Vance v. Microsoft Corp.

525 F.Supp.3d 1287

Steven VANCE, et al., Plaintiffs,

v.MICROSOFT CORPORATION, Defendant.

CASE NO. C20-1082JLR

United States District Court, W.D. Washington, at Seattle.

Signed March 15, 2021

David B. Owens, Loevy & Loevy, Seattle, WA, Gary F. Lynch, Pro Hac Vice, Carlson Lynch LLP, Pittsburgh, PA, Katrina Carroll, Pro Hac Vice, Nicholas R. Lange, Pro Hac Vice, Carlson Lynch LLP, Mike Kanovitz, Pro Hac Vice, Scott Drury, Pro Hac Vice, Loevy & Loevy, Chicago, IL, for Plaintiffs.

Elizabeth Brooke Herrington, Pro Hac Vice, Tyler Zachary Zmick, Pro Hac Vice, Morgan Lewis & Bockius, Chicago, IL, Stephen M. Rummage, Xiang Li, Davis Wright Tremaine, Seattle, WA, for Defendant.

ORDER GRANTING IN PART AND DENYING IN PART MICROSOFT'S MOTION TO DISMISS

JAMES L. ROBART, United States District Judge

I. INTRODUCTION

Before the court is Defendant Microsoft Corporation's ("Microsoft") motion to dismiss Plaintiffs Steven Vance and Tim Janecyk's (collectively, "Plaintiffs") complaint. (MTD (Dkt. # 25); Reply (Dkt. # 34).) Plaintiffs oppose the motion. (Resp. (Dkt. # 37).) Having considered the motion, the parties’ submissions regarding the motion, the relevant portions of the record, and the applicable law,¹ the court GRANTS in part and DENIES in part the motion to dismiss.

II. BACKGROUND

Facial recognition technology uses computer artificial intelligence and machine learning algorithms to "detect, recognize, verify and understand characteristics of humans faces."² (Compl. (Dkt. # 1) ¶ 23 (quoting Michele Merler, et al. , Diversity in Faces , IBM Research AI at 1 (Apr. 10, 2019)) ("Diversity in Faces ").) However, "significant technical hurdles" hinder the technology's accuracy, and improving that accuracy relies upon "the use of data-driven deep learning to train increasingly accurate models by using growing amounts of data." (Diversity in Faces at 1.) In other words, practice makes perfect: for artificial intelligence to more accurately recognize different faces, "vast quantities of images of a diverse array of faces" must be fed to the underlying machine-learning algorithms. (Compl. ¶ 24.)

Microsoft is one of many companies that have developed and produced facial recognition products. (Id. ¶¶ 3, 52-53.) Among these products are its Cognitive Services Face Application Program Interface and its Face Artificial Intelligence service that allow customers to embed facial recognition technology into their applications. (Id. ¶ 53.) Microsoft conducts "extensive business within Illinois" related to facial recognition, including selling its facial recognition products through an Illinois-based vendor; working with an Illinois-based business to build new applications for facial recognition technology; and working with Illinois entities to build a "digital transformation institute" that accelerates the use of artificial intelligence throughout society. (Id. ¶ 59.)

Plaintiffs are Illinois residents who, starting in 2008, uploaded photos of themselves to the photo-sharing website Flickr. (Id. ¶¶ 6-7, 28, 60-61, 69.) Both were in Illinois when uploading the photos. (Id. ¶¶ 60, 69.) Unbeknownst to Plaintiffs, Flickr, through its parent company Yahoo!, compiled hundreds of millions of photographs posted on its platform, including those of Plaintiffs and other Illinois residents, into a dataset ("Flickr dataset") that it then made publicly available to "help improve the accuracy and reliability of facial recognition technology." (Id. ¶¶ 29-32.)

Utilizing the Flickr dataset, International Business Machines Corporation ("IBM") selected one million images to create a new dataset called Diversity in Faces in an effort to reduce bias in facial recognition. (Id. ¶ 40.) IBM scanned the "facial geometry" of the images and created a "comprehensive set of annotations of intrinsic facial features," including craniofacial distances, areas and ratios, facial symmetry and contrast, skin color, age and gender predictions, subjective annotations, and pose and resolution. (Id. ¶ 41 (citing Diversity in Faces at 2).) Ultimately, IBM utilized "19 facial landmark points" to determine "68 key points for each face" and to extract "craniofacial features" for each image in the dataset. (Id. ¶¶ 42-43 (citing Diversity in Faces at 9).) Again, the Diversity in Faces dataset included the facial scans of Plaintiffs and other Illinois residents, but like Flickr and Yahoo!, IBM did not seek or receive permission from individuals whose faces were analyzed. (Id. ¶¶ 44-45.)

IBM made the Diversity in Faces dataset available to other companies seeking to improve their facial recognition technology. (Id. ¶ 47.) To obtain the dataset, companies applied for permission via an online questionnaire, and if IBM granted access, IBM would send a link for companies to download the dataset. (Id. ¶ 48.) Those with the dataset, and the corresponding information, could "identify the Flickr user who uploaded the photograph," "view the Flickr user's homepage," and "view each photograph's metadata, including any available [information] relating to where the photograph was taken or uploaded." (Id. ¶ 51.) Microsoft applied for and downloaded the dataset from IBM. (Id. ¶ 55.) Microsoft used the dataset to improve "the fairness and accuracy of its facial recognition products," which "improve[d] the effectiveness" of those products and made them "more valuable in the commercial marketplace." (Id. ¶¶ 57-58.) Once again, the dataset downloaded by Microsoft contained Plaintiffs’ information, but Microsoft did not inform or obtain permission from Plaintiffs. (Id. ¶¶ 56, 65-66, 73-74.)

Plaintiffs bring a class action suit against Microsoft for violating Illinois's Biometric Information Privacy Act, 740 ILCS 14/1, et seq. ("BIPA"), which regulates the collection, storage and use of biometric identifiers and biometric information (collectively, "biometric data"). (Id. ¶¶ 4, 17.) Specifically, they allege violations of two BIPA provisions: (1) Microsoft violated § 15(b) by collecting and obtaining biometric data without providing the requisite information or obtaining written releases; and (2) Microsoft violated § 15(c) by unlawfully profiting from individuals’ biometric data. (Id. ¶¶ 93-106.) Plaintiffs additionally bring an unjust enrichment claim (id. ¶¶ 107-16) and a separate count for injunctive relief (id. ¶¶ 117-22).

III. ANALYSIS

When considering a motion to dismiss under Rule 12(b)(6), the court construes the complaint in the light most favorable to the nonmoving party. Livid Holdings Ltd. v. Salomon Smith Barney, Inc. , 416 F.3d 940, 946 (9th Cir. 2005). The court must accept all well-pleaded facts as true and draw all reasonable inferences in favor of the plaintiff. Wyler Summit P'ship , 135 F.3d at 661. The court, however, is not required "to accept as true allegations that are merely conclusory, unwarranted deductions of fact, or unreasonable inferences." Sprewell v. Golden State Warriors , 266 F.3d 979, 988 (9th Cir. 2001). "To survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’ " Ashcroft v. Iqbal , 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009) (quoting Bell Atl. Corp. v. Twombly , 550 U.S. 544, 570, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007) ); see also Telesaurus VPC, LLC v. Power , 623 F.3d 998, 1003 (9th Cir. 2010). "A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Iqbal , 556 U.S. at 677-78, 129 S.Ct. 1937. Dismissal under Rule 12(b)(6) can be based on the lack of a cognizable legal theory or the absence of sufficient facts alleged under a cognizable legal theory. Balistreri v. Pacifica Police Dep't , 901 F.2d 696, 699 (9th Cir. 1990).

Microsoft moves to dismiss all of Plaintiffs’ claims in its instant motion. (See MTD.) The court addresses the arguments pertaining to each claim in turn.

A. BIPA Claims

In urging the court to dismiss Plaintiffs’ two BIPA claims, Microsoft first challenges the applicability of BIPA. (MTD at 6-15.) It argues that BIPA does not have extraterritorial effect here and that if it did, BIPA would violate the Dormant Commerce Clause. (Id. ) Even if BIPA applies, Microsoft contends that Plaintiffs fail to state a claim. (Id. at 16-22.) The court addresses each argument in turn.

1. Illinois Extraterritorial Doctrine

Microsoft first argues that BIPA was not intended to have exterritorial effect and thus could not apply here because Plaintiffs have not established that the claim occurred in Illinois. (Id. at 6-9.) The court, like many others that have considered this argument, determines that at this early stage, it cannot dismiss the BIPA claims on this basis.

The parties agree that an Illinois statute does not have an "extraterritorial effect unless a clear intent in this respect appears from the express provisions of the statute." Avery v. State Farm Mutual Auto. Ins. Co. , 216 Ill.2d 100, 296 Ill.Dec. 448, 835 N.E.2d 801, 852 (2005) ; (MTD at 6; see Resp. at 4-5.) They further agree that BIPA does not have such an express provision and thus is not authorized to have extraterritorial effect. (MTD at 6; see Resp. at 4-5); see Rivera v. Google Inc. , 238 F. Supp. 3d 1088, 1100 (N.D. Ill. 2017). Nonetheless, Plaintiffs may assert BIPA claims if they sufficiently allege that Microsoft's purported violations "occur[red] primarily and substantially in Illinois." See Avery , 296 Ill.Dec. 448, 835 N.E.2d at 853. The parties disagree on whether Plaintiffs have done so.

There is "no single formula or bright-line test for determining whether a transaction occurs within [Illinois]." Id. , 296 Ill.Dec. 448, 835 N.E.2d at 854. Instead, "each case must be decided on its own facts." Id. Courts consider a myriad of factors, including the plaintiff's residency, the location of harm, where communications between parties occurred, and where a...