{"id":927,"date":"2023-11-04T11:30:14","date_gmt":"2023-11-04T15:30:14","guid":{"rendered":"https:\/\/blogs.duanemorris.com\/classactiondefense\/?p=927"},"modified":"2023-11-04T11:31:54","modified_gmt":"2023-11-04T15:31:54","slug":"illinois-federal-court-allows-amazon-alexa-privacy-class-action-to-proceed","status":"publish","type":"post","link":"https:\/\/blogs.duanemorris.com\/classactiondefense\/2023\/11\/04\/illinois-federal-court-allows-amazon-alexa-privacy-class-action-to-proceed\/","title":{"rendered":"Illinois Federal Court Allows Amazon \u201cAlexa\u201d Privacy Class Action To Proceed"},"content":{"rendered":"

\"\"<\/a>By Gerald L. Maatman, Jr. and Tyler Zmick<\/span><\/p>\n

Duane Morris Takeaways:\u00a0 <\/em><\/strong>In Wilcosky, et al. v. Amazon.com, Inc., et al., No. 19-CV-5061 (N.D. Ill. Nov. 1, 2023), the U.S. District Court for the Northern District of Illinois issued\u00a0a decision <\/a>embracing a strict interpretation<\/em> of the notice a private entity must provide before collecting a person\u2019s biometric data in compliance with the Illinois Biometric Information Privacy Act (\u201cBIPA\u201d).\u00a0 The decision underscores the importance of not only obtaining written consent before collecting a person\u2019s biometric data, but also of the need to be as specific as possible in drafting privacy notices to inform end users that the company is collecting biometric data and<\/em> to<\/em> describe the \u201cspecific purpose and length of term for which\u201d biometric data is being collected.\u00a0<\/em><\/p>\n

In light of the potentially monumental exposure faced by companies defending putative BIPA class actions, companies that operate in Illinois and collect data that could potentially be characterized as \u201cbiometric\u201d should review and, if necessary, update their public-facing privacy notices to ensure compliance with the BIPA.\u00a0<\/em><\/p>\n

Background<\/strong><\/p>\n

Plaintiffs\u2019 BIPA claims in Wilcosky<\/em> were premised on their respective interactions with Amazon\u2019s \u201cAlexa\u201d device \u2013 a digital assistant that provides voice-based access to Amazon\u2019s shopping application and other services.\u00a0 According to Plaintiffs, Alexa devices identify individuals who speak within the vicinity of an active device by collecting and analyzing the speaker\u2019s \u201cbiometric identifiers\u201d (specifically, \u201cvoiceprints\u201d).<\/p>\n

In their complaint, Plaintiffs claimed that Amazon identifies people from the sound of their voices after they enroll in Amazon\u2019s \u201cVoice ID\u201d feature on the Alexa Application.\u00a0 To enroll in Voice ID, a user is taken to a screen notifying him or her that the Voice ID feature \u201cenables Alexa to learn your voice, recognize you when you speak to any of your Alexa devices, and provide enhanced personalization.\u201d\u00a0 Order at 3.\u00a0 A hyperlink to the Alexa Terms of Use is located at the bottom of the enrollment screen, which Terms state that Voice ID \u201cuses recordings of your voice to create an acoustic model of your voice characteristics.\u201d\u00a0 Id.<\/em> at 8.\u00a0 Before completing the Voice ID enrollment process, a user must agree to the Alexa Terms of Use and authorize \u201cthe creation, use, improvement, and storage\u201d of his or her Voice ID by tapping an \u201cAgree and Continue\u201d button.\u00a0 Id.<\/em> at 3.<\/p>\n

Among the four named Plaintiffs, three had enrolled in Voice ID using their respective Alexa devices (the \u201cVoice ID Plaintiffs\u201d).\u00a0 One Plaintiff, Julia Bloom Stebbins, did not enroll in Voice ID; rather, she alleged that she spoke in the vicinity of Plaintiff Jason Stebbins\u2019s Alexa device, resulting in Alexa collecting her \u201cvoiceprint\u201d to determine whether her voice \u201cmatched\u201d the Voice ID of Plaintiff Jason Stebbins.<\/p>\n

Based on their alleged interactions with Alexa, Plaintiffs claimed that Amazon violated Sections 15(b), 15(c), and 15(d) of the BIPA by (i) collecting their biometric data without providing them with the requisite notice and obtaining their written consent, (ii) impermissibly \u201cprofiting from\u201d their biometric data, and (iii) disclosing their biometric data without consent.<\/p>\n

Amazon moved to dismiss Plaintiffs\u2019 complainton the basis that: (1) the Voice ID Plaintiffs received the required notice and provided their written consent by completing the Voice ID enrollment process; and (2) Plaintiff Bloom Stebbins never enrolled in Voice ID \u2013 meaning she was a \u201ctotal stranger\u201d to Amazon such that Amazon could not possibly identify her based on the sound of her voice.<\/p>\n

The Court\u2019s Decision<\/strong><\/p>\n

The Court denied Amazon\u2019s motion to dismiss in a 15-page order, focused primarily on Amazon\u2019s arguments relating to Plaintiffs\u2019 Section 15(b) claim.<\/p>\n

Sufficiency Of Notice Provided To Voice ID Plaintiffs<\/u><\/p>\n

Regarding the requirements of Section 15(b), the Court noted that a company collecting biometric data must first: (1) inform the individual that biometric data is being collected or stored; (2) inform the individual of the specific purpose and length of term for which the biometric data is being collected, stored, and used; and (3) receive a written release signed by the individual.<\/p>\n

In moving to dismiss the Voice ID Plaintiffs\u2019 Section 15(b) claim, Amazon argued that those three Plaintiffs received all legally required notices during the Voice ID enrollment process.\u00a0 During that process, Amazon explained how Voice ID works and informed users that the technology creates an acoustic model of a user\u2019s voice characteristics.\u00a0 Amazon maintained that notice language need not track the exact language set forth in Section 15(b) because the BIPA does not require that any particular statutory language be provided to obtain a person\u2019s informed consent.\u00a0 I<\/em>d.<\/em> at 6 (noting Amazon\u2019s argument that \u201cVoice ID Plaintiffs\u2019 voiceprints were collected in circumstances under which any reasonable consumer should have known that his or her biometric information was being collected\u201d).<\/p>\n

The Court adopted Plaintiffs\u2019 stricter reading of Section 15(b). It held that the complaint plausibly alleged that Amazon\u2019s disclosures did not fully satisfy Section 15(b)\u2019s notice requirements.\u00a0 While Amazon may have informed users that Voice ID enables Alexa to learn their voices and recognize them when they speak, Amazon did not specifically inform users that it is \u201ccollecting and capturing the enrollee\u2019s voiceprint, a biometric identifier.\u201d\u00a0 Id.<\/em>at 8.\u00a0 As a result, and acknowledging that it was \u201ca close call,\u201d the Court denied Amazon\u2019s motion to dismiss the Section 15(b) claim asserted by the Voice ID Plaintiffs.<\/p>\n

Application Of The BIPA To \u201cNon-User\u201d Plaintiff Julia Bloom Stebbins<\/u><\/p>\n

The Court next turned to Plaintiff Bloom Stebbins, who did not create an Alexa Voice ID but alleged that Amazon collected her \u201cvoiceprint\u201d when she spoke in the vicinity of Plaintiff Jason Stebbins\u2019s Alexa device.\u00a0 Amazon argued that her Section 15(b) claim failed because the BIPA was not meant to apply to someone in her shoes \u2013 that is, a stranger to Amazon and \u201cwho Amazon has no means of identifying.\u201d\u00a0 Id.<\/em> at 11.<\/p>\n

The Court rejected Amazon\u2019s argument.\u00a0 In doing so, the Court refused to read Section 15(b)\u2019s requirements as applying only where a company has some relationship with an individual.\u00a0 According to the Court, that interpretation would amount to \u201cread[ing] a requirement into the statute that does not appear in the statute itself.\u201d\u00a0 Id.<\/em> at 12; see also id.<\/em> (\u201c[C]ourts in this Circuit have rejected the notion that to state a claim for a Section 15(b) violation, there must be a relationship between the collector of the biometric information and the individual.\u201d).<\/p>\n

Conclusion<\/strong><\/p>\n

Wilcosky<\/em>\u00a0is required reading for corporate counsel of companies that are facing privacy-related class actions and\/or want to ensure their consumer or employee-facing privacy disclosures contain all notices required under applicable law.<\/p>\n

The Wilcosky<\/em> decision endorses a strict view regarding the notice a company must provide to individuals to fully comply with Section 15(b) of the BIPA.\u00a0 To ensure compliance, companies should provide end users with language that is as specific as possible regarding the type(s) of data being collected (including the fact that the data may be \u201cbiometric\u201d), the purpose the data is being collected, and the time period during which the data will be stored.\u00a0 The notice should closely track the BIPA\u2019s statutory text, and companies should also require individuals to affirmatively express that they have received the notice and agree to the collection of their biometric data.\u00a0 (Despite a footnote stating that the Court\u2019s order in Wilcosky<\/em> should not \u201cbe interpreted to mean that . . . a disclosure must parrot the exact language of BIPA in order to satisfy Section 15(b),\u201d id.<\/em> at 8 n.3, the Court does not explain how a disclosure could satisfy Section 15(b) without tracking the statute\u2019s language verbatim.)<\/p>\n

Moreover, Wilcosky<\/em> raises the question whether a company should characterize data it collects as \u201cbiometric\u201d data in its privacy notice \u2013 even if the company maintains (perhaps for good reason) that the data does not<\/em><\/strong> constitute biometric data subject to regulation under the BIPA.\u00a0 Further complicating this question is the fact that the precise contours of the types of data that qualify as \u201cbiometric\u201d under the BIPA are unclear and are currently being litigated in many cases.\u00a0 Companies may wish to err on the \u201csafe side\u201d and refer to the data being collected as \u201cbiometric\u201d data in their privacy notices.<\/p>\n","protected":false},"excerpt":{"rendered":"

By Gerald L. Maatman, Jr. and Tyler Zmick Duane Morris Takeaways:\u00a0 In Wilcosky, et al. v. Amazon.com, Inc., et al., No. 19-CV-5061 (N.D. Ill. Nov. 1, 2023), the U.S. District Court for the Northern District of Illinois issued\u00a0a decision embracing a strict interpretation of the notice a private entity must provide before collecting a person\u2019s … <\/p>\n

Continue reading “Illinois Federal Court Allows Amazon \u201cAlexa\u201d Privacy Class Action To Proceed”<\/span><\/a><\/p>\n","protected":false},"author":575,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[59],"tags":[],"ppma_author":[7,12],"class_list":["post-927","post","type-post","status-publish","format-standard","hentry","category-privacy-class-actions"],"authors":[{"term_id":7,"user_id":575,"is_guest":0,"slug":"gmaatman","display_name":"Gerald L. Maatman, Jr.","avatar_url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2022\/09\/maatmangerald-100x100.jpg","0":null,"1":"","2":"","3":"","4":"","5":"","6":"","7":"","8":""},{"term_id":12,"user_id":578,"is_guest":0,"slug":"tzzmick","display_name":"Tyler Z. Zmick","avatar_url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2022\/09\/zmicktyler-100x100.jpg","0":null,"1":"","2":"","3":"","4":"","5":"","6":"","7":"","8":""}],"_links":{"self":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts\/927","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/users\/575"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/comments?post=927"}],"version-history":[{"count":0,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts\/927\/revisions"}],"wp:attachment":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/media?parent=927"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/categories?post=927"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/tags?post=927"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/ppma_author?post=927"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}