Tibbs v. Arlo Technologies, Inc.

Background

Casey Tibbs, Andrew Castillo, and Eric Wilim sued Arlo Technologies, Inc. in a proposed class action under Illinois’s Biometric Information Privacy Act (BIPA). The plaintiffs alleged that Arlo’s home-security cameras capture geometric scans of delivery drivers’ faces, bodies, and hands in infrared and visible light when the drivers deliver food, mail, or packages to Illinois homes equipped with Arlo systems. They further alleged that Arlo uses and stores those scans for features including Person Detection.

The plaintiffs asserted two claims: violation of BIPA Section 15(b), which generally requires written notice of biometric-data collection and its purpose and a written release; and violation of Section 15(a), which requires a private entity possessing biometric data to maintain and publicly provide a retention schedule and destruction guidelines. The plaintiffs alleged that Arlo did not provide the required notice, obtain written releases, or publish the required retention policy.

Motions

Arlo moved to dismiss under Federal Rules of Civil Procedure 12(b)(1) and 12(b)(6). Rule 12(b)(1) concerns subject-matter jurisdiction, including constitutional standing. Rule 12(b)(6) tests whether the complaint states a legally sufficient claim. Arlo argued that the plaintiffs lacked standing for the Section 15(a) claim and that the allegations did not plausibly show that Arlo’s cameras captured the relevant scans, that the scans were BIPA-covered biometric identifiers, or that Arlo actively collected and possessed the data.

Arlo also argued that Section 15(b) should not apply because the collection was passive and because providing notice and obtaining consent from delivery drivers would be impractical. For Section 15(a), Arlo argued that it had a compliant public policy, that the plaintiffs were not sufficiently affected by any retention-policy violation, and that Arlo did not possess the data.

The plaintiffs separately moved to strike Arlo’s notice of supplemental authority. Arlo contended that the notice included improper argument beyond the citation and copy of a new decision allowed by the local rule. The plaintiffs disputed that characterization.

Court’s analysis

The court held that the plaintiffs adequately alleged Article III standing for Section 15(a). Relying on Ninth Circuit precedent, the court explained that BIPA protects concrete privacy interests, not merely procedural rights. The court found that the plaintiffs alleged more than a failure to publish a retention policy: they alleged that Arlo collected, used, and stored their biometric information without procedures designed to safeguard their privacy. Those allegations were sufficient at the pleading stage to allege a concrete and particularized injury.

The court also found the allegations sufficient to support the BIPA claims. Although the plaintiffs could not identify which Illinois homes had Arlo cameras with the relevant features, the court concluded that their allegations presented a plausible account that they were scanned while making deliveries to Illinois homes. The court accepted, for purposes of the motion to dismiss, the allegations that Arlo’s technology maps facial geometry and that the scans can identify particular individuals. The court therefore found that the alleged scans could qualify as BIPA-covered scans of hand or face geometry.

For Section 15(b), the court rejected Arlo’s argument that it did not actively collect the data. The complaint alleged that Arlo’s cameras scan visitors’ faces, bodies, and hands, that Arlo stores the scans in an electronic database, and that Arlo uses them for security features. The court also rejected Arlo’s argument that notice and consent were impractical because the Ninth Circuit had rejected that reasoning in a later decision discussed by the court.

For Section 15(a), the court concluded that Arlo’s cited policy did not address biometric identifiers or biometric information and therefore did not establish that Arlo complied with the statutory retention-policy requirement. The court also concluded that the plaintiffs had adequately alleged that they were affected by the violation and that Arlo possessed the data because the complaint alleged that Arlo stored and accessed the biometric information for its Person Detection feature.

Regarding the motion to strike, the court found that the plaintiffs’ notice violated the local rule because it included more than the permitted citation and copy of the decision. Nevertheless, the court exercised its discretion to treat the filing as compliant and considered only the attached decision, not the additional text. It therefore denied both Arlo’s request to refuse consideration of the supplemental authority and Arlo’s alternative request for permission to file a response.

Disposition

Judge Edward J. Davila ordered that: (1) Arlo’s motion to strike the supplemental authority, or alternatively to file a response, was DENIED; (2) Arlo’s motion to dismiss the Section 15(a) claim for lack of standing was DENIED; and (3) Arlo’s motion to dismiss both BIPA claims for failure to state a claim was DENIED. The court ordered Arlo to file an answer within 14 days and stated that it would separately set an initial case-management conference. The order addressed the sufficiency of the pleadings and standing; it did not determine whether Arlo ultimately violated BIPA.