Hartman v. Meta Platforms, Inc.

IN THE UNITED STATES DISTRICT COURT

FOR THE SOUTHERN DISTRICT OF ILLINOIS

REBECCA HARTMAN, JOSEPH

TURNER, R.H., a Minor, by and through

her Guardian and Next of Friend

REBECCA HARTMAN, and E.T., a

Minor, by and through his Guardian

and Next of Friend JOSEPH TURNER,

on behalf of themselves and all other

persons similarly situated known and

unknown,

Plaintiffs,

v. Case No. 3:23-CV-02995-NJR

META PLATFORMS, INC.,

Defendant.

MEMORANDUM AND ORDER

ROSENSTENGEL, Chief Judge:

In this putative class action lawsuit, Plaintiffs allege that Defendant Meta

Platforms, Inc. (“Meta” or “Defendant”) violated the Illinois Biometric Information

Privacy Act, 740 ILCS 14/1, et seq. (“BIPA”), by improperly collecting and possessing

biometric identifiers and information through its Facebook Messenger and Messenger

Kids applications (collectively “Messenger Applications”). (Doc. 23-2). Plaintiffs’ theory

is that Meta collects peoples’ “face geometries” when they use the Messenger

Applications’ filters and effects (e.g., bunny ears and flower crowns), and that this practice

fails to comply with BIPA’s requirements. Id. Plaintiffs bring this action on behalf of

themselves and other Illinois citizens whose face geometries were allegedly collected

between June 28, 2018, and the date of judgment in this case.1

BACKGROUND

Meta released Facebook Messenger in August 2011 and Messenger Kids in

December 2017. Compl. at ¶ 2 (Doc. 23-2). The Messenger Applications are widely

available in popular app stores such as the Google Play App Store and the Apple App

Store. Id. The named Plaintiffs are long-time users of the Messenger Applications:

Rebecca Hartman and Joseph Turner have used Facebook Messenger for “ten-plus

years,” whereas their minor children, including R.H. and E.T., have used Messenger Kids

for “several years.” Id. at ¶¶ 121, 122.

Until May 2022, the Messenger Applications included facial recognition

technology known as “augmented reality” or “AR.” Id. at ¶¶ 64, 65. AR, as shown below,

enabled users to superimpose filters, masks, emojis, and other effects while

communicating with their contacts. Id. at ¶¶ 66, 76.

1 Meta removed this case to federal court from the Circuit Court for the Twentieth Judicial Circuit, St. Clair

County, Illinois. (Doc. 1 at 1). Thus, the allegations in Plaintiff’s complaint and Meta’s notice of removal

serve as the basis for this Court’s subject matter jurisdiction (Docs. 1 & 23-2). See Dancel v. Groupon, Inc., 940

F.3d 381, 383-85 (7th Cir. 2019). Here, subject matter jurisdiction is secure under the Class Action Fairness

Act (“CAFA”). See 28 U.S.C. § 1332(d). CAFA jurisdiction requires (i) the aggregate number of members in

the proposed class to be 100 or more; (ii) the parties to be minimally diverse; and (iii) the matter in

controversy to exceed $5,000,000, exclusive of interest and costs. Id. Plaintiffs’ complaint alleges that the

number of putative class members is in the “thousands” or even “millions.” (Doc. 1 at 4). This satisfies the

aggregate number requirement. Minimal diversity means that “any member of a class of plaintiffs is a

citizen of a State different from any defendant.” 28 U.S.C. § 1332(d)(2)(A). Here, the named Plaintiffs are

citizens of Illinois, whereas Meta is a citizen of California and Delaware. (Docs. 1 at 2 & 1-3 at 2). This

satisfies minimal diversity. Finally, BIPA provides for statutory damages of up to $5,000 per violation. See

740 ILCS 14/20(a)(2). With a putative class of “thousands or millions” of members, the $5,000,000 threshold

is easily reached. This satisfies the amount in controversy requirement.

[ay:)

ra

ms Fs ae |

p= €5, :

Woe

oa ke i

ig ty Poe

Re ay 3 a be]

aa □

FAA

7 Tomy 4

=

This technology allegedly used “scans of face geometry to identify individuals’

location[s], expressions, and movements” in real time so that filters and effects could be

applied. Id. at | 73, 74. The resulting facial geometry scans “model[ed] users [sic] faces

and track[ed] [their] expressions” based on an “estimation of the location of parts of

users’ faces.” Id. at 9] 72, 73. Meta then “collect[ed] the Biometric Data of each child and

adult user who utilize[d] an effect or filter,” and stored it locally on a user’s operating

device and on its own servers. Id. at {| 74, 78, & 82.

Meta retains control over the data it collects, regardless of where it is stored. Id. at

{| 92, 93. It controls data stored on its servers because it “owns, operates, and controls”

them. Id. at {| 92. This, in turn, gives Meta “exclusive control over the process by which

Biometric Data is harvested and stored on its servers.” Id. In addition, Meta “ possesses

data stored locally on [Plaintiffs’] devices because it has complete and exclusive control”

over it through its operation of the Messenger Applications. Id. at {| 93.

Page 3 of 41

All of this happened without users’ knowledge and consent. Id. at ¶ 2. Indeed,

Meta allegedly did not inform Illinois users that their biometric data was being collected

when they used the AR filters on the Messenger Applications. Id. at ¶ 126. Meta also

provided no way for users to opt out of its data collection while using the AR filters in

the Messenger Applications. Id. at ¶ at 89. And considering its collection and possession

of biometric data, Plaintiffs allege that Meta failed to publish and follow a compliant data

retention and destruction policy under BIPA. Id. at ¶¶ 94, 95, 145, & 146; see also 740 ILCS

14/15(a).

LEGAL STANDARD

A motion to dismiss under Federal Rule of Civil Procedure 12(b)(6) “tests whether

the complaint states a claim on which relief may be granted.” Richards v. Mitcheff, 696 F.3d

635, 637 (7th Cir. 2012). This “generous standard” requires courts to accept the plaintiff’s

factual allegations as true and draw all inferences in his or her favor. Domanus v. Locke

Lord LLP, 847 F.3d 469, 479 (7th Cir. 2017); Reynolds v. CB Sports Bar, Inc., 623 F.3d 1143,

1146 (7th Cir. 2010) (quotation marks and citation omitted). To survive a Rule 12(b)(6)

motion, the plaintiff only needs to allege enough facts to state a claim for relief that is

plausible on its face. Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 570 (2007). A plaintiff

need not plead detailed factual allegations, but must provide “more than labels and

conclusions, and a formulaic recitation of the elements.” Id. at 555. Taken together, the

factual allegations contained within a complaint must “raise a right to relief above the

speculative level, . . . on the assumption that all the allegations in the complaint are true

(even if doubtful in fact).” Id. (internal citations omitted).

DISCUSSION

A. The BIPA Framework

BIPA regulates the collection, retention, use, and destruction of people’s

“biometric identifiers” and “biometric information” in Illinois. A “biometric identifier” is

“a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.”2 740 ILCS

14/10. “Biometric information” is defined as “any information, regardless of how it is

captured, converted, stored, or shared, based on an individual’s biometric identifier used

to identify an individual.” Id.

Private entities that collect and retain biometric identifiers and information must

take certain steps to ensure that such information is securely and transparently handled.

See 740 ILCS 14/15(a)-(b). Under section 15(a), “[a] private entity in possession of

biometric identifiers or biometric information must develop a written policy, made

available to the public, establishing a retention schedule and guidelines for permanently

destroying biometric identifiers and biometric information” within a certain amount of

time. 740 ILCS 14/15(a). And, perhaps unsurprisingly, the entity must then comply with

2 The statute excludes certain items from its definition of “biometric identifiers,” including writing samples,

photographs, descriptions of tattoos, descriptions of one’s physical characteristics, and information and

images generated for healthcare purposes. 740 ILCS 14/10. The excluded data types do not appear relevant

here. See In re Facebook Biometric Info. Priv. Litig., 185 F. Supp. 3d 1155, 1171 (N.D. Cal. 2016) (statutory

definition of “biometric identifier” “indicate[s] that the Illinois legislature enacted BIPA to address

emerging biometric technology, such as Facebook’s face recognition software . . ., without including

physical identifiers that are more qualitative and non-digital in nature.”).

its biometric data retention and destruction policy.3 Id.; Patterson v. Respondus, Inc., 593 F.

Supp. 3d 783, 802 (N.D. Ill. 2022).

Section 15(b) prohibits a private entity from “collect[ing], captur[ing],

purchas[ing], receiv[ing] through trade, or otherwise obtain[ing] a person’s or a

customer’s biometric identifier or biometric information,” unless it first provides certain

disclosures and obtains the subject’s informed written consent. 740 ILCS 14/15(b). Private

entities are also prohibited from selling, leasing, trading, or otherwise profiting from a

person’s biometric identifier or information. 740 ILCS 14/15(c). They also may not

disclose, redisclose, or otherwise disseminate a person’s biometric identifier or

information, unless they receive the person’s consent, the disclosure completes a financial

transaction that the person authorized, or the disclosure is required by law. 740 ILCS

14/15(d)(1)-(4).

A person aggrieved by an entity’s violation of these requirements may bring an

action against the entity under BIPA. 740 ILCS 14/20(a). In such actions, a prevailing

plaintiff may recover his or her actual or liquidated damages (whichever is greater), and

3 The duty to publish a data retention and destruction policy “is owed to the public generally, not to

particular persons.” Bryant v. Compass Gr. USA, Inc., 958 F.3d 617, 626 (7th Cir. 2020). Individual plaintiffs

thus do not have standing to bring claims in federal court based solely on an entity’s failure to publish a

compliant policy. Id.; Patterson, 593 F. Supp. 3d at 802. An entity’s failure to comply with its data retention

and destruction policy, on the other hand, inflicts a particularized injury and allows individual plaintiffs

to sue under section 15(a). See Fox v. Dakkota Integrated Sys., LLC, 980 F.3d 1146, 1154 (7th Cir. 2020)

(plaintiff’s allegation that defendant failed to “develop, publicly disclose, and comply with a data-retention

schedule and guidelines for the permanent destruction of biometric data” sufficient to confer standing)

(emphasis in original). Plaintiffs’ claim under section 15(a) falls into the latter category. See Compl. at

¶¶ 145, 146 (Doc. 23-2) (alleging failure to “follow[]” retention schedule and destruction guidelines). Thus,

it does not appear to pose any standing issues, nor has Meta raised any.

reasonable attorney’s fees and costs. Id. §§ (a)(1)-(3); see also Sosa v. Onfido, Inc., 600 F.

Supp. 3d 859, 873-74 (N.D. Ill. 2022).

B. Incorporation by Reference

Before reaching the merits of Defendant’s arguments, the Court must address a

threshold question: which documents are properly considered at this nascent stage of the

litigation? This question is before the Court because Meta attached 11 documents to its

motion to dismiss which, it contends, “are cognizable,” even though several of them are

not mentioned in Plaintiffs’ complaint. See Decl. of Lauren R. Goldman (Doc. 23-1) (listing

exhibits to Meta’s motion to dismiss and urging Court to consider them). This inquiry

requires the Court to evaluate the following documents (attached to Meta’s motion to

dismiss as Exhibits A through K) to determine whether they may be considered at the

pleading stage:

e Exhibit A: A copy of Plaintiffs’ complaint filed on July 6, 2023. (Doc. 23-2).

e Exhibit B: Messenger Kids’ Face and Hand Effects Privacy Notice, published

in 2023. (Doc. 23-3).

e Exhibit C: Facebook Messenger’s Face and Hand Effects Privacy Notice,

published in 2023. (Doc. 23-4).

e Exhibit D: Meta’s Terms of Service, last revised July 26, 2022. (Doc. 23-5).

e Exhibit E: Messenger Kids’ Terms of Service, last revised February 4, 2020.

(Doc. 23-6).

e Exhibit F: Messenger Kids’ Privacy Policy, last revised December 15, 2022.

(Doc. 23-7).

e Exhibit G: Facebook’s Sign-up Webpage, published in 2023. (Doc. 23-8).

Page 7 of 41

e Exhibit H: Messenger Kids’ Sign-up Webpage, publication date unknown.

(Doc. 23-9).

e Exhibit I: An article titled “Introducing Messenger Kids, a New App for

Families to Connect,” by Loren Chang, Meta’s Product Management Director,

published December 4, 2017. (Doc. 23-10).

e Exhibit J: An article titled “Children’s Online Privacy Protection Rule: A Six-

Step Compliance Plan for Your Business,” published by the Federal Trade

Commission, publication date unknown. (Doc. 23-11).

e Exhibit K: An article titled “Messenger Kids,” published in the Facebook

Messenger Help Center in 2023. (Doc. 23-12).

Asa general matter, courts may consider only the plaintiff's complaint on a motion

to dismiss under Rule 12(b)(6). Rosenblum v. Tavelbyus.com Ltd., 299 F.3d 657, 661 (7th

Cir. 2002). Indeed, if on a motion to dismiss, “matters outside the pleadings are presented

to and not excluded by the court, the motion must be treated as one for summary

judgment under Rule 56.” FEDR. Civ. P. 12(d). And when that happens, “ [a]ll parties must

be given a reasonable opportunity to present all the material that is pertinent to the

motion.” Id. But there are exceptions to this rule. First, “written instrument[s]” attached

to a complaint as exhibits are considered part of the complaint “for all purposes.” FED. R.

Civ. P. 10(c); see also Thompson v. Ill. Dep't of Prof. Reg., 300 F.3d 750, 753 (7th Cir. 2002)

(“The consideration of a [Rule] 12(b)(6) motion is restricted solely to the pleadings, which

consist generally of the complaint, any exhibits attached thereto, and supporting briefs.”).

Second, the “incorporation-by-reference” doctrine allows courts to consider “documents

attached to a motion to dismiss if they are referred to in the plaintiff's complaint and are

central to his claim.” Brownmark Films, LLC v. Comedy Partners, 682 F.3d 687, 690 (7th

Cir. 2012) (cleaned up). And third, courts may consider “information that is properly

Page 8 of 41

subject to judicial notice.” Williamson v. Curran, 714 F.3d 432, 436 (7th Cir. 2013); see also

Patterson, 593 F. Supp. 3d at 803-07 (discussing reviewability of extraneous documents on

motion to dismiss BIPA claims).

Plaintiffs’ complaint does not attach any documents as exhibits. Thus, Meta

invokes the second and third exceptions to the general rule to argue that its exhibits

warrant consideration. Ultimately, the decision to consider extraneous documents and, if

necessary, convert a motion to dismiss into one for summary judgment is within the

Court’s discretion. Hecker v. Deere & Co., 556 F.3d 575, 583 (7th Cir. 2009), abrogation on

other grounds recognized by Hughes v. Northwestern Univ., 63 F.4th 615, 624 (7th Cir. 2023).

1. Exhibit A

Exhibit A is the easiest one. It is a copy of Plaintiffs’ complaint and thus the critical

document to the resolution of Meta’s motion to dismiss. No further discussion is required

on this point. The Court will, and indeed must, consider Plaintiffs’ complaint to resolve

Meta’s motion.

2. Exhibits D, E, G, and H

Exhibits D, E, G, and H are not mentioned in Plaintiffs’ complaint. They are Meta’s

Terms of Service (Exhibit D), Messenger Kids’ Terms of Service (Exhibit E), a copy of the

Facebook Sign-up page showing how users create Facebook accounts for themselves

(Exhibit G), and a copy of the Messenger Kids Sign-up page showing how parents create

Messenger Kids accounts for their children (Exhibit H).

Meta relies on these documents to lay the groundwork for its argument that

California law applies to this dispute, and that Plaintiffs’ BIPA claims are consequently

not viable as a matter of law. Because the Facebook and Messenger Kids’ sign-up pages

require a user to agree to Meta’s and Messenger Kids’ terms of service, and the terms of

service select California law to govern disputes between Meta and its users, so the

argument goes, these documents establish California as the governing law for this case.

And Meta contends that these documents are fair game because they are part of its

website and Plaintiffs have cited other parts of the website in the complaint, thus opening

the door for the full website to be considered.

But, as noted, these documents are neither mentioned in Plaintiffs’ complaint, nor

do they appear “central” to their claims as required by the incorporation-by-reference

doctrine. Exhibits D and E lay out the terms and conditions of a user’s relationship with

Meta, but neither mentions anything about biometric data. Exhibits G and H (the sign-up

pages) provide a link to the terms and conditions (Exhibits D and E) to which a user must

consent, and they ask the user for identifying information like their name, birthday, and

gender. (Docs. 23-8 & 23-9). But the sign-up pages also do not mention anything about

biometric data. Thus, nothing in these documents suggests their centrality to Plaintiffs’

claims that Meta improperly collected biometric data in violation of BIPA. See Patterson,

593 F. Supp. 3d at 805 (“To be incorporated by reference, the documents themselves—not

just their general category or theme—must be central to the complaint and referred to in

it.”); Hogan v. Amazon.com, Inc., No. 21 C 3169, 2022 WL 952763, at *3 (N.D. Ill. Mar.

30, 2022) (declining to consider defendant’s privacy notice and file retention policy

because even though they were “linked” in documents that were considered on motion

to dismiss, they were not “central” to plaintiffs’ BIPA claims).

Patterson and Hogan are particularly instructive and thus worthy of further

discussion. Patterson involved a BIPA action against Respondus, Inc., a provider of a

software program that allowed schools to administer online exams using a student’s

webcam and microphone to record their testing environment. Patterson, 593 F. Supp. 3d

at 795. The plaintiffs alleged that the program captured their biometric information

without their written consent in violation of BIPA. Id. at 795-96. The plaintiffs attached

two documents to their complaint: Respondus’ terms of use and a copy of its webpage

containing its privacy policy. Id. at 804. Respondus, in turn, filed a motion to dismiss and

attached a document titled “Privacy Center Overview” and a webpage titled “Additional

Privacy Information.” Id. Respondus argued that the two documents it introduced were

incorporated into the plaintiffs’ complaint by reference because the privacy policy (which

the plaintiffs did attach) “links to” the Privacy Center Overview, which, in turn, “links

to” the Additional Privacy Information page. Id. The court rejected this invitation to

expand the record, offering the following commentary:

Respondus seems to believe that because Plaintiffs’ BIPA claims relate

broadly to Respondus’ written policies, and Plaintiffs attached only some

of the relevant policies to their complaints, Respondus has license to

supplement the pleadings at its discretion. That is incorrect. To be

incorporated by reference, the documents themselves—not just their

general category or theme—must be central to the complaint and referred

to in it.

Id. at 804-05 (record citations and quotation marks omitted).

In Hogan, the plaintiffs sued Amazon.com, Inc. under BIPA, arguing that its

Amazon Photos service included “image recognition technology” that improperly

collected users’ biometric identifiers. Hogan, 2022 WL 952763, at *1. Amazon filed a

motion to dismiss with seven attachments, which, it claimed, qualified for review under

the incorporation-by-reference doctrine. Id. at *2. Although the court considered two of

these documents because they were “quoted in the Complaint and are central to

Plaintiffs’ claims,” it declined to consider the other five. Id. at *3. Among the documents

Hogan excluded from its review were Amazon’s privacy notice and its file retention

policy, even though those documents were “linked” in a document that the court did

consider. Id. Neither of these documents, Hogan explained, “specifically mentions how

Amazon treats biometric information or identifiers, so they are not central to Plaintiffs’

claims.” Id. Patterson and Hogan thus took a cautious approach to the defendants’

invitations to expand the record on a motion to dismiss.

Meta, for its part, relies on several other cases for the proposition that once a

plaintiff cites a website, the Court may consider the full content of that website on a

motion to dismiss. For instance, it relies on a footnote from Gardener v. MeTV, 681 F. Supp.

3d 864, 867 n.2 (N.D. Ill. 2023), for the proposition that “Plaintiffs referenced [defendant’s]

website, including specifically their viewing of its video content, in their complaint, such

that its contents can be incorporated by reference.” Although the footnote cites

Brownmark’s discussion of the incorporation-by-reference doctrine, it does not address

how the website’s contents satisfy the doctrine’s centrality requirement. Similarly, in

James v. City of Evanston, No. 20-cv-00551, 2021 WL 4459508, at *7 n.3 (N.D. Ill. Sept. 29,

2021), the court observed in a footnote that “[b]ecause James referenced Evanston’s

website in his complaint concerning [sic] its contents could be incorporated by reference.”

James also does not explain how the website in question was central to the plaintiff’s claim

and thus appropriate for consideration. Patterson and Hogan, on the other hand,

addressed an almost identical issue to the one presented here, and they did so in the

context of a BIPA action. They thoroughly explained why certain terms and conditions

and privacy notices, documents that are thematically similar to Exhibits D, E, G, and H,

did not qualify for consideration on a motion to dismiss. Patterson, 593 F. Supp. 3d at 806;

Hogan, 2022 WL 952763, at *3. These cases are thus more aligned with the facts and

posture of this case than Gardner and James, neither of which addressed a BIPA claim.4

The Court recognizes that “the broader contents of [Meta’s] website . . . may be relevant

at a later stage of this litigation.” Patterson, 593 F. Supp. 3d at 805. But for now, “allowing

[Meta] to cherry pick portions of [its] website to introduce via a motion to dismiss simply

because the complaint implicates [the website] would convert an examination of the

complaint into full-blown summary judgment analysis.” Facebook, Inc. v. Teachbook.com

LLC, 819 F. Supp. 2d 764, 773 (N.D. Ill. 2011).

Meta also argues that Exhibits D, E, G, and H may be judicially noticed. Although

webpages may be judicially noticed as a general matter, the Seventh Circuit has urged

courts to do so cautiously. Daniel v. Cook Cnty., 833 F.3d 728, 742 (7th Cir. 2016); Pickett v.

Sheridan Health Care Ctr., 664 F.3d 632, 648 (7th Cir. 2011). Indeed, before the Court could

even do what Meta asks, Plaintiffs would have to have an opportunity to be heard

4 Meta also cites Sonrai Sys., LLC v. AMCS Grp. Inc., No. 16 C 9404, 2017 WL 4281122, at *8 n.3 (N.D. Ill. Sept.

27, 2017), to argue that Exhibits D, E, G, and H should be considered under the incorporation-by-reference

doctrine. But like Gardner and James, Sonrai is not a BIPA case, and its discussion of the doctrine is limited

to a single footnote.

because “the [i]nternet contains an unlimited supply of information with varying degrees

of reliability, permanence, and accessibility.” Id. Here, it is entirely unclear whether

Exhibits D, E, G, and H even accurately present the terms and conditions of Plaintiffs’

relationship with Meta over time. Exhibits D and E (Meta and Messenger Kids’ respective

terms of service) are dated July 26, 2022, and February 4, 2020, respectively. Plaintiffs, for

their part, have used Facebook Messenger for “ten-plus years” and Messenger Kids for

“several years” prior to filing this lawsuit in July 2023. These recent versions of Facebook

and Messenger Kinds’ terms and conditions may have been modified over the years, thus

triggering questions of whether a valid agreement was ever reached on these terms.

See Patterson, 593 F. Supp. 3d at 805 (declining to consider recent versions of defendant’s

terms and conditions submitted with motion to dismiss because “corporate websites can

change over time, often in ways not made clear from the face of the pages themselves.”).

Consistent with this sentiment from Patterson, the Court finds that it would be

inappropriate to take judicial notice of Exhibits D, E, G, and H at this time. See Karon v.

CNU Online Holdings, LLC, No. 18 C 7360, 2019 WL 3202822, at *2 (N.D. Ill. July 16, 2019)

(“The printed portions of [defendant’s] website . . . are outside the complaint altogether

and inappropriate for judicial notice.”); Mussat v. Power Liens, LLC, No. 13–cv–7853, 2014

WL 3610991, at *3 (N.D. Ill. July 21, 2014) (finding that “[defendant’s] website, without

more, is not sufficiently reliable for this Court to take judicial notice of its contents as

evidence of a prior business relationship with [plaintiff].”); Felty v. Driver Solutions, LLC,

No. 13 C 2818, 2013 WL 5835712, at *3 (N.D. Ill. Oct. 30, 2013) (similar). The Court thus

declines to consider Exhibits D, E, G, and H in resolving Meta’s motion to dismiss.

3. Exhibits I, J, and K

Exhibits I, J, and K are cited in the complaint, and thus, according to Meta, suitable

for consideration under the incorporation-by-reference doctrine. Exhibit I is a copy of an

article titled “Introducing Messenger Kids, a New App for Families to Connect,” by Loren

Cheng, Meta’s Product Management Director. (Doc. 23-10). Exhibit J is a copy of an article

titled “Children’s Online Privacy Protection Rule: A Six-Step Compliance Plan for Your

Business,” published by the Federal Trade Commission. (Doc. 23-11). And Exhibit K is a

copy of an article titled “Messenger Kids,” published in the Facebook Messenger Help

Center in 2023. (Doc. 23-12).

These articles did little more than set the stage for Plaintiffs’ opening narrative.

Exhibit I, as its title suggests, introduces Messenger Kids to the public and explains how

parents can set up an account for their children. It is cited in three paragraphs of Plaintiffs’

150-paragraph complaint. These three citations provide the date when Messenger Kids

was launched (Doc. 23-2 at ¶ 67), explain the four-step process to set up a Messenger Kids

account, Id. at ¶ 70, and note that Meta advertised its AR filters for Messenger Kids users,

Id. at ¶ 77. Exhibit J offers regulatory compliance advice to businesses that collect personal

information from children under the age of 13 and are thus subject to the Children’s

Online Privacy Protection Act (“COPPA”). Plaintiffs cited Exhibit J once in their

complaint to support their assertion that federal regulators “recognize[]” “[t]he

heightened sensitivity of minors’ personal data.” Id. at ¶ 61. And Exhibit K offers a how-

to guide for parents and their children as to the operation of Messenger Kids, e.g., how to

set up an account, add and remove “friends,” and report improper behavior. Exhibit K is

not even directly cited in Plaintiffs’ complaint; it merely appears within the Facebook

Messenger Help Center, which is mentioned in the complaint once. Id. at ¶ 102. This one

reference alleges that the Help Center acts as a document repository that does not make

critical privacy notices and disclosures easily accessible to the public. Id.

Conspicuously absent from all three of these exhibits is any mention of biometric

data. As a result, the Court has little problem concluding that they are not “central” to

Plaintiffs’ claims. See Hogan, 2022 WL 952763, at *3 (documents attached to motion to

dismiss did not “specifically mention[] how [defendant] treats biometric information or

identifiers, so they [were] not central to Plaintiffs’ claims.”). At best, these documents

provide background information about Messenger Kids as a product offering (Exhibits I

and K) and the regulatory environment regarding children’s online activity (Exhibit J).

Certainly, these documents may be relevant to the case; but relevance does not equate to

centrality under the incorporation-by-reference doctrine. Patterson, 593 F. Supp. 3d at 805.

Accordingly, the Court will exclude Exhibits I, J, and K from its consideration of Meta’s

motion to dismiss.

4. Exhibits B, C, and F

Exhibits B, C, and F present a more difficult question. All three of these documents

are cited in Plaintiffs’ complaint and they appear relevant to a critical issue in the case:

whether, and if so, how Meta collected Plaintiffs’ biometric identifiers and information.

Exhibits B and C are nearly identical privacy notices concerning the Messenger

Applications’ face and hand effects.5 They explain that “[f]ace and hand effects are

augmented reality features that react as people in the scene move, speak and express

themselves.” (Doc. 23-3 at 2). The technology “estimate[s] the location of parts of your

child’s face (like their eyes, nose or mouth) and points on their face, eyes or hands.” Id.

Critically, these documents state that “[t]his information is not used to identify you [or

your child],” and that Meta “do[esn’t] store this information on [its] servers or share it

with third parties.” (Docs. 23-3 at 2 & 23-4 at 2). Exhibits B and C do state, however, that

“[t]he information may be stored on your [or your child’s] device to make repeat

experiences work better.” (Docs. 23-3 at 2 & 23-4 at 2).

These disclosures present important evidence in this case because they explain

(i) the type of information that is captured; and (ii) how and where it is stored. Thus,

Exhibits B and C address the heart of a BIPA action under section 15(b), which prohibits

a private entity from “collect[ing], captur[ing], . . . or otherwise obtain[ing] a person’s or

a customer’s biometric identifier or biometric information,” unless it first obtains their

informed written consent. 740 ILCS 14/15(b). They also appear highly relevant to a claim

under section 15(a), which imposes certain requirements on private entities that are “in

possession” of biometric identifiers and information. 740 ILCS 14/15(a). Considering the

5 The Facebook Messenger Face and Hand Effects Privacy Notice (Exhibit C) contains nearly identical

language to that in Messenger Kids’ privacy notice (Exhibit B)—instead of referring to the user as “your

child,” it refers to the user as “you.” (Doc. 23-3); see also (Doc. 23 at 12 n.2) (Meta’s Motion to Dismiss

explaining difference in wording between privacy notices).

synergy between the information provided in Exhibits B and C and the legal

requirements of the asserted BIPA claims, the Court finds that they are “central” to

Plaintiffs’ claims and thus eligible for consideration under the incorporation-by-reference

doctrine.

But eligibility under the incorporation-by-reference doctrine does not mandate the

Court’s consideration of extraneous documents at the motion to dismiss stage. See Fin.

Fiduciaries, LLC v. Gannett Co., 46 F.4th 654, 663 (7th Cir. 2022) (on a motion to dismiss,

district court “may” consider documents that satisfy incorporation-by-reference

doctrine). And here, consideration of Exhibits B and C would be inappropriate.

The privacy notices at issue were allegedly first “created and published” in 2022.

See Compl. at ¶ 96, (Doc. 23-2). The publication date of Exhibits B and C as attached to

Meta’s motion even suggests their publication in the year 2023.6 The recency of these

documents presents two problems for Meta. First, Plaintiffs alleged that that Messenger

Applications only utilized AR facial recognition technology until May 2022, the same year

or even the year before Exhibits B and C were published. Id. at ¶ 64. Thus, Exhibits B and

C offer little if any value to Plaintiffs’ central allegation that Meta misused its AR

technology to violate BIPA until May 2022. Second, Exhibits B and C do not allow for an

informed review of the terms of Plaintiffs’ relationships with Meta over the “ten-plus

years” or “several years” that they used the Messenger Applications. Instead, they offer

6 Both documents contain the following copyright notice: “© 2023 Meta.” (Docs. 23-3 & 23-4). This notice

indicates 2023 as the year of first publication and identifies Meta as the owner of the copyrighted work.

See 17 U.S.C. § 401(b) (outlining form and elements of copyright notice).

a recent snapshot of Meta’s privacy notices and do not account for modifications that may

(or may not) have been added over time. This targeted view of the evidence as it existed

in 2023 would allow Meta to “amend its opponent’s pleading using documents that

[Meta] itself could have modified,” while Plaintiffs used the Messenger Applications.

Patterson, 593 F. Supp. 3d at 805. For instance, it is entirely possible that prior versions of

the privacy notices contained different language about Meta’s collection of biometric

data, or that they contained no such language at all. To consider Exhibits B and C at this

stage of the case would effectively freeze the evidence in place as it existed in 2023. And

for reasons that should be apparent, the Court will not engage in such targeted fact-

finding on a motion to dismiss. The court in Patterson encountered a similar issue and

offered the following commentary:

Because Plaintiffs’ BIPA claims cover several years, this case may involve

factual questions about what [defendant’s] policies looked like at different

moments in time. There is no basis for preempting that fact-intensive

inquiry by concluding, as a matter of law, that these specific versions of

[defendant’s] webpages govern Plaintiffs’ claims.

Id. So too here—to avoid preempting highly factual inquiries into topics like (i) the scope

of the Messenger Applications’ collection of biometric data (if they collected such data at

all); (ii) whether, and if so, how, Meta informed Plaintiffs of its collection of biometric

data; (iii) where and how such data was stored; and (iv) how these practices may have

changed over time, the Court declines to consider Exhibits B and C in resolving Meta’s

motion to dismiss.

This brings us to the last document Meta asks the Court to consider: Exhibit F.

Exhibit F is Messenger Kids’ Privacy Notice, which explains the “kinds of information”

Meta collects from users, what it does with this information, how parents can control and

delete information about their child, and when and how a user’s information is shared

with law enforcement. (Doc. 23-7). This document presents the same problems as Exhibits

B and C: it was last revised on December 15, 2022, less than seven months before Plaintiffs

filed this lawsuit, and seven months after Meta allegedly stopped offering its AR

technology on the Messenger Applications. Thus, it does not capture the full spectrum of

terms, conditions, and disclosures that Plaintiffs agreed to while using Messenger Kids.

And because the terms that Plaintiffs agreed to and the scope of disclosures regarding

biometric data over time are critical to Plaintiffs’ BIPA action, the Court declines to

consider Exhibit F at this stage as well. Patterson, 593 F. Supp. 3d at 805.

Thus, in conclusion, the Court will consider Exhibit A of Meta’s motion to dismiss

Plaintiffs’ complaint (Doc. 23-2). It will not consider Exhibits B through K (Docs. 23-3

through 23-12).

C. Choice of Law

Having resolved one preliminary issue, the Court turns its attention to another:

which state’s substantive law governs this dispute? Meta contends that California law

applies, and that Plaintiffs are consequently barred from bringing claims under BIPA, an

Illinois statute. The problem with this argument is that it relies on choice-of-law

provisions in Facebook Messenger and Messenger Kids’ Terms of Service (Exhibits D

and E), which the Court has excluded from its review at this stage of the case. Thus, there

is no basis in the record to support the application of California law. So, the Court will

consider the viability of Plaintiffs’ BIPA claims under Illinois law as that is the legal

framework the complaint invokes. See Patterson, 593 F. Supp. 3d at 807 (rejecting

defendant’s choice of law argument on motion to dismiss because it was based on

documents the court declined to consider).

To be clear, the Court’s decision to apply Illinois law for the limited purpose of

testing the legal sufficiency of Plaintiffs’ claims does not resolve the question of which

state’s law ultimately governs this case. Plaintiffs assert that Meta’s choice-of-law theory

is beset by “factual disputes,” and the Court acknowledges this possibility. (Doc. 29 at 7).

Indeed, the Court has already explained how the recency of the documents Meta

submitted may not capture the evolution of the terms and conditions that governed

Plaintiffs’ relationship with Meta over time. Discovery may also reveal facts concerning

the enforceability of the choice-of-law provisions that Meta seeks to apply. For now, it is

enough to recognize that a choice-of-law determination is not possible based solely on

Plaintiffs’ complaint because the complaint says nothing about it. See Foisie v. Worcester

Polytech. Inst., 967 F.3d 27, 42 (1st Cir. 2020) (district courts should refrain from deciding

choice-of-law issues when the record is “tenebrous, and the complaint itself leaves

unanswered questions about critical aspects of the pertinent facts.”).

For these reasons, the Court will defer consideration of the choice-of-law issue

pending at least some discovery and further briefing under Rule 56 of the Federal Rules

of Civil Procedure.7

7 Meta’s choice-of-law argument raises the important procedural issue of when and how to decide the case’s

governing law. The parties should give this question some thought because “the optimal timing for a

choice-of-law determination is case-specific.” Foisie, 967 F.3d at 42. Here, although the record does not

D. Plaintiffs’ BIPA Claims

Meta contests the viability of Plaintiffs’ BIPA claims on two grounds. First, it

argues that the information at issue is not “biometric” because it is incapable of

identifying individual users and people. Second, it contends that Plaintiffs fail to allege

that Meta “collected” and “possessed” the information at issue under sections 15(b) and

15(a) respectively.

1. Is the Data at Issue “Biometric”?

Meta argues that the facial scans it allegedly generated are not covered under BIPA

because they are not unique to individual users and thus incapable of identifying them.

Plaintiffs respond that the ability to identify individual users is irrelevant when, as here,

the information at issue is a “biometric identifier” in the form of a “scan of . . . face

geometry.” See 740 ILCS 14/10. Plaintiffs’ theory is based on a textual comparison of

BIPA’s definitions of “biometric identifier” and “biometric information.” Whereas

“biometric information” must be “used to identify an individual,” the term “biometric

identifier” contains no such requirement. Id.

Meta’s position, on the other hand, finds support in BIPA’s legislative findings and

in numerous cases that have addressed the issue. In 2008, the Illinois legislature found

that “[b]iometrics . . . are biologically unique to the individual,” and thus capable of

permit an informed choice-of-law determination at this time, the issue may be a candidate for resolution

on summary judgment. See In re Facebook, 185 F. Supp. 3d at 1159 (converting choice-of-law argument in

motion to dismiss into summary judgment issue). The Court will address this and other matters at an

upcoming scheduling conference.

identifying the person to whom they belong. 740 ILCS 14/5(c). It thus appears reasonable

to construe the term “biometric identifier” to mean “a biology-based set of measurements

(“biometric”) that can be used to identify a person (“identifier”),” as the Northern District

of Illinois did in Rivera v. Google Inc., 238 F. Supp. 3d 1088, 1094 (N.D. Ill. 2017), and as

Meta urges here. Several courts, including this one, have adopted this construction of the

term “biometric identifier” and found that it must be capable of identifying an individual.

See e.g., Zellmer v. Meta Platforms, Inc., 104 F.4th 1117, 1124 (9th Cir. 2024); G.T. v. Samsung

Elec. Am. Inc., --- F. Supp. 3d ----, ----, 2024 WL 3520026, at *7 (N.D. Ill. 2024); Sosa v. Onfido,

Inc., 600 F. Supp. 3d 859, 873 (N.D. Ill. 2022); Hazlitt v. Apple Inc., 500 F. Supp. 3d 738, 749

(S.D. Ill. 2020), vacated on other grounds by In re Apple Inc., No. 20-8033, 2021 WL 2451296,

at *1 (7th Cir. Jan. 22, 2021); Martell v. X Corp., No. 23 C 5449, 2024 WL 3011353, at *3 (N.D.

Ill. June 13, 2024); Daichendt v. CVS Pharm., Inc., No. 22 CV 3318, 2022 WL 17404488, at *5

(N.D. Ill. Dec. 2, 2022). For now, it is not necessary to wade further into this issue because

Plaintiffs have imperfectly but sufficiently alleged that the information at issue is capable

of identifying them.

Affording the complaint the generous interpretation to which it is entitled, the

Court finds that it sufficiently alleges that Meta scanned users’ face geometries and that

these scans are capable of identifying the people from whom they were taken. Plaintiffs

allege that the Messenger Applications relied on AR technology to create “scans of face

geometry to identify individuals’ location[s], expressions, and movements” in real time.

The resulting facial geometry scans “model[ed] users [sic] faces” based on an “estimation

of the location of parts of [their] faces.” These allegations permit an inference of

personalization that supports the uniqueness of each scan based on the user from whom

it was taken.

Indeed, the point of this process is to allow users to superimpose filters and effects

like bunny ears or cat whiskers on their face. To do so effectively, the bunny ears or cat

whiskers would have to appear in a location that creates a plausible appearance. If the

filters and effects were applied based on a generic face template that included an oval

shape to convey a facial structure, and general outlines of ears, nose, and mouth, the

filters and effects could, and often would, create an odd appearance. Bunny ears could

appear on the user’s forehead or be superimposed in a location that is not connected to

the face at all. The technology would have little entertainment or commercial value if it

applied these effects in such a non-personalized manner. See Sosa, 600 F. Supp. 3d at 871

(extraction of “unique numerical representation of the shape or geometry of each facial

image” plausibly constituted scan of face geometry under BIPA); In re Facebook, 185 F.

Supp. 3d at 1171 (same for “unique digital representation” of users’ faces “based on

geometric relationship of their facial features”).

Meta contends that an “estimation” of the “location” of parts of a person’s face

cannot possibly identify them. This contention may well be validated in discovery. But

to adopt it now requires a factual determination that is not warranted under a faithful

application of Rule 12(b)(6). Scanning a person’s face to identify the locations of its

constituent parts, including eyes, nose, mouth, and ears, creates a geometric

representation that is unique to that person. See Rivera, 238 F. Supp. 3d at 1091 (scanning

for “unique contours” of users’ faces and identifying “distinct facial measurements”

constituted “biometric identifier”); ACLU v. Clearview AI, Inc., No. 20 CH 4353, 2021 WL

4164452, at *1, *5 (Ill. Cir. Ct. Aug. 27, 2021) (scanning photograph for “data such as the

shape of the cheekbones and the distance between eyes, nose, and ears,” constituted scan

of face geometry). Thus, an “estimation of the location of parts of users’ faces” based on

a scan of their face is intrinsically unique and could plausibly be used to identify them.

Meta also offers a second argument in support of its contention that the

information at issue is incapable of identifying individual users and people, and thus not

covered as “biometric” data under BIPA. On this point, Meta claims that Plaintiffs did

not provide identifying information that would allow it to match the alleged facial

geometry scans to individual users. Without such information, Meta argues, it is

impossible to identify people whose face geometry was scanned, regardless of the

uniqueness of the data. Meta cites the Northern District of Illinois’ decision in Daichendt

v. CVS Pharmacy, Inc. for the proposition that scans of face geometry, without more, are

incapable of identifying individual users, and thus not covered by BIPA. Daichendt, 2022

WL 17404488, at *5. But Daichendt does not offer Meta the support it claims. In Daichendt,

the court observed that the plaintiffs failed to allege that they “provided defendant with

any information, such as their names or physical or email addresses, that could connect

the voluntary scans of face geometry with their identities.” Id. Thus, the court concluded

that the plaintiffs “failed to plead the most foundational aspect of a BIPA claim.” Id.

The allegations here are slightly more robust. Plaintiffs Rebecca Hartman and

Joseph Turner, at a minimum, allege that they created usernames and passwords for

themselves to set up their Facebook accounts. See Compl. at ¶ 70 (Doc. 23-2). They also

allege that Messenger Kids requires a child’s name to set up an account for them. Id.

Although more information would have been helpful, Plaintiffs have sufficiently alleged

that they supplied identifying information that Meta could match to their face geometry

scans to identify them. These allegations meet the minimum plausibility threshold under

Rule 12(b)(6), and thus distinguish this case from Daichendt, where the plaintiffs did not

provide “any information” that could be matched to their face geometry to reveal their

identities. Daichendt, 2022 WL 17404488, at *5.

So, crediting the truth of Plaintiffs’ allegations and drawing all reasonable

inferences in their favor, the Court rejects Meta’s argument that the information at issue

is incapable of identifying individual users and people, and thus not covered under BIPA.

2. Did the Messenger Applications “Collect” and “Possess” Plaintiffs’

Biometric Data?

Count I of Plaintiffs’ complaint asserts a claim under 740 ILCS 14/15(b), which

prohibits private entities from “collect[ing]” or otherwise obtaining a person’s biometric

data without their informed written consent. Count II advances a claim under 740 ILCS

14/15(a), which imposes certain requirements on private entities “in possession” of

peoples’ biometric data. Meta contends that Plaintiffs have failed to state a claim under

either section because the complaint lacks the necessary factual allegations to suggest that

Meta “collect[ed]” or was “in possession” of biometric data.

BIPA does not define the terms “collect” and “possess.” When statutory terms are

undefined, the Illinois Supreme Court “assume[s] the legislature intended for [them] to

have [their] popularly understood meaning.” Rosenbach v. Six Flags Ent. Corp., 129 N.E.3d

1197, 1205 (Ill. 2019). Moreover, “if a term has a settled legal meaning, the courts will

normally infer that the legislature intended to incorporate that established meaning into

the law.” Id. Fortunately with respect to the terms “collect” and “possess,” the Illinois

Supreme Court has offered guidance as to their respective meanings. To “collect” means

to “to receive, gather, or exact from a number of persons or other sources.” Cothron v.

White Castle Sys., Inc., 216 N.E.3d 918, 924 (Ill. 2023) (quotation marks and citation

omitted). To “possess” means that a person “has or takes control of the subject property

or holds the property at his or her disposal.” People v. Ward, 830 N.E.2d 556, 560 (Ill. 2005).

According to Meta, Plaintiffs “acknowledge” that the only place where the

information at issue is stored is on users’ personal devices, not on servers or in databases

that Meta controls. (Doc. 23 at 27). Thus, so the argument goes, if the information at issue

never leaves a user’s personal device, there is no way Meta could have “collected” or

“possessed” it. And with this concession, Meta argues that Counts I and II are fatally

defective.8

8 The factual premise that Meta did not “collect” or “possess” the information at issue is based on

documents that this Court has excluded from its review. Specifically, Meta points to language in Exhibits

B and C (the Facebook Messenger and Messenger Kids Face and Hand Effects Privacy Notices) that states

“[w]e [Meta] don’t store this information on our servers or share it with third parties.” (Docs. 23-3 at 2 &

23-4 at 2). To support its bid to have these documents considered, Meta cites Zablocki v. Merchants Credit

Guide Co., 968 F.3d 620, 623 (7th Cir. 2020), where the Seventh Circuit observed that “when the plaintiff

relies on a document attached to the complaint and does not deny its accuracy, the facts communicated by

that document control over allegations to the contrary” (emphasis added). In Zablocki, the plaintiffs

attached certain documents to their complaint that had the unintended effect of negating a critical factual

contention they made. Id. at 624. Here, Plaintiffs did not attach any documents to their complaint. Thus,

Meta’s exhibits are not susceptible to consideration in the same way the documents in Zablocki were.

Moreover, to the extent that Plaintiffs cite Meta’s claim that it does not store biometric data on its servers,

they do so to refute its accuracy. See Compl. at ¶¶ 54 & 74 (Doc. 23-2) (noting Meta’s “claim[]” that it does

not store biometric data on its servers and refuting it by alleging the opposite). In other words, Plaintiffs

openly contest the accuracy of the privacy notices, they do not acknowledge it. This distinguishes their

But the complaint reveals no such concession. In fact, it reveals the opposite.

Plaintiffs allege that Meta “collect[ed] the Biometric Data of each child and adult user

who utilize[d] an effect or filter,” and stored it locally on users’ devices and on its

“servers.” Compl. at ¶¶ 74, 78, & 82 (Doc. 23-2). And specifically with respect to biometric

data on Meta’s servers, Meta retains “exclusive control over the process by which

Biometric Data is harvested and stored.” Id. at ¶ 92. These allegations refute Meta’s claim

of an “acknowledge[ment]” from Plaintiffs that the information at issue is only stored on

users’ personal devices.

The allegation that Meta stores Plaintiffs’ biometric data on its servers (which the

Court accepts as true) also undercuts Meta’s legal argument that it did not “collect” or

“possess” it. Meta relies on the Illinois Appellate Court’s decision in Barnett v. Apple Inc.

to support its contention that biometric data storage on a user’s personal device and

nowhere else is fatal to a claim that it “collect[ed]” and “possess[ed]” such data.

225 N.E.3d 602, 611 (Ill. App. Ct. 2022). In Barnett, the plaintiffs alleged that their

fingerprints and face geometries were stored on their own devices, which the defendant,

Apple Inc., had manufactured. Id. at 603-04. This information allowed them to unlock

their devices and make purchases using their biometric data. Id. at 604. But the plaintiffs

offered “no allegation that Apple stores this information on a separate server or that Apple

invocation of the privacy notices from Zablocki, where the plaintiffs attached the documents at issue to their

complaint and “d[id] not deny [their] accuracy.” Zablocki, 968 F.3d at 623; see also H.K. through Farwell v.

Google LLC, 595 F. Supp. 3d 702, 708 (C.D. Ill. 2022) (“Defendant’s representations about its own privacy

practices cannot control at the motion to dismiss stage.”).

has ever once prevented a user from deleting her own information.” Id. at 610 (emphasis

added). This factual gap compelled the conclusions that Apple (i) did not “possess” the

plaintiffs’ biometric data because it never exercised control over it, and (ii) never

“collected” it because it “remained in a multitude of different and distinct places, namely

the millions of devices of Apple’s numerous users.” Id. at 610, 611.

Barnett is easily distinguishable for the simple reason that Plaintiffs do allege that

Meta stores their biometric data on its servers as well as on users’ personal devices. And

because the Court is bound to credit the truth of this allegation over Meta’s contention

that “the data is stored not on Meta’s servers, but rather only on the individual personal

devices . . . that users themselves control,” it must also reject Meta’s argument that it

could not have “collected” or “possessed” Plaintiffs’ biometric data. (Doc. 23 at 27). By

scanning peoples’ face geometries when they use the Messenger Applications’ filters and

effects and centrally storing such data on its servers, Meta plausibly “gather[s], or exact[s]

[biometric data] from a number of persons or other sources” (collection) and “takes

control” of it (possession). See Heard v. Becton, Dickinson & Co., 524 F. Supp. 3d 831, 841

(N.D. Ill. 2021); Mayhew v. Candid Color Sys., Inc., No. 23-cv-2964-DWD, 2024 WL 3650095,

at *13 (S.D. Ill. Aug. 5, 2024).

With that, the Court rejects Meta’s argument that Plaintiffs’ complaint fails to

allege that it “collected” or “possessed” their biometric data.

E. COPPA Preemption

Meta’s final argument is that the Children’s Online Privacy Protection Act

(“COPPA”), 15 U.S.C. §§ 6501-06, expressly preempts Plaintiffs’ BIPA claims with respect

to Messenger Kids. “Under COPPA and its regulations, companies that operate websites

and online services marketed toward children must provide certain disclosures about

their data collection activities and must safeguard the confidentiality, security, and

integrity of the children’s personal online information.” Jones v. Google LLC, 73 F.4th 636,

641 (9th Cir. 2023). The Federal Trade Commission (“FTC”) has rule-making authority

under COPPA, and it shares enforcement authority with state attorneys general. 15 U.S.C.

§§ 6502(b), 6504. Unlike BIPA, however, COPPA does not authorize a private right of

action. Jones, 73 F.4th at 641.

COPPA’s regulatory focus is the online collection of “personal information” from

children. 15 U.S.C. § 6502(a)(1). “Personal information” is defined as “individually

identifiable information about an individual collected online,” including one’s name,

physical and email addresses, telephone number, social security number, and

“information concerning the child or the parents of that child that the website collects

online from the child and combines with [one of the aforementioned identifiers].”

15 U.S.C. § 6501(8). Under the FTC’s regulations, “personal information” also includes

(i) a “persistent identifier,” like an internet protocol (“IP”) address or device serial

number, which “can be used to recognize a user over time and across different Web sites”;

(ii) a “photograph, video, or audio file . . . contain[ing] a child’s image or voice”; and

(iii) geolocation information. 16 C.F.R. § 312.2. Operators of websites and online services

directed to children are prohibited from collecting their personal information unless they

meet certain requirements concerning notice, safekeeping, and transparent handling of

such information. 15 U.S.C. § 6502(b). They also must obtain “verifiable parental consent

for the collection, use, or disclosure of personal information from children.” Id.

§ 6502(b)(1)(A)(ii).

To help accomplish these goals at the federal level, COPPA contains the following

express preemption clause:

No State or local government may impose any liability for commercial

activities or actions by operators in interstate or foreign commerce in

connection with an activity or action described in this chapter that is

inconsistent with the treatment of those activities or actions under this

section.

15 U.S.C. § 6502(d). The question is whether this provision preempts Plaintiffs’ BIPA

claims with respect to Messenger Kids.

The Court begins by recognizing the paucity of authority discussing COPPA’s

preemptive effect on BIPA actions like this one. Indeed, the parties and this Court have

identified only one case that addresses this issue. See H.K. through Farwell v. Google LLC,

595 F. Supp. 3d 702, 709-11 (C.D. Ill. 2022). Nevertheless, the Seventh Circuit has provided

the analytical framework for an informed preemption assessment in this case.

There are three forms of federal preemption: express preemption, conflict

preemption, and field preemption.9 Aux Sable Liquid Prods. v. Murphy, 526 F.3d 1028, 1033

(7th Cir. 2008). “Express preemption applies when Congress clearly declares its intention

9 Meta has only raised express preemption as an affirmative defense. Thus, the Court will confine its

analysis to that issue. See Aux Sable, 526 F.3d at 1033-34. It is worth noting, however, that conflict

preemption and express preemption “effectively collapse into one when the preemption clause uses the

term ‘inconsistent,’” as COPPA’s does. Jones, 73 F.4th at 644. Field preemption, moreover, is “rare” and

requires a clear expression of congressional intent. Nelson, 928 F.3d at 651-52. Field preemption is unlikely

here because “by expressly limiting federal preemption to state requirements that are inconsistent with the

federal regulations, Congress signaled its intent not to occupy the entire field.” Metrophones Telecomms., Inc.

v. Global Crossing Telecomms., Inc., 423 F.3d 1056, 1072 (9th Cir. 2005) (emphasis in original).

to preempt state law.” Nelson v. Great Lakes Ed. Loan Srvs., Inc., 928 F.3d 639, 651-52 (7th

Cir. 2019) (emphasis added). Thus, “when the text of a preemption clause is susceptible

of more than one plausible reading, courts ordinarily accept the reading that disfavors

preemption.” Altria Group, Inc. v. Good, 555 U.S. 70, 77 (2008) (internal quotation marks

omitted). “Conflict preemption applies when there is an actual conflict between state and

federal law such that it is impossible for a person to obey both, or when state law stands

as an obstacle to fully accomplishing the objectives of Congress.” Nelson, 928 F.3d

at 646-47. Field preemption exists “when federal law so thoroughly occupies a legislative

field as to make it reasonable to infer that Congress left no room for the states to act.” Aux

Sable, 526 F.3d at 1033 (citation and internal quotation marks omitted). Regardless of the

preemption doctrine under consideration, preemption may not be “lightly applied”

because of its potential encroachment on a state’s police powers. Patriotic Veterans, Inc. v.

Indiana, 736 F.3d 1041, 1046, 1049 (7th Cir. 2013). That is why courts consider preemption

questions “through a lens that presumes that the state law has not been preempted.” Id.

at 1046.

In Patriotic Veterans v. Indiana, the Seventh Circuit confronted the issue of whether

the federal Telephone Consumer Protection Act (“TCPA”) preempted an Indiana law

regulating telemarketing and robocalling. Id. at 1044-46. The Indiana law barred the use

of “automatic dialing-announcing device[s]” without the recipient’s consent. Id. at 1044.

The TCPA, for its part, prohibited the use of an “artificial or prerecorded voice to deliver

a message” without the recipient’s written consent, unless the call is “not made for a

commercial purpose.” Id. at 1045. The TCPA also contained a preemption clause in the

form of a “savings clause,” which stated that it did not “preempt any State law that

imposes more restrictive intrastate requirements or regulations on” robocalling, or

“which prohibits” its use and the use of autodialing technology. Id. at 1046. The district

court held that any law that was not expressly saved by the savings clause was

preempted—i.e., only general prohibitions and intrastate regulations and restrictions on

auto-dialing technology were not preempted. Id. Thus, the district court found that the

Indiana law was preempted because it was a non-covered regulation under the savings

clause. Id. at 1047. The Seventh Circuit reversed because this interpretation of the TCPA’s

savings clause turned the preemption analysis on its head. Id. at 1047-48. According to

the Seventh Circuit, the district court erroneously “presum[ed] that laws that were not

explicitly saved were preempted.” Id. at 1048. Rather, because “the TCPA says nothing

about preempting laws that regulate the interstate use of automatic dialing systems,” the

court had to “conclude that they are not preempted.” Id. The takeaway from Patriotic

Veterans is that courts should avoid expansive interpretations of preemption language in

a federal statute when a narrower construction is reasonably available.

Six years later, in Nelson v. Great Lakes Ed. Loan Srvs., the Seventh Circuit

considered the preemptive effect of the federal Higher Education Act (“HEA”), which

provided that federal student loans “shall not be subject to any disclosure requirements

of any State law.” 928 F.3d at 642. In that case, the plaintiff alleged that her student loan

servicer had made affirmative misrepresentations in its loan-related communications

with her and that she relied on these misrepresentations to her detriment. Id. The Seventh

Circuit reversed the district court’s holding that the HEA preempted the plaintiff’s claims

because the preemption clause was limited to “disclosure requirements,” not affirmative

misrepresentations that could trigger liability under state law. Id. at 649. State consumer

protection and tort laws, the court reasoned, “could impose liability on these affirmative

misrepresentations without imposing additional disclosure requirements on [the

defendant].” Id. Accordingly, the plaintiff’s claims based on affirmative

misrepresentations were not preempted because they did not implicate additional

“disclosure requirements.” Id.

More recently, in C.Y. Wholesale, Inc. v. Holcomb, the Seventh Circuit considered the

preemptive effect of a federal hemp statute on state criminal laws targeting smokable

hemp. 965 F.3d 541, 544 (7th Cir. 2020). In that case, the federal Farm Law of 2018 relaxed

restrictions on certain hemp products. Id. At the same time, the Farm Law expressly did

not “preempt[] or limit[] any law of a State . . . that regulates the production of hemp and

is more stringent than this subchapter.” Id. (quoting 7 U.S.C. § 1639p). However, states

were barred from “prohibiting the transportation or shipment of hemp or hemp products

through the State.” C.Y. Wholesale, 965 F.3d at 544 (cleaned up). In 2019, Indiana passed a

law criminalizing the manufacture, delivery, and possession of “smokable hemp.” Id. The

district court held that the Farm Law expressly preempted the Indiana statute’s

prohibition on the manufacture, delivery, possession, and financing of smokable hemp.

Id. at 546. The Seventh Circuit found this interpretation too broad. Id. at 547. The Indiana

statute covered “much more than transportation, including the manufacture, financing,

delivery, or possession of smokable hemp.” Id. at 545. And by finding the Indiana law

preempted, the district court enjoined the enforcement of parts of it (manufacture,

delivery, possession, and financing) that had nothing to do with the target of the

preemption clause (transportation). Id. at 547. Thus, as in Patriotic Veterans and Nelson,

the court construed the preemption clause narrowly to avoid an unnecessary conflict with

state law.

With this decisional authority and the presumption against preemption in mind,

the Court returns to COPPA’s express premotion clause, which prohibits states from

“impos[ing] any liability for commercial activities . . . that is inconsistent with the

treatment of those activities or actions under this section.” 15 U.S.C. § 6502(d). Although

a preemptive intent is evident here, the statute does not explain what it means for a state

law to be “inconsistent” with its “treatment” of covered activities. So, the question is

whether BIPA imposes requirements that are “inconsistent” with COPPA’s regulation of

children’s online activity.

Again, the only court to address this question appears to be the Central District of

Illinois in H.K. through Farwell v. Google, 595 F. Supp. 3d at 709-11. The plaintiffs in that

case brought claims under BIPA alleging that Google collected “acoustic details and

characteristics of [children’s] voices,” as well as scans and images of their face geometries.

Id. at 705. The court emphasized the parties’ agreement that Google’s alleged conduct

also violated COPPA and found that “to allow Plaintiffs to assert H.K.’s claim against

Defendant would be “inconsistent with COPPA’s treatment” of online data collection

from children under 13 because COPPA provides for no private right of action . . .

whereas BIPA does so explicitly.” Id. at 710 (internal brackets and citation omitted). The

court relied on COPPA’s broad definition of “personal information” to find that BIPA’s

regulation of biometric data “falls squarely in COPPA’s orbit,” even though “COPPA

does not expressly reference biometric data in its statutory text.” Id. at 711. Thus, the

Court held that COPPA preempted Plaintiffs’ BIPA claims under sections 15(a) and 15(b).

Id.

Other courts also have addressed COPPA’s preemptive effect, albeit with respect

to state laws other than BIPA. In Jones v. Google, the Ninth Circuit considered whether

COPPA preempted consumer protection and tort claims arising under California,

Colorado, Indiana, Massachusetts, New Jersey, and Tennessee law. 73 F.4th at 640. The

plaintiffs alleged that Google sent them targeted ads and that this process depended on

the collection of “persistent identifiers,” like IP addresses, which are covered under

COPPA as “personal information.” 16 C.F.R. § 312.2. The plaintiffs further alleged that

Google collected their persistent identifiers without their consent. Jones, 73 F.4th at 640.

And like in H.K., the parties agreed that “all of the claims allege conduct that would

violate COPPA’s requirement that child-directed online services give notice and obtain

“verifiable parental consent” before collecting persistent identifiers.” Id. The district court

found that Plaintiffs’ claims were expressly preempted because their “core allegations”

were “squarely covered” by COPPA. Id. at 640-41. The Ninth Circuit reversed. Bearing in

mind COPPA’s limited preemption of “inconsistent” state laws, the court interpreted that

statutory term “to refer to contradictory state law requirements, or to requirements that

stand as obstacles to federal objectives.” Id. at 642. And “state laws that supplement or

require the same thing as federal law, do not stand as an obstacle to Congress’s objectives

and so are not “inconsistent.”” Id. (cleaned up). So, to preempt state laws that

inconsistently “treat[]” children’s online activity, the court reasoned, did not “evince[]

clear congressional intent to create an exclusive remedial scheme for enforcement of

COPPA requirements.” Id. at 643 (emphasis in original). In short, the absence of a conflict

between the plaintiffs’ claims and COPPA meant that they were not preempted, even if

those causes of action “are parallel to, or proscribe the same conduct forbidden by,

COPPA.” Id. at 644; accord In re Nickelodeon Cons. Priv. Litig, 827 F.3d 262, 291-93 (3d

Cir. 2016) (intrusion claim under state law not preempted by COPPA).

The Court finds that Jones is more aligned with the Seventh Circuit’s governing

framework to narrowly construe preemption provisions when possible. This conclusion

is particularly appropriate where, as here, a harmonious construction of BIPA and

COPPA is possible based on their distinct regulatory objectives. C.Y. Wholesale, 965 F.3d

at 547; Nelson, 928 F.3d at 649.

BIPA’s subject matter is almost entirely distinct from that of COPPA. BIPA, as

noted, regulates “biometric identifiers” and “biometric information.” A biometric

identifier is “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face

geometry.” 740 ILCS 14/10. “Biometric information” is “any information . . . based on an

individual’s biometric identifier used to identify an individual.” Id. These biology-based

characteristics (biometric identifiers) and information based on them (biometric

information) are inherently “immutable.” Fox v. Dakkota Integrated Sys., LLC, 980 F.3d

1146, 1155 (7th Cir. 2020). COPPA, on the other hand, regulates “personal information,”

in the form of data-based identifiers. For instance, “personal information” includes one’s

name, physical and email addresses, telephone number, social security number,

“persistent identifiers” like IP addresses and device serial numbers, and a person’s

geolocation information. 15 U.S.C. § 6501(8); 16 C.F.R. § 312.2. Indeed, BIPA’s enactment

was motivated, in large part, by this very distinction as shown in its legislative findings:

Biometrics are unlike other unique identifiers that are used to access

finances or other sensitive information. For example, social security numbers,

when compromised, can be changed. Biometrics, however, are biologically

unique to the individual; therefore, once compromised, the individual has

no recourse, is at heightened risk for identity theft, and is likely to withdraw

from biometric-facilitated transactions.

740 ILCS 14/5(c) (emphases added). The thematic difference between biology-based and

data-based identifying information should be apparent. And considering these distinct

regulatory targets, there is no basis to conclude that BIPA’s requirements are

“inconsistent” with COPPA’s. See H.K., 595 F. Supp. 3d at 711 (recognizing that “COPPA

does not expressly reference biometric data in its statutory text.”).

One form of “personal information” under COPPA does present a possible

overlap with BIPA’s regulation of biometric data: “A photograph, video, or audio file

where such file contains a child’s image or voice.” 16 C.F.R. § 312.2. A child’s “image”

and “voice” are, of course, unique to them, and thus could trigger concomitant coverage

under BIPA. But that alone is not enough to trigger preemption here. State laws that

“supplement” or even “require the same thing” as federal law are not “inconsistent” with

federal law. Jones, 73 F.4th at 642 (quotation marks and internal citations omitted).

Moreover, differences in regulatory methodologies do not justify preemption in

this case because none of them involve the “inconsistent . . . treatment” of a “photograph,

video, or audio file where such file contains a child’s image or voice.” Meta has identified

several requirements under COPPA that, it claims are “different[]” from BIPA’s

regulatory approach on similar matters. (Doc. 23 at 30-31 & n.16). First, 16 C.F.R.

§ 312.4(d) requires a website operator to “post a prominent and clearly labeled link to an

online notice of its information practices with regard to children on the home or landing

page or screen of its Web site or online service.” BIPA, on the other hand, requires an

entity in possession of biometric data to “develop a written policy” for its retention and

destruction and to “ma[k]e [the policy] available to the public.” 740 ILCS 14/15(a). Meta

argues that because BIPA does not require a policy that is “specific to children,” its

requirement that private entities publish their data retention and destruction policies is

inconsistent with COPPA. This argument is easily rejected because a requirement that is

silent on an issue that COPPA addresses can hardly be seen as “inconsistent” with it.

Second, the FTC’s regulations allow covered entities to retain personal information “as

long as is reasonably necessary.” See 16 C.F.R. § 312.10 (website operators “shall retain

personal information collected online from a child for only as long as is reasonably necessary

to fulfill the purpose for which the information was collected”) (emphasis added). BIPA,

however, requires the deletion of biometric data when the initial purpose for its collection

is no longer present or three years after the subject’s last interaction with the collecting

entity. See 740 ILCS 14/15(a). This distinction is irrelevant for preemption purposes

because there is no irreconcilable conflict between a federal law’s grant of permission to

do something (retain data) and a state law’s requirement to eventually do the opposite

(delete data). Third, Meta contends that COPPA’s requirement that website operators

obtain “verifiable parental consent” before collecting a child’s personal information but

allowing them to do so through “any reasonable effort,” 16 C.F.R. § 312.2, is inconsistent

with BIPA’s requirement that private entities obtain a “written release” from people

before collecting their biometric data. 740 ILCS 14/15(b)(3). Here too, there is no

inconsistency. A federal statute that does not govern the form in which consent must be

obtained is not inconsistent with a state law that does.

The Court is equally unpersuaded that the lack of a private right of action under

COPPA warrants the preemption of Plaintiffs’ BIPA claims. The Seventh Circuit

recognizes that “[t]he absence of a private right of action from a federal statute provides

no reason to dismiss a claim under a state law just because it refers to or incorporates

some element of the federal law.” Wigod v. Wells Fargo Bank, N.A., 673 F.3d 547, 581 (7th

Cir. 2012). Here, the two statutes occupy distinct regulatory fields with minimal (if any)

substantive overlap. Thus, the absence of a private right of action provides no basis for a

finding of “inconsistent” regulatory “treatment” that would trigger COPPA’s

preemption clause. 15 U.S.C. § 6502(d).

Based on the foregoing, the Court finds that Meta is unable to overcome the

presumption against preemption in this case. See Patriotic Veterans, 736 F.3d at 1046.

COPPA does not preempt Plaintiffs’ BIPA claims with respect to Messenger Kids. It bars

only the imposition of liability for covered conduct that is “inconsistent” with its

treatment of such conduct. 15 U.S.C. § 6502(d). Nothing in sections 15(a) and 15(b) of

BIPA impose such “inconsistent” requirements.

CONCLUSION

Meta’s Motion to Dismiss Plaintiffs’ complaint (Doc. 23) is DENIED. This case will

proceed to discovery and the Court will set a telephonic scheduling conference by

separate order.

IT IS SO ORDERED.

DATED: September 17, 2024 7 g 5

NANCY J. ROSENSTENGEL

Chief U.S. District Judge

Page 41 of 41