McGoveran v. Amazon Web Services, Inc.

IN THE UNITED STATES DISTRICT COURT

FOR THE SOUTHERN DISTRICT OF ILLINOIS

CHRISTINE MCGOVERAN,

JOSEPH VALENTINE, and

AMELIA RODRIGUEZ, on behalf of

themselves and all other persons

similarly situated,

Plaintiffs,

v. Case No. 3:20-CV-31-NJR

AMAZON WEB SERVICES, INC. and

PINDROP SECURITY, INC.,

Defendants.

MEMORANDUM AND ORDER

ROSENSTENGEL, Chief Judge:

This matter is before the Court on the motions to dismiss filed by Defendants

Pindrop Security, Inc. (Doc. 35) and Amazon Web Services, Inc. (Doc. 49). Defendants

seek to dismiss the case for lack of personal jurisdiction under Federal Rule of Civil

Procedure 12(b)(2). Alternatively, they move for dismissal under Rule 12(b)(6) for failure

to state a claim. For the following reasons, this action is dismissed for lack of personal

jurisdiction.

BACKGROUND

On December 17, 2019, Plaintiffs Christine McGoveran, Joseph Valentine, and

Amelia Rodriguez filed a putative Class Action Complaint against Defendants Amazon

Web Services, Inc. (“AWS”), and Pindrop Security, Inc. (“Pindrop”), in the Circuit Court

for the Third Judicial Circuit in Madison County, Illinois, alleging violations of the

Biometric Information Privacy Act (BIPA), 740 ILL. COMP. STAT. § 14/1, et seq. (Doc. 1-1).

Specifically, Plaintiffs allege Pindrop and AWS violated BIPA by collecting, possessing,

redisclosing, profiting from, and failing to safeguard their biometric identifiers and

biometric information, including their voiceprints (Id. at ¶ 1).

Voiceprinting, also known as voice biometrics, is the use of biological

characteristics—one’s voice—to verify an individual’s identity without requiring the use

of a passcode or answers to secret questions (Id. at ¶¶ 33-35). Unlike a traditional

passcode, however, in the event of a data breach there is nothing the individual can do to

prevent someone from using his or her voiceprint to gain access to a compromised

account (Id. at ¶ 36).

Plaintiffs allege Pindrop offers voiceprint services for use by call centers and

customer service personnel to confirm the identity of callers (Id. at ¶¶ 38-39). Pindrop

does this through its “Deep Voice” product, which uses biometrics to identify and

analyze repeat callers (Id. at ¶ 42). Similarly, Pindrop’s “Phoneprinting” product analyzes

call audio to create a distinctive identifier for each caller (Id.).

AWS offers cloud storage services, including the ability for customers to store their

data, access data remotely, and create backup copies of data (Id. at ¶ 45). AWS also offers

call center services under the brand “Amazon Connect” (Id. at ¶ 46). In connection with

Amazon Connect, AWS possesses and stores a variety of types of customer data,

including biometric identifiers and information (Id. at ¶¶ 48-49).

Pindrop was one of the first partners with AWS in launching Amazon Connect (Id.

at ¶ 52). Plaintiffs allege that after an individual places a call to an AWS client’s call center,

the audio is sent to Pindrop for processing (Id. at ¶¶ 57-59; Doc. 57 at p. 8). Pindrop then

processes the audio, analyzes the caller’s unique voice biometric data, and sends the

results of its analysis to AWS’s servers (Id. at ¶¶ 58-59; Doc. 57 at p. 8). Plaintiffs claim

that once this process occurs, AWS then possesses “biometric information” as defined by

BIPA (Id. at. ¶ 60).

With regard to the named Plaintiffs, the Complaint alleges that they called John

Hancock customer service representatives or call centers on numerous occasions

regarding investment or insurance products (Id. at ¶¶ 67-70; Doc. 57 at p. 9). Plaintiffs

were residents of Illinois, located in Illinois, and used Illinois phone numbers to call John

Hancock (Docs. 57-2; 57-3; 57-4). John Hancock’s call centers use Amazon Connect with

Pindrop biometric voiceprint authentication; as a result, they no longer require customers

to have a pin number for authentication (Id. at ¶¶ 71-72). Plaintiffs allege that AWS and

Pindrop apply their voice biometric technology to every caller to John Hancock’s call

centers (Id. at ¶ 73).

Plaintiffs’ Complaint asserts five counts of BIPA violations, 740 ILL. COMP. STAT.

§ 14/15(a)-(e). In Count I, Plaintiffs claim that Defendants violated BIPA section 14/15(a)

by possessing Plaintiffs’ and Class members’ biometric information, including

voiceprints and related biometric information, without creating and following a written

policy, made available to the public, establishing and following a retention schedule and

destruction guidelines for their possession of biometric identifiers and information (Id. at

¶ 90). In Count II, Plaintiffs assert Defendants violated BIPA section 14/15(b) by failing

to inform John Hancock’s Illinois callers that their biometric information is being

collected and stored and by not obtaining any form of consent (Id. at ¶¶ 94-95). In Count

III, Plaintiffs allege that Defendants violated BIPA section 14/15(c) by profiting from the

possession of their biometric information, including their voiceprints (Id. at ¶ 102). Count

IV alleges Defendants violated BIPA section 14/15(d) when they disclosed, redisclosed,

and disseminated their biometric information, including voiceprints, without consent (Id.

at ¶ 107). Finally, Plaintiffs claim Defendants violated BIPA section 14/15(e) by failing to

use reasonable care in storing, transmitting, and protecting the biometric information

from disclosure, or by failing to do so in a manner the same as or more protective than

the manner in which Defendants store, transmit, and protect other confidential and

sensitive information (Id. at ¶¶ 112-13).

Plaintiffs seek to represent a class consisting of:

All Illinois citizens who placed one or more phone calls to, or received one

or more phone calls from, an entity using Amazon Connect and Pindrop’s

voice authentication and/or fraud detection technology, from December

17, 2014 until present.

(Id. at ¶ 81).

On behalf of themselves and the putative class, Plaintiffs seek an order enjoining

Defendants from further violating BIPA, actual damages, statutory damages of $5,000 for

each intentional and reckless violation of BIPA pursuant to 740 ILL. COMP. STAT. 14/20(2),

or statutory damages of $1,000 for each negligent violation of BIPA pursuant to 740 ILL.

COMP. STAT. 14/20(1), attorneys’ fees and costs, and pre- and post-judgment interest. 740

ILL. COMP. STAT. 14/20(3). (Id. at pp. 26-27).

SUBJECT MATTER JURISDICTION

On January 8, 2020, Defendants removed the action to this Court under the Class

Action Fairness Act (CAFA), 28 U.S.C. § 1332(d)(2) (Doc. 1). CAFA extends federal

jurisdiction over class actions where: (1) any member of the proposed class is a citizen of

a state different from any defendant (i.e., minimal diversity exists); (2) the proposed class

consists of more than 100 members; and (3) the amount in controversy is $5,000,000 or

more, aggregating all claims and exclusive of interest and costs. See 28 U.S.C.

§§ 1332(d)(2), 1332(d)(5)(B).

Here, the proposed class consists of more than 100 members, as Plaintiffs allege

that the putative class includes “thousands of people.” (Doc. 1-1 at ¶ 82). There also is

minimal diversity of citizenship between the parties. Plaintiffs are citizens of Illinois,

AWS is a Delaware corporation with its principal place of business in Washington, and

Pindrop is a Delaware corporation with its principal place of business in Georgia (Docs. 1,

8). Finally, CAFA’s amount in controversy requirement is satisfied. At a minimum,

Plaintiffs allege statutory damages of $1,000 for each negligent violation of BIPA

pursuant to 740 ILL. COMP. STAT. 14/20(1). Plaintiffs then allege at least five separate BIPA

violations in Count I-V and have asserted there are thousands of class members. Even

assuming a class size of only 1,000, the Complaint alleges damages of at least $5,000,000.

And when considering attorneys’ fees and potential statutory damages of $5,000 for each

intentional and reckless violation of BIPA, the amount in controversy well exceeds the

required threshold.

LEGAL STANDARDS

A. Federal Rule of Civil Procedure 12(b)(2)

When personal jurisdiction is challenged under Federal Rule of Civil Procedure

12(b)(2), the plaintiff bears the burden of establishing personal jurisdiction over a

defendant. Matlin v. Spin Master Corp., 921 F.3d 701, 705 (7th Cir. 2019); Purdue Research

Found. v. Sanofi-Synthelabo, S.A., 338 F.3d 773, 782 (7th Cir. 2003). If there are material facts

in dispute regarding the Court’s jurisdiction, the Court must hold an evidentiary hearing

at which the plaintiff must establish jurisdiction by a preponderance of the evidence.

Purdue Research, 338 F.3d at 782 (citing Hyatt Int’l Corp. v. Coco, 302 F.3d 707, 713 (7th Cir.

2002)). Alternatively, the Court may decide the motion to dismiss without a hearing

based on the submitted written materials so long as it resolves all factual disputes in the

plaintiff’s favor. Purdue Research, 338 F.3d at 782 (citing RAR, Inc. v. Turner Diesel, Ltd.,

107 F.3d 1272, 1276 (7th Cir. 1997)); see uBID, Inc. v. GoDaddy Grp., Inc., 623 F.3d 421, 423-

24 (7th Cir. 2010). If the Court consults only the written materials, the plaintiff need only

make a prima facie showing of personal jurisdiction. Matlin, 921 F.3d at 701; Purdue

Research, 338 F.3d at 782 (citing Hyatt, 302 F.3d at 713).

B. Federal Rule of Civil Procedure 12(b)(6)

A motion to dismiss under Federal Rule of Civil Procedure 12(b)(6) is meant to

“test the sufficiency of the complaint, not to decide the merits” of the case. Gibson v. City

of Chi., 910 F.2d 1510, 1520 (7th Cir. 1990) (citation omitted). To survive a Rule 12(b)(6)

motion to dismiss, the plaintiff only needs to allege enough facts to state a claim for relief

that is plausible on its face. Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). A plaintiff

need not plead detailed factual allegations, but must provide “more than labels and

conclusions, and a formulaic recitation of the elements.” Id. For purposes of a motion to

dismiss under Rule 12(b)(6), the Court must accept all well-pleaded facts as true and draw

all possible inferences in favor of the plaintiff. McReynolds v. Merrill Lynch & Co., Inc., 694

F.3d 873, 879 (7th Cir. 2012). Taken together, the factual allegations contained within a

complaint must “raise a right to relief above the speculative level, on the assumption that

all the allegations in the complaint are true (even if doubtful in fact).” Twombly, 550 U.S.

at 555 (internal citations omitted).

DISCUSSION

The Court first addresses Defendants’ motions to dismiss for lack of personal

jurisdiction, for if the Court lacks jurisdiction, it cannot reach the motion to dismiss under

Rule 12(b)(6). See Norberg v. Shutterfly, Inc., 152 F. Supp. 3d 1103, 1104 (N.D. Ill. 2015). Both

AWS and Pindrop contend the Class Action Complaint should be dismissed because

Plaintiffs have failed to meet their burden of making a prima facie showing of personal

jurisdiction.

“As a procedural matter, federal courts look to state law in determining the

bounds of their jurisdiction over a party.” Brook v. McCormley, 873 F.3d 549, 552 (7th Cir.

2017) (citing FED. R. CIV. P. 4(k)(1)(A)). Because the Illinois long-arm statute permits a

court to exercise jurisdiction to the full extent permitted by the Due Process Clause of the

Fourteenth Amendment, the state statutory and federal constitutional requirements

merge. Id. (citing Tamburo v. Dworkin, 601 F.3d 693, 700 (7th Cir. 2010)).

“The Due Process Clause of the Fourteenth Amendment limits the power of a court

to render a judgment over nonresident defendants.” Id. at 552 (citing World-Wide

Volkswagen Corp. v. Woodson, 444 U.S. 286, 291, 100 S.Ct. 559, 62 L.Ed.2d 490 (1980)). Thus,

personal jurisdiction is only proper if a defendant has sufficient minimum contacts with

the forum state “such that the maintenance of the suit does not offend traditional notions

of fair play and substantial justice.” Id. While the defendant’s physical presence in the

forum State is not required, there must be sufficient minimum contacts such that he or

she “should reasonably anticipate being haled into court there.” Id. (quoting Burger King

Corp. v. Rudzewicz, 471 U.S. 462, 474, 105 S.Ct. 2174, 85 L.Ed.2d 528 (1985)). Personal

jurisdiction can be established through general or specific jurisdiction.

General jurisdiction, or “all-purpose” jurisdiction, allows a court to hear any and

all claims against foreign corporations when their “affiliations with the State [in which

suit is brought] are so ‘continuous and systematic’ as to render them essentially at home

in the forum State.” Daimler AG v. Bauman, 571 U.S. 117, 127, 134 S. Ct. 746, 754, 187 L. Ed.

2d 624 (2014) (quoting Goodyear Dunlop Tires Operations, S.A. v. Brown, 131 S.Ct. 2846, 2851

(2011)). Determining whether a corporation is “at home” in a particular state “calls for an

appraisal of a corporation’s activities in their entirety, nationwide and worldwide”

because “[a] corporation that operates in many places can scarcely be deemed at home in

all of them.” Id. at 762 n. 20. Indeed, the Supreme Court has identified only two places

where a corporation is “at home”: the state of the corporation’s principal place of business

and the state of its incorporation. Daimler, 571 U.S. at 137.

“Specific” or “case-linked” jurisdiction requires an affiliation between the forum

and the underlying controversy—that is, “an activity or an occurrence that takes place in

the forum State and is therefore subject to the State’s regulation.” Goodyear, 131 S.Ct. at

2851; Brook, 873 F.3d at 552 (“Specific jurisdiction requires a defendant’s contacts with the

forum State to be directly related to the conduct pertaining to the claims asserted.”).

Specific jurisdiction arises where an out-of-state “defendant has ‘purposefully directed’

his activities at residents of the forum, Keeton v. Hustler Magazine, Inc., 465 U.S. 770, 774

(1984), and the litigation results from alleged injuries that ‘arise out of or relate to those

activities’ Helicopteros Nacionales de Colombia, S.A. v. Hall, 466 U.S. 408, 414 (1984).” Burger

King Corp. v. Rudzewicz, 471 U.S. 462, 472–73 (1985).

“The inquiry whether a forum State may assert specific jurisdiction over a

nonresident defendant focuses on the relationship among the defendant, the forum, and

the litigation.” Walden v. Fiore, 134 S. Ct. 1115, 1121 (2014) (quotation omitted). “The mere

fact that a defendant’s conduct affects a plaintiff with connections to the forum State is

not sufficient to establish jurisdiction.” Id. Rather, the out-of-state defendant must

purposefully direct its activities at residents of the forum, and the litigation must “arise

out of contacts that the ‘defendant himself’ creates with the forum state.” Curry v.

Revolution Labs., LLC, 949 F.3d 385, 396 (7th Cir. 2020) (quoting Burger King, 471 U.S. at

475). The defendant’s relationship with the plaintiff or a third party, standing alone, is

insufficient to create the necessary “minimum contacts.” Walden, 134 S. Ct. at 1123.

A. Consent to Jurisdiction

Plaintiffs first argue that AWS consented to this Court’s personal jurisdiction when

it asked the Court to compel discovery from Plaintiffs prior to asserting its personal

jurisdiction defense. Specifically, on February 5, 2020, AWS filed a motion to permit

discovery of Plaintiffs’ contact information and to compel discovery necessary to

determine whether it should file a motion to compel arbitration (Doc. 32). AWS sought

basic information, such as Plaintiffs’ email addresses and phone numbers, to determine

whether Plaintiffs had ever agreed to arbitrate as a customer of Amazon or AWS. The

motion was denied (Doc. 46). Plaintiffs argue that this motion to compel discovery

constituted a request for affirmative relief that waived any objection to personal

jurisdiction.

In response, AWS contends that its motion only sought to compel Plaintiffs to

provide basic contact information, which would be relevant for a “potential motion to

compel arbitration.” AWS notes that it has not served any discovery requests on

Plaintiffs, nor has it sought to compel any merits discovery whatsoever. Rather, it was

merely doing all it could do, as early as possible, to prevent a finding that it waived its

right to arbitrate. See Kawasaki Heavy Indus. v. Bombardier Rec. Prods., 660 F.3d 988, 996 (7th

Cir. 2011).

“[A] personal jurisdiction defense may be waived if a defendant gives a plaintiff a

reasonable expectation that he will defend the suit on the merits or where he causes the

court to go to some effort that would be wasted if personal jurisdiction is subsequently

found lacking.” Hedeen Int’l, LLC v. Zing Toys, Inc., 811 F.3d 904, 906 (7th Cir. 2016); see

also Mobile Anesthesiologists Chicago, LLC v. Anesthesia Assocs. of Houston Metroplex, P.A.,

623 F.3d 440, 443 (7th Cir. 2010) (defendant’s request for expedited discovery to prepare

for a preliminary injunction hearing did “not come close to what is required for waiver

of forfeiture” of a personal jurisdiction defense). Here, however, AWS gave no indication

that it intended to defend the suit on the merits in this district court. Instead, its motion

to compel discovery of information relevant to arbitration demonstrates the opposite: that

AWS thought this may be the improper venue to decide Plaintiffs’ claims and that it

would not be litigating the merits of the claims in this Court. AWS’s motion also did not

cause the Court to undertake any effort that would be wasted if jurisdiction subsequently

was found lacking. Accordingly, the Court finds that AWS did not waive its personal

jurisdiction defense.

B. Specific Jurisdiction

Because Plaintiffs concede that general jurisdiction is lacking, the Court focuses its

analysis on whether Defendants are subject to specific personal jurisdiction in this Court.

Pindrop argues that Plaintiffs have identified no litigation-related contacts

between Pindrop and Illinois that suffice to establish specific personal jurisdiction. First,

the fact that it is registered to do business in Illinois is irrelevant and fails to establish

personal jurisdiction. Second, the Complaint does not allege any acts Pindrop committed

in Illinois, let alone any acts committed in violation of BIPA. And finally, while Plaintiffs

themselves reside in Illinois, “[t]he mere fact that a defendant’s conduct affects a plaintiff

with connections to the forum State is not sufficient to establish jurisdiction.” Walden, 134

S. Ct. at 121.

In support of its motion to dismiss, Pindrop provided an affidavit from its Chief

Financial Officer, Jeff Hodges, who attested that Pindrop is incorporated in Delaware,

and its headquarters and principal place of business are in Atlanta, Georgia (Doc. 35-1 at

¶ 5). Pindrop does not own, lease, or operate any office, facility, or computer servers in

the State of Illinois (Id. at ¶ 7-8). It also does not operate or integrate with AWS or Amazon

Connect in the State of Illinois (Id. at ¶9). While it employs three individuals who reside

in Illinois, those individuals’ responsibilities do not involve or relate to any conduct

described in the Complaint (Id. at ¶¶ 12-13).

AWS also asserts specific personal jurisdiction is lacking because Plaintiffs have

not alleged AWS engaged in any conduct in Illinois that is connected to Plaintiffs’ claims.

At most, it argues, Plaintiffs claim that non-party John Hancock directed its conduct at

Illinois, and that AWS is a vendor used by that third party. Because specific jurisdiction

cannot be established thorough a third party’s contacts with the forum state, AWS should

be dismissed for lack of jurisdiction. AWS also points to the fact that its data centers are

located in Virginia, Ohio, California, and Oregon—not Illinois.

In response, Plaintiffs contend both Pindrop and AWS are subject to personal

jurisdiction in Illinois because they collected, possessed, and used the voiceprints of

Illinois citizens who placed calls from within Illinois and from Illinois phone numbers

(Docs. 57, 62). They argue there can be no dispute that “Illinois courts have personal

jurisdiction over nonresidents that reach into Illinois through phone or electronic means

and commit intentional torts against Illinois residents,” as Defendants did here (Id.). They

further aver that when intentional and tortious conduct takes place during telephone

communications involving a resident of the forum state and a phone number from the

forum state, courts have found the non-resident defendant expressly aimed its conduct

at the forum state with knowledge of its effect in the forum state.

In both cases cited by Plaintiffs, however, the defendant resisting jurisdiction was

the one that “reached into” the state to contact the plaintiff. See Felland v. Clifton, 682 F.3d

665, 670 (7th Cir. 2012) (defendant’s “repeated communications” to plaintiff’s Wisconsin

home “were part of a deliberate attempt to lull him into a false sense of security and to

induce him” into making installment payments); Johnson v. Levine, No. 09-CV-0994-MJR-

DGW, 2010 WL 11565552, at *3 (S.D. Ill. Sept. 17, 2010) (defendant called plaintiff’s Illinois

phone number, with the knowledge that plaintiff resided in Illinois, then made material

misrepresentations that induced plaintiff to take certain actions). In this case, Plaintiffs

were the ones who made the call—to John Hancock—from their Illinois phone numbers.

AWS then intercepted the calls once they were connected to an Amazon Connect call

center and sent the audio to Pindrop for processing. The output from that processing was

then returned to AWS’s servers (Doc. 1-1 at ¶ 59). Nothing about this process occurred in

Illinois except for the initial dialing of the phone by Plaintiffs.

Moreover, there is no indication that either of these companies purposefully

directed their activities at Illinois citizens or that this litigation arises from contacts they

created with Illinois. Rather, the litigation arises because John Hancock, a third party

based in Massachusetts, contracted with AWS and Pindrop to analyze the voices of its

customers. The fact that Plaintiffs called John Hancock from Illinois using their own

Illinois phone numbers is insufficient to confer specific personal jurisdiction over the

foreign Defendants. See Salkauskaite v. Sephora USA, Inc., No. 18-CV-08507, 2020 WL

2796122, at *4 (N.D. Ill. May 30, 2020) (the contacts must come from the activity of the

defendant, not the activity of the plaintiff or a third party).

Furthermore, according to the Complaint, AWS and Pindrop apply their voice

biometric technology to every caller to John Hancock’s call centers—not just those calls

initiated by Illinois residents (Doc. 1-1 at ¶ 73). The Court cannot say, then, that

Defendants purposefully availed themselves of the privilege of conducting business in

Illinois or directed their activities at residents of Illinois. See Gullen v. Facebook.com, Inc.,

No. 15 C 7681, 2016 WL 245910, at *2 (N.D. Ill. Jan. 21, 2016) (“Because plaintiff does not

allege that Facebook targets its alleged biometric collection activities at Illinois residents,

the fact that its site is accessible to Illinois residents does not confer specific jurisdiction

over Facebook.”).

Since filing their briefs, both Plaintiffs and Pindrop filed motions for leave to

submit supplemental authority.1 Pindrop asks the Court to consider Salkauskaite v.

Sephora USA, Inc., No. 18-cv-08507, 2020 WL 2796122 (N.D. Ill. May 30, 2020), in which

the plaintiff alleged that technology provided by non-resident defendant ModiFace, Inc.,

was used by defendant Sephora to collect plaintiff’s biometric facial-geometry

information at a Sephora store in Illinois. The Northern District of Illinois held that

personal jurisdiction was lacking when there was no evidence ModiFace purposefully

aimed its conduct at Illinois. Salkauskaite, 2020 WL 2796122, at *5. Rather, the use of the

technology in Illinois was, at most, a fortuitous or attenuated contact that was the result

of actions by Sephora, not ModiFace itself. Id.

Pindrop likens that factual situation to the events at issue here, in that its contacts

with Illinois, at most, resulted from the decision by third party John Hancock to use

1 Both motions for leave to provide supplemental authority (Docs. 60, 64) are GRANTED.

Pindrop’s technology in its call centers. Plaintiffs disagree, arguing that Salkauskaite is

distinguishable because Pindrop “knowingly and purposefully intercepted phone calls

from Illinois residents and phone numbers to collect, possess, and profit from Illinois

residents’ voiceprints” and it is “well established that Illinois has jurisdiction over non-

residents, such as Pindrop, who virtually reach into the state via telephonic or electronic

means to commit intentional torts.”

Here, however, there is no indication that Pindrop ever reached into Illinois via

telephonic or electronic means to commit an intentional tort. It was Plaintiffs who made

outgoing calls from Illinois to John Hancock call centers. The calls were then intercepted

by AWS, which sent the audio to Pindrop for analysis outside of Illinois. (See Doc. 35-1 at

¶¶ 7-8).

Plaintiffs also ask the Court to consider Mutnick v. Clearview AI, Inc., No. 20-0512,

2020 WL 4676667 (N.D. Ill. Aug. 12, 2020), as supplemental authority demonstrating this

Court has jurisdiction over Defendants. In Mutnick, the plaintiffs alleged the defendants

scraped over three billion facial images from the internet and scanned the facial images’

biometric identifiers and information. Mutnick, 2020 WL 4676667, at *1. Defendants then

built a searchable database of the scanned images, which would enable users to identify

individuals by simply using a photograph. Id. The images contained in the databases

“were uploaded and created using internet-based platforms and websites from

companies in Illinois or companies who operate servers in Illinois.” Id. Defendants sold

access to the facial recognition database to numerous Illinois law enforcement and

government agencies, as well as federal law enforcement agencies located in Illinois. Id.

Through those hundreds of agreements, defendants sold, disclosed, obtained, and

profited from the biometric identifiers of Illinois citizens. Id. at *2. Despite this evidence,

Defendants argued that personal jurisdiction was lacking because they never targeted

businesses in Illinois and never traveled to Illinois. Id. The court rejected this argument,

noting that physical presence is not necessary for a defendant to have sufficient minimum

contacts with a forum state. Id.

Defendants do not oppose the Court’s consideration of Mutnick, but argue the case

further supports their arguments that jurisdiction is lacking here (Doc. 65). First, they

argue, the defendants in Mutnick directly aimed their conduct at Illinois plaintiffs when

they took facial images from internet-based platforms and websites from companies in

Illinois or companies who operate servers in Illinois (Id.). They did not use a third party’s

contacts with Illinois to establish personal jurisdiction. Second, the defendants in Mutnick

sold access to their database to Illinois law enforcement and government agencies in

Illinois, thus directly profiting from use of the database in Illinois in violation of BIPA. In

this case, however, Plaintiffs allege Defendants profited from their voiceprints in

violation of Section 15(c) of BIPA through their commercial relationship with John

Hancock, a Massachusetts-based company.

The Court agrees with Defendants. Unlike the defendants in Mutnick, there is no

indication that either AWS or Pindrop specifically targeted Illinois citizens when they

provided their voiceprinting services to John Hancock. Rather, Plaintiffs’ voiceprints

were collected because John Hancock chose to use Amazon Connect with Pindrop to

analyze the voices of its customers. Because the litigation does not arise from contacts

that Defendants themselves created with Illinois or actions purposefully directed at

residents of Illinois, the Court finds that Plaintiffs have failed to make a prima facie

showing of specific personal jurisdiction with regard to both Pindrop and AWS.

Accordingly, the case must be dismissed for lack of personal jurisdiction.

CONCLUSION

For these reasons, the motions to dismiss under Federal Rule of Civil Procedure

12(b)(2) for lack of personal jurisdiction filed by Defendants Pindrop Security, Inc.

(Doc. 35) and Amazon Web Services, Inc. (Doc. 49) are GRANTED. Plaintiffs’ individual

claims against Defendants are DISMISSED without prejudice.

IT IS SO ORDERED.

DATED: September 18, 2020

NANCY J. ROSENSTENGEL |

Chief U.S. District Judge

Page 17 of 17