Zellmer v. Meta Platforms, Inc.

104 F.4th 1117

Clayton P. ZELLMER,on behalf of himself and all others similarly situated, Plaintiff-Appellant, v. META PLATFORMS, INC., Defendant-Appellee.

No. 22-16925

United States Court of Appeals, Ninth Circuit

Submitted February 7, 2024 San Francisco, California

Filed June 17, 2024

Appeal from the United States District Court for the Northern District of California, James Donato, District Judge, Presiding, D.C. No. 3:18-cv-01880-JD

John Carey (argued), Carey Rodriguez LLP, Miami, Florida; David P. Milian, The Milian Legal Group, Miami, Florida; Albert Y. Chang, Bottini & Bottini Inc., La Jolla, California; for Plaintiff-Appellant.

Lauren R. Goldman (argued), Michael Brandon, and Lefteri J. Christos, Gibson Dunn & Crutcher LLP, New York, New York; Michael G. Rhodes and Whitty Somvichian, Cooley LLP, San Francisco, California; John Nadolenco, Mayer Brown LLP, Los Angeles, California; for Defendant-Appellee.

Roman Martinez and Jeremy L. Brown, Latham & Watkins LLP, Washington, D.C.; Gary Feinerman, Latham & Watkins LLP, Chicago, Illinois; for Amicus Curiae, Security Industry Association.

Before: Ryan D. Nelson, Danielle J. Forrest, and Gabriel P. Sanchez, Circuit Judges.

OPINION

R. NELSON, Circuit Judge:

Clayton Zellmer has never used Facebook. He sued Facebook—now Meta Platforms—for alleged violations of the Illinois Biometrics Information Privacy Act after his friends uploaded photographs of him to Facebook. He alleged that Facebook collected or captured his biometric identifiers when it created what Facebook calls a "face signature" from those uploaded photos. The district court granted summary judgment to Facebook on that claim. Zellmer also alleged that Facebook failed to publish a written policy establishing its retention schedule for collected biometric data. The district court dismissed that claim for lack of standing. We have jurisdiction under 28 U.S.C. § 1291, and we affirm.

I

A

Under the Illinois Biometrics Information Privacy Act (BIPA), a private entity can "collect, capture, purchase, receive through trade, or otherwise obtain a person's or a customer's biometric identifier or biometric information" only if it:

• Informs the subject or her representative in writing of the collection or storage of her biometric identifier or information;

• Informs the subject or her representative in writing of "the specific purpose and length of term" for their use; and

• Receives written authorization to do so from the subject or her representative.

740 ILL. COMP. STAT. 14/15(b) (Section 15(b)). A "biometric identifier" is "a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry." Id. 14/10. As potentially relevant, biometric identifiers do not include photographs. Id. For its part, "biometric information" is "any information, regardless of how it is captured, converted, stored, or shared, based on an individual's biometric identifier used to identify an individual" and "does not include information derived from items or procedures excluded under the definition of biometric identifiers." Id.

Any company that possesses biometric identifiers or information must "develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information." Id. 14/15(a) (Section 15(a)). The required policy must clarify that any collected biometric identifier or information will be deleted "when the initial purpose" for the collection "has been satisfied or within 3 years of the individual's last interaction with the private entity, whichever occurs first." Id. To ensure compliance, BIPA grants a "right of action" against an "offending party" to anyone aggrieved by a violation of its terms. Id. 14/20.

B

"In 2010, Facebook launched a feature called Tag Suggestions." Patel v. Facebook, Inc., 932 F.3d 1264, 1268 (9th Cir. 2019). If a user enables Tag Suggestions, Facebook "analyze[s] whether the user's Facebook friends are in photos uploaded by that user." Id. If there is a match, then Facebook suggests that the user "tag" his friend. Id. The Tag Suggestions feature proceeds in four steps.

The first step is the Detection Stage. Facebook analyzes the photo to determine whether it includes any human faces. If Facebook detects a human face, it produces a cropped image of the face. Nothing more is done at this stage.

The next step is the Alignment Stage. Facebook takes any cropped image of a face and standardizes it by centering it, bringing it forward, and scaling it. Facebook is not always successful at standardizing a photo's detected faces. But if alignment is successful, then Facebook moves to the third step.

That step—which is the focus of this appeal—is the Representation Stage. Facebook tries to create what it calls a "face signature." A face signature is a string of numbers that represents a particular image of a face. Face signatures do not—and cannot—reveal information about a face's geometric information. And they neither reveal facial features nor the distances between them. They are simply numbers—an abstract, numerical representation of the aligned face crop created in previous stages. No one—not even Facebook—can reverse-engineer the numbers comprising a given face signature to derive information about a person. And even if the reverse-engineering of a face signature were technically possible, face signatures exist for only a tiny fraction of a second—they are neither saved nor stored after the final stage of the Tag Suggestions process.

The final step is the Classification Stage, which occurs immediately after a face signature is created. At this point, Facebook compares the face signature to what it calls face templates, which are only created for Facebook users. Facebook does not run the new face signature against every face template it has. Instead, it compares the face signature with the face templates of users who have both enabled face recognition and are connected to the user who uploaded the photo from which Facebook created the face signature. Regardless of whether the comparison yields a match, the face signature is immediately deleted.

C

After Zellmer's friends uploaded photos of him to Facebook, he sued Facebook (now Meta, which we use interchangeably) alleging violations of Sections 15(a) and 15(b) of BIPA by collecting, using, and storing biometric identifiers from photos without first obtaining written consent and establishing a public retention schedule.

After discovery, the district court granted summary judgment to Meta on Zellmer's Section 15(b) claim, finding that this statutory section did not protect the privacy interests of non-users. Zellmer v. Facebook, Inc., No. 3:18-CV-01880-JD, 2022 WL 976981, at *5 (N.D. Cal. Mar. 31, 2022). In the district court's view, "it would be patently unreasonable to construe BIPA to mean that Facebook was required to provide notice to, and obtain consent from, non-users who were for all practical purposes total strangers to Facebook, and with whom Facebook had no relationship whatsoever." Id. at *3. The court considered this construction of Section 15(b) "untenable" because it deviated from the Illinois legislature's intent and would lead to absurd results, such as putting Meta in the "impossible position" of "obtain[ing] consent from every stranger whose face happened to be caught on camera." Id. at *3-5. And that requirement would require Meta to abandon Tag Suggestions everywhere to avoid violating the law in Illinois. Such a result, the court explained, was impossible to square with the Supreme Court of Illinois's conclusion that BIPA "should not impose extraordinary burdens on businesses." Id. at *5; accord id. at *3 (quoting Rosenbach v. Six Flags Ent. Corp., 432 Ill.Dec. 654, 129 N.E.3d 1197, 1207 (Ill. 2019)).

The district court denied Meta summary judgment on the Section 15(a) claim, finding that there is a factual dispute to be resolved at trial. Id. at *5. A few months later, the district court addressed Zellmer's standing to bring a Section 15(a) claim. Zellmer v. Facebook, Inc., No. 3:18-CV-01880-JD, 2022 WL 16924098 (N.D. Cal. Nov. 14, 2022). It held that Zellmer lacked Article III standing because he did not suffer a particularized injury and dismissed the Section 15(a) claim. Id. at *2-4.

II

We review "a summary judgment ruling de novo." Guzman v. Polaris Indus. Inc., 49 F.4th 1308, 1311 (9th Cir. 2022). We review the facts in the light most favorable to the non-moving party. Scott v. Harris, 550 U.S. 372, 380, 127 S.Ct. 1769, 167 L.Ed.2d 686 (2007). "[I]f the nonmoving party contests summary judgment, the alleged factual dispute must be both genuine and material to the non-moving party's claims." Momox-Caselis v. Donohue, 987 F.3d 835, 841 (9th Cir. 2021). But the nonmoving party "may not rest upon mere allegations or denials of his pleading, but must set forth specific facts showing that there is a genuine issue for trial." Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 256, 106 S.Ct. 2505, 91 L.Ed.2d 202 (1986). "The mere existence of a scintilla of evidence in support of the plaintiff's position will be insufficient; there must be evidence on which the jury could reasonably find for the plaintiff." Id. at 252, 106 S.Ct. 2505. "The judge's inquiry, therefore, unavoidably asks whether reasonable jurors could find by a preponderance of the evidence that the plaintiff is entitled to a verdict." Id. We "may affirm on any ground supported by the record." Maner v. Dignity Health, 9 F.4th 1114, 1119 (9th Cir. 2021).

We likewise review a grant of a motion to dismiss for lack of standing de novo. Wakefield v. ViSalus, Inc., 51 F.4th 1109, 1117 (9th Cir. 2022). In reviewing a ruling on a motion to dismiss, we accept the allegations in the complaint as true. Ashcroft v. Iqbal, 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009).

III

A

We begin by rejecting the grounds on which the district court granted summary judgment to Meta. As we...