Opinion
23-cv-05096-EJD
06-27-2024
CASEY TIBBS, ANDREW CASTILLO, and ERIC WILIM, on behalf of themselves and all others similarly situated, Plaintiffs, v. ARLO TECHNOLOGIES, INC., Defendant.
Re: ECF Nos. 29, 45
ORDER DENYING DEFENDANT'S MOTION TO DISMISS AND MOTION TO STRIKE
EDWARD J. DAVILA, United States District Judge.
Plaintiffs Casey Tibbs, Andrew Castillo, and Eric Wilim (together, “Plaintiffs”) bring this putative class action against Defendant Arlo Technologies, Inc. (“Defendant” or “Arlo”) for alleged violations of Illinois's Biometric Information Privacy Act (“BIPA”), 740 Ill. Comp. Stat. (“ILCS”) 14/1, et seq. (2008). See First Am. Class Action Compl. (“FAC”), ECF No. 28. Now pending before the Court is (1) Defendant's motion to dismiss the FAC (the “Motion to Dismiss”), see Mot., ECF No. 29, and (2) Plaintiffs' motion to strike Defendant's notice of supplemental authority (the “Motion to Strike”), see Strike Mot., ECF No. 45. The Court finds the matter suitable for decision without oral argument pursuant to Civil Local Rule 7-1(b), and, for the reasons below, DENIES Defendant's Motion to Dismiss and Motion to Strike.
I. BACKGROUND
A. Factual Allegations
1. Parties
Plaintiffs Tibbs, Castillo, and Wilim are Illinois residents. FAC ¶¶ 14-16. Plaintiffs work as delivery drivers who make deliveries to customers' homes in Illinois; Tibbs and Casey are DoorDash drivers and Wilim is a UPS driver. Id.
Arlo is a Delaware corporation with a principal place of business in Milpitas, California. Id. ¶ 17. Arlo is a home security company that offers security cameras supported by high quality video and artificial intelligence (“AI”) monitoring. Id.
2. Arlo's Home Security System
Plaintiffs allege that every time an Illinois delivery driver makes a food, mail, or package delivery to a home that is equipped with Arlo's home security system, Arlo's security cameras capture geometric scans of the driver's face, body, and hands in both the infrared and visible light spectra. FAC ¶ 2. The cameras can collect videos in the visible light spectrum in various high resolutions, including 1080p, 2K, HD, and 4K; some have color night vision as well. Id. ¶ 26. Further, most Arlo devices detect motion using passive infrared (“PIR”) technology, which detects objects that are warmer than the surrounding environment. Id. Arlo's infrared facial recognition technology is even capable of distinguishing between individuals wearing glasses, whereas many other types of facial recognition technology struggle to identify individuals wearing sunglasses or balaclavas. Id. ¶ 4. The combination and analysis of the scans in two spectra-infrared radiation and visible light-allows Arlo to identify particular individuals. See id. ¶ 27.
Arlo's home security systems do not include the full capabilities of its recognition software, and it does not provide homeowners with software that can process the camera scans to recognize unique individuals. FAC ¶ 6. However, Arlo does sell a “Person Detection” feature as part of its home security offerings. See id. ¶ 5. The Person Detection feature uses artificial intelligence (“AI”) technology and uses advanced algorithms to analyze the infrared and visible light scans collected by Arlo's cameras to: (1) distinguish between humans and animals; (2) filter out everyday movement (such as tree branches) and provide real-time alerts to the homeowner when a person is detected approaching the home; and (3) allow the homeowner to search the camera video feeds for videos containing people. See id. ¶¶ 5, 24.
In addition to the Person Detection feature, Arlo sells homeowners the following features: (1) Package Detection, which allows homeowners to “receive [] notifications when [their] Arlo camera sees a package being picked up or dripped off”; (2) Vehicle Detection, which “detects cars, trucks, buses, motorbikes, and bicycles, and allows [homeowners] to receive notifications when [their] Arlo camera detects a vehicle”; and (3) Animal Detection, which alerts homeowners when the “Arlo camera detects an animal . . . any larger than a small rodent.” FAC ¶ 25 (citations omitted). Homeowners may activate or deactivate these features by toggling a motion alert setting for each category in the Arlo app. Id.
Plaintiffs allege that the scans that Arlo can use to identify unique individuals are biometric identifiers, and Arlo's AI needs to collect, use, and store such biometric identifiers to accomplish its various person detection tasks. See id. ¶¶ 2, 5, 26. In particular, Plaintiffs allege that the Person Detection feature necessarily requires the collection of people's facial, body, and hand geometry in both the infrared and visible light spectra to reliably distinguish people from animals. See id. ¶ 5, 26.
Arlo did not inform Plaintiffs that it was collecting biometric identifiers, or of the purpose and length of time for which their biometric identifiers would be collected, stored, and used. See FAC ¶ 43. Further, Arlo did not publish public access policies identifying its retention schedules or guidelines for permanently destroying any of these biometric identifiers. Id. ¶ 44.
3. Arlo's Presence in Market
Arlo is one of the largest players in the home security market in the United States. FAC ¶ 21. According to its most recent investor report, Arlo generated $490 million in revenue in 2022 and had a particularly strong 53% year-over-year growth in the last quarter of 2022. Id.
4. Class Allegations
Plaintiffs allege a putative class defined as: “All natural persons in Illinois who are delivery drivers and who, when making deliveries, had their biometric identifiers collected, stored, and scanned by Arlo cameras and software from October 4, 2018, to present.” Id. ¶ 45.
B. Procedural History
Plaintiffs initiated this action on October 4, 2023. See Compl., ECF No. 1. Arlo filed a motion to dismiss, see ECF No. 13, and Plaintiffs responded by filing the operative FAC. The FAC asserts two claims: (1) violation of 740 ILCS 14/15(b) and (2) violation of 740 ILCS 14/15(a). See FAC ¶¶ 52-75.
Arlo filed the instant Motion to Dismiss on January 26, 2024, pursuant to Federal Rules of Civil Procedure 12(b)(1) and 12(b)(6). See Mot. The Motion to Dismiss was fully briefed on February 14, 2024. See Opp'n, ECF No. 32; Reply, No. 33. The hearing was set for March 28, 2024, and Court took the Motion to Dismiss under submission without oral argument on March 22, 2024. See ECF No. 43.
On April 30, 2024, Plaintiffs filed a Notice of Supplemental Authority. See ECF No. 44. On May 3, 2024, Arlo filed the instant Motion to Strike. See Strike Mot. Plaintiffs filed an opposition to the Motion to Strike on May 6, 2024. See Strike Opp'n, ECF No. 47. Additionally, Arlo filed a Statement of Recent Decision on May 3, 2024, see ECF No. 46, and Plaintiffs filed a Notice of Supplemental Authority on June 17, 2024, see ECF No. 48.
II. LEGAL STANDARDS
A. Motion to Dismiss FAC
1. Federal Rule of Civil Procedure 12(b)(1)
Federal Rule of Civil Procedure 12(b)(1) permits a defendant to challenge the existence of the Court's subject matter jurisdiction over the action. See Fed.R.Civ.P. 12(b)(1). “Federal courts are courts of limited jurisdiction . . . possess[ing] only that power authorized by Constitution and statute.” Kokkonen v. Guardian Life Ins. Co. of Am., 511 U.S. 375, 377 (1994). Article III of the United States Constitution “limits the jurisdiction of federal courts to ‘Cases' and ‘Controversies.'” Lujan v. Defenders of Wildlife, 504 U.S. 555, 559 (1992). The party invoking federal jurisdiction bears the burden of establishing that the plaintiff has standing to bring the suit, i.e., that the action is a case or controversy “of the justiciable sort referred to in Article III.” Id. at 560-61. “[T]he irreducible constitutional minimum of standing contains three elements.” Id. at 560. “The plaintiff must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.” Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016) (citations omitted). “[A]t the pleading stage, the plaintiff must ‘clearly . . . allege facts demonstrating' each element.” Id. (quoting Warth v. Seldin, 442 U.S. 490, 518 (1975)).
2. Federal Rule of Civil Procedure 12(b)(6)
Under Federal Rule of Civil Procedure 12(b)(6), a court must dismiss a complaint if it fails to state a claim upon which relief can be granted. To survive a Rule 12(b)(6) motion, a plaintiff must allege “enough facts to state a claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). A claim is facially plausible when the plaintiff pleads facts permitting the court to “draw the reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (citation omitted). The allegations must show “more than a sheer possibility that a defendant has acted unlawfully.” Id. Mere “conclusory allegations of law and unwarranted inferences are insufficient to defeat a motion to dismiss.” Adams v. Johnson, 355 F.3d 1179, 1183 (9th Cir. 2004).
When determining whether a claim has been stated, a district court's review is limited to the face of the complaint and judicially noticeable information. MGIC Indem. Corp. v. Weisman, 803 F.2d 500, 504 (9th Cir. 1986); N. Star Int'l v. Ariz. Corp. Comm'n, 720 F.2d 578, 581 (9th Cir. 1983). The court must accept as true all well-pleaded factual allegations and construe them in the light most favorable to the plaintiff. Reese v. BP Expl. (Alaska) Inc., 643 F.3d 681, 690 (9th Cir. 2011). The Court need not, however, “assume the truth of legal conclusions merely because they are cast in the form of factual allegations.” Fayer v. Vaughn, 649 F.3d 1061, 1064 (9th Cir. 2011) (per curiam).
B. Motion to Strike Notice of Supplemental Authority
A district court may in its discretion strike a filing for failure to comply with the local rules. See Christian v. Mattel, Inc., 286 F.3d 1118, 1129 (9th Cir. 2002) (“The district court has considerable latitude in managing the parties' motion practice and enforcing local rules that place parameters on briefing.”); see also, e.g., Hudson v. Wells Fargo & Co., No. 21-cv-08296, 2022 WL 2716526, at *4 (N.D. Cal. July 13, 2022) (“While Plaintiff clearly exceeded the page limit in violation of the local rules, the Court in its discretion DENIES Defendants' motion to strike.”).
Civil Local Rule 7-3 provides that “Once a reply is filed, no additional memoranda, papers or letters may be filed without prior Court approval,” except that “[b]efore the noticed hearing date, counsel may bring to the Court's attention a relevant judicial opinion published after the date the opposition or reply was filed by filing and serving a Statement of Recent Decision.” Civil L.R. 7-3(d)(2). “Such Statement shall contain a citation to and provide a copy of the new opinion without argument.” Id.
III. DISCUSSION
Because Defendant's Motion to Strike concerns a Notice of Supplemental Authority Plaintiffs filed in support of their opposition to Defendant's Motion to Dismiss, the Court addresses the Motion to Strike first.
A. Motion to Strike
Defendant moves the Court to strike Plaintiffs' Notice of Supplemental Authority, see ECF No. 44, filed on April 30, 2024. See Strike Mot. 1. Defendant argues that the filing violates Civil Local Rule 7-3(d) because it includes about 1.5 pages of argument regarding the supplemental authority at issue, and requests that the Court either (1) “deny Plaintiffs' request that the improperly submitted supplemental authority be considered in ruling on Arlo's pending Motion to Dismiss” or (2) grant Defendant leave to file a proposed 1.5-page response to the argument set forth in Plaintiffs' filing. See id. Plaintiffs counter that (1) the Notice does not contain argument, but instead directly quotes the new authority, and (2) even if the Court considers the filing to contain argument, the sum total of Plaintiffs' opposition papers to the Motion to Dismiss would be 18 pages and thus well below the 25-page limit for opposition briefs. See Strike Opp'n 1.
The Court finds that Plaintiffs' April 30, 2024 Notice of Supplemental Authority violates this district's local rules, which require a party to provide no more than a citation and copy of the decision at issue. See Civil L.R. 7-3(d)(2). However, the Court has not reviewed and will not review the text of Plaintiff's filing. The Court will in its discretion consider Plaintiffs to have filed a compliant statement of recent decision, and will consider only the copy of the decision attached to Plaintiff's Notice. The Court therefore DENIES Defendant's request that the Court refuse to consider the supplemental authority. Further, because the Court is not considering Plaintiff's additional text, it also DENIES Defendant's request for leave to file a proposed response.
The Court notes that both Defendant and Plaintiffs subsequently filed further statements of recent decisions. See ECF Nos. 46, 48.
B. Motion to Dismiss
Plaintiffs assert BIPA claims for violations of 740 ILCS 14/15(b) (“Claim 1” or “Section 15(b)”) and 740 ILCS 14/15(a) (“Claim 2” or “Section 15(a)”). See FAC ¶¶ 52-75. Sections 15(a) and (b) of BIPA provide:
(a) A private entity in possession of biometric identifiers or biometric information must develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within 3 years of the individual's last interaction with the private entity, whichever occurs first. Absent a valid warrant or subpoena issued by a court of competent jurisdiction, a private entity in possession of biometric identifiers or biometric information must comply with its established retention schedule and destruction guidelines.
(b) No private entity may collect, capture, purchase, receive through trade, or otherwise obtain a person's or a customer's biometric identifier or biometric information, unless it first:
(1) informs the subject or the subject's legally authorized representative in writing that a biometric identifier or biometric information is being collected or stored;
(2) informs the subject or the subject's legally authorized representative in writing of the specific purpose and length of term for which a biometric identifier or biometric information is being collected, stored, and used; and
(3) receives a written release executed by the subject of the biometric identifier or biometric information or the subject's legally authorized representative.740 ILCS 14/15(a).
Arlo moves to dismiss both counts of the FAC on the grounds that (1) Plaintiffs lack Article III standing for Claim 2 and therefore cannot invoke federal jurisdiction over the claim, and (2) Plaintiffs fail to allege facts sufficient to plead either Claim 1 or Claim 2. See generally Mot. The Court addresses these arguments in turn.
1. Standing
Plaintiffs have the burden to establish Article III standing by sufficiently alleging that they have “(1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.” Spokeo, 578 U.S. at 338 (citations omitted). The injury in fact element requires Plaintiffs to allege “an invasion of a legally protected interest which is (a) concrete and particularized; and (b) actual or imminent, not conjectural or hypothetical.” Patel v. Facebook, Inc., 932 F.3d 1264, 1270 (9th Cir. 2019) (quoting Lujan, 504 U.S. at 560). Defendant argues that Plaintiffs fail to establish an injury in fact because they have not alleged a concrete and particularized injury. See Mot. 6-7; Reply 12-13.
The Ninth Circuit has “adopted a two-step approach to determine whether the violation of a statute causes a concrete injury.” Patel, 932 F.3d at 1270. Under this approach, courts should “ask ‘(1) whether the statutory provisions at issue were established to protect the plaintiff's concrete interests (as opposed to purely procedural rights), and if so, (2) whether the specific procedural violations alleged in this case actually harm, or present a material risk of harm to, such interests.” Id. at 1270-71 (quoting Robins v. Spokeo, Inc., 867 F.3d 1108, 1113 (9th Cir. 2017)) (internal brackets omitted).
In Patel, the Ninth Circuit applied the two-step approach to determine whether plaintiffs had standing to bring BIPA claims against Facebook for alleged violations of Sections 15(a) and (b), i.e., the same statutes at issue in this action. See id. at 1268 (“According to the complaint, Facebook violated sections 15(a) and 15(b) of BIPA by collecting, using, and storing biometric identifiers (a ‘scan' of ‘face geometry,' []) from their photos without obtaining a written release and without establishing a compliant retention schedule.”) (internal citation omitted). At the first step, the circuit court held that Sections 15(a) and (b) “were established to protect an individual's ‘concrete interests' in privacy, not merely procedural rights.” Id. at 1274 (citing Robins, 867 F.3d at 1113). The court then turned to the second step of the analysis and found that the defendant's “alleged collection, use, and storage of plaintiffs' face templates here is the very substantive harm targeted by BIPA,” so that “violations of the procedures in BIPA actually harm or pose a material risk of harm” to the concrete privacy interests protected by BIPA. Id. at 1275. The Ninth Circuit concluded that the Patel plaintiffs' allegations that Facebook's violations of the BIPA requirements allowed it to create, use, and retain individuals' face templates “necessarily violate[d] the plaintiffs' substantive privacy interests,” so that the plaintiffs had alleged a concrete and particularized harm sufficient to establish the injury-in-fact element for Article III standing for the alleged violations of Sections 15(a) and (b). See id. at 1274-75.
The Ninth Circuit recently clarified that although BIPA establishes concrete interests in privacy, the mere failure to “provide a retention schedule or guidelines for permanently destroying the biometric identifiers and/or biometric information” is not sufficient to state an injury to a particular person, as opposed to the public generally. See Zellmer v. Meta Platforms, Inc., ---F.4th ----, 2024 WL 3016946, at *8 (9th Cir. June 17, 2024) (citing Bryant v. Compass Grp. USA, Inc., 958 F.3d 617, 626 (7th Cir. 2020); Fox v. Dakkota Integrated Sys., LLC, 980 F.3d 1146, 1154-55 (7th Cir. 2020)). The court noted that its decision did not contradict Patel because the plaintiffs in Patel, unlike those in Zellmer, had sufficiently alleged a violation of Section 15(b), from which they could show “direct and discrete harm from the alleged Section 15(a) violation.” Id. (citing Patel, 932 F.3d at 1275-76).
Defendant argues that Plaintiffs do not have standing for their Section 15(a) claim because they allege only a failure to publish a retention policy. See Mot. 6-7 (citing Bryant, 958 F.3d at 626; Fox, 980 F.3d at 1154-55); Reply 12-13. However, upon review of the FAC in the light most favorable to Plaintiffs, the Court finds that Plaintiffs allege that Arlo (1) collected biometric identifiers in the form of geometric scans of Plaintiffs' faces, bodies, and hands, see FAC ¶ 5; (2) used these scans to provide various home security features, including Person Detection, see id. ¶ 26; (3) “failed to develop a publicly available retention schedule or guidelines for permanently destroying Plaintiffs' biometric identifiers,” id. ¶ 73; (4) never made such a schedule available to the public because no schedule was developed in the first place, see id.; and (5) never adhered to any such schedule, id. These allegations, along with the Court's conclusion that Plaintiffs have sufficiently stated a violation of Section 15(b), see infra, at Part III(B)(2), are sufficient to state a theory of concrete and particularized harm in violation of Section 15(a): namely, that Arlo has collected, used, and stored Plaintiffs' biometric information without the proper procedures-a retention policy and compliance therewith-to safeguard Plaintiffs' substantive privacy interests. See Patel, 932 F.3d at 1274-75; Zellmer, 2024 WL 3016946, at *8.
Defendant submitted its Motion and Reply prior to the Ninth Circuit's Zellmer decision.
2. Sufficiency of Allegations to State a Claim
Arlo next argues that both of Plaintiffs' claims must be dismissed for failure to state a claim under Rule 12(b)(6). See Mot. 7-23. Arlo first argues that that both BIPA claims fail for two common reasons: (1) Plaintiffs do not allege facts suggesting that they were recorded by an Arlo camera equipped with the relevant detection features; and (2) Plaintiffs do not sufficiently allege that Arlo collected biometric identifiers. See Mot. 8-17. Arlo then argues that the Section 15(b) claim fails because the statute does not apply to the conduct at issue here, see id. at 17-21, and that the Section 15(a) claim fails because Arlo is in compliance with the statute and because Arlo does not “possess” Plaintiffs' biometric data under the meaning of the statute, see id. at 2123. The Court addresses these arguments in turn.
a. Recordings by Arlo Cameras
Defendant argues that the FAC does not plausibly allege that Plaintiffs made deliveries to any home in Illinois at which an Arlo camera was installed with the necessary features to capture the scans at issue in this action. See Mot. 8-10; see also Reply 2 (arguing Plaintiffs' claims are premised on “pure speculation” that they have been captured by Arlo cameras in Illinois). Plaintiffs respond that these arguments raise factual questions not appropriate for resolution on a motion to dismiss. See Opp'n 4-6.
The Court agrees with Plaintiffs. The FAC acknowledges that Plaintiffs are “unable to determine which houses have such surveillance[] systems in place,” FAC ¶ 56, but alleges that Arlo has captured Plaintiffs' information because Plaintiffs make deliveries to Illinois homes during which they walk to the front door of the residences, see id. ¶¶ 14-16, and Arlo is one of the largest players in the home security market in the United States, see id. ¶ 21. Plaintiffs also allege that Arlo “advertises that the [Person Detection] feature ‘also allows you to search the Arlo Feed for videos containing people.'” Id. ¶ 24; see also Decl. of Tyler Zmick (“Zmick Decl.”), Exhs. 14 (webpages from Arlo's public-facing website describing various security features), ECF Nos. 30-1-30-4. It is entirely possible that discovery will show, for example, that Arlo has no cameras in Illinois with the Person Detection feature, but the Court finds that-drawing every reasonable inference in Plaintiffs' favor-Plaintiffs have presented a plausible story that Illinois homeowners would buy security cameras from one of the largest players in the market, and that enough homeowners would choose the camera versions with the enhanced security features advertised by Arlo that Plaintiffs would have been subject to scans by Arlo's cameras as they made deliveries to Illinois homes. See Neals v. PAR Tech. Corp., 419 F.Supp.3d 1088, 1091 (N.D. Ill. 2018) (noting that plaintiffs need not “substantiate” an allegation that defendants collected biometric information, but must only “present ‘a story that holds together'”) (quoting Swanson v. Citibank, N.A., 614 F.3d 400, 404 (7th Cir. 2020)).
These documents are incorporated by reference to the FAC because Plaintiffs relied on the sources extensively. See Khoja v. Orexigen Therapeutics, Inc., 899 F.3d 988, 1002 (9th Cir. 2018); FAC ¶¶ 1, 8, 11, 13, 24-26. Defendant also requests that the Court take judicial notice of a further Arlo webpage in the public realm, as well as an order and two reports of proceedings from Illinois state courts. See Req. Jud. Not., ECF No. 31; Reply Req. Jud. Not., ECF No. 35. Plaintiffs do not oppose the requests for judicial notice. See Opp'n 4 n.2. The documents at issue are in the public realm and judicial records, and the Court grants Arlo's requests for judicial notice. See United States v. Bychak, No. 18-CR-4683-GPC, 2021 WL 734371, at *6 (S.D. Cal. Feb. 25, 2021) (“[T]he judicial notice of publications is often used by Courts for the purpose of establishing inquiry notice, and not to rely on a fact stated in the publication for its truth value.”); U.S. ex rel. Robinson Rancheria Citizens Council v. Borneo, Inc., 971 F.2d 244, 248 (9th Cir. 1992).
b. Biometric Identifiers
Arlo next argues that Plaintiffs fail to allege that Arlo collected or possessed “biometric identifiers” as defined by BIPA. See Mot. 10-17. Sections 15(a) and 15(b) regulate “biometric identifiers” and “biometric information.” See 740 ILCS 14/15(a) (“A private entity in possession of biometric identifiers or biometric information must . . .”); id. at 15(b) (No private entity may collect, capture, purchase, receive through trade, or otherwise obtain a person's or a customer's biometric identifier or biometric information, unless . . .”). BIPA provides that “‘[b]iometric identifier' means a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry,” and goes on to list various items, such as tattoos or human biological samples used for scientific testing, that are not “biometric identifiers” covered by BIPA. Id. at 14/10. “‘Biometric information' means any information, regardless of how it is captured, converted, stored, or shared, based on an individual's biometric identifier used to identify an individual.” Id.
Arlo argues that the FAC does not state a claim under BIPA because Plaintiffs do not allege that Arlo's infrared or visible light scans (1) can be used by Arlo to identify Plaintiffs, see Mot. 14-17, and (2) fall into the definition of “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry,” but rather that Arlo's scans are “heat maps,” which are not included in BIPA's enumerated list of biometric identifiers, see id. at 17. Plaintiffs counter that the FAC plausibly alleges that Arlo collects biometric identifiers by capturing geometric scans of an individual's face and hands, which can be used to identify Plaintiffs. See Opp'n 6-11.
Addressing the second argument first, Plaintiffs allege that the scans taken by Arlo's cameras capture infrared and visible light data that Arlo's technology then uses to “map[] peoples' facial geometry.” FAC ¶ 31; see also, e.g., id. ¶ 2 (“Defendant's security cameras capture geometric scans of Plaintiffs and other Illinois delivery drivers' faces, bodies, and hands.”). Taking these allegations as true, the Court finds that Plaintiffs have alleged the necessary- although not sufficient-fact that Arlo captures data included on BIPA's list of biometric identifiers, namely, “scan[s] of hand or face geometry.”
In addition to alleging data included on the BIPA list, the Ninth Circuit has clarified that both biometric identifiers and biometric information must be capable of identifying an individual to be regulated by BIPA. See Zellmer, 2024 WL 3016946, at *4. Thus, “[f]or example, scans of face geometry fall within BIPA's list, but are not covered by BIPA if they cannot identify a person.” Id. at *5. In Zellmer, the Ninth Circuit held on review of summary judgment that a “face signature” that did not reveal any geometric information about a face or correspond to facial features-and instead was an abstract, numerical representation that could not be reverse-engineered to display a face-was not a biometric identifier. See id. at *6. By contrast, Plaintiffs here allege that “Arlo's patents confirm that these . . . scans . . . can be used to identify particular individuals.” FAC ¶ 6; see also id. ¶ 32 (“Arlo boasts that ‘the invention provides a new and useful facial recognition system that may further automatically execute tasks in response to the detection of a particular individual.'”).
Defendant argues that Plaintiffs must allege that Arlo itself is capable of using the scans to determine Plaintiffs' identities-e.g., their names, phone numbers, email addresses-and that the FAC instead alleges an implausible hypothetical situation in which Arlo could use its facial recognition technology to match Plaintiffs' faces to their photos on public facing social media profiles. See Mot. 16; FAC ¶¶ 64-65. But these are not Plaintiffs' only allegations regarding Arlo's capacity to identify individuals using its scans. Plaintiffs allege that Arlo has explained in a European patent that its face recognition technology can identify a specific person at a door and send a user a message such as “Mary detected at front door” or, conversely, inform a user of “Unknown person at front door.” FAC ¶¶ 28, 32. Arlo argues that the European patent is not relevant here, but the Court takes as true Plaintiffs' allegation that the same scans are used in Arlo's home security cameras. See id. ¶ 27. Plaintiffs further allege that “Defendant's cameras collected Plaintiffs' face geometry and stored the image of Plaintiffs' face geometry in an electronic database” whenever Plaintiffs made deliveries to homes equipped with Arlo cameras. The Court finds these allegations sufficient to establish at the pleading stage that the scans Arlo captures are “biometric identifiers” for purposes of BIPA's regulations. See Wise v. Ring LLC, No. 20-1298, 2022 WL 3083068, at *3 (W.D. Wash. Aug. 3, 2022) (finding allegations that defendant was “collecting face geometry from photos, processing these images for a facial recognition database ‘with the ultimate goal of identifying people who can be “tagged” as safe or potentially suspicious visitors'” using technology “capable of immediately identifying individuals” survived motion to dismiss); cf. Ji v. Naver Corp., No. 21-cv-05143, 2023 WL 6466211, at *12 (N.D. Cal. Oct. 3, 2023) (finding plaintiff did not allege collection of biometric data because they “stop short of pleading that Defendants are capable of identifying Plaintiff . . . by using the biometric data Defendants collect, whether standing alone or when combined with other methods or sources available to Defendants”).
Plaintiffs argue that biometric identifiers are distinct from biometric information under BIPA, so that biometric identifiers need not be capable of being used to identify an individual, but the Ninth Circuit rejected this argument in Zellmer (decided subsequent to Plaintiffs' submission of their opposition brief). See Opp'n 11; Zellmer, 2024 WL 3016946, at *4 (“We join the other courts to have considered this issue and reject Zellmer's argument” that “while biometric information requires the ability to ‘identify an individual,' biometric identifiers have no such explicit requirement.'”).
The Wise decision also notes that the complaint alleged that the defendant partnered with law enforcement agencies to semi-automatically identify individuals based on face recognition, but that allegation was not dispositive. See Wise, 2022 WL 3083068, at *3.
c. Section 15(b) Arguments
Arlo next argues that Plaintiffs do not state a claim under Section 15(b) because (1) Plaintiffs do not allege that Arlo actively collected their biometric data, but rather that Arlo passively captured scans only after homeowners activated the Person Detection feature, see Mot. 17-19, and (2) Section 15(b) does not require impossible notice and consent from individuals who are strangers to Arlo, id. at 20-21.
The Court finds Arlo's first argument thoroughly unpersuasive. Contrary to Arlo's position, Plaintiffs do not “claim their ‘infrared scans' were collected by ‘homeowners.'” See Mot. 18. It is plainly not Plaintiffs' theory that homeowners are collecting and storing the scans of individuals who arrive at their doors. Rather, Plaintiffs expressly allege that Arlo's cameras scan the faces, bodies, and hands of visitors to homes equipped with Arlo's home security system, see FAC ¶ 2; that Arlo then stores the scans in an electronic database, see id. ¶¶ 28, 42; and that if a homeowner activates a feature such as Person Detection, then Arlo alerts the homeowner when a person is detected by the camera, see id. ¶ 24. These allegations are sufficient to establish that Arlo does not merely mysteriously end up in possession of the scans, but rather is the entity capturing the biometric information at issue. See, e.g., Jacobs v. Hanwha Techwin Am., Inc., 2021 WL 3172967, at *2 (N.D. Ill. July 27, 2021) (“[F]or § 15(b)'s requirements to apply, an entity must, at a minimum, take an active step to collect, capture, purchase, or otherwise obtain biometric data.”)
Arlo's second argument specific to Section 15(b)-i.e., that it is too far removed from Plaintiffs, such that it would be practically impossible to provide notice and obtain consent-relies on the district court's decision in Zellmer v. Facebook, Inc., No. 18-cv-01880, 2022 WL 976981 (N.D. Cal. Mar. 31, 2022). However, on appeal, the Ninth Circuit stated that the district court's decision “turned on the practical impossibility of Meta's complying with BIPA if it had to obtain consent from everyone whose photo was uploaded to Facebook,” but that “this conclusion was wrong” because “the plain text applies to everyone whose biometric identifiers or information is held by Facebook.” Zellmer, 2024 WL 3016946, at *4. Arlo's second argument-made before the Ninth Circuit's issuance of Zellmer-must therefore be rejected.
d. Section 15(a) Arguments
Arlo lastly argues that Plaintiffs' Section 15(a) claim must be dismissed because (1) Arlo has a publicly available policy that complies with the retention periods set forth in Section 15(a); (2) Plaintiffs lack statutory standing to bring the claim because they were not themselves aggrieved by Arlo's alleged violation of the retention policy because Arlo's retention duty is owed to the public at large rather than individuals; and (3) Plaintiffs fail to allege that Arlo “possessed” their biometric data. See Mot. 21-23. These arguments are unavailing.
First, the policy put forth by Arlo-of which the Court has taken judicial notice, see supra, at 11 n.3-does not address Section 15(a)'s requirement that companies “develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information.” 740 ILCS 14/15(a). Instead, the policy states that “Arlo permanently and immediately deletes videos after a subscriber deletes a video, or after expiration of the applicable retention period for the subscription plan of the subscriber.” See Req. Jud. Not, Exh. 6. Regardless of the truth of this statement-which the Court does not consider-the policy does not discuss biometric identifiers and biometric information, particularly as Plaintiffs allege that Arlo stores the scans at issue in an electronic database. See FAC ¶ 42; see also Rivera v. Google, Inc., 238 F.Supp.3d 1088, 1096 (N.D. Ill. 2017) (“The bottom line is that a ‘biometric identifier' is not the underlying medium itself, or a way of taking measurements, but instead is a set of measurements of a specified physical component (eye, finger, voice, hand, face) used to identify a person.”) (emphasis added).
Second, Arlo's argument that Plaintiffs lack statutory standing (as distinct from Article III standing) must also be rejected. BIPA provides that “[a]ny person aggrieved by a violation of [BIPA] shall have a right of action in a State circuit court or as a supplemental claim in federal district court against an offending party.” 740 ILCS 14/20. Arlo relies on a Seventh Circuit decision finding that the plaintiff lacked Article III standing to bring a Section 15(a) claim because an entity's policy disclosure duty was “owed to the public generally, not to particular persons whose biometric data the entity collects.” Mot. 22 (quoting Bryant, 958 F.3d at 626). However, the Seventh Circuit specifically stated that given its finding as to Article III standing, it had “no authority and no occasion to address her state-court standing to bring this claim.” Bryant, 658 F.3d at 626. Here, the Court has found that Plaintiffs have Article III standing to bring their Section 15(a) claim under Ninth Circuit law because they have sufficiently alleged a concrete and particularized injury. See supra, at Part III(B)(1). For the same reasons, the Court finds that Plaintiffs have alleged that they are “aggrieved” by the violation of Section 15(a).
Third, Arlo argues that Plaintiffs do not sufficiently allege its “possession” of their biometric data, i.e., that Arlo had control of the biometric data, as opposed to the homeowners. See Mot. 22-23. But the FAC plainly alleges that Arlo “stored and used” biometric identifiers too provide its Person Detection feature, FAC ¶ 12, and that Arlo is unable to accomplish its person detection tasks without “collect[ing], us[ing], and stor[ing]” the identifiers, id. ¶ 26. The FAC further alleges that Arlo stores the biometric data in an electronic database, see id. ¶ 42, and that homeowners can toggle features such as Person Detection on and off. See id. ¶ 25. These allegations, which permit the reasonable inference that Arlo stores the biometric data and accesses it at need when the relevant security features are toggled, easily distinguish Plaintiffs' complaint from those dismissed in the cases cited by Defendant. See, e.g., Barnett v. Apple Inc., 225 N.E.3d 602, 603 (Ill.App.Ct. 2022) (finding allegations that defendant designed software for individuals to capture their own biometric data and store on personal device, without allegations of other storage by defendant, insufficient to show possession); Heard v. Becton, Dickinson & Co., 440 F.Supp.3d 960, 962, 968-69 (N.D. Ill. 2020) (finding allegations did not “say whether BD could freely access the data or even how BD allegedly received it”); Kyles v. Amazon Web Servs., Inc., No. 2021-CV-04026, Report of Proceedings (Cook Cnty., Ill. Cir. Ct. Jan. 3, 2023) (Reply Req. Jud. Not., Exh. 8) (defendant AWS provided cloud storage to non-party which collected and used fingerprint data).
IV. CONCLUSION
For the foregoing reasons, the Court hereby ORDERS that:
1. Arlo's motion to strike Plaintiffs' notice of supplemental authority at ECF No. 44, or in the alternative to file a response, is DENIED because the Court has considered only the decision attached to the notice and has not considered Plaintiffs' additional text;
2. Arlo's motion to dismiss Plaintiffs' Section 15(a) claim for lack of standing is DENIED; and
3. Arlo's motion to dismiss both BIPA claims for failure to state a claim is DENIED.
4. Arlo shall file an answer within 14 days of the entry of this order.
5. The Court will separately set an initial case management conference.
IT IS SO ORDERED.