Hazlitt v. Apple Inc. ( 2020 )

IN THE UNITED STATES DISTRICT COURT FOR THE SOUTHERN DISTRICT OF ILLINOIS ROSLYN HAZLITT, JANE DOE, by and through Next Friend JOHN DOE, RICHARD ROBINSON, and YOLANDA BROWN, on behalf of themselves and all other persons similarly situated, Plaintiffs, v. Case No. 3:20-CV-421-NJR APPLE INC., Defendant. MEMORANDUM AND ORDER ROSENSTENGEL, Chief Judge: Pending before the Court is a Motion to Dismiss filed by Defendant Apple Inc. (Doc. 19). Defendant seeks dismissal of the Complaint for failure to state a claim under Rule 12(b)(6). Alternatively, Defendant moves to dismiss Count II for lack of subject matter jurisdiction under Rule 12(b)(1). For the reasons set forth below, the motion is granted in part and denied in part. FACTUAL AND PROCEDURAL BACKGROUND On March 2, 2020, Plaintiffs Roslyn Hazlitt, Jane Doe, a minor, by and through Next Friend John Doe, Richard Robinson, and Yolanda Brown (“Plaintiffs”) filed a putative Class Action Complaint against Defendant Apple Inc. (“Apple”), in the Circuit Court for the Twentieth Judicial Circuit in St. Clair County, Illinois. Within the Complaint, Plaintiffs allege violations of Illinois’ Biometric Information Privacy Act (BIPA), 740 ILL. COMP. STAT. § 14/1 et seq. (Doc. 1-1). Specifically, Plaintiffs allege Apple violated sections 14/15(a)-(c) of BIPA by collecting, possessing, and profiting from their facial geometries, which qualify as biometric identifiers and biometric information (Id. at ¶¶ 1, 3). A. The Illinois Biometric Information Privacy Act In 2008, Illinois passed BIPA due to concerns with emerging technology and the increasing collection and use of biometrics in the business and security screening sectors. The Illinois legislature recognized that unlike other personal identifiers, like social security numbers, biometrics are biologically unique to each individual and cannot be altered or changed once compromised. If this data is compromised, due to the sensitive nature of biometrics, an individual is at heightened risk for identity theft and lacks recourse. See 740 ILL. COMP. STAT. §§ 14/5(a)-(c). The Illinois legislature observed an overwhelming majority of the public is wary of the use of biometrics when such information is tied to finances and other personal information. While the full ramifications of biometric technology are unknown, BIPA is intended to serve public welfare, security, and safety by regulating the “collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information.” See 740 ILL. COMP. STAT. §§ 14/5(d)-(g). BIPA regulates private entities or “any individual, partnership, corporation, limited liability company, association, or other group, however organized.” See 740 ILL. COMP. STAT. §§ 14/10-20. BIPA requires all private entities in possession of biometric identifiers or biometric information to “develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within 3 years of the individual’s last interaction with the private entity.” 740 ILL. COMP. STAT. § 14/15(a). Further, private entities are prohibited from collecting, capturing, purchasing, or receiving through trade, or otherwise obtaining a person’s biometric identifier or biometric information unless it informs the subject in writing with the specific purpose and length of time disclosed, and receives a written release, i.e., informed written consent. 740 ILL. COMP. STAT. §§ 14/10, 15(b). Moreover, BIPA prohibits private entities from selling, leasing, trading, or otherwise profiting from a person’s or customer’s biometric identifier or information in their possession. 740 ILL. COMP. STAT. § 14/15(b). BIPA’s definition of “biometric identifier” includes “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.” 740 ILL. COMP. STAT. § 14/10. BIPA excludes writing samples, written signatures, photographs, human biological samples for valid scientific testing or medical uses, demographic data, tattoo descriptions, and physical descriptions from the definition for “biometric identifier.” Id. The Act defines “biometric information” as “any information, regardless of how it is captured, converted, stored, or shared, based on an individual’s biometric identifier used to identify an individual.” Id. BIPA further narrows the definition by not including “information derived from items or procedures excluded under the definition of biometric identifiers.” Id. The Illinois legislature devised BIPA to protect consumers against the threat of irreparable privacy violations, identity theft, and economic injuries stemming from the use biometric identifiers and biometric information by private entities. Notably, as a matter of state law, BIPA creates a private right of action for “[a]ny person aggrieved by a violation” of the outlined provisions. 740 ILL. COMP. STAT. § 14/20. B. Plaintiffs’ Complaint and Procedural Background Plaintiffs allege Apple violated sections 14/15(a)-(c) of BIPA by collecting, possessing, and profiting from their facial geometries and associated data, which qualify as biometric identifiers and biometric information (Doc. 1-1 at ¶¶ 1, 3). Facial recognition or “faceprinting” uses biological characteristics to verify an individual’s identity by extracting an individual’s face geometry data in order to confirm a subsequent match of the individual’s face (Id. at ¶ 44). Geometric attributes of faces include distance between the eyes, width of the nose, and other features (Id. at ¶ 75). Face geometry is a physiological characteristic and qualifies as a “biometric identifier” under BIPA (Id. at ¶ 26). Plaintiffs allege Apple’s Photos app employs a proprietary software and facial recognition technology to scan individual face geometries from a user’s photographs creating a unique “faceprint” for every person detected (Id. at ¶¶ 2, 27, 67, 77). Apple’s devices use facial recognition technology to add frequently detected faces to the user’s “People” album within the Photos app (Id. at ¶ 67). Further, Apple pre-installs the Photos app on all devices including phones, tablets, and computers, and the app cannot be removed or modified (Id. at ¶¶ 2, 64). This feature of the Photos app allegedly enables users to “recognize the people, scenes, and objects in [photographs]” and easily sort or find images of their “favorite subjects—the people in [their lives]” (Id. at ¶¶ 80, 81, 83). Plaintiffs also allege that the Photos app applies an algorithm to specifically identify the Apple device user, which creates biometric information as defined by BIPA (Id. at ¶ 101). Moreover, device users can “tag” and input names for each of the faces detected in the People album (Id. at ¶¶ 146, 147). Apple does not store or transfer all user biometric identifiers or biometric information on its servers, but rather, as Plaintiffs allege, on each Apple device locally in a facial recognition database in the solid-state memory on the device (Id. at ¶¶ 71, 105, 179). Plaintiffs allege this conduct presents an imminent threat of serious harm to Plaintiffs and the proposed class, as Apple does not delete the biometric data it collects on the devices, even discarded Apple devices (Id. at ¶ 130). Moreover, Plaintiffs cannot prevent their devices from collecting their unique and sensitive biometric data (Id. at ¶ 132). And because this information is stored on individual devices, Plaintiffs and the class members face the imminent threat of disclosure of their biometric data as the result of a data breach on any Apple device on which their biometric data is stored (Id. at ¶ 133). Each named Plaintiff is a resident of Illinois (Id. at ¶¶ 10-13). According to the Complaint, each named Plaintiff has used an Apple device to take or store photographs of themselves or others using the Photos app (Id. at ¶¶ 2, 143). Furthermore, each named Plaintiff had his or her facial geometry scanned from the photographs and their biometric data collected, stored, and used by Apple (Id. at ¶ 14). Apple is a California corporation conducting business throughout Illinois (Id. at ¶ 15). Plaintiffs assert three counts of BIPA violations, 740 ILL. COMP. STAT. §§ 14/15(a)- (c). In Count I, Plaintiffs claim Apple violated BIPA section 14/15(b) by collecting Plaintiffs’ and Class Members’ biometric identifiers and biometric information, including scans of facial geometry and related biometric information, without first notifying Plaintiffs in writing and obtaining informed consent (Id. at ¶¶ 162-164). In Count II, Plaintiffs assert Apple violated BIPA section 14/15(a) by possessing biometric identifiers and biometric information without creating and following a written, publicly available policy with retention schedules and destruction guidelines (Id. at ¶ 171). In Count III, Plaintiffs allege Apple violated BIPA section 14/15(c) by profiting from biometric identifiers and biometric information it possessed, through marketing and selling its devices based upon claims of photograph sorting technology (Id. at ¶¶ 179-181). Plaintiffs seek to represent a class consisting of all Illinois citizens whose faces appeared in one or more photos taken or stored on their own, or someone else’s, Apple device using the Photos app from March 4, 2015, until present (Id. at ¶ 153). On behalf of themselves and the putative class, Plaintiffs seek actual damages, statutory damages of $5,000 for each intentional and reckless violation of BIPA pursuant to 740 ILL. COMP. STAT. § 14/20(2), statutory damages of $1,000 for each negligent violation of BIPA pursuant to 740 ILL. COMP. STAT. § 14/20(1), an order enjoining Apple from further violating BIPA, attorneys’ fees and costs, and pre- and post-judgment interest (Id. at ¶ 42). In the motion before the Court, Apple argues that Plaintiffs have failed to state a claim under BIPA because: (1) the alleged scans of face geometry are derived from photos and not linked to identifiable individuals; (2) facial recognition takes place solely on the device; (3) Plaintiffs lack standing under Article III to pursue the section 15(a) claim in Count II; (4) Plaintiffs fail to allege that Apple sold or profited from biometric identifiers or biometric information; and (5) Plaintiffs fail to allege any factual support for an intentional or reckless violation of BIPA as necessary to sustain the request for enhanced statutory damages. The Court considers each of these arguments in turn. SUBJECT MATTER JURISDICTION UNDER CAFA On May 6, 2020, Apple removed the action from the Twentieth Judicial Circuit in St. Clair County, Illinois, to this Court under the Class Action Fairness Act (CAFA), 28 U.S.C. § 1332(d)(2) (Doc. 1). CAFA authorizes federal jurisdiction over class actions where: (1) any member of the proposed class is a citizen of a state different from any defendant (minimal diversity requirement); (2) the proposed class consists of more than 100 members; and (3) the amount in controversy is $5,000,000 or more, aggregating all claims and exclusive of interest and costs. See 28 U.S.C. §§ 1332(d)(2), 1332(d)(5)(B), 1332(d)(6). Here, minimal diversity of citizenship exists between the parties, as Plaintiffs are residents of Illinois, and Apple is a California corporation (Doc. 1-1 at ¶¶ 10-13, 15). Moreover, the proposed class involves more than the requisite 100 members, as Plaintiffs allege that the putative class includes “thousands of people” (Id. at ¶ 154). Finally, the amount in controversy requirement is satisfied. Plaintiffs seek statutory damages of $5,000 for each intentional and reckless violation of BIPA pursuant to 740 ILL. COMP. STAT. § 14/20(2) and damages of $1,000 for each negligent violation of BIPA pursuant to 740 ILL. COMP. STAT. § 14/20(1). Plaintiffs allege at least three separate BIPA violations in Count I-III and have asserted there are thousands of Class Members. Even assuming a class size of only 1,000, and without considering attorneys’ fees, the Complaint alleges possible damages of $5,000,000. The amount in controversy meets the required threshold. The Court will discuss subject matter jurisdiction specifically with regard to Article III standing in detail below. ANALYSIS The Court will first address Apple’s Article III standing argument raised in opposition to Count II. Additionally, the Court will evaluate Article III standing for Plaintiffs’ other two claims sua sponte. Finally, the Court will address Apple’s remaining arguments for 12(b)(6) dismissal. I. Article III Standing Jurisdiction must be established as a threshold matter, due to the nature and limits of federal judicial power. Steel Co. v. Citizens for a Better Environment, 532 U.S. 83, 94-95, 118 S.Ct. 1003, 140 L.Ed.2d 210 (1998). Without Article III standing, federal courts have no authority to resolve a case for want of subject matter jurisdiction. MAO-MSO Recovery II, LLC v. State Farm Mut. Auto. Ins. Co., 935 F.3d 573, 581 (7th Cir. 2019); see also Spokeo, Inc. v. Robins, 136 S.Ct. 1540, 1547, 194 L.Ed.2d 635 (2016). Article III standing requires: (1) plaintiffs to suffer an actual or imminent, concrete and particularized injury-in-fact; (2) a causal connection between the injury and the conduct complained of; and (3) a likelihood that the injury can be redressed by a favorable decision. Bryant v. Compass Grp. USA, Inc., 958 F.3d 617, 620-21 (7th Cir. 2020) (citing Lujan v. Defs. of Wildlife, 504 U.S. 555, 560-61, 112 S.Ct. 2130, 119 L.Ed.2d 352 (1992)). Bare procedural violations separated from any concrete harm do not satisfy the injury-in-fact requirement. Spokeo, 136 S.Ct. at 1549, 194 L.Ed.2d 635 (2016). The violation of a procedural right, conferred by a statute, may sufficiently constitute an injury-in-fact. Id. A statutory violation, however, must present “an ‘appreciable risk of harm’ to the underlying concrete interest [the legislature] sought to protect by enacting the statute.” Bryant, 958 F.3d at 621 (quoting Groshek v. Time Warner Cable, Inc., 865 F.3d 884, 887 (7th Cir. 2017)). A. Standing Under Section 15(a) of BIPA Apple claims that Plaintiffs fail to allege any particularized harm that resulted from Apple’s supposed failure to comply with section 15(a) of BIPA. Section 15(a) requires private entities that possess biometric data to develop, publish, and follow a written policy containing a retention schedule and destruction guidelines. Without a particularized harm, Apple avers that the allegations do not satisfy Article III standing (Doc. 20, pp. 14-15). Typically, the party that has removed a case to federal court, here Apple, has the burden to prove standing. Yet, after removing the case under CAFA, Apple now seeks to dismiss this claim for lack of standing. Despite this unusual positioning, the Court will review this argument, as a federal court must satisfy itself that it has jurisdiction over the claims that appear before it. Ruhrgas AG v. Marathon Oil Co., 526 U.S. 574, 577, 119 S.Ct. 1563, 143 L.Ed.2d 760 (1999). As cited by Apple, the Seventh Circuit’s recent decision in Bryant v. Compass Group USA, Inc. informs the discussion on subject matter jurisdiction over Plaintiffs’ claims under BIPA section 15(a) (Doc. 20, pp. 14-15). Bryant, 958 F.3d at 626. In Bryant, the Seventh Circuit resolved an important issue that divided several district courts concerning which BIPA violations give rise to a particularized and concrete injury for purposes of standing under Article III. Id. The Bryant court examined standing under sections 15(a) and 15(b) of BIPA. Id. at 619-20. The Seventh Circuit, applying the analysis from Justice Thomas’ concurring opinion in Spokeo, distinguished between the violation of personal and public rights. Id. at 624; see Spokeo, 136 S.Ct. at 1550-54, 194 L.Ed.2d 635 (2016). In Bryant, the plaintiff used a vending machine, owned and operated by the defendant, that scanned fingerprints to create user accounts for payment purposes. 958 F.3d at 619. The plaintiff asserted claims that the defendant never published a data-retention policy or guidelines for destroying biometric information, violating section 15(a), and that the defendant never obtained written consent in the collection of her fingerprints, violating 15(b). Id. In Bryant, the Seventh Circuit only evaluated a claim under the provision of section 15(a) requiring development of a publicly available written policy establishing a retention schedule and destruction guidelines. Id. at 626. Under this theory, the court held that the plaintiff did not sufficiently allege a concrete, particularized injury-in-fact resulting from the defendant’s failure to develop such a written policy. Id. The Bryant court found the duties conferred in this provision of section 15(a) are owed to the public generally, not to private individuals. Id. This is not to say that a plaintiff never has standing under section 15(a), just that a particularized harm stemming from a public duty must be sufficiently alleged. Id. at 622; see Miller v. Southwest Airlines Co., 926 F.3d 898, 902-03 (7th Cir. 2019) (union airline workers sufficiently alleged a concrete injury-in-fact under section 15(a) when they faced a potential material change in the terms and conditions of their employment with regards to clocking in with a fingerprint scanner). Because obligations imposed by section 15(a) are directed at the public as opposed to the individual, Article III standing under this provision “seems to hinge more on the relationship of the parties.” Stauffer v. Innovative Heights Fairview Heights, LLC, ---F.Supp.3d at ---, 2020 WL 4815960 *6 (S.D. Ill. Aug. 19, 2020). It appears the Seventh Circuit left open the possibility of Article III standing when a plaintiff does allege a particularized harm even when the duties imposed by a statute, as in section 15(a), are generally duties to the public. Importantly, the Bryant court only assessed a claim under the provision requiring development of a written policy with a retention schedule and destruction guidelines, not under the provision mandating compliance with the retention schedule and destruction guidelines. 958 F.3d at 626. As in Bryant, Apple’s purported failure to publicize a retention and destruction policy in violation of BIPA section 15(a) constitutes a public harm, not a harm particular to Plaintiffs. This violation, as Bryant illuminates, does not create the type of concrete, particularized injury necessary to satisfy Article III’s requirements. Therefore, the Court finds Plaintiffs lack standing to bring this claim in federal court. As a result, Plaintiffs’ claims under BIPA section 15(a) shall be remanded to the Circuit Court of St. Clair County. See Bergquist v. Mann Bracken, LLP, 592 F.3d 816, 819 (7th Cir. 2010) (“If some parts of a single suit are within federal jurisdiction, while others are not, then the federal court must resolve the elements within federal jurisdiction and remand the rest.”). Unlike Bryant, however, Plaintiffs also allege Apple’s failure to destroy biometric information, in violation of section 15(a), caused harm. Section 15(a) requires destruction of biometric data when “the initial purpose for collecting or obtaining such [data] has been satisfied or within 3 years of the individual’s last interaction with the private entity, whichever occurs first.” 740 ILL. COMP. STAT. § 14/15(a). After the Seventh Circuit decided Bryant, the Northern District of Illinois evaluated Article III standing in Cothron v. White Castle. In Cothron, the court hypothesized that the second part of section 15(a) requiring permanent destruction of biometric data, when the initial purpose has been satisfied or within three years of the individual’s last interaction with the private entity, could potentially create an individualized right; however, the court did not ultimately address that possibility because the plaintiff still worked for the entity collecting her biometric data. See Cothron v. White Castle, ---F.Supp.3d ---, 2020 WL 32505706 at *3 (N.D. Ill. 2020). In their Complaint, Plaintiffs allege Apple violated their right to have their personal data deleted, which makes Plaintiffs’ personal data vulnerable to hacking or other means of extraction (Doc. 1-1 at ¶¶ 110, 130, 133-38, 171, 174). Similar to Cothron, however, Plaintiffs do not allege that they have ceased use of the application or device collecting the biometric data. Thus, the initial purpose for collecting the data has not been satisfied, nor have three years passed since Plaintiffs last interacted with Apple or its devices. As such, Plaintiffs fail to describe a violation of the destruction requirements in section 15(a). B. Standing Under Section 15(b) of BIPA Continuing the Article III standing analysis, the Court undertakes an analysis of whether it has subject matter jurisdiction over Plaintiffs’ claims under section 15(b). In Bryant, unlike the claims asserted under section 15(a), the Seventh Circuit found that the plaintiff asserted a concrete, particularized injury, as required to satisfy Article III’s requirements with respect to her claim under section 15(b). Id. at 626. The Seventh Circuit also found that the obligations conferred in section 15(b) are owed to private individuals. Id. at 624-26. The court reasoned that, by failing to obtain written consent, the defendant “inflicted the concrete injury BIPA intended to protect against, i.e. a consumer’s loss of the power and ability to make informed decisions about the collection, storage, and use of her biometric information.” Id. at 627. Moreover, the court noted that a failure to adhere to the informed consent provision caused a concrete injury because the associated information was “substantive and personal” and may change a person’s actions with regard to how he or she uses the device. Id. at 626. Bryant sets out the analysis for Plaintiffs’ claims under section 15(b). Section 15(b) requires private entities to make specific disclosures and receive written informed consent from consumers before collecting or capturing their biometric information. 740 ILL. COMP. STAT. § 14/15(b). And Plaintiffs allege that Apple never requested or received informed consent before collecting face geometries from their photos within the Photos app. Apple’s purported violation of section 15(b) would create a concrete, particularized injury to Plaintiffs, as their power to make informed decisions about the collection and storage of their biometric data has been eroded. Accordingly, Plaintiffs have Article III standing for their claims under section 15(b). C. Standing Under Section 15(c) of BIPA While the Seventh Circuit has not addressed Article III standing for BIPA claims arising under section 15(c), the analysis directly follows the Bryant court’s approach to claims under section 15(a). Article III standing requires allegations of a particularized and concrete harm. Bryant, 958 F.3d at 624. A concrete injury does not necessarily mean a tangible harm. Id. The Spokeo Court further clarified that for a plaintiff’s injury to be particularized, the plaintiff must be affected in a personal and individual way. 136 S. Ct. at 1548. And, for a plaintiff’s injury to be concrete, the injury must be “de facto” and actually exist. Id. Section 15(c) prohibits entities in possession of a person’s or customer’s biometric identifiers or information from selling, leasing, trading, or otherwise profiting from that data. 740 ILL. COMP. STAT. § 14/15(c). Here, Plaintiffs allege that Apple violated section 15(c) by marketing and selling its devices based upon claims that its facial recognition technology could sort photographs, thus profiting from a person’s or customer’s biometric data (Doc. 1-1 at ¶ 181). Importantly, Plaintiffs do not allege that Apple sold or otherwise profited from their individual biometric data. Plaintiffs seem to generally allege that Apple profited from sales of its devices which include a facial recognition feature within the pre-installed Photos app. Plaintiffs’ allegations are devoid of any particularized or concrete injury. Plaintiffs do not, nor could they, claim to be personally or individually affected by Apple selling devices based on the facial recognition technology in its Photos app. Moreover, by its plain language, section 15(c) clearly prohibits profiting from “a person’s or a customer’s” biometric identifier or biometric information, not the general sales of devices equipped with facial recognition technology. Notably, even if BIPA sought to prohibit marketing campaigns or sales based on facial recognition technology, that prohibition would protect a right generally conveyed to the public, not an individual right, much like the public retention and destruction policy required through section 15(a). Under the Supreme Court’s guidance in Spokeo, as used by the Seventh Circuit in Bryant, Plaintiffs’ claim under section 15(c) does not satisfy the requirements of Article III standing. Plaintiffs have failed to demonstrate a concrete and particularized injury-in- fact resulting from Apple’s purported violation of section 15(c) of BIPA. Thus, this claim also will be remanded to the Circuit Court of St. Clair County. II. Motion to Dismiss under 12(b)(6) Because the remaining claim under BIPA section 15(b) is within the Court’s jurisdiction, the Court now turns to Apple’s remaining arguments in its motion to dismiss. The purpose of a motion to dismiss under Rule 12(b)(6) is to evaluate the adequacy of a complaint, not to determine the merits of the case or decide whether a plaintiff will ultimately prevail. Gibson v. City of Chicago, 910 F.2d 1510, 1520 (7th Cir. 1990). To survive a Rule 12(b)(6) motion, the plaintiff only needs to allege enough facts to state a claim for relief that is plausible on its face. Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 570 (2007). A plaintiff need not plead detailed factual allegations, but must provide “more than labels and conclusions, and a formulaic recitation of the elements.” Id. In deciding a motion to dismiss under Rule 12(b)(6), the Court accepts as true all well-pleaded facts in the complaint and draws all reasonable inferences in the plaintiff’s favor. Burke v. 401 N. Wabash Venture, LLC, 714 F.3d 501, 504 (7th Cir. 2013). Taken together, the factual allegations contained within a complaint must “raise a right to relief above the speculative level, on the assumption that all the allegations in the complaint are true (even if doubtful in fact).” Twombly, 550 U.S. at 555 (internal citations omitted). A. Biometric Identifiers and Biometric Information Apple argues that Plaintiffs fail to allege that Apple, the device, or the Photos app links the alleged scans of face geometry from photos to identifiable individuals (Doc. 20, p. 1). In Apple’s view, the purported facial templates do not qualify as biometric identifiers as defined by BIPA because they are anonymous and do not actually identify any individual (Id. at 7). According to Apple, the Illinois legislature chose to attach the word “identifier” to the word biometric to intentionally exclude data that does not identify an actual person (Id.). Apple further reasons that device users have a choice to “tag” and assign names to the albums within the People folder by inputting a name themselves and that Apple does not receive this information, even if it is personally identifying (Id. at 1).1 BIPA exhaustively defines what is a biometric identifier, along with providing 1 Apple distinguishes several BIPA cases relied on by Plaintiffs. Apple distinguishes Rivera v. Google, Inc. by emphasizing the fact that Google Photos created a set of biology-based measurements that were used to identify a person. (Doc. 20, p. 10). Further, Apple distinguishes Monroy v. Shutterfly because Shutterfly operates a database that stores individual names to suggest for people in users’ photographs, and only if no match is found, the user is prompted to enter a name. Apple argues Norberg v. Shutterfly, Inc. is also not comparable, as Norberg alleged Shutterfly used his personal face pattern to recognize and identify him in photographs posted to the photo sharing website. Apple separates this case from In re Facebook Biometric Info. Privacy Litig., because Facebook suggests an individual’s name to automatically tag them, and the program puts names on the faces in the photos (Id.). examples of what is not a biometric identifier, as follows: “Biometric identifier” means a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry. Biometric identifiers do not include writing samples, written signatures, photographs, human biological samples used for valid scientific testing or screening, demographic data, tattoo descriptions, or physical descriptions such as height, weight, hair color, or eye color. Biometric identifiers do not include donated organs, tissues, or parts as defined in the Illinois Anatomical Gift Act or blood or serum stored on behalf of recipients or potential recipients of living or cadaveric transplants and obtained or stored by a federally designated organ procurement agency. Biometric identifiers do not include biological materials regulated under the Genetic Information Privacy Act. Biometric identifiers do not include information captured from a patient in a health care setting or information collected, used, or stored for health care treatment, payment, or operations under the federal Health Insurance Portability and Accountability Act of 1996. Biometric identifiers do not include an X-ray, roentgen process, computed tomography, MRI, PET scan, mammography, or other image or film of the human anatomy used to diagnose, prognose, or treat an illness or other medical condition or to further validate scientific testing or screening. 740 ILL. COMP. STAT. § 14/10. Even though photographs are explicitly excluded from the definition of biometric identifier, several courts have determined that scans of photographs for facial geometry do qualify under the definition of biometric identifier. See Rivera v. Google, Inc., 238 F.Supp.3d 1088 (N.D. Ill. 2017); In re Facebook Biometric Information Privacy Litigation, 185 F.Supp.3d 1155 (N.D. Cal. 2016); Monroy v. Shutterfly, Inc., 2017 WL 4099846 (N.D. Ill. 2017). Apple argues, however, that these facial scans cannot qualify as biometric identifiers because Apple does not use the scans to actually identify a person (Doc. 20, p. 10). First, the Court is not convinced of Apple’s proposed reading of the statutory language regarding biometric identifiers. The definition of biometric identifier explicitly includes scans of face geometry, which Plaintiffs allege Apple collected without consent (Doc. 1-1 at ¶ 27). Apple reads the word “identifier” to exclude data that does not identify an actual person (Doc. 20, p. 7). This Court finds that interpretation too narrow. Each specific item on the list fits within the meaning of the term “biometric identifier.” The word “identifier” modifies the word “biometric” to signal that the types of data listed could be used to identify a person. See Rivera v. Google, Inc., 238 F.Supp.3d 1088 (N.D. Ill. 2017) (interpreting “biometric identifier” to mean a biology-based set of measurements that can be used to identify a person). This reading is supported by the legislative intent finding for BIPA, which reads “Biometrics are unlike other unique identifiers that are used to access . . . sensitive information. For example, social security numbers, when compromised, can be changed.” See 740 ILL. COMP. STAT. § 14/5(c). This language suggests that “biometrics” are a type of “identifier” different from other identifiers like social security numbers. Second, even if Apple’s proposed reading is correct, within the Complaint, Plaintiffs allege that the Photos app applies an algorithm to identify the device user (Doc. 1-1 at ¶ 101). Taken as true, at this stage, Plaintiffs sufficiently allege that the face scans qualify as biometric identifiers. Further, Apple argues BIPA’s definition of biometric information expressly excludes information derived from photographs. Apple cites to language in Monroy v. Shutterfly, Inc., stating that “[i]t is clear that the data extracted from Monroy’s photograph cannot constitute ‘biometric information’ within the meaning of the statute . . . ” 2017 WL 4099846 * 3 (N.D. Ill. 2017); (Doc. 20, p. 7). Notably, only one district court has concluded that facial scans from photographs are emphatically excluded within the definition of biometric information. However, as BIPA section 15(b) covers the collection, capturing, purchasing, receiving, or obtaining of “biometric identifiers or biometric information,” it is unnecessary at this stage to decide whether the facial scans qualify as biometric information, as this Court has already found that the facial scans qualify as biometric identifiers. 740 ILL. COMP. STAT. § 14/10 (emphasis added). Plaintiffs need only sufficiently allege that Apple collected one or the other to state a plausible claim for relief under section 15(b), and they have done so. B. Collection and Possession of Biometric Data Apple next argues that Plaintiffs fail to allege that Apple—as the manufacturer of Plaintiffs’ devices or licensor of software—ever actually collects, captures, possesses, or otherwise obtains any of the information at issue (Doc. 20, pp. 10-11). Apple considers Plaintiffs’ allegation that Apple “possesses the Biometric Data” collected through the Photos app and stored locally on users’ device to be speculative and conclusory (Id. at 11). Further, Apple argues only Plaintiffs own and control the devices and physical media that run the processes and generate the alleged scans of face geometry, and users choose to take and store photographs (Id. at 12). Apple also asserts the Complaint lacks allegations that Apple reserves the right to access a user’s photos or associated information (Id.). Apple disputes Plaintiffs’ theory that Apple is vicariously liable for the actions of the Photos app, as Apple’s “software agent” (Id.). Plaintiffs allege that Apple both “collected” and “possessed” their biometric data using proprietary software that Apple owned, exclusively controlled, and barred individual users from accessing, removing, or disabling (Doc. 1-1 at ¶¶ 75-79, 105-10). More specifically, Plaintiffs allege that Apple used its software to create, gather, and harvest faceprints, which Apple stored in facial recognition databases that Apple provided users no knowledge of, or control over, and Apple alone could access the biometric data or disable its collection (Id. at ¶¶ 32, 65-104). Plaintiffs assert that Apple is subject to BIPA liability from its collection and possession of Plaintiffs’ biometric data based on common law agency principles (Id. at ¶¶ 101-04). In furtherance of this theory, Plaintiffs allege that Apple’s software cannot be used as intended without biometric data automatically being collected, that device users had no ability to disable the collection (or notice of collection), and Apple prevents users from accessing, disabling, or altering the software (Id. at ¶¶ 85-87, 89-91, 142-52). Both parties correctly recognize that BIPA applies only to those entities “in possession” of or who “collect, capture, purchase, receive through trade, or otherwise obtain,” biometric identifiers and biometric information (Doc. 20, p. 10); 740 ILL. COMP. STAT. § 14/15. Apple urges the Court to adopt the definition of “collect” as “to gain or regain control of” (Doc. 20, p. 11). Plaintiffs urge the Court to interpret the word “collect” to mean “bring[ing] together [biometric data] into one body or place,” and the term “possess” to mean “taking [those data] into control.” (Doc. 24, p. 11). Under either definition, at this stage—taking all allegations as true and making all inferences in favor of Plaintiffs—the Court finds that Plaintiffs state a plausible cause of action to survive Apple’s 12(b)(6) motion to dismiss. Apple argues that many BIPA claims against equipment manufacturers and vendors have been dismissed due to failure to allege the manufacturer collected or used the biometric data in violation of BIPA (Doc. 20, p. 14). See Heard v. Becton, Dickinson & Co., 440 F.Supp.3d 960, 965-66 (N.D. Ill. 2020); Kloss v. Acuant, Inc., 2020 WL 2571901, at *3 (N.D. Ill. May 21, 2020); Namuwonge v. Kronos, Inc., 418 F.Supp.3d 279, 286 (N.D. Ill. 2019); Bernal v. ADP, LLC, 2019 WL 5028609, at *1-2 (Ill. Cir. Ct. Aug. 23, 2019). The cases Apple cites are distinguishable here. In those cases, the relationship between the plaintiff and the manufacturer was a third-party relationship— the manufacturers sold machines to employers or businesses who then had employees or customers use the devices, ultimately collecting their biometric data. In those cases, the intervening employer or business possessed and collected the biometric data, not the manufacturer of the device. Here, Apple’s relationship with the Plaintiffs is more direct. Apple sells devices directly to customers and, if what Plaintiffs allege is true, collects the biometric data into a facial recognition database on the device that Apple alone can access. Again, taking their allegations as true, Plaintiffs plausibly allege that Apple collected or possessed their data through the Photos app on their Apple devices, and that Apple alone can access the data stored within an internal database on their devices. Apple’s further discussion disputing Plaintiffs’ underlying theories of liability attempts to examine the merits of Plaintiffs’ case, which is inappropriate at this stage absent further discovery. As the facts develop, it may be that Apple cannot access any data stored on the device via its software or otherwise. Other fact issues can inform the application of BIPA, but the Court does not reach those issues yet. The Court accepts as true Plaintiffs’ allegations that Apple collected, possessed, and exercised exclusive control over the biometric data extracted from Plaintiffs’ photos within the Photos app, and that Apple did not obtain Plaintiffs’ consent in doing so. C. Intentional or Reckless Violations of BIPA Apple next argues that because Plaintiffs seek heightened statutory damages under BIPA, they must allege scienter supporting recovery for intentional and reckless conduct and have failed to do so (Doc. 20, p. 16). This argument has been raised in many BIPA cases. Section 20 of BIPA allows recovery for each violation: (1) against a private entity that negligently violates a provision of this Act, liquidated damages of $1,000 or actual damages, whichever is greater; (2) against a private entity that intentionally or recklessly violates a provision of this Act, liquidated damages of $5,000 or actual damages, whichever is greater; (3) reasonable attorneys’ fees and costs, including expert witness fees and other litigation expenses; and (4) other relief, including an injunction, as the State or federal court may deem appropriate. 740 ILL. COMP. STAT. § 14/20. Several courts have held that mental states need not be alleged for the purpose of stating a plausible claim under BIPA to survive a motion to dismiss. See Stauffer v. Innovative Heights Fairview Heights, LLC., ---F.Supp.3d at ---, 2020 WL 4815960 * 13-14 (S.D. Ill. 2020) (finding that mental state standards come into play when determining remedies, not at the pleading stage); Cothron v. White Castle System, Inc., ---F.Supp.3d at ---, 2020 WL 3250706 * 5 (N.D. Ill. 2020) (finding that overcoming a Rule 12(b)(6) motion does not require the plaintiff to plead facts that will determine the amount of actual damages possible to recover); Peatry v. Bimbo Bakeries USA, Inc., 2020 WL 919202 * 6 (N.D. Ill. 2020) (finding that Rule 8 does not require a plaintiff to plead damages with particularity but only requires a demand for relief sought); Neals v. PAR Technology Corp., 419 F.Supp.3d 1088, 1092 (N.D. Ill. 2019) (finding that under Rule 9(b), states of mind may be alleged generally, and Rule 8 does not demand that a plaintiff plead facts he or she would have no way of knowing prior to discovery). These courts have found that mental states go only to the damages recoverable for a given claim and can be proven later, but per the relevant pleading requirements plaintiffs may allege states of mind generally. Further, allegations that a defendant has made no effort to comply with BIPA’s requirements, even though BIPA has been in effect for over ten years, are enough, at the pleading stage, to make claims of negligence or recklessness plausible. Rogers v. BNSF Railway Co., 2019 WL 5635180 * 5 (N.D. Ill. 2019). But see Namuwonge v. Kronos, Inc., 418 F.Supp.3d 279, 286 (N.D. Ill. 2019) (dismissing the claim for damages based on intentional and reckless conduct because allegations were only sufficient to plausibly infer negligent conduct); Rogers v. CSX Intermodal Terminals, Inc., 409 F.Supp.3d 612, 618-19 (N.D. Ill. 2019). Plaintiffs allege that Apple continues to collect faceprints from Illinois residents in violation of BIPA more than eleven years after BIPA’s enactment (Doc. 1-1 at ¶¶ 21, 104). These allegations are sufficient to create an inference that the conduct was either negligent or reckless. As other courts have established, the states of mind with regard to BIPA only relate to possible recovery for each violation, which is not yet before the Court. Accordingly, Plaintiffs have sufficiently pled facts to state a cause of action under BIPA section 15(b). CONCLUSION For these reasons, the Motion to Dismiss (Doc. 19) filed by Defendant Apple Inc. is GRANTED in part and DENIED in part. Plaintiffs’ claims in Count II and III under BIPA sections 15(a) and (c) are REMANDED to the Twentieth Judicial Circuit, St. Clair County, Illinois, for lack of subject matter jurisdiction. Defendant Apple Inc.’s motion to dismiss under Federal Rule of Civil Procedure 12(b)(6) as to Count I is DENIED. IT IS SO ORDERED. DATED: November 12, 2020 TI g 2 NANCY J. ROSENSTENGEL Chief U.S. District Judge Page 24 of 24