BHAVILAI v. MICROSOFT CORPORATION (2024)

Order

Pasinee Bhavilai alleges that Microsoft possesses her facial scan in violation of sections 15(a) and 15(b) of the Illinois Biometric Information Privacy Act (“BIPA”). Bhavilai alleges that Microsoft acquired this information when third parties viewed her photograph with a device running the Windows 10 or 11 operating system owned and controlled by Microsoft. Microsoft has moved to dismiss for failure to state a claim pursuant to Federal Rule of Civil Procedure 12(b)(6). R. 24. That motion is granted.

BIPA § 15(a) imposes certain requirements on an entity that is “in possession of biometric identifiers or biometric information,” such as a facial scan. 740 ILCS § 14/15(a). Bhavilai concedes that she “does not allege that her biometrics were ‘physically’ stored on [Microsoft's] hardware.” R. 29 at 5. Instead, she notes that “courts have required evidence of ‘dominion or control’ to show possession for purposes of § 15(a).” Wilk v. Brainshark, Inc., 631 F. Supp. 3d 522, 530-31 (N.D. Ill. 2022). Following this interpretation, she argues that Microsoft “exercised dominion and control” over her facial scan because it designed, licensed, and updated the facial scan software on users’ devices. See R. 29 at 4. Bhavilai alleges that Microsoft exercised control over the device users’ ability to access and use the facial scan software. But control of the facial scan software is not the same as control of the facial scan data that is collected using the software. Bhavilai has not alleged that Microsoft used or exercised any control over her facial scan data in any way. The fact that Microsoft has the ability to give users the ability to collect facial scan data does not mean that Microsoft possesses the facial scan data.

Similar to § 15(a), BIPA § 15(b) imposes certain requirements on an entity that “collects,” “captures,” or “otherwise obtains” a person's “biometric identifiers or biometric information.” 740 ILCS § 14/15(b). Bhavilai argues that Microsoft “collected” her facial scan data when it “enabled the facial biometric scanning within its Photos application.” R. 29 at 6. Bhavilai argues that because Microsoft retained the ability to control whether and how a user could use the facial scan software demonstrates that Microsoft was in fact the collector. But selling or licensing a tool that can be used to collect a facial scan is not the same as actually doing the collecting. This argument conflates two different activities—providing the tool versus using the tool. Bhavilai has simply failed to allege that Microsoft did anything beyond providing a tool.

Therefore, Microsoft's motion to dismiss [24] is granted, and Bhavilai's claims are dismissed without prejudice. If Bhavilai believes she can cure the deficiencies with her allegations described in this opinion, she has leave to file an amended complaint by 3/8/2024. Bhavilai should inform the Court's Deputy and Microsoft by email no later than 2/26/2024 whether she intends to file an amended complaint. If Bhavilai does not filed an amended complaint by 3/8/2024, her claims will be dismissed with prejudice.

Thomas M. Durkin, United States District Judge