In re Facebook Biometric Information Privacy Litigation

Filing 333

ORDER RE CLASS CERTIFICATION (Dkt. No. #255 ). Signed by Judge James Donato on 4/16/2018. (jdlc3S, COURT STAFF) (Filed on 4/16/2018)

1
2
3
4

UNITED STATES DISTRICT COURT

5

NORTHERN DISTRICT OF CALIFORNIA

6
7

IN RE FACEBOOK BIOMETRIC
INFORMATION PRIVACY LITIGATION

8
9

Case No. 3:15-cv-03747-JD
ORDER RE CLASS CERTIFICATION

THIS DOCUMENT RELATES TO:
ALL ACTIONS

Re: Dkt. No. 255

10

United States District Court
Northern District of California

11
12
13

In this privacy action against defendant Facebook, Inc. (“Facebook”), named plaintiffs

14

Nimesh Patel, Adam Pezen, and Carlo Licata move for class certification. Dkt. No. 255.

15

Plaintiffs’ claims are sufficiently cohesive to allow for a fair and efficient resolution on a class

16

basis. Consequently, the case will proceed with a class consisting of Facebook users located in

17

Illinois for whom Facebook created and stored a face template after June 7, 2011.
BACKGROUND

18
19

The material facts of this case are reported in a number of prior orders. See, e.g., Patel v.

20

Facebook Inc., __ F. Supp. 3d. __, No. 3:15-cv-03747-JD, 2018 WL 1050154, at *1 (N.D. Cal.

21

Feb. 26, 2018) [“Spokeo order”]. Briefly summarized, plaintiffs are Facebook users who

22

challenge its “Tag Suggestions” program, which scans for and identifies people in uploaded

23

photographs to promote user tagging. Plaintiffs allege that Facebook collects and stores their

24

biometric data without prior notice or consent in violation of their privacy rights and Sections

25

15(a) and 15(b) of the Illinois Biometric Information Privacy Act, 740 Ill. Comp. Stat. 14/1 et seq.

26

(“BIPA”). Dkt. No. 40.

27
28

The salient facts for class certification are undisputed. Facebook launched Tag
Suggestions on June 7, 2011. Dkt. No. 255 at 2. In broad strokes, Tag Suggestions is powered by

1

a four-step facial recognition process. Initially, the software tries to detect faces (the “detection”

2

step) and standardizes any detected faces for qualities like orientation and size (the “alignment

3

step”). Dkt. No. 256-8 ¶¶ 13-17. For each face that is detected and aligned, Facebook computes a

4

“face signature,” which is a “string of numbers that represents a particular image of a face” (the

5

“representation” step). Id. ¶ 18. Face signatures are then run through a stored database of user

6

“face templates” to look for matches (the “classification” step). Id. ¶¶ 21-23. A face template is

7

“a string of numbers that represents a boundary” between the face signatures of a given Facebook

8

user and the face signatures of others, and is calculated based on that user’s photographs. Id. If a

9

computed face signature falls within the boundary described by a user’s face template, Facebook
suggests tagging the user. See Dkt. No. 284-20 at 37. Facebook represents, with no challenge

11
United States District Court
Northern District of California

10

from plaintiffs, that face signatures are not stored. Dkt. No. 256-8 ¶ 20. Only face templates are

12

kept by Facebook.

13

Facebook’s facial recognition technology is reliable but not foolproof. Facebook estimates

14

that 90% of faces appearing in photographs are successfully detected, and of those detected faces,

15

85% are successfully aligned. Dkt. No. 284-9 ¶¶ 5-6. That means approximately 76% of faces

16

appearing in photographs reach the representation step and have face signatures computed.

17

Facebook states that in 2014, it was able to match around 67% of detected faces with users, which

18

somewhat understates current matches because the rate has risen as the technology has matured.

19

Id. ¶¶ 8-9.

20

Plaintiffs seek certification under Federal Rule of Civil Procedure 23(b)(3) and propose a

21

class of all “Facebook users living in Illinois whose face appeared in a photo uploaded to

22

Facebook from Illinois between June 7, 2011, and the final disposition of this action.” Dkt. No.

23

255 at 5. Plaintiffs also propose an alternative class of all “people living in Illinois for whom

24

Facebook has a stored ‘face template’ that was created between June 7, 2011, and final disposition

25

of this action.” Id.

26
27
28

LEGAL STANDARDS
As the parties seeking certification, plaintiffs bear the burden of showing that the
requirements of Federal Rule of Civil Procedure 23 are met. Mazza v. Am. Honda Motor Co., 666
2

1

F.3d 581, 588 (9th Cir. 2012). The proposed class action must satisfy all four requirements of

2

Rule 23(a), and at least one of the sub-sections of Rule 23(b). Comcast Corp. v. Behrend, 569

3

U.S. 27, 33 (2013); Zinser v. Accufix Research Inst., Inc., 253 F.3d 1180, 1186 (9th Cir. 2001),

4

amended by 273 F.3d 1266 (9th Cir. 2001).

5

Rule 23(a) imposes four prerequisites. The class must be “so numerous that joinder of all

6

members is impracticable” (numerosity). There must be “questions of law or fact common to the

7

class” (commonality). The claims or defenses of the named plaintiffs must be “typical of the

8

claims or defenses of the class” (typicality). And the named parties must show that they “will

9

fairly and adequately protect the interests of the class” (adequacy). Fed. R. Civ. P. 23(a)(1)-(4).

10

To obtain a Rule 23(b)(3) class, plaintiffs must also must show that “questions of law or

United States District Court
Northern District of California

11

fact common to class members predominate over any questions affecting only individual

12

members” (predominance) and that a class action is “superior to other available methods for fairly

13

and efficiently adjudicating the controversy” (superiority). Fed. R. Civ. P. 23(b)(3).

14

The Court’s “class-certification analysis must be rigorous and may entail some overlap

15

with the merits of the plaintiff’s underlying claim.” Amgen Inc. v. Connecticut Ret. Plans & Trust

16

Funds, 568 U.S. 455, 465-66 (2013) (internal quotations and citations omitted). “That is so

17

because the class determination generally involves considerations that are enmeshed in the factual

18

and legal issues comprising the plaintiff’s cause of action.” Comcast, 569 U.S. at 33-34 (internal

19

quotations and citations omitted). These principles apply to the Rule 23(a) and 23(b) analysis

20

alike. Id. at 34.

21

The rigorous analysis, however, has its limits. “Rule 23 grants courts no license to engage

22

in free-ranging merits inquiries at the certification stage. Merits questions may be considered to

23

the extent -- but only to the extent -- that they are relevant to determining whether the Rule 23

24

prerequisites for class certification are satisfied.” Amgen, 586 U.S. at 466. The class certification

25

procedure is decidedly not an alternative form of summary judgment or an occasion to hold a

26

mini-trial on the merits. Alcantar v. Hobart Service, 800 F.3d 1047, 1053 (9th Cir. 2015). The

27

goal under Rule 23 is “to select the metho[d] best suited to adjudication of the controversy fairly

28

and efficiently.” Amgen, 568 U.S. at 460 (internal quotations omitted) (modification in original).
3

1

That means deciding whether efficiency and the interests of justice are best served by having the

2

named plaintiffs go forward to the merits as individuals or on behalf of a class as “an exception to

3

the usual rule that litigation is conducted by and on behalf of the individual named parties only.”

4

Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338, 348 (2011) (quoting Califano v. Yamasaki, 442

5

U.S. 682, 700-701 (1979)). See generally Brickman v. Fitbit, Inc., No. 3:15-CV-02077-JD, 2017

6

WL 5569827, at *2-3 (N.D. Cal. Nov. 20, 2017).

7
8

The decision of whether to certify a class is entrusted to the sound discretion of the district
court. Zinser, 253 F.3d at 1186.
DISCUSSION

9
I.

11
United States District Court
Northern District of California

10

The Initial Proposed Class

Plaintiffs initially propose a class consisting of all Illinois Facebook users appearing in a

12

photograph uploaded to Facebook. This broad definition is not viable because it poses

13

insurmountable problems with superiority and manageability, commonality, predominance, and is

14

not “reasonably co-extensive with Plaintiffs’ chosen theory of liability.” Torres v. Mercer

15

Canyons Inc., 835 F.3d 1125, 1136-37 (9th Cir. 2016).

16

Simply appearing in an uploaded photograph does not necessarily mean that a face

17

signature or template was collected or stored, or that any biometric data was harvested. As

18

plaintiffs acknowledge, Facebook “locates certain landmarks on the face and uses that data to

19

create a three-dimensional map of the face” only after the initial steps of detection and alignment

20

are successfully completed. Dkt. No. 255 at 3. Unique physical characteristics are not involved in

21

the detection step, which is about locating all faces rather than a specific face. The detection and

22

alignment steps fail for approximately 24% of faces appearing in photographs. See Dkt. No. 284-

23

9 ¶¶ 5-6. The uncertainty generated by this match failure rate is compounded by evidence in the

24

record, which plaintiffs do not contest, that Facebook cannot reliably determine whether a face

25

signature was ever computed from a particular photograph, id. ¶¶ 11-12, and that face signatures

26

are not stored, Dkt. No. 256-8 ¶ 20. The record also shows that at times during the proposed class

27

period, the software did not consistently compute face signatures from a given photograph. See

28

Dkt. No. 284-9 ¶ 12.
4

1

These uncontested facts establish that uploading a photo did not necessarily result in the

2

collection of biometric data. Consequently, a class defined by uploaded photographs is too

3

amorphous and potentially over-inclusive to be certified. See Torres, 835 F.3d at 1139; Lozano v.

4

AT & T Wireless Servs., Inc., 504 F.3d 718, 730 (9th Cir. 2007). Plaintiffs suggest that a vigorous

5

claims process can fix these problems, but that only pushes them down the road to a later stage.

6

Facebook will have no greater ability to resolve these uncertainties at the verification stage than at

7

this definitional one. Plaintiffs’ citations to claims procedure cases are inapposite for this reason.

8

See, e.g., In re Cmty. Bank of N. Virginia Mortg. Lending Practices Litig., 795 F.3d 380, 397 (3d

9

Cir. 2015) (defendant already possessed all relevant records and identification method was reliable

10

United States District Court
Northern District of California

11

and repeatable).
Plaintiffs also suggest that they can obtain certification on the theory that users with

12

multiple photos posted on Facebook are likely to have had at least one processed in the

13

representation or classification steps, where biometric data is collected. Dkt. No. 292 at 7. That

14

too is inherently imprecise, and plaintiffs do not offer any statistical or other methods that might

15

translate this presumed likelihood into a reasonably certain class definition.

16

II.

The Certified Class

17

Plaintiffs’ alternative proposal is tied to face templates, and with a minor modification it

18

provides a sound basis for certification. A class comprised of Facebook users located in Illinois

19

for whom Facebook created and stored a face template after June 7, 2011, satisfies Rule 23’s

20

requirements and neutralizes most of Facebook’s objections, which go mainly to problems caused

21

by the use of face signatures to define the class. This definition modestly refines plaintiffs’

22

alternative class proposal, and will be used for the remaining Rule 23 analysis. See Armstrong v.

23

Davis, 275 F.3d 849, 871 n.28 (9th Cir. 2001) (“district court may redefine the class”) (citing Penk

24

v. Oregon State Bd. of Higher Educ., 816 F.2d 458, 467 (9th Cir. 1987)), abrogated on other

25

grounds by Johnson v. California, 543 U.S. 499 (2005).

26

A. Numerosity, Adequacy, and Typicality

27

The numerosity, adequacy, and typicality requirements in Rule 23(a) are readily satisfied

28

for a template-based class of Illinois users. Plaintiffs reasonably estimate that millions of Illinois
5

1

residents are Facebook users, many of whom have been tagged in enough photographs to have

2

face templates. Dkt. No. 255 at 6. Plaintiffs’ arguments are uncontested by Facebook, and

3

numerosity is established.

4

Adequacy is also not an issue. Neither named plaintiffs nor their counsel have an apparent
conflict of interest with other class members, and the hard-fought proceedings in this case amply

6

establish that they will “prosecute the action vigorously on behalf of the class.” Hanlon v.

7

Chrysler Corp., 150 F.3d 1011, 1020 (9th Cir. 1998). Facebook says adequacy cannot be found

8

because the named plaintiffs “know almost nothing” about their case or claims, but that goes too

9

far. Dkt. No. 285 at 24. The deposition testimony by the named plaintiffs shows a perfectly

10

adequate understanding of the case, and it clearly manifests their concerns about Facebook’s

11
United States District Court
Northern District of California

5

treatment of personal biometric data. See, e.g., Dkt. Nos. 255-5; 255-6; 284-23; 284-24; 284-25.

12

This is not a situation where the named plaintiffs “are startlingly unfamiliar with the case.”

13

Dufour v. Be LLC, 291 F.R.D. 413, 419 (N.D. Cal. 2013) (internal quotations omitted). In any

14

event, objections to adequacy based on a named representative’s alleged ignorance are disfavored.

15

See Surowitz v. Hilton Hotels Corp., 383 U.S. 363, 370-74 (1966). Even if the named plaintiffs

16

have relied heavily on the advice of attorneys and others, it is hardly a badge of inadequacy to

17

seek help from those with relevant expertise, particularly in a complex case like this one. Baffa v.

18

Donaldson, Lufkin & Jenrette Sec. Corp., 222 F.3d 52, 62 (2d Cir. 2000).

19

There is no serious doubt that typicality is satisfied, too. Named plaintiffs are Illinois

20

Facebook users with face templates suing under Illinois law on behalf of fellow users in Illinois.

21

That is enough to “assure that the interest of the named representative aligns with the interests of

22

the class.” Hanon v. Dataproducts Corp., 976 F.2d 497, 508 (9th Cir. 1992). Typicality may be a

23

bar to certification if other members would suffer because the named plaintiffs would be

24

“preoccupied with defenses unique to” them. Just Film, Inc. v. Buono, 847 F.3d 1108, 1116 (9th

25

Cir. 2017) (quoting Hanon, 976 F.2d at 508). That is not the situation here. Facebook has not

26

shown that named plaintiffs would be preoccupied with unique defenses, or are in any way

27

atypical with respect to the overall class.

28
6

1

B. Commonality and Predominance

2

The main thrust of Facebook’s non-technical objections to certification go to the somewhat

3

overlapping factors of commonality under Rule 23(a)(2) and predominance under Rule 23(b)(3).

4

These inquiries go to the heart of whether adjudication of the claims on a class basis would be fair,

5

efficient and superior to individual prosecution.

6

The commonality requirement is satisfied when “there are questions of law or fact

7

common to the class.” Fed. R. Civ. P. 23(a)(2). “Because any competently crafted class

8

complaint literally raises common questions,” the Court’s task is to look for a common contention

9

“capable of classwide resolution -- which means that determination of its truth or falsity will
resolve an issue that is central to the validity of each one of the claims in one stroke.” Alcantar,

11
United States District Court
Northern District of California

10

800 F.3d at 1052 (internal quotations and citations omitted). What matters is the “capacity of a

12

classwide proceeding to generate common answers apt to drive the resolution of the litigation.”

13

Wal-Mart, 564 U.S. at 350 (internal quotations omitted) (emphasis in original).

14

Rule 23(a)(2) does not demand total uniformity across a class. “All questions of fact and

15

law need not be common to satisfy the rule. The existence of shared legal issues with divergent

16

factual predicates is sufficient, as is a common core of salient facts coupled with disparate legal

17

remedies within the class.” Hanlon, 150 F.3d at 1019. Rule 23(a)(2) imposes a “‘rigorous’

18

commonality standard.” Levya v. Medline Indus. Inc., 716 F.3d 510, 512 (9th Cir. 2013).

19

Rule 23(b)(3) requires that common questions of law or fact predominate over individual

20

ones. The predominance inquiry asks whether “common questions present a significant aspect of

21

the case and [if] they can be resolved for all members of the class in a single adjudication.”

22

Hanlon, 150 F.3d at 1022 (internal quotations omitted); see also Tyson Foods v. Bouaphakeo, __

23

U.S. __, 136 S.Ct. 1036, 1045 (2016). Each element of a claim need not be susceptible to

24

classwide proof, Amgen, 568 U.S. at 468-69, and the “important questions apt to drive the

25

resolution of the litigation are given more weight in the predominance analysis over individualized

26

questions which are of considerably less significance to the claims of the class.” Torres, 835 F.3d

27

at 1134. Rule 23(b)(3) permits certification when “one or more of the central issues in the action

28

are common to the class and can be said to predominate, . . . even though other important matters
7

1

will have to be tried separately, such as damages or some affirmative defenses peculiar to some

2

individual class members.” Tyson, 136 S. Ct. at 1045 (internal quotations omitted).

3

As the Court has discussed in other decisions, the line separating the commonality inquiry
under Rule 23(a)(2) and the predominance assessment under Rule 23(b)(3) can be elusive. See

5

Ochoa v. McDonald’s Corp., Case No. 14-cv-02098 JD, 2016 WL 3648550, at *5-6 (N.D. Cal.

6

July 7, 2016). Wal-Mart emphasized the commonality inquiry, but the Supreme Court has also

7

advised that “[i]f anything, Rule 23(b)(3)’s predominance criterion is even more demanding than

8

Rule 23(a).” Comcast, 569 U.S. at 34. Whatever the precise demarcation might be between the

9

two inquiries, it is clear that commonality alone will not fulfill Rule 23(b)(3), and that the main

10

concern under subsection (b)(3) “is the balance between individual and common issues.” In re

11
United States District Court
Northern District of California

4

Hyundai and Kia Fuel Economy Litigation, 881 F.3d 679, 691 (9th Cir. 2018) (internal quotations

12

omitted); see also Tyson, 136 S.Ct. at 1045 (purpose of the Rule 23(b)(3) inquiry is to determine

13

whether the proposed class is “sufficiently cohesive to warrant adjudication by representation”)

14

(quoting Amchem Products, Inc. v. Windsor, 521 U.S. 591, 623 (1997)). As a practical matter,

15

commonality and predominance can be assessed in tandem, with a careful eye toward ensuring

16

that the specific requirements of each are fully satisfied. See, e.g., Just Film, 847 F.3d at 1120-21.

17

As an initial matter, there is no doubt that a template-based class poses common legal and

18

factual questions, namely: did Facebook’s facial recognition technology harvest biometric

19

identifiers as contemplated under BIPA, and if so, did Facebook give users prior notice of these

20

practices and obtain their consent? Facebook agrees that these questions reach the entire class,

21

Dkt. No. 285 at 9, but challenges whether common answers will predominate. Specifically,

22

Facebook contends that three issues can be resolved only by individualized evidence of:

23

(1) whether a class member is “aggrieved” as that word is used in BIPA, which grants a private

24

right of action only to “persons aggrieved” under it; (2) whether a class member’s claims fall

25

within BIPA’s territorial scope; and (3) whether a class member was depicted in photographs

26

derived from “paper photos . . . converted to digital form before upload.” Id.

27
28

Facebook puts greatest emphasis on its argument about the meaning of “aggrieved.” It
relies almost exclusively on Rosenbach v. Six Flags Entertainment Corporation, 2017 IL App (2d)
8

1

170317 (Ill. App. Ct. 2017), a currently unpublished opinion by an intermediate court of appeals in

2

Illinois. The BIPA claim in Rosenbach arose out of the practice by the defendant amusement

3

parks of fingerprinting season pass holders so that thumb scans could speed up entry into the park.

4

The parks collected a minor’s thumbprint when he purchased a pass, and his mother subsequently

5

objected under BIPA that the parks had not provided prior notice or obtained consent. She sued

6

on those grounds. The trial court initially denied defendants’ motion to dismiss but certified

7

questions about the meaning of “aggrieved” to the appellate court. Rosenbach is the intermediate

8

court’s response to the certified questions.
As a threshold matter, Rosenbach does not bear the heavy weight Facebook seeks to place

10

on it. Facebook heatedly insists that Rosenbach interpreted “aggrieved” to require injury or harm

11
United States District Court
Northern District of California

9

“beyond the alleged statutory violation.” Dkt. No. 285 at 1 (emphasis in original). But the

12

opinion is far less pertinent or definitive than Facebook contends, and a fair reading suggests that

13

the Rosenbach court would have reached the opposite conclusion had the allegations in this case

14

been before it. Rosenbach states on several occasions that the plaintiff in that case -- the mother of

15

the minor fingerprinted by the amusement park defendants -- did not allege that she or her son

16

“suffered any actual injury.” See, e.g., Rosenbach, 2017 IL App (2d) 170317, ¶ 10 (“Plaintiff

17

alleged not that she or Alexander suffered any actual injury, but that, had she known of

18

defendants’ conduct, ‘she never would have purchased a season pass for her son.’”). Instead, “the

19

only injury alleged” by the plaintiff was “a violation of the notice and consent requirements of

20

section 15(b) of the Act,” and her argument was that “a mere technical violation of the Act is

21

sufficient to render a party ‘aggrieved.’” Id. ¶ 18. Critically, the Rosenbach court expressly

22

observed that “Plaintiff did not allege in her complaint any harm or injury to a privacy right,” id.

23

¶ 20 n.1, and underscored that the “injury or adverse effect need not be pecuniary” to qualify a

24

person as “aggrieved” under BIPA. Id. ¶ 28. Facebook glosses over these essential parts of

25

Rosenbach to say it demands some undefined “actual” harm beyond injury to a privacy right, but

26

the better reading is Rosenbach would find that injury to a privacy right is enough to make a

27

person aggrieved under BIPA. As the Court has already found, there is no question that plaintiffs

28
9

1

here have sufficiently alleged that intangible injury. See, e.g., Dkt. No. 40 ¶ 17 (Facebook

2

“continues to violate millions of Illinois residents’ legal privacy rights”); id. ¶ 31.

3

This is enough to overcome Facebook’s objections based on its interpretation of

4

Rosenbach. To the extent Rosenbach might be read differently, the Court would part company

5

with it. To be sure, principles of comity and federalism counsel that federal courts should not

6

lightly disregard state court interpretations of state law. But as an intermediate court opinion,

7

Rosenbach is a non-binding data point for ascertaining Illinois law, and if “other persuasive data”

8

convinces the Court that the Illinois Supreme Court would decide otherwise, the Court need not

9

follow it. Am. Tower Corp. v. City of San Diego, 763 F.3d 1035, 1047 (9th Cir. 2014); Klein v.

10

United States District Court
Northern District of California

11

United States, 537 F.3d 1027, 1032 (9th Cir. 2008).
A considerable amount of “persuasive data” would indeed call into serious doubt an

12

intermediate court decision holding that BIPA requires “actual” injury beyond an invasion of

13

privacy. First and foremost is the plain language of BIPA itself. As the Illinois Supreme Court

14

has held, the “cardinal rule in interpreting a statute is to give effect to the intent of the legislature.”

15

People v. Fort, 88 N.E.3d 718, 723 (Ill. 2017) (internal citation omitted). The legislature’s intent

16

is best determined from the language of the statute itself, which should be read as a whole to

17

determine “its nature, its object and the consequences that would result from construing it one way

18

or the other.” Id. at 723-724 (internal quotations omitted); see also FDA v. Brown & Williamson

19

Tobacco Corp., 529 U.S. 120, 132-33 (2000) (“fundamental canon of statutory construction” to

20

define words in reference to “context” and “overall statutory scheme”) (quoting Davis v. Michigan

21

Dept. of Treasury, 489 U.S. 803, 809 (1989)).

22

These well-established canons of interpretation are crucial here, because a plain of reading

23

of BIPA “leave[s] little question that the Illinois legislature codified a right of privacy in personal

24

biometric information” rooted in “a long tradition of claims actionable in privacy law” and

25

extending to control over one’s data, independent of disclosure or misuse risks. Patel, 2018 WL

26

1050154, at *4. This intent cannot be squared with a construction of “aggrieved” that requires

27

some other “actual” injury, whatever that might be, particularly when deprivation of BIPA’s

28

notice and consent requirements amounts to the “precise harm the Illinois legislature sought to
10

1

prevent.” Id. Such a holding would be all the more questionable because the Illinois legislature

2

clearly knows how to condition a cause of action on actual injury simply by saying so in the

3

statute. See, e.g., 815 Ill. Comp. Stat. Ann. 505/10a (Illinois Consumer Fraud and Deceptive

4

Business Practices Act) (private right of action limited to person who suffers “actual” damage).

5

The legislature did not choose to say so in BIPA, and that choice must be given weight.

6

This statutory analysis would be enough on its own to turn away Facebook’s
characterization of Rosenbach. See Am. Tower, 763 F.3d at 1047 (text of statute alone is

8

persuasive data). Express precedent from the Illinois Supreme Court is another point of

9

persuasive data against it. The Illinois high court has determined that “aggrieved” parties under an

10

Illinois statute are those with a “direct, immediate and substantial interest rather than a speculative,

11
United States District Court
Northern District of California

7

theoretical, inconsequential or remote interest.” Am. Sur. Co. v. Jones, 384 Ill. 222, 230 (Ill.

12

1943). The Illinois Supreme Court made this determination in the context of an insurance statute,

13

but did not cabin its holding to that statute or the facts before it. Jones stands for the proposition

14

that, under Illinois law, an individual is “aggrieved” when “a legal right is invaded by the act

15

complained of.” Id. at 229-230 (quoting Glos v. People, 259 Ill. 332, 340 (Ill. 1913)).

16

Tellingly, Rosenbach omits any discussion of Jones, and Facebook also does not address it

17

in its papers. That is a concern because Jones is good law in Illinois and is actively cited today by

18

other federal courts and Illinois state courts, significantly in the BIPA context. See, e.g., Vigil v.

19

Take-Two Interactive Software, Inc., 235 F. Supp. 3d 499, 520 (S.D.N.Y. 2017) (citing Jones in

20

interpreting BIPA). A convincing construction of “aggrieved” in BIPA would need to account for

21

Jones, and not rely entirely, for example, on decisions from courts outside Illinois. See, e.g.,

22

Rosenbach, 2017 IL App (2d) 170317, ¶ 22 (citing Wisconsin decision).

23

An analysis of Jones is particularly important because a good argument can be made that

24

Facebook’s reading of Rosenbach is not consistent with it. Jones holds that a party is aggrieved

25

by an act that directly or immediately affects her legal interest. In contrast, Facebook portrays

26

Rosenbach as saying that the word “aggrieved” requires a plaintiff to affirmatively plead some

27

additional “actual injury” as an element of her claim, whatever that undefined extra harm might

28
11

1

be. Dkt. No. 285 at 10. This is a significantly more limited construction of “aggrieved” than

2

afforded by Jones, and the grounds on which it can be harmonized with Jones are not at all clear.

3

It is also worth noting that the facts in Rosenbach place it several steps away from this

4

case. In Rosenbach, the plaintiff’s son provided his thumbprint for scanning by the defendant.

5

Rosenbach, 2017 IL App (2d) 170317, ¶ 7. As the Spokeo order discussed, an express request for

6

a fingerprint scan is a far cry from the situation here, where plaintiffs plausibly argue that simply

7

using Facebook or reading Facebook’s user policy did not put them on notice that Facebook was

8

collecting their biometric data. See Patel, 2018 WL 1050154, at *5 (distinguishing fingerprinting

9

cases). Indeed, an Illinois trial court has applied Rosenbach to dismiss a BIPA case precisely
because the plaintiff expressly allowed defendants to take a fingerprint scan and so could not plead

11
United States District Court
Northern District of California

10

an invasion of privacy. Rottner v. Palm Beach Tan, Inc., et al., No. 15 CH 16695 (Ill. Cir. Ct.

12

Mar. 2, 2018) (available at Dkt. No. 315-1).
Consequently, if Rosenbach were to be read as Facebook urges, persuasive data convinces

13
14

the Court it would not be a good prediction of how the Illinois Supreme Court would interpret

15

“aggrieved” under BIPA. It follows that Facebook has not demonstrated on the basis of

16

Rosenbach that a predominance of individual inquiries would defeat class certification.
Facebook’s other commonality and predominance objections also pose no certification bar.

17
18

Facebook raises an “extraterritoriality” contention based on the assertion that its servers are not

19

located within Illinois. The parties agree that BIPA does not have extraterritorial reach because no

20

“clear intent in this respect appears from the express provisions of the statute,” Avery v. State

21

Farm Mut. Auto. Ins. Co., 216 Ill.2d 100, 185 (Ill. 2005), but disagree how that applies here.1
There is no genuine dispute that this case is deeply rooted in Illinois. The named plaintiffs

22
23

are located in Illinois along with all of the proposed class members, and the claims are based on

24

the application of Illinois law to use of Facebook mainly in Illinois. As the Court found in a prior

25

order, the case is properly governed by Illinois law pursuant to California choice of law principles,

26

In re Facebook Biometric Info. Privacy Litig., 185 F. Supp. 3d 1155, 1169 (N.D. Cal. 2016), and

27
1

28

Facebook raises a similar argument in its motion for summary judgment. The Court considers it
here with respect to certification only.
12

1

Facebook does not contest the application of Illinois law in opposing class certification. None of

2

the class members are non-residents suing under Illinois law, which is the paradigmatic situation

3

for the presumption against the extraterritorial application of local law. See, e.g., Avery, 216 Ill.2d

4

at 187. Facebook has not tendered any evidence to indicate that the circumstances relating to the

5

challenged conduct did not occur “primarily and substantially within” Illinois. Id. Class members

6

do not need to show more in order to sue under BIPA, particularly in light of BIPA’s express

7

concerns about data collection by “[m]ajor national corporations,” 740 Ill. Comp. Stat. Ann.

8

14/5(b). See Morrison v. Nat’l Australia Bank Ltd., 561 U.S. 247, 267 (2010) (territoriality

9

inquiry looks to the “objects of the statute’s solicitude”).

10

Contrary to Facebook’s suggestion, the geographic location of its data servers is not a

United States District Court
Northern District of California

11

dispositive factor. Server location may be one factor in the territoriality inquiry, but it is not the

12

exclusive one. As Avery cautions, “focusing solely on [only one circumstance] . . . can create

13

questionable results” where “the bulk of the circumstances . . . occur within Illinois.” Avery, 216

14

Ill.2d at 186; see also Rivera v. Google Inc., 238 F. Supp. 3d 1088, 1102 (N.D. Ill. 2017) (in BIPA

15

face scan context, even if “the scanning takes place outside of Illinois, that would not necessarily

16

be dispositive”). Avery’s warning is particularly apt here because the functionality and reach of

17

modern online services like Facebook’s cannot be compartmentalized into neat geographic boxes.

18

Making the geographic coordinates of a server the most important circumstance in fixing the

19

location of an Internet company’s conduct would yield the questionable results Avery counsels

20

against. Among other problematic outcomes, it would effectively gut the ability of states without

21

server sites to apply their consumer protection laws to residents for online activity that occurred

22

substantially within their borders. See Rocky Mountain Farmers Union v. Corey, 730 F.3d 1070,

23

1104 (9th Cir. 2013) (state cannot “impose its own regulatory standards on another jurisdiction”

24

but “may regulate with reference to local harms”). Correlatively, a single-minded focus on server

25

location would also potentially nationalize the consumer protection laws of states that host servers,

26

which in this case includes California. Both outcomes are fraught with unintended and

27

undesirable consequences.

28
13

1

Facebook also suggests that the claims of some class members may only be peripherally

2

related to Illinois. It says for example that some class members might have just moved to Illinois

3

with face templates created elsewhere. Dkt. No. 285 at 18. Maybe so, but Facebook does not

4

offer anything other than its own conjecture on this point, and mere “speculation” about class

5

variability “does not meet [defendant’s] burden of demonstrating that individual . . . issues

6

predominate.” Gutierrez v. Wells Fargo Bank, NA, 704 F.3d 712, 729 (9th Cir. 2012).
As a final contention, Facebook says that predominance cannot be found because

8

individualized inquiries may be necessary to determine which users’ face templates were derived

9

from scans of paper photographs. This too is unavailing. Assuming for discussion purposes only

10

that a class member’s claim could turn on whether an uploaded photograph was taken by a digital

11
United States District Court
Northern District of California

7

versus film camera, Facebook simply asserts with no accompanying evidence that “[m]any photos

12

uploaded to Facebook fit that description.” Dkt. No. 285 at 19. Conclusory allegations with no

13

support in the record will not defeat commonality and predominance. Brickman, 2017 WL

14

5569827, at *5.

15

C. Superiority

16

The closing consideration for certification is whether any fairness or practical case

17

management reasons count against it. “Rule 23(b)(3) requires that a class action be ‘superior to

18

other available methods for fairly and efficiently adjudicating the controversy,’ and it specifically

19

mandates that courts consider ‘the likely difficulties in managing a class action.’” Briseno v.

20

ConAgra Foods, Inc., 844 F.3d 1121, 1127-28 (9th Cir. 2017).

21

A class action is clearly superior to individual proceedings here. While not trivial, BIPA’s

22

statutory damages are not enough to incentivize individual plaintiffs given the high costs of

23

pursuing discovery on Facebook’s software and code base and Facebook’s willingness to litigate

24

the case. Just Film, 847 F.3d at 1123. The class will be manageable because members can be

25

identified in a straightforward way. Facebook has collected a wealth of data on its users, including

26

self-reported residency and IP addresses. See Dkt. No. 255 at 7. Facebook does not argue that

27

determining the location of Facebook users with face templates would be unduly difficult or

28

subject to significant uncertainty.
14

1

Facebook seems to believe that a class action is not superior because statutory damages

2

could amount to billions of dollars. Dkt. No. 285 at 20. To be sure, class certification may be

3

inappropriate where it would result in damages inconsistent with legislative intent. Bateman v.

4

Am. Multi-Cinema, Inc., 623 F.3d 708, 722-23 (9th Cir. 2010); Kline v. Coldwell, Banker & Co.,

5

508 F.2d 226, 235 (9th Cir. 1974). But the Illinois legislature knows how to speak clearly when it

6

wants to foreclose class actions. See, e.g., 35 Ill. Comp. Stat. 200/23-15(a) (“no complaint shall

7

be filed as a class action”). Facebook suggests that BIPA’s limitation of relief to “aggrieved”

8

persons bespeaks a reluctance to impose hefty penalties on non-compliant companies, but it offers

9

no evidence or cogent explanation in support of that claim, and to the extent it relies on
Rosenbach, the argument is rejected for the previously stated reasons. In addition, substantial

11
United States District Court
Northern District of California

10

damages are not a reason to decline class certification because it is within the Court’s discretion to

12

reduce a liquidated damages award to comport with due process at a later stage of the proceedings.

13

See, e.g., Six (6) Mexican Workers v. Arizona Citrus Growers, 904 F.2d 1301, 1309 (9th Cir.

14

1990).

15

CONCLUSION

16

The Court certifies a class of Facebook users located in Illinois for whom Facebook

17
18
19

created and stored a face template after June 7, 2011.
IT IS SO ORDERED.
Dated: April 16, 2018

20
21
JAMES DONATO
United States District Judge

22
23
24
25
26
27
28
15