
Duane Morris Takeaway: This week’s episode features Duane Morris partner Jerry Maatman and special counsel Tyler Zmick with their analysis of a dismissal of a proposed Illinois Biometric Information Privacy Act (“BIPA”) class action and its implications for corporate defendants.
Check out today’s episode and subscribe to our show from your preferred podcast platform: Spotify, Amazon Music, Apple Podcasts, Podcast Index, Tune In, Listen Notes, iHeartRadio, Deezer, and YouTube.
Episode Transcript
Jerry Maatman: Thank you, loyal listeners, for being here again for the next episode of our weekly podcast, The Class Action Weekly Wire. I’m Jerry Maatman, a partner at Duane Morris, and joining me today is my colleague, Tyler Zmick. Thanks so much for being on the podcast, Tyler.
Tyler Zmick: Great to be here, Jerry. Thanks for having me.
Jerry: Today, we’ll be discussing an important new decision by the U.S. Court of Appeals for the Seventh Circuit that could have significant and far-reaching implications for biometric privacy litigation under the Illinois Biometric Information Privacy Act. which goes by the acronym BIPA. The case is G.T. v. Samsung Electronics America, Inc.
Tyler: This is really a fascinating decision, Jerry, just because the Seventh Circuit has addressed a question that had been percolating in ports for years now, and that question is, when does a tech company actually “possess”, “collect”, or “obtain” biometric data under BIPA?
Jerry: I think that’s kind of at the heart of most of these cases, certainly at this one, isn’t it?
Tyler: Exactly right. So, the plaintiffs in this case allege that Samsung violated BIPA through a photo gallery application that comes pre-installed on Samsung devices. According to the complaint, Samsung’s gallery app, it automatically scans photos that are stored on the device, it then identifies faces, creates facial geometry templates based on those faces, which are then used to group people into, basically, photo galleries based on who appears in the photos. And so, the plaintiffs argued that these facial templates qualify as biometric data, and that Samsung collected and stored that information without providing the disclosures or obtaining the written consent required by BIPA.
Jerry: At first glance, having defended many of these cases with you over the years, that sounds like a fairly straightforward and traditional BIPA litigation allegation.
Tyler: It does. I think the critical distinction in this case is where the biometric data was actually maintained, and who controlled it. So, the plaintiffs in this case acknowledged that the face templates were stored on users’ personal devices. They nevertheless claim that Samsung exercised control over the templates, because Samsung is the one that designed the software, licensed the operating system, and controlled how the data was processed and stored.
Jerry: I take it in this particular instance, the Seventh Circuit, however, was not persuaded by the plaintiffs.
Tyler: It was not, correct. Judge Lee, writing for the panel, focused heavily on the BIPA’s statutory language. Specifically, the court examined the words “possession”, “collect”, “capture”, and “obtain”, and concluded that each term requires some degree of control over the actual biometric data itself. The court relied on Illinois Supreme Court precedent, including in Cothron v. White Castle, providing that to collect, capture, and obtain biometric data all involves gaining control over the data. According to the Seventh Circuit, simply providing a tool that can generate biometric information is not the same thing as actually controlling that data.
Jerry: That’s a critical and important distinction. The court essentially separates the technology from the data generated from the technology.
Tyler: That’s right, and the opinion repeatedly emphasizes that distinction. The court found that Samsung may have designed the software and manufactured the devices, but the complaint did not plausibly allege that Samsung itself could access, modify, use, or control the facial geometry data stored on customers’ phones. In fact, the court said that the plaintiffs were essentially conflating two separate activities: providing a tool versus using the tool.
Jerry: My sense is that this language from the Seventh Circuit is apt to be quoted in BIPA litigation for years to come. One thing I found critically important, and certainly interesting, was the Seventh Circuit’s discussion of the concept of cloud storage.
Tyler: Absolutely. The plaintiffs argued that because Samsung had previously offered cloud backup services through a product called Samsung Cloud, that it was reasonable to infer that facial templates were also being uploaded to Samsung-controlled servers. This was sort of their backup theory. The court rejected that theory, finding that the complaint lacked factual allegations supporting that inference. The judges noted that plaintiffs could not simply speculate that biometric data reached Samsung’s servers because photographs might be backed up to the cloud. That part of the opinion is important because it reinforces federal pleading standards, and it reinforces the idea that plaintiffs need factual allegations showing that biometric data was actually controlled by a defendant.
Jerry: Let’s talk about the broader, overall significance of this ruling. What does it mean for companies that are developing software involving facial recognition, biometric authentication, or artificial intelligence?
Tyler: This is absolutely a significant defense victory. For years, many BIPA lawsuits have focused on the mere existence of biometric functionalities within tech products. Plaintiffs would often argue that if a company created software that analyzes facial geometry, let’s say, then BIPA liability automatically followed. Seventh Circuit rejected that theory in the Samsung decision and instead, the court held that there must be a plausible allegation that a defendant exercised control over the actual biometric data. If the data remains entirely on the user’s personal device, as is the case here, and the company cannot access or use the data, then the company falls beyond BIPA’s statutory reach under those facts.
Jerry: In your view, then, does this ruling create a safe harbor or a potentially important limitation on BIPA exposure?
Tyler: It does. Obviously, plaintiffs’ lawyers are going to try to, be creative in pleading their way around it, but, for device manufacturers, software developers, and tech providers, the opinion does provide a roadmap for reducing risk. Companies that design privacy-protective systems where biometric information stays local on a user’s device have stronger defenses against BIPA claims now. The Seventh Circuit, again, repeatedly stressed Samsung never possessed, accessed, modified, or used the actual biometric data, and those facts played a central role in the outcome here.
Jerry: Well, the plaintiffs’ class action bar is nothing if not innovative. Do you have a sense that this means that BIPA plaintiffs will stop bringing these sorts of cases against technology companies?
Tyler: I don’t think we should expect the cases to stop. What I expect, though, is a shift in litigation strategy. I think that plaintiffs and attorneys will focus much more heavily on whether biometric data is transmitted to company servers, shared with third parties, used for analytics, or otherwise controlled by a company. In other words, I think future cases may turn less on the mere existence of biometric technology, and more on the flow and location of biometric data.
Jerry: That’s an excellent point, and a critical distinction. Another aspect of the opinion that struck me was the Seventh Circuit’s decision of the purpose of the BIPA. The court looked back at the statute’s origins and emphasized that the BIPA was designed to regulate the collection and storage of biometric information by entities that actually possess and use that data.
Tyler: That’s correct, and the court compared Samsung’s situation to the classic BIPA cases, which involved, generally, fingerprint-based timekeeping systems, amusement park entry systems, and payment authentication platforms. In those cases, you have a company that directly gathered biometric information from individuals and maintained that information for operational purposes. According to the Seventh Circuit, Samsung’s alleged conduct was fundamentally different from those facts, because the biometric data remained at all times on the user’s device, so the Seventh Circuit concluded that extending BIPA to those facts would move really beyond statute’s core purpose.
Jerry: Well, thank you, Tyler, for joining us on this week’s episode of the Class Action Weekly Wire and lending your thought leadership and expertise to this area. To me, this decision certainly is one of the more significant ones involving the interpretation of BIPA from the Seventh Circuit in recent years and provides very valuable guidance in terms of the limits of biometric privacy liability for manufacturers and software developers. Well, thank you to our listeners for tuning in, and we’ll continue tracking the latest developments in biometric class action privacy litigation and workplace laws.
Tyler: Thanks, Jerry. Thank you, listeners. It was a pleasure to be here.









