Opinion
23 C 1566
08-06-2024
TYRONE BRANTLEY, on behalf of himself and all others similarly situated, Plaintiff, v. PRISMA LABS, INC., Defendant.
MEMORANDUM OPINION AND ORDER
HON. JORGE ALONSO, UNITED STATES DISTRICT JUDGE
Plaintiff Tyrone Brantley brings suit, individually and on behalf of all others similarly situated, against Prisma Labs, Inc., for violation of Illinois' Biometric Information Privacy Act (“BIPA”), 740 ILCS 14/1, et seq. Plaintiff asserts two counts under 740 ILCS 14/15(b) (“Section 15(b)”), one count under 740 ILCS 14/15(c) (“Section 15(c)”), and one count under 740 ILCS 14/15(d) (“Section 15(d)”). Before the Court is Defendant's motion to dismiss pursuant to Federal Rule of Civil Procedure 12(b)(1), (2), (3), and (6) (“Motion” or “Mot.”). For the following reasons, the Court grants the Motion under Rule 12(b)(1) and, alternatively, under Rule 12(b)(2).
BACKGROUND
Defendant moves in part under Rule 12(b)(1), which challenges the Court's subject matter jurisdiction. Fed.R.Civ.P. 12(b)(1). Typically, on a Rule 12(b)(1) motion, courts “read a complaint liberally and accept as true the well pleaded allegations of the complaint and the inferences that may be reasonably drawn from those allegations.” Sapperstein v. Hager, 188 F.3d 852, 855 (7th Cir. 1999) (citation and internal punctuation omitted). However, in considering a factual Rule 12(b)(1) challenge, the court may look beyond the pleadings and consider competent evidence. Apex Digital, Inc. v. Sears, Roebuck & Co., 572 F.3d 440, 444 (7th Cir. 2009) (“[T]he district court may properly look beyond the jurisdictional allegations of the complaint and view whatever evidence has been submitted on the issue to determine whether in fact subject matter jurisdiction exists[.]”). “Once such evidence is offered, . . . the plaintiff bears the burden of coming forward with competent proof that jurisdiction exists.” Id. (internal quotations omitted). In accordance with this authority, unless otherwise noted, the following facts are taken from the First Amended Complaint (“FAC”) and are assumed true for the purposes of this motion at this stage of the proceedings.
Prisma is the developer of the Lensa App, a popular mobile application on which users can upload photos of themselves and, for a fee, generate avatars called “Magic Avatars.” (FAC ¶ 3, ECF No. 21.) Prisma explains in its Privacy Policythat the Magic Avatar feature works by running third-party software, specifically the neutral neural network model, or AI model, of nonparty Stability AI called Stable Diffusion. In 2022, Stability AI used a dataset called LAION-5B (“LAION-5B Dataset”) to train or fine-tune Stable Diffusion. (Poyaganov Decl. ¶¶ 9-10.) Nonparty LAION, a German non-profit with no ties to Prisma, created the LAION-5B Dataset. (Id. ¶ 4.) The LAION-5B Dataset is a publicly available research database of over five billion URLs for image/text pairs “indiscriminately scraped from the internet.” (FAC ¶ 19.) Plaintiff “is informed and believes that the websites scraped include Facebook, Instagram, Snapchat, LinkedIn and millions of other social media, as well as dating, websites, news, e-commerce, blogs and websites such as, for example, those containing photos or images from Illinois high school yearbooks, Illinois high school events and athletic games, Illinois businesses, events, local news, and residents.” (Id.)
Prisma attaches its Privacy Policy, effective December 15, 2022, as Exhibit B to the Declaration of Oleg Poyaganov (“Poyaganov Declaration” or “Poyaganov Decl.”), Prisma's co-founder and Chief Technology Officer. The Poyaganov Declaration is in turn attached as Exhibit 3 to the Motion. Plaintiff objects to Exhibit B. But as Prisma points out, Plaintiff improperly filed its objection as a document styled as “Objections,” which is not a motion and which was not noticed for presentment in accordance with the Court's case procedures or Local Rule 5.3. (ECF No. 31.) In any event, Prisma responded to Plaintiff's objections in its response brief and the Court will consider them on the merits. Plaintiff objects that Exhibit B is incomplete under Federal Rule of Evidence 106. See Fed.R.Evid. 106 (“If a party introduces all or part of a statement, an adverse party may require the introduction, at that time, of any other part - or any other statement - that in fairness ought to be considered at the same time.”). Plaintiff argues that this Privacy Policy represents only a snapshot in time and has been amended several times during the class period. Plaintiff requests that the Court require all versions during the putative class period to be considered. Prisma has no objection to the Court considering all versions of Prisma's Privacy Policy and argues that this does not warrant ignoring Prisma's evidence. Prisma argues, and the Court agrees, that the proper remedy under Rule 106 is for the objecting party to “introduce[e], at that time . . . any other part-or any other statement-that in fairness ought to be considered at the same time.” Fed.R.Evid. 106. Plaintiff does not identify any additional Privacy Policies the Court should consider in deciding the Motion. In any event, while the Privacy Policy is helpful in aiding the Court's understanding of the technology at issue, no provisions therein are material to this Court's ruling.
Plaintiff does not allege that he ever used the Lensa App or directly uploaded his photo to the Lensa App. Plaintiff's allegations of how Prisma used his photos is less direct. Plaintiff regularly uses various social-media platforms and dating apps such as Facebook, Instagram, Snapchat, Tinder, and BLK, and he and others have uploaded photos of Plaintiff to those platforms and apps. (FAC ¶¶ 36-42.) For example, Plaintiff has maintained a Facebook profile for approximately 15 years and currently has nearly 5,000 followers. (Id. ¶ 36.) He has maintained an Instagram account for approximately 15 years and has over 300 followers. (Id. ¶ 38.) He has maintained a Snapchat account for over seven years and has posted numerous popular photographs and videos, one of which garnered over 7,000 views. (Id. ¶ 39.) Although photos and videos shared through Snapchat typically disappear after they are viewed, they can be saved or screenshot before they disappear and shared to other places on the internet. (Id.) As for Tinder, Plaintiff was required to upload photos and a video of himself to create an account. (Id. ¶ 40.) Plaintiff also uploaded photos of himself to his profile on BLK, the “top dating and lifestyle app for the Black community in the U.S., with over 7 million downloads.” (Id. ¶ 41.)
Plaintiff alleges that the photos of him uploaded to the various social-media platforms and dating apps contained his facial geometry. (Id. ¶ 42.) Plaintiff further alleges “[o]n information and belief, given Plaintiff's prolific social media presence, the broad access that others have to his photographs and facial geometry, the scraping of millions of URLs and the billions of photographs contained in the database, Plaintiff's biometric information is contained in the LAION-5B Dataset and was accessed by Prisma to create, augment, and develop its training set for the App.” (Id.)
Stable Diffusion-the third-party software used in the Lensa App's Magic Avatar feature-is a set of code and does not actually contain photos from the LAION-5B Dataset; it is merely software that was previously taught to look for patterns in LAION-5B data. (Poyaganov Decl. ¶¶ 9-10.) Stability AI's training of Stable Diffusion took place before Prisma integrated Stable Diffusion into the Lensa App. (Id. ¶ 13.) Prisma neither encouraged nor participated in Stability AI's use of LAION-5B images. (Id. ¶ 11.) Prisma and Stability AI are separate, unaffiliated companies. (Id. ¶ 12.) Prisma claims to have never used any part of the LAION-5B Dataset for any version of the Lensa App and has no knowledge of whose photographs are contained in the dataset. (Id.)
Plaintiff alleges that he has been injured by Prisma's unlawful conduct because it has resulted in: “(a) Plaintiff's and Class Members' unique biometric information being collected, captured, obtained, purchased, disclosed, redisclosed and otherwise disseminated without the requisite notice having been given and without the requisite releases or consents having been obtained; and (b) Plaintiff and Class members being deprived of control over their biometric information.” (Id. ¶ 49.) Further, Plaintiff alleges he “do[es] not know which, or how many, individuals or entities have received, obtained, purchased, received through trade, accessed, stored, disclosed, redisclosed or otherwise made use of Plaintiff's and Class Members' biometric information, exposing them to the imminent and certainly impending injuries of identity theft, fraud, stalking, surveillance, social engineering and other invasions of privacy.” (Id. ¶ 50.) Finally, Plaintiff alleges that he and the putative class members “have also been injured and face many more imminent and impending injuries because their biometric data has been used to train technology that is prone to misuse and abuse. Namely, Prisma's Lensa app perpetuates racial bias and stereotypes, sexualizes women and children and is used to create non-consensual deep fake images. This abuse of the app's technology not only exploits innocent people, but it creates significant problems for governments and law enforcement.” (Id. ¶ 51.)
DISCUSSION
Prisma argues a variety of potential issues with Plaintiff's complaint. The Court begins with the threshold-and ultimately dispositive-issues of subject matter jurisdiction and personal jurisdiction. Ruhrgas AG v. Marathon Oil Co., 526 U.S. 574, 588 (1999); Page v. Democratic Nat'l Comm., 2 F.4th 630, 639 (7th Cir. 2021), cert. denied, 142 S.Ct. 776 (2022); Hoeller v. Vill. of Barrington, 619 Fed.Appx. 534, 535 (7th Cir. 2015) (“[W]ithout personal jurisdiction, the court cannot proceed to the merits.”).
I. Rule 12(b)(1)-Subject Matter Jurisdiction
A motion under Rule 12(b)(1) challenges the Court's subject matter jurisdiction, including Article III standing. Fed.R.Civ.P. 12(b)(1); Int'l Union of Operating Eng'rs, Loc. 139, AFL-CIO v. Daley, 983 F.3d 287, 294 (7th Cir. 2020). It is well-settled that the jurisdiction of the federal courts is limited, and that no presumption of federal jurisdiction exists. Preston v. Purtrell, 410 F.2d 234, 236 (7th Cir. 1969). A complaint must affirmatively allege facts that support the existence of federal jurisdiction. Id. Prisma contends that Plaintiff lacks Article III standing to bring this suit and this Court therefore lacks subject matter jurisdiction.
“To establish standing under Article III of the Constitution, a plaintiff must demonstrate (1) that he or she suffered an injury in fact that is concrete, particularized, and actual or imminent, (2) that the injury was caused by the defendant, and (3) that the injury would likely be redressed by the requested judicial relief.” Thornley v. Clearview AI, Inc., 984 F.3d 1241, 1244 (7th Cir. 2021) (quoting Thole v. U.S. Bank N.A, 590 U.S. 538, 540 (2020)). Prisma argues that all three requirements are lacking in this case. As “[t]he party invoking federal jurisdiction,” the Plaintiff “bears the burden of establishing the elements of standing.” Perry v. Vill. of Arlington Heights, 186 F.3d 826, 829 (7th Cir. 1999). Plaintiff must establish standing “for each claim” and “form of relief sought.” DaimlerChrysler Corp. v. Cuno, 547 U.S. 332, 352 (2006) (cleaned up).
At the pleading stage, standing can be challenged on either a facial or factual basis. Prisma raises both facial and factual challenges to Plaintiff's theory of standing. Because the facial challenge is dispositive, the Court declines to address the factual challenges.
i. Injury-in-Fact
First, Prisma argues that Plaintiff's FAC is facially deficient because his alleged injury is entirely speculative and hypothetical and therefore is not concrete, particularized, and actual or imminent. “Facial challenges require only that the court look to the complaint and see if the plaintiff has sufficiently alleged a basis of subject matter jurisdiction.” Lardas v. Grcic, 847 F.3d 561, 565 (7th Cir. 2017) (cleaned up). The Court accepts all well-pleaded factual allegations as true and construes all reasonable inferences in the plaintiff's favor. In re Clearview AI, Inc., Consumer Priv. Litig., 585 F.Supp.3d 1111, 1119 (N.D. Ill. 2022), clarified on denial of reconsideration, No. 21-CV-0135, 2022 WL 2915627 (N.D. Ill. July 25, 2022). To plead an injury-in-fact, a plaintiff must allege an injury that is “concrete and particularized” and “actual or imminent, not conjectural or hypothetical.” Spokeo, Inc. v. Robins, 578 U.S. 330, 339 (2016) (cleaned up). A “particularized” injury is one that “affect[s] the plaintiff in a personal and individual way.” Lujan v. Defs. of Wildlife, 504 U.S. 555, 560 n.1 (1992); see DaimlerChrysler, 547 U.S. at 342-44 (generalized grievance shared by all members of the public will not suffice); Cothron v. White Castle Sys., Inc., 20 F.4th 1156, 1161 (7th Cir. 2021), certified question answered, 2023 IL 128004, 216 N.E.3d 918, as modified on denial of reh'g (July 18, 2023).
Plaintiff asserts two counts under BIPA Section 15(b), one count under Section 15(c), and one count under Section 15(d). Section 15(b) of BIPA prohibits private entities from “collect[ing], captur[ing], purchas[ing], receiv[ing] through trade, or otherwise obtain[ing] a person's or a customer's biometric identifier or biometric information” without their informed consent. Section 15(d) provides that “[n]o private entity in possession of a biometric identifier or biometric information may disclose, redisclose, or otherwise disseminate a person's or a customer's biometric identifier or biometric information” without consent. A violation of Section 15(b) or (d) is akin to invasion of an individual's right to privacy and therefore “inflicts a concrete and particularized Article III injury.” Cothron, 20 F.4th at 1161 (citing Bryant v. Compass Grp. USA, Inc., 958 F.3d 617, 626 (7th Cir. 2020), as amended on denial of reh'g and reh'g en banc (June 30, 2020)).
Section 15(c) provides, “No private entity in possession of a biometric identifier or biometric information may sell, lease, trade, or otherwise profit from a person's or a customer's biometric identifier or biometric information.” Unlike Sections (b) and (d), Section 15(c) establishes a general regulatory rule, imposing on defendants a duty owed to the public at large “prohibit[ing] the operation of a market in biometric identifiers and information.” Thornley, 984 F.3d at 1247. “[S]uch a general regulatory rule . . . is insufficient to create Article III standing absent an assertion that the plaintiff suffered a particularized injury resulting from the operation of such a market.” Kashkeesh v. Microsoft Corp., No. 21 C 3229, 2022 WL 2340876, at *3 (N.D. Ill. June 29, 2022) (citing Thornley, 984 F.3d at 1247). “For example, a plaintiff might establish Article III standing by asserting: (1) ‘that by selling her data, the collector has deprived her of the opportunity to profit from her biometric information'; (2) ‘that the act of selling her data amplified the invasion of her privacy that occurred when the data was first collected, by disseminating it to some unspecified number of other people'; or (3) ‘that [the defendant] raise[d] the cost' she incurred in using social media sites.” Gorgas v. Amazon.com, Inc., No. 22 CV 5159, 2023 WL 4173051, at *1 (N.D. Ill. June 23, 2023) (quoting Thornley, 984 F.3d at 1247).
Prisma argues that Plaintiff's alleged injury rests on the conjecture that photos of him were included in the LAION-5B Dataset because LAION scraped photos from websites on which Plaintiff and his friends posted photos of Plaintiff, including Facebook, Instagram, Snapchat, and dating apps. Prisma further contends that Plaintiff does not allege that Prisma used any of his information or photos, alleging only that Prisma used the LAION-5B Dataset to train the Lensa App. Specifically, Plaintiff alleges, “[o]n information and belief, given Plaintiff's prolific social media presence, the broad access that others have to his photographs and facial geometry, the scraping of millions of URLs and the billions of photographs contained in the database, Plaintiff's biometric information is contained in the LAION-5B Dataset and was accessed by Prisma to create, augment, and develop its training set for the App.” (FAC ¶ 42.)
Prisma relies upon Strautins v. Trustwave Holdings, Inc., 27 F.Supp.3d 871 (N.D. Ill. 2014) and Alonso v. Blue Sky Resorts, LLC, 179 F.Supp.3d 857 (S.D. Ind. 2016). In Strautins, the South Carolina Department of Revenue (“SCDOR”) announced that 3.6 million Social Security numbers, 387,000 credit and debit card numbers, and tax records for 657,000 businesses had been exposed by a cyber-attack. 27 F.Supp.3d at 872. The plaintiff brought a putative class action suit against the data-security company working for the SCDOR, alleging that it failed to adequately protect the SCDOR's computer systems and that the data breach “placed the other class members and her at an imminent, immediate and continuing increased risk of identity theft and identity fraud[.]” Id. at 874. She asserted claims for violation of the Fair Credit Reporting Act, negligence, invasion of privacy by public disclosure of private facts, and breach of contract. Id. at 875.
The defendant moved to dismiss for lack of standing and for failure to state a claim. The court found in part,
Strautins alleges that her PII was “stolen and compromised[]” . . . as a result of the breach of the SCDOR database, but that is a conclusion in need of factual support. Her complaint rests entirely on the assumption that her PII was disclosed because (1) the SCDOR was cyber-attacked and (2) because she filed tax returns in South Carolina. But the fact that hackers gained some access to a SCDOR database does not necessarily mean, or even plausibly suggest, that they obtained access to all of the data in SCDOR's possession, and the complaint provides no basis to infer that the hacker (or hackers) obtained her data.Id. at 880 (emphasis original) (citation omitted). For this reason, the court held in part that “the complaint fails plausibly to allege that Strautins' PII was stolen and compromised and thus fails in this way too to establish standing to pursue any of her claims.” Id. at 881.
In Alonso, the plaintiffs filed a putative class action lawsuit against a resort and casino after a data breach of the defendants' servers allowed hackers to periodically obtain credit card information for some of the defendants' customers. 179 F.Supp.3d at 859. The defendants moved to dismiss for lack of standing and for failure to state a claim. Id. at 861. The Court held that the plaintiffs lacked standing where not all resort customers who used their credit cards during the relevant time period were actually exposed to the hacker's malware, and neither plaintiff alleged that her credit card information was actually stolen or that any fraudulent activity ever occurred. Id. at 862-65. Further, the plaintiffs' credit cards were canceled before any fraudulent transactions occurred, so the future risk of injury was essentially nonexistent. Id. at 864.
Plaintiff, in turn, relies upon In re Clearview AI. At first blush In re Clearview AI appears analogous: the plaintiffs there alleged that the defendants “covertly scraped over three billion photographs of facial images from the internet and then used artificial intelligence algorithms to scan the face geometry of each photograph to harvest the individuals' unique biometric identifiers and information.” 585 F.Supp.3d at 1120. But ultimately that case is not helpful to this Court's standing analysis; standing was not challenged or examined for the same or similar reasons as in this case.
The Court finds Strautins and Alonso persuasive. Here, the FAC fails to plausibly allege that photos of Plaintiff were contained in the LAION-5B Dataset or that Prisma used any of his information or photos. Plaintiff relies solely on “information and belief” in alleging that his photos are in the LAION-5B Dataset and that Prisma used his photos to train the Lensa App. “The Twombly plausibility standard . . . does not prevent a plaintiff from pleading facts alleged upon information and belief where the facts are peculiarly within the possession and control of the defendant.” Arista Records, LLC v. Doe 3, 604 F.3d 110, 120 (2d Cir. 2010) (internal quotation marks omitted); see also Green v. Beth, 663 Fed.Appx. 471, 474 (7th Cir. 2016) (same); Heard v. Becton, Dickinson & Co., 440 F.Supp.3d 960, 969 (N.D. Ill. 2020) (finding a plaintiff could not rely on “information and belief” without identifying the specific facts that create a “legitimate reason to suspect” that his biometric data has been disclosed). But Plaintiff alleges that the LAION-5B Dataset is “publicly available.” (FAC ¶ 19.)Prisma further points to two free search engines that allow users to see if their photos are in the LAION-5B Dataset or in Stable Diffusion's training set. (Reply 3 n.2 (citing https://haveibeentrained.com/; https://laion-aesthetic.datasette.io/laion-aesthetic-6pls/images).) Further, Prisma states that a search of Plaintiff's name did not return any results. Plainly, whether Plaintiff's images are in the LAION-5B Dataset is not peculiarly within Prisma's possession and control. See Heard, 440 F.Supp.3d at 969.
The Court is unpersuaded by Plaintiff's attempts to distinguish Heard on the basis that it involved fingerprinting, rather than facial geometry, and the definition of “possession” under Section 15(d). Those circumstances, while different from this case, do not bear on the general principals underlying the court's analysis of allegations made “on information and belief.”
For this reason as well, the Court declines to grant Plaintiff's request for jurisdictional discovery in the event the Court finds that he lacks standing. Plaintiff fails to explain why such discovery is warranted when the relevant facts are publicly available and not within Prisma's possession and control.
Plaintiff nonetheless argues that it is “virtually certain that LAION contains Plaintiff's photographs and, more importantly, his biometric data which Prisma uses, in violation of BIPA, when it sells Magic Avatars to users” (Resp. 7-8) because an article attached to the Poyaganov Declaration states that the LAION-5B Dataset includes “almost every website” from September 2021 to January 2022. (ECF 31-1 at 26-27.) But Prisma points out that the article quoted by Plaintiffs in fact states that LAION-5B collected images from a dataset called “Common Crawl” and that Common Crawl “contains almost all websites.” (ECF No. 31-1 at 26.) The article also explains, “Of the existing 50+ billion images available in common crawl, [LAION-5B used] only 5.8 billion images,” or 10%. (Id. at 23.)
Although Plaintiff does not so allege in the FAC, the Court may consider and assume as true facts raised by a plaintiff in response to a motion to dismiss so long as those additional facts “are consistent with the pleadings.” Phillips v. Prudential Ins. Co. of Am., 714 F.3d 1017, 1020 (7th Cir. 2013) (internal quotation marks omitted). There is no inconsistency concern here.
The FAC does not allege that the LAION-5B Dataset contained every photo uploaded to Facebook, Instagram, Snapchat, Tinder, or BLK, from September 2021 to January 2022. Nor does the FAC allege that photos of Plaintiff were uploaded to those websites during that time period. “At most, then, [Plaintiff's] allegations are ‘consistent with' the possibility that [his photos were scraped and contained in the LAION-5B Dataset], but, again, where a complaint pleads facts that are ‘merely consistent with' a defendant's liability, it ‘stops short of the line between possibility and plausibility of entitlement to relief.'” Strautins, 27 F.Supp.3d at 881 (quoting Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009)). All of Plaintiff's alleged injuries stem from Prisma's alleged use of his own photos. Accordingly, the FAC fails to plausibly allege that Plaintiff's photos-and thus, allegedly, his facial geometry and biometric identifiers and information-were scraped and included in the LAION-5B Dataset and thus fails to establish that Plaintiff suffered concrete and particularized injury-in-fact. Cf. id.
Plaintiff attempts to distinguish Strautins because there the court found the plaintiff's allegations too speculative because she merely alleged the conclusion that her data was stolen with no factual allegations in support. 27 F.Supp.3d at 880-81. But Plaintiff fails to explain how that is any different from the circumstances at issue in this case, where Plaintiff speculates that his photos were possibly scraped by LAION-5B because he regularly has photos of him uploaded to Facebook, Instagram, Snapchat, Tinder, and BLK, and because the LAION-5B Dataset includes 10% of images available on “almost every website” from September 2021 to January 2022.
Plaintiff's argument that Alonso is distinguishable is similarly unpersuasive. Plaintiff argues that Alonso is distinguishable because the plaintiffs immediately cancelled their credit cards upon notification of the data breach, and the defendant had offered free credit monitoring services, so the court found in part that the plaintiffs had suffered no fraudulent transaction and the future risk of injury was nonexistent. 179 F.Supp.3d at 864. Plaintiff argues that here, Prisma continues to access and use Plaintiff's biometric information to train its software. But that is not what the FAC plausibly alleges. Rather, the FAC alleges that Prisma continues to use the technology that was at one time trained on the LAION-5B Dataset, which may have contained photos of Plaintiff. In any event, the Alonso court found it significant that the plaintiffs failed to plausibly allege that their credit card information was obtained-so too here with respect to Plaintiff's photos.
For all of these reasons, Plaintiff fails to plead a concrete and particularized injury-in-fact and lacks standing to bring his BIPA claims. Consequently, this Court lacks subject matter jurisdiction and grants Prisma's motion to dismiss pursuant to Rule 12(b)(1). The Court declines to consider Prisma's factual challenges to causation and redressability.
II. Rule 12(b)(2)-Personal Jurisdiction
A. Legal Standard
In the alternative, the Court grants Prisma's motion to dismiss pursuant to Rule 12(b)(2). A motion to dismiss under Rule 12(b)(2) challenges a court's personal jurisdiction over a defendant. Fed.R.Civ.P. 12(b)(2); Cent. States, Se. & Sw. Areas Pension Fund v. Phencorp Reins. Co., 440 F.3d 870, 873 (7th Cir. 2006). Once a defendant moves to dismiss under Rule 12(b)(2), the burden is on the plaintiff to establish that the court has personal jurisdiction over that defendant. RAR, Inc. v. Turner Diesel, Ltd., 107 F.3d 1272, 1276 (7th Cir. 1997).
Generally, a plaintiff need not include facts alleging personal jurisdiction in their complaint, only a short plain statement on the grounds for the court's subject matter jurisdiction. Fed.R.Civ.P. 8(a); Purdue Research Found. v. Sanofi-Synthelabo, S.A., 338 F.3d 773, 782 (7th Cir. 2003); In re Teknek, LLC, 354 B.R. 181, 190 (Bankr. N.D.Ill. 2006). There are two possible ways in which a court makes factual determinations on a 12(b)(2) motion to dismiss: (1) based on pleadings and other materials submitted in relation to the motion, or (2) through an evidentiary hearing. Teknek, 354 B.R. at 190. More commonly, courts make determinations based on pleadings, affidavits, and submitted written material alone when there are no material facts disputed and thus no evidentiary hearing is needed. Id.; Purdue Rsch. Found., 338 F.3d at 782. In that case, a plaintiff need only make a prima facie showing of the court's personal jurisdiction over the defendant and the court must consider all well-pleaded facts as true and resolve all nonmaterial factual disputes in the plaintiff's favor. Purdue Rsch. Found., 338 F.3d at 782-83 (quoting Hyatt Int'l Corp. v. Coco, 302 F.3d 707, 713 (7th Cir. 2002)); see also Curry v. Revolution Labs., LLC, 949 F.3d 385, 393 (7th Cir. 2020). A court need not hold an evidentiary hearing unless there is a dispute of material fact pertaining to personal jurisdiction. Hyatt, 302 F.3d at 713.
B. Discussion
Personal jurisdiction comes in two forms: general and specific. uBID, Inc. v. GoDaddy Grp., Inc., 623 F.3d 421, 425 (7th Cir. 2010). Plaintiff does not contend that this Court has general jurisdiction over Prisma so the Court limits its analysis accordingly. Specific jurisdiction exists “when the defendant purposefully directs its activities at the forum state and the alleged injury arises out of those activities.” Mobile Anesthesiologists Chi., LLC v. Anesthesia Assocs. of Houston Metroplex, P.A., 623 F.3d 440, 444 (7th Cir. 2010). The Court looks to the “defendant's suit-related conduct” and its connection to the forum state; “a defendant's relationship with a plaintiff or third party, standing alone, is an insufficient basis for jurisdiction.” Walden v. Fiore, 571 U.S. 277, 283 (2014); Philos Techs., Inc. v. Philos & D, Inc., 802 F.3d 905, 915-16 (7th Cir. 2015). The Court considers “whether the conduct underlying the claims was purposely directed at the forum state,” looking at whether Prisma engaged in “(1) intentional conduct (or ‘intentional and allegedly tortious' conduct); (2) expressly aimed at the forum state; (3) with the defendant's knowledge that the effects would be felt-that is, the plaintiff would be injured-in the forum state.” Tamburo v. Dworkin, 601 F.3d 693, 702-03 (7th Cir. 2010).
Plaintiff argues that he is an Illinois resident who uploaded photos from Illinois and was in Illinois when he did not receive disclosures or provide consent. Plaintiff further argues that Prisma engaged in nationwide marketing; advertises and transacts significant business related to its Lensa App in Illinois, evidenced by the Lensa App's $40 million in revenue as of April 2023; pays money to Stability AI to access illegally harvested data originally scraped by LAION and uses the data for profit; and uses and unjustly benefits from the use of photos of thousands of Illinoisans, including Plaintiff, without their consent. In the alternative, Plaintiff is amenable to transfer to California, where Prisma is headquartered.
The Court focuses first on Prisma's alleged conduct and whether it was purposely directed at Illinois. Prisma's nationwide marketing cannot be a basis to hale Prisma into court in Illinois-Plaintiff points to no Illinois-targeted marketing. The Seventh Circuit has cautioned that courts “should be careful in resolving questions about personal jurisdiction involving online contacts to ensure that a defendant is not haled into court simply because the defendant owns or operates a website that is accessible in the forum state.” Illinois v. Hemi Grp. LLC, 622 F.3d 754, 760 (7th Cir. 2010); see also be2 LLC v. Ivanov, 642 F.3d 555, 558 (7th Cir. 2011) (“Beyond simply operating an interactive website that is accessible from the forum state, a defendant must in some way target the forum state's market. If the defendant merely operates a website, even a ‘highly interactive' website, that is accessible from, but does not target, the forum state, then the defendant may not be haled into court in that state without offending the Constitution.” (citations omitted)). Similarly, the fact that the Lensa App generated $40 million in revenue as of April 2023 shows no Illinois-specific conduct.
Next, Plaintiff's contention that Prisma paid money to Stable Diffusion to use data from photos scraped by LAION that were originally uploaded in Illinois is too attenuated. Prisma's “contacts with Illinois must come from its suit-related activity in the forum state, not from the activity of a third party” such as LAION. Stein v. Clarifai, Inc., 526 F.Supp.3d 339, 344 (N.D. Ill. 2021) (citing Purdue Rsch. Found., 338 F.3d at 780; Salkauskaite v. Sephora USA, Inc., No. 18-CV-08507, 2020 WL 2796122, at *4 (N.D. Ill. May 30, 2020)).
The Court is left with the facts that Plaintiff is an Illinois resident, uploaded photos from Illinois, and was in Illinois when he did not receive disclosures or provide consent. Prisma contends-and the Court agrees-that this argument is foreclosed by Walden, supra. In Walden, the Supreme Court held that “‘minimum contacts' analysis looks to the defendant's contacts with the forum State itself, not the defendant's contacts with persons who reside there....[T]he plaintiff cannot be the only link between the defendant and the forum.” 571 U.S. at 285.
King v. PeopleNet Corp., on which Plaintiff relies, is inapposite. No. 21 CV 2774, 2021 WL 5006692 (N.D. Ill. Oct. 28, 2021). There, the court found personal jurisdiction over a defendant company that contracted with and sold devices to an Illinois-based employer, who required the plaintiff to use the devices to scan into her job. Id. at *6. The devices then transmitted plaintiff's biometric information to the defendant's servers. Id. Here, there is no indication that Prisma similarly contracted with and/or sold devices to an Illinois-based company to collect biometric information in Illinois.
For all of these reasons, the Court grants Prisma's motion to dismiss in the alternative pursuant to Rule 12(b)(2) for lack of personal jurisdiction.Because the Court dismisses the case for lack of subject matter jurisdiction in the first instance, it declines to transfer the case to California. Finally, Plaintiff does not request limited discovery with respect to personal jurisdiction. Even if he had, however, a “plaintiff must establish a colorable or prima facie showing of personal jurisdiction before discovery should be permitted.” Cent. States, Se. & Sw. Areas Pension Fund v. Reimer Express World Corp., 230 F.3d 934, 946 (7th Cir. 2000). Plaintiff fails to do so here.
Having found that the Court lacks subject matter jurisdiction or, in the alternative, personal jurisdiction over Prisma, it declines to consider Prisma's arguments under Rule 12(b)(3) and (6).
CONCLUSION
For the reasons stated above, the Court grants Defendants' motion to dismiss [26] under Rule 12(b)(1) for lack of subject matter jurisdiction and, alternatively, under Rule 12(b)(2) for lack of personal jurisdiction. Plaintiff may file an amended complaint by September 9, 2024.
SO ORDERED.