Tibbs v. Arlo Technologies, Inc.

• Court: District Court, N.D. California
• Decided: June 27, 2024
• Docket: 5:23-cv-05096
• Status: Unknown

Opinion

1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 SAN JOSE DIVISION 7 8 CASEY TIBBS, ANDREW CASTILLO, Case No. 23-cv-05096-EJD and ERIC WILIM, on behalf of themselves 9 and all others similarly situated, ORDER DENYING DEFENDANT’S MOTION TO DISMISS AND MOTION 10 Plaintiffs, TO STRIKE

v. 11 Re: ECF Nos. 29, 45 12 ARLO TECHNOLOGIES, INC., Defendant. 13

14 Plaintiffs Casey Tibbs, Andrew Castillo, and Eric Wilim (together, “Plaintiffs”) bring this 15 putative class action against Defendant Arlo Technologies, Inc. (“Defendant” or “Arlo”) for 16 alleged violations of Illinois’s Biometric Information Privacy Act (“BIPA”), 740 Ill. Comp. Stat. 17 (“ILCS”) 14/1, et seq. (2008). See First Am. Class Action Compl. (“FAC”), ECF No. 28. Now 18 pending before the Court is (1) Defendant’s motion to dismiss the FAC (the “Motion to Dismiss”), 19 see Mot., ECF No. 29, and (2) Plaintiffs’ motion to strike Defendant’s notice of supplemental 20 authority (the “Motion to Strike”), see Strike Mot., ECF No. 45. The Court finds the matter 21 suitable for decision without oral argument pursuant to Civil Local Rule 7-1(b), and, for the 22 reasons below, DENIES Defendant’s Motion to Dismiss and Motion to Strike. 23 24 I. BACKGROUND 25 A. Factual Allegations 26 1. Parties Plaintiffs Tibbs, Castillo, and Wilim are Illinois residents. FAC ¶¶ 14–16. Plaintiffs work 27 1 as delivery drivers who make deliveries to customers’ homes in Illinois; Tibbs and Casey are 2 DoorDash drivers and Wilim is a UPS driver. Id. 3 Arlo is a Delaware corporation with a principal place of business in Milpitas, California. 4 Id. ¶ 17. Arlo is a home security company that offers security cameras supported by high quality 5 video and artificial intelligence (“AI”) monitoring. Id. 6 2. Arlo’s Home Security System 7 Plaintiffs allege that every time an Illinois delivery driver makes a food, mail, or package 8 delivery to a home that is equipped with Arlo’s home security system, Arlo’s security cameras 9 capture geometric scans of the driver’s face, body, and hands in both the infrared and visible light 10 spectra. FAC ¶ 2. The cameras can collect videos in the visible light spectrum in various high 11 resolutions, including 1080p, 2K, HD, and 4K; some have color night vision as well. Id. ¶ 26. 12 Further, most Arlo devices detect motion using passive infrared (“PIR”) technology, which detects 13 objects that are warmer than the surrounding environment. Id. Arlo’s infrared facial recognition 14 technology is even capable of distinguishing between individuals wearing glasses, whereas many 15 other types of facial recognition technology struggle to identify individuals wearing sunglasses or 16 balaclavas. Id. ¶ 4. The combination and analysis of the scans in two spectra—infrared radiation 17 and visible light—allows Arlo to identify particular individuals. See id. ¶ 27. 18 Arlo’s home security systems do not include the full capabilities of its recognition 19 software, and it does not provide homeowners with software that can process the camera scans to 20 recognize unique individuals. FAC ¶ 6. However, Arlo does sell a “Person Detection” feature as 21 part of its home security offerings. See id. ¶ 5. The Person Detection feature uses artificial 22 intelligence (“AI”) technology and uses advanced algorithms to analyze the infrared and visible 23 light scans collected by Arlo’s cameras to: (1) distinguish between humans and animals; (2) filter 24 out everyday movement (such as tree branches) and provide real-time alerts to the homeowner 25 when a person is detected approaching the home; and (3) allow the homeowner to search the 26 camera video feeds for videos containing people. See id. ¶¶ 5, 24. 27 In addition to the Person Detection feature, Arlo sells homeowners the following features: 1 (1) Package Detection, which allows homeowners to “receive [] notifications when [their] Arlo 2 camera sees a package being picked up or dripped off”; (2) Vehicle Detection, which “detects 3 cars, trucks, buses, motorbikes, and bicycles, and allows [homeowners] to receive notifications 4 when [their] Arlo camera detects a vehicle”; and (3) Animal Detection, which alerts homeowners 5 when the “Arlo camera detects an animal . . . any larger than a small rodent.” FAC ¶ 25 (citations 6 omitted). Homeowners may activate or deactivate these features by toggling a motion alert setting 7 for each category in the Arlo app. Id. 8 Plaintiffs allege that the scans that Arlo can use to identify unique individuals are 9 biometric identifiers, and Arlo’s AI needs to collect, use, and store such biometric identifiers to 10 accomplish its various person detection tasks. See id. ¶¶ 2, 5, 26. In particular, Plaintiffs allege 11 that the Person Detection feature necessarily requires the collection of people’s facial, body, and 12 hand geometry in both the infrared and visible light spectra to reliably distinguish people from 13 animals. See id. ¶ 5, 26. 14 Arlo did not inform Plaintiffs that it was collecting biometric identifiers, or of the purpose 15 and length of time for which their biometric identifiers would be collected, stored, and used. See 16 FAC ¶ 43. Further, Arlo did not publish public access policies identifying its retention schedules 17 or guidelines for permanently destroying any of these biometric identifiers. Id. ¶ 44. 18 3. Arlo’s Presence in Market 19 Arlo is one of the largest players in the home security market in the United States. FAC ¶ 20 21. According to its most recent investor report, Arlo generated $490 million in revenue in 2022 21 and had a particularly strong 53% year-over-year growth in the last quarter of 2022. Id. 22 4. Class Allegations 23 Plaintiffs allege a putative class defined as: “All natural persons in Illinois who are 24 delivery drivers and who, when making deliveries, had their biometric identifiers collected, stored, 25 and scanned by Arlo cameras and software from October 4, 2018, to present.” Id. ¶ 45. 26 B. Procedural History 27 Plaintiffs initiated this action on October 4, 2023. See Compl., ECF No. 1. Arlo filed a 1 motion to dismiss, see ECF No. 13, and Plaintiffs responded by filing the operative FAC. The 2 FAC asserts two claims: (1) violation of 740 ILCS 14/15(b) and (2) violation of 740 ILCS 3 14/15(a). See FAC ¶¶ 52–75. 4 Arlo filed the instant Motion to Dismiss on January 26, 2024, pursuant to Federal Rules of 5 Civil Procedure 12(b)(1) and 12(b)(6). See Mot. The Motion to Dismiss was fully briefed on 6 February 14, 2024. See Opp’n, ECF No. 32; Reply, No. 33. The hearing was set for March 28, 7 2024, and Court took the Motion to Dismiss under submission without oral argument on March 8 22, 2024. See ECF No. 43. 9 On April 30, 2024, Plaintiffs filed a Notice of Supplemental Authority. See ECF No. 44. 10 On May 3, 2024, Arlo filed the instant Motion to Strike. See Strike Mot. Plaintiffs filed an 11 opposition to the Motion to Strike on May 6, 2024. See Strike Opp’n, ECF No. 47. Additionally, 12 Arlo filed a Statement of Recent Decision on May 3, 2024, see ECF No. 46, and Plaintiffs filed a 13 Notice of Supplemental Authority on June 17, 2024, see ECF No. 48. 14 II. LEGAL STANDARDS 15 A. Motion to Dismiss FAC 16 1. Federal Rule of Civil Procedure 12(b)(1) 17 Federal Rule of Civil Procedure 12(b)(1) permits a defendant to challenge the existence of 18 the Court’s subject matter jurisdiction over the action. See Fed. R. Civ. P. 12(b)(1). “Federal 19 courts are courts of limited jurisdiction . . . possess[ing] only that power authorized by 20 Constitution and statute.” Kokkonen v. Guardian Life Ins. Co. of Am., 511 U.S. 375, 377 (1994). 21 Article III of the United States Constitution “limits the jurisdiction of federal courts to ‘Cases’ and 22 ‘Controversies.’” Lujan v. Defenders of Wildlife, 504 U.S. 555, 559 (1992). The party invoking 23 federal jurisdiction bears the burden of establishing that the plaintiff has standing to bring the suit, 24 i.e., that the action is a case or controversy “of the justiciable sort referred to in Article III.” Id. at 25 560–61. “[T]he irreducible constitutional minimum of standing contains three elements.” Id. at 26 560. “The plaintiff must have (1) suffered an injury in fact, (2) that is fairly traceable to the 27 challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial 1 decision.” Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016) (citations omitted). “[A]t the 2 pleading stage, the plaintiff must ‘clearly . . . allege facts demonstrating’ each element.” Id. 3 (quoting Warth v. Seldin, 442 U.S. 490, 518 (1975)). 4 2. Federal Rule of Civil Procedure 12(b)(6) 5 Under Federal Rule of Civil Procedure 12(b)(6), a court must dismiss a complaint if it fails 6 to state a claim upon which relief can be granted. To survive a Rule 12(b)(6) motion, a plaintiff 7 must allege “enough facts to state a claim to relief that is plausible on its face.” Bell Atl. Corp. v. 8 Twombly, 550 U.S. 544, 570 (2007). A claim is facially plausible when the plaintiff pleads facts 9 permitting the court to “draw the reasonable inference that the defendant is liable for the 10 misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (citation omitted). The 11 allegations must show “more than a sheer possibility that a defendant has acted unlawfully.” Id. 12 Mere “conclusory allegations of law and unwarranted inferences are insufficient to defeat a 13 motion to dismiss.” Adams v. Johnson, 355 F.3d 1179, 1183 (9th Cir. 2004). 14 When determining whether a claim has been stated, a district court's review is limited to 15 the face of the complaint and judicially noticeable information. MGIC Indem. Corp. v. Weisman, 16 803 F.2d 500, 504 (9th Cir. 1986); N. Star Int'l v. Ariz. Corp. Comm’n, 720 F.2d 578, 581 (9th 17 Cir. 1983). The court must accept as true all well-pleaded factual allegations and construe them in 18 the light most favorable to the plaintiff. Reese v. BP Expl. (Alaska) Inc., 643 F.3d 681, 690 (9th 19 Cir. 2011). The Court need not, however, “assume the truth of legal conclusions merely because 20 they are cast in the form of factual allegations.” Fayer v. Vaughn, 649 F.3d 1061, 1064 (9th Cir. 21 2011) (per curiam). 22 B. Motion to Strike Notice of Supplemental Authority 23 A district court may in its discretion strike a filing for failure to comply with the local 24 rules. See Christian v. Mattel, Inc., 286 F.3d 1118, 1129 (9th Cir. 2002) (“The district court has 25 considerable latitude in managing the parties' motion practice and enforcing local rules that place 26 parameters on briefing.”); see also, e.g., Hudson v. Wells Fargo & Co., No. 21-cv-08296, 2022 27 WL 2716526, at *4 (N.D. Cal. July 13, 2022) (“While Plaintiff clearly exceeded the page limit in 1 violation of the local rules, the Court in its discretion DENIES Defendants’ motion to strike.”). 2 Civil Local Rule 7-3 provides that “Once a reply is filed, no additional memoranda, papers 3 or letters may be filed without prior Court approval,” except that “[b]efore the noticed hearing 4 date, counsel may bring to the Court’s attention a relevant judicial opinion published after the date 5 the opposition or reply was filed by filing and serving a Statement of Recent Decision.” Civil 6 L.R. 7-3(d)(2). “Such Statement shall contain a citation to and provide a copy of the new opinion 7 without argument.” Id. 8 III. DISCUSSION 9 Because Defendant’s Motion to Strike concerns a Notice of Supplemental Authority 10 Plaintiffs filed in support of their opposition to Defendant’s Motion to Dismiss, the Court 11 addresses the Motion to Strike first. 12 A. Motion to Strike 13 Defendant moves the Court to strike Plaintiffs’ Notice of Supplemental Authority, see ECF 14 No. 44, filed on April 30, 2024. See Strike Mot. 1. Defendant argues that the filing violates Civil 15 Local Rule 7-3(d) because it includes about 1.5 pages of argument regarding the supplemental 16 authority at issue, and requests that the Court either (1) “deny Plaintiffs’ request that the 17 improperly submitted supplemental authority be considered in ruling on Arlo’s pending Motion to 18 Dismiss” or (2) grant Defendant leave to file a proposed 1.5-page response to the argument set 19 forth in Plaintiffs’ filing. See id. Plaintiffs counter that (1) the Notice does not contain argument, 20 but instead directly quotes the new authority, and (2) even if the Court considers the filing to 21 contain argument, the sum total of Plaintiffs’ opposition papers to the Motion to Dismiss would be 22 18 pages and thus well below the 25-page limit for opposition briefs. See Strike Opp’n 1. 23 The Court finds that Plaintiffs’ April 30, 2024 Notice of Supplemental Authority violates 24 this district’s local rules, which require a party to provide no more than a citation and copy of the 25 decision at issue. See Civil L.R. 7-3(d)(2). However, the Court has not reviewed and will not 26 review the text of Plaintiff’s filing. The Court will in its discretion consider Plaintiffs to have filed 27 a compliant statement of recent decision, and will consider only the copy of the decision attached 1 to Plaintiff’s Notice. The Court therefore DENIES Defendant’s request that the Court refuse to 2 consider the supplemental authority.1 Further, because the Court is not considering Plaintiff’s 3 additional text, it also DENIES Defendant’s request for leave to file a proposed response. 4 B. Motion to Dismiss 5 Plaintiffs assert BIPA claims for violations of 740 ILCS 14/15(b) (“Claim 1” or “Section 6 15(b)”) and 740 ILCS 14/15(a) (“Claim 2” or “Section 15(a)”). See FAC ¶¶ 52–75. Sections 7 15(a) and (b) of BIPA provide:

8 (a) A private entity in possession of biometric identifiers or biometric information must develop a written policy, made available to the 9 public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric 10 information when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within 3 years 11 of the individual's last interaction with the private entity, whichever occurs first. Absent a valid warrant or subpoena issued 12 by a court of competent jurisdiction, a private entity in possession of biometric identifiers or biometric information must comply 13 with its established retention schedule and destruction guidelines.

14 (b) No private entity may collect, capture, purchase, receive through trade, or otherwise obtain a person's or a customer's biometric 15 identifier or biometric information, unless it first:

16 (1) informs the subject or the subject's legally authorized representative in writing that a biometric identifier or 17 biometric information is being collected or stored;

18 (2) informs the subject or the subject's legally authorized representative in writing of the specific purpose and length of 19 term for which a biometric identifier or biometric information is being collected, stored, and used; and 20 (3) receives a written release executed by the subject of the 21 biometric identifier or biometric information or the subject's legally authorized representative. 22 23 740 ILCS 14/15(a). 24 Arlo moves to dismiss both counts of the FAC on the grounds that (1) Plaintiffs lack 25 Article III standing for Claim 2 and therefore cannot invoke federal jurisdiction over the claim, 26

27 1 The Court notes that both Defendant and Plaintiffs subsequently filed further statements of recent decisions. See ECF Nos. 46, 48. 1 and (2) Plaintiffs fail to allege facts sufficient to plead either Claim 1 or Claim 2. See generally 2 Mot. The Court addresses these arguments in turn. 3 1. Standing 4 Plaintiffs have the burden to establish Article III standing by sufficiently alleging that they 5 have “(1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the 6 defendant, and (3) that is likely to be redressed by a favorable judicial decision.” Spokeo, 578 7 U.S. at 338 (citations omitted). The injury in fact element requires Plaintiffs to allege “an invasion 8 of a legally protected interest which is (a) concrete and particularized; and (b) actual or imminent, 9 not conjectural or hypothetical.” Patel v. Facebook, Inc., 932 F.3d 1264, 1270 (9th Cir. 2019) 10 (quoting Lujan, 504 U.S. at 560). Defendant argues that Plaintiffs fail to establish an injury in fact 11 because they have not alleged a concrete and particularized injury. See Mot. 6–7; Reply 12–13. 12 The Ninth Circuit has “adopted a two-step approach to determine whether the violation of 13 a statute causes a concrete injury.” Patel, 932 F.3d at 1270. Under this approach, courts should 14 “ask ‘(1) whether the statutory provisions at issue were established to protect the plaintiff’s 15 concrete interests (as opposed to purely procedural rights), and if so, (2) whether the specific 16 procedural violations alleged in this case actually harm, or present a material risk of harm to, such 17 interests.” Id. at 1270–71 (quoting Robins v. Spokeo, Inc., 867 F.3d 1108, 1113 (9th Cir. 2017)) 18 (internal brackets omitted). 19 In Patel, the Ninth Circuit applied the two-step approach to determine whether plaintiffs 20 had standing to bring BIPA claims against Facebook for alleged violations of Sections 15(a) and 21 (b), i.e., the same statutes at issue in this action. See id. at 1268 (“According to the complaint, 22 Facebook violated sections 15(a) and 15(b) of BIPA by collecting, using, and storing biometric 23 identifiers (a ‘scan’ of ‘face geometry,’ []) from their photos without obtaining a written release 24 and without establishing a compliant retention schedule.”) (internal citation omitted). At the first 25 step, the circuit court held that Sections 15(a) and (b) “were established to protect an individual’s 26 ‘concrete interests’ in privacy, not merely procedural rights.” Id. at 1274 (citing Robins, 867 F.3d 27 at 1113). The court then turned to the second step of the analysis and found that the defendant’s 1 “alleged collection, use, and storage of plaintiffs’ face templates here is the very substantive harm 2 targeted by BIPA,” so that “violations of the procedures in BIPA actually harm or pose a material 3 risk of harm” to the concrete privacy interests protected by BIPA. Id. at 1275. The Ninth Circuit 4 concluded that the Patel plaintiffs’ allegations that Facebook’s violations of the BIPA 5 requirements allowed it to create, use, and retain individuals’ face templates “necessarily 6 violate[d] the plaintiffs’ substantive privacy interests,” so that the plaintiffs had alleged a concrete 7 and particularized harm sufficient to establish the injury-in-fact element for Article III standing for 8 the alleged violations of Sections 15(a) and (b). See id. at 1274–75. 9 The Ninth Circuit recently clarified that although BIPA establishes concrete interests in 10 privacy, the mere failure to “provide a retention schedule or guidelines for permanently destroying 11 the biometric identifiers and/or biometric information” is not sufficient to state an injury to a 12 particular person, as opposed to the public generally. See Zellmer v. Meta Platforms, Inc., --- 13 F.4th ----, 2024 WL 3016946, at *8 (9th Cir. June 17, 2024) (citing Bryant v. Compass Grp. USA, 14 Inc., 958 F.3d 617, 626 (7th Cir. 2020); Fox v. Dakkota Integrated Sys., LLC, 980 F.3d 1146, 15 1154–55 (7th Cir. 2020)). The court noted that its decision did not contradict Patel because the 16 plaintiffs in Patel, unlike those in Zellmer, had sufficiently alleged a violation of Section 15(b), 17 from which they could show “direct and discrete harm from the alleged Section 15(a) violation.” 18 Id. (citing Patel, 932 F.3d at 1275–76). 19 Defendant argues that Plaintiffs do not have standing for their Section 15(a) claim because 20 they allege only a failure to publish a retention policy. See Mot. 6–7 (citing Bryant, 958 F.3d at 21 626; Fox, 980 F.3d at 1154–55); Reply 12–13.2 However, upon review of the FAC in the light 22 most favorable to Plaintiffs, the Court finds that Plaintiffs allege that Arlo (1) collected biometric 23 identifiers in the form of geometric scans of Plaintiffs’ faces, bodies, and hands, see FAC ¶ 5; (2) 24 used these scans to provide various home security features, including Person Detection, see id. ¶ 25 26; (3) “failed to develop a publicly available retention schedule or guidelines for permanently 26

27 2 Defendant submitted its Motion and Reply prior to the Ninth Circuit’s Zellmer decision. 1 destroying Plaintiffs’ biometric identifiers,” id. ¶ 73; (4) never made such a schedule available to 2 the public because no schedule was developed in the first place, see id.; and (5) never adhered to 3 any such schedule, id. These allegations, along with the Court’s conclusion that Plaintiffs have 4 sufficiently stated a violation of Section 15(b), see infra, at Part III(B)(2), are sufficient to state a 5 theory of concrete and particularized harm in violation of Section 15(a): namely, that Arlo has 6 collected, used, and stored Plaintiffs’ biometric information without the proper procedures—a 7 retention policy and compliance therewith—to safeguard Plaintiffs’ substantive privacy interests. 8 See Patel, 932 F.3d at 1274–75; Zellmer, 2024 WL 3016946, at *8. 9 2. Sufficiency of Allegations to State a Claim 10 Arlo next argues that both of Plaintiffs’ claims must be dismissed for failure to state a 11 claim under Rule 12(b)(6). See Mot. 7–23. Arlo first argues that that both BIPA claims fail for 12 two common reasons: (1) Plaintiffs do not allege facts suggesting that they were recorded by an 13 Arlo camera equipped with the relevant detection features; and (2) Plaintiffs do not sufficiently 14 allege that Arlo collected biometric identifiers. See Mot. 8–17. Arlo then argues that the Section 15 15(b) claim fails because the statute does not apply to the conduct at issue here, see id. at 17–21, 16 and that the Section 15(a) claim fails because Arlo is in compliance with the statute and because 17 Arlo does not “possess” Plaintiffs’ biometric data under the meaning of the statute, see id. at 21– 18 23. The Court addresses these arguments in turn. 19 a. Recordings by Arlo Cameras 20 Defendant argues that the FAC does not plausibly allege that Plaintiffs made deliveries to 21 any home in Illinois at which an Arlo camera was installed with the necessary features to capture 22 the scans at issue in this action. See Mot. 8–10; see also Reply 2 (arguing Plaintiffs’ claims are 23 premised on “pure speculation” that they have been captured by Arlo cameras in Illinois). 24 Plaintiffs respond that these arguments raise factual questions not appropriate for resolution on a 25 motion to dismiss. See Opp’n 4–6. 26 The Court agrees with Plaintiffs. The FAC acknowledges that Plaintiffs are “unable to 27 determine which houses have such surveillance[] systems in place,” FAC ¶ 56, but alleges that 1 Arlo has captured Plaintiffs’ information because Plaintiffs make deliveries to Illinois homes 2 during which they walk to the front door of the residences, see id. ¶¶ 14–16, and Arlo is one of the 3 largest players in the home security market in the United States, see id. ¶ 21. Plaintiffs also allege 4 that Arlo “advertises that the [Person Detection] feature ‘also allows you to search the Arlo Feed 5 for videos containing people.’” Id. ¶ 24; see also Decl. of Tyler Zmick (“Zmick Decl.”), Exhs. 1– 6 4 (webpages from Arlo’s public-facing website describing various security features), ECF Nos. 7 30-1–30-4.3 It is entirely possible that discovery will show, for example, that Arlo has no cameras 8 in Illinois with the Person Detection feature, but the Court finds that—drawing every reasonable 9 inference in Plaintiffs’ favor—Plaintiffs have presented a plausible story that Illinois homeowners 10 would buy security cameras from one of the largest players in the market, and that enough 11 homeowners would choose the camera versions with the enhanced security features advertised by 12 Arlo that Plaintiffs would have been subject to scans by Arlo’s cameras as they made deliveries to 13 Illinois homes. See Neals v. PAR Tech. Corp., 419 F. Supp. 3d 1088, 1091 (N.D. Ill. 2018) 14 (noting that plaintiffs need not “substantiate” an allegation that defendants collected biometric 15 information, but must only “present ‘a story that holds together’”) (quoting Swanson v. Citibank, 16 N.A., 614 F.3d 400, 404 (7th Cir. 2020)). 17 b. Biometric Identifiers 18 Arlo next argues that Plaintiffs fail to allege that Arlo collected or possessed “biometric 19 identifiers” as defined by BIPA. See Mot. 10–17. Sections 15(a) and 15(b) regulate “biometric 20

21 3 These documents are incorporated by reference to the FAC because Plaintiffs relied on the sources extensively. See Khoja v. Orexigen Therapeutics, Inc., 899 F.3d 988, 1002 (9th Cir. 22 2018); FAC ¶¶ 1, 8, 11, 13, 24–26. Defendant also requests that the Court take judicial notice of a further Arlo webpage in the public realm, as well as an order and two reports of proceedings from 23 Illinois state courts. See Req. Jud. Not., ECF No. 31; Reply Req. Jud. Not., ECF No. 35. 24 Plaintiffs do not oppose the requests for judicial notice. See Opp’n 4 n.2. The documents at issue are in the public realm and judicial records, and the Court grants Arlo’s requests for judicial 25 notice. See United States v. Bychak, No. 18-CR-4683-GPC, 2021 WL 734371, at *6 (S.D. Cal. Feb. 25, 2021) (“[T]he judicial notice of publications is often used by Courts for the purpose of 26 establishing inquiry notice, and not to rely on a fact stated in the publication for its truth value.”); 27 U.S. ex rel. Robinson Rancheria Citizens Council v. Borneo, Inc., 971 F.2d 244, 248 (9th Cir. 1992). 1 identifiers” and “biometric information.” See 740 ILCS 14/15(a) (“A private entity in possession 2 of biometric identifiers or biometric information must . . .”); id. at 15(b) (No private entity may 3 collect, capture, purchase, receive through trade, or otherwise obtain a person's or a customer's 4 biometric identifier or biometric information, unless . . .”). BIPA provides that “‘[b]iometric 5 identifier’ means a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry,” 6 and goes on to list various items, such as tattoos or human biological samples used for scientific 7 testing, that are not “biometric identifiers” covered by BIPA. Id. at 14/10. “‘Biometric 8 information’ means any information, regardless of how it is captured, converted, stored, or shared, 9 based on an individual's biometric identifier used to identify an individual.” Id. 10 Arlo argues that the FAC does not state a claim under BIPA because Plaintiffs do not 11 allege that Arlo’s infrared or visible light scans (1) can be used by Arlo to identify Plaintiffs, see 12 Mot. 14–17, and (2) fall into the definition of “a retina or iris scan, fingerprint, voiceprint, or scan 13 of hand or face geometry,” but rather that Arlo’s scans are “heat maps,” which are not included in 14 BIPA’s enumerated list of biometric identifiers, see id. at 17. Plaintiffs counter that the FAC 15 plausibly alleges that Arlo collects biometric identifiers by capturing geometric scans of an 16 individual’s face and hands, which can be used to identify Plaintiffs. See Opp’n 6–11. 17 Addressing the second argument first, Plaintiffs allege that the scans taken by Arlo’s 18 cameras capture infrared and visible light data that Arlo’s technology then uses to “map[] peoples’ 19 facial geometry.” FAC ¶ 31; see also, e.g., id. ¶ 2 (“Defendant’s security cameras capture 20 geometric scans of Plaintiffs and other Illinois delivery drivers’ faces, bodies, and hands.”). 21 Taking these allegations as true, the Court finds that Plaintiffs have alleged the necessary— 22 although not sufficient—fact that Arlo captures data included on BIPA’s list of biometric 23 identifiers, namely, “scan[s] of hand or face geometry.” 24 In addition to alleging data included on the BIPA list, the Ninth Circuit has clarified that 25 both biometric identifiers and biometric information must be capable of identifying an individual 26 to be regulated by BIPA. See Zellmer, 2024 WL 3016946, at *4. Thus, “[f]or example, scans of 27 face geometry fall within BIPA's list, but are not covered by BIPA if they cannot identify a 1 person.” Id. at *5. In Zellmer, the Ninth Circuit held on review of summary judgment that a “face 2 signature” that did not reveal any geometric information about a face or correspond to facial 3 features—and instead was an abstract, numerical representation that could not be reverse- 4 engineered to display a face—was not a biometric identifier. See id. at *6. By contrast, Plaintiffs 5 here allege that “Arlo’s patents confirm that these . . . scans . . . can be used to identify particular 6 individuals.” FAC ¶ 6; see also id. ¶ 32 (“Arlo boasts that ‘the invention provides a new and 7 useful facial recognition system that may further automatically execute tasks in response to the 8 detection of a particular individual.’”). 9 Defendant argues that Plaintiffs must allege that Arlo itself is capable of using the scans to 10 determine Plaintiffs’ identities—e.g., their names, phone numbers, email addresses—and that the 11 FAC instead alleges an implausible hypothetical situation in which Arlo could use its facial 12 recognition technology to match Plaintiffs’ faces to their photos on public facing social media 13 profiles. See Mot. 16; FAC ¶¶ 64–65.4 But these are not Plaintiffs’ only allegations regarding 14 Arlo’s capacity to identify individuals using its scans. Plaintiffs allege that Arlo has explained in a 15 European patent that its face recognition technology can identify a specific person at a door and 16 send a user a message such as “Mary detected at front door” or, conversely, inform a user of 17 “Unknown person at front door.” FAC ¶¶ 28, 32. Arlo argues that the European patent is not 18 relevant here, but the Court takes as true Plaintiffs’ allegation that the same scans are used in 19 Arlo’s home security cameras. See id. ¶ 27. Plaintiffs further allege that “Defendant’s cameras 20 collected Plaintiffs’ face geometry and stored the image of Plaintiffs’ face geometry in an 21 electronic database” whenever Plaintiffs made deliveries to homes equipped with Arlo cameras. 22 The Court finds these allegations sufficient to establish at the pleading stage that the scans Arlo 23

24 4 Plaintiffs argue that biometric identifiers are distinct from biometric information under BIPA, so 25 that biometric identifiers need not be capable of being used to identify an individual, but the Ninth Circuit rejected this argument in Zellmer (decided subsequent to Plaintiffs’ submission of their 26 opposition brief). See Opp’n 11; Zellmer, 2024 WL 3016946, at *4 (“We join the other courts to have considered this issue and reject Zellmer’s argument” that “while biometric information 27 requires the ability to ‘identify an individual,’ biometric identifiers have no such explicit requirement.’”). 1 captures are “biometric identifiers” for purposes of BIPA’s regulations. See Wise v. Ring LLC, 2 No. 20-1298, 2022 WL 3083068, at *3 (W.D. Wash. Aug. 3, 2022) (finding allegations that 3 defendant was “collecting face geometry from photos, processing these images for a facial 4 recognition database ‘with the ultimate goal of identifying people who can be “tagged” as safe or 5 potentially suspicious visitors’” using technology “capable of immediately identifying 6 individuals” survived motion to dismiss)5; cf. Ji v. Naver Corp., No. 21-cv-05143, 2023 WL 7 6466211, at *12 (N.D. Cal. Oct. 3, 2023) (finding plaintiff did not allege collection of biometric 8 data because they “stop short of pleading that Defendants are capable of identifying Plaintiff . . . 9 by using the biometric data Defendants collect, whether standing alone or when combined with 10 other methods or sources available to Defendants”). 11 c. Section 15(b) Arguments 12 Arlo next argues that Plaintiffs do not state a claim under Section 15(b) because (1) 13 Plaintiffs do not allege that Arlo actively collected their biometric data, but rather that Arlo 14 passively captured scans only after homeowners activated the Person Detection feature, see Mot. 15 17–19, and (2) Section 15(b) does not require impossible notice and consent from individuals who 16 are strangers to Arlo, id. at 20–21. 17 The Court finds Arlo’s first argument thoroughly unpersuasive. Contrary to Arlo’s 18 position, Plaintiffs do not “claim their ‘infrared scans’ were collected by ‘homeowners.’” See 19 Mot. 18. It is plainly not Plaintiffs’ theory that homeowners are collecting and storing the scans of 20 individuals who arrive at their doors. Rather, Plaintiffs expressly allege that Arlo’s cameras scan 21 the faces, bodies, and hands of visitors to homes equipped with Arlo’s home security system, see 22 FAC ¶ 2; that Arlo then stores the scans in an electronic database, see id. ¶¶ 28, 42; and that if a 23 homeowner activates a feature such as Person Detection, then Arlo alerts the homeowner when a 24 person is detected by the camera, see id. ¶ 24. These allegations are sufficient to establish that 25

26 5 The Wise decision also notes that the complaint alleged that the defendant partnered with law 27 enforcement agencies to semi-automatically identify individuals based on face recognition, but that allegation was not dispositive. See Wise, 2022 WL 3083068, at *3. 1 Arlo does not merely mysteriously end up in possession of the scans, but rather is the entity 2 capturing the biometric information at issue. See, e.g., Jacobs v. Hanwha Techwin Am., Inc., 3 2021 WL 3172967, at *2 (N.D. Ill. July 27, 2021) (“[F]or § 15(b)’s requirements to apply, an 4 entity must, at a minimum, take an active step to collect, capture, purchase, or otherwise obtain 5 biometric data.”) 6 Arlo’s second argument specific to Section 15(b)—i.e., that it is too far removed from 7 Plaintiffs, such that it would be practically impossible to provide notice and obtain consent—relies 8 on the district court’s decision in Zellmer v. Facebook, Inc., No. 18-cv-01880, 2022 WL 976981 9 (N.D. Cal. Mar. 31, 2022). However, on appeal, the Ninth Circuit stated that the district court’s 10 decision “turned on the practical impossibility of Meta’s complying with BIPA if it had to obtain 11 consent from everyone whose photo was uploaded to Facebook,” but that “this conclusion was 12 wrong” because “the plain text applies to everyone whose biometric identifiers or information is 13 held by Facebook.” Zellmer, 2024 WL 3016946, at *4. Arlo’s second argument—made before 14 the Ninth Circuit’s issuance of Zellmer—must therefore be rejected. 15 d. Section 15(a) Arguments 16 Arlo lastly argues that Plaintiffs’ Section 15(a) claim must be dismissed because (1) Arlo 17 has a publicly available policy that complies with the retention periods set forth in Section 15(a); 18 (2) Plaintiffs lack statutory standing to bring the claim because they were not themselves 19 aggrieved by Arlo’s alleged violation of the retention policy because Arlo’s retention duty is owed 20 to the public at large rather than individuals; and (3) Plaintiffs fail to allege that Arlo “possessed” 21 their biometric data. See Mot. 21–23. These arguments are unavailing. 22 First, the policy put forth by Arlo—of which the Court has taken judicial notice, see supra, 23 at 11 n.3—does not address Section 15(a)’s requirement that companies “develop a written policy, 24 made available to the public, establishing a retention schedule and guidelines for permanently 25 destroying biometric identifiers and biometric information.” 740 ILCS 14/15(a). Instead, the 26 policy states that “Arlo permanently and immediately deletes videos after a subscriber deletes a 27 video, or after expiration of the applicable retention period for the subscription plan of the 1 subscriber.” See Req. Jud. Not, Exh. 6. Regardless of the truth of this statement—which the 2 Court does not consider—the policy does not discuss biometric identifiers and biometric 3 information, particularly as Plaintiffs allege that Arlo stores the scans at issue in an electronic 4 database. See FAC ¶ 42; see also Rivera v. Google, Inc., 238 F. Supp. 3d 1088, 1096 (N.D. Ill. 5 2017) (“The bottom line is that a ‘biometric identifier’ is not the underlying medium itself, or a 6 way of taking measurements, but instead is a set of measurements of a specified physical 7 component (eye, finger, voice, hand, face) used to identify a person.”) (emphasis added). 8 Second, Arlo’s argument that Plaintiffs lack statutory standing (as distinct from Article III 9 standing) must also be rejected. BIPA provides that “[a]ny person aggrieved by a violation of 10 [BIPA] shall have a right of action in a State circuit court or as a supplemental claim in federal 11 district court against an offending party.” 740 ILCS 14/20. Arlo relies on a Seventh Circuit 12 decision finding that the plaintiff lacked Article III standing to bring a Section 15(a) claim because 13 an entity’s policy disclosure duty was “owed to the public generally, not to particular persons 14 whose biometric data the entity collects.” Mot. 22 (quoting Bryant, 958 F.3d at 626). However, 15 the Seventh Circuit specifically stated that given its finding as to Article III standing, it had “no 16 authority and no occasion to address her state-court standing to bring this claim.” Bryant, 658 17 F.3d at 626. Here, the Court has found that Plaintiffs have Article III standing to bring their 18 Section 15(a) claim under Ninth Circuit law because they have sufficiently alleged a concrete and 19 particularized injury. See supra, at Part III(B)(1). For the same reasons, the Court finds that 20 Plaintiffs have alleged that they are “aggrieved” by the violation of Section 15(a). 21 Third, Arlo argues that Plaintiffs do not sufficiently allege its “possession” of their 22 biometric data, i.e., that Arlo had control of the biometric data, as opposed to the homeowners. 23 See Mot. 22–23. But the FAC plainly alleges that Arlo “stored and used” biometric identifiers too 24 provide its Person Detection feature, FAC ¶ 12, and that Arlo is unable to accomplish its person 25 detection tasks without “collect[ing], us[ing], and stor[ing]” the identifiers, id. ¶ 26. The FAC 26 further alleges that Arlo stores the biometric data in an electronic database, see id. ¶ 42, and that 27 homeowners can toggle features such as Person Detection on and off. See id. ¶ 25. These 1 allegations, which permit the reasonable inference that Arlo stores the biometric data and accesses 2 || it at need when the relevant security features are toggled, easily distinguish Plaintiffs’ complaint 3 from those dismissed in the cases cited by Defendant. See, e.g., Barnett v. Apple Inc., 225 N.E.3d 4 602, 603 IIL. App. Ct. 2022) (finding allegations that defendant designed software for individuals 5 to capture their own biometric data and store on personal device, without allegations of other 6 storage by defendant, insufficient to show possession); Heard v. Becton, Dickinson & Co., 440 F. 7 Supp. 3d 960, 962, 968-69 (N.D. Ill. 2020) (finding allegations did not “say whether BD could 8 freely access the data or even how BD allegedly received it”); Kyles v. Amazon Web Servs., Inc., 9 || No. 2021-CV-04026, Report of Proceedings (Cook Cnty., Ill. Cir. Ct. Jan. 3, 2023) (Reply Req. 10 || Jud. Not., Exh. 8) (defendant AWS provided cloud storage to non-party which collected and used 11 fingerprint data). 12 || Iv. CONCLUSION 5 13 For the foregoing reasons, the Court hereby ORDERS that: 14 1. Arlo’s motion to strike Plaintiffs’ notice of supplemental authority at ECF No. 44, 3 15 or in the alternative to file a response, is DENIED because the Court has considered a 16 only the decision attached to the notice and has not considered Plaintiffs’ additional 3 17 text; 18 2. Arlo’s motion to dismiss Plaintiffs’ Section 15(a) claim for lack of standing is 19 DENIED; and 20 3. Arlo’s motion to dismiss both BIPA claims for failure to state a claim is DENIED. 21 4. Arlo shall file an answer within 14 days of the entry of this order. 22 5. The Court will separately set an initial case management conference. 23 IT IS SO ORDERED. 24 Dated: June 27, 2024 25 26 EDWARD J. DAVILA 27 United States District Judge 28 || Case No.: 23-cv-05096-EJD ORDER DENYING DEFT.’S MOT. DISMISS FAC, MOT. STRIKE NOT. SUPPL. AUTH.