In re Clearview AI, Inc., Consumer Privacy Litig.

585 F.Supp.3d 1111

IN RE CLEARVIEW AI, INC., CONSUMER PRIVACY LITIGATION,

Case No. 21-cv-0135

United States District Court, N.D. Illinois, Eastern Division.

Signed February 14, 2022

MEMORANDUM OPINION AND ORDER

SHARON JOHNSON COLEMAN, United States District Judge

Plaintiffs brought a first amended consolidated class action complaint in this multi-district litigation against the "Clearview defendants," which include Clearview AI, Inc., Hoan Ton-That, Richard Schwartz, Thomas Mulcaire, and Rocky Mountain Data Analytics LLC. Plaintiffs bring claims under the Illinois Biometric Information Privacy Act, 740 ILCS 14/1, et seq. ("BIPA"), as well as statutory and common law claims under Virginia, California, and New York law. Before the Court is the Clearview defendants’ motion to dismiss under Federal Rules of Civil Procedure 12(b)(1) and 12(b)(6). For the following reasons, the Court grants in part and denies in part the Clearview defendants’ motion.

Background

The Court presumes familiarity with its prior rulings in this multi-district litigation. In their first amended consolidated class action complaint, plaintiffs allege that the Clearview defendants’ conduct violated their privacy rights and that defendants’ use of their biometric information was without their knowledge and consent. Plaintiffs specifically allege that the Clearview defendants covertly scraped over three billion photographs of facial images from the internet and then used artificial intelligence algorithms to scan the face geometry of each individual depicted to harvest the individuals’ unique biometric identifiers and corresponding biometric information.

The centerpiece of this multi-district litigation and plaintiffs’ class action lawsuit is BIPA. The Illinois General Assembly "enacted BIPA in 2008 in response to the growing use of biometrics ‘in the business and security screening sectors.’ " Fox v. Dakkota Integrated Sys., LLC, 980 F.3d 1146, 1149 (7th Cir. 2020) (quoting 740 ILCS 14/5 ). The legislative findings include:

Biometrics are unlike other unique identifiers that are used to access finances or other sensitive information. For example, social security numbers, when compromised, can be changed. Biometrics, however, are biologically unique to the individual; therefore, once compromised, the individual has no recourse, is at heightened risk for identity theft, and is likely to withdraw from biometric-facilitated transactions.

740 ILCS 14/5(c). The Illinois General Assembly further concluded that "[t]he public welfare, security, and safety will be served by regulating the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information." 740 ILCS 14/5(g).

The Illinois Supreme Court has explained that through BIPA, "our General Assembly has codified that individuals possess a right to privacy in and control over their biometric identifiers and biometric information." Rosenbach v. Six Flags Entm't Corp., 129 N.E.3d 1197, 1206, 432 Ill.Dec. 654, 663, 2019 IL 123186, ¶ 33 (Ill. 2019). As the Seventh Circuit has noted, BIPA "is designed to protect consumers against the threat of irreparable privacy harms, identity theft, and other economic injuries arising from the increasing use of biometric identifiers and information by private entities." Bryant v. Compass Group USA, Inc. , 958 F.3d 617, 619 (7th Cir. 2020).

Legal Standards

A Rule 12(b)(1) motion challenges federal jurisdiction, including Article III standing, and the party invoking jurisdiction bears the burden of establishing the elements necessary for subject matter jurisdiction, including standing. Thornley v. Clearview AI, Inc. , 984 F.3d 1241, 1244 (7th Cir. 2021) ; International Union of Operating Eng'rs v. Daley , 983 F.3d 287, 294 (7th Cir. 2020). Under Rule 12(b)(1), the Court accepts all well-pleaded factual allegations as true and construes all reasonable inferences in the plaintiff's favor when a defendant is facially attacked standing. Prairie Rivers Network v. Dynegy Midwest Generation, LLC , 2 F.4th 1002, 1007 (7th Cir. 2021).

A motion to dismiss pursuant to Rule 12(b)(6) for failure to state a claim tests the sufficiency of the complaint, not its merits. Skinner v. Switzer , 562 U.S. 521, 529, 131 S.Ct. 1289, 179 L.Ed.2d 233 (2011). When considering dismissal of a complaint, the Court accepts all well-pleaded factual allegations as true and draws all reasonable inferences in favor of the plaintiff. Erickson v. Pardus , 551 U.S. 89, 94, 127 S.Ct. 2197, 167 L.Ed.2d 1081 (2007) (per curiam). To survive a motion to dismiss, plaintiff must "state a claim for relief that is plausible on its face." Bell Atlantic Corp. v. Twombly , 550 U.S. 544, 570, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007). A complaint is facially plausible when the plaintiff alleges enough "factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Ashcroft v. Iqbal , 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009).

Discussion

First Amendment

The Court starts with the parties’ First Amendment arguments, keeping in mind that state statutes are presumed constitutional. Heller v. Doe by Doe , 509 U.S. 312, 320, 113 S.Ct. 2637, 125 L.Ed.2d 257 (1993). The Supreme Court recognizes that First Amendment protections and state-protected privacy interests can clash. See The Florida Star v. B.J.F., 491 U.S. 524, 533, 109 S.Ct. 2603, 105 L.Ed.2d 443 (1989). As the Florida Star Court reasoned, "the sensitivity and significance of the interests presented in clashes between First Amendment and privacy rights counsel relying on limited principles that sweep no more broadly than the appropriate context of the instant case." Id. at 533, 109 S.Ct. 2603. Accordingly, at this stage of the proceedings, the Court must review plaintiffs’ allegations in detail and examine the First Amendment arguments narrowly in order to strike a balance between privacy interests and the interests protected by the First Amendment. See id. ; Snyder v. Phelps , 562 U.S. 443, 462, 131 S.Ct. 1207, 179 L.Ed.2d 172 (2011) (Breyer, J., concurrence).

Viewing plaintiffs’ allegations as true and in their favor, plaintiffs allege the Clearview defendants covertly scraped over three billion photographs of facial images from the internet and then used artificial intelligence algorithms to scan the face geometry of each photograph to harvest the individuals’ unique biometric identifiers and information. Clearview then created a searchable database containing this biometric information and data that allows users to identify unknown individuals by uploading a photograph to the database. The database can be searched remotely by licensed users of Clearview's web application. Plaintiffs further allege that the Clearview defendants have collected, captured, or otherwise obtained their biometric data without notice and consent, and thereafter, sold or otherwise profited from their biometric information.

Here, the Clearview defendants maintain that the capture of faceprints from public images and Clearview's analysis of the public faceprints is protected speech, and thus, BIPA violates the First Amendment by inhibiting Clearview's ability to collect and analyze public information. See Sorrell v. IMS Health Inc., 564 U.S. 552, 570, 131 S.Ct. 2653, 180 L.Ed.2d 544 (2011) ("This Court has held that the creation and dissemination of information are speech within the meaning of the First Amendment."). Plaintiffs, however, assert that the capturing of faceprints and the action of extracting private biometric identifiers from the faceprints is unprotected conduct. See Rumsfeld v. Forum for Acad. & Institutional Rights, Inc. , 547 U.S. 47, 66, 126 S. Ct. 1297, 164 L.Ed. 2d 156 (2006).

The Clearview defendants’ argument oversimplifies plaintiffs’ allegations. Although Clearview captures public photographs from the internet, according to plaintiffs’ allegations, Clearview then harvests an individual's unique biometric identifiers and information—which are not public information—without the individual's consent. Put differently, plaintiffs assert that the Clearview defendants’ business model is not based on the collection of public photographs from the internet, some source code, and republishing information via a search engine, but the additional conduct of harvesting nonpublic, personal biometric data. And, as plaintiffs further allege, unlike fingerprints, facial biometrics are readily observable and present a grave and immediate danger to privacy, individual autonomy, and liberty. See Fox , 980 F.3d at 1155 (biometric identifiers "are immutable, and once compromised, are compromised forever").

Accordingly, Clearview's process in creating its database involves both speech and nonspeech elements. When these "elements are combined in the same course of conduct, a sufficiently important governmental interest in regulating the nonspeech element can justify incidental limitations on First Amendment freedoms."

United States v. O'Brien , 391 U.S. 367, 376, 88 S.Ct. 1673, 20 L.Ed.2d 672 (1968). Under these circumstances, the Court applies the intermediate scrutiny standard elucidated in O'Brien , namely, a regulation does not violate the First Amendment if (1) it is within the power of the government to enact, (2) furthers an important government interest, (3) the governmental interest is unrelated to the suppression of free expression, and (4) any incidental restriction on speech is no greater than is necessary to further the government interest. Id. at 377, 88 S.Ct. 1673 ; Foxxxy Ladyz Adult World, Inc. v. Village of Dix, Ill. , 779 F.3d 706, 712 (7th Cir. 2015).

The parties do not discuss the power of the Illinois General Assembly to enact BIPA, therefore, the Court turns to the second O'Brien prong. The General Assembly enacted BIPA to protect Illinois residents’ highly sensitive biometric information from unauthorized collection and disclosure. See 740 ILCS...