{"id":622,"date":"2023-07-01T12:29:28","date_gmt":"2023-07-01T16:29:28","guid":{"rendered":"https:\/\/blogs.duanemorris.com\/classactiondefense\/?p=622"},"modified":"2023-07-01T12:29:28","modified_gmt":"2023-07-01T16:29:28","slug":"california-district-court-gives-green-light-to-bipa-claims-brought-against-youtube","status":"publish","type":"post","link":"https:\/\/blogs.duanemorris.com\/classactiondefense\/2023\/07\/01\/california-district-court-gives-green-light-to-bipa-claims-brought-against-youtube\/","title":{"rendered":"California District Court Gives Green Light To BIPA Claims Brought Against YouTube"},"content":{"rendered":"

\"\"<\/a>By Gerald L. Maatman, Jr. and Tyler Z. Zmick<\/p>\n

Duane Morris Takeaways:\u00a0 <\/em><\/strong>In Colombo v. YouTube, LLC, et al., No. 22-CV-6987, 2023 WL 4240226 (N.D. Cal. June 28, 2023), the U.S. District Court for the Northern District of California issued a decision<\/a>\u00a0embracing a broad interpretation of the data types that are within the scope of the Illinois Biometric Information Privacy Act (\u201cBIPA\u201d).\u00a0 The decision puts businesses on notice that the statute may apply to the collection or possession of any \u201cscan of face geometry,\u201d regardless of whether the scan can be used to identify a specific individual<\/em> – – i<\/em>n other words, a \u201cbiometric identifier\u201d under the BIPA need not be capable of \u201cidentifying\u201d a person.\u00a0 Colombo <\/em>v. YouTube, LLC <\/em>is required reading for corporate counsel facing privacy class action litigation.<\/em><\/p>\n

Background<\/strong><\/p>\n

Plaintiff\u2019s BIPA claims were premised on two YouTube video editing tools that allegedly resulted in the collection of his \u201cbiometric identifiers\u201d and \u201cbiometric information\u201d (collectively, \u201cbiometric data\u201d) \u2013 YouTube\u2019s (1) \u201cFace Blur\u201d tool and (2) \u201cThumbnail Generator\u201d tool.\u00a0 Id.<\/em> at 2-3. According to Plaintiff, the \u201cFace Blur\u201d tool enables a user to select faces appearing in videos uploaded by the user that he or she may wish to \u201cblur,\u201d resulting in those faces appearing blurry and unrecognizable to any viewer of the videos.\u00a0 Plaintiff claimed that when someone uses the tool, YouTube scans the uploaded video \u201cto detect all unique faces\u201d and, in doing so, \u201ccaptures and stores scans of face geometry from all detected faces, creating a unique \u2018faceId\u2019 for each.\u201d\u00a0 Id<\/em>. at 2 (citation omitted).<\/p>\n

Regarding YouTube\u2019s \u201cThumbnail Generator\u201d feature, Plaintiff described the tool as auto-generating photographic thumbnails (i.e.<\/em>, screenshots from an uploaded video) by scanning videos for faces at the time they are uploaded and using the \u201cface data to auto-generate thumbnails that contain faces.\u201d\u00a0 Id.<\/em> (citation omitted).<\/p>\n

Based on his alleged use of these two YouTube tools, Plaintiff alleged that YouTube violated Sections 15(a) and 15(b) of the BIPA by (i) failing to develop and comply with a written policy made available to the public establishing a retention policy and guidelines for destroying biometric data, and (ii) collecting his biometric data without providing him with the requisite notice and obtaining his written consent.<\/p>\n

YouTube moved to dismiss on three grounds, arguing that: (1) Plaintiff failed to allege that data collected by YouTube qualifies as \u201cbiometric data\u201d under the BIPA because YouTube did not (and could not) use the data to identify Plaintiff or others appearing in uploaded videos; (2) Plaintiff\u2019s claims violated Illinois\u2019s extraterritoriality doctrine and the dormant Commerce Clause; and (3) Plaintiff failed to allege that he was \u201caggrieved\u201d for purposes of his Section 15(a) claim.<\/p>\n

The Court\u2019s Decision<\/strong><\/p>\n

The Court denied YouTube\u2019s motion to dismiss on all three grounds.<\/p>\n

\u201cBiometric Identifiers\u201d And \u201cBiometric Information\u201d <\/u><\/p>\n

YouTube first argued that Plaintiff failed to allege that data collected through the Face Blur and Thumbnail Generator tools qualify as \u201cbiometric data\u201d under the BIPA because Plaintiff did not plausibly allege that YouTube could use the data to affirmatively identify Plaintiff or other individuals.\u00a0 See<\/em> id.<\/em> at 4 (\u201cIn YouTube\u2019s view, biometric identifiers must identify a person and biometric information must actually be used to identify a person.\u201d).<\/p>\n

The Court rejected YouTube\u2019s argument, stating that \u201c[t]he \u201cpoint is not well taken.\u201d\u00a0 Id.<\/em>\u00a0 The Court noted the statute\u2019s definition of \u201cbiometric identifier\u201d as \u201ca retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry,\u201d see<\/em> 740 ILCS 14\/10 \u2013 a definition that does not explicitly require that the listed data points be capable of identifying a particular person.\u00a0 While the Court acknowledged that the term \u201cidentifier\u201d may suggest that the data must be used to identify a person, the Court also opined that \u201c\u2018[w]hen a statute includes an explicit definition, we must follow that definition,\u2019 even if it varies from a term\u2019s ordinary meaning.\u201d\u00a0 Id.<\/em> at 4 (citation omitted); see also id.<\/em> at 5 (\u201c[T]he Illinois legislature was perfectly free to define \u2018biometric identifier\u2019 in a specific manner that is not tethered to the plain meaning of the word \u2018identifier\u2019 alone.\u201d).<\/p>\n

Extraterritoriality & Dormant Commerce Clause<\/u><\/p>\n

The Court also rejected YouTube\u2019s arguments that Plaintiff failed to allege that YouTube\u2019s relevant conduct occurred \u201cprimarily and substantially\u201d in Illinois, and Plaintiff\u2019s interpretation of the BIPA would run afoul of the dormant Commerce Clause.<\/p>\n

The Court held that Plaintiff sufficiently alleged that YouTube\u2019s conduct occurred \u201cprimarily and substantially\u201d in Illinois, thereby satisfying the extraterritoriality doctrine.\u00a0 Id.<\/em> at 5. Responding to YouTube\u2019s argument that the company\u2019s headquarters and data servers are located outside of Illinois, the Court stated that those facts are \u201cnot dispositive\u201d and that \u201c[m]aking the geographic coordinates of a server the most important circumstance in fixing the location of an Internet company\u2019s conduct would . . . effectively gut the ability of states without server sites to apply their consumer protection laws to residents for online activity that occurred substantially within their borders.\u201d\u00a0 Id.<\/em> at 6 (citation omitted).<\/p>\n

Using the same reasoning, the Court concluded that \u201cYouTube\u2019s dormant Commerce Clause theory fares no better\u201d because YouTube\u2019s allegedly BIPA-violating conduct \u201ccannot be understood to have occurred wholly outside Illinois,\u201d id.<\/em> at 7 (citation omitted) \u2013 i.e.<\/em>, Plaintiff\u2019s claims were based on the application of an Illinois law to Illinois-based YouTube users.<\/p>\n

Whether Plaintiff Is \u201cAggrieved\u201d Under Section 15(a)<\/u><\/p>\n

Finally, the Court rejected YouTube\u2019s argument that Plaintiff failed to allege that he was \u201caggrieved\u201d under Section 15(a), which sets forth two requirements for entities in possession of biometric data: (i) to develop a publicly available BIPA-compliant retention policy; and (ii) to comply with that policy.\u00a0 YouTube argued that Plaintiff failed to allege that he was aggrieved under Section 15(a) because he did not claim that YouTube failed to comply with<\/em><\/strong> an existing retention policy as to his biometric data (e.g.<\/em>, that three years had passed since his last interaction with YouTube, yet YouTube had failed to destroy his biometric data).<\/p>\n

The Court observed, however, that Plaintiff alleged that YouTube failed to develop and<\/em><\/strong> \u201ctherefore failed to comply with any BIPA-compliant policy,\u201d which \u201cis enough to move forward . . . [a]t the pleadings stage.\u201d\u00a0 Id.<\/em> at 8 (emphasis added) (citation omitted).<\/p>\n

Implications For Corporate Counsel<\/strong><\/p>\n

Colombo<\/em>\u00a0can be added to the list of recent plaintiff-friendly BIPA decisions, as it endorses an expansive view of the types of data that constitute \u201cbiometric data\u201d under the statute.\u00a0 Indeed, the Colombo<\/em> ruling suggests that any data that can be characterized as a \u201cscan of face geometry\u201d \u2013 regardless of whether the scan can be linked to a specific person to identify him or her \u2013 qualifies as a \u201cbiometric identifier\u201d within the BIPA\u2019s scope.\u00a0 Put another way, technology capable of only detecting a category of objects or characteristics in a photo or video (e.g.<\/em>, software that identifies the location of a human face in a photo \u2013 as opposed to an arm or leg \u2013 without being able to link that face to a specific person) may involve data subject to regulation under the BIPA.<\/p>\n","protected":false},"excerpt":{"rendered":"

By Gerald L. Maatman, Jr. and Tyler Z. Zmick Duane Morris Takeaways:\u00a0 In Colombo v. YouTube, LLC, et al., No. 22-CV-6987, 2023 WL 4240226 (N.D. Cal. June 28, 2023), the U.S. District Court for the Northern District of California issued a decision\u00a0embracing a broad interpretation of the data types that are within the scope of … <\/p>\n

Continue reading “California District Court Gives Green Light To BIPA Claims Brought Against YouTube”<\/span><\/a><\/p>\n","protected":false},"author":575,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"ppma_author":[7,12],"class_list":["post-622","post","type-post","status-publish","format-standard","hentry","category-general"],"authors":[{"term_id":7,"user_id":575,"is_guest":0,"slug":"gmaatman","display_name":"Gerald L. Maatman, Jr.","avatar_url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2022\/09\/maatmangerald-100x100.jpg","0":null,"1":"","2":"","3":"","4":"","5":"","6":"","7":"","8":""},{"term_id":12,"user_id":578,"is_guest":0,"slug":"tzzmick","display_name":"Tyler Z. Zmick","avatar_url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2022\/09\/zmicktyler-100x100.jpg","0":null,"1":"","2":"","3":"","4":"","5":"","6":"","7":"","8":""}],"_links":{"self":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts\/622","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/users\/575"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/comments?post=622"}],"version-history":[{"count":0,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts\/622\/revisions"}],"wp:attachment":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/media?parent=622"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/categories?post=622"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/tags?post=622"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/ppma_author?post=622"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}