By Gerald L. Maatman, Jr., Tyler Zmick, and Christian J. Palacios
Duane Morris Takeaways: In Svoboda v. Amazon, Case No. 21-C-5336, 2024 U.S. Dist. LEXIS 58867 (N.D. Ill. Mar. 30, 2024), Judge Jorge L. Alonso of the U.S. District Court for the Northern District of Illinois granted class certification to a class of plaintiffs who alleged that Amazon’s “virtual try-on” (“VTO”) technology violated the Illinois Biometric Information Privacy Act (“BIPA”). In doing so, Judge Alonso dealt Amazon a significant blow in its efforts to block the certification of a purported class of claimants that might number in the millions (with pre-certification discovery already establishing that there were over 160,000 persons who used Amazon’s VTO technology during the relevant class period). This decision is the most recent success by the plaintiffs’ bar in a string of victories for class action privacy lawsuits across Illinois and illustrates that even the largest and most sophisticated companies in the world face legal exposure in connection with their biometric retention and application practices.
Background
Amazon sells products to consumers on its mobile website and shopping application. Its “virtual try-on” technology allows users to virtually try on makeup and eyewear, and is exclusively available on mobile devices. VTOs are software programs that use augmented reality to overlay makeup and eyewear products on an image or video of a face, which allows shoppers to see what the product might look like prior to deciding whether to purchase it. During the relevant class period, there were two VTOs at issue, one of which was developed by a third party (ModiFace), and another which was developed in-house by Amazon that later replaced ModiFace. Id. at 4. Amazon’s VTOs come in two forms, including: (1) VTO technology available for lip products, and; (2) VTOs available for glasses. The ModiFace VTO is available for lip liner, eye shadow, eye liner, and hair color. Amazon licenses, rather than owns ModiFace VTO. Id. at 5.
Both Amazon and ModiFace VTOs essentially works the same for every user. In order to access Amazon’s virtual try-on technology, the user first begins by clicking a “try on” button on an Amazon product page (the use of this try-on feature is entirely optional and does not serve as a barrier to the customer actually purchasing the product). The first time the customer uses Amazon VTO, she is shown a pop-up screen that states, “Amazon uses your camera to virtually place products such as sunglasses and lipstick on your face using Augmented Reality. All information remains on your device and is not otherwise stored, processed or shared by Amazon.” Only after granting permission can the customer use the VTO technology to virtually try on the product. Users may select “live mode” or “photo upload mode” to superimpose the try-on product on an image of their own face. For both modes, the VTOs use software to detect users’ facial features and use that facial data in order to determine where to overlay the virtual products. Id. at 5.
Based on these facts, plaintiffs brought a class action lawsuit against Amazon, which alleged that the online retailer violated the BIPA’s requirements by collecting, capturing, storing or otherwise obtaining the facial geometry and associated personal identifying information of thousands (if not millions) of Illinois residents who used Amazon’s VTO applications from computers and other devices without first providing notice and the required information, obtaining informed written consent, or creating written publicly-available data retention and destruction guidelines. Id. Plaintiffs sought to certify a class of all individuals who used a virtual try-on feature on Amazon’s mobile website or app while in Illinois on or after September 7, 2016. Significantly, pre-certification discovery established that at least 163,738 people used virtual try-on technology on Amazon’s platforms while in Illinois during the class period. Id. at 6.
The Court’s Ruling
In ruling in favor of the plaintiffs, Judge Alonso systematically rejected each of Amazon’s arguments as to why plaintiffs failed to satisfy Rule 23’s requirements for class certification. Given the size of the purported class, Amazon did not attempt to contest the numerosity requirement. With respect to the adequacy requirement, Amazon argued that the named plaintiffs were inadequate and atypical because they alleged they used VTO for lipstick, and not eyewear or eye makeup (while the majority of the proposed class was comprised of individuals who used VTO for eyewear). Amazon further argued that the named plaintiffs had a conflicting interest with the class members who used VTO for eyewear, because the BIPA’s healthcare exception bars claims arising from the virtual try-on of eyewear. Id. at 12. The Court rejected this argument. It found that there was no evidence that the named plaintiffs’ interests were antagonistic, or directly conflicted with those members who used VTO to try on eyewear, and Amazon’s concern that plaintiffs lacked an incentive to vigorously contest the healthcare exception defense was merely speculative. Id. The Court was also satisfied that the plaintiffs’ claims arose from the same course of conduct that gave rise to other class members’ claims (such as Amazon’s purported collection, capture, possession, and use of facial templates via its VTOs) and thus the typicality requirement was satisfied. Id. at 15.
Similarly, the Court reasoned that common questions of law or fact predominated over any questions affecting individual members, and a class action was superior to other available methods for fairly and efficiently adjudicating the controversy. Id. at 17. Amazon asserted that there was no reliable way to identify class members who used VTO in Illinois during the class period, and thus, individualized inquiries predominated rendering the case unmanageable. Id. at 21. The Court rejected this argument. It agreed with the plaintiffs that Illinois billing addresses, IP addresses from which VTO was used, and geo-location data all served as a way of identifying class members. Amazon raised other arguments about the difficulty of identifying potential class members, but Judge Alonzo rejected all of these arguments, observing that plaintiffs did not need to identify every member of the class at the certification stage. Id. at 23.
Finally, the Court dispatched with Amazon’s various affirmative defenses. In particular, Amazon argued that it had unique defenses for every member of the putative class, since damages were discretionary under the BIPA. The Court disagreed. It noted that the Illinois Supreme Court had determined that a trial court could fashion a damages award in a BIPA lawsuit that fairly compensated class members while deterring future violations, without destroying a defendant’s business. Id. at 25.
Implications for Employers
Employers should be well aware of the dangers associated with collecting or retaining individuals’ biometric information without BIPA-compliant policies in place. This case serves as a reminder that the larger the company, the larger the potential class size of a class or collective action. Although it remains to be seen the actual size of Svoboda v. Amazon, the class will likely number in the hundreds of thousands and this case should serve as a wake-up call for companies, regardless of scale, of the dangers of running afoul of the Prairie State’s privacy laws.