Patterson v. Respondus, Inc.

Full title: Courtnie PATTERSON, individually and on behalf of all others similarly…

Court: United States District Court, N.D. Illinois, Eastern Division.

Date published: Mar 23, 2022

593 F. Supp. 3d 783 (N.D. Ill. 2022)

Opinion

No. 20 C 7692 No. 21 C 1785 No. 21 C 2620

2022-03-23

Courtnie PATTERSON, individually and on behalf of all others similarly situated, Plaintiff, v. RESPONDUS, INC. and Lewis University, Defendants. Cheng Wu, individually and on behalf of all others similarly situated, Plaintiff, v. Respondus, Inc., Defendant. Lucius Veiga, Michael Sterchele, and Alex Parker Zimmerman, on behalf of themselves and all others similarly situated, Plaintiffs, v. Respondus, Inc., Defendant.

Raina C. Borrelli, Samuel J. Strauss, Turke & Strauss LLP, Madison, WI, Brian Kevin Murphy, Murray Murphy Moul Basil LLP, Columbus, OH, for Plaintiff in 20 C 7692. Raina C. Borrelli, Mary C. Turke, Samuel J. Strauss, Turke & Strauss LLP, Madison, WI, Jonathan Patrick Misny, Brian Kevin Murphy, Murray Murphy Moul Basil LLP, Columbus, OH, Lauren E. Urban, Attorney at Law, Chicago, IL, for Plaintiff in 21 C 1785. Andrei Vladimir Rado, Blake Hunter Yagman, Pro Hac Vice, Milberg Coleman Bryson Phillips Grossman, PLLC, Garden City, NY, Erin J. Ruben, Pro Hac Vice, Matthew E. Lee, Pro Hac Vice, Milberg Coleman Bryson Phillips Grossman, PLLC, Raleigh, NC, Gary M. Klinger, Milberg Coleman Bryson Phillips Grossman, PLLC, Chicago, IL, Gregory F. Coleman, Greg Coleman Law PC, Knoxville, TN, Jonathan Betten Cohen, Melissa Kaye Sims, Milberg Coleman Bryson Phillips Grossman, PLLC, Knoxville, TN, for Plaintiffs in 21 C 2620. Bonnie Keane DelGobbo, Amy Lynn Lenz, Baker & Hostetler LLP, Chicago, IL, Joel Griswold, Baker & Hostetler, LLP, Orlando, FL, for Defendant Respondus, Inc. in 20 C 7692, 21 C 1785, 21 C 2620. Colette Lynn Kopon, David Anthony Pestell, Kopon Airdo, LLC, Chicago, IL, Darcy L. Proctor, Tressler LLP, Chicago, IL, for Defendant Lewis University in 20 C 7692.

REBECCA R. PALLMEYER, United States District Judge

Raina C. Borrelli, Samuel J. Strauss, Turke & Strauss LLP, Madison, WI, Brian Kevin Murphy, Murray Murphy Moul Basil LLP, Columbus, OH, for Plaintiff in 20 C 7692.

Raina C. Borrelli, Mary C. Turke, Samuel J. Strauss, Turke & Strauss LLP, Madison, WI, Jonathan Patrick Misny, Brian Kevin Murphy, Murray Murphy Moul Basil LLP, Columbus, OH, Lauren E. Urban, Attorney at Law, Chicago, IL, for Plaintiff in 21 C 1785.

Andrei Vladimir Rado, Blake Hunter Yagman, Pro Hac Vice, Milberg Coleman Bryson Phillips Grossman, PLLC, Garden City, NY, Erin J. Ruben, Pro Hac Vice, Matthew E. Lee, Pro Hac Vice, Milberg Coleman Bryson Phillips Grossman, PLLC, Raleigh, NC, Gary M. Klinger, Milberg Coleman Bryson Phillips Grossman, PLLC, Chicago, IL, Gregory F. Coleman, Greg Coleman Law PC, Knoxville, TN, Jonathan Betten Cohen, Melissa Kaye Sims, Milberg Coleman Bryson Phillips Grossman, PLLC, Knoxville, TN, for Plaintiffs in 21 C 2620.

Bonnie Keane DelGobbo, Amy Lynn Lenz, Baker & Hostetler LLP, Chicago, IL, Joel Griswold, Baker & Hostetler, LLP, Orlando, FL, for Defendant Respondus, Inc. in 20 C 7692, 21 C 1785, 21 C 2620.

Colette Lynn Kopon, David Anthony Pestell, Kopon Airdo, LLC, Chicago, IL, Darcy L. Proctor, Tressler LLP, Chicago, IL, for Defendant Lewis University in 20 C 7692.

MEMORANDUM OPINION AND ORDER

REBECCA R. PALLMEYER, United States District Judge

This opinion concerns three putative class actions brought under the Illinois Biometric Information Privacy Act (BIPA), 740 ILCS 14/1 et seq. In each case, the plaintiffs are current or former students who took an exam using Respondus Monitor, a software program that their schools used to administer online exams without a proctor. Respondus Monitor employs a student's webcam and microphone to record the student and their examination environment. The plaintiffs allege that the program captures various types of biometric data, including scans of students’ facial geometry. All three sets of plaintiffs have sued the company that makes Respondus Monitor (Respondus, Inc., a Washington-based company), and one plaintiff has also sued her school (Lewis University, a private university in Illinois). All plaintiffs allege that the defendants violated BIPA by failing to obtain their informed, written consent to the collection of their biometric data, 740 ILCS 14/15(b), and by failing to publicly disclose a compliance policy regarding the retention and destruction of biometric data in their possession, id. § 14/15(a). Some plaintiffs also allege that the defendants unlawfully profited from their biometric data, id. § 14/15(c), and unlawfully disclosed their biometric data to third parties, id. § 14/15(d).

Respondus and Lewis have moved to dismiss the plaintiffs’ BIPA claims on several grounds. The motions have generated a host of subsidiary disputes, including questions of civil procedure and contract law. After resolving these threshold issues, the court reaches the BIPA claims, addressing standing in addition to the issues briefed by the parties. As explained here, the court finds that the plaintiffs have successfully stated claims for violations of some BIPA provisions but that they lack Article III standing with respect to other provisions.

PROCEDURAL HISTORY

This opinion resolves four motions to dismiss filed by two separate defendants in three different cases. The court attempts to provide clarity below.

Patterson v. Respondus Inc. & Lewis University (No. 20 C 7692). On November 16, 2020, Jerrie Hinds filed a putative class-action complaint against Respondus in the Circuit Court of Cook County, Illinois. On December 23, 2020, Respondus removed the case to this district under the Class Action Fairness Act of 2005 (CAFA).¹ (See Notice of Removal, Patterson v. Respondus, Inc. , No. 20 C 7692 [1] (hereinafter "Notice of Removal (Patterson )").) The case was assigned to this court. On January 22, 2021, Hinds filed the operative First Amended Complaint, in which Courtnie Patterson was joined as a plaintiff and Lewis University was added as a defendant. Hinds has since voluntarily dismissed her claims, leaving Patterson as the sole remaining named plaintiff. Patterson claims that both Respondus and Lewis violated BIPA sections 15(a), 15(b), 15(c), and 15(d). (See First Am. Class Action Compl., Patterson v. Respondus, Inc. , No. 20 C 7692 [12] (hereinafter "Compl. (Patterson )").) Patterson sues on behalf of herself and two proposed classes, defined (with exclusions not relevant here) as follows:

1 The CAFA gives federal courts jurisdiction over class actions in which there is at least $5,000,000 in controversy; minimal diversity exists between the parties; and the total number of class members is greater than 100. See 28 U.S.C. § 1332(d) ; see also id. § 1453(b) (removal).

Respondus Monitor Class : All persons who took an exam using Respondus Monitor in the state of Illinois at any time during the five years prior to the filing of this Complaint through trial.

Lewis University Class : All persons who took an exam using Respondus Monitor as a student of Lewis in the state of Illinois at any time during the five years prior to the filing of this Complaint through trial.

(Compl. (Patterson ) ¶ 107.)

Wu v. Respondus, Inc. (No. 21 C 1785). On April 2, 2021, Phillip Bridges and Cheng Wu filed a putative class-action complaint against Respondus in this district, premising federal jurisdiction on the CAFA. The case was initially assigned to Judge Sara Ellis, but it was reassigned to this court as related to Patterson. Bridges voluntarily dismissed his claims, leaving Wu as the sole remaining named plaintiff. The same attorneys represent Plaintiffs Patterson and Wu, and apart from the fact that the Wu complaint does not name Lewis University as a defendant, it is essentially identical to the Patterson complaint. Like Patterson, Wu sues on behalf of himself and others similarly situated and claims that Respondus violated BIPA sections 15(a), 15(b), 15(c), and 15(d). (See Class Action Compl., Wu v. Respondus, Inc. , No. 21 C 1785 [1] (hereinafter "Compl. (Wu )").) Wu proposed the following class definition (with exclusions not relevant here):

All persons who took an assessment using Respondus Monitor in Illinois at any time during the five years prior to the filing of this Complaint through January 20, 2021.

(Compl. (Wu ) ¶ 106.)

Veiga et al. v. Respondus, Inc. (No. 21 C 2620). On March 31, 2021, Lucius Veiga, Michael Sterchele, and Alex Parker Zimmerman filed a putative class-action complaint against Respondus in the Circuit Court of Cook County, Illinois. Respondus removed the case to this district under the CAFA. (See Notice of Removal, Veiga v. Respondus, Inc. , No. 21 C 2620 [1] (hereinafter "Notice of Removal (Veiga )").) The case was initially assigned to Judge John Lee, but, like Wu , it was reassigned to this court as related to Patterson. Plaintiffs Veiga, Sterchele, and Zimmerman are represented by different attorneys than Plaintiffs Patterson and Wu, and the allegations in their complaint are slightly different. The Veiga Plaintiffs claim that Respondus violated BIPA sections 15(a) and 15(b). (See Class Action Compl., Ex. 1 to Notice of Removal, Veiga v. Respondus, Inc. , No. 21 C 2620 [1] (hereinafter "Compl. (Veiga )").) Like the Patterson and Wu Plaintiffs, the Veiga Plaintiffs seek to represent a class. They have proposed the following class definition (again, with exclusions not relevant here):

All Illinois citizens, who used Respondus Monitor's software for a remotely proctored exam from 2016 through 2020, and whose biometric information or identifiers were collected, captured, purchased, received through trade, or otherwise obtained by Respondus in Illinois in violation of the Illinois Biometric Information Privacy Act, 740 ILCS 14/5 et seq.

(Compl. (Veiga ) ¶ 37.)

Respondus's three motions to dismiss. On June 4, 2021, Respondus filed motions to dismiss in Patterson (No. 20 C 7692 [48]), Wu (No. 21 C 1785 [21]), and Veiga (No. 21 C 2620 [15]).² Respondus's supporting memoranda of law were largely the same in each case. The three motions have been exhaustively briefed.³ In this opinion, the court addresses the Patterson and Wu cases together because these Plaintiffs filed nearly identical complaints, are represented by the same counsel, and filed nearly identical response briefs. The Veiga case differs slightly, so the court addresses that motion separately at times.

2 Respondus's motion to dismiss in the Veiga case is directed only to the claims of Plaintiffs Sterchele and Zimmerman, not to the claims of Plaintiff Veiga. Respondus's separately-filed motion to compel arbitration of Plaintiff Veiga's claims (see No. 21 C 2620 [12].) will be resolved in a separate written order. The court notes, however, that Plaintiff Veiga's BIPA claims are materially identical to those of his two co-plaintiffs. Thus, where the court concludes, in this opinion, that the two co-plaintiffs lack Article III standing, it necessarily concludes that Plaintiff Veiga lacks Article III standing, as well.

3 For Respondus's motion in Patterson , see Def.’s Memo. in Support of Its Rule 12(b)(6) Mot. to Dismiss, Patterson v. Respondus, Inc. , No. 20 C 7692 [49] (hereinafter "Respondus Mot. (Patterson )"); Pl.’s Memo. in Opp. to Def. Respondus, Inc.’s Rule 12(b)(6) Mot. to Dismiss, Patterson v. Respondus, Inc. , No. 20 C 7692 [57] (hereinafter "Pl. Resp. to Respondus (Patterson )"); Def.’s Reply in Further Support of Its Rule 12(b)(6) Mot. to Dismiss, Patterson v. Respondus, Inc. , No. 20 C 7692 [63] (hereinafter "Respondus Reply (Patterson )"); Pl.’s Sur-Reply and Supp. Auth. in Opp. to Def. Respondus, Inc.’s Rule 12(b)(6) Mot. to Dismiss, Patterson v. Respondus, Inc. , No. 20 C 7692 [70]; Respondus, Inc.’s Resp. to Pl.’s Sur-Reply Regarding Def.’s Rule 12(b)(6) Mot., Patterson v. Respondus, Inc. , No. 20 C 7692 [71].
For Respondus's motion in Wu , see Def.’s Memo. in Support of Its Rule 12(b)(6) Mot. to Dismiss, Wu v. Respondus, Inc. , No. 21 C 1785 [22] (hereinafter "Respondus Mot. (Wu )"); Pl.’s Memo. in Opp. to Def.’s Rule 12(b)(6) Mot. to Dismiss, Wu v. Respondus, Inc. , No. 21 C 1785 [25] (hereinafter "Pl. Resp. (Wu )"); Def.’s Reply in Further Support of Its Rule 12(b)(6) Mot. to Dismiss, Wu v. Respondus, Inc. , No. 21 C 1785 [31] (hereinafter "Respondus Reply (Wu )"); Pl.’s Sur-Reply and Supp. Auth. in Opp. to Def. Respondus, Inc.’s Rule 12(b)(6) Mot. to Dismiss, Wu v. Respondus, Inc. , No. 21 C 1785 [36]; Respondus, Inc.’s Resp. to Pl.’s Sur-Reply Regarding Def.’s Rule 12(b)(6) Mot., Wu v. Respondus, Inc. , No. 21 C 1785 [39].
For Respondus's motion in Veiga , see Def.’s Memo. in Support of Its Rule 12(b)(6) Mot. to Dismiss, Veiga v. Respondus, Inc. , No. 21 C 2620 [16] (hereinafter "Respondus Mot. (Veiga )"); Pl.’s Resp. in Opp. to Def. Respondus, Inc.’s Mot. to Dismiss Claims of Pls. Michael Sterchele and Alex Parker Zimmerman, Veiga v. Respondus, Inc. , No. 21 C 2620 [26] (hereinafter "Pl. Resp. (Veiga )"); Def.’s Reply Memo. in Further Support of Its Rule 12(b)(6) Mot. to Dismiss, Veiga v. Respondus, Inc. , No. 21 C 2620 [33].

Lewis's motion to dismiss. On June 4, 2021, Lewis filed a motion to dismiss in Patterson (No. 20 C 7692 [50]), the only case in which it is a defendant. That motion, too, is fully briefed.⁴ Because Lewis's motion raises different legal issues than Respondus's motions, the court addresses it separately.

4 Def. Lewis Univ.’s Memo. of Law in Support of Its Mot. to Dismiss Pursuant to Fed. R. Civ. P. 12(b)(6), Patterson v. Respondus, Inc. , No. 20 C 7692 [51]; Pl.’s Memo. in Opp. to Def. Lewis Univ.’s Rule 12(b)(6) Mot. to Dismiss, Patterson v. Respondus, Inc. , No. 20 C 7692 [55] (hereinafter "Pl. Resp. to Lewis (Patterson )"); Decl. of Samuel J. Strauss in Support of Pl.’s Memo. in Opp. to Def. Lewis Univ.’s Rule 12(b)(6) Mot. to Dismiss, Patterson v. Respondus, Inc. , No. 20 C 7692 [56]; Def. Lewis Univ.’s Reply in Support of Its Mot. to Dismiss Pursuant to Fed. R. Civ. P. 12(b)(6), Patterson v. Respondus, Inc. , No. 20 C 7692 [61].

FACTUAL BACKGROUND

Plaintiffs are all Illinois citizens who took exams using Respondus Monitor at least once while attending school in Illinois. (Compl. (Patterson ) ¶¶ 27, 98–100; Compl. (Wu ) ¶¶ 24, 95–98; Compl. (Veiga ) ¶¶ 9–10, 31–32.) Each named plaintiff attended a different school at the time they used Respondus Monitor. (See Compl. (Patterson ) ¶¶ 98; Compl. (Wu ) ¶ 95; Compl. (Veiga ) ¶¶ 9–10.) Plaintiff Courtnie Patterson, who attended Lewis University (see Compl. (Patterson ) ¶ 98), has also named Lewis as a defendant in her case.

Defendant Respondus, Inc. is a Washington-based software company that "offers several cloud-based software and service applications to assist educational institutions in providing online content and exams to students." (Compl. (Patterson ) ¶¶ 28, 34; Compl. (Wu ) ¶¶ 25, 29; see also Compl. (Veiga ) ¶¶ 11, 18.) The software at the center of this case, Respondus Monitor, is an automated proctoring tool that schools use to administer online exams. (Compl. (Patterson ) ¶¶ 41–42; Compl. (Wu ) ¶¶ 36–37; Compl. (Veiga ) ¶¶ 4, 24–25.) One of the main purposes of Respondus Monitor is to prevent students from cheating. (Compl. (Patterson ) ¶ 1; Compl. (Wu ) ¶ 1; Compl. (Veiga ) ¶ 19.) In 2021 alone, Respondus projected that more than 20 million exams would be taken through Respondus Monitor, making it the most widely used proctoring software in higher education. (Compl. (Patterson ) ¶ 42; Compl. (Wu ) ¶ 37; see also Compl. (Veiga ) ¶ 4.)

Before a student begins an exam using Respondus Monitor, the program confirms that the student's webcam and microphone are working properly, and it verifies the student's identity. (Compl. (Patterson ) ¶¶ 82–84; Compl. (Wu ) ¶¶ 81–83; Compl. (Veiga ) ¶¶ 26–27.) This process, which includes a "facial detection check," requires the student to center their face in the camera frame and speak into the microphone. (Compl. (Patterson ) ¶¶ 82–83, 86; Compl. (Wu ) ¶¶ 81–82, 85; Compl. (Veiga ) ¶¶ 26–27.) Respondus Monitor also uses the student's webcam to perform an "environment check," which records the student's surroundings. (Compl. (Patterson ) ¶ 85; Compl. (Wu ) ¶ 84; Compl. (Veiga ) ¶ 26.) Depending on settings that the school controls, the program may also require the student to show a piece of photo identification to the camera, confirming their identity. (Compl. (Patterson ) ¶ 84; Compl. (Wu ) ¶ 83; Compl. (Veiga ) ¶¶ 26–27.) Through this series of steps, Respondus Monitor captures various forms of biometric data, including scans of the student's facial geometry. (Compl. (Patterson ) ¶ 87; Compl. (Wu ) ¶ 86; Compl. (Veiga ) ¶ 27.) According to the Veiga Plaintiffs, Respondus Monitor also captures a biometric "voiceprint" when it records the student speaking. (Compl. (Veiga ) ¶ 27.)

While a student takes an exam, Respondus Monitor uses, according to Respondus's website, "facial detection, motion, and lighting to analyze the student and [their] examination environment." (Compl. (Patterson ) ¶ 44; Compl. (Wu ) ¶ 39; Compl. (Veiga ) ¶¶ 29–30.) If, for example, the test taker should attempt to substitute another person to take the test, the software would recognize this. (Compl. (Patterson ) ¶ 45; Compl. (Wu ) ¶ 40; Compl. (Veiga ) ¶ 28.) And the software records patterns of keystrokes, eye-monitoring data, gaze-monitoring data, and other information about a student's exam. (Compl. (Patterson ) ¶ 3; Compl. (Wu ) ¶ 3; Compl. (Veiga ) ¶¶ 20, 29.) After an exam has been completed, the data that has been collected and analyzed by Respondus Monitor flows into a separate portal, called the "Review Priority" system, through which the school's instructors can review the proctoring results. (Compl. (Patterson ) ¶¶ 46–47; Compl. (Wu ) ¶¶ 41–42; Compl. (Veiga ) ¶¶ 20, 28.)

All Plaintiffs allege that aspects of this process were not properly disclosed to them before using Respondus Monitor, but they articulate that general point in different ways. The Veiga Plaintiffs simply allege that before they used Respondus Monitor, they were not provided with written disclosures explaining that their biometric data would be collected or handled. (See, e.g. , Compl. (Veiga ) ¶¶ 33–36.) Plaintiffs Patterson and Wu provide significantly more detailed allegations about the information that they did receive, and about why they believe that information was inadequate.

According to Plaintiffs Patterson and Wu, Respondus Monitor integrates with a school's existing "learning management system." (Compl. (Patterson ) ¶¶ 35, 37; Compl. (Wu ) ¶¶ 30–31.) To take an exam, a student logs into their school's learning management system and opens the "LockDown Browser," which "locks down a testing environment" by limiting a computer's functionality. (Compl. (Patterson ) ¶¶ 38, 49; Compl. (Wu ) ¶¶ 33, 45.) Then, the student is presented with Respondus Monitor's terms of use (the "Student Terms"), which the student must accept as a condition of proceeding with the exam. (Compl. (Patterson ) ¶¶ 40, 50, 52, 78; Compl. (Wu ) ¶¶ 35, 46, 48, 77.) Plaintiffs Patterson and Wu assented to these terms by clicking "I accept," but because their acceptance was a condition of proceeding with each exam, they allege that they lacked a "meaningful choice" under the circumstances. (Compl. (Patterson ) ¶¶ 50, 105; Compl. (Wu ) ¶¶ 46, 104.) Moreover, according to Plaintiffs Patterson and Wu, the Student Terms do "not disclose that Respondus Monitor will use facial recognition technology to collect, capture, analyze, and disseminate a student's biometric identifiers or biometric information." (Compl. (Patterson ) ¶ 54; Compl. (Wu ) ¶ 50.) The Student Terms contain an abbreviated privacy policy and incorporate by reference a longer privacy policy available on Respondus's website. (See Compl. (Patterson ) ¶ 69; Compl. (Wu ) ¶ 66.) Neither of these two policies explain that Respondus collects students’ biometric data through Respondus Monitor, nor do the policies disclose the fact that schools using Respondus Monitor (or those schools’ agents) are given access to students’ biometric data. (See Compl. (Patterson ) ¶¶ 70–73, 75–76; Compl. (Wu ) ¶¶ 67–70, 73–74.) Furthermore, neither of the policies establish guidelines for the retention and destruction of biometric data by Respondus. (See Compl. (Patterson ) ¶¶ 74, 77; Compl. (Wu ) ¶¶ 72, 76.)

Defendant Lewis is a private university located in Romeoville, Illinois. (Compl. (Patterson ) ¶¶ 6, 30.) Plaintiff Patterson attended Lewis between 2015 and 2019, paying tuition and taking courses toward a college degree. (Id. ¶¶ 98–99.) She took exams using Respondus Monitor, which was required to complete some of her courses. (Id. ¶ 100.) Lewis purchases a license from Respondus to integrate Respondus Monitor into Lewis's learning management system. (Id. ¶ 36.) Lewis's use of Respondus Monitor is subject to terms of use imposed by Respondus (the "Institution Terms"). (Id. ¶¶ 36, 88.) Under the Institution Terms, Lewis agrees that Respondus may share recordings of student exams with researchers, including "research institutions and/or biometric experts." (Id. ¶ 91 (quoting the Institution Terms).) Respondus agrees to make recordings of student exams available to Lewis's "instructors, administrators, and other agents." (Id. ¶ 90.) And Respondus agrees that it will, at Lewis's "direction and control," share student recordings with third parties. (Id. ¶ 92.) Lewis may also, under the Institution Terms, elect to save student data for up to four years beyond the default, one-year timeline that Respondus follows. (Id. ¶ 93.) Notwithstanding Lewis's agreement with Respondus, Lewis's "publicly-available privacy policy and Student Handbook do not disclose that Lewis may collect, capture, disclose, or disseminate a student's biometric information or biometric identifiers." (Id. ¶ 96.) Nor do these documents describe Lewis's "retention and destruction policy for biometric information and biometric identifiers." (Id. ¶ 97.)

LEGAL STANDARD

As detailed below, all three sets of Plaintiffs allege various violations of BIPA. Before addressing the merits of those claims, the court considers its subject-matter jurisdiction—specifically, whether Plaintiffs have standing to pursue their claims in federal court.

I. Standing

Even where parties do not raise the issue, a court has an "independent duty" to ensure that it has subject-matter jurisdiction. Dexia Crédit Loc. v. Rogan , 602 F.3d 879, 883 (7th Cir. 2010). In federal court, a key component of jurisdiction is Article III standing. Bazile v. Fin. Sys. of Green Bay, Inc. , 983 F.3d 274, 278 (7th Cir. 2020). To establish standing, "a plaintiff must demonstrate (1) that he or she suffered an injury in fact that is concrete, particularized, and actual or imminent, (2) that the injury was caused by the defendant, and (3) that the injury would likely be redressed by the requested judicial relief." Thole v. U.S. Bank N.A. , ––– U.S. ––––, 140 S. Ct. 1615, 1618, 207 L. Ed. 2d 85 (2020) (citing Lujan v. Defs. of Wildlife , 504 U.S. 555, 560–61, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992) ). These three elements must be satisfied for each claim a plaintiff asserts. DaimlerChrysler Corp. v. Cuno , 547 U.S. 332, 351–52, 126 S.Ct. 1854, 164 L.Ed.2d 589 (2006). A district court may dismiss claims sua sponte if it determines that the plaintiff lacks Article III standing. See Metallgesellschaft AG v. Sumitomo Corp. of Am. , 325 F.3d 836, 842 (7th Cir. 2003).

When a case is filed in state court and removed to federal court, the party seeking removal "bears the burden of establishing federal jurisdiction," including standing. Tri-State Water Treatment, Inc. v. Bauer , 845 F.3d 350, 352 (7th Cir. 2017). "If at any time before final judgment it appears that the district court lacks subject matter jurisdiction, the case shall be remanded" to the state court. 28 U.S.C. § 1447(c). If some parts of the case lie within federal jurisdiction but others do not, "the federal court must resolve the elements within federal jurisdiction and remand the rest—unless the balance can be handled under the supplemental jurisdiction" statutes. Bergquist v. Mann Bracken, LLP , 592 F.3d 816, 819 (7th Cir. 2010) (citing 28 U.S.C. §§ 1367(c)(3), 1441(c) ). Supplemental jurisdiction does not extend to claims for which the plaintiff lacks Article III standing. See DaimlerChrysler , 547 U.S. at 351–53, 126 S.Ct. 1854 (rejecting the principle of "ancillary standing").

II. Rule 12(b)(6)

A complaint must include a "short and plain statement of the claim showing that the pleader is entitled to relief." FED. R. CIV. P. 8(a)(2). A motion to dismiss under Rule 12(b)(6) "challenges the viability of a complaint by arguing that it fails to state a claim upon which relief may be granted." FED. R. CIV. P. 12(b)(6) ; Firestone Fin. Corp. v. Meyer , 796 F.3d 822, 825 (7th Cir. 2015). While "detailed factual allegations are unnecessary, the complaint must have ‘enough facts to state a claim to relief that is plausible on its face.’ " Pierce v. Zoetis, Inc. , 818 F.3d 274, 277 (7th Cir. 2016) (quoting Bell Atl. Corp. v. Twombly , 550 U.S. 544, 570, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007) ). A claim is facially plausible "when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Ashcroft v. Iqbal , 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009). That task is "context-specific" and "requires the reviewing court to draw on its judicial experience and common sense." Id. at 679, 129 S.Ct. 1937. In deciding a motion to dismiss, the court accepts all factual allegations in the complaint as true and draws all reasonable inferences in favor of the plaintiff. Kanter v. Barr , 919 F.3d 437, 441 (7th Cir. 2019).

DISCUSSION

As its name suggests, the Illinois Biometric Information Privacy Act (BIPA) protects an individual's privacy interest in her biometric data.⁵ 740 ILCS 14/1 et seq. ; see also Rosenbach v. Six Flags Ent. Corp. , 2019 IL 123186, ¶ 33, 432 Ill.Dec. 654, 129 N.E.3d 1197, 1206. The Illinois General Assembly enacted BIPA in 2008 in response to the increasing use of biometric data in commercial settings. See 740 ILCS 14/5(a) – (b), (d). The legislature emphasized that biometric data, unlike other types of sensitive information (such as Social Security numbers), is both unique and immutable. Id. § 14/5(c). If biometric data is compromised, the individual may be left with "no recourse" and at a "heightened risk for identity theft." Id. § 14/5(c) ; see also Bryant v. Compass Grp. USA, Inc. , 958 F.3d 617, 619 (7th Cir. 2020) (noting the "threat of irreparable privacy harms, identity theft, and other economic injuries" arising from biometric data).

5 Under the statute, the term "biometric identifier" refers to a person's "retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry," while the term "biometric information" refers to "any information, regardless of how it is captured, converted, stored, or shared, based on an individual's biometric identifier." 740 ILCS 14/10.
In this opinion, the court uses the catchall term "biometric data" to encompass the statutory terms "biometric information" and "biometric identifier."

To address these and other privacy concerns, BIPA regulates how private entities may collect and handle biometric data, 740 ILCS 14/15, and it creates a private cause of action for any person aggrieved by a violation of the statute, id. § 14/20. BIPA's operative regulations all appear in section 15. Id. § 14/15. Different provisions in section 15 aim at different types of violations, and those differences bear on the question of Article III standing. See Cothron v. White Castle Sys., Inc. , 20 F.4th 1156, 1160–61 (7th Cir. 2021) (summarizing the Seventh Circuit's standing rules for different BIPA provisions).

Section 15(a). Section 15(a) of BIPA requires a private entity in possession of biometric data to develop, publicly disclose, and comply with a retention schedule and guidelines for destroying the data within specified time limits. 740 ILCS 14/15(a). These distinct obligations give rise to different legal theories with different requirements for standing. The duty to publicize a retention-and-destruction policy "is owed to the public generally, not to particular persons" whose biometric data an entity possesses. Bryant , 958 F.3d at 626. Thus, a violation of section 15(a)’s publication requirement does not, by itself, inflict an Article III injury; to establish standing, a plaintiff claiming such a violation must allege a more concrete and particularized harm. See id. In contrast, "[a]n unlawful retention of biometric data inflicts a privacy injury in the same sense that an unlawful collection does." Fox v. Dakkota Integrated Sys., LLC , 980 F.3d 1146, 1154–55 (7th Cir. 2020). Failure to comply with a retention-and-destruction policy necessarily inflicts an Article III injury, at least where it results in the unlawful retention of biometric data beyond the time limits set by section 15(a). Id. at 1155 ; see also id. at 1149 (finding a "concrete and particularized" harm where the plaintiff alleged that the defendant violated the "full panoply" of section 15(a) requirements).

Section 15(b). Section 15(b) of BIPA requires a private entity that collects or otherwise obtains an individual's biometric data to first obtain the individual's informed, written consent. 740 ILCS 14/15(b). The Seventh Circuit has described the informed-consent regime as the "heart of BIPA." Bryant , 958 F.3d at 626. Section 15(b) ensures that "consumers understand, before providing their biometric data, how that information will be used, who will have access to it, and for how long it will be retained." Id. Unlike a plaintiff asserting a section 15(a) publication claim, for example, a plaintiff asserting a violation of section 15(b) need not make any special showing to establish standing. The failure to obtain informed consent before collecting an individual's biometric data necessarily inflicts an Article III injury. See id. at 619, 624, 626 (comparing a violation of section 15(b) to "an invasion of [an individual's] private domain, much like an act of trespass").

Section 15(c). Section 15(c) of BIPA prohibits a private entity in possession of biometric data from selling, leasing, trading, or otherwise profiting from that data. 740 ILCS 14/15(c). According to the Seventh Circuit, section 15(c) "flatly prohibits" certain for-profit transactions involving biometric data. Thornley v. Clearview AI, Inc. , 984 F.3d 1241, 1247 (7th Cir. 2021). It does not, for example, allow an entity to avoid liability merely by obtaining the informed consent of the individual whose biometric data it profits from. Contra 740 ILCS 14/15(b) (allowing for informed consent to the collection of biometric data); id. § 14/15(d) (allowing for informed consent to the disclosure of biometric data). In this sense, section 15(c)’s prohibition on for-profit transactions involving biometric data is "the same kind of general regulation as the duty to create and publish a retention and destruction schedule found in section 15(a)." Thornley , 984 F.3d at 1247. Thus, the violation of this requirement does not, by itself, inflict an Article III injury. See id. at 1248. A plaintiff must allege a more concrete and particularized harm in order to establish standing in federal court. See id.

Section 15(d). Section 15(d) of BIPA prohibits a private entity in possession of biometric data from disclosing or disseminating that data except in certain circumstances, such as obtaining a subject's consent. 740 ILCS 14/15(d). The Seventh Circuit has held that the unlawful disclosure of biometric data invades an individual's private domain "just as surely as an unconsented collection or retention does." Cothron , 20 F.4th at 1161. Thus, an unlawful disclosure of an individual's biometric data necessarily inflicts an injury that satisfies Article III. See id.

I. Respondus's Motions to Dismiss

The Patterson, Wu , and Veiga Plaintiffs all allege that Respondus violated sections 15(a) and 15(b) of BIPA. The Patterson and Wu Plaintiffs also allege that Respondus violated sections 15(c) and 15(d). Respondus contends that Plaintiffs have failed to state a claim. Before addressing the parties’ arguments on this score, the court pauses to identify the documents (other than the complaints themselves) that are properly considered on these Rule 12 motions, and to resolve choice-of-law issues.

A. Incorporation-by-Reference Doctrine

In general, a court deciding a Rule 12(b)(6) motion may consider only the plaintiff's complaint. Rosenblum v. Travelbyus.com Ltd. , 299 F.3d 657, 661 (7th Cir. 2002). There are, of course, major exceptions to this rule. First, a "written instrument" attached to a complaint is considered a part of the pleading "for all purposes." FED. R. CIV. P. 10(c) ; see also Williamson v. Curran , 714 F.3d 432, 435–36 (7th Cir. 2013) (noting this circuit's broad view of the term "written instrument"). Second, a document attached to a motion to dismiss may likewise be considered a part of the pleading if it is "referred to in the plaintiff's complaint and ... central to his claim." Wright v. Associated Ins. Cos. Inc. , 29 F.3d 1244, 1248 (7th Cir. 1994) ; see also Brownmark Films, LLC v. Comedy Partners , 682 F.3d 687, 690 (7th Cir. 2012) (referring to this rule as the "incorporation-by-reference doctrine"); Tierney v. Vahle , 304 F.3d 734, 738 (7th Cir. 2002) (tracing the incorporation-by-reference doctrine to Rule 10(c) ). Finally, the court may consider information that is "properly subject to judicial notice." See Williamson , 714 F.3d at 436.

When a defendant attaches documents to its Rule 12(b)(6) motion, as Respondus has done here, the court must make a threshold determination. If the attachments are "central to the complaint and ... referred to in it," the court may consider them in deciding the motion under Rule 12. See id. But if the connection between the attachments and the complaint is more attenuated, the court must "either convert the 12(b)(6) motion into a motion for summary judgment under Rule 56, or exclude the documents attached to the motion to dismiss and continue under Rule 12." Macias v. Bakersfield Rest., LLC , 54 F. Supp. 3d 922, 926–27 (N.D. Ill. 2014) (citing FED. R. CIV. P. 12(d) ). This decision about how to treat the defendant's attachments, and by extension the motion itself, falls within the court's discretion. See Hecker v. Deere & Co. , 556 F.3d 575, 583 (7th Cir. 2009). But a court should not convert the motion into one for summary judgment without first allowing the plaintiff to take discovery and supplement the record. See Wright , 29 F.3d at 1248 ; Travel All Over the World, Inc. v. Kingdom of Saudi Arabia , 73 F.3d 1423, 1430 (7th Cir. 1996). The Seventh Circuit has emphasized that incorporation by reference is a "narrow" exception to normal pleading-stage rules, intended mainly for "cases interpreting, for example, a contract." Levenstein v. Salafsky , 164 F.3d 345, 347 (7th Cir. 1998). The exception is "not intended to grant litigants license to ignore the distinction between motions to dismiss and motions for summary judgment." Id.

As against Respondus, the Patterson and Wu Plaintiffs each attached the same two exhibits to their respective complaints, while the Veiga Plaintiffs attached no documents to their complaint.⁶ Respondus seeks to expand the record in all three cases—attaching two additional documents to its motions to dismiss in Patterson and Wu and four documents to its motion to dismiss in Veiga. The upshot is that the four attachments at issue in Patterson and Wu (two via Plaintiffs; two via Respondus) are essentially the same four attachments that are at issue in Veiga (all four via Respondus). But because the two sets of Plaintiffs pleaded their claims differently, the court must approach the incorporation question separately for each set.

6 Patterson attached a third document to her complaint, but it is relevant only to her claims against Lewis University.

1. Patterson and Wu

The Patterson and Wu Plaintiffs each attached the same two documents to their respective complaints against Respondus: (1) a copy, dated November 2, 2020, of a Respondus webpage containing the "Respondus Monitor—Student Terms of Use" ("Student Terms"), and (2) a copy, also dated November 2, 2020, of a Respondus webpage containing the "Respondus Privacy Policy" ("Privacy Policy"). Respondus then attached two additional documents to its motions to dismiss: (3) a copy, dated June 2, 2021, of a Respondus webpage entitled "Privacy Center Overview" ("Privacy Center"), and (4) a copy, also dated June 2, 2021, of another Respondus webpage entitled "Additional Privacy Information—Respondus Monitor" ("Additional Information page"). Respondus contends that these two additional documents were incorporated into Plaintiffs’ complaints by reference because the Privacy Policy, which Plaintiffs did attach, "links to" the Privacy Center, which in turn "links to" the Additional Information page. (Respondus Mot. (Patterson ) at 10–11; Respondus Mot. (Wu ) at 10–11.)

The court declines to consider Respondus's two additional documents at this stage. To be considered incorporated by reference, a document must be "central to the complaint and ... referred to in it." See Williamson , 714 F.3d at 436. Respondus seems to believe that because Plaintiffs’ BIPA claims relate broadly to "Respondus’ written policies," and Plaintiffs "attached only some of the relevant policies" to their complaints, Respondus has license to supplement the pleadings at its discretion. (Respondus Reply (Patterson ) at 11; Respondus Reply (Wu ) at 11.) That is incorrect. To be incorporated by reference, the documents themselves—not just their general category or theme—must be central to the complaint and referred to in it. Respondus does not attempt to argue that either of its two documents (the Privacy Center or the Additional Information page) is itself central to the complaints, nor could it reasonably make that argument. In setting out their claims, Plaintiffs relied on, referred to, and introduced some documents but not others, just as they, the authors of the complaint, were entitled to do.⁷ Although the broader contents of Respondus's website, including the Privacy Center and the Additional Information page, may be relevant at a later stage of this litigation, "allowing [Respondus] to cherry pick portions of [the] website to introduce via a motion to dismiss simply because the complaint implicates [that website] would convert an examination of the complaint into full-blown summary judgment analysis." See Facebook, Inc. v. Teachbook.com LLC , 819 F. Supp. 2d 764, 773 (N.D. Ill. 2011).

7 The complaints describe the Student Terms as the "terms of use that students must accept before using Respondus Monitor" to take an exam. (Compl. (Patterson ) ¶ 47; see also Compl. (Wu ) ¶¶ 35, 43.) The complaints describe the Privacy Policy as a Respondus-maintained webpage that is incorporated by reference into the Student Terms. (Compl. (Patterson ) ¶¶ 69, 75; Compl. (Wu ) ¶¶ 66, 73.)

The court also notes that the face of Respondus's two documents suggests that they were generated on June 2, 2021—in other words, well after these lawsuits began. Considering the substance of the documents would effectively allow Respondus to amend its opponent's pleading using documents that Respondus itself could have modified after the pleading was filed. That would be unacceptable.⁸ Furthermore, it goes without saying that corporate websites can change over time, often in ways not made clear on the face of the pages themselves. Because Plaintiffs’ BIPA claims cover several years, this case may involve factual questions about what Respondus's policies looked like at different moments in time. There is no basis for preempting that fact-intensive inquiry by concluding, as a matter of law, that these specific versions of Respondus's webpages govern Plaintiffs’ claims.

8 The court recognizes the likelihood that June 2, 2021, is simply the date on which Respondus's attorneys, while preparing its motions to dismiss, exported the underlying webpages from Respondus's website to PDF files. There is no specific reason to believe that Respondus did, in fact, create or revise these documents on or near June 2, 2021. But the documents contain no other indication of the date on which they were created or last revised, and the court must accept them at face value. On their face, the documents post-date the filing of the complaints.

In deciding Respondus's motions to dismiss the Patterson and Wu complaints under Rule 12, the court will consider only the two documents attached to Plaintiffs’ complaints: the Student Terms and the Privacy Policy. (See "Respondus Monitor—Student Terms of Use," Ex. A to Compl. (Patterson ), No. 20 C 7692 [12-1] (hereinafter "Student Terms"); "Respondus Monitor—Student Terms of Use," Ex. A to Compl. (Wu ), No. 21 C 1785 [1-1] (same); "Respondus Privacy Policy," Ex. B to Compl. (Patterson ), No. 20 C 7692 [12-2] (hereinafter "Privacy Policy"); "Respondus Privacy Policy," Ex. B to Compl. (Wu ), No. 21 C 1785 [1-2] (same).)

2. Veiga

The Veiga Plaintiffs attached no documents to their complaint, but Respondus attached the following documents to its motion to dismiss: (1) an archived copy, dated January 16, 2021, of the Student Terms, (2) an undated copy of the Privacy Policy,⁹ (3) a copy, dated June 2, 2021, of the Privacy Center, and (4) a copy, also dated June 2, 2021, of the Additional Information page.¹⁰ In other words, Respondus wants the court to consider, in the context of the Veiga case, (1) the same two documents that the Patterson and Wu Plaintiffs attached to their own complaints, plus (2) the same two documents that Respondus itself (unsuccessfully) introduced in its motions to dismiss the Patterson and Wu complaints. The court now discusses these four documents in the context of the Veiga complaint.

9 The footer of this document is marked "Privacy 092820." In theory, that numeric string could refer to a date, such as September 28, 2020, but Respondus has provided no explanation.

10 A note about the dates: For both the third and fourth documents, Respondus claims that it has submitted the versions that were available on Respondus's website as of March 24, 2021, which is the "last accessed" date identified in the Veiga complaint. (Respondus Mot. (Veiga ) at 3 n.11; Compl. (Veiga ) ¶¶ 21 n.6, 22 n.17, 30 n.14.) The court notes, however, that the two documents submitted by Respondus are visibly dated "6/2/2021" (just two days before Respondus filed its motion to dismiss). Nothing on the face of these documents shows that they date to March 24, 2021.

Respondus contends that the Veiga complaint incorporates the Student Terms by reference because it "explicitly references" the Student Terms, "quotes selected portions" of the Student Terms, and "cites the web address" where the Student Terms are available. (Respondus Mot. (Veiga ) at 4.) The court disagrees that these citations amount to incorporation by reference. Although the Veiga complaint does briefly refer to the Student Terms, it does so mainly to support an allegation that Respondus recently removed uses of the word "biometric" on its website. (Compl. (Veiga ) ¶¶ 23–24 & nn.9–10; see also Pl. Resp. (Veiga ) at 1 n.1.) That issue is far from "central" to Plaintiff's complaint. See Williamson , 714 F.3d at 436. Because Plaintiffs’ BIPA claims do not rely significantly on the Student Terms—much less a particular version of it—it would be inappropriate to consider that document on this motion. And because Respondus's sole argument in favor of considering the Privacy Policy is that it is incorporated by reference into the Student Terms, the court likewise declines to consider the Privacy Policy.

Respondus argues that the third and fourth documents—the Privacy Center and the Additional Information page—should be deemed incorporated into the complaint because they, like the Student Terms, are either referred to or quoted from in it. (Respondus Mot. (Veiga ) at 11 n.3.) Again, the court disagrees. For one thing, the Veiga Plaintiffs do not quote directly from the Privacy Center. They appear to mention the Privacy Center by name only to note that, on Respondus's website, the Additional Information page resides within the so-called Privacy Center. (See Compl. (Veiga ) ¶¶ 21–22 & nn. 5–7.) The court rejects the notion that by providing such context, Plaintiffs incorporated the Privacy Center page itself. Second, although the complaint quotes directly from the Additional Information page (see id. ), this page is insufficiently central to the complaint to be deemed incorporated. See Williamson , 714 F.3d at 436. It is particularly crucial to apply the incorporation-by-reference doctrine cautiously when dealing with webpages. The Additional Information page has no reliable date-related information other than the date on which the PDF was generated, and the content itself has quite possibly been subject to change during the years relevant to Plaintiffs’ claims (and even since the litigation began). The court is unwilling to wade into these potential evidentiary disputes at this stage. In deciding Respondus's motions to dismiss the Veiga complaint under Rule 12, the court will consider no exhibits.

B. Choice of Law

Another preliminary issue is which state's substantive laws apply to Plaintiffs’ claims against Respondus. A federal court exercising diversity jurisdiction applies the choice-of-law rules of the state in which it sits—here, Illinois. See Heiman v. Bimbo Foods Bakeries Distrib. Co. , 902 F.3d 715, 718 (7th Cir. 2018) (citing Klaxon Co. v. Stentor Elec. Mfg. Co. , 313 U.S. 487, 496, 61 S.Ct. 1020, 85 L.Ed. 1477 (1941) ). Under Illinois choice-of-law rules, this state's laws presumptively apply to a dispute unless there is an actual conflict with another state's laws or the parties agree that forum-state law does not apply. See Sosa v. Onfido, Inc. , 8 F.4th 631, 637 (7th Cir. 2021). Respondus contends that the parties have entered such an agreement. It points to a choice-of-law provision contained in the Student Terms, which states that Washington law, not Illinois law, applies to disputes related to the use of Respondus Monitor.¹¹ (Respondus Mot. (Patterson ) at 4–10; Respondus Mot. (Wu ) at 5–10; Respondus Mot. (Veiga ) at 4–10.) Because BIPA is an Illinois statute, applying Washington law would likely foreclose every one of Plaintiffs’ claims against Respondus.

11 The choice-of-law provision reads as follows: "All legal issues arising from or related to the use of Respondus Monitor between you and Respondus shall be construed in accordance with the laws of the State of Washington, without regard to conflicts of law principles." (See Student Terms at 5.)

As explained above, the court has determined that it will consider the Student Terms in deciding the Patterson and Wu motions but not the Veiga motion. That difference affects how the court analyzes Respondus's choice-of-law argument in each case.

1. Veiga

Because Respondus's choice-of-law argument relies on a document that the court will not consider in deciding this motion, the court rejects the argument. It will apply Illinois law in the Veiga case.

In any event, the court finds Respondus's choice-of-law argument meritless. To prevail on the argument, Respondus would first have to show that the Veiga Plaintiffs assented to the Student Terms as a matter of contract law.¹² But the Veiga complaint (unlike the Patterson and Wu complaints) contains no factual allegations from which to reasonably conclude that Plaintiffs knew of, much less assented to, the Student Terms. To the contrary, the Veiga Plaintiffs allege that they "were never provided with any disclosures regarding the collection of their biometric information." (Pl. Resp. (Veiga ) at 11 (citing Compl. (Veiga ) ¶¶ 33–36).)

12 In Illinois, the basic elements of an enforceable contract are "an offer, acceptance, consideration, and mutual assent." Nat'l Prod. Workers Union Ins. Tr. v. Cigna Corp. , 665 F.3d 897, 901 (7th Cir. 2011). Transporting these traditional principles of contract law to web-based environments often requires a "fact-intensive inquiry." Sgouros v. TransUnion Corp. , 817 F.3d 1029, 1034–35 (7th Cir. 2016) ; see also, e.g. , Wilson v. Redbox Automated Retail, LLC , 448 F. Supp. 3d 873, 882 (N.D. Ill. 2020).

Even if the court were willing to consider its contents, the Student Terms document attached by Respondus does not undermine that allegation. First, it is an archived copy dated January 16, 2021. Although that is before the date the Veiga Plaintiffs filed their complaint, it is after Plaintiffs allege that they used Respondus Monitor (and therefore after they would have agreed to any terms governing that use). (See Compl. (Veiga ) ¶ 37 (defining the proposed class as comprising individuals who used Respondus Monitor between 2016 and 2020).) Thus, the Veiga Plaintiffs cannot possibly have agreed to this version of the Student Terms before they used Respondus Monitor. Second, the version of the Student Terms submitted by Respondus contains a series of important caveats:

A copy of the Respondus Monitor Terms of Use for Students is shown below for reference. Please note, terms may vary by region. Certain institutions may also use customized versions of these terms. Students should review the terms that appear each time they start an exam as those are the exact terms they must agree to at their institution in order to use Respondus Monitor.

(Ex. A to Respondus Mot. (Veiga ) [16] at 1.) In other words, this document is not a contract at all, much less one for which there is any evidence of Plaintiffs’ agreement.

The court will apply Illinois law to the Veiga case.

2. Patterson and Wu

Because the Patterson and Wu Plaintiffs attached a version of the Student Terms to their pleadings, the court will consider this document in deciding Respondus's motions to dismiss these complaints and, specifically, in resolving the choice-of-law issue.

Illinois courts typically enforce a contractual choice-of-law provision unless (1) doing so would violate fundamental Illinois public policy, and (2) Illinois has a materially greater interest in the litigation than the other state. Smurfit Newsprint Corp. v. Se. Paper Mfg. , 368 F.3d 944, 949 (7th Cir. 2004) (citing English Co. v. Nw. Envirocon, Inc. , 278 Ill. App. 3d 406, 411, 663 N.E.2d 448, 452, 215 Ill.Dec. 437 (2nd Dist. 1996) ). That framing of the rule, however, presupposes a valid, enforceable contract. A court may also decline to enforce a contractual choice-of-law provision "if the contract's legality is fairly in doubt, for example, if the contract is unconscionable, or if there is some other issue as to the validity of the very formation of the contract." Life Plans, Inc. v. Sec. Life of Denver Ins. Co. , 800 F.3d 343, 357 (7th Cir. 2015).¹³ The Patterson and Wu Plaintiffs pursue both theories, arguing that (1) the contract is unenforceable because it is unconscionable, and (2) even if the contract is enforceable, applying Washington law would contravene Illinois public policy and subvert its interest in the litigation. Both objections appear to have merit.

13 In some cases where a party wants a contractual choice-of-law provision to govern a claim that is not contractual in nature (such as a statutory tort), the court must first determine whether the claim fits within the scope of the choice-of-law provision. See, e.g. , Vendavo, Inc. v. Long , 397 F. Supp. 3d 1115, 1127 (N.D. Ill. 2019) (describing Illinois courts’ two-part test used to determine whether a contract's choice-of-law provision applies to a "related tort claim"); see also FDIC v. Citizens Bank & Tr. Co. of Park Ridge , 592 F.2d 364, 369 (7th Cir. 1979) ("Liability for breach of a duty imposed by statute ... and not by contract is in tort."). Here, the court will not closely examine the scope of the Student Terms’ choice-of-law provision, as the parties appear to agree that it encompasses Plaintiffs’ BIPA claims.

a. Unconscionability

The Patterson and Wu Plaintiffs argue that the Student Terms, including the choice-of-law provision, are unenforceable because they are unconscionable.¹⁴ (See Pl. Resp. to Respondus (Patterson ) at 3–5; Pl. Resp. (Wu ) at 3–5.) Both parties cite Illinois cases on the issue of unconscionability, and Respondus asserts that the differences between Washington and Illinois law are immaterial. (Respondus Reply (Patterson ) at 1 n.1; Respondus Reply (Wu ) at 1 n.1.) The court will therefore apply Illinois law. Thornton v. M7 Aerospace LP , 796 F.3d 757, 770 n.6 (7th Cir. 2015) ("Where the parties have not identified a conflict between the two bodies of state law that might apply to their dispute, we apply the law of the forum state ...."); see also Wood v. Mid-Valley Inc. , 942 F.2d 425, 427 (7th Cir. 1991) ("Courts do not worry about conflict of laws unless the parties disagree on which state's law applies. We are busy enough without creating issues that are unlikely to affect the outcome of the case ....").

14 The Patterson and Wu Plaintiffs do not dispute the basic proposition that they objectively manifested their assent to the Student Terms. Nor could they reasonably dispute that point given the allegations they made. (See, e.g. , Compl. (Patterson ) ¶ 50; Compl. (Wu ) ¶ 46.)

Under Illinois law, "unconscionability analysis asks whether the agreement, by its formation or by its terms, is so unfair that the court cannot enforce it consistent with the interests of justice." Phoenix Ins. Co. v. Rosen , 242 Ill. 2d 48, 60, 350 Ill.Dec. 847, 949 N.E.2d 639, 648 (2011). A contractual provision may be unconscionable on either procedural or substantive grounds, or a combination of both. Razor v. Hyundai Motor Am. , 222 Ill. 2d 75, 99, 305 Ill.Dec. 15, 854 N.E.2d 607, 622 (2006). Whether a contractual clause is unconscionable is a question of law. Id.

Substantive unconscionability "concerns the actual terms of the contract and examines the relative fairness of the obligations assumed." Kinkel v. Cingular Wireless LLC , 223 Ill. 2d 1, 28, 306 Ill.Dec. 157, 857 N.E.2d 250, 267 (2006) (quoting Maxwell v. Fid. Fin. Servs., Inc. , 184 Ariz. 82, 89, 907 P.2d 51, 58 (1995) ). The factors considered include "contract terms so one-sided as to oppress or unfairly surprise an innocent party, an overall imbalance in the obligations and rights imposed by the bargain, and significant cost-price disparity." Id. (quoting Maxwell , 184 Ariz. at 89, 907 P.2d at 58 ). Here, Plaintiffs’ sole argument that the Student Terms are substantively unconscionable is that enforcing the Washington choice-of-law provision would doom their BIPA claims or any analogous private right of action. (See Pl. Resp. to Respondus (Patterson ) at 5; Pl. Resp. (Wu ) at 5.) As Respondus points out, this is merely a variation on Plaintiffs’ argument that the choice-of-law provision should not be enforced because it would violate Illinois public policy. (Respondus Reply (Patterson ) at 5–6; Respondus Reply (Wu ) at 5–6 (same).) The court discusses that narrower argument below. Plaintiffs have not made a case for their broader contention that the foreclosing of their BIPA claims by itself renders the Student Terms themselves so inordinately one-sided or oppressive as to be unconscionable. The court rejects the substantive-unconscionability argument.

Plaintiffs’ charge of procedural unconscionability is far more compelling. "Procedural unconscionability refers to a situation where a term is so difficult to find, read, or understand that the plaintiff cannot fairly be said to have been aware he was agreeing to it, and also takes into account a lack of bargaining power." Razor , 222 Ill. 2d at 100, 305 Ill.Dec. 15, 854 N.E.2d at 622. Procedural unconscionability usually involves "some impropriety during the process of forming the contract depriving a party of a meaningful choice." Kinkel , 223 Ill. 2d at 23, 306 Ill.Dec. 157, 857 N.E.2d at 264 (quoting Frank's Maint. & Eng'g, Inc. v. C.A. Roberts Co. , 86 Ill. App. 3d 980, 989, 42 Ill.Dec. 25, 408 N.E.2d 403, 410 (1st Dist. 1980) ). Relevant factors include "whether each party had the opportunity to understand the terms of the contract, whether important terms were ‘hidden in a maze of fine print,’ and all of the circumstances surrounding the formation of the contract." Phoenix , 242 Ill. 2d at 60, 350 Ill.Dec. 847, 949 N.E.2d at 647 (quoting Kinkel , 223 Ill. 2d at 23, 306 Ill.Dec. 157, 857 N.E.2d at 265 ).

The Patterson and Wu Plaintiffs note correctly that the Student Terms appear to be a quintessential contact of adhesion: "a contract submitted by one party to another on a take-it-or-leave-it basis, without any opportunity to negotiate its terms." Ironbeam, Inc. v. Evert , 417 F. Supp. 3d 1031, 1037 (N.D. Ill. 2019) (internal quotation marks omitted). Respondus also notes correctly, however, that contracts of adhesion are not per se unconscionable. See Kinkel , 223 Ill. 2d at 26, 306 Ill.Dec. 157, 857 N.E.2d at 266. As the Illinois Supreme Court has recognized, contracts of adhesion are a "fact of modern life," which "[c]onsumers routinely sign ... to obtain credit cards, rental cars, land and cellular telephone service, home furnishings and appliances, loans, and other products and services." Id. "It cannot reasonably be said that all such contracts are so procedurally unconscionable as to be unenforceable." Id.

In determining whether a contract of adhesion is procedurally unconscionable, Illinois law counsels a holistic view of the circumstances under which the contract was entered. See Phoenix , 242 Ill. 2d at 60, 350 Ill.Dec. 847, 949 N.E.2d at 647. The court finds, on this record, that the context in which Plaintiffs agreed to the Student Terms did not allow for a "meaningful choice" about entering the contract. See Kinkel , 223 Ill. 2d at 23, 306 Ill.Dec. 157, 857 N.E.2d at 264 (quoting Frank's Maint. , 86 Ill. App. 3d at 989, 42 Ill.Dec. 25, 408 N.E.2d at 410 ). Unlike with a routine consumer contract, in which a consumer might select a vendor from among several options, Plaintiffs here had "no choice but to use Respondus Monitor if their educational institutions selected Respondus Monitor as the automatic proctoring solution for courses in which they are enrolled." (Compl. (Patterson ) ¶ 4; Compl. (Wu ) ¶ 4.) If Plaintiffs’ school chose Respondus, then in order to take an exam, they "had to use Respondus Monitor, and thus had to accept the Monitor Student Terms." (Pl. Resp. to Respondus (Patterson ) at 4; Pl. Resp. (Wu ) at 4; see also Compl. (Patterson ) ¶¶ 49–50; Compl. (Wu ) ¶¶ 45–46.) Plaintiffs did not "choose" to use Respondus Monitor in any meaningful sense—a fact that sharply distinguishes the cases cited by Respondus in which courts upheld contracts of adhesion based on the principle of consumer choice. See, e.g. , Ironbeam , 417 F. Supp. 3d at 1038 ("Although the Agreement was a form contract, with Evert lacking the opportunity to negotiate its terms, Evert still freely chose to open his account with Ironbeam through Deep Discount from among a number of other brokers offering similar services."); Larned v. First Chi. Corp. , 264 Ill. App. 3d 697, 700, 636 N.E.2d 1004, 1006, 201 Ill.Dec. 572 (1st Dist. 1994) ("[T]he Visa card agreement is not an adhesion contract since Larned freely chose to obtain this Visa card from among a number of other credit cards offering similar benefits."). It takes no stretch of the imagination to see how the threat of academic penalty would constrain a student's sense of choice about entering a contract with the one company that their school has selected to help administer an exam.

The court also finds that Plaintiffs’ "opportunity to understand" the Student Terms was significantly reduced by the circumstances in which the contract was presented to them. See Phoenix , 242 Ill. 2d at 60, 350 Ill.Dec. 847, 949 N.E.2d at 647. The complaints allege that to take an exam, a student logged into their school's learning management system and "open[ed] the LockDown Browser," a program that "locks down a testing environment" by limiting a computer's functionality. (Compl. (Patterson ) ¶¶ 38, 49–50; Compl. (Wu ) ¶¶ 33, 45–46.) Only after doing so was a student presented with the Student Terms and required to accept the contract as a "condition of proceeding with the exam." (Compl. (Patterson ) ¶ 50; Compl. (Wu ) ¶ 46.) The Student Terms contain well over 40 paragraphs of text, many of them quite long. (See Student Terms.) The provision that Respondus now seeks to enforce—which is the second of two choice-of-law provisions in the contract—sits more than 30 paragraphs into the document under a heading labeled " MISCELLANEOUS ." (Id. at 5.) The court finds that, under the circumstances in which the Student Terms are alleged to be presented, this provision was "so difficult to find, read, or understand that the plaintiff cannot fairly be said to have been aware he was agreeing to it." Razor , 222 Ill. 2d at 100, 305 Ill.Dec. 15, 854 N.E.2d at 622. Given these procedural defects, the court declines to enforce the choice-of-law provision.

b. Illinois Public Policy

The court also finds, separately, that enforcing the choice-of-law provision would violate Illinois public policy.

"When exercising diversity jurisdiction, a federal court must follow the choice of law rules adopted by the State in which it sits, including rules about whether stipulations as to choice of law are binding." Flextronics Int'l USA, Inc. v. Sparkling Drink Sys. Innovation Ctr. Ltd. , 186 F. Supp. 3d 852, 861 (N.D. Ill. 2016). Even where parties have entered an enforceable contract, Illinois courts do not enforce choice-of-law provisions if (1) doing so would violate fundamental Illinois public policy, and (2) Illinois has a materially greater interest in the litigation than the other state. Smurfit Newsprint , 368 F.3d at 949 (citing English Co. , 278 Ill. App. 3d at 411, 215 Ill.Dec. 437, 663 N.E.2d at 452 ). The state's public policy may be gleaned from its constitution, statutes, and case law. Morris B. Chapman & Assocs., Ltd. v. Kitzman , 193 Ill. 2d 560, 569, 251 Ill.Dec. 141, 739 N.E.2d 1263, 1270 (2000). When comparing two state's laws, "the public policy considerations must be strong and of a fundamental nature to justify overriding the chosen law of the parties." Potomac Leasing Co. v. Chuck's Pub, Inc. , 156 Ill. App. 3d 755, 759, 109 Ill.Dec. 90, 509 N.E.2d 751, 754 (2nd Dist. 1987) ; Demitropoulos v. Bank One Milwaukee, N.A. , 915 F. Supp. 1399, 1413 (N.D. Ill. 1996) (noting that the "mere fact that state laws may differ" is not sufficient).

In enacting BIPA in 2008, the Illinois General Assembly codified the principle that "individuals possess a right to privacy in and control over their biometric identifiers and biometric information." Rosenbach , 2019 IL 123186, ¶ 33, 432 Ill.Dec. 654, 129 N.E.3d at 1206. Recognizing the risks that arise from biologically unique identifying information, see, e.g. , 740 ILCS 14/5(c), the legislature implemented several statutory requirements to safeguard individual rights with respect to "the collection, use, safeguarding, handling, storage, retention, and destruction" of biometric data. Id. § 14/5(g) ; see also id. § 14/5(d) (announcing that an "overwhelming majority" of the public was "weary [sic] of the use of biometrics"). Most importantly here, the legislature created a private right of action to vindicate these individual rights. Id. § 14/20. Given these distinct features and clear language, the court concludes that BIPA reflects a fundamental Illinois public policy of protecting individual privacy rights in biometric information. See In re Facebook Biometric Info. Privacy Litig. , 185 F. Supp. 3d 1155, 1169–70 (N.D. Cal. 2016) (holding similarly). Plaintiffs contend that applying Washington law would contravene this fundamental Illinois public policy because Washington law provides no cause of action comparable to BIPA. Although Washington does have a biometric-privacy statute, see WASH. REV. CODE ANN . §§ 19.375.010 –.900, it is enforceable only by the state's attorney general, not by individuals, see id. § 19.375.030(2). Enforcing the Washington choice-of-law provision would thus thwart Plaintiffs’ individual right to assert biometric-privacy claims. Respondus counters this argument by citing a slew of cases in which Illinois courts have, in its view, enforced choice-of-law provisions "even when a foreign state's law precludes plaintiffs from pursuing Illinois-specific claims or defenses." (See Respondus Mot. (Patterson ) at 7–8; Respondus Mot. (Wu ) at 7–8.) But the court finds none of those cases especially persuasive, much less controlling.

In WTM, Inc. v. Henneck , for example, the plaintiffs, who filed suit in Illinois, sought to apply Minnesota law despite an Illinois choice-of-law provision contained in their contract with the defendants. 125 F. Supp. 2d 864, 867–68 (N.D. Ill. 2000). Applying Illinois choice-of-law rules, the court concluded that enforcing "the choice-of-law provision, [and] choosing Illinois law, is not contrary to the public policy of Illinois." Id. That situation is the factual inverse of this one. Here, enforcing the choice-of-law provision would preclude , rather than require, the application of Illinois law, which is a much different outcome for the purpose of assessing this state's public-policy concerns. In three other district court cases that Respondus cites, courts enforced choice-of-law provisions that foreclosed the plaintiffs’ Illinois statutory claims, but, in doing so, the courts did not discuss Illinois’ public-policy considerations in any depth, nor did they explain whether comparable protections existed under foreign law. See M. Block & Sons, Inc. v. Int'l Bus. Machs. Corp. , No. 04 C 340, 2004 WL 1557631, at *7 (N.D. Ill. July 8, 2004) ; Telular Corp. v. Mentor Graphics Corp. , 282 F. Supp. 2d 869, 871 (N.D. Ill. 2003) ; Midway Home Ent., Inc. v. Atwood Richards, Inc. , No. 98 C 2128, 1998 WL 774123, at *2–3 (N.D. Ill. Oct. 29, 1998). In still other cases, where the courts did discuss foreign-law protections, they determined that those protections differed in degree, rather than in kind, from the protections afforded under Illinois law. See Demitropoulos , 915 F. Supp. at 1414 ; Janice Doty Unlimited, Inc. v. Stoecker , 697 F. Supp. 1016, 1019–20 (N.D. Ill. 1988) ; Mell v. Goodbody & Co. , 10 Ill. App. 3d 809, 813, 295 N.E.2d 97, 100 (1st Dist. 1973).

In the last case that Respondus cites, Potomac Leasing , an Illinois court enforced a Michigan choice-of-law provision even though doing so would deprive the defendants of an affirmative defense that they sought to plead under an Illinois statute. See 156 Ill. App. 3d at 759, 109 Ill.Dec. 90, 509 N.E.2d at 754. That decision provides minimal guidance here. For one thing, the statute in question concerned a narrow, technical matter that did not appear to implicate any fundamental Illinois public policy. See id. at 756–57, 109 Ill.Dec. 90, 509 N.E.2d at 753. In fact, because the parties were business entities that had dealt with each other at arms’ length, the court determined that the "freedom to contract" was the key public policy at issue. See id. at 759, 109 Ill.Dec. 90, 509 N.E.2d at 754. Finally, the decision to apply Michigan law merely foreclosed a single affirmative defense; it did not frustrate the defendant's remaining argument that it had not actually defaulted on the lease agreement in dispute. See id. at 756–57, 109 Ill.Dec. 90, 509 N.E.2d at 753.

Because applying Washington law would leave Plaintiffs without recourse under BIPA or any analogous right of action, it would undermine the fundamental Illinois public policy of protecting individual privacy rights over biometric data. See In re Facebook , 185 F. Supp. 3d at 1169 (holding that it "would be contrary to [Illinois] policy in the starkest way possible" to enforce a contractual choice-of-law provision that would foreclose the plaintiffs’ BIPA claims); cf. Brown & Brown, Inc. v. Mudron , 379 Ill. App. 3d 724, 727–28, 320 Ill.Dec. 293, 887 N.E.2d 437, 440 (3rd Dist. 2008) (declining to enforce a Florida choice-of-law provision because Florida law prohibited a court from considering whether a restrictive covenant caused hardship to an individual employee, while "as a matter of fundamental public policy, Illinois has chosen to provide its workers greater protection from the negative effects of restrictive covenants"); Maher & Assocs., Inc. v. Quality Cabinets , 267 Ill. App. 3d 69, 75–77, 203 Ill.Dec. 850, 640 N.E.2d 1000, 1005–06 (2nd Dist. 1994) (declining to enforce a Texas choice-of-law provision because Texas had no statute equivalent to the Illinois Sales Act, which "constitutes the legislature's pronouncement that protecting sales representatives is fundamental public policy in Illinois").

Relatedly, the court also recognizes that Illinois has a materially greater interest in this litigation than Washington does. Respondus argues that although Washington law offers no counterpart to BIPA, it "has a countervailing interest since Respondus is a Washington corporation and maintains its principal place of business in Washington." (Respondus Mot. (Patterson ) at 9; Respondus Mot. (Wu ) at 10.) Taken alone, the mere fact of corporate domicile is not compelling. See English Co. , 278 Ill. App. 3d at 411, 215 Ill.Dec. 437, 663 N.E.2d at 452 (holding that Illinois had a materially greater interest in litigation where the "[t]he interests of the State of Washington rest solely on [defendant's] status as a Washington corporation"). Because Illinois has enacted BIPA, and Washington is connected to this dispute only by virtue of the Defendant's domicile, Illinois has a materially greater interest in the litigation. The court therefore declines to enforce the choice-of-law provision. See Smurfit Newsprint , 368 F.3d at 949.

C. Failure to State a Claim Under BIPA

Having determined which documents are properly considered on Respondus's Rule 12 motions and concluded that Illinois law applies in all three cases, the court turns to Respondus's arguments that Plaintiffs have failed to state a claim under BIPA. Again, however, the court is mindful that standing is a key component of federal court jurisdiction, Bazile , 983 F.3d at 278, and a court must always "satisfy [itself] that jurisdiction is secure," Carroll v. Stryker Corp. , 658 F.3d 675, 680 (7th Cir. 2011). As explained above, a plaintiff must establish that it has standing for each claim it asserts. DaimlerChrysler , 547 U.S. at 353, 126 S.Ct. 1854. Distinctions between Plaintiffs’ various BIPA claims prove critical in these cases.

1. Section 15(a) and Standing

The Patterson, Wu , and Veiga Plaintiffs all claim that Respondus violated section 15(a) of BIPA, which requires a private entity in possession of biometric data to develop, publicly disclose, and comply with a retention schedule and guidelines for destroying the data within specified time limits. See 740 ILCS 14/15(a). Plaintiffs Patterson and Wu allege that Respondus "does not have a written policy made available to the public establishing a retention schedule and guidelines for permanently destroying" biometric data, particularly scans of facial geometry. (Compl. (Patterson ) ¶ 122; Compl. (Wu ) ¶ 120.) The Veiga Plaintiffs claim, somewhat similarly, that Respondus "did not provide to Plaintiffs and putative Class Members a publicly available retention schedule or guidelines for permanently destroying" such biometric data. (Compl. (Veiga ) ¶ 54.) In its motions to dismiss, Respondus says that "the documents that Plaintiffs incorporate by reference in their Complaint[s] demonstrate that Respondus did have a publicly available retention and destruction policy in effect during the timeframe alleged in" each complaint.¹⁵ (Respondus Mot. (Patterson ) at 12; Respondus Mot. (Wu ) at 12; Respondus Mot. (Veiga ) at 11.)

15 Respondus's argument that Plaintiffs have failed to state a claim under section 15(a) relies on both the Student Terms and the Additional Information page. In Patterson and Wu , only the Student Terms exhibit is properly considered on this Rule 12 motion. In Veiga , neither exhibit is properly considered. This distinction proves immaterial, however, because Plaintiffs lack standing either way.

In briefing these motions, the parties did not discuss standing, but Respondus touched on the topic in its removal papers for the Patterson and Veiga cases. (See Notice of Removal (Patterson ) at 2 & n.1; Notice of Removal (Veiga ) at 2 & n.1.) As is typical for a defendant initiating removal, Respondus argued that federal jurisdiction is secure. It observed correctly that a plaintiff ordinarily has Article III standing to assert a claim for the unlawful retention of their biometric data beyond the time limits set by section 15(a). (See Notice of Removal (Patterson ) at 2 (citing Fox , 980 F.3d at 1154–55 ); Notice of Removal (Veiga ) at 2 (same).) In Respondus's view, the Patterson and Veiga Plaintiffs have alleged exactly that kind of retention-based injury. For example, the Patterson complaint notes that the Student Terms did not guarantee the removal of all "traces" of biometric data after the data's deletion. (See Notice of Removal (Patterson ) at 2 n.1 (citing Class Action Compl., Ex. A to Notice of Removal (Patterson ) [1-1] ¶¶ 57–58); see also Compl. (Patterson ) ¶¶ 66–67 (equivalent allegations in operative complaint).)¹⁶ And the Veiga complaint cited a page on Respondus's website explaining that the "default data retention period for Respondus Monitor is five years." (See Notice of Removal (Veiga ) at 2 n.1; see also Compl. (Veiga ) ¶ 22.) According to Respondus, these allegations reflect a claim that Respondus has unlawfully retained Plaintiffs’ biometric data in violation of section 15(a), thereby inflicting a concrete and particularized harm. See Fox , 980 F.3d at 1154–55.

16 Because Plaintiff Wu's case was filed in federal court, not removed from state court, Respondus had no reason to argue in favor of Wu's standing. In fact, it is Wu, as the plaintiff seeking a federal forum, who bears the burden of establishing his own Article III standing. The court nevertheless notes that the Wu complaint is materially the same as the Patterson complaint with respect to Defendant Respondus, so the arguments for and against section 15(a) standing apply equally to these two cases.

The court disagrees. Considering each complaint as a whole, the court finds that none of the Plaintiffs alleges that Respondus failed to comply with a retention-and-destruction policy or that Respondus otherwise retained their biometric data beyond the time limits set by section 15(a). Instead, Plaintiffs merely allege that Respondus's policies, such as the Student Terms and the Privacy Policy, did not meet section 15(a)’s criteria for a publicly-available retention-and-destruction policy. (See, e.g. , Compl. (Patterson ) ¶¶ 65, 77 (alleging that the Student Terms and Privacy Policy do not "establish a retention schedule or guidelines for permanently destroying" biometric data); Compl. (Wu ) ¶¶ 62, 76 (same); Compl. (Veiga ) ¶¶ 8–10 (alleging that Respondus "failed to disclose the retention schedule" that would govern Plaintiffs’ biometric data); id. ¶ 35 (similar).) In short, these cases are like Bryant , not Fox . See Bryant , 958 F.3d at 626 (no standing for a section 15(a) publication claim); Fox , 980 F.3d at 1155 (standing for a section 15(a) compliance claim). The allegations that Respondus has cited certainly could be relevant to a Fox -like compliance claim, if Plaintiffs alleged that Respondus unlawfully retained their biometric data beyond the time limits set by section 15(a). But these Plaintiffs have not made such a claim, and the court declines to recognize standing on the basis of legal theories they might have pursued but did not.

Without allegations of a more concrete and particularized harm, such as the unlawful retention of their biometric data beyond the time limits set by section 15(a), Plaintiffs lack standing to assert these claims in federal court. The court will therefore remand the Patterson and Veiga complaints’ section 15(a) claims against Respondus.¹⁷ It will dismiss without prejudice the Wu complaint's section 15(a) claim against Respondus.

17 Lack of standing is dispositive and requires dismissal or remand, but the court notes that the Veiga Plaintiffs may have failed to state a claim under section 15(a) anyway. Throughout their complaint (and even in their operative claim language, quoted above), they appear to conflate the publication requirements imposed by section 15(a) with the informed-consent requirements imposed by section 15(b). See 740 ILCS 14/15(a) –(b). Section 15(b), not section 15(a), is where BIPA imposes informed-consent requirements for the act of collection.

2. Section 15(b)

The Patterson, Wu , and Veiga Plaintiffs all claim that Respondus violated section 15(b) of BIPA, which requires a private entity that collects or otherwise obtains an individual's biometric data to first obtain the individual's informed, written consent. See 740 ILCS 14/15(b). Plaintiffs claim that Respondus violated section 15(b) because it collected their biometric data, particularly scans of facial geometry, without (1) informing them in writing that it was doing so, (2) informing them in writing of the purpose and length of the term for which it was doing so, or (3) receiving a written release executed by them. (Compl. (Patterson ) ¶¶ 133–35; Compl. (Wu ) ¶¶ 126–28; Compl. (Veiga ) ¶¶ 63–66.) Respondus argues that Plaintiffs have failed to state a claim because, in its view, they have "alleged that Respondus did, in fact, provide all disclosures and obtain all consents allegedly required by BIPA." (Respondus Mot. (Patterson ) at 15; Respondus Mot. (Wu ) at 15; Respondus Mot. (Veiga ) at 14–15.) Here, Respondus relies on both the Student Terms and the Additional Information page. In the Veiga case, however, neither exhibit is properly considered under Rule 12, so the court rejects the argument as to that complaint. In Patterson and Wu , only the Student Terms exhibit is properly considered, so the court will evaluate Respondus's argument in light of the single document.

According to Respondus, the Student Terms adequately "explain the data that Respondus Monitor captures and how that data is used." (Respondus Reply (Patterson ) at 15; Respondus Reply (Wu ) at 15.) The court agrees with Plaintiffs, however, that the language Respondus cites is not clear enough, by itself, to satisfy section 15(b)’s informed-consent requirements. Subsection (b)(1) requires disclosure that "a biometric identifier or biometric information is being collected or stored." 740 ILCS 14/15(b)(1). The Student Terms state that "individual student activity [will] be recorded, both audibly and visually, during certain assessment sessions," and "[o]ther data related to individual student activity during assessment sessions may also be recorded by Respondus Monitor, such as, for example, without limitation, time taken by a student to answer specific inquiries on an assessment, etc." (Student Terms at 2.) In the court's view, such language does not disclose that Respondus would collect "biometric identifiers" or "biometric information" as defined in BIPA. See 740 ILCS 14/10. The court therefore rejects Respondus's argument that the Student Terms satisfy section 15(b), and it concludes that the Patterson and Wu Plaintiffs have stated a claim for a violation of this provision.

3. Section 15(c) and Standing

The Patterson and Wu Plaintiffs (but not the Veiga Plaintiffs) claim that Respondus violated section 15(c) of BIPA, which prohibits a private entity in possession of biometric data from selling, leasing, trading, or otherwise profiting from that data. See 740 ILCS 14/15(c). Specifically, Plaintiffs claim that Respondus profited from their biometric data, namely scans of their facial geometry, "through contracts it has with Institutions for the Respondus Monitor service." (Compl. (Patterson ) ¶ 147; Compl. (Wu ) ¶ 135.) In other words, Plaintiffs do not claim that Respondus sold, leased, or traded their biometric data directly. Rather, they claim that Respondus "otherwise profit[s] from" their biometric data by marketing the Respondus Monitor product—the "essence and purpose" of which is "the collection of, and subsequent access to," that data. (Pl. Resp. to Respondus (Patterson ) at 16 (citing Compl. (Patterson ) ¶¶ 42–47); Pl. Resp. (Wu ) at 16 (citing Compl. (Wu ) ¶ 39).) Respondus believes that Plaintiffs read the statutory language much too broadly. It argues that their expansive reading of "otherwise profit from" creates a "blanket prohibition on profiting from products involving biometrics," which would be contrary to BIPA's plain language and legislative history. (Respondus Mot. (Patterson ) at 15; Respondus Mot. (Wu ) at 16.) In Respondus's view, "otherwise profit from" should carry a meaning that merely "reinforce[s] the prohibition on selling biometric data for profit" but does not "completely prohibit separate acts related to the mere possession of biometrics." (Respondus Mot. (Patterson ) at 16; Respondus Mot. (Wu ) at 16.)

Whatever the merits of these competing statutory interpretations, the court must address the issue of standing once again. Plaintiffs allege no concrete or particularized harm resulting from a violation of section 15(c). They allege only a bare violation of the "general regulation" prohibiting "the operation of a market" in biometric data. Thornley , 984 F.3d at 1247. Without more substantial allegations about how they were personally affected by Respondus's alleged profiting from their biometric data, Plaintiffs have failed to establish standing to maintain their section 15(c) claim in federal court. The court will remand the Patterson complaint's section 15(c) claim against Respondus, and it will dismiss without prejudice the Wu complaint's section 15(c) claim against Respondus.

4. Section 15(d)

The Patterson and Wu Plaintiffs (but not the Veiga Plaintiffs) claim that Respondus violated section 15(d) of BIPA, which prohibits a private entity in possession of biometric data from disclosing or disseminating that data except in certain circumstances, such as obtaining a subject's consent. See 740 ILCS 14/15(d). Specifically, Plaintiffs claim that Respondus violated section 15(d) because it "discloses or disseminates students’ biometric identifiers or biometric information to the student's Institution without the student's consent to the disclosure." (Compl. (Patterson ) ¶ 157; Compl. (Wu ) ¶ 141.) Respondus now argues that Plaintiffs have failed to state a claim. In its view, the policies that were disclosed to Plaintiffs "repeatedly specify that [third-party] institutions have access to the data collected by Respondus Monitor." (Respondus Mot. (Patterson ) at 18; Respondus Mot. (Wu ) at 18.) And because Plaintiffs agreed to the Student Terms, Respondus says, they consented to that disclosure, thereby satisfying section 15(d)(1). (Respondus Mot. (Patterson ) at 18; Respondus Mot. (Wu ) at 18.)

As the court has already discussed, the Additional Information page is not properly considered on this motion. And as the court explained with respect to the Patterson and Wu Plaintiffs’ section 15(b) claims, the Student Terms do not disclose that Respondus collected biometric data. Without receiving notice that their biometric data was being collected (or was otherwise in the possession of Respondus), Plaintiffs could not possibly have consented to the further disclosure of that data to third parties. The court therefore concludes that the Patterson and Wu complaints have stated a claim for a violation of section 15(d).

5. Deriving Biometric Data Through Photographic Means

Finally, Respondus makes a halfhearted argument that Plaintiffs’ allegations do not concern "biometric identifiers" or "biometric information" within the meaning of BIPA. Specifically, Respondus suggests that any information derived through photographic means, such as a video recording, is categorically excluded from BIPA's definitions of "biometric" data. (Respondus Mot. (Patterson ) at 19; Respondus Mot. (Wu ) at 19; Respondus Mot. (Veiga ) at 15.) The apparent implication is that to fall within BIPA's protections, a face scan must be captured in person—not, for example, through a webcam. Respondus cites no case law to support this contention. Indeed, several courts have rejected the theory, and this one will, as well.

BIPA defines a "biometric identifier" as "a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry," and it defines "biometric information" as "any information, regardless of how it is captured, converted, stored, or shared, based on an individual's biometric identifier." See 740 ILCS 14/10. The first definition expressly excludes "photographs," while the second definition expressly excludes "information derived from items or procedures excluded under the definition of biometric identifiers." Id. The statute thus makes clear that a photograph (and perhaps, by extension, a video) is not itself a biometric identifier, and that information "derived from" a photograph is not biometric information. But those exclusions are not implicated here. Plaintiffs in these cases all allege that Respondus Monitor captures scans of students’ facial geometry. (See, e.g. , Compl. (Patterson ) ¶ 87; Compl. (Wu ) ¶ 86; Compl. (Veiga ) ¶ 27.) And the Veiga Plaintiffs also allege that Respondus Monitor captures a voiceprint. (Compl. (Veiga ) ¶ 27.) The fact that these biometric identifiers are captured through photographic means is immaterial. As Judge Chang explained in a thorough discussion of this issue, "[n]othing in the statute says, one way or the other, how the biometric measurements must be obtained (or stored, for that matter) in order to meet the definition of ‘biometric identifier.’ " Rivera v. Google Inc. , 238 F. Supp. 3d 1088, 1095 (N.D. Ill. 2017). The "bottom line" is that "a ‘biometric identifier’ is not the underlying medium itself, or a way of taking measurements, but instead is a set of measurements of a specified physical component (eye, finger, voice, hand, face) used to identify a person." Id. at 1096 ; see also id. at 1092–1100 (lengthy discussion of the text and legislative history); In re Facebook , 185 F. Supp. 3d at 1170–72 ; Norberg v. Shutterfly, Inc. , 152 F. Supp. 3d 1103, 1106 (N.D. Ill. 2015). The court is satisfied that Plaintiffs’ allegations concern biometric data as defined in BIPA. II. Lewis's Motion to Dismiss

Plaintiff Courtnie Patterson alleges that Lewis University ("Lewis") violated sections 15(a), 15(b), 15(c), and 15(d) of BIPA. In this motion, Lewis asks the court to dismiss Patterson's claims because (1) Lewis is exempt from BIPA, (2) Patterson's claims are time barred, and (3) Patterson has failed to state a claim.

A. BIPA's Exemption for "Financial Institutions"

Section 25(c) of BIPA provides that "[n]othing in this Act shall be deemed to apply in any manner to a financial institution or an affiliate of a financial institution that is subject to Title V of the federal Gramm–Leach–Bliley Act of 1999 and the rules promulgated thereunder." 740 ILCS 14/25(c). Lewis contends that it falls within this exemption, foreclosing Patterson's BIPA claims against it.

By way of background, Title V of the Gramm–Leach–Bliley Act ("GLBA"), 15 U.S.C. §§ 6801 – 6809, is a privacy law that regulates how financial institutions handle certain customer information. See 15 U.S.C. § 6801(a) (statement of policy); see also Am. Bar Ass'n v. FTC , 430 F.3d 457, 459 (D.C. Cir. 2005) (background). Under Title V, a "financial institution" is "any institution the business of which is engaging in financial activities," such as "[l]ending, exchanging, transferring, investing for others, or safeguarding money or securities"; "[p]roviding financial, investment, or economic advisory services"; and "[u]nderwriting, dealing in, or making a market in securities." 15 U.S.C. § 6809(3)(A) ; 12 U.S.C. § 1843(k)(4).

The parties disagree, first, about a threshold question of statutory interpretation. Lewis urges that BIPA's section 25(c) incorporates its definition of "financial institution" directly from the GLBA, while Patterson urges that the phrase "financial institution," in section 25(c), should be given its plain meaning. Patterson's plain-meaning construction would potentially doom Lewis's defense right out of the gate. After all, Lewis is a university, not a bank. If the BIPA exemption is limited to entities like banks, as Patterson suggests, then Lewis probably would not qualify. Second, the parties disagree about whether Lewis is "subject to" the GBLA anyway. According to Patterson, even if Lewis is correct that section 25(c) incorporates the GLBA's definition of "financial institution," Lewis does not fall within the federal statute's coverage. Lewis, on the other hand, contends that it satisfies the GLBA's definition of "financial institution" because it is a university that provides student loans and participates in financial-aid programs.

Only a few courts have squarely considered BIPA's financial-institution exemption. Last year, in Doe v. Elmhurst University , an Illinois circuit court adopted the incorporation theory that Lewis now advocates: "The term ‘financial institution’ in Section 14/25(c) of [BIPA] means an entity that is subject to Title V of the [GLBA] and the rules promulgated thereunder ...." Doe v. Elmhurst Univ. , No. 2020 L 1400, slip op. at 1 (Cir. Ct. DuPage Cnty. June 9, 2021). (See No. 20 C 7692 [61-1].) After determining that Elmhurst did qualify as a "financial institution" under the GLBA, the court dismissed the case. Doe v. Elmhurst Univ. , No. 2020 L 1400, slip op. at 1 (Cir. Ct. DuPage Cnty. Nov. 19, 2021). (See No. 20 C 7692 [76-2].) More recently, in Doe v. Northwestern University , a judge in this district approvingly cited Elmhurst ’s holding that the "the plain meaning of ‘financial institution’ in BIPA is the same as in GLBA." Doe v. Northwestern Univ. , No. 21 C 1579, 586 F.Supp.3d 841, 842 (N.D. Ill. Feb. 22, 2022) (Lefkow, J.). (See No. 20 C 7692 [76-1].) Given the brevity of these decisions, the proper construction of section 25(c) may warrant further analysis in the future. The scope of this exemption could have significant effects on the overall reach of BIPA. Nevertheless, the court does not need to wade into this interpretive issue today. Under either party's construction of section 25(c), Lewis must establish that it is, in fact, "subject to Title V of the [GLBA] and the rules promulgated thereunder." 740 ILCS 14/25(c). Lewis has cited a handful of agency statements suggesting that it qualifies, but the court is not confident that those statements remain good law after more recent amendments to the GLBA. The court thus rejects the argument that Lewis is exempt from BIPA.¹⁸

18 The court also notes the possibility that section 25(c) provides an affirmative defense, as it does not bear on the sufficiency of Plaintiff's BIPA claims. See Winforge, Inc. v. Coachmen Indus., Inc. , 691 F.3d 856, 872 (7th Cir. 2012) (noting that a defense may be affirmative in character "if it [does] not controvert the plaintiff's proof" (quoting Brunswick Leasing Corp. v. Wis. Cent., Ltd. , 136 F.3d 521, 530 (7th Cir. 1998) )).
A complaint is not required to "anticipate affirmative defenses to survive a motion to dismiss." United States v. Lewis , 411 F.3d 838, 842 (7th Cir. 2005). On a Rule 12 motion like this one, ordinarily it is inappropriate to dismiss a claim based on an affirmative defense unless "the allegations of the complaint itself set forth everything necessary to satisfy" it. Id. Even if Lewis's argument rested on firmer legal ground, it does not appear that Patterson's complaint, by itself, would provide the facts necessary for Lewis to persuade the court on its GLBA argument. Lewis's brief relies heavily on non-record facts, suggesting that section 25(c) provides an affirmative defense not fit for resolution at this stage. See Brownmark Films , 682 F.3d at 690 (noting that affirmative defenses "typically turn on facts not before the court" at the motion-to-dismiss stage).

The statute itself does not obviously answer the question of whether an institution like Lewis is regulated. Title V of GLBA says that "financial institution" means "any institution the business of which is engaging in financial activities as described in section 1843(k) of title 12." 15 U.S.C. § 6809(3)(A). Section 1843(k), in turn, lists activities such as "[l]ending, exchanging, transferring, investing for others, or safeguarding money or securities"; "providing financial, investment, or economic advisory services"; and "[u]nderwriting, dealing in, or making a market in securities." 12 U.S.C. § 1843(k)(4).

In arguing that it is engaged in such activities, Lewis relies on statements made by the Federal Trade Commission, which, Lewis asserts, "is vested with the regulatory authority for the GLBA." (Lewis Mot. at 4 (citing 15 U.S.C. § 6805(a)(7) ; 15 U.S.C. § 6801(b) ).) Lewis's entire argument assumes that those FTC statements govern the question of whether Lewis is "subject to Title V of the [GLBA] and the rules promulgated thereunder." See 740 ILCS 14/25(c). The court is less certain. First, § 6805, which Lewis cites, grants the FTC enforcement authority under the GLBA. See 15 U.S.C. § 6805. But § 6804, which Lewis does not cite, is where the GLBA grants rulemaking authority. See 15 U.S.C. § 6804. As a general matter, it is unclear whether FTC statements made pursuant to GLBA enforcement authority, rather than GLBA rulemaking authority, would constitute "rules promulgated thereunder" for the purpose of section 25(c).

It turns out that § 6804, the rulemaking provision that Lewis fails to cite, does grant the FTC certain rulemaking authority, but that authority is plainly too narrow to cover an institution like Lewis. See 15 U.S.C. § 6804(a)(1)(C) (granting the FTC rulemaking authority over entities described in 12 U.S.C. § 5519(a) ); 12 U.S.C. § 5519(a) (excluding from another agency's authority any "motor vehicle dealer that is predominantly engaged in the sale and servicing of motor vehicles, the leasing and servicing of motor vehicles, or both"). In other words, the FTC appears to have GLBA rulemaking authority only over certain entities in the motor-vehicle industry—a category that unquestionably does not include Lewis. Recent FTC statements confirm this understanding of the FTC's limited rulemaking authority. The agency explained recently, for instance, that "[i]n 2010, the Dodd–Frank Act transferred a majority of GLBA's privacy rulemaking authority ... to the Consumer Financial Protection Bureau." FTC, Privacy of Consumer Financial Information Under the Gramm–Leach–Bliley Act, 86 Fed. Reg. 70,020, 70,020 (Dec. 9, 2021). The FTC "retained rulemaking authority for certain motor vehicle dealers." Id.

This confusion over the breadth of FTC authority undermines much of Lewis's argument. Lewis's chief piece of evidence that it is subject to GLBA (and therefore exempt from BIPA) is a statement that the FTC issued in 2000, when it published a final rule implementing a portion of Title V: "The Commission disagrees with those commenters who suggested that colleges and universities are not financial institutions. Many, if not all, such institutions appear to be significantly engaged in lending funds to consumers." See FTC, Privacy of Consumer Financial Information, 65 Fed. Reg. 33,646, 33,648 (May 24, 2000) (promulgating 16 C.F.R. pt. 313).¹⁹ But the current version of the same regulations, 16 C.F.R. part 313, confirm that they do not apply to entities like Lewis. See 16 C.F.R. § 313.1 (noting that "[t]his part applies to those ‘financial institutions’ over which the [FTC] has rulemaking authority pursuant to [ 15 U.S.C. § 6804(a)(1)(C) ]"); 15 U.S.C. § 6804(a)(1)(C) (incorporating 12 U.S.C. § 5519(a), which refers only to "motor vehicle dealer[s]" and similar entities).

19 It bears noting that at least one other agency has continued to echo this principle more recently. See Fed. Student Aid Office, U.S. Dep't of Educ., GEN-15-18, Protecting Student Information (July 29, 2015) (stating that "institutions of higher education" must comply with the Title V of the GLBA); Fed. Student Aid Office, U.S. Dep't of Educ., Enforcement of Cybersecurity Requirements Under the Gramm–Leach–Bliley Act (Feb. 28, 2020), https://fsapartners.ed.gov/knowledge-center/library/electronic-announcements/2020-02-28/enforcement-cybersecurity-requirements-under-gramm-leach-bliley-act (similar).
The court recognizes, however, that as the Federal Student Aid Office has no enforcement or rulemaking authority under the GLBA, see 15 U.S.C. §§ 6804 –6805, these statements carry no significant weight.

The court recognizes the complexity of the administrative landscape created by the GLBA, especially as amended by the Dodd–Frank Act. See 15 U.S.C. §§ 6804 – 6805. The GLBA grants several agencies rulemaking or enforcement power, and one or more of those agencies may well have issued regulations or other policy statements that would provide a more decisive answer to the question here—whether Lewis is "subject to Title V of the [GLBA] and the rules promulgated thereunder." 740 ILCS 14/25(c). But the court cannot dismiss the case on the dubious basis that Lewis has presented, and it is unwilling to untangle this web of agency authority without the benefit of further briefing. Based on the information it has been shown, the court rejects Lewis's argument that it is exempt from BIPA under section 25(c).

B. Statute of Limitations

The parties agree that BIPA itself contains no statute of limitations. See 740 ILCS 14/1 et seq. Patterson believes that the court should simply enforce Illinois's five-year catchall statute of limitations, which applies to "all civil actions not otherwise provided for." 735 ILCS 5/13-205. Lewis, on the other hand, asserts that BIPA claims are governed by Illinois's one-year rule for "[a]ctions for slander, libel or for publication of matter violating the right of privacy," 735 ILCS 5/13-201. According to Lewis, the shorter limitations period would bar Patterson's claims.

Although the Illinois Supreme Court has not resolved this question, the First District recently provided an answer in Tims v. Black Horse Carriers, Inc. , 2021 IL App (1st) 200563, 451 Ill.Dec. 879, 184 N.E.3d 466. Tims held that the one-year statute of limitations contained in section 13-201 governs claims brought under sections 15(c) and 15(d) of BIPA, while the five-year statute of limitations contained in section 13-205 governs actions under sections 15(a), 15(b), and 15(e) of the statute. See id. ¶ 33. The Tims court recognized that while BIPA broadly protects an individual's "privacy right of secrecy," id. ¶ 26, there are several different ways in which that right may be violated. The duties created by sections 15(a), 15(b), and 15(e) "have absolutely no element of publication or dissemination," as required by section 13-201. Id. ¶ 31. On the other hand, actions for violations of sections 15(c) (which prohibits for-profit transactions involving biometric data) and 15(d) (which prohibits the unlawful disclosure or dissemination of biometric data) are actions "for publication of matter violating the right of privacy" within the meaning of section 13-201. Id. (quoting 735 ILCS 5/13-201 ).

This court will follow the persuasive reasoning of Tims . See Blood v. VH-1 Music First , 668 F.3d 543, 546 (7th Cir. 2012) (explaining that where the Illinois Supreme Court has not spoken directly on an issue, a federal court applying Illinois law may give "may give ‘proper regard’ " to a lower state court's decision (quoting Comm'r v. Estate of Bosch , 387 U.S. 456, 465, 87 S.Ct. 1776, 18 L.Ed.2d 886 (1967) )). Patterson's claims under sections 15(a) and 15(b) are governed by a five-year statute of limitations, see 735 ILCS 5/13-205, while her claims under sections 15(c) and 15(d) are governed by a one-year statute of limitations, see id. § 201.

Lewis does not argue that any of Patterson's claims would be barred by the five-year statute of limitations, so Patterson's claims under sections 15(a) and 15(b) survive this timeliness challenge. The remaining question is whether Patterson's section 15(c) and 15(d) claims were filed within the one-year time frame that applies to them. Patterson alleges that she "was a student at Lewis between 2015 and 2019" (Compl. (Patterson ) ¶ 98), but she did not file her claims against Lewis until January 22, 2021 (see id. at 26). According to Lewis, that filing date was "more than a year after [Patterson] could have last possibly used the software," which renders her claims untimely. (Lewis Mot. at 11.) In response, Patterson points out that although she alleges that she was enrolled in Lewis only through 2019, she also alleges that "Lewis had the contractual right to continue possessing and sharing Plaintiff's biometric data" after that date. (Pl. Resp. to Lewis (Patterson ) at 15 (citing Compl. (Patterson ) ¶¶ 63–64).) Thus, Patterson says, Lewis could have continued to violate her BIPA rights within the one-year limitations period.

Lewis's argument presupposes that any BIPA claim necessarily accrued when Patterson "used" Respondus Monitor. But that is untrue at least for Patterson's section 15(d) claim. Patterson alleges that Lewis unlawfully disclosed her biometric data to instructors or other agents without her consent. (Compl. (Patterson ) ¶ 160.) While it is true that Lewis initially obtained Patterson's biometric data around the time she used Respondus Monitor, Patterson alleges that Lewis may retain such data for a substantial period of time. (See, e.g. , id. ¶¶ 63–64.) Lewis therefore could have made an unlawful disclosure of Patterson's biometric data long after she stopped being a student in 2019.

Patterson's section 15(c) claim is trickier because the theory of harm is more convoluted. The complaint alleges that Respondus violated section 15(c) because it (1) charged its students tuition and other fees for online coursework, (2) required the use of Respondus Monitor for the completion of that coursework, and (3) obtained students’ biometric data through their use of Respondus Monitor. (See Compl. (Patterson ) ¶¶ 149–51.) Even if Patterson stated a claim for a violation of section 15(c) by Lewis, it is not clear when the violation occurred. The court is mindful, however, that a "plaintiff is not required to plead elements in his or her complaint that overcome affirmative defenses, such as statute-of-limitations defenses." NewSpin Sports, LLC v. Arrow Elecs., Inc. , 910 F.3d 293, 299 (7th Cir. 2018). "The right question is whether it is possible to imagine proof of the critical facts consistent with the allegations actually in the complaint." U.S. Gypsum Co. v. Ind. Gas Co. , 350 F.3d 623, 628 (7th Cir. 2003). For now, the court declines to dismiss any of Patterson's claims for untimeliness, as it is not clear from the complaint that Lewis's alleged violations of sections 15(c) and 15(d) fell outside the one-year period before the complaint was filed.

C. Failure to State a Claim Under BIPA

Having rejected, for now, the argument that Lewis is exempt from BIPA under section 25(c), as well as Lewis's timeliness challenge, the court turns to the merits of Patterson's BIPA claims against Lewis. As explained below, Lewis moves to dismiss the complaint for various reasons. In evaluating Patterson's claims, the court again recognizes its "independent duty to ensure" that this case is properly in federal court. Dexia Crédit Loc. , 602 F.3d at 883.

1. "Possession" of Biometric Data

Lewis argues that all of Patterson's claims fail because she has not alleged that Lewis was "in possession of" her biometric data. By their terms, sections 15(a), 15(c), and 15(d) of BIPA apply to private entities "in possession of" biometric data.²⁰ 740 ILCS 14/15(a), (c) – (d). The statute does not define "possession," so the court "assumes the legislature intended for [the term] to have its popularly understood meaning," or its "settled legal meaning" if one exists. Rosenbach , 2019 IL 123186, ¶ 29, 432 Ill.Dec. 654, 129 N.E.3d at 1205. The Illinois Supreme Court has held that " ‘possession,’ as ordinarily understood, occurs when a person has or takes control of the subject property or holds the property at his or her disposal." People v. Ward , 215 Ill. 2d 317, 325, 294 Ill.Dec. 144, 830 N.E.2d 556, 560 (2005). As this court explained in another case, "[t]he ordinary meaning of possession does not contemplate exclusive control, and nothing in the BIPA indicates that the ordinary definition of possession does not apply." Heard v. Becton, Dickinson & Co. , 440 F. Supp. 3d 960, 968 (N.D. Ill. 2020) (citation omitted) (citing Ward , 215 Ill. 2d at 325, 294 Ill.Dec. 144, 830 N.E.2d at 560 ).

20 Section 15(b), by contrast, does not expressly require "possession"; it applies instead to entities that "collect, capture, purchase, receive through trade, or otherwise obtain" biometric data. 740 ILCS 14/15(b). Lewis nevertheless asserts that Patterson's failure to plead possession dooms her section 15(b) claim. As discussed below in this opinion, numerous decisions have distinguished between possession and collection in the BIPA context—holding that an allegation of mere "possession" is not sufficient for a section 15(b) "collection" claim. See Heard v. Becton, Dickinson & Co. , 440 F. Supp. 3d 960, 965–66 (N.D. Ill. 2020). But the fact that alleging possession is insufficient for establishing collection does not mean that it is required for it. Of course, one could argue that the collection of biometric data necessarily results, at least momentarily, in the possession of that data, but the court declines to read an independent possession element into section 15(b), especially where Lewis has provided no cogent argument for doing so. The court thus rejects Lewis's "possession" argument as to Patterson's section 15(b) claim.

Lewis cites two main cases, but neither clearly supports its position. In Heard , this court granted a Rule 12(b)(6) motion on some of the plaintiff's BIPA claims because "most of [the plaintiff's] allegations concerning possession merely parrot the statutory language" of BIPA. Heard , 440 F. Supp. 3d at 968. The complaint, which alleged in conclusory terms that the defendant "stored" biometric data, failed to explain how the defendant exercised any control over that data, how it held the data at its disposal, whether it could freely access the data, or even how it had received the data in the first place. Id. The complaint in Kloss v. Acuant, Inc. , 462 F. Supp. 3d 873, 877 (N.D. Ill. 2020), was possibly even more barebones, and the court reasonably found that its allegations were "so sketchy that the complaint does not provide the type of notice of the claim to which the defendant is entitled under Rule 8.’ " Id. at 876 (quoting Brooks v. Ross , 578 F.3d 574, 581 (7th Cir. 2009) ).

Patterson alleges far more detailed facts about the circumstances of Lewis's "possession" of her biometric data. According to the complaint, Lewis purchases a license to use the Respondus Monitor tool for remote proctoring. (Compl. (Patterson ) ¶ 36.) When a student takes an exam using Respondus Monitor, the program captures various forms of biometric data, including scans of the student's facial geometry. (See, e.g. , id. ¶¶ 82–87.) The exam-related data captured by Respondus Monitor flows into a review system that is integrated with Lewis's learning management system, providing Lewis's instructors with the ability to view and analyze the data. (Id. ¶¶ 36, 46–47, 70–71.) The Student Terms and the Institution Terms, both of which Patterson attached to her complaint, provide further details about how Lewis has "control" of students’ biometric data or holds such data at its "disposal." See Ward , 215 Ill. 2d at 325, 294 Ill.Dec. 144, 830 N.E.2d at 560. For example, the Student Terms provide that exam recordings (and, allegedly, related biometric data) will be "controlled by your institution" and may be "evaluated" by its agents. (Compl. (Patterson ) ¶¶ 53–60 (quoting Student Terms).) And the Institution Terms provide that, although Respondus itself retains data for one year by default, institutions like Lewis may elect to retain the data (including, allegedly, related biometric data) for up to an additional four years. (Id. ¶¶ 93–94 (quoting Ex. C to Compl. (Patterson ) [12-3]).) Similarly, the Institution Terms, which place limits on how Respondus may share certain student data with third parties, provide that an institution like Lewis "may direct Respondus to share the personal information or data with that third party under [Lewis's] direction and control." (Id. ¶ 92 (quoting Ex. C to Compl. (Patterson )).)

These allegations do not suffer from the lack of details identified in Heard or Kloss . Patterson has adequately sketched out how Respondus Monitor obtains or generates biometric data, how Lewis or its agents may freely access that data, and even how Lewis may dictate how or when that biometric data is shared or disposed of. She has therefore sufficiently pleaded that Lewis was "in possession of" her biometric data.

2. Section 15(a) and Standing

Patterson claims that Lewis violated section 15(a) because it (1) "does not have a written policy made available to the public establishing a retention schedule and guidelines for permanently destroying" biometric data, and (2) "does not comply with any established retention schedule or destruction guideline." (Compl. (Patterson ) ¶¶ 126–27.) In its motion to dismiss, Lewis makes no argument that applies specifically to this claim, but the court must again consider the issue of standing.

As an initial matter, the court recognizes that Patterson's two-part section 15(a) claim against Lewis appears to differ from her section 15(a) claim against Respondus, which the court discussed above. As against Lewis, Patterson does not invoke only the publication theory; she also claims that Lewis has not complied with a proper retention-and-destruction policy. That additional theory might well support a finding that Patterson has standing, because the unlawful retention of biometric data beyond the time limits set by section 15(a) works a concrete and particularized harm. Fox , 980 F.3d at 1155. Yet Patterson's allegations about retention and destruction are entirely conclusory. She does not meaningfully allege that Lewis violated the "full panoply" of section 15(a)’s requirements by unlawfully retaining her biometric data beyond the time limits set by the provision. See id. She merely parrots the statutory language without making any specific factual allegations about retention. (See, e.g. , Compl. (Patterson ) ¶¶ 7, 10, 20, 127.)

The court thus concludes that Patterson has not established Article III standing for her section 15(a) claim against Lewis. It will therefore remand this claim.

3. Section 15(b)

Patterson claims that Lewis violated section 15(b) because it collected her biometric data without (1) informing her in writing that it was doing so, (2) informing her in writing of the purpose and length of the term for which it was doing so, or (3) receiving a written release executed by her. (Compl. (Patterson ) ¶¶ 138–40.) In its motions to dismiss, Lewis contends that Patterson has failed to allege that Lewis "collected" her biometric data.

Under section 15(b), a private entity must obtain an individual's informed, written consent before it may "collect, capture, purchase, receive through trade, or otherwise obtain" the individual's biometric data. 740 ILCS 14/15(c). As several courts have recognized, "there is a difference between possessing and collecting biometric information." Namuwonge v. Kronos, Inc. , 418 F. Supp. 3d 279, 282–83, 286 (N.D. Ill. 2019) ("BIPA imposes distinct sets of obligations on possessors and collectors of biometric data."). To come within the purview of section 15(b), an entity "must, at a minimum, take an active step" to obtain the biometric data in question. Heard , 440 F. Supp. 3d at 966.

Lewis believes that Patterson has alleged no such active step, but the court disagrees. As described above with respect to the "possession" issue, Patterson has made detailed allegations about how the Respondus Monitor software captures biometric data and transfers it into Lewis's hands. (See, e.g. , Compl. (Patterson ) ¶¶ 36, 46–47, 70–71, 82–87.) Although the software carries out many of these individual functions, Lewis itself steers the process by licensing the Respondus Monitor tool and then requiring that its students use Respondus Monitor to take specific exams. (Id. ¶¶ 31–36, 52, 100.) In the court's view, Patterson sufficiently alleges that Lewis exercised volition in this process.

Lewis cites at least one case that directly undermines its own argument. In Namuwonge , an employee asserted a section 15(b) claim against a vendor (Kronos) that provided her employer (Brookdale) with a timekeeping system that collected her biometric data. Namuwonge , 418 F. Supp. 3d at 281–82. The court found that the complaint failed to allege that the vendor took an active step in collecting the biometric data. Id. at 286 ("[T]he more precise allegation ... makes clear that Brookdale collected the fingerprints using a system that Kronos supplied to Brookdale."). Here, Respondu s's role is closer to that of the more-passive vendor, Kronos, while Lewis is akin to the employer, Brookdale, that affirmatively implemented the timekeeping system at issue.

In sum, the court finds that Patterson adequately alleges that Lewis took an active step to "collect" or "obtain" her data, as required by section 15(b).

4. Section 15(c) and Standing

Patterson claims that Lewis violated section 15(c) because it "profits from requiring students to use Respondus Monitor, as it allows Lewis to offer online coursework and thereby receive tuition dollars from students." (Compl. (Patterson ) ¶ 151.) In other words, she does not claim that Lewis sold, leased, or traded her biometric data directly. Rather, she claims that Lewis "otherwise profit[s] from" biometric data by requiring tuition-paying students to use Respondus Monitor, a program through which Lewis obtains their biometric data.

Instead of engaging with that somewhat convoluted theory on the merits, Lewis simply argues that Patterson lacks standing, and the court agrees. Patterson alleges only a bare violation of the "general regulation" prohibiting "the operation of a market" in biometric data. Thornley , 984 F.3d at 1247. Without more substantial allegations about how she was personally affected by Lewis's alleged profiting from her biometric data, she has failed to establish standing to maintain a section 15(c) claim against Lewis in federal court. The court will remand this claim.

5. Section 15(d)

Finally, Patterson claims that Lewis violated section 15(d) because it "discloses or disseminates students’ biometric identifiers or biometric information to its instructors and other agents without the students’ consent to the disclosure." (Compl. (Patterson ) ¶ 160.) In its motion to dismiss, Lewis argues that Patterson has failed to allege that Lewis "disclose[d]" or "disseminate[d]" her biometric data, as required by section 15(d). Again, the court agrees with Lewis.

Section 15(d) prohibits a private entity in possession of biometric data from disclosing or disseminating that data except in certain circumstances, such as obtaining a subject's consent. 740 ILCS 14/15(d). As Patterson summarizes it now, her complaint alleges that "under the terms of the various agreements with Respondus, [Lewis] has the right to access and share Plaintiff's and the Class's biometric data with third-parties, including Respondus as well as Lewis's ‘instructors, administrators, and other agents’ as well as ‘researchers.’ " (Pl. Resp. to Lewis (Patterson ) at 19 (citing Compl. (Patterson ) ¶¶ 89–91).) But Patterson's complaint never alleges that Lewis did disclose biometric data. She has therefore failed to state a claim against Lewis under section 15(d). This claim is dismissed without prejudice.

CONCLUSION

For the reasons explained above, Respondus's motion to dismiss the Patterson complaint (No. 20 C 7692 [48]) is denied, but the court remands Plaintiff's section 15(a) and 15(c) claims against Respondus for lack of standing. Respondus's motion to dismiss the Wu complaint (No. 21 C 1785 [21]) is denied, as well, but the court dismisses without prejudice Plaintiff's section 15(a) and 15(c) claims for lack of standing. Respondent's motion to dismiss the Veiga complaint (No. 21 C 2620 [15]) is also denied, but the court remands Plaintiffs’ section 15(a) claim for lack of standing. Lewis's motion to dismiss the Patterson complaint (No. 20 C 7692 [50]) is granted in part and denied in part. Plaintiff's section 15(b) claim survives this motion, but the section 15(a) and 15(c) claims against Lewis are remanded for lack of standing, and the section 15(d) claim is dismissed without prejudice for failure to state a claim.