FREDY SOSA, individually and on behalf of all others similarly situated, v. ONFIDO, INC.
No. 20-cv-4247
UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION
04/25/22
Judge Marvin E. Aspen
MARVIN E. ASPEN, District Judge:
Defendant Onfido, Inc. (“Onfido“) moves to dismiss Plaintiff Fredy Sosa‘s Complaint under
FACTUAL BACKGROUND
We take the following facts from the Complaint, “documents attached to the [Complaint], documents that are critical to the [Complaint] and referred to in it, [] information that is subject to proper judicial notice[,]” and any additional facts set forth in Sosa‘s response, “so long as those facts are consistent with the pleadings.” Phillips v. Prudential Ins. Co. of Am., 714 F.3d 1017, 1019-20 (7th Cir. 2013) (quotation marks omitted). We have accepted as true all well-
Onfido, a Delaware corporation with its principal place of business in England,2 markets and sells proprietary facial recognition software that is used by online businesses to verify consumers’ identities. (Class Action Complaint and Demand for Jury Trial (“Compl.“) (Dkt. No. 1-1) ¶¶ 1, 2, 9.) To verify a consumer‘s identity using Onfido‘s software, the consumer first uploads a copy of his or her identification and a photograph of his or her face. (Id. ¶ 22.) Onfido‘s software then scans the identification and photograph to locate the facial images on each document; extracts a unique numerical representation of the shape or geometry of each facial image, which is often called a “faceprint“; compares the faceprints from the consumer‘s identification and photograph; and generates a score based on the similarity of the faceprints. (See id. ¶¶ 2, 23, 24, 41; Plaintiff‘s Response to Defendant‘s Motion to Dismiss (“Resp.“) (Dkt. No. 49) at 3.) Onfido‘s software also can compare the faceprints obtained from a consumer‘s identification or photograph with other biometric data in Onfido‘s database, such as the biometric data of known masks or other consumers’ photographs. (Compl. ¶¶ 2, 25, 27.) Online businesses can integrate Onfido‘s software into their products and mobile apps in such a way that consumers seeking to verify their identities likely do not know that they are interacting with and providing their sensitive information to Onfido, a third party. (Id. ¶¶ 3, 4, 21.)
Sosa, an Illinois citizen, is a member of OfferUp, an online marketplace that partnered with Onfido to verify its users’ identities using Onfido‘s software. (Id. ¶¶ 8, 33, 34); Sosa v. Onfido, 8 F.4th 631, 634-35 (7th Cir. 2021). In April 2020, Sosa verified his identity with
Onfido did not inform “Sosa that it would collect, store, or use his biometric identifiers derived from his face,” and Sosa never signed a written release allowing Onfido to do so. (Compl. ¶¶ 36, 38.) Nor did Onfido inform Sosa about a biometric data retention policy or whether it would “ever permanently delete the biometric identifiers derived from his face.” (Id. ¶ 37.) In fact, “there was almost no notice whatsoever that Onfido [was] even involved in the process.” (Id. ¶ 36.)
PROCEDURAL HISTORY
Sosa filed suit against Onfido in the Circuit Court of Cook County, Illinois, alleging that Onfido violated Illinois‘s Biometric Information Privacy Act (“BIPA“),
A motion to dismiss under
ANALYSIS
In response to growing public concern about the increased commercial use of biometric data, the Illinois General Assembly enacted BIPA in 2008 “to help regulate ‘the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information.‘” Cothron v. White Castle Sys., Inc., 20 F.4th 1156, 1159 (7th Cir. 2021); Rosenbach v. Six Flags Ent. Corp., 2019 IL 123186, ¶ 19, 129 N.E.3d 1197, 1203 (quoting
Onfido‘s arguments for dismissal require us to address the scope and meaning of sections 15 and 20 of BIPA, as well as whether BIPA runs afoul of the United States Constitution. Before we can reach these arguments, however, we must assure ourselves that Sosa has standing to maintain his lawsuit in this Court. See Persinger v. Sw. Credit Sys., L.P., 20 F.4th 1184, 1189 (7th Cir. 2021) (addressing “the jurisdictional question of whether [the plaintiff] has standing to sue” before addressing the merits of the case).
I. Standing
”
“At the pleading stage, standing requires allegations of a concrete and particularized injury in fact that is traceable to the defendant‘s conduct and redressable by judicial relief.” Cothron, 20 F.4th at 1160. There is no dispute that “whatever injury [Sosa] suffered occurred at [Onfido‘s] hands” or that a court can remedy the injury by, for instance, awarding statutory damages. See Thornley v. Clearview AI, Inc., 984 F.3d 1241, 1244 (7th Cir. 2021); Bryant, 958 F.3d at 620-21. Thus, for purposes of our standing inquiry, we consider only whether the Complaint establishes an injury in fact. See Thornley, 984 F.3d at 1244.
We begin our standing analysis with Sosa‘s section 15(a) allegations. Section 15(a) requires “[a] private entity in possession of biometric identifiers or biometric information” to develop and make publicly available a written policy “establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information.”
Whether a plaintiff has standing to sue for a § 15(a) violation depends on how the defendant allegedly violated § 15(a). See Thornley, 984 F.3d at 1246 (“[A]s the difference between the treatment of section 15(a) in Bryant and Fox illustrates, the result of the standing inquiry for the identical section of a statute will depend on what that section provides and what the plaintiff has alleged.“). For instance, the plaintiff in Bryant did not have standing to pursue
Similar to the plaintiff in Fox, Sosa alleges that Onfido failed to “make publicly available a written policy establishing a retention schedule and guidelines for permanent deletion of biometric data” and failed to “adhere to that retention schedule and actually delete the biometric information.” (Compl. ¶¶ 48, 49.) Under Fox, Onfido‘s alleged failure to delete biometric information in compliance with a data-retention schedule constitutes an unlawful retention of Sosa‘s information sufficient to establish an injury in fact. See Fox, 980 F.3d at 1149, 1154-56. Sosa has standing to pursue his section 15(a) allegations before us.
That leaves Sosa‘s section 15(b) allegations. Section 15(b) prohibits the collection of biometric identifiers or biometric information unless the collector first (1) informs the person “in writing that a biometric identifier or biometric information is being collected or stored“; (2) informs the person “in writing of the specific purpose and length of term for which a
The Seventh Circuit‘s decision in Bryant “resolved the standing question for claims under section 15(b)” by holding that “a violation of section 15(b) inflicts an Article III injury.” Cothron, 20 F.4th at 1160-61. In Bryant, the plaintiff alleged that the defendant had violated section 15(b) by failing to (1) inform her in writing that her biometric identifier was being collected or stored; (2) inform her in writing of the specific purpose and length of term for which her identifier was being collected, stored, and used; and (3) obtain the plaintiff‘s written release to collect, store, and use the identifier. 958 F.3d at 619. The Seventh Circuit held that the plaintiff had standing to pursue her section 15(b) claim because a defendant‘s failure to follow section 15(b) “leads to an invasion of personal rights that is both concrete and personalized.” Id. at 619, 626-27. Sosa similarly alleges that Onfido violated section 15(b) by failing to inform him and the Class in writing that it was collecting and storing their information, failing to inform him and the Class in writing of the purpose and length of term for which the information was being collected, stored, and used, and failing to obtain written releases from him and the Class. (Compl. ¶¶ 53-55.) Sosa‘s section 15(b) allegations fall squarely within Bryant‘s holding, so he has standing to pursue these allegations before us as well.
II. Onfido‘s Motion to Dismiss
Onfido makes three arguments for dismissal. First, Onfido argues that Sosa has not stated a BIPA claim because the information Onfido allegedly collects—photographs and information derived from photographs—is not protected by BIPA. (Mem. at 9-10.) Second, Onfido argues that Sosa has not stated claims for liquidated damages because he has not alleged facts from which we can reasonably infer that Onfido intentionally, recklessly, or negligently violated BIPA. (Id. at 11-14.) Third, Onfido argues that BIPA violates the First Amendment. (Id. at 14-18.) We consider Onfido‘s non-constitutional arguments first and proceed to its First Amendment argument only if it is necessary to resolve Onfido‘s motion to dismiss. See ISI Int‘l, Inc. v. Borden Ladner Gervais LLP, 256 F.3d 548, 552 (7th Cir. 2001) (“[F]ederal courts are supposed to do what they can to avoid making constitutional decisions, and strive doubly to avoid making unnecessary constitutional decisions.“).
A. Information Protected by BIPA
Section 15 of BIPA imposes “various obligations regarding the collection, retention, disclosure, and destruction of biometric identifiers and biometric information.” Rosenbach, 2019 IL 123186, ¶ 20, 129 N.E.3d at 1203. According to Onfido, Sosa has failed to state a claim for relief under section 15 because he alleges “that Onfido‘s software captures information from photographs submitted by users,” and neither photographs nor information derived from
We interpret BIPA using the same principles that Illinois courts would apply. K-S Pharmacies, Inc. v. Am. Home Prods. Corp., 962 F.2d 728, 730 (7th Cir. 1992). Under Illinois law, we look first to the plain meaning of the statutory language. People v. Porter, 156 Ill. 2d 218, 222, 620 N.E.2d 381, 384 (1993). Where the statutory language “is clear and unambiguous, we will apply it as written” without “consider[ing] other interpretive aids.” Raab v. Frank, 2019 IL 124641, ¶ 18, 157 N.E.3d 470, 474; Ultsch v. Ill. Mun. Ret. Fund, 226 Ill. 2d 169, 184, 874 N.E.2d 1, 10 (2007).
Our analysis starts with section 10 of BIPA, which expressly defines “biometric information” and “biometric identifier.” People v. Olsson, 2011 IL App (2d) 091351, ¶ 6, 958 N.E.2d 356, 359 (“When an act defines its own terms, those terms must be construed according to the definitions given to them in the statute.“). Section 10 defines a “biometric identifier” as “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry” and “biometric information” as “any information, regardless of how it is captured, converted, stored, or shared, based on an individual‘s biometric identifier used to identify an individual.”
Because BIPA excludes photographs from its definition of biometric identifiers, information “derived from” photographs does not constitute biometric information. See id.
We conclude that it does. As alleged in Sosa‘s Complaint and response to Onfido‘s motion to dismiss, Onfido‘s software scans identification cards and photographs to locate facial images and extracts a unique numerical representation of the shape or geometry of each facial image, which Sosa refers to as a “faceprint.” (See Compl. ¶¶ 2, 22-24, 41; Resp. at 3-4.) The faceprints extracted by Onfido plausibly constitute scans of face geometry and, therefore, “biometric identifiers” under BIPA. See, e.g., Vance, 525 F. Supp. 3d at 1295 (holding that “facial scans are ‘biometric identifiers’ under BIPA“); Rivera v. Google Inc., 238 F. Supp. 3d 1088, 1091, 1095 (N.D. Ill. 2017) (scanning an uploaded photograph, locating the plaintiff‘s
Onfido‘s arguments to the contrary are unavailing. (See Mem. at 9-10; Defendant‘s Reply in Further Support of Its Rule 12(b)(6) Motion to Dismiss for Failure to State a Claim (“Reply“) (Dkt. No. 51) at 2-5.) First, Onfido argues that BIPA “expressly excludes both photographs and information derived from photographs” from its reach. (Mem. at 10.) This is not accurate. True, section 10 expressly excludes photographs from the definition of “biometric identifier” and information derived from photographs from the definition of “biometric information.”
Second, Onfido argues that the information it allegedly obtains cannot be a “scan of face geometry” because it “was not the scan of Plaintiff‘s actual face, but rather, a scan of a photograph of his face.” (Mem. at 10; Reply at 4.) Nothing in BIPA‘s text, however, supports Onfido‘s contention that a scan of face geometry must be an “in person” scan. Rivera, 238 F. Supp. 3d at 1095 (BIPA‘s definition of “biometric identifier” does not “say whether a scan of face geometry has to be in person or may be generated from a photograph or a video“). We therefore join those courts that have rejected similar arguments. See, e.g., id. at 1095-98 (rejecting the defendant‘s argument that “face-scan measurements derived from a photograph do not qualify as biometric identifiers“); Vance, 525 F. Supp. 3d at 1296 (rejecting the defendant‘s argument “that only scans taken in-person, not from photographs, are biometric identifiers“); In re Facebook Biometric Info. Priv. Litig., 185 F. Supp. 3d at 1171-72 (rejecting the defendant‘s argument “that the only way to reconcile [BIPA‘s] inclusion of ‘scan’ and exclusion of ‘photographs’ is to read the word ‘scan’ to mean in-person scan“).
Third, Onfido argues that “it is not clear what the BIPA intended to cover as a ‘scan of face geometry‘” because BIPA‘s text and legislative history do not define “scan” or “face geometry,” and dictionaries do not provide a workable definition for “scan of face geometry.”
Fourth, Onfido argues that if “a ‘scan of face geometry’ can be derived from a photograph[,]” this “could lead to the absurd result where one becomes in possession of a ‘scan of face geometry’ simply by examining a photograph and creating a depiction, i.e. a drawing or portrait, based on the shape or form of the face in the photograph.” (Reply at 4.) Sosa does not allege that Onfido derives information from photographs in this manner, however, so Onfido‘s hypothetical result (absurd or not) is irrelevant.
Finally, Onfido argues that allowing information derived from a photograph to constitute a “biometric identifier” renders the definition of “biometric information,” which excludes information derived from biometric identifiers, meaningless and redundant. (Id. at 4-5.) According to Onfido, this is because the definition of “biometric identifiers” covers original sources of information about a person and the definition of “biometric information” covers data derived from those original sources. (Id. at 4.) We are not persuaded. Initially, it is unclear what Onfido means by “original” sources of information. If Onfido means that biometric identifiers must be obtained only via in-person processes, it is incorrect, as “the scanning of
What is more, Onfido does not explain how allowing faceprints derived from photographs to qualify as “biometric identifiers” would render BIPA‘s definition of “biometric information” redundant or meaningless. (Reply at 4-5.) Nor does Onfido identify a single case that has come to this conclusion, let alone at the motion to dismiss stage. (Id.) To the contrary, Rivera—a case cited by Onfido (id. at 5)—cast aside an argument similar to Onfido‘s. In Rivera, the defendant argued that the definitions of “biometric identifier” and “biometric information” “distinguish the ‘source of the content‘” and that allowing a face template based on a photograph to constitute a “biometric identifier” would render this distinction meaningless. 238 F. Supp. 3d at 1096. Essentially, the defendant argued “that if biometric information cannot be ‘based on’ something from the biometric-identifier paragraph‘s ‘do not include’ list (for example, ‘photographs‘), then an identifier may also not be ‘based on’ something from that same list.” Id. The defendant‘s argument, however, had “no textual or structural clue to support it.” Id. As the Rivera court explained, there is a meaningful distinction between biometric identifiers and biometric information: the items identified as “biometric identifiers” are “specific, biology-based measurements used to identify a person, without reference to how the measurements were
In conclusion, we join the “Illinois courts [that] have uniformly rejected the argument that BIPA exempts biometric data extracted from photographs.” In re Clearview AI, Inc. Consumer Priv. Litig., No. 21-cv-0135, 2022 WL 444135, at *5 (N.D. Ill. Feb. 14, 2022); see also Vance, 525 F. Supp. 3d at 1295 (“This is not the first—or second, or third, or even fourth—time that defendants have challenged BIPA‘s applicability to facial scans derived from photographs. Every court has rejected Microsoft‘s argument.“). By alleging that Onfido‘s software scans identification cards and photographs to locate facial images and extracts a unique numerical representation of the shape or geometry of each facial image, Sosa has plausibly alleged that Onfido obtains “biometric identifiers” as defined by BIPA.
B. Liquidated Damages
We turn next to Onfido‘s contention that we must dismiss Sosa‘s requests for liquidated damages. BIPA authorizes a prevailing party to recover the greater of actual damages or $1,000 in liquidated damages for each negligent BIPA violation, and the greater of actual damages or $5,000 in liquidated damages for each intentional or reckless BIPA violation.
We agree with Sosa that dismissing his requests for liquidated damages is not warranted. Sosa‘s requests for liquidated damages are requests for a particular type of remedy should he prevail on his underlying BIPA claim. See Bradenberg, 2021 WL 4494275, at *5 (“Section 14/20 of BIPA contains four remedies available to prevailing plaintiffs in BIPA cases. Two of the four remedies in Section 14/20 are liquidated damages in the event a defendant acts with a specific state of mind when violating BIPA.” (internal citation omitted)); Cothron v. White Castle Sys., Inc., 467 F. Supp. 3d 604, 615 (N.D. Ill. 2020) (BIPA plaintiff‘s requests for statutory damages, declaratory relief, and injunctive relief for each alleged statutory violation were requests for “various forms of relief” that stemmed from the same claim). Sosa seeks other remedies authorized by BIPA as well—injunctive relief and reasonable attorneys’ fees, costs, and expenses. (Compl. ¶ 58); see
Nor does Sosa need to allege facts suggesting any level of culpability to plausibly state a BIPA claim in the first place. “BIPA imposes liability . . . regardless of the violator‘s state of mind,” Snider v. Heartland Beef, Inc., 479 F. Supp. 3d 762, 772 (C.D. Ill. 2020), and “the need to demonstrate negligence, intentional action, or recklessness impacts a plaintiff‘s recovery, not
C. First Amendment
Because Onfido‘s non-constitutional arguments do not persuade us to dismiss Sosa‘s Complaint, we now consider Onfido‘s contention that BIPA violates the First Amendment. Onfido argues that BIPA is a restraint on commercial speech that fails intermediate scrutiny or,
We begin by defining the scope of our constitutional inquiry, keeping in mind that we should “avoid making unnecessary constitutional decisions.” ISI Int’l, 256 F.3d at 552. Onfido suggests in its briefing that the entirety of BIPA is unconstitutional. (See, e.g., Mem. at 6 (“BIPA is an unconstitutional restraint on speech in violation of the First Amendment . . . and consequently is invalid.”).) Yet Sosa accuses Onfido of violating only subsections (a) and (b) of section 15. (Compl. ¶¶ 47–49, 53–56.) Furthermore, Onfido does not contend that section 15(a) unconstitutionally restricts speech. Onfido argues only that BIPA restricts speech by regulating its collection of “factual information voluntarily provided by consumers to identify themselves as marketplace users.” (See Mem. at 14–15; Reply at 8–9.) Section 15(b) regulates the collection of this information; section 15(a) does not. Compare
As we will discuss, section 15(b) does not violate Onfido’s First Amendment rights for two reasons. First, section 15(b) does not restrict Onfido’s speech, so the First Amendment does not apply. Second, even if section 15(b) restricts Onfido’s speech, it is a content-neutral restriction that survives the applicable level of First Amendment scrutiny.
1. Section 15(b) Does Not Restrict Onfido’s Speech
“The First Amendment, applicable to the States through the Fourteenth Amendment, prohibits the enactment of laws” that restrict speech or inherently expressive conduct. Reed v. Town of Gilbert, 576 U.S. 155, 163 (2015); Tagami v. City of Chicago, 875 F.3d 375, 378 (7th Cir. 2017). If a statute does not regulate the ability to engage in speech or inherently expressive conduct, the First Amendment does not come into play. See, e.g., Cornelius v. NAACP Legal Def. & Educ. Fund, Inc., 473 U.S. 788, 797 (1985) (explaining that the Court “need go no further” in its First Amendment analysis if the solicitation at issue was not “speech protected by the First Amendment”); Doe v. City of Lafayette, 377 F.3d 757, 764 (7th Cir. 2004) (en banc) (finding First Amendment doctrine inapplicable “because there [was] no expression at issue”). Accordingly, we begin by asking
We start with section 15(b)’s text. See Sorrell v. IMS Health Inc., 564 U.S. 552, 562 (2011) (starting its First Amendment analysis with the text of the challenged statutory provision). Section 15(b) states:
No private entity may collect, capture, purchase, receive through trade, or otherwise obtain a person’s or a customer’s biometric identifier or biometric information, unless it first:
(1) informs the subject or the subject’s legally authorized representative in writing that a biometric identifier or biometric information is being collected or stored;
(2) informs the subject or the subject’s legally authorized representative in writing of the specific purpose and length of term for which a biometric identifier or biometric information is being collected, stored, and used; and
(3) receives a written release executed by the subject of the biometric identifier or biometric information or the subject’s legally authorized representative.
The Seventh Circuit’s decision in Dahlstrom v. Sun-Times Media, LLC, 777 F.3d 937 (7th Cir. 2015), cited by Sosa, leads us to conclude that section 15(b) does not restrict Onfido’s speech. In Dahlstrom, the Seventh Circuit addressed the Driver’s Privacy Protection Act (“DPPA”), which “prohibits individuals from knowingly obtaining or disclosing ‘personal information’ from a motor vehicle record.” 777 F.3d at 939. Five Chicago police officers sued Sun-Times Media, LLC, arguing that it “violated the DPPA by obtaining each officer’s birth date, height, weight, hair color, and eye color from the Illinois Secretary of State’s motor vehicle records” and then publishing that information in a newspaper article. Id. Sun-Times moved to dismiss the officers’ complaint, arguing, among other things, that the DPPA’s “prohibition on acquiring and disclosing personal information from driving records violates the First Amendment’s guarantees of free speech and freedom of the press.” Id.
Evaluating Sun-Times’s First Amendment challenge “as applied to the facts of [the] case,” the Seventh Circuit addressed the DPPA’s prohibition on “obtaining personal information from driving records,” and then addressed the DPPA’s prohibition on “disclosing that information.” Id. at 946. The Dahlstrom court concluded that the “prohibition on obtaining information from driving records” did not restrict speech because it limited only “access to information.” Id. at 947–49 (emphasis in original). The court then concluded that the
Like the first DPPA provision at issue in Dahlstrom, section 15(b) burdens a party’s ability to access certain information. In determining “that the DPPA’s limitation on obtaining personal information [was] not a restriction on speech at all,” 777 F.3d at 949, the Dahlstrom court found unpersuasive Sun-Times’s argument that this limitation burdened its speech, “albeit at an earlier point in the speech process,” by restricting its “ability to gather and report the news,” id. at 947–48. Onfido makes a similar argument here; it contends that section 15(b) burdens its speech by restricting its ability to obtain biometric data from consumers. (See Mem. at 14–15; Reply at 8–9.) Based on Dahlstrom, Onfido’s argument cannot carry the day. If the DPPA’s prohibition on obtaining personal information is not a restriction on speech (as the Seventh Circuit has held), neither is section 15(b)’s regulation on obtaining biometric data.
Onfido does not attempt to reconcile its position with Dahlstrom. (See Reply at 8–10 (failing to address Dahlstrom after Sosa cited it in his response).) Rather, Onfido rests its contention on a Tenth Circuit decision, U.S. West, Inc. v. FCC, 182 F.3d 1224 (10th Cir. 1999), and the Supreme Court’s decision in Sorrell. (Mem. at 14–15.) But even if U.S. West supported Onfido’s contention, it does not bind us, and it cannot compel a conclusion at odds with Dahlstrom. See United States v. Glaser, 14 F.3d 1213, 1216 (7th Cir. 1994). And although Sorrell is binding precedent, it is distinguishable.
At issue in Sorrell was a Vermont statutory provision, section 4631(d), that restricted the sale, disclosure, and use of pharmacy records that revealed doctors’ prescribing practices (known as prescriber-identifying information). 564 U.S. at 557–58. Pharmacies sold
Sorrell differs from our case in two key respects. First, central to the Sorrell Court’s analysis was the fact that the detailers’ inability to obtain prescriber-identifying information burdened their subsequent ability to use the information to communicate with physicians. See, e.g., id. at 564 (“But § 4631(d) leaves detailers no means of purchasing, acquiring, or using prescriber-identifying information. . . . Vermont’s law thus has the effect of preventing detailers—and only detailers—from communicating with physicians in an effective and informative manner.”). Indeed, in rejecting the State’s “access to information” argument, the Court relied upon the burden section 4631(d) imposed on potential recipients’ expression. Id.
Second, the statutory provisions addressed in Sorrell substantively differ from section 15(b). Each of the three provisions at issue in Sorrell expressly restricted the sale, disclosure, or use of prescriber-identifying information. 564 U.S. at 558–59, 563–64. As such, each provision undoubtedly restricted speech. See id. at 570 (“This Court has held that the creation and dissemination of information are speech within the meaning of the First Amendment.”); Dahlstrom, 777 F.3d at 949 (“[T]he [DPPA’s] prohibition on disclosing [personal] information is a direct regulation of speech.”). In contrast, section 15(b) does nothing to restrict an entity’s sale, disclosure, or use of biometric data once the data is obtained. Thus, section 15(b) is much more like the DPPA prohibition on obtaining information at issue in Dahlstrom, which does not restrict speech, than the provisions at issue in Sorrell, which do restrict speech.
In sum, Dahlstrom is much closer to the facts before us than Sorrell. Based on Dahlstrom, we find that section 15(b) does not restrict Onfido’s speech and is not subject to the First Amendment. But for the sake of completeness, we also consider whether—assuming section 15(b) restricts Onfido’s speech—section 15(b) survives First Amendment scrutiny.
2. Even if Section 15(b) Restricts Onfido’s Speech, It Survives First Amendment Scrutiny
Assuming that section 15(b) restricts Onfido’s speech, we must determine what level of First Amendment scrutiny applies. United States v. Kokinda, 497 U.S. 720, 725 (1990) (plurality opinion); Deida v. City of Milwaukee, 176 F. Supp. 2d 859, 864
a. Strict Scrutiny
“Content-based laws—those that target speech based on its communicative content—are presumptively unconstitutional” and “can stand only if they survive strict scrutiny.” Reed, 576 U.S. at 163, 171. In Reed, the Supreme Court recognized two types of content-based laws: (1) laws that, on their face, make distinctions based on “the topic discussed or the idea or message expressed”; and (2) facially content-neutral laws that “cannot be justified without reference to the content of the regulated speech, or that were adopted by the government because of disagreement with the message the speech conveys.” Id. at 163–64 (alteration and quotation marks omitted); Ill. Republican Party v. Pritzker, 973 F.3d 760, 768 (7th Cir. 2020). Thus, “strict scrutiny applies either when a law is content based on its face or when the purpose and justification for the law are content based.” Reed, 576 U.S. at 166. For a content-based restriction to survive strict scrutiny, it must “further[] a compelling interest and [be] narrowly tailored to achieve that interest.” Id. at 171 (quotation marks omitted).
Section 15(b) regulates the collection of an individual’s “biometric identifier or biometric information.”
Sosa has the better argument. We do not see—and Onfido does not explain—how the different categories of information set forth in BIPA’s definitions for “biometric identifier” and “biometric information” relate to the communicative content of that information. If BIPA regulated the use of, for example, face geometry scans of people yelling but not the face geometry scans of people smiling, that could be a content-based regulation, but “BIPA does nothing of the sort.” Clearview AI, 2021 WL 4164452, at *7 (rejecting the defendant’s argument “that BIPA is content-based because it targets specific content—biometric information such as faceprints, but not other content such as photos”). Nor does Onfido argue that although BIPA is content neutral on its face, “the purpose and justification” for its regulation of some categories of information (but not others) is content based. See Reed, 576 U.S. at 164, 166. Because section 15(b) is a content-neutral restriction, we evaluate it using intermediate scrutiny. See Clearview AI, 2021 WL 4164452, at *7–8 (finding that BIPA’s restrictions are content neutral and subject to intermediate scrutiny).
b. Intermediate Scrutiny
“The Supreme Court uses several variations of intermediate scrutiny in its free-speech cases.” ACLU v. Alvarez, 679 F.3d 583, 604 (7th Cir. 2012). Here, both parties base their intermediate scrutiny arguments on the framework for evaluating restrictions on commercial speech set forth by the Supreme Court in Central Hudson Gas & Electric Corp. v. Public Service Commission of New York, 447 U.S. 557 (1980). (See Mem. at 15–17; Resp. at 14–16); see also Fla. Bar v. Went For It, Inc., 515 U.S. 618, 623 (1995)
The Central Hudson analysis has four prongs. See Cent. Hudson, 447 U.S. at 566. First, “we ask as a threshold matter whether the commercial speech concerns unlawful activity or is misleading.” Thompson v. W. States Med. Ctr., 535 U.S. 357, 367 (2002). “If so, then the speech is not protected by the First Amendment.” Id. “If the speech concerns lawful activity and is not misleading, however, we next ask ‘whether the asserted governmental interest is substantial.’” Id. (quoting Cent. Hudson, 447 U.S. at 566). “If it is, then we ‘determine whether the regulation directly advances the governmental interest asserted,’ and, finally, ‘whether it is not more extensive than is necessary to serve that interest.’” Id. (quoting Cent. Hudson, 447 U.S. at 566). “Each of these latter three inquiries must be answered in the affirmative for the regulation to be found constitutional.” Id.; see also Fla. Bar, 515 U.S. at 623–24 (reciting a slightly different formulation for the Central Hudson analysis).
(i) Is the Speech Unlawful or Misleading?
We first consider “whether the commercial speech concerns unlawful activity or is misleading.” Thompson, 535 U.S. at 367. It does not. Obtaining an individual’s biometric data, although regulated, is not unlawful, and Sosa does not argue to the contrary. (See Resp. at 14.) Nor is there anything inherently misleading about biometric data itself or the act of obtaining biometric data. Moreover, even if a company could misleadingly
Sosa disagrees, arguing that Onfido’s actions are misleading because it “takes steps to conceal its involvement in the collection of biometric data, making it difficult to tell that Onfido is even involved.” (Resp. at 14.) But we do not read Sosa’s Complaint as alleging active concealment by Onfido, and Sosa fails to identify any allegation from the Complaint that supports his assertion. (Id.) Sosa also does not cite any case suggesting that either the integration of Onfido’s software into third-party products or consumers’ unawareness of this integration (e.g., Compl. ¶¶ 3, 4, 21) amounts to “misleading” speech that brings our Central Hudson analysis to a halt. We therefore proceed to the second prong of the analysis.
(ii) Is There a Substantial Governmental Interest?
We next ask whether section 15(b) is supported by a substantial governmental interest. See Fla. Bar, 515 U.S. at 624. Section 15(b) is intended to protect consumers’ rights to privacy in and control over their biometric data. Bryant v. Compass Grp. USA, Inc., 958 F.3d 617, 619, 626 (7th Cir. 2020); Rosenbach v. Six Flags Ent. Corp., 2019 IL 123186, ¶¶ 33–34, 129 N.E.3d 1197, 1206 (2019). Illinois has a substantial interest in protecting consumers, and more specifically, protecting their privacy in and control over their biometric data. See Trudeau, 662 F.3d at 953 (“The protection of consumers is a
According to Onfido, however, “the government has no ‘substantial interest’ in restricting the collection, handling, or disclosure of facial geometry” because a person has no reasonable expectation of privacy in her face, which is constantly exposed to the public. (Mem. at 16 (emphasis added); Reply at 8–9.) But Onfido’s argument erroneously equates viewing a person’s face with scanning facial geometry. Although the naked eye can perceive general aspects of a person’s face, it cannot perceive detailed information about the face’s geometry, such as a unique numerical representation of the face’s shape. This is the type of information collected when companies obtain scans of facial geometry. (Compl. ¶¶ 2, 23, 24; Resp. at 3–4); see, e.g., Rivera v. Google Inc., 238 F. Supp. 3d 1088, 1091, 1095 (N.D. Ill. 2017) (scanning photographs and zeroing in on the unique contours of a face “to create a ‘template’ that maps and records [] distinct facial measurements” was a scan of face geometry); In re Facebook Biometric Info. Priv. Litig., 185 F. Supp. 3d 1155, 1171 (N.D. Cal. 2016) (scanning “user-uploaded photographs to create a ‘unique digital representation of the face . . . based on [the] geometric relationship of [] facial features” constituted a scan of face geometry); Clearview AI, 2021 WL 4164452, at *1, *5 (scanning a photograph, measuring and recording “data such as the shape of the cheekbones and the distance between eyes, nose, and ears,” and assigning “that data a numerical value” constituted a scan of face geometry). We
(iii) Does Section 15(b) Directly Advance the Governmental Interest?
Third, we ask whether section 15(b) “directly advances” the governmental interest. Cent. Hudson, 447 U.S. at 566. For this prong to be met, the harms identified by Illinois must be real and the restriction at issue must in fact “alleviate them to a material degree.” Fla. Bar, 515 U.S. at 625–26 (quotation marks omitted).
Both parts of this prong are satisfied. In enacting BIPA, the Illinois General Assembly found that the immutability of an individual’s biometric data means that once it is compromised, the individual suffers an irreparable privacy harm and is at heightened risk for identity theft. See
Onfido does not agree. It first contends that Sosa voluntarily uploaded his photograph and driver’s license and understood that his photograph would be stored. (Mem. at 16–17.) It then contends that requiring a company to make certain disclosures and obtain a release in writing, as section 15(b) does, fails to “materially advance any interest because—as this case illustrates—other[] forms of disclosure and consent are equally effective.” (Id. at 17.) Taking these contentions together, Onfido appears to argue that (1) Sosa consented to Onfido’s collection of his photograph by voluntarily uploading it with the understanding that the photograph would be stored, and (2) this consent is “equally effective” as the disclosures and consent required by section 15(b).
This argument is a non-starter. Consenting to Onfido’s collection of a photograph is not the same as consenting to Onfido’s collection of biometric data—here, a scan of face geometry. Because section 15(b) is concerned with obtaining consumers’ informed consent for the collection of their biometric data, not their photographs, see
(iv) Is Section 15(b) More Extensive Than Necessary?
Finally, we come to the fourth Central Hudson prong: is section 15(b) “more extensive than [] necessary to serve” the government’s interest? Cent. Hudson, 447 U.S. at 566. To answer this question, “we examine the relationship between the [government’s] interests and the means chosen to serve them.” Fla. Bar, 515 U.S. at 632. The “fit” between the government’s interests and the restriction at issue need not be perfect or the least restrictive means available. Id. The fit only needs to be reasonable, i.e., “one whose scope is in proportion to the interest served.” Id. (quotation marks omitted).
Section 15(b) meets this standard. First, it does not outright prohibit companies like Onfido from obtaining biometric data; it merely requires them to obtain informed consent before doing so. Second, it is not too onerous to require a company that wants to collect a consumer’s sensitive and immutable biometric data to obtain the consumer’s consent before doing so. See
Onfido’s argument to the contrary again does not persuade us. Onfido contends that section 15(b) is more extensive than necessary to prevent identity theft “because it restricts companies from engaging in wholly permissible activities.” (Mem. at 17; Reply at 10.) But the government’s interest is broader than simply preventing identity theft; it is protecting consumers’ rights to privacy in and control over their biometric data. More to the point, any restriction that proceeds past the first Central Hudson prong curbs lawful activities in some way. See Fla. Bar, 515 U.S. at 623–24; Cent. Hudson, 447 U.S. at 563–64, 566. Yet this does not mean that the restriction fails the fourth and final Central Hudson prong. See, e.g., Fla. Bar, 515 U.S. at 632–34 (bar regulation satisfied the final Central Hudson prong); Trudeau, 662 F.3d at 952–54 (same for bond requirement). So too here: section 15(b)’s restrictions are not more extensive than necessary simply because they regulate the otherwise permissible act of obtaining biometric data.
* * *
In conclusion, we deny Onfido’s motion to dismiss based on the First Amendment because section 15(b) does not restrict Onfido’s speech, and even if it does, it is a content-neutral restriction that satisfies Central Hudson’s intermediate level of scrutiny.
For the foregoing reasons, we deny Onfido’s motion to dismiss (Dkt. No. 45). Onfido shall answer Sosa’s Complaint by May 16, 2022. It is so ordered.
Marvin E. Aspen
United States District Judge
Dated: April 25, 2022