Summary
analyzing issue in class certification context
Summary of this case from Vance v. Microsoft Corp.Opinion
[Copyrighted Material Omitted] [Copyrighted Material Omitted] [Copyrighted Material Omitted] [Copyrighted Material Omitted] ORDER RE CLASS CERTIFICATION
Re: Dkt. No. 255
JAMES DONATO, United States District Judge
In this privacy action against defendant Facebook, Inc. ("Facebook"), named plaintiffs Nimesh Patel, Adam Pezen, and Carlo Licata move for class certification. Dkt. No. 255. Plaintiffs’ claims are sufficiently cohesive to allow for a fair and efficient resolution on a class basis. Consequently, the case will proceed with a class consisting of Facebook users located in Illinois for whom Facebook created and stored a face template after June 7, 2011.
BACKGROUND
The material facts of this case are reported in a number of prior orders. See, e.g., Patel v. Facebook Inc., 290 F.Supp.3d. 948, 950-51 (N.D. Cal. 2018) ["Spokeo order"]. Briefly summarized, plaintiffs are Facebook users who challenge its "Tag Suggestions" program, which scans for and identifies people in uploaded photographs to promote user tagging. Plaintiffs allege that Facebook collects and stores their biometric data without prior notice or consent in violation of their privacy rights and Sections 15(a) and 15(b) of the Illinois Biometric Information Privacy Act, 740 Ill.Comp.Stat. 14/1 et seq. ("BIPA"). Dkt. No. 40.
The salient facts for class certification are undisputed. Facebook launched Tag Suggestions on June 7, 2011. Dkt. No. 255 at 2. In broad strokes, Tag Suggestions is powered by a four-step facial recognition process. Initially, the software tries to detect faces (the "detection" step) and standardizes any detected faces for qualities like orientation and size (the "alignment step"). Dkt. No. 256-8 ¶¶ 13-17. For each face that is detected and aligned, Facebook computes a "face signature," which is a "string of numbers that represents a particular image of a face" (the "representation" step). Id. ¶ 18. Face signatures are then run through a stored database of user "face templates" to look for matches (the "classification" step). Id. ¶¶ 21-23. A face template is "a string of numbers that represents a boundary" between the face signatures of a given Facebook user and the face signatures of others, and is calculated based on that user’s photographs. Id. If a computed face signature falls within the boundary described by a user’s face template, Facebook suggests tagging the user. See Dkt. No. 284-20 at 37. Facebook represents, with no challenge from plaintiffs, that face signatures are not stored. Dkt. No. 256-8 ¶ 20. Only face templates are kept by Facebook.
Facebook’s facial recognition technology is reliable but not foolproof. Facebook estimates that 90% of faces appearing in photographs are successfully detected, and of those detected faces, 85% are successfully aligned. Dkt. No. 284-9 ¶¶ 5-6. That means approximately 76% of faces appearing in photographs reach the representation step and have face signatures computed. Facebook states that in 2014, it was able to match around 67% of detected faces with users, which somewhat understates current matches because the rate has risen as the technology has matured. Id. ¶¶ 8-9.
Plaintiffs seek certification under Federal Rule of Civil Procedure 23(b)(3) and propose a class of all "Facebook users living in Illinois whose face appeared in a photo uploaded to Facebook from Illinois between June 7, 2011, and the final disposition of this action." Dkt. No. 255 at 5. Plaintiffs also propose an alternative class of all "people living in Illinois for whom Facebook has a stored ‘face template’ that was created between June 7, 2011, and final disposition of this action." Id.
LEGAL STANDARDS
As the parties seeking certification, plaintiffs bear the burden of showing that the requirements of Federal Rule of Civil Procedure 23 are met. Mazza v. Am. Honda Motor Co., 666 F.3d 581, 588 (9th Cir. 2012). The proposed class action must satisfy all four requirements of Rule 23(a), and at least one of the sub-sections of Rule 23(b). Comcast Corp. v. Behrend, 569 U.S. 27, 33, 133 S.Ct. 1426, 185 L.Ed.2d 515 (2013); Zinser v. Accufix Research Inst., Inc., 253 F.3d 1180, 1186 (9th Cir. 2001), amended by 273 F.3d 1266 (9th Cir. 2001).
Rule 23(a) imposes four prerequisites. The class must be "so numerous that joinder of all members is impracticable" (numerosity). There must be "questions of law or fact common to the class" (commonality). The claims or defenses of the named plaintiffs must be "typical of the claims or defenses of the class" (typicality). And the named parties must show that they "will fairly and adequately protect the interests of the class" (adequacy). Fed.R.Civ.P. 23(a)(1)-(4).
To obtain a Rule 23(b)(3) class, plaintiffs must also must show that "questions of law or fact common to class members predominate over any questions affecting only individual members" (predominance) and that a class action is "superior to other available methods for fairly and efficiently adjudicating the controversy" (superiority). Fed.R.Civ.P. 23(b)(3).
The Court’s "class-certification analysis must be rigorous and may entail some overlap with the merits of the plaintiff’s underlying claim." Amgen Inc. v. Connecticut Ret. Plans & Trust Funds, 568 U.S. 455, 465-66, 133 S.Ct. 1184, 185 L.Ed.2d 308 (2013) (internal quotations and citations omitted). "That is so because the class determination generally involves considerations that are enmeshed in the factual and legal issues comprising the plaintiff’s cause of action." Comcast, 569 U.S. at 33-34, 133 S.Ct. 1426 (internal quotations and citations omitted). These principles apply to the Rule 23(a) and 23(b) analysis alike. Id. at 34, 133 S.Ct. 1426.
The rigorous analysis, however, has its limits. "Rule 23 grants courts no license to engage in free-ranging merits inquiries at the certification stage. Merits questions may be considered to the extent— but only to the extent— that they are relevant to determining whether the Rule 23 prerequisites for class certification are satisfied." Amgen, 568 U.S. at 466, 133 S.Ct. 1184. The class certification procedure is decidedly not an alternative form of summary judgment or an occasion to hold a mini-trial on the merits. Alcantar v. Hobart Service, 800 F.3d 1047, 1053 (9th Cir. 2015). The goal under Rule 23 is "to select the metho[d] best suited to adjudication of the controversy fairly and efficiently." Amgen, 568 U.S. at 460, 133 S.Ct. 1184 (internal quotations omitted) (modification in original). That means deciding whether efficiency and the interests of justice are best served by having the named plaintiffs go forward to the merits as individuals or on behalf of a class as "an exception to the usual rule that litigation is conducted by and on behalf of the individual named parties only." Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338, 348, 131 S.Ct. 2541, 180 L.Ed.2d 374 (2011) (quoting Califano v. Yamasaki, 442 U.S. 682, 700-701, 99 S.Ct. 2545, 61 L.Ed.2d 176 (1979) ). See generally Brickman v. Fitbit, Inc., No. 3:15-CV-02077-JD, 2017 WL 5569827, at *2-3 (N.D. Cal. Nov. 20, 2017).
The decision of whether to certify a class is entrusted to the sound discretion of the district court. Zinser, 253 F.3d at 1186.
DISCUSSION
I. The Initial Proposed Class
Plaintiffs initially propose a class consisting of all Illinois Facebook users appearing in a photograph uploaded to Facebook. This broad definition is not viable because it poses insurmountable problems with superiority and manageability, commonality, predominance, and is not "reasonably co-extensive with Plaintiffs’ chosen theory of liability." Torres v. Mercer Canyons Inc., 835 F.3d 1125, 1136-37 (9th Cir. 2016).
Simply appearing in an uploaded photograph does not necessarily mean that a face signature or template was collected or stored, or that any biometric data was harvested. As plaintiffs acknowledge, Facebook "locates certain landmarks on the face and uses that data to create a three-dimensional map of the face" only after the initial steps of detection and alignment are successfully completed. Dkt. No. 255 at 3. Unique physical characteristics are not involved in the detection step, which is about locating all faces rather than a specific face. The detection and alignment steps fail for approximately 24% of faces appearing in photographs. See Dkt. No. 284-9 ¶¶ 5-6. The uncertainty generated by this match failure rate is compounded by evidence in the record, which plaintiffs do not contest, that Facebook cannot reliably determine whether a face signature was ever computed from a particular photograph, id. ¶¶ 11-12, and that face signatures are not stored, Dkt. No. 256-8 ¶ 20. The record also shows that at times during the proposed class period, the software did not consistently compute face signatures from a given photograph. See Dkt. No. 284-9 ¶ 12.
These uncontested facts establish that uploading a photo did not necessarily result in the collection of biometric data. Consequently, a class defined by uploaded photographs is too amorphous and potentially over-inclusive to be certified. See Torres, 835 F.3d at 1139; Lozano v. AT & T Wireless Servs., Inc., 504 F.3d 718, 730 (9th Cir. 2007). Plaintiffs suggest that a vigorous claims process can fix these problems, but that only pushes them down the road to a later stage. Facebook will have no greater ability to resolve these uncertainties at the verification stage than at this definitional one. Plaintiffs’ citations to claims procedure cases are inapposite for this reason. See, e.g., In re Cmty. Bank of N. Virginia Mortg. Lending Practices Litig., 795 F.3d 380, 397 (3d Cir. 2015) (defendant already possessed all relevant records and identification method was reliable and repeatable).
Plaintiffs also suggest that they can obtain certification on the theory that users with multiple photos posted on Facebook are likely to have had at least one processed in the representation or classification steps, where biometric data is collected. Dkt. No. 292 at 7. That too is inherently imprecise, and plaintiffs do not offer any statistical or other methods that might translate this presumed likelihood into a reasonably certain class definition.
II. The Certified Class
Plaintiffs’ alternative proposal is tied to face templates, and with a minor modification it provides a sound basis for certification. A class comprised of Facebook users located in Illinois for whom Facebook created and stored a face template after June 7, 2011, satisfies Rule 23’s requirements and neutralizes most of Facebook’s objections, which go mainly to problems caused by the use of face signatures to define the class. This definition modestly refines plaintiffs’ alternative class proposal, and will be used for the remaining Rule 23 analysis. See Armstrong v. Davis, 275 F.3d 849, 871 n.28 (9th Cir. 2001) ("district court may redefine the class") (citing Penk v. Oregon State Bd. of Higher Educ., 816 F.2d 458, 467 (9th Cir. 1987) ), abrogated on other grounds by Johnson v. California, 543 U.S. 499, 125 S.Ct. 1141, 160 L.Ed.2d 949 (2005).
A. Numerosity, Adequacy, and Typicality
The numerosity, adequacy, and typicality requirements in Rule 23(a) are readily satisfied for a template-based class of Illinois users. Plaintiffs reasonably estimate that millions of Illinois residents are Facebook users, many of whom have been tagged in enough photographs to have face templates. Dkt. No. 255 at 6. Plaintiffs’ arguments are uncontested by Facebook, and numerosity is established.
Adequacy is also not an issue. Neither named plaintiffs nor their counsel have an apparent conflict of interest with other class members, and the hard-fought proceedings in this case amply establish that they will "prosecute the action vigorously on behalf of the class." Hanlon v. Chrysler Corp., 150 F.3d 1011, 1020 (9th Cir. 1998). Facebook says adequacy cannot be found because the named plaintiffs "know almost nothing" about their case or claims, but that goes too far. Dkt. No. 285 at 24. The deposition testimony by the named plaintiffs shows a perfectly adequate understanding of the case, and it clearly manifests their concerns about Facebook’s treatment of personal biometric data. See, e.g., Dkt. Nos. 255-5; 255-6; 284-23; 284-24; 284-25. This is not a situation where the named plaintiffs "are startlingly unfamiliar with the case." Dufour v. Be LLC, 291 F.R.D. 413, 419 (N.D. Cal. 2013) (internal quotations omitted). In any event, objections to adequacy based on a named representative’s alleged ignorance are disfavored. See Surowitz v. Hilton Hotels Corp., 383 U.S. 363, 370-74, 86 S.Ct. 845, 15 L.Ed.2d 807 (1966). Even if the named plaintiffs have relied heavily on the advice of attorneys and others, it is hardly a badge of inadequacy to seek help from those with relevant expertise, particularly in a complex case like this one. Baffa v. Donaldson, Lufkin & Jenrette Sec. Corp., 222 F.3d 52, 62 (2d Cir. 2000).
There is no serious doubt that typicality is satisfied, too. Named plaintiffs are Illinois Facebook users with face templates suing under Illinois law on behalf of fellow users in Illinois. That is enough to "assure that the interest of the named representative aligns with the interests of the class." Hanon v. Dataproducts Corp., 976 F.2d 497, 508 (9th Cir. 1992). Typicality may be a bar to certification if other members would suffer because the named plaintiffs would be "preoccupied with defenses unique to" them. Just Film, Inc. v. Buono, 847 F.3d 1108, 1116 (9th Cir. 2017) (quoting Hanon, 976 F.2d at 508). That is not the situation here. Facebook has not shown that named plaintiffs would be preoccupied with unique defenses, or are in any way atypical with respect to the overall class.
B. Commonality and Predominance
The main thrust of Facebook’s non-technical objections to certification go to the somewhat overlapping factors of commonality under Rule 23(a)(2) and predominance under Rule 23(b)(3). These inquiries go to the heart of whether adjudication of the claims on a class basis would be fair, efficient and superior to individual prosecution.
The commonality requirement is satisfied when "there are questions of law or fact common to the class." Fed.R.Civ.P. 23(a)(2). "Because any competently crafted class complaint literally raises common questions," the Court’s task is to look for a common contention "capable of classwide resolution— which means that determination of its truth or falsity will resolve an issue that is central to the validity of each one of the claims in one stroke." Alcantar, 800 F.3d at 1052 (internal quotations and citations omitted). What matters is the "capacity of a classwide proceeding to generate common answers apt to drive the resolution of the litigation." Wal-Mart, 564 U.S. at 350, 131 S.Ct. 2541 (internal quotations omitted) (emphasis in original).
Rule 23(a)(2) does not demand total uniformity across a class. "All questions of fact and law need not be common to satisfy the rule. The existence of shared legal issues with divergent factual predicates is sufficient, as is a common core of salient facts coupled with disparate legal remedies within the class." Hanlon, 150 F.3d at 1019. Rule 23(a)(2) imposes a " ‘rigorous’ commonality standard." Leyva v. Medline Indus. Inc., 716 F.3d 510, 512 (9th Cir. 2013).
Rule 23(b)(3) requires that common questions of law or fact predominate over individual ones. The predominance inquiry asks whether "common questions present a significant aspect of the case and [if] they can be resolved for all members of the class in a single adjudication." Hanlon, 150 F.3d at 1022 (internal quotations omitted); see also Tyson Foods v. Bouaphakeo, __ U.S. __, 136 S.Ct. 1036, 1045, 194 L.Ed.2d 124 (2016). Each element of a claim need not be susceptible to classwide proof, Amgen, 568 U.S. at 468-69, 133 S.Ct. 1184, and the "important questions apt to drive the resolution of the litigation are given more weight in the predominance analysis over individualized questions which are of considerably less significance to the claims of the class." Torres, 835 F.3d at 1134. Rule 23(b)(3) permits certification when "one or more of the central issues in the action are common to the class and can be said to predominate, ... even though other important matters will have to be tried separately, such as damages or some affirmative defenses peculiar to some individual class members." Tyson, 136 S.Ct. at 1045 (internal quotations omitted).
As the Court has discussed in other decisions, the line separating the commonality inquiry under Rule 23(a)(2) and the predominance assessment under Rule 23(b)(3) can be elusive. See Ochoa v. McDonald’s Corp., Case No. 14-cv-02098 JD, 2016 WL 3648550, at *5-6 (N.D. Cal. July 7, 2016). Wal-Mart emphasized the commonality inquiry, but the Supreme Court has also advised that "[i]f anything, Rule 23(b)(3)’s predominance criterion is even more demanding than Rule 23(a)." Comcast, 569 U.S. at 34, 133 S.Ct. 1426. Whatever the precise demarcation might be between the two inquiries, it is clear that commonality alone will not fulfill Rule 23(b)(3), and that the main concern under subsection (b)(3) "is the balance between individual and common issues." In re Hyundai and Kia Fuel Economy Litigation, 881 F.3d 679, 691 (9th Cir. 2018) (internal quotations omitted); see also Tyson, 136 S.Ct. at 1045 (purpose of the Rule 23(b)(3) inquiry is to determine whether the proposed class is "sufficiently cohesive to warrant adjudication by representation") (quoting Amchem Products, Inc. v. Windsor, 521 U.S. 591, 623, 117 S.Ct. 2231, 138 L.Ed.2d 689 (1997) ). As a practical matter, commonality and predominance can be assessed in tandem, with a careful eye toward ensuring that the specific requirements of each are fully satisfied. See, e.g., Just Film, 847 F.3d at 1120-21. As an initial matter, there is no doubt that a template-based class poses common legal and factual questions, namely: did Facebook’s facial recognition technology harvest biometric identifiers as contemplated under BIPA, and if so, did Facebook give users prior notice of these practices and obtain their consent? Facebook agrees that these questions reach the entire class, Dkt. No. 285 at 9, but challenges whether common answers will predominate. Specifically, Facebook contends that three issues can be resolved only by individualized evidence of: (1) whether a class member is "aggrieved" as that word is used in BIPA, which grants a private right of action only to "persons aggrieved" under it; (2) whether a class member’s claims fall within BIPA’s territorial scope; and (3) whether a class member was depicted in photographs derived from "paper photos ... converted to digital form before upload." Id.
Facebook puts greatest emphasis on its argument about the meaning of "aggrieved." It relies almost exclusively on Rosenbach v. Six Flags Entertainment Corporation, 2017 IL App. (2d) 170317, __ Ill.Dec. __, __ N.E.3d __ (Ill.App.Ct. 2017), a currently unpublished opinion by an intermediate court of appeals in Illinois. The BIPA claim in Rosenbach arose out of the practice by the defendant amusement parks of fingerprinting season pass holders so that thumb scans could speed up entry into the park. The parks collected a minor’s thumbprint when he purchased a pass, and his mother subsequently objected under BIPA that the parks had not provided prior notice or obtained consent. She sued on those grounds. The trial court initially denied defendants’ motion to dismiss but certified questions about the meaning of "aggrieved" to the appellate court. Rosenbach is the intermediate court’s response to the certified questions.
As a threshold matter, Rosenbach does not bear the heavy weight Facebook seeks to place on it. Facebook heatedly insists that Rosenbach interpreted "aggrieved" to require injury or harm "beyond the alleged statutory violation." Dkt. No. 285 at 1 (emphasis in original). But the opinion is far less pertinent or definitive than Facebook contends, and a fair reading suggests that the Rosenbach court would have reached the opposite conclusion had the allegations in this case been before it. Rosenbach states on several occasions that the plaintiff in that case— the mother of the minor fingerprinted by the amusement park defendants— did not allege that she or her son "suffered any actual injury." See, e.g., Rosenbach, 2017 IL App. (2d) 170317, ¶ 10, __ Ill.Dec. __, __ N.E.3d __ ("Plaintiff alleged not that she or Alexander suffered any actual injury, but that, had she known of defendants’ conduct, ‘she never would have purchased a season pass for her son.’ "). Instead, "the only injury alleged" by the plaintiff was "a violation of the notice and consent requirements of section 15(b) of the Act," and her argument was that "a mere technical violation of the Act is sufficient to render a party ‘aggrieved.’ " Id. ¶ 18. Critically, the Rosenbach court expressly observed that "Plaintiff did not allege in her complaint any harm or injury to a privacy right," id. ¶ 20 n.1, and underscored that the "injury or adverse effect need not be pecuniary" to qualify a person as "aggrieved" under BIPA. Id. ¶ 28. Facebook glosses over these essential parts of Rosenbach to say it demands some undefined "actual" harm beyond injury to a privacy right, but the better reading is Rosenbach would find that injury to a privacy right is enough to make a person aggrieved under BIPA. As the Court has already found, there is no question that plaintiffs here have sufficiently alleged that intangible injury. See, e.g., Dkt. No. 40 ¶ 17 (Facebook "continues to violate millions of Illinois residents’ legal privacy rights"); id. ¶ 31.
This is enough to overcome Facebook’s objections based on its interpretation of Rosenbach . To the extent Rosenbach might be read differently, the Court would part company with it. To be sure, principles of comity and federalism counsel that federal courts should not lightly disregard state court interpretations of state law. But as an intermediate court opinion, Rosenbach is a non-binding data point for ascertaining Illinois law, and if "other persuasive data" convinces the Court that the Illinois Supreme Court would decide otherwise, the Court need not follow it. Am. Tower Corp. v. City of San Diego, 763 F.3d 1035, 1047 (9th Cir. 2014); Klein v. United States, 537 F.3d 1027, 1032 (9th Cir. 2008).
A considerable amount of "persuasive data" would indeed call into serious doubt an intermediate court decision holding that BIPA requires "actual" injury beyond an invasion of privacy. First and foremost is the plain language of BIPA itself. As the Illinois Supreme Court has held, the "cardinal rule in interpreting a statute is to give effect to the intent of the legislature." People v. Fort, 417 Ill.Dec. 566, 88 N.E.3d 718, 723 (2017) (internal citation omitted). The legislature’s intent is best determined from the language of the statute itself, which should be read as a whole to determine "its nature, its object and the consequences that would result from construing it one way or the other." Id. at 723-724 (internal quotations omitted); see also FDA v. Brown & Williamson Tobacco Corp., 529 U.S. 120, 132-33, 120 S.Ct. 1291, 146 L.Ed.2d 121 (2000) ("fundamental canon of statutory construction" to define words in reference to "context" and "overall statutory scheme") (quoting Davis v. Michigan Dept. of Treasury, 489 U.S. 803, 809, 109 S.Ct. 1500, 103 L.Ed.2d 891 (1989) ).
These well-established canons of interpretation are crucial here, because a plain of reading of BIPA "leave[s] little question that the Illinois legislature codified a right of privacy in personal biometric information" rooted in "a long tradition of claims actionable in privacy law" and extending to control over one’s data, independent of disclosure or misuse risks. Patel, 2018 WL 1050154, at *4. This intent cannot be squared with a construction of "aggrieved" that requires some other "actual" injury, whatever that might be, particularly when deprivation of BIPA’s notice and consent requirements amounts to the "precise harm the Illinois legislature sought to prevent." Id. Such a holding would be all the more questionable because the Illinois legislature clearly knows how to condition a cause of action on actual injury simply by saying so in the statute. See, e.g., 815 Ill.Comp.Stat. Ann. 505/10a (Illinois Consumer Fraud and Deceptive Business Practices Act) (private right of action limited to person who suffers "actual" damage). The legislature did not choose to say so in BIPA, and that choice must be given weight.
This statutory analysis would be enough on its own to turn away Facebook’s characterization of Rosenbach. See Am. Tower, 763 F.3d at 1047 (text of statute alone is persuasive data). Express precedent from the Illinois Supreme Court is another point of persuasive data against it. The Illinois high court has determined that "aggrieved" parties under an Illinois statute are those with a "direct, immediate and substantial interest rather than a speculative, theoretical, inconsequential or remote interest." Am. Sur. Co. v. Jones, 384 Ill. 222, 230, 51 N.E.2d 122 (Ill. 1943). The Illinois Supreme Court made this determination in the context of an insurance statute, but did not cabin its holding to that statute or the facts before it. Jones stands for the proposition that, under Illinois law, an individual is "aggrieved" when "a legal right is invaded by the act complained of." Id. at 229-230, 51 N.E.2d 122 (quoting Glos v. People, 259 Ill. 332, 340, 102 N.E. 763 (Ill. 1913) ).
Tellingly, Rosenbach omits any discussion of Jones, and Facebook also does not address it in its papers. That is a concern because Jones is good law in Illinois and is actively cited today by other federal courts and Illinois state courts, significantly in the BIPA context. See, e.g., Vigil v. Take-Two Interactive Software, Inc., 235 F.Supp.3d 499, 520 (S.D.N.Y. 2017) (citing Jones in interpreting BIPA). A convincing construction of "aggrieved" in BIPA would need to account for Jones, and not rely entirely, for example, on decisions from courts outside Illinois. See, e.g., Rosenbach, 2017 IL App. (2d) 170317, ¶ 22, __ Ill.Dec. __, __ N.E.3d __(citing Wisconsin decision).
An analysis of Jones is particularly important because a good argument can be made that Facebook’s reading of Rosenbach is not consistent with it. Jones holds that a party is aggrieved by an act that directly or immediately affects her legal interest. In contrast, Facebook portrays Rosenbach as saying that the word "aggrieved" requires a plaintiff to affirmatively plead some additional "actual injury" as an element of her claim, whatever that undefined extra harm might be. Dkt. No. 285 at 10. This is a significantly more limited construction of "aggrieved" than afforded by Jones, and the grounds on which it can be harmonized with Jones are not at all clear.
It is also worth noting that the facts in Rosenbach place it several steps away from this case. In Rosenbach, the plaintiff’s son provided his thumbprint for scanning by the defendant. Rosenbach, 2017 IL App. (2d) 170317, ¶ 7, __ Ill.Dec. __, __ N.E.3d __. As the Spokeo order discussed, an express request for a fingerprint scan is a far cry from the situation here, where plaintiffs plausibly argue that simply using Facebook or reading Facebook’s user policy did not put them on notice that Facebook was collecting their biometric data. See Patel, 2018 WL 1050154, at *5 (distinguishing fingerprinting cases). Indeed, an Illinois trial court has applied Rosenbach to dismiss a BIPA case precisely because the plaintiff expressly allowed defendants to take a fingerprint scan and so could not plead an invasion of privacy. Rottner v. Palm Beach Tan, Inc., et al., No. 15 CH 16695 (Ill. Cir. Ct. Mar. 2, 2018) (available at Dkt. No. 315-1).
Consequently, if Rosenbach were to be read as Facebook urges, persuasive data convinces the Court it would not be a good prediction of how the Illinois Supreme Court would interpret "aggrieved" under BIPA. It follows that Facebook has not demonstrated on the basis of Rosenbach that a predominance of individual inquiries would defeat class certification.
Facebook’s other commonality and predominance objections also pose no certification bar. Facebook raises an "extraterritoriality" contention based on the assertion that its servers are not located within Illinois. The parties agree that BIPA does not have extraterritorial reach because no "clear intent in this respect appears from the express provisions of the statute," Avery v. State Farm Mut. Auto. Ins. Co., 216 Ill.2d 100, 185, 296 Ill.Dec. 448, 835 N.E.2d 801 (Ill. 2005), but disagree how that applies here.
Facebook raises a similar argument in its motion for summary judgment. The Court considers it here with respect to certification only.
There is no genuine dispute that this case is deeply rooted in Illinois. The named plaintiffs are located in Illinois along with all of the proposed class members, and the claims are based on the application of Illinois law to use of Facebook mainly in Illinois. As the Court found in a prior order, the case is properly governed by Illinois law pursuant to California choice of law principles, In re Facebook Biometric Info. Privacy Litig., 185 F.Supp.3d 1155, 1169 (N.D. Cal. 2016), and Facebook does not contest the application of Illinois law in opposing class certification. None of the class members are non-residents suing under Illinois law, which is the paradigmatic situation for the presumption against the extraterritorial application of local law. See, e.g., Avery, 216 Ill.2d at 187, 296 Ill.Dec. 448, 835 N.E.2d 801. Facebook has not tendered any evidence to indicate that the circumstances relating to the challenged conduct did not occur "primarily and substantially within" Illinois. Id. Class members do not need to show more in order to sue under BIPA, particularly in light of BIPA’s express concerns about data collection by "[m]ajor national corporations," 740 Ill.Comp.Stat. Ann. 14/5(b). See Morrison v. Nat’l Australia Bank Ltd., 561 U.S. 247, 267, 130 S.Ct. 2869, 177 L.Ed.2d 535 (2010) (territoriality inquiry looks to the "objects of the statute’s solicitude").
Contrary to Facebook’s suggestion, the geographic location of its data servers is not a dispositive factor. Server location may be one factor in the territoriality inquiry, but it is not the exclusive one. As Avery cautions, "focusing solely on [only one circumstance] ... can create questionable results" where "the bulk of the circumstances ... occur within Illinois." Avery, 216 Ill.2d at 186, 296 Ill.Dec. 448, 835 N.E.2d 801; see also Rivera v. Google Inc., 238 F.Supp.3d 1088, 1102 (N.D.Ill. 2017) (in BIPA face scan context, even if "the scanning takes place outside of Illinois, that would not necessarily be dispositive"). Avery ’s warning is particularly apt here because the functionality and reach of modern online services like Facebook’s cannot be compartmentalized into neat geographic boxes. Making the geographic coordinates of a server the most important circumstance in fixing the location of an Internet company’s conduct would yield the questionable results Avery counsels against. Among other problematic outcomes, it would effectively gut the ability of states without server sites to apply their consumer protection laws to residents for online activity that occurred substantially within their borders. See Rocky Mountain Farmers Union v. Corey, 730 F.3d 1070, 1104 (9th Cir. 2013) (state cannot "impose its own regulatory standards on another jurisdiction" but "may regulate with reference to local harms"). Correlatively, a single-minded focus on server location would also potentially nationalize the consumer protection laws of states that host servers, which in this case includes California. Both outcomes are fraught with unintended and undesirable consequences.
Facebook also suggests that the claims of some class members may only be peripherally related to Illinois. It says for example that some class members might have just moved to Illinois with face templates created elsewhere. Dkt. No. 285 at 18. Maybe so, but Facebook does not offer anything other than its own conjecture on this point, and mere "speculation" about class variability "does not meet [defendant’s] burden of demonstrating that individual ... issues predominate." Gutierrez v. Wells Fargo Bank, NA, 704 F.3d 712, 729 (9th Cir. 2012).
As a final contention, Facebook says that predominance cannot be found because individualized inquiries may be necessary to determine which users’ face templates were derived from scans of paper photographs. This too is unavailing. Assuming for discussion purposes only that a class member’s claim could turn on whether an uploaded photograph was taken by a digital versus film camera, Facebook simply asserts with no accompanying evidence that "[m]any photos uploaded to Facebook fit that description." Dkt. No. 285 at 19. Conclusory allegations with no support in the record will not defeat commonality and predominance. Brickman, 2017 WL 5569827, at *5.
C. Superiority
The closing consideration for certification is whether any fairness or practical case management reasons count against it. "Rule 23(b)(3) requires that a class action be ‘superior to other available methods for fairly and efficiently adjudicating the controversy,’ and it specifically mandates that courts consider ‘the likely difficulties in managing a class action.’ " Briseno v. ConAgra Foods, Inc., 844 F.3d 1121, 1127-28 (9th Cir. 2017).
A class action is clearly superior to individual proceedings here. While not trivial, BIPA’s statutory damages are not enough to incentivize individual plaintiffs given the high costs of pursuing discovery on Facebook’s software and code base and Facebook’s willingness to litigate the case. Just Film, 847 F.3d at 1123. The class will be manageable because members can be identified in a straightforward way. Facebook has collected a wealth of data on its users, including self-reported residency and IP addresses. See Dkt. No. 255 at 7. Facebook does not argue that determining the location of Facebook users with face templates would be unduly difficult or subject to significant uncertainty.
Facebook seems to believe that a class action is not superior because statutory damages could amount to billions of dollars. Dkt. No. 285 at 20. To be sure, class certification may be inappropriate where it would result in damages inconsistent with legislative intent. Bateman v. Am. Multi-Cinema, Inc., 623 F.3d 708, 722-23 (9th Cir. 2010); Kline v. Coldwell, Banker & Co., 508 F.2d 226, 235 (9th Cir. 1974). But the Illinois legislature knows how to speak clearly when it wants to foreclose class actions. See, e.g., 35 Ill.Comp.Stat. 200/23-15(a) ("no complaint shall be filed as a class action"). Facebook suggests that BIPA’s limitation of relief to "aggrieved" persons bespeaks a reluctance to impose hefty penalties on non-compliant companies, but it offers no evidence or cogent explanation in support of that claim, and to the extent it relies on Rosenbach, the argument is rejected for the previously stated reasons. In addition, substantial damages are not a reason to decline class certification because it is within the Court’s discretion to reduce a liquidated damages award to comport with due process at a later stage of the proceedings. See, e.g., Six (6) Mexican Workers v. Arizona Citrus Growers, 904 F.2d 1301, 1309 (9th Cir. 1990).
CONCLUSION
The Court certifies a class of Facebook users located in Illinois for whom Facebook created and stored a face template after June 7, 2011.
IT IS SO ORDERED.