Meta Lays the Groundwork for Potential Sea Change in BIPA Litigation
In Zellmer v. Meta Platforms, the Ninth Circuit evaluated an appeal from summary judgment entered in favor of Meta.1 This case stemmed from the allegation that Facebook—now Meta Platforms—collected biometric information when it created “face signatures” for the Facebook Tag Suggestions feature. This case specifically involved persons who were not Facebook users, but appeared in photos uploaded to Facebook.
For the tagging feature, Facebook created “face signatures,” or a string of numbers that represented a particular facial image. Notably, these “face signatures” could not be reverse-engineered to derive information about a person. The focus of the decision was on the issue of whether the information collected could identify a person, finding “if either form of biometric data [biometric identifiers or biometric information] cannot identify an individual, it is not an identifier and thus not covered by BIPA.”2
The key was that face signatures could not identify non-users, and thus the Court affirmed summary judgment in favor of Meta. However, the court noted this different from a scenario in which biometric information could identify someone, but was not used to do so.
X’s Motion to Dismiss BIPA Case Granted After Plaintiff Failed to Allege that Pictures Were Biometric Identifiers
A Northern District of Illinois court recently granted a Motion to Dismiss filed by X (formerly known as Twitter) on the grounds that software which scans images uploaded to X for nudity does not necessarily create biometric identifiers under BIPA.3 In 2015, X began to implement a software called PhotoDNA to review and tag images that may contain inappropriate materials as not-safe-for-work. Plaintiff alleged that PhotoDNA, which works by creating a unique hash of each image and comparing that hash to other images in its database, violates BIPA.4 But, on June 13, 2024, the Court found that Plaintiff’s Complaint did not allege that such hashes were “biometric identifiers” under BIPA.
X argued first that the plaintiff failed to allege facial geometry was captured when a hash is created. The Court agreed with this argument that there were no specific factual allegations to support scanning of facial geometry. The Court next evaluated X’s argument that the plaintiff failed to allege that PhotoDNA information could be used to identify the individuals in the photo. The Court agreed here as well, noting that the complaint “fails to sufficiently allege that the PhotoDNA hashes consist of a scan of face geometry that could be used to identify an individual.” The Court’s ruling provides much needed good news for defendants, suggesting that courts may be willing to dig deeper into the actual functionality of biometric technology to evaluate whether it is covered by BIPA.
Clearview AI Reaches Class Settlement with “Unique” Payment of Stake in Future Company Growth
Facing twelve BIPA class actions consolidated into a multidistrict litigation pending in the Northern District of Illinois, Clearview AI reached a “unique” deal to settle them in exchange for investments in the company. Clearview AI’s facial recognition software relies on an algorithm that matches faces to a database of images collected from the internet. In a series of cases beginning in 2020, Plaintiffs accused the company of failing to obtain consent before collecting, storing, using, and profiting from biometric data. After years of mediation and motions to dismiss, Clearview AI announced a settlement on June 12, 2024, where it agreed to fund a Settlement Fund by offering class members a stake in its future value upon an IPO or sale (notably, this stake is currently valued at $51 million).5 Clearview AI opted for the “unique structure” due to the sheer number of people in the class, describing it as “virtually anyone in the United States whose face appears on the internet.”6
A clear grasp of when a business is obliged to seek consent from users is vital, due to the potentially business-ending price tags on BIPA exposure.
Suit Challenges Target’s New Biometric Security System
On May 30, 2024, a new class action was filed against Target Corporation alleging that Target’s new theft-prevention technology, which utilizes video surveillance, facial-recognition, and artificial intelligence, violates BIPA.7 Plaintiffs’ Complaint cites, in part, a Target press release stating that it is making “significant investments in strategies to prevent [theft] from happening in our stores and protect our guests and our team.”8 Plaintiffs allege centrally that Target fails to inform customers that their biometric information is being “surreptitiously” collected for theft prevention.
This suit and several similar ones against Amazon and T-Mobile over their loss prevention systems emphasize that companies utilizing such systems must ensure compliance with the state and local biometric privacy laws.
The BIPA landscape continues to evolve with new technologies, much of which simply did not exist when the BIPA was adopted in 2008. Nevertheless, the myriad gray areas with respect to the BIPA (and the biometric laws of other states and municipalities) require companies to be fully cognizant of the risks associated with any data collection practices.
1 Opinion, Zellmer v. Meta Platforms, Inc., -- F. 4th --, 2024 WL 3016946 (9th Cir. June 17, 2024).
2 Id. at *5 (“[S]cans of face geometry fall within BIPA's list, but are not covered by BIPA if they cannot identify a person.”)
3 Memorandum Opinion and Order, Martrell v. X Corp., Case No. 23 C 5449, N. D. Illinois.
4 Id. at 2-3.
5 Plaintiff’s Unopposed Motion and Memorandum in Support of Preliminary Approval of Class Action Settlement, In re: Clearview AI, Inc. Consumer Privacy Litigation, Case No. 1:21-cv-00135, N.D. Illinois.
6 Id. at 2.
7 Class Action Complaint, Arnold et al. v. Target Corporation, Case No. 1:24-cv-04452, N.D. Illinois.
8 Id. at ¶ 22.
