Vance v. Microsoft Corporation

Opinion

UNITED STATES DISTRICT COURT WESTERN DISTRICT OF WASHINGTON AT SEATTLE

STEVEN VANCE, et al., CASE NO. C20-1082JLR Plaintiffs, ORDER GRANTING IN PART v. AND DENYING IN PART REMAINDER OF MICROSOFT’S MOTION TO DISMISS MICROSOFT CORPORATION, Defendant.

Before the court are two remaining portions of Defendant Microsoft Corporation’s (“Microsoft”) motion to dismiss. (See MTD (Dkt. #25).) Plaintiffs Steven Vance and Tim Janecyk (collectively, “Plaintiffs”) oppose Microsoft’s motion. (Resp. (Dkt. # 37).) At the direction of the court, both parties filed supplemental briefs to address (1) the interpretation of “otherwise profit from” in § 15(c) of Illinois’s Biometric Information Privacy Act, 740 ILCS 14/1, et seq. (“BIPA”); and (2) whether Washington or Illinois law should govern Plaintiffs’ unjust enrichment claim. (Pls. Supp. Br. (Dkt. # 45); Def. Supp. Br. (Dkt. # 44); 3/15/21 Order (Dkt. # 43) at 24.) The court has considered the motion, the supplemental briefing, the relevant portions of the record, and the applicable law. The court additionally held oral arguments on April 13, 2021. (See 4/13/21 Min.

Entry (Dkt. # 46).) Being fully advised, the court GRANTS in part and DENIES in part the motion to dismiss. The court discussed the factual and procedural backgrounds of this case in its previous order on the other portions of Microsoft’s motion to dismiss. (See 3/15/21 Order

at 2-5.) Thus, it only summarizes here the facts most relevant to the remaining portions of the motion.1 Plaintiffs are Illinois residents who uploaded photos of themselves to the photo-sharing website Flickr. (Compl. (Dkt. # 1) ¶¶ 6-7, 28, 60-61, 69.) Both were in Illinois when uploading the photos. (Id. ¶¶ 60, 69.) Unbeknownst to them, Flickr,

through its parent company Yahoo!, compiled their photos along with hundreds of millions of other photographs posted on the platform into a dataset (“Flickr dataset”) that it made publicly available for those developing facial recognition technology. (Id. ¶¶ 29-32.) International Business Machines Corporation (“IBM”) created facial scans from the photographs in the Flickr dataset to create a new dataset called Diversity in

Faces, which contained facial scans of Plaintiffs and other Illinois residents. (Id. //

1 For the purposes of a motion to dismiss, the court accepts all well-pleaded allegations in Plaintiffs’ complaint as true and draws all reasonable inferences in favor of Plaintiffs. See Wyler Summit P’ship v. Turner Broad. Sys., Inc., 135 F.3d 658, 661 (9th Cir. 1998). ¶¶ 40-41.) Microsoft obtained the Diversity in Faces dataset, including Plaintiffs’ facial scans, from IBM. (Id. ¶¶ 55-56.) No company in this chain of events—Flickr, Yahoo!, IBM, or Microsoft—informed or obtained permission from Plaintiffs for the use of their

photographs or facial scans. (Id. ¶¶ 30, 45, 65-66, 73-74.) Microsoft used the Diversity in Faces dataset to improve “the fairness and accuracy of its facial recognition products,” which “improve[d] the effectiveness of its facial recognition technology on a diverse array of faces” and in turn made those products “more valuable in the commercial marketplace.” (Id. ¶¶ 57-58.) Microsoft’s facial

recognition products include its Cognitive Service Face Application Program Interface and its Face Artificial Intelligence service that “allowed customers to embed facial recognition into their apps without having to have any machine learning expertise.” (Id. ¶ 53.) Microsoft additionally conducts “extensive business within Illinois” related to facial recognition, including selling its facial recognition products through an

Illinois-based vendor; working with an Illinois-based business to build new applications for facial recognition technology; and working with Illinois entities to build a “‘digital transformation institute’ that accelerates the use of artificial intelligence throughout society.” (Id. ¶ 59.) Plaintiffs assert various claims in their class action suit against Microsoft. (See

generally id.) Relevant here are two of those claims: (1) violation of § 15(c) of BIPA (id. ¶¶ 100-06); and (2) unjust enrichment (id. ¶¶ 107-16).2 The court in its March 15, 2021,

2 Microsoft also challenged Plaintiffs’ other claims, and the court resolved those challenges in its previous order. (See 3/15/21 Order at 6-19, 23.) order found that additional briefing from the parties would be beneficial, as neither party meaningfully analyzed critical legal questions behind both claims in their original briefing. (3/15/21 Order at 20, 22-23.) Specifically, the court ordered the parties to file

supplemental briefing on (1) “the definition of ‘otherwise profit from’ in the context of § 15(c)”; and (2) “which state law should govern [Plaintiffs’ unjust enrichment claim] under Washington’s ‘most significant relationship’ test.” (Id.) The parties subsequently filed their supplemental briefing. (See Pls. Supp. Br.; Def. Supp. Br.)

When considering a motion to dismiss under Rule 12(b)(6), the court construes the complaint in the light most favorable to the nonmoving party. Livid Holdings Ltd. v. Salomon Smith Barney, Inc., 416 F.3d 940, 946 (9th Cir. 2005). The court must accept all well-pleaded facts as true and draw all reasonable inferences in favor of the plaintiff. Wyler Summit P’ship, 135 F.3d at 661. The court, however, is not required “to accept as

true allegations that are merely conclusory, unwarranted deductions of fact, or unreasonable inferences.” Sprewell v. Golden State Warriors, 266 F.3d 979, 988 (9th Cir. 2001). “To survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544,

570 (2007)); see also Telesaurus VPC, LLC v. Power, 623 F.3d 998, 1003 (9th Cir. 2010). “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Iqbal, 556 U.S. at 677-78. Dismissal under Rule 12(b)(6) can be based on the lack of a cognizable legal theory or the absence of sufficient facts alleged under a cognizable legal theory. Balistreri v. Pacifica Police Dep’t, 901 F.2d 696, 699 (9th Cir. 1990). Utilizing this standard, the court addresses the BIPA § 15(c) and unjust

enrichment claims in turn. A. Profit Under BIPA § 15(c) Section 15(c) states that “[n]o private entity in possession of a biometric identifier or biometric information may sell, lease, trade, or otherwise profit from a person’s or a customer’s biometric identifier or biometric information.” 740 ILCS 14/15(c). The

parties disagree on how broadly to read “otherwise profit from.” Microsoft argues that “otherwise profit” requires “an entity receiving a pecuniary benefit in exchange for a person’s biometric data.” (MTD at 22; Def. Supp. Br. at 1.) Plaintiffs propose that “otherwise profit” means any use of biometric data that generates profits. (Resp. at 21; Pls. Supp. Br. at 3-4.) The court finds that the proper interpretation of §15(c) falls

somewhere in between the two parties’ proposals. The court begins, as it must, with the statutory language. See Lacey v. Village of Palatine, 904 N.E.2d 18, 26 (Ill. 2009). “Profit” as a verb means “to be of service or advantage” or “to derive benefit.” Profit, Merriam-Webster.com, https://www.merriam- webster.com/dictionary/profit (last accessed Apr. 1, 2021); see also Profit, Oxford

English Dictionary, https://www.oed.com/view/Entry/152098 (last accessed Apr. 1, 2021) (defining “profit” as “[t]o be of advantage or benefit to”). “Otherwise” means “[i]n a different manner; in another way, or in other ways.” Black’s Law Dictionary 1101 (6th ed. 1990). Thus, in the context of § 15(c), sale, lease or trade are examples of what the Illinois legislature had in mind as ways to derive benefit from biometric data, but the statute leaves room for other ways resembling those examples to gain an advantage.

When a statute, like § 15(c), “specifically describes several classes of persons or things and then includes ‘other persons or things,’ the word ‘other’ is interpreted to mean ‘other such like.’” Pooh-Bah Enters., Inc. v. Cnty. of Cook, 905 N.E.2d 781, 799 (Ill. 2009); Circuit City Stores, Inc. v. Adams, 532 U.S. 105, 115 (2001) (discussing how general terms that follow more specific terms “embrace only objects similar in nature to

those objects enumerated by the preceding specific words”). This “cardinal rule of statutory construction” is known as ejusdem generis, and it is a “common drafting technique” to save the legislature “from spelling out in advance every contingency in which the statute could apply.”3 Pooh-Bah Enters., 905 N.E.2d at 799 (quoting 2A N. Singer & J. Singer, Sutherland on Statutory Construction § 47:17, at 370-73 (7th ed.

2007)) (internal quotation marks omitted). Thus, the general catchall is not “given [its] full and ordinary meaning” because to do so would render the specific words superfluous. Id.; see also id. (“If the legislature had meant the general words to have their unrestricted sense, it would not have used the specific words.”). Accordingly, applied to § 15(c), “otherwise profit” should be interpreted in light of

the terms that precede it: sell, lease and trade. See 740 ILCS 14/15(c). All three of these

3 Contrary to Plaintiffs’ contention, ejusdem generis applies equally to verbs. (See Resp. at 22.) Courts have applied this canon to actions as well as persons or things. See, e.g., Epic Sys. Corp. v. Lewis, 138 S. Ct. 1612, 1625 (2018) (applying ejusdem generis canon to “form[ing], join[ing], or assist[ing] labor organizations”); (Reply (Dkt. # 34) at 10-11.) terms contemplate a transaction in which an item is given or shared in exchange for something of value. See Sell, Merriam-Webster.com, https://www.merriam- webster.com/dictionary/sell (last accessed Mar. 31, 2021) (defining “sell” as “to give

up . . . to another for something of value”); Lease, Oxford English Dictionary, https://www.oed.com/view/Entry/106734 (last accessed Mar. 31, 2021) (defining “lease” as “[t]o grant the possession or use of (lands, etc.) by a lease”); Trade, Oxford English Dictionary, https://www.oed.com/view/Entry/204275 (last accessed Mar. 31, 2021) (defining “trade” as “[t]o exchange (goods, commodities, etc.) on a commercial basis; to

cause to change hands”). Similarly then, while “profit” may have a broader “ordinary meaning,” see Pooh-Bah Enters., 905 N.E. 2d at 799, in the context of the enumerated terms, “otherwise profit” encompasses commercial transactions—such as a sale, lease or trade—during which the biometric data is transferred or shared in return for some benefit. Thus, § 15(c) regulates transactions with two components: (1) access to biometric

data is shared or given to another; and (2) in return for that access, the entity receives something of value. As to the first component, the biometric data itself may be the product of the transaction, such as in a direct sale. Or the biometric data may be so integrated into a product that consumers necessarily gain access to biometric data by using the product or service. As to the second component, the court disagrees with

Microsoft’s contention that the biometric data must be provided “in exchange for money.” (See MTD at 22.) Not all the enumerated examples involve monetary benefits. For instance, one could trade for something of value that is not money. Thus, it does not follow that “otherwise profit” must also be limited to a pecuniary benefit. Section 15(c) prohibits the commercial dissemination of biometric data for some sort of gain, whether pecuniary or not. This reading of § 15(c) aligns with the legislative intent expressed in BIPA. See

740 ILCS 14/5. BIPA was designed to “regulate and promote, not inhibit,” the use of biometric technology. See Vigil v. Take-Two Interactive Software, Inc., 235 F. Supp. 3d 499, 512 n.9 (S.D.N.Y. 2017). The legislature recognized the benefits of using biometrics but understood that if biometrics are “compromised, the individual has no recourse, is at heightened risk for identity theft, and is likely to withdraw from biometric

facilitated transactions.” 740 ILCS 14/5(a), (c). To counteract that public “wear[iness]” and to encourage those who may be “deterred from partaking in biometric identifier-facilitated transactions,” the legislature enacted BIPA’s additional regulations. Id. 14/5(d)-(e), (g). Thus, BIPA was not intended to stop all use of biometric technology; instead, it set a standard for the safe collection, use, and storage of biometrics, including

protecting against the public’s main fear that their biometric data would be widely disseminated. Section 15(c) achieves that goal by prohibiting a market in the transfer of biometric data, whether through a direct exchange—sale, lease or trade—or some other transaction where the product is comprised of biometric data. To that end, Plaintiffs are correct that BIPA, and § 15(c) in particular, aims to

“eliminate the incentive” behind marketing biometric data. (See Pls. Supp. Br. at 2-3 (citing Thornley v. Clearview AI, Inc., 984 F.3d 1241, 1247 (7th Cir. 2021) (analyzing standing under § 15(c)).) But Plaintiffs’ argument goes astray when it assumes that BIPA sought “to eliminate the incentive for private entities to collect, possess or disseminate biometrics” in any fashion. (Id. at 2.) Not so, as BIPA’s legislative intent makes clear. See 740 ILCS 14/5(a). Instead, BIPA sought to control the unauthorized collection, possession or dissemination of biometric data, and § 15(c) operates to remove one main

incentive of sharing biometric data—to exchange it for some benefit.4 Indeed, Plaintiffs’ reading of § 15(c)—prohibition of any use of biometric data that brings a benefit—would lead to absurd results that contravene BIPA itself. As acknowledged by Plaintiffs in oral argument, § 15(c) is a flat-out prohibition. See 740 ILCS 14/15(c). In other words, unlike the collection, possession or dissemination of

biometric data, no private entity may “otherwise profit” from biometric data even if they inform and obtain permission from the subject. Compare, e.g., 740 ILCS 14/15(d) (allowing dissemination of biometric data with consent from subject), with 740 ILCS 14/15(c) (containing no exceptions). Taken to its logical end, Plaintiffs’ reading of § 15(c) would prohibit the sale of any product containing biometric technology because

any such feature had to be developed or built with biometric data. (See Compl. ¶¶ 15, 24-25 (describing how all facial recognition technology utilizes biometric data).) For instance, a company could not sell biometric timekeeping systems—or any product with a biometric feature—because it was presumably developed using biometric data. //

4 Although dicta, Thornley makes clear that it interpreted § 15(c) to “prohibit[] the operation of a market in biometric [data],” not all technology based on biometric data. 984 F.3d at 1247. Analogizing to other laws such as those prohibiting the sale of migratory birds, the Seventh Circuit recognized that these laws aim to “eliminate the market for such material.” Id. In other words, the law removes an incentive behind the dissemination of these materials to control the spread of that material. The same holds true here. By prohibiting for-profit transactions involving biometric data, BIPA aims to control the spread of biometric data. Similarly, no company could use that biometric timekeeping system because it uses employees’ biometric data to streamline operations and decrease costs. Nothing—not BIPA’s statutory language, its stated intent, or any authority analyzing § 15(c)—supports

such a broad reading.5 At oral argument, Plaintiffs relied on the exemptions laid out in § 25 of BIPA as a limiting principle, but that section does not resolve the absurdity discussed above. Section 25 provides limited scenarios that are exempt from BIPA. See 740 ILCS § 14/25. For instance, the act shall not apply “to a financial institution or an affiliate of a financial

institution that is subject to Title V of the federal Gramm-Leach Bliley Act of 1999” or to “a contractor, subcontractor, or agency of a State agency or local unit of government when working for that [entity].” Id. 14/25(c), (e). But this provision does not reach the scenarios discussed above, where a private entity necessarily uses biometric data—even if lawfully obtained—to develop biometric technology. Nor does § 25 alter the intent

expressed in § 5 that BIPA did not intend to stop all use of biometric technology, especially those that BIPA recognized as potentially beneficial. See 740 ILCS 14/5. Adopting Plaintiffs’ reading would do just that. //

// 5 Courts that have opined on the scope of § 15(c) in the context of standing have generally rejected such a broad reading. For instance, in Hazlitt v. Apple Inc., --- F.3d ----, 2020 WL 6681374 (S.D. Ill. 2020), the court noted that “by its plain language,” § 15(c) does not prohibit “the general sales of devices equipped with facial recognition technology.” Id. at *7. Similarly, in Vigil, the court explained that “otherwise profiting” is best read as “a catchall for prohibiting commercially transferring biometric [data],” which does not reach the sale of a product with a biometric-related feature. 235 F. Supp. 3d at 512 n.9. Reading § 15(c) to prohibit for-profit transactions of biometric data also comports with the one court to have analyzed § 15(c)’s reach. In Flores v. Motorola Solutions, Inc., No. 1:20-cv-01128, 2021 WL 232627 (N.D. Ill. Jan. 8, 2021), plaintiffs alleged that

the defendant used biometric data to develop a database that allowed customers to search for facial matches. Id. at *3. Thus, using the product—“compar[ing] novel images to the database images to find facial matches”—necessarily allowed customers to gain access to the underlying biometric data. See id. In other words, without the identified biometric data, there would be no product to speak of. See id. Concluding that “biometric data is a

necessary element to Defendant’s business model,” the court declined to say that this activity does not constitute “otherwise profiting from” biometric data. Id. Flores illustrates one example of how a company could “otherwise profit” from biometric data without directly selling it: by creating technology that is so intertwined with the biometric data that marketing the technology is essentially disseminating biometric data for profit.

Applied here, Plaintiffs have not alleged that Microsoft “otherwise profited” from their biometric data as that term is used in § 15(c). Plaintiffs allege that Microsoft used the biometric data to “improve its facial recognition products and technologies,” which “improve[d] the effectiveness” of those products and made them “more valuable in the commercial marketplace.” (Compl. ¶ 58.) While these allegations support the inference

that Microsoft may have received some benefit from increased sales of its improved products, these allegations do not establish that Microsoft disseminated or shared access to biometric data through its products. Plaintiffs do not allege that Microsoft directly sold biometric data. (See id.) And unlike in Flores, they have not alleged that the biometric data is itself so incorporated into Microsoft’s product that by marketing the product, it is commercially disseminating the biometric data. (See id.); see 2021 WL 232627, at *3. Because Plaintiffs’ factual allegations do not allow the court to reasonably

infer that Microsoft is sharing access to the biometric data, the court dismisses their claim under § 15(c) without prejudice and with leave to amend. B. Unjust Enrichment As the court articulated in its previous order, Microsoft challenges Plaintiffs’ unjust enrichment claim as insufficiently pleaded under Washington law, but Plaintiffs

maintain that the claim is sufficiently pleaded under Illinois law. (3/15/21 Order at 20-21.) The court concluded that under step one of Washington’s two-step approach to choice-of-law questions, an actual conflict between Washington and Illinois law exists over whether Plaintiffs must plead that they suffered an economic expense distinct from a privacy harm. (Id. at 21.) Because an actual conflict exists, the court must, at step two,

determine which state has the “most significant relationship” to the instant claim. (Id. at 22.) Washington’s “most significant relationship” test also consists of two steps. Coe v. Philips Oral Healthcare Inc., No. C13-0518MJP, 2014 WL 5162912, at *3 (W.D. Wash. Oct. 14, 2014). First, the court considers the states’ relevant contacts to the cause of action. Johnson v. Spider Staging Corp., 555 P.2d 997, 1000-01 (Wash. 1976). Second,

if those contacts are evenly balanced, the court considers “the interests and public policies of [the two] states and . . . the manner and extent of such policies as they relate to the transaction in issue.” Id. at 1001. // At the outset, the parties disagree on which contacts should guide the analysis. Microsoft argues that Restatement § 221 governs restitution claims, such as Plaintiffs’ unjust enrichment claim. (Def. Supp. Br. at 6.) Plaintiffs urge for application of

Restatement § 152, which governs invasion of privacy claims, or alternatively, Restatement § 145, which applies generally to torts. (Pls. Supp. Br. at 7.) The court determines that § 221 is most applicable here. The commentary to § 221 plainly states that it “applies to claims, which are based neither on contract nor on tort, to recover for unjust enrichment.” Restatement (Second) of Law on Conflict of Laws § 221(1) cmt. a.

Although Plaintiffs are correct that the underlying issues involve privacy, Plaintiffs do not, as in their cited authority, bring an invasion of privacy tort claim. (See Pls. Supp. Br. at 8); see, e.g., Cooper v. Am. Exp. Co., 593 F.2d 612, 612 (5th Cir. 1979) (invasion of privacy claim); York Grp. Inc. v. Pontone, No. 10-cv-1078, 2014 WL 896632, at *33 (W.D. Pa. Mar. 6, 2014) (tortious surveillance claim). Indeed, Plaintiffs provide no

authority applying §§ 152 or 145 to an unjust enrichment claim. (See Pls. Supp. Br.) Restatement § 221 provides that: In actions for restitution, the rights and liabilities of the parties with respect to the particular issue are determined by the local law of the state which, with respect to that issue, has the most significant relationship to the occurrence and the parties under the principles stated in § 6. Restatement (Second) of Law on Conflict of Laws § 221(1). Section 6, in turn, identifies the following principles as relevant to the choice-of-law analysis: (a) The needs of the interstate and international systems, (b) The relevant policies of the forum, (c) The relevant policies of other interested states and the relative interests of those states in the determination of the particular issue, (d) The protection of justified expectations, (e) The basic policies underlying the particular field of law, (f) Certainty, predictability and uniformity of result, and (g) Ease in the determination and application of the law to be applied. Restatement (Second) of Law on Conflict of Laws § 6(2). In applying these principles of § 6, the following contacts should be taken into account: (a) The place where a relationship between the parties was centered, provided that the receipt of enrichment was substantially related to the relationship, (b) The place where the benefit or enrichment was received, (c) The place where the act conferring the benefit or enrichment was done, (d) The domicil, residence, nationality, place of incorporation and place of business of the parties, and (e) The place where a physical thing, such as land or a chattel, which was substantially related to the enrichment, was situated at the time of the enrichment. Restatement (Second) of Law on Conflict of Laws § 221(2). The court’s approach is not merely to count contacts but rather to consider which contacts are the most significant and where those contacts are found. Johnson, 555 P.2d at 1000. Three of these contacts identified by § 221 are neutral in the unique circumstances presented by this case and thus have little bearing on the court’s choice-of-law analysis. The parties’ relationship is not centered in any one place, as Plaintiffs did not directly interact with Microsoft or its products.6 (See Compl. ¶¶ 60-63; 68-71); see Veridian Credit Union v. Eddie Bauer, LLC, 295 F. Supp. 3d 1140, 1154 (W.D. Wash. 2017) 6 The enrichment Microsoft allegedly received was unjust specifically because of the lack of relationship with Plaintiffs, as the unjustness stems from the lack of consent from Plaintiffs in Illinois. Thus, it is unclear whether this first factor, which is identified as the contact “given the greatest weight,” would ever be applicable in cases such as these. See Restatement (Second) of Law on Conflict of Laws § 221(2) cmt. d. (finding this factor to bear “little, if any, weight” when parties did not contract with one another). Second, there is no “physical thing, such as land or a chattel,” related to the enrichment. Restatement (Second) of Law on Conflict of Laws § 221(2)(e). Instead,

Plaintiffs’ allegations revolve around the benefits obtained from intangible notions of biometric data and facial recognition technology. Thus, this factor, too, is neutral. Lastly, the place where the benefit was received is also neutral. Microsoft is based in Washington and thus would have received benefits in Washington from increased product sales. (Compl. ¶ 8; see Def. Supp. Br. at 7.) However, Plaintiffs also allege that

Microsoft “conducted extensive business within Illinois related to the facial recognition products it unlawfully developed” and thus allows the reasonable inference that Microsoft received benefits in Illinois as well. (Compl. ¶ 59.) Indeed, Microsoft self-proclaims that it “work[s] with customers around the world” and “play[s] a leading role in developing facial recognition technology” and thus presumably may receive

benefit in many places due to its improved facial recognition products. (See id. ¶ 54 n.15 (citing Brad Smith, Facial Recognition: It’s Time for Action, Microsoft on the Issues (Dec. 6, 2018)).) Thus, although usually of greatest importance when there is no relationship between the parties, this factor also does not weigh strongly in favor of one state over another. See Restatement (Second) of Law on Conflict of Laws § 221(2)(d)

(assigning this factor “little or no weight” when place where benefit was received “bears little relation to the occurrence . . . or where this place cannot be identified”). The two remaining factors lean towards application of Illinois law. The place where the act conferring the benefit occurred will be given “[p]articular weight” if it differs from the place where the benefit was received or if the place where the benefit was received cannot be identified. Restatement (Second) of Law on Conflict of Laws § 221(2) cmt. d. Plaintiffs conferred the benefit in Illinois, as they and all putative class

members are Illinois residents who uploaded Illinois-created content in Illinois. (Compl. ¶¶ 6-7, 60-62, 68-70, 77.) Although there are other acts in the chain of events leading to Microsoft benefiting off of Plaintiffs’ biometric data, including actions Microsoft allegedly took itself (see Def. Supp. Br. at 7), the core of the benefit lies in Plaintiffs providing images of their faces—albeit unknowingly—that ultimately improved

Microsoft’s products. (See Compl. ¶¶ 57-59, 108-12.) Thus, this factor, which is assigned particular weight given the neutrality of the place where the benefit was received, counsels application of Illinois law. See Restatement (Second) of Law on Conflict of Laws § 221(2) cmt. d. Moreover, the domicil and place of business of the parties tip towards Illinois.

Although Microsoft is headquartered in Washington (id. ¶¶ 8-9), “[t]he fact that one of the parties is domiciled in a particular state is of little significance” alone, see Veridian, 295 F. Supp. 3d at 1154; see also Restatement (Second) of Law on Conflict of Laws § 221(2) cmt. d (“The fact . . . that one of the parties is domiciled . . . in a given state will usually carry little weight of itself.”). Instead, the importance of these locations “depends

largely upon the extent to which they are grouped with other contacts.” Restatement (Second) of Law on Conflict of Laws § 221(2) cmt. d. Here, several contacts are grouped in Illinois: Plaintiffs are domiciled there, the benefiting act (the sharing of facial images) was done there, and Microsoft conducts business there related to the enrichment at issue. See id. (“The state where these contacts are grouped is particularly likely to be the state of the applicable law if . . . the benefiting act was done there.”); (Compl. ¶¶ 6-7, 58-63, 68-71.) Aside from Microsoft’s headquarters, the allegations largely do not concern

Washington. (See Compl.) Accordingly, this factor favors application of Illinois law. In sum, and in light of the guidance that the court is to evaluate these contacts with respect to the particular issues presented, the court concludes that Illinois has the most significant relationship to this occurrence. See Restatement (Second) of Law on Conflict of Laws § 221. Of particular significance is the place of the benefiting act and the

grouping of Plaintiffs’ domicile, residence and Microsoft’s business in that place: Illinois. See id.; (Compl. ¶¶ 6-7, 58-63, 68-71.) The remaining contacts are neutral or carry little weight to the court’s analysis. The conclusion that Illinois has the most significant relationship here is bolstered by consideration of the underlying principles of § 6. First, the consideration of the two

states’ relevant policies leans towards Illinois. See Restatement (Second) of Law on Conflict of Laws § 6(b)-(c). While Microsoft is correct that Washington has its own biometrics statute that differs from BIPA (see Def. Supp. Br. at 8-9), that difference in itself encourages the application of Illinois law for Plaintiffs and a putative class who are all Illinois residents. Illinois made clear through BIPA that it has substantial interest in

protecting its residents’ biometric data, even if the harm is inflicted by an out-of-state corporation. See In re Facebook Biometric Info. Privacy Litig., 185 F. Supp. 3d 1155, 1169-70 (N.D. Cal. 2016). Indeed, Illinois’s recognition of both the role of major national corporations as well as the unknown nature of the full ramifications of biometric technology underscores Illinois’s great interest in protecting its citizenry against a multitude of harms stemming from a privacy violation, including if a corporation unjustly enriches itself off of Illinois residents’ biometric data. See 740 ILCS 14/5(b), (f).

Washington’s interest, on the other hand, is relatively insignificant in comparison, as illustrated by the lack of Washington’s connection to the majority of substantive allegations in Plaintiffs’ complaint. See McNamara v. Hallinan, No. 2:17-cv-02967- GMN-BNW, 2019 WL 4752265, at *6 (D. Nev. Sept. 30, 2019) (finding state’s lack of significance to substantive allegations suggests that its public policy interest is minimal).

Certainty, predictability and uniformity of result, as well as the ease in the determination of the law to be applied, tip towards Illinois as well. See Restatement (Second) of Law on Conflict of Laws § 6(f)-(g). In cases involving privacy, the Restatement recognizes that both these values are furthered by choosing the state where the invasion of privacy occurred, as that location “will usually be readily ascertainable.”

Cf. Restatement (Second) of Law on Conflicts of Law § 152 cmt. b (analyzing § 6 principles). That is especially true here, as this court and others have opined on the difficulty of pinpointing where events occurred in BIPA cases. (See 3/15/21 Order at 6-7); see, e.g., Rivera v. Google Inc., 238 F. Supp. 3d 1088, 1101-02 (N.D. Ill. 2017). Moreover, uniformity concerns for the multitude of cases brought by Illinois residents

across the country again counsel application of Illinois law. See Vance v. IBM Corp., No. 20 C 577, 2020 WL 5530134, at *5 (N.D. Ill. Sept. 15, 2020) (“IBM”) (applying Illinois law to IBM’s actions). // Microsoft relies largely on protection of its justified expectations that Washington’s biometrics law would apply, “not a far-flung state’s law.” (Def. Supp. Br. at 9.) But in restitution cases, the protection of justified expectations “plays a less

important role in the choice-of-law process with respect to some of the areas covered by the field of restitution” because “the purpose of restitution is to do justice to the parties after an event whose occurrence one of the parties, at least, will usually not have foreseen.” Restatement (Second) of Law on Conflict of Laws § 221(1) cmt. b. Even if justified expectations carried greater importance, Microsoft’s expectation of relying on

Washington law when it is a national corporation and does extensive business in other states, including Illinois, is outweighed by Illinois residents’ justified expectation that their state’s laws will protect their privacy interests, especially as their relevant actions do not reach into Washington. (See Compl. ¶¶ 54, 59, 60-63, 69-72.) Thus, this principle does not dictate the application of Washington law.

Assuming, arguendo, that the foregoing contacts were evenly balanced, the court would still apply Illinois law under the second step of Washington’s choice-of-law analysis. “If the contacts are evenly balanced, the second step of the analysis involves an evaluation of the interests and public policies of the concerned states to determine which state has the greater interest in determination of the particular issue.” Zenaida-Garcia v.

Recovery Sys. Tech., 115 P.3d 1017, 1020 (Wash. 2005). This second step “turns on the purpose of the law and the issues involved.” Veridian, 295 F. Supp. 3d at 1155. As discussed above, Illinois has the “paramount interest” in applying its law here. Application of its unjust enrichment law, which recognizes privacy harms, aligns with and strengthens Illinois’s general regulatory scheme regarding privacy interests. See IBM, 2020 WL 5530134, at *5. Although applying Washington unjust enrichment law would not cause Illinois to suffer “a complete negation of its biometric privacy

protections,” the court concludes that applying Washington law would cause Illinois to suffer greater impairment of its policies than if the other state’s law is applied. See In re Facebook, 185 F. Supp. 3d at 1170. Having determined that Illinois law applies to Plaintiffs’ unjust enrichment claim, the remainder of the analysis becomes straightforward. As the court previously

articulated, under Illinois law, “the assertion that plaintiffs are ‘exposed to a heightened risk of privacy harm’ and ‘have been deprived of their control over their biometric data’ sufficiently states an unjust enrichment claim.” (3/15/21 Order at 21-22 (quoting IBM, 2020 WL 5530134, at *5).) Because Plaintiffs have so pleaded (see Compl. ¶ 108), they have sufficiently stated a claim for unjust enrichment under Illinois law.7

In sum, the court determines that Illinois has the most significant relationship with the occurrence here under both the contacts analysis laid out in Restatement § 221 and the general principles listed in § 6. Moreover, even if the contacts were balanced, Illinois has the greater interest in determining this particular issue. Applying Illinois law, //

7 Microsoft makes two additional arguments for dismissal: (1) that the unjust enrichment claim must be dismissed because the BIPA claims should be dismissed; and (2) that unjust enrichment is not available as Plaintiffs have a statutory remedy. The court does not address the first argument because at least one of Plaintiffs’ BIPA claims survive. (See 3/15/21 Order.) As for the second argument, Plaintiffs may set forth an unjust enrichment claim alternatively, and thus dismissal is not warranted. See Fed. R. Civ. P. 8(e)(2); Quadion Corp. v Mache, 738 F. Supp. 270, 278 (N.D. Ill. 1990). Plaintiffs have sufficiently pleaded their unjust enrichment claim, and Microsoft’s remaining arguments are unavailing. Thus, the court denies Microsoft’s motion to dismiss Plaintiffs’ unjust enrichment claim.

For the foregoing reasons, the court GRANTS in part and DENIES in part the remainder of Microsoft’s motion to dismiss (Dkt. # 25). Specifically, Plaintiffs’ BIPA § 15(c) is dismissed with leave to amend. Plaintiffs shall file an amended complaint, if any, alleging facts that resolve the issues stated herein, no later than 14 days from the

filing date of this order. Dated this 14th day of April, 2021. A United States District Judge