IN THE UNITED STATES DISTRICT COURT FOR THE WESTERN DISTRICT OF OKLAHOMA
SPENCER MAYHEW, individually and on ) behalf of all others similarly situated; and ) ROSALIE NOREN, individually and on behalf ) of all others similarly situated, ) ) Plaintiffs, ) ) v. ) Case No. CIV-24-00814-JD ) CANDID COLOR SYSTEMS, INC., ) an Oklahoma corporation, ) ) Defendant. )
ORDER
Before the Court is Defendant Candid Color Systems, Inc.’s (“Defendant”) Motion to Dismiss Plaintiffs’ First Amended Class Action Complaint Pursuant to Federal Rules of Civil Procedure 12(b)(1) and 12(b)(6) (“Motion”). [Doc. No. 28]. Plaintiffs Spencer Mayhew and Rosalie Noren (collectively “Plaintiffs”) filed a Brief in Opposition to Defendant’s Motion (“Response”). [Doc. No. 33]. Defendant filed a Reply in Support of its Motion (“Reply”). [Doc. No. 34]. For the reasons outlined below, the Court grants the Motion in part and denies it in part. I. BACKGROUND1 Plaintiffs, individually, and on behalf of others who are similarly situated initiated this class action. [Doc. No. 25].
1 The Court takes the following factual allegations, presumed to be true for the purposes of the Motion, from Plaintiffs’ First Amended Class Action Complaint (“the Complaint”). [Doc. No. 25]. Defendant is a photography business that “has the tools to help photographers effectively market and sell images from events both small and large.” [Id. ¶ 21 (internal
alterations omitted)]. Defendant provides a web-based, Ecommerce platform for professional photographers to use in the marketing and sale of photos. [Id. ¶ 22]. Defendant’s platform uses facial recognition technology. [Id. ¶ 23]. Defendant’s facial recognition software can identify facial images in one photograph and locate the same facial images in other photographs. [Id.]. Defendant markets its facial recognition feature as part of its Ecommerce platform. [See id. ¶¶ 23–24]. The platform applies the facial
recognition feature to photos once photographers upload them to the platform. [Id. ¶ 23]. The facial recognition feature scans photos for facial images and extracts data representing the unique geometry of each facial image. [Id. ¶ 27]. Defendant owns the Grad Photo Network, which it describes as “the largest network of professional photographers for graduation and commencement ceremonies.”
[Id. ¶ 33]. The website for the Grad Photo Network integrates the Ecommerce platform and allows consumers the ability to order photos taken by photographers who are part of the Grad Photo Network. [Id. ¶ 34]. Kabance Photo Services, Inc. (“Kabance”) is a photography company and is a member of the Grad Photo Network. [Id. ¶ 39].
Plaintiff Spencer Mayhew (“Mayhew”) attended Collinsville High School’s graduation ceremony on May 13, 2023, in Collinsville, Illinois. [Id. ¶ 40]. During the ceremony, Kabance photographers photographed Mayhew and uploaded the photos to the Grad Photo Network website. [Id. ¶ 41]. Plaintiffs are unaware if Kabance uploaded the photos while in Illinois. [Id.]. When viewing photos of Mayhew, one can see the application of the facial recognition software, as demonstrated by the appearance of a
dotted-line rectangular field that appears around Mayhew’s face and the return of other photos of Mayhew upon clicking in the rectangular field. [Id. ¶¶ 43–44]. Mayhew’s mother, who lives in Illinois, purchased photos and received digital prints and physical prints at her address in Illinois. [Id. ¶ 48]. Similarly, Plaintiff Rosalie Noren (“Noren”) attended Blackburn College’s graduation ceremony on May 15, 2021, in Carlinville, Illinois. [Id. ¶ 52]. Kabance
photographers photographed Noren and uploaded the photos to the Grad Photo Network website. [Id. ¶ 53]. Plaintiffs are unaware if Kabance uploaded the photos while in Illinois. [Id.]. The platform applied facial recognition software to Noren’s image, as demonstrated in the same manner described above. [Id. ¶¶ 55–56]. Defendant did not inform Mayhew or Noren that it would collect or use their
biometrics. [Id. ¶¶ 49, 60]. Defendant did not inform Mayhew or Noren that it would profit from the use of their biometrics by using them to locate photos of them and facilitate sales of those photos, from which Defendant collected a fee. [Id. ¶¶ 50, 61]. Because Defendant did so without their consent, Plaintiffs allege they “lost control over [their] unique biometrics” and Defendant “violated [their] rights in and ownership to
those unique biometrics without compensation.” [Id.]. Plaintiffs did not give Defendant their consent to collect, use, or profit from their biometrics. [Id. ¶¶ 51, 62]. Plaintiffs allege that Defendant has collected biometrics from hundreds of other individuals via the Grad Photo Network website. [Id. ¶ 65]. Plaintiffs assert causes of action against Defendant for violations of the Illinois Biometric Information Privacy Act (“BIPA”). [Id. ¶¶ 86–125]. Plaintiffs plead five
causes of action arising under BIPA. [See id.]. First, Plaintiffs allege Defendant failed to develop a publicly available, written policy in violation of BIPA section 15(a), which requires private entities in possession of biometrics to develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within [three] years of the individual’s last interaction with the private entity, whichever occurs first.
[Id. ¶ 87 (quoting 740 Ill. Comp. Stat. Ann. 14/15(a)); see also id. ¶¶ 72, 86–93]. Second, Plaintiffs allege Defendant collected, captured, received through trade, or otherwise obtained the biometrics of Plaintiffs and the putative class members without first informing them in writing that their biometrics were being collected and stored in violation of BIPA section 15(b)(1). [Id. ¶¶ 94–101 (citing 740 Ill. Comp. Stat. Ann. 14/15(b)(1)); see also id. ¶ 73]. Third, Plaintiffs allege Defendant collected, captured, received through trade, or otherwise obtained the biometrics of Plaintiffs and the putative class members without first informing them in writing of the specific purpose and length of term for which their biometrics were being collected, stored, or used in violation of BIPA section 15(b)(2). [Id. ¶¶ 102–09 (citing 740 Ill. Comp. Stat. Ann. 14/15(b)(2)); see also id. ¶ 74]. Fourth, Plaintiffs allege Defendant collected, captured, received through trade, or otherwise obtained the biometrics of Plaintiffs and the putative class members without having first obtained a written release in violation of BIPA section 15(b)(3). [Id. ¶¶ 110– 17 (citing 740 Ill. Comp. Stat. Ann. 14/15(b)(3)); see also id. ¶ 75].
Fifth, Plaintiffs allege Defendant’s practice of profiting from Plaintiffs’ and the putative class members’ biometrics violates BIPA section 15(c) and deprives Plaintiffs and the putative class members of control over their unique biometrics and their rights in and ownership to those unique biometrics without compensation. [Id. ¶ 123]. BIPA section 15(c) prohibits any private entity from selling, leasing, trading, or otherwise profiting from a person’s biometrics. [Id. ¶ 119 (citing 740 Ill. Comp. Stat. Ann.
14/15(c)); see also id. ¶¶ 76, 118–25]. Previously, Plaintiffs brought these same claims against Defendant and Kabance in the Southern District of Illinois. See Mayhew v. Candid Color Sys., Inc., 743 F. Supp. 3d 994 (S.D. Ill. 2024). The Court dismissed Plaintiffs’ claims against Defendant for lack of personal jurisdiction. Id. at 1005–06 (dismissing Plaintiffs’ claims for lack of specific
personal jurisdiction because Defendant did not have “sufficient minimum contacts with Illinois to show it purposefully availed itself of the privilege of conducting business in or purposefully directed its activities at that state”). Kabance moved the court to dismiss Plaintiffs’ claims pursuant to Federal Rule of Civil Procedure 12(b)(6), which the Court denied. Id. at 1006–15.
Defendant moves to dismiss Plaintiffs’ claims pursuant to Federal Rules of Civil Procedure 12(b)(1) and 12(b)(6). [Doc. No. 28]. Defendant moves to dismiss Plaintiffs’ claims on four grounds. First, pursuant to Rule 12(b)(1), Defendant asserts Plaintiffs lack Article III standing for their BIPA section 15(c) claim. [Id. at 13–15].2 Second, pursuant to Rule 12(b)(6), Defendant argues the Court should dismiss all of Plaintiffs’ claims
because Illinois’s extraterritorial doctrine bars those claims. [Id. at 15–22]. Third, pursuant to Rule 12(b)(6), Defendant claims BIPA’s government contractor exception bars Plaintiffs’ claims. [Id. at 22–25]. Fourth, Defendant states the Court should dismiss all of Plaintiffs’ claims for failure to state a claim under Rule 12(b)(6). [Id. at 26–30]. II. STANDARD OF REVIEW
A. Standard of review for Plaintiffs’ Rule 12(b)(1) Motion Rule 12(b)(1) motions “generally take one of two forms: (1) a facial attack on the sufficiency of the complaint’s allegations as to subject matter jurisdiction; or (2) a challenge to the actual facts upon which subject matter jurisdiction is based.” Ruiz v. McDonnell, 299 F.3d 1173, 1180 (10th Cir. 2002). When a motion is a facial attack, as is the case here, the Court presumes that all allegations in the complaint are true. Id.
B. Standard of review for Plaintiffs’ Rule 12(b)(6) Motion To survive a motion to dismiss under Rule 12(b)(6), a complaint must contain “enough facts to state a claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the
defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). Although a complaint does not need detailed factual assertions, a pleading that
2 The Court uses the page numbers from the top of the CM/ECF documents on this Court’s docket. offers only “labels and conclusions” or “pleads facts that are merely consistent with a defendant’s liability” will not suffice. Id. (internal quotation marks and citations omitted).
The burden is on the plaintiff to plead factual allegations that “raise a right to relief above the speculative level.” Twombly, 550 U.S. at 555. Under this standard, the Court accepts all well-pled factual allegations as true and views the allegations in the light most favorable to the nonmoving party. Peterson v. Grisham, 594 F.3d 723, 727 (10th Cir. 2010). Conclusory statements, however, are not entitled to the assumption of truth, and courts are free to disregard them. Khalik v. United
Air Lines, 671 F.3d 1188, 1191 (10th Cir. 2012). When deciding a motion to dismiss, the Court must consider whether the facts alleged in the complaint state a claim upon which relief can be granted. Miller v. Glanz, 948 F.2d 1562, 1565 (10th Cir. 1991) (“The court’s function on a Rule 12(b)(6) motion is not to weigh potential evidence that the parties might present at trial, but to assess
whether the plaintiff’s complaint alone is legally sufficient to state a claim for which relief may be granted.”). If the Court considers matters outside the complaint, it may convert Defendant’s Motion into one for summary judgment. See Fed. R. Civ. P. 12(d). The Court, therefore, must specifically outline what is excluded from its consideration. Glanz, 948 F.2d at 1565 (explaining that “if matters outside the complaint are presented
to and not excluded by the court, then the court should treat the motion as one for summary judgment under Rule 56 and not as a motion to dismiss”). III. ANALYSIS “[I]n a federal diversity action, the district court applies state substantive law—
those rights and remedies that bear upon the outcome of the suit—and federal procedural law—the processes or modes for enforcing those substantive rights and remedies.” Los Lobos Renewable Power, LLC v. Americulture, Inc., 885 F.3d 659, 668 (10th Cir. 2018) (citing Sibbach v. Wilson & Co., 312 U.S. 1, 14 (1941)). Accordingly, in this case, the Court applies federal procedural law and Illinois substantive law to Plaintiffs’ claims under BIPA.
A. Plaintiffs lack standing for their BIPA section 15(c) claim. Defendant’s first argument is that Plaintiffs lack Article III standing to bring their BIPA section 15(c) claim. [Doc. No. 28 at 13–15]. Article III of the Constitution limits the power of federal courts to the resolution of cases and controversies. TransUnion LLC v. Ramirez, 594 U.S. 413, 423 (2021). A plaintiff must have a personal stake in a case,
i.e., standing, for a case or controversy to exist. Id. To demonstrate standing, Plaintiffs must show (1) they suffered an injury-in-fact, which is an injury that is concrete, particularized, and actual or imminent; (2) the injury was caused by Defendant; and (3) judicial relief will likely redress the injury. Id. Plaintiffs bear the burden of demonstrating the Court has subject matter jurisdiction over
their claims, including that Article III standing exists. See id. Defendant attacks Plaintiffs’ standing on the ground that they did not suffer an injury-in-fact that is concrete or particularized. [See Doc. No. 28 at 13–14]. Defendant’s argument regarding standing pertains to Plaintiffs’ claim under BIPA section 15(c), which provides “[n]o private entity in possession of a biometric identifier
or biometric information may sell, lease, trade, or otherwise profit from a person’s or a customer’s biometric identifier or biometric information.” 740 Ill. Comp. Stat. Ann. 14/15(c). In support of their BIPA section 15(c) claim, Plaintiffs allege as follows: Defendant profits from the biometrics of Plaintiffs and the Class members by using them to facilitate the sale of photographs through its Ecommerce platform.
Defendant’s practice of profiting from Plaintiffs’ and the Class members’ biometrics violates BIPA Section 15(c) and deprives Plaintiffs and the Class members of control over their unique biometrics and their rights in and ownership to those unique biometrics without compensation.
Plaintiffs and the Class members are aggrieved by Defendant’s practice of profiting from their biometrics in violation of BIPA Section 15(c).
[Doc. No. 25 ¶¶ 122–24]. Defendant challenges Plaintiffs’ standing on the basis that Plaintiffs have not alleged any particularized harm other than a claim that Defendant violated BIPA section 15(c). [Doc. No. 28 at 14–15]. In considering standing in the context of a BIPA section 15(c) claim, the Seventh Circuit has explained that a complaint that describes “only a general, regulatory violation, not something that is particularized to [the plaintiffs] and concrete” cannot demonstrate standing. Thornley v. Clearview AI, Inc., 984 F.3d 1241, 1248 (7th Cir. 2021).3 In this vein, an Illinois district court has found that allegations that the use of technology that collects biometric data “to sell more devices, advertise its
3 The Court finds the Seventh Circuit and district court decisions discussed in this Order persuasive on the issues presented by the Motion, even though they are not binding authority. software, and to give [a defendant] an edge over competitors—all in an effort to profit from the sale of its [technology]” are insufficient to amount to particularized harm.
Hazlitt v. Apple Inc., 543 F. Supp. 3d 643, 651 (S.D. Ill. 2021). The Seventh Circuit has opined on circumstances under which a plaintiff potentially could demonstrate standing in context of a BIPA section 15(c) claim: “that by selling her data, the collector has deprived her of the opportunity to profit from her biometric information”; “that the act of selling her data amplified the invasion of her privacy that occurred when the data was first collected, by disseminating it to some unspecified number of other people”; or “that
the scraping of data from social media sites raises the cost of using those sites in some respect.” Thornley, 984 F.3d at 1247. In Gorgas v. Amazon.com, Inc., the Northern District of Illinois considered similar allegations of injury as Plaintiffs present here. No. 22 CV 5159, 2023 WL 4173051, at *2 (N.D. Ill. June 23, 2023). There, the party asserting standing existed on the BIPA section
15(c) claim argued particularized injury was shown based on the allegations that: (1) the defendant “violated their right to control the collection, use, and storage of their biometric data”; and (2) the defendant used the collection of biometric data to improve its technology and profited from that technology. Id. at *2–3 (internal quotation marks omitted). The court rejected the argument regarding the defendant profiting from the
collection of biometric data and summarized numerous cases rejecting such arguments as not presenting sufficient particularized injury. Id. at *2.4 The court also rejected the
4 In support of this holding the court cited the following cases: Kashkeesh v. Microsoft Corp., No. 21 C 3229, 2022 WL 2340876, at *1 (N.D. Ill. June 29, 2022); argument about the loss of control over biometric data constituting particularized injury: “the [plaintiffs] allege that they lost only ‘the right to control the collection, use, and
storage’ of their biometric data[]—not the ‘opportunity to profit’ from it.” Id. at *3 (citing Thornley, 984 F.3d at 1247). The court compared the facts of the case to the facts of Warmack-Stillwell v. Christian Dior, Inc., in which the court concluded that “[the] defendant’s use of plaintiff’s biometric information for profit ‘deprived her of the opportunity to profit from her biometric information.’” 655 F. Supp. 3d 742, 746 (N.D. Ill. 2023) (quoting Thornley, 984 F.3d at 1247).
Applying the above principles here, Plaintiffs’ allegation that “Defendant profits from the biometrics of Plaintiffs and the Class members by using them to facilitate the sale of photographs through its Ecommerce platform[]” does not state a particularized injury sufficient for standing. [Doc. No. 25 ¶ 122]. Under the well-established caselaw of Illinois, general allegations that a party uses the collection of biometric data to promote
its technology, drive sales, or gain a competitive advantage are insufficient to establish a particularized injury. See Gorgas, 2023 WL 4173051, at *2 (summarizing cases); Hazlitt, 543 F. Supp. 3d at 651. Plaintiffs’ allegation that “Defendant’s practice of profiting from Plaintiffs’ and the Class members’ biometrics violates BIPA Section 15(c) and deprives Plaintiffs and
Hogan v. Amazon.com, Inc., No. 21 C 3169, 2022 WL 952763, at *7 (N.D. Ill. Mar. 30, 2022); Patterson v. Respondus, Inc., 593 F. Supp. 3d 783, 816 (N.D. Ill. 2022); Carpenter v. McDonald’s Corp., No. 1:21-CV-02906, 2021 WL 6752295, at *4 (N.D. Ill. Nov. 1, 2021); King v. PeopleNet Corp., No. 21 CV 2774, 2021 WL 5006692, at *4 (N.D. Ill. Oct. 28, 2021); Hazlitt v. Apple Inc., 543 F. Supp. 3d at 647. the Class members of control over their unique biometrics and their rights in and ownership to those unique biometrics without compensation[]” also does not state a
particularized injury sufficient for standing. [Doc. No. 25 ¶ 123]. The court in Gorgas rejected a similar allegation of injury. 2023 WL 4173051, at *3. Plaintiffs, like the plaintiffs in Gorgas, do not allege that, by selling Plaintiffs’ biometric data, Defendant has deprived Plaintiffs of the opportunity to profit from it themselves. Instead, they only allege Defendant’s profit from their biometric data deprived them of “control over their unique biometrics and their rights in and ownership to those unique biometrics without
compensation.” [Doc. No. 25 ¶ 123]. For the above reasons, the Court concludes Plaintiffs have failed to allege a particularized injury related to their BIPA section 15(c) claim and, therefore, lack standing to bring this claim. Accordingly, the Court grants Defendant’s Rule 12(b)(1) Motion and dismisses Plaintiffs’ BIPA section 15(c) claim without prejudice.
B. Plaintiffs have alleged sufficient events occurred in Illinois to survive a motion to dismiss based upon the extraterritorial doctrine.
Defendant next argues the Court should dismiss all of Plaintiffs’ BIPA claims, pursuant to Rule 12(b)(6), because they violate the extraterritoriality doctrine. [Doc. No. 28 at 15–22]. Under Illinois law, a statute does not have an “extraterritorial effect unless a clear intent in this respect appears from the express provisions of the statute.” Avery v. State Farm Mut. Auto. Ins. Co., 216 Ill. 2d 100, 184–85, 835 N.E.2d 801, 852 (Ill. 2005) (internal quotation marks and citations omitted). Because BIPA does not have a provision authorizing its extraterritorial application, the Court must determine whether the alleged BIPA violations occurred “primarily and substantially in Illinois.” Id. at 187, 835 N.E.2d at 854; see also Ronquillo v. Doctor’s Assocs., LLC, 597 F. Supp. 3d 1227, 1233 (N.D.
Ill. 2022) (stating that “[b]ecause none of BIPA’s express provisions indicates that the statute was intended to have extraterritorial effect . . . BIPA does not apply extraterritorially”) (internal quotation marks and citation omitted) (omission in original). “[T]here is no single formula or bright-line test for determining whether a transaction occurs within this state. Rather, each case must be decided on its own facts.” Avery, 216 Ill. 2d at 187, 835 N.E.2d at 854.
When determining whether the extraterritorial doctrine bars BIPA claims, factors vary with each case. Some factors courts have examined include where the biometric data was collected (i.e., the location of the harm), the residency of the plaintiff, the parties’ communications, and where a company policy is executed. Rivera v. Google Inc., 238 F. Supp. 3d 1088, 1101 (N.D. Ill. 2017). At the motion to dismiss stage, Plaintiffs only need
to allege sufficient facts, taken as true, to demonstrate the purported violations occurred primarily in Illinois. See, e.g., Vance v. Amazon.com Inc., 525 F. Supp. 3d 1301, 1308 (W.D. Wash. 2021). “[T]he majority of courts in BIPA cases to consider the [extraterritorial] issue at this stage have denied the motion to dismiss, opting instead to allow discovery for more information regarding the extent to which the alleged
misconduct occurred in Illinois.” Id. In Rivera v. Google, Inc., the court examined circumstances like those presented in this case. 238 F. Supp. 3d 1088. The plaintiffs’ photographs were taken in Illinois and automatically downloaded to a cloud-based, photo service. Id. at 1091. The defendant then used the photos to create a face-scan of the plaintiffs. Id. The complaint did not allege where the face scan was made. Id. at 1102. The court concluded these allegations,
along with the allegation that Illinois was the place where the defendant failed to provide the plaintiffs with the required disclosures and obtain their consent, favored a finding that the allegations occurred primarily in Illinois. Id. at 1101–02. Similarly to Rivera, in this case, Plaintiffs’ photographs were taken in Illinois. Unlike Rivera, in this case, Plaintiffs do not yet know where Kabance uploaded the images to the Ecommerce platform. In another case with analogous circumstances, Vance v. Amazon.com Inc., a
Washington district court considered whether the Illinois extraterritorial doctrine prohibited the application of BIPA to an out-of-state defendant. 525 F. Supp. 3d at 1307– 08. The plaintiffs were Illinois residents who uploaded their photos to a third-party, photo-sharing website, whose parent company created a dataset from photos compiled from the website. Id. at 1306. The defendant acquired the dataset and used it to improve
its facial recognition products. Id. The court considered the following allegations when concluding the extraterritorial doctrine did not prohibit the plaintiffs’ BIPA claims: Plaintiffs, and all purported class members, are Illinois residents who, while in Illinois, uploaded photos that were taken in Illinois. The required disclosures or permissions would have been obtained from Illinois, and so any communication would have necessarily involved Illinois. The alleged harm to privacy interests is ongoing for Illinois residents. Moreover, Plaintiffs allege that [the defendant] sells various facial recognition products nationwide, that these products are used by consumers and law enforcement agencies with national reach, and that the Diversity in Faces dataset improved its facial recognition products, thereby allowing the reasonable inference that [the defendant] utilized the dataset in Illinois during its business dealings. Id. at 1308 (internal citations, quotations, and alteration omitted). Many of the above factors are present in this case, except that Plaintiffs do not know where Kabance
downloaded the images to the Ecommerce platform. [Doc. No. 25 ¶¶ 41, 53]. In this case, some of the conduct relating to the alleged BIPA violations did occur in Illinois. Kabance photographed Plaintiffs in Illinois. [Doc. No. 33 at 21; see also Doc. No. 25 ¶¶ 40–41, 52–53]. The alleged harm to Plaintiffs is ongoing in Illinois. [See Doc. No. 33 at 21–22]. That Plaintiffs do not know where Kabance was when it uploaded the photos and that Plaintiffs did not include allegations regarding the same are but one factor
and not determinative at the pleading stage on a motion to dismiss standard. Cf. Vance, 525 F. Supp. 3d at 1309 (explaining that “more information is needed to reach any determination, and so, the court agrees with Rivera that ‘[f]or now, it is enough to say that the allegations survive the accusation that the law is being applied outside of Illinois’”) (alteration in original) (citing Rivera, 238 F. Supp. 3d at 1102). Additionally,
the great weight of Illinois cases considering the extraterritorial doctrine as applied to BIPA claims supports denying a motion to dismiss on this ground. See id. at 1308. Defendant places great reliance on the fact that Defendant itself did not have contact with Illinois. [See Doc. No. 28 at 16, Doc. No. 34 at 6–7]. Defendant argues that Kabance, not Defendant, photographed Plaintiffs in Illinois. [See id.]. However, the
inquiry is not what conduct of Defendant occurred in Illinois. The inquiry is whether events giving rise to the alleged BIPA violations occurred in Illinois. See Avery, 216 Ill. 2d at 187, 835 N.E.2d at 854; Rivera, 238 F. Supp. 3d at 1101. In Vance v. Amazon.com Inc., discussed above, the defendant did not take the photographs or upload them, but the court still considered the facts that the plaintiffs took the photos and uploaded them whilst in Illinois as part of its analysis of the extraterritorial doctrine. See 525 F. Supp. 3d
at 1308 (discussing, as part of its extraterritorial analysis, that “Plaintiffs, and all purported class members, are Illinois residents who, while in Illinois, uploaded photos that were taken in Illinois.”). In this case, the Court rightfully considers where Plaintiffs were photographed and where those photos were uploaded. Defendant asserts the Court should apply the extraterritorial doctrine to Plaintiffs’ claims because the prior court’s dismissal of Plaintiffs’ claims due to lack of personal
jurisdiction demonstrates the absence of connection of the case to Illinois. [Doc. No. 28 at 20–21]. The Court does not find this argument convincing because the inquiries are distinct. The Southern District of Illinois’s analysis focused upon whether Defendant had “sufficient minimum contacts with Illinois to show it purposefully availed itself of the privilege of conducting business in or purposefully directed its activities at that state.”
Mayhew, 743 F. Supp. 3d at 1005. Yet to determine if the extraterritorial doctrine applies, the Court must look at all the facts alleged in Plaintiffs’ Complaint, not just Defendant’s actions, to determine if the BIPA violations primarily and substantially occurred in Illinois. In some cases, these inquiries may substantially overlap. However, in this case, the Court cannot conclude that the court’s prior dismissal of Plaintiffs’ claims against
Defendant for lack of personal jurisdiction dictate the Court’s conclusion here. Based on the above analysis, the Court cannot currently conclude that the extraterritorial doctrine bars Plaintiffs’ BIPA claims. At this stage of the case, Plaintiffs have alleged enough of the events giving rise to the alleged BIPA violations occurred in Illinois to survive a motion to dismiss. Accordingly, the Court denies Defendant’s Motion on this ground.
C. Defendant’s government contractor defense is not apparent from the face of Plaintiffs’ Complaint.
Defendant next argues the Court should dismiss all of Plaintiffs’ BIPA claims as barred under BIPA’s government contractor exception. [Doc. No. 28 at 22–25 (citing 740 Ill. Comp. Stat. Ann. 14/25(e))]. The government contractor exception is an affirmative defense. See Mayhew, 743 F. Supp. 3d at 1010. The Court may only dispose of claims based on affirmative defenses “[i]f the defense appears plainly on the face of the complaint itself[.]” Miller v. Shell Oil Co., 345 F.2d 891, 893 (10th Cir. 1965). As discussed in Defendant’s Motion, establishing the government contractor exception requires that the accused entity (1) be a contractor, (2) of a unit of government, and (3) was working for that unit of government at the time it collected or disseminated biometric information. [Doc. No. 28 at 23 (citing Enriquez v. Navy Pier, Inc., 2022 IL App (1st) 211414-U, ¶ 19, appeal denied, 201 N.E.3d 582 (Ill. 2023))]. As demonstrated by Defendant’s extensive discussion in its Motion, these elements require legal analysis
from the Court. [See Doc. No. 28 at 22–25]. But the facts necessary to the Court’s analysis regarding the application of this exception are not evident from the face of Plaintiffs’ Complaint. The Complaint does not include facts necessary for the Court to conclude that Kabance was a contractor, Defendant was a subcontractor, or the applicable schools/school districts were units of government. [See id.]. Defendant relies upon evidence outside of the Complaint to attempt to establish Kabance’s relationship with Collinsville High School and to assert the government
contractor exception. [See Doc. No. 28 at 24 (citing to Doc. No. 28-4)]. Defendant attached as exhibits to its Response documents attempting to establish Kabance served as a government contractor, including an agreement between Kabance and Collinsville High School. [See id.]. Upon a motion to dismiss, the Court’s review is limited to the complaint and documents specifically relied upon in the complaint. Glanz, 948 F.2d at 1565. Accordingly, the Court cannot normally consider additional documents upon a
motion to dismiss without converting it into one for summary judgment. See Fed. R. Civ. P. 12(d). The Court may, however, take judicial notice of certain documents without transforming a motion to dismiss into one for summary judgment. Johnson v. Spencer, 950 F.3d 680, 705 (10th Cir. 2020) (stating that “[a] district court, however, may ‘take judicial notice of its own files and records, as well as facts which are a matter of public
record,’ without converting a motion to dismiss into a motion for summary judgment”) (quoting Tal v. Hogan, 453 F.3d 1244, 1264 n.24 (10th Cir. 2006)). Although the Court may take judicial notice of public documents, the Court may not consider such documents for the purpose of proving the truth of their contents. Tal, 453 F.3d at 1264 n.24; see, e.g., Mrs. Fields Franchising, LLC v. MFGPC, 721 F. App’x
755, 759 (10th Cir. 2018) (unpublished) (refusing to consider a declaration to prove the truth of its contents). Accordingly, the Court may take judicial notice that an agreement existed between Kabance and Collinsville High School but cannot rely upon the contents of that agreement to establish Kabance was a government contractor. Even if the Court were to rely upon the agreement for that purpose, Defendant’s attempt to use the government contractor exception to justify dismissal would still be
unsuccessful because it would not serve to dismiss Plaintiffs’ claims based upon Plaintiff Noren’s factual allegations, which occurred at Blackburn College, or other similarly situated putative class members. [See Doc. No. 25 ¶¶ 52, 64 (stating “Kabance’s account on the Network Website, for example, hosts photos of other participants in the Collinsville High School and Blackburn College graduation ceremonies, as well as photos from other events held in Illinois . . . .”).5
For the reasons outlined above, the Court denies Defendant’s Motion based upon the government contractor exception. D. Plaintiffs have adequately alleged Defendant has “possession” of their biometrics.
Defendant next requests that the Court dismiss Plaintiffs’ BIPA sections 15(a) and 15(c) claims because Plaintiffs have not adequately alleged facts demonstrating Defendant had “possession” of their biometrics. [Doc. No. 28 at 26–27].6 Sections 15(a)
5 Rule 12(b)(6) speaks to dismissal of claims, not dismissal of allegations. See BBL, Inc. v. City of Angola, 809 F.3d 317, 325 (7th Cir. 2015) (“A motion to dismiss under Rule 12(b)(6) doesn’t permit piecemeal dismissals of parts of claims; the question at this stage is simply whether the complaint includes factual allegations that state a plausible claim for relief.”) (emphasis in original); Fed. Trade Comm’n v. Nudge, LLC, 430 F. Supp. 3d 1230, 1246 (D. Utah 2019) (“As many courts have recognized, parties may not use rule 12(b)(6) to dismiss only parts of a claim.”).
6 The Court has concluded Plaintiffs lack standing for their BIPA section 15(c) claim. Because Defendant presents its argument about possession of biometrics collectively toward both Plaintiffs’ BIPA sections 15(a) and 15(c) claims, the Court still considers this argument. and 15(c) both apply to private entities “in possession” of biometrics. 740 Ill. Comp. Stat. Ann. 14/15(a), 14/15(c). The Illinois Supreme Court has defined “possession” as “when a
person has or takes control of the subject property or holds the property at his or her disposal.” People v. Ward, 215 Ill. 2d 317, 325, 830 N.E.2d 556, 560 (Ill. 2005). Plaintiffs have alleged that Defendant “facilitates the sale of photographs through its Ecommerce platform by collecting the biometrics of the individuals depicted in photographs uploaded to the platform, even if those individuals never knowingly dealt with [Defendant].” [Doc. No. 25 ¶ 30]. Plaintiffs allege that the Ecommerce platform’s
facial recognition technology extracts faceprints from photos, displays the face-matching functionality, and then stores the biometrics on the website. [Doc. No. 33 at 31 (citing Doc. No. 25 ¶¶ 41, 44, 53, 56, 66)]. Defendant argues the above allegations do not amount to “possession” for purposes of BIPA because Defendant did not control or know about the data uploaded to
the Ecommerce platform. [Doc. No. 28 at 26]. Defendant asserts the photographers own and control the photos uploaded to the website. [Id. at 26–27]. Defendant’s arguments present the issue of who controls biometrics extracted by a third-party provider, which is an issue other courts have addressed. In Heard v. Becton, Dickinson & Co., the defendant manufactured a device for
dispensing medication that required a fingerprint scan. 524 F. Supp. 3d 831, 836 (N.D. Ill. 2021). Hospitals used the device for hospital workers to obtain medication for patients. Id. The court considered if the defendant, a third-party provider of the device for hospitals, “possessed” the fingerprint data collected by its device. Id. at 840. In deciding that the defendant possessed the biometric data for purposes of a BIPA section 15(a) claim, the court relied upon allegations that the fingerprint information was stored on the
defendant’s server “for analysis and support services.” Id. The court rejected the defendant’s argument that the allegations in the plaintiff’s complaint were insufficient because the “[p]laintiff still makes no allegation that [the defendant] could freely access biometric data, that [the defendant] exercised any control over the data, or even how [the defendant] received it.” Id. The court’s conclusion regarding the defendant’s possession of biometric data is consistent with other decisions with similar factual scenarios. See,
e.g., Clark v. Microsoft Corp., 688 F. Supp. 3d 743, 749 (N.D. Ill. 2023) (determining that facts alleging the defendant’s “storage of data together with the ability to control access to that data adequately pleads possession”); Mayhall ex rel. D.M. v. Amazon Web Services, Inc., No. 2:21-cv-01473-TL, 2023 WL 2728292, at *3 (W.D. Wash. Mar. 31, 2023) (stating the following pleading was sufficient to allege possession: “The Complaint
alleges that [the defendants] use their computing power not only to collect facial features vectors from face-scan data . . . but also to construct a 3D Face Geometry of the user, which [the defendants] then transmit to the players’ Gaming Platforms.”); Johnson v. NCR Corp., No. 22 C 3061, 2023 WL 1779774, at *2 (N.D. Ill. Feb. 6, 2023) (finding the plaintiff sufficiently pled possession of biometrics by stating the defendant’s system
collected fingerprint data from its terminals). The Court concludes, based upon the court’s reasoning in Heard and the other cases outlined above, Plaintiffs’ allegations that Defendant’s Ecommerce platform collected Plaintiffs’ biometric data and applied the face-matching technology to it are sufficient to amount to “possession” under BIPA. The Court rejects Defendant’s argument that Defendant had to have specific knowledge about Plaintiffs’ specific data to
demonstrate possession. [See Doc. No. 28 at 26]. Additionally, the Court finds it immaterial that the photographers controlled Plaintiffs’ actual photographs because the inquiry under BIPA relates to possession of Plaintiffs’ biometric data, which is what Plaintiffs allege Defendant’s Ecommerce platform extracted. [See id. at 26–27]. For the above reasons, the Court concludes Plaintiffs have adequately pled Defendant possessed their biometric data for purpose of their BIPA sections 15(a) and
15(c) claims and denies Defendant’s Motion on this ground. E. Plaintiffs have adequately pled that Defendant collected Plaintiffs’ biometrics.
Defendant next argues that, for purposes of Plaintiffs’ BIPA section 15(b) claims, Plaintiffs have not adequately pled that Defendant collected Plaintiffs’ biometric data. [Doc. No. 28 at 27–29]. Section 15(b) regulates a private entity’s ability to collect, capture, purchase, receive through trade, or obtain biometric data. 740 Ill. Comp. Stat. Ann. 14/15(b). Courts have recognized, unlike possession of biometric data, collecting biometrics requires an active step by the private entity. Clark, 688 F. Supp. 3d at 747 (stating that “[w]hile true that section 15(b) nowhere says the words ‘active step,’ the statutory construction . . . shows that, under a commonsense reading, the private entity must undertake some effort to collect or obtain biometric identifiers or information”) (internal quotation marks and alteration omitted). In Clark v. Microsoft Corp., the court discussed situations in which defendants provide technology that extracts biometric data. 688 F. Supp. 3d 743. In that case, the
defendant provided a technology incorporated into another party’s software that collected biometric data. Id. at 745–46. The court ultimately concluded that the plaintiff did not adequately plead that the defendant took an active step to collect biometric data because the plaintiff’s allegations that the other party’s software interfaced with the defendant’s software were inadequate. See id. at 747–48.7 The court distinguished the factual situation involved in that case and situations in which “the defendant could ‘access’ and
‘extract’ biometric data uploaded by an intermediary, and that it was ‘involve[d] in the data collection process . . . beyond simply providing the technology to’ another entity.” Id. (alteration in original) (quoting Rivera v. Amazon Web Servs., Inc., No. 2:22-cv- 00269, 2023 WL 4761481, *5 (W.D. Wash. July 26, 2023)). Here, the allegations in Plaintiffs’ Complaint are most like the factual situation
where “the defendant could ‘access’ and ‘extract’ biometric data uploaded by an intermediary.” Id. Unlike the defendant in Clark v. Microsoft Corp., Defendant was not providing technology incorporated into another entity’s software that extracted biometrics. See id. at 745–46. Plaintiffs allege that Defendant’s Ecommerce platform
7 In support of its conclusion, the court stated “[the plaintiff] alleges that because “Brainshark’s software interfaces with and/or integrates [the defendant’s software], [the defendant] also (1) collects, captures, and/or otherwise obtains; (2) stores; and/or (3) makes use of such individuals’ biometric identifiers and biometric information. That alone is a conclusory jump, and the complaint does not elsewhere allege facts sufficient to draw the inference that [the defendant] actively obtained [the plaintiff’s] biometrics.” Id. (internal citations omitted). itself, using photographs uploaded by photographers, extracts biometric data and uses it in facial recognition technology advertised as part of the platform. [Doc. No. 25 ¶ 5].
These allegations are sufficient to demonstrate Defendant collected Plaintiffs’ biometric data under BIPA section 15(b) and are consistent with other circumstances in which courts found the defendants took active steps to collect biometrics. See, e.g., Mayhall, 2023 WL 2728292, at *4 (deciding that the plaintiff pled facts adequate to show the defendant collected biometrics by stating that defendant’s system extracted facial data from uploaded photos, constructed face geometry from that data, and stored it in the
users’ accounts); Johnson, 2023 WL 1779774, at *4 (concluding that the plaintiff sufficiently pled the defendant collected biometrics by alleging the defendant’s “system captures workers’ fingerprints and creates unique templates for each worker at the time of their enrollment in the database”). Accordingly, the Court denies Defendant’s request to dismiss Plaintiffs’ BIPA section 15(b) claims on this ground.
F. The Court does not consider Defendant’s remaining argument regarding Plaintiffs’ BIPA section 15(c) claim.
Because the Court has already concluded Plaintiffs lack standing for their BIPA section 15(c) claim, the Court does not address Defendant’s final argument that Plaintiffs allege no facts that Defendant profited from Plaintiffs’ data. [See Doc. No. 28 at 29–30]. This argument only pertains to Plaintiffs’ BIPA section 15(c) claim, which the Court has already concluded it should dismiss. IV. CONCLUSION For the reasons outlined above, the Court GRANTS Defendant’s Motion to Dismiss to the extent the Court determines Plaintiffs lack standing to pursue their BIPA section 15(c) claim and, therefore, dismisses that claim without prejudice. The Court DENIES the remainder of Defendant’s Motion. IT IS SO ORDERED this 11th day of June 2025. ei W. DISHMAN UNITED STATES DISTRICT JUDGE