Rivera v. Google Inc.

238 F.Supp.3d 1088

Lindabeth RIVERA and Joseph Weiss, on behalf of themselves and all others similarly situated, Plaintiffs,

v.GOOGLE INC., Defendant.

No. 16 C 02714

United States District Court, N.D. Illinois, Eastern Division.

Signed February 27, 2017

David P. Milian, pro hac vice, Frank S. Hedin, pro hac vice, Carey Rodriguez O'Keefe Milian Gonya, LLP, Miami, FL, Katrina Carroll, Ismael Tariq Salam, Kyle Alan Shamberg, Lite DePalma Greenberg LLC, Chicago, IL, Robert R. Ahdoot, pro hac vice, Tina Wolfson, pro hac vice, Ahdoot & Wolfson, PC, West Hollywood, CA, for Plaintiffs.

Nicola C. Menaldo, pro hac vice, Debra Rae Bernard, Perkins Coie LLP, Chicago, IL, Neal Kumar Katyal, pro hac vice, Hogan Lovells US LLP, Washington, DC, Sunita Bali, pro hac vice, Perkins Coie LLP, San Francisco, CA, Susan D. Fahringer, pro hac vice, Perkins Coie LLP, Seattle, WA, for Defendant.

MEMORANDUM OPINION AND ORDER

Honorable Edmond E. Chang, United States District Judge

The Illinois Biometric Information Privacy Act forbids the unauthorized collection and storing of some types of biometric data. 740 ILCS 14/1 et seq. A private entity cannot gather and use someone's "biometric identifier"—defined as retinal or iris scans, fingerprints, voiceprints, or hand or face geometry scans—unless that person has consented. Id. § 14/10. The Act also bans the non-consensual collection and storage of information (the Act labels it "biometric information") that is "based on" those biometric identifiers. Id.

In the months leading up to March 2016, photographs of Lindabeth Rivera were allegedly taken by a "Google Droid device"¹ in Illinois and automatically uploaded to Google Photos, a cloud-based service. R. 40, Rivera First Am. Compl. ¶ 27.² From there, Rivera claims, Google immediately scanned her facial features to create a unique face "template." Id. ¶ 28. Rivera brings suit against Google for a violation of the Biometric Information Privacy Act, arguing that the company took a scan of her facial geometry without her consent. Id. ¶¶ 45. Joseph Weiss alleges a violation of the same Act on the same grounds.³ See R. 41, Weiss First Am. Compl. He claims that Google used photographs of him, taken from a Google Droid device in Illinois (in this case his own), to unlawfully create a face scan. Id. ¶¶ 27–29. Google now moves to dismiss Rivera's and Weiss's claims under Federal Rule of Civil Procedure 12(b)(6) for failure to state a claim.⁴ See R. 48, Def.'s Mot. to Dismiss. For the reasons discussed below, Google's motion to dismiss is denied.

I. Background

For purposes of evaluating the dismissal motion, the Court must accept as true the allegations in the First Amended Complaints. Erickson v. Pardus , 551 U.S. 89, 94, 127 S.Ct. 2197, 167 L.Ed.2d 1081 (2007). Between around March 2015 and March 2016, "approximately eleven" photographs of Lindabeth Rivera were taken in Illinois by a Google Photos user on a Google Droid device. Rivera First Am. Compl. ¶ 27. The person who took the picture was an Illinois resident who had purchased the Droid device in Illinois. Id. As soon as the photographs of Rivera were taken, the Droid automatically uploaded them to the cloud-based Google Photos service. Id. According to the Complaint, Google immediately scanned each uploaded photograph of Rivera. Id. ¶ 28. The scans located her face and zeroed in on its unique contours to create a "template" that maps and records her distinct facial measurements. Id. At the time of the automatic upload and face-scan, the photographer's Droid device was still in Illinois and would have had an Illinois-based Internet Protocol (IP) address. Id. ¶ 27.

Weiss's experience was similar, except that Weiss himself was a user of Google Droid and Google Photos (Rivera, on the other hand, neither had a Droid nor a Google Photos account). Weiss First Am. Compl. ¶¶ 26–27; Rivera First Am. Compl. ¶ 26. Between 2013 and 2016, Weiss took "approximately twenty-one" photos of himself while in Illinois on his Droid device. Weiss First Am. Compl. ¶¶ 26–27. These photos were automatically uploaded when they were taken, and then immediately scanned to create a custom face-template based on Weiss's features. Id. ¶¶ 28–29. At the time of uploading and scanning, Weiss's Droid was in Illinois and it would have had an Illinois-based Internet Protocol (IP) address. Id. ¶ 28.

Both Rivera and Weiss contend that their face-templates were then used by Google to find and group together other photos of them. Rivera First Am. Compl. ¶ 29; Weiss First Am. Compl. ¶ 30. Google also used the templates to recognize their gender, age, race, and location. Rivera First Am. Compl. ¶ 30; Weiss First Am. Compl. ¶ 31. At no time was Rivera's or Weiss's consent sought by Google to create or use the face-templates. Rivera First Am. Compl. ¶¶ 32–33; Weiss First Am. Compl. ¶ 33–34. Nor did Rivera or Weiss give Google permission to collect or store the data derived from their faces. Rivera First Am. Compl. ¶ 31; Weiss First Am. Compl. ¶ 32.

Based on these allegations, Rivera and Weiss, individually and on behalf of a proposed class, bring suit against Google for a violation of the Illinois Biometric Information Privacy Act. They argue that the face geometry templates created by Google are "biometric identifiers" within the definition of the Privacy Act, and accordingly cannot be collected without consent. Rivera First Am. Compl. ¶¶ 1, 21, 43–48; Weiss First Am. Compl. ¶¶ 1, 21, 44–49. Rivera and Weiss also contend that when the face templates are used to recognize gender, age, and location, Google is collecting "biometric information" within the definition of the Act, which is also forbidden without consent. Rivera First Am. Compl. ¶¶ 1, 23, 43–48; Weiss First Am. Compl. ¶¶ 1, 23, 44–49. Rivera and Weiss finally allege that Google did not make publicly available a biometric data retention and destruction schedule as required by the Act. Rivera First Am. Compl. ¶ 47; Weiss First Am. Compl. ¶ 48. Google now moves to dismiss Plaintiffs' suit for failure to state a claim. See Def.'s Mot. to Dismiss; R. 49, Def.'s Br.

II. Standard

Google brings its motion under Federal Rule of Civil Procedure 12(b)(6). A Rule 12(b)(6) motion tests the sufficiency of the complaint, Hallinan v. Fraternal Order of Police of Chi. Lodge No. 7 , 570 F.3d 811, 820 (7th Cir. 2009) ; Gibson v. City of Chi. , 910 F.2d 1510, 1520 (7th Cir. 1990). When deciding a motion to dismiss, the Court accepts as true all factual allegations in the complaint and draws all reasonable inferences in the plaintiff's favor. Killingsworth v. HSBC Bank Nev., N.A. , 507 F.3d 614, 618 (7th Cir. 2007).

Under Rule 8(a)(2), a complaint generally need only include "a short and plain statement of the claim showing that the pleader is entitled to relief." Fed. R. Civ. P. 8(a)(2). The complaint must "give the defendant fair notice of what the ... claim is and the grounds upon which it rests." Bell Atl. Corp. v. Twombly , 550 U.S. 544, 555, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007) (alteration in original) (internal quotation marks and citation omitted). These allegations "must be enough to raise a right to relief above the speculative level," id. , and must "contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face,’ " Ashcroft v. Iqbal , 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009) (quoting Twombly , 550 U.S. at 570, 127 S.Ct. 1955 ). Only factual allegations are entitled to the assumption of truth, not mere legal conclusions. Iqbal , 556 U.S. at 678–79, 129 S.Ct. 1937.

III. Analysis

Google's primary argument is that Rivera and Weiss really are complaining about Google's use of their photographs , and the Illinois Biometric Information Privacy Act does not cover photographs or information derived from photographs. Def.'s Br. at 6–13. Google also offers a backup argument: even if what Google is doing would run afoul of the Privacy Act if done in Illinois , Google supposedly did not do anything in Illinois, so there is no violation of that Illinois law. Id. at 13–15. And Google offers a backup to the backup argument: if the Privacy Act does purport to cover what Google did outside of Illinois, then the state statute actually conflicts with the federal Constitution's Dormant Commerce Clause. Id. at 15–19. Each issue is addressed in turn below.

A. Face Geometry Scans

Google submits that Rivera's and Weiss's claims should be dismissed because the Privacy Act does not apply to photographs or information derived from photographs. Rivera and Weiss, however, argue that face geometry scans created from photographs are covered by the Act, and qualify as both "biometric identifiers" and "biometric information" within the Act. So the first question is whether the face geometry scan as described by Rivera and Weiss (a description that must be accepted as accurate at the dismissal-motion stage) fits the statutory definition of either "biometric identifier" or "biometric information." To answer the question, the usual principles of statutory interpretation apply.

Statutory interpretation starts with the plain meaning of the statute's text. Paris v. Feder , 179 Ill.2d 173, 227 Ill.Dec. 800, 688 N.E.2d 137, 139 (1997) ("The cardinal rule of statutory construction is to ascertain and give effect to the true intent of the legislature ... The best evidence of legislative intent is the language used in the statute itself, which must be given its plain and ordinary meaning." (citations omitted)). If the text bears a plain meaning, then that is the end of the interpretive exercise, and no other interpretive aids should be used. People v. Fitzpatrick , 158 Ill.2d 360, 198 Ill.Dec. 844, 633 N.E.2d 685, 687 (1994). When searching for the statutory text's plain meaning, the overall structure of the statute can provide guidance. Abrahamson v. Ill. Dep't of Prof'l Regulation , 153 Ill.2d 76, 180 Ill.Dec. 34, 606 N.E.2d 1111, 1118 (1992). Illinois also follows the...