593 F.Supp.3d 783
N.D. Ill.2022Background
- Plaintiffs are Illinois students who took remote, proctored exams using Respondus Monitor; the software uses webcams/microphones to perform a facial-detection check, environment check, may record ID, and allegedly creates scans of facial geometry (and voiceprints) that flow into a school-accessible Review Priority portal.
- Plaintiffs sued Respondus (and Lewis University in Patterson) asserting violations of the Illinois Biometric Information Privacy Act (BIPA) §§15(a) (retention/destruction policy), 15(b) (written informed consent), 15(c) (profit prohibition), and 15(d) (disclosure prohibition); these are putative class actions removed under CAFA.
- Key factual / evidentiary disputes: which Respondus website documents may be considered on Rule 12(b)(6); whether the Student Terms’ Washington choice-of-law clause binds plaintiffs; and whether webcam/video-derived data qualifies as BIPA biometric data.
- The court treated the Student Terms and Privacy Policy attached to Patterson and Wu as part of those complaints but refused to consider additional Respondus webpages submitted later; it did not consider any exhibits in Veiga.
- Rulings summarized below: court applied Illinois law, found plaintiffs stated claims under §15(b) and §15(d) against Respondus and §15(b) against Lewis; remanded or dismissed without prejudice several claims for lack of Article III standing (notably §15(a) publication claims and §15(c) profit claims) and dismissed Lewis §15(d) claim for failure to plead an actual disclosure.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held | |
|---|---|---|---|---|
| Incorporation-by-reference of Respondus webpages | Plaintiffs relied on Student Terms and Privacy Policy only | Respondus asked court to consider additional later website pages linked from Privacy Policy | Court limited consideration to exhibits actually attached to each complaint; declined to consider Respondus’s post-filing webpages for Patterson/Wu and considered none in Veiga | |
| Choice-of-law clause (Student Terms: Washington law) | Plaintiffs argued clause unenforceable (procedural unconscionability) and contrary to Illinois public policy | Respondus argued plaintiffs assented and Washington law governs, which would defeat BIPA claims | Court declined to enforce clause as procedurally unconscionable (adhesion, presented as condition to take exam) and because enforcing it would undermine Illinois public policy in protecting biometric privacy | |
| Standing for §15(a) (publication vs. unlawful retention) | Plaintiffs alleged no unlawful retention beyond statutory limits but alleged inadequate public policies | Plaintiffs claim violation of §15(a) publication and noncompliance | Respondus contended website showed a retention policy; Plaintiffs deny adequate disclosure | Court: no Article III standing for §15(a) publication-only claims (Bryant); remanded Patterson and Veiga §15(a) claims and dismissed Wu §15(a) claim without prejudice because plaintiffs did not allege unlawful retention beyond the statutory limits |
| Sufficiency of §15(b) informed-consent claims against Respondus | Plaintiffs alleged Respondus did not inform or obtain written consent for biometric collection | Respondus argued Student Terms (and other pages) disclosed the data collection and purposes | Court: Student Terms did not adequately disclose collection of biometric identifiers or biometric information as defined by BIPA; §15(b) claims against Respondus survived | |
| Standing for §15(c) profit prohibition | Plaintiffs alleged Respondus and Lewis "otherwise profit" from biometric data by licensing/marketing Respondus Monitor | Defendants argued §15(c) targets direct-for-profit transfers and that plaintiffs allege only generalized regulatory violations | Court: §15(c) allegations as pleaded were generalized and did not show concrete, particularized injury — no Article III standing; remanded Patterson §15(c) (Respondus) and dismissed Wu §15(c) without prejudice; remanded Patterson §15(c) as to Lewis | |
| Sufficiency of §15(d) unlawful-disclosure claims | Plaintiffs alleged Respondus disclosed biometric data to institutions and third parties without consent | Respondus argued Student Terms put students on notice and obtained consent | Court: because Student Terms did not disclose biometric collection, plaintiffs could not have consented; §15(d) claims against Respondus survived; Patterson’s §15(d) claim against Lewis failed for lack of an allegation that Lewis actually disclosed data (dismissed without prejudice) | |
| Whether webcam/video capture is excluded from BIPA | Respondus suggested photographic/video-derived data falls outside BIPA | Plaintiffs argued biometric scans derived from photos/videos are covered | Court: rejected narrow photographic exception; biometric "scans of face geometry" and voiceprints captured via webcam are covered under BIPA definitions | |
| Lewis: GLBA "financial institution" exemption and possession/collection | Lewis argued it is exempt under BIPA §25(c) because subject to GLBA; also argued Patterson failed to plead possession/collection or timely claims | Patterson argued Lewis is not necessarily covered by GLBA and adequately alleged licensing/use and access | Court: rejected Lewis’s motion to dismiss on GLBA-exemption ground (insufficient to resolve at Rule 12); found Patterson adequately pleaded that Lewis "possessed" and "collected" biometric data for §15(b); Patterson lacked standing for §15(a) publication-only claim; §15(d) failed for no pleaded disclosure; statute-of-limitations issues not resolved at dismissal stage |
Key Cases Cited
- Bryant v. Compass Grp. USA, Inc., 958 F.3d 617 (7th Cir. 2020) (BIPA §15(b) informed consent central; standing analysis for BIPA violations)
- Fox v. Dakkota Integrated Sys., LLC, 980 F.3d 1146 (7th Cir. 2020) (unlawful retention under §15(a) can confer Article III injury)
- Thornley v. Clearview AI, Inc., 984 F.3d 1241 (7th Cir. 2021) (§15(c) is a general market/profit prohibition; standing requires concrete harm)
- Cothron v. White Castle Sys., Inc., 20 F.4th 1156 (7th Cir. 2021) (unlawful disclosure under §15(d) confers Article III injury)
- Rosenbach v. Six Flags Ent. Corp., 129 N.E.3d 1197 (Ill. 2019) (Illinois Supreme Court recognizing private right under BIPA and privacy interest in biometric data)
- Rivera v. Google Inc., 238 F. Supp. 3d 1088 (N.D. Ill. 2017) (statutory text supports biometric measurements derived from photos/videos)
- In re Facebook Biometric Info. Privacy Litig., 185 F. Supp. 3d 1155 (N.D. Cal. 2016) (analysis of BIPA and policy considerations)
- Norberg v. Shutterfly, Inc., 152 F. Supp. 3d 1103 (N.D. Ill. 2015) (biometric-information definitions and derived data)
- Levenstein v. Salafsky, 164 F.3d 345 (7th Cir. 1998) (limits on incorporation-by-reference at pleading stage)
- Metallgesellschaft AG v. Sumitomo Corp. of Am., 325 F.3d 836 (7th Cir. 2003) (court's duty to ensure subject-matter jurisdiction)
- Bazile v. Fin. Sys. of Green Bay, Inc., 983 F.3d 274 (7th Cir. 2020) (standing principles applied in consumer cases)
- Lujan v. Defenders of Wildlife, 504 U.S. 555 (U.S. 1992) (Article III standing elements explained)