Citizens Insurance Company of America v. Wynndalco Enterprises, LLC

70 F.4th 987

• Court: Court of Appeals for the Seventh Circuit
• Decided: June 15, 2023
• Docket: 22-2313
• Status: Published

Opinion

In the

United States Court of Appeals For the Seventh Circuit ____________________ No. 22-2313 CITIZENS INSURANCE COMPANY OF AMERICA, Plaintiff-Appellant,

v.

WYNNDALCO ENTERPRISES, LLC, et al., Defendants-Appellees. ____________________

Appeal from the United States District Court for the Northern District of Illinois, Eastern Division. No. 20-cv-03873 — John Z. Lee, Judge. ____________________

ARGUED FEBRUARY 14, 2023 — DECIDED JUNE 15, 2023 ____________________

Before ROVNER, KIRSCH, and JACKSON-AKIWUMI, Circuit Judges. ROVNER, Circuit Judge. This business insurance coverage dispute calls on us to decide whether a broad catch-all provi- sion in a violation-of-statutes exclusion relieves the insurer of the duty to defend its insured in litigation over violations of Illinois’ Biometric Information Privacy Act (“BIPA”), 740 ILCS 141 et seq. After Wynndalco Enterprises, LLC was sued 2 No. 22-2313

in two putative class actions for violating BIPA, its business liability insurer, Citizens Insurance Company of America, filed this action seeking a declaration that it has no obligation under the terms of the insurance contract to indemnify Wynndalco for the BIPA violations or to supply Wynndalco with a defense. Citizens’ theory is that alleged violations of BIPA are expressly excluded from the coverage of the policy. Wynndalco counterclaimed seeking a declaration to the con- trary that Citizens is obligated to provide it with a defense in both actions. The district court entered judgment on the pleadings for Wynndalco, finding that the language of the catch-all exclusion is ambiguous on its face and that, constru- ing that ambiguity in favor of the insured, Citizens conse- quently had a duty to defend Wynndalco. 1 We agree with the

1 This is an issue that has divided the lower courts. Compare Thermoflex

Waukegan, LLC v. Mitsui Sumitomo Ins. USA, Inc., No. 21 C 788, 2023 WL 319235, at *5–*7 (N.D. Ill. Jan. 19, 2023), appeals filed, Nos. 23-1521 & 23-1578 (7th Cir. Mar. 20 & 27, 2023); Am. Family Mut. Ins. Co., S.I. v. Carnagio En- ters., Inc., No. 20 C 3665, 2022 WL 952533, at *6–*7 (N.D. Ill. Mar. 30, 2022); Citizens Ins. Co. of Am. v. Highland Baking Co., No. 20-cv-04997, 2022 WL 1210709, at *1 (N.D. Ill. Mar. 29, 2022); Citizens Ins. Co. of Am. v. Thermoflex Waukegan, LLC, 588 F.Supp.3d 845, 853–54 (N.D. Ill. 2022); Am. Family Mut. Ins. Co., S.I. v. Caremel, Inc., No. 20 C 637, 2022 WL 79868, at *4 (N.D. Ill. Jan. 7, 2022) (all rejecting arguments that similar catch-all exclusions un- ambiguously barred coverage for BIPA violations), with State Auto Prop. & Cas. Ins. Co. v. Fruit Fusion, Inc., — F.Supp.3d —, No. 3:21-CV-1132-NJR, 2022 WL 4549824 (S.D. Ill. Sep. 29, 2022); Continental W. Ins. Co. v. Cheese Merchants of Am., LLC, — F.Supp.3d —, No. 21-cv-1571, 2022 WL 4483886, at *9–*16 (N.D. Ill. Sep. 27, 2022); Westfield Ins. Co. v. Archer Advisors, LLC, No. 21 CH 1469 (Cook Cnty. Cir. Ct. Aug. 4, 2022) (unpublished transcript attached to Citizens Br. as Exhibit A); Mass. Bay Ins. Co. v. Impact Fulfillment Servs., LLC, No. 1:20 CV 926, 2021 WL 4392061, at *5–*7 (M.D.N.C. Sep. 24, 2021) (applying North Carolina law) (all concluding that similar catch-all exclusions barred coverage for BIPA violations). No. 22-2313 3

district court that the facial breadth of the catch-all provision gives rise to an ambiguity in the policy, in that the catch-all provision appears to nullify coverage that the policy else- where purports to provide. Citizens Ins. Co. of Am. v. Wynndalco Enters., LLC, 595 F.Supp.3d 668 (N.D. Ill. 2022). The narrowing construction that Citizens proposes to resolve that ambiguity is not supported by the language of the provision and does not, in fact, resolve the ambiguity. In view of what the district court described as the “intractabl[e] ambigu[ity]” of the provision, Citizens must defend Wynndalco in the two class actions. Id. at 676. I. The litigation that has given rise to this coverage dispute stems from a massive database of facial-image scans assem- bled by Clearview AI, an artificial intelligence firm that spe- cializes in facial recognition software. We accept as true the following factual allegations gleaned from the two com- plaints filed against Wynndalco. Clearview AI allegedly has extracted or “scraped” in ex- cess of three billion photographs of individuals from online social media, content-sharing, and digital payment platforms (including Facebook, Twitter, Instagram, TikTok, Snapchat, YouTube, Google Photos, LinkedIn, and Venmo); converted those images into biometric facial recognition identifiers us- ing proprietary algorithms; collected the original images and their biometric counterparts into its database; and paired those images with information as to where those images were found on the Internet. Clearview AI has also created a facial recognition application or “app” that allows a user to identify an individual by uploading a photograph of that person to the app. The app then allows the user to see other photographs of 4 No. 22-2313

that same person on the media platforms or websites where they appear, along with the identifying information (includ- ing their name, address, and other personal information) as- sociated with that individual. Thus, a user could take a pho- tograph of a stranger on the street and upload the image to the app, which converts the photograph into a biometric facial scan, and (assuming the individual’s photos and information are in Clearview AI’s database), determine who that person is, and access any number of additional photographs of and associated content (tweets, Facebook and Instagram posts, YouTube and TikTok videos, LinkedIn profiles, etc.) created by and about that individual. Clearview AI marketed the app to law enforcement agencies, among others. See Kashmir Hill, The Secretive Company That Might End Privacy As We Know It, NEW YORK TIMES (Jan. 18, 2020), available at https://www.ny- times.com/2020/01/18/technology/clearview-privacy-facial- recognition.html?. The Chicago Police Department, through its purchasing agent CDW-Government, gained access to the Clearview AI database and its facial-identification app by means of a two- year contract between CDW-Government and Wynndalco. Melissa Thornley and Mario Calderon are the respective lead, named plaintiffs in two putative class actions filed on behalf of themselves and other Illinois residents whose facial images have been collected and scanned into the Clearview AI database: Thornley, et al. v. CDW-Government, LLC, et al., No. 2020 CH 04346 (Cir. Ct. Cook Cnty. filed May 27, 2020); Calderon, et al. v. Clearview AI, Inc., et al., No. 1:20-cv-01296-CM (S.D.N.Y. filed Jul. 22, 2020). We shall refer to the two suits using their surnames. No. 22-2313 5

Wynndalco is an Illinois-based information technology services and consulting firm. The Thornley and Calderon com- plaints describe Wynndalco’s relationship with Clearview AI in two different ways. According to the Thornley complaint, Clearview AI was not able to sell access to its database and app directly to the Chicago Police Department because it was not an approved vendor for the department, whereas Wynndalco was an approved vender. Thus, CDW- Government contacted Wynndalco and entered into an ar- rangement pursuant to which Wynndalco would purchase the product from Clearview AI and then re-sell it to CDW- Government. Wynndalco proceeded to make the purchase from Clearview AI in December 2019 for the sum of $47,500, and then immediately re-sold the product to CDW- Government for $48,450.00. CDW-Government in turn re- sold the product to the Chicago Police Department for $49,875. By contrast, the Calderon complaint alleges that Wynndalco is Clearview AI’s agent and that Wynndalco li- censes and supplies the product to customers on Clearview AI’s behalf. The Calderon complaint alleges that on January 1, 2020, the Chicago Police Department, through its agent, CDW-Government, entered into a two-year, $49,875 contract with Clearview AI. Both suits allege that Wynndalco’s role in this transaction ran afoul of BIPA. Illinois became the first state in the nation to enact biometric data privacy legislation when it promul- gated BIPA. Broadly speaking, BIPA codifies an individual’s right of privacy in and control over his or her biometric iden- tifiers and biometric information. See Bryant v. Compass Grp. USA, Inc., 958 F.3d 617, 621 (7th Cir. 2020) (quoting Rosenbach v. Six Flags Entm’t Corp., 129 N.E.3d 1197, 1206 (Ill. 2019)). “[The Act] imposes numerous restrictions on how private 6 No. 22-2313

entities collect, retain, disclose and destroy biometric identifi- ers, including retina or iris scans, fingerprints, voiceprints, scans of hand or face geometry, or biometric information. Un- der the Act, any person ‘aggrieved’ by a violation of its provi- sions ‘shall have a right of action … against an offending party’ and ‘may recover for each violation’ the greater of liq- uidated damages or actual damages, reasonable attorney fees and costs, and any other relief, including an injunction, that the court deems appropriate.” Rosenbach, 129 N.E.3d at 1199– 1200 (quoting 740 ILCS 14/20). A violation of the statute as to one’s biometric information is sufficient in and of itself to ren- der an individual an “aggrieved person” entitled to pursue relief; he or she need not suffer an actual injury as a result of the violation. Id. at 1205–07. BIPA currently provides the broadest private right of action among the states that have adopted similar statutory protections for biometric data. See Molly DiRago, The Litigation Landscape of Illinois’ Biometric In- formation Privacy Act, American Bar Association Cybersecu- rity and Data Privacy Committee (Aug. 20, 2021), available at https://www.americanbar.org/groups/tort_trial_insur- ance_practice/committees/cyber-data-privacy/the-litigation- landscape/. The amended complaint in Thornley includes three counts directed against Wynndalco. 2 The first of these counts alleges that Wynndalco intentionally or recklessly violated section

2 The proposed class in the Thornley suit is comprised of all current Illinois citizens whose biometric identifiers or information were, at any time between December 13, 2019, and April 30, 2020, included in the Clear- view AI database as part of the product purchased by Wynndalco from Clearview AI, resold to CDW-Government, and then resold again to the Chicago Police Department. No. 22-2313 7

15(c) of BIPA, 740 ILCS 14/15(c), by profiting from the named plaintiffs’ and putative class members’ biometric identifiers or biometric information in the Clearview AI app database. Section 15(c) provides: No private entity in possession of a biometric identifier or biometric information may sell, lease, trade, or otherwise profit from a person’s or a customer’s biometric identifier or biometric information. 740 ILCS 14/15(c). The term “biometric identifier” is defined to include, among other attributes, “face geometry.” 740 ILCS 14/10. A second, unjust enrichment count in the Thornley com- plaint alleges that Wynndalco has unjustly benefitted from its publication of the class members’ biometric information, to the detriment of the named plaintiffs and the class. A third, invasion-of-privacy count alleges that Wynndalco’s publica- tion and exploitation of the plaintiffs’ biometric data amounted to an unauthorized intrusion upon their seclusion, causing them mental anguish. 3 The first amended complaint in Calderon includes a single count against Wynndalco. 4 It alleges that Wynndalco and its

3 Wynndalco attempted to remove the Thornley case to federal court, but we affirmed the district court’s assessment that, given the nature of the statutory violations alleged in that case, the plaintiffs lacked Article III standing to pursue relief in a federal forum, and the case was remanded to Illinois state court. Thornley v. Clearview AI, Inc., 984 F.3d 1241 (7th Cir. 2021). 4The proposed class in the Calderon suit is comprised of all individu- als who, while residing in Illinois, had their biometric identifiers or infor- mation captured, collected, or obtained by Clearview AI at any point (continued) 8 No. 22-2313

officers violated BIPA by capturing, collecting, storing and using the named plaintiffs’ and the other class members’ bio- metric identifiers and/or biometric information without, inter alia, their notice and permission in violation of section 15(b) of the Act, 740 ILCS 14/15(b). That section provides: No private entity may collect, capture, purchase, re- ceive through trade, or otherwise obtain a person's or a customer's biometric identifier or biometric in- formation, unless it first: (1) informs the subject or the subject's legally authorized representative in writing that a bio- metric identifier or biometric information is be- ing collected or stored; (2) informs the subject or the subject's legally authorized representative in writing of the spe- cific purpose and length of term for which a bi- ometric identifier or biometric information is being collected, stored, and used; and (3) receives a written release executed by the subject of the biometric identifier or biometric information or the subject's legally authorized representative At the time of the sale of the Clearview AI app to the Chi- cago Police Department, Wynndalco had business owner’s in- surance coverage through a policy issued to it by Citizens ef- fective from October 2, 2019, to October 2, 2020. Section II of

during the five years immediately preceding the filing of the Calderon complaint. No. 22-2313 9

the policy sets forth the liability coverage for the business. Section II(A)(1) provides liability coverage for, among other injuries, “personal and advertising injury,” R. 20-1 at 83, which section II(F)(14) defines, in relevant part, as an “injury, including consequential ‘bodily injury,’ arising out of one or more of the following offenses: … e. [o]ral or written publica- tion, in any manner, of material that violates a person’s right of privacy.” R. 20-1 at 100. Citizens does not dispute that Wynndalco’s conduct, as alleged in the Thornley and Calderon complaints, falls within the policy’s definition of “personal and advertising injury.” But Citizens contends that coverage of the Thornley and Calderon claims is barred by a catch-all provision in a policy exclusion barring coverage for injuries arising out of certain statutory violations. The exclusion in question provides as follows (with the catch-all provision highlighted): This insurance does not apply to: … q. Distribution of Material in Violation of Statutes “Bodily injury,” “property damage” or “per- sonal and advertising injury” arising directly or indirectly out of any action or omission that vi- olates or is alleged to violate: (1) The Telephone Consumer Protection Act (TCPA), including any amendment of or addi- tion to such law; or (2) The CAN-SPAM Act of 2003, including any amendment or addition to such law; or 10 No. 22-2313

(3) The Fair Credit Reporting Act (FCRA), and any amendment of or addition to such law, including the Fair and Accurate Credit Transac- tion Act (FACTA); or (4) Any other laws, statutes, ordinances, or reg- ulations, that address, prohibit or limit the printing, dissemination, disposal, collecting, recording, send- ing, transmitting, communicating or distribution of material or information. Policy § II(B)(1)(q) (bold emphasis in original; italicized em- phasis added), R. 20-1 at 91–92. Citizens contends that the in- jury alleged by the plaintiffs in both the Thornley and Calderon complaints constitutes a “personal or advertising injury” that arises, directly or indirectly, out of a violation of BIPA, which, in Citizens’ view, is a “law” or “statute” of the type referenced in the catch-all provision set forth in ¶ 4 of the exclusion. 5 After Wynndalco tendered the two complaints to Citizens and asked that it supply Wynndalco with a defense, Citizens filed this diversity action pursuant to 28 U.S.C. § 1332(a)(1), seeking a declaration pursuant to 28 U.S.C. §§ 2201 and 2202 that it has no duty to defend or indemnify Wynndalco (or its officers) in either the Thornley or the Calderon suit, invoking the catch-all provision of the violation-of-statutes exclusion. Wynndalco and its officers answered the complaint, denied the allegation that the injuries alleged in the Thornley and Cal- deron suits were not covered by the insurance policy, and filed a counterclaim pursuant to 28 U.S.C. § 1367, Count I of which

5The catch-all provision in the violation-of-statutes exclusion is the sole basis on which Citizens contends it has no duty to defend or indem- nify Wynndalco. See R. 20 at 8 ¶¶ 39–41. No. 22-2313 11

seeks a declaration that Citizens is, in fact, obligated to defend them against the Calderon suit. R. 59 at 27–29. Count II of the counterclaim alleged that Citizens had breached the insur- ance policy by refusing to provide a defense for the Thornley suit and the Calderon suit and seeks damages, including the attorney’s fees and costs Wynndalco has incurred in defend- ing against the two lawsuits. R. 59 at 29–31. Citizens answered the counterclaim and denied its allegations. On the parties’ cross-motions for judgment on the plead- ings, the district court entered judgment for Wynndalco, con- cluding that the catch-all is facially ambiguous and therefore not enforceable against Wynndalco. 595 F.Supp.3d 668. The court deemed it so because a literal reading of the expansive wording of that provision would preclude coverage not only for violations of privacy-related statutes like BIPA, but a num- ber of other statutory causes of action that the policy in the first instance purported to cover, including slander, libel, trademark, and copyright. Id. at 673–74. Given the ambiguity, the court turned to two interpretive canons, ejusdem generis and noscitur a sociis to determine whether a narrower reading of the catch-all might be warranted based on the types of stat- utes cited in the exclusionary provisions immediately preced- ing the catch-all. But those canons, the court concluded, did not resolve the ambiguity. In contrast to comparable policy language at issue in West Bend Mut. Ins. Co. v. Krishna Schaum- burg Tan, Inc., 183 N.E.3d 47 (Ill. 2021), the catch-all could not reasonably be interpreted to reach only statutes regulating methods of communication, given that the statutes specifi- cally cited as excluded from coverage were not limited to those regulating communication, as they were in Krishna Tan. Wynndalco, 595 F.Supp.3d at 674. Citizens proposed that the statutes singled out by name in the exclusion at issue here all 12 No. 22-2313

regulate privacy, but the court pointed out that the cited stat- utes regulate different forms of privacy, so there is no true commonality among them suggesting that the catch-all pro- vision should be read to reach only injuries resulting from vi- olations of privacy-regulating statutes. Id. at 674–75. Conclud- ing that the catch-all provision was thus “intractably ambigu- ous,” id. at 676, the district court concluded that Citizens had not affirmatively established that the claims against Wynndalco were excluded from coverage and held that Citi- zens had a duty to defend Wynndalco as to both the BIPA and common law claims, id. 6 II. We review the district court’s decision to enter judgment on the pleadings de novo. E.g., StarNet Ins. Co. v. Ruprecht, 3 F.4th 342, 346 (7th Cir. 2021). In doing so, we apply the same standard that we reference in reviewing a decision to grant a Rule 12(b)(6) motion to dismiss for failure to state a claim for relief. Mesa Labs., Inc. v. Fed. Ins. Co., 994 F.3d 865, 867 (7th Cir. 2021) (citing Landmark Am. Ins. Co. v. Hilger, 838 F.3d 821, 824 (7th Cir. 2016)). We therefore take the facts alleged in the pleadings in the light most favorable to the nonmoving party, and we will sustain the entry of judgment only if it is beyond doubt that the nonmoving party cannot prove facts sufficient to support its position and that the movant is entitled to relief. See id. (citing Hilger, 838 F.3d at 824); see also Scottsdale Ins. Co. v. Columbia Ins. Grp., Inc., 972 F.3d 915, 919 (7th Cir. 2020) (cit- ing Housing Auth. Risk Retention Grp., Inc. v. Chicago Housing

6Count II of Wynndalco’s counterclaim (seeking damages for Citi- zens’ refusal to defend Wynndalco) was subsequently dismissed without prejudice in order to facilitate the entry of final judgment. R. 121. No. 22-2313 13

Auth., 378 F.3d 596, 600 (7th Cir. 2004)). For purposes of the motion, the pleadings include not only the complaint, the an- swer, and counterclaims, but any written instruments at- tached thereto. Fed. R. Civ. P. 10(c); see Federated Mut. Ins. Co. v. Coyle Mech. Supply Inc., 983 F.3d 307, 312–13 (7th Cir. 2020); Adams v. City of Indianapolis, 742 F.3d 720, 729 (7th Cir. 2014). The parties agree that Illinois law governs this dispute and we have no reason to question them on this point: Apart from the fact that Illinois is the forum state, Wynndalco is an Illinois firm, and the injuries alleged in the two actions for which it seeks a defense arose from Wynndalco’s role in the sale to the Chicago Police Department of a product granting access to a database containing biometric identifiers and information be- longing to Illinois citizens. As this is a diversity case, our task is to resolve the substantive questions as we believe the Illi- nois Supreme Court would do. E.g., Newman v. Metro. Life Ins. Co., 885 F.3d 992, 1000 (7th Cir. 2018). To determine whether Citizens owes Wynndalco a duty to defend it in the Thornley and Calderon litigation, we compare the allegations of the Thornley and Calderon complaints with the relevant provisions of the insurance policy to determine whether the nature of the liability asserted falls within the scope of the policy’s cover- age. E.g., United Fire & Cas. Co. v. Prate Roofing & Installations, LLC, 7 F.4th 573, 579–80 (7th Cir. 2021). 7 The duty to defend is broader than the duty to indemnify, id. at 579, so the insurer must supply the insured with a defense so long as the facts

7 Unless otherwise noted, all of the cases cited in this opinion applied Illinois law. 14 No. 22-2313

alleged potentially fall within the scope of the policy, see id. at 580 (collecting cases). 8 Illinois regards the proper interpretation of an insurance policy as a question of law. Mashallah, Inc. v. W. Bend Mut. Ins. Co., 20 F.4th 311, 319 (7th Cir. 2021) (citing Sanders v. Ill. Union Ins. Co., 157 N.E.3d 463, 467 (Ill. 2019)). In examining the terms of the policy, the normal rules of contract interpretation ap- ply. Bradley Hotel Corp. v. Aspen Specialty Ins. Co., 19 F.4th 1002, 1006 (7th Cir. 2021) (citing Windridge of Naperville Condo. Ass’n v. Philadelphia Indem. Ins. Co., 932 F.3d 1035, 1039 (7th Cir. 2019)); Hess v. Estate of Klamm, 161 N.E.3d 183, 187 (Ill. 2020). Our primary goal is to ascertain and give effect to intentions of parties as expressed in the policy language. Bradley Hotel Corp., 19 F.4th at 1006; Hess, 161 N.E.3d at 187 (quoting Hobbs v. Hartford Ins. Co. of Midwest, 823 N.E.2d 561, 564 (Ill. 2005)). We construe the individual provisions of the policy not in iso- lation but as a whole, giving effect to each and every provi- sion whenever possible. E.g., Founders Ins. Co. v. Muñoz, 930 N.E.2d 999, 1004 (Ill. 2010). Provided there is no ambiguity in the contract terms, we will accord those terms their ordinary meanings and apply the policy language as written, so long as doing so would not conflict with public policy. Clarendon Nat’l Ins. Co. v. Medina, 645 F.3d 928, 933 (7th Cir. 2011) (citing Hobbs, 832 N.E.2d at 564); Muñoz, 930 N.E.2d at 1004. Absent some indication that the policy’s terms were intended to have

8 Because we conclude that Citizens does have a duty to defend Wynndalco, it is unnecessary for us to consider whether Citizens also bears a duty to indemnify Wynndalco, a separate question that is gener- ally considered premature to resolve unless and until the insured is held liable on the claim for which it seeks coverage. See, e.g., Am. Bankers Ins. Co. of Fla. v. Shockley, 3 F.4th 322, 331–32 (7th Cir. 2021). No. 22-2313 15

a technical connotation, we will also read the policy as an or- dinary, reasonable layperson purchasing such a policy would read them. I/N Kote v. Hartford Steam Boiler Inspection & Ins. Co., 115 F.3d 1312, 1317 (7th Cir. 1997) (collecting cases); see also Muñoz, 930 N.E.2d at 1004. Policy terms that purport to limit the insurance company’s liability are construed in favor of coverage, but only when the terms are ambiguous or susceptible to more than one reason- able interpretation. Medina, 645 F.3d at 933 (citing, inter alia, Hobbs, 823 N.E.2d at 564). Wherever possible, a court should construe a policy so as to harmonize its provisions and avoid reading an exclusion in such a way that it removes the cover- age explicitly provided elsewhere in the policy. Gen. Agents Ins. Co. of Am., Inc. v. Midwest Sporting Goods Co., 765 N.E.2d 1152, 1156 (Ill. App. Ct. 2002) (quoting Lincoln Logan Mut. Ins. Co. v. Fornshell, 722 N.E.2d 239, 242 (Ill. App. Ct. 1999)); see also Panfil v. Nautilus Ins. Co., No. 12 C 6481, 2013 WL 6670779, at *3 (N.D. Ill. Dec. 18, 2013), j. aff’d, 799 F.3d 716 (7th Cir. 2015); Perry v. Fidelity Nat’l Title Ins. Co., 48 N.E.3d 1168, 1173 (Ill. App. Ct. 2015); Yates v. Farmers Auto Ins. Ass’n, 724 N.E.2d 1042, 1045 (Ill. App. Ct. 2000); Jones v. Universal Cas. Co., 630 N.E.2d 94, 98–99 (Ill. App. Ct. 1994); Mosby v. Mut. Life Ins. Co. of N.Y., 92 N.E.2d 103, 107 (Ill. 1950) (“To [imply] in large and heavy print that the insurer is liable for total and permanent disability before age sixty, and then in smaller type and stand- ard inking below to use language which purportedly limits the insure[r]’s liability for total and permanent disability of which proof is made before age sixty is so misleading as to create an ambiguity which must be resolved in favor of the in- sured.”) (emphasis ours). 16 No. 22-2313

The latter point deserves some amplification. In some in- stances, the language of a policy exclusion may appear clear in isolation, but when compared with a separate policy provi- sion granting coverage for the same type of action or injury that the exclusion ostensibly reaches, an ambiguity arises, in that the exclusion appears to take away with one hand cover- age that the policy purports to give with the other. See Panfil, 799 F.3d at 721–22 (quoting Cherrington v. Erie Ins. Prop. & Cas. Co., 745 S.E.2d 508, 526 (W. Va. 2013)); see also Tews Funeral Home, Inc. v. Ohio Cas. Ins. Co., 832 F.2d 1037, 1045 (7th Cir. 1987) (per curiam), abrogated in part on other grounds, Nat’l Cy- cle, Inc. v. Savoy Reins. Co., 938 F.2d 61, 64 (7th Cir. 1991). The cases sometimes refer to this as the exclusion appearing to “swallow” the coverage that the policy purports to grant the insured. Wynndalco, 595 F.Supp.3d at 673; Fornshell, 722 N.E.2d at 242. Because the aim of policy interpretation is to give effect to all provisions of the policy and avoid whenever possible construing one provision in a way that tends to nul- lify another provision, a court when confronted with such an ambiguity must consider whether the reach of the “swallow- ing” exclusion can be deemed more narrow than its plain terms taken in isolation would otherwise suggest. Id.; see also Midwest Sporting Goods, 765 N.E.2d at 1156–57. If the ambigu- ity cannot be resolved in this way, it must be construed against the insurer and in favor of coverage. Panfil, 799 F.3d at 721. The plaintiff bears the burden in the first instance of show- ing that its claim falls within the coverage of the policy. E.g., Bradley Hotel Corp., 19 F.4th at 1006 (citing Addison Ins. Co. v. Fay, 905 N.E.2d 747, 752 (Ill. 2009). There is no dispute that Wynndalco has met that burden here. The parties agree that the injuries alleged in the Thornley and Calderon complaints No. 22-2313 17

qualify as “personal or advertising injur[ies]” in that a viola- tion of BIPA is a violation of privacy, and the policy defines “personal or advertising injury” to include, inter alia, the “[o]ral or written publication, in any manner, of material that violates a person’s right to privacy.” Policy § II(F)(14)(e), R. 20-1 at 100. The burden thus falls on Citizens to affirma- tively establish that an exclusion applies. Id. (citing Fay). “Ex- clusions are read narrowly and apply only if their application is clear and free from doubt.” Id. at 1006–07 (cleaned up); see also Zurich Am. Ins. Co. v. Ocwen Fin. Corp., 990 F.3d 1073, 1078 (7th Cir. 2021) (“a decision to excuse an insurer’s duty to de- fend based on an exclusionary clause in the contract ‘must be clear and free from doubt’”) (quoting Evergreen Real Estate Servs., LLC v. Hanover Ins. Co., 142 N.E.3d 880, 887 (Ill. App. Ct. 2019)); Gillen v. State Farm Mut. Auto. Ins. Co., 830 N.E.2d 575, 582 (Ill. 2005) (“a policy provision that purports to ex- clude or limit coverage will be read narrowly and will be ap- plied only where its terms are clear, definite, and specific”) (citing Nat’l Union Fire Ins. Co. of Pittsburg, Pa. v. Glenview Park Dist., 632 N.E.2d 1039, 1042 (Ill. 1994)). Citizens, of course, argues that BIPA is a statute that falls within the violation-of-statutes exclusion’s catch-all provision for acts or omissions that transgress “[a]ny other laws, stat- utes, ordinances, or regulations, that address, prohibit, or limit the printing, dissemination, disposal, collecting, record- ing, sending, transmitting, communicating or distribution of material or information,” (Policy § II(B)(1)(q)(4), R. 20-1 at 91– 92) in that BIPA governs the collection (“recording”) as well as the sale and transmission (“dissemination,” “sending,” “communicating” and “distribution”) of information, in this case biometric identifiers and information. There is no dispute 18 No. 22-2313

that a literal, plain-text reading of the catch-all provision would include BIPA violations. But we agree with the district court that a plain-text read- ing of the exclusion gives rise to an ambiguity with respect to what the policy does or does not cover. The Citizens policy purports, in the first instance, to provide liability coverage for a “personal and advertising injury,” which the policy defines broadly to include not only the oral or written publication of material that violates a person’s right of privacy (§ II(F)(14e)) but also, inter alia, the oral or written publication of material that slanders or libels a person or organization or disparages a person’s or organization’s goods, products or services (§ II(F)(14d)); the use of another’s advertising idea in one’s own “advertisement,” (§II(F)(14f)); and infringing upon an- other’s copyright, trade dress, or slogan in one’s own “adver- tisement” (§II(F)(14g)). R. 20-1 at 100. These are all injuries that are subject to, or potentially subject to, statutory causes of action. See 740 ILCS 145 (Illinois Slander and Libel Act); 815 ILCS 510/2(a)(8) (Illinois Uniform Deceptive Trade Practices Act provision defining deceptive trade practices to include commercial disparagement of another’s goods, services, or business); 15 U.S.C. § 1125(a) & (c) (Lanham Act provision for civil action seeking relief for false designation of origin, false or misleading description or representation of fact, and dilu- tion of distinctive mark by blurring or tarnishment); 17 U.S.C. § 501 (federal Copyright Act provision for civil action seeking relief for copyright infringement); 765 ILCS 1036/60 (Illinois Trademark Registration and Protection Act provision for civil suit seeking relief for trademark infringement). Reading the exclusion’s catch-all provision literally and broadly would es- sentially exclude from the policy’s coverage injuries resulting from all such statutory prohibitions, as they all have to do No. 22-2313 19

with the recording, distribution, and so forth of information and material. True, it would still leave non-statutory, com- mon-law claims within the coverage of the policy, including those for defamation. To that extent, a plain-text reading of the exclusion might not render the coverage promised earlier in the policy for “personal and advertising injuries” wholly il- lusory. But as the district court pointed out, such a reading would, as a practical matter, all but eliminate coverage for cer- tain claims that are largely, if not exclusively, statutory in na- ture (intellectual property claims in particular) and that the policy by its express terms otherwise purports to cover. Wynndalco, 595 F.Supp.3d at 673–74. For that reason, we agree with the district court that this conflict between the competing policy provisions granting and excluding coverage gives rise to an ambiguity: the broad language of the catch-all exclusion purports to take away with one hand what the policy pur- ports to give with the other in defining covered personal and advertising injuries. See First Mercury Ins. Co. v. Triple Location LLC, 536 F.Supp.3d 326, 333 (N.D. Ill. 2021), appeal dismissed, No. 21-1962, 2021 WL 5579015 (7th Cir. Oct. 13, 2021) (con- cluding that “stark incompatibility” between dueling provi- sions of policy purporting to grant and then exclude coverage for same type of injury resulted in ambiguity) (citing, inter alia, Yates v. Farmers Auto. Ins. Ass’n, supra, 724 N.E.2d at 1045); accord, Gibson v. First Mercury Ins. Co., — F.Supp.3d —, No. 3:21-cv-1522 (SRU), 2022 WL 4599153, at * 12 (D. Conn. Sep. 30, 2022) (Conn. law). Citizens, however, contends that the catch-all exclusion does not, properly understood, conflict with the provisions for coverage of a “personal and advertising injury” and that, consequently, there is no ambiguity. It reasons that if one ex- amines the nature of the statutory causes of action expressly 20 No. 22-2313

cited in the exclusion, just prior to the catch-all provision, one can infer that the exclusion applies only to statutory causes of action related to privacy. On this understanding, the reach of the catch-all exclusion is much more limited than its language would otherwise suggest and does not pose the prospect of swallowing the coverage that the definition of “personal and advertising injury” would otherwise provide. Citizens Br. 25– 29, 34–35. But note the sleight of hand here. The title heading of the exclusion refers broadly to “Distribution of Material in Viola- tion of Statutes,” and following the citation of four such stat- utes, the catch-all provision purports to exclude from cover- age a “personal or advertising injury” arising out of an act or omission that is alleged to violate “[a]ny other laws, statutes, ordinances, or regulations that address, prohibit or limit the printing, dissemination, disposal, collecting, recording, send- ing, transmitting, communicating or distribution of material or information.” (Emphasis ours.) No mention, and indeed no hint, of “privacy” appears anywhere in this language. Only if one looks beyond the facially expansive sweep of the catch- all provision and attempts to divine potential limiting clues from the nature of the statutes cited immediately prior to the catch-all provision might it be possible to arrive at the nar- rowing privacy gloss for which Citizens advocates. But to do that presumes that the language of the catch-all provision means something other than what its terms ordinarily would suggest on their face. This is inconsistent with Citizens’ em- phasis elsewhere in its opening brief that the language of the catch-all provision, including in particular the term “any,” should be given a broad construction. Citizens Br. 18–19; see also id. at 10 (noting its argument in favor of a broad interpre- tation of the provision in the district court). Indeed, the No. 22-2313 21

narrowing approach that Citizens takes to construing the lan- guage of the catch-all follows the ejusdem generis canon of con- struction, a canon that typically comes into play only if there is some doubt about the meaning of the terms used in a con- tract or statute, as Citizens itself agrees. Citizens Br. 12–13, 16, 34. See generally Garcia v. United States, 469 U.S. 70, 74–75, 105 S. Ct. 479, 482 (1984) (“the rule of ejusdem generis, while firmly established, is only an instrumentality for ascertaining the correct meaning of words when there is uncertainty”) (cleaned up); Tourdot v. Rockford Health Plans, Inc., 439 F.3d 351, 353–54 (7th Cir. 2006) (“Ejusdem generis provides guid- ance on how to interpret language where [the] meaning is not plain. … [I]t applies only when it is not possible to determine the meaning of the words unless one focuses on the context.”); id. at 354 (rejecting party’s effort to use ejusdem generis to cre- ate and then resolve ambiguity in policy language in order to avoid otherwise facially broad scope of exclusion for “any il- legal act”); cf. Continental W. Ins. Co. v. Cheese Merchants of Am. LLC, supra n.1, 2022 WL 4483886, at *11 (rejecting application of ejusdem generis to similar exclusionary provision: “[H]ere, the text does not seem particularly ambiguous. Quite the op- posite, it seems clear as a bell— and the clear message is that the provision sweeps broadly. The text is undoubtedly broad. But breadth is not the same thing as ambiguity.”). For these reasons, we agree with Wynndalco that the catch-all provision of the exclusion is ambiguous. A plain-text reading of that provision would swallow a substantial portion of the coverage that the policy otherwise explicitly purports to provide in defining a covered “personal or advertising in- jury,” and arguably all of the coverage for certain categories of wrongs—copyright infringement, to take one example— that are entirely statutory in nature. As a general matter, an 22 No. 22-2313

ambiguity should be resolved against the insurer and in favor of the insured. Newman v. Metro. Life Ins. Co., 885 F.3d 992, 999–1000 (7th Cir. 2018) (collecting cases). But we can now consider whether resort to textual canons, and in particular, ejusdem generis, results in a plausible, more narrow reading of the catch-all provision that would nonetheless encompass an injury resulting from a violation of BIPA, as Citizens urges. Ejusdem generis is a textual canon that seeks to clarify a broad or general term by looking to the specific items preced- ing that term for clues as to how that term should be con- strued. “Where general words follow specific words …, the general words are usually construed to embrace only objects similar in nature to those objects enumerated by the preced- ing specific words.” Yates v. United States, 574 U.S. 528, 545, 135 S. Ct. 1074, 1086 (2015) (plurality) (cleaned up); see also Poohbah Enters., Inc. v. Cnty. of Cook, 905 N.E.2d 781, 799 (Ill. 2009) (“Under the ejusdem generis doctrine, when a statutory clause specifically describes several classes of persons or things and then includes ‘other persons or things,’ the word ‘other’ is interpreted to mean ‘other such like.’”) (citing People v. Davis, 766 N.E.2d 641, 645 (Ill. 2002)). 9 “The interpretation is justified on the ground that, if the general words were given their full and ordinary meaning, the specific words would be superfluous as encompassed by the general terms. If the [drafter] had meant the general words to have their unre- stricted sense, it would not have used the specific words.” Id. (citing 2A N. Singer & J. Singer, SUTHERLAND ON STATUTORY CONSTRUCTION § 47:17, at 370–73 (7th ed. 2007)). So, for

9 The ejusdem generis doctrine, like its companion doctrine, noscitur a sociis, is used in the construction of contracts as well as statutes. See Krishna, 183 N.E.3d at 161. No. 22-2313 23

example, where a will leaves to a particular devisee “my fur- niture, clothes, cooking utensils, housewares, motor vehicles, and all other property,” the general phrase “all other prop- erty” will, absent contrary signals, be construed in light of the specific items previously named to include not all types of property, including real estate, but only other items of per- sonal property. A. Scalia and B. Garner, READING LAW: THE INTERPRETATION OF LEGAL TEXTS, at 199 (2012). We applied the canon in Pipefitters Welfare Educ. Fund v. Westchester Fire Ins. Co., 976 F.2d 1037, 1040–42 (7th Cir. 1992), to construe an insurance policy’s definition of a covered “per- sonal injury” as including, inter alia, a “wrongful entry or evic- tion or other invasion of the right to private occupancy.” (Empha- sis ours.) The question was whether a toxic spill for which the insured was allegedly responsible at least arguably qualified as an “other invasion of the right to private occupancy,” such that the insurance company was required to defend its in- sured against the victim property owner’s suit. The insured, of course, asserted that it did so qualify, given that the spill literally interfered with the owner’s occupancy of its prop- erty, even if the interference was unintentional and incidental to the mishap. The insurer, on the other hand, argued that the insured must have acted with the intent to deprive the prop- erty owner of his right to private occupancy in order for its act to fall within the scope of the catch-all phrase. The catch- all phrase, we observed, was “fairly general and elastic,” but “it d[id] not stand alone”: it was part of a definition that in- cluded the two more specific terms directly preceding the catch-all—"wrongful entry” and “eviction.” Id. at 1041. We therefore looked to those specific actions and what they en- tailed to decide whether, as the insurance company argued, an intent to deprive the property owner of his right to private 24 No. 22-2313

occupancy of the premises was an element of the catch-all phrase. We concluded that it was not: although the cases were clear that eviction required such an intent, there was no clear indication that wrongful entry did. [O]ne can commit a wrongful entry under Mis- souri and Illinois law without intending to de- prive the occupant of his right of occupancy. It follows—despite our understanding of the term “eviction”—that the principal of ejusdem gene- ris does not limit the catch-all phrase “other in- vasion of the right to private occupancy” to con- duct undertaken with a motive to possess or to deprive another of possession. Id. at 1042. So here, the question is whether the broad language of the catch-all provision can be given a more focused scope by lo- cating a common element among the four statutes cited just prior to the catch-all provision and imputing that same ele- ment to the catch-all provision itself. Again, Citizens’ theory is that each of the four statutes singled out by the exclusion regulates privacy in some way, and therefore we should con- strue the catch-all provision to reach only statutes that like- wise regulate privacy. As a starting point, we look to the Illinois Supreme Court’s decision in West Bend Mutual Insurance Company v. Krishna Schaumburg Tan, supra, which dealt with comparable exclu- sionary policy language. The insured in Krishna had been sued for violating BIPA by, among other things, disclosing the biometric information it had collected from its customers to an out-of-state vendor. As in this case, the insurance policies No. 22-2313 25

under review in Krishna provided liability coverage for an “advertising injury” or “personal injury,” both of which the policies defined to include an injury arising out of the “[o]ral or written publication of material that violates a person’s right of privacy.” But also as in this case, an exclusion in the policies specifically barred coverage for an advertising or personal in- jury arising out of a violation of two listed statutes, the Tele- phone Consumer Protection Act (TCPA) and the CAN-SPAM Act of 2003, and then concluded with a catch-all provision barring coverage for an advertising injury “arising directly or indirectly out of any action or omission that violates or is al- leged to violate … [a]ny statute, ordinance or regulation, other than the TCPA or CAN-SPAM Act of 2003, that prohibits or limits the sending, transmitting, communicating or distribu- tion of material or information.” (Emphasis ours.) The in- sured, relying on ejusdem generis, read the “other than” lan- guage of the catch-all provision to signify that the catch-all applied only to those statutes which, like the TCPA and CAN- SPAM Act, regulate methods of communication. The insur- ance company, on the other hand, argued that “other than” should be construed to mean statutes that were different from the TCPA and the CAN-SPAM Act, including in particular BIPA, which of course did not regulate modes of communica- tion. The Illinois Supreme Court began its analysis of the catch- all provision by noting that the exclusion bore the heading, “Violation of Statutes that Govern E-Mails, Fax, Phone Calls, or Other Methods of Sending Material or Information,” and all of the items listed in that heading were methods of com- munication. 183 N.E.3d at 60. Moreover, the two statutes ex- pressly identified in the exclusion both regulated methods of communication: the TCPA regulated telephone calls and 26 No. 22-2313

faxes, and the CAN-SPAM Act regulated emails. Id. Turning then to the catch-all provision, the court observed that the doctrine of ejusdem generis would suggest that the words “other than” should be construed to reference statutes which, like the TCPA and the CAN-SPAM Act, also regulated meth- ods of communication. Thus, to the extent the meaning of “other than” was unclear, resort to ejusdem generis counseled in favor of reaching the catch-all provision to exclude cover- age only for statutes “which regulate methods of communica- tion like telephone calls, faxes, and emails.” Id. at 61. “[S]ince the Act [BIPA] does not regulate methods of communication, the violation of statutes exclusion does not apply to the Act,” id. at 60, and the policies did not bar coverage for the com- plaint filed against the insureds alleging violations of BIPA, id. at 61. The insurer thus owed the insured a duty to defend them in the underlying lawsuit. Id. We distill Krishna’s analysis down to this rationale: Where a violation-of-statutes exclusion has a title or heading that points to a particular category of statutes, where the statutes expressly identified in the exclusion fall within that very same category, and where there is some doubt about the reach of a broad catch-all provision immediately following the ex- pressly-identified statutes, it is an appropriate application of ejusdem generis to construe the more general language of the catch-all provision as encompassing only that same category of statutes. Unfortunately, this rationale does not resolve the ambiguity presented by the violation-of-statutes exclusion in the Citizens policy. Although the policy exclusion in the Citizens policy is broadly similar to the one at issue in Krishna, there are certain important differences. First, in the Citizens policy, there is no No. 22-2313 27

language in the heading of the exclusion suggesting that only a certain category of statutes is implicated by the exclusion: the heading refers broadly to “Distribution of Material in Vi- olation of Statutes,” period, with no additional words sug- gesting that the exclusion is limited to statutes regulating methods of communication, privacy, or any other particular subject matter. For example, it is easy to imagine that the scope of the heading, coupled with the broad language of the catch-all provision, might include a violation of the Illinois Trade Secrets Act, 765 ILCS 1065/1, et seq., which deals with the misappropriation of proprietary commercial information rather than individual privacy. 10 Second, although the exclu- sion, as in Krishna, expressly identifies the TCPA and the CAN-SPAM Act as laws that are implicated by the exclusion, the Citizens exclusion also references the FCRA and FACTA as statutes that are implicated, and in contrast to the first two statutes, those additional statutes do not regulate methods of communication: the FCRA regulates the reporting of credit information, and FACTA, an amendment to FCRA, deals with the accuracy of consumers’ credit-related records. Third, the language of the catch-all provision here is broader, as it in- cludes not only the sending, transmitting, communicating or distribution of material or information, but also the printing,

10 We recognize, of course, that titles and headings play a limited role in the construction of a policy exclusion, and that terms used only in a heading cannot be invoked as a basis for expanding the scope of an exclu- sion. See Barth v. State Farm Fire & Cas. Co., 886 N.E.2d 976, 982–83 (Ill. 2008) (citing 2 Mark S. Rhodes, COUCH CYCLOPEDIA OF INS. LAW § 15:57, at 302 (2d rev. ed. 1984)); Pekin Ins. Co. v. Tovar Snow Professionals, Inc., 970 N.E.2d 534, 537 (Ill. App. Ct. 2012). Nonetheless, they are permissible in- dicators of the meaning of the text that follows them. See Scalia & Garner, READING LAW at 221. 28 No. 22-2313

dissemination, disposal, collecting, and recording of material or information. Citizens cites these differences as the spring- board for an argument that the reach of the catch-all provision is broader than the one at issue in Krishna and is expansive enough to encompass injuries resulting from a violation of BIPA. We agree with Citizens that these differences matter, at least to some degree. Plainly, it is not possible here as it was in Krishna to limit the exclusion to statutes regulating meth- ods of communication, given that the two statutes added to the list of those expressly covered by the exclusion are not ones that regulate any method of communication. Moreover, the additional terms added to the catch-all provision here, re- ferring to the “collecting,” “disposal,” and “recording” of ma- terial and information, arguably address something other than communication. As we have noted, Citizens argues the harmonizing factor among the statutes cited in its violation-of-statutes exclusion is that they all address privacy. If one were to put that gloss on the exclusion, one could readily read the catch-all provi- sion as reaching injuries arising out of a violation of BIPA, which protects the secrecy of one’s biometric information by regulating, among other things, the collection, recording and dissemination of such information. But other injuries, like those stemming from slander and libel, copyright infringe- ment, and trademark and trade dress infringement would re- main untouched by the exclusion and thus within the scope of liability coverage, on this understanding of the exclusion. Reading the exclusion to apply solely to injuries resulting from violations of statutes that protect privacy interests thus No. 22-2313 29

avoids the problem of the exclusion swallowing the policy’s coverage provisions for “personal and advertising injuries.” Yet, as the district court pointed out, the statutes listed in the exclusion encompass two distinct types of privacy: seclu- sion and secrecy. 595 F.Supp.3d at 675; see Am. States Ins. Co. v. Capital Assocs. of Jackson Cnty., Inc., 392 F.3d 939, 941 (7th Cir. 2004). Seclusion is the right to be left alone. Auto-Owners Ins. Co. v. Websolv Computing, Inc., 580 F.3d 543, 549 (7th Cir. 2009) (applying Iowa law, but referencing Illinois law); Krishna, 183 N.E.3d at 58; Valley Forge Ins. Co. v. Swiderski El- ecs., Inc., 860 N.E.2d 307, 317 (Ill. 2006); Benitez v. KFC Nat’l Mgmt. Co., 714 N.E.2d 1002, 1033 (Ill. App. Ct 1999). Statutes regulating phone calls, faxes, and emails address that type of privacy by imposing restrictions on these methods of commu- nication when the individual has not consented to receive them. See Websolv Computing, 580 F.3d at 549; Capital Assocs., 392 F.3d at 941, 942. Secrecy, on the other hand, is the right to maintain the confidentiality of one’s personal information. See Websolv Computing, 580 F.3d at 549; Krishna, 183 N.E.3d at 58. The FCRA and FACTA address the secrecy of one’s credit and other personal identifying information by regulating how that information is reported. See Websolv Computing, 580 F.3d at 549; Krishna, 183 N.E.3d at 58. BIPA would fall into this same secrecy-related subset of statutes regulating privacy in- terests, as it regulates how one’s biometric information may be collected, retained, and shared with others. See Krishna, 183 N.E.3d at 58. Our decision in Capital Associates, 392 F.3d at 941–43, notes the distinctions between these two different types of privacy and admonishes courts to take care in distin- guishing between them as they evaluate in what sense an in- surance policy may be using the term “privacy.” Thus, only by referencing privacy at a high level of generality can one 30 No. 22-2313

find a common thread among these statutes—one that would encompass privacy in multiple forms (seclusion in some cases and secrecy in others) and addressing distinct interests. We are not convinced that ejusdem generis can resolve the ambiguity presented by the exclusion in this way. As we noted earlier, there is nothing in the language of the exclu- sion—be it in the title or in any of the provisions that follow— which points to privacy as the focus of the exclusion. And a proper application of the ejusdem generis canon looks for a readily discernible theme among the specific items cited in a provision that in turn suggests how the broad language that follows should be construed. Scalia & Garner, READING LAW, at 199. Here there is no readily discernible theme—certainly nothing, as the district court noted in the Cheese Merchants case, that “jumps off the page,” 2022 WL 4483886, at *11, as a common characteristic uniting the four statutes listed in the exclusion, see id., at *11–*13. True, at a very high level of gen- erality, one might describe all four statutes as bearing on in- dividual “privacy,” id. at *13, but that would not be obvious to the type of layperson or business purchasing this policy, given the different ways in which the statutes operate to pro- tect the two distinct categories of privacy interests we have discussed. In this respect, the exclusion here stands in marked contrast to the one at issue in Krishna, where the wording of the exclusion’s heading indicated that it was statutes regulat- ing methods of communication that were implicated by the exclusion and the two statutes specifically named by the title fell neatly into that very category of laws. There are no such textual clues to guide the reader to the privacy gloss for which Citizens advocates here. Only by engaging in a relatively so- phisticated and nuanced examination of the four statutes sin- gled out by the exclusion and the interests they protect might No. 22-2313 31

one be able to identify generic privacy as a theme that unifies those statutes and infer that the catch-all provision, notwith- standing its sweeping language, should be limited to other statutes that likewise address some aspect of personal pri- vacy, be it seclusion, secrecy, or some other form of privacy. 11 That gives the ejusdem generis canon entirely too much work to do. The noscitur a sociis textual canon fails to resolve the ambi- guity posed by the catch-all provision for the same reasons. “[T]he principle of noscitur a sociis—a word is known by the company it keeps—[is used] to ‘avoid ascribing to one word a meaning so broad that it is inconsistent with its accompany- ing words … .’” Yates v. United States, 574 U.S. at 543, 135 S. Ct. at 1085 (quoting Gustafson v. Alloyd Co., 513 U.S. 561, 575, 115 S. Ct. 1061, 1069 (1995)); see also Bilski v. Kappos, 561 U.S. 593, 604, 130 S. Ct. 3218, 3226 (2010) (“Under this canon, ‘an am- biguous term may be given more precise content by the neigh- boring words with which it is associated.’”) (quoting United

11 As we noted in Capital Associates, “’[p]rivacy’ is a word with many connotations.” 392 F.3d at 941. Secrecy and seclusion are the two principal meanings, id., but there are other connotations, including, for example personal autonomy and freedom from government regulation, which may overlap with secrecy or seclusion to some extent, but which also reflect distinct interests, see id. See also Pucillo v. Nat’l Credit Sys., Inc., 66 F.4th 634, 639–40 (7th Cir. 2023) (quoting Persinger v. Sw. Credit Sys., L.P., 20 F.4th 1184, 1192 (7th Cir. 2021) (identifying four theories of wrongdoing encom- passed by tort of invasion of privacy, including publicly placing a person in a false light and appropriation of one’s name or likeness)); Websolv Com- puting, 580 F.3d at 549 (same); RESTATEMENT (2D) OF TORTS § 652A (same); Lovgren v. Citizens First Nat’l Bank of Princeton, 534 N.E.2d 987, 989–92 (Ill. 1989) (false light); 765 ILCS 1075/10 (recognizing right of publicity encom- passing “[t]he right to control and to choose whether and how to use an individual’s identity for commercial purposes”). 32 No. 22-2313

States v. Stevens, 559 U.S. 460, 474, 130 S. Ct. 1577, 1587 (2010)). As we have discussed, there are no readily-discernible clues in the text surrounding the catch-all provision that point to privacy as the factor that harmonizes the catch-all with the other provisions of the violation-of-statutes exclusion. Consequently, we return to where we started: On a plain- text reading, the catch-all provision has an extremely broad sweep—so broad, in fact, that the exclusion on its face would eliminate coverage for a number of statutory injuries ex- pressly included in the definition of “personal and advertis- ing injur[ies]” that the policy purports to cover. This clash be- tween competing provisions of the policy gives rise to an am- biguity, one that neither ejusdem generis nor noscitur a sociis can plausibly resolve. We are left with no choice other than to con- clude, as did the district court, that the catch-all provision in the violation-of-statutes exclusion is “intractably ambigu- ous.” 595 F.Supp.3d at 676. Applying yet another well-estab- lished canon, we must construe that ambiguity against Citi- zens and in favor of the insured. Panfil, 799 F.3d at 721. As the catch-all provision says nothing about injuries arising from statutes regulating privacy interests, and the policy defines a covered “personal and advertising injury” so as to include an injury arising out of the “[o]ral or written publication, in any manner, of material that violates a person’s right of privacy” (Policy § II(F)(14)(e), R. 20-1 at 100), we conclude that the in- juries alleged in the Thornley and Calderon complaints at least potentially fall within the coverage of the Citizens policy. Cit- izens thus owes its insured, Wynndalco, a duty to defend it against those complaints. Am. Bankers Ins. Co. of Fla. v. Shock- ley, supra n.8, 3 F.4th at 331; Panfil, 799 F.3d at 721–22; Supreme Laundry Serv., L.L.C. v. Hartford Cas. Ins. Co., 521 F.3d 743, 749 (7th Cir. 2008). This duty extends to the common law claims No. 22-2313 33

asserted against Wynndalco in the Thornley litigation, which as Citizens itself argues, arise out of the same acts or omis- sions as the BIPA claim asserted in that suit. Citizens Br. 42– 43. Having come to this conclusion, we need not separately address whether, even if Citizens’ reading of the exclusion were correct, the Thornley plaintiffs’ claim for a violation of section 15(c) of BIPA, which focuses on profiting from bio- metric information, falls outside of the wording of the catch- all exclusion. III. The judgment of the district court is AFFIRMED.