Mallouk v. Amazon.com Inc

Opinion

UNITED STATES DISTRICT COURT WESTERN DISTRICT OF WASHINGTON AT SEATTLE

SUZANNE MALLOUK, ALFREDO Case No. C23-852-RSM RODRIGUEZ PEREZ, ARJUN DHAWAN, and WILLIAM NOVOLT ORDER GRANTING IN PART AND DENYING IN PART Plaintiffs, DEFENDANTS’ MOTION TO DISMISS v. AMAZON.COM, INC. and STARBUCKS CORPORATION, Defendants.

This matter comes before the Court on Defendants Amazon.com, Inc. and Starbucks Corporation (collectively, “Defendants”)’s Motion to Dismiss for Failure to State a Claim, Dkt. #45. Plaintiffs Suzanne Mallouk, Alfredo Rodriguez Perez, Arjun Dhawan, and William Novolt (collectively, “Plaintiffs”) oppose the Motion. Dkt. #49. The Court has determined it can rule on the Motion without the need for oral argument. For the reasons stated below, the Court GRANTS IN PART and DENIES IN PART Defendants’ Motion to Dismiss. Unless stated otherwise, the following facts are drawn from Plaintiffs’ Amended Complaint, Dkt. #42. Plaintiffs filed their Amended Complaint on September 8, 2023. Dkt. #42. Plaintiffs bring this putative class action for damages and other remedies resulting from Amazon’s and Starbucks’ alleged illegal actions of retaining, storing, collecting, profiting, etc. from Plaintiffs’ and others’ biometric identifier information. Plaintiffs raise claims pursuant to: (1) New York City’s Biometric Identifier Information Law, N.Y.C. Admin. Code § 22-1202(a); (2) N.Y.C. Admin. Code § 22-1202(b); and (3) unjust enrichment. Plaintiffs seek class certification, compensatory, statutory, and punitive damages, prejudgment interest, restitution, injunctive relief, and reasonable attorneys’ fees and costs. A. New York City’s Biometric Identifier Information Law In 2021, New York City enacted its Biometric Identifier Information Law to address the growing use of biometric identifier information by commercial establishments. This law makes it unlawful for companies to “sell, lease, share in exchange for anything of value or otherwise profit from the transaction of biometric identifier information.” N.Y.C. Admin. Code § 22-1202(b). The law also has a disclosure provision, requiring these companies that store, collect, share, etc. biometric identifier information to disclose such actions “by placing a clear and conspicuous sign near all . . . entrances notifying customers in plain, simple language” prescribed by the Commissioner of Consumer and Worker Protection. N.Y.C. Admin. Code § 22-1202. Violations of these provisions provide statutory remedies and monetary amounts for those harmed. However, to succeed on a claim for violating the required sign disclosure, a prospective plaintiff must first send the company notice of the defect and allow the company thirty days to cure it. No such notice requirement is attached to a violation of selling, sharing, or otherwise profiting from the exchange of a plaintiff’s biometric identifier information. The law defines biometric identifier information as “a physiological or biological characteristic that is used by or on behalf of a commercial establishment, singly or in combination, to identify, or assist in identifying, an individual, including, but not limited to: (i) a retina or iris scan, (ii) a fingerprint or voiceprint, (iii) a

scan of hand or face geometry, or any other identifying characteristic.” N.Y.C. Admin. Code § 22-1201. B. Amazon “Just Walk Out” Technology In 2018, Amazon launched its Amazon Go stores, selling consumer goods using a feature called “Just Walk Out” technology. This technology uses computer vision, algorithms, and “sensor fusion” to combine data from sensors and cameras within the store. This technology allows Amazon to identify and track the movements of a customer shopping in the store. To enter an Amazon Go store, customers either scan a credit card, a QR code generated by the Amazon mobile app, or scan their palms registered through Amazon One technology. Using cameras and sensors, Amazon can personally identify customers in the store and use identifying information to determine what products a customer decides to buy or not buy. Customers are then able to simply just walk out of the store with their chosen products. Using the identifying information while in the store, Amazon detects what products the customers chose to walk out with and charges the cost to customers’ credit cards or Amazon accounts, depending on the customer’s method of entering the store. C. Starbucks-Amazon Go In November 2021, Amazon and Starbucks collaborated to combine the Starbucks Pickup and Amazon Go experiences into one location. At these storefronts, customers can order ahead through the Starbucks app to pickup beverages from the Starbucks side of the store, but customers also can enter an Amazon Go market at the same location to browse additional items and utilize a lounge area to enjoy both Starbucks and Amazon

Go products. While Starbucks purchases are made through the Starbucks application, Amazon Go purchases are acquired using the Just Walk Out technology. D. Plaintiffs Plaintiffs entered Starbucks-Amazon Go stores throughout 2022 and 2023 by using QR codes, palm scans, and a credit card. Plaintiffs did not see the required signage notifying them that biometric identifier information was being collected. Afterward, Plaintiffs Rodriguez Perez, Mallouk, and Novolt mailed letters to Amazon (Mallouk to Starbucks as well) stating that the stores did not provide the required signage notifying customers that biometric information was being collected. Plaintiff Mallouk received no response from Starbucks. Plaintiff Rodriguez Perez received no response from Amazon. Plaintiffs Novolt and Mallouk, however, did receive responses from Amazon. Amazon’s response to Plaintiff Novolt stated that the Starbucks-Amazon Go store did not collect, retain, or share data as the NYC law required, thus the signage was not required. Amazon’s response to Plaintiff Mallouk also stated that the Starbucks-Amazon Go store was not required to post signage pursuant to the NYC statute, but they had installed signage at the store Plaintiff Mallouk used. However, Plaintiffs allege that this signage only warns of collecting biometric identifier information through its use of palm scans, not by using identifier information on every customer who enters the Amazon Go store. A. Legal Standard

a. Standing and Rule 12(b)(1) Pursuant to Article III of the US. Constitution, federal courts have limited jurisdiction to hear only live “cases” and “controversies.” Lujan v. Defenders of Wildlife, 504 U.S. 555, 559 (192); U.S. CONST. art III, § 2. Accordingly, “Article III standing is a necessary component of subject matter jurisdiction.” In re Palmdale Hills Prop., LLC, 654 F.3d 868, 873 (9th Cir. 2011). To satisfy the case-or-controversy requirement, “a plaintiff must show (1) it has suffered an ‘injury in fact’ that is (a) concrete and particularized and (b) actual or imminent, not conjectural or hypothetical; (2) the injury is fairly traceable to the challenged action of the defendant; and (3) it is likely, as opposed to merely speculative, that the injury will be redressed by a favorable

decision.” Friends of the Earth, Inc. v. Laidlaw Envtl. Servs. (TOC), Inc., 528 U.S. 167, 180-81 (2000). When a plaintiff lacks standing, dismissal under Federal Rule of Civil Procedure 12(b)(1) is appropriate. See Maya v. Centex Corp., 658 F.3d 1060, 1067 (9th Cir. 2011); Walsh v. Microsoft Corp., 63 F.Supp. 3d 1312, 1317-18 (W.D. Wash. 2014). A motion to dismiss under Rule 12(b)(1) can attack the factual allegations establishing standing or can attack plaintiff’s standing facially. Leite v. Crane Co., 749 F.3d 1117, 1121 (9th Cir. 2014). “The district court resolves a facial attack as it would a motion to dismiss under 12(b)(6): Accepting the plaintiff’s allegations as true and drawing all reasonable inferences in the plaintiff’s favor, the court determines whether the allegations are sufficient as a legal matter to invoke the court’s jurisdiction.” Id. at 1121 (citing Pride v. Correa, 719 F.3d 1130, 1133 (9th Cir. 2013)). At the pleading stage, a plaintiff need not satisfy Iqbal/Twombly’s1 plausibility standard but “must ‘clearly . . . allege facts demonstrating’ each element” of standing. Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016) (citing Warth v. Seldin, 422 U.S. 490, 518 (1975)). As such, the inquiry does not touch directly on the merits of the plaintiff’s case. See Maya, 658 F.3d at 1068 (contrasting with consideration of a Rule 12(b)(6) motion which “necessarily assesses the merits of the plaintiff’s case”). b. Rule 12(b)(6) In making a 12(b)(6) assessment, the court accepts all facts alleged in the complaint as true and makes all inferences in the light most favorable to the non-moving party. Baker v. Riverside County Office of Educ., 584 F.3d 821, 824 (9th Cir. 2009) (internal citations omitted). However, the court is not required to accept as true a “legal conclusion couched as a factual allegation.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Twombly, 550 U.S. at 555 (2007)). The complaint “must contain sufficient factual matter, accepted as true, to state a claim to relief that is plausible on its face.” Id. at 678. This requirement is met when the plaintiff “pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Id. The complaint need not include detailed allegations, but it must have “more than labels and conclusions, and a formulaic recitation of the elements of a cause of action will not do.” Twombly, 550 U.S. at 555. Absent facial plausibility, a plaintiff’s claims must be dismissed. Id. at 570. Where a complaint is dismissed for failure to state a claim, “leave to amend should be granted unless the court determines that the allegation of other facts consistent with the

1 See Ashcroft v. Iqbal, 556 U.S. 662 (2009) and Bell Atl. Corp. v. Twombly, 550 U.S. challenged pleading could not possibly cure the deficiency.” Schreiber Distrib. Co. v. Serv-Well Furniture Co., 806 F.2d 1393, 1401 (9th Cir. 1986). B. Analysis a. Article III Standing Defendants first argue that Plaintiffs lack Article III standing because Plaintiffs consented to the use of Amazon’s technology. Dkt. #45 at 12-17. Drawing all inferences in a light most favorable to Plaintiffs as the non-moving party, the Court finds several reasons to side with Plaintiffs on this issue. First, unlike other laws on biometric identifying information, NYC’s law does not include a consent limitation or defense. § 22-1202(a) specifically states that businesses must post “clear and conspicuous sign[age]” by all entrances in order to notify customers that their information is being collected, stored, or shared. Furthermore, exactly what Plaintiffs are consenting to when entering an Amazon Go store is questionable. Plaintiffs entered the stores using several mechanisms, including by scanning a credit card, their palms, or a digital QR code from their personal Amazon accounts. Dkt. #42 at 46-57. Defendants attempt to distinguish Plaintiffs Dhawan and Novolt from the group because they registered their palms at Amazon One kiosks, implying they specifically consented to Amazon’s use of the JWO Technology. Id. at 148, 155; Dkt. #45 at 16-17. But it is unclear what Plaintiffs Dhawan and Novolt consented to concerning their palm scans. As the Amended Complaint alleges, Plaintiff Dhawan scanned his palm to enter the store. Dkt. #42 at 148. However, Plaintiff Dhawan possibly registered his palm at an Amazon kiosk for other reasons, such as to make a purchase at a Whole Foods Market. Though the Amended Complaint says that Plaintiff Novolt registered his palm at the Amazon Go store, it is still unclear whether Plaintiff Novolt was consenting to the use and storage of his biometric information or if he simply thought it the easiest method or required to enter the store. Id. at 155. Furthermore, as the NYC law does not include a consent exemption or defense, the Court is inclined to agree with Plaintiffs that NYC requires specific signage for adequate notice and consent to occur. Dkt. #49 at 9. Drawing all reasonable inferences in Plaintiffs’ favor, the Court finds that these issues of notice and consent are questions of fact best left to a jury and not for this Court to decide on a motion to dismiss. b. Notice Requirement Defendants argue that Plaintiff Dhawan and the absent class members must be dismissed from Count 1 of the First Amended Complaint for failure to comply with the New York City (“NYC”) statute’s notice requirement. Dkt. #45 at 17. Plaintiffs contend that Plaintiffs Mallouk, Perez, and Novolt gave the required pre-notice for themselves, Plaintiff Dhawan, and the class members because the statute only requires that the named plaintiff who initiates the statute must provide notice, not absent class members who might join later. Dkt. #49 at 14-18. When interpreting a statute, this Court is guided by the fundamental canons of statutory construction and begins with the statutory texts. See BedRoc Ltd., LLC v. United States, 541 U.S. 176, 183 (2004). The Court interprets statutory terms in accordance with their ordinary meaning, unless the statute clearly expresses an intention on the contrary. United States v. Ron Pair Enters., Inc., 489 U.S. 235, 242 (1989). Furthermore, the Court must “interpret [the] statut[e] as a whole, giving effect to each word and making every effort not to interpret a provision in a manner that renders other provisions of the same statute inconsistent, meaningless or superfluous.” Boise Cascade Corp. v. U.S. E.P.A., 942 F.2d 1427, 1432 (9th Cir. 1991). Additionally, “[p]articular phrases must be construed in light of the overall purpose and structure of the whole statutory scheme.” United States v. Lewis, 67 F.3d 225, 228-29 (9th Cir. 1995). Here, a review of the record and law reveals that NYC’s overall purpose is to limit statutory damages to plaintiffs who fully comply with statutory pre-notice requirements. The statute specifically states that a person aggrieved by a commercial establishment not posting clear and conspicuous signage may commence an action “on his or her own behalf[,]” and this aggrieved person must provide written notice to the offending party before initiating an action. See N.Y.C. Admin. Code § 22-1203. The basic language of the statute clearly appears to limit recovery for no proper signage to plaintiffs who comply with the pre-suit notice. Therefore, based on the plain meaning of the statute, the Court finds that purported class action members and Plaintiff Dhawan must be dismissed from Count 1 for failure to comply with the pre-suit notice requirement. c. Sufficient Facts Defendants argue that Plaintiffs Dhawan and Mallouk fail to plead sufficient fact to allege a violation of NYC § 22-1201(b). Dkt. #45 at 20-21. Plaintiffs contend that Amazon and Starbucks have profited from the sharing of biometric identifier information with third parties such as Panera Bread stores and T-Mobile Stadium, that Starbucks collects palm images and size and shape information from customers it shares with Amazon’s outside servers, and that Amazon received “monetary compensation” for sharing its palmprint databases, as well as “tangible and intangible benefits” including opportunities to install more devices, advertising, and growing and improving its database and technology by sharing biometric data with third-party retailers . Dtks. #42 at 77-79, #49 at 18-21. Under § 22-1201(b), it is “unlawful [for a commercial establishment] to sell, lease, trade, share in exchange for anything of value or otherwise profit form the transaction of biometric identifier information.” NYC § 22-1201(b). Here, Plaintiffs identify two main parties Amazon allegedly shared biometric identifier information with: Starbucks and Whole Foods. Dkt. #42 at 77. Plaintiffs also, as mentioned above, mention Panera Bread retailers and T-Mobile Stadium. Dkt. #49 at 19. Regarding Whole Foods, even assuming that Plaintiffs conclusively proved Amazon shares biometric identifier information with Whole Foods, the Court fails to see how this would violate § 22-1201(b) since Amazon owns Whole Foods and does not constitute a “third party” under the statue. Between Amazon and Starbucks (and other third parties), Plaintiffs contend that Amazon “provides . . . palm scanner devices and databases to . . . Starbucks-Amazon Go stores in New York City.” Dkt. #42 at 3-4. Specifically, Plaintiffs’ theory is as follows: [Amazon has] gained [and] profited from sharing, leasing, trading or selling its Amazon One devices and databases by . . . allow[ing[ Amazon to link individuals’ biometric information to other valuable forms of information [like] . . . consumers’ phone numbers, credit or debit card numbers, and in-store activities like purchase history . . . allowing Amazon (or other third parties willing to pay Amazon for such packaged data) to make more targeted advertising, marketing, pricing, and promotional decisions.

Id. at 65-66. The Court finds Plaintiffs’ theory unpersuasive. First, § 22-1201(b) does not prohibit companies from receiving “any benefit, no matter how attenuated, from the sharing of biometric data. Rather it makes it unlawful for companies to ‘profit from the transaction itself.’” Gross v. Madison Square Garden Ent. Corp., 2024 WL 2055343, at *1 (S.D.N.Y. May 7, 2024). Here, the profit Plaintiffs allege appears to “flow from defendant’s employment of broader program, albeit one advanced by biometric data sharing.” Id. Second, if “profit” were construed as liberally as Plaintiffs posit, § 22-1201(b) would essentially nullify § 22-1201(a), since it would effectively ban all biometric data sharing that is useful, thus rendering the notice requirement meaningless. See Gross at *1. Taking all reasonable inferences in a light most favorable to Plaintiffs, the Court finds that – at least on the facts alleged – Defendants’ use of biometric data is a tool or element it uses to further its business goals and not a violation within the meaning of § 22-1201(b). d. Unjust Enrichment Defendants argue that Plaintiffs’ unjust enrichment claim must be dismissed because: (1) Plaintiffs Dhawan and Novolt did not allege that they purchased anything in the Amazon Go store; (2) it is duplicative of their other claims; and (3) there is a valid contract between the parties. Dkt. #45 at 21-22. Plaintiffs contend that: (1) the Complaint alleges the Plaintiffs did make purchases, and even if they did not, “Defendants were still enriched by obtaining Plaintiffs’ biometric data and sharing it for profit[;]” (2) the claim is not duplicative but “in the alternative[;]” and (3) any contract between the parties is “lacking” because Plaintiffs “did not consent to Defendants’ collection of their biometric information[.]” Dkt. #49 at 21. Washington law is clear that “[u]njust enrichment is the method of recovery for the value of the benefit absent any contractual relationship[.]” Young v. Young, 164 Wn.2d 477, 484, 191 P.3d 1258, 1262 (2008) (emphasis added); see Chandler v. Wash. Toll Bridge Auth., 17 Wn.2d 591, 604, 137 P.2d 97 (Wash. 1943) (“A party to a valid express contract is bound by the provisions . . . and may not disregard the same and bring an action on an implied contract relating to the same matter[.]”); see also Pengbao Xia v. Feast Buffet, Inc., 387 F. Supp. 3d 1181, 1191 (W.D. Wash. 2019 (“Where a valid contract governs the rights and obligations of the parties, unjust enrichment does not apply.”). Under New York law, where “there is a bona fide dispute as to the existence of a contract, or where the contract does not cover the dispute in issue, a plaintiff may proceed upon a theory of quasi-contract” unjust enrichment. AHA Sales, Inc. v. Creative Bath Products, Inc., 867 N.Y.S.2d 169, 180 (N.Y. App. Div. 2008). As discussed above, while the parties might have a valid contract, it is unclear exactly what Plaintiffs consented to by signing up for palm scans and/or entering the Starbucks-Amazon Go store. Therefore, whether the contract governs these terms or not, Plaintiffs are not barred by neither Washington nor New York law from bringing an unjust enrichment claim because of a contract. The Court is still unconvinced that all Plaintiffs have a survivable unjust enrichment claim at this point. Plaintiffs argue that they would not have entered and made purchases in the store if they had known Amazon was collecting biometric identifier information. Dkt. #48 at 21. However, Plaintiffs fail to allege facts sufficiently showing how Amazon profited or was otherwise unjustly enriched by this process because it is not clear that Amazon shared any biometric identifier information for profit. Though Plaintiffs argue they would not have made purchases had they known of this collection, this appears duplicative of Plaintiffs claims under § 22-1201(a), which provide for recovery due to lack of required notice. However, while unjust enrichment claims brought by Plaintiffs with § 22-1201(a) claims might be duplicative, Plaintiffs such as Dhawan and others who failed to provide the required pre-suit notice to succeed on a § 22-1201(b) could bring unjust enrichment claims under the premise that they would not have made store purchases if they had known Amazon was collecting biometric identifier information. Though Defendants state that Plaintiff Dhawan does not allege that he purchased anything in the store, taking all reasonable inferences in Plaintiffs’ favor, the Complaint does allege that Plaintiff Dhawan “would not have entered the Amazon Go store or purchased anything from the store, or would not have paid as much for the items he purchased” if he had known Amazon was collecting his information. Thus, the Court finds that Plaintiff Dhawan does have a potential unjust enrichment claim. e. Starbucks Defendants argue that Starbucks should be dismissed from the case because Starbucks is distinct from the Amazon-portion of the Starbucks-Amazon Go store, and Starbucks does not collect, retain, sell, or trade biometric identifier information or otherwise violate § 22-1201(b). Dkt. #45 at 23. Defendants note that none of the Plaintiffs allege to have even used the Starbucks portion of the store. Id. at 23-24. Plaintiffs contend that Starbucks cannot be dismissed because the Starbucks-Amazon Go store is a single store where biometric identifier information is being shared between Amazon and Starbucks upon entering the store. Dkt. #49 at 21-23. The Court finds that, taking all inferences in a light most favorable to Plaintiffs, Starbucks should be dismissed for similar reasons to dismissal of Plaintiffs’ claims under § 22-1201(b). Though Starbucks employees work in the store and, perhaps, direct and instruct customers on palm scanning and entering the gated area, as Plaintiffs allege, Plaintiffs fail to allege sufficient facts that Starbucks plays any part in the control of the Just Walk Out technology or otherwise share in biometric identifier information as defined under § 22-1201(b). For similar reasons to Plaintiffs’ § 22-1201(b) claims warranting dismissal, at this stage, Starbucks shall be dismissed as a defendant in this case. IV. CONCLUSION Having revied the relevant pleadings and briefings and the remainder of the record, the Court finds and ORDERS that Defendants’ Motion to Dismiss, Dkt. #45, is GRANTED IN PART and DENIED IN PART as follows: (1) Plaintiff Dhawan’s and purported class members’ claims under N.Y.C. Admin. Code § 22-1201(a) are DISMISSED; (2) Plaintiffs’ claims under N.Y.C. Admin. Code § 22-1201(b) are DISMISSED; (3) Defendant Starbucks is DISMISSED from this case; (4) Plaintiff Dhawan’s unjust enrichment claim STANDS. All other Plaintiffs’ unjust enrichment claims are DISMISSED. DATED this 23rd day of July, 2024. A RICARDO S. MARTINEZ UNITED STATES DISTRICT JUDGE