Davis v. Jumio Corporation

• Court: District Court, N.D. Illinois
• Decided: February 14, 2023
• Docket: 1:22-cv-00776
• Status: Unknown

Opinion

IN THE UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION

CORY DAVIS, individually and on behalf of ) all others similarly situated, ) ) Plaintiff, ) ) No. 22-cv-00776 ) v. ) Judge Andrea R. Wood ) JUMIO CORPORATION, ) ) Defendant. )

MEMORANDUM OPINION AND ORDER Plaintiff Cory Davis, an Illinois resident, is a member of the online cryptocurrency marketplace operated by Binance. Defendant Jumio Corporation (“Jumio”) provides identification verification services for its clients, including Binance. Davis claims that Jumio violated the notice and consent requirements of Illinois’s Biometric Information Privacy Act (“BIPA”), 740 ILCS 14/1 et seq., when it collected his biometric information while verifying his identity for Binance. Accordingly, Davis has sued Jumio under BIPA, on behalf of himself and a putative class of similarly situated Illinois residents who allegedly had their biometric information collected by Jumio without their informed consent. Now before the Court is Jumio’s motion to dismiss the Complaint pursuant to Federal Rule of Civil Procedure 12(b)(6). (Dkt. No. 14.) For the following reasons, Jumio’s motion is denied. BACKGROUND For purposes of Jumio’s motion to dismiss, the Court accepts all well-pleaded facts in the Complaint as true and views those facts in the light most favorable to Davis as the nonmoving party. Killingsworth v. HSBC Bank Nev., N.A., 507 F.3d 614, 618 (7th Cir. 2007). The Complaint alleges as follows. Jumio employs facial recognition software to provide identity verification services to businesses seeking to confirm the identities of customers making transactions. (Compl. ¶¶ 1–2, Dkt. No. 1-1.) The customers of Jumio’s clients are prompted to upload a photograph of their face

and a copy of an identification document (i.e., driver’s license); Jumio’s facial recognition software then scans the photograph, creates a biometric template of the customer’s face, and compares the customer’s facial biometrics to the photograph on the identification document to confirm whether they match. (Id. ¶¶ 2, 21–22.) Businesses may embed and integrate Jumio’s identity verification software into their own websites and mobile applications, so that their customers are not redirected to another location during the identity verification process. (Id. ¶ 3.) As a result, customers are likely to be entirely unaware that they are providing their biometric information to third-party Jumio. (Id.) In January 2021, Davis registered to participate in Binance’s online cryptocurrency

marketplace. (Id. ¶¶ 31, 33.) Binance has “partnered up” with Jumio to verify the identities of Binance’s prospective customers. (Id. ¶ 32.) Thus, during Davis’s registration process using Binance’s mobile application (“Binance App”), Davis was required to upload a photograph of his driver’s license and a photograph of his face to verify his identity. (Id. ¶ 33.) Jumio subsequently used its facial recognition software to extract Davis’s biometric identifiers from the photographs, compose a facial template, and compare the templates for a match—all without providing notice and obtaining Davis’s informed consent. (Id. ¶¶ 33–35.) BIPA regulates private entities’ “collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information.” 740 ILCS 14/5(g). According to Davis, Jumio violated BIPA by failing to inform him and other Illinois residents in writing that it was collecting or storing their biometric data; failing to inform him and other Illinois residents in writing of the purpose and length of time for which it was collecting, storing, and using their biometric data; and not obtaining Davis’s and other Illinois residents’ written authorization to collect their biometric data. (Compl. ¶¶ 6, 27–28, 34–35.) Consequently, Davis has sued Jumio on

behalf of himself and a class of similarly situated Illinois residents “who had their biometric identifiers or biometric information, including faceprints and facial geometry, collected, captured, received, or otherwise obtained by or disclosed to Jumio while residing in Illinois.” (Id. ¶ 38.) DISCUSSION To survive a Rule 12(b)(6) motion, “a complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). This pleading standard does not necessarily require a complaint to contain detailed factual allegations. Twombly, 550 U.S. at 555. Rather, “[a] claim has facial plausibility when the plaintiff

pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Adams v. City of Indianapolis, 742 F.3d 720, 728 (7th Cir. 2014) (quoting Iqbal, 556 U.S. at 678). Although the Court accepts the plaintiff’s well-pleaded factual allegations as true, conclusory allegations will not be sufficient to avoid dismissal. See Iqbal, 556 U.S. at 678 (“Threadbare recitals of the elements of a cause of action, supported by mere conclusory statements, do not suffice.”). “In addition to the allegations in the complaint, courts are free to examine . . . matters of which a court may take judicial notice in evaluating a motion to dismiss under Rule 12(b)(6).” Facebook, Inc. v. Teachbook.com LLC, 819 F. Supp. 2d 764, 770 (N.D. Ill. 2011) (internal quotation marks omitted). Here, Jumio argues that the Complaint must be dismissed pursuant to Rule 12(b)(6) for two reasons. First, Jumio claims that Davis’s suit is barred by BIPA’s exemption for financial institutions subject to Title V of the Gramm-Leech-Bliley Act of 1999 (“GLBA”). Second, Jumio contends that BIPA does not apply extraterritorially and Davis does not allege that Jumio engaged in any relevant conduct that occurred primarily and substantially in Illinois.

I. BIPA’s Financial-Institution Exemption The Court first considers whether BIPA’s exemption for financial institutions precludes Davis’s claims against Jumio. BIPA Section 25(c) provides that “[n]othing in this Act shall be deemed to apply in any manner to a financial institution or an affiliate of a financial institution that is subject to Title V of the federal Gramm-Leach-Bliley Act of 1999 and the rules promulgated thereunder.” 740 ILCS 14/25(c). In raising the financial-institution exemption as a defense to Davis’s claims, Jumio does not contend that it is a financial institution itself; rather, Jumio argues that Binance is a financial institution and applying BIPA to Jumio based on Davis’s use of the Binance App would effectively result in applying BIPA to Binance, an action that

BIPA proscribes. As an initial matter, Davis asserts that the financial-institution exemption constitutes an affirmative defense and, as such, Jumio has the burden to establish it and Davis has no obligation to plead around it. Indeed, as a general rule, a plaintiff’s complaint need not anticipate an affirmative defense to survive a motion to dismiss. United States v. Lewis, 411 F.3d 838, 842 (7th Cir. 2005). Accordingly, courts should not grant a Rule 12(b)(6) motion to dismiss on the basis of an affirmative defense unless the allegations of the complaint itself establish the relevant facts necessary to satisfy the defense. Brownmark Films, LLC v. Comedy Partners, 682 F.3d 687, 690 (7th Cir. 2012); United States v. Lewis, 411 F.3d 838, 842 (7th Cir. 2005). Jumio does not dispute that the financial-institution exemption is an affirmative defense but contends that the allegations of the Complaint, along with certain matters of which the Court may take judicial notice, suffice to establish that the exemption applies to Davis’s claim. A. Binance as a Financial Institution

Aside from its reference to the GLBA, BIPA does not define the term “financial institution,” and neither the Illinois Supreme Court nor any intermediate Illinois appellate court has discussed the scope of Section 25(c)’s exemption, as relevant here. Consequently, this Court’s task in interpreting BIPA’s financial-institution exemption is to determine how the Illinois Supreme Court would rule. Rodas v. Seidlin, 656 F.3d 610, 626 (7th Cir. 2011). In Illinois, “[t]he fundamental rule of statutory interpretation is to ascertain and give effect to the intent of the legislature.” Dome Tax Servs. Co. v. Weber, 136 N.E.3d 1121, 1124 (Ill. App. Ct. 2019). “The most reliable indicator of that intent is the language of the statute itself. In determining the plain meaning of statutory language, a court will consider the statute in its entirety, the subject the

statute addresses, and the apparent intent of the legislature in enacting the statute.” Id. at 1123–24 (citation omitted). In addition, a court “may consider the reason for the law, the problems sought to be remedied, the purposes to be achieved, and the consequences of construing the statute one way or another.” Evans v. Cook Cnty. State’s Att’y, 183 N.E.3d 810, 818 (Ill. 2021). But where the statutory language is clear and unambiguous, it must be applied as written. Dome Tax Servs. Co., 136 N.E.3d at 1124. This Court has previously observed that BIPA’s exemption for financial institutions subject to Title V of the GLBA means what it says and is therefore best understood by looking to Title V of the GLBA. See Fee v. Ill. Inst. of Tech., No. 21-CV-02512, 2022 WL 2791818, at *2 (N.D. Ill. July 15, 2022). “Codified at 15 U.S.C. §§ 6801–6809, Title V of the GLBA ‘contains a number of provisions designed to protect the privacy of ‘nonpublic personal information’ . . . that consumers provide to financial institutions.’” Id. (quoting Trans Union LLC v. FTC, 295 F.3d 42, 46 (D.C. Cir. 2002)); see also 15 U.S.C. § 6801(a). Title V defines a financial institution as “any institution the business of which is engaging in financial activities as described in section 1843(k) of Title 12.” 15 U.S.C. § 6809(3). The financial activities described in 12 U.S.C. § 1843(k)

include “lending, exchanging, transferring, investing for others, or safeguarding money or securities;” or engaging in activities that the Board of Governors of the Federal Reserve System (“Federal Reserve Board”) has determined to be “so closely related to banking or managing or controlling banks as to be a proper incident” to financial activities. 12 U.S.C. § 1843(k)(4)(A), (F). The Federal Reserve Board, in turn, has issued rules finding money transmission to be an activity closely related to banking. 12 C.F.R. § 225.86(a)(2)(v). In addition, the Federal Trade Commission (“FTC”) and Consumer Financial Protection Bureau (“CFPB”), in rules promulgated under Title V of the GLBA, have defined financial institution to include “an institution that is significantly engaged in financial activities,” such as a business that regularly wires money to and

from customers. 16 C.F.R. §§ 314.2(h)(1), (h)(2)(vi); 12 C.F.R. § 1016.3(l)(3). Jumio contends that the Court should take judicial notice of certain facts that it believes establish that Binance qualifies as a financial institution. Specifically, Jumio asks the Court to take judicial notice of the facts that Binance has described itself as a financial institution in court filings in other proceedings and that Binance is registered as a money transmitter with the U.S. Department of the Treasury’s Financial Crimes Enforcement Network (“FinCEN”). But while courts may take judicial notice of court filings and matters of public record when considering a motion to dismiss, see Parungao v. Cmty. Health Sys., Inc., 858 F.3d 452, 457 (7th Cir. 2017), judicial notice is appropriate only when the fact “is generally known within the trial court’s territorial jurisdiction” or the fact “can be accurately and readily determined from sources whose accuracy cannot reasonably be questioned.” Fed. R. Evid. 201(b). As a result, judicial notice of court filings is proper “to establish the fact of such litigation (but not for the truth of the matters asserted in the other litigation).” Mitchell v. B-Way Corp., No. 20 CV 1648, 2021 WL 83735, at *3 n.7 (N.D. Ill. Jan. 11, 2021) (citing Opoka v. I.N.S., 94 F.3d 392, 395 (7th Cir. 1996)).

Accordingly, even though this Court may take judicial notice of the fact that Binance has described itself as a financial institution in other contexts, Binance’s self-serving statements (such as characterizing itself as a financial institution in other litigation to avoid liability under BIPA) need not be accepted as true and do not support taking judicial notice of the contested fact that Binance is, in fact, a financial institution. Similarly, Binance’s decision to register as a money transmitter with FinCEN reveals nothing about FinCEN’s own views regarding whether such registration was accurate and necessary.1 Jumio asserts that even without taking judicial notice of any additional facts, the Court can and should find that the allegations in the Complaint establish that Binance is a financial

institution based on Davis’s description of Binance as an “online cryptocurrency marketplace.” (See Compl. ¶ 31.) According to Jumio, by referring to Binance as a cryptocurrency marketplace, Davis has admitted that Binance performs money transmission services and is engaged in exchanging, transferring, and safeguarding money. To support this argument, Jumio relies on Black’s Law Dictionary’s definition of cryptocurrency as “[a] digital or virtual currency that is not issued by any central authority . . . [and] is designed to function as a medium of exchange.”

1 Jumio attaches as an exhibit to its memorandum in support of its motion a printout from a FinCEN database reflecting Money Services Business (“MSB”) registration status information for Binance. The report explicitly states that FinCEN does not verify information submitted by the registrant and that the information reflects only what the registrant has provided to FinCEN. (Def.’s Mem. in Supp. of Mot. to Dismiss at 49, Dkt. No. 15.) Cryptocurrency, Black’s Law Dictionary (11th ed. 2019). But the definition to which Jumio points does not define what it means to be a “cryptocurrency marketplace,” and a generic dictionary definition of “cryptocurrency” sheds little light on how Binance’s business (or any cryptocurrency marketplace) actually operates. Moreover, other than using the term “cryptocurrency marketplace,” the Complaint contains no further factual allegations about the

financial activities of Binance. And unlike the term “bank,” for example, the term “cryptocurrency marketplace” has not acquired such common meaning that the Court can readily determine whether Binance’s operations fall within the category of financial institutions exempted from regulation under BIPA. In short, whether Binance qualifies as a financial institution for purposes of BIPA’s exemption presents a question of fact that cannot be determined based on the allegations of the Complaint, regardless of whether Binance has called itself financial institution in other proceedings to avoid its own liability under BIPA.2

2 Jumio argues that Davis has waived the argument that Binance is not in the business of performing money transmission services and exchanging and transferring money. That is because, according to Jumio, Davis has not disputed that by describing Binance as a cryptocurrency marketplace, he has admitted that Binance performs money transmission services and engages in exchanging and transferring money. But while it is true that a party’s failure to respond to an opposing party’s argument can result in waiver, see Bonte v. U.S. Bank, N.A., 624 F.3d 461, 466 (7th Cir. 2010), the Court declines to find that Jumio has waived any argument here. While Davis might not have responded directly to the specific point raised by Jumio, he certainly contests Jumio’s broader argument that the allegations of the Complaint establish that Binance is a financial institution subject to Title V of the GLBA. For example, Davis argues that the Complaint contains no allegations to establish that Binance is a financial institution, he disputes that the Court can take judicial notice of Binance’s beliefs that it is a financial institution and money transmitter, and he contends that the FTC and CFPB have not yet found that cryptocurrency exchanges are financial institutions. (See Pl.’s Resp. in Opp’n to Def.’s Mot. to Dismiss (“PROMD”) at 4–5, Dkt. No. 18.) Regardless, courts have discretion to excuse a party’s failure to respond. Abubakar v. Walmart, Inc., No. 21-CV-06248, 2022 WL 14632902, at *3 n.1 (N.D. Ill. Oct. 25, 2022); Hudson v. Gaines, No. 20 C 5663, 2022 WL 4272781, at *3 (N.D. Ill. Sept. 15, 2022). B. Definition of “In Any Manner” Even if Binance is a financial institution within the meaning of Title V of the GLBA, it would not necessarily follow that Davis’s claim against Jumio is barred. BIPA provides that “[n]othing in this Act shall be deemed to apply in any manner to a financial institution or an affiliate of a financial institution that is subject to Title V of the federal Gramm-Leach-Bliley Act

of 1999 and the rules promulgated thereunder.” 740 ILCS 14/25(c) (emphasis added). Jumio argues that because its software is embedded and integrated into the Binance App, granting Davis’s requested relief under BIPA would necessarily entail altering the operation of the Binance App.3 As a result, BIPA would be impermissibly applied to Binance “in any manner.” BIPA does not define the phrase “in any manner.” Jumio, however, argues that it should be broadly construed under Illinois law. For instance, Jumio observes that courts have interpreted “in any manner” broadly in the context of the Illinois Controlled Substances Act, 720 ILCS 570/505(a)(3), and the Illinois Workers’ Compensation Act, 820 ILCS 305/4(h). See, e.g., People ex rel. Broch v. Hogg, 571 N.E.2d 888, 892 (Ill. App. Ct. 1991) (concluding that the defendant

used his vehicle “in any manner” to facilitate the transportation of narcotics when he hid cocaine in his sock while in a vehicle); Stevenson v. FedEx Ground Package Sys., Inc., 69 F. Supp. 3d 792, 796 (N.D. Ill. 2014) (finding that an employer interfered “in any manner” with an employee’s right to seek medical treatment by requiring him to notify the company before obtaining medical treatment). Yet “the same word may mean one thing in one statute and something different in another, dependent upon the connection in which the word is used, the object or purpose of the statute, and the consequences which probably will result from the

3 In addition to requesting damages for Jumio’s alleged BIPA violations, Davis also seeks injunctive and equitable relief. The requested remedies would require Jumio to comply with BIPA’s requirements for the collection, storage, and use of biometric identifiers and biometric information. (Compl. ¶ 53.) proposed construction.” Rosenbach, 129 N.E.3d at 1205 (internal quotation marks and citation omitted). Jumio additionally contends that Section 25(c)’s “in any manner” language is broader than BIPA’s other exclusions. According to Jumio, the Illinois legislature intentionally drafted such a broad prohibition to cover even indirect applications to financial institutions. Specifically, Jumio

contrasts Section 25(c) with other nearby provisions addressing the ways in which BIPA should be construed. For instance, Section 25(a) provides that BIPA “shall [not] be construed to impact the admission or discovery” of biometric information in court proceedings; Section 25(b) establishes that BIPA “shall [not] be construed to conflict with,” inter alia, the federal Health Insurance Portability and Accountability Act of 1996; Section 25(d) declares that BIPA “shall [not] be construed to conflict with the Private Detective, Private Alarm, Private Security, Fingerprint Vendor, and Locksmith Act of 2004; and Section 25(e) states that BIPA “shall [not] be construed to apply” to government contractors. 740 ILCS 14/25(a)–(e). “If possible, the court must give effect to every word, clause, and sentence” in a statute

and “must not read it to render any part inoperative, superfluous, or insignificant.” People v. McChriston, 4 N.E.3d 29, 35 (Ill. 2014). When giving effect to the legislature’s intent, courts look to the plain and ordinary meaning of the statutory language; courts also construe the statute holistically and may consider the reason for the statute and the consequences of interpreting the statute in a certain way. See Evans, 183 N.E.3d at 818. Examining the plain language of the phrase “in any manner,” it is difficult to see how requiring Jumio to comply with BIPA’s notice and consent provisions leads to BIPA being applied in any manner to Binance. If this Court were to order Jumio to comply with BIPA’s requirements, Jumio might have to modify the software that it provides to Binance to allow for notice and consent obligations; Binance, however, would not have any affirmative obligation under BIPA to change the Binance App. As with the question of whether Binance qualifies as a financial institution, however, this is not a determination that can be made based on the pleadings. Without further information regarding how the Binance App functions and how Jumio’s identity- verification software is integrated into the Binance App, the Court cannot determine the extent to

which requiring Jumio to comply with BIPA would necessitate changes to how Binance does business, such that BIPA might be considered as applying “in any manner” to Binance. That is a determination more appropriately made with the benefit of discovery at the summary judgment stage of the proceedings. Accordingly, Jumio’s motion to dismiss Davis’s Complaint based on the financial- institution exemption is denied. II. Extraterritorial Application of BIPA The Court next turns to Jumio’s argument that the extraterritoriality doctrine bars Davis’s suit. In its opening brief in support of its motion to dismiss, Jumio contends that Davis does not

allege that any relevant conduct occurred in Illinois aside from his allegation that he is an Illinois resident. Davis, however, has added allegations in his response brief. And so Jumio now claims that Davis has failed to allege that any of Jumio’s conduct happened in Illinois. In making its determination, the Court will consider Davis’s elaborations to the Complaint’s factual allegations in his response brief.4

4 “[A] party responding to a motion to dismiss ‘may elaborate on his factual allegations so long as the new elaborations are consistent with the pleadings.’” Krafcky v. Frued Am., Inc., No. 19-CV-4234, 2022 WL 4132495, at *2 (N.D. Ill. Sept. 12, 2022) (quoting Geinosky v. City of Chicago, 675 F.3d 743, 745 n.1 (7th Cir. 2012)). In the Complaint, Davis alleges that he is an Illinois resident, Jumio is headquartered in California, Jumio conducts business transactions in Illinois, Jumio is aware that it collects biometric data from Illinois residents, and Davis uploaded a facial photograph and a photograph of his driver’s license on the Binance App in January 2021. (Compl. ¶¶ 8–10, 33.) However, Davis did not specify where he uploaded the photograph of his driver’s license and his facial photograph on the Binance App. In Illinois, “a statute is without extraterritorial effect unless a clear intent in this respect appears from the express provisions of the statute.” Avery v. State Farm Mut. Auto. Ins. Co., 835 N.E.2d 801, 852 (Ill. 2005) (internal quotation marks and citations omitted). Here, following the lead of the majority of courts to consider the issue, the parties agree that BIPA does not apply extraterritorially. See, e.g., Mahmood v. Berbix, Inc., No. 22 C 2456, 2022 WL 3684636, at *1

(N.D. Ill. Aug. 25, 2022); Ronquillo v. Dr.’s Assocs., LLC, 597 F. Supp. 3d 1227, 1233 (N.D. Ill. 2022); Monroy v. Shutterfly, Inc., No. 16 C 10984, 2017 WL 4099846, at *5 (N.D. Ill. Sept. 15, 2017). Therefore, for BIPA to apply to Jumio’s conduct, the circumstances relating to the disputed transaction must have occurred “primarily and substantially in Illinois.” Avery, 835 N.E.2d at 853–54. Yet “there is no single formula or bright-line test for determining whether a transaction occurs within this state. Rather, each case must be decided on its own facts.” Id. at 854. Relevant factors include “the residency of the plaintiff, the location of harm, communications between parties (where sent and where received), and where a company policy is carried out.” Rivera v. Google Inc., 238 F. Supp. 3d 1088 (N.D. Ill. 2017) (citing Avery, 835

N.E.2d at 854). Considering the allegations in the Complaint, as supplemented by the additional facts in his response brief, the Court finds that Davis has plausibly alleged that Jumio’s BIPA violations occurred primarily and substantially in Illinois. Specifically, Davis alleges that he is an Illinois resident, that Jumio conducts businesses transactions in Illinois, and that he submitted a photograph of his driver’s license and photograph of his face on the Binance App from Illinois.

In his response brief, Davis states that he registered on the Binance App in Illinois and Jumio collected his biometric identifiers from Illinois. (PROMD at 9.) The Court finds these factual allegations in the response brief consistent with the Complaint, and thus will consider them in deciding the motion to dismiss. Viewing those allegations in the light most favorable to Davis, they are sufficient at the pleadings stage plausibly to allege that circumstances relating to the alleged BIPA violation occurred in Illinois. See, e.g., Mahmood, 2022 WL 3684636, at *2 (finding that the plaintiff alleged sufficiently that BIPA violations occurred primarily and substantially in Illinois, where she alleged that she was an Illinois resident and uploaded her driver’s license on the defendant’s

platform while she was in Illinois); Ronquillo, 597 F. Supp. 3d at 1234 (holding that the plaintiff plausibly alleged that BIPA violations occurred primarily and substantially in Illinois, where she claimed that she scanned her fingerprints at a site in Illinois and the defendant’s hardware— located in Illinois— stored her fingerprints); Monroy, 2017 WL 4099846, at *6 (concluding that the plaintiff’s suit survived a motion to dismiss where the plaintiff alleged that a user uploaded his photograph to the defendant’s website in Illinois, the user was an Illinois resident, and that the defendant’s failure to obtain the required consent occurred in Illinois); cf. Patel v. Facebook, Inc., 932 F.3d 1264, 1276 (9th Cir. 2019) (“[I]t is reasonable to infer that the General Assembly contemplated BIPA’s application to individuals who are located in Illinois, even if some relevant

activities occur outside the state.); Rivera, 238 F. Supp. 3d. at 1102 (noting that it would not “necessarily be dispositive” if the defendant conducted its facial scanning of plaintiff’s photograph outside of Illinois). Neither of the cases cited by Jumio requires a contrary result. In Neals v. PAR Technology Corp., 419 F. Supp. 3d 1088 (N.D. Ill. 2019), the plaintiff sued the developer of a biometric finger scanner that her employer used to track employees’ time. 419 F. Supp. 3d at 1089–90. The Neals court dismissed the plaintiff’s BIPA claim, on the basis of the extraterritoriality doctrine, due to the fact that the plaintiff failed to specify her employer’s location or allege that she scanned her fingerprints into the defendant’s system in Illinois. Id. at 1090. But the court also emphasized that plaintiff were able to so allege, then she would sufficiently allege facts indicating that the circumstances relating to the alleged transaction occurred primarily and substantially in Illinois.” Id. at 1091. Here, Davis alleges that he uploaded a photograph of his face and a photograph of his driver’s license from Illinois. In McGoveran v. Amazon Web Services., Inc., No. 20-1399, 2021 WL 4502089 (D. Del. Sept. 30, 2021), the plaintiffs, who were Illinois residents, sued out-of-state service providers for allegedly using biometric voiceprint authentication on the plaintiffs’ calls to a call center. 2021 WL 4502089, at *1-2. The McGoveran court held that the plaintiffs’ claims were barred by the extraterritoriality doctrine because the complaint did not indicate that the defendants did anything in Illinois; the only connections to Illinois were the plaintiffs’ residency and the fact that plaintiffs called the call center from Illinois. /d. at *4, *6. But McGoveran, a district court case from outside of this Circuit, represents a minority view regarding what a BIPA plaintiff must allege. And moreover, McGoveran is arguably distinguishable from the present case because Davis alleges that Jumio conducts business transactions in Illinois, suggesting an additional nexus to Illinois beyond Davis’s residency and the source of his biometric data. Thus, the Court also denies Jumio’s motion to dismiss based on the extraterritoriality doctrine. In so doing, the Court acknowledges that discovery may reveal that the connection to Illinois is sufficiently tenuous as to warrant revisiting the matter at the summary judgment stage of the proceedings. But for now, Davis’s claim survives. CONCLUSION Accordingly, for the foregoing reasons, Jumio’s motion to dismiss (Dkt. No. 14) is denied. ENTERED:

Dated: February 14, 2023 iL po Andrea R. Wood United States District Judge