Google’s BIPA extraterritoriality dismissal provides key lessons

By David J. Oberly, Biometric Privacy & Data Privacy Attorney

Utilizing a successful extraterritoriality challenge, Google was recently able to procure the dismissal of an Illinois Biometric Information Privacy Act (BIPA) class action lawsuit claiming it used a training dataset containing individuals’ biometric data for purposes of improving its facial recognition technologies in violation of the Illinois statute.

The training data, known as the Diversity in Faces Dataset (DiF Dataset), entails a large collection of biometric data that was created through the use of publicly-available photos. Google subsequently acquired the DiF Dataset to improve and enhance its array of biometric-powered products and services. Two individuals whose biometric data was encompassed within the DiF Dataset sued Google, alleging that it acquired the DiF Dataset without their consent, and thereafter profited from it, in violation of BIPA.

Google moved to dismiss the BIPA claims, arguing that Illinois’s extraterritoriality doctrine necessitated dismissal because the plaintiffs did not, and could not, allege that it engaged in any conduct in Illinois. The court agreed, finding the complaint contained insufficient facts to establish a connection to the forum, resulting in dismissal of the BIPA claims under Civil Rule 12(b)(6).

The case is Vance v. Google LLC, No. 20 CV 4696, 2024 WL 1141007 (N.D. Cal. Mar. 15, 2024).

Analysis

The Vance decision provides key insight into the scope and contours of Illinois’s extraterritoriality doctrine as a defense in BIPA class action litigation.

Under the extraterritoriality doctrine, BIPA violations must occur in Illinois for plaintiffs to obtain relief. The applicable test is whether the circumstances that relate to the dispute “occurred primarily and substantially” in Illinois. The Illinois Supreme Court has made clear that courts do not apply a bright-line rule for determining whether the alleged conduct occurred in Illinois. Instead, they must consider the “totality of the circumstances” when analyzing an extraterritoriality challenge.

Prior to Vance, only one other BIPA class action—McGoveran v. Amazon Web Servs., Inc., No. 20 CV 1399, 2021 WL 4502089 (D. Del. Sept. 30, 2022)—had been dismissed on extraterritoriality grounds at the pleading stage. Outside of this single outlier, however, attempts by defendants to procure the early dismissal of BIPA class disputes based on Illinois’s extraterritoriality doctrine have fared unsuccessful time and time again. This is due, in large part, to courts reasoning that because application of the extraterritoriality doctrine is fact-intensive, the issue is better resolved at summary judgment.

So what is the dividing line between Vance and McGoveran, and those other BIPA decisions that rejected pleading-stage extraterritoriality challenges? Ultimately, it is the extent of the allegations asserted by a plaintiff that the defendant engaged in conduct relating to the dispute in Illinois that is the decisive factor as to whether a defendant can prevail in challenging BIPA claims at the pleading stage based on this defense.

For example, in McGoveran, the court reasoned that dismissal was appropriate because the plaintiffs identified nothing in their complaint to suggest that their biometric data was created, possessed, or stored in Illinois. At most, the plaintiff’s allegations regarding the dispute’s connections to Illinois amounted to nothing more than repeated statements, phrased differently, regarding their residency. This fell short of indicating a “sufficient nexus” to Illinois that could allow the plaintiffs to avoid dismissal on extraterritoriality grounds. Moreover, the complaint was devoid of any allegations to suggest any direct interaction between the plaintiffs and the defendants that could be plausibly imputed to Illinois. Together, the absence of any allegations suggesting that the conduct at issue took place “primarily and substantially” in Illinois necessitated dismissal on extraterritoriality grounds.

Similarly, the Vance court held that dismissal was appropriate because complaint contained only limited allegations linking the events giving rise to the suit and Illinois—all of which were tied solely to the plaintiffs’ Illinois residency. Moreover, and similar to McGoveran, there was an absence of “any indication” in the complaint that the defendant “did anything” in Illinois to tie it to the state. Specifically, the complaint did not contain any allegations that Google:

• processed, stored, or otherwise made use of the plaintiffs’ biometric data in Illinois; or
• interacted with the plaintiffs or any other individuals or entities in Illinois to obtain or otherwise utilize the plaintiffs’ biometric data.

Together, because complaint lacked any allegations of any direct interaction on the part of Google that could plausibly link the company to Illinois, the Vance plaintiffs’ BIPA claims were dismissed on extraterritoriality grounds.

Practical tips and strategies

Extraterritoriality defense

Vance and McGoveran demonstrate how Illinois’s extraterritoriality doctrine can be leveraged to facilitate the dismissal of BIPA class actions at an early juncture—and before the commencement of costly discovery. Of note, this defense is particularly relevant to biometric technology developers and suppliers, as these entities oftentimes maintain no type of direct connection with Illinois whatsoever—but instead only provide biometric solutions to their customers, who then interact with end users located in Illinois.

In the event a company finds itself named as a defendant in a BIPA class action, it—along with experienced outside biometrics counsel—should thoroughly evaluate the complaint’s allegations to determine whether extraterritoriality can be used as a vehicle to procure dismissal through motion practice attacking the initial pleading. As a general rule, the extraterritoriality defense may be in play where the complaint lacks any allegations to suggest a direct connection between the defendant and the Prairie State.

In evaluating the applicability of this defense, complaints should be reviewed with a particularly close eye for any allegations pleaded on “information and belief,” as these allegations are, in many instances, insufficient as a matter of law to establish a connection between a defendant and Illinois that would otherwise defeat an extraterritoriality challenge.

To satisfy applicable pleading standards, a plaintiff that asserts allegations on “information and belief” must show that the relevant facts are within the exclusive possession and control of the defendant. Importantly, however, where a complaint does not provide any indication that the defendant alone maintains possession of those facts pleaded on “information and belief” relating to a purported connection with Illinois, such allegations—characterized as “rank speculation”—must be disregarded by a court in ruling on a motion to dismiss.

Oftentimes, after stripping away these flawed “information and belief” allegations, a complaint is left without any plausible allegations to suggest any direct interaction involving the defendant that could be imputed to Illinois and, in turn, defeat an extraterritoriality challenge—leaving a viable path for the defendant to prevail on an extraterritoriality challenge and, in turn, obtain the dismissal of the BIPA suit in its entirety.

Personal jurisdiction defense

In addition, companies should remain mindful of the fact that where extraterritoriality appears to be a viable defense to BIPA claims, lack of personal jurisdiction may also be available as a second path for procuring the dismissal of BIPA class action suits. This is because both defenses hinge on the lack of any concrete ties between the defendant and Illinois.

In particular, where a company is neither incorporated, nor maintains its principal place of business, in Illinois, the plaintiff must establish specific personal jurisdiction to avoid dismissal of the suit. The Seventh Circuit Court of Appeals has stated that specific personal jurisdiction exists when the defendant “purposely directs activities” at the forum state and “the alleged injury arises out of those activities.” In many instances, where a company can establish that it does not directly target Illinois residents with advertising or marketing of its products or services, it may be able to mount a successful challenge to BIPA claims based on the personal jurisdiction defense.

Conclusion

Companies that develop, supply, or use biometric technologies in their commercial operations should expect to see a continued high volume of BIPA class action filings for the foreseeable future. Importantly, however—as discussed above—extraterritoriality and personal jurisdiction challenges can serve as powerful tools to defeat BIPA class action lawsuits involving defendants that lack any genuine ties to the state of Illinois.

About the author

David J. Oberly is Of Counsel in the Washington, D.C. office of Baker Donelson, and a member of the firm’s Biometric Privacy, Artificial Intelligence, and Data Protection, Privacy & Cybersecurity practices. Recognized as “one of the nation’s foremost thought leaders in the biometric privacy space” by LexisNexis, David’s practice focuses on counseling and advising clients on a wide range of biometric privacy, artificial intelligence, and data privacy/security compliance and risk management matters. In addition, David has deep experience in litigating bet-the-company BIPA class action disputes. He is also the author of Biometric Data Privacy Compliance & Best Practices—the first and only full-length treatise of its kind to provide a comprehensive compendium of biometric privacy law. He can be reached at doberly@bakerdonelson.com. You can follow David on X at @DavidJOberly.

DISCLAIMER: Biometric Update’s Industry Insights are submitted content. The views expressed in this post are that of the author, and don’t necessarily reflect the views of Biometric Update.

Article Topics

biometric data  |  Biometric Information Privacy Act (BIPA)  |  dataset  |  David Oberly  |  face biometrics  |  Google  |  lawsuits  |  training