Patel v. Facebook Inc.
290 F. Supp. 3d 948
N.D. Cal.2018Background
- Plaintiffs (Patel, Pezen, Licata) filed a consolidated putative class action under Illinois BIPA alleging Facebook’s "Tag Suggestions" used facial-recognition to create and store biometric face templates without written notice or consent.
- Plaintiffs allege violations of BIPA §§ 15(a) (retention/destruction policy) and 15(b) (written notice of collection, purpose, retention period, and written consent), and seek statutory damages, declaratory and injunctive relief.
- Facebook moved to dismiss under Rule 12(b)(1), arguing plaintiffs lack Article III standing because they allege no concrete injury as required by Spokeo v. Robins.
- The court framed the standing inquiry under Spokeo I/II and Ninth Circuit precedent: whether a statutory procedural-right violation can itself be a concrete injury and whether the alleged violation presents a material risk of harm to concrete interests.
- The court found BIPA expresses the Illinois legislature’s judgment that biometric data are uniquely sensitive and that unauthorized collection without notice/consent infringes a privacy interest—thus a procedural violation under BIPA can constitute a concrete injury.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Article III standing — is alleged BIPA procedural violation a "concrete" injury? | Violation of BIPA notice/consent provisions is a concrete injury because it deprives plaintiffs of control over uniquely sensitive biometric data. | Absent additional "real-world" harms (e.g., identity theft, employment effects, anxiety), mere procedural violations are insufficient under Spokeo. | Court: Denied dismissal. BIPA procedural violations here are concrete injuries given Illinois legislature’s judgment and privacy tradition; standing exists. |
| Role of state statute judgment in Spokeo analysis | Illinois legislature’s findings about biometric sensitivity render procedural protections sufficient to confer concrete injury. | State-law-created interests cannot override federal standing requirements; require additional harm. | Court: State legislative judgment is entitled to weight; state-law procedural rights can satisfy Spokeo where they protect concrete interests. |
| Whether extrinsic evidence (user agreements, policies) defeats standing at Rule 12(b)(1) stage | Plaintiffs: factual disputes about notice/consent go to the merits, not jurisdiction. | Facebook: submitted extrinsic materials asserting it provided adequate notice/consent, arguing no injury. | Court: Evidence raises merits questions; cannot resolve factual disputes on jurisdictional motion—decide on summary judgment/trial. |
| Applicability of Spokeo II / FCRA analogies | BIPA protects against initial unauthorized collection, unlike FCRA reporting inaccuracies; thus Spokeo II FCRA concerns are inapposite. | Facebook: Spokeo II suggests procedural violations that do not cause real-world harm may not be concrete. | Court: Distinguishes Spokeo II and FCRA; BIPA targets unauthorized collection and is rooted in privacy tradition—supports standing. |
Key Cases Cited
- Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016) (procedural statutory violations may be concrete injuries in some circumstances)
- Lujan v. Defenders of Wildlife, 504 U.S. 555 (1992) (standing: injury in fact must be concrete and particularized)
- Safe Air for Everyone v. Meyer, 373 F.3d 1035 (9th Cir. 2004) (distinguishes facial vs. factual Rule 12(b)(1) attacks)
- Robins v. Spokeo, Inc., 867 F.3d 1108 (9th Cir. 2017) (Spokeo II: state-law procedural rights can support standing where statute protects concrete interests and violation presents real risk of harm)
- Cantrell v. City of Long Beach, 241 F.3d 674 (9th Cir. 2001) (state law can create interests supporting federal standing in diversity cases)
- Eichenberger v. ESPN, Inc., 876 F.3d 979 (9th Cir. 2017) (privacy torts can be concrete injuries absent additional consequences)
- Syed v. M-I, LLC, 853 F.3d 492 (9th Cir. 2017) (loss of statutory procedural right can be concrete injury)
- In re Facebook Internet Tracking Litig., 263 F. Supp. 3d 836 (N.D. Cal. 2017) (unauthorized tracking found to be a concrete injury)
- Gubala v. Time Warner Cable, Inc., 846 F.3d 909 (7th Cir. 2017) (distinguishing contexts where retained personal identifiers did not produce standing)