Martell v. X Corp.

1

MARK MARTELL, on behalf of himself and all others similarly situated, Plaintiff, v. X CORP., Defendant.

No. 23 C 5449

United States District Court, N.D. Illinois, Eastern Division

June 13, 2024

MEMORANDUM OPINION AND ORDER

HONORABLE SUNIL R. HARJANI, JUDGE

In this lawsuit, Plaintiff Mark Martell brings a Class Action Complaint on behalf of himself and others similarly situated for violations of the Illinois Biometric Information Privacy Act (BIPA) against Defendant X Corp.^[1] Martell alleges that he uploaded a photograph of himself on the social media platform X (formerly known as Twitter), which X analyzed for nudity and other not-safe-for-work content using a Microsoft product called PhotoDNA. Plaintiff alleges that PhotoDNA created a unique digital signature of the photograph, known as a “hash”, to compare against other photographs' hashes. As a result, Plaintiff alleges that creating this hash necessarily created a scan of his facial geometry in violation of BIPA. Defendant moved to dismiss the Complaint pursuant to Federal Rule of Civil Procedure 12(b)(6) claiming that the Complaint fails to state a claim upon which relief can be granted. For the reasons stated below Defendant's motion [15] is granted.

Legal Standard

“A motion under Rule 12(b)(6) tests whether the complaint states a claim on which relief may be granted.” Richards v. Mitcheff, 696 F.3d 635, 637 (7th Cir. 2012). To survive a Rule 12(b)(6) motion, “a complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.'” Ashcroft v. Iqbal, 556 U.S. 662 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). This pleading standard does not necessarily require a complaint to contain detailed factual allegations. Twombly, 550 U.S. at 555. Rather, “[a] claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Adams v. City of Indianapolis, 742 F.3d 720, 728 (7th Cir. 2014) (quoting Iqbal, 556 U.S. at 678). When deciding a motion to dismiss under Rule 12(b)(6), the court accepts as true all factual allegations in the complaint and draws all inferences in favor of the plaintiff. Heredia v. Capital Management Services, L.P., 942 F.3d 811, 814 (7th Cir. 2019). However, a complaint must consist of more than “threadbare recitals of the elements of a cause of action, supported by mere conclusory statements.” Iqbal, 556 U.S. at 678 (quoting Twombly, 550 U.S. at 555).

Discussion

The Defendant raises three primary issues with the Complaint. First, Defendant argues the Complaint should be dismissed because Plaintiff fails to plausibly allege that PhotoDNA collects facial geometry scans as defined by BIPA. Second, Defendant contends that the hashes created by PhotoDNA are not biometric information or biometric identifiers under BIPA because they cannot be used to identify a person. Finally, Defendant argues that the Communication Decency Act bars Plaintiff's claim.^[2] The Court will address each of these arguments in turn.

Initially, it is important to understand what BIPA protects. In 2008, the Illinois legislature found that businesses were increasingly using biometrics to streamline financial transactions and security screenings. The legislature found that biometrics-unlike other identifiers such as social security numbers that can be changed if compromised-are “biologically unique to the individual; therefore, once compromised, the individual has no recourse, is at heightened risk for identity theft, and is likely to withdraw from biometric-facilitated transactions.” 740 ILCS 14/5(c). The legislature also found that an overwhelming majority of the public was weary of using biometrics when such information was tied to finances and other personal information. Since the full ramifications of biometric technology were not fully known, the legislature found that “public welfare, security, and safety will be served by regulating the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information.” 740 ILCS 14/5(g).

BIPA prohibits private entities from collecting or capturing “a person's or a customer's biometric identifier or biometric information” without first providing written notice that the information is being collected and of the specific purpose and length of the term for the collection, storage, and use of the data. 740 ILCS 14/15(b). The entity must then receive written consent from the subject of the biometric identifier or biometric information. Id. BIPA defines “biometric identifier” as “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.” 740 ILCS 14/10. BIPA further defines “biometric information” as any information “based on an individual's biometric identifier used to identify an individual.” Id.

Facial Geometry

Defendant first argues that the Complaint should be dismissed because Plaintiff fails to plausibly allege that PhotoDNA collects facial geometry scans as defined by BIPA. Defendant contends that according to Microsoft's website, which Plaintiff cited in the Complaint, PhotoDNA is not facial recognition software and cannot be used to identify a person, so it cannot be a scan of facial geometry. Defendant argues that an allegation that PhotoDNA scanned the facial geometry of the individuals in the photograph is required for the scans to be considered a biometric under BIPA. Plaintiff responds that he sufficiently alleged that PhotoDNA scans for facial geometry.

Whether PhotoDNA scans for facial geometry is an important consideration because a scan of face geometry is required for the conduct to be covered by BIPA. BIPA defines “biometric identifier” as “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.” 740 ILCS 14/10. The statute then goes on to list items that do not qualify as biometric identifiers including writing samples, written signatures, demographic data, tattoo descriptions, physical descriptions, and relevant to this dispute, photographs. Id. Thus, Plaintiff must allege that the PhotoDNA scanned individuals' face geometry and not just that it scanned a photo. This consideration also impacts what qualifies as biometric information because biometric information is “based on an individual's biometric identifier,” so if PhotoDNA only scans a photograph, it is not biometric information.

Plaintiff responds that he sufficiently alleged that the PhotoDNA software collected facial geometry scans when it created the unique hash for the photograph. Specifically, Plaintiff alleged that “PhotoDNA creates a unique digital signature (known as a ‘hash') of an image which is then compared against signatures (hashes) of other photos to find copies of the same image.” Compl. [1-2] ¶ 25. Plaintiff included in the Complaint an image from Microsoft's website, which he alleged shows that PhotoDNA creates “a unique digital signature, or ‘hash,' from any image containing a person's face [which] necessitates creating a scan of that person's facial geometry.” Id. ¶ 27. The Court finds that these allegations are conclusory. The fact that PhotoDNA creates a unique hash for each photo does not necessarily imply that it is scanning for an individual's facial geometry when creating the hash.

The absence of factual allegations to this point is evident when Plaintiff's allegations are compared to BIPA complaints where district courts found that a plaintiff plausibly alleged that the defendant collected their biometric identifier. For example, in Carpenter v. McDonald's Corp., the plaintiff alleged that the defendant's “AI voice assistant is able to extract voice information including pitch, volume, and duration along with identifying information like age, gender, nationality, and national origin.” 580 F.Supp.3d 512, 517 (N.D. Ill. 2022). The plaintiff also alleged that the AI voice assistant used an acoustic model that was trained to receive “a graphical representation, measurement, or illustration of acoustic patterns.” Id. The court also noted that “importantly, Plaintiff alleges that McDonald's uses the AI and data to actually identify unique individuals.” Id. The court found that these allegations were sufficient to plausibly allege that the technology “mechanically analyzes customers' voices in a measurable way such that McDonald's has collected a voiceprint[.]” Id. Here, Plaintiff has not made similar factual allegations but instead merely concludes that creating the digital hash “necessitates creating a scan of that person's facial geometry.” Compl. [1-2] ¶ 27. Plaintiff's Complaint does not include factual allegations about the hashes including that it conducts a face geometry scan of individuals in the photo. Allegations that a photo was scanned are insufficient to plausibly allege that PhotoDNA creates a scan of an individual's face geometry under BIPA.

Similarly in Rivera v. Google Inc., the plaintiff alleged that when she was photographed on a Google Android device, those photos were automatically uploaded to Google Photos and Google immediately scanned each of the photos. 238 F.Supp.3d 1088, 1091 (N.D. Ill. 2017). The plaintiff alleged that the scans “located her face and zeroed in on its unique contours to create a ‘template' that maps and records her distinct facial measurements.” Id. The court found that the allegation that Google created a biology-based face template of the individuals in the photos was sufficient to allege a scan of face geometry under BIPA. Id. at 1095. Importantly, the court noted that the plaintiff was not alleging that the photos themselves were biometric identifiers, but rather that the...