State v. Clearview Ai

Opinion

‘JERMONT SBPEREQR COURT Ty; Cr

5" ”‘ ‘ElrL' VERMONT SUPERIOR COURT CHIWENDEN UNIT CHWTENOEN um CIVIL DIVISION

STATE OF VERMONT, Plaintiff

v. Docket N0. 226-3—20 Cncv

CLEARVIEW AI, INC., Defendant

RULING ON DEFENDANT’S MOTION TO DISMISS

The State brings this consumer fraud action concerning facial recognition

technology developed by Defendant Clearview AI, Inc. In this three—count complaint, the

State alleges that Clearview has engaged in unfair acts and practices by collecting billions

of photographs and making them available for its customers to search using facial

recognition technology without the consent of those depicted, engaged in deceptive acts

and practices by making material misrepresentations about its product, and fraudulently

acquired brokered personal information (i.e., biometric data used to identify a consumer).

The State claims that Clearview’s actions violate the Vermont Consumer Protection Act

(9 V.S.A. § 2453(a)) (Counts I and II) and Vermont’s Fraudulent Acquisition of Data law

(9 V.S.A. § 2431(a)(1)) (Count III). Clearview moves to dismiss on various grounds. Ryan

Kriger, Justin Kolber, and Jill Abrams, Esqs., represent the State. Timothy Doherty,

Tristram Coffin, and Tor Ekeland, Esqs. represent Clearview.1

1 The State has requested oral argument on this motion. State’s Opp’n at 78. Given that the State has largely prevailed on this motion, and in the interest of resolving this motion prior to the undersigned’s rotation to another court, the court denies that request. 31513

The following facts are alleged in the complaint. The court makes no nding as to

their accuracy for purposes of this motion to dismiss.

Clearview, a Delaware corporation with its principle place of business in New York,

is engaged in the business of identifying individuals using facial recognition technology

applied to photographs. Clearview is also registered as a data broker in Vermont’s Data

Broker Registry. See 9 V.S.A. § 2446. A data broker is “a business . . . that knowingly collects and sells or licenses to third parties the brokered personal information of a

consumer with whom the business does not have a direct relationship.” 9 V.S.A. § 2430(4).

As a small start-up company, Clearview developed facial recognition technology and, using “screen scraping” technology, amassed a database ofthree billion photographs.

Facial recognition technology involves using computers to extract biometric identiers

from photographs based on specic features of an individual’s face like relative position,

size, or shape ofthe eyes, nose, cheekbones, andjaw. These identiers are stored as digital

“hashes” in a searchable database to quickly identify an individual based on a photograph or video. A biometric identifier is a piece of information used to authenticate an individual

that is based on that person’s physical or behavioral traits, for example, a ngerprint, DNA mapping, ocular scan, or an analysis of the way someone walks. Facial recognition

extracts a unique, instantly searchable biometric identier for a person, which that person

cannot change absent extreme efforts. Once entered into a facial recognition database,

that individual can then be picked out of a crowd by anyone using the technology. Businesses and policy makers have been particularly cautious regarding the

implementation of facial recognition technology because of the potential for misuse and its consequences. Easily accessible facial recognition would permit governments,

stalkers, predators, con artists, and others to instantly identify any Stranger and,

combined with other readily available data sources, know extensive details about their

family, address, workplace, and other characteristics. For example, large technology

companies such as Google and Facebook have declined to make a facial recognition tool

commercially available, though they have the capability to do so.

Clearview collected the billions of photographs by scouring millions of websites

through a process called “screen scraping.” Screen scraping is a term for sending

automated scripts or other processes, sometimes called “spiders,” “web scrapers,” or

“crawlers,” to collect information throughout the Internet, such as downloading

photographs. It has commercialized these photographs via a service that allows the

customer to upload a photograph in order to instantly identify an individual through

facial recognition matching. The general public rst learned of Clearview through a

January 18, 2020 article in the New York Times. The State alleges in Count I (Compl. 11 78) that Clearview has engaged in unfair acts and practices in commerce, in violation of the Consumer Protection Act, through the

following acts:

o screen scraping billions of photographs without the consent of their owners, many

of which had been uploaded subject to terms of service of web sites which limited

their use;

o collecting, storing, analyzing, and distributing the photographs of minors without

the consent of their parents or guardians;

o invading the privacy of consumers; o failing to provide adequate data security for the data collected; exposing consumers’ sensitive personal data to theft by foreign actors and

Criminals;

Violating consumers’ civil rights by chilling their freedoms of assembly and

political expression;

Violating consumers’ rights as to the display and distribution of their photographs

and other property rights; and

exposing citizens to the threat of surveillance, stalking , harassment, and fraud.

In Count 2 (Compl. 11 81), the State alleges that Clearview has engaged in deceptive

acts and practices, in Violation of the CPA, by making materially false or misleading

statements regarding:

the ways that Vermont consumers can assert their privacy rights to opt out of its

product;

that Clearview's processing of consumers’ personal data does not unduly affect

their interests or fundamental rights and freedoms;

the strength of its data security;

that the product is only used by law enforcement agencies and is not publicly

available;

that it removes consumers from its database to comply with relevant laws;

the accuracy of its facial recognition matching product; and

its success in assisting law enforcement investigations. Finally, in Count 3, the State alleges that Clearview’s use of screen scraping

technology constitutes fraudulent acquisition of brokered personal information in

Violation of Vermont’s Fraudulent Acquisition of Data Law. Compl. 1} 86.2

Discussion

Clearview’s motion to dismiss is based on several grounds: (1) improper venue; (2)

preemption by the federal Communications Decency Act; (3) the First Amendment; (4)

that the claims are void for vagueness under the Fifth and Fourteenth Amendments; (5)

failure to state a claim for a CPA violation; and (6) lack of standing. Clearview also appears

to assert a Fourth Amendment argument, but the basis for that argument is unclear.

Clearview’s Mot. to Dismiss at 2. Clearview incorporated its memorandum opposing the

State’s motion for a preliminary injunction into its motion to dismiss (led Apr. 9, 2020),

making its arguments for dismissal less than crystal clear. The court uses “Clearview’s

Mem.” to refer to that memorandum throughout this ruling.

I. icing Clearview contends that this case cannot be brought in Chittenden County under

9 V.S.A. § 2458(a) because it does not reside in, have a place of business in, or do business

in Chittenden County. However, the State has pled that venue is proper because Clearview

2 Clearview asks the court to disregard several paragraphs from the Complaint that, it asserts, are conclusory allegations or legal conclusions masquerading as facts. Clearview’s Reply at 35~38 & n.135. The court observes that most of the cited paragraphs are proper factual allegations but, to the extent they are not, the court does not assume their truth for purposes of this motion to dismiss. Clearview also asks the court to disregard numerous paragraphs “which appear to be drawn from newspaper articles and other news reports without independent investigation as required by Rule 11.” Ll. at 38—41 & n.141. All statements in a pleading “shall be made subject to the obligations set forth in Rule 11.” V.R.C.P. 8(e)(2). Rule 11 requires that “to the best of the person’s knowledge, information, and belief, formed after an inquiry reasonable under the circumstances . . . the allegations and other factual contentions have evidentiary support . . . .” V.R.C.P. 11(b)(3). The court has no reason to believe there was a Rule 11 violation here. In any event, Clearview has not properly initiated a Rule 11 motion. See V.R.C.P. 11(c)(1). does business in Chittenden County. Compl. 9. That is sufcient to survive a motion to i

dismiss.

II. Communications Decencv Act § 220

Clearview next contends that it is protected from liability for the State’s claims

under section 230 of the federal Communications Decency Act, which provides in

pertinent part: “No provider or user of an interactive computer service shall be treated as

the publisher or speaker of any information provided by another information content

provider.” 47 U.S.C. § 230(c)(1). Section 230 further provides that “[n]o cause of action

may be brought and no liability may be imposed under any State or local law that is

inconsistent with this section.” 1d. § 230(e)(3).

Generally, section 230 bars plaintiffs from holding internet service providers and

web hosts legally responsible for information that third parties created and developed. Johnson v. Arden, 614 F.3d 785, 791 (8th Cir. 2010); see also Fed. Trade Comm’n v.

LeadClick Media LLC, 838 F.3d 158, 173 (2d Cir. 2016) (noting that section 230 was

enacted in response to inconsistent district court rulings concerning liability for

publishing or censoring third—party defamatory statements, and “intended to . . . provide

immunity for ‘interactive computer service[s]’ that make ‘good faith’ efforts to block and

screen offensive content”). “Section 230 was enacted, in part, to maintain the robust

nature of Internet communication and, accordingly, to keep government interference in

the medium to a minimum.” Zeran v. Am. Online. Inc., 129 F.3d 327, 330 (4th Cir. 1997).

“[T]he application of Section 230(c)(1) is appropriate at the pleading stage when . . . the statute’s barrier to suit is evident from the face of [the] complaint.” Force V. Facebook,

inc” 934 F.3d 53, 63 n.15 (2d Cir. 2019). “In applying the statute, courts have broken [it] down into three component parts,

nding that [i]t shields conduct if the defendant (1) is a provider or user of an interactive

computer service, (2) the claim is based on information provided by another information

content provider and (3) the claim would treat [the defendant] as the publisher or speaker of that information.” Fed. Trade Comm’n V. LeadClick Media, LLC, 838 F.3d 158, 173 (2d

Cir. 2016) (quotations omitted). The parties agree that Clearview is a provider or user of

an “interactive computer service” under that term’s broad See id. at statutory denition.

174; 47 U.S.C. § 230(f)(2).

However, the State’s claims are not based on information provided by another

information content provider. “Information content provider” means “any person or

entity that is responsible, in whole or in part, for the creation or development of

information provided through the Internet or any other interactive computer service.” 47

U.S.C. § 230(f)(3). The statute’s “grant of immunity” applies “only ifthe interactive service

provider is not also an ‘information content provider’ of the content which gives rise to

the underlying claim.” LeadClick, 838 F.3d at 174. This denition of information content

provider “cover[s] even those who are responsible for the development of content only in

part,” FTC v. Accusearch Inc, 57o F.3d 1187, 1197 (10th Cir. 2009), however, a defendant

“will not be held responsible unless it assisted in the development of what made the

content unlawful.” 1d. at 1201; see also, e.g., id. at 1199 (a defendant who paid researchers

to uncover condential phone records protected by law, and then provided that

information to paying customers, fell within the denition because he did not merely act

as a neutral intermediary, but instead “specically encourage[d] development of what

[was] offensive about the content”); Fair Hous. Council of San Fernando Valley v.

Roommates.Com LLC, 521 F.3d 1157, 1167—68 (9th Cir. 2008) (holding defendant liable for developing content by “not merely . . . augmenting the content generally, but . . .

materially contributing to its alleged unlawfulness” by requiring subscribers to provide

information which enabled site users to unlawfully discriminate in selecting a roommate).

Importantly, the basis for the State’s claims is not merely the photographs

provided by third—party individuals and entities, or that Clearview makes those

photographs available to its consumers. Instead, the claims are based on the means by

which Clearview acquired the photographs, its use of facial recognition technology to allow its users to easily identify random individuals from photographs, and its allegedly deceptive statements regarding its product. See LeadClick, 838 F.3d at 176 (defendant

“not entitled to immunity because it participated in the development of the deceptive content posted on fake news pages”). This is not simply a case of Clearview republishing offensive photographs provided by someone else, and the State seeking liability because

those photographs are offensive. See, e.g., Barnes v. Yahool, Inc., 570 F.3d 1096, 1103

(9th Cir. 2009) (no liability for failure to “remov[e] . . . indecent proles that [plaintiff’s]

former boyfriend posted on Yahoo!’s website”). Indeed, whether the photographs themselves are offensive or defamatory is immaterial to the State’s claims.

Moreover, the State’s claims do not treat Clearview as the publisher or speaker of

the third—party photographs. “At its core, § 230 bars lawsuits seeking to hold a service

provider liable for its exercise of a publisher’s traditional editorial functions—such as

deciding whether to publish, withdraw, postpone or alter content.” LeadClick, 838 F.3d

at 174 (quotation omitted); see also Barnes v. Yahoo! Inc., 570 F.3d 1096, 1102 (9th Cir.

2009) (“To put it another way, courts must ask whether the duty that the plaintiff alleges the defendant violated derives from the defendant’s status or conduct as a ‘publisher or

speaker.’ If it does, section 230(c)(1) precludes liability.”). Instead, the claims here attempt to hold Clearview “accountable for its own unfair or deceptive acts or practices,”

such as screen—scraping photographs Without the owners’ consent and in Violation of the

source’s terms of service, providing inadequate data security for consumers’ data,

applying facial recognition technology to allow others to easily identify persons in the

photographs, and making material false or misleading statements about its product.

LeadClick, 838 F.3d at 176 (emphasis in original); see also Accusearch, 570 F.3d at 1204——

05 (Tymkovitch, J., concurring) (noting that “the FTC sought and ultimately held

[defendant] liable for its conduct rather than for the content of the information it was

offering on [its] website” and arguing that there should be no immunity because “Section

230 only immunizes publishers or speakers for the content of the information from other

providers that they make public”) (emphasis in original).

The complaint here simply does not fall into the category of cases relied upon by

Clearview where § 230 precluded liability. See, e.g., Barnes, 570 F.3d at 1103; Marshall's

Locksmith Serv. Inc. v. Google. LLC, 925 F.3d 1263, 1269 (D.C. Cir. 2019) (holding that

§ 230 immunized search engine for publishing false information provided by third

parties); Bennett v. Google, LLC, 882 F.3d 1163, 1167~68 (D.C. Cir. 2018) (Google

immune from liability under § 230 for failure to remove offensive third-party blog post);

Parker v. Google, lnc., 242 F. App’x 833, 838 (3d Cir. 2007) (immunity under § 230 for

linking to defamatory third-party posts); Zeran v. Am. Online, Inc., 129 F.3d 327, 332 (4th Cir. 1997) (AOL immune from liability for defamatory third-party posts on its message

board service). The Communications Decency Act is not grounds for dismissal.

III. First Amendment

Clearview’s next ground for dismissal is that its app (and the computer code used

to write it) is protected First Amendment speech, and that the State’s action amounts to an unconstitutional regulation of that speech. The State contends that many of its claims

are unrelated to speech, that the First Amendment does not protect deceptive statements,

and that the Clearview app is not protected speech and, even if it were, it would survive

whatever First Amendment scrutiny applied.

The First Amendment guarantees an individual the right to free speech, “a term

necessarily comprising the decision of both what to say and what not to say.” Riley v.

National Fed’n of the Blind of North Carolina Inc., 487 U.S. 781, 796-—97 (1988).

Generally, this means that “government has no power to restrict expression because of its

message, its ideas, its subject matter, or its content.” Bolger v. Youngs Drug Prod. Com,

463 U.S. 60, 65 (1983) (quotation omitted). “Even dry information, devoid of advocacy,

political relevance, or artistic expression, has been accorded First Amendment

protection.” Universal Citv Studios. Inc. v. Corlev, 273 F.3d 429, 446 (2d Cir. 2001)

(collecting cases).

Content-based speech restrictions-Le, “those that target speech based on its

communicative content”—-are “presumptively unconstitutional” and subject to strict

scrutiny. Reed v. Town of Gilbert, Ariz., 576 U.S. 155, 163 (2015). Content-neutral

regulations that incidentally restrict speech~—i.e., a law that targets the non-

communicative component of conduct that includes both communicative and non—

communicative elements—are subject to intermediate scrutiny. United States v. O’Brien,

391 U.S. 367, 376 (1968); Citv of Erie v. Pan’s A.M., 529 U.S. 277, 289 (2000); Vermont

Soc. of Ass’n Executives v. Milne, 172 Vt. 375, 390 (2001); Citv of Burlington v. New York

Times C0., 148 Vt. 275, 278 (1987). However, a restriction on nonspeech or

nonexpressive conduct does not implicate the First Amendment and receives only

10 rational basis scrutiny. See Arcara v. Cloud Books, Inc., 478 U.S. 697, 706—07 (1986);

Sorrell V. IMS Health Inc., 564 U.S. 552, 567(2011).

Preliminarily, the court agrees with the State that the First Amendment does not

protect the alleged deceptive statements in Count II. “The First Amendment, as applied

to the States through the Fourteenth Amendment, protects commercial speech from

unwarranted governmental regulation.” Cent. Hudson Gas & Elec. Corn. V. Pub. Serv.

Comm’n of New York, 447 U.S. 557, 561 (1980). Commercial speech is dened as

“expression related solely to the economic interests of the speaker and its audience.” I_d.

(emphasis added); see also United States v. United Foods, Inc., 533 U.S. 405, 409 (2001)

(stating that commercial speech is “usually dened as speech that does no more than

propose a commercial transaction”). The alleged deceptive statements in Count II are

advertisement, and are therefore properly categorized as commercial speech.

However, the First Amendment does not protect false or deceptive commercial

speech. “[T]he government may freely regulate commercial speech that concerns

unlawful activity or is misleading.” Fla. Bar v. Went For It, Inc., 515 U.S. 618, 623-24

(1995); see also In re Deyo, 164 Vt. 613, 614 (1995) (“For commercial speech to come

within that provision, it must at least concern lawful activity and not be misleading”)

(quotation omitted). Therefore, the alleged deceptive statements in Count II are not

protected by the First Amendment.

The court next observes that at least some of the conduct alleged in Counts I and

III is largely nonexpressive in nature. The allegations that Clearview provided inadequate

data security and exposed consumers’ information to theft, security breaches, and

surveillance lack a communicative element. The First Amendment does not protect such

conduct. See Nat’l Rie Ass’n of Am. V. Citv of Los Angeles, 441 F. Supp. 3d 915, 928—29

11 (C.D. Cal. 2019) (summarizing different categories of speech and corresponding levels of

scrutiny).

Whether Clearview’s app is First Amendment speech presents a harder question.

Courts have considered whether other forms of electronic media constitute First

Amendment speech. For instance, the U.S. Supreme Court has recognized that Video

games are protected speech because they “communicate ideas-and even social

messages—through many familiar literary devices (such as characters, dialogue, plot, and

music) and through features distinctive to the medium (such as the player’s interaction

with the virtual world)” like the “protected books, plays, and movies that preceded

them . . . Brown v. Entm’t Merchants Ass’n, 564 U.S. 786, 790 (2011).

However, _B_r_91v_n_ does not state that all software applications are speech, and

Clearview’s app is not like a video game. A better analogy is found in a pair of Second

Circuit cases: Commodi Futures Trading Comm’n v. Vartuli, 228 F.3d 94 (2d Cir. 2000)

and Universal CitV Studios, Inc. v. CorleV, 273 F.3d 429 (2d Cir. 2001). In Co_rley, the

Second Circuit considered whether posting a DVD decryption code and links to other DVD

decryption codes on a website was protected First Amendment speech. The court

recognized that “computer code, and computer programs constructed from code can

merit First Amendment protection ” because they have the capacity to communicate to

other programmers reading the code. I_d. at 449 (emphasis added). The court held that

the regulation sought was content-neutral because it targeted only the code’s nonspeech,

functional component (i.e., its “capacity to instruct a computer to decrypt” DVDs), not its

speech component (i.e., its capacity to convey information to a human being). Li. at 454,

456. The court went on to hold that the regulation survived intermediate scrutiny. IA. at

454—57. Vartuli involved a software program that told users when to buy or sell currency

12 futures contracts iftheir computers were fed currency market rates. Because this program q

was sold and marketed as an automatic trading system generating buy and sell

instructions “in an entirely mechanical way,” and to “induce action without the

intercession of the mind or the will of the recipient,” the court held that it was not

protected speech and accordingly did not apply even intermediate scrutiny to the

government’s regulation. \Lartylj, 228 F.3d at 111.

Because the Clearview app’s raw code is not at issue here as in the app

arguably has no expressive speech component and is more similar to the “entirely

mechanical” automatic trading system in \_7a_rt_u that “induce[d] action without the

intercession of the mind or the will of the recipient.” Vartuli, 228 F.3d at 111. The user

simply inputs a photograph of a person, and the app automatically displays other

photographs of that person with no further interaction required from the human user. In

that sense, the app might not be entitled to any First Amendment protection.

Complicating matters, however, is the fact that Clearview’s app is similar to a search

engine, and some courts have generally recognized First Amendment protection for

search engines, at least to the extent that the display and order of search results involve a

degree of editorial discretion. See Dreamstimecom. LLC v. Google, LLC, No. C 18-01910

WHA, 2019 WL 2372280, at *2 (ND. Cal. June 5, 2019) (collecting cases). The State would conne those cases to search engine results for text rather than photos, and also

contends that Clearview’s app goes far beyond what any other search engines have done.

The court need not decide whether the Clearview app is speech, however.

Assuming without deciding that it is speech or at least contains a speech component, the

State’s attempted regulation of Clearview through this enforcement action is a

permissible content—neutral regulation that survives intermediate scrutiny.

13 “[G]overnment regulation of expressive activity is ‘content neutral’ if it is justied without

reference to the content of regulated speech.” Hill V. Colorado, 530 U.S. 703, 720 (2000).

“The government’s purpose is the controlling consideration. A regulation that serves

purposes unrelated to the content of expression is deemed neutral, even if it has an

incidental effect on some speakers or messages but not others.” Ward v. Rock Against

B_a_g_i_s_m_, 491 U.S. 781, 791 (1989). “The Supreme Court’s approach to determining

content—neutrality appears to be applicable whether What is regulated is

expression, conduct, or any ‘activity’ that can be said to combine speech and non-speech

elements.” QgLey, 273 F.3d at 450 (citations omitted).

The State does not justify its action against Clearview based on the content of

Clearview’s speech, for example, the order of its search results or whether the

photographs displayed are offensive. Instead, its purpose is based purely on the alleged

function of the Clearview app in allowing users to easily identify Vermonters through

photographs obtained unfairly and without consent, thereby resulting in privacy

invasions and unwarranted surveillance. Presumably, the State has no problem with

Clearview operating its app so long as the Vermonters depicted in its photograph database

have fully consented. The regulation sought by the State here is content—neutral and,

accordingly, subject to intermediate scrutiny.

Clearview maintains that the State’s attempted regulation is nevertheless subject

to strict scrutiny because it is “speaker-based,” relying on Sorrell V. IMS Health Inc., 564

U.S. 552, 563—64 (2011) (“On its face, Vermont’s law enacts content—and speaker—based

restrictions on the sale, disclosure, and use of prescriber—identifying information”); see

also Citizens United V. Fed. Election Comm’n, 558 U.S. 310, 340—41 (2010). Clearview’s

reliance on Sorrell is misplaced. The statute there specically prohibited pharmaceutical

14 manufacturers from using prescriber-identiring information for marketing, but allowed

other speakers to obtain and use such information. _S_o_r_r__e_1_l, 564 U.S. at 564. Here, the

Consumer Protection Act is obviously not facially speaker—based, but Clearview complains

of discriminatory enforcement. Clearview contends that the State is targeting only

Clearview and none of the other search engines, and asserts that Google has also

developed and patented facial—recognition technology. See Clearview’s Reply at 41, 53.

However, the State alleges that Google has not actually used that technology, Compl.

111i 16—17, and that Google’s image search does not display photographs from websites

with terms of service that prohibit screen scraping. 1d. 1] 39. There is no basis to conclude

that the State’s action is a speaker—based restriction on speech.

A content—neutral restriction is permissible if it serves a substantial governmental

interest, the interest is unrelated to the suppression of free expression, and the regulation

is narrowly tailored, which “in this context requires . . . that the means chosen do not

‘burden substantially more speech than is necessary to further the government’s

legitimate interests.’” Turner Broadcasting System, Inc. V. FCC, 512 U.S. 622, 662 (1994)

(quoting Ward v. Rock Against Racism, 491 U.S. 781, 799 (1989)). The State plainly has a

substantial governmental interest in maintaining a fair and honest commercial

marketplace, and in protecting the health, welfare, and privacy of its citizens. See 9 V.S.A.

§ 2451 (stating that purposes of the Consumer Protection Act are “to protect the public

and to encourage fair and honest competition”); Rubin v. Coors Brewing Co., 514 U.S.

476, 485 (1995) (“the Government . . . has a significant interest in protecting the health,

safety, and welfare of its citizens”); Edeneld v. Fane, 507 U.S. 761, 769 (1993) (protecting

individual privacy is a “substantial state interest”); State v. VanBuren, 2018 VT 95, 57, _a_s_ 11

15 supplemented (June 7, 2019) (“The government’s interest in preventing any intrusions

on individual privacy is substantial.”).

This interest is unrelated to the suppression of free expression. The injunction the

State seeks would require Clearview to remove all images of Vermonters from its facial

recognition database in order to protect their privacy and welfare, regardless of the

content ofthose images or what information they convey. See gm, 273 F.3d at 454. The State also seeks civil penalties for Clearview’s allegedly unfair and deceptive acts, as

permitted by the Consumer Protection Act. See 9 V.S.A. §§ 2431(b), 2458(a)—(b). The

State seeks those penalties because of the app’s function in invading Vermonters’ privacy,

not because of disagreement with the app’s content.

Furthermore, any incidental restriction on speech imposed by the State’s action

would not burden substantially more speech than is necessary to further the State’s

interest in protecting privacy. The State estimates that the relief it requests will leave more

than 99 percent of Clearview’s database intact. Moreover, an injunction would

presumably allow Clearview the option of obtaining afrmative consent in order t0 add

Vermonters’ images to its database. In any event, the court might need to take evidence

on whether there are other, substantially less burdensome ways to further the State’s

interest here. Any remedies could accordingly be further tailored in light of such evidence.

Clearview also advances a slightly different First Amendment theory—that this

action violates its right to access public data on the web. See Clearview’s Mem. at 37—42;

see also Packineham v. North Carolina, 137 S. Ct. 1730, 1732 (2017) (holding that

restricting sex offenders from accessing social media sites violates First Amendment). The

court nds this theory unpersuasive. None of the relief sought by the State would prohibit

Clearview from accessing and viewing any particular website. Instead, the claims derive

16 from what Clearview does with that information, and the theory that Clearview’s actions

constitute unfair trade praotices.

Clearview relatedly relies on a trio of federal court decisions discussing the

application of the federal Computer Fraud and Abuse Act (CFAA), 18 U.S.C.

§ 1030(a)(2)(C), to data scraping. See higz Labs, Inc. v. LinkedIn Corp, 938 F.3d 985 (9th

Cir. 2019) (involving data analytics company scraping LinkedIn’s data and selling to

employers interested in retaining employees); SandVig V. Barr, No. CV 16—1368 (JDB),

2020 WL 1494065 (D.D.C. Mar. 27, 2020) (Sandvig II) (involving academic researchers’

intended conduct of violating employment websites’ terms of service to research whether

sites discriminated based on race or gender); Sandvig V. Sessions, 315 F. Supp. 3d 1

(D.D.C. 2018) (Sandvig I). These decisions are inapposite. While those courts suggested

that criminalizing data scraping and website terms of service Violations might implicate

the First Amendment, the decisions ultimately turned on a statutory interpretation of the

CFAA, which is not at issue here. See higz Labs, 938 F.3d at 999—1004; Sandvig II, 2020 WL 1494065, at *14 (“[T]he Court concludes that plaintiffs’ research plans do not Violate the Access Provision of the CFAA. . . . [T]he Court need not wade into the question

whether plaintiffs’ proposed conduct should receive First Amendment protection”). The

same is true for the other federal cases cited by Clearview. See Clearview’s Mem. at 42

n.146 (listing cases); see also United States v. Valle, 807 F.3d 508, 524 (2d Cir. 2015)

(explaining circuit split on CFAA statutory interpretation issue).

Moreover, dicta by the Ninth Circuit further undermines Clearview’s argument.

See hiQ Labs, 938 F.3d at 1004 (“We note that entities that View themselves as Victims of

data scraping are not without resort, even if the CFAA does not apply: state law trespass

to chattels claims may still be available. And other causes of action, such as copyright

17 infringement, misappropriation, unjust enrichment, conversion, breach of contract, or

breach of privacy, may also lie”) (emphasis added) (footnote omitted). The First

Amendment does not provide grounds for dismissal here at the pleading stage.

IV. Vagueness

Clearview next argues that the Consumer Protection Act as applied here is

unconstitutionally vague. “A statute is void for vagueness when it ‘either forbids or

requires the doing of an act in terms so vague that [persons] of common intelligence must

necessarily guess at its meaning and differ as to its application.”’ Kimbell V. Hooper, 164

Vt. 80, 88 (1995) (quoting Zwickler v. Koota, 389 U.S. 241, 249 (1967)); see

also Rutherford V. Best, 139 Vt. 56, 60 (1980) (due process requires that person have fair

warning of what conduct is prohibited). However, “a statute need not detail every

circumstance that would amount to a violation.” Kimbell, 164 Vt. at 89; see also State V.

11w, 2007 VT 41, 11 11, 181 Vt. 627 (“the fact that the statute does not enumerate ‘every

act that might constitute a violation’ does not render it unconstitutionally vague”)

(quoting In re Illuzzi, 160 Vt. 474, 481 (1993)).

The vagueness doctrine is “based on the rationale that persons should not be

chilled in their exercise of constitutional rights because of their fear of criminal

sanctions.” Kimbell, 164 Vt. at 88 (quotation omitted). Thus, generally, the U.S. Supreme

Court has “expressed greater tolerance of enactments with civil rather than criminal

penalties because the consequences of imprecision are qualitatively less severe.” Sessions

v. Dimaya, 138 S. Ct. 1204, 1212—13 (2018) (quotation omitted). Moreover, the court

generally presumes statues to be constitutional. In re LaBerge NOV, 2016 VT 99, 1] 18,

203 Vt. 98. A proponent of a constitutional vagueness challenge “has a very weighty

burden to overcome.” _I_d. (quotation omitted).

18 In prohibiting the acts of screen scraping individuals’ photographs without consent

and allowing users to search those photographs through facial recognition technology as

unfair, the Consumer Protection Act is not unconstitutionally vague. Clearview complains

that “privacy” is the primary basis for the State’s action. However, the Vermont Supreme

Court has at least implicitly recognized a tort for invasion of privacy, based upon

“intrusion upon seclusion” and the applicable standards set forth in the Restatement. See,

e.g., Denton v. Chittenden Bank, 163 Vt. 62, 68-69 (1994) (supervisor’s questions of

employee about his illness and absence from work, although “unusual and possibly rude,”

were not “substantial” or “an intrusion that would be highly offensive to a reasonable

person”); Hodgdon V. Mt. Mansfield Co., 160 Vt. 150, 162 (1992) (“the single letter from

defendant threatening termination, although perhaps insensitive under the

circumstances in this case, was insufficient to constitute an invasion of privacy”) (citing

Restatement (Second) of Torts § 652A).

Moreover, as stated above, a statute need not enumerate every single act that might

constitute a violation. Rather, “[s]tatutory language that conveys a definite warning as to

proscribed conduct when measured by common understanding and practices will satisfy

due process.” In re Palmer, 171 Vt. 464, 472 (2000) (quoting Brody v. Barasch, 155 Vt.

103, 111 (1990)). Clearview suggests that it lacked fair warning without a specific statute

or regulation prohibiting screen scraping and applying facial recognition technology to

those photos. This court rejected a similar argument earlier this year, in a case alleging

price-gouging of personal protective equipment:

The fact that there is not a precise statute or declaration directly discussing PPEs is not relevant. If a separate law or executive order was required to find a particular practice unfair under the Act, the Act would have little meaning. Moreover, the Sperry case expressly rejected the argument,

19 concluding that in determining what is “unfair” the FI‘C may “consider[] public values beyond simply those enshrined in the letter or encompassed in the spirit of” other laws.

State V. Big Brother Security Programs, No. 326~4—20 Cncv, slip copy at 12 (Apr. 27, 2020)

(EX. A to Pl.’s Opp’n to Def.’s Mot. to Dismiss) (quoting F.T.C. V. Sperry & Hutchinson

Q, 405 U.S. 233, 244 (1972)). As the State recognizes, consumer protection statutes have been applied to

numerous specific behaviors that are not specifically enumerated in a particular statute

or regulation. See, e.g., McDonald V. Kiloo ADS, 385 F. Supp. 3d 1022, 1029 (N.D. Cal.

2019) (gaming app collecting user data for geo—targeted advertising). It would make no

sense for the legislature to have to pass a new law as soon as any new technology is

invented and brought to market. Such a requirement would defeat the broad, proscriptive

purpose of the Consumer Protection Act. See Fed. Trade Comm’n v. Raladam Co., 316

U.S. 149, 152 (1942) (“One ofthe objects ofthe Act creating the Federal Trade Commission

was to prevent potential injury by stopping unfair methods of competition in their

incipiency.”). Clearview had fair notice that its alleged conduct implicates privacy

interests and might reasonably be considered “unfair” under the Act. Clearview has not

met its “very weighty burden” to demonstrate that the Act as applied is unconstitutionally

vague.

V. Vermont Consumer Protection Act and Fraudulent Acquisition of Data Law

Clearview contends that the complaint fails to state a claim under the Consumer

Protection Act and the Fraudulent Acquisition of Data law pursuant to V.R.C.P. 12(b)(6).

Both laws prohibit “unfair or deceptive acts or practices in commerce.” 9 V.S.A. § 2453(a);

id. § 2431(b)(1). Essentially, Clearview argues that the conduct alleged in Count I is not

2O “unfair,” that the conduct alleged in Count II is not “deceptive,” and that the conduct

alleged in Count III does not constitute a fraudulent acquisition of brokered personal

information and, consequently, is not an unfair or deceptive act or practice.3

A. Unfairness

There are three factors courts generally consider in deciding whether a practice is

unfair under the Consumer Protection Act:

(1) whether the practice, without necessarily having been previously considered unlawful, offends public policy as it has been established by statutes, the common law, or otherwise whether, in other words, it is within at least the penumbra of some common-law, statutory, or other established concept of unfairness; (2) whether it is immoral, unethical, oppressive or unscrupulous; (3) whether it causes substantial injury to consumers . . . .

Christie V. Dalmig, Inc., 136 Vt. 597, 601 (1979) (quoting F.T.C. v. Sperry & Hutchinson

Cg, 405 U.S. 233, 244 n.5 (1972)). To the extent Clearview argues that all three factors must be satised or that the “substantial injury” factor in particular must be satised in

all cases, this court has already concluded in a previous case that the factors are

independent. See State v. Big Brother Security Programs, No. 326~4-2o Cncv, slip copy at

9—10 (Apr. 27, 2020) (EX. A to Pl.’s Opp’n to Def.’s Mot. to Dismiss). Moreover, numerous

other courts have concluded similarly. See, e.g., Wendorfv. Landers, 755 F. Supp. 2d 972,

979 (N.D. Ill. 2010) (“The Illinois Supreme Court has interpreted Sperry to impose only a

factor-based framework, not a three~part conjunctive test”); Ramirez v. Health Net of Ne.,

inc, 938 A.2d 576, 589 (Conn. 2008) (“All three criteria do not need to be satisfied to

support a nding of unfairness. A practice may be unfair because of the degree to which

3To the extent it is relevant to the motion to dismiss, the court rejects as entirely unpersuasive Clearview’s suggestion that the State’s action is preempted by 23 V.S.A. § 634(c). See Clearview’s Mem. at 67—68.

21 it meets one of the criteria or because to a lesser extent it meets all three”); Morrison V.

To s I“R” Us lino, 806 N.E.2d 388, 392 (Mass. 2004) (same); Rohrer V. Knudson, 203

P.3d 759, 764 (Mont. 2009) (“We hold as a matter of law that an unfair act or practice is

one which offends established public policy and which is either immoral, unethical,

oppressive, unscrupulous or substantially injurious to consumers”).

Here, the State has adequately alleged, at the very least, the rst two factors. It

alleges that Clearview’s acts offend public policy as it relates to the privacy of Vermont

consumers. Compl. 11 77. As to the public policy factor, the FTC specied that

the policies relied upon “should be clear and well— established”—that is, “declared or embodied in formal sources such as statutes, judicial decisions, or the Constitution as interpreted by the courts, rather than being ascertained from the general sense of the national values.” Put another way, an act or practice’s “unfairness” must be grounded in statute, judicial decisions—Le, the common law-or the Constitution.

LabMD, Inc. V. Fed. Trade Comm’n. 894 F.3d 1221, 1229 (11th Cir. 2018) (citation

omitted). Privacy as a public policy is embodied in numerous Vermont and non-Vermont

judicial decisions. As noted above, the Vermont Supreme Court has at least implicitly

recognized a tort for invasion of privacy, based upon “intrusion upon seclusion” and the

applicable standards set forth in the Restatement. See, e.g., Denton v. Chittenden Bank,

163 Vt. 62, 68—69 (1994) (supervisor’s questions of employee about his illness and

absence from work, although “unusual and possibly rude,” were not “substantial” or “an

intrusion that would be highly offensive to a reasonable person”); Hodgdon v. Mt.

Manseld Co., 16o Vt. 15o, 162 (1992) (“the single letter from defendant threatening

termination, although perhaps insensitive under the circumstances in this case, was

insufcient to constitute an invasion of privacy”) (citing Restatement (Second) of Torts

§ 652A). The Court has also recognized that “[t]he government’s interest in preventing

22 any intrusions on individual privacy is substantial.” State V. VanBuren, 2018 VT 95,

11 57, as supplemented (June 7, 2019).4

As the cases cited by the State amply demonstrate, many courts outside ofVermont

have recognized privacy rights in the context of emerging technology. “Technological

advances provide access to a category of information otherwise unknowable, and

implicate privacy concerns in a manner as different from traditional intrusions as a ride

on horseback is different from a ight to the moon.” Patel V. Facebook, Inc., 932 F.3d

1264, 1272~73 (9th Cir. 2019) (collecting recent U.S. Supreme Court cases recognizing

privacy implications of sense-enhancing thermal imaging, GPS monitoring, cell phone

storage of personal information, and tracking of cell—site location information). See also,

e.g., id. at 1273 (“We conclude that the development of a face template using facial-

recognition technology without consent (as alleged here) invades an individual’s private

affairs and concrete interests. Similar conduct is actionable at common law”); Opperman

v. Path Inc., 84 F. Supp. 3d 962, 992—93 (N.D. Cal. 2015) (accessing and misusing phone

and app purchasers’ address and contacts lists without consent); McDonald v. Kiloo ADS,

385 F. Supp. 3d 1022, 1029 (N.D. Cal. 2019) (gaming app covertly collecting user data for

4 Clearview contends that VanBuren undermines the State’s privacy argument. Clearview’s Mem. at 48—«51. VanBuren involved a criminal prosecution for the unconsented disclosure of an intimate image of the complainant under Vermont’s relatively new “revenge porn” statute. The Court afrmed the dismissal of the charge because “the State has not established that it has evidence showing that complainant had a reasonable expectation of privacy in the images she sent to” the intended recipient, necessary to prove an element 0f the crime. VanBuren, 2018 VT 95, 1] 97. Clearview’s argument about VanBuren is unpersuasive. First, VanBuren was a criminal case, deciding whether the State could prove an element of the charged crime (beyond a reasonable doubt). It did not hold that individuals have no privacy interests whatsoever in photos they post on any digital platform. Second, VanBuren involved merely republishing a photo, while Clearview’s alleged conduct (extracting biometric data and adding the photos to a searchable database for easy identification) goes beyond mere republication. Finally, whereas the VanBuren Court noted that the State offered no “evidence of any promise by [intended recipient], 0r even express request by complainant, to keep the photos condential,” or any other basis from which the complainant could “reasonably assume that he would not share the photos she sent with others,” . l 106, many social media sites to which consumers post photos have terms of service policies that expressly prohibit screen scraping. Compl. 1W 38~ 39, 43. Those terms of service provide a reasonable basis for consumers to assume that their photos would not be scraped and used in a facial recognition search engine without their consent.

23 gee—targeted advertising). The invasion of privacy alleged here is “Within at least the

penumbra of some common—law, staturory, er other established concept of unfairness.”

Christie, 136 Vt. at 601; see also LabMD, 894 F.3d 1221, 1229 (“an act or practice’s

‘unfairness’ must be grounded in . . . judicial decisions—~i.e., the common law”).

The State also sufciently alleges that Clearview’s conduct is “immoral, unethical,

oppressive or unscrupulous.” Christie, 136 Vt. at 601; see also Compl. 1] 77. Courts have

described such conduct as that which “imposes a lack of meaningful choice,” Centerline

Equip. Corp. v. Banner Pers. Serv., 1110., 545 F. Supp. 2d 768, 780 (N.D. Ill. 2008), or that

involves a lack of consent. Votto v. Am. Car Rental, Inc., 871 A.2d 981, 985 (Conn. 2005)

(“The defendant’s use of the plaintiffs signature on a blank credit card slip to charge the

plaintiff more than twice the amount of the estimated cost of repair to the vehicle was without question unscrupulous, immoral and oppressive”). Clearview’s alleged collection

of and application of facial recognition technology to Vermonters’ photographs without

their consent plainly falls within this standard. While it remains to be seen whether the

State can prove unfairness at trial, the allegations in the complaint are sufcient to survive

a motion to dismiss.

Even assuming the State also had to allege substantial injury, the complaint would

still sufce to move past the pleading stage. Clearview correctly observes that, in deciding

whether an act or practice is “unfair or deceptive” under the Consumer Protection Act,

“the courts of this State will be guided by the construction of similar terms contained in

Section 5(a)(1) of the Federal Trade Commission Act [9 U.S.C. § 45] as from time to time

amended by the Federal Trade Commission and the courts of the United States.” 9 V.S.A.

§ 2453(b). Notably, however, the provision of the FTC Act on which Clearview relies

provides in part:

24 The Commission shall have no authority under this section . . . ito declare unlawful an act or practice on the grounds that such '

,_

act or practice is unfair unless the act or practice causes or is likely to cause substantial injury to consumers which is not reasonably avoidable by consumers themselves and not outweighed by countervailing benets to consumers or to competition.

15 U.S.C. § 45(n) (emphasis added). Based on a fair reading of the complaint, the State

alleges that Clearview’s conduct is at least “likely to cause substantial injury” by exposing

Vermonters to unwanted surveillance and through Clearview’s marketing of its product

to law enforcement. Clearview’s argument that consumers can reasonably avoid such

injury by not uploading photographs ofthemselves online is spurious at best. It is a matter of common knowledge that a signicant portion of the population has uploaded

photographs or (often unwittingly) appeared in photographs uploaded by others. See

Compl. 11 45. Further, the court cannot conclude from the complaint alone whether such

injury is “outweighed by countervailing benets to consumers.” 15 U.S.C. § 45(n).

B. Deception

Count II alleges several deceptive statements by Clearview. To establish a

“deceptive act or practice” under the Consumer Protection Act requires three elements:

“(1) there must be a representation, omission, or practice likely to mislead consumers; (2)

the consumer must be interpreting the message reasonably under the circumstances; and

(3) the misleading effects must be material, that is, likely to affect the consumer’s conduct or decision regarding the product.” Carter v. Gugliuzzi, 168 Vt. 48, 56 (1998).

“Deception is measured by an objective standard, looking to whether the representation

or omission had the capacity or tendency to deceive a reasonable consumer; actual injury need not be shown.” I_d_. at 56 (quotation omitted).

25 Clearview first argues that Vermonters are not “consumers” since they did not

purchase the app, and that only law enforcement, nancial institutions, and security

companies are purchasers and, thus, consumers in this context. Because the users of the

app are not the people allegedly harmed—the Vermont public whose photos are used—-

Clearview contends that the Act is inapplicable. Therefore, Clearview asserts, the

deception claim fails. The court rejects this argument. First, the Act includes a specific

definition of “consumer” that is limited to purchasers, 9 V.S.A. § 2451a(a), but that applies

to private actions brought by individuals under § 2461(b); it does not somehow limit the

State’s enforcement rights under § 2458. No Vermont cases say that, to be actionable,

deceptive statements must have caused direct harm to an actual or would~be purchaser

of the product or service in question.

Second, the FTC has brought actions against companies whose deceptive conduct

allegedly misled non—purchasers of those companies’ products or services, indicating that

the FTC does not interpret the FTC Act to include such a “purchaser” requirement. See,

e.g., In re Epic Marketplace, No. C—4389 (F.T.C. Mar. 13, 2013), available at

httDs: //www.ftc.gov/enforcement/cases—proceedings/112—2182/epic—marketplace—inc

(online advertising company used “history sniffing” to secretly and illegally gather data

from millions of consumers’ web-browsing histories); FTC v. Eguifax, No. 1:19—cv-03297-

TWT (N.D. Ga. July 23, 2019), available at: https://www.ftc.gov/enforcement/cases—

proceedingsZ122-3203[eguifax-inc (credit reporting agency failed to secure personal

information of millions of consumers stored on its network, leading to security breach

that exposed information to identify theft and fraud).

Moreover, the Consumer Protection Act is to be construed “liberally. . . in light of

its remedial purposes.” Anderson v. Johnson, 2011 VT 17, 1] 7, 189 Vt. 603. It is “designed

26 not merely to compensate consumers for actual monetary losses resulting from

fraudulent or deceptive practices in the marketplace, but more broadly to protect citizens

from unfair or deceptive acts in commerce, and to encourage a commercial environment

highlighted by integrity and fairness.” E. (citation and quotations omitted). Under

Clearview’s logic, the State could never enforce the Act against patently false advertising

so long as no person had yet been duped into buying the advertised product or service.

Such a result is untenable, especially since “actual injury need not be shown.” C_arte_r, 168

Vt. at 56.

Next, Clearview contends that the State has not adequately pled that each of the

alleged statements in Count II were deceptive and material, and that some of those

statements are mere opinion or commercial puffery rather than objective fact. The

complaint lists seven allegedly deceptive statements.

1. Opt~Out Rights

In the privacy policy on its website, Clearview makes the following statement

concerning consumers’ privacy rights: “Users and members of the public are entitled to

. . . The right to erasure — You have the right to request that we erase your personal data

under certain conditions.” Compl. 1] 56. The policy goes on to clarify that this right is

“subject to limitations that vary by jurisdiction. We will honor such requests . . . as

required under applicable data protection rules but these rights are not absolute: they do

not always apply and exemptions may be engaged.” _I_d. The State alleges that the data

protection rights listed are actually from the European Union’s General Data Protection

Regulation, which is not applicable to U.S. citizens, and that the only state law that comes

close to this is California’s consumer privacy act. 1d. ‘ 58. Clearview argues that this

statement is technically accurate, but the State alleges that this policy “creates a

27 reasonable belief in any Vermont consumer who is not a privacy law scholar that they can

take some action to protect their privacy” concerning data stored by Clearview. m. 1] 58.

The Vermont Supreme Court has “distinguished statements of fact from

statements of opinion in the consumer—fraud context, holding that misrepresentations of

the former may constitute fraud while misrepresentations of the latter cannot.” Heath v.

Elmer, 2006 VT 125, 1i 14, 181 Vt. 545. Representations about the status of the law are generally considered nonactionable, but the Court has recognized that “[a]n important

distinction must be made between representations of legal opinions and representations

offact relating t0 the law as it exists.” Winton V. Johnson & Dix Fuel Com, 147 Vt. 236,

240 (1986) (emphasis in original). Legal opinions “involve[] the legal meaning and effect

of a statute, court ruling, document, instrument or other source of law,” while factual

representations about the law “involve[] statements that imply the existence of accurate

and readily ascertainable facts that either concern the law or have legal signicance, but

which are not part of the law themselves.” E. at 240. Such legal facts “may imply the

existence or non—existence of an applicable statute, regulation, or judicial decision, and

this is one kind of external fact which may seem very important to the person addressed

by the statement.” 1d. at 241 (statements in hot water heater advertisement that

emphasized availability of state energy tax credit were “fashioned as facts, rather than

opinions about the application of the law” and therefore actionable under Consumer

Fraud Act); see also Webb v. Leclair, 2007 VT 65, 1i 22, 182 Vt. 559.

The alleged statement involves an “objectively verifiable statement of fact,” that is,

whether consumers have a right to have their data erased, rather than a subjective

“opinion.” He_ath, 2006 VT 125, 1i 14. To the extent it involves a component of legal status,

it is a representation of fact regarding the law as it exists, rather than a legal opinion.

28 Winton, 147 Vt. at 240. While the policy’s statements might not be literally false and might

not be so clear as the statement in Winton, Clearview could have presented the policy in

a less misleading manner, for example, by making it clear that these opt—out “rights” in

fact do not apply to most U.S. citizens. The complaint sufficiently alleges that these statements could mislead a reasonable consumer regarding their ability to opt out of

Clearview’s product.

2. Affect on Consumers’ Interests or Fundamental Rights and Freedoms

Clearview’s privacy policy also states: “We are not allowed to process personal data

if we do not have a valid legal ground. Therefore, we will only process personal data if . . .

the processing is necessary for the legitimate interests of Clearview, and does not unduly

affect your interests or fundamental rights and freedoms.” Compl. 1] 59. The State alleges

that this statement is false because “Clearview’s processing does very much unduly affect

consumers’ interests and fundamental rights and freedoms.” _I_d_. 1i 6o. Essentially, this

statement amounts to a legal conclusion or opinion about whether Clearview’s alleged

unfair acts as stated in Count I implicate consumers’ privacy rights. It goes far beyond a

mere assertion that a particular statute does or does not exist or apply. See Winton, 147

Vt. at 240-41. Moreover, as it would require a resolution on the merits of Count I, it was

not objectively veriable at the time the statement was made. Consequently, this

statement does not constitute a deceptive act under the Consumer Protection Act. See

generally Heath, 2006 VT 125, 11 14.

29 3. Strength 0f Data Securitv

Clearview’s privacy policy also includes a paragraph with assertions about the

strength of the data security technology it uses to protect personal information. Compl.

'H 61. While parts of this paragraph undoubtedly constitute vague commercial puffery,

other parts plainly consist of facts capable of objective analysis, likely by computer

security experts. This statement could lead a reasonable consumer to believe that

Clearview’s stored personal data is completely secure. 1d. 11 62. The complaint sufficiently

alleges a deceptive statement regarding the strength of Clearview’s data security. Compl.

1H] 63—68.

4. Use bv Law Enforcement and Public Availabilitv

In its “User Code of Conduct,” Clearview states that users may use its app for only

“legitimate law enforcement and security purposes,” and not for “personal purposes.”

Compl. 1i 69. Clearview also states on its website that its app is not available to the public.

Li. 1i 30. However, the State alleges that this is not true because Clearview has provided access to its app to numerous for—profit corporations, universities, investors, reporters,

and governments in dozens of countries, and has not limited its use to authorized users

even in the law enforcement context. 1d. W 31—32. Furthermore, in private marketing

statements, Clearview has allegedly told users to use the app on friends and family and to

“feel free to run wild with your searches.” I_d. 1W 33, 7o. The complaint fairly alleges that

Clearview’s statements about law enforcement use and the public availability of its app

are deceptive.

5. Removal of Consumer Data from Database

Clearview has allegedly claimed or implied that it removes consumer data from its

database to comply with existing law. Compl. 1m 50, 56, 81(e). However, the State alleges

30 that Clearview does not yet have the capability to remove individuals by geographic region

or age. Ld. ‘H 51. This plainly states a claim for a deceptive act.

6. Accuracy of Matching Technology

According to the State’s allegations, Clearview has claimed (1) an accuracy rate of

98.6% to 99.6% for its photograph matching technology without providing any evidence

or a standard benchmark, and (2) an accuracy rate of 100% according to the ACLU’S

methodology which it then retracted after the ACLU complained that Clearview had not

properly applied its technology and called Clearview’s claim “absurd.” Compl. {HI 71—72.

Clearview also has allegedly not provided its matching algorithm for testing to the only

entity that provides public testing of facial recognition technology. 1d,. ll 73. These

allegations state a claim for deceptive statements regarding the accuracy of Clearview’s

matching technology. Clearview provides an affidavit asserting that it has tested its

technology’s accuracy using the Megaface benchmark test. Clearview’s Mem. at 66 n.231.

That may be so, but the court cannot consider an affidavit on a motion to dismiss.

'7. Success in Assisting Law Enforcement Investigations

According to the complaint, Clearview claimed to have assisted the NYPD in

solving several cases, but the NYPD denied that Clearview was used in any of those cases.

Compl. ‘H‘H 74—75. This also is sufficient to survive a motion to dismiss.

Moreover, all of the alleged statements described above are material in that they

are “likely to affect [a] consumer’s conduct or decision regarding the product,” Ca_rter, 168

Vt. at 56, at least for purposes of the motion to dismiss. The State does not allege a de

minimus misrepresentation such as, for example, if Clearview claimed to have a 95.3%

accuracy rate when the actual rate was 95.2%. Such an insignificant deception would not

reasonably affect a consumer’s conduct regarding the product. The alleged deceptions

31 here, however, are significant, and are reasonably likely to affect the conduct of either law

enforcement or the general public with respect to Clearview’s app.

C. Vermont’s Fraudulent Acquisition of Data Law

Vermont’s Fraudulent Acquisition of Data law prohibits the acquisition of

“brokered personal information through fraudulent means.” 9 V.S.A. § 2431(a)(1). A

Violation of this law constitutes “an unfair and deceptive act in commerce in Violation of

[9 V.S.A. §] 2453.” I_d. § 2431(b)(1). “Brokered personal information” means

“computerized data elements about a consumer, if categorized or organized for

dissemination to third parties,” including “unique biometric data generated from

measurements or technical analysis of human body characteristics used by the owner or

licensee of the data to identify or authenticate the consumer, such as a fingerprint, retina

or iris image, or other unique physical representation or digital representation of

biometric data.” I_d. § 2430(1)(A)(vi).5 For purposes of this statute, “consumer” means “an

individual residing in this State.” I_d. § 2430(3).

Clearview asserts that this law does not apply because the data it acquires is “not

brokered” and “not acquired by fraud.” Clearview’s Mem. at 68. The data it acquires

plainly falls within the statutory definition of “brokered personal information.” 9 V.S.A.

§ 2430(1)(A)(vi). However, the complaint does not adequately allege that the data was

acquired by fraudulent means. The court disagrees with the State’s contention that, in this

context, “fraud” refers to consumer fraud, i.e., an unfair or deceptive act or practice in

commerce. While the statute does not explicitly define “fraud,” and the legislature’s

5The definition also includes “other information that, alone or in combination with the other information sold or licensed, would allow a reasonable person to identify the consumer with reasonable certainty.” 9 V.S.A. § 2430(a)(ix).

32 statement of findings and intent unsurprisingly provides little assistance in that regard,

see 2017, N0. 171, § 1, the court concludes that “fraud” here means fraud in the traditional

or common law sense, rather than in the “consumer fraud” sense. The statute would

simply make no sense otherwise. That a fraudulent acquisition of brokered personal

information constitutes “an unfair and deceptive act in commerce in violation of” the

Consumer Protection Act does not also mean that any variation of “consumer fraud”

necessarily constitutes acquisition of “brokered personal information through fraudulent

means.” lg. § 2431(a)(1).6 That is circular reasoning that would render the Fraudulent

Acquisition of Data law meaningless. Under that logic, the law would proscribe virtually

no conduct beyond that also proscribed by the Consumer Protection Act.7

Fraud traditionally requires some form of misrepresentation. Ianelli V. U.S. Bank,

2010 VT 34, 1i 14 n.*, 187 Vt. 644 (mem.). The complaint, however, alleges no such

misrepresentation with respect to Clearview’s acquisition of the data. The State argues in

its memorandum that Clearview’s “indiscriminate screen—scraping . . . involved using

spiders that misrepresented their purpose in accessing websites,” State’s Opp’n at 71, yet

alleges nowhere in the complaint that Clearview’s “spiders” actually misrepresented their

purpose. It argues that Clearview violated the terms of service of the websites it scraped,

yet the complaint is devoid of any allegation that Clearview actually misrepresented its

6 Notably, several years before the Fraudulent Acquisition of Data law was added in 2018, the legislature changed the title of the “Consumer Fraud Act” to “Consumer Protection Act” in 2012. See 2011, No. 109, § 3 (“Redesignation of term ‘consumer fraud’ to read ‘consumer protection”) ; McKinstry v. Fecteau Residential Homes Inc., 2015 VT 125, 1] 4 n.1, 200 Vt. 392. This makes it even less likely that the legislature’s intent behind using the term “fraud” in section 2431(a)(1) was to refer to “consumer fraud” rather than common law fraud.

7The Attorney General’s own guidance about this law suggests that acquisition by “fraudulent means” refers to common law fraud. See Vermont Ofce of the Attorney General, Guidance on Vermont’s Act 171 of 2018 Data Broker Regulation at 11 (Dec. 11, 2018) (“The concepts of fraud, stalking and harassing, identity theft, and unlawful discrimination are addressed in the common law and other statutes”) (available at: httpszz [perma.cc[BK6G—YBHH).

33 purpose in accessing the websites rather than merely contravening the terms of service.

The State also argues that Clearview collected personal photos without consumers’

knowledge or consent “in order to turn those photographs against their owners through

the use of facial recognition.” Ld. Again, no allegation of misrepresentation in the

complaint supports this argument. Clearview’s actions in acquiring the photos is akin to

someone walking into a store and surreptitiously stealing an item. In that example, the

person’s action might be larceny and it might Violate the store’s posted rules, but it is not

fraud because it does not involve a misrepresentation. Moreover, the post—acquisition use

of those photographs is immaterial to Count III, which asserts that Clearview acquired

brokered personal information by fraudulent means under 9 V.S.A. § 2431(a)(1), not that

it “acquire[d] or use[d] brokered personal information for the purpose of” stalking,

harassment, committing a fraud, or engaging in unlawful discrimination under

§ 2431(a)(2).

The court could imagine how the deceptive statements alleged in Count II might

support the alleged fraudulent acquisition of data in Count III by inducing someone to

continue posting photographs on social media, or to refrain from deleting their

photographs from social media. However, that would depend on the deceptive statements

being presented before the screen scraping began, so that consumers would have time to

act on those statements. There is no such information in the complaint concerning the

dates the deceptive statements were made and when the screen scraping began, nor does

the State allege that a Clearview misrepresentation induced anyone to make their

photographs available for Clearview’s acquisition. It appears that this is the first time the Fraudulent Acquisition of Data Law—which

went into effect in 2019 and is apparently the first of its kind in the country—has been

34 discussed or construed in a court decision. See generally Note, The Federalist Regulation

of Privacv: The HaDDV Incidents of State Regulatorv Activitv and Costs of Preemptive

Federal Action, 84 Mo. L. Rev. 1055, 1073—75 and nn.130, 138—-43 (2019). As this court

has recognized many times, “[a] motion to dismiss. . . is not favored and [is] rarely

granted[,] . . . especially . . . when the asserted theory of liability is novel or extreme,” as

such cases “should be explored in the light of facts as developed by the evidence, and,

generally, not dismissed before trial because of the mere novelty of the allegations.” Alger

v. Dep’t of Labor & Indus, 2oo6 VT 115, 'H 12, 181 Vt. 309 (citation and quotations

omitted). “Nonetheless, where the plaintiff does not allege a legally cognizable claim,

dismissal is appropriate.” Montague V. Hundred Acre Homestead. LLC, 2019 VT 16, ‘II 11,

209 Vt. 514. Because the State has not sufciently alleged that the data was acquired by

“fraudulent means,” dismissal of Count III is appropriate.

Vlmrig Finally, Clearview contends that the State lacks standing to bring this action.

Typically, the standing doctrine requires that a plaintiff “must have suffered a particular

injury that is attributable to the defendant and that can be redressed by a court of law.”

Paige V. State, 2018 VT 136, 1i 8, 209 Vt. 379 (quotation omitted). However, the standing

analysis is different when the plaintiff is a sovereign state rather than a private individual.

Massachusetts V. E.P.A., 549 U.S. 497, 518 (2007). The U.S. Supreme Court has

recognized that where the state has a procedural right to bring that action and a “stake in

protecting its quasi-sovereign interests, the [state] is entitled to special solicitude in our

standing analysis.” E. at 520—21 & n.17 (Massachusetts has quasi—sovereign standing to

challenge EPA’s refusal to regulate greenhouse gas emissions).

35 The State asserts that it has such standing under the “parens patriae” doctrine.

“[T]0 have such standing the State must assert an injury to . . . a ‘quasi—sovereign’

interest,” an admittedly vague judicial construct with no “simple or exact definition. Its

nature is perhaps best understood by comparing it to other kinds of interests that a State

may pursue and then by examining those interests that have historically been found to

fall within this category.” Alfred L. Snapo & Son. Inc. V. Puerto Rico, ex rel., Barez, 458

U.S. 592, 601 (1982). Quasi—sovereign interests generally “consist of a set of interests that

the State has in the well-being of its populace.” I_d. at 602. The Court has summarized the

doctrine as follows:

In order to maintain such an action, the State must articulate an interest apart from the interests of particular private parties, i.e., the State must be more than a nominal party. The State must express a quasi—sovereign interest. Although the articulation of such interests is a matter for case—by-case development—neither an exhaustive formal definition nor a definitive list of qualifying interests can be presented in the abstract—certain characteristics of such interests are so far evident. These characteristics fall into two general categories. First, a State has a quasi—sovereign interest in the health and well—being—both physical and economicwof its residents in general. Second, a State has a quasi—sovereign interest in not being discriminatorily denied its rightful status within the federal system.

m. at 607. Additionally, the State must “allege[] injury to a sufciently substantial

segment of its population.” Id.

The State has a clear procedural right to bring this action. The Consumer

Protection Act prohibits “unfair or deceptive acts or practices in commerce.” 9 V.S.A.

§ 2453(a). “Whenever the Attorney General . . . has reason to believe that any person is

using or is about to use any method, act, or practice declared by section 2453 . . . to be

unlawful, . . . and that proceedings would be in the public interest,” he may “bring an

36 action in the name of the State against such person to restrain by temporary or permanent

injunction the use of such method, act, or practice . . . .” 9 V.S.A. § 2458(a).

The State also has quasi-sovereign interests in protecting a fair and honest

marketplace from deceptive advertising statements, and in avoiding societal harm from

mass surveillance. Mass surveillance could reasonably chill citizens’ freedoms of assembly

and political expression. See Compl. ‘H 78. These interests go beyond those of any

individual party, and courts have recognized these interests as sufficient to confer

standing. See People ex rel. Cuomo V. Liberty Mut. Ins. Co., 861 N.Y.S.2d 294, 296 (N.Y.

App. Div. 2008) (“the Attorney General sued to redress injury to its quasi—sovereign

interest in securing an honest marketplace for all consumers”) (qUOtation omitted);

ex rel. Hatch v. Cross Country Bank. Inc., 703 N.W.2d 562, 569 (Minn. Ct. App. 2005)

(“The state . . . is pursuing its claim[] not with the purpose of obtaining relief for particular

victims, but to vindicate a ‘quasi-sovereign’ interest: protecting the privacy of its

citizens”); State ofN. Y. byAbrams v. Gen. Motors Corp, 547 F. Supp. 703, 705 (S.D.N.Y.

1982) (“The State’s goal of securing an honest marketplace in which to transact business

is a quasi—sovereign interest”); Kelley V. Carr, 442 F. Supp. 346, 356-57 (W.D. Mich.

1977), aff’d in part, rev’d in Dart, 691 F.2d 800 (6th Cir. 1980) (“Surely some of the most

basic of a state’s quasi-sovereign interests include . . . protection of its citizens from

fraudulent and deceptive practices [and] support for the general welfare of its residents

and its economy ”)

Moreover, the State estimates that millions of photographs of Vermonters may be

part of Clearview’s database, State’s Opp’n at 75, a reasonable implication from the

complaint. See Compl. 1H] 24—25, 44, 47—49. This surely constitutes a substantial segment

of Vermont’s population. “This is not a case in which the state is gratuitously attempting

37 to prosecute purely personal claims of its citizens, but rather is one in which the state is

seeking to protect the public interest.” Eloy, 442 F. Supp. at 357. Given the lower bar for

standing at the pleading stage, the complaint adequately alleges sufcient facts to confer

standing on the State as parens patriae in this action. See Connecticut V. Am. Elec. Power

Q, 582 F.3d 309, 333 (2d Cir. 2009), rev’d on other grounds. 564 U.S. 410 (2011); see also 13B Wright & Miller, Fed. Prac. & Proc. Juris. § 3531.11.1 (3d ed.) (“There can be no

doubt whatever that in its own courts and under its own law, a state has standing to

enforce broad concepts of the public interest against individual defendants, whether

through criminal or civil proceedings”).

Qrder

Clearview’s motion to dismiss is granted as to one of the deceptive statements

alleged in Count Iwspecifically paragraph 81(b) of the complaint—and as to Count III.

The motion is denied in all other respects. The parties shall proceed with scheduling

according to the court’s May 6, 2020 order.

Dated at Burlington this 4th day of September, 2020.

Helen M. Toor Superior Court Judge