Vigil v. Take-Two Interactive Software, Inc.
235 F. Supp. 3d 499
S.D.N.Y.2017Background
- Plaintiffs Ricardo and Vanessa Vigil (Illinois residents) used Take-Two’s NBA 2K15 MyPlayer feature to scan their faces and create in-game avatars; they allege Take-Two stored and transmitted the biometric data and failed to comply with the Illinois Biometric Information Privacy Act (BIPA).
- Plaintiffs claimed violations of multiple BIPA provisions (notice/consent, retention/destruction, data-security, dissemination, and profit from biometrics) and sought damages and injunctive relief as a putative class action.
- Take-Two moved to dismiss under Federal Rules 12(b)(1) and 12(b)(6); the court allowed repleading after Spokeo and later considered Take-Two’s renewed motion against the Second Amended Complaint.
- Plaintiffs alleged only that their face scans were used to create avatars for in-game play (the use they consented to); they did not allege dissemination beyond multiplayer gameplay, no data breach, and no concrete misuse of their biometrics.
- The court evaluated Article III standing (Spokeo framework) and whether the BIPA grants a private cause of action to an "aggrieved" person, concluding plaintiffs lacked standing and failed to state a claim.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Article III standing for alleged BIPA procedural violations | Plaintiffs: statutory procedural violations (notice, consent, retention, security) alone constitute concrete injury under Spokeo | Take-Two: procedural violations without a material risk of misuse are abstract and insufficient for Article III standing | Dismissed for lack of Article III standing; bare procedural violations insufficient absent a material risk of harm |
| Risk of future harm from data retention/security | Plaintiffs: indefinite retention and allegedly insecure transmission create an enhanced, concrete risk of identity misuse because biometrics are immutable | Take-Two: allegations are speculative; no breach or misuse alleged, so risk is abstract | Court: speculative risk is too attenuated to be "certainly impending" or materially concrete; standing lacking |
| Notice/consent defects under BIPA §15(b) | Plaintiffs: notice did not use statutory terms or specify retention period; consent not in BIPA-prescribed written form, so consent is invalid | Take-Two: users were informed face scans would occur and were used to create avatars; plaintiffs understood the functionality and purpose | Court: notice/consent deficiencies are procedural and, without risk of misuse, do not create standing or injury; plaintiffs understood the use of scans |
| Whether "aggrieved" under BIPA creates a private cause of action for mere procedural violations | Plaintiffs: "aggrieved" is satisfied by statutory rights violation alone; provides private remedy for procedural breaches | Take-Two: "aggrieved" requires an injury causally linked to the statutory violation (i.e., harm) | Court: "aggrieved" construed to require an injury from the statutory violation; plaintiffs failed to show such injury, so no cause of action |
Key Cases Cited
- Spokeo, Inc. v. Robins, 136 S.Ct. 1540 (2016) (statutory procedural violations must cause or present a material risk of concrete harm to satisfy Article III)
- Strubel v. Comenity Bank, 842 F.3d 181 (2d Cir. 2016) (interpretation of Spokeo: procedural rights can create standing only when tied to a concrete interest and a material risk of harm)
- Lujan v. Defenders of Wildlife, 504 U.S. 555 (1992) (Article III standing elements: injury-in-fact, causation, redressability)
- Clapper v. Amnesty Int’l USA, 568 U.S. 398 (2013) (future injury must be certainly impending or show a substantial risk; speculative fears insufficient)
- Braitberg v. Charter Commc’ns, Inc., 836 F.3d 925 (8th Cir. 2016) (retention of data alone does not constitute concrete injury absent disclosure or misuse)
- Gubala v. Time Warner Cable, Inc., 846 F.3d 909 (7th Cir. 2017) (no standing where plaintiffs allege only unlawful retention without actual leak, misuse, or other injury)