600 F.Supp.3d 859
N.D. Ill.2022Background
- Onfido, a tech company providing facial-recognition identity verification, scans ID photos and user selfies to extract and store numerical "faceprints." Plaintiff Fredy Sosa used OfferUp, which integrated Onfido, and alleges Onfido scanned and retained his faceprints without written notice or consent.
- Sosa filed a putative class action in Illinois state court, alleging violations of the Illinois Biometric Information Privacy Act (BIPA), 740 Ill. Comp. Stat. 14/1 et seq., specifically §§15(a) and 15(b), seeking injunctive relief, statutory damages, and fees.
- Onfido removed the case to federal court, moved to compel arbitration (denied and affirmed on appeal), then moved to dismiss under Rule 12(b)(6) arguing (inter alia) BIPA is inapplicable to photo-derived data, statutory damages were insufficiently pleaded, and BIPA violates the First Amendment.
- The district court treated the facts in the complaint as true for Rule 12(b)(6) purposes, addressed Article III standing for both §15(a) (retention policy) and §15(b) (written notice and consent), and evaluated the merits of Onfido’s statutory and constitutional arguments.
- The Court denied the motion to dismiss in full: (1) found Sosa has standing under both §15(a) and §15(b); (2) held the alleged faceprints plausibly qualify as BIPA "biometric identifiers" (a scan of face geometry) even if derived from photographs; (3) held plaintiff need not plead defendant’s state of mind to state a BIPA claim or to demand statutory (liquidated) damages; and (4) rejected Onfido’s as-applied First Amendment challenge to §15(b).
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Article III standing for §15(a) (retention policy) | Sosa alleges Onfido failed to publish and comply with a retention/destruction policy, unlawfully retaining his biometric identifiers, causing concrete privacy injury | Onfido contended plaintiff lacked a particularized injury from a failure-to-publish claim alone | Held: Sosa has standing for §15(a) because alleged failure to delete/comply plausibly caused unlawful retention and a concrete injury (Fox precedent) |
| Article III standing for §15(b) (written notice & release) | Failure to provide written notice of collection, purpose, retention term, and failure to obtain written release is a concrete invasion of personal rights | Onfido disputed standing | Held: Sosa has standing for §15(b) under Bryant: §15(b) violations inflict a concrete, personalized injury |
| Whether data derived from photographs (faceprints) are covered by BIPA | Faceprints are "scans of face geometry" and thus are biometric identifiers covered by BIPA even if derived from photos | Onfido argued photographs and information derived from photos are excluded from BIPA and a photo-derived scan cannot be a scan of face geometry | Held: Allegations plausibly state Onfido extracted face-geometry scans (faceprints); BIPA’s text does not exclude photo-derived scans from the definition of biometric identifier, so dismissal denied |
| Liquidated damages and pleading culpability | Sosa need not plead defendant’s state of mind to demand statutory damages; pleading the statutory violation suffices | Onfido argued Sosa failed to plead facts to show negligence, recklessness, or willfulness required for statutory liquidated damages tiers | Held: Requests for statutory (liquidated) damages are remedies, not separate claims; plaintiff need not plead scienter to state the underlying BIPA claim or to demand damages; dismissal of damages request denied |
| First Amendment challenge to §15(b) (as-applied) | Sosa: §15(b) regulates conduct (collection/consent), not speech; even if speech is implicated, §15(b) is content-neutral and satisfies intermediate scrutiny | Onfido: §15(b) burdens commercial/content-based speech by restricting collection/use of factual consumer data and fails intermediate or strict scrutiny | Held: §15(b) does not regulate speech (it limits access to information), and even assuming it does, it is content-neutral and survives Central Hudson intermediate-scrutiny analysis; First Amendment challenge rejected |
Key Cases Cited
- Sosa v. Onfido, 8 F.4th 631 (7th Cir. 2021) (arbitrability/appeal decision referenced)
- Bryant v. Compass Grp. USA, Inc., 958 F.3d 617 (7th Cir. 2020) (section 15(b) violation gives plaintiff Article III injury)
- Fox v. Dakkota Integrated Sys., LLC, 980 F.3d 1146 (7th Cir. 2020) (failure to comply with retention schedule can cause unlawful retention and injury under §15(a))
- Rosenbach v. Six Flags Ent. Corp., 129 N.E.3d 1197 (Ill. 2019) (BIPA’s purpose and that violation of §15 alone can give rise to claim)
- TransUnion LLC v. Ramirez, 141 S. Ct. 2190 (U.S. 2021) (standing must be assessed claim-by-claim)
- Dahlstrom v. Sun‑Times Media, LLC, 777 F.3d 937 (7th Cir. 2015) (statute limiting access to information does not necessarily restrict speech)
- Central Hudson Gas & Elec. Corp. v. Public Serv. Comm’n, 447 U.S. 557 (U.S. 1980) (commercial-speech intermediate-scrutiny framework)
- Sorrell v. IMS Health Inc., 564 U.S. 552 (U.S. 2011) (content-based speech restrictions analysis)
- In re Facebook Biometric Information Privacy Litigation, 185 F. Supp. 3d 1155 (N.D. Cal. 2016) (photo-derived facial templates can be scans of face geometry under BIPA)