Brown v. AS Beauty Group LLC

• Court: District Court, N.D. Illinois
• Decided: May 22, 2024
• Docket: 1:22-cv-07288
• Status: Unknown

Opinion

IN THE UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION

LaPrena Brown, individually and on behalf of all others similarly situated,

Plaintiff, Case No. 22 C 7288

v. Hon. LaShonda A. Hunt

AS Beauty Group LLC,

Defendant.

MEMORANDUM OPINION AND ORDER

Plaintiff filed this putative class action complaint asserting a cause of action for violation of Section 15(b) of the Illinois Biometric Information Privacy Act of 2008 (BIPA). Defendant moved to dismiss for lack of personal jurisdiction, or, in the alternative, for failure to state a claim for which relief can be granted. For the reasons that follow, Defendant’s motion [11] is denied. BACKGROUND Defendant AS Beauty Group LLC markets and sells beauty products through its website (www.coverfx.com). (Compl. ¶ 43, Dkt. 1). On the website, Defendant allows users to see how products might look on them through its “Virtual Try-On” feature. (Id. ¶ 44). When a user is viewing a product, Defendant’s website presents a button reading “TRY IT ON.” Upon clicking the button, “the website navigates to its Virtual Try-On page, which uses the user’s computer or phone camera to display, on [Defendant’s] website, a real-time image of themselves reflecting one of the various beauty products [Defendant] sells.” (Id. ¶ 46). There are two ways a potential customer can use the Virtual Try-on feature—live camera (through the user’s webcam) or by uploading a photo—but Plaintiff alleges both options functionally work the same way. (Id. ¶¶ 47- 48, 52). Virtual Try-On allows users to see Defendant’s products on their faces, “with the image moving and changing angles, in real time, to comport with the user’s facial movements and adjustments.” (Id. ¶ 48). The feature “is powered by proprietary technology which [Defendant] incorporates into its website in order to collect and process the user’s facial geometry . . . .” (Id.

¶ 50). “These facial-geometry scans are used to identify the shape and features of the user’s face to accurately, and virtually, overlay the beauty products onto the user’s facial image.” (Id. ¶ 52). In sum, Plaintiff alleges Defendant’s “website extracts the user’s biometric data, which is combined with data necessary to show [Defendant’s] beauty products on the user’s face, before that data is repackaged and sent back to the user’s device.” (Id. ¶ 55). Plaintiff further alleges Defendant did not inform users that Defendant’s Virtual Try-On tool would capture, transfer, or facilitate the processing and storage of their facial geometry, or obtain their consent before capturing and collecting such data. (Id. ¶¶ 56-57). Plaintiff asserts that Defendant “directs, markets, and provides its business activities throughout the State of Illinois, and makes its active commercial website available to residents of

Illinois.” (Id. ¶ 17). Additionally, Plaintiff maintains that “Defendant entered into contracts for the sale of goods with residents of Illinois that involved the knowing and repeated transmission of computer data over the Internet.” (Id.) Finally, Plaintiff claims “[t]his resulted in Defendant generating revenue from sales to residents of Illinois, as well as accepting payments from Illinois residents through the site and ultimately shipping products to Illinois.” (Id.) Plaintiff LaPrena Brown is a citizen of Illinois who used Defendant’s Virtual Try-On feature in June 2022 while at her home. (Id. ¶¶ 20, 36-37). Plaintiff alleges she was not informed that the Virtual Try-On tool would collect her biometric identifiers, and Defendant never obtained her consent to collect, transmit, store, or process her biometric information. (Id. ¶¶ 38, 40). LEGAL STANDARDS Federal Rule of Civil Procedure 12(b)(2) allows a defendant to move to dismiss for lack of personal jurisdiction. Plaintiff bears the burden of establishing a prima facie case for personal jurisdiction. Purdue Rsch. Found. v. Sanofi-Synthelabo, S.A., 338 F.3d 773, 782 (7th Cir. 2003)

(citing Hyatt Int’l Corp. v. Coco, 302 F.3d 707, 713 (7th Cir. 2002)). Where, as here, neither party has presented affidavits or other evidence relating to personal jurisdiction, the Court rules on the motion based on the allegations in the complaint, taking all allegations as true and drawing all reasonable inferences in the non-movant’s favor. Walker v. Walgreens Specialty Pharmacy, LLC, No. 21 C 5780, 2023 WL 5334609, at *4 (N.D. Ill. Aug. 18, 2023). Defendant has also moved to dismiss for failure to state a claim upon which relief can be granted under Federal Rule of Civil Procedure 12(b)(6). While a complaint need not include “detailed factual allegations,” a plaintiff must provide more than “labels and conclusions” or a “formulaic recitation of the elements of a cause of action.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007). In analyzing a motion to dismiss under Rule 12(b)(6), this Court must “accept all

well-pleaded facts as true and draw all reasonable inferences in the plaintiff’s favor.” White v. United Airlines, Inc., 987 F.3d 616, 620 (7th Cir. 2021). However, the court need not accept legal conclusions as true. Twombly, 550 U.S. at 555 (citing Papasan v. Allain, 478 U.S. 265, 286 (1986)). A claim must be facially plausible to survive a motion to dismiss. Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). A plausible claim is one that allows the court to “draw the reasonable inference that the defendant is liable for the misconduct alleged.” Id. Plausibility requires more than a “sheer possibility,” but does not rise to the level of probability. Id. DISCUSSION I. Rule 12(b)(2) – Lack of Personal Jurisdiction “A federal district court sitting in diversity applies the personal jurisdiction rules of the state in which it sits, and Illinois law allows personal jurisdiction over a defendant to the extent

permitted by the Due Process Clause, which authorizes personal jurisdiction over out-of-state defendants when they have sufficient minimum contacts with the forum state.” Henneberger v. Ticom Geomatics, Inc., 602 Fed. Appx. 352, 353 (7th Cir. 2015). “The nature of the defendant’s contacts with the forum state determines the propriety of personal jurisdiction and also its scope— that is, whether jurisdiction is proper at all, and if so, whether it is general or specific to the claims made in the case.” N. Grain Mktg., LLC v. Greving, 743 F.3d 487, 492 (7th Cir. 2014) (quoting Tamburo v. Dworkin, 601 F.3d 693, 701 (7th Cir. 2010)). Specific jurisdiction is appropriate where: (1) the defendant has purposefully directed its activities at the forum, and (2) the alleged injury “arise[s] out of or relate[s] to the defendant’s contacts” with the forum. Ford Motor Co. v. Montana Eighth Jud. Dist. Ct., 592 U.S. 351, 359 (2021) (quoting Bristol-Myers Squibb Co. v. Superior Ct. of Cal., San Francisco Cnty., 582 U.S. 255, 262 (2017)).1

Here, the Court finds that Plaintiff’s allegations are sufficient to establish that Defendant purposefully directs activities to Illinois. The fact that Defendant not only made its website available to Illinois residents, but also entered into contracts in Illinois, accepted payments for beauty products from Illinois residents, and shipped beauty products sold from its website to Illinois is sufficient to find that Defendant directed its activities toward Illinois. For example, in Illinois v. Hemi Group LLC, the Seventh Circuit held that a company that “maintained commercial websites through which customers could purchase cigarettes, calculate their shipping charges

1 Because Plaintiff’s brief in opposition focuses only on specific jurisdiction, the Court limits its discussion to that analysis. (Resp. at 4, Dkt. 18). using their zip codes, and create accounts,” and stated that it would ship to any state other than New York had shown it “stood ready and willing to do business with Illinois residents” such that personal jurisdiction was proper. 622 F.3d 754, 757-58 (7th Cir. 2010); see also Curry v. Revolution Labs, LLC, 949 F.3d 385, 399 (7th Cir. 2020) (establishing a website that conducts

sales and ships products to Illinois residents qualifies as purposefully directing activities to Illinois). Similarly, in Norberg v. Shutterfly, Inc., an out-of-state defendant who had been accused of violating BIPA was found to have “sufficient minimum contacts to establish specific personal jurisdiction without offending the notions of fair play and substantial justice,” where “Defendants offer[ed] their photo sharing and printing services to citizens of Illinois and ship[ped] their hard copy photographs and other products directly to their customers.” 152 F. Supp. 3d 1103, 1105 (N.D. Ill. 2015). Likewise, Plaintiff’s alleged injuries also arise out of the activities Defendant purposefully directed to Illinois. At least one other court in this district reached the same conclusion when faced with a similar question on nearly identical facts. See Kukovec v. Estée Lauder Cos., Inc.,

No. 22 C 1988, 2022 WL 16744196, at *4 (N.D. Ill. Nov. 7, 2022). The plaintiff in Kukovec was an Illinois citizen who used the virtual try-on feature on a cosmetic company’s website and alleged that the tool captured users’ facial geometry without informing them or obtaining their consent. Id. at *2. The court there denied Defendant’s motion to dismiss for lack of personal jurisdiction, holding that under those circumstances, defendant has purposely availed itself of the privilege of conducting business in Illinois, and the plaintiff’s BIPA injuries were related to the activities defendant directed toward Illinois. Id. at *3-4. Relevant here, the Kukovec court rejected defendant’s argument that the injury did not arise from its contact with Illinois: Defendant’s objection to jurisdiction is based on what it sees as a mismatch between the misconduct (implementation of the cosmetics try-on tool) and defendant’s forum contacts (selling cosmetics). But that is an overly narrow reading of Ford’s “arise out of or relate to” standard. The try-on tool is part of Estée Lauder’s cosmetics marketing and sales strategy. That’s why, as plaintiff notes, a customer who pulls up the try-on tool is also presented with “add to cart,” “add to bag,” and “send as a gift” buttons.

Id. at *4 (internal citations omitted). That reasoning applies equally to the case at bar, including Defendant here also placing an “add to cart” button when a user engages with the Virtual Try-On feature. (See Compl. ¶ 47). The Court therefore follows Kukovec in finding that that an injury from a BIPA violation involving a Virtual Try-On tool sufficiently relates to the sale of cosmetics to satisfy the specific jurisdiction test. The cases cited by Defendant do not persuade the Court otherwise, as none of the contacts in those cases were as robust as the instant suit. For example, in be2 LLC v. Ivanov, the Seventh Circuit found the defendant did not have sufficient contacts with Illinois where the only evidence was a “printout showing that just 20 persons who listed Illinois addresses had at some point created free dating profiles” on defendant’s website. 642 F.3d 555, 559 (7th Cir. 2011). That defendant did not enter into any transactions with Illinois residents, market products specifically in Illinois, or ship products to Illinois, as Defendant has here. In Gutierrez v. Wemagine.AI LLP, the court held it did not have personal jurisdiction over defendant because there was “no evidence that [defendant] purposefully directed any of its conduct toward Illinois, did any Illinois-specific shipping, marketing or advertising, or sought out the Illinois market in any way. No. 21 C 05702, 2022 WL 6129268, at *2 (N.D. Ill. Oct. 7, 2022) (emphasis added). Finally, in Gullen v. Facebook.com, Inc., the court found that the defendant’s two contacts with Illinois—registering to do business in Illinois and establishing a sales and advertising office in Illinois—were not related to plaintiff’s BIPA injuries from Facebook’s face geometry scans on photos uploaded to the site. No. 15 C 7681, 2016 WL 245910 (N.D. Ill. Jan. 21, 2016). Unlike Gullen, the BIPA violations arising from Defendant’s Virtual Try-On feature are directly related to its efforts to market and sell beauty products in Illinois. Indeed, the primary purpose of offering potential customers a virtual opportunity to see how the product looks on them is so that they will

be encouraged to purchase. Accordingly, the Court finds that Plaintiff has sufficiently alleged Defendant purposefully directed activities toward Illinois and her injuries are related to those activities, to establish specific personal jurisdiction over Defendant. Defendant’s motion to dismiss on this ground is therefore denied. II. Rule 12(b)(6) – Failure to State a Claim under BIPA A. Section 15(b) Section 15(b) of BIPA states that “[n]o private entity may collect, capture, purchase, receive through trade, or otherwise obtain a person's or a customer’s biometric identifier or biometric information,” unless it informs the user in writing that biometric data is being collected

or stored and the specific purpose and length of time for which the biometric data is being collected, stored, and used, and the user executes a written release. 740 ILCS 14/15(b). “Face geometry” is included within the definition of “biometric identifier.” 740 ILCS 14/10. The Court rejects Defendant’s argument that Plaintiff’s “allegations merely parrot the language of section 15(b) of BIPA, without providing any specifics as to how [Defendant] purportedly collects, retains, or controls biometric identifiers or biometric information.” (Mem. at 12, Dkt. 12). As noted above, Plaintiff alleges that the Virtual Try-On feature shows users their faces with Defendant’s products, “with the image moving and changing angles, in real time, to comport with the user’s facial movements and adjustments.” (Compl. ¶ 48). Moreover, the Virtual Try-On tool “is powered by proprietary technology which [Defendant] incorporates into its website in order to collect and process the user’s facial geometry . . . ” and “[t]hese facial-geometry scans are used to identify the shape and features of the user’s face to accurately, and virtually, overlay the beauty products onto the user’s facial image.” (Id. ¶¶ 50, 52). The process involves

Defendant’s “website extract[ing] the user’s biometric data, which is combined with data necessary to show [Defendant’s] beauty products on the user’s face, before that data is repackaged and sent back to the user’s device.” (Id. ¶ 55). Those allegations are more than adequate to state a claim for a violation of Section 15(b). Other cases considering Section 15(b) claims based on a cosmetic company’s virtual try- on feature have found similar allegations adequate to survive a motion to dismiss. See, e.g., Kukovec, 2022 WL 16744196, at *6 (denying dismissal based on allegations that the virtual try- on tool uses facial-geometry scans from a user’s uploaded picture or live camera and identifies “the shape and features of the user’s face in order to accurately overlay the virtual makeup product onto the image provided.”). The Kukovec court held that plaintiff’s Section 15(b) claims should

move forward, reasoning “[w]ith that description of the technology, it is reasonable to infer that collection of biometric data is necessary for it to work.” Id. In Theriot v. Louis Vuitton N. Am., Inc., the court reached a similar conclusion, explaining: Here, plaintiffs allege that [defendant] violated § 15(b) through its Virtual Try-On tool. The plaintiffs assert that [defendant] encourages its website visitors to use the Virtual Try-On tool, through which it collects their facial geometry. The plaintiffs’ allegations are sufficient to survive a motion to dismiss.

645 F. Supp. 3d 178, 183-84 (S.D.N.Y. 2022) (applying BIPA). Finally, in Powell v. Shisheido Ams. Corp., the court found plaintiff’s allegations that the virtual try-on tool on defendant’s website created a facial geometry map to show how makeup would look on the user’s face, “amount[ed] to a plausible allegation that Defendant actively captured and/or collected biometric identifiers.” No. 21 C 2295, 2022 WL 19914948, at *5-6 (C.D. Ill. Aug. 22, 2022). Plaintiff’s allegations here are similar to—and in some cases more detailed than—the allegations in those cases. Because the logic of those courts is persuasive, the Court declines to

narrowly construe Plaintiff’s complaint as containing conclusory allegation that do no more than recite the statutory language of BIPA.2 Defendant also asserts that Plaintiff’s claim should be dismissed because she failed to allege that the biometric identifier Defendant collected (i.e., facial geometry) was capable of identifying particular individuals. This is a closer question. Indeed, courts in this district have gone both ways. Defendant relies on Daichendt v. CVS Pharmacy, Inc., where the district court dismissed the plaintiffs’ Section 15(b) claims because they failed to allege that “defendant’s collection of their biometric data made defendant capable of determining their identities.” No. 22 C 3318, 2022 WL 17404488, at *5 (N.D. Ill. Dec. 2, 2022) (Gettleman, J.). In Clarke v. Aveda Corp., the court agreed that the collection of data using a virtual hair color tool “does not constitute

biometric identifier or biometric information without allegations that [defendant] was capable of identifying individuals who used” that tool. No. 21 C 4185, 2023 WL 9119927 at *2 (N.D. Ill. Dec. 1, 2023) (Rowland, J.). And in Castelaz v. Estee Lauder Cos., which involved a virtual cosmetic tool, the court cited both Daichendt and Clarke in concluding that the ability to ascertain identities is “the most foundational aspect of a BIPA claim.” No. 22C 5713, 2024 WL 136872 at *6-7 (N.D. Ill. Jan. 10, 2024) (Jenkins, J.) (citation omitted).

2 The Court also rejects Defendant’s contention that Plaintiff has failed to allege an “active step” to collect or capture Plaintiff’s biometric identifiers. (Mem. at 12). Putting a Virtual Try-On tool on a website that creates a geometric scan of users’ faces is in itself an active step. See, e.g., Powell, 2022 WL 19914948, at *5-6 (“Plaintiff’s allegation that [a face geometry] map was created through Defendant’s website amounts to a plausible allegation that Defendant actively captured and/or collected biometric identifiers”). However, the Court does not find support in the statute or policy rationale for this “narrower reading of BIPA’s broad language.” Konow v. Brink’s Inc., No. 23 C 760, 2024 WL 942553 at *4 (N.D. Ill. Mar. 5, 2024) (“This court is not certain that the ‘uniquely identifying’ test is supported by BIPA’s plain language.”). Section 15(b) plainly states that a private entity cannot

collect, capture, purchase, receive through trade, or otherwise obtain a person’s biometric identifier without appropriately informing them and securing a release. Defendant appears to concede that face geometry is a biometric identifier, and it is specifically included in the statutory definition. 740 ILCS 14/10. Furthermore, the nature of a “biometric identifier” is that it is capable of determining an individual’s identity, which is why the Illinois legislature felt compelled to draft BIPA to protect such information. See 740 ILCS 14/5(c) (“Biometrics are unlike other unique identifiers that are used to access finances or other sensitive information. For example, social security numbers, when compromised, can be changed. Biometrics, however, are biologically unique to the individual.”). There is no requirement to plead that the specific biometric identifiers in each case were especially

capable of being used to identify an individual. Thus, the only relevant question is whether Plaintiff adequately pled that Defendant collected, captured, or otherwise obtained Plaintiff’s face geometry through the Virtual Try-On feature. The Court has already determined that Plaintiff has met this standard. As in Kukovec, “[a]t this stage, it’s enough that plaintiff alleged the use of the try-on tool on defendant’s website, and that defendant possessed and collected biometric data through use of the tool.” 2022 WL 16744196 at *7. Defendant’s motion to dismiss on this ground is therefore denied. B. Heightened Damages Finally, Defendant argues that the allegations of recklessness are insufficient. The liquidated damages available under BIPA vary depending on a defendant’s mental state. A court may award up to $5,000 for each intentional or reckless violation but only up to $1,000 for each

negligent violation. 740 ILCS 14/20. In Kukovec, the court dismissed the claims for heightened damages, where no “facts in the complaint point to recklessness or intent—e.g., knowledge of BIPA’s requirements or statements about purposefully not complying with the law.” 2022 WL 16744196, at *8. Defendant cites another case reaching the same conclusion. Namuwonge v. Kronos, Inc., 418 F. Supp. 3d 279, 286 (N.D. Ill. Nov. 22, 2019). But the majority of recent cases that directly address this issue hold that a plaintiff is not required to make specific allegations about a defendant’s mental state to successfully plead a BIPA claim. See generally Kyles v. Hoosier Papa LLC, No. 20 C 7146, 2023 WL 2711608, at *7 (N.D. Ill. Mar. 30, 2023); Sosa v. Onfido, Inc., 600 F. Supp. 3d 859, 875 (N.D. Ill. 2022); Ibarra v. Prospera, LLC, No. 20 C 7015, 2021 WL 1921015, at *4 (N.D. Ill. May 12, 2021); Brandenburg

v. Meridian Senior Living, LLC, 564 F. Supp. 3d 627, 634 (C.D. Ill. 2021); Cothron v. White Castle Sys., Inc., 467 F. Supp. 3d 604, 615 (N.D. Ill. 2020); Snider v. Heartland Beef, Inc., 479 F. Supp. 3d 762, 770 (C.D. Ill. 2020). These cases reason that BIPA’s text makes mental state part of the remedy, which is governed at the pleadings stage by Rule 8(a)(3), not part of the claim governed by Rules 8(a)(2) and 12(b)(6). Rule 8(a)(3) merely requires that a pleading contain a “demand for the relief sought[.]” It does not require “a short and plain statement of the claim showing that the pleader is entitled to relief” like Rule 8(a)(2) or statement of “a claim upon which relief can be granted” like Rule 12(b)(6). See, e.g., Sosa., 600 F. Supp. 3d at 875. Thus, because mental states are relevant only for purposes of remedies under 740 ILCS 14/20, a plaintiff “need not plead facts (such as facts plausibly suggesting negligence, recklessness, or intentional conduct) that show .. . entitlement to these precise forms of relief.” /d. at 874. The Court agrees with the rationale of the majority of courts that have considered the issue. Rules 8 and 12 do not require Plaintiffs to plead specific facts regarding Defendant’s mental state to show entitlement to the forms of relief available under BIPA. Accordingly, the request for heightened damages will not be dismissed at this juncture of the case. CONCLUSION For all the foregoing reasons, Defendant’s Motion to Dismiss [11] is denied. Defendant is ordered to file an answer to the complaint by June 18, 2024. DATED: May 22, 2024 ENTERED: Addon da. J iseets LASHONDAA.HUNT United States District Judge