By Gerald L. Maatman, Jr. and Tyler Z. Zmick
Duane Morris Takeaways: In Colombo v. YouTube, LLC, et al., No. 22-CV-6987, 2023 WL 4240226 (N.D. Cal. June 28, 2023), the U.S. District Court for the Northern District of California issued a decision embracing a broad interpretation of the data types that are within the scope of the Illinois Biometric Information Privacy Act (“BIPA”). The decision puts businesses on notice that the statute may apply to the collection or possession of any “scan of face geometry,” regardless of whether the scan can be used to identify a specific individual – – in other words, a “biometric identifier” under the BIPA need not be capable of “identifying” a person. Colombo v. YouTube, LLC is required reading for corporate counsel facing privacy class action litigation.
Background
Plaintiff’s BIPA claims were premised on two YouTube video editing tools that allegedly resulted in the collection of his “biometric identifiers” and “biometric information” (collectively, “biometric data”) – YouTube’s (1) “Face Blur” tool and (2) “Thumbnail Generator” tool. Id. at 2-3. According to Plaintiff, the “Face Blur” tool enables a user to select faces appearing in videos uploaded by the user that he or she may wish to “blur,” resulting in those faces appearing blurry and unrecognizable to any viewer of the videos. Plaintiff claimed that when someone uses the tool, YouTube scans the uploaded video “to detect all unique faces” and, in doing so, “captures and stores scans of face geometry from all detected faces, creating a unique ‘faceId’ for each.” Id. at 2 (citation omitted).
Regarding YouTube’s “Thumbnail Generator” feature, Plaintiff described the tool as auto-generating photographic thumbnails (i.e., screenshots from an uploaded video) by scanning videos for faces at the time they are uploaded and using the “face data to auto-generate thumbnails that contain faces.” Id. (citation omitted).
Based on his alleged use of these two YouTube tools, Plaintiff alleged that YouTube violated Sections 15(a) and 15(b) of the BIPA by (i) failing to develop and comply with a written policy made available to the public establishing a retention policy and guidelines for destroying biometric data, and (ii) collecting his biometric data without providing him with the requisite notice and obtaining his written consent.
YouTube moved to dismiss on three grounds, arguing that: (1) Plaintiff failed to allege that data collected by YouTube qualifies as “biometric data” under the BIPA because YouTube did not (and could not) use the data to identify Plaintiff or others appearing in uploaded videos; (2) Plaintiff’s claims violated Illinois’s extraterritoriality doctrine and the dormant Commerce Clause; and (3) Plaintiff failed to allege that he was “aggrieved” for purposes of his Section 15(a) claim.
The Court’s Decision
The Court denied YouTube’s motion to dismiss on all three grounds.
“Biometric Identifiers” And “Biometric Information”
YouTube first argued that Plaintiff failed to allege that data collected through the Face Blur and Thumbnail Generator tools qualify as “biometric data” under the BIPA because Plaintiff did not plausibly allege that YouTube could use the data to affirmatively identify Plaintiff or other individuals. See id. at 4 (“In YouTube’s view, biometric identifiers must identify a person and biometric information must actually be used to identify a person.”).
The Court rejected YouTube’s argument, stating that “[t]he “point is not well taken.” Id. The Court noted the statute’s definition of “biometric identifier” as “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry,” see 740 ILCS 14/10 – a definition that does not explicitly require that the listed data points be capable of identifying a particular person. While the Court acknowledged that the term “identifier” may suggest that the data must be used to identify a person, the Court also opined that “‘[w]hen a statute includes an explicit definition, we must follow that definition,’ even if it varies from a term’s ordinary meaning.” Id. at 4 (citation omitted); see also id. at 5 (“[T]he Illinois legislature was perfectly free to define ‘biometric identifier’ in a specific manner that is not tethered to the plain meaning of the word ‘identifier’ alone.”).
Extraterritoriality & Dormant Commerce Clause
The Court also rejected YouTube’s arguments that Plaintiff failed to allege that YouTube’s relevant conduct occurred “primarily and substantially” in Illinois, and Plaintiff’s interpretation of the BIPA would run afoul of the dormant Commerce Clause.
The Court held that Plaintiff sufficiently alleged that YouTube’s conduct occurred “primarily and substantially” in Illinois, thereby satisfying the extraterritoriality doctrine. Id. at 5. Responding to YouTube’s argument that the company’s headquarters and data servers are located outside of Illinois, the Court stated that those facts are “not dispositive” and that “[m]aking the geographic coordinates of a server the most important circumstance in fixing the location of an Internet company’s conduct would . . . effectively gut the ability of states without server sites to apply their consumer protection laws to residents for online activity that occurred substantially within their borders.” Id. at 6 (citation omitted).
Using the same reasoning, the Court concluded that “YouTube’s dormant Commerce Clause theory fares no better” because YouTube’s allegedly BIPA-violating conduct “cannot be understood to have occurred wholly outside Illinois,” id. at 7 (citation omitted) – i.e., Plaintiff’s claims were based on the application of an Illinois law to Illinois-based YouTube users.
Whether Plaintiff Is “Aggrieved” Under Section 15(a)
Finally, the Court rejected YouTube’s argument that Plaintiff failed to allege that he was “aggrieved” under Section 15(a), which sets forth two requirements for entities in possession of biometric data: (i) to develop a publicly available BIPA-compliant retention policy; and (ii) to comply with that policy. YouTube argued that Plaintiff failed to allege that he was aggrieved under Section 15(a) because he did not claim that YouTube failed to comply with an existing retention policy as to his biometric data (e.g., that three years had passed since his last interaction with YouTube, yet YouTube had failed to destroy his biometric data).
The Court observed, however, that Plaintiff alleged that YouTube failed to develop and “therefore failed to comply with any BIPA-compliant policy,” which “is enough to move forward . . . [a]t the pleadings stage.” Id. at 8 (emphasis added) (citation omitted).
Implications For Corporate Counsel
Colombo can be added to the list of recent plaintiff-friendly BIPA decisions, as it endorses an expansive view of the types of data that constitute “biometric data” under the statute. Indeed, the Colombo ruling suggests that any data that can be characterized as a “scan of face geometry” – regardless of whether the scan can be linked to a specific person to identify him or her – qualifies as a “biometric identifier” within the BIPA’s scope. Put another way, technology capable of only detecting a category of objects or characteristics in a photo or video (e.g., software that identifies the location of a human face in a photo – as opposed to an arm or leg – without being able to link that face to a specific person) may involve data subject to regulation under the BIPA.