Sosa v. Onfido, Inc.

• Court: District Court, N.D. Illinois
• Decided: April 25, 2022
• Docket: 1:20-cv-04247
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION

FREDY SOSA, individually and on behalf of ) all others similarly situated, ) ) Plaintiff, ) ) No. 20-cv-4247 v. ) ) Judge Marvin E. Aspen ONFIDO, INC., ) ) Defendant. )

MEMORANDUM OPINION AND ORDER MARVIN E. ASPEN, District Judge: Defendant Onfido, Inc. (“Onfido”) moves to dismiss Plaintiff Fredy Sosa’s Complaint under Federal Rule of Civil Procedure 12(b)(6). (See Defendant’s Rule 12(b)(6) Motion to Dismiss (“Mot.”) (Dkt. No. 45); Defendant’s Memorandum of Law in Support of Its Rule 12(b)(6) Motion to Dismiss for Failure to State a Claim (“Mem.”) (Dkt. No. 46).)1 For the following reasons, we deny Onfido’s motion. FACTUAL BACKGROUND We take the following facts from the Complaint, “documents attached to the [Complaint], documents that are critical to the [Complaint] and referred to in it, [] information that is subject to proper judicial notice[,]” and any additional facts set forth in Sosa’s response, “so long as those facts are consistent with the pleadings.” Phillips v. Prudential Ins. Co. of Am., 714 F.3d 1017, 1019–20 (7th Cir. 2013) (quotation marks omitted). We have accepted as true all well-

1 For ECF filings, we cite to the page number(s) set forth in the document’s ECF header unless citing to a particular paragraph or other page designation is more appropriate. pleaded factual allegations and drawn all reasonable inferences in Sosa’s favor. O’Brien v. Vill. of Lincolnshire, 955 F.3d 616, 621 (7th Cir. 2020). Onfido, a Delaware corporation with its principal place of business in England,2 markets and sells proprietary facial recognition software that is used by online businesses to verify

consumers’ identities. (Class Action Complaint and Demand for Jury Trial (“Compl.”) (Dkt. No. 1-1) ¶¶ 1, 2, 9.) To verify a consumer’s identity using Onfido’s software, the consumer first uploads a copy of his or her identification and a photograph of his or her face. (Id. ¶ 22.) Onfido’s software then scans the identification and photograph to locate the facial images on each document; extracts a unique numerical representation of the shape or geometry of each facial image, which is often called a “faceprint”; compares the faceprints from the consumer’s identification and photograph; and generates a score based on the similarity of the faceprints. (See id. ¶¶ 2, 23, 24, 41; Plaintiff’s Response to Defendant’s Motion to Dismiss (“Resp.”) (Dkt. No. 49) at 3.) Onfido’s software also can compare the faceprints obtained from a consumer’s identification or photograph with other biometric data in Onfido’s database, such as the

biometric data of known masks or other consumers’ photographs. (Compl. ¶¶ 2, 25, 27.) Online businesses can integrate Onfido’s software into their products and mobile apps in such a way that consumers seeking to verify their identities likely do not know that they are interacting with and providing their sensitive information to Onfido, a third party. (Id. ¶¶ 3, 4, 21.) Sosa, an Illinois citizen, is a member of OfferUp, an online marketplace that partnered with Onfido to verify its users’ identities using Onfido’s software. (Id. ¶¶ 8, 33, 34); Sosa v. Onfido, 8 F.4th 631, 634–35 (7th Cir. 2021). In April 2020, Sosa verified his identity with

2 In a declaration filed at the outset of the case, Onfido’s Chief Product Officer stated that Onfido’s headquarters and principal place of business are in California. (Declaration of Kevin Trilli (“Trilli Decl.”) (Dkt. No. 1-4) ¶¶ 1, 3.) OfferUp by using OfferUp’s mobile application to “upload[] a photograph of his driver’s license and a photograph of his face.” (Compl. ¶ 35); Sosa, 8 F.4th at 635. Onfido used its software to scan Sosa’s face, extract Sosa’s faceprints, and compare the two photographs. (Compl. ¶ 35; Resp. at 3.) “Onfido then kept Sosa’s unique faceprint in a database and accessed it every time

another person used Onfido’s verification process.” (Resp. at 3.) Onfido did not inform “Sosa that it would collect, store, or use his biometric identifiers derived from his face,” and Sosa never signed a written release allowing Onfido to do so. (Compl. ¶¶ 36, 38.) Nor did Onfido inform Sosa about a biometric data retention policy or whether it would “ever permanently delete the biometric identifiers derived from his face.” (Id. ¶ 37.) In fact, “there was almost no notice whatsoever that Onfido [was] even involved in the process.” (Id. ¶ 36.) PROCEDURAL HISTORY Sosa filed suit against Onfido in the Circuit Court of Cook County, Illinois, alleging that Onfido violated Illinois’s Biometric Information Privacy Act (“BIPA”), 740 Ill. Comp. Stat. 14/1 et seq. (See generally Compl.) Sosa seeks to represent himself and a putative class of Illinois

residents “who had their biometric identifiers or biometric information, including faceprints, collected, captured, received, otherwise obtained, or disclosed by Onfido while residing in Illinois.” (Id. ¶ 41.) Sosa alleges that Onfido violated sections 15(a) and 15(b) of BIPA and requests, on behalf of himself and the putative class, (1) injunctive and equitable relief that requires Onfido to comply with “BIPA’s requirements for the collection, storage, and use of biometric identifiers and biometric information”; (2) “liquidated damages of $5,000 for each willful and/or reckless violation” of BIPA or, alternatively, “liquidated damages of $1,000 for each negligent violation” of BIPA; and (3) “reasonable attorneys’ fees, costs, and expenses.” (Id. ¶¶ 47–49, 53–56, 58.) Onfido removed Sosa’s lawsuit to this Court based on diversity jurisdiction and the Class Action Fairness Act (“CAFA”).3 (Notice of Removal (Dkt. No. 1) at 3–9.) Onfido then filed a motion to compel arbitration. (Dkt. No. 20.) We denied Onfido’s motion (Dkt. No. 31), and the Seventh Circuit affirmed our decision. Sosa, 8 F.4th at 634–35. After the case returned to us

from the Seventh Circuit, Onfido moved to dismiss Sosa’s Complaint under Rule 12(b)(6) arguing, among other things, that BIPA violates the United States Constitution’s First Amendment. (See Mot. at 1.) Because Onfido’s motion challenged the constitutionality of a state statute, we gave Illinois the opportunity to intervene and defend BIPA’s constitutionality (Dkt. No. 50), but it has declined to do so. We also directed the parties to submit supplemental briefing regarding Sosa’s standing to assert that Onfido violated section 15(a) of BIPA, which the parties have done. (See Dkt. Nos. 52, 54, 55.) Onfido’s motion to dismiss is now ripe for decision.

3 We are satisfied that we have jurisdiction over Sosa’s lawsuit. The citizenship of the named parties is completely diverse—Sosa is a citizen of Illinois, and Onfido is incorporated in Delaware and maintains its principal place of business in either California or England (Compl. ¶¶ 8, 9; Trilli Decl. ¶ 3)—and the amount in controversy is more than $75,000 because it would cost Onfido at least $80,000 to re-engineer its services in response to Sosa’s request for injunctive relief (Notice of Removal at 4–5; Trilli Decl. ¶ 4); see Tropp v. W.-S. Life Ins. Co., 381 F.3d 591, 595 (7th Cir. 2004) (explaining that “the cost a defendant incurs in complying with injunctive relief is a legitimate consideration” in determining whether the amount in controversy exceeds $75,000 as required for diversity jurisdiction). We therefore have diversity jurisdiction over this case. See 28 U.S.C. § 1332(a); Page v. Democratic Nat’l Comm., 2 F.4th 630, 634–36 (7th Cir. 2021) (discussing the requirements for diversity jurisdiction). We also have jurisdiction under the CAFA. First, the parties’ complete diversity of citizenship satisfies the CAFA’s minimal diversity requirement. Roppo v. Travelers Com. Ins. Co., 869 F.3d 568, 578 (7th Cir. 2017); Johnson v. Bankers Life & Cas. Co., 973 F. Supp. 2d 950, 954 (W.D. Wis. 2013). Second, the putative class consists of at least 501 members (see Trilli Decl. ¶ 6), which exceeds CAFA’s 100-member threshold. Roppo, 869 F.3d at 578. Finally, the aggregate amount in controversy exceeds “$5 million, exclusive of interest and costs.” Id. Sosa alleges that Onfido has violated two subsections of BIPA, section 15(a) and section 15(b), and seeks up to $5,000 for each violation. (Compl. ¶¶ 47–49, 53–58.) Thus, each of the at least 501 putative class members could be entitled to $10,000 ($5,000 for each BIPA violation), which makes the aggregate amount in controversy at least $5,010,000. LEGAL STANDARD A motion to dismiss under Rule 12(b)(6) challenges the sufficiency of the complaint, not its merits. Gibson v. City of Chicago, 910 F.2d 1510, 1520 (7th Cir. 1990). In considering a Rule 12(b)(6) motion, we accept as true all well-pleaded facts in the plaintiff’s complaint and draw all reasonable inferences in the plaintiff’s favor. Kubiak v. City of Chicago, 810 F.3d 476,

480–81 (7th Cir. 2016). To survive a Rule 12(b)(6) motion, the complaint must assert a facially plausible claim and provide fair notice to the defendant of the claim’s basis. Ashcroft v. Iqbal, 556 U.S. 662, 678, 129 S. Ct. 1937, 1949 (2009); Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555, 127 S. Ct. 1955, 1964 (2007); Adams v. City of Indianapolis, 742 F.3d 720, 728–29 (7th Cir. 2014). A claim is facially plausible “when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Iqbal, 556 U.S. at 678, 129 S. Ct. at 1949. “If the well-pleaded allegations plausibly suggest—as opposed to possibly suggest—that the plaintiff[] [is] entitled to relief, the case enters discovery.” Alarm Detection Sys., Inc. v. Vill. of Schaumburg, 930 F.3d 812, 821 (7th Cir. 2019). ANALYSIS

In response to growing public concern about the increased commercial use of biometric data, the Illinois General Assembly enacted BIPA in 2008 “to help regulate ‘the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information.’” Cothron v. White Castle Sys., Inc., 20 F.4th 1156, 1159 (7th Cir. 2021); Rosenbach v. Six Flags Ent. Corp., 2019 IL 123186, ¶ 19, 129 N.E.3d 1197, 1203 (quoting 740 Ill. Comp. Stat. 14/5(g)). To that end, section 15 of BIPA “imposes on private entities . . . various obligations regarding the collection, retention, disclosure, and destruction of biometric identifiers and biometric information.” Rosenbach, 2019 IL 123186, ¶ 20, 129 N.E.3d at 1203. Section 20, in turn, “provides a right of action for persons aggrieved by a violation” of section 15, as well as remedies for any such violations. Fox v. Dakkota Integrated Sys., LLC, 980 F.3d 1146, 1148 (7th Cir. 2020); Bradenberg v. Meridian Senior Living, LLC, --- F. Supp. 3d ----, 2021 WL 4494275, at *5 (C.D. Ill. Sept. 30, 2021). Onfido’s arguments for dismissal require us to address the scope and meaning of sections

15 and 20 of BIPA, as well as whether BIPA runs afoul of the United States Constitution. Before we can reach these arguments, however, we must assure ourselves that Sosa has standing to maintain his lawsuit in this Court. See Persinger v. Sw. Credit Sys., L.P., 20 F.4th 1184, 1189 (7th Cir. 2021) (addressing “the jurisdictional question of whether [the plaintiff] has standing to sue” before addressing the merits of the case). I. Standing “Article III of the Constitution limits the jurisdictional reach of the federal courts to ‘Cases’ and ‘Controversies.’” Cothron, 20 F.4th at 1160 (quoting U.S. Const. art. III, § 2). “Essential to this limitation is the requirement that a plaintiff have standing to sue in federal court.” Id. The party invoking federal jurisdiction bears the burden of demonstrating the plaintiff’s standing to sue under Article III. Bryant v. Compass Grp. USA, Inc., 958 F.3d 617,

620 (7th Cir. 2020). Onfido bears that burden here because it removed Sosa’s case from state court. Fox, 980 F.3d at 1151. “At the pleading stage, standing requires allegations of a concrete and particularized injury in fact that is traceable to the defendant’s conduct and redressable by judicial relief.” Cothron, 20 F.4th at 1160. There is no dispute that “whatever injury [Sosa] suffered occurred at [Onfido’s] hands” or that a court can remedy the injury by, for instance, awarding statutory damages. See Thornley v. Clearview AI, Inc., 984 F.3d 1241, 1244 (7th Cir. 2021); Bryant, 958 F.3d at 620–21. Thus, for purposes of our standing inquiry, we consider only whether the Complaint establishes an injury in fact. See Thornley, 984 F.3d at 1244. Sosa’s Complaint alleges that Onfido has violated sections 15(a) and 15(b) of BIPA. (Compl. ¶¶ 47–49, 53–56.) We must consider whether Sosa’s allegations establish that he has standing to seek relief based on section 15(a) and, separately, whether they establish that he has standing to seek relief based on section 15(b). See TransUnion LLC v. Ramirez, 141 S. Ct. 2190,

2208 (2021) (“[S]tanding is not dispensed in gross; rather, plaintiffs must [have] standing for each claim that they press[.]”); see also Bryant, 958 F.3d at 626 (holding that the plaintiff had standing to pursue her section 15(b) claim but not her section 15(a) claim). We begin our standing analysis with Sosa’s section 15(a) allegations. Section 15(a) requires “[a] private entity in possession of biometric identifiers or biometric information” to develop and make publicly available a written policy “establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information.” 740 Ill. Comp. Stat. 14/15(a). It also requires the entity to “comply with its established retention schedule and destruction guidelines” “[a]bsent a valid warrant or subpoena” to the contrary. Id. Sosa alleges that Onfido does not comply with section 15(a)’s mandates requiring “companies in

possession of biometric data” to “(i) make publicly available a written policy establishing a retention schedule and guidelines for permanent deletion of biometric data (i.e., when the business relationship ends); and (ii) actually adhere to that retention schedule and actually delete the biometric information.” (Compl. ¶¶ 48, 49, 56.) Whether a plaintiff has standing to sue for a § 15(a) violation depends on how the defendant allegedly violated § 15(a). See Thornley, 984 F.3d at 1246 (“[A]s the difference between the treatment of section 15(a) in Bryant and Fox illustrates, the result of the standing inquiry for the identical section of a statute will depend on what that section provides and what the plaintiff has alleged.”). For instance, the plaintiff in Bryant did not have standing to pursue her section 15(a) claim because it was based solely on an alleged violation of the provision requiring a collector to make a data retention and destruction schedule publicly available. 958 F.3d at 626. Because this provision imposed a duty “owed to the public generally, not to particular persons whose biometric information [an] entity collects,” the defendant’s alleged

violation of this provision, without more, did not establish that the plaintiff suffered a particularized harm. See id. In contrast, the plaintiff in Fox accused the defendant of violating section 15(a) “by failing to develop, publicly disclose, and comply with a data-retention schedule and guidelines for the permanent destruction of biometric data.” 980 F.3d at 1154 (emphasis in original). The defendant’s failure to comply with the retention schedule meant that it was unlawfully retaining the plaintiff’s biometric data, which inflicted a concrete and particularized privacy injury on the plaintiff. Id. at 1154–55. Thus, the plaintiff had standing to pursue her section 15(a) claim. Id. at 1149, 1156. Similar to the plaintiff in Fox, Sosa alleges that Onfido failed to “make publicly available a written policy establishing a retention schedule and guidelines for permanent deletion of

biometric data” and failed to “adhere to that retention schedule and actually delete the biometric information.” (Compl. ¶¶ 48, 49.) Under Fox, Onfido’s alleged failure to delete biometric information in compliance with a data-retention schedule constitutes an unlawful retention of Sosa’s information sufficient to establish an injury in fact. See Fox, 980 F.3d at 1149, 1154–56. Sosa has standing to pursue his section 15(a) allegations before us. That leaves Sosa’s section 15(b) allegations. Section 15(b) prohibits the collection of biometric identifiers or biometric information unless the collector first (1) informs the person “in writing that a biometric identifier or biometric information is being collected or stored”; (2) informs the person “in writing of the specific purpose and length of term for which a biometric identifier or biometric information is being collected, stored, and used”; and (3) obtains a written release from the person. 740 Ill. Comp. Stat. 14/15(b). Sosa alleges that Onfido violated section 15(b) by failing to comply with these three requirements. (Compl. ¶¶ 53–55.)

The Seventh Circuit’s decision in Bryant “resolved the standing question for claims under section 15(b)” by holding that “a violation of section 15(b) inflicts an Article III injury.” Cothron, 20 F.4th at 1160–61. In Bryant, the plaintiff alleged that the defendant had violated section 15(b) by failing to (1) inform her in writing that her biometric identifier was being collected or stored; (2) inform her in writing of the specific purpose and length of term for which her identifier was being collected, stored, and used; and (3) obtain the plaintiff’s written release to collect, store, and use the identifier. 958 F.3d at 619. The Seventh Circuit held that the plaintiff had standing to pursue her section 15(b) claim because a defendant’s failure to follow section 15(b) “leads to an invasion of personal rights that is both concrete and personalized.” Id. at 619, 626–27. Sosa similarly alleges that Onfido violated section 15(b) by failing to inform

him and the Class in writing that it was collecting and storing their information, failing to inform him and the Class in writing of the purpose and length of term for which the information was being collected, stored, and used, and failing to obtain written releases from him and the Class. (Compl. ¶¶ 53–55.) Sosa’s section 15(b) allegations fall squarely within Bryant’s holding, so he has standing to pursue these allegations before us as well. Sosa has standing to pursue both his section 15(a) and section 15(b) allegations in federal court at this stage of the litigation.4 We now turn to the merits of Onfido’s arguments for dismissal. II. Onfido’s Motion to Dismiss Onfido makes three arguments for dismissal. First, Onfido argues that Sosa has not

stated a BIPA claim because the information Onfido allegedly collects—photographs and information derived from photographs—is not protected by BIPA. (Mem. at 9–10.) Second, Onfido argues that Sosa has not stated claims for liquidated damages because he has not alleged facts from which we can reasonably infer that Onfido intentionally, recklessly, or negligently violated BIPA. (Id. at 11–14.) Third, Onfido argues that BIPA violates the First Amendment. (Id. at 14–18.) We consider Onfido’s non-constitutional arguments first and proceed to its First Amendment argument only if it is necessary to resolve Onfido’s motion to dismiss. See ISI Int’l, Inc. v. Borden Ladner Gervais LLP, 256 F.3d 548, 552 (7th Cir. 2001) (“[F]ederal courts are supposed to do what they can to avoid making constitutional decisions, and strive doubly to avoid making unnecessary constitutional decisions.”).

A. Information Protected by BIPA Section 15 of BIPA imposes “various obligations regarding the collection, retention, disclosure, and destruction of biometric identifiers and biometric information.” Rosenbach, 2019 IL 123186, ¶ 20, 129 N.E.3d at 1203. According to Onfido, Sosa has failed to state a claim for relief under section 15 because he alleges “that Onfido’s software captures information from photographs submitted by users,” and neither photographs nor information derived from

4 Nonetheless, “[t]he Article III standing inquiry remains open to review at all stages of the litigation.” Persinger, 20 F.4th at 1189 (quotation marks omitted). If later developments in the case suggest that Sosa does not actually have standing to pursue either his section 15(a) or section 15(b) allegations at trial, the parties should bring any such developments to our attention. photographs are covered by BIPA. (Mem. at 9–10.) Sosa responds that Onfido’s software creates “a scan of face geometry collected from a photograph,” which is encompassed by BIPA’s definition of “biometric identifiers.” (Resp. at 3.) We interpret BIPA using the same principles that Illinois courts would apply. K-S

Pharmacies, Inc. v. Am. Home Prods. Corp., 962 F.2d 728, 730 (7th Cir. 1992). Under Illinois law, we look first to the plain meaning of the statutory language. People v. Porter, 156 Ill. 2d 218, 222, 620 N.E.2d 381, 384 (1993). Where the statutory language “is clear and unambiguous, we will apply it as written” without “consider[ing] other interpretive aids.” Raab v. Frank, 2019 IL 124641, ¶ 18, 157 N.E.3d 470, 474; Ultsch v. Ill. Mun. Ret. Fund, 226 Ill. 2d 169, 184, 874 N.E.2d 1, 10 (2007). Our analysis starts with section 10 of BIPA, which expressly defines “biometric information” and “biometric identifier.” People v. Olsson, 2011 IL App (2d) 091351, ¶ 6, 958 N.E.2d 356, 359 (“When an act defines its own terms, those terms must be construed according to the definitions given to them in the statute.”). Section 10 defines a “biometric identifier” as “a

retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry” and “biometric information” as “any information, regardless of how it is captured, converted, stored, or shared, based on an individual’s biometric identifier used to identify an individual.” 740 Ill. Comp. Stat. 14/10. Section 10 also lists items that do not constitute “biometric identifiers” or “biometric information.” See id. Relevant here, biometric identifiers do not include photographs, and biometric information “does not include information derived from items or procedures excluded under the definition of biometric identifiers.” Id. Because BIPA excludes photographs from its definition of biometric identifiers, information “derived from” photographs does not constitute biometric information. See id. Thus, the data Onfido obtains when scanning uploaded photographs likely does not fall within BIPA’s definition of “biometric information.” See Vance v. Microsoft Corp., 525 F. Supp. 3d 1287, 1296 (W.D. Wash. 2021) (acknowledging that facial scans of photographs “may not qualify as biometric information” under BIPA “because they are ‘derived from items . . .

excluded under the definition of biometric identifiers,’ namely, photographs”); Monroy v. Shutterfly, Inc., No. 16 C 10984, 2017 WL 4099846, at *3 (N.D. Ill. Sept. 15, 2017) (“[T]he data extracted from [the plaintiff’s] photograph cannot constitute ‘biometric information’ within the meaning of [BIPA].”). But section 15 regulates the collection, retention, disclosure, and destruction of both biometric information and biometric identifiers. See 740 Ill. Comp. Stat. 14/15; Rosenbach, 2019 IL 123186, ¶ 20, 129 N.E.3d at 1203. Even if the data Onfido obtains is not biometric information, it can still subject Onfido to liability if it constitutes a biometric identifier. That is precisely what Sosa contends: that the data obtained by Onfido constitutes a “scan of . . . face geometry,” which qualifies as a “biometric identifier.” (Resp. at 3–5.) As such, the dispositive question is whether the information Onfido allegedly obtains plausibly

constitutes a scan of face geometry. We conclude that it does. As alleged in Sosa’s Complaint and response to Onfido’s motion to dismiss, Onfido’s software scans identification cards and photographs to locate facial images and extracts a unique numerical representation of the shape or geometry of each facial image, which Sosa refers to as a “faceprint.” (See Compl. ¶¶ 2, 22–24, 41; Resp. at 3–4.) The faceprints extracted by Onfido plausibly constitute scans of face geometry and, therefore, “biometric identifiers” under BIPA. See, e.g., Vance, 525 F. Supp. 3d at 1295 (holding that “facial scans are ‘biometric identifiers’ under BIPA”); Rivera v. Google Inc., 238 F. Supp. 3d 1088, 1091, 1095 (N.D. Ill. 2017) (scanning an uploaded photograph, locating the plaintiff’s face, and zeroing “in on its unique contours to create a ‘template’ that maps and records her distinct facial measurements” constituted a scan of face geometry); In re Facebook Biometric Info. Priv. Litig., 185 F. Supp. 3d 1155, 1171 (N.D. Cal. 2016) (scanning “user-uploaded photographs to create a ‘unique digital representation of the face . . . based on [the] geometric

relationship of [] facial features” constituted a scan of face geometry); ACLU v. Clearview AI, Inc., No. 20 CH 4353, 2021 WL 4164452, at *1, *5 (Ill. Cir. Ct. Aug. 27, 2021) (creating a faceprint by scanning a photograph, measuring and recording “data such as the shape of the cheekbones and the distance between eyes, nose, and ears,” and assigning “that data a numerical value” constituted a scan of face geometry). Onfido’s arguments to the contrary are unavailing. (See Mem. at 9–10; Defendant’s Reply in Further Support of Its Rule 12(b)(6) Motion to Dismiss for Failure to State a Claim (“Reply”) (Dkt. No. 51) at 2–5.) First, Onfido argues that BIPA “expressly excludes both photographs and information derived from photographs” from its reach. (Mem. at 10.) This is not accurate. True, section 10 expressly excludes photographs from the definition of “biometric

identifier” and information derived from photographs from the definition of “biometric information.” 740 Ill. Comp. Stat. 14/10. But nothing in section 10 expressly excludes information derived from photographs from the definition of “biometric identifiers.” See id.; Vance, 525 F. Supp. 3d at 1296 (“[W]hile these facial scans [derived from photographs] may not qualify as biometric information[,] . . . there is no textual support for the contention that these scans could not be biometric identifiers themselves.”); Monroy, 2017 WL 4099846, at *3–5 (rejecting the defendant’s argument that data obtained from a photograph cannot constitute a “biometric identifier”). BIPA does not exclude photograph-derived information from its reach.5 Second, Onfido argues that the information it allegedly obtains cannot be a “scan of face geometry” because it “was not the scan of Plaintiff’s actual face, but rather, a scan of a

photograph of his face.” (Mem. at 10; Reply at 4.) Nothing in BIPA’s text, however, supports Onfido’s contention that a scan of face geometry must be an “in person” scan. Rivera, 238 F. Supp. 3d at 1095 (BIPA’s definition of “biometric identifier” does not “say whether a scan of face geometry has to be in person or may be generated from a photograph or a video”). We therefore join those courts that have rejected similar arguments. See, e.g., id. at 1095–98 (rejecting the defendant’s argument that “face-scan measurements derived from a photograph do not qualify as biometric identifiers”); Vance, 525 F. Supp. 3d at 1296 (rejecting the defendant’s argument “that only scans taken in-person, not from photographs, are biometric identifiers”); In re Facebook Biometric Info. Priv. Litig., 185 F. Supp. 3d at 1171–72 (rejecting the defendant’s argument “that the only way to reconcile [BIPA’s] inclusion of ‘scan’ and exclusion of

‘photographs’ is to read the word ‘scan’ to mean in-person scan”). Third, Onfido argues that “it is not clear what the BIPA intended to cover as a ‘scan of face geometry’” because BIPA’s text and legislative history do not define “scan” or “face geometry,” and dictionaries do not provide a workable definition for “scan of face geometry.”

5 We need not consider whether BIPA excludes photographs from its reach because Sosa does not contend that Onfido violated BIPA by merely obtaining photographs; he contends that Onfido violated BIPA by scanning photographs and extracting faceprints from them. (Resp. at 3–4; Mem. at 10 (recognizing that Sosa’s BIPA claim “is based on his allegations that Onfido’s software captures information from photographs submitted by users” (emphasis added))); see Vance, 525 F. Supp. 3d at 1296 (“Plaintiffs do not claim that simply possessing a photograph of a face violates BIPA, and thus the exclusion of photographs as biometric identifiers has little bearing.” (quotation marks omitted)). (Reply at 2–3.)6 If the meaning of “scan of face geometry” is unclear, though, how can we definitively say—as a matter of law—that the information Onfido allegedly obtains cannot plausibly satisfy this meaning? At any rate, what constitutes a “scan of face geometry” is sufficiently clear for us to determine, at this early stage of litigation, that the information

allegedly obtained by Onfido plausibly satisfies this definition. Fourth, Onfido argues that if “a ‘scan of face geometry’ can be derived from a photograph[,]” this “could lead to the absurd result where one becomes in possession of a ‘scan of face geometry’ simply by examining a photograph and creating a depiction, i.e. a drawing or portrait, based on the shape or form of the face in the photograph.” (Reply at 4.) Sosa does not allege that Onfido derives information from photographs in this manner, however, so Onfido’s hypothetical result (absurd or not) is irrelevant. Finally, Onfido argues that allowing information derived from a photograph to constitute a “biometric identifier” renders the definition of “biometric information,” which excludes information derived from biometric identifiers, meaningless and redundant. (Id. at 4–5.)

According to Onfido, this is because the definition of “biometric identifiers” covers original sources of information about a person and the definition of “biometric information” covers data derived from those original sources. (Id. at 4.) We are not persuaded. Initially, it is unclear what Onfido means by “original” sources of information. If Onfido means that biometric identifiers must be obtained only via in-person processes, it is incorrect, as “the scanning of

6 Onfido makes this argument, as well as the arguments we address in the remainder of this section, for the first time in its reply. We have considered these arguments, but the parties risk forfeiting arguments in the future by failing to raise and develop them in their opening papers. See Rexing Quality Eggs v. Rembrandt Enters., Inc., 996 F.3d 354, 365–66 n.52 (7th Cir. 2021) (a party’s failure to fully develop a contention until its reply brief risked waiver); O’Neal v. Reilly, 961 F.3d 973, 974 (7th Cir. 2020) (“[D]istrict courts are entitled to treat an argument raised for the first time in a reply brief as waived.”). biometric identifiers is often based on an image or photograph.” In re Facebook Biometric Info. Priv. Litig., 185 F. Supp. 3d at 1171; see also Monroy, 2017 WL 4099846, at *4 (noting that fingerprints and retinal scans, which are biometric identifiers, apparently “can be obtained from images and photographs”). Moreover, because BIPA does not say “one way or the other, how

the biometric measurements must be obtained . . . to meet the definition of ‘biometric identifier,’” the items identified as biometric identifiers can “be collected in various ways without altering the fact that the measurements still are biometric identifiers.” Rivera, 238 F. Supp. 3d at 1095. In short, Onfido’s argument relies upon a flawed premise. What is more, Onfido does not explain how allowing faceprints derived from photographs to qualify as “biometric identifiers” would render BIPA’s definition of “biometric information” redundant or meaningless. (Reply at 4–5.) Nor does Onfido identify a single case that has come to this conclusion, let alone at the motion to dismiss stage. (Id.) To the contrary, Rivera—a case cited by Onfido (id. at 5)—cast aside an argument similar to Onfido’s. In Rivera, the defendant argued that the definitions of “biometric identifier” and “biometric information”

“distinguish the ‘source of the content’” and that allowing a face template based on a photograph to constitute a “biometric identifier” would render this distinction meaningless. 238 F. Supp. 3d at 1096. Essentially, the defendant argued “that if biometric information cannot be ‘based on’ something from the biometric-identifier paragraph’s ‘do not include’ list (for example, ‘photographs’), then an identifier may also not be ‘based on’ something from that same list.” Id. The defendant’s argument, however, had “no textual or structural clue to support it.” Id. As the Rivera court explained, there is a meaningful distinction between biometric identifiers and biometric information: the items identified as “biometric identifiers” are “specific, biology-based measurements used to identify a person, without reference to how the measurements were taken,” whereas the definition of “biometric information” ensures “that private entities cannot do an end-around [BIPA] by converting biometric identifiers into some other format.” Id. at 1097. We likewise see nothing to suggest that allowing faceprints derived from photographs to qualify as “biometric identifiers” would render BIPA’s definition of “biometric information” redundant

or meaningless. In conclusion, we join the “Illinois courts [that] have uniformly rejected the argument that BIPA exempts biometric data extracted from photographs.” In re Clearview AI, Inc. Consumer Priv. Litig., No. 21-cv-0135, 2022 WL 444135, at *5 (N.D. Ill. Feb. 14, 2022); see also Vance, 525 F. Supp. 3d at 1295 (“This is not the first—or second, or third, or even fourth— time that defendants have challenged BIPA’s applicability to facial scans derived from photographs. Every court has rejected Microsoft’s argument.”). By alleging that Onfido’s software scans identification cards and photographs to locate facial images and extracts a unique numerical representation of the shape or geometry of each facial image, Sosa has plausibly alleged that Onfido obtains “biometric identifiers” as defined by BIPA.

B. Liquidated Damages We turn next to Onfido’s contention that we must dismiss Sosa’s requests for liquidated damages. BIPA authorizes a prevailing party to recover the greater of actual damages or $1,000 in liquidated damages for each negligent BIPA violation, and the greater of actual damages or $5,000 in liquidated damages for each intentional or reckless BIPA violation. 740 Ill. Comp. Stat. 14/20(1), (2). Among other things, Sosa seeks liquidated damages of $5,000 for each willful and/or reckless BIPA violation or, alternatively, liquidated damages of $1,000 for each negligent BIPA violation. (Compl. ¶ 58.) According to Onfido, we must dismiss these claims because Sosa has failed to allege facts from which we can reasonably infer that Onfido negligently, recklessly, or intentionally violated the BIPA. (Mem. at 11–14.) In response, Sosa argues that he does not need to plead Onfido’s state of mind, and even if he did, he has alleged facts sufficient to plead that Onfido was negligent, intentional, or reckless. (Resp. at 5–11.) We agree with Sosa that dismissing his requests for liquidated damages is not warranted. Sosa’s requests for liquidated damages are requests for a particular type of remedy should he

prevail on his underlying BIPA claim. See Bradenberg, 2021 WL 4494275, at *5 (“Section 14/20 of BIPA contains four remedies available to prevailing plaintiffs in BIPA cases. Two of the four remedies in Section 14/20 are liquidated damages in the event a defendant acts with a specific state of mind when violating BIPA.” (internal citation omitted)); Cothron v. White Castle Sys., Inc., 467 F. Supp. 3d 604, 615 (N.D. Ill. 2020) (BIPA plaintiff’s requests for statutory damages, declaratory relief, and injunctive relief for each alleged statutory violation were requests for “various forms of relief” that stemmed from the same claim). Sosa seeks other remedies authorized by BIPA as well—injunctive relief and reasonable attorneys’ fees, costs, and expenses. (Compl. ¶ 58); see 740 Ill. Comp. Stat. 14/20(3), (4). These remedies are distinct from Sosa’s underlying claim for relief based on BIPA. See Davis v. Passman, 442 U.S. 228,

239, 99 S. Ct. 2264, 2274 (1979) (“[W]hether a litigant has a ‘cause of action’ is analytically distinct and prior to the question of what relief, if any, a litigant may be entitled to receive.”); Jones v. Butler, 663 F. App’x 468, 470 (7th Cir. 2016) (a demand for relief “is not itself a part of the plaintiff’s claim” (quotation marks omitted)); Onyango v. Downtown Ent., LLC, 525 F. App’x 458, 460 (7th Cir. 2013) (“An injunction is a type of remedy, as distinct from an underlying claim for relief[.]” (internal citations omitted)). Federal Rule of Civil Procedure 8 recognizes this distinction by requiring “a short and plain statement of the claim showing that the pleader is entitled to relief” at subsection (a)(2) and, separately, “a demand for the relief sought” at subsection (a)(3). Fed. R. Civ. P. 8(a)(2), (3) (emphases added). In other words, Sosa’s requests for liquidated damages are not “claims,” as Onfido contends, but demands for relief. Sosa need not plead facts (such as facts plausibly suggesting negligence, recklessness, or intentional conduct) that show his entitlement to these precise forms of relief.7 See Ibarra v. Prospera, LLC, No. 20 C 7015, 2021 WL 1921015, at *4 (N.D. Ill. May

12, 2021) (“Rule 8(a)(3) requires plaintiffs to include a ‘demand for the relief sought’ but does not require damages to be alleged plausibly or with particularity.”); Cothron, 467 F. Supp. 3d at 615 (“Rule 12(b)(6) does not require [the plaintiff] to plead the facts that will determine the amount of actual damages she may be entitled to recover [under sections 15(b) and 15(d) of BIPA].”); Peatry v. Bimbo Bakeries USA, Inc., No. 19 C 2942, 2020 WL 919202, at *6 (N.D. Ill. Feb. 26, 2020) (“Rule 8 does not require a plaintiff to plead damages with particularity and instead only requires ‘a demand for the relief sought.’” (quoting Fed. R. Civ. P. 8(a)(3)); see also Wolf v. Walker, No. 14-cv-64-BBC, 2014 WL 1729098, at *3 (W.D. Wis. Apr. 30, 2014) (noting that Twombly and Iqbal did not address the detail necessary for a request for relief). Nor does Sosa need to allege facts suggesting any level of culpability to plausibly state a

BIPA claim in the first place. “BIPA imposes liability . . . regardless of the violator’s state of mind,” Snider v. Heartland Beef, Inc., 479 F. Supp. 3d 762, 772 (C.D. Ill. 2020), and “the need to demonstrate negligence, intentional action, or recklessness impacts a plaintiff’s recovery, not

7 We came to a contrary conclusion in Rogers v. CSX Intermodal Terminals, Inc., where we dismissed a BIPA plaintiff’s “claim of intentional and reckless conduct” because he alleged in conclusory fashion that the defendant’s BIPA violations were knowing and willful. 409 F. Supp. 3d 612, 618–19 (N.D. Ill. 2019). But Rogers does not bind us. Camreta v. Greene, 563 U.S. 692, 709, 131 S. Ct. 2020, 2033 n.7 (2011). And although we strive to rule consistently from case to case, we will not hesitate to depart from a ruling in a previous case if we determine that it is appropriate to do so. Cf. Hangzhou Aoshuang E-Commerce Co. v. 008Fashion, 336 F.R.D. 154, 155–57 (N.D. Ill. 2020) (rejecting the defendants’ suggestion that the court had to adhere to an opinion it issued eight years before, “no matter how erroneous”). Here, several decisions that we did not consider in Rogers (and many of which did not issue until after Rogers) have convinced us that our conclusion today is the correct one. the underlying substantive violation of BIPA,” Peatry, 2020 WL 919202, at *6. As the Supreme Court of Illinois has explained, a violation of section 15, “in itself, is sufficient to support the individual’s or customer’s statutory cause of action,” and “[n]o additional consequences need be pleaded or proved.” Rosenbach, 2019 IL 123186, ¶ 33. For instance, Sosa may obtain injunctive

relief or attorneys’ fees—as he has requested (Compl. ¶ 58)—regardless of whether Onfido’s actions are proven to be negligent, reckless, or intentional. 740 Ill. Comp. Stat. 14/20(3), (4); Stauffer v. Innovative Heights Fairview Heights, LLC, 480 F. Supp. 3d 888, 907 (S.D. Ill. 2020); Cothron, 467 F. Supp. 3d at 615. Sosa, therefore, is not required to plead facts showing negligence, recklessness, or intentional conduct to state a BIPA claim either. Smith v. Signature Sys., Inc., No. 2021-CV-02025, 2022 WL 595707, at *5 (N.D. Ill. Feb. 28, 2022) (rejecting argument that the plaintiff had to plead negligence, recklessness, or intent to state a BIPA claim); Bradenberg, 2021 WL 4494275, at *6 (“Plaintiff need not plead facts showing Defendant’s mental state to state a claim for relief [under BIPA].”); Ibarra, 2021 WL 1921015, at *4 (“[P]laintiff does not need to include additional allegations of defendant’s mental state in order to

state the underlying BIPA claim[.]”); Stauffer, 480 F. Supp. 3d at 907 (the plaintiff was not required to assert facts regarding the defendant’s “negligent, reckless, or intentional actions to bring a BIPA cause of action”); Snider, 479 F. Supp. 3d at 770 (“[A] BIPA plaintiff need not plead facts showing the defendant’s mental state to state a claim for relief.”); Cothron, 467 F. Supp. 3d at 615 (“[A]llegations of scienter or no, Ms. Cothron’s complaint states a plausible claim for relief under sections 15(b) and 15(d) [of BIPA].”). C. First Amendment Because Onfido’s non-constitutional arguments do not persuade us to dismiss Sosa’s Complaint, we now consider Onfido’s contention that BIPA violates the First Amendment. Onfido argues that BIPA is a restraint on commercial speech that fails intermediate scrutiny or, alternatively, that BIPA is a content-based restriction that fails strict scrutiny.8 (Mem. at 14–18.) Sosa argues that the BIPA provisions at issue, sections 15(a) and 15(b), do not violate the First Amendment because they restrict conduct, not speech. (Resp. at 11–13.) But even if sections 15(a) and 15(b) restrict speech, Sosa continues, they are not subject to strict scrutiny and satisfy

intermediate scrutiny. (Id. at 13–16.) We begin by defining the scope of our constitutional inquiry, keeping in mind that we should “avoid making unnecessary constitutional decisions.” ISI Int’l, 256 F.3d at 552. Onfido suggests in its briefing that the entirety of BIPA is unconstitutional. (See, e.g., Mem. at 6 (“BIPA is an unconstitutional restraint on speech in violation of the First Amendment . . . and consequently is invalid.”).) Yet Sosa accuses Onfido of violating only subsections (a) and (b) of section 15. (Compl. ¶¶ 47–49, 53–56.) Furthermore, Onfido does not contend that section 15(a) unconstitutionally restricts speech. Onfido argues only that BIPA restricts speech by regulating its collection of “factual information voluntarily provided by consumers to identify themselves as marketplace users.” (See Mem. at 14–15; Reply at 8–9.) Section 15(b) regulates the collection

of this information; section 15(a) does not. Compare 740 Ill. Comp. Stat. 14/15(b) (requiring an individual’s informed consent before collecting the individual’s biometric information or identifiers), with id. § 15(a) (requiring the development of a publicly available written data- retention policy and compliance with the policy). We therefore limit our First Amendment analysis to section 15(b).

8 Onfido also contends in a footnote that BIPA is a speaker-based restriction on speech that is subject to heightened scrutiny. (Mem. at 15 n.2.) But Onfido neither identifies the level of scrutiny at issue nor explains why BIPA would fail that scrutiny. (See id.) We decline to consider whether a duly enacted statute is unconstitutional based on Onfido’s undeveloped contention. See United States v. Berkowitz, 927 F.2d 1376, 1384 (7th Cir. 1991) (“[P]erfunctory and undeveloped arguments, and arguments that are unsupported by pertinent authority, are waived (even where those arguments raise constitutional issues).”). We also consider Onfido’s First Amendment challenge as applied to the facts of this case. Onfido does not dispute that its challenge is “as applied,” and treating Onfido’s First Amendment argument as an as-applied challenge comports with our duty to avoid deciding unnecessary constitutional questions. See Hegwood v. City of Eau Claire, 676 F.3d 600, 603

(7th Cir. 2012); ISI Int’l, 256 F.3d at 552. Thus, “we examine the facts of the case before us exclusively,” Hegwood, 676 F.3d at 603, and ask whether section 15(b) impermissibly abridges Onfido’s right to free speech, see HH-Indianapolis, LLC v. Consol. City of Indianapolis & Cnty. of Marion, 889 F.3d 432, 439 (7th Cir. 2018) (“[t]he critical inquiry” in the plaintiff’s as-applied challenge was whether the ordinance abridged the plaintiff’s First Amendment rights). As we will discuss, section 15(b) does not violate Onfido’s First Amendment rights for two reasons. First, section 15(b) does not restrict Onfido’s speech, so the First Amendment does not apply. Second, even if section 15(b) restricts Onfido’s speech, it is a content-neutral restriction that survives the applicable level of First Amendment scrutiny. 1. Section 15(b) Does Not Restrict Onfido’s Speech “The First Amendment, applicable to the States through the Fourteenth Amendment,

prohibits the enactment of laws” that restrict speech or inherently expressive conduct. Reed v. Town of Gilbert, 576 U.S. 155, 163, 135 S. Ct. 2218, 2226 (2015); Tagami v. City of Chicago, 875 F.3d 375, 378 (7th Cir. 2017). If a statute does not regulate the ability to engage in speech or inherently expressive conduct, the First Amendment does not come into play. See, e.g., Cornelius v. NAACP Legal Def. & Educ. Fund, Inc., 473 U.S. 788, 797, 105 S. Ct. 3439, 3446 (1985) (explaining that the Court “need go no further” in its First Amendment analysis if the solicitation at issue was not “speech protected by the First Amendment”); Doe v. City of Lafayette, 377 F.3d 757, 764 (7th Cir. 2004) (en banc) (finding First Amendment doctrine inapplicable “because there [was] no expression at issue”). Accordingly, we begin by asking whether section 15(b) regulates Onfido’s speech.9 See Cablevision Sys. Corp. v. FCC, 570 F.3d 83, 96 (2d Cir. 2009) (“As a threshold matter, a party alleging violation of its First Amendment rights must show that the challenged government action actually regulates protected speech.”). We start with section 15(b)’s text. See Sorrell v. IMS Health Inc., 564 U.S. 552, 562, 131

S. Ct. 2653, 2662 (2011) (starting its First Amendment analysis with the text of the challenged statutory provision). Section 15(b) states: No private entity may collect, capture, purchase, receive through trade, or otherwise obtain a person’s or a customer’s biometric identifier or biometric information, unless it first:

(1) informs the subject or the subject’s legally authorized representative in writing that a biometric identifier or biometric information is being collected or stored;

(2) informs the subject or the subject’s legally authorized representative in writing of the specific purpose and length of term for which a biometric identifier or biometric information is being collected, stored, and used; and

(3) receives a written release executed by the subject of the biometric identifier or biometric information or the subject’s legally authorized representative.

740 Ill. Comp. Stat. 14/15(b). Section 15(b) thus prohibits a private entity from obtaining an individual’s biometric data10 unless the entity satisfies three prerequisites designed to obtain the individual’s informed consent. See id.; Fox, 980 F.3d at 1150. Section 15(b), however, does not prohibit or otherwise restrict what a private entity may do with an individual’s biometric data once the data is obtained. Compare 740 Ill. Comp. Stat. 14/15(b), with id. § 15(c) (prohibiting the sale of biometric data), and id. § 15(d) (restricting the disclosure of biometric data).

9 Onfido does not contend that BIPA regulates inherently expressive conduct.

10 For purposes of our First Amendment analysis, we use the term “biometric data” to refer to “biometric identifiers” and “biometric information” collectively. Applied here, section 15(b) regulates Onfido’s ability to obtain an individual’s biometric data by requiring Onfido to acquire the individual’s informed consent before doing so. The question is whether this requirement regulates Onfido’s speech. Onfido says that it does because “factual information voluntarily provided by consumers to identify themselves as marketplace

users” is commercial speech. (Mem. at 14–15; Reply at 8–9.) Sosa disagrees; it contends that section 15(b) regulates conduct, not speech. (Resp. at 11–13.) The Seventh Circuit’s decision in Dahlstrom v. Sun-Times Media, LLC, 777 F.3d 937 (7th Cir. 2015), cited by Sosa, leads us to conclude that section 15(b) does not restrict Onfido’s speech. In Dahlstrom, the Seventh Circuit addressed the Driver’s Privacy Protection Act (“DPPA”), which “prohibits individuals from knowingly obtaining or disclosing ‘personal information’ from a motor vehicle record.” 777 F.3d at 939. Five Chicago police officers sued Sun-Times Media, LLC, arguing that it “violated the DPPA by obtaining each officer’s birth date, height, weight, hair color, and eye color from the Illinois Secretary of State’s motor vehicle records” and then publishing that information in a newspaper article. Id. Sun-Times moved to

dismiss the officers’ complaint, arguing, among other things, that the DPPA’s “prohibition on acquiring and disclosing personal information from driving records violates the First Amendment’s guarantees of free speech and freedom of the press.” Id. Evaluating Sun-Times’s First Amendment challenge “as applied to the facts of [the] case,” the Seventh Circuit addressed the DPPA’s prohibition on “obtaining personal information from driving records,” and then addressed the DPPA’s prohibition on “disclosing that information.” Id. at 946. The Dahlstrom court concluded that the “prohibition on obtaining information from driving records” did not restrict speech because it limited only “access to information.” Id. at 947–49 (emphasis in original). The court then concluded that the prohibition on disclosing personal information from driving records, while “a direct regulation of speech,” id. at 949, survived intermediate scrutiny and did not violate Sun-Times’s First Amendment rights, id. at 949–54. Like the first DPPA provision at issue in Dahlstrom, section 15(b) burdens a party’s

ability to access certain information. In determining “that the DPPA’s limitation on obtaining personal information [was] not a restriction on speech at all,” 777 F.3d at 949, the Dahlstrom court found unpersuasive Sun-Times’s argument that this limitation burdened its speech, “albeit at an earlier point in the speech process,” by restricting its “ability to gather and report the news,” id. at 947–48. Onfido makes a similar argument here; it contends that section 15(b) burdens its speech by restricting its ability to obtain biometric data from consumers. (See Mem. at 14–15; Reply at 8–9.) Based on Dahlstrom, Onfido’s argument cannot carry the day. If the DPPA’s prohibition on obtaining personal information is not a restriction on speech (as the Seventh Circuit has held), neither is section 15(b)’s regulation on obtaining biometric data. Onfido does not attempt to reconcile its position with Dahlstrom. (See Reply at 8–10

(failing to address Dahlstrom after Sosa cited it in his response).) Rather, Onfido rests its contention on a Tenth Circuit decision, U.S. West, Inc. v. FCC, 182 F.3d 1224 (10th Cir. 1999), and the Supreme Court’s decision in Sorrell. (Mem. at 14–15.) But even if U.S. West supported Onfido’s contention, it does not bind us, and it cannot compel a conclusion at odds with Dahlstrom. See United States v. Glaser, 14 F.3d 1213, 1216 (7th Cir. 1994). And although Sorrell is binding precedent, it is distinguishable. At issue in Sorrell was a Vermont statutory provision, section 4631(d), that restricted the sale, disclosure, and use of pharmacy records that revealed doctors’ prescribing practices (known as prescriber-identifying information). 564 U.S. at 557–58, 131 S. Ct. at 2659. Pharmacies sold prescriber-identifying information to data miners; data miners, in turn, analyzed the information, produced reports on prescriber behavior, and leased these reports to pharmaceutical manufacturers; and representatives of the manufacturers (known as detailers) used these reports to help promote and market their manufacturers’ drugs to doctors. Id., 131 S. Ct. at 2659–60.

Section 4631(d) generally prohibited, absent the prescriber’s consent, (1) pharmacies and similar entities from selling prescriber-identifying information; (2) pharmacies and similar entities from disclosing prescriber-identifying information for marketing purposes; and (3) pharmaceutical manufacturers and detailers from using prescriber-identifying information for marketing. Id. at 558–60, 131 S. Ct. at 2660. The Supreme Court held that section 4631(d) violated the First Amendment. Id. at 557, 131 S. Ct. at 2659. In doing so, the Court rejected the State’s contention that the statute “regulate[d] not speech but simply access to information.” Id. at 567– 70, 131 S. Ct. at 2665–66. As the Court explained, the statute burdened the speech of the data miners and pharmaceutical manufacturers because “restrictions on the disclosure of government- held information can facilitate or burden the expression of potential recipients and so transgress

the First Amendment.” Id. at 561, 569, 131 S. Ct. at 2661, 2666. Sorrell differs from our case in two key respects. First, central to the Sorrell Court’s analysis was the fact that the detailers’ inability to obtain prescriber-identifying information burdened their subsequent ability to use the information to communicate with physicians. See, e.g., id. at 564, 131 S. Ct. at 2663 (“But § 4631(d) leaves detailers no means of purchasing, acquiring, or using prescriber-identifying information. . . . Vermont’s law thus has the effect of preventing detailers—and only detailers—from communicating with physicians in an effective and informative manner.”). Indeed, in rejecting the State’s “access to information” argument, the Court relied upon the burden section 4631(d) imposed on potential recipients’ expression. Id. at 569–70, 131 S. Ct. at 2666. As Sosa points out, though, Onfido does not identify any speech it wishes to undertake once it obtains individuals’ biometric data. (Resp. at 12.) So, unlike in Sorrell, the party challenging the statute’s constitutionality here has not identified how the statute burdens its own ability to engage in speech or expression.

Second, the statutory provisions addressed in Sorrell substantively differ from section 15(b). Each of the three provisions at issue in Sorrell expressly restricted the sale, disclosure, or use of prescriber-identifying information. 564 U.S. at 558–59, 563–64, 131 S. Ct. at 2660, 2663. As such, each provision undoubtedly restricted speech. See id. at 570, 131 S. Ct. at 2667 (“This Court has held that the creation and dissemination of information are speech within the meaning of the First Amendment.”); Dahlstrom, 777 F.3d at 949 (“[T]he [DPPA’s] prohibition on disclosing [personal] information is a direct regulation of speech.”). In contrast, section 15(b) does nothing to restrict an entity’s sale, disclosure, or use of biometric data once the data is obtained. Thus, section 15(b) is much more like the DPPA prohibition on obtaining information at issue in Dahlstrom, which does not restrict speech, than the provisions at issue in Sorrell,

which do restrict speech. In sum, Dahlstrom is much closer to the facts before us than Sorrell. Based on Dahlstrom, we find that section 15(b) does not restrict Onfido’s speech and is not subject to the First Amendment. But for the sake of completeness, we also consider whether—assuming section 15(b) restricts Onfido’s speech—section 15(b) survives First Amendment scrutiny. 2. Even if Section 15(b) Restricts Onfido’s Speech, It Survives First Amendment Scrutiny Assuming that section 15(b) restricts Onfido’s speech, we must determine what level of First Amendment scrutiny applies. United States v. Kokinda, 497 U.S. 720, 725, 110 S. Ct. 3115, 3118 (1990) (plurality opinion); Deida v. City of Milwaukee, 176 F. Supp. 2d 859, 864 (E.D. Wis. 2001). Onfido argues that section 15(b) is a restraint on commercial speech that fails intermediate scrutiny or, alternatively, that section 15(b) is a content-based restriction that fails strict scrutiny. (Mem. at 14–18.) Although Onfido makes its strict scrutiny argument in the alternative, we address that argument first, as section 15(b) is “much less likely to survive

[Onfido’s] First Amendment challenge” if strict scrutiny applies. Deida, 176 F. Supp. 2d at 864. a. Strict Scrutiny “Content-based laws—those that target speech based on its communicative content—are presumptively unconstitutional” and “can stand only if they survive strict scrutiny.” Reed, 576 U.S. at 163, 171, 135 S. Ct. at 2226, 2231. In Reed, the Supreme Court recognized two types of content-based laws: (1) laws that, on their face, make distinctions based on “the topic discussed or the idea or message expressed”; and (2) facially content-neutral laws that “cannot be justified without reference to the content of the regulated speech, or that were adopted by the government because of disagreement with the message the speech conveys.” Id. at 163–64, 135 S. Ct. at 2227 (alteration and quotation marks omitted); Ill. Republican Party v. Pritzker, 973 F.3d 760, 768 (7th Cir. 2020). Thus, “strict scrutiny applies either when a law is content based on its face

or when the purpose and justification for the law are content based.” Reed, 576 U.S. at 166, 135 S. Ct. at 2228. For a content-based restriction to survive strict scrutiny, it must “further[] a compelling interest and [be] narrowly tailored to achieve that interest.” Id. at 171, 135 S. Ct. at 2231 (quotation marks omitted). Section 15(b) regulates the collection of an individual’s “biometric identifier or biometric information.” 740 Ill. Comp. Stat. 14/15(b). Based on BIPA’s definitions for these terms, this means that section 15(b) regulates the collection of some types of information but not others. See id. § 10 (identifying types of information that do and do not constitute a “biometric identifier” or “biometric information”). Onfido contends that because BIPA “targets only certain categories of information that can be used to identify a person,” it is “a content-based restriction on speech.” (Mem. at 17–18.) Not so, says Sosa. He contends that “BIPA does not concern itself with the message, if any even exists, communicated by a person’s biometric identifiers or biometric information.” (Resp. at 13–14.)

Sosa has the better argument. We do not see—and Onfido does not explain—how the different categories of information set forth in BIPA’s definitions for “biometric identifier” and “biometric information” relate to the communicative content of that information. If BIPA regulated the use of, for example, face geometry scans of people yelling but not the face geometry scans of people smiling, that could be a content-based regulation, but “BIPA does nothing of the sort.” Clearview AI, 2021 WL 4164452, at *7 (rejecting the defendant’s argument “that BIPA is content-based because it targets specific content—biometric information such as faceprints, but not other content such as photos”). Nor does Onfido argue that although BIPA is content neutral on its face, “the purpose and justification” for its regulation of some categories of information (but not others) is content based. See Reed, 576 U.S. at 164, 166, 135 S. Ct. at

2227–28. Because section 15(b) is a content-neutral restriction, we evaluate it using intermediate scrutiny. See Clearview AI, 2021 WL 4164452, at *7–8 (finding that BIPA’s restrictions are content neutral and subject to intermediate scrutiny). b. Intermediate Scrutiny “The Supreme Court uses several variations of intermediate scrutiny in its free-speech cases.” ACLU v. Alvarez, 679 F.3d 583, 604 (7th Cir. 2012). Here, both parties base their intermediate scrutiny arguments on the framework for evaluating restrictions on commercial speech set forth by the Supreme Court in Central Hudson Gas & Electric Corp. v. Public Service Commission of New York, 447 U.S. 557, 100 S. Ct. 2343 (1980). (See Mem. at 15–17; Resp. at 14–16); see also Fla. Bar v. Went For It, Inc., 515 U.S. 618, 623, 115 S. Ct. 2371, 2375–76 (1995) (characterizing the Central Hudson framework as intermediate scrutiny). We therefore analyze Onfido’s First Amendment challenge using Central Hudson’s framework. See Andy’s Rest. & Lounge, Inc. v. City of Gary, 466 F.3d 550, 552–53 (7th Cir. 2006) (using the framework relied upon by the parties to address First Amendment challenge); see also United States v.

Sineneng-Smith, 140 S. Ct. 1575, 1579 (2020) (explaining that federal courts “rely on the parties to frame the issues for decision” (quotation marks omitted)). The Central Hudson analysis has four prongs. See Cent. Hudson, 447 U.S. at 566, 100 S. Ct. at 2351. First, “we ask as a threshold matter whether the commercial speech concerns unlawful activity or is misleading.” Thompson v. W. States Med. Ctr., 535 U.S. 357, 367, 122 S. Ct. 1497, 1504 (2002). “If so, then the speech is not protected by the First Amendment.” Id. “If the speech concerns lawful activity and is not misleading, however, we next ask ‘whether the asserted governmental interest is substantial.’” Id. (quoting Cent. Hudson, 447 U.S. at 566, 100 S. Ct. at 2351). “If it is, then we ‘determine whether the regulation directly advances the governmental interest asserted,’ and, finally, ‘whether it is not more extensive than is necessary

to serve that interest.’” Id. (quoting Cent. Hudson, 447 U.S. at 566, 100 S. Ct. at 2351). “Each of these latter three inquiries must be answered in the affirmative for the regulation to be found constitutional.” Id.; see also Fla. Bar, 515 U.S. at 623–24, 115 S. Ct. at 2376 (reciting a slightly different formulation for the Central Hudson analysis). (i) Is the Speech Unlawful or Misleading? We first consider “whether the commercial speech concerns unlawful activity or is misleading.” Thompson, 535 U.S. at 367, 122 S. Ct. at 1504. It does not. Obtaining an individual’s biometric data, although regulated, is not unlawful, and Sosa does not argue to the contrary. (See Resp. at 14.) Nor is there anything inherently misleading about biometric data itself or the act of obtaining biometric data. Moreover, even if a company could misleadingly obtain biometric data in some circumstances, section 15(b) does not make a distinction based on this possibility. Stated differently, section 15(b) regulates both the misleading and non- misleading collection of biometric data. Section 15(b) therefore must satisfy the remainder of the Central Hudson test. Edenfield v. Fane, 507 U.S. 761, 768–69, 113 S. Ct. 1792, 1799 (1993)

(“[W]here . . . truthful and nonmisleading expression will be snared along with fraudulent or deceptive commercial speech, the State must satisfy the remainder of the Central Hudson test[.]”); FTC v. Trudeau, 662 F.3d 947, 953 (7th Cir. 2011) (requirement that the defendant post a bond before participating in an infomercial, regardless of whether the informercial contained a misleading statement, triggered intermediate scrutiny under Central Hudson). Sosa disagrees, arguing that Onfido’s actions are misleading because it “takes steps to conceal its involvement in the collection of biometric data, making it difficult to tell that Onfido is even involved.” (Resp. at 14.) But we do not read Sosa’s Complaint as alleging active concealment by Onfido, and Sosa fails to identify any allegation from the Complaint that supports his assertion. (Id.) Sosa also does not cite any case suggesting that either the

integration of Onfido’s software into third-party products or consumers’ unawareness of this integration (e.g., Compl. ¶¶ 3, 4, 21) amounts to “misleading” speech that brings our Central Hudson analysis to a halt. We therefore proceed to the second prong of the analysis. (ii) Is There a Substantial Governmental Interest? We next ask whether section 15(b) is supported by a substantial governmental interest. See Fla. Bar, 515 U.S. at 624, 115 S. Ct. at 2376. Section 15(b) is intended to protect consumers’ rights to privacy in and control over their biometric data. Bryant, 958 F.3d at 619, 626; Rosenbach, 2019 IL 123186, ¶¶ 33–34, 129 N.E.3d at 1206. Illinois has a substantial interest in protecting consumers, and more specifically, protecting their privacy in and control over their biometric data. See Trudeau, 662 F.3d at 953 (“The protection of consumers is a substantial interest.”); Abbas v. Selling Source, LLC, No. 09 CV 3413, 2009 WL 4884471, at *7– 8 (N.D. Ill. Dec. 14, 2009) (protecting consumer privacy was a substantial government interest); see also Nat’l Cable & Telecomms. Ass’n v. FCC, 555 F.3d 996, 1001 (D.C. Cir. 2009) (recognizing that “protecting the privacy of consumer credit information is a substantial

governmental interest” under Central Hudson (quotation marks omitted)). Section 15(b) satisfies this prong of the Central Hudson inquiry. According to Onfido, however, “the government has no ‘substantial interest’ in restricting the collection, handling, or disclosure of facial geometry” because a person has no reasonable expectation of privacy in her face, which is constantly exposed to the public. (Mem. at 16 (emphasis added); Reply at 8–9.) But Onfido’s argument erroneously equates viewing a person’s face with scanning facial geometry. Although the naked eye can perceive general aspects of a person’s face, it cannot perceive detailed information about the face’s geometry, such as a unique numerical representation of the face’s shape. This is the type of information collected when companies obtain scans of facial geometry. (Compl. ¶¶ 2, 23, 24; Resp. at 3–4);

see, e.g., Rivera, 238 F. Supp. 3d at 1091, 1095 (scanning photographs and zeroing in on the unique contours of a face “to create a ‘template’ that maps and records [] distinct facial measurements” was a scan of face geometry); In re Facebook Biometric Info. Priv. Litig., 185 F. Supp. 3d at 1171 (scanning “user-uploaded photographs to create a ‘unique digital representation of the face . . . based on [the] geometric relationship of [] facial features” constituted a scan of face geometry); Clearview AI, 2021 WL 4164452, at *1, *5 (scanning a photograph, measuring and recording “data such as the shape of the cheekbones and the distance between eyes, nose, and ears,” and assigning “that data a numerical value” constituted a scan of face geometry). We have no trouble finding that the government has a substantial interest in protecting consumers’ rights to privacy in and control over this type of information. (iii) Does Section 15(b) Directly Advance the Governmental Interest? Third, we ask whether section 15(b) “directly advances” the governmental interest. Cent. Hudson, 447 U.S. at 566, 100 S. Ct. at 2351. For this prong to be met, the harms identified by

Illinois must be real and the restriction at issue must in fact “alleviate them to a material degree.” Fla. Bar, 515 U.S. at 625–26, 115 S. Ct. at 2377 (quotation marks omitted). Both parts of this prong are satisfied. In enacting BIPA, the Illinois General Assembly found that the immutability of an individual’s biometric data means that once it is compromised, the individual suffers an irreparable privacy harm and is at heightened risk for identity theft. See 740 Ill. Comp. Stat. 14/5(c); Fox, 980 F.3d at 1149; Bryant, 958 F.3d at 619. We have no reason to question the existence of these harms, and Onfido gives us none. Section 15(b) materially alleviates these real harms by preventing them from occurring in the first place. See Rosenbach, 2019 IL 123186, ¶ 36, 129 N.E.3d at 1206 (“The strategy adopted by the General Assembly through enactment of [BIPA] is to try to head off [problems caused by the use of biometric data]

before they occur.”). Section 15(b)’s informed-consent regime seeks to protect consumers’ rights in their biometric data “before they are or can be compromised” by ensuring that consumers understand how their biometric data will be used, disclosed, or retained before they relinquish control over it. Id., 129 N.E.3d at 1206–07; Bryant, 958 F.3d at 626. Indeed, the power to refuse to provide biometric data after being informed of the potential consequences is a key part of consumers’ right to control their data, and when a company does not allow a consumer to exercise this power, the consumer’s right to maintain his “biometric privacy vanishes into thin air.” See Rosenbach, 2019 IL 123186, ¶ 34, 129 N.E.3d at 1206 (quotation marks omitted); Bryant, 958 F.3d at 621. By allowing a company to collect a consumer’s biometric data only after the consumer can make an informed choice about whether to allow the collection, section 15(b) directly advances the government’s interest in protecting consumers’ rights to privacy in and control over their biometric data. Onfido does not agree. It first contends that Sosa voluntarily uploaded his photograph

and driver’s license and understood that his photograph would be stored. (Mem. at 16–17.) It then contends that requiring a company to make certain disclosures and obtain a release in writing, as section 15(b) does, fails to “materially advance any interest because—as this case illustrates—other[] forms of disclosure and consent are equally effective.” (Id. at 17.) Taking these contentions together, Onfido appears to argue that (1) Sosa consented to Onfido’s collection of his photograph by voluntarily uploading it with the understanding that the photograph would be stored, and (2) this consent is “equally effective” as the disclosures and consent required by section 15(b). This argument is a non-starter. Consenting to Onfido’s collection of a photograph is not the same as consenting to Onfido’s collection of biometric data—here, a scan of face geometry.

Because section 15(b) is concerned with obtaining consumers’ informed consent for the collection of their biometric data, not their photographs, see 740 Ill. Comp. Stat. 14/10, 14/15(b), Sosa’s purported consent in the case at hand does nothing to advance the government’s interest in protecting consumers’ rights in their biometric data. Nor does Onfido identify any other forms of disclosure or consent that are purportedly as effective as disclosures and consent memorialized in writing. (Mem. at 16–17; Reply at 10.) But even if Onfido had identified available and equally effective forms of non-written informed consent, it would not have impacted whether section 15(b)’s “in writing” requirement directly advances the governmental interest in protecting consumer privacy. At best, the availability and effectiveness of alternative forms would affect the “fit” between section 15(b) and the government’s interest, which is addressed as part of the last Central Hudson prong, not the current one. See Fla. Bar, 515 U.S. at 632, 115 S. Ct. at 2380; Trudeau, 662 F.3d at 953. (iv) Is Section 15(b) More Extensive Than Necessary? Finally, we come to the fourth Central Hudson prong: is section 15(b) “more extensive

than [] necessary to serve” the government’s interest? Cent. Hudson, 447 U.S. at 566, 100 S. Ct. at 2351. To answer this question, “we examine the relationship between the [government’s] interests and the means chosen to serve them.” Fla. Bar, 515 U.S. at 632, 115 S. Ct. at 2380. The “fit” between the government’s interests and the restriction at issue need not be perfect or the least restrictive means available. Id. The fit only needs to be reasonable, i.e., “one whose scope is in proportion to the interest served.” Id. (quotation marks omitted). Section 15(b) meets this standard. First, it does not outright prohibit companies like Onfido from obtaining biometric data; it merely requires them to obtain informed consent before doing so. Second, it is not too onerous to require a company that wants to collect a consumer’s sensitive and immutable biometric data to obtain the consumer’s consent before doing so. See

740 Ill. Comp. Stat. 14/15(b)(3). Similarly, we do not see anything unduly burdensome about the amount and type of information—the fact that biometric data is being collected or stored and the purpose and length of term for which the data is being collected, stored, and used—that must be provided to ensure that the consumer’s consent is informed. Id. § 15(b)(1), (2). “Compliance should not be difficult; whatever expenses a business might incur to meet [these] requirements are likely to be insignificant compared to the substantial and irreversible harm that could result if biometric identifiers and information are not properly safeguarded.” Rosenbach, 2019 IL 123186, ¶ 37, 129 N.E.3d at 1207. Third, section 15(b)’s “in writing” requirement guarantees that there is a record of the required disclosures and release should the consumer’s biometric data later become compromised, or some other dispute between the consumer and the collector arises. Finally, and as already noted, Onfido does not identify any other forms of disclosure and consent that are as equally effective as those required by section 15(b). The fit between section 15(b)’s requirements and the government’s interest in protecting consumers’ rights to privacy in and

control over their biometric data is certainly reasonable. Onfido’s argument to the contrary again does not persuade us. Onfido contends that section 15(b) is more extensive than necessary to prevent identity theft “because it restricts companies from engaging in wholly permissible activities.” (Mem. at 17; Reply at 10.) But the government’s interest is broader than simply preventing identity theft; it is protecting consumers’ rights to privacy in and control over their biometric data. More to the point, any restriction that proceeds past the first Central Hudson prong curbs lawful activities in some way. See Fla. Bar, 515 U.S. at 623–24, 115 S. Ct. at 2376; Cent. Hudson, 447 U.S. at 563–64, 566, 100 S. Ct. at 2350–51. Yet this does not mean that the restriction fails the fourth and final Central Hudson prong. See, e.g., Fla. Bar, 515 U.S. at 632–34, 115 S. Ct. at 2380–81 (bar regulation satisfied the

final Central Hudson prong); Trudeau, 662 F.3d at 952–54 (same for bond requirement). So too here: section 15(b)’s restrictions are not more extensive than necessary simply because they regulate the otherwise permissible act of obtaining biometric data. * * * In conclusion, we deny Onfido’s motion to dismiss based on the First Amendment because section 15(b) does not restrict Onfido’s speech, and even if it does, it is a content-neutral restriction that satisfies Central Hudson’s intermediate level of scrutiny. CONCLUSION For the foregoing reasons, we deny Onfido’s motion to dismiss (Dkt. No. 45). Onfido shall answer Sosa’s Complaint by May 16, 2022. It is so ordered.

Marvin E. Aspen / United States District Judge Dated: April 25, 2022