SHEPPARD v. FANTASIA TRADING LLC (2024)

Proceedings: Order (1) GRANTING Defendant's Motion to Dismiss (Dkt. No. 16); and (2) VACATING the April 29, 2024 Hearing (IN CHAMBERS)

Before the Court is Defendant Fantasia Trading LLC's motion to dismiss, or in the alternative to strike class allegations, pursuant to Federal Rules of Civil Procedure 12(b)(6) and 12(f). (“Motion,” Dkt. No. 16.) The Court determines this matter appropriate for resolution without a hearing. See Fed. R. Civ. P. 78; L.R. 7-15. After considering the papers filed in support of and in opposition to the Motion, the Court GRANTS the Motion. The Court VACATES the April 29, 2024 hearing.

I. BACKGROUND

On November 27, 2023, Plaintiffs Isiah Sheppard, Bernabe Benitez, Helene Lauzier-Meyer, and Hilscio Rivera (collectively, “Plaintiffs”) filed a class action complaint against Defendant Fantasia Trading LLC (“Defendant” or “Fantasia”). (“Complaint,” Dkt. No. 1.) On January 22, 2024, Defendant moved to dismiss the Complaint. (Dkt. No. 12.) Plaintiffs filed a first amended complaint on February 12, 2024. (“FAC,” Dkt. No. 14.) On February 15, 2024, the Court denied Defendant's first motion to dismiss as moot because Plaintiffs had filed the FAC. (Dkt. No. 15.)

The FAC alleges two causes of action: (1) violation of Illinois's Biometric Information Privacy Act (“BIPA”), 740 ILCS 14/15(b) (“Section 15(b)”); and (2) violation of BIPA, 740 ILCS 14/15(a) (“Section 15(a)”). (See FAC.) On February 26, 2024, Defendant filed this Motion. (Motion.) On March 18, 2024, Plaintiffs opposed the Motion. (“Opposition,” Dkt. No. 19.) Defendant replied on April 8, 2024. (“Reply,” Dkt. No. 20.) On April 19, 2024, Defendant filed a notice of supplemental authority in support of the Motion. (“Supp. Authority,” Dkt. No. 21.) Plaintiffs filed a response to the Supp. Authority on April 19, 2024. (“Supp. Authority Response,” Dkt. No. 22.)¹

II. FACTUAL ALLEGATIONS

Plaintiffs allege the following facts, which are assumed to be true for the purposes of this Motion. See Am. Fam. Ass'n, Inc. v. City & Cnty. of San Francisco, 277 F.3d 1114, 1120 (9th Cir. 2002).

A. Parties

Plaintiff Isiah Sheppard (“Sheppard”) is a resident of Cook County, Illinois and works as an Uber Eats and DoorDash delivery driver making deliveries to customers’ homes. (FAC ¶ 10.) As part of Sheppard's regular delivery process, he walks to the front door of a customer's residence to make a delivery. (Id.) On multiple deliveries, Defendant's security system captured scans of Sheppard's face and/or hands. (Id.) Sheppard has a publicly available Facebook account which is searchable by his name and which features photos of himself. (Id.)

Plaintiff Hilscio Rivera (“Rivera”) is a resident of Cook County, Illinois and works as an Amazon, DoorDash, Postmates, Dispatch, Veho, AxleHire, and Roadie delivery driver making deliveries to customers’ homes. (Id. ¶ 11.) As part of Rivera's regular delivery process, he walks to the front door of a customer's residence to make a delivery. (Id.) On multiple deliveries, Defendant's security system captured scans of Rivera's face and/or hands. (Id.) Rivera has publicly available Facebook and Twitter accounts which are searchable by his name and which feature photos of himself. (Id.)

Plaintiff Helene Lauzier-Meyer (“Lauzier-Meyer”) is a resident of Sangamon County, Illinois and works as a DoorDash and Spark delivery driver making deliveries to customers’ homes. (Id. ¶ 12.) As part of Lauzier-Meyer's regular delivery process, she walks to the front door of a customer's residence to make a delivery. (Id.) On multiple occasions, Defendant's security system captured scans of Lauzier-Meyer's face and/or hands. (Id.) Lauzier-Meyer has a publicly available Facebook account which is searchable by her maiden name and which features images of herself. (Id.)

Plaintiff Bernabe Benitez (“Benitez”) is a resident of Lake County, Illinois and works as an UberEats delivery driver who makes deliveries to customers’ homes. (Id. ¶ 13.) As part of Benitez's regular delivery process, he walks to the front door of a customer's residence to make a delivery. (Id.) On multiple occasions, Defendant's security system captured scans of Benitez's face and/or hands. (Id.) Benitez has publicly available Facebook and TikTok accounts which are searchable by his last name and which feature images of himself. (Id.)

Defendant Fantasia Trading LLC is a Delaware corporation with its principal place of business in Ontario, California. (Id. ¶ 14.) It is the parent company of Anker Innovations and Eufy. (Id.) Eufy is a home security technology company that offers security cameras supported by high-quality video and artificial intelligence (“AI”) monitoring. (Id. ¶ 15.) Eufy is “an emerging leader in home security systems.” (Id. ¶ 19.) It “isn't like your traditional alarm company. It's a tech first company.” (Id.)

B. Eufy's Technology

Eufy sells 36 different security camera models, each equipped with on-device AI monitoring capabilities. (Id. ¶ 20.) These cameras include multiple models of doorbell cameras, exterior mounted and floodlight cameras, and a series of base stations. (Id.) Eufy's AI technology is categorized as either “Local AI” or “BionicMind AI.” (Id. ¶ 21.) Together, the AI technologies offer homeowners several different detection features, depending on the user's subscription and base station. (Id.) “Local AI” (Eufy's on-device AI mechanism) uses an “embedded AI chip” built into the cameras which provides “local, safe, and intelligent detection.” (Id. ¶ 22.) “BionicMind AI” has “the ability to recognize similar faces, body shapes/positions, different objects, and even human behavior with is machine self-learning system.” (Id. ¶ 23.) The system conducts this analysis “locally on the base station” and is added to an already operating Eufy system by incorporating the proper base station. (Id.)

Eufy's intelligent detection arises through six unique features: (1) a human detection feature where the system tries “to detect objects similar to the human shape and filter out other objects like cars and animals for motion alerts”; (2) facial detection where the system tries to “detect and screen faces shown in the video image”; (3) human facial recognition where the system tries to “recognize faces in the video image and identify the person for [the homeowner]”; (4) pet detection where the system tries “to detect pets which appear in the video image”; (5) crying detection where the system tries “to detect crying and will notify [the homeowner] if necessary”; and (6) vehicle detection where the system “will catch up with the user's vehicle in the backyard or driveway.” (Id. ¶ 24.)

Generally, the kind of base station the homeowner uses affects which version of Eufy's AI the homeowner can turn on. (Id. ¶ 25.) For example, the base level “Original HomeBase” allows all AI-incorporated cameras and battery-operated video doorbells to use the human detection and facial recognition features. (Id.) The “HomeBase 3,” alternatively, allows the homeowner to deploy each AI recognition feature. (Id.) “HomeBase E” and “HomeBase 2” allow the homeowner to use just the human detection and facial recognition detection features. (Id.) Although the homeowner has, in some instances, a choice of which base station to pair with their Eufy camera, eufyCam (eufyCam, eufyCam E, eufyCam 2, eufyCam 2C, eufyCam 2 Pro, eufyCam 2C Pro) must be used with HomeBase, which ensures that EufyCam and EufyCam2 cameras are AI-capable. (Id. ¶ 26.) Likewise, the EufyCam 3 comes included with HomeBase 3. (Id.)

However, unlike the rest of the products, Eufy's wired video doorbells allow the homeowner to use the human- and facial-detection features without needing a base station. (Id. ¶ 27.) Regardless of which camera is used, Eufy's Local AI system is remarkably accurate. (Id. ¶ 28.) As Eufy boasts, its on-camera AI human-detection feature “accurately detect[s] humans and vehicles” 95% of the time. (Id.) Likewise, users can enhance their system's AI capabilities by adding Eufy's BionicMind AI-equipped base stations to their security systems. (Id. ¶ 29.) Eufy's BionicMind AI system, which can be added simply by connecting a new base station, “uses self-learning algorithms after every facial and body shape scan to improve recognition accuracy to more than 99.9% over time—no matter what [the subject is] wearing and how [the subject] approach[es] the camera.” (Id.)

Human detection, available for “Local AI” and “BionicMind AI” users, “detects and captures motion ․ for accurate object classification.” (Id. ¶ 30.) The technology “works in two steps.” (Id.) First, “[w]hen the camera detects motion in its field of view, the AI engine analyzes the figure to determine if it is a human being or not.” (Id.) Second, “if the captured face meets the AI engine's analysis parameters, the AI engine will try to capture the face and then send a notification to the user.” (Id.) This step allows the system to use the captured biometric identifiers in two scenarios. (Id.)

Once stored with the proper base station connected, Eufy's “cross camera tracking” feature will “automatically compile shots of the same event and person and organize them chronologically into a single clip” if an event occurs within the view of multiple cameras. (Id. ¶ 31.) As Eufy explains, “[w]hen the same individual appears across multiple cameras within a specified timeframe, the system automatically locates and merges these footage [sic] into a single video” so that the homeowner can “easily review the entire activity of that specific individual in a single video.” (Id. ¶ 32.) To piece the footage together, the BionicMind base station “analyzes the video content and stitches it together in-real [sic]” time and, “[a]fter each camera has finished recording and saving videos to [the base station], [ ] re-analyzes the video content for splicing.” (Id. ¶ 33.) Cameras that are not compatible with BionicMind base stations cannot stitch images together in real time and, instead, analyze saved video after recording has ended. (Id.) The homeowner then receives a notification alerting them that the device has either detected an already catalogued face, like a friend, or a new, unknown visitor like a delivery driver. (Id.)

Eufy is capable of making these identifications by storing and analyzing biometric-identifier data so the AI can “keep learning the details of the characteristics of people, including different angles of the face and bodies” to “help the AI recognize a person more accurately and quickly.” (Id. ¶ 35.) That data is then accessible to the user via the EufySecurity App. (Id.) Eufy “readily admits” that “[t]he Cross-Camera Tracking function depends on a human feature recognition algorithm that determines the similarity of an individual's appearance in two videos to stitch them together. Even if the face is not visible in the video, videos of similar-looking individuals are still identified and stitched together.” (Id. ¶ 36.)

C. Eufy's Data Management Practices

Although Eufy represents that its AI and biometric collections are stored locally, as recently as December 2022, “it was revealed that ․ Eufy was sending data from its cameras to the cloud, despite ․ advertising its cameras and video doorbells [used] local-only recording ․ [after] a security researcher found that the company was uploading images from the cameras to AWS servers alongside facial recognition data.” (Id. ¶ 37.) Specifically, in testing one of Eufy's devices, the researcher found that “[t]he doorbell's camera was uploading facial recognition data from the camera to Eufy's cloud servers with identifiable information attached, and that this data wasn't actually removed from Eufy's servers when the related footage had been deleted from the Eufy app.” (Id.) The researcher also expressed concern that “Eufy could link footage collected from different cameras and apps to individuals using facial recognition.” (Id.) AWS Servers are servers offered by Amazon.com to companies like Defendant as “low-cost ways to deliver their websites and web applications” to users. (Id. ¶ 38.)

Once Eufy's data management practices were discovered, Eufy acknowledged in a January 2023 press release that “[p]reviously, we [had] one device, the Video Doorbell Dual, that sent and stored an image of the user to our secure cloud․ First, the purpose of sending a user image from the eufy App to our devices is to give the local facial recognition software a baseline to run its algorithm.” (Id. ¶ 39.) Eufy's data collection and storage systems were further scrutinized because of their vulnerability in storing and protecting Eufy customer and recording data. (Id. ¶ 40.) In late 2022, technology reporters and security experts again “accused ․ Eufy of lying to users that their video streams were end-to-end encrypted, even though users were easily able to access the streams using simple browser tools and a desktop media player.” (Id. ¶ 41.) As data and technology giant Cisco explains, encryption is “the process of converting or scrambling data and information into an unreadable, encoded version that can only be read with authorized access ․ and is [a] widely used security tool that can prevent the interception of sensitive data, either while stored in files or while in transit across networks.” (Id. ¶ 42.)

The reporters’ accusations turned out to be correct. (Id. ¶ 43.) “In a series of emails ․ Anker [ ] finally admitted its Eufy security cameras [were] not natively end-to-end encrypted—they [could] and did produce unencrypted video streams from Eufy's web portal.” (Id. (emphasis in original).) In fact, Eufy's systems were so vulnerable that, despite “a Eufy Support representative[’s] state[ment] that [facial] thumbnails [were] restricted by account logins,” one security expert was easily able to hack into his own Eufy system—despite unplugging it—and “could pull up a thumbnail image of himself, an image of the feed shortly before he was visible, and—perhaps more concerning—ID numbers indicating his recognized face and his status as the camera owner.” (Id. ¶ 44.) Eufy has since hired “outside security and penetration testing companies to audit [its] practices.” (Id. ¶ 45.)

In sum, unbeknownst to Plaintiffs, Defendant collected, scanned, and indefinitely stored in an electronic database Plaintiffs’ face and/or hand geometry, each time that Plaintiffs and class members made a delivery to Defendant's customers’ homes. (Id. ¶ 55.) Defendant did not inform Plaintiffs in writing that it was doing so. (Id.) Defendant never informed Plaintiffs and class members of the specific purpose and length of time for which their face and/or hand geometry would be collected, stored, and used, nor did Defendant ever obtain a written release. (Id. ¶ 56.) Finally, Defendant failed to publish policies for public access identify its retention schedules or guidelines for permanently destroying any “biometric identifiers” collected. (Id. ¶ 57.)

III. LEGAL STANDARD

A. Rule 12(b)(6)

Under Rule 12(b)(6), a party may bring a motion to dismiss for failure to state a claim upon which relief can be granted. Rule 12(b)(6) must be read in conjunction with Rule 8(a), which requires a “short and plain statement of the claim showing that a pleader is entitled to relief,” in order to give the defendant “fair notice of what the claim is and the grounds upon which it rests.” Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 555, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007); see Ileto v. Glock Inc., 349 F.3d 1191, 1199-1200 (9th Cir. 2003). When evaluating a Rule 12(b)(6) motion, a court must accept all material allegations in the complaint—as well as any reasonable inferences to be drawn from them—as true and construe them in the light most favorable to the non-moving party. See Doe v. United States, 419 F.3d 1058, 1062 (9th Cir. 2005); ARC Ecology v. U.S. Dep't of Air Force, 411 F.3d 1092, 1096 (9th Cir. 2005); Moyo v. Gomez, 32 F.3d 1382, 1384 (9th Cir. 1994). Courts are not required, however, “to accept as true allegations that are merely conclusory, unwarranted deductions of fact, or unreasonable inferences.” In re Gilead Scis. Sec. Litig., 536 F.2d 1049, 1055 (9th Cir. 2008) (internal citation and quotation omitted). Courts also need not accept as true allegations that contradict facts which may be judicially noticed. See Mullis v. U.S. Bankr. Court, 828 F.2d 1385, 1388 (9th Cir. 1987).

“While a complaint attacked by a Rule 12(b)(6) motion to dismiss does not need detailed factual allegations, a plaintiff's obligation to provide the ‘grounds’ of his ‘entitlement to relief’ requires more than labels and conclusions, and a formulaic recitation of the elements of a cause of action will not do.” Twombly, 550 U.S. at 555, 127 S.Ct. 1955 (citations omitted). Rather, the allegations in the complaint “must be enough to raise a right to relief above the speculative level.” Id.

To survive a motion to dismiss, a plaintiff must allege “enough facts to state a claim to relief that is plausible on its face.” Id. at 570, 127 S.Ct. 1955; Ashcroft v. Iqbal, 556 U.S. 662, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009). “The plausibility standard is not akin to a ‘probability requirement,’ but it asks for more than a sheer possibility that a defendant has acted unlawfully. Where a complaint pleads facts that are ‘merely consistent with’ a defendant's liability, it stops short of the line between possibility and plausibility of ‘entitlement to relief.’ ” Iqbal, 556 U.S. at 678, 129 S.Ct. 1937 (quoting Twombly, 550 U.S. at 556, 127 S.Ct. 1955). The Ninth Circuit has clarified that (1) a complaint must “contain sufficient allegations of underlying facts to give fair notice and to enable the opposing party to defend itself effectively,” and (2) “the factual allegations that are taken as true must plausibly suggest an entitlement to relief, such that it is not unfair to require the opposing party to be subjected to the expense of discovery and continued litigation.” Starr v. Baca, 652 F.3d 1202, 1216 (9th Cir. 2011).

B. Rule 12(f)

Under Rule 12(f) of the Federal Rules of Civil Procedure, a district court “may strike from a pleading an insufficient defense or any redundant, immaterial, impertinent, or scandalous matter.” Fed. R. Civ. P. 12(f). “The function of a 12(f) motion to strike is to avoid the expenditure of time and money that must arise from litigating spurious issues by dispensing with those issues prior to trial.” Whittlestone, Inc. v. Handi–Craft Co., 618 F.3d 970, 973 (9th Cir. 2010) (internal quotation marks omitted). “Where the complaint demonstrates that a class action cannot be maintained on the facts alleged, a defendant may move to strike class allegations prior to discovery.” Sanders v. Apple Inc., 672 F. Supp. 2d 978, 990 (N.D. Cal. 2009). Motions under Rule 12(f) are “generally regarded with disfavor because of the limited importance of pleading in federal practice[.]” Neilson v. Union Bank of Cal., N.A., 290 F. Supp. 2d 1101, 1152 (C.D. Cal. 2003). A court has discretion in determining whether to strike matter from a pleading. Fantasy, Inc. v. Fogerty, 984 F.2d 1524, 1528 (9th Cir. 1993), rev'd on other grounds, 510 U.S. 517, 114 S.Ct. 1023, 127 L.Ed.2d 455 (1994).

C. Rule 15

Rule 15 provides that leave to amend “shall be freely given when justice so requires.” Fed. R. Civ. P. 15(a). The Ninth Circuit has held that “ ‘[t]his policy is to be applied with extreme liberality.’ ” Eminence Cap., L.L.C. v. Aspeon, Inc., 316 F.3d 1048, 1051 (9th Cir. 2003) (quoting Owens v. Kaiser Found. Health Plan, Inc., 244 F.3d 708, 712 (9th Cir. 2001)). Generally, a “district court should grant leave to amend even if no request to amend the pleading was made, unless it determines that the pleading could not possibly be cured by allegation of other facts.” Lopez v. Smith, 203 F.3d 1122, 1127 (9th Cir. 2000) (en banc) (citation omitted).

IV. DISCUSSION

Plaintiffs bring two causes of action: (1) violation of BIPA Section 15(b); and (2) violation of BIPA Section 15(a). (See FAC.) Defendant argues the following: (1) Plaintiffs fail to state a claim under Section 15(b) because they do not allege that Defendant captures, collects, or obtains their biometric identifiers, nor does the statute require that Defendant provide notice to Plaintiffs; (2) Plaintiffs fail to state a claim under Section 15(a) because they do not allege that Defendant is in possession of their biometric data; and (3) the Court should strike Plaintiffs’ class allegations. (See Motion.) The Court addresses each of these arguments in turn.

A. Count One: BIPA Section 15(b)

BIPA Section 15(b) provides that “[n]o entity may collect, capture, purchase, receive through trade, or otherwise obtain a person's or a customer's biometric identifier or biometric information” unless it first “(1) informs the subject ․ in writing that a biometric identifier or biometric information is being collected or stored; (2) informs the subject ․ in writing of the specific purpose and length of term for which a biometric identifier or biometric information is being collected, stored, and used; and (3) receives a written release executed by the subject of the biometric identifier or biometric information.” 740 ILCS 14/15(b). Defendant argues that Plaintiffs fail to allege the existence of any “biometric identifier” or “biometric information” about them, that they do not allege Defendant captures, collects, or obtains any information about them, and that Section 15(b) does not require Defendant to obtain consent from parties with whom it has no relationship. (See Motion at 6-11.) The Court addresses these arguments in turn.

1. Allegations of Biometric Identifiers

BIPA defines a biometric identifier as a “retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.” 740 ILCS 14/10; see also Clarke v. Aveda Corporation, 2023 WL 9119927, at *2 (N.D. Ill. Dec. 1, 2023). Separately, biometric information is defined as “any information ․ based on an individual's biometric identifier used to identify an individual.” 740 ILCS 14/10. Defendant argues that data only qualifies as a biometric identifier if it makes a defendant “capable of determining” plaintiffs’ identities because the defendant can “discern some real-world identifying information,” such as “names and email addresses,” about the plaintiffs. (See Motion at 7.) As such, Defendant contends, Plaintiffs fail to allege the existence of any biometric identifier because they do not plead that Defendant possessed their real-world identifying information. (See id.) The Court disagrees.

Here, Plaintiffs allege that Defendant scanned their “face and/or hand” geometry. (FAC ¶ 55.) As other courts in this circuit have found, BIPA itself provides an “explicit definition” for biometric identifiers, which includes scans of face or hand geometry. See Colombo v. YouTube, LLC, 679 F. Supp. 3d 940, 944 (N.D. Cal. 2023) (rejecting a defendant's argument that biometric identifiers must “consist of, or at least link to, identity information (e.g., name, email address)”). “When a term is defined within a statute, that term must be construed by applying the statutory definition provided by the legislature.” People v. Fiveash, 396 Ill.Dec. 98, 39 N.E.3d 924, 928 (Ill. 2015). Though some courts have “read into the statute a requirement that scans of unique personal features must be capable of being used to uniquely identify a plaintiff,” this Court disagrees. See Konow v. Brink's, Incorporated, ––– F.Supp.3d ––––, ––––, 2024 WL 942553, at *4 (N.D. Ill. Mar. 5, 2024) (internal quotations omitted) (citing Clarke, 2023 WL 9119927, at *2; Carpenter v. McDonald's Corporation, 580 F. Supp. 3d 512, 515 (N.D. Ill. 2022)). BIPA's text provides little basis for the “capable of determining” standard—nowhere does the statute state that biometric identifiers must consist of or link to identity information such as names or addresses. See 740 ILCS 14/; Ji v. Naver Corporation, 2023 WL 6466211, at *12 n.10 (N.D. Cal. Oct. 3, 2023) (using the “capable of determining” standard because the plaintiffs argued under it, but stating that “the Court does not hold here that a plaintiff making an allegation under [Section] 15(b) just about biometric identifiers (such as facial geometry scans) necessarily must meet the ‘capable of determining’ standard”); Konow, ––– F.Supp.3d at ––––, 2024 WL 942553, at *4 (“The court is not certain that the ‘uniquely identifying’ test is supported by BIPA's plain language.”). And to the extent Defendant reads the term “identifier” to mean that the scans must link to identity information, this Court agrees with the finding in Colombo that “the Illinois legislature was perfectly free to define ‘biometric identifier’ in a specific manner that is not tethered to the plain meaning of the word ‘identifier’ alone.” Colombo, 679 F. Supp. 3d at 944-45 (citing Tanzin v. Tanvir, 592 U.S. 43, 141 S. Ct. 486, 490, 208 L.Ed.2d 295 (2020) (“[I]f a statute defines a ‘State’ to include territories and districts, that addition to the plain meaning controls.”)).

Moreover, BIPA's omission of the phrase “used to identify” in its definition of biometric identifier, but its inclusion in the definition of biometric information, indicates that a biometric identifier need not be used to identify an individual. See Melzer, 2023 WL 3098633, at *3 (“[I]t is a simple conclusion that BIPA does not require a ‘biometric identifier’ to be used to identify an individual.”); Vance v. Microsoft Corporation, 525 F. Supp. 3d 1287, 1296 (W.D. Wash. 2021) (differentiating biometric identifiers, which include facial scans, from biometric information); Dana Tank Container, Inc. v. Human Rights Comm'n, 292 Ill.App.3d 1022, 227 Ill.Dec. 179, 687 N.E.2d 102, 104 (1997) (“Where the legislature uses certain words in one instance and different words in another, it intended different results.”).

Rather, as multiple courts across the country have held, a “commonsense interpretation” of BIPA “compels a finding that facial scans captured and collected ․ fall within BIPA's definition of a ‘biometric identifier,’ which explicitly includes a scan of facial geometry—a term that this Court views as unambiguously clear.” Melzer v. Johnson & Johnson Consumer Inc., 2023 WL 3098633, at *3 (D.N.J. Apr. 26, 2023); see also Rivera v. Google Inc., 238 F. Supp. 3d 1088, 1095 (N.D. Ill. 2017) (“[A] face template is one of the specified biometric identifiers in the Privacy Act, namely, a scan of face geometry.”) (internal quotations and citations omitted); Sosa v. Onfido, Inc., 600 F. Supp. 3d 859, 870 (N.D. Ill. 2022) (“The faceprints extracted by Onfido plausibly constitute scans of face geometry and, therefore, biometric identifiers under BIPA.”) (internal quotations and citations omitted). Under this commonsense interpretation of BIPA, Plaintiffs adequately allege the existence of biometric identifiers—namely, scans of their face or hand geometry. (FAC ¶¶ 10-13, 55.)

Even assuming a narrower interpretation of “biometric identifier” in line with the “capable of determining” standard, the Court finds that Plaintiffs still plausibly state a claim. Courts which follow the narrower approach require there be “some additional connection between the collected scans and the plaintiffs’ identities.” See Konow, ––– F.Supp.3d at ––––, 2024 WL 942553, at *4. In Clarke, plaintiffs alleged that Aveda, the defendant, “scanned and collected, and then stored ․ digital copies of each [p]laintiffs’ facial geometry.” Clarke, 2023 WL 9119927, at *2. However, the plaintiffs provided no allegations demonstrating that Aveda was “capable of identifying them from this data.” Id. Similarly, in Daichendt v. CVS Pharmacy, Inc., the plaintiffs alleged that CVS, the defendant, violated BIPA by collecting biometric data with a passport photo system. 2022 WL 17404488, at *5 (N.D. Ill. Dec. 2, 2022). Employees at CVS stores took a photo with a digital camera, then scanned the digital image for biometric identifiers. Id. But the court in Daichendt granted CVS's motion to dismiss because the plaintiffs failed to allege that they provided CVS with “their names or physical or email addresses,” which could “connect the voluntary scans of face geometry with their identities.” Id.

Unlike the plaintiffs in Clarke and Daichendt, Plaintiffs here do plausibly plead a connection between the facial and hand scans and their identities. Plaintiffs allege that Defendant recently stored images and facial recognition data on the cloud, that Defendant “could [therefore] link footage collected from different cameras and apps to individuals using facial recognition,” and that Plaintiffs all have publicly accessible social media profiles containing their names and faces. (FAC ¶¶ 10-13, 37.) In sum, Plaintiffs plead that “Defendant is capable of employing ․ [its] facial recognition technology used in its cameras and base stations on someone's public facing social media profile to match that individual's biometric identifiers collected from their public online photos to their biometric identifiers collected by its cameras.” (Id. ¶ 77.) These allegations are sufficient to plausibly establish a connection between the scans and Plaintiffs’ identities and to plead that Defendant is “capable of determining” Plaintiffs’ identities, especially under the minimal pleading standards of Rule 8. See Melzer, 2023 WL 3098633, at *3-4 (finding that the plaintiff's BIPA allegations established even the narrower definition of biometric identifier because the plaintiff plead that “once a person's face is scanned and its unique facial geometry is captured, computers can store this information and use it to identify that individual, including any other time that person's face appears on the internet or in public”).

Accordingly, the Court finds that Plaintiffs have properly alleged the existence of biometric identifiers.

2. Allegations that Defendant Collected, Captured, or Obtained Biometric Data

Defendant next argues that Plaintiffs fail to allege that Defendant collected, captured, or obtained their biometric identifiers. (See Motion at 9-11.) Defendant contends that Plaintiffs must plead facts showing that their biometric data was sent from the camera devices to some other location controlled by Defendant. (Id. at 10.) However, Defendant argues, Plaintiffs plead that any data purportedly sent by the video doorbells was transmitted to Anker, not to Defendant Fantasia. (Id. at 11.)

Under BIPA, Plaintiffs must plead that Defendant “collect[ed], captur[ed], purchas[ed], receiv[ed] through trade, or otherwise obtain[ed] a person's or a customer's biometric identifier or biometric information.” 740 ILCS 14/15(b). “BIPA does not define ‘collect,’ but courts have held that collection requires more than mere possession.” Theriot v. Louis Vuitton North America, 645 F. Supp. 3d 178, 183 (S.D.N.Y. 2022). “[F]or an entity to ‘collect,’ biometric data, it must take an ‘active step,’ towards that collection.” Id. (citing Naughton v. Amazon.com, Inc., 2022 WL 19324, at *3 (N.D. Ill. Jan. 3, 2022); Namuwonge v. Kronos, Inc., 418 F. Supp. 3d 279, 286 (N.D. Ill. 2019)). Citing an Illinois state court case, Defendant argues it is insufficient to plead that the biometric data is captured or collected “on the user's own device”—rather, Plaintiffs must plead that the biometric identifiers are collected “on the defendant's device.” See Barnett v. Apple, 469 Ill.Dec. 759, 225 N.E.3d 602, 611 (Ill. 2022).

Plaintiffs allege that Eufy, an Anker brand,² “was sending data from its cameras to the cloud,” and that a researcher discovered one Eufy camera “was uploading facial recognition data from the camera to Eufy's cloud servers with identifiable information attached.” (FAC ¶¶ 37, 43.) Plaintiffs also allege that Eufy itself acknowledged “one device, the Video Doorbell Dual, ․ sent and stored an image of the user to our secure cloud.” (Id. ¶ 39.) The FAC also alleges that Defendant Fantasia is both Anker and Eufy's parent company. (FAC ¶ 14.) Were Anker a defendant in this action, the allegations that biometric identifiers were sent from the Eufy cameras to Anker/Eufy's cloud server would likely suffice to plead an “active step” towards collection, as BIPA requires. See Theriot, 645 F. Supp. 3d at 183. However, nowhere do Plaintiffs plead that Fantasia itself—the only defendant in this action—took any “active step” towards collecting the biometric identifiers (e.g., by transferring the data to a Fantasia cloud).

Plaintiffs respond only that Defendant makes an improper “group pleading argument,” which was previously rejected by a court in Sloan v. Anker Innovations Limited, ––– F.Supp.3d ––––, ––––, 2024 WL 935426, at *3 (N.D. Ill. Jan. 9, 2024). (See Opposition at 9-10.) In Sloan, a case which also dealt with Eufy cameras, the court found that the plaintiffs were not required to plead which claims or allegations pertained to which individual defendant. Id. But the plaintiffs in Sloan brought their claims against three defendants—Fantasia, Power Mobile Life LLC, and Anker Innovations Limited. Id. at ––––, 2024 WL 935426 at *1. As such, the complaint “d[id] not have to speculate about which claims or allegations pertain[ed] to them because Plaintiffs [ ] asserted all claims against all three defendants.” Id. at ––––, 2024 WL 935426 at *3 (internal quotations and citations omitted). That is not the case here. Plaintiffs bring their claims only against Fantasia, and the FAC is notably absent of any allegations that Fantasia itself collected Plaintiffs’ biometric identifiers. (See FAC.) As such, they fail to state a Section 15(b) claim against Fantasia alone.

Plaintiffs also cite Theriot, where a court found that plaintiffs sufficiently alleged the defendant, LVNA, “collected” users’ facial scans. Theriot, 645 F. Supp. 3d at 184. But Theriot is easily distinguishable. In Theriot, a “Virtual Try-On tool” was the device that created the facial scans at issue, and it was powered by a separate company which was not a party to the action. Id. But the complaint also contained allegations that LVNA itself took “active steps to collect users’ facial scans using [the Try-On tool],” for instance by “inviting users to take advantage of the Virtual Try-On tool.” Id. The Court can identify no such allegations against Fantasia—nor does the Opposition point to any allegations of Fantasia's “active steps” in the FAC. (See Opposition.)

As such, Plaintiffs do not allege that Defendant Fantasia collected, captured, purchased, received, or obtained their biometric identifiers and they fail to state a claim under BIPA Section 15(b). The Court GRANTS the Motion as to the Section 15(b) claim and DISMISSES the claim WITH LEAVE TO AMEND.

B. Count Two: BIPA Section 15(a)

BIPA Section 15(a) provides that “[a] private entity in possession of biometric identifiers or biometric information must develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information.” 740 ILCS 14/15(a). Defendant argues that Plaintiffs fail to allege Fantasia itself possessed any biometric identifiers, for the same reasons as discussed above. (Motion at 9-10.) Plaintiffs do not address or oppose Defendant's Section 15(a) arguments.

As explained above, the FAC lacks any allegation that Fantasia, specifically, collected or obtained Plaintiffs’ biometric identifiers. (See FAC.) The Court also cannot identify any allegations in the FAC that Fantasia independently possessed Plaintiffs’ biometric data. (See id.) Because Plaintiffs fail to address this argument, they concede it. Caravan Canopy Intl, Inc. v. Home Depot U.S.A., Inc., 2021 WL 831028, at *3 (C.D. Cal. Feb. 25, 2021) (“Plaintiff does not address this argument, and arguments to which no response is supplied are deemed conceded.”).

Accordingly, the Court finds that Plaintiffs fail to state a claim under BIPA Section 15(a). The Court GRANTS the Motion as to the Section 15(a) claim and DISMISSES the claim WITH LEAVE TO AMEND.

Because the Court dismisses both of Plaintiffs’ claims, it does not address Defendant's request to strike class allegations.

V. CONCLUSION

For the above reasons, the Court ORDERS as follows:

1. Defendant's Motion is GRANTED.

2. Plaintiff's FAC is DISMISSED WITH LEAVE TO AMEND.

3. Plaintiffs may file an amended complaint no later than May 13, 2024.

4. The Court VACATES the April 29, 2024 hearing.

IT IS SO ORDERED.

FOOTNOTES

1.   Defendant asks the Court to take notice of the Ninth Circuit's oral argument in Zellmer v. Meta Platforms, Inc., No. 22-16925, a case which also deals with BIPA. (See Supp. Authority.) The Court declines to do so for two reasons. First, statements made at oral argument are not pronouncements of law, nor do they indicate any binding decision. Second, it is not clear that the oral argument excerpts Defendant provides necessarily favor Defendant's arguments in this Motion.

2.   Defendant argues that Plaintiffs plead a Eufy camera sent biometric data to a cloud served operated by Anker, not by Fantasia. (Motion at 10.) Nowhere does the FAC explicitly allege that the cloud was operated by Anker, but web articles cited in the FAC do make clear that Eufy is an Anker brand, and that the footage was sent to the Eufy cloud. (See FAC ¶¶ 37 n.28, 39 n.32.) The articles contain no mention of Fantasia. (Id. ¶¶ 37-39.) Despite using information from the articles in its argument, Defendant does not request that the Court take judicial notice of the articles. (See Motion at 9-11.) The Court, on its own motion, takes judicial notice of the articles and web pages cited in paragraphs 37-41 of the FAC. The Court may take judicial notice of matters that are either (1) generally known within the trial court's territorial jurisdiction or (2) capable of accurate and ready determination by resort to sources whose accuracy cannot reasonably be questioned. Fed. R. Evid. 201(b). The articles cited in paragraphs 37 to 41 of the FAC are properly subject to judicial notice because they are incorporated by reference into the FAC, and their authenticity is not disputed. See Knievel v. ESPN, 393 F.3d 1068, 1076 (2005); Shalikar v. Asahi Beer U.S.A., Inc., 2017 WL 9362139, *2 (C.D. Cal. Oct. 16, 2017).

JESUS G. BERNAL, UNITED STATES DISTRICT JUDGE