TREVOR SLOAN, JOSEPH BLEIBERG, ARYEH LOUIS ROTHBERGER, PATRICK COMMERFORD, KEVIN FARR, ELMER ORPILLA, KEITH LAPATING, and SAGAR DESAI, on behalf of themselves and all others similarly situated, v. ANKER INNOVATIONS LIMITED, FANTASIA TRADING LLC, and POWER MOBILE LIFE LLC
UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION
January 9, 2024
Judge Sara L. Ellis
Case: 1:22-cv-07174 Document #: 66 Filed: 01/09/24 Page 1 of 25 PageID #:444
Plaintiffs Trevor Sloan, Joseph Bleiberg, Aryeh Louis Rothberger, Patrick Commerford, Kevin Farr, Sagar Desai, Elmer Orpilla, and Keith Lapating allege Defendants Anker Innovations Limited, Fantasia Trading LLC, and Power Mobile Life LLC violated various privacy laws relating to their practices in storing data connected to their “eufy” branded security products.1 Specifically, Plaintiffs seek redress under the Federal Wiretap Act,
The Court grants in part and denies in part Defendants’ motion to dismiss. The Wiretap Act does not apply to the facts of this case because Defendants are a party to the communication—specifically the transmission of data from the eufy products to Plaintiffs’ receipt of that data on the eufy Security app—and so the Court dismisses the Wiretap Act claim. Similarly, the Court dismisses Plaintiffs’ BIPA and ICFA claims as to the non-Illinois resident plaintiffs and the nationwide class because neither statute applies extraterritorially. Finally, the Court dismisses Plaintiffs’ ICFA, NY Gen. Bus. § 349, Mass. Ch. 93A, and FDUPTA claims to the extent they rely on Defendants’ statements relating to security because those statements are puffery. Plaintiffs may proceed on their remaining claims as discussed below.
BACKGROUND2
Plaintiffs’ claims arise from their purchase and use of Defendants’ “eufy”
As advertised, the cameras store the video recordings and data to conduct facial recognition locally, “meaning on equipment located with and controlled by the consumer.” Doc. 31 ¶ 2. Additionally, Defendants advertised that information from the eufy products remained encrypted, so only the user could access the data. The eufy products’ packaging included the following statements: “your privacy is something we value as much as you do“; “to start, we‘re taking every step imaginable to ensure that your data remains private, with you“; “whether it‘s your newborn crying for mom, or your victory dance after a game, your recorded footage will be kept private“; “stored locally with military grade encryption“; “transmitted to you, and only you“; and “that‘s just the start of our commitment to protect you, your family, and your privacy.” Id. ¶ 32. Defendants also warranted that “there is no online link available to any video.” Id. ¶ 33. Defendants’ privacy policy stated that the eufy products operate with “no clouds.” Id. ¶ 37.
Plaintiffs all purchased at least one eufy product between June 2020 and November 2022 and installed them in their respective residences—Sloan and Orpilla in Illinois, Bleiberg and Rothberger in New York, Desai in Florida, Commerford in Texas, Farr in Massachusetts, and Lapating in California. Plaintiffs all allege they relied on representations that the products would store data locally and encrypt their data when purchasing the eufy products. Similarly, Plaintiffs all allege they would have paid less or not purchased the eufy products at all if they knew the data would not be encrypted, could be accessed by third parties, or would be uploaded to Defendants’ servers.
In November 2022, Paul Moore, a security researcher, posted several tweets and videos revealing holes in the security network for the eufy products. Specifically, Moore identified that the eufy products uploaded the thumbnail images used to notify users of movement through the app to Defendants’ cloud storage without encryption. Moore determined that he could stream content from his videos through unencrypted websites and posted a video showing that his camera feed could be accessed through an incognito web browser. SEC Consult, a security firm, and The Verge, an online technology media outlet, confirmed Moore‘s results.
Defendants initially denied that the eufy products streamed video without encryption. However, on November 29, 2022, Defendants released a statement asserting that “[a]lthough our eufy Security app allows users to choose between text-based or
LEGAL STANDARD
A motion to dismiss under
ANALYSIS
I. Group Pleading
Defendants move to dismiss Plaintiffs’ entire complaint for improper use of group pleading. Under
However, group pleading can run headfirst into
Plaintiffs’ use of group pleading does not violate
II. The Wiretap Act
The Wiretap Act empowers a private citizen to bring a civil claim against
The Wiretap Act exempts a person who intercepted an electronic communication “where such person is a party to the communication or where one of the parties to the communication has given prior consent to such interception unless such communication is intercepted for the purpose of committing any criminal or tortious act in violation of the Constitution or laws of the United States or of any State.”
A. Sufficiency of the Pleading
Defendants challenge the sufficiency of Plaintiffs’ BIPA claim only as to whether the information that Plaintiffs allege Defendants illegally collected and stored qualifies for protection under BIPA. BIPA makes it unlawful to “collect, capture, purchase, receive through trade, or otherwise obtain a person‘s or a customer‘s biometric identifiers and/or biometric information” without a written release.
Defendants argue the data Plaintiffs allege has been illegally collected and stored—namely, thumbnails photographs—do not qualify as biometric data. While photographs alone do not support a BIPA action, photographs used by a system that can take a geometric scan of a person do qualify as biometric data. Sosa v. Onfido, Inc., 600 F. Supp. 3d 859, 871 (N.D. Ill. 2022) (determining that faceprints—scans of identification cards and photographs—qualify as biometric identifiers because they “plausibly constitute scans of face geometry“). This is because “a ‘biometric identifier’ is not the underlying medium itself, or a way of taking measurements, but instead is a set of measurements of a specified physical component (eye, finger, voice, hand, face) used to identify a person.” Rivera v. Google Inc., 238 F. Supp. 3d 1088, 1096 (N.D. Ill. 2017); see also Sosa, 600 F. Supp. 3d at 871 (“But nothing in section 10 expressly excludes information derived from photographs from the definition of biometric identifiers.“).
Here, Plaintiffs allege that Defendants do more than simply upload thumbnail information to their cloud storage. They instead assert that Defendants “upload images and facial recognition data to Defendants’ cloud storage.” Doc. 31 ¶ 6. Plaintiffs do not specify what facial recognition data Defendants store. However, they do describe the BionicMind program, which Plaintiffs allege “enables eufy cameras to differentiate between known individuals and strangers by recognizing biometric identifiers (i.e. details about the face‘s geometry as determined by facial points and contours) and comparing the resulting ‘face template’ (or ‘faceprint‘) against the face templates stored in a database.” Id. ¶ 28; see also id. ¶ 43 (“[T]he Camera Products paired consumers’ facial scans with other personally identifiable information from the consumer, which made Defendants capable
B. Non-Illinois Resident Plaintiffs
Defendants also argue that the Court should dismiss Bleiberg, Rothberger, Desai, Commerford, Farr, Lapating, and the Nationwide Class’ BIPA claims because those Plaintiffs failed to allege sufficient facts to tie their harm to Illinois. The Court agrees.
Under Illinois law, “a statute is without extraterritorial effect unless a clear intent in this respect appears from the express provisions of the statute.” Avery v. State Farm Mut. Auto. Ins. Co., 216 Ill. 2d 100, 184–85 (2005) (citation omitted).4 Because “none of BIPA‘s express provisions indicates that the statute was intended to have extraterritorial effect . . . BIPA does not apply extraterritorially.” Monroy, 2017 WL 4099846, at *5. To avoid the extraterritoriality doctrine, “the circumstances that relate to the disputed transaction [must have] occur[red] primarily and substantially in Illinois,” with “each case . . . decided on its own facts.” Avery, 216 Ill. 2d at 187.
The non-Illinois resident Plaintiffs have not alleged any facts suggesting that the “bulk of the circumstances that make up a fraudulent transaction occur[ed] within Illinois.” Rivera, 238 F. Supp. 3d at 1102 (quoting Avery, 216 Ill. 2d at 186). None of the non-Illinois plaintiffs claim they purchased their eufy products in Illinois. And Plaintiffs’ allegations that Anker Innovations exports and sells its products “throughout the world, including throughout the United States in New York and Illinois,” do not establish that the non-Illinois resident Plaintiffs acquired their eufy products in Illinois. Doc. 31 ¶ 19. Instead, Plaintiffs’ pleadings illustrate that the circumstances making up each transaction occurred primarily and substantially in the state of residency for each Plaintiff. Plaintiffs all experienced their alleged harm—access to their data without their consent—at their residence, where they had installed the cameras. Neals v. PAR Tech. Corp., 419 F. Supp. 3d 1088, 1091 (N.D. Ill. 2019) (dismissing BIPA claim where plaintiff failed to allege where her biometric information was collected). As alleged, the eufy products provide home security; therefore, the bulk of the circumstances at issue for each individual Plaintiff would occur in his own home. For those who reside out of Illinois, those circumstances would occur outside of Illinois. Accordingly, as alleged, BIPA does not apply to the non-Illinois residents.
Plaintiffs, however, argue that because they are governed by Illinois law, as detailed in the choice of law provision in the End User License Agreement for Camera Products and the eufy Security App, the non-Illinois putative class members and named Plaintiffs may benefit from BIPA. This argument is incorrect. Shaw v. Hyatt Int‘l Corp., No. 05 C 5022, 2005 WL 3088438, at *3 (N.D. Ill. Nov. 15, 2005) (“As discussed above, the extraterritorial application of the ICFA is limited to deceptive trade practices occurring primarily and substantially within Illinois. The fact that Illinois law was selected to govern disputes arising out of Hyatt‘s website does nothing to further the contention that the allegedly deceptive practices occurred in Illinois.“), aff‘d, 461 F.3d 899 (7th Cir. 2006). Therefore, the Court dismisses the BIPA claims as to Plaintiffs Bleiberg, Rothberger, Desai, Commerford, Farr, and Lapating. Plaintiffs Sloan, and Orpilla may proceed on their BIPA claim.
IV. Consumer Protection Laws
Plaintiffs bring claims on behalf of both individual Plaintiffs and statewide classes under four state consumer protection laws: ICFA, NY Gen. Bus. §§ 349 and 350, Mass. Ch. 93A, and FDUPTA. While the consolidated complaint states that the statements were unfair and deceptive, the parties only discuss whether the statements support a deceptive practice claim under each of the consumer fraud statutes. The Court therefore similarly only considers whether Plaintiffs have alleged a deceptive practices theory within the meaning of each consumer fraud statute. See Rudy v. Fam. Dollar Stores, Inc., 583 F. Supp. 3d 1149, 1158 (N.D. Ill. 2022) (only applying the standard for deceptive practice to a ICFA claim where the plaintiff‘s claim “challenges a ‘deceptive,’ as opposed to an ‘unfair,’ practice“).
To state a claim for deceptive practices under any of the alleged state consumer fraud statutes, Plaintiffs must allege a deceptive statement or act that caused their harm. Camasta v. Jos. A. Bank Clothiers, Inc., 761 F.3d 732, 739 (7th Cir. 2014) (listing the elements of an ICFA claim: “(1) a deceptive or unfair act or promise by the defendant; (2) the defendant‘s intent that the plaintiff rely on the deceptive or unfair practice; and (3) that the unfair or deceptive practice occurred during a course of conduct involving trade or commerce“); Tomasella v. Nestle USA, Inc., 962 F.3d 60, 71 (1st Cir. 2020) (stating a claim under
Defendants raise identical arguments for the dismissal of each of the consumer protection law claims.5 First, Defendants argue that the consumer fraud claims fail because Plaintiffs do
not allege cognizable deceptive statements, either because the statements constitute puffery, are not
A. Deceptive Acts
“[A] statement is deceptive if it creates a likelihood of deception or has the capacity to deceive.” Bober v. Glaxo Wellcome PLC, 246 F.3d 934, 938 (7th Cir. 2001). “[T]he allegedly deceptive act must be looked upon in light of the totality of the information made available to the plaintiff.” Davis v. G.N. Mortg. Corp., 396 F.3d 869, 884 (7th Cir. 2005). “Courts apply a ‘reasonable consumer’ standard to analyze the likelihood of deception.” Benson v. Fannie May Confections Brands, Inc., 944 F.3d 639, 646 (7th Cir. 2019); see also Mirza, 439 F. Supp. 3d at 1072 (“Under New York law, ‘materially misleading’ conduct means an act that is likely to mislead a reasonable consumer acting reasonably under similar circumstances.“); Tomasella, 962 F.3d 60 at 71 (applying the reasonable consumer standard to
1. Puffery
“Puffery is a statement of subjective description or opinion, and is not actionable as a fraudulent misrepresentation.” Castaneda v. Amazon.com, Inc., No. 22-CV-3187, 2023 WL 4181275, at *6 (N.D. Ill. June 26, 2023) (citations omitted). “Puffing ‘denotes the exaggerations reasonably to be expected of a seller as to the degree of quality of his or her product, the truth or falsity of which cannot be precisely determined.‘” Schwebe v. AGC Flat Glass N. Am., Inc., 2013 WL 2151551, at *4 (N.D. Ill. 2013) (quoting Avery, 216 Ill. 2d at 173); see also Lugones v. Pete & Gerry‘s Organic, LLC, 440 F. Supp. 3d 226, 241 (S.D.N.Y. 2020) (defining puffery as “generalized or exaggerated statements which a reasonable consumer would not interpret as a factual claim upon which he could rely . . . [or] an exaggeration or overstatement expressed in broad, vague, and commendatory language, as distinguished from misdescriptions or false representations of specific characteristics of a product“); Martin, 2010 WL 3928707, at *3 (same for Mass. Ch. 93A). “Examples of puffery include ‘high-quality,’ ‘expert workmanship,’ ‘custom quality,’ ‘perfect,’ ‘magnificent,’ ‘comfortable,’ and ‘picture perfect.‘” Lateef v. Pharmavite LLC, No. 12 C 5611, 2013 WL 1499029, at *3 (N.D. Ill. Apr. 10, 2013); see also Isaac v. Ashley Furniture Indus., Inc., No. CV 17-11827-RGS, 2017 WL 4684027, at *1 (D. Mass. Oct. 18, 2017) (listing “slogans, catch phrases, and focus-grouped puffing by manufacturers and distributors [who are] striving to make themselves heard in the din of a consumption-driven marketplace” as nonactionable puffery).
Plaintiffs argue that the fifth statement, that Defendants took every step imaginable to ensure that consumers’ data remained private, differs from the other four statements because it can be tested and proven whether Defendants did so. While it may be possible to count how many steps Defendants took, no reasonable consumer would expect a company to take every step she could literally imagine to protect her data. Further, it is unclear how someone, other than an expert in data security, could identify “every step imaginable” in protecting someone‘s data. A reasonable consumer would thus interpret “every step imaginable” as Defendants’ exaggeration to convey their general commitment to their consumers’ privacy, not as a statement of fact. See, e.g., Castaneda, 2023 WL 4181275, at *7 (determining that a claim that a game console worked at “lightning speed” was puffery even though a consumer can measure speed of a game console because “no reasonable consumer would expect literal ‘lightning speed‘“). Therefore, the Court dismisses the ICFA,
2. Accurate Statements
Defendants claim each of the remaining statements are not misleading because they are not false. Defendants categorized these statements into the following three groups—statements relating to storage and streaming,6 statements relating
statements in each of these categories are false or misleading. Plaintiffs allege that Defendants stored data acquired from their eufy products on a third-party cloud server, see Doc. 31 ¶¶ 44, 55, directly challenging the validity of Defendants’ statements regarding storage and streaming. Similarly, Plaintiffs allege Defendants stored data for facial recognition on their third-party cloud website, see id. ¶¶ 43, 53, challenging the representation that Defendants’ AI conducts facial recognition on a local server. Finally, Plaintiffs allege video streams could be accessed online without using secure encryption codes, see id. ¶¶ 42, 45, 64–65, challenging the statements that Defendants secure the captured video using military grade encryption. Defendants may ultimately prove that the statements at issue are true, but at this stage in the case, Plaintiffs have sufficiently alleged that the storage, encryption, and facial recognition statements may have misled a reasonable consumer and so they may proceed on those statements. See, e.g., Fero v. Excellus Health Plan, Inc., 236 F. Supp. 3d 735, 776 (W.D.N.Y. 2017) (finding plaintiffs alleged materially misleading statements where Defendants stated on their website that they “would maintain adequate data privacy and security practices and procedures to safeguard . . . PII and PHI from unauthorized disclosure, release, data breaches, and cyber attack“), on reconsideration on other grounds, 304 F. Supp. 3d 333 (W.D.N.Y. 2018), order clarified on unrelated grounds, 502 F. Supp. 3d 724 (W.D.N.Y. 2020).
3. Omissions
Defendants also argue that omissions cannot support claims under ICFA,
When bringing a consumer fraud claim based on an omission, the omission must be “employed as a device to mislead.” Spector v. Mondelez Int‘l, Inc., 178 F. Supp. 3d 657, 672 (N.D. Ill. 2016); see also Mack v. Cultural Care Inc., No. 1:19-CV-11530-ADB, 2020 WL 4673522, at *8 (D. Mass. Aug. 12, 2020) (a statement is actionable under
Defendants only challenge Plaintiffs’ reliance on omissions to the extent that the omissions cannot be misleading because they do not track how the eufy products functioned. However, Plaintiffs have alleged that Defendants stored data for facial recognition on their third-party cloud website, see Doc. 31 ¶¶ 43, 53, and that video streams could be accessed online without using secure encryption codes, see id. ¶¶ 42, 45, 64-65. While discovery may ultimately prove that each of the stated omissions does not accurately describe how the eufy products function, at this stage, Plaintiffs have alleged enough to pursue their consumer fraud claims based on a theory of omissions for their ICFA and
However, Plaintiffs may not rely on omissions to further their FDUPTA claim. To proceed based on an omission, FDUPTA requires Plaintiffs to also allege a duty to disclose based on a confidential, contractual, or fiduciary relationship. See DJ Lincoln Enters., Inc. v. Google LLC, No. 21-12894, 2022 WL 203365, at *3 (11th Cir. Jan. 24, 2022). Plaintiffs have not included any allegations suggesting a confidential, contractual, or fiduciary relationship between Plaintiffs and Defendants, and Plaintiffs fail to address this argument in their response. Accordingly, the Court dismisses the FDUPTA claim to the extent that Plaintiffs rely on omissions to support it.
B. Causation
Defendants also argue that Plaintiffs have not alleged causation with the particularity required by
Here, Plaintiffs all allege that they personally saw some misrepresentations by Defendants, relied on those misrepresentations when purchasing their products, and consequently experienced financial harm in overpaying for or purchasing that product. See Muir v. Playtex Prods., LLC, 983 F. Supp. 2d 980, 991 (N.D. Ill. 2013) (“By claiming that ‘he personally saw the misrepresentations [on the Diaper Genie II Elite package], was deceived
While Farr, Desai, and Orpilla did not explicitly quote the representations on which they relied in the paragraph of the complaint describing their purchases, see id. ¶¶ 14, 16, 17, reading the complaint in its entirety reveals that Farr, Desai, and Orpilla do identify the statements on which they relied. Both Farr and Desai state they relied on the “privacy commitments as advertised on [] Anker‘s eufy website.” See id. ¶ 14, 16. The complaint details the privacy commitment on Defendants’ website “during all relevant times,” which included statements that “all recorded videos are encrypted from device to phone—only you have the key to decrypt and access your videos via the eufy Security app” and “our AI is built in to your security devices. It analyzes recorded video locally without the need to send it to the cloud for analysis.” Id. ¶ 33. Similarly, Orpilla stated he “reviewed the accompanying labels and disclosures” on the eufy products he purchased. Id. ¶ 17. As Plaintiffs allege, “each of the camera products, on the product‘s label, advertises and warrants” statements including that the videos were “stored locally [,] [w]ith military-grade encryption” and “transmitted to you, and only you.” Id. ¶ 32. Reviewing the allegations together and in the light most favorable to Plaintiffs Farr, Desai, and Orpilla, they have met the particularity requirement of
C. Extraterritoriality under the ICFA
Finally, Defendants move to dismiss any non-Illinois resident Plaintiffs and classes from the ICFA count on extraterritoriality grounds. Like their BIPA claims, only Plaintiffs residing in Illinois, Sloan and Orpilla, have alleged sufficient facts to establish that the misrepresentation substantially occurred in Illinois. See Crichton v. Golden Rule Ins. Co., 576 F.3d 392, 396 (7th Cir. 2009) (“[F]or a nonresident plaintiff to have standing under the [Illinois Consumer Fraud] Act, the court
V. Unjust Enrichment
Defendants’ sole argument to dismiss Plaintiffs’ unjust enrichment claim is the failure of Plaintiffs’ consumer fraud claims. Unjust enrichment claims “stand or fall with the related claim” when “an unjust enrichment claim rests on the same improper conduct alleged in another claim.” Cleary v. Philip Morris Inc., 656 F.3d 511, 517 (7th Cir. 2011). As detailed above, the Court dismisses Plaintiffs’ consumer fraud claims to the extent they rely on statements related to privacy because those statements are puffery and the FDUPTA claim based on any omissions. Plaintiffs’ unjust enrichment claims cannot rely on those statements. However, as Defendants do not argue any other basis to dismiss Plaintiffs’ unjust enrichment claims, the Court otherwise allows the claim to proceed.
CONCLUSION
For the foregoing reasons, the Court grants in part and denies in part Defendants’ motion to dismiss [45]. The Court dismisses Plaintiffs’ Wiretap Act claim (Count III) in its entirety without prejudice. The Court dismisses Plaintiffs’ BIPA claim (Count IV) as to all non-Illinois resident Plaintiffs without prejudice; Sloan, Orpilla, and the Illinois class may proceed on the BIPA claim. The Court dismisses without prejudice Plaintiffs’ consumer fraud claims (Counts I, II, V, VI) and their unjust enrichment claim (Count VII) to the extent they rely on the statements related to privacy identified above, Plaintiffs’ ICFA claim (Count I) for non-Illinois residents, and Plaintiffs’ FDUPTA claim (Count VI) to the extent it relies on omissions. Finally, because Commerford and Lapating no longer have any viable claims, the Court also dismisses them as named Plaintiffs.
Dated: January 9, 2024
SARA L. ELLIS
United States District Judge