Vance v. Google LLC

• Court: District Court, N.D. California
• Decided: March 15, 2024
• Docket: 5:20-cv-04696
• Status: Unknown

Opinion

1 2 3 UNITED STATES DISTRICT COURT 4 NORTHERN DISTRICT OF CALIFORNIA 5 SAN JOSE DIVISION 6 7 STEVEN VANCE, et al., Case No. 20-cv-04696-BLF

8 Plaintiffs, ORDER GRANTING MOTION TO 9 v. DISMISS WITH LEAVE TO AMEND

10 GOOGLE LLC, [Re: ECF No. 92] 11 Defendant.

12 13 In April 2019, International Business Machines Corporation (“IBM”) used publicly 14 available photos, including those posted by Plaintiffs to the photo-sharing website Flickr, to create 15 a massive collection of biometric information called the Diversity in Faces Dataset (“DiF 16 Dataset”). ECF No. 1 (“Compl.”) ¶¶ 6–7, 29, 39–46. Plaintiffs allege that Defendant Google LLC 17 (“Google”) acquired the DiF Dataset from IBM without Plaintiffs’ consent and profited from it in 18 violation of the Illinois Biometric Information Privacy Act (“BIPA”). Id. ¶¶ 55, 92–105. 19 Plaintiffs also allege claims for unjust enrichment and injunctive relief. Id. ¶¶ 106–121. Google 20 moves to dismiss Plaintiffs’ complaint in its entirety. ECF No. 92 (“Mot.”); ECF No. 97 21 (“Reply”). Plaintiffs oppose. ECF No. 96 (“Opp.”). For the reasons described below, Google’s 22 motion is GRANTED WITH LEAVE TO AMEND. 23 I. BACKGROUND 24 A. BIPA 25 The Illinois Biometric Information Privacy Act regulates the use of an individual’s 26 biometric data. See 740 ILCS § 14/1, et seq. Under Illinois law, “biometric identifiers” include a 27 “scan of . . . face geometry,” and “biometric information” is “any information . . . based on an 1 provisions are at issue in this case: (1) no private entity may “collect, capture, purchase, receive 2 through trade, or otherwise obtain a person’s or a customer’s biometric identifier or biometric 3 information” without providing written notice and obtaining a written release, id. § 14/15(b) 4 (“section 15(b)”); and (2) no private entity “in possession of a biometric identifier or biometric 5 information may sell, lease, trade, or otherwise profit from a person’s or a customer’s biometric 6 identifier or biometric information,” id. § 14/15(c) (“section 15(c)”) (emphasis added). BIPA 7 provides for a private right of action and allows a prevailing party to recover liquidated damages 8 in the amount of: (1) $1,000 or actual damages, whichever is greater, for negligent violations; and 9 (2) $5,000 or actual damages, whichever is greater, for intentional or reckless violations. Id. § 10 14/20. BIPA also allows for the recovery of attorneys’ fees and costs and injunctive relief. Id. 11 B. Allegations 12 The following allegations are taken from the complaint and taken as true for the purposes 13 of this motion. Plaintiffs Steven Vance and Tim Janecyk are Illinois residents who uploaded 14 photographs containing their faces to the photo-sharing website Flickr. Compl. ¶¶ 6–7, 59–62, 15 67–70. In or about 2014, Flickr compiled approximately 100 million Flickr photographs into a 16 single dataset (the “Flickr Dataset”) and made the dataset publicly available. Id. ¶ 29. Using the 17 Flickr Dataset, IBM then created the DiF Dataset, which contains biometric identifiers of Plaintiffs 18 taken from the Flickr Dataset, by scanning the facial geometry of facial images contained in one 19 million photographs taken from the Flickr Dataset. See id. ¶¶ 28–29, 40–43. 20 IBM then made the DiF Dataset available by request to for-profit companies, and 21 Defendant Google applied for and obtained it. Id. ¶¶ 47–48, 50, 55. Plaintiffs allege that Google 22 obtained the DiF Dataset “in order to improve the fairness and accuracy of its facial recognition 23 products and technologies” “by allowing Google to improve the effectiveness of its facial 24 recognition technology on a diverse array of faces, thereby making those products and 25 technologies more valuable in the commercial marketplace.” Id. ¶ 57–58. According to Plaintiffs, 26 at no time did Google provide written notice to or obtain written consent from Plaintiffs and Class 27 Members regarding its procurement and use of their biometric data. Id. ¶¶ 64–65, 72–73, 93. 1 collecting and obtaining Plaintiffs’ biometric information without providing the requisite written 2 information and without obtaining the requisite written releases. Id. ¶ 92–98. Count two alleges 3 that Google violated BIPA section 15(c) by unlawfully profiting from Plaintiffs and Class 4 Members’ biometric information. Id. ¶ 99–105. Count three alleges unjust enrichment. Id. ¶¶ 5 106–115. Count four seeks injunctive relief. Id. ¶¶ 116–121. 6 C. Procedural Posture 7 Plaintiffs filed their Complaint on July 14, 2020. ECF No. 1. Google moved to stay the 8 case pending resolution of Plaintiffs’ related suit against IBM, Vance v. IBM, No. 1:20-cv-00577 9 (N.D. Ill.) and the Court granted the motion. See ECF Nos. 33, 66. The case remained stayed 10 until August 28, 2023, and Google filed the instant motion on October 12, 2023. See Mot. 11 II. LEGAL STANDARD 12 “A motion to dismiss under Federal Rule of Civil Procedure 12(b)(6) for failure to state a 13 claim upon which relief can be granted ‘tests the legal sufficiency of a claim.’” Conservation 14 Force v. Salazar, 646 F.3d 1240, 1241–42 (9th Cir. 2011) (quoting Navarro v. Block, 250 F.3d 15 729, 732 (9th Cir. 2001)). When determining whether a claim has been stated, the Court accepts 16 as true all well-pled factual allegations and construes them in the light most favorable to the 17 plaintiff. Reese v. BP Expl. (Alaska) Inc., 643 F.3d 681, 690 (9th Cir. 2011). However, the Court 18 need not “accept as true allegations that contradict matters properly subject to judicial notice” or 19 “allegations that are merely conclusory, unwarranted deductions of fact, or unreasonable 20 inferences.” In re Gilead Scis. Sec. Litig., 536 F.3d 1049, 1055 (9th Cir. 2008) (citation omitted). 21 While a complaint need not contain detailed factual allegations, it “must contain sufficient factual 22 matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’” Ashcroft v. Iqbal, 23 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). A 24 claim is facially plausible when it “allows the court to draw the reasonable inference that the 25 defendant is liable for the misconduct alleged.” Id. On a motion to dismiss, the Court’s review is 26 limited to the face of the complaint and matters judicially noticeable. MGIC Indem. Corp. v. 27 Weisman, 803 F.2d 500, 504 (9th Cir. 1986); N. Star Int'l v. Ariz. Corp. Comm'n, 720 F.2d 578, 1 III. DISCUSSION 2 A. Judicial Notice 3 Google requests that the Court consider Exhibits A and B to the Declaration of Sunita Bali 4 in Support of its Motion to Dismiss, ECF No. 93 (“Bali Decl.”), which represent business entity 5 searches on the California and New York Secretary of State websites showing that both Flickr and 6 IBM maintain principal offices outside of Illinois (in California and New York, respectively). 7 Plaintiffs do not oppose the request. 8 The Court may take judicial notice of information that is “readily verifiable and, therefore, 9 the proper subject of judicial notice.” Reyn’s Pasta Bella, LLC v. Visa USA, Inc., 442 F.3d 741, 10 746 n.6 (9th Cir. 2006); L’Garde, Inc. v. Raytheon Space & Airborne Sys., 805 F. Supp. 2d 932, 11 938 (C.D. Cal. 2011). Because Google’s unopposed request concerns readily verifiable 12 information posted on a state government website, the Court grants the request. 13 B. BIPA Claims 14 Google makes two challenges to Plaintiffs’ BIPA claims. Google first argues that both 15 BIPA claims fail “because they have not alleged, and cannot allege, that Google engaged in any 16 conduct in Illinois.” Mot. at 7–11. Google further argues that Plaintiffs’ second claim fails 17 because Plaintiffs cannot allege Google “otherwise profit[ed] from” Plaintiffs’ biometric 18 information. Id. at 11–13. The Court addresses the arguments in turn. 19 1. Extraterritoriality 20 Under Illinois law, a “statute is without extraterritorial effect unless a clear intent in this 21 respect appears from the express provisions of the statute.” Avery v. State Farm Mut. Ins. Co., 835 22 N.E.2d 801, 852 (Ill. 2005) (internal quotation marks omitted). BIPA does not contain an express 23 provision stating it is intended to apply extraterritorially. See Monroy v. Shutterfly, Inc., 2017 WL 24 4099846, at *5 (N.D. Ill. Sept. 15, 2017). Therefore, BIPA violations must occur in Illinois in 25 order for plaintiffs to obtain any relief. Rivera v. Google Inc., 238 F. Supp. 3d 1088, 1100 (N.D. 26 Ill. 2017) (“[The plaintiffs’] asserted violations of [BIPA] must have taken place in Illinois in 27 order for them to win.”). The applicable test is whether the circumstances “occur[ed] primarily 1 Google argues that Plaintiffs only plead their Illinois residency, which is insufficient to 2 establish a connection to the forum. Mot. at 7–8. Plaintiffs respond that three things – their 3 residency, Google’s failure to provide notice under the statute, and their injuries – connect 4 Google’s alleged conduct to Illinois. Opp. at 6–7. 5 Plaintiffs allege that they uploaded their photos to a website hosted by Flickr, a California 6 company, in Illinois. Compl. ¶ 32, 59–60, 68–70; ECF No. 93 at 7. Flickr then compiled 7 approximately 100 million Flickr photographs, including Plaintiff photographs, into a single 8 dataset (the “Flickr Dataset”) and “made the dataset publicly available.” Compl. ¶¶ 29, 32. 9 IBM, a New York company, then used one million images culled from the Flickr Dataset 10 to create the DiF Dataset “for the purpose of improving the ability of facial recognition systems to 11 fairly and accurately identify all individuals.” Compl. ¶¶ 29, 41–46; ECF No. 93 at 4. To create 12 the DiF Dataset, IBM scanned and processed the facial geometry of images from the Flickr 13 Dataset. Id. at ¶ 41; Michele Merler, et al., Diversity in Faces, IBM Research AI (Apr. 10, 2019). 14 IBM made the DiF Dataset available to other for-profit companies through an online 15 application process. Compl. ¶¶ 47–48. One company that applied for and received the DiF 16 Dataset from IBM was Google, a California company. Id. ¶¶ 55–56. Plaintiffs allege that Google 17 obtained the DiF Dataset “in order to improve the fairness and accuracy of its facial recognition 18 products and technologies.” Id. ¶ 57. Plaintiffs also allege that Google profited from the DiF 19 Dataset because it “allowed Google to improve its facial recognition products and technologies” 20 such as “Google Photos software application, Google Nest Hub Max, Google Pixel smartphone 21 and its Cloud Vision Application Program Interface.” Id. ¶ 53, 58. 22 Missing from the complaint, however, is any indication that Google did anything in 23 Illinois. Plaintiffs do not allege that Google processes, stores, or otherwise makes use of the DiF 24 Dataset (or any biometric data for that matter) in Illinois. Nor do Plaintiffs allege that Google ever 25 interacted with them or any other person or entity in Illinois to obtain the DiF Dataset. The only 26 company alleged of directly interacting with Plaintiffs is Flickr. The only company alleged of 27 directly interacting with Google is IBM, which is also not alleged to have any direct connection 1 that could plausibly be imputed to Illinois such that it would “g[i]ve rise to the alleged BIPA 2 violations.” See Vance v. Microsoft Corp. (“Microsoft III”), No. C20-1082-JLR, 2022 WL 3 9983979, at *7 (W.D. Wash. Oct. 17, 2022) (citing In re Facebook Biometric Info. Privacy Litig., 4 326 F.R.D. 535, 547 (N.D. Cal. 2018)); Vance v. Amazon.com, Inc. (“Amazon III”), No. C20- 5 1084-JLR, 2022 WL 12306231, at *7 (W.D. Wash. Oct. 17, 2022). Plaintiffs seek to procedurally 6 distinguish Microsoft III and Amazon III as summary judgment orders. Opp. at 9. But where, as 7 here, Plaintiffs fail to allege any direct interaction, the rationale in those orders applies here at the 8 pleadings stage with equal force. 9 As a result, Plaintiffs’ allegation that Google’s failed to provide notice under the statute, 10 Compl. ¶ 93, does not connect Google’s conduct to Illinois. A “failure to disclose” can be tied to 11 a geographic location. See Avery, 835 N.E.2d at 854. But because Plaintiffs have not alleged a 12 “direct interaction” that would “g[i]ve rise to the alleged BIPA violations,” Microsoft III, 2022 13 WL 9983979, at *7, Plaintiffs have not established that Google was ever required to provide 14 Plaintiffs notice. Thus, Plaintiffs have not established a failure to notify, much less that any 15 failure took place in Illinois. McGoveran v. Amazon Web Servs., Inc., No. CV 20-1399-LPS, 2021 16 WL 4502089, at *4 (D. Del. Sept. 30, 2021) (rejecting a similar argument that “depend[ed] on the 17 assumption that [the defendants] were required to provide notice, publish policies, and obtain 18 consent in Illinois” because the plaintiffs did not allege “any activity in Illinois that would impose 19 such obligations on [the defendants]”). 20 Nor do Plaintiffs’ alleged injuries connect Google’s conduct to Illinois. Opp. at 6. 21 Plaintiffs allege that Google exposed Plaintiffs to “potential surveillance” and other “ongoing 22 privacy risks” and harms “within Illinois,” deprived Plaintiffs of their “statutorily-protected 23 privacy rights,” and “deter[red] Plaintiffs and Class Members from publicly posting photographs.” 24 Compl. ¶ 76. But again, because Plaintiffs have not alleged any “direct interaction” that would 25 “g[i]ve rise to the alleged BIPA violations,” Microsoft III, 2022 WL 9983979, at *7, they have not 26 plausibly alleged an injury stemming from that violation. Furthermore, while the Court recognizes 27 the seriousness of the alleged injuries, for the purposes of establishing Google’s connection to 1 McGoveran, 2021 WL 4502089, at *4 (rejecting allegations about a “case’s connections to 2 Illinois” that were “nothing more than repeated statements . . . about [the plaintiffs’] residency”). 3 Finally, while it is undisputed that Plaintiffs reside in Illinois, Plaintiffs’ residency alone is 4 not enough to connect Google’s conduct to Illinois. See, e.g., Vulcan Golf, LLC v. Google Inc., 5 552 F. Supp. 2d 752, 755 (N.D. Ill. 2008) (dismissing claim even though “plaintiffs contend that 6 Illinois has ‘significant contacts’ with each of the named class plaintiffs because each is a 7 resident”); Super Pawn Jewelry & Loan, LLC v. Am. Env’t Energy, Inc., 2013 WL 1337303, at *7 8 (N.D. Ill. Mar. 29, 2013) (dismissing claim given “weak connection to Illinois” despite plaintiff’s 9 residency); McGoveran, 2021 WL 4502089, at *4 (dismissing claims where “[the plaintiffs did] 10 not allege any direct interaction with [the defendants] that might plausibly be imputed to Illinois” 11 but instead “allege only interactions with [a nonparty] in Massachusetts, who in turn interacted 12 with [the defendants]”). 13 Thus, the Court finds that Plaintiffs have not established that the alleged conduct occurred 14 “primarily and substantially” in Illinois. Avery, 835 N.E.2d at 854; Rivera, 238 F. Supp. 3d at 15 1101. Plaintiffs candidly stated at the hearing that it would be difficult to allege additional facts 16 tying Google’s conduct to Illinois without discovery, but nonetheless requested leave to amend. 17 Thus, the Court grants Google’s motion to dismiss Plaintiffs’ BIPA claims with leave to amend. 18 2. Profit 19 Because the Court finds that Plaintiffs’ BIPA claims are deficient for failure to plead that 20 Google’s actions occurred in Illinois, the Court need not address Google’s second argument. That 21 said, the Court notes that Plaintiffs’ 15(c) allegations may also be deficient, as they allege little 22 about how Google makes use of the DiF Dataset. Absent such allegations, the Court cannot 23 interpret or apply the phrase “otherwise profit from” in section 15(c). 24 C. Unjust Enrichment 25 Google argues that Plaintiffs’ third claim for unjust enrichment is deficient because 26 Plaintiffs do not identify the applicable law. Mot. at 13. Plaintiffs respond that they do not need 27 to identify the state because “no material difference exists between a cause of action for unjust 1 As this Court and others have recognized, “due to variances among state laws, failure to 2 allege which state law governs a common law claim is grounds for dismissal.” In re Samsung 3 Galaxy Smartphone Mktg. & Sales Pracs. Litig., No. 16-CV-06391-BLF, 2018 WL 1576457, at 4 *4 (N.D. Cal. Mar. 30, 2018) (quoting In re Nexus 6P Prod. Liab. Litig., 293 F. Supp. 3d 888 5 (N.D. Cal. 2018)); In re TFT–LCD (Flat Panel) Antitrust Litig., 781 F. Supp. 2d 955, 966 (N.D. 6 Cal. 2011) (“Several other courts in this district have similarly held that a plaintiff must specify 7 the state under which it brings an unjust enrichment claim.”). Plaintiffs acknowledge that the 8 elements for unjust enrichment in California and Illinois are not identical, Opp. at 17, and 9 indicated at the hearing that they could replead the claim under Illinois law. Accordingly, the 10 Court grants Google’s motion to dismiss Plaintiffs’ unjust enrichment claim with leave to amend. 11 D. Injunctive Relief 12 The parties do not dispute that Plaintiffs’ claim for injunctive relief is improperly pled as a 13 cause of action. See Mot. at 15; Reply at 10. The Court agrees with the parties and grants 14 Google’s motion to dismiss Plaintiffs’ claim for injunctive relief without leave to amend. See 15 Vance v. Amazon.com Inc., 525 F. Supp. 3d 1301, 1316 (W.D. Wash. 2021); Vance v. Microsoft 16 Corp., 525 F. Supp. 3d 1287, 1300 (W.D. Wash. 2021). 17 IV. ORDER 18 For the foregoing reasons, IT IS HEREBY ORDERED that: 19 1. Defendant’s motion to dismiss Plaintiffs’ first and second claims for violations of the 20 Illinois Biometric Privacy Act is GRANTED WITH LEAVE TO AMEND. 21 2. Defendant’s motion to dismiss Plaintiffs’ third claim for unjust enrichment is 22 GRANTED WITH LEAVE TO AMEND. 23 3. Defendant’s motion to dismiss Plaintiffs’ fourth claim for injunctive relief is 24 GRANTED WITHOUT LEAVE TO AMEND. 25 \\ 26 \\ 27 \\ 1 Any amended complaint shall be filed no later than 30 days from the entry of this order. 2 || Plaintiffs may only amend consistent with this order. No additional claims or parties may be 3 added without leave of the Court. Plaintiffs shall also file a redlined version of any amended 4 || complaint. 5 6 Dated: March 15, 2024 ’ BETH LABSON FREEMAN 8 United States District Judge 9 10 11 12

© 15 16

= 17

Z 18 19 20 21 22 23 24 25 26 27 28