Opinion
Case No. 1:21-cv-01122-SLD-JEH
2022-03-31
H.K. and J.C., THROUGH their father and legal guardian Clinton FARWELL, and M.W., through her mother and legal guardian Elizabeth Whitehead, individually and on behalf of all others similarly situated, Plaintiffs, v. GOOGLE LLC, Defendant.
Andrew John Stuckart, Lucie Bougher & Associates, Macomb, IL, David W. Hall, Frank S. Hedin, Hedin Hall LLP, Miami, FL, Joseph I. Marchese, Joshua D. Arisohn, Philip L. Fraietta, Scott A. Bursor, Bursor & Fisher PA, New York, NY, for Plaintiffs. Bobbie J. Wilson, Samuel Wilson, Sunita Bali, Perkins Coie LLP, San Francisco, CA, Nicola C. Menaldo, Perkins Coie LLP, Seattle, WA, Kathleen A. Stetsko, Perkins Coie LLP, Chicago, IL, for Defendant.
Andrew John Stuckart, Lucie Bougher & Associates, Macomb, IL, David W. Hall, Frank S. Hedin, Hedin Hall LLP, Miami, FL, Joseph I. Marchese, Joshua D. Arisohn, Philip L. Fraietta, Scott A. Bursor, Bursor & Fisher PA, New York, NY, for Plaintiffs.
Bobbie J. Wilson, Samuel Wilson, Sunita Bali, Perkins Coie LLP, San Francisco, CA, Nicola C. Menaldo, Perkins Coie LLP, Seattle, WA, Kathleen A. Stetsko, Perkins Coie LLP, Chicago, IL, for Defendant.
ORDER
SARA DARROW, CHIEF UNITED STATES DISTRICT JUDGE Before the Court are Defendant Google LLC's motion to dismiss, ECF No. 16, and motion for leave to file a reply, ECF No. 19. For the following reasons, the motion to dismiss is GRANTED IN PART and DENIED IN PART, and the motion for leave to file a reply is GRANTED.
BACKGROUND
At the motion to dismiss stage, the court "accept[s] as true all well-pleaded facts in the complaint, and draw[s] all reasonable inferences in [the plaintiff's] favor." Pierce v. Zoetis, Inc. , 818 F.3d 274, 277 (7th Cir. 2016). Thus, unless indicated otherwise, this factual background comes from the First Amended Class Action Complaint.
Plaintiffs H.K. and J.C., through their father and legal guardian Clinton Farwell, and Plaintiff M.W., through her mother and legal guardian Elizabeth Whitehead, bring this putative class action against Defendant, a technology company headquartered in California. Plaintiffs allege that Defendant has "systematically violated" the Illinois Biometric Information Privacy Act ("BIPA"), 740 ILCS 14/1–99, "by collecting, storing, and using the biometric data of millions of school children throughout the country ... without seeking, much less obtaining the requisite informed written consent from any of their parents or other legal guardians." First. Am. Class Action Compl. ¶ 4, ECF No. 14. "Specifically, Google provides its ‘ChromeBook’ laptops to grade schools, elementary schools, and high schools nationwide, who in turn make these computing devices available for use by children who attend their schools." Id. ¶ 26. The laptops are pre-installed with Defendant's " ‘G Suite for Education’ platform, a cloud-based service used by young students all across the country, including the state of Illinois." Id. To drive adoption of ChromeBooks and alleviate privacy concerns, Defendant assured students, parents, and educators it would only collect education-related data from students using "G Suite for Education." Defendant also promised not to mine student data for its own commercial purposes. Such representations were significant because Defendant maintains services, such as Google Photos, utilizing facial recognition technology, "s[ells] licenses to its Google Photos APIs, including APIs that enable the use of its facial recognition technology, to various mobile application developers, and derives substantial commercial profit from such sales." Id. ¶ 24.
Defendant stylizes this term as "Chromebook." See, e.g. , Mot. Dismiss 18. But the Court follows Plaintiffs’ stylization to reflect the First Amended Class Action Complaint.
Defendant indicates "G Suite for Education" is a prior name for the platform, which was renamed "Google Workspace for Education." See Mot. Dismiss 2 n.2. But to reflect the First Amended Class Action Complaint, the Court uses the phrase Plaintiffs use.
The term "API" is not defined anywhere in the First Amended Class Action Complaint. See First Am. Class Action Compl. ¶¶ 1–64.
Plaintiffs allege that, contrary to Defendant's privacy-related promises, features on "G Suite for Education" instruct schoolchildren to speak into their ChromeBook's recording device and look into its camera. Defendant subsequently records the "acoustic details and characteristics of their voices" and "scans and images the geometry of their faces," then "extracts, collects, stores, and catalogs" the students’ voiceprints and face templates, which are unique biometric identifiers. Id. ¶¶ 30, 31. Defendant's technology then "compares the generated voiceprint or face template against the voiceprints and face templates already stored in its database" to improve the functionality of the platform, improve the quality of the collected voiceprints and face templates, "identify children by name[,] ... [and] recognize childrens’ [sic] gender, age, and location." Id. ¶¶ 32, 33.
Plaintiffs, who are elementary and middle school students in McDonough County, Illinois and Kane County, Illinois, were provided ChromeBooks pre-installed with "G Suite for Education" by officials at their schools. Plaintiffs used accounts linked to their names and other personal details that Defendant had established for them. When Plaintiffs used features of the platform that required them to speak into their laptops’ audio recording devices and look into their cameras, Defendant recorded their voices, imaged their faces, and collected their biometric data for its database.
That Defendant collected Plaintiffs’ biometric data was "unbeknownst to Plaintiffs H.K., J.C. or their father, Clinton Farwell, and unbeknownst to Plaintiff M.W. or her mother, Elizabeth Whitehead." Id. ¶ 41. Neither Farwell nor Whitehead, whom Plaintiffs indicate are their legal guardians and "authorized representative[s]," received a disclosure from Defendant that it would collect, capture, otherwise obtain, or store Plaintiffs’ biometric data. Id. ¶ 44. Nor did Farwell or Whitehead "consent[ ], agree[ ], or g[i]ve permission—via a written release or otherwise—to authorize" Defendant's data collection. Id. Accordingly, Plaintiffs contend Defendant has collected students’ biometric data without notice or consent in violation of 740 ILCS 14/15(b) ("§ 15(b)") and without a written, publicly available retention and destruction schedule in violation of 740 ILCS 14/15(a) ("§ 15(a)").
Plaintiffs first filed this putative class action in Illinois state court, which Defendant removed to this Court on April 20, 2021. See Not. Removal 1, ECF No. 1. Defendant moved to dismiss Plaintiffs’ complaint, ECF No. 11, after which Plaintiffs filed the First Amended Class Action Complaint, mooting Defendant's motion, see July 2, 2021 Text Order; see also Civil LR 7.1(E) ("Whenever an amended pleading is filed, the Clerk will moot any motion attacking the original pleading."). Defendant filed the instant motion to dismiss on August 2, 2021. See Mot. Dismiss 1. Plaintiffs responded, ECF No. 18, and Defendant filed a motion for leave to file a response, ECF No. 19.
DISCUSSION
I. Defendant's Motion for Leave to File a Reply
"No reply to [a] response [to a motion that is not a summary-judgment motion] is permitted without leave of Court." See Civil LR 7.1(B)(3). Defendant argues that its reply will "aid the Court with the disposition of ... novel legal issues," address documents that were attached to Plaintiffs’ response and are extrinsic to the First Amended Class Action Complaint, and serve the interest of completeness. See Mot. Leave File Reply 1–3. Plaintiffs do not oppose Defendant's motion. See id. at 1. Accordingly, Defendant's motion for leave to file a reply is granted. See Shefts v. Petrakis , No. 10-cv-1104, 2011 WL 5930469, at *8 (C.D. Ill. Nov. 29, 2011) ("Typically, reply briefs are permitted if the party opposing a motion has introduced new and unexpected issues in his response to the motion, and the Court finds that a reply from the moving party would be helpful to its disposition of the motion ...."). The Clerk is directed to file Defendant's reply, Mot. Leave File Reply Ex. A, ECF No. 19-1 ("Reply"), on the docket.
II. Motion to Dismiss
a. Legal Standard
A complaint must contain "a short and plain statement of the claim showing that the pleader is entitled to relief." Fed. R. Civ. P. 8(a)(2). A party may move to dismiss a complaint if it fails to state a claim upon which relief can be granted. Id. 12(b)(6). To analyze the sufficiency of a complaint, the court "must construe it in the light most favorable to the plaintiff, accept well-pleaded facts as true, and draw all inferences in the plaintiff's favor." Carlson v. CSX Transp., Inc. , 758 F.3d 819, 826 (7th Cir. 2014). A court must "determine whether [the complaint's well-pleaded factual allegations] plausibly give rise to an entitlement to relief." Ashcroft v. Iqbal , 556 U.S. 662, 679, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009). These allegations must "raise a right to relief above the speculative level." Tamayo v. Blagojevich , 526 F.3d 1074, 1084 (7th Cir. 2008) (quotation marks omitted); see also Carlson , 758 F.3d at 826–27 ("A claim must be plausible rather than merely conceivable or speculative, meaning that the plaintiff must include enough details about the subject-matter of the case to present a story that holds together." (citations and quotation marks omitted)).
b. Analysis
Defendant raises three separate arguments for dismissal. Mot. Dismiss 1–2. First, Defendant argues that Plaintiff H.K.’s claim must be dismissed because BIPA is explicitly and implicitly preempted by the federal Children's Online Privacy Protection Act ("COPPA"), 15 §§ U.S.C. 6501–06, which regulates the online collection of personal information from children who, like H.K., are under the age of 13 See Mot. Dismiss 8–12. Second, Defendant argues that the Illinois Student Online Personal Protection Act ("SOPPA"), 105 ILCS 85/1–99, exclusively governs the collection, use, and protection of personal data, including biometric data, in Illinois K–12 schools. See Mot. Dismiss 12–18. Third, Defendant argues that Plaintiffs’ First Amended Class Action Complaint fails to plausibly state a claim for relief under BIPA. See id. at 18–22. The Court will begin by examining whether Plaintiffs have stated a claim and then address the COPPA and SOPPA issues.
i. Failure to State a Claim
Defendant contends Plaintiffs’ First Amended Class Action Complaint fails to plausibly suggest that Defendant collected Plaintiffs’ biometric data and "merely restates BIPA's statutory language with a varnish of technospeak." See id. at 18–19. The gist of this argument is that Plaintiffs’ claims that Defendant has gathered students’ biometric data simply do not "hold together" without additional factual allegations. See id. at 21 (quotation marks omitted).
To suggest Plaintiffs’ allegations are insufficient to support an inference that Google collected biometric data from students, Defendant relies primarily on two cases. See id. at 19, 22; see also Reply 18. Upon inspection, neither is particularly helpful to its argument. The court in In re Facebook Biometric Information Privacy Litigation did not address whether the plaintiffs’ factual allegations were sufficient to render the inference of data collection plausible: The defendant had moved to dismiss the complaint because it disputed that the relevant data was subject to BIPA. See 185 F. Supp. 3d 1155, 1170–72 (N.D. Cal. 2016). Heard v. Becton, Dickinson & Co. , 440 F. Supp. 3d 960 (N.D. Ill. 2020) (" Heard I "), is also distinguishable: In that case, the court dismissed the plaintiff's complaint because he did not allege how the defendant, which manufactured the Pyxis automated medication dispensing system, came to possess the plaintiff's data after he scanned his fingerprint to access Pyxis at work, see id. at 963, 966–69. However, the Heard I court cited Neals v. PAR Technology Corporation , 419 F. Supp. 3d 1088 (N.D. Ill. 2019), for the proposition that "to state a claim for a Section 15(b) violation, the plaintiff did not need to substantiate her allegation that [the defendant] collected her biometric information," Heard I , 440 F. Supp. 3d at 967 (alteration in original) (quotation marks omitted). As such, it was sufficient in Heard v. Becton, Dickinson & Co. , 524 F. Supp. 3d 831 (N.D. Ill. 2021) (" Heard II "), that the plaintiff alleged "that when a user enrolls in the Pyxis system, the device scans the user's fingerprint, extracts the unique features of that fingerprint to create a user template, and then stores users’ biometric information both on the device and in BD's servers," id. at 841. The Heard II allegations echo the language of Plaintiffs’ First Amended Class Action Complaint. See First Am. Class Action Compl. ¶¶ 38, 39 (alleging that when Plaintiffs used the ChromeBooks, Defendant "recorded [their] voices," "imaged their faces," and "extracted, collected, stored, and cataloged" the data in its database).
Defendant's motion to dismiss Plaintiffs’ First Amended Class Action Complaint was filed on August 2, 2021, see Mot. Dismiss i, and thus postdates Heard II .
Defendant also argues that the First Amended Class Action Complaint "fails to explain how [Defendant's] alleged recording [of Plaintiffs’ voices] is any different from a normal audio recording of Plaintiffs’ voices, which clearly does not trigger BIPA." Mot. Dismiss 20. But Defendant cites a case to support this proposition in which the court rejected a similar argument at the motion to dismiss stage. See Rivera v. Google Inc. , 238 F. Supp. 3d 1088, 1100 (N.D. Ill. 2017) ("[I]t remains possible that Google could prevail on its face-template arguments (that is, that what Google collects from the photos are not covered by the Act) once further factual development has occurred.... Until that time, however, the Plaintiffs’ allegations must be taken as true...."). The In re Facebook Biometric Information Privacy Litigation court also declined to dismiss the plaintiffs’ complaint on the basis of that argument. See In re Facebook , 185 F. Supp. 3d at 1172 ("[I]t may be that ‘scan’ and ‘photograph’ ... take on technological dimensions that might affect the BIPA claims.... But those are questions for another day. The Court accepts as true [the] plaintiffs’ allegations that Facebook's face recognition technology involves a scan of face geometry ...."); see also Vance v. Int'l Bus. Machines Corp. , 20 C 577, 2020 WL 5530134, at *5 (N.D. Ill. Sept. 15, 2020) ("[The p]laintiffs allege that [the defendant] extracted biometric information from photographs to create [its dataset]. The [dataset] includes biometric measurements that can be used to identify [the p]laintiffs. Thus, [the defendant's] alleged actions implicate BIPA."). At the motion to dismiss stage, it is enough that Plaintiffs’ allegations plausibly implicate the collection of data falling within BIPA's ambit.
Defendant also contends it is implausible it would " ‘track’ students in the manner alleged in the [First Amended Class Action Complaint]" because Defendant's "Privacy and Security Information" webpage "establishes that ... [Defendant] ‘do[es] not collect or use student data for advertising purposes or create advertising profiles.’ " Mot. Dismiss 21 (fourth alteration in original) (quoting Privacy and Security Information 2, Mot. Dismiss Ex. A, ECF No. 16-2). There are no allegations related to advertising in the First Amended Class Action Complaint, see First. Am. Class Action Compl. ¶¶ 1–64, so the import of this argument is unclear: Plaintiffs are alleging Defendant collected their data not to sell ads but rather to improve its technology, see id. ¶ 40; make that technology more attractive to buyers and licensees, see id. ¶ 24; drive further adoption by schools, cf. id. ¶ 27; and "enhanc[e] the formidability of its brand," id. ¶ 40. In any event, Defendant's representations about its own privacy practices cannot control at the motion to dismiss stage. See Reed v. Palmer , 906 F.3d 540, 549 (7th Cir. 2018) ("[T]he well-pleaded factual allegations in plaintiffs’ complaints ... are taken as true and considered in the light most favorable to plaintiffs on a Rule 12(b)(6) motion to dismiss."). Indeed, a key part of Plaintiffs’ allegations is that Defendant does not abide by its public representations concerning privacy. See First Am. Class Action Compl. ¶¶ 29, 30.
Defendant cites Goplin v. WeConnect, Inc. , 893 F.3d 488, 491 (7th Cir. 2018) (Barrett, J.), see Mot. Dismiss 21, but that case had a different procedural context. Goplin did not involve a motion to dismiss but rather a defendant's motion to compel arbitration. Id. at 489. The plaintiff, in his response to the motion, argued that the defendant was not a party to the arbitration agreement, directing the district court to language on the defendant's website that supported his claim that the defendant was not the entity with whom he had entered the agreement. Id. at 489–90. In that context, the district court concluded that the defendant had "failed to meet its burden of demonstrating that it was a party to the arbitration agreement or otherwise entitled to enforce it." Id. at 490.
Finally, Defendant argues Plaintiffs’ allegations related to Google Photos are "disparate" and do not suggest that Defendant misappropriated Plaintiffs’ biometric data because Plaintiffs did not claim to have used that product. See Mot. Dismiss 21–22; see also Reply 16–19. But the Court has found no authority suggesting allegations of that nature are even necessary for Plaintiffs to allege a § 15(b) claim. See Stauffer v. Innovative Heights Fairview Heights, LLC , 480 F. Supp. 3d 888, 907 (S.D. Ill. 2020) ("To allege a claim that [the defendant] violated BIPA, all [the plaintiff] must do is allege that Defendant collected, captured, purchased, received, or obtained her fingerprints without complying with BIPA's requirements."); King v. PeopleNet Corp. , No. 21 CV 2774, 2021 WL 5006692, at *9 (N.D. Ill. Oct. 28, 2021) ("The bottom line is this: [The defendant] ... allegedly obtained [the plaintiff's] biometric information. [The d]efendant didn't tell [her] about the collection, spell out why it was collecting the information or for how long, and didn't get a written release before-hand. [She] has stated a claim under § 15(b)."); see also In re Clearview AI, Inc., Consumer Priv. Litig. , Case No. 21-cv-135, 2022 WL 252702, at *3 (N.D. Ill. Jan. 27, 2022) ("[I]t appears [the defendant] is arguing that [the] plaintiffs must fulfill the heightened pleading standard under Rule 9(b), which is simply not the case." (citation omitted)).
In sum, Plaintiffs have alleged that Defendant, without consent and notice, "recorded Plaintiffs’ voices," "imaged their faces," and "extracted, collected, stored, and cataloged" their biometric data when Plaintiffs used audio and video features on ChromeBook laptops pre-installed with Defendant's "G Suite for Education" platform at their Illinois public schools. See First Am. Class Action Compl. ¶¶ 38, 39. Nothing more is required to state their claim. See, e.g. , Heard II , 524 F. Supp. 3d at 841. Accordingly, the Court denies Defendant's motion to dismiss Plaintiffs’ claim on this basis. ii. Preemption
Defendant advances two preemption-related arguments for dismissal. See Mot. Dismiss 8–18. First, Defendant argues that COPPA expressly and implicitly preempts Plaintiff H.K.’s claim because COPPA regulates the collection of personal information from children under the age of 13 by online operators. See id. at 8–12. Defendant also argues that SOPPA, a recent Illinois law, precludes Plaintiffs’ claims because SOPPA, not BIPA, governs the collection of biometric data in schools. See id. at 12–18.
"Preemption ... is an affirmative defense upon which the defendants bear the burden of proof." Benson v. Fannie May Confections Brands, Inc. , 944 F.3d 639, 645 (7th Cir. 2019) (quotation marks omitted). Because "[a]ffirmative defenses do not justify dismissal under [Federal Rule of Civil Procedure] 12(b)(6) [,] [m]oving for judgment on the pleadings under Rule 12(c) is the more appropriate way to address an affirmative defense." See id. (quotation marks omitted); cf. Bausch v. Stryker Corp. , 630 F.3d 546, 561 (7th Cir. 2010) ("The defendants led the district court into a procedural sidetrack that began with ... mov[ing] for dismissal under Rule 12(b)(6) rather than filing an answer to plead preemption as an affirmative defense and moving for judgment on the pleadings under Rule 12(c)."). "Dismissal based on an affirmative defense is appropriate only when the pleadings and matters properly subject to judicial notice make clear that a plaintiff's claim is barred as a matter of law." Fleury v. Union Pac. R.R. Co. , 528 F. Supp. 3d 885, 890 (N.D. Ill. 2021).
1. COPPA
COPPA, the federal law regulating the collection of personal information from children under the age of 13, contains an express preemption provision. It reads:
No State or local government may impose any liability for commercial activities or actions by operators in interstate or foreign commerce in connection with an activity or action described in this chapter that is inconsistent with the treatment of those activities or actions under this section.
15 U.S.C. § 6502(d). Defendant argues that its alleged conduct is regulated by COPPA and that BIPA treats that conduct inconsistently: BIPA and COPPA have, at minimum, different notice and data retention requirements, plus COPPA has no private right of action and provides for enforcement by state attorneys general and the Federal Trade Commission ("FTC"). Cf. 15 U.S.C. § 6501 – 06. Accordingly, Defendant contends H.K.’s claims are preempted by COPPA. Mot. Dismiss 8–10.
Plaintiffs respond that "nothing in [COPPA's express preemption provision] prohibits a state from holding an online operator liable for conduct that so happens to also violate COPPA." Resp. Mot. Dismiss 3. If there are differences between COPPA and BIPA's consent, notice, and retention rules, Plaintiffs argue that they are immaterial. Cf. id. at 4 ("Defendant fails to cite any material difference." (emphasis added)). As for the private right of action, Plaintiffs claim that " Tiny Lab Productions held the exact opposite." Id. at 5 (referencing New Mexico ex rel. Balderas v. Tiny Lab Productions , 457 F. Supp. 3d 1103 (D.N.M. 2020) ).
"If [a] statute contains an express pre-emption clause, the task of statutory construction must in the first instance focus on the plain wording of the clause, which necessarily contains the best evidence of Congress’ pre-emptive intent." CSX Transp., Inc. v. Easterwood , 507 U.S. 658, 664, 113 S.Ct. 1732, 123 L.Ed.2d 387 (1993) ; see also Nelson v. Great Lakes Educ. Loan Servs., Inc. , 928 F.3d 639, 647 (7th Cir. 2019) ("Express preemption presents a question of statutory interpretation, so we start with the preemptive language ...."). Per the language of COPPA's preemption clause, Congress intended that "[n]o State or local government may impose any liability ... in connection with an activity or action described in [COPPA] that is inconsistent with the treatment of those activities or actions ...." 15 U.S.C. § 6502(d).
Plaintiffs do not contest that Defendant's alleged conduct "happens to ... violate COPPA." See Resp. Mot. 3. Thus, to allow Plaintiffs to assert H.K.’s claim against Defendant would be "inconsistent with [COPPA's] treatment" of online data collection from children under 13 because COPPA provides for no private right of action, id. § 6504, whereas BIPA does so explicitly, 740 ILCS 14/20. See Hubbard v. Google LLC , 546 F. Supp. 3d 986, 991 (N.D. Cal. 2021) ("Allowing private plaintiffs to bring suits for violations of conduct regulated by COPPA, even styled in the form of state law claims, with no obligation to cooperate with the FTC, is inconsistent with the treatment of COPPA violations as outlined in the COPPA statute."); Manigault-Johnson v. Google, LLC , Civil Action No. 2:18-cv-1032-BHH, 2019 WL 3006646, at *6 (D.S.C. Mar. 31, 2019) ("Plaintiffs seek to use the vehicle of state law to privately enforce the provisions of COPPA, which Congress clearly intended to preclude when it included an express preemption clause in COPPA and assigned exclusive enforcement of COPPA to the Federal Trade Commission and state attorneys general.").
Plaintiffs argue this case is distinguishable because the operative complaint alleged that Google disclosed it had collected data. Resp. Mot. Dismiss 5 ("Here, Plaintiffs allege that Defendant failed to disclose."). It is unclear why that distinction is dispositive, assuming there is even a meaningful difference between the allegations. Compare Hubbard , 546 F. Supp. 3d at 991 ("Google did not disclose the full extent of the information it collected from the children.") with First Am. Class Action Compl. ¶ 27 ("Google publicly assured ... it only collects education-related data from students using its ‘G Suite for Education’ platform.").
In the interest of thoroughness, the Court notes that the Third Circuit reached a different conclusion on preemption in In re Nickelodeon Consumer Privacy Litigation , 827 F.3d 262 (3d. Cir. 2016), but that case is distinguishable because the plaintiffs had brought a common law intrusion upon seclusion claim against the defendant, see id. at 291, and the court reasoned that the "the heart of the plaintiffs’ intrusion claim is not that Viacom and Google collected children's personal information, or even that they disclosed it. Rather, it is that Viacom created an expectation of privacy on its websites and then obtained the plaintiffs’ personal information under false pretenses," see id. at 291–931. Here, the "heart" of Plaintiffs’ claim is that Defendant collected their biometric data without consent and notice. See First. Am. Class Action. Compl. ¶ 42.
The Court cannot agree with Plaintiffs’ characterization of Tiny Lab , which elides a crucial distinction between that case and the instant action. In Tiny Lab , the State of New Mexico brought COPPA, state common law, and state statutory claims against a game developer whose "cartoonish" offerings attracted child players. 457 F. Supp. 3d at 1109–10. Also named as defendants were various companies that sold proprietary technologies to the developer, who argued COPPA preempted the state law claims against them. See id. at 1110, 1120–21. The court found that the state law claims against all but one of the companies were preempted because there were no allegations that those companies "had actual knowledge that they were collecting personal information" and it would be "inconsistent with COPPA's imposition of an actual knowledge standard ... to hold the [companies] liable under state law." Id. at 1120–21. The claims were not preempted as to the remaining company defendant because there were allegations the defendant knew it was "collecting personal information from users of child-directed apps." Id. at 1121 ("Accordingly, to allow Plaintiff's state law claims against Google to proceed would result in the imposition of liability only for conduct that violates COPPA, and thus would not run afoul of COPPA's express preemption provision."). The Tiny Lab court, in reaching both conclusions, did not address the potential "inconsisten[cy]," see 15 U.S.C. § 6502(d), of a private right of action because the plaintiff was the State of New Mexico. 457 F. Supp. 3d at 1110. But here, Plaintiffs are private parties. See Hubbard v. Google LLC , 508 F. Supp. 3d 623, 632 (N.D. Cal. 2020) (" Tiny Lab was brought by the New Mexico Attorney General, who can enforce violations of COPPA under the statute's remedial scheme.... [T]he Court finds that Tiny Lab is distinguishable and does not inform the decision in this case.").
Contrary to Plaintiffs’ insinuation, see Resp. Mot. Dismiss 3–4, Tiny Lab also does not suggest only "material" inconsistencies are implicated by COPPA's express preemption provision. See Tiny Lab , 457 F. Supp. 3d at 1121 ("COPPA preempts state law that treats like conduct differently.").
Here, Plaintiffs allege that Defendant collected students’ voiceprints and face templates without consent, without notice, and without a data retention policy. First Am. Class Action Compl. ¶¶ 59–61. Although COPPA does not expressly reference biometric data in its statutory text, the COPPA Rule broadly regulates the collection of children's personal information. See 16 C.F.R. § 312.2 ("Personal information means individually identifiable information about an individual collected online" including "[a] photograph, video, or audio file where such file contains a child's image or voice," "[a] persistent identifier that can be used to recognize a user over time," and "[i]nformation concerning the child ... that the operator collects online from the child and combines with an identifier described in [the Rule's] definition."). The COPPA Rule also broadly defines data collection as "the gathering of any personal information from a child by any means." See id. And Plaintiffs’ response makes clear that Plaintiffs are asserting Defendant's conduct falls squarely in COPPA's orbit, see Resp. Mot. Dismiss 3; Plaintiff does not challenge that COPPA indeed regulates Defendant's alleged conduct. On those facts, the Court will dismiss H.K.’s claim against Defendant, but without precluding Plaintiffs from amending their complaint to add additional allegations that could possibly bring the claim "beyond what [is] regulated by COPPA." See Hubbard , 546 F. Supp. 3d at 992.
2. SOPPA
SOPPA "is intended to ensure that student data will be protected when it is collected by educational technology companies." 105 ILCS 85/3. Among other provisions, SOPPA requires educational technology operators to enter into agreements with schools concerning student data collection. 105 ILCS 85/15(4). Defendant argues SOPPA precludes Plaintiffs’ claims because it postdates BIPA and is the "more specific statute" regulating the collection of biometric data from Illinois students. Mot. Dismiss 12–15. Moreover, Defendant argues that "allowing BIPA actions in the school context would lead to unworkable results" because "educational technology providers would ... be forced to obtain consent directly from parents of each student" and "direct parental consent requirements would impede the kind of swift delivery of technology to students that proved invaluable during the COVID-19 pandemic." Id. at 16–17.
Defendant's argument may have ultimately merit, but the Court cannot grant Defendant's motion to dismiss on the basis of the First Amended Class Action Complaint. See Fleury , 528 F. Supp. 3d at 890. Without a more developed record, Defendant's contention that "direct parental consent requirements would impede ... swift delivery" of educational technology and "create disincentives for providers to develop and deliver technology designed for the classroom," see Mot. Dismiss 17, is, at best, speculative. See Fleury , 528 F. Supp. 3d at 896 ("This underscores the dearth of facts currently in the record; any determination by the Court as to what impact BIPA would have on [the defendant's] operations would be highly speculative." (quotation marks omitted)); see also Rogers v. BNSF Ry. Co. , Case No. 19 C 3083, 2019 WL 5635180, at *3 (N.D. Ill. Oct. 31, 2019) ("Any impact of the BIPA's disclosure, consent, and recordkeeping requirements on [the defendant's] operations is—on the present record at least—not just indirect but also highly speculative.").
This contention is also not supported by the materials provided by Defendant, assuming it would be proper for the Court to consider them on a motion to dismiss. For example, the short article about Plaintiffs H.K. and J.C.’s school district is silent on the impact of remote learning on educational technology providers. See Mot. Dismiss Ex. B, ECF No. 16-3. Another exhibit appears to undermine the conclusion that a parental content requirement would be onerous and unworkable. See Privacy and Security Information 2 ("We contractually require that schools using G Suite for Education get the parental consent required by COPPA. Our services can be used in compliance with COPPA as long as a school has parental consent.").
A threshold issue, however, is whether BIPA requires parental consent for student data collection at all. This assumption underlies Plaintiffs’ First Amended Class Action Complaint, see, e.g. , First Am. Class Action Compl. ¶ 4, but it is not clear that Farwell and Whitehead are in fact Plaintiffs’ legally "authorized representative[s]," see id. ¶ 44, in light of SOPPA. Defendant assumes a parental consent requirement for the purpose of argument but does not appear to believe any such requirement actually exists. See Mot. Dismiss 17 n.4 ("[Defendant] does not concede that BIPA's notice and consent requirements would require direct parental consent, as opposed to consent from schools."); Reply 7 (referencing BIPA's "purported parental consent requirement"). If BIPA does not require parental consent, it is possible Plaintiffs’ claims would be frustrated entirely.
Before the Court can untangle the interplay between SOPPA and BIPA, both parties must address this threshold question: Who is a legally authorized representative under BIPA? In light of these outstanding questions, the Court declines to dismiss Plaintiff's First Amended Class Action Complaint on this basis. Defendant is welcome to reraise the question of SOPPA preemption at the appropriate stage in this litigation.
Or Defendant must instill confidence that the answer to this question is immaterial to the resolution of the preemption issue.
CONCLUSION
Accordingly, Defendant Google LLC's motion to dismiss, ECF No. 16, is GRANTED IN PART and DENIED IN PART: Plaintiff H.K.’s claim is dismissed without prejudice; Plaintiffs J.C. and M.W.’s claims remain. The Court denies Defendant's request for oral argument on its motion to dismiss. Defendant's motion for leave to file a reply, ECF No. 19, is GRANTED. The Clerk is directed to file the Reply, ECF No. 19-1, on the docket and update Defendant's name on the docket to Google LLC.