Mayhall v. Amazon Web Services Inc

Opinion

UNITED STATES DISTRICT COURT WESTERN DISTRICT OF WASHINGTON ANN MAYHALL, on behalf of her Minor CASE NO. 2:21-cv-01473-TL Child, D.M., individually and on behalf of all others similarly situated, ORDER ADOPTING REPORT AND Plaintiff, RECOMMENDATION v. AMAZON WEB SERVICES, INC. and Defendants.

This matter comes before the Court on the Report and Recommendation of United States Magistrate Judge Michelle L. Peterson (“R&R”) (Dkt. No. 31) on Defendants Amazon Web Services Inc. (“AWS”) and Amazon.com, Inc.’s Motion to Dismiss Complaint (Dkt. No. 18) and Defendants’ objections to the R&R (Dkt. No. 32). The Court has reviewed the R&R, Defendants’ objections, Plaintiff’s response to Defendants’ objections (Dkt. No. 33), and the remaining record. The Court finds oral argument unnecessary (see LCR 7(b)(4)), ADOPTS the Report and Recommendation, and OVERRULES the objections. Plaintiff Ann Mayhall filed this case on behalf of her minor child, D.M. Dkt. No. 1 at 1. At the core of this case is what involvement Defendants AWS and Amazon.com, Inc. have with respect to the biometric data created by players of NBA 2K, a basketball video game published

by Take 2 Interactive Software, Inc. (“Take 2”) and its subsidiary 2K Games Inc. Dkt. No. 1 ¶¶ 9, 77–81. The Court assumes familiarity with the detailed facts as described in the R&R. Dkt. No. 31 at 2–6. In brief, the relevant facts for the purposes of this motion as alleged in Plaintiff’s Complaint are as follows. Plaintiff alleges that Take 2 utilizes Amazon’s cloud-computing services for, inter alia, computing storage, and to provide the infrastructure to deliver its games to internet-connected gaming platforms.1 Id. ¶¶ 9–11, 83–85. Players of NBA 2K, such as Plaintiff’s minor child, take and scan multiple photos of their faces on the Take 2 app and upload those images to the AWS/Amazon cloud to make customized players resembling the user. Id. ¶¶ 13, 93–103. When players log on to insert their faces onto a player in the game, AWS and/or

Amazon uses its computing power to collect facial features vectors from the face-scan data to construct a 3D face geometry of the user (“Face Geometry”). Id. ¶¶ 106, 141–42. Once the Face Geometry is created, AWS and/or Amazon transmits the Face Geometry to the players’ Gaming Platforms. Id. ¶¶ 107, 144. The process of retrieving the Face Geometry as well as any associated data is repeated each time a player uses their custom player. Id. ¶¶ 113, 117, 150. AWS and/or Amazon also stores the data based on the Face Geometry used to identify individual players. Id, ¶¶ 110, 145.

1 Take 2 and/or 2K Games use AWS/Amazon cloud-computing to deliver its games to the following internet- connected gaming platforms: X-Box, PlayStation, Nintendo Switch, and the personal computers of users who play the game on Steam (collectively, the “Gaming Platforms”). Id. ¶¶ 84–85. Defendants moved to dismiss the Complaint under Federal Rule of Civil Procedure 12(b)(6). Dkt. No. 18. Judge Peterson recommended that the motion to dismiss be denied, for the reasons spelled out in the R&R. Dkt. No. 31. Defendants objected (Dkt. No. 32), and Plaintiff has responded to Defendants’ objection (Dkt. No. 33).

A. District Court Review of a Report and Recommendation A district court has jurisdiction to review a magistrate judge’s report and recommendation on dispositive matters. See Fed. R. Civ. P. 72(b). The district court “shall make a de novo determination of those portions of the report or specified proposed findings or recommendations to which objection is made.” 28 U.S.C. § 636(b)(1); see also Fed. R. Civ. P. 72(b)(3) ( “The district judge must determine de novo any part of the magistrate judge’s disposition that has been properly objected to.”). “The district judge may accept, reject, or modify the recommended disposition; receive further evidence; or return the matter to the magistrate judge with instructions.” Fed. R. Civ. P. 72(b)(3); accord 28 U.S.C. § 636(b)(1). A

party properly objects when the party files “specific written objections” to the report and recommendation as required under Federal Rule of Civil Procedure 72(b)(2). Defendant filed timely objections to the report and recommendation, and Plaintiff filed a timely response to the objections. B. Motions to Dismiss A complaint must include “a short and plain statement of the claim showing that the pleader is entitled to relief.” Fed. R. Civ. P. 8(a)(2). In reviewing a Rule 12(b)(6) motion to dismiss, the Court takes all well-pleaded factual allegations as true and considers whether the complaint “state[s] a claim to relief that is plausible on its face.” Ashcroft v. Iqbal, 556 U.S. 662,

678 (2009); accord Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555–56 (2007). The Court “accept[s] as true all facts alleged in the complaint and construe[s] them in the light most favorable to plaintiff[], the non-moving party.’” DaVinci Aircraft, Inc. v. United States, 926 F.3d 1117, 1122 (9th Cir. 2019) (quoting Snyder & Assocs. Acquisitions LLC v. United States, 859 F.3d 1152, 1156–57 (9th Cir. 2017)). While “[t]hreadbare recitals of the

elements of a cause of action, supported by mere conclusory statements” are insufficient, a claim has “facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Iqbal, 556 U.S. at 672, 678. A. Preliminary Matters 1. Exhibit C to Defendants’ Motion The Court finds no error in the Magistrate Judge’s ruling with regard to Exhibit C. Dkt. No. 31 at 10. The Court agrees that it should err on the side of caution and not consider the exhibit in evaluating Defendants’ Motion to Dismiss, given the dispute as to the accuracy and

nature of the document. 2. Rule 8(a)(2) Pleading as to Amazon.com, Inc. Federal Rule of Civil Procedure 8(a)(2) does not require that a complaint set forth a “defendant’s precise role in the injurious conduct.” Silicon Knights, Inc. v. Crystal Dynamics, Inc., 983 F. Supp. 1303, 1308 (N.D. Cal. 1997) (citation omitted). A complaint only needs to “put [defendants] on notice as to the nature of the allegations against them and their relationship to the actions at issue in the case.” Id. (quotation omitted). The Court also finds that Plaintiff’s Complaint outlines the interrelatedness of AWS and Amazon.com in both their infrastructure generally (see Dkt. No. 1 ¶¶ 59–64), and the provision of services to video game companies such

as Take 2 (id. ¶¶ 61–66). Therefore, the allegations in the Complaint suffice to put Amazon.com, Inc. on notice of the claims against it. See Tivoli LLC v. Sankey, No. C14-1285, 2015 WL 12683801, at *3 (C.D. Cal. Feb. 3, 2015) (“Group pleading is not fatal to a complaint if the complaint still gives defendants fair notice of the claims against them.”). B. The BIPA Claims

Plaintiffs allege that Defendants violated Illinois’s Biometric Information Privacy Act (“BIPA”), 740 Ill. Comp. Stat. 14/1 et seq. BIPA was enacted to help regulate “the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information.” Rosenbach v. Six Flags Ent. Corp., 129 N.E.3d 1197, 1203 (Ill. 2019). BIPA “imposes numerous restrictions on how private entities collect, retain, disclose and destroy biometric identifiers, including . . . scans of . . . face geometry. ” Id. at 1199 (quoting 740 Ill. Comp. Stat. 14/20). 1. Section 15(a) Pursuant to Section 15(a) of BIPA, a private entity in possession of biometric identifiers or biometric information must develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within 3 years of the individual’s last interaction with the private entity, whichever occurs first. 740 Ill. Comp. Stat. 14/15(a). a. Possession BIPA does not define “possession.” See 740 Ill. Comp. Stat. 14/10. Defendants assert that “the exercise of control is the touchstone of ‘possession’ under Section 15(a)” and object that the R&R “disregards a long line of cases” holding as much. Dkt. No. 32 at 9. But the R&R leads off with an Illinois Supreme Court case holding that possession “occurs when a person has or takes control of the subject property . . . .” Dkt. No. 31 at 14 (quoting People v. Ward, 830 N.E.2d 556, 560 (Ill. 2005)). Ward is the same case Defendants lead off with in their motion and cite in their objection. Compare Dkt. No. 31 at 14 with Dkt. No. 18 at 12 and Dkt. No. 32 at 9. In their introduction to their objection, Defendants try to portray themselves as simply offering cloud storage services where biometric data is merely “present on their servers.” Dkt.

No. 32 at 6–7. Defendants then fault the Magistrate Judge for “credit[ing] Plaintiff’s vague allegation that AWS took certain actions—creating the face geometry and storing it on their servers . . .” (id. at 9 (quotations omitted)), though a court is supposed to accept as true the facts alleged in a complaint and construe them in them in the light most favorable to the plaintiff. DaVinci Aircraft, Inc., 926 F.3d at 1122. And Defendants’ very next sentence then admits that “when the Complaint is read as a whole, the only plausible interpretation is that Take-Two uploaded the photos it collected from [Plaintiff’s child] to its AWS account, extracted face geometry data from them using AWS computing power, and then stored the resulting face geometry data in its AWS account.” Dkt. No. 32 at 10 (emphasis added). Therefore, Defendants admit that the Complaint alleges that they did more than simply store biometric data on their

servers.2 The Complaint alleges that Defendants use their computing power not only to collect facial features vectors from face-scan data for Take 2 but also to construct a 3D Face Geometry of the user, which Defendants then transmit to the players’ Gaming Platforms. Dkt. No. 1 ¶¶ 106–07. These allegations more than suffice to infer Defendants had control over Plaintiff’s biometric data—and, therefore, possessed the data under Section 15(a) of BIPA—for the purposes of a motion to dismiss. See Wilk v. Brainshark, Inc., No. C21-4794, 2022 WL 4482842, 2 Defendants inappropriately raised this policy argument for the first time in their objection. United States v. Howell, 231 F. 3d 615, 621–22 (9th Cir. 2000) (a district court need not consider arguments presented for the first time in objections to a report and recommendation). However, the facts alleged in the Complaint make it unnecessary for the Court to consider the new policy argument regarding entities that merely provide cloud computing and storage services to other entities. Dkt. No. 32 at 1–2, 10. at *5 (N.D. Ill. Sept. 27, 2022) (denying Rule 12(b)(6) motion where allegations that defendant used its technology to scan plaintiff’s facial geometry from videos, analyzed those scans, and then developed reports for plaintiff’s employer were sufficient to establish possession under

b. Ripeness Defendants also object to the R&R’s conclusion that Plaintiff’s Section 15(a) claim is ripe because Plaintiff’s child continues to play the NBA 2K game with a personal avatar so the “initial purpose” of collection remains ongoing. Again, at the motion to dismiss stage of a case, the Court accepts the allegations in a complaint as true and construes them in the light most favorable to Plaintiff. DaVinci Aircraft, Inc. 926 F.3d at 1122. In doing so, the Court finds that Plaintiff adequately alleges facts for the Court to draw the reasonable inference that the “initial purpose” for collecting biometric data was satisfied once it was delivered to a player’s Gaming Platform. See Dkt. No. 1 ¶¶ 104–115; Dkt. No. 33 at 9. Further, the Court acknowledges that there is disagreement as to whether the “when”

clause in Section 15(a)3 describes what a written policy should cover or is a time trigger. The R&R discusses both sets of cases. Dkt. No. 31 at 16–17. In their response to Defendants’ objections (Dkt. No. 33 at 9), Plaintiffs point to Fluery v. Union Pacific Railroad Company, a case decided after the issuance of an R&R where a court interpreted the “when” clause “to explain what the policies must describe—not to create a time frame within which [those] policies must be developed.” No. C20-390, 2022 WL 1803357, at *4 (N.D. Ill. June 2, 2022). The Court 3 “A private entity in possession of biometric identifiers or biometric information must develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within 3 years of the individual’s last interaction with the private entity, whichever occurs first.” 740 Ill. Comp. Stat. 14/15(a) (emphasis added). agrees with the rationale in Fleury and interprets Section 15(a) to require the development of publicly available written policy regarding the retention and destruction of biometric identifiers or biometric information, at a minimum, as soon as an entity possesses the information. Id. at *4; see also Fox v. Dakkota Integrated Sys., LLC, 980 F.3d 1146, 1149 (7th Cir. 2020) (noting

Section 15(a) delineates three duties: “the duties to develop, publicly disclose, and comply with data retention and destruction policies” (emphasis removed)); Rogers v. CSX Intermodal Terminals, Inc., 409 F. Supp. 3d 612, 617 (N.D. Ill. 2019) (noting the Illinois Supreme Court has held that “the strategy adopted by the General Assembly was to head off . . . problems before they occur by imposing safeguards to insure that individuals’ and customers’ privacy rights in their biometric identifiers and biometric information are properly honored and protected to begin with” (citation and quotations omitted)). Any other reading simply does not make sense. First, reading the “when” clause as a time trigger would contradict the proactive approach to biometric data collection and retention that the General Assembly sought when it enacted BIPA. Id.; see also S.B. 2400, 95th Gen. Assemb. 1532–35 (Ill. 2007) (making clear that BIPA

requires affirmative action by covered entities to develop policy for retention and deletion of biometric information); Nseumen v. Dal Glob. Servs. Inc., No. C21-2630, 2021 WL 4728707, at *2 (N.D. Ill. Oct. 11, 2021) (an entity may not wait three years to develop a policy because “a claim regarding [defendant’s] failure to establish a retention and destruction policy involves a current violation, not a potential future violation” (emphasis in original)). Second, reading the “when” clause to be a time trigger would subject private entities in possession of biometric identifiers or information to not only keep track of their obligation to develop a written policy on a rolling basis for each individual affected but also seemingly could allow an entity to constantly change its policy for each individual. Defendant AWS has more than one million enterprise

customers who utilize its cloud storage and computing services. Dkt. No. 23 at 6, 8. The Court highly doubts that AWS (or any entity subject to BIPA) would actually want to potentially develop more than one million different policies and keep track of when those policies needed to be issued. The Court agrees with the R&R’s determination that Plaintiff’s Section 15(a) claim is

ripe. 2. Section 15(b) Section 15(b) requires a person’s informed consent and release before a private entity collects, purchases, receives through trade, or otherwise obtains that person’s biometric identified or biometric information. 740 Ill. Comp. Stat. 14/15(b). The parties disagree whether an entity must take an “active step” to collect, capture or otherwise obtain biometric information (see Dkt. No. 33 at 10), and the R&R held that an active step was required. Dkt. No. 31 at 20. Defendants object as to whether the R&R correctly found that they had taken any active steps. The same facts that establish that Defendants did not merely passively store information4 but actively possessed it also adequately show that they took active steps to otherwise obtain

biometric data from Plaintiff’s child, for purposes of surviving a motion to dismiss. See supra Section III.B.1.a; see also Dkt. No. 31 at 20–21. 3. Section 15(c) Section 15(c) states that “[n]o private entity in possession of a biometric identifier or biometric information may sell, lease, trade, or otherwise profit from a person's or a customer's biometric identifier or biometric information.” 740 Ill. Comp. Stat. 14/15(c). Defendants object to the R&R crediting Plaintiff’s allegations that “Defendants somehow ‘shared’ face geometry

4 The Court finds inapposite Jones v. Microsoft Corp., No. C22-3437, 2023 WL 130495 (N.D. Ill. Jan. 9, 2023), which Defendants submit as supplemental authority. Dkt. No. 45. In Jones, the district court found that the defendant (Microsoft) provided only one service (storage). Jones, 2023 WL 130495, at *4 (“Microsoft provided Paychex with one component (storage) that it used as part of its system for collecting and storing biometric data.”). ‘with Take-Two for a fee in order to use Defendant’s cloud computing services.’” Dkt. No. 32 at 13 (citing Dkt. No. 31 at 24–25). Once again, courts are supposed to accept the allegations pleaded in a complaint as true and construe them in the light most favorable to the non-moving party.

In particular, the R&R referenced Plaintiff’s allegations that “Defendants: (1) retrieve the photographs from Take-Two’s servers; (2) utilize the photographs and related data to create face geometry—the biometric identifier at issue in the case—on their servers; and (3) that the face geometry is then shared with Take-Two for a fee in order to use Defendants’ cloud computing services.” Dkt. No. 31 at 24–25. The Complaint specifically alleges that Defendants “received money from Take2/2K Games to create biometric identifiers of Plaintiff and the Class Members.” Dkt. No. 1 at ¶¶ 187, 224. These facts are sufficient for the Court to reasonably infer that Defendants possessed biometric data and otherwise profited from that information for purposes of surviving a motion to dismiss. Whether discovery will yield additional or contrary facts is unknown, but the Court takes into account the limited access plaintiffs often have to

crucial information that may be in the sole possession of the defendant. See Braden v. Wal-Mart Stores, Inc., 588 F.3d 585, 598 (8th Cir. 2009) (recognizing that “while a [claimant] must offer sufficient factual allegations to show that he or she is not merely engaged in a fishing expedition . . . , we must also take account of their limited access to crucial information . . . . which tend systemically to be in the sole possession of defendants”); see also Khoja v. Orexigen Therapeutics, Inc., 899 F.3d 988, 998–99 (9th Cir. 2018) (describing how the asymmetry of access to litigation-related information can be unfair where defendants “possess materials to which the plaintiffs do not yet have access”).

4. Section 15(d) Section 15(d) prohibits a private entity “in possession of a biometric identifier or biometric information” to “disclose, redisclose, or otherwise disseminate a person’s . . . biometric identifier or biometric information” unless a listed exception applies, such as when the

subject or legally authorized representative of the biometric identifier or information “consents to the disclosure or redisclosure.” 740 Ill. Comp. Stat. 14/15(d). Defendants object to the R&R finding that Section 15(d) claims do not necessarily require third-party disclosure and claim that “[t]here is no mention of third parties in this case.” Dkt. No. 32 at 13–14. However, this completely ignores that the R&R also found that “Plaintiff has alleged that Defendants disseminated the biometric information to the user’s gaming platform, which would share it with Take-Two and/or the gaming platform’s servers.” Dkt. No. 31 at 26. In particular, the Complaint alleges that: (1) “Take 2 and/or 2K Games use AWS/Amazon cloud-computing for, inter alia, servers, computing, storage, and to provide the infrastructure to deliver its games to internet-connected gaming platforms” (Dkt. No. 1 ¶ 84); and

(2) once Defendants have used their computing power to collect facial feature vectors to construct the Face Geometry of a user, “[Defendants] transmit[] the Face Geometry via CloudFront . . . and deliver[] it to the user’s Gaming Platform.” Id. ¶¶ 106–07. These facts allow the Court to draw the reasonable inference that Defendants disseminated Plaintiff’s biometric information to a third-party.5 Plaintiff’s allegations sufficiently suggest that Defendants disseminated Plaintiff’s biometric data to a third-party, which is all that Plaintiff must do to

5 Defendants’ reliance on Jones for its Section 15(d) argument is again inapposite as “Jones [did] not allege that Microsoft disseminated her biometric data to any third-party data centers or any tangible third parties whatsoever.” 2023 WL 130495, at *5. proceed to discovery on this claim. See Johnson v. NCR Corp., No. C22-3061, 2023 WL 1779774, at *5 (N.D. Ill. Feb. 6, 2023). Defendants also object that “the R&R incorrectly finds that the Complaint does not indicate that [Plaintiff’s child] gave consent.” Dkt. No. 32 at 14. But the Complaint alleges that

“[Defendants] never informed nor received consent from Plaintiff or the Class Members to disclose and /or redisclose their biometric identifiers and biometric information to third parties.” Dkt. No. 1 ¶¶ 198, 235. In addition, as correctly noted in the R&R, Plaintiff’s child could not consent, as a minor. Dkt. No. 31 at 27. Thus, at this stage, the Court concludes that Plaintiff has sufficiently pleaded a Section 15(d) claim. C. The Unjust Enrichment Claim Defendants object to the R&R’s conclusion that Illinois, rather than Washington, law applies. Dkt. No. 32 at 15. The Court agrees with and adopts the six-page, detailed analysis provided in the R&R with respect to the five factors laid out in Sections 6 and 221 of the Restatement (Second) of Law on Conflict of Laws. Dkt. No. 31 at 28–33.

Defendants further object that Plaintiff does not plausibly allege any benefit that they received from Plaintiff’s child’s data and assert that the Complaint simply recites the elements of the cause of action. Dkt. No. 32 at 16 (citing only to Paragraph 241 of the Complaint). However, the unjust enrichment claim starts by incorporating by reference all of previous allegations set forth in the Complaint. Dkt. No. 1 ¶ 240. As Defendants point out in their motion, under Illinois law, “[w]here ‘an unjust enrichment claim rests on the same improper conduct alleged in another claim, . . . unjust enrichment will stand or fall with the related claim’” (Dkt. No. 18 at 22 (quoting Cleary v. Philip Morris Inc., 656 F.3d 511, 516 (7th Cir. 2011))); Washington law leads to the same result. As Plaintiff sufficiently alleged BIPA claims, the unjust enrichment claim

survives, linked with the BIPA claims at this juncture. Finally, Defendants assert that Plaintiff did not plausibly allege detriment because Illinois law requires an economic detriment. Dkt. No. 32 at 16. But Plaintiff accurately points to at least three cases where Illinois courts allowed unjust enrichment claims to proceed where no economic detriment was alleged. Dkt. No. 33 at 16 (citing cases). Accordingly, the Court rejects

Defendants’ objection on this ground. For the foregoing reasons, the Court hereby ORDERS that: (1) The Report and Recommendation (Dkt. No. 31) is ADOPTED; (2) Defendants Amazon Web Services and Amazon.com Inc’s objections (Dkt. No. 32) are OVERRULED; (3) The Clerk is DIRECTED to send a copy of this Order to counsel and to Judge Peterson. Dated this 31st day of March 2023.

A Tana Lin United States District Judge