened without users' knowledge and consent. Id. at ¶ 2. Indeed, Meta allegedly did not inform Illinois users that their biometric data was being collected when they used the AR filters on the Messenger Applications. Id. at ¶ 126. Meta also provided no way for users to opt out of its data collection while using the AR filters in the Messenger Applications. Id. at ¶ at 89. And considering its collection and possession of biometric data, Plaintiffs allege that Meta failed to publish and follow a compliant data retention and destruction policy under BIPA. Id. at ¶¶ 94, 95, 145, & 146; see also 740 ILCS 14/15(a).

Legal Standard

A motion to dismiss under Federal Rule of Civil Procedure 12(b)(6) “tests whether the complaint states a claim on which relief may be granted.” Richards v Mitcheff, 696 F.3d 635, 637 (7th Cir. 2012). This “generous standard” requires courts to accept the plaintiff's factual allegations as true and draw all inferences in his or her favor. Domanus v. Locke Lord LLP, 847 F.3d 469, 479 (7th Cir. 2017); Reynolds v. CB Sports Bar, Inc., 623 F.3d 1143, 1146 (7th Cir. 2010) (quotation marks and citation omitted). To survive a Rule 12(b)(6) motion, the plaintiff only needs to allege enough facts to state a claim for relief that is plausible on its face. Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 570 (2007). A plaintiff need not plead detailed factual allegations, but must provide “more than labels and conclusions, and a formulaic recitation of the elements.” Id. at 555. Taken together, the factual allegations contained within a complaint must “raise a right to relief above the speculative level, . . . on the assumption that all the allegations in the complaint are true (even if doubtful in fact).” Id. (internal citations omitted).

Discussion

A. The BIPA Framework

BIPA regulates the collection, retention, use, and destruction of people's “biometric identifiers” and “biometric information” in Illinois. A “biometric identifier” is “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.”^[2] 740 ILCS 14/10. “Biometric information” is defined as “any information, regardless of how it is captured, converted, stored, or shared, based on an individual's biometric identifier used to identify an individual.” Id.

Private entities that collect and retain biometric identifiers and information must take certain steps to ensure that such information is securely and transparently handled. See 740 ILCS 14/15(a)-(b). Under section 15(a), “[a] private entity in possession of biometric identifiers or biometric information must develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information” within a certain amount of time. 740 ILCS 14/15(a). And, perhaps unsurprisingly, the entity must then comply with its biometric data retention and destruction policy.^[3] Id.; Patterson v. Respondus, Inc., 593 F.Supp.3d 783, 802 (N.D. Ill. 2022).

Section 15(b) prohibits a private entity from “collect[ing], captur[ing], purchas[ing], receiv[ing] through trade, or otherwise obtain[ing] a person's or a customer's biometric identifier or biometric information,” unless it first provides certain disclosures and obtains the subject's informed written consent. 740 ILCS 14/15(b). Private entities are also prohibited from selling, leasing, trading, or otherwise profiting from a person's biometric identifier or information. 740 ILCS 14/15(c). They also may not disclose, redisclose, or otherwise disseminate a person's biometric identifier or information, unless they receive the person's consent, the disclosure completes a financial transaction that the person authorized, or the disclosure is required by law. 740 ILCS 14/15(d)(1)-(4).

A person aggrieved by an entity's violation of these requirements may bring an action against the entity under BIPA. 740 ILCS 14/20(a). In such actions, a prevailing plaintiff may recover his or her actual or liquidated damages (whichever is greater), and reasonable attorney's fees and costs. Id. §§ (a)(1)-(3); see also Sosa v. Onfido, Inc., 600 F.Supp.3d 859, 873-74 (N.D. Ill. 2022).

B. Incorporation by Reference

Before reaching the merits of Defendant's arguments, the Court must address a threshold question: which documents are properly considered at this nascent stage of the litigation? This question is before the Court because Meta attached 11 documents to its motion to dismiss which, it contends, “are cognizable,” even though several of them are not mentioned in Plaintiffs' complaint. See Decl. of Lauren R. Goldman (Doc. 23-1) (listing exhibits to Meta's motion to dismiss and urging Court to consider them). This inquiry requires the Court to evaluate the following documents (attached to Meta's motion to dismiss as Exhibits A through K) to determine whether they may be considered at the pleading stage:

• Exhibit A: A copy of Plaintiffs' complaint filed on July 6, 2023. (Doc. 23-2).

• Exhibit B: Messenger Kids' Face and Hand Effects Privacy Notice, published in 2023. (Doc. 23-3).

• Exhibit C: Facebook Messenger's Face and Hand Effects Privacy Notice, published in 2023. (Doc. 23-4).

• Exhibit D: Meta's Terms of Service, last revised July 26, 2022. (Doc. 23-5).

• Exhibit E: Messenger Kids' Terms of Service, last revised February 4, 2020. (Doc. 23-6).

• Exhibit F: Messenger Kids' Privacy Policy, last revised December 15, 2022. (Doc. 23-7).

• Exhibit G: Facebook's Sign-up Webpage, published in 2023. (Doc. 23-8).

• Exhibit H: Messenger Kids' Sign-up Webpage, publication date unknown. (Doc. 23-9).

• Exhibit I: An article titled “Introducing Messenger Kids, a New App for Families to Connect,” by Loren Chang, Meta's Product Management Director, published December 4, 2017. (Doc. 23-10).

• Exhibit J: An article titled “Children's Online Privacy Protection Rule: A Six-Step Compliance Plan for Your Business,” published by the Federal Trade Commission, publication date unknown. (Doc. 23-11).

• Exhibit K: An article titled “Messenger Kids,” published in the Facebook Messenger Help Center in 2023. (Doc. 23-12).

As a general matter, courts may consider only the plaintiff's complaint on a motion to dismiss under Rule 12(b)(6). Rosenblum v. Tavelbyus.com Ltd., 299 F.3d 657, 661 (7th Cir. 2002). Indeed, if on a motion to dismiss “matters outside the pleadings are presented to and not excluded by the court, the motion must be treated as one...