Opinion
3:23-cv-2964-DWD
08-05-2024
SPENCER MAYHEW, individually and on behalf of all others similarly situated, and ROSALIE NOREN, Plaintiffs, v. CANDID COLOR SYSTEMS, INC., an Oklahoma corporation, and KABANCE PHOTO SERVICES, INC., a voluntary unincorporated association based in Missouri, Defendants.
MEMORANDUM & ORDER
DAVID W. DUGAN, United States District Judge.
Before the Court are Defendants' separate Motions to Dismiss Plaintiffs' First Amended Class Action Complaint. (Docs. 28 & 39). Plaintiffs filed Responses in Opposition to, and Defendants filed separate Replies in Support of, the Motions to Dismiss. (Docs. 33, 38, 42, 46). As explained below, the Motion to Dismiss of Defendant Candid Color Systems, Inc. (“CCSI”), is GRANTED for lack of personal jurisdiction and the Motion to Dismiss of Defendant Kabance Photo Services, Inc. (“KPSI”), is DENIED.
I. Background
This case arises under the Biometric Information Privacy Act (“BIPA”), 740 ILCS 14/1 et seq. Defendant CCSI, an Oklahoma corporation, provides photography-related products, services, and software to its customers, who operate their own photography businesses. (Docs. 21, pgs. 2, 6; 28-1, pgs. 2-3). It allegedly “represents itself as ‘a leader in event photography products and services, connecting photographers with innovative products and workflow solutions that increase sales[] and improve overall efficiency.” (Doc. 21, pg. 6). Defendant CCSI allegedly “has the tools to help [photographers] effectively market and sell images from events both small and large.” (Doc. 21, pg. 6).
Particularly relevant to this case, Defendant CCSI provides its photographercustomers, including Defendant KPSI, a Missouri-based business, with an online platform to market and sell the photographs that they take at graduation ceremonies, sports contests, and other events. (Docs. 21, pgs. 2-3, 6; 28-1, pgs. 1-6). That “robust, mobile-optimized Ecommerce platform” uses facial recognition technology to “identify facial images in a particular photograph and locate potentially-matching facial images among other photographs in a gallery.” (Doc. 21, pgs. 2, 6, 9). Defendant CCSI allegedly:
[T]ells potential photograph clients that “[i]ntegrated facial recognition makes finding images easy,” and [it] describes its facial recognition feature as follows: “With this ability built into our website[,] your consumers can click on one of their images to see all of their images. By eliminating the need to search for their images[,] customers are more likely to buy.”(Doc. 21, pgs. 2, 6).
Defendant CCSI also allegedly owns the trademark for and does business as Grad Photo Network, which “is ‘the largest network of professional photographers for graduation and commencement ceremonies.' ” (Doc. 21, pg. 8). Defendant KPSI belongs to the Grad Photo Network, which it uses to sell photographs. (Doc. 21, pg. 8). The Grad Photo Network website is part of the “Ecommerce platform.” (Doc. 21, pg. 8).
Further, Defendant CCSI allegedly claims the “benefits of its facial recognition feature include ‘ID[ing] more images faster and more accurately.' ” (Doc. 21, pg. 6). When a photograph on the Grad Photo Network website is selected, “a dotted-line rectangular field automatically appears” around the individual's face. (Doc. 21, pgs. 9, 11). By clicking inside the “rectangular field,” the website user can reload the webpage and return other photographs of the same individual. (Doc. 21, pgs. 9, 11). The address of the reloaded webpage includes a “FaceID” unique to that individual. (Doc. 21, pgs. 9, 11). Plaintiffs allege this is only possible through the collection of biometric identifiers, i.e., through the scanning of photographs for facial images and the “extracti[on] from each photo [of] data representing the unique geometry of each facial image so that comparisons” can be made with other photographs. (Doc. 21, pgs. 2, 6-7). Defendant CCSI allegedly collects an “Ecommerce fee” from purchases of photographs on the platform. (Doc. 21, pg. 6).
Plaintiffs allege they were subjected to Defendant CCSI's facial recognition technology, as described above, after participating in their respective graduation ceremonies. Plaintiff Noren graduated from Blackburn College in Carlinville, Illinois, on May 15, 2021. (Doc. 21, pg. 11). Plaintiff Mayhew graduated from Collinsville High School in Collinsville, Illinois, on May 13, 2023. (Doc. 21, pg. 8). During the graduation ceremonies, Defendant KPSI's photographer(s) photographed Plaintiffs pursuant to agreements it entered with their schools. (Docs. 21, pgs. 4, 8, 11; 28-1, pg. 8; 28-2, pgs. 910). Defendant KPSI then uploaded the photographs to its account on Defendant CCSI's Grad Photo Network website. (Doc. 21, pgs. 8, 11). As such, Defendant CCSI's facial recognition technology was allegedly used to identify and extract Plaintiffs' faceprints to compile all of their photographs from the graduation ceremonies. (Doc. 21, pgs. 9, 12).
After Plaintiff Mayhew's graduation ceremony, his mother allegedly received an email, containing a link to Defendant KPSI's account on the Grad Photo Network website, that solicited the purchase of photographs. (Doc. 21, pgs. 9, 12). The email was received from “Kabance Photo Services, Inc.,” and the email address was “YourPhotos@kylekabance.picsemail.com.” (Doc. 21, pg. 10). The picsemail.com domain, contained within the solicitation email address, redirects to “www.candid.com,” allegedly showing it is owned by Defendant CCSI. (Doc. 21, pg. 10). When Plaintiff Mayhew's mother clicked on the Grad Photo Network website link contained in the solicitation email, Plaintiff “Mayhew's photos appear[ed] with the same dotted-line rectangular field and the same functionality as described” above. (Doc. 21, pg. 10). Plaintiff Mayhew's mother purchased both digital and physical photographs through Defendant KPSI's account on the Grad Photo Network website. (Doc. 21, pgs. 10, 12). The physical photographs were shipped to her residence in Collinsville, Illinois. (Doc. 21, pg. 10). Like the solicitation email, the confirmation email to Plaintiff Mayhew's mother, which listed an address in Collinsville, Illinois, was received from “Kabance Photo Services, Inc.,” and the email address “YourPhotos@kylekabance.picsemail.com.” (Doc. 21, pg. 10). Plaintiff Noren also believes “she received one or more emails soliciting her to purchase the photos” taken at her graduation ceremony. (Doc. 21, pg. 12).
Due to their relationship with each other and with other Illinois entities, as detailed in relation to the sale of photographs on the Grad Photo Network website, Defendants allegedly collected, stored, used, and/or profited from the biometric identifiers of hundreds of Illinois residents. (Doc. 21, pgs. 3, 12-13). Defendant KPSI's account on the Grad Photo Network website allegedly depicts “other participants in the Collinsville High School and Blackburn College graduation ceremonies[] as well as photos from other events.. .in Illinois.” (Doc. 21, pg. 12). Aside from Defendant KPSI, “other photographers operating in Illinois have [allegedly] used the various online platforms within the ‘Ecommerce platform' to capture the biometrics of Illinois residents.” (Doc. 21, pg. 13).
On October 4, 2023, Plaintiff filed a 5-Count First Amended Class Action Complaint (Doc. 21) against Defendants CCSI and KPSI under BIPA. Plaintiffs allege each Defendant: (1) violated § 15(a) of BIPA by failing to develop and comply with a publicly available written retention policy for biometric identifiers; (2) violated § 15(b)(1) of BIPA by collecting, capturing, receiving through trade, or otherwise obtaining Plaintiffs' biometric identifiers without first informing them, in writing, that their biometric identifiers were collected or stored; (3) violated § 15(b)(2) of BIPA by collecting, capturing, receiving through trade, or otherwise obtaining Plaintiffs' biometric identifiers without first informing them, in writing, of the specific purpose and length of term for the collection, use, and storage of their biometric identifiers; (4) violated § 15(b)(3) of BIPA by collecting, capturing, receiving through trade, or otherwise obtaining Plaintiffs' biometric identifiers without first obtaining written releases; and (5) violated § 15(c) of BIPA by profiting from Plaintiffs' biometric identifiers on Defendant CCSI's “Ecommerce platform.” (Doc. 21, pgs. 5, 14, 17-22). Plaintiffs seek the certification of a class under Federal Rule of Civil Procedure 23, the appointment of class counsel, declaratory and injunctive relief, statutory damages, and attorney fees and costs. (Doc. 21, pgs. 18-23).
II. Analysis
Now, Defendants present separate Motions to Dismiss under Federal Rule of Civil Procedure 12(b)(2) and/or (6). Each Motion to Dismiss is addressed separately below.
A. Defendant CCSI's Motion to Dismiss
Defendant CCSI seeks a dismissal of the First Amended Class Action Complaint under Rule 12(b)(2) and (6). However, the arguments as to specific personal jurisdiction under Rule 12(b)(2) are dispositive, so the Court's analysis is confined to that issue.
Under Rule 12(b)(2), a defendant may assert a lack of personal jurisdiction in a motion. Fed.R.Civ.P. 12(b)(2). The burden is on the plaintiff to establish the existence of personal jurisdiction. Curry v. Revolution Labs., LLC, 949 F.3d 385, 392 (7th Cir. 2020) (quoting Purdue Research Found. v. Sanofi-Synthelabo, S.A., 338 F.3d 773, 782 (7th Cir. 2003)). If the Court rules on a Rule 12(b)(2) motion based only upon the written materials of record, without an evidentiary hearing, then the plaintiff must make a prima facie showing of personal jurisdiction. Id. (quoting uBid, Inc. v. GoDaddy Grp., Inc., 623 F.3d 421, 423 (7th Cir. 2010)); Crumpton v. Haemonetics Corp., 595 F.Supp.3d 687, 695 (N.D. Ill. 2022) (citing Purdue Research Found., 338 F.3d at 782). When the parties submit declarations as to personal jurisdiction, the Court may weigh the declarations. Curry, 949 F.3d at 392 (quoting Purdue Research Found., 338 F.3d at 782). When assessing whether the plaintiff satisfied the prima facie standard, though, the Court resolves all disputes as to the relevant facts of record for the plaintiff. Id. (quoting Purdue Research Found., 338 F.3d at 782). That is, the Court accepts as true any facts in the defendant's declarations that do not conflict with the record; however, if there is a factual conflict between the defendant's declarations and the record, it is resolved in the plaintiff's favor. See id.
Defendant CCSI, an Oklahoma corporation, argues Plaintiffs failed to establish specific personal jurisdiction. (Doc. 28, pgs. 6, 12-16). As a factual basis for this assertion, Defendant CCSI relies upon the Declaration of its Chief Information Officer, Mr. Demetri Barges, stating: (1) while its “Ecommerce platform” is accessible to and can be used by photographers in all 50 states, neither it nor its affiliates engage in sales activity targeting Illinois; (2) it does not provide hardware, setup-related services, or technical support at customer sites located within Illinois; (3) neither the data from nor the equipment used to operate the “Ecommerce platform” is stored or located in Illinois; (4) it has no control over the photographs taken or uploaded to the “Ecommerce platform” by its customers; (5) decisions related to the method of sorting photographs on the “Ecommerce platform” are made solely by its customers; (6) it owns no real property in Illinois, has no bank accounts in Illinois, and has no employees residing in Illinois; (7) the “Ecommerce platform” was developed outside of Illinois; and (8) it licensed the use of the “Ecommerce platform” to Defendant KPSI, which is headquartered in Missouri. (Docs. 28, pg. 11; 281, pgs. 3, 6-8). Defendant CCSI emphasizes its belief that Plaintiffs' Illinois residences, and the fact that the photographs were taken in Illinois, are the only Illinois-specific factual allegations. (Doc. 28, pg. 13). That is, Plaintiffs do not allege the photographs were uploaded to Defendant KPSI's account on the “Ecommerce platform” in Illinois, or that Plaintiffs' faceprints were analyzed in Illinois rather than at Defendant KPSI's Missouri headquarters. (Doc. 28, pg. 13). In the absence of a direct connection between Defendant CCSI and Illinois, Defendant CCSI argues the Court cannot exercise specific personal jurisdiction based upon Illinois residents' interactions with its website or the conduct of Defendant CCSI's Missouri-based customer, Defendant KPSI. (Doc. 28, pgs. 13-16).
In their Response, Plaintiffs first argue the Court has specific personal jurisdiction over Defendant CCSI because it directed its activities toward the Illinois market. (Doc. 33, pgs. 3, 10-12). Defendant CCSI allegedly set up its “Ecommerce platform” to sell and ship photographs to, among others, Illinois residents. (Doc. 33, pgs. 3, 10-12). Defendant CCSI allegedly collects a fee from photographs sold through the “Ecommerce platform.” (Doc. 33, pgs. 3, 10-12). Plaintiffs also remind the Court of the Illinois contacts related to the solicitation of Plaintiff Mayhew's mother to buy photographs on the “Ecommerce platform,” which are supported by her Declaration. (Docs. 21, pgs. 9-10; 33, pgs. 3, 10-12; 33-1, pgs. 2-3). Finally, Plaintiffs maintain it is not unfair to require a seller to defend a lawsuit in a forum where it does business. (Doc. 33, pgs. 12-13).
In a Reply, Defendant CCSI takes issue with Plaintiffs' characterization of the facts, related to this assertion, in the Declarations and First Amended Class Action Complaint, stating: “Plaintiffs' suggestion that CCS[I] does anything more than make its customer-controlled platform available for others to use is misdirection and contradicts the facts stated in both CCS[I]'s and Plaintiffs' declarations.” (Doc. 38, pg. 2).
To satisfy federal due process standards for specific personal jurisdiction, a plaintiff must establish “three ‘essential requirements.' ” Curry, 949 F.3d at 398 (quoting Lexington Ins. Co. v. Hotai Ins. Co., 938 F.3d 874, 878 (7th Cir. 2019)); see also Illinois v. Hemi Grp. LLC, 622 F.3d 754, 757 (7th Cir. 2010) (finding it was proper to limit the analysis to whether jurisdiction comported with federal guarantees of due process, as it could not discern a difference in the Illinois and federal constitutions' limits on jurisdiction). First, the defendant must have sufficient minimum contacts to show it purposefully availed itself of the privilege of conducting business in the forum state or purposefully directed its activities at the forum state. Curry, 949 F.3d at 398 (quoting Lexington Ins. Co., 938 F.3d at 878). The “essential point” of this first requirement “is to ‘ensure that an out-of-state defendant is not bound to appear to account for merely “random, fortuitous, or attenuated contacts” with the forum state.' ” Id. at 398 (quoting Dudnikov v. Chalk & Vermilion Fine Arts, Inc., 514 F.3d 1063, 1071 (10th Cir. 2008)). Indeed, “[d]ue process requires that ‘potential defendants should have some control over-and certainly should not be surprised by-the jurisdictional consequences of their actions.' ” Hemi Grp. LLC, 622 F.3d at 758 (quoting RAR, Inc. v. Turner Diesel, Ltd., 107 F.3d 1272, 1278 (1997)).
Second, the plaintiff's alleged injury must arise out of the defendant's contacts with or activities in the forum state. Curry, 949 F.3d at 398 (quoting Lexington Ins. Co., 938 F.3d at 878). Put another way, the defendant's contacts with the forum state must be “suit related,” as to create a connection between the forum state and the claims of the plaintiff. Id. at 400 (quoting Advanced Tactical Ordnance Systems, LLC v. Real Action Paintball, Inc., 751 F.3d 796, 801 (7th Cir. 2014); Bristol-Myers Squibb Co. v. Superior Court of California, 582 U.S. 255, 264-65 (2017)). It insufficient that the defendant's conduct merely affected a plaintiff with connections to the forum state. Advanced Tactical, 751 F.3d at 801 (quoting Walden v. Fiore, 571 U.S. 277, 291 (2014)). Again, it is the defendant's own contacts with the forum state that matter, and “[c]ontacts between the plaintiff or other third parties and the forum [state] do not satisfy this requirement.” See id. (quoting Walden, 571 U.S. at 284-85); see also Castelaz v. Estee Lauder Cos., Inc., No. 22-cv-5713, 2024 WL 136872, *3 (N.D. Ill. Jan. 10, 2024) (“While ‘a defendant's contacts with the forum State may be intertwined with his transactions or interactions with the plaintiff or other parties,' its ‘relationship with a plaintiff or third party, standing alone, is an insufficient basis for jurisdiction.' ”).
Third, the Court's exercise of specific personal jurisdiction must comport with traditional notions of fair play and substantial justice. Curry, 949 F.3d at 398. (quoting Lexington Ins. Co., 938 F.3d at 878). When assessing this third requirement, the Court considers the burden on the defendant, the forum state's interest in adjudicating the parties' dispute, the plaintiff's interest in obtaining convenient and effective relief, the interstate judicial system's interest in the most efficient resolution of the parties' dispute, and the shared interest of the States in advancing fundamental substantive social policies. Id. at 402 (quoting Purdue Research Found., 338 F.3d at 781). If the defendant's contacts with the forum state are weak, then these considerations may counsel in favor of an exercise of specific personal jurisdiction. Id. (quoting Purdue Research Found., 338 F.3d at 781). Conversely, the plaintiff's threshold showing of sufficient minimum contacts is generally only defeated when “the defendant presents ‘a compelling case that the presence of some other considerations would render [specific personal] jurisdiction unreasonable.” Id. (quoting Burger King Corp. v. Rudzewicz, 471 U.S. 462, 477 (1985)).
Particularly relevant here, the Seventh Circuit has “consistently...declined ‘to fashion a special jurisdictional test for internet-based cases.' ” Id. at 398 (quoting Tamburo v. Dworkin, 601 F.3d 693, 703 n. 7 (7th Cir. 2010)). Rather, the Seventh Circuit has explained that the traditional due process inquiry, articulated with the above requirements, is not so difficult to apply in internet-based cases as to require an easier, categorical test. Id. (quoting Hemi Grp. LLC, 622 F.3d at 759); accord Advanced Tactical, 751 F.3d at 802. When doing so, the Seventh Circuit noted “[s]ignificant caution is certainly appropriate when assessing a defendant's online contacts with a forum ‘to ensure that a defendant is not haled into court simply because the defendant owns or operates a website that is accessible in the forum state.' ” Curry, 949 F.3d at 400 (quoting Hemi Grp.LLC, 622 F.3d at 760). This “[s]ignificant caution” is warranted even if an interactive website is at issue because, while evidence of extensive sales from an interactive website may suffice, the mere operation of a website does not show a defendant has sufficient minimum contacts with the forum state. Advanced Tactical, 751 F.3d at 803 (quoting be2 LLC v. Ivanov, 642 F.3d 555, 558 (7th Cir. 2011)); Stein v. Clarifai, Inc., 526 F.Supp.3d 339, 345 (N.D. Ill. 2021).
In short, if the operation of an interactive website alone could result in sufficient minimum contacts with a forum state, then there would be “no limiting principle.” Advanced Tactical, 751 F.3d at 803. The plaintiff could sue “everywhere,” i.e., “in every spot on the planet where th[e] interactive website is accessible,” thereby offending traditional notions of fair play and substantial justice under the third requirement for specific personal jurisdiction. Id. (quoting Int'l Shoe Co. v. Washington, 326 U.S. 310, 316 (1945)); accord Hemi Grp. LLC, 622 F.3d at 760. To be clear, though, a defendant's deliberate and continuous exploitation of a forum state's market, through its website and other contacts, can be sufficient to establish minimum contacts with the forum state for purposes of specific personal jurisdiction. Dzananovic v. Bumble, Inc., No. 21-cv-6925, 2023 WL 4405833, *3 (N.D. Ill. July 7, 2023) (quoting Mobile Anesthesiologists Chicago, LLC v. Anesthesia Assocs. of Houston Metroplex, P.A., 623 F.3d 440, 446 (7th Cir. 2010)); see also Kukovec v. Estee Lauder Cos., Inc., No. 22-cv-1988, 2022 WL 16744196, *4 (N.D. Ill. Nov. 7, 2022) (finding the defendant had sufficient minimum contacts with the forum state, as “the operation of an interactive website by itself [i]s not enough to confer specific jurisdiction in any state where the website could be accessed”) (Emphasis in original.).
Similarly, courts have concluded that there can be no specific personal jurisdiction over a defendant-vendor who simply provides technology to corporate customers from outside of Illinois with little to no knowledge of how that technology arrived in Illinois or was used by its residents. See Crumpton, 595 F.Supp.3d at 696-97 (collecting cases). However, if the defendant-vendor has its own direct contacts with the forum state, and they are not merely enabled or created by a third party, it has been recognized that those contacts may support an exercise of specific personal jurisdiction. See id. (quoting and discussing King v. PeopleNet Corp., No 21-cv-2774, 2021 WL 5006692, *6 (N.D. Ill. Oct. 28, 2021)). Also, a defendant-vendor's contract with a corporate customer may establish sufficient minimum contacts in the forum state even if the corporate customer itself is not domiciled in that forum state. See id. at 699 (quoting Burger King Corp., 471 U.S. at 478-79).
Here, the Court finds Plaintiffs have failed to make a prima facie showing of specific personal jurisdiction against Defendant CCSI. See Curry, 949 F.3d at 392; Crumpton, 595 F.Supp.3d at 695. When doing so, the Court relies upon the Declaration of Defendant CCSI's Chief Information Officer, Mr. Barges, the relevant portions of which do not conflict with the other materials of record. See Curry, 949 F.3d at 392; (Doc. 28-1). For starters, Defendant CCSI does not, through the location of its offices or its current or former employees, have a physical presence in Illinois. (Doc. 28-1, pg. 3). Moreover, the facial recognition technology at issue was developed, and the team responsible for its operation and updates is located, outside of Illinois. (Doc. 28-1, pg. 6). Defendant CCSI has not located any computer servers or other equipment, used to operate its software products or to store end-users' data, in Illinois. (Doc. 28-1, pg. 6). Also, Defendant CCSI only interacts with photographer-customers, like Defendant KPSI, and not with endusers of its Grad Photo Network website, like Plaintiffs or their families. (Doc. 28-1, pg. 3 n. 2). Finally, Defendant CCSI's products, services, software, and website are obviously accessible to photographer-customers and end-users in each of the 50 states, but the extent to which any related sales activity may create specific contacts between Defendant CCSI and Illinois is entirely unclear on this record. (Doc. 28-1, pg. 6).
Instead, the record reflects any contacts of Defendant CCSI with Illinois are random, fortuitous, attenuated, and contingent upon the independent conduct of Defendant KPSI and Plaintiffs or their families. See Curry, 949 F.3d at 398; Advanced Tactical, 751 F.3d at 801; Castelaz, 2024 WL 136872 at *3. Defendant KPSI, a Missouri-based business, purchased the products, services, and/or software, namely, the ability to use the “Ecommerce platform” and Grad Photo Network website, of Defendant CCSI, an Oklahoma corporation, to facilitate the marketing and sale of its photographs. (Doc. 281, pgs. 2-6). Defendant KPSI then entered independent agreements with Plaintiffs' educational institutions to travel from Missouri to Illinois for the purpose of photographing their graduation ceremonies. (Docs. 21, pgs. 4, 8, 11; 28-1, pg. 8; 28-2, pgs. 9-10). After doing so, Defendant KPSI, as a result of having purchased the ability to use Defendant CCSI's “Ecommerce platform” and Grad Photo Network website, uploaded the photographs of Plaintiffs to its account on the Grad Photo Network website from a location that could have been in Illinois, Missouri, or some other place. At that point, the photographs of Plaintiffs were subjected to Defendant CCSI's facial recognition technology. Defendant KPSI, not Defendant CCSI, then solicited purchases from Plaintiffs or their families through its Grad Photo Network account. (Doc. 33-1, pgs. 2-3).
To be sure, the website domain in the solicitation email address may be owned by Defendant CCSI, and the “View Your Photos” link in that solicitation email may redirect to Defendant KPSI's account on Defendant CCSI's Grad Photo Network website, but it is undisputed that the solicitation email and a subsequent confirmation email were sent to Plaintiff Mayhew's mother by Defendant KPSI rather than by Defendant CCSI. (Docs. 21, pg. 10; 33-1, pgs. 2-3, 5). In any event, the Seventh Circuit has indicated that certain solicitation emails alone provide only a tenuous connection between a defendant and a forum state. See Advanced Tactical, 751 F.3d at 803 (“[E]mail does not exist in any location at all; it bounces from one server to another, it starts wherever the account-holder is sitting when she clicks the ‘send' button, and it winds up wherever the recipient happens to be at that instant. The connection between the place where an email is opened and a lawsuit is entirely fortuitous.”). Also, even assuming Defendant CCSI owns the website domain at issue, it aptly argues that a finding of sufficient minimum contacts with Illinois on that basis alone would be “tantamount” to finding Google has sufficient minimum contacts with any state to which its account holders send their emails. (Doc. 38, pgs. 3-4).
Further, while Plaintiff Mayhew's mother purchased photographs through Defendant KPSI's account on Defendant CCSI's Grad Photo Network website, it was Defendant KPSI that could customize or configure the “Ecommerce platform” to fit its needs or preferences, including by choosing whether or not to organize and sort its photographs with the facial recognition technology at issue. (Doc. 28-1, pgs. 4-8). Based on Plaintiffs' claims, Defendant KPSI chose to use the facial recognition software, despite having a manual option for organizing and sorting the photographs. (Doc. 28-1, pgs. 48). And, notably, Defendant CCSI may have collected an “Ecommerce fee” from the photographs sold by Defendant KPSI to Plaintiff Mayhew's mother through the Grad Photo Network website, but it again appears such fees arose solely from its relationship with Defendant KPSI and that business's email solicitation to Plaintiff Mayhew's mother rather than from any of Defendant CCSI's own contacts with Illinois. (Doc. 21, pg. 6).
In short, Defendant CCSI's mere ownership, operation, and/or maintenance of an “Ecommerce platform” and Grad Photo Network website with an optional facial recognition technology, which Defendant KPSI, a Missouri-based business, paid to use to market and sell its own photographs to Plaintiffs in Illinois, does not result in Defendant CCSI having sufficient minimum contacts with Illinois to show it purposefully availed itself of the privilege of conducting business in or purposefully directed its activities at that state. See Curry, 949 F.3d at 398; Advanced Tactical, 751 F.3d at 801; Castelaz, 2024 WL 136872 at *3. The cases supporting this conclusion in the Seventh Circuit, under similar factual scenarios, are plentiful. See, e.g., Redd v. Amazon Web Servs., Inc., 673 F.Supp.3d 943, 946-47 (N.D. Ill. 2023) (finding insufficient minimum contacts where the defendant merely provided its technology to a third party who then used that technology in Illinois); Moomaw v. GeoSnapShot PTY LTD, No. 23-cv-1321, 2024 WL 991531, *7-9 (S.D. Ill. March 7, 2024) (finding sufficient minimum contacts where the defendant, unlike Defendant CCSI, was not merely involved in a one-off transaction with a third-party who, without the defendant's knowledge, utilized its technology in Illinois for its own purposes; rather, the defendant, through the creation of its “self-hosted interactive website,” allowed Illinois residents to engage in commerce, stood ready and willing to do business with Illinois residents, knowingly did do business with Illinois residents through the licensing and sale of photographs on its online platform, exercised control over the photographers' work in Illinois, and identified those photographers as its representatives); Salkauskaite v. Sephora USA, Inc., No. 18-cv-8507, 2020 WL 2796122, *4-5 (N.D. Ill. May 30, 2020) (finding insufficient minimum contacts where the defendant sold its software to a co-defendant but did not target Illinois with its commercial activity, know the extent to which its codefendant would use the software in Illinois, intend to collect or solicit biometric information from Illinois residents, deploy its software or employees to Illinois, meet or develop a business relationship with the co-defendant in Illinois, discuss with the codefendant whether the software would be used in Illinois, or agree to deploy or service the software in Illinois); Castelaz, 2024 WL 136872 at *4-5 (finding the defendant-licensor of a “virtual try-on tool” had insufficient minimum contacts with Illinois because its only alleged connection to that state was the plaintiffs' own interactions with the “virtual tryon tool” on the defendant-licensee's websites); Bray v. Lathem Time Co., No. 19-cv-3157, 2020 WL 1492742, *3-4 (C.D. Ill. March 27, 2020) (finding insufficient minimum contacts where the defendant itself did not target Illinois or have anything to do with how its device arrived in Illinois; instead, the defendant sold its device to an Arkansas customer who then chose to use the device on end-users in Illinois, enable a facial-recognition feature offered by the device, and enroll in an optional web-service available to all customers); Stein, 526 F.Supp.3d at 344-46 (finding insufficient minimum contacts where the defendant's only tie to Illinois arose from third parties, and “the miniscule number of transactions” on an interactive website could not show the defendant targeted Illinois); Gutierrez v. Wemagine.AI LLP, No. 21-cv-5702, 2022 WL 252704, *2-3 (N.D. Ill. Jan. 26, 2022) (finding insufficient minimum contacts where the only connection between the defendant, an interactive website, and Illinois was the plaintiff, it was the plaintiff who downloaded the application at issue, it was not enough that Illinois residents used the application, and there was no shipping, marketing, or advertising directed at Illinois); Crumpton, 595 F.Supp.3d at 697-99 (finding sufficient minimum contacts where, although the defendant did not directly send its software to Illinois, it deliberately entered into contracts that ensured the software was deployed in Illinois, it collected data in Illinois, it hosted the data on its servers, and it collected fees based on the data storage); NBA Props., Inc. v. HANWJH, 46 F.4th 614, 624-25 (7th Cir. 2022) (finding sufficient minimum contacts where the defendant, unlike Defendant CCSI, “unequivocally asserted a willingness to ship goods to Illinois and established the capacity to do so” through the creation of an online store, then intentionally did ship products to Illinois).
For these reasons, Defendant CCSI's Motion to Dismiss (Doc. 28) is GRANTED for lack of specific personal jurisdiction. The claims against it are DISMISSED without prejudice. See Lauderdale-El v. Indiana Parole Bd, 35 F.4th 572, 576 (7th Cir. 2022) (noting dismissals for lack of personal jurisdiction are necessarily without prejudice).
B. Defendant KPSI's Motion to Dismiss
Defendant KPSI seeks a dismissal of the First Amended Class Action Complaint under Rule 12(b)(6), which allows challenges to a pleading based upon the failure to state a claim for which relief may be granted. Fed.R.Civ.P. 12(b)(6); Firestone Fin. Corp., 796 F.3d 822, 825 (7th Cir. 2015) (quoting Camasta v. Jos. A. Bank Clothiers, Inc., 761 F.3d 732, 736 (7th Cir. 2014)). To survive a Rule 12(b)(6) motion, which tests the sufficiency of the pleading but not its merits, the plaintiff must allege enough facts for the claim to be facially plausible. Kloss v. Acuant, Inc., 462 F.Supp.3d 873, 876 (7th Cir. 2020) (quoting McReynolds v. Merrill Lynch & Co., Inc., 694 F.3d 873, 878 (7th Cir. 2012)); Fosnight v. Jones, 41 F.4th 916, 921-22 (7th Cir. 2022) (quoting Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 570 (2007)). There must be enough facts pled to draw inferences as to liability. Fosnight, 41 F.4th at 922 (quoting Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009)). A pleading need not allege “detailed factual allegations,” but it must lift the claim above the speculative level. Kloss, 462 F.Supp.3d at 876 (citing Twombly, 550 U.S. at 555). “Threadbare recitals,” supported by conclusions, do not suffice. Trivedi v. Wells Fargo Bank, N.A., 609 F.Supp.3d 628, 631 (N.D. Ill. 2022) (quoting Iqbal, 556 U.S. at 678). When ruling, the Court accepts all well-pled facts as true and draws all inferences for the pleader. Id. (quoting Tamayo v. Blagojevich, 526 F.3d 1074, 1081 (7th Cir. 2008)); accord Kloss, 462 F.Supp.3d at 874-75.
Now, BIPA was enacted to regulate the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information. Tims v. Black Horse Carriers, Inc., 2023 IL 127801, ¶ 27 (quoting 740 ILCS 14/5(g)). “Biometric identifier” includes a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry, but not a photograph. 740 ILCS 14/10. Here, Plaintiffs invoke § 15(a), (b), and (c), which relate to the retention, collection, disclosure, and destruction of biometric identifiers.
Section 15(a) of BIPA provides as follows:
A private entity in possession of biometric identifiers or biometric information must develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within 3 years of the individual's last interaction with the private entity, whichever occurs first. Absent a valid warrant or subpoena issued by a court of competent jurisdiction, a private entity in possession of biometric identifiers or biometric information must comply with its established retention schedule and destruction guidelines.740 ILCS 14/15(a).
A plaintiff cannot merely allege a procedural failure to publicly disclose a data-retention policy under § 15(a). See Fox v. Dakkota Integrated Sys., LLC, 980 F.3d 1146, 1149 (7th Cir. 2020) (discussing Bryant v. Compass Grp. USA, Inc., 958 F.3d 617 (7th Cir. 2020)). The duty to develop a publicly available written policy, establishing a retention schedule and guidelines for destroying biometric identifiers, is owed to the public, generally, rather than to particular persons whose biometric identifiers are collected by a private entity. Thornley v. Clearview AI, Inc., 984 F.3d 1241, 1245 (7th Cir. 2021) (discussing Bryant); accord Patterson v. Respondus, Inc., 593 F.Supp.3d 783, 802 (N.D. Ill. 2022). However, a plaintiff may allege an injury related to the invasion of his or her privacy interests in biometric identifiers by invoking “the full panoply” of § 15(a), i.e., by invoking the duties to develop, publicly disclose, and comply with data retention and destruction policies. Fox, 980 F.3d at 1149, 1154-55; accord Warmack-Stillwell v. Christian Dior, Inc., 655 F.Supp.3d 742, 744-45 (N.D. Ill. 2023); Sosa v. Onfido, Inc., 600 F.Supp.3d 859, 868-69 (N.D. Ill. 2022). Such violations may result in the retention of biometric identifiers beyond the time authorized by law. Fox, 980 F.3d at 1149, 1154-55; accord Patterson, 593 F.Supp.3d at 802.
Further, § 15(b) of BIPA states:
No private entity may collect, capture, purchase, receive through trade, or otherwise obtain a person's or a customer's biometric identifier or biometric information, unless it first:
(1) informs the subject or the subject's legally authorized representative in writing that a biometric identifier or biometric information is being collected or stored;
(2) informs the subject or the subject's legally authorized representative in writing of the specific purpose and length of term for which a biometric identifier or biometric information is being collected, stored, and used; and
(3) receives a written release executed by the subject of the biometric identifier or biometric information or the subject's legally authorized representative.740 ILCS 14/15(b); see also Cothron v. White Castle Sys., Inc., 2023 IL 128004, ¶ 23 (finding, in the context of § 15(b), “collect” means “to receive, gather, or exact from a number of persons or other sources,” and “capture” means “to take, seize, or catch”) (quoting Webster's Third New International Dictionary 334, 444 (1993)).
Since § 15(b) confers a right to receive certain information from a private entity that collects, stores, or uses a person's biometric identifiers, the violation of that right, by itself, provides an actionable grievance. Bryant, 958 F.3d at 621 (citing Rosenbach v. Six Flags Entm't Corp., 2019 IL 123186, ¶ 33); Patterson, 593 F.Supp.3d at 802. It has been held, however, that § 15(b) requires an “active step” by the defendant to “obtain” the plaintiff's biometric identifiers. Clark v. Microsoft Corp., 688 F.Supp.3d 743, 746 (N.D. Ill. 2023) (collecting cases); accord Jones v. Microsoft Corp., 649 F.Supp.3d 679, 683 (N.D. Ill. 2023); Patterson, 593 F.Supp.3d at 824. That holding is based, at least in part, on the Illinois General Assembly's premising of § 15(a), (c), (d), and (e), but not § 15(b), on the mere “possession” of biometric identifiers. Clark, 688 F.Supp. at 746-47 (citing Chicago Teachers Union, Local No. 1 v. Bd. of Educ. of the City of Chicago, 2012 IL 112566, ¶ 24); see also Jones, 649 F.Supp.3d at 683 (noting this semantic decision and stating, “§ 15(b) does not penalize merely possessing biometric identifiers or information, unlike other BIPA sections.”); Patterson, 593 F.Supp.3d at 824 (stating, as to § 15(b), “ ‘there is a difference between possessing and collecting biometric information.' ”) (Emphasis in original.). Also, the phrase “otherwise obtain” in § 15(b) is “best construed as requiring something beyond passive possession or receipt” since it follows active verbs. Clark, 688 F.Supp. at 747 (citing Pooh-Bah Enters., Inc. v. County of Cook, 232 Ill.2d 463, 492 (2009)); see also Jones, 649 F.Supp.3d at 683-84 (“[E]ven the catch-all phrase ‘otherwise obtain' contemplates some type of affirmative effort.”). “[T]he statutory construction offered above shows that, ‘[u]nder a commonsense reading,' ‘the private entity must undertake some effort to collect or obtain biometric identifiers or information.' ” Clark, 688 F.Supp. at 747; see also Jones, 649 F.Supp.3d at 683-84 (“Although BIPA does not say the words ‘active step,' this concept simply describes the unifying characteristic among the verbs in the statute.”)).
Next, § 15(c) of BIPA provides: “No private entity in possession of a biometric identifier or biometric information may sell, lease, trade, or otherwise profit from a person's or a customer's biometric identifier or biometric information.” 14/15(c). The Seventh Circuit has described § 15(c) as “addressing] only the regulated entity - the collector or holder of the biometric data - and flatly prohibiting] for-profit transactions.” Thornley, 984 F.3d at 1247; accord Patterson, 593 F.Supp.3d at 803. As such, absent an adequate allegation of injury, § 15(c) involves “the same kind of general regulation” as § 15(a)-it generally “prohibits the operation of a market in biometric identifiers and information.” Thornley, 984 F.3d at 1247; accord Clark, 688 F.Supp. at 749; Warmack-Stillwell, 655 F.Supp.3d at 745; Patterson, 593 F.Supp.3d at 803. When discussing potential injuries under § 15(c), however, the Seventh Circuit suggested:
A plaintiff might assert, for example, that by selling her data, the collector has deprived her of the opportunity to profit from her biometric information. Or a plaintiff could assert that the act of selling her data amplified the invasion of her privacy that occurred when the data was first collected, by disseminating it to some unspecified number of other people. Perhaps a plaintiff might assert that the scraping of data from social media sites raises the cost of using those sites in some respect (though they are nominally free, in the same sense that network television or conventional radio is free - ads pay for these outlets, and the viewers are the “product” that the advertiser is buying).Thornley, 984 F.3d at 1247; see also Clark, 688 F.Supp. at 749 (stating, in Thornley, “the Seventh Circuit held that a section 15(c) plaintiff must allege more than that the defendant profited from their data; they must allege how that conduct harmed them individually”); Warmack-Stillwell, 655 F.Supp.3d at 745 (acknowledging that the Thornley court observed the ways in which a plaintiff may adequately plead injuries under § 15(c)).
Finally, the Court emphasizes § 15(a) and (c), unlike § 15(b), require the plaintiff to show the defendant was “in possession” of biometric identifiers. See Clark, 688 F.Supp.3d at 749; Patterson, 593 F.Supp.3d at 822. While “in possession” is not defined by BIPA, courts have required evidence that the defendant exercised “dominion or control” of the biometric identifiers to satisfy that requirement. Wilk v. Brainshark, Inc., 631 F.Supp.3d 522, 530-31 (N.D. Ill. 2022) (citing Heard v. Becton, Dickinson & Co., 440 F.Supp.3d 960, 968 (N.D. Ill. 2020)). Such a requirement is consistent with the ordinary meaning of “possession,” “which is ‘ “the act or condition of having in or taking into one's control or holding at one's disposal.”' ” See Clark, 688 F.Supp.3d at 749 (quoting People v. Ward, 215 Ill.2d 317 (2005); Webster's Third New International Dictionary 1770 (1986)); Patterson, 593 F.Supp.3d at 822 (quoting Rosenbach, 2019 IL 123186, ¶ 29); accord Hazlitt v. Apple Inc., 543 F.Supp.3d 643, 653 (S.D. Ill. 2021). That definition does not contemplate exclusive control, and nothing indicates it is inapplicable to BIPA. Patterson, 593 F.Supp.3d at 822-23 (quoting Heard, 440 F.Supp.3d at 968); accord Hazlitt, 543 F.Supp.3d at 653.
1. Defendant KPSI's Arguments under the Government Contractor Exception to BIPA
As an initial matter, Defendant KPSI argues Plaintiffs were photographed pursuant to agreements that it executed with Collinsville High School and Blackburn College. (Doc. 39, pgs. 3, 11-13). Therefore, in its view, Plaintiffs' claims are barred by the government contractor exception contained in § 25(e) of BIPA, which states: “Nothing in this Act shall be construed to apply to a contractor, subcontractor, or agent of a State agency or local unit of government when working for that State agency or local unit of government.” 740 ILCS 14/25(e). Plaintiffs respond that Defendant KPSI improperly seeks the application of an affirmative defense under Rule 12(b)(6). (Doc. 42, pgs. 4, 14-21). At this stage, Plaintiffs dispute whether Defendant KPSI has unambiguously established that affirmative defense applies. (Doc. 42, pgs. 4, 14-21).
Federal Rule of Civil Procedure 8 “carefully distinguishes between” defenses that are denials in subpart (b) and affirmative defenses in subpart (c)(1). Luna Vanegas v. Signet Builders, Inc., 46 F.4th 636, 640 (7th Cir. 2022); compare Fed.R.Civ.P. 8(b) (“In responding to a pleading, a party must: (A) state in short and plain terms its defenses to each claim asserted against it; and (B) admit or deny the allegations asserted against it by an opposing party.”), with Fed.R.Civ.P. 8(c)(1) (“In responding to a pleading, a party must affirmatively state any avoidance or affirmative defense.”). Importantly, Rule 8(c)(1) “provides a nonexclusive list of such defenses” that require the defendant to “come back with a responsive pleading” - i.e., to answer the complaint under Federal Rule of Civil Procedure 7(a)(2) -“unless it is raising one of the seven defenses listed in Rule 12(b) as appropriate for a motion.” Luna Vanegas, 46 F.4th at 640; see also Fed.R.Civ.P. 12(b) (stating, with the exception of the seven expressly identified defenses, “[e]very defense to a claim for relief in any pleading must be asserted in the responsive pleading if one is required”). The Seventh Circuit has noted affirmative defenses do not appear on Rule 12(b)'s list of defenses that are appropriate for a motion. See Luna Vanegas, 46 F.4th at 640; see also Doe v. GTE Corp., 347 F.3d 655, 657 (7th Cir. 2003) (“Affirmative defenses do not justify dismissal under Rule 12(b)(6).”). Indeed, from the structure of the Rules and the plain language of Rule 8(c)(1), the Seventh Circuit has found: “It follows.. .[that] an affirmative defense must be raised in the answer, not by motion.” Luna Vanegas, 46 F.4th at 640 (Emphasis added) (citing Vazquez v. Indiana Univ. Health, Inc., 40 F.4th 582, 588 (7th Or. 2022)); accord King v. King, No. 23-cv-355, 2023 WL 3346974, *6 (S.D. Ill. May 10, 2023); Johnston v. Kashi Sales, L.L.C., 626 F.Supp.3d 997, 1006 (S.D. Ill. 2007).
Moreover, in Luna Vanegas, the Seventh Circuit explained, “ [t]here is real consequence to this structure” because a plaintiff, when drafting a complaint, is not required to anticipate or refute affirmative defenses. Luna Vanegas, 46 F.4th at 640. Also, motions under Rule 12(b)(6) are limited to instances where “the law does not confer a right to relief,” and it is rare that “the face of the complaint [will] so clearly prove the opponent's affirmative defense that immediate dismissal, prior to the filing of an answer, will be proper.” Id. (citing Hecker v. Deere & Co., 556 F.3d 575, 588 (7th Cir. 2009)).
It is true, though, that courts have “taken shortcuts” when “the complaint leaves no doubt that there is a good” affirmative defense. Id. at 640, 645. But the Seventh Circuit has stressed “it is safer to insist on compliance with the rules.” Id. at 640; accord Johnston, 626 F.Supp.3d at 1006. The “shortcut[ ]” has been described as “a narrow and pragmatic exception” to the structure of the Rules. Gunn v. Cont'l Cas. Co., 968 F.3d 802, 806 (7th Cir. 2020). Absent an application of that exception, which is available only if a plaintiff pleads him or herself out of court, the proper vehicle for resolving an affirmative defense is a Rule 12(c) motion for a judgment on the pleadings. Id. (citing Benson, 944 F.3d at 645; Burton v. Ghosh, 961 F.3d 960, 964-65 (7th Cir. 2020); Brooks v. Ross, 578 F.3d 574, 579 (7th Cir. 2009)); accord Luna Vanegas, 46 F.4th at 640; H.A.L. NY Holdings, LLC v. Guinan, 958 F.3d 627, 632 (7th Cir. 2020). A plaintiff pleads him or herself out of court if the complaint sets forth all that is necessary to satisfy the affirmative defense, i.e., if the complaint “present[s] ‘all relevant facts,' [citation], such that... [the plaintiff] has essentially ‘admit[ted] all the ingredients of an impenetrable defense.' ” Novotney v. Walgreen Co., 683 F.Supp.3d 785, 788 (N.D. Ill. 2023) (quoting Sidney Hillman Health Ctr. of Rochester v. Abbott Labs, Inc., 782 F.3d 922, 928 (7th Cir. 2015); Brownmark Films, LLC v. Comedy Partners, 682 F.3d 687, 690 (7th Cir. 2012); Xechem, Inc. v. Bristol-Myers Squibb Co., 372 F.3d 899, 901 (7th Cir. 2004)); accord Luna Vanegas, 46 F.4th at 640, 645.
If the “narrow and pragmatic” exception applies, “the difference between Rules 12(b)(6) and 12(c)...[may] be disregarded.” Benson, 944 F.3d at 645 (citing Logan v. Wilkins, 644 F.3d 577, 582-83 (7th Cir. 2011); Brooks, 578 F.3d at 579). Otherwise, the distinction between the rules is “ ‘necessary to allocate correctly the burdens of pleading and proof,' [citation], and [it] serves an important notice function.” Gunn, 968 F.3d at 806 (quoting H.A.L. NY Holdings, LLC, 958 F.3d at 632; citing Burton, 961 F.3d at 964-65).
Here, the Court agrees with Plaintiffs that it would be imprudent to apply the government contractor exception to BIPA, contained in § 25(e), at this stage in the case. See Enriquez v. Navy Pier, Inc., 2022 IL App (1st) 211414-U, ¶¶ 18-19 (reviewing the applicability of § 25(e) of BIPA as an affirmative defense). Plaintiffs were not required to plead around § 25(e), and this is not one of the rare instances where the First Amended Class Action Complaint alleges all that is necessary to find that exception to BIPA is satisfied. As a result, the Court insists that Defendant KPSI comply with the structure of the Rules by filing an answer with any appropriate affirmative defenses. See Fed. Rs. Civ. P. 7(a)(2), 8(c)(1), 12(b); Luna Vanegas, 46 F.4th at 640; King, 2023 WL 3346974, *6; Johnston, 626 F.Supp.3d at 1006; Gunn, 968 F.3d at 806; Novotney, 683 F.Supp.3d at 788.
2. Defendant KPSI's Arguments as to Plaintiffs' Alleged Failure to State Claims under § 15(a), (b) and (c) of BIPA
Defendant KPSI argues Plaintiffs make general and conclusory allegations that do not distinguish between the alleged wrongful conduct of Defendants, as required by Rule 8(a). (Doc. 39, pgs. 3, 5-8). Defendant KPSI also suggests Plaintiffs failed to adequately allege it obtained, collected, stored, or possessed or controlled their biometric identifiers under BIPA. (Doc. 39, pgs. 8-10). Notwithstanding Plaintiffs' allegations as to the taking of photographs, which do not implicate BIPA, and the uploading of those photographs onto its account on Defendant CCSI's Grad Photo Network website to use the facial recognition technology offered by the “Ecommerce platform,” Defendant KPSI argues it does not own the website, control the biometric identifiers related to the facial recognition technology, extract faceprints, or have biometric identifiers at its disposal. (Doc. 39, pgs. 9-10). Defendant KPSI also argues Plaintiffs failed to allege it profited from their biometric identifiers under § 15(c). (Doc. 39, pgs. 10-11). Plaintiffs' “profiting-by-facilitating sales” theory is allegedly insufficient without an allegation that (1) access to their biometric identifiers was shared with or given to another, or (2) something of value was received in return for the access. (Doc. 39, pgs. 10-11). Defendant KPSI argues using biometric identifiers to increase the sale of photographs, which do not themselves implicate BIPA, does not entail sharing biometric identifiers. (Doc. 39, pg. 11).
In Response, Plaintiffs argue group pleading does not violate Rule 8(a) when multiple defendants are alleged to have engaged in the same wrongful conduct. (Doc. 42, pgs. 3, 8-9). Plaintiffs argue they have not deprived Defendant KPSI of fair notice under Rule 8(a) because the allegations clearly indicate why it is subject to liability. (Doc. 42, pgs. 3, 8-9). In short, Defendant KPSI allegedly used Defendant CCSI's facial recognition tool to collect Plaintiffs' biometric identifiers from photographs that it took and uploaded to the “Ecommerce platform.” (Doc. 42, pgs. 3, 8-9). In Plaintiffs' view, “[t]echnical details,” such as the way the biometric identifiers were extracted from the photographs and stored, will necessarily be revealed in discovery. (Doc. 42, pgs. 3, 9-10).
In addition, Plaintiffs argue they plausibly alleged that Defendant KPSI collected, possessed, controlled, and profited from their biometric identifiers. (Doc. 42, pgs. 3, 1014). Defendant KPSI allegedly used Defendant CCSI's facial recognition tool to extract Plaintiffs' faceprints, which involve biometric identifiers, to scan for similar images on the “Ecommerce platform.” (Doc. 42, pgs. 3, 10-13). Defendant KPSI allegedly profits from the use of the facial recognition technology because it is designed to make customers more likely to buy the photographs. (Doc. 42, pgs. 3-4, 13-14).
Here, the Court initially finds Plaintiffs did not engage in impermissible group pleading. Under Rule 8(a), their obligation was to, among other things, make “a short and plain statement of the claim showing” an entitlement to relief. Fed.R.Civ.P. 8(a)(2). And, notably, “[t]here ‘is no “group pleading” doctrine, per se, that either permits or forbids allegations against defendants collectively.' ” Sloan v. Anker Innovations Ltd., __ F.Supp.3d __, 2024 WL 935426, *3 (N.D. Ill. Jan. 9, 2024) (quoting Robles v. City of Chicago, 354 F.Supp.3d 873, 875 (N.D. Ill. 2019)); see also Fulton v. Bartik, 547 F.Supp.3d 799, 810 (N.D. Ill. 2021) (“Group pleading, while not ideal, is not categorically impermissible.”). Therefore, group pleading is only impermissible if Plaintiffs failed to provide sufficient detail to put Defendant KPSI on notice of their claims under Rule 8(a)(2). See Sloan, 2024 WL 935426 at *3 (quoting Horton v. City of Rockford, No. 18-cv-6829, 2019 WL 3573566, *3 (N.D. Ill. Aug. 6, 2019)); see also Fulton, 547 F.Supp.3d at 810 (“Notice and plausibility remain the benchmarks. [Citations]. Thus, group pleading is permissible so long as it provides notice to each defendant of the contours of the alleged deprivation and that he or she is alleged to have participated in it.”). That is not the case here, where Plaintiffs, with the assertion of facts common to all Counts and the use of specific subheadings, provided detail far exceeding what was required under Rule 8(a)(2). See Wordlaw v. Enter. Leasing Co. of Chicago, LLC, No. 20-cv-3200, 2020 WL 7490414, *3 (N.D. Ill.Dec. 21, 2020) (finding, in a case arising under BIPA, the plaintiff alleged enough to put each defendant on notice of their alleged wrongdoing where “she plan[ned] to prove that both defendants violated BIPA, even though she [wa]s currently unable to allege which one in particular installed and controlled the timekeeping system”); (Doc. 21, pgs. 4-14).
The only allegations identified as problematic by Defendant KPSI in its Motion to Dismiss are contained within this range of pages in the First Amended Class Action Complaint. (Doc. 39, pg. 8). Defendant KPSI expands upon the allegedly problematic allegations in its Reply, but the Court remains of the view that Plaintiffs satisfied their obligations under Rule 8(a)(2). (Doc. 46, pgs. 1-2).
Further, the Court finds Plaintiffs have alleged facially plausible claims to relief against Defendant KPSI under § 15(a), (b), and (c) of BIPA. See Kloss, 462 F.Supp.3d at 876; Fosnight, 41 F.4th at 921-22. To begin, while photographs themselves are excluded from the definition of “biometric identifier,” the Court notes faceprints extracted from uploaded photographs may plausibly constitute scans of face geometry within the meaning of “biometric identifier,” as Plaintiffs allege under § 15. Sosa, 600 F.Supp.3d at 870-72 (collecting cases to support this principle); accord Patterson, 593 F.Supp.3d at 817. Indeed, “nothing in section 10 expressly excludes information derived from photographs from the definition of ‘biometric identifiers.' ” Sosa, 600 F.Supp.3d at 871 (quoting 740 ILCS 14/10; citing Vance v. Microsoft Corp., 525 F.Supp.3d 1287, 1296 (W.D. Wash. 2021); Monroy v. Shutterfly, Inc., No. 16-cv-10984, 2017 WL 4099846, *3-5 (N.D. Ill. Sept. 15, 2017)).
With respect to § 15(a), Plaintiffs plausibly allege Defendant KPSI was “in possession” of their biometric identifiers without a publicly available retention schedule or destruction guidelines. See 740 ILCS 14/15(a); Fox, 980 F.3d at 1149, 1154-55; WarmackStillwell, 655 F.Supp.3d at 744-45; Sosa, 600 F.Supp.3d at 868-69. Specifically, Plaintiffs allege Defendant KPSI uploaded the photographs taken at the graduation ceremonies to its own account on Defendant CCSI's Grad Photo Network Website. (Doc. 21, pgs. 8, 1112). Defendant KPSI allegedly used Defendant CCSI's facial recognition technology to scan the photographs of Plaintiffs, identify and extract their unique facial geometries, and compile their other pictures. See Sosa, 600 F.Supp.3d at 870-72; Patterson, 593 F.Supp.3d at 817; (Doc. 21, pgs. 2-3, 6, 9-12). In light of these allegations, the Court agrees with Plaintiffs that technical questions about, inter alia, the manner in which biometric identifiers are extracted from the photographs and stored, are better suited for discovery. (Doc. 42, pgs. 3, 9-10). At present, it suffices to find, within a nonexclusive meaning of “possession,” Plaintiffs plausibly allege Defendant KPSI exercised dominion over, controlled, or held their biometric identifiers. See Clark, 688 F.Supp.3d at 749; Patterson, 593 F.Supp.3d at 822-23; Wilk, 631 F.Supp.3d at 530-31; Hazlitt, 543 F.Supp.3d at 653.
As to § 15(b), Plaintiffs plausibly allege Defendant KPSI collected, captured, or otherwise obtained their biometric identifiers without first complying with the requirements of that statutory provision. See 740 ILCS 14/15(b); Bryant, 958 F.3d at 621; Patterson, 593 F.Supp.3d at 802. Again, Defendant KPSI allegedly used Defendant CCSI's facial recognition technology to scan the photographs of Plaintiffs, identify and extract their unique facial geometries, and compile their other pictures. See Sosa, 600 F.Supp.3d at 870-72; Patterson, 593 F.Supp.3d at 817; (Doc. 21, pgs. 2-3, 6, 9-12). And, according to Plaintiffs' allegations as to the functionality and use of its account on Defendant CCSI's Grad Photo Network Website, Defendant KPSI successfully took this “active step.” See Clark, 688 F.Supp.3d at 746; Jones, 649 F.Supp.3d at 683; Patterson, 593 F.Supp.3d at 824; (Doc. 21, pgs. 8-12). As a result, the Court finds Plaintiffs plausibly allege Defendant KPSI did the following under § 15(b): (1) “collected,” i.e., received, gathered, or exacted, their biometric identifiers from the photographs; (2) “captured,” i.e., took, seized, or caught, their biometric identifiers from the photographs; or (3) “otherwise obtained” their biometric identifiers from the photographs. See Cothron, 2023 IL 128004, ¶ 23; Clark, 688 F.Supp.3d at 746-47; Jones, 649 F.Supp.3d at 683-84; Patterson, 593 F.Supp.3d at 824.
Finally, for the same reasons discussed as to § 15(a), the Court finds Plaintiffs plausibly allege Defendant KPSI was “in possession” of their biometric identifiers under § 15(c). See Clark, 688 F.Supp.3d at 749; Patterson, 593 F.Supp.3d at 822-23; Wilk, 631 F.Supp.3d at 530-31; Hazlitt, 543 F.Supp.3d at 653. Moreover, under a plain reading of § 15(c), the Court finds Plaintiffs plausibly allege Defendant KPSI “otherwise profit[ed]” from their biometric identifiers. See 740 ILCS 14/15(c). After uploading the photographs of Plaintiffs to its account on the Grad Photo Network website, Defendant KPSI allegedly used Defendant CCSI's facial recognition technology to scan the photographs of Plaintiffs, identify and extract their unique facial geometries, and compile their other pictures. (Doc. 21, pgs. 2-3, 6, 8-12). Plaintiffs also allege some of the photographs include individuals other than Plaintiffs, such that they too were subjected to the functionality of the facial recognition technology. (Doc. 21, pgs. 9-12). At a minimum, it is plausible that when Defendant KPSI solicited the purchase of photographs through emails, containing links to compiled photographs of Plaintiffs and others on a Grad Photo Network website that was still using the facial recognition technology, it was “otherwise profit[ing]” from the commercial use of Plaintiffs' biometric identifiers to sell photographs. See 740 ILCS 14/15(c); (Doc. 21, pgs. 2, 6, 8-12). As noted above, the Seventh Circuit has suggested, when discussing potential injuries that may arise under § 15(c), “a plaintiff could assert that the act of selling her data amplified the invasion of her privacy that occurred when the data was first collected, by disseminating it to some unspecified number of other people.” See Thornley, 984 F.3d at 1247; Warmack-Stillwell, 655 F.Supp.3d at 745. This is essentially what Plaintiffs allege under § 15(c)'s “otherwise profit” language in this case.
Also, Plaintiffs' are correct that their claim is analogous to those presented in other courts within the Seventh Circuit. See, e.g., In re Clearview AI, Inc., Consumer Privacy Litig., 585 F.Supp.3d 1111, 1126 (N.D. Ill. 2022) (finding the defendants' argument that § 15(c)'s “otherwise profit from” language indicated only a prohibition on the sale of biometric data, and not the business of using biometric technology, was without merit where, at its core, the “plaintiffs' claim concern[ed] the sale of biometric data because the....defendants' business model [wa]s premised on collecting and capturing biometric data and then profiting from that data when customers pa [id] to search the[ir].database”); Flores v. Motorola Sols, Inc., No. 20-cv-1128, 2021 WL 232627, *3 (N.D. Ill. Jan. 8, 2021) (finding, as a matter of law under § 15(c), the court could not conclude the defendants' activity constituted selling or profiting from biometric data where “Plaintiffs' complaint assert[ed] that Defendants develop[ed] the database by extracting biometric identifiers, compare novel images to the database images to find facial matches, and offer access to that database for a fee to law enforcement”); Mahmood v. Berbix, Inc., No. 22-cv-2456, 2022 WL 3684636, *2 (N.D. Ill. Aug. 25, 2022) (finding the plaintiff “plausibly alleged [the defendant] violated § 15(c) because [the defendant's client] paid for access to [the defendant's facial recognition platform to verify [the plaintiffs age and identity before she rented a car,” such that the defendant's “collection and use of biometrics [wa]s a necessary component to its business model”); (Doc. 42, pg. 14). For these reasons, the Court finds Plaintiffs allege a facially plausible claim under § 15(c).
III. Conclusion
As explained above, Defendant CCSI's Motion to Dismiss is GRANTED for lack of personal jurisdiction. The claims against it are DISMISSED without prejudice. Defendant KPSI's Motion to Dismiss is DENIED. The stay of discovery is LIFTED. Plaintiffs and Defendant KPSI are DIRECTED to meet, confer, and submit a proposed scheduling and discovery order to the Court's proposed documents email within 21 days.
SO ORDERED.