Sosa v. Onfido, Inc.

• Decision Date: 25 April 2022
• Docket Number: 20-cv-4247
• Citation: 600 F.Supp.3d 859
• Parties: Fredy SOSA, individually and on behalf of all others similarly situated, Plaintiff, v. ONFIDO, INC., Defendant.
• Court: U.S. District Court — Northern District of Illinois

600 F.Supp.3d 859

Fredy SOSA, individually and on behalf of all others similarly situated, Plaintiff,

v.ONFIDO, INC., Defendant.

No. 20-cv-4247

United States District Court, N.D. Illinois, Eastern Division.

Signed April 25, 2022

Benjamin Harris Richman, J. Eli Wade Scott, Schuyler Ufkes, Edelson PC, Chicago, IL, for Plaintiff.

Amy Lynn Lenz, Bonnie Keane DelGobbo, Baker & Hostetler LLP, Chicago, IL, Joel Griswold, Baker & Hostetler, LLP, Orlando, FL, Paul G. Karlsgodt, Baker & Hostetler LLP, Denver, CO, for Defendant.

MEMORANDUM OPINION AND ORDER

MARVIN E. ASPEN, District Judge:

Defendant Onfido, Inc. ("Onfido") moves to dismiss Plaintiff Fredy Sosa's Complaint under Federal Rule of Civil Procedure 12(b)(6). (See Defendant's Rule 12(b)(6) Motion to Dismiss ("Mot.") (Dkt. No. 45); Defendant's Memorandum of Law in Support of Its Rule 12(b)(6) Motion to Dismiss for Failure to State a Claim ("Mem.") (Dkt. No. 46).)¹ For the following reasons, we deny Onfido's motion.

FACTUAL BACKGROUND

We take the following facts from the Complaint, "documents attached to the [Complaint], documents that are critical to the [Complaint] and referred to in it, [ ] information that is subject to proper judicial notice[,]" and any additional facts set forth in Sosa's response, "so long as those facts are consistent with the pleadings."

Phillips v. Prudential Ins. Co. of Am. , 714 F.3d 1017, 1019–20 (7th Cir. 2013) (quotation marks omitted). We have accepted as true all well-pleaded factual allegations and drawn all reasonable inferences in Sosa's favor. O'Brien v. Vill. of Lincolnshire , 955 F.3d 616, 621 (7th Cir. 2020).

Onfido, a Delaware corporation with its principal place of business in England,² markets and sells proprietary facial recognition software that is used by online businesses to verify consumers’ identities. (Class Action Complaint and Demand for Jury Trial ("Compl.") (Dkt. No. 1-1) ¶¶ 1, 2, 9.) To verify a consumer's identity using Onfido's software, the consumer first uploads a copy of his or her identification and a photograph of his or her face. (Id. ¶ 22.) Onfido's software then scans the identification and photograph to locate the facial images on each document; extracts a unique numerical representation of the shape or geometry of each facial image, which is often called a "faceprint"; compares the faceprints from the consumer's identification and photograph; and generates a score based on the similarity of the faceprints. (See id. ¶¶ 2, 23, 24, 41; Plaintiff's Response to Defendant's Motion to Dismiss ("Resp.") (Dkt. No. 49) at 3.) Onfido's software also can compare the faceprints obtained from a consumer's identification or photograph with other biometric data in Onfido's database, such as the biometric data of known masks or other consumers’ photographs. (Compl. ¶¶ 2, 25, 27.) Online businesses can integrate Onfido's software into their products and mobile apps in such a way that consumers seeking to verify their identities likely do not know that they are interacting with and providing their sensitive information to Onfido, a third party. (Id. ¶¶ 3, 4, 21.)

Sosa, an Illinois citizen, is a member of OfferUp, an online marketplace that partnered with Onfido to verify its users’ identities using Onfido's software. (Id. ¶¶ 8, 33, 34); Sosa v. Onfido , 8 F.4th 631, 634–35 (7th Cir. 2021). In April 2020, Sosa verified his identity with OfferUp by using OfferUp's mobile application to "upload[ ] a photograph of his driver's license and a photograph of his face." (Compl. ¶ 35); Sosa , 8 F.4th at 635. Onfido used its software to scan Sosa's face, extract Sosa's faceprints, and compare the two photographs. (Compl. ¶ 35; Resp. at 3.) "Onfido then kept Sosa's unique faceprint in a database and accessed it every time another person used Onfido's verification process." (Resp. at 3.)

Onfido did not inform "Sosa that it would collect, store, or use his biometric identifiers derived from his face," and Sosa never signed a written release allowing Onfido to do so. (Compl. ¶¶ 36, 38.) Nor did Onfido inform Sosa about a biometric data retention policy or whether it would "ever permanently delete the biometric identifiers derived from his face." (Id. ¶ 37.) In fact, "there was almost no notice whatsoever that Onfido [was] even involved in the process." (Id. ¶ 36.)

PROCEDURAL HISTORY

Sosa filed suit against Onfido in the Circuit Court of Cook County, Illinois, alleging that Onfido violated Illinois's Biometric Information Privacy Act ("BIPA"), 740 Ill. Comp. Stat. 14/1 et seq. (See generally Compl.) Sosa seeks to represent himself and a putative class of Illinois residents "who had their biometric identifiers or biometric information, including faceprints, collected, captured, received, otherwise obtained, or disclosed by Onfido while residing in Illinois." (Id. ¶ 41.) Sosa alleges that Onfido violated sections 15(a) and 15(b) of BIPA and requests, on behalf of himself and the putative class, (1) injunctive and equitable relief that requires Onfido to comply with "BIPA's requirements for the collection, storage, and use of biometric identifiers and biometric information"; (2) "liquidated damages of $5,000 for each willful and/or reckless violation" of BIPA or, alternatively, "liquidated damages of $1,000 for each negligent violation" of BIPA; and (3) "reasonable attorneys’ fees, costs, and expenses." (Id. ¶¶ 47–49, 53–56, 58.)

Onfido removed Sosa's lawsuit to this Court based on diversity jurisdiction and the Class Action Fairness Act ("CAFA").³ (Notice of Removal (Dkt. No. 1) at 3–9.) Onfido then filed a motion to compel arbitration. (Dkt. No. 20.) We denied Onfido's motion (Dkt. No. 31), and the Seventh Circuit affirmed our decision. Sosa , 8 F.4th at 634–35. After the case returned to us from the Seventh Circuit, Onfido moved to dismiss Sosa's Complaint under Rule 12(b)(6) arguing, among other things, that BIPA violates the United States Constitution's First Amendment. (See Mot. at 1.) Because Onfido's motion challenged the constitutionality of a state statute, we gave Illinois the opportunity to intervene and defend BIPA's constitutionality (Dkt. No. 50), but it has declined to do so. We also directed the parties to submit supplemental briefing regarding Sosa's standing to assert that Onfido violated section 15(a) of BIPA, which the parties have done. (See Dkt. Nos. 52, 54, 55.) Onfido's motion to dismiss is now ripe for decision.

LEGAL STANDARD

A motion to dismiss under Rule 12(b)(6) challenges the sufficiency of the complaint, not its merits. Gibson v. City of Chicago , 910 F.2d 1510, 1520 (7th Cir. 1990). In considering a Rule 12(b)(6) motion, we accept as true all well-pleaded facts in the plaintiff's complaint and draw all reasonable inferences in the plaintiff's favor. Kubiak v. City of Chicago , 810 F.3d 476, 480–81 (7th Cir. 2016). To survive a Rule 12(b)(6) motion, the complaint must assert a facially plausible claim and provide fair notice to the defendant of the claim's basis.

Ashcroft v. Iqbal , 556 U.S. 662, 678, 129 S. Ct. 1937, 1949, 173 L.Ed.2d 868 (2009) ; Bell Atl. Corp. v. Twombly , 550 U.S. 544, 555, 127 S. Ct. 1955, 1964, 167 L.Ed.2d 929 (2007) ; Adams v. City of Indianapolis , 742 F.3d 720, 728–29 (7th Cir. 2014). A claim is facially plausible "when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Iqbal , 556 U.S. at 678, 129 S. Ct. at 1949. "If the well-pleaded allegations plausibly suggest—as opposed to possibly suggest—that the plaintiff[ ] [is] entitled to relief, the case enters discovery." Alarm Detection Sys., Inc. v. Vill. of Schaumburg , 930 F.3d 812, 821 (7th Cir. 2019).

ANALYSIS

In response to growing public concern about the increased commercial use of biometric data, the Illinois General Assembly enacted BIPA in 2008 "to help regulate ‘the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information.’ " Cothron v. White Castle Sys., Inc. , 20 F.4th 1156, 1159 (7th Cir. 2021) ; Rosenbach v. Six Flags Ent. Corp. , 2019 IL 123186, ¶ 19, 432 Ill.Dec. 654, 129 N.E.3d 1197, 1203 (quoting 740 Ill. Comp. Stat. 14/5(g) ). To that end, section 15 of BIPA "imposes on private entities ... various obligations regarding the collection, retention, disclosure, and destruction of biometric identifiers and biometric information." Rosenbach , 2019 IL 123186, ¶ 20, 129 N.E.3d at 1203. Section 20, in turn, "provides a right of action for persons aggrieved by a violation" of section 15, as well as remedies for any such violations. Fox v. Dakkota Integrated Sys., LLC , 980 F.3d 1146, 1148 (7th Cir. 2020) ; Bradenberg v. Meridian Senior Living, LLC , 564 F.Supp.3d 627, 634 (C.D. Ill. 2021).

Onfido's arguments for dismissal require us to address the scope and meaning of sections 15 and 20 of BIPA, as well as whether BIPA runs afoul of the United States Constitution. Before we can reach these arguments, however, we must assure ourselves that Sosa has standing to maintain his lawsuit in this Court. See Persinger v. Sw. Credit Sys., L.P. , 20 F.4th 1184, 1189 (7th Cir. 2021) (addressing "the jurisdictional question of whether [the plaintiff] has standing to sue" before addressing the merits of the case).

I. Standing

" Article III of the Constitution limits the jurisdictional reach of the federal courts to ‘Cases’ and ‘Controversies.’ " Cothron , 20 F.4th at 1160 (quoting U.S. Const. art. III, § 2). "Essential to this limitation is the requirement that a plaintiff have standing to sue in federal court." Id. The party invoking federal jurisdiction bears the burden of demonstrating the plaintiff's standing to sue under Article III. Bryant v. Compass Grp. USA, Inc. , 958 F.3d 617, 620 (7th Cir. 2020). Onfido bears that burden here because it removed Sosa's case from state court. Fox , 980 F.3d at 1151.

"At the pleading stage, standing requires allegations of a concrete and...