IN THE UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION CALY JILES, on behalf of himself and all others similarly situated, Plaintiff, Case No. 24 C 8122 v. Hon. LaShonda A. Hunt AU10TIX LTD., Defendant. MEMORANDUM OPINION AND ORDER Plaintiff Caly Jiles brings this putative class action against Defendant Au10Tix Ltd. based on its use of Illinois residents’ driver’s licenses and facial geometry in violation of the Illinois Driver’s License Law (“IDLL”),1 625 ILCS 5/6-117.1, and Illinois Biometric Information Privacy Act (“BIPA”), 740 ILCS 14/1-14/99. (Second Am. Compl. (“SAC”), Dkt. 39). Defendant has moved for dismissal under Rule 12(b)(2) for lack of personal jurisdiction, Rule 12(b)(6) for failure to state a claim based on both the extraterritoriality doctrine and consent, and Rules 12(f), 23(c)(1)(A), and 23(d)(1)(D) to the extent the IDLL claim is based on Illinois residents with non- Illinois driver’s licenses (Dkt. 41). For the reasons discussed below, Defendant’s motion to dismiss is denied, and as requested, Plaintiff is granted leave to amend the IDLL claim to add a proper named plaintiff.
1 The parties refer to the IDLL as the “Illinois Driver’s License Act” or “IDLA.” However, the Illinois Vehicle Code, which encompasses IDLL, expressly designates the short title of Chapter 6 as the “Illinois Driver Licensing Law,” so the Court will use the official short title chosen by the Legislature. 625 ILCS 5/1-100.The Illinois Vehicle Code later defines “Act” to also refer to the entire Code, so referring to Chapter 6 (IDLL) as the Act would also be incorrect and confusing. 1 I. BACKGROUND Defendant is a company that provides software-based identity verification, documentation authentication, and age verification services. (SAC ¶¶ 1, 23). At a very basic level, a user submits an identification document such as a driver’s license and a photo of themselves, and Defendant
analyzes and compares that information to databases to verify identity and age and authenticate documents. (Id. ¶¶ 2, 3, 24-32). As part of Defendant’s process, it also uses facial recognition technology that compares a user’s photo to the user’s identification document. (Id. ¶¶ 6, 52-61). In addition to verifying identity and authenticating documents for its clients, Defendant uses the information provided by users as “training data” to improve its own products and services. (Id. ¶¶ 4, 40-41). Defendant’s services are provided through its clients’ websites and mobile device applications. (Id. ¶¶ 1, 23). Some of Defendant’s clients are based in Illinois, and, in some instances, its software is sold to clients through a marketplace based in Chicago. (Id. ¶ 16). Defendant’s software includes Illinois driver’s licenses in the format profiles, uses Illinois
addresses as part of the identity verification process, and references Illinois’ laws in its policies. (Id. ¶¶ 17-20). The documentation and photos of users in Illinois are scanned in and provided by users in Illinois. (Id. ¶ 21). However, Defendant is not registered to do business in Illinois and has no registered agent, mailing address, employees, real estate, data servers or centers, or other operations or assets in the State. (Hershkovitz Decl., Dkt. 42-1). Plaintiff Caly Jiles is a resident of Illinois, who uploaded photographs of his driver’s license and his face through Defendant’s software in 2023 as part of an onboarding process for an online job marketplace called Fiverr, which is one of Defendant’s clients. (Id. ¶¶ 10-11, 62). Plaintiff brings this putative class action on behalf of himself and all others similarly situated against
2 Defendant asserting claims under the IDLL, (id. ¶¶ 78-88) and BIPA, (id. ¶¶ 89-98). According to Plaintiff, Defendant did not request or obtain users’ consent to use their information for the purpose of improving its own products and services. (Id. ¶ 42). Furthermore, Plaintiff contends that Defendant did not obtain users’ consent before obtaining their biometric information through the
facial recognition technology. (Id. ¶¶ 54-55). The SAC thus defines two putative classes: the “Information Class,” consisting of all Illinois residents who uploaded a photo of their driver’s license to Defendant; and the “Biometric Class,” consisting of all Illinois residents who had their facial geometry captured, collected, possessed, received, stored, otherwise obtained and/or used, by Defendant in Illinois. (Id. ¶ 72). Among other relief, Plaintiff seeks statutory damages of $250 for each violation of IDLL and $5,000 for each intentional and/or reckless violation of BIPA or, alternatively, $1,000 for each negligent violation of BIPA. (Id. at 407-409).2 II. LEGAL STANDARDS A. Rule 12(b)(2) Rule 12(b)(2) permits a party to assert lack of personal jurisdiction through a motion to
dismiss. Fed. R. Civ. P. 12(b)(2). At the pleadings stage, the plaintiff “need only make out a prima facie case of personal jurisdiction.” Purdue Rsch. Found. v. Sanofi-Synthelabo, S.A., 338 F.3d 773, 782 (7th Cir. 2003) (quoting Hyatt Int’l Corp. v. Coco, 302 F.3d 707, 713 (7th Cir. 2002)). In determining whether the plaintiff has met its burden, the Court must take all well-pleaded factual allegations as true and resolve any factual disputes in the plaintiff’s favor. Bilek v. Fed. Ins. Co., 8 F.4th 581, 589 (7th Cir. 2021). “[B]ut the court accepts as true any facts contained in the defendants’ affidavits that remain unrefuted by the plaintiffs.” ABN AMRO, Inc. v. Cap. Int’l Ltd.,
2 Unless otherwise noted, page numbers in citations to the docket reference “PageID #” in the CM/ECF header of the filing, not other page numbers in the header or footer of the document. 3 595 F. Supp. 2d 805, 818 (N.D. Ill. 2008) (quoting Interlease Aviation Invs. II (Aloha) L.L.C. v. Vanguard Airlines, Inc., 262 F. Supp. 2d 898, 904 n.3 & 905 (N.D. Ill. 2003)). Ultimately, the burden of establishing personal jurisdiction falls on the plaintiff. Advanced Tactical Ordnance Sys., LLC v. Real Action Paintball, Inc., 751 F.3d 796, 799 (7th Cir. 2014), as corrected (May 12,
2014). B. Rule 12(b)(6) Rule 12(b)(6) permits a party to move for dismissal based on a pleading’s “failure to state a claim upon which relief can be granted[.]” Fed. R. Civ. P. 12(b)(6). In determining whether a complaint states a claim under Rule 12(b)(6), courts must accept all non-conclusory factual allegations as true. Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). However, legal conclusions and “[t]hreadbare recitals of the elements of a cause of action, supported by mere conclusory statements, do not suffice.” Id. at 678 (citing Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007)). In addition, the Court must construe the complaint in the light most favorable to the plaintiff and draw all reasonable inferences in the plaintiff’s favor. Levy v. W. Coast Life Ins. Co., 44 F.4th 621,
626 (7th Cir. 2022). Applying these principles, a complaint will survive a motion to dismiss if it “states a plausible claim for relief.” Iqbal, 556 U.S. at 679 (citing Twombly, 550 U.S. at 556). To state a plausible claim for relief, a complaint must “permit the court to infer more than the mere possibility of misconduct[.]” Id. at 679. The movant has the ultimate burden to show that dismissal is warranted. Marcure v. Lynn, 992 F.3d 625, 631 (7th Cir. 2021). C. Rules 12(f), 23(c)(1)(A), and 23(d)(1)(D) Rule 12(f) permits the Court to “strike from a pleading . . . any redundant, immaterial, impertinent, or scandalous matter.” Fed. R. Civ. P. 12(f). Rule 23(c)(1)(A) requires that, “[a]t an early practicable time after a person sues or is sued as a class representative, the court must
4 determine by order whether to certify the action as a class action[,]” and Rule 23(d)(1)(D) authorizes the Court to “require that the pleadings be amended to eliminate allegations about representation of absent persons and that the action proceed accordingly[.]” Fed. R. Civ. P. 23(c)(1)(A) & 23(d)(1)(D). “The interplay of Rules 12(f), 23(c)(1)(A), and 23(d)(1)(D) empowers
the Court to dismiss or strike class allegations at the pleading stage.” Murdock-Alexander v. Tempsnow Emp., No. 16 C 5182, 2016 WL 6833961, at *3 (N.D. Ill. Nov. 21, 2016). III. DISCUSSION Defendant has moved for dismissal under Rules 12(b)(2) for lack of personal jurisdiction due to an absence of forum-related activities, 12(b)(6) for failure to state a claim under BIPA based on both the extraterritoriality doctrine and consent, and 12(f), 23(c)(1)(A), and 23(d)(1)(D) to the extent the IDLL claim is based on non-Illinois driver’s licenses. Having considered the arguments and relevant authorities, the Court finds that the allegations regarding personal jurisdiction and BIPA are sufficient and the IDLL claim may be amended to name a proper plaintiff. A. Personal Jurisdiction The law of a forum state applies where there is no federal statute authorizing nationwide
service of process, so Illinois law governs personal jurisdiction in this case. Tamburo v. Dworkin, 601 F.3d 693, 700 (7th Cir. 2010). Illinois’ long arm statute provides for jurisdiction to the full extent permitted by the Fourteenth Amendment’s Due Process Clause. 735 ILCS 5/2-209(c); Tamburo, 601 F.3d at 700. Under longstanding precedent, due process allows the court to exercise personal jurisdiction over an out-of-state defendant so long as it has “certain minimum contacts with it such that the maintenance of the suit does not offend ‘traditional notions of fair play and substantial justice.’” Int’l Shoe Co. v. Washington, 326 U.S. 310, 316 (1945) (quoting Milliken v.
5 Meyer, 311 U.S. 457, 463 (1940)). Under this guiding principle, there are two categories of personal jurisdiction: general and specific. Id. at 283 n.6. General jurisdiction exists only in “instances in which the continuous corporate operations within a state [are] so substantial and of such a nature as to justify suit . . . on causes of action
arising from dealings entirely distinct from those activities.” Daimler AG v. Bauman, 571 U.S. 117, 138 (2014) (quoting Int’l Shoe, 326 U.S. at 318). In other words, the analysis turns on ‘“whether that corporation’s “affiliations with the State are so ‘continuous and systematic’ as to render [it] essentially at home in the forum State.’” Daimler, 571 U.S. at 139 (quoting Goodyear Dunlop Tires Operations, S.A. v. Brown, 564 U.S. 915, 919 (2011)). It is undisputed that Defendant is not “at home” in Illinois. Indeed, Plaintiff does not contend that Defendant is subject to general jurisdiction in the state. Instead, Plaintiff argues that the Court has specific jurisdiction over Defendant because it intentionally collects and uses Illinois residents’ personal data, consciously designed its software to be compatible with Illinois driver’s licenses, intentionally uses Illinois addresses to confirm authenticity, and often has employees
examine Illinois licenses during manual review. In addition, Plaintiff maintains that his injuries arise from Defendant using his driver’s license data and obtaining his biometric information. “The inquiry whether a forum State may assert specific jurisdiction over a nonresident defendant ‘focuses on the relationship among the defendant, the forum, and the litigation.’” Walden v. Fiore, 571 U.S. 277, 284 (2014) (quoting Keeton v. Hustler Magazine, Inc., 465 U.S. 770, 775 (1984)). The Seventh Circuit has distilled Supreme Court precedent down to three essential elements that must be shown to exercise specific jurisdiction over an out-of-state defendant: “(1) the defendant has purposefully directed his activities at the forum state or purposefully availed himself of the privilege of conducting business in the state; (2) the alleged
6 injury arises out of or relates to the defendant’s forum-related activities; and (3) any exercise of personal jurisdiction must comport with traditional notions of fair play and substantial justice.” Rogers v. City of Hobart, Indiana, 996 F.3d 812, 819 (7th Cir. 2021) (citing Curry v. Revolution Lab’ys, LLC, 949 F.3d 385, 398 (7th Cir. 2020)). To date, courts have declined to apply any special
jurisdictional test for Internet-based cases, so the traditional due process inquiry applies. Curry, 949 F.3d at 398. 1. Purposeful Direction/Availment The requirement that a defendant purposefully direct activities toward or avail itself of the privilege of conducting business in a forum State “ensures that [it] will not be haled into a jurisdiction solely as a result of ‘random,’ ‘fortuitous,’ or ‘attenuated’ contacts, . . . or of the ‘unilateral activity of another party or a third person[.]’” Burger King Corp. v. Rudzewicz, 471 U.S. 462, 475 (1985) (quoting Keeton, 465 U.S. at 781; World-Wide Volkswagen Corp. v. Woodson, 444 U.S. 286, 299 (1980); Helicopteros Nacionales de Colombia, S.A. v. Hall, 466 U.S. 408, 417 (1984)). Thus, the Supreme Court and Seventh Circuit have repeatedly explained that
“the relationship must arise out of contacts that the ‘defendant himself’ creates with the forum State[,]” the “analysis looks to the defendant’s contacts with the forum State itself, not the defendant’s contacts with persons who reside there[,]” and the “plaintiff cannot be the only link between the defendant and the forum[;] [r]ather, it is the defendant’s conduct that must form the necessary connection with the forum State that is the basis for its jurisdiction over him.” Walden, 571 U.S. at 284-285; see also Advanced Tactical, 751 F.3d at 802. In Internet-based cases, the Seventh Circuit has “warned that ‘[c]ourts should be careful in resolving questions about personal jurisdiction involving online contacts to ensure that a defendant is not haled into court simply because the defendant owns or operates a website that is accessible in the forum state, even if that
7 site is ‘interactive.’” Advanced Tactical, 751 F.3d at 803 (quoting be2 LLC v. Ivanov, 642 F.3d 555, 558 (7th Cir. 2011)). The question of whether out-of-state Internet-based companies are subject to specific jurisdiction in Illinois for claims arising under BIPA and similar statutes is not new. On the one
hand, several district courts have found that specific jurisdiction exists where a defendant operates a website accessible in Illinois and targets activities such as marketing or completed sales toward Illinois. See, e.g., Dzananovic v. Bumble, Inc., No. 21 C 6925, 2023 WL 4405833, *3-4 (N.D. Ill. July 7, 2023) (Wood, J.) (finding that dating application company was subject to specific jurisdiction in Illinois for BIPA claims based on its use of facial recognition software because it “purposefully availed itself of the Illinois market for its dating app services by deliberately and continuously exploiting that market[,]” including through billboards, events, employees, and temporary physical locations and significant revenue); Howell v. Bumble, Inc., No. 21 C 6898, 2023 WL 6126492, at *10 (N.D. Ill. Sept. 19, 2023) (Jenkins, J.) (concluding that dating application company’s promotion of its product in Illinois satisfied purposeful availment prong of
the specific jurisdiction analysis in BIPA case); Crumpton v. Haemonetics Corp., 595 F. Supp. 3d 687, 696-698 (N.D. Ill. 2022) (Pallmeyer, J.) (holding that the defendant was subject to personal jurisdiction in BIPA action because it “deliberately entered into contractual and business arrangements to ensure that its software collected data in Illinois and that [defendant] itself hosted Illinois resident’s data on its servers.”); Kukovec v. Estee Lauder Cos., Inc., No. 22 C 1988, 2022 WL 16744196, at *4 (N.D. Ill. Nov. 7, 2022) (Shah, J.) (finding personal jurisdiction existed because “defendant was using its website (and the virtual try-on tool that appears on it) in order to purposefully avail itself of the Illinois cosmetics market.”); Mutnick v. Clearview AI, Inc., No. 20 C 512, 2020 WL 4676667, at *2 (N.D. Ill. Aug. 12, 2020) (Coleman, J.) (holding specific
8 jurisdiction existed where “defendants took biometric information from Illinois residents, created a surveillance database, and then marketed and sold licenses to use this database to entities in Illinois.”). On the other hand, many lower courts have concluded that operating a website accessible
in Illinois is not enough by itself to establish personal jurisdiction where the defendant has not otherwise targeted the State. See, e.g., Castelaz v. Estee Lauder Cos., Inc., No. 22 C 5713, 2024 WL 136872, at *4 (N.D. Ill. Jan. 10, 2024) (Jenkins, J.) (dismissing BIPA claims against virtual- try-on tool tech company that licensed its product to online retailer client with website accessible in Illinois because it had not directed or targeted any activity toward Illinois); Redd v. Amazon Web Servs., Inc., 673 F. Supp. 3d 943 (N.D. Ill. 2023) (Bucklo, J.) (dismissing BIPA action brought by Illinois plaintiff against out-of-state defendant arising from plaintiff’s use of a third-party facial recognition identity verification mobile application hosted on defendant’s servers and utilizing defendant’s image-recognition technology because registration to do business in Illinois, contacts with third-party, and lack of activities targeted to Illinois were insufficient to established specific
personal jurisdiction); Gutierrez v. Wemagine.AI LLP, No. 21 C 5702, 2022 WL 252704 (N.D. Ill. Jan. 26, 2022) (Durkin, J.) (dismissing BIPA action brought by Illinois plaintiff against Canadian defendant arising from plaintiff’s use of defendant’s photo-to-cartoon transformation mobile application because the only connection between defendant and Illinois was plaintiff and defendant had not purposefully directed any activities toward Illinois); Salkauskaite v. Sephora USA, Inc., No. 18 C 8507, 2020 WL 2796122, at *4 (N.D. Ill. May 30, 2020) (Wood, J.) (dismissing BIPA action brought against facial geometry technology company used by client at store in Illinois because there was no evidence the defendant targeted Illinois, only the client had); McGoveran v. Amazon Web Servs., Inc., 488 F. Supp. 3d 714, 722 (S.D. Ill. 2020) (dismissing BIPA action
9 brought against out-of-state provider of biometric voice technology because the defendant’s third- party client applied defendant’s technology to every caller, not just those in Illinois); Gullen v. Facebook.com, Inc., No. 15 C 7681, 2016 WL 245910, at *2 (N.D. Ill. Jan. 21, 2016) (Alonso, J.) (“Because plaintiff does not allege that Facebook targets its alleged biometric collection activities
at Illinois residents, the fact that its site is accessible to Illinois residents does not confer specific jurisdiction over Facebook.”). Several recent Seventh Circuit decisions reinforce these principles. First, in Illinois v. Hemi Group LLC, the court held that an out-of-state company with no physical presence in Illinois was subject to personal jurisdiction in part because it maintained “commercial websites through which customers could purchase cigarettes, calculate their shipping charges using their zip codes, and create accounts” and therefore “knowingly did do business with Illinois residents.” 622 F.3d 754, 757-758 (7th Cir. 2010). The same year, in a case involving digital services instead of physical goods, the court reversed the district court’s determination that it lacked personal jurisdiction, holding that the defendant Internet domain name registration website’s “extensive marketing in
Illinois and sales to Illinois customers,” showed that it had deliberately exploited the Illinois market, despite not having specifically targeted Illinois customers. uBID, Inc. v. GoDaddy Grp., Inc., 623 F.3d 421, 427-428 (7th Cir. 2010). Then, in a case reaching the opposite conclusion, the court found that an “Internet printout showing that just 20 persons who listed Illinois addresses had at some point created free dating profiles on be2.net” was insufficient to show that the defendant had deliberately targeted or exploited the Illinois market. be2 LLC v. Ivanov, 642 F.3d 555, 559 (7th Cir. 2011). Most recently, in Curry v. Revolution Laboratories, LLC, the court found that it had specific jurisdiction over an out-of-state defendant where online customers had selected an Illinois shipping address, defendant confirmed the Illinois address via email, and defendant
10 shipped products to Illinois. 949 F.3d at 399. Notably, in Curry, the defendant included Illinois in the “ship-to” options for customers to select on its website. Id. In addition, the court observed that “[t]here is no per se requirement that the defendant especially target the forum in its business activity; it is sufficient that the defendant reasonably could foresee that its product would be sold
in the forum.” Id. Here, Plaintiff alleges that Defendant’s software is designed to work specifically with the format of Illinois driver’s licenses, uses information provided by Illinois residents, including their addresses, and, in some instances, Defendant’s employees conduct a second level of analysis that involves reviewing Illinois residents’ licenses and information to verify their identities. As alleged, Defendant’s service is not merely an interactive website accessed by residents of Illinois. Rather, Defendant designed its services to be used by individuals with Illinois driver’s licenses, regularly provides such services to Illinois residents, and is aware that Illinois residents use the services because they provide their addresses. As uBID and Curry both instruct, the fact that Defendant targets residents of other states in the same manner is of no consequence because a defendant need
not specifically or especially target the forum state. uBID, 623 F.3d at 427-428; Curry, 949 F.3d at 399; see also Hemi, 622 F.3d at 758 (finding that defendant’s express election to do business with 49 states showed that it “stood ready and willing to do business with Illinois residents.”). In addition, although users sometimes initiate the identity verification process through third-party platforms like Fiverr, access to a defendant’s products or services through a third-party is not enough by itself to defeat jurisdiction. See Curry, 949 F.3d at 398 (noting that the defendant’s “sales of the allegedly infringing product to Illinois consumers all took place through either its interactive website or a third party’s website”). Thus, whether Defendant’s services were provided directly or through a client, “[c]haracterizing [such use] as unilateral is misleading . . . because it
11 ignores several of [Defendant’s] own actions that led up to and followed [Plaintiff’s use of its services].” Hemi, 622 F.3d at 758. Furthermore, for purposes of the personal jurisdiction analysis, the Court sees no meaningful difference between Defendant providing identity verification services to Illinois residents, and defendants shipping physical goods to customers in Illinois like
in Hemi and Curry. As such, Defendant’s contacts with Illinois are not random, fortuitous, or attenuated or a result of the unilateral activity of Plaintiff or Fiverr. Rather, Defendant itself seems to have deliberately designed its services to work with Illinois driver’s licenses to exploit the market and therefore could reasonably foresee that its services would be used in Illinois. Accordingly, Plaintiff’s allegations are sufficient to establish that Defendant purposefully targeted Illinois and its residents. 2. Relatedness The second element that must be shown to establish specific jurisdiction over a defendant is that “the plaintiff’s claims . . . ‘must arise out of or relate to the defendant’s contacts’ with the forum.” Ford Motor Co. v. Montana Eighth Jud. Dist. Ct., 592 U.S. 351, 359 (2021) (quoting
Bristol-Myers Squibb Co. v. Superior Ct. of California, San Francisco Cnty., 582 U.S. 255, 262, (2017)). To satisfy this prong, there need not be “a ‘strict causal relationship’ between the contacts and claims.” B.D. by & through Myer v. Samsung SDI Co., 91 F.4th 856, 862 (7th Cir. 2024) (quoting Ford, 592 U.S. at 362). But “when there is ‘no such connection [between the forum and the particular claims at issue], specific jurisdiction is lacking regardless of the extent of a defendant’s unconnected activities in the State.’” B.D. by & through Myer, 91 F.4th at 862 (quoting Bristol-Myers, 582 U.S. at 264). Plaintiff’s claims are based on Defendant’s use of information from driver’s licenses and photos containing facial geometry in connection with identity verification. As discussed above,
12 Defendant’s contacts with Illinois include setting up its services to accept Illinois driver’s licenses and its internal processes to take the information from such documents to verify users’ identities. Although Defendant disputes having sufficient minimum contacts with Illinois, it makes no effort to contest that Plaintiff’s claims “arise from or relate to” such contacts if they exist. For these
reasons, the Court has no trouble concluding that Plaintiff’s claims at the very least relate to Defendant’s contacts with the State. 3. Fair Play and Substantial Justice Last, the Court must ensure that the exercise of personal jurisdiction over Defendant “does not offend traditional notions of fair play and substantial justice.” Int’l Shoe, 326 U.S. at 316. “[W]here a defendant who purposefully has directed his activities at forum residents seeks to defeat jurisdiction, he must present a compelling case that the presence of some other considerations would render jurisdiction unreasonable.” Burger King Corp., 471 U.S. at 477. In making this determination, courts may evaluate: [T]he burden on the defendant, the forum State’s interest in adjudicating the dispute, the plaintiff’s interest in obtaining convenient and effective relief, the interstate judicial system’s interest in obtaining the most efficient resolution of controversies, and the shared interest of the several States in furthering fundamental substantive social policies. Id. at 477 (quoting World-Wide Volkswagen, 444 U.S. at 292) (internal quotations omitted); see also Curry, 949 F.3d at 402; Purdue Rsch. Found., 338 F.3d at 781. In weighing these factors, courts must consider whether the exercise of jurisdiction would create de facto universal jurisdiction. See Advanced Tactical, 751 F.3d at 801-803 (“if having an interactive website were enough in situations like this one, there is no limiting principle—a plaintiff could sue everywhere.”). Running counter to this principle, however, is the well-established rule that “[t]here is no per se requirement that the defendant especially target the forum in its business activity; it is 13 sufficient that the defendant reasonably could foresee that its product would be sold in the forum.” Curry, 949 F.3d at 399. Having carefully considered the relevant factors here, the Court concludes that Defendant has not presented a compelling case that the exercise of personal jurisdiction would offend
traditional notions of fair play and substantial justice or otherwise be unreasonable. Although it is true that Defendant’s services are accessible online globally, the Court finds this case distinct from Advanced Tactical because there is a limiting principle—Defendant itself set up its software to work with Illinois driver’s licenses and service Illinois residents and therefore could reasonably foresee that it would be used in the State. Turning to the other factors, the Court has not been presented with any convincing evidence that would lead it to believe that litigating here would create any extra burden on Defendant. Indeed, it appears that Defendant holds itself out as a sophisticated company providing services worldwide, so litigating here would be neither burdensome nor inconvenient. The plaintiff-focused factors also weigh in favor of exercising jurisdiction. Specifically, Illinois has a strong interest in providing its residents a forum for
adjudicating Illinois statutes such as IDLL and BIPA. See, e.g., Dzananovic, 2023 WL 4405833, at *7 (“Illinois has an interest in providing a forum for its residents . . . to seek redress for the collection of their biometric information in violation of BIPA, an Illinois statute.”). Accordingly, the Court has specific personal jurisdiction over Defendant. B. Extraterritoriality Under Illinois law, a “statute is without extraterritorial effect unless a clear intent in this respect appears from the express provisions of the statute.” Avery v. State Farm Mut. Auto. Ins. Co., 216 Ill. 100, 184-185 (2005) (quoting Dur-Ite Co. v. Industrial Comm’n, 394 Ill. 338, 350, (1946)). A violation “may be said to take place within a state if the circumstances relating to the
14 [violation] occur primarily and substantially within that state.” Avery, 216 Ill. at 188 (emphasis added). The question of extraterritoriality “is a highly fact-based analysis that is generally inappropriate for the motion to dismiss stage.” Vance v. Int’l Bus. Machines Corp., No. 20 C 577, 2020 WL 5530134, at *3 (N.D. Ill. Sept. 15, 2020) (citing Monroy v. Shutterfly, Inc., 2017 WL
4099846, at *6 (N.D. Ill. 2017); Rivera v. Google, Inc., 238 F. Supp. 3d 1088, 1101-1102 (N.D. Ill. 2017)). It is undisputed that BIPA and IDLL are not extraterritorial, and the Court has no reason to question this proposition. See Svoboda v. Amazon.com Inc., 168 F.4th 956, 959 (7th Cir. 2026). Accordingly, neither BIPA nor the IDLL apply to violations that occurred outside of Illinois. Still, Defendant argues that Plaintiff’s claims should be dismissed for failure to state a claim upon which relief can be granted under Rule 12(b)(6) because Plaintiff’s Illinois residency and physical presence in Illinois when uploading his driver’s license and photo are not enough to show that the violations occurred in Illinois. To the contrary, Defendant contends that once the license and photo were uploaded by Plaintiff, Defendant took no action in Illinois, so any violations could not have
occurred within the State. In response, Plaintiff first claims that the argument is premature and often not resolved at the pleading stage because it is fact intensive. Nonetheless, Plaintiff maintains that the circumstances relating to the violations occurred primarily and substantially in Illinois because consent (or lack thereof) occurs at the site where an aggrieved party is located, disclosures would have to have been provided in Illinois, and geographic location of servers, etc. is irrelevant for purposes of determining where biometric information is created, possessed, stored, or otherwise obtained. Given the fact-intensive inquiry required to fully evaluate the applicability of the extraterritoriality doctrine to a particular case, especially one involving complicated technical
15 issues about online biometric data transmission, the Court agrees that, at this stage in the proceeding, Plaintiff has plausibly alleged that the violations occurred primarily and substantially in Illinois because Plaintiff is a resident of Illinois and uploaded the license and photo from the State. See e.g., Freifeld v. Persona Identities, Inc., No. 24 C 5459, 2026 WL 1472770, at *5 (N.D.
Ill. Mar. 11, 2026) (Alonso, J.) (rejecting extraterritoriality argument regarding BIPA claim at pleading stage because “[t]he complaint does not—and need not—conclusively establish what happened with Plaintiff's biometric data in which state.”); Deyerler v. HireVue, Inc., No. 22 C 1284, 2025 WL 4109046, at *3 (N.D. Ill. Nov. 21, 2025) (Daniel, J.) (rejecting extraterritoriality argument for the second time in the case because such issues “are fact-specific and generally not amenable for resolution at the motion to dismiss stage.”); Davis v. Jumio Corp., No. 22 C 776, 2023 WL 2019048, at *6 (N.D. Ill. Feb. 14, 2023) (Wood, J.) (finding the allegations were “sufficient at the pleadings stage plausibly to allege that circumstances relating to the alleged BIPA violation occurred in Illinois” where Plaintiff contended that “he is an Illinois resident, that [defendant] conducts business[] transactions in Illinois, and that he submitted a photograph of his
driver’s license and photograph of his face on the [mobile app] from Illinois.”); Wilk v. Brainshark, Inc., 631 F. Supp. 3d 522, 528 (N.D. Ill. 2022) (“[C]ourts frequently find it premature to dismiss claims at the pleading stage based upon the extraterritorial doctrine given the doctrine’s fact- intensive inquiry.”). In fact, the Jumio case is nearly identical to this one, and the Court sees no logical reason to reach another conclusion. In the two main cases cited by Defendant, each court essentially found that the plaintiff’s allegations were repackaged allegations of residency and more detailed allegations regarding how the events occurred in Illinois were necessary. See Campana v. Nuance Commc’ns, Inc., No. 21 C 1241, 2024 WL 2809838, at *2 (N.D. Ill. Mar. 8, 2024) (Tharp, J.); McGoveran v. Amazon Web
16 Servs., Inc., No. 20 C 1399, 2024 WL 4626253, at *6 (D. Del. Oct. 30, 2024). The Court respectfully declines to follow those cases. Plaintiff has alleged that he resides in Illinois, initiated the identity verification process from Illinois, Defendant was set up to provide the services to him there, and the end of the process (i.e., the approval of Plaintiff’s identity verification) circles back
to Plaintiff. That is more than enough under Rules 8(a)(2) and 12(b)(6) to survive dismissal and proceed to discovery on the more complicated and nuanced technical aspects of determining whether the circumstances relating to the purported violations occurred primarily and substantially within Illinois. C. Prior Consent (BIPA Claim) Section 15(b) of BIPA states that “[n]o private entity may collect, capture, purchase, receive through trade, or otherwise obtain a person’s or a customer’s biometric identifier or biometric information, unless it first (1) informs the subject . . . in writing that a biometric [data] is being collected or stored; (2) informs the subject . . . in writing of the specific purpose and length of term for which a biometric [data] is being collected, stored, and used; and (3) receives a written
release executed by the subject of the biometric identifier . . . .” 740 ILCS 14/15(b). Defendant argues that Plaintiff’s BIPA claim should be dismissed under Rule 12(b)(6) because Fiverr obtained written consent for itself “and its service providers,” without expressly naming Defendant as such a provider. Plaintiff responds that each entity must obtain independent consent and, in any event, Fiverr’s consent provision was inadequate. In that regard, Plaintiff claims that the consent was not “informed” as required because Defendant was never identified by name. Starting with the statutory text, the Court agrees with Plaintiff that it applies individually to each entity that obtains a person’s biometric data. The statute states that “[n]o private entity may
17 collect, capture, purchase, receive through trade, or otherwise obtain a person’s or a customer’s biometric identifier or biometric information, unless it first” provides the subject certain written disclosures and receives a written release from the subject. 740 ILCS 14/15(b) (emphasis added). By referring specifically to a “private entity” and “it” the statute makes clear that each private
entity that obtains the data must comply with the disclosure and release provisions. Furthermore, by listing several ways in which an entity might obtain the data, including two which are not necessarily ways of obtaining the data in the first instance (i.e., purchasing or receiving through trade), the text implicitly contemplates situations such as this, where a consumer-facing entity (i.e., Fiverr) collects the data and a service provider (Defendant) receives the data through trade or otherwise obtains it. Indeed, if each entity is liable for its own violations, see Boyd v. Lazer Spot, Inc., No. 19 C 8173, 2022 WL 2863285, at *1 (N.D. Ill. July 20, 2022) (Lefkow, J.) (“each entity is liable for its own violations, ‘even if such violations occurred simultaneously or through use of the same equipment’ as the violations of another entity.”) (quoting Figueroa v. Kronos Inc., 454 F. Supp. 3d 772, 787 (N.D. Ill. 2020)), then why would each not be required to make its own
disclosures and receive its own consent? Thus, Plaintiff has plausibly alleged that any disclosure provided and release obtained by Fiverr was inadequate to satisfy the statutory requirements for Defendant. Several cases cited by Plaintiff are consistent with this conclusion. See Boyd, 2022 WL 2863285, at *1 (“BIPA creates a scenario where each entity’s violation gives rise to a claim; a plaintiff does not incur one, indivisible injury (e.g., a broken leg or lost cargo) caused by multiple defendants, but many individual injuries at the hands of many individual defendants who violated BIPA”); King v. PeopleNet Corp., No. 21 C 2774, 2021 WL 5006692, at *9 (N.D. Ill. Oct. 28, 2021) (Shah, J.) (BIPA “doesn’t excuse vendors like PeopleNet from securing their own waivers
18 before obtaining a person’s data.”); cf. Johnson v. NCR Corp., No. 22 C 3061, 2023 WL 1779774, at *5 (N.D. Ill. Feb. 6, 2023) (Ellis, J.) (concluding that biometric technology provider “may not escape liability under § 15(b) because it does not have a direct employment relationship with Plaintiffs.”).
Accordingly, based on both a plain reading of the statute and relevant case law, the Court concludes that the disclosure provided and release obtained by Fiverr did not obviate Defendant of its own obligations under Section 15(b) and therefore do not shield it from liability. D. Non-Illinois Driver’s License Holders (IDLL Claim) Section 6-117.1(a) of IDLL provides that: When information is obtained from a driver’s license to identify or prove the age of the holder of the license, or in the course of a commercial transaction, that information may be used only for purposes of identification of the individual or for completing the commercial transaction in which the information was obtained, including all subsequent payment, processing, collection, and other related actions. Information obtained from a driver’s license may not be used for purposes unrelated to the transaction in which it was obtained, including, but not limited to, commercial solicitations. Information obtained from a driver’s license to identify the holder of the license, or in the course of a commercial transaction, may not be sold, leased, or otherwise provided to any third party. 625 ILCS 5/6-117.1(a) (emphasis added). The Illinois Vehicle Code defines “driver’s license” as “[a]ny license to operate a motor vehicle issued under the laws of this State.” 625 ILCS 5/1-116.1 (emphasis added). Elsewhere, IDLL expressly refers to “any person who holds a valid Foreign State license,” 625 ILCS 5/6-101(b), and “a valid license issued to him in his home state[.]” 625 ILCS 5/6-102. In the definitions section, the Illinois Vehicle Code explains, that defined terms “shall . . . have the meanings respectively ascribed to them . . . , except when the context otherwise requires . . . .” 625 ILCS 5/1-101. 19 Reading Section 6-117.1(a) of the IDLL to create a cause of action for only individuals with driver’s licenses issued by Illinois and not other states, Defendants move to strike or dismiss Plaintiff’s IDLL claim to the extent it includes claims brought by Illinois residents with non- Illinois driver’s licenses. Critically here, Jiles, the named Plaintiff, was an Illinois resident with a
non-Illinois driver’s license at the time he provided his driver’s license to Defendant and Fiverr. In response, Plaintiff argues that (1) in the context of the entire Illinois Vehicle Code, IDLL Section 6-117.1(a)’s use of “a driver’s license” should be read to include new Illinois residents with non-Illinois driver’s licenses; (2) incorporation of the Driver License Compact into the IDLL, 625 ILCS 5/6 Art. VII, negates any issues regarding Illinois’ authority to pass laws restricting use of non-Illinois driver’s licenses; (3) differences between the IDLL and its sister statute, the Illinois Identification Card Act (IICA), wherein the IICA protects information on “an identification card issued by the Secretary of State[,]” 15 ILCS 335/14D(b), while the IDLL more broadly protects “[i]nformation obtained from a driver’s license[,]” 625 ILCS 5/6-117.1(a), should illustrate the meaning; and (4) alternatively, Plaintiff stands ready to amend the SAC to add an already-retained
client with an Illinois driver’s license provided to Defendant. Having considered the Illinois Vehicle Code, IDLL, and IICA, the Court agrees that Defendant’s reading is consistent with the plain meaning and context of the statute. By prohibiting the use of “[i]nformation obtained from a driver’s license” in certain circumstances, Section 6-117.1(a) of the IDLL protects only those with Illinois driver’s licenses and not Illinois residents with non-Illinois driver’s licenses. Starting with the text itself, “driver’s license” is expressly defined to include only licenses issued by Illinois. 625 ILCS 5/1-116.1. When the Legislature wanted to refer to driver’s licenses issued by other States, it used language indicating its intention to do so. 625 ILCS 5/6-101(b); 625 ILCS 5/6-102.
20 Furthermore, considering several other provisions of IDLL and the Illinois Vehicle Code, there are many uses of “a driver’s license” that would not make sense if the use were not referring exclusively to Illinois driver’s licenses. See, e.g., 625 ILCS 5/6-101(a) (defining “application process” to mean the “process of obtaining a driver’s license [that] begins when a person enters a
Secretary of State Driver Services facility . . . .”); 625 ILCS 5/6-109(a) (“The Secretary of State shall examine every applicant for a driver’s license . . . who has not been previously licensed as a driver under the laws of this State or any other state . . . .”). Similarly, there are other instances where the statute refers more broadly to “a valid license” that covers both Illinois and non-Illinois licenses. See 625 ILCS 5/6-101(a). Illinois’ adoption of the Driver License Compact, which aims to promote road safety by considering driver’s compliance with laws in other states, does not alter this conclusion. The “Applicability of Other Laws” provision confirms that the Compact does not affect the right of Illinois to apply its laws relating to licenses to any person; even so, it does not expand the scope of laws already on the books. 625 ILCS 5/6-705. Finally, Plaintiff’s comparison of the IDLL to the IICA is flawed. Although the
corresponding provision of the IICA refers specifically to “an identification card issued by the Secretary of State[,]” 15 ILCS 335/14D(b), while the IDLL more broadly protects “[i]nformation obtained from a driver’s license[,]” 625 ILCS 5/6-117.1(a), Plaintiff ignores that the applicable IDLL provision fits into the much larger statutory framework of the Illinois Vehicle Code, which contains its own definitions section and many other chapters for which similar terminology is applied. For these reasons, the Court finds that both the plain meaning of “a driver’s license” and context of the IDLL places non-Illinois licenses outside the scope of 625 ILCS 5/6-117.1(a). Nevertheless, Plaintiff’s alternative request to amend the IDLL claim to add a new named plaintiff who was an Illinois resident with an Illinois driver’s license at the time their driver’s
21 license was provided to Defendant will be granted. “The court should freely give leave when Justice so requires[,]” Fed. R. Civ. P. 15(a)(1)(2), such leave is routinely granted in instances similar to this, Phillips v. Ford Motor Co., 435 F.3d 785, 787 (7th Cir. 2006) (“Substitution of unnamed class members for named plaintiffs who fall out of the case because of settlement or other reasons is a common and normally an unexceptionable (“routine”) feature of class action litigation”), and Defendant’s cursory statement that further amendments would be futile lacks any development whatsoever and is therefore forfeited, John K. Maclver Inst. for Pub. Pol’y, Inc. v. Evers, 994 F.3d 602, 614 (7th Cir. 2021) (“A party who does not sufficiently develop an issue or argument forfeits it.”). Indeed, except for Defendant’s objection to the inclusion of Illinois residents with non-IIlinois driver’s licenses in the IDLL count, it makes no other arguments for dismissal of the claim. Thus, it appears that after Plaintiff amends the pleading to include a proper plaintiff for that count, Defendant will be ready to answer the operative complaint. IV. CONCLUSION For the reasons stated above, Defendant’s motion to dismiss is denied, except that the IDLL claim may be amended to add a proper named Plaintiff consistent with this ruling. DATED: June 10, 2026 ENTERED: Lodhorda A Hui LASHONDA A. HUNT United States District Judge