Nimesh Patel, Individually and on Behalf of All Others Similarly Situated; Adam Pezen; Carlo Licata, Plaintiffs-Appellees,
Facebook, Inc., Defendant-Appellant.
and Submitted June 12, 2019 San Francisco, California
from the United States District Court for the Northern
District of California James Donato, District Judge,
Presiding D.C. No. 3:15-cv-03747-JD
R. Goldman (argued), Andrew J. Pincus, and Michael Rayfield,
Mayer Brown LLP, New York, New York, for Defendant-Appellant.
Aaron Lawson (argued) and Rafey S. Balabanian, Edelson PC,
San Francisco, California; Susan K. Alexander and Shawn A.
Williams, Robbins Geller Rudman & Dowd LLP, San
Francisco, California; Michael P. Canty and Corban S. Rhodes,
Labaton Sucharow LLP, New York, New York; for
Fahringer and Nicola Menaldo, Perkins Coie LLP, Seattle,
Washington; Neal Kumar Katyal, Hogan Lovells U.S. LLP,
Washington, D.C.; Lauren Ruben, Perkins Coie LLP, Denver,
Colorado; Thomas P. Schmidt, Hogan Lovells U.S. LLP, New
York, New York; Sara Solow, Hogan Lovells U.S. LLP,
Philadelphia, Pennsylvania; for Amicus Curiae Internet
Freed Wessler, American Civil Liberties Union, New York, New
York; Rebecca K. Glenberg, Roger Baldwin Foundation of ACLU,
Chicago, Illinois; Jacob A. Snow, American Civil Liberties
Union Foundation of Northern California, San Francisco,
California; Jennifer Lynch and Adam Schwartz, Electronic
Frontier Foundation, San Francisco, California; Joseph
Jerome, Center for Democracy & Technology, Washington,
D.C.; Michael C. Landis, Illinois PIRG Education Fund Inc.,
Chicago, Illinois; for Amici Curiae American Civil Liberties
Union, American Civil Liberties Union of Illinois, American
Civil Liberties Union Foundation of Northern California,
American Civil Liberties Union Foundation of Southern
California, Center for Democracy & Technology, Electronic
Frontier Foundation, and Illinois PIRG Education Fund Inc.
Rotenberg, Alan Butler, and John Davisson, Electronic Privacy
Information Center, Washington, D.C., for Amicus Curiae
Electronic Privacy Information Center (EPIC).
P. Dunbar, Reginald J. Brown, Patrick J. Carome, Jonathan G.
Cedarbaum, and Samuel M. Strongin, Wilmer Cutler Pickering
Hale and Dorr LLP, Washington, D.C.; Steven P. Lehotsky and
Jonathan D. Urick, U.S. Chamber Litigation Center,
Washington, D.C.; for Amicus Curiae Chamber of Commerce of
the United States of America.
Before: Ronald M. Gould and Sandra S. Ikuta, Circuit Judges,
and Benita Y. Pearson, [*] District Judge.
/ Class Certification / Illinois Law
panel affirmed the district court's order certifying a
class under Fed.R.Civ.P. 23 of users of Facebook, Inc., who
alleged that Facebook's facial-recognition technology
violated Illinois's Biometric Information Privacy Act
panel held that plaintiffs alleged a concrete and
particularized harm, sufficient to confer Article III
standing, because BIPA protected the plaintiffs' concrete
privacy interest, and violations of the procedures in BIPA
actually harmed or posed a material risk of harm to those
privacy interests. Specifically, the panel concluded that the
development of a face template using facial-recognition
technology without consent (as alleged in this case) invades
an individual's private affairs and concrete interests.
panel held that the district court did not abuse its
discretion in certifying the class. Specifically, the panel
rejected Facebook's argument that Illinois's
extraterritoriality doctrine precluded the district court
from finding predominance. The panel further held that the
district court did not abuse its discretion in determining
that a class action was superior to individual actions in
complaint alleges that Facebook subjected them to
facial-recognition technology without complying with an
Illinois statute intended to safeguard their privacy. Because
a violation of the Illinois statute injures an
individual's concrete right to privacy, we reject
Facebook's claim that the plaintiffs have failed to
allege a concrete injury-in-fact for purposes of Article III
standing. Additionally, we conclude that the district court
did not abuse its discretion in certifying the class.
operates one of the largest social media platforms in the
world, with over one billion active users. Packingham v.
North Carolina, 137 S.Ct. 1730, 1735 (2017). About seven
in ten adults in the United States use
new user registers for a Facebook account, the user must
create a profile and agree to Facebook's terms and
conditions, which permit Facebook to collect and use data in
accordance with Facebook's policies. To interact with
other users on the platform, a Facebook user identifies
another user as a friend and sends a friend request. If the
request is accepted, the two users are able to share content,
such as text and photographs.
years, Facebook has allowed users to tag their Facebook
friends in photos posted to Facebook. A tag identifies the
friend in the photo by name and includes a link to that
friend's Facebook profile. Users who are tagged are
notified of the tag, granted access to the photo, and allowed
to share the photo with other friends or "un-tag"
themselves if they choose.
2010, Facebook launched a feature called Tag Suggestions. If
Tag Suggestions is enabled, Facebook may use
facial-recognition technology to analyze whether the
user's Facebook friends are in photos uploaded by that
user. When a photo is uploaded, the technology scans the
photo and detects whether it contains images of faces. If so,
the technology extracts the various geometric data points
that make a face unique, such as the distance between the
eyes, nose, and ears, to create a face signature or map. The
technology then compares the face signature to faces in
Facebook's database of user face templates (i.e., face
signatures that have already been matched to the user's
profiles). If there is a match between the face
signature and the face template, Facebook may suggest tagging
the person in the photo.
face templates are stored on its servers, which are located
in nine data centers maintained by Facebook. The six data
centers located in the United States are in Oregon,
California, Iowa, Texas, Virginia, and North Carolina.
Facebook's headquarters are in California.
users living in Illinois brought a class action against
Facebook, claiming that Facebook's facial-recognition
technology violates Illinois law. Class representatives Adam
Pezen, Carlo Licata, and Nimesh Patel each live in Illinois.
They joined Facebook in 2005, 2009, and 2008, respectively,
and each uploaded photos to ...