Vance v. Google LLC

Opinion

STEVEN VANCE, et al., Case No. 20-cv-04696-BLF

Plaintiffs, ORDER GRANTING MOTION TO v. DISMISS WITH LEAVE TO AMEND

GOOGLE LLC, [Re: ECF No. 92] Defendant.

In April 2019, International Business Machines Corporation (“IBM”) used publicly available photos, including those posted by Plaintiffs to the photo-sharing website Flickr, to create a massive collection of biometric information called the Diversity in Faces Dataset (“DiF Dataset”). ECF No. 1 (“Compl.”) ¶¶ 6–7, 29, 39–46. Plaintiffs allege that Defendant Google LLC (“Google”) acquired the DiF Dataset from IBM without Plaintiffs’ consent and profited from it in violation of the Illinois Biometric Information Privacy Act (“BIPA”). Id. ¶¶ 55, 92–105. Plaintiffs also allege claims for unjust enrichment and injunctive relief. Id. ¶¶ 106–121. Google moves to dismiss Plaintiffs’ complaint in its entirety. ECF No. 92 (“Mot.”); ECF No. 97 (“Reply”). Plaintiffs oppose. ECF No. 96 (“Opp.”). For the reasons described below, Google’s motion is GRANTED WITH LEAVE TO AMEND. The Illinois Biometric Information Privacy Act regulates the use of an individual’s biometric data. See 740 ILCS § 14/1, et seq. Under Illinois law, “biometric identifiers” include a “scan of . . . face geometry,” and “biometric information” is “any information . . . based on an provisions are at issue in this case: (1) no private entity may “collect, capture, purchase, receive through trade, or otherwise obtain a person’s or a customer’s biometric identifier or biometric information” without providing written notice and obtaining a written release, id. § 14/15(b) (“section 15(b)”); and (2) no private entity “in possession of a biometric identifier or biometric information may sell, lease, trade, or otherwise profit from a person’s or a customer’s biometric identifier or biometric information,” id. § 14/15(c) (“section 15(c)”) (emphasis added). BIPA provides for a private right of action and allows a prevailing party to recover liquidated damages in the amount of: (1) $1,000 or actual damages, whichever is greater, for negligent violations; and (2) $5,000 or actual damages, whichever is greater, for intentional or reckless violations. Id. § 14/20. BIPA also allows for the recovery of attorneys’ fees and costs and injunctive relief. Id. B. Allegations The following allegations are taken from the complaint and taken as true for the purposes of this motion. Plaintiffs Steven Vance and Tim Janecyk are Illinois residents who uploaded photographs containing their faces to the photo-sharing website Flickr. Compl. ¶¶ 6–7, 59–62, 67–70. In or about 2014, Flickr compiled approximately 100 million Flickr photographs into a single dataset (the “Flickr Dataset”) and made the dataset publicly available. Id. ¶ 29. Using the Flickr Dataset, IBM then created the DiF Dataset, which contains biometric identifiers of Plaintiffs taken from the Flickr Dataset, by scanning the facial geometry of facial images contained in one million photographs taken from the Flickr Dataset. See id. ¶¶ 28–29, 40–43. IBM then made the DiF Dataset available by request to for-profit companies, and Defendant Google applied for and obtained it. Id. ¶¶ 47–48, 50, 55. Plaintiffs allege that Google obtained the DiF Dataset “in order to improve the fairness and accuracy of its facial recognition products and technologies” “by allowing Google to improve the effectiveness of its facial recognition technology on a diverse array of faces, thereby making those products and technologies more valuable in the commercial marketplace.” Id. ¶ 57–58. According to Plaintiffs, at no time did Google provide written notice to or obtain written consent from Plaintiffs and Class Members regarding its procurement and use of their biometric data. Id. ¶¶ 64–65, 72–73, 93. collecting and obtaining Plaintiffs’ biometric information without providing the requisite written information and without obtaining the requisite written releases. Id. ¶ 92–98. Count two alleges that Google violated BIPA section 15(c) by unlawfully profiting from Plaintiffs and Class Members’ biometric information. Id. ¶ 99–105. Count three alleges unjust enrichment. Id. ¶¶ 106–115. Count four seeks injunctive relief. Id. ¶¶ 116–121. C. Procedural Posture Plaintiffs filed their Complaint on July 14, 2020. ECF No. 1. Google moved to stay the case pending resolution of Plaintiffs’ related suit against IBM, Vance v. IBM, No. 1:20-cv-00577 (N.D. Ill.) and the Court granted the motion. See ECF Nos. 33, 66. The case remained stayed until August 28, 2023, and Google filed the instant motion on October 12, 2023. See Mot. “A motion to dismiss under Federal Rule of Civil Procedure 12(b)(6) for failure to state a claim upon which relief can be granted ‘tests the legal sufficiency of a claim.’” Conservation Force v. Salazar, 646 F.3d 1240, 1241–42 (9th Cir. 2011) (quoting Navarro v. Block, 250 F.3d 729, 732 (9th Cir. 2001)). When determining whether a claim has been stated, the Court accepts as true all well-pled factual allegations and construes them in the light most favorable to the plaintiff. Reese v. BP Expl. (Alaska) Inc., 643 F.3d 681, 690 (9th Cir. 2011). However, the Court need not “accept as true allegations that contradict matters properly subject to judicial notice” or “allegations that are merely conclusory, unwarranted deductions of fact, or unreasonable inferences.” In re Gilead Scis. Sec. Litig., 536 F.3d 1049, 1055 (9th Cir. 2008) (citation omitted). While a complaint need not contain detailed factual allegations, it “must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). A claim is facially plausible when it “allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Id. On a motion to dismiss, the Court’s review is limited to the face of the complaint and matters judicially noticeable. MGIC Indem. Corp. v. Weisman, 803 F.2d 500, 504 (9th Cir. 1986); N. Star Int'l v. Ariz. Corp. Comm'n, 720 F.2d 578, A. Judicial Notice Google requests that the Court consider Exhibits A and B to the Declaration of Sunita Bali in Support of its Motion to Dismiss, ECF No. 93 (“Bali Decl.”), which represent business entity searches on the California and New York Secretary of State websites showing that both Flickr and IBM maintain principal offices outside of Illinois (in California and New York, respectively). Plaintiffs do not oppose the request. The Court may take judicial notice of information that is “readily verifiable and, therefore, the proper subject of judicial notice.” Reyn’s Pasta Bella, LLC v. Visa USA, Inc., 442 F.3d 741, 746 n.6 (9th Cir. 2006); L’Garde, Inc. v. Raytheon Space & Airborne Sys., 805 F. Supp. 2d 932, 938 (C.D. Cal. 2011). Because Google’s unopposed request concerns readily verifiable information posted on a state government website, the Court grants the request. B. BIPA Claims Google makes two challenges to Plaintiffs’ BIPA claims. Google first argues that both BIPA claims fail “because they have not alleged, and cannot allege, that Google engaged in any conduct in Illinois.” Mot. at 7–11. Google further argues that Plaintiffs’ second claim fails because Plaintiffs cannot allege Google “otherwise profit[ed] from” Plaintiffs’ biometric information. Id. at 11–13. The Court addresses the arguments in turn. 1. Extraterritoriality Under Illinois law, a “statute is without extraterritorial effect unless a clear intent in this respect appears from the express provisions of the statute.” Avery v. State Farm Mut. Ins. Co., 835 N.E.2d 801, 852 (Ill. 2005) (internal quotation marks omitted). BIPA does not contain an express provision stating it is intended to apply extraterritorially. See Monroy v. Shutterfly, Inc., 2017 WL 4099846, at *5 (N.D. Ill. Sept. 15, 2017). Therefore, BIPA violations must occur in Illinois in order for plaintiffs to obtain any relief. Rivera v. Google Inc., 238 F. Supp. 3d 1088, 1100 (N.D. Ill. 2017) (“[The plaintiffs’] asserted violations of [BIPA] must have taken place in Illinois in order for them to win.”). The applicable test is whether the circumstances “occur[ed] primarily Google argues that Plaintiffs only plead their Illinois residency, which is insufficient to establish a connection to the forum. Mot. at 7–8. Plaintiffs respond that three things – their residency, Google’s failure to provide notice under the statute, and their injuries – connect Google’s alleged conduct to Illinois. Opp. at 6–7. Plaintiffs allege that they uploaded their photos to a website hosted by Flickr, a California company, in Illinois. Compl. ¶ 32, 59–60, 68–70; ECF No. 93 at 7. Flickr then compiled approximately 100 million Flickr photographs, including Plaintiff photographs, into a single dataset (the “Flickr Dataset”) and “made the dataset publicly available.” Compl. ¶¶ 29, 32. IBM, a New York company, then used one million images culled from the Flickr Dataset to create the DiF Dataset “for the purpose of improving the ability of facial recognition systems to fairly and accurately identify all individuals.” Compl. ¶¶ 29, 41–46; ECF No. 93 at 4. To create the DiF Dataset, IBM scanned and processed the facial geometry of images from the Flickr Dataset. Id. at ¶ 41; Michele Merler, et al., Diversity in Faces, IBM Research AI (Apr. 10, 2019). IBM made the DiF Dataset available to other for-profit companies through an online application process. Compl. ¶¶ 47–48. One company that applied for and received the DiF Dataset from IBM was Google, a California company. Id. ¶¶ 55–56. Plaintiffs allege that Google obtained the DiF Dataset “in order to improve the fairness and accuracy of its facial recognition products and technologies.” Id. ¶ 57. Plaintiffs also allege that Google profited from the DiF Dataset because it “allowed Google to improve its facial recognition products and technologies” such as “Google Photos software application, Google Nest Hub Max, Google Pixel smartphone and its Cloud Vision Application Program Interface.” Id. ¶ 53, 58. Missing from the complaint, however, is any indication that Google did anything in Illinois. Plaintiffs do not allege that Google processes, stores, or otherwise makes use of the DiF Dataset (or any biometric data for that matter) in Illinois. Nor do Plaintiffs allege that Google ever interacted with them or any other person or entity in Illinois to obtain the DiF Dataset. The only company alleged of directly interacting with Plaintiffs is Flickr. The only company alleged of directly interacting with Google is IBM, which is also not alleged to have any direct connection that could plausibly be imputed to Illinois such that it would “g[i]ve rise to the alleged BIPA violations.” See Vance v. Microsoft Corp. (“Microsoft III”), No. C20-1082-JLR, 2022 WL 9983979, at *7 (W.D. Wash. Oct. 17, 2022) (citing In re Facebook Biometric Info. Privacy Litig., 326 F.R.D. 535, 547 (N.D. Cal. 2018)); Vance v. Amazon.com, Inc. (“Amazon III”), No. C20- 1084-JLR, 2022 WL 12306231, at *7 (W.D. Wash. Oct. 17, 2022). Plaintiffs seek to procedurally distinguish Microsoft III and Amazon III as summary judgment orders. Opp. at 9. But where, as here, Plaintiffs fail to allege any direct interaction, the rationale in those orders applies here at the pleadings stage with equal force. As a result, Plaintiffs’ allegation that Google’s failed to provide notice under the statute, Compl. ¶ 93, does not connect Google’s conduct to Illinois. A “failure to disclose” can be tied to a geographic location. See Avery, 835 N.E.2d at 854. But because Plaintiffs have not alleged a “direct interaction” that would “g[i]ve rise to the alleged BIPA violations,” Microsoft III, 2022 WL 9983979, at *7, Plaintiffs have not established that Google was ever required to provide Plaintiffs notice. Thus, Plaintiffs have not established a failure to notify, much less that any failure took place in Illinois. McGoveran v. Amazon Web Servs., Inc., No. CV 20-1399-LPS, 2021 WL 4502089, at *4 (D. Del. Sept. 30, 2021) (rejecting a similar argument that “depend[ed] on the assumption that [the defendants] were required to provide notice, publish policies, and obtain consent in Illinois” because the plaintiffs did not allege “any activity in Illinois that would impose such obligations on [the defendants]”). Nor do Plaintiffs’ alleged injuries connect Google’s conduct to Illinois. Opp. at 6. Plaintiffs allege that Google exposed Plaintiffs to “potential surveillance” and other “ongoing privacy risks” and harms “within Illinois,” deprived Plaintiffs of their “statutorily-protected privacy rights,” and “deter[red] Plaintiffs and Class Members from publicly posting photographs.” Compl. ¶ 76. But again, because Plaintiffs have not alleged any “direct interaction” that would “g[i]ve rise to the alleged BIPA violations,” Microsoft III, 2022 WL 9983979, at *7, they have not plausibly alleged an injury stemming from that violation. Furthermore, while the Court recognizes the seriousness of the alleged injuries, for the purposes of establishing Google’s connection to McGoveran, 2021 WL 4502089, at *4 (rejecting allegations about a “case’s connections to Illinois” that were “nothing more than repeated statements . . . about [the plaintiffs’] residency”). Finally, while it is undisputed that Plaintiffs reside in Illinois, Plaintiffs’ residency alone is not enough to connect Google’s conduct to Illinois. See, e.g., Vulcan Golf, LLC v. Google Inc., 552 F. Supp. 2d 752, 755 (N.D. Ill. 2008) (dismissing claim even though “plaintiffs contend that Illinois has ‘significant contacts’ with each of the named class plaintiffs because each is a resident”); Super Pawn Jewelry & Loan, LLC v. Am. Env’t Energy, Inc., 2013 WL 1337303, at *7 (N.D. Ill. Mar. 29, 2013) (dismissing claim given “weak connection to Illinois” despite plaintiff’s residency); McGoveran, 2021 WL 4502089, at *4 (dismissing claims where “[the plaintiffs did] not allege any direct interaction with [the defendants] that might plausibly be imputed to Illinois” but instead “allege only interactions with [a nonparty] in Massachusetts, who in turn interacted with [the defendants]”). Thus, the Court finds that Plaintiffs have not established that the alleged conduct occurred “primarily and substantially” in Illinois. Avery, 835 N.E.2d at 854; Rivera, 238 F. Supp. 3d at 1101. Plaintiffs candidly stated at the hearing that it would be difficult to allege additional facts tying Google’s conduct to Illinois without discovery, but nonetheless requested leave to amend. Thus, the Court grants Google’s motion to dismiss Plaintiffs’ BIPA claims with leave to amend. 2. Profit Because the Court finds that Plaintiffs’ BIPA claims are deficient for failure to plead that Google’s actions occurred in Illinois, the Court need not address Google’s second argument. That said, the Court notes that Plaintiffs’ 15(c) allegations may also be deficient, as they allege little about how Google makes use of the DiF Dataset. Absent such allegations, the Court cannot interpret or apply the phrase “otherwise profit from” in section 15(c). C. Unjust Enrichment Google argues that Plaintiffs’ third claim for unjust enrichment is deficient because Plaintiffs do not identify the applicable law. Mot. at 13. Plaintiffs respond that they do not need to identify the state because “no material difference exists between a cause of action for unjust As this Court and others have recognized, “due to variances among state laws, failure to allege which state law governs a common law claim is grounds for dismissal.” In re Samsung Galaxy Smartphone Mktg. & Sales Pracs. Litig., No. 16-CV-06391-BLF, 2018 WL 1576457, at *4 (N.D. Cal. Mar. 30, 2018) (quoting In re Nexus 6P Prod. Liab. Litig., 293 F. Supp. 3d 888 (N.D. Cal. 2018)); In re TFT–LCD (Flat Panel) Antitrust Litig., 781 F. Supp. 2d 955, 966 (N.D. Cal. 2011) (“Several other courts in this district have similarly held that a plaintiff must specify the state under which it brings an unjust enrichment claim.”). Plaintiffs acknowledge that the elements for unjust enrichment in California and Illinois are not identical, Opp. at 17, and indicated at the hearing that they could replead the claim under Illinois law. Accordingly, the Court grants Google’s motion to dismiss Plaintiffs’ unjust enrichment claim with leave to amend. D. Injunctive Relief The parties do not dispute that Plaintiffs’ claim for injunctive relief is improperly pled as a cause of action. See Mot. at 15; Reply at 10. The Court agrees with the parties and grants Google’s motion to dismiss Plaintiffs’ claim for injunctive relief without leave to amend. See Vance v. Amazon.com Inc., 525 F. Supp. 3d 1301, 1316 (W.D. Wash. 2021); Vance v. Microsoft Corp., 525 F. Supp. 3d 1287, 1300 (W.D. Wash. 2021). For the foregoing reasons, IT IS HEREBY ORDERED that: 1. Defendant’s motion to dismiss Plaintiffs’ first and second claims for violations of the Illinois Biometric Privacy Act is GRANTED WITH LEAVE TO AMEND. 2. Defendant’s motion to dismiss Plaintiffs’ third claim for unjust enrichment is 3. Defendant’s motion to dismiss Plaintiffs’ fourth claim for injunctive relief is \\ \\ \\ 1 Any amended complaint shall be filed no later than 30 days from the entry of this order. 2 Plaintiffs may only amend consistent with this order. No additional claims or parties may be 3 added without leave of the Court. Plaintiffs shall also file a redlined version of any amended 4 complaint. 5 6 Dated: March 15, 2024 ’ BETH LABSON FREEMAN 8 United States District Judge 9 10 11 12

© 15 16

= 17

Z 18 19 20 21 22 23 24 25 26 27 28