By Gerald L. Maatman, Jr., Justin R. Donoho, and Tyler Z. Zmick
Duane Morris Takeaways: In a consequential ruling on June 13, 2024, Judge Sunil Harjani of the U.S. District Court for the Northern District of Illinois dismissed a class action brought under the Illinois Biometric Information Privacy Act (BIPA) in Martell v. X Corp., Case No. 23-CV-5449, 2024 WL 3011353 (N.D. Ill. June 13, 2024). The ruling is significant as it shows that plaintiffs alleging that cutting-edge technologies violate the BIPA face significant hurdles to support the plausibility of their claims when the technology neither performs facial recognition nor records distinct facial measurements as part of any facial recognition process.
Background
This case is one of over 400 class actions filed in 2023 alleging that companies improperly obtained individuals’ biometric identifiers and biometric information in violation of the BIPA.
In Martell v. X Corp., Plaintiff alleged that he uploaded a photograph containing his face to the social media platform “X” (formerly known as Twitter), which X then analyzed for nudity and other inappropriate content using a product called “PhotoDNA.” According to Plaintiff, PhotoDNA created a unique digital signature of his face-containing photograph known as a “hash” to compare against the hashes of other photographs, thus necessarily obtaining a “scan of … face geometry” in violation of the BIPA, 740 ILCS 14/10.
X Corp. moved to dismiss Plaintiff’s BIPA claim, arguing, among other things, that Plaintiff failed to allege that PhotoDNA obtained a scan of face geometry because (1) PhotoDNA did not perform facial recognition; and (2) the hash obtained by PhotoDNA could not be used to re-identify him.
The Court’s Opinion And Its Dual Significance
The Court granted X Corp.’s motion to dismiss based on both of these arguments. First, the Court found no plausible allegations of a scan of face geometry because “PhotoDNA is not facial recognition software.” Martell, 2024 WL 3011353, at *2 (N.D. Ill. June 13, 2024). As the Court explained, “Plaintiff does not allege that the hash process takes a scan of face geometry, rather he summarily concludes that it must. The Court cannot accept such conclusions as facts adequate to state a plausible claim.” Id. at *3.
In other cases in which plaintiffs have brought BIPA claims involving face-related technologies performing functions other than facial recognition, companies have received mixed rulings when challenging the plausibility of allegations that their technologies obtained facial data “biologically unique to the individual.” 740 ILCS 14/5(c). BIPA defendants have been similarly successful at the pleading stage as X Corp., for example, in securing dismissal of BIPA lawsuits involving virtual try-on technologies that allow customers to use their computers to visualize glasses, makeup, or other accessories on their face. See Clarke v. Aveda Corp., 2023 WL 9119927, at *2 (N.D. Ill. Dec. 1, 2023); Castelaz v. Estee Lauder Cos., Inc., 2024 WL 136872, at *7 (N.D. Ill. Jan. 10, 2024). Defendants have been less successful at the pleading stage and continue to litigate their cases, however, in cases involving software verifying compliance with U.S. passport photo requirements, Daichendt v. CVS Pharmacy, Inc., 2023 WL 3559669, at *2 (N.D. Ill. May 4, 2023), and software detecting fever from the forehead and whether the patient is wearing a facemask, Trio v. Turing Video, Inc., 2022 WL 4466050, at *13 (N.D. Ill. Sept. 26, 2022). Martell bolsters these mixed rulings in non-facial recognition cases in favor of defendants, with its finding that mere allegations of verification that a face-containing picture is not pornographic are insufficient to establish that the defendant obtained any biometric identifier or biometric information.
Second, the Court found no plausible allegations of a scan of face geometry because “Plaintiff’s Complaint does not include factual allegations about the hashes including that it conducts a face geometry scan of individuals in the photo.” Martell, 2024 WL 3011353, at *3. Instead, the Court found, obtaining a scan of face geometry means “zero[ing] in on [a face’s] unique contours to create a ‘template’ that maps and records [the individual’s] distinct facial measurements.” Id.
This holding is significant and has potential implications for BIPA suits based on AI‑based, modern facial recognition systems in which the AI transforms photographs into numerical expressions that can be compared to determine their similarity, similar to the way X Corp.’s PhotoDNA transformed a photograph containing a face into a unique numerical hash. Older, non-AI facial recognition systems in place at the time of the BIPA’s enactment in 2008, by contrast, attempt to identify individuals by using measurements of face geometry that identify distinguishing features of each subject’s face. These older systems construct a facial graph from key landmarks such as the corners of the eyes, tip of the nose, corners of the mouth, and chin. Does AI-based facial recognition — which does not “map[] and record[] … distinct facial measurements” (id. at *3) like these older systems — perform a scan of face geometry under the BIPA? One court addressing this question raised in opposing summary judgment briefs and opined on by opposing experts held: “This is a quintessential dispute of fact for the jury to decide.” In Re Facebook Biometric Info. Priv. Litig., 2018 WL 2197546, at *3 (N.D. Cal. May 14, 2018). In short, whether AI-based facial recognitions systems violate the BIPA remains “the subject of debate.” “The Sedona Conference U.S. Biometric Systems Privacy Primer,” The Sedona Conference Journal, vol. 25, at 200 (May 2024). The Court’s holding in Martell adds to this mosiac and suggests that plaintiffs challenging AI-based facial recognition systems under the BIPA will have significant hurdles to prove that the technology obtains a scan of face geometry.
Implications for Companies
The Court’s dismissal of conclusory allegations is a win for defendants’ whose cutting-edge technologies neither perform facial recognition nor record distinct facial measurements as part of any facial recognition process. While undoubtedly litigation over the BIPA will continue, the Martell decision supplies useful precedent for companies facing BIPA lawsuits containing insufficient allegations that they have obtained a scan of facial geometry unique to an individual.