Cullen v. Kunes Country Automotive Management Inc

• Court: District Court, C.D. Illinois
• Decided: June 6, 2025
• Docket: 4:24-cv-04153
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT CENTRAL DISTRICT OF ILLINOIS ROCK ISLAND DIVISION

BUDDY CULLEN, individually and on ) behalf of all others similarly situated, ) ) Plaintiff, ) ) v. ) Case No. 4:24-cv-04153-SLD-RLH ) KUNES COUNTRY AUTOMOTIVE ) MANAGEMENT, INC., d/b/a KUNES ) AUTO GROUP, and KUNES FORD OF ) EAST MOLINE, INC., ) ) Defendants. )

ORDER Before the Court is Defendants’ Motion to Dismiss, ECF No. 15, and Motion for Leave to File a Reply, ECF No. 21. For the following reasons, Defendants’ Motion to Dismiss is DENIED and their Motion for Leave to File a Reply is GRANTED. BACKGROUND1 Plaintiff Buddy Cullen initiated this lawsuit on August 14, 2024, individually and on behalf of all others similarly situated, alleging that Defendants Kunes Country Automotive Management, Inc., doing business as Kunes Auto Group (“KCAM”), and Kunes Ford of East Moline, Inc. (“KFEM”), violated the Illinois Biometric Information Privacy Act (“BIPA”), 740 ILCS 14/15. Defendant KCAM is a Wisconsin corporation with its principal place of business in Delavan, Wisconsin, and operates motor vehicle dealerships across the country, including

1 When ruling on a motion to dismiss, a court must take all of the complaint’s well-pleaded allegations as true and view them in the light most favorable to the plaintiff. Indep. Tr. Corp. v. Stewart Info. Servs. Corp., 665 F.3d 930, 934 (7th Cir. 2012). Accordingly, unless otherwise stated, the facts in this section are taken from the Complaint, ECF No. 1. KFEM, an Illinois corporation with its principal place of business also in Delavan, Wisconsin.2 This dispute stems from Plaintiff’s employment at KFEM, which lasted from August 2020 to June 2024. Defendants stored keys to vehicles in a “biometric key storage system with hardware and

software” from a third-party doing business as “KEYper Systems.” Compl. 2, ECF No. 1. During Plaintiff’s employment, Defendants required him to “enroll in the KEYper Systems biometric key storage system,” and “scan his fingerprint each time he accessed or returned a key to a vehicle.” Id. at 8. This process required Defendants to store Plaintiff’s fingerprint data in the key storage system for use as an authentication method. Plaintiff was not informed of a retention policy for his biometric data,3 nor was he aware of whether his biometric data would be permanently deleted. Defendants did not obtain his consent or have him sign a written release to collect, store, use, or disclose his biometric data. Plaintiff now brings three claims against Defendants: Count I, which alleges a violation of 740 ILCS 14/15(a) for a failure to institute, maintain, and adhere to a publicly available retention schedule; Count II, which alleges a

violation of 740 ILCS 14/15(b) for a failure to obtain a written release; and Count III, which alleges a violation of 740 ILCS 14/15(d) for the disclosure of biometric data without obtaining Plaintiff’s consent. Defendants move to dismiss all counts against them under Federal Rule Civil Procedure 12(b)(6). See generally Mot. Dismiss. They argue that each claim is barred by 740 ILCS

2 Plaintiff invokes the Court’s jurisdiction under the Class Action Fairness Act (“CAFA”), 28 U.S.C. § 1446(d), which requires only minimal diversity, not complete diversity. See Sudholt v. Country Mut. Ins. Co., 83 F.4th 621, 625 (7th Cir. 2023), cert. denied, 144 S. Ct. 2525 (2024). Therefore, KFEM’s status as an Illinois citizen does not inherently preclude the Court from exercising jurisdiction over this lawsuit because Plaintiff is an Illinois citizen and KCAM is a Wisconsin citizen. See Compl. ¶ 16. At this early stage, the Court expresses no view on whether either the “home-state controversy” or “local controversy” exceptions apply to the Court’s jurisdiction under CAFA. See 28 U.S.C. § 1332(d)(4)(A)–(B); Hart v. FedEx Ground Package Sys. Inc., 457 F.3d 675, 679 (7th Cir. 2006). 3 The Court follows Plaintiff’s convention of using “biometric data” to refer to both “biometric identifiers” and “biometric information.” See Compl. 1 n.1. 14/25(c), as Defendants are “financial institution[s] that [are] subject to Title V of the federal Gramm-Leach-Bliley Act of 1999 and the rules promulgated thereunder.” Mem. Supp. Mot. Dismiss 3–8 (quoting 740 ILCS 14/25(c)), ECF No. 16. Further, Defendants ask for dismissal of the Complaint because it fails to comply with the pleading requirements under Rule 8(a). Id. at

8–11. Plaintiff opposes dismissal. See generally Opp. Mot. Dismiss, ECF No. 20. Defendants seek leave to file a reply. See generally Mot. Leave File Reply. DISCUSSION I. Motion for Leave to Reply “A reply to [a non-summary-judgment] response is only permitted with leave of Court.” Civil LR 7.1(B)(3). “Typically, reply briefs are permitted if the party opposing a motion has introduced new and unexpected issues in his response to the motion, and the [c]ourt finds that a reply from the moving party would be helpful to its disposition of the motion . . . .” Shefts v. Petrakis, No. 10-cv-1104, 2011 WL 5930469, at *8 (C.D. Ill. Nov. 29, 2011). A court may also permit a reply “in the interest of completeness.” Zhan v. Hogan, No. 4:18-cv-04126-SLD-JEH,

2018 WL 9877970, at *2 (C.D. Ill. Dec. 18, 2018) (quotation marks omitted). Here, Defendants inform the Court that they seek leave to reply to “Plaintiff’s arguments which contradict BIPA’s plain language, the findings of the Federal Trade Commission, and this Court’s holding in Duerr v. Bradley Univ., 590 F. Supp. 3d 1160, 1170 (C.D. Ill. 2022).” Mot. Leave File Reply 2. Also, Defendants state that the Reply will aid the Court and “help ensure [it] has all of the information and legal authorities” to make an informed ruling. Id. Considering that the motion is unopposed, and in the interest of completeness, Defendants are granted leave to reply to address the arguments raised by Plaintiff in his response. The Court will consider Defendants’ Reply and the attached exhibits in its analysis. See generally Reply, Mot. Leave File Reply Ex. 1, ECF No. 21-1. II. Standing Although neither party has raised the issue of standing, “[w]hen a requirement goes to

subject-matter jurisdiction,” courts must consider the issue sua sponte. Gonzalez v. Thaler, 565 U.S. 134, 141 (2012). “At the pleading stage, [Article III] standing requires allegations of a concrete and particularized injury in fact that is traceable to the defendant’s conduct and redressable by judicial relief.” Cothron v. White Castle Sys., Inc., 20 F.4th 1156, 1160 (7th Cir. 2021) (citations omitted). More specifically, the test for injury in fact asks whether the plaintiff “suffered an invasion of a legally protected interest that is concrete and particularized and actual or imminent, not conjectural or hypothetical.” Spokeo, Inc. v. Robins, 578 U.S. 330, 339 (2016) (quotation marks omitted). Here, Plaintiff brings claims under sections 15(a), 15(b), and 15(d) of BIPA. See generally Compl. Standing must be demonstrated for each claim. Johnson v. U.S. Off. of Pers. Mgmt., 783 F.3d 655, 661 (7th Cir. 2015).

To begin, section 15(a) “impose[s] [a] dut[y] owed only to the public generally,” so a plaintiff cannot only allege a regulatory violation. See Cothron, 20 F.4th at 1161. It mandates that: A private entity in possession of biometric identifiers or information must develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within 3 years of the individual’s last interaction with the private entity, whichever occurs first.

740 ILCS 14/15(a). When a plaintiff alleges only that a company has failed to develop a written policy, he fails to allege a concrete injury in fact. Bryant v. Compass Grp. USA, Inc., 958 F.3d 617, 626 (7th Cir. 2020) (holding that the plaintiff did not suffer a particularized injury and therefore lacked standing to pursue her section 15(a) claim because her allegation that the defendant failed publicly disclose a data retention schedule was a violation of a duty “owed to the public generally, not to particular persons whose biometric information the entity collects”). However, a plaintiff may allege a sufficiently concrete and particularized injury related to the

invasion of privacy interests by invoking “the full panoply” of section 15(a), i.e., by invoking the duties to develop, publicly disclose, and comply with data retention and destruction policies. Fox v. Dakkota Integrated Systems, LLC, 980 F.3d 1146, 1154–55 (7th Cir. 2020). Such violations may result in the retention of biometric identifiers or information for longer than is allowed by law. Id.; see also id. at 1155–56 (observing that “an unlawful retention of a person’s biometric data is as concrete and particularized an injury as an unlawful collection of a person’s biometric data” in violation of section 15(b)). As a part of this analysis, courts look to whether a section 15(a) claim is ripe, as well. See Giles v. Sabert Corp., No. 24 C 2996, 2025 WL 274326, at *6 (N.D. Ill. Jan. 21, 2025) (finding that one plaintiff’s section 15(a) claim was ripe because the purpose for retaining the plaintiff’s biometric data—employment by the defendant—had ended).

Here, Plaintiff’s section 15(a) claim is more like that brought in Fox, as he alleges more than a failure to develop and disclose the relevant policies, and his claim includes “the full panoply” of duties under this part of BIPA. Id. at 1149. The allegations in Count I include that “Defendants failed to develop and adhere to a publicly available retention schedule or guidelines for permanently destroying biometric [data],” and that they did not comply with BIPA’s requirements as they “ha[ve] not and will not destroy Plaintiff’s or class members’ biometric data when the initial purpose for collecting or obtaining such data has been satisfied or within three years of the individual’s last interaction with the company.” Compl. 13–14. Plaintiff’s Complaint alleges that Defendants have failed to create and adhere to an adequate policy for the retention of Plaintiff’s biometric data—this is enough to establish a particularized and concrete injury sufficient for standing. As for ripeness, Plaintiff alleges that Defendants collected his biometric data for use in the KEYper System, a key cabinet opened with fingerprint data which Plaintiff accessed while

employed at KFEM. Compl. 8. Plaintiff’s claim is ripe because the purpose for which the data was collected—to access vehicle keys at the dealership—ended when Plaintiff ceased working at KFEM, and Defendants have allegedly failed to destroy this biometric data. Compare Giles, 2025 WL 274326 at *7 (“Jones’ claim for unlawful retention is ripe because the purpose for which Sabert collected Plaintiffs’ biometric identifiers—timekeeping and attendance on its biometric timeclock system—ended when Jones ceased working for Sabert, and Sabert has allegedly failed to destroy Jones’ biometric identifiers.”), with Taylor v. 48forty Sols., LLC, No. 23 C 14400, 2024 WL 1530383, at *4 (N.D. Ill. Apr. 9, 2024) (finding the sole allegation that the defendant “did not delete its workers[’] biometric identifiers or biometric information within three years of its last interaction with those workers as required by BIPA” to be insufficient, as

the plaintiff’s employment “just ended in June 2023” and “[w]ithout more allegations regarding retention of Plaintiff’s biometrics after the initial purpose for collection had ended, any Section 15(a) claim for unlawful retention is likely unripe” (all but third alteration in original)). As Plaintiff has alleged that the initial purpose for collecting the data has been satisfied and that Defendants retained his biometric data beyond that purpose, the section 15(a) claim is ripe, and he has demonstrated standing. Plaintiff’s section 15(b) claim also meets the standing requirements. Section 15(b) “prohibits private entities from collecting, capturing, or otherwise obtaining a person’s biometric identifiers or information without the person’s informed written consent.” Fox, 980 F.3d at 1150 (citing 740 ILCS 14/15(b)). It “confers a right to receive certain information from a private entity that collects, stores, or uses a person’s biometric [data], the violation of that right, by itself, provides an actionable grievance.” Mayhew v. Candid Color Systems, 743 F. Supp. 3d. 994, 1008 (S.D. Ill. 2024) (citing Bryant, 958 F.3d at 621). Section 15(b) requires an “active step” by

the defendant to “obtain” the plaintiff’s biometric data; passive possession is not itself actionable under section 15(b). See Clark v. Microsoft Corp., 688 F. Supp. 3d 743, 746–47 (N.D. Ill. 2023) (collecting cases). Plaintiff alleges that to perform his job duties, Defendants collected his biometric data, and that while working, Plaintiff had to scan his fingerprint to access vehicle keys. Compl. 8. According to Count II, Defendants allegedly failed to “inform Plaintiff and class members in writing of the specific purpose and length of term for which their biometric identifiers and biometric information were being collected, stored and used” and failed to receive their written releases consenting to this automatic collection, obtainment, use, and storage of their biometric data. Id. at 15. These allegations are sufficient to establish standing. See Bryant, 958 F.3d at

626 (“[A] failure to follow [S]ection 15(b) of the law leads to an invasion of personal rights that is both concrete and particularized.”). His third claim, asserted under section 15(d), is sufficient as well. This section generally prohibits private entities in possession of biometric data from disclosing, redisclosing, or otherwise disseminating that data without consent. 740 ILCS 14/15(d). Similar to section 15(b), a plaintiff may allege a concrete informational injury under section 15(d). See Cothron, 20 F.4th at 1161 (“And just as with section 15(b), the failure to obtain consent for a disclosure or dissemination deprives a person of the opportunity to consider who may possess his biometric data and under what circumstances . . . . It follows that a violation of section 15(d) inflicts a concrete and particularized Article III injury.”). Plaintiff’s allegations in Count III meet this standard, as he outlines that Defendants collected his biometric data, stored it in their system, and disclosed or otherwise disseminated Plaintiff’s biometric data “to at least one third-party, KEYper Systems” without his consent. Compl. 8. These allegations go beyond merely

“parroting” the statutory language. See Carpenter v. McDonald’s Corp., 580 F. Supp. 3d 512, 519 (N.D. Ill. 2022) (dismissing section 15(d) claim where the allegations “regarding disclosure, redisclosure, or dissemination [were] conclusions that parrot BIPA’s language”). Accordingly, Plaintiff has established Article III standing for his claims under sections 15(a), 15(b), and 15(d). III. Motion to Dismiss a. Legal Standard A complaint must contain “a short and plain statement of the claim showing that the pleader is entitled to relief.” Fed. R. Civ. P. 8(a)(2). At the motion to dismiss stage, the key inquiry is whether the complaint is “sufficient to provide the defendant with ‘fair notice’ of the plaintiff’s claim and its basis.” Indep. Tr. Corp. v. Stewart Info. Servs. Corp., 665 F.3d 930, 934

(7th Cir. 2012) (quoting Erickson v. Pardus, 551 U.S. 89, 93 (2007)). A court must take all of the complaint’s well-pleaded allegations as true and view them in the light most favorable to the plaintiff. Id. While “detailed factual allegations are unnecessary, the complaint must have ‘enough facts to state a claim to relief that is plausible on its face.’” Pierce v. Zoetis, Inc., 818 F.3d 274, 277 (7th Cir. 2016) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). “The purpose of a motion to dismiss is to challenge the sufficiency of the complaint, not to decide its merits.” Dutch Valley Growers, Inc. v. Rietveld, No. 16-2085, 2016 WL 10789393, at *2 (C.D. Ill. Aug. 29, 2016). Typically, a complaint does not have to anticipate an affirmative defense. Bausch v. Stryker Corp., 630 F.3d 546, 561 (7th Cir. 2010). Nevertheless, courts may dismiss a complaint if its allegations establish the affirmative defense. See Collins v. Village of Palatine, 875 F.3d 839, 842 (7th Cir. 2017) (affirming the procedural propriety of considering a motion to dismiss

based on a statute of limitations where the “complaint [and judicially noticeable court documents] contain[ed] everything necessary to establish that the claim [wa]s untimely”); Patterson v. Respondus, Inc., 593 F. Supp. 3d 783, 819 n.18 (N.D. Ill. 2022) (“On a Rule 12 motion . . . ordinarily it is inappropriate to dismiss a claim based on an affirmative defense unless the allegations of the complaint itself set forth everything necessary to satisfy it.” (quotation marks omitted)). b. Analysis BIPA’s requirements are addressed to “private entities,” meaning “any individual, partnership, corporation, limited liability company, association, or other group, however organized.” 740 ILCS 14/10. In their motion, Defendants ask this Court to dismiss Plaintiff’s

Complaint because each Defendant falls within an exemption to BIPA found within section 25(c), or, in the alternative, because Plaintiff has failed to comply with Rule 8(a)’s pleading requirements. See generally Mot. Dismiss. Both arguments will be addressed. i. Application of Section 25(c) Section 25(c) limits the reach of BIPA and includes an exemption for “financial institutions.” See 740 ILCS 14/25(c) (“Nothing in [BIPA] shall be deemed to apply in any manner to a financial institution or an affiliate of a financial institution that is subject to Title V of the federal Gramm-Leach-Bliley Act [(“GLBA”)] of 1999 and the rules promulgated thereunder.”). Title V of the GLBA, 15 U.S.C. §§ 6801–6809, is a privacy law that regulates how financial institutions handle certain customer information. See 15 U.S.C. § 6801(a). Under Title V, a “financial institution” is “any institution the business of which is engaging in financial activities,” 15 U.S.C. § 6809(3)(A), such as “[l]ending, exchanging, transferring, investing for others, or safeguarding money or securities”; “[p]roviding financial, investment, or economic

advisory services”; and “[u]nderwriting, dealing in, or making a market in securities,” 12 U.S.C. § 1843(k)(4). To establish this defense, Defendants argue that “[i]t is undisputed [that] automobile dealerships who finance the purchase of vehicles, extend credit to customers through retail installment contracts, and/or lease vehicles are ‘financial institutions’ subject to the GLBA.” Mem. Supp. Mot. Dismiss 5 (citing 16 C.F.R. § 313.3(k)). Defendants point the Court to the Federal Trade Commission’s website, where a list of frequently asked questions informs the reader that car dealerships are subject to the Privacy Rule, an aspect of the GLBA. Id. at 5–6. To establish that KFEM is a car dealership, Defendants include a screenshot from KFEM’s website, id. at 7, and to argue that Plaintiff himself classified both Defendants as “affiliates,”

they point to Plaintiff’s Complaint, id. at 8 (stating “[Plaintiff] alleges Defendant KCAM ‘operates more than 40 motor vehicle dealerships[,]’ including Defendant KFEM” and quoting 16 CFR § 313.3(a) for the proposition that an “affiliate for purposes of the GLBA ‘means any company that controls, is controlled by, or is under common control with another company’”). Plaintiff argues that application of section 25(c) is an affirmative defense, and Defendants’ entitlement thereto is not apparent from the face of the Complaint. Opp. Mot. Dismiss 5–6. Defendants’ Reply contains significantly more screenshots from KFEM’s website and redundant arguments contending that the GLBA applies to car dealerships. See generally Reply. To analyze the exemption, Defendants ask the Court to take judicial notice of KFEM’s website, as Plaintiff’s Complaint does not allege that it is a financial institution subject to the GLBA. Mem. Supp. Mot. Dismiss 8. In reviewing a motion to dismiss, a court considers “the complaint itself” as well as “documents attached to the complaint, documents that are critical to the complaint and referred

to in it, and information that is subject to proper judicial notice.” Phillips v. Prudential Ins. Co. of Am., 714 F.3d 1017, 1019–20 (7th Cir. 2013) (quotation marks omitted). Courts may take judicial notice of court filings and matters of public record when considering a motion to dismiss, see Parungao v. Cmty. Health Sys., Inc., 858 F.3d 452, 457 (7th Cir. 2017), but judicial notice is appropriate only when the fact “is generally known within the trial court’s territorial jurisdiction” or the fact “can be accurately and readily determined from sources whose accuracy cannot reasonably be questioned,” Fed. R. Evid. 201(b). Here, Defendants ask the Court to take judicial notice of KFEM’s website, and they explain that such action is proper “so long as the web site’s authenticity is not in dispute and it is capable of accurate and ready determination.” Mem. Supp. Mot. Dismiss 8 (quoting Cesca v. W.

Illinois Univ. Bd. of Trs., No. 4:23-CV-04043-SLD-JEH, 2024 WL 152812, at *1 n.1 (C.D. Ill. Jan. 15, 2024)).4 However, Defendants’ cited cases in support of taking judicial notice are distinguishable from the facts at issue here. See Reply 11–14. They point to the decision in Duerr, 590 F. Supp. 3d at 1171, in which this Court took judicial notice of documents from the U.S. Department of Education detailing the University’s “participation in federal student aid programs requiring GLBA and FERPA compliance.” The other cases cited by Defendants are

4 In Cesca v. Western Illinois University Board of Trustees, No. 4:23-CV-04043-SLD-JEH, 2024 WL 152812, *1 n.1 (C.D. Ill. Jan. 15, 2024), this Court took judicial notice of the defendant’s website pages when deciding a motion for a preliminary injunction after the plaintiff cited to and quoted the information from the website, which indicated that the authenticity was not in dispute. That is not the case here, as Defendants are asking the Court to take judicial notice of their own website, and Plaintiff has labeled the information “unverified, untested and self-serving.” Opp. Mot. Dismiss 10. The Court is not persuaded by Defendants’ reference to Cesca. similarly distinguishable—the courts took judicial notice of publicly available documents from government entities. See Reply 13–14 (first citing Powell v. DePaul Univ., No. 21 C 3001, 2022 WL 16715887, at *3 (N.D. Ill. Nov. 4, 2022), and then citing Doe v. Nw. Univ., 586 F. Supp. 3d 841, 843 (N.D. Ill. 2022)).

The distinction here is clear: Defendants’ proffered website is for a private company and is seemingly operated by Defendants themselves. Plaintiff, in response, challenges the accuracy and authenticity of the website links, and labels them “unverified, untested and self-serving representations.” Opp. Mot. Dismiss 10. Plaintiff is correct—it cannot be determined that the information on KFEM’s website “is generally known within the trial court’s territorial jurisdiction” or “accurately and readily determined from sources whose accuracy cannot reasonably be questioned” in accordance with Federal Rule of Evidence 201(b). See Gaertner v. Commemorative Brands, Inc., No. 23-cv-02452-SPM, 2025 WL 931290, at *10 (S.D. Ill. Mar. 27, 2025) (analyzing a section 25(c) argument and finding that it “is not appropriate for this Court to take into consideration the website links or exhibits provided by the Defendants as

judicially noticeable facts”). Additionally, the documents in Duerr and Powell were specific to those defendants. See Duerr, 590 F. Supp. 3d at 1171 (citing the defendant’s “Program Participation Agreement”); Powell, 2022 WL 16715887, at *3 (citing the defendant’s “Participation Agreement with the [Department of Education]”). Here, Defendants point to Federal Trade Commission materials addressed to a lay audience as well as disclosures from their website, and rhetorically ask why they would bother with such disclosures at their own expense if they were not covered by the GLBA. See Reply 3–4. Concluding that the self-authored materials from Defendants’ website, as opposed to documents from government entities addressed to Defendants, mandates an inference that Defendants are subject to the GLBA would contravene the Court’s duty to view the Complaint’s allegations in Plaintiff’s favor and take judicial notice only of those facts whose accuracy cannot be questioned. See Phillips, 714 F.3d at 1019–20; Indep. Tr. Corp, 665 F.3d at 934. Therefore, the Court declines to take judicial notice of screenshots and links related to

KFEM’s website. One of Defendants’ last arguments in support of taking judicial notice of the website is that Plaintiff’s experience as an employee demonstrates his knowledge that the website accurately reflects the services offered at KFEM. Reply 12. They contend that Plaintiff cannot “conveniently ignore or omit what he knows to be true solely to avoid dismissal.” Id. However, the Complaint alleges only that Plaintiff “worked for Defendants from approximately August 2020 to June 2024 at [KFEM]” and that he had to access the KEYper Systems biometric key storage system each time “he accessed or returned a key to a vehicle.” Compl. 8. From this, the Court cannot say that Plaintiff is aware of the financing, leasing, or other services Defendants argue are provided at KFEM—these are factual issues that the Court cannot weigh at this stage

of the proceedings. See Collins, 875 F.3d at 842. While the Court is cognizant of the principles of judicial economy, see Reply 12–13, it cannot ignore the relevant standards, and it must make all reasonable inferences in Plaintiff’s favor—what Defendants ask the Court to consider is not proper on a motion to dismiss. At this time, the Court declines to take judicial notice of KFEM’s website pages. See Tobey v. Chibucos, 890 F.3d 634, 648 (7th Cir. 2018) (“Judicial notice is a powerful tool that must be used with caution.” (quotation marks omitted)). The issues of whether KFEM is a financial institution under the GLBA and if KCAM is its affiliate present issues of fact that cannot be determined based on the allegations of the Complaint. Defendants’ arguments for dismissal related to section 25(c) are rejected.5 ii. Defendants’ Rule 8(a) Argument The last argument for dismissal is that Plaintiff has failed to comply with pleading

standards because many of the allegations “lump” Defendants together as one, and each Defendant is entitled to notice of the claims against it. See Mem. Supp. Mot. Dismiss 8–11; Reply 15. Plaintiff’s responsive argument is that group pleading is not categorically impermissible, and that the Complaint provides adequate notice to Defendants. Opp. Mot. Dismiss 11–13. A complaint must set forth what each defendant is accused of doing. Bank of Am., N.A. v. Knight, 725 F.3d 815, 818 (7th Cir. 2013). The core of such a requirement is that each defendant is put on notice as to the scope of the claims against it. Brooks v. Ross, 578 F.3d 574, 582 (7th Cir. 2009). “Details about who did what are not merely nice-to-have features of an otherwise- valid complaint; to pass muster under Rule 8 of the Federal Rules of Civil Procedure, a claim to

relief must include such particulars.” Atkins v. Hasan, No. 15 CV 203, 2015 WL 3862724, at *2 (N.D. Ill. June 22, 2015). Group pleading, which is when a plaintiff attributes individual actions to a group of defendants rather than specifying which party did what, “ma[kes] it exceedingly difficult for the [d]efendants to respond to her claims and for [a] [c]ourt to oversee th[e] litigation.” Eilenfeldt v. United C.U.S.D. #304 Bd. of Educ., No. 4:12-cv-04029-SLD-JAG, 2013 WL 12248080, at *3 (C.D. Ill. Mar. 25, 2013). However, group pleading does not automatically require dismissal at the pleading stage and, in some cases, may be more appropriately addressed

5 As Defendants’ motion is denied as to this ground, Plaintiff’s responsive argument related to whether the financial institution exemption is limited in the employee-employer context need not be addressed. See Opp. Mot. Dismiss 6–11; Reply 7–11. through a motion for summary judgment. See, e.g., Rivera v. Lake County, 974 F. Supp. 2d 1179, 1194 (N.D. Ill. 2013) (“[A]n allegation directed at multiple defendants can be adequate to plead personal involvement. . . . [W]here a plaintiff has been injured as the consequence of the actions of an unknown member of a collective body, identification of the responsible party may be

impossible without pretrial discovery.”). In support of dismissing the Complaint, Defendants point to Plaintiff’s allegation that he worked for “Defendants from approximately August 2020 to June 2024,” and state that this is the type of allegation that Plaintiff has knowledge to plead more specifically. Mem. Supp. Mot. Dismiss 9 (“Plaintiff was obviously only employed by one company.”). This argument fails to consider that Plaintiff did allege that he worked at a specific dealership, and that Plaintiff included information on connecting the two defendants. See Compl. 2 (“Defendant [KCAM] is a Wisconsin corporation . . . that operates more than 40 motor vehicle dealerships across the country . . . . Defendant [KFEM] is one of approximately 22 [KCAM] dealerships located in Illinois and where Plaintiff worked.”). The Complaint provides adequate background by

identifying each defendant and outlining that KCAM is a corporation that operates motor vehicle dealerships, including KFEM. Id. Plaintiff then alleges that KCAM and its dealerships, including KFEM, “require individuals authorized to access vehicle keys to enroll into [a] biometric storage system with hardware and software . . . using a fingerprint scan.” Id. The allegations become broader, as Plaintiff contends that “Defendants have disregarded . . . statutorily protected privacy rights and unlawfully collect, store, disseminate, and use . . . biometric data in violation of BIPA,” id. at 3–4, but also that the system was in place during his employment at KFEM, id. at 8. This is a permissible use of group pleading at this stage. From these allegations, Plaintiff intends to establish that both KCAM and KFEM violated BIPA. Within the three counts, which are leveled against both Defendants, the allegations in which Plaintiff “lumps” together the defendants are related to facts that Plaintiff may not reasonably know without the benefit of

discovery—like which defendant implemented the policy to use KEYper, where the data was stored and by who, or which defendant disclosed data to a third party. See id. at 13–17. Complaints like the one here have been found to be permissible at a motion to dismiss stage. See e.g., Wordlaw v. Enter. Leasing Co. of Chi., LLC, No. 20 CV 3200, 2020 WL 7490414, at *3 (N.D. Ill. Dec. 21, 2020) (concluding that the plaintiff pleaded sufficient factual allegations to put defendants on notice of potential BIPA violations despite the use of group pleading and not knowing which of the corporate entities installed and controlled the timekeeping system); Cunningham v. Foresters Financial Services, Inc., 300 F. Supp. 3d 1004, 1016 (N.D. Ind. Jan. 9, 2018) (allowing the plaintiff to pursue claims against multiple defendants where the allegations connected defendants to the alleged harm but did not fully flesh out the relationships between

defendants). In other words, Plaintiff is not required to include “detailed factual allegations” in his Complaint. See Alexander v. United States, 721 F.3d 418, 422 (7th Cir. 2013). Instead, Plaintiff need only “give enough details about the subject-matter of the case to present a story that holds together.” Swanson v. Citibank, N.A., 614 F.3d 400, 404 (7th Cir. 2010). That is done so here; Defendants’ argument for dismissal related to Plaintiff’s failure to meet the standards under Rule 8(a) is rejected. CONCLUSION For the foregoing reasons, Defendants’ Motion to Dismiss, ECF No. 15, is DENIED. Defendants’ Motion for Leave to File a Reply, ECF No. 21, is GRANTED. The Clerk is directed to file the Reply, ECF No. 21-1, along with the accompanying exhibits, ECF Nos. 21-2, 21-3, 21-

4, 21-5, 21-6, 21-7, on the docket. Entered this 6th day of June, 2025. s/ Sara Darrow SARA DARROW CHIEF UNITED STATES DISTRICT JUDGE