Tyler Z. Zmick – Class Action Defense

November 4, 2025November 4, 2025 by Gerald L. Maatman, Jr.

California Federal Court Dismisses Adtech Class Action For Failure To Specify Highly Offensive Invasion Of Privacy

By Gerald L. Maatman, Jr., Justin R. Donoho, Tyler Zmick, and Hayley Ryan

Duane Morris Takeaways: On October 30, 2025, in DellaSalla, et al. v. Samba TV, Inc., 2025 WL 3034069 (N.D. Cal. Oct. 30, 2025), Judge Jacqueline Scott Corley of the U.S. District Court for the Northern District of California dismissed a complaint brought by TV viewers against a TV technology company alleging that the company’s provision of advertising technology in the plaintiffs’ smart TVs committed the common law tort of invasion of privacy and violated the Video Privacy Protection Act (“VPPA”), the California Invasion of Privacy Act (“CIPA”), and California’s Comprehensive Computer Data Access and Fraud Act (“CDAFA”). The ruling is significant as it shows that in the hundreds of adtech class actions across the nation alleging that adtech violates privacy laws, plaintiffs do not plausibly state a common law claim for invasion of privacy unless they specify in the complaint the information allegedly disclosed and explain how such a disclosure was highly offensive. The case is also significant in that it shows that the VPPA does not apply to video analytics companies, and that California privacy statutes do not apply extraterritorially to plaintiffs located outside California.

Background

This case is one of a legion of class actions that plaintiffs have filed nationwide alleging that third-party technology captured plaintiffs’ information and used it to facilitate targeted advertising.

This software, often called advertising technologies or “adtech,” is a common feature of millions of consumer products and websites in operation today. In adtech class actions, the key issue is often a claim brought under a federal or state wiretap act, a consumer fraud act, or the VPPA, because plaintiffs often seek millions (and sometimes even billions) of dollars, even from midsize companies, on the theory that hundreds of thousands of consumers or website visitors, times $2,500 per claimant in statutory damages under the VPPA, for example, equals a huge amount of damages. Plaintiffs have filed the bulk of these types of lawsuits to date against healthcare providers, but they have filed suits against companies that span nearly every industry including retailers, consumer products, universities, and the adtech companies themselves. Several of these cases have resulted in multimillion-dollar settlements, several have been dismissed, and the vast majority remain undecided.

In DellaSalla, the plaintiffs brought suit against a TV technology company that embedded a chip with analytics software in plaintiffs’ smart TVs. Id. at *1, 5. According to the plaintiffs, the company intercepted the plaintiffs’ “private video-viewing data in real time, including what [t]he[y] watched on cable television and streaming services,” and tied this information to each plaintiff’s unique anonymized identifier in order to “facilitate targeted advertising,” all allegedly without the plaintiffs’ consent. Id. at *1. Based on these allegations, the plaintiffs claimed that the TV technology company violated the CIPA, CDAFA, and VPPA, and committed the common-law tort of invasion of privacy.

The company moved to dismiss, arguing that the CIPA and CDAFA did not apply because the plaintiffs were located outside California, that the VPPA did not apply because the TV technology company was not a “video tape service provider,” and that the plaintiffs failed to plausibly allege a highly offensive violation of a privacy interest.

The Court’s Decision

The Court agreed with the TV technology company and dismissed the complaint in its entirety, with leave to amend any existing claims but not to add any additional claims without further leave.

On the CIPA and CDAFA claims, the Court found that the plaintiffs did not allege that any unlawful conduct occurred in California. Instead, the plaintiffs alleged that the challenged conduct occurred in their home states of North Carolina and Oklahoma. Id. at *1, 3-4. For these reasons, the Court dismissed the CIPA and CDAFA claims, finding that these statutes do not apply extraterritorially. Id.

On the VPPA claim, the Court addressed the VPPA’s definition of “video tape service provider,” which is “any person, engaged in the business … of rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials.” Id. at *5. The plaintiffs argued that the TV technology company was a video tape service provider “because its technology is incorporated in Smart TVs, which deliver prerecorded videos. [The defendant] advertises its technology precisely as providing a ‘better viewing experience’ ‘immersive on-screen experiences’ and a ‘more tailored ad experience’ through its technology.” Id. The Court rejected this argument. It held that “[t]his allegation does not plausibly support an inference, [the defendant]—an analytics software provider—facilitated the exchange of a video product. Rather, the allegations support an inference [the defendant] collected information about Plaintiffs’ use of a video product, but not that it provided the product itself.” Id. (emphasis added).

On the common law claim for invasion of privacy, the TV technology company argued that this claim failed because the plaintiffs “have no expectation of privacy in the information it collects and Plaintiffs have not alleged a highly offensive intrusion.” In examining this argument, the Court noted that Plaintiff had only provided “vague references” to the information supposedly intercepted. Id. at *4. This information included video-viewing data generally (none specified) tied to an anonymized identifier. Id. at *1, 5. Thus, the Court agreed with the defendant’s argument and found that plaintiffs identified “no embarrassing, invasive, or otherwise private information collected” and no explanation of how the tracking of video viewing history with an anonymized ID caused plaintiffs “to experience any kind of harm that is remotely similar to the ‘highly offensive’ inferences or disclosures that were actionable at common law.” Id. at *5. In sum, the Court concluded that “Plaintiffs have not plausibly alleged a highly offensive violation of a privacy interest.”

Implications For Companies

DellaSala provides powerful precedent for any company opposing adtech class action claims (1) brought under statutes enacted in states other than the plaintiffs’ place of residence; (2) brought under the federal VPPA where the company allegedly transmitted video usage information, as opposed to any videos themselves; and (3) alleging common-law invasion of privacy, where the plaintiffs have not specified the information disclosed and why such a disclosure is highly offensive.

The last point is a recurring theme in adtech class actions. Just as this plaintiff suing a TV technology company did not plausibly state a common-law claim for invasion of privacy without identifying the videos watched and any highly offensive harm in associating those videos with an anonymized ID, so did a plaintiff not plausibly state a claim for invasion of privacy by way of alleging adtech’s disclosure of protected health information (“PHI”), without specifying the PHI allegedly disclosed (as we blogged about here). These cases show that for adtech plaintiffs to plausibly plead claims for invasion of privacy, they at least need to identify what allegedly private information was disclosed and explain how the alleged disclosure was highly offensive.

October 21, 2025 by Gerald L. Maatman, Jr.

California Federal Court Narrows CIPA “In-Transit” Liability for Common Website Advertising Technology and Urges Legislature to Modernize Privacy Law

By Gerald L. Maatman, Jr., Justin Donoho, Hayley Ryan, and Tyler Zmick

Duane Morris Takeaways: On October 17, 2025, in Doe v. Eating Recovery Center LLC, No. 23-CV-05561, ECF 167 (N.D. Cal. Oct. 17, 2025), Judge Vince Chhabria of the U.S. District Court for the Northern District of California granted summary judgment to Eating Recovery Center, finding no violation of the California Invasion of Privacy Act (CIPA) where the Meta Pixel collected website event data. Specifically, the Court held that Meta did not “read” those contents while the communications were “in transit.” In so holding, the Court applied the rule of lenity, construed CIPA narrowly, and urged the California Legislature “to step up” and modernize the statute for the digital age. Id. at 2.

This decision is significant because Judge Chhabria candidly described CIPA as “a total mess,” noting it is often “borderline impossible” to determine whether the law – enacted in 1967 to criminalize wiretapping and eavesdropping on confidential communications – applies to modern internet transmissions. Id. at 1. As the Court observed, CIPA “was a mess from the get-go, but the mess gets bigger and bigger as the world continues to change and as courts are called upon to apply CIPA’s already-obtuse language to new technologies.” Id. This is a “must read” decision for corporate counsel dealing with privacy issues and litigation.

Background

This class action arose after plaintiff, Jane Doe, visited Eating Recovery Center’s (ERC) website to research anorexia treatment and later received targeted advertisements. Plaintiff alleged that ERC’s use of the Meta Pixel caused Meta to receive sensitive URL and event data from her interactions with ERC’s site, resulting in targeted ads related to eating disorders.

ERC had installed the standard Meta Pixel on its website, which automatically collected page URLs, time on page, referrer paths, and certain click events to help ERC build custom audiences for advertising. Id. at 3. Plaintiff alleged that ERC’s use of the Pixel allowed Meta to intercept her communications in violation of CIPA, Cal. Penal Code § 631(a). She also brought claims under the California Medical Information Act (CMIA), the California Unfair Competition Law (UCL), and for common law unjust enrichment. The UCL claim was dismissed at the pleading stage.

ERC later moved for summary judgment on the remaining CIPA, CMIA, and unjust enrichment claims. In a separate order, the Court granted summary judgment on the CMIA and unjust enrichment claims, finding that plaintiff was not a “patient” under the CMIA and that there was no evidence ERC had been unjustly enriched. See id., ECF 168 at 1-2.

The Court’s Decision

With respect to the CIPA claim, the parties disputed two elements under CIPA § 631(a): (1) whether the event data obtained by Meta constituted “contents” of plaintiff’s communication with ERC, and (2) whether Meta read, attempted to read, or attempted to learn those contents while they were “in transit.” ECF 167 at 6.

The Court first held that URLs and event data can constitute the “contents” of a communication because they can reveal substantive information about a user’s activities – such as researching medical treatment. Id. at 7. The court thus deviated from other courts that have held differently on this particular issue when considering additional facts or allegations not addressed by this court (such as encryption, and inability to reasonably identify the data among lines of code). However, the Court concluded that Meta did not read or attempt to learn any contents while the communications were “in transit.” Instead, Meta processed the data only after it had reached its intended recipient (i.e., ERC, the website operator).

In reaching that conclusion, Judge Chhabria relied on undisputed testimony about Meta’s internal filtering processes: “Meta’s corporate representative testified that, before logging the data that it obtains from websites, Meta filters URLs to remove information that it does not wish to store (including information that Meta views as privacy protected).” Id. at 8.

This evidence supported the finding that Meta’s conduct involved post-receipt filtering rather than contemporaneous “reading” or “learning.” Id. at 9. The Court emphasized that expanding “in transit” to include post-receipt processing would improperly criminalize routine website analytics practices. Because CIPA is both a criminal statute and a source of punitive civil penalties, the Court applied the rule of lenity to adopt a narrow interpretation. Id. at 11-12. The Court further cautioned that an overly broad reading would render CIPA’s related provision (§ 632, prohibiting eavesdropping and recording) largely redundant. Id. at 10.

Finding that Meta did not read, attempt to read, or attempt to learn the contents of Doe’s communications while they were in transit, the court granted summary judgment to ERC on the CIPA claim. Id. at 12.

The opinion concluded by reiterating that California’s decades-old wiretap law is “virtually impossible to apply [] to the online world,” urging the Legislature to “go back to the drawing board on CIPA,” and suggesting that it “would probably be best to erase the board entirely and start writing something new.” Id.

Implications For Companies

The Doe decision narrows one significant avenue for CIPA liability, particularly for routine use of website analytics and advertising pixels. The Northern District of California has now drawn a distinction between data “read” while in transit and data processed after receipt, significantly reducing immediate CIPA exposure for standard web advertising tools.

At the same time, the court’s reasoning underscores that pixel-captured data may be considered by some courts as “contents” of a communication under CIPA, although there is a split of authority on this issue. Companies could therefore face potential exposure under other California privacy statutes, including the CMIA, the California Consumer Privacy Act (CCPA), and the California Privacy Rights Act (CPRA), depending on the data involved and how it is used.

Organizations should continue to inventory the data they share through advertising technologies, minimize sensitive information in URLs, and ensure clear and accurate privacy disclosures. Because the court expressly invited legislative reform, companies should also monitor ongoing case law and potential statutory amendments.

Ultimately, Doe v. Eating Recovery Center reflects a pragmatic narrowing of CIPA’s “in transit” requirement while reaffirming that CIPA was not intended to cover common website advertising technologies or, in any event, should not be interpreted as such given the harsh statutory penalties involved and the rule of lenity — like the Supreme Judicial Court of Massachusetts concluded regarding Massachusetts’ wiretap act, as we previously blogged about here. While this case is a big win for website operators, companies relying on third-party analytics should treat this decision as guidance—not immunity—and continue adopting privacy-by-design principles in their data collection and vendor management practices.

October 20, 2025October 20, 2025 by Gerald L. Maatman, Jr.

Third Circuit Green Lights “Hybrid” Class Action Settlements That Release Unasserted FLSA Claims

By Gerald L. Maatman, Jr., Jennifer A. Riley, and Tyler Zmick

Duane Morris Takeaways: In Lundeen v. 10 West Ferry Street Operations, LLC, No. 24-3375 (3d Cir. Oct. 16, 2025), the U.S. Court of Appeals for the Third Circuit held that the opt-in requirement set forth in Section 216(b) of the federal Fair Labor Standards Act (“FLSA”) does not prohibit plaintiffs in a class action from settling prospective class members’ unasserted FLSA claims as part of an opt-out class settlement. In a precedential and unanimous opinion, the Third Circuit concluded that Section 216(b) establishes only the mechanism by which FLSA claims may be litigated, not the conditions under which they may be released. The decision is welcome news for both plaintiffs and defendants, as the case makes it easier for parties to settle “hybrid” cases asserting claims under both federal and state wage-and-hour laws.

Background

Plaintiff Graham Lundeen alleged that Defendant – his former employer, and the owner of a restaurant and bar – violated the FLSA and the Pennsylvania Minimum Wage Act (“PMWA”) in connection with its tip-pooling practices. Plaintiff styled his case as a “hybrid” class/collective action, asserting that his FLSA claim should proceed as a collective action under Section 216(b) and that his PMWA claim should proceed as a class action under Federal Rule of Civil Procedure 23(b)(3).

The parties reached a settlement under which class members would agree to release their claims, including those arising under the FLSA, even if class members did not submit claim forms, submit opt-in consent forms, or receive settlement payouts.

The U.S. District Court for the Eastern District of Pennsylvania denied preliminary approval of the proposed settlement, ruling that the settlement “was ‘neither fair nor reasonable’ because it ‘require[d] class members who did not opt in to the FLSA collective to release their FLSA claims.’” Id. at 6.

The Third Circuit’s Decision

After accepting the parties’ interlocutory appeal, the Third Circuit vacated the District Court’s ruling and held that Section 216(b) does not bar approval of a Rule 23 settlement that includes the release of “unasserted FLSA claims.” Id. at 10-11. In reaching its conclusion, the Third Circuit began with the text of Section 216(b):

An action to recover the liability prescribed in the preceding sentences [for failure to pay statutorily required overtime or minimum wages under the FLSA] may be maintained against any employer (including a public agency) in any Federal or State court of competent jurisdiction by any one or more employees for and in behalf of himself or themselves and other employees similarly situated. No employee shall be a party plaintiff to any such action unless he gives his consent in writing to become such a party and such consent is filed in the court in which such action is brought.

Id. at 8-9 (emphasis in original) (quoting 29 U.S.C. § 216(b)).

Acknowledging that no other federal circuit has resolved the split among district courts regarding the propriety of “hybrid” settlements, the Third Circuit ultimately sided “with those courts that have held that § 216(b) of the FLSA provides only a mechanism for opting into collective litigation.” Id. at 10 (emphasis added). In other words, Section 216(b) “requires written consent to litigate FLSA claims, but it does not forbid the release of unasserted claims through a Rule 23(b)(3) opt-out settlement.” Id. at 16 (emphases added).

The Third Circuit concluded with an important caveat, however, emphasizing that while the FLSA does not prohibit settlements through which Rule 23 class members release unasserted FLSA claims, that does not mean such settlements are always permissible: “[W]hether judges can approve opt-out settlements that release FLSA claims is a different inquiry from whether judges should do so. The former question is an issue of statutory interpretation; the latter turns on whether the settlement is ‘fair, reasonable, and adequate,’ subject to the District Court’s considerable discretion.” Id. at 16-17 (internal citation omitted). Thus, “while § 216(b) does not forbid the release of unasserted FLSA claims in opt-out settlements, such releases remain relevant to the court’s overall Rule 23(e)(2) analysis.” Id. at 18.

Implications Of The Decision

The Lundeen decision provides clarity on the proper scope of “hybrid” settlements involving the simultaneous release of FLSA claims and Rule 23 class claims premised on state wage-and-hour laws. Moving forward, defendants settling such claims will likely rely on Lundeen to broaden their settlements to cover the FLSA claims of all individuals within the Rule 23 settlement class, even if such individuals do not affirmatively opt into the case. This will give defendant-employers closure and alleviate potential risks as to whether settlement class members who did not opt into the case retain their rights to bring FLSA claims.

Parties should take heed of the caveat noted by the Third Circuit, however – namely, that a class settlement involving the release of unasserted FLSA claims will not automatically pass muster. Rather, district courts must still consider whether a class settlement is “fair, reasonable, and adequate.” To increase the likelihood that courts will approve “hybrid” class settlements, parties should ensure their proposed settlements satisfy the Rule 23(e)(2) “fairness” factors, including by: providing clear notice to class members of the scope of the release and a meaningful opportunity to opt out; and ensuring that the relief provided to the class is adequate when accounting for the costs and risks of litigation, the method of distributing relief to the class, and the terms of any proposed award of attorney’s fees.

October 6, 2025October 6, 2025 by Gerald L. Maatman, Jr.

Illinois Federal Court Finds “Self-Inflicted Injury” Insufficient To Confer Article III Standing In Publicity Class Action Lawsuit

By Gerald L. Maatman, Jr., Justin Donoho, Hayley Ryan, and Tyler Zmick

Duane Morris Takeaways: On October 2, 2025, in Azuz v. Accucom Corp. d/b/a InfoTracer, No. 21-CV-01182, 2025 U.S. Dist. LEXIS 195474 (N.D. Ill. Oct. 2, 2025), Judge LaShonda A. Hunt of the U.S. District Court for the Northern District of Illinois dismissed a class action complaint alleging violations of the Illinois Right of Publicity Act (IRPA). The plaintiff claimed that InfoTracer unlawfully used individuals’ names and likeness to advertise and promote its products without consent. The Court held that the Plaintiff lacked Article III standing because she failed to plausibly allege a concrete injury – her only alleged harm was “self-inflicted,” as no one other than her own counsel ever searched her name on the site.

The decision illustrates that plaintiffs bringing right of publicity claims against website operators must show that a third party actually accessed their information for a commercial purpose. Mere availability of an individual’s information on a website, without evidence of third-party viewing, does not establish a concrete injury under Article III.

Background

Plaintiff Marilyn Azuz filed a putative class action complaint against Accucom Corp. d/b/a InfoTracer, which operates infotracer.com, a website selling personal background reports. She alleged that Accucom used her name and likeness to advertise and promote its products without written consent, in violation of the IRPA. Id. at *2-4. Plaintiff sought damages and injunctive relief barring Accucom from continuing the alleged conduct. Id. at *4.

After three years of litigation and discovery, Accucom moved to dismiss for lack of subject matter jurisdiction, raising a factual challenge to Article III standing. Accucom submitted evidence showing that the only search of Plaintiff’s name on InfoTracer occurred in February 2021, when her own counsel accessed the site after she responded to a Facebook solicitation by her counsel about potential claims. Accucom argued that such a “self-inflicted” search could not establish a concrete injury and that Plaintiff’s claim for injunctive relief was moot because she had since moved to Minnesota and her data had been removed from the site.

Plaintiff countered that her identify being “held out” to be searched constituted a sufficient injury, and that her request for injunctive relief was not moot Accucom could resume the alleged conduct.

The Court’s Decision

The Court sided with Accucom, holding that the Plaintiff failed to establish a concrete injury and therefore lacked standing to pursue her individual claims. Id. at *15.

Relying on the U.S. Supreme Court’s decision in TransUnion LLC v. Ramirez, 594 U.S. 413 (2021), Judge Hunt explained that an intangible statutory violation, without evidence of concrete harm, is insufficient for Article III standing. Just as inaccurate information in a credit file causes no concrete injury unless disclosed to a third party, the Court concluded, “a person’s identity is not appropriated under the IRPA unless it is used for a commercial purpose.” Id. at *14.

The Court rejected Plaintiff’s reliance on Lukis v. Whitepages Inc., 549 F. Supp. 3d 798 (N.D. Ill. 2021), noting that Lukis involved only a facial attack to standing at the pleading stage, not a factual attack supported by evidence, like here. Id. at *9-10.

Noting that it had not found any post-TransUnion decisions analyzing the IRPA under a factual challenge to standing, Judge Hunt found Fry v. Ancestry.com Operations Inc., 2023 U.S. Dist. LEXIS 50330 (N.D. Ind. Mar. 24, 2023) to be instructive. Id. at *11. In Fry, the court cautioned that a plaintiff asserting a right of publicity claim must ultimately produce evidence showing that his likeness was viewed by someone other than his attorney or their agents. That same “forewarning,” Judge Hunt concluded, applied to Plaintiff, who presented no such evidence. Id. at *12-13.

The Court also dismissed Plaintiff’s request for injunctive relief, holding that any potential future harm was speculative and not sufficiently imminent. Because Plaintiff had relocated to Minnesota, the IRPA’s extraterritorial application could not extend to her circumstances. Id. at *16.

Finally, the Court declined to allow the substitution of new named plaintiffs so that the case could continue, reasoning that because the original plaintiff lacked standing from the outset, the Court never had jurisdiction to allow substitution. Id. at *17.

Implications For Companies

Azuz underscores the importance of scrutinizing Article III standing in every stage of litigation, particularly in statutory publicity and privacy cases. Where plaintiffs cannot show that a third party viewed or interacted with their data, courts are likely to find no concrete injury — and therefore no federal jurisdiction.

Website operators facing IRPA or similar publicity-based class actions should consider asserting factual standing challenges supported by evidence demonstrating the absence of third-party access. Such jurisdictional defenses can be decisive and may be raised at any time in the litigation.

August 26, 2025August 26, 2025 by Gerald L. Maatman, Jr.

Illinois Federal Courts Allow Adtech And Edtech ECPA Claims To Proceed, Furthering Split Of Authority

By Gerald L. Maatman, Jr., Justin Donoho, Hayley Ryan, and Tyler Zmick

Duane Morris Takeaways: On August 20, 2025, in Hannant v. Sarah D. Culbertson Memorial Hospital, 2025 WL 2413894 (C.D. Ill. Aug. 20, 2025), Judge Sara Darrow of the U.S. District Court for the Central District of Illinois granted a motion to dismiss while allowing a website user to re-plead her claim that the hospital’s use of website advertising technology (“adtech”) violated the Electronic Communications Privacy Act (“ECPA”). The same day, in Q.J. v. Powerschool Holdings, LLC, 2025 WL 2410472 (N.D. Ill. Aug. 20, 2025), Judge Jorge Alonso of the U.S. District Court for the Northern District of Illinois denied the Chicago school board and its educational technology (“edtech”) provider’s motion to dismiss a claim that their use of a third-party data analytics tool violated the ECPA. These rulings are significant in that they show that in the hundreds of adtech, edtech, and other internet-based technology class actions across the nation seeking millions (or billions) in dollars in statutory damages under the ECPA, Illinois Federal courts have distinguished themselves from other courts in other jurisdictions that have refused to interpret the ECPA in such a plaintiff-friendly manner as have the Illinois Federal courts.

Background

These cases are two of a legion of class actions that plaintiffs have filed nationwide alleging that Meta Pixel, Google Analytics, and other similar software embedded in defendants’ websites secretly captured plaintiffs’ web-browsing data and sent it to Meta, Google, and other online advertising agencies and/or data analytics companies. In these adtech, edtech, and similar class actions, the key issue is often a claim brought under the ECPA on the theory that hundreds of thousands of website visitors times $10,000 per claimant in statutory damages equals a huge amount of damages. Plaintiffs have filed the bulk of these types of lawsuits to date against healthcare providers, but they have filed suits against companies that span nearly every industry including education, retailers, and consumer products. Several of these cases have resulted in multimillion-dollar settlements, several have been dismissed, and the vast majority remain undecided.

In Hannant, the plaintiff brought suit against a hospital. According to the plaintiff, the hospital installed the Meta Pixel on its website, thereby transmitting to Meta, allegedly without the plaintiff’s consent, data about her visit to the hospital’s website.

In Q.J., the plaintiff brought suit against the Chicago school board and its edtech provider. According to the plaintiff, the school board and edtech provider installed a third-party data analytics tools called Heap Autocapture on the edtech provider’s online platform, thereby transmitting to Heap, allegedly without consent, information about the students’ visits to the online platform.

In both lawsuits, the plaintiffs claimed that these alleged events amounted to an “interception” by the defendant that violated the ECPA. Neither defendant contested whether the plaintiff had plausibly alleged an “interception,” even though the events were more like the catching and forwarding of a different ball, not an interception: (1) as alleged in Hannant, see No. 24-CV-4164, ECF No. 14 ¶¶ 49, 363 (alleging that the communication Meta received was not the same transmission but a “duplicate[]” that was “forward[ed]”); and (2) despite the wholly conclusory allegations of a purported “interception” in Q.J. However, both defendants moved to dismiss the claim under the ECPA on the grounds that, to the extent there was any interception, no liability exists under the ECPA pursuant to its exception where the party does not act “for the purpose of committing any criminal or tortious act.” 18 U.S.C. 2511(2)(d).

The Courts’ Decisions

In Hannant, the Court dismissed the ECPA claim without prejudice, and granted the plaintiff leave to re-plead in a fashion that may allow such an amended complaint to withstand the ECPA claim. Specifically, the Court found that an amendment might plausibly allege a criminal or tortious purpose by adding sufficient detail about the plaintiff’s website interactions to show that there had been a violation of the Health Insurance Portability and Accountability Act (“HIPAA”), which provides for criminal and civil penalties against a person “who knowingly … discloses individually identifiable health information [(‘IIHI’)] to another person.” 2025 WL 2413894,at *3 (quoting 42 U.S.C. § 1320d-6). As the Court explained, under adtech class-action precedent in the U.S. District Court for the Northern District of Illinois, adding additional detail regarding alleged transmission of IIHI could be enough to allege a criminal or tortious purpose. Id. at *3-5.

In Q.C., the Court denied the school board and edtech provider’s motion to dismiss, citing the same plaintiff-friendly precedent in the Northern District of Illinois cited by the opinion in Hannant, and explaining that while the allegedly disclosed data in this educational context did not violate the HIPAA, the plaintiff had plausibly alleged that the transmissions at issue violated the Illinois School Student Records Act (“ISSRA”), 105 ILCS 10/6, and Family Educational Rights and Privacy Act (“FERPA”), 20 U.S.C. § 1232g. 2025 WL 2410472, at *6.

Implications For Companies

In Illinois Federal courts, pixels and cookies are no longer just marketing and educational tools – they are legal risk vectors. By contrast, other U.S. District Courts ruling on Rule 12(b)(6) motions have found no plausibly alleged interception when an internet-based communication is forwarded as opposed to being intercepted mid-flight, and no plausibly alleged criminal or tortious purpose because the purpose was not to violate any statute but rather to engage in advertising or data analytics. (See, e.g., our prior blog entry discussing one of these several cases, here.)Website owners facing lawsuits in Illinois District Courts would do well to press such arguments finding success in other jurisdictions in order to preserve them for appeal in the Seventh Circuit, which has yet to rule on these issues. In addition, other defenses remain, including demonstrating that plaintiffs cannot meet their burden of proof to show any actual disclosure where transmissions of information entered on the website to adtech vendors and data analytics providers such as Meta or Google are encrypted, ephemeral, anonymized, aggregated, and otherwise unviewable and irretrievable by any human and hence not any actual disclosure to a third party.

Corporate counsel seeking to deter ECPA litigation should keep in mind the following best practices (discussed in more detail in our prior blog post, here): (1) add or update arbitration clauses to deter class actions and mitigate the risks of mass arbitration; (2) update website terms of use, data privacy policies, and vendor agreements; and (3) audit and adjust uses of website advertising technologies.

May 12, 2025May 12, 2025 by Gerald L. Maatman, Jr.

California Court Sua Sponte Dismisses CIPA Class Action For Lack Of Standing

By Gerald L. Maatman, Jr., Tyler Z. Zmick, and George J. Schaller

Duane Morris Takeaways: On April 4, 2025,inRodriguez v. Autotrader.com, Inc., No. 24-CV-08735, 2025 U.S. Dist. LEXIS 70074 (C.D. Cal. Apr. 4, 2025), Judge R. Gary Klausner of the U.S. District Court for the Central District of California dismissed with prejudice a class action complaint which asserted violations of the California Invasion of Privacy Act (“CIPA”) for lack of standing. Plaintiff admitted she was a “tester” and knew that defendant Autotrader’s website contained tracking devices before accessing it, leading the Court to rule that Plaintiff failed to allege an unlawful use of pen registers and trace devices under the CIPA.

This ruling is welcome news for businesses sued by so-called “tester” plaintiffs, who actively seek out websites to “test” for potential CIPA violations.

Case Background

Plaintiff Rebeka Rodriguez filed a class action complaint against Autotrader.com, asserting claims under (i) CIPA § 631 for violating California’s wiretapping and eavesdropping statute and (ii) CIPA § 638.51 for violating California’s statute prohibiting the use of pen registers and trace devices.

Plaintiff claimed that Autotrader’s website immediately installs third-party tracking software that collects various types of information to deliver targeted advertising. She alleged that she ran a search containing “confidential” and “private” information using a search bar on Autotrader’s website, and that such information was then shared with third parties without her consent. Plaintiff also claimed that when she visited the website, tracking software was installed on her browser which “captured and sent identifying information to third parties.” Plaintiff admitted that she was actively seeking out privacy violations when she visited Autotrader’s website.

On March 14, 2025, the District Court granted Autotrader’s request that Plaintiff’s CIPA § 631 claim be dismissed with prejudice for lack of standing. See Rodriguez v. Autotrader.com, Inc., No. 24-CV-08735, 2025 U.S. Dist. LEXIS 47308, at *1 (C.D. Cal. Mar. 14, 2025). The Court’s March 14 order also directed the parties to show cause in writing “whether Plaintiff has standing to bring her § 638.51 claim.” Id.

The Court’s Order

On April 4, 2025, the Court sua sponte dismissed Plaintiff’s remaining pen register claim under CIPA § 638.51 for lack of standing. The Court relied on the same analysis used in dismissing Plaintiff’s § 631 claim – specifically, Plaintiff was “a tester that actively [sought] out privacy violations,” she “had no expectation of privacy’ when she visited [Autotrader’s] website, and therefore, lacked an injury sufficient to establish standing.” Rodriguez v. Autotrader.com, Inc.,No. 24-CV-08735, 2025 U.S. Dist. LEXIS 47308, *2 (C.D. Cal. Apr. 4, 2025). In its ruling, the Court determined that neither party disputed that Plaintiff’s § 638.51 claim “requires the same disclosure of sensitive information and reasonable expectation of privacy as her § 631 claim.” Id.

The Court was not persuaded by Plaintiff’s argument that her status as a tester did not preclude “standing even though she expected or sought out an injury,”finding her supporting authority distinguishable because the cases she relied on involved “First Amendment and ADA claims for which the plaintiffs were injured regardless of their expectations or intentions.” Id. at *3. Accordingly, the Court dismissed Plaintiff’s § 638.51 claim with prejudice.

Implications For Companies

While the ruling in Rodriguez is a positive development for businesses, the scope of the decision was limited in that Plaintiff lacked standing only because her claim required a violation of her “reasonable expectation of privacy.” “Tester” plaintiffs in other class action lawsuits frequently assert claims against website hosts and website service providers and can proceed past the motion-to-dismiss stage.

While companies cannot prevent “tester” plaintiffs from filing similar lawsuits, companies can protect themselves from liability under the CIPA by employing safeguards on their websites in the form of data-tracking disclosures and obtaining consent from users.

March 13, 2025March 13, 2025 by Justin Donoho

Federal Court Holds Illinois Genetic Privacy Claim Not Preempted By Federal Transportation Regulations

By Justin Donoho, Gerald L. Maatman, Jr., and Tyler Zmick

Duane Morris Takeaways: In Short v. MV Transportation, Inc., No. 24-CV-3019 (N.D. Ill. Mar. 10, 2025), Judge Manish S. Shah of the U.S. District Court for the Northern District of Illinois denied defendant’s bid to dismiss a claim brought under the Illinois Genetic Information Privacy Act (“GIPA”). In his ruling, Judge Shah acknowledged that U.S. Department of Transportation regulations require companies in the transportation industry (including defendant) to ensure their drivers satisfy certain physical qualification criteria. The Court nonetheless rejected defendant’s argument that the regulations preempt the GIPA because they do not specifically require employers to ask applicants about their family medical histories (which the GIPA prohibits). In other words, the Court denied defendant’s motion to dismiss because the GIPA does not make it “physically impossible” to comply with federal regulations.

Background

Plaintiff Kevin Short alleged that he applied for a position as a driver for Defendant MV Transportation, Inc., a company that provides paratransit services. As part of the application process, Plaintiff was required to complete a physical examination during which he was asked about his family medical history, including whether his family members had a history of high blood pressure, heart disease, or diabetes.

Plaintiff subsequently sued MV Transportation under the GIPA, alleging that the company violated Section 25(c)(1) of the statute by “solicit[ing], request[ing], [or] requir[ing] . . . genetic information of a person or a family member of the person . . . as a condition of employment [or] preemployment application.” 410 ILCS 513/25(c)(1).

MV Transportation moved to dismiss the complaint on the basis that the Department of Transportation’s (“DOT”) regulations preempted Plaintiff’s GIPA claim. Specifically, MV Transportation argued that Plaintiff’s claim was barred under a “conflict preemption” theory because allowing the claim to proceed would force MV Transportation to choose between complying with the GIPA or complying with federal requirements to “conduct[ ] thorough physical examinations of its drivers.”

MV Transportation pointed to the Motor Carrier Safety Act for support, under which the DOT regulates commercial motor vehicle safety by promulgating “minimum safety standards” to ensure that “the physical condition of operators . . . is adequate to enable them to operate the vehicles safely” – including by requiring drivers to satisfy 13 “physical qualification criteria.” 49 U.S.C. § 31136(a)(3).

The Court’s Decision

In denying MV Transportation’s motion, the Court noted that conflict preemption applies only where “compliance with both federal and state regulations is a physical impossibility” or where the state law “stands as an obstacle to the accomplishment and execution of the full purposes and objectives of Congress.” Id. at 6-7 (citations omitted); see also id. at 6 (noting that “‘[i]nvoking some brooding federal interest’ is insufficient to establish preemption; instead, MV Transportation must identify ‘a constitutional text or a federal statute’ that displaces or conflicts with the state law”) (quoting Virginia Uranium, Inc. v. Warren, 587 U.S. 761, 767 (2019)). The Court further observed that MV Transportation had the burden of overcoming the “presumption against preemption.”

In its ruling, the Court concluded that it is not physically impossible for MV Transportation to simultaneously comply with the GIPA and DOT regulations relative to Plaintiff’s pre-employment health screening because the DOT regulations do not specifically require any inquiry into a driver’s family medical history. MV Transportation asserted that DOT regulations nonetheless “contemplate[] that medical examiners may discuss” a person’s family medical history during a physical exam. The Court was not persuaded, however, stating that such a scenario is “not enough to suggest that compliance with GIPA and the federal regulations is ‘physically impossible.’” Id. at 9 (“The mere possibility that a medical examiner asks for information protected by GIPA while performing an examination does not demonstrate impossibility to comply with both federal and state law.”).

The Court similarly held that the GIPA is not an obstacle to the execution of Congress’s purposes, as reflected in the Motor Carrier Safety Act and DOT regulations. As support for this conclusion, the Court observed that the relevant DOL regulations and the GIPA serve different purposes – the regulations are meant to promote the safe operation of commercial motor vehicles, while the GIPA focuses on health information privacy.

Implications Of The Decision

Short v. MV Transportation is one of several recent decisions in which courts denied bids to dismiss GIPA claims at the pleading stage.

Given this litigation landscape and the statute’s strict penalty provision – under which statutory damages can quickly become significant ($2,500 per negligent violation and $15,000 per intentional or reckless violation, see 410 ILCS 513/40(a)(1)-(2)) – employers should ensure they comply with the statute regarding any health screenings they ask applicants or employees to complete (including by explicitly advising applicants and employees not to disclose their family medical histories during the screenings).

February 20, 2025February 20, 2025 by Gerald L. Maatman, Jr.

The Class Action Weekly Wire – Episode 89: Key Trends In Privacy Class Actions

Duane Morris Takeaway: This week’s episode of the Class Action Weekly Wire features Duane Morris partner Jerry Maatman, special counsel Justin Donoho, and senior associate Tyler Zmick with their discussion of the key trends analyzed in the 2025 edition of the Duane Morris Privacy Class Action Review, including the major settlements and cutting-edge litigation theories percolating in a variety of privacy-related class actions, including the Biometric Information Privacy Act (“BIPA”), advertising technologies (“adtech”), and artificial intelligence tools.

Bookmark or download the Privacy Class Action Review e-book here, which is fully searchable and accessible from any device.

Check out today’s episode and subscribe to our show from your preferred podcast platform: Spotify, Amazon Music, Apple Podcasts, Samsung Podcasts, Podcast Index, Tune In, Listen Notes, iHeartRadio, Deezer, and YouTube.

Episode Transcript

Jerry Maatman: Welcome, loyal listeners, to the next installment of the Class Action Weekly Wire. My name is Jerry Maatman, I’m a partner at Duane Morris, and joining me today are my colleagues, Justin and Tyler.

Justin Donoho: Thank you, Jerry, happy to be part of the podcast.

Tyler Zmick: Thanks, Jerry. I’m glad to be here.

Jerry: Today on our podcast we’re discussing the recent publication of this year’s edition of the Duane Morris Privacy Class Action Review. Our loyal listeners can download the desk reference from our blog, the Duane Morris Class Action Defense Blog. Justin, can you tell our listeners a little bit about our desk reference?

Justin: Yes, and thank you. Last year saw a continued explosion in privacy class action litigation. As a result, it is imperative that companies beef up their efforts to comply with privacy laws in the many ways that companies interact with employees, customers, and others. To that end, the class action team at Duane Morris is pleased to present the Privacy Class Action Review – 2025. This publication analyzes the key privacy-related rulings and developments in 2024, and the significant legal decisions and trends impacting privacy class action litigation for 2025 in a variety of different privacy-related subject areas. We hope that companies and employers will benefit from this resource in their compliance with these evolving laws and standards.

Jerry: Well, just on this podcast I know the assembled speakers have over 60 years of experience in dealing with these issues. But I’d have to say 2024 was a year of incredible change and flux. Tyler, what are some of the key guideposts out there in the case law over the past 12 months?

Tyler: So, there’s been an explosion of class action lawsuits in recent years, including 2024, involving adtech technologies. And of course, biometric data. I think the biggest driver is the fact that we are operating in a legal environment that is evolving so quickly that said technology has far outpaced the law, especially when it comes to new tools like Meta Pixel, Google Analytics, and other adtech technologies. While these tools are innovative in many ways that benefit businesses, they’re also collecting massive amounts of sensitive data – data that consumers may have never explicitly agreed to share. The courts are now grappling with outdated statutes, such as old wiretapping and eavesdropping laws, and trying to apply them to modern technologies.

Justin: Absolutely. Businesses that rely on these technologies have often done so without thinking through a variety of ways that they can mitigate the risk of noncompliance or mitigate the risk of facing any class action lawsuit in the first place, by modernizing their terms of service and data privacy policies. The rise in class actions is directly related to an increased public awareness about data privacy, and of course, the increased aggressiveness of plaintiffs’ attorneys trying to expand the application of the Illinois Biometric Information Privacy Act, for example, with high-profile cases alleging violations of various AI technologies that perform functions other than facial recognition or any kind of person recognition.

Jerry: Speaking of BIPA – 2024 certainly saw a mixed bag of rulings related to biometric data collection, particularly on the issue of facial analysis technologies. So, how does one make sense, if you’re a corporate decision-maker, of what businesses are facing and the risks that are out there, given these murky waters with the case law developments?

Tyler: That’s a great question. The mixed rulings obviously create an atmosphere of uncertainty. And that’s what I think is driving so much of the litigation companies are basically being forced to decide whether to settle or to litigate these cases and risk very high damage awards, because often there are substantial penalties for violations when courts release decisions on issues where there’s no clear-cut answer, and when the decisions are often conflicting, such as on the issue you mentioned about whether certain types of data count as biologically unique. It leaves businesses with many gray areas to navigate, and this is only compounded by the reality that these technologies evolve faster than courts can keep up.

Justin: Yes, and from the business side, companies are being forced to take a much more cautious approach when it comes to how they collect and process biometric data. For example, they’re revisiting their privacy policies in terms of service and taking a closer look at the technologies they use, too. Some companies, especially larger ones, like Google, Meta, and Oracle, have already settled for significant amounts, which sends a clear signal to others that ignoring these issues is just simply too costly.

Jerry: Let’s talk about settlements. So, the plaintiffs’ mantra is file the case, certify the case, then monetize the case. Certainly, in the last 12 months we saw some eye-popping settlements, particularly the $1.4 billion deal between Meta and the State of Texas. What does this tell us about the broader implications of these settlements and what it means for companies operating in this sort of environment?

Justin: Yeah, the size of these settlements is indicative of the stakes involved for sure. As you mentioned, the Meta settlement alone was huge, and it’s reflective of the kind of high-dollar cases we are now seeing across the board. Privacy class action litigation has outpaced other areas of law in terms of growth. And as companies continue to allegedly violate privacy laws, there’s real financial risk involved statutory damages in some of these privacy laws can reach up to $5,000 per violation, which to a plaintiff means per website visit of millions of visitors. And with class actions these violations multiply quickly. This creates significant potential liability for companies.

Tyler: I think that’s exactly right. and it’s not just the monetary cost. These cases also damage a company’s reputation in the world we live in. Consumers are more aware than ever of how their data is used. And if you’re a company in a settlement like that, it’s not just about paying a fine – you’ve also potentially lost consumer trust, and that can have long term business implications.

Jerry: Well, we’ve certainly seen a rise in filings of privacy-related class actions, but we’re also seeing an increase in the skill and ability of the plaintiffs’ bar to secure certification in these class actions. Do you expect this trend to continue during 2025?

Justin: Well, at least the rise in privacy class actions I expect to continue. I mean, it’s been going like this, and it’s going to keep going. We’ll see about the certification decisions as more consumers become aware of their rights, and as data privacy laws continue to evolve. I think we’ll continue to see an uptick in class action filings for sure. Privacy law is still in its infancy in many respects. and many of the current legal frameworks just don’t fully cover the realities of all the new technologies, and how data is being used today, and how data science is evolving the ambiguity is creating fertile grounds for litigation, and I expect that to keep growing.

Tyler: And from a litigation standpoint – yes, we’ll likely continue to see class actions. However, I do think that courts will eventually have to provide more clarity on some of these unsettled issues. We’ve got one of the first federal appeals brewing soon, for example, regarding whether online advertising technology violates the Federal Wiretap Act. As things currently stand, though, the litigation landscape in this area and many other areas of privacy law remain in flux, and there’s still a lot of uncertainty about certain privacy laws, and how they will be applied.

Jerry: Well, I guess the bottom line is we’ve reached a pivot point, certainly a pivotal moment in the intersection of technology and privacy law. Well, thank you, Justin and Tyler, for being here today, and thank you to our loyal listeners for participating in this week’s Class Action Weekly Wire. Please stop by and visit our blog for a free copy that you can download of the Privacy Class Action Review e-book.

Tyler: Thank you for having me, Jerry, and thank you, Listeners.

Justin: Thank you so much, everybody.

February 18, 2025February 18, 2025 by Gerald L. Maatman, Jr.

It’s Here! The Duane Morris Privacy Class Action Review – 2025

By Gerald L. Maatman, Jr., Jennifer A. Riley, Alex W. Karasik, Gregory Tsonis, Justin Donoho, and Tyler Zmick

Duane Morris Takeaways: The last year saw a virtual explosion in privacy class action litigation. As a result, compliance with privacy laws in the myriad of ways that companies interact with employees, customers, and third parties is a corporate imperative. To that end, the class action team at Duane Morris is pleased to present the second edition of the Privacy Class Action Review – 2025. This publication analyzes the key privacy-related rulings and developments in 2024 and the significant legal decisions and trends impacting privacy class action litigation for 2025. We hope that companies and employers will benefit from this resource in their compliance with these evolving laws and standards.

Click here to bookmark or download a copy of the Privacy Class Action Review – 2025 e-book. Look forward to an episode on the Review coming soon on the Class Action Weekly Wire!

July 28, 2024July 29, 2024 by Tyler Z. Zmick

Illinois Federal Court Dismisses Class Action Privacy Claims Involving Use Of Samsung’s “Gallery” App

By Tyler Zmick, Justin Donoho, and Gerald L. Maatman, Jr.

Duane Morris Takeaways: In G.T., et al. v. Samsung Electronics America, Inc., et al., No. 21-CV-4976, 2024 WL 3520026 (N.D. Ill. July 24, 2024), Judge Lindsay C. Jenkins of the U.S. District Court for the Northern District of Illinois dismissed claims brought under the Illinois Biometric Information Privacy Act (“BIPA”). In doing so, Judge Jenkins acknowledged limitations on the types of conduct (and types of data) that can subject a company to liability under the statute. The decision is welcome news for businesses that design, sell, or license technology yet do not control or store any “biometric” data that may be generated when customers use the technology. The case also reflects the common sense notion that a data point does not qualify as a “biometric identifier” under the BIPA if it cannot be used to identify a specific person. G.T. v. Samsung is required reading for corporate counsel facing privacy class action litigation.

Background

Plaintiffs — a group of Illinois residents who used Samsung smartphones and tablets — alleged that their respective devices came pre-installed with a “Gallery application” (the “App”) that can be used to organize users’ photos. According to Plaintiffs, whenever an image is created on a Samsung device, the App automatically: (1) scans the image to search for faces using Samsung’s “proprietary facial recognition technology”; and (2) if it detects a face, the App analyzes the face’s “unique facial geometry” to create a “face template” (i.e., “a unique digital representation of the face”). Id. at *2. The App then organizes photos based on images with similar face templates, resulting in “pictures with a certain individual’s face [being] ‘stacked’ together on the App.” Id.

Based on their use of the devices, Plaintiffs alleged that Samsung violated §§ 15(a) and 15(b) of the BIPA by: (1) failing to develop a written policy made available to the public establishing a retention policy and guidelines for destroying biometric data, and (2) collecting Plaintiffs’ biometric data without providing them with the requisite notice and obtaining their written consent.

Samsung moved to dismiss on two grounds, arguing that: (1) Plaintiffs did not allege that Samsung “possessed” or “collected” their biometric data because they did not claim the data ever left their devices; and (2) Plaintiffs failed to allege that data generated by the App qualifies as “biometric identifiers” or “biometric information” under the BIPA, because Samsung cannot use the data to identify Plaintiffs or others appearing in uploaded photos.

The Court’s Decision

The Court granted Samsung’s motion to dismiss on both grounds.

“Possession” And “Collection” Of Biometric Data

Regarding Samsung’s first argument, the Court began by explaining what it means for an entity to be “in possession of” biometric data under § 15(a) and to “collect” biometric data under § 15(b). The Court observed that “possession” occurs when an entity exercises control over data or holds it at its disposal. Regarding “collection,” the Court noted that the term “collect,” and the other verbs used in § 15(b) (“capture, purchase, receive through trade, or otherwise obtain”), all refer to an entity taking an “active step” to gain control of biometric data.

The Court proceeded to consider Plaintiffs’ contention that Samsung was “in possession of” their biometrics because Samsung controls the proprietary software used to operate the App. The Court sided with Samsung, however, concluding that Plaintiffs failed to allege “possession” (and thus failed to state a § 15(a) claim) because they did not allege that Samsung can access the data (as opposed to the technology Samsung employs). Id. at *9 (“Samsung controls the App and its technology, but it does not follow that this control gives Samsung dominion over the Biometrics generated from the App, and plaintiffs have not alleged Samsung receives (or can receive) such data.”).

As for § 15(b), the Court rejected Plaintiffs’ argument that Samsung took an “active step” to “collect” their biometrics by designing the App to “automatically harvest[] biometric data from every photo stored on the Device.” Id. at *11. The Court determined that Plaintiffs’ argument failed for the same reason their § 15(a) “possession” argument failed. Id. at *11-12 (“Plaintiffs’ argument again conflates technology with Biometrics. . . . Plaintiffs do not argue that Samsung possesses the Data or took any active steps to collect it. Rather, the active step according to Plaintiffs is the creation of the technology.”).

“Biometric Identifiers” And “Biometric Information”

The Court next turned to Samsung’s second argument for dismissal – namely, that Plaintiffs failed to allege that data generated by the App is “biometric” under the BIPA because Samsung could not use it to identify Plaintiffs (or others appearing in uploaded photos).

In opposing this argument, Plaintiffs asserted that: (1) the “App scans facial geometry, which is an explicitly enumerated biometric identifier”; and (2) the “mathematical representations of face templates” stored through the App constitute “biometric information” (i.e., information “based on” scans of Plaintiffs’ “facial geometry”). Id. at *13.

The Court ruled that “Samsung has the better argument,” holding that Plaintiffs’ claims failed because Plaintiffs did not allege that Samsung can use data generated through the App to identify specific people. Id. at *15. The Court acknowledged that cases are split “on whether a plaintiff must allege a biometric identifier can identify a particular individual, or if it is sufficient to allege the defendant merely scanned, for example, the plaintiff’s face or retina.” Id. at *13. After employing relevant principles of statutory interpretation, the Court sided with the cases in the former category and opined that “the plain meaning of ‘identifier,’ combined with the BIPA’s purpose, demonstrates that only those scans that can identify an individual qualify.” Id. at *15.

Turning to the facts alleged in the Complaint, the Court concluded that Plaintiffs failed to state claims under the BIPA because the data generated by the App does not amount to “biometric identifiers” or “biometric information” simply because the data can be used to identify and group the unique faces of unnamed people. In other words, biometric information must be capable of recognizing an individual’s identity – “not simply an individual’s feature.” Id. at *17; see also id. at *18 (noting that Plaintiffs claimed only that the App groups unidentified faces together, and that it is the device user who can add names or other identifying information to the faces).

Implications Of The Decision

G.T. v. Samsung is one of several recent decisions grappling with key questions surrounding the BIPA, including questions as to: (1) when an entity engages in conduct that rises to the level of “possession” or “collection” of biometrics; and (2) what data points qualify (and do not qualify) as “biometric identifiers” and “biometric information” such that they are subject to regulation under the statute.

Regarding the first question, the Samsung case reflects the developing majority position among courts – i.e., a company is not “in possession of,” and has not “collected,” data that it does not actually receive or access, even if it created and controlled the technology that generated the allegedly biometric data.

As for the second question, the Court’s decision in Samsung complements the Ninth Circuit’s recent decision in Zellmer v. Meta Platforms, Inc., where it held that a “biometric identifier” must be capable of identifying a specific person. See Zellmer v. Meta Platforms, Inc., 104 F.4th 1117, 1124 (9th Cir. 2024) (“Reading the statute as a whole, it makes sense to impose a similar requirement on ‘biometric identifier,’ particularly because the ability to identify did not need to be spelled out in that term — it was readily apparent from the use of ‘identifier.’”). Courts have not uniformly endorsed this reading, however, and parties will likely continue litigating the issue unless and until the Illinois Supreme Court provides the final word on what counts as a “biometric identifier” and “biometric information.”