Zellmer v. Facebook, Inc.

Background

Clayton P. Zellmer brought one claim under the Illinois Biometric Information Privacy Act (BIPA) on behalf of himself and a proposed class of Illinois residents who did not have and had never had Facebook accounts and had never used Facebook’s services. The claim concerned Facebook’s former facial-recognition “tagging” functionality, which scanned faces in photographs uploaded to Facebook and associated them with other scanned faces to automatically tag users, friends, and other recognized individuals.

Zellmer alleged that Facebook violated BIPA Sections 15(a) and 15(b). Section 15(a) requires a private entity possessing biometric identifiers or biometric information to make public a written policy establishing a retention schedule and guidelines for destruction. Section 15(b) generally requires written notice about the collection or storage of biometric information, written notice of the purpose and duration of that activity, and a written release from the person whose biometric information is involved.

Facebook moved for summary judgment. The court stated that summary judgment is appropriate when there is no genuine dispute about a material fact and the moving party is entitled to judgment under the law. The court ruled on the motion in part and denied it in part.

Section 15(b) Notice-and-Consent Claim

The court granted summary judgment in Facebook’s favor on the Section 15(b) portion of Zellmer’s claim. It concluded that it would be unreasonable to interpret BIPA as requiring Facebook to provide notice to and obtain consent from non-users who were, for practical purposes, complete strangers to Facebook and had no relationship with it.

The court applied Illinois principles of statutory interpretation, including considering the statutory language, the law as a whole, the legislature’s purpose, and whether an interpretation would produce absurd or unreasonable results. It viewed BIPA’s references to interactions between businesses and customers as showing that the legislature contemplated at least some known contact between the entity collecting biometric information and the affected person. The court also noted that BIPA regulated biometric use rather than banning it altogether.

The court distinguished its earlier rulings concerning Facebook users, for whom Facebook had a direct relationship and access to contact information. Zellmer and the proposed class, by contrast, were defined as unknown to Facebook. The court said Zellmer did not explain how BIPA could reasonably apply in that situation. It also found that his proposed methods for providing notice—such as using Facebook users as representatives or requiring photo uploaders to obtain written permission from every person shown in a photograph—created serious practical problems and did not fit the statute’s language.

The court emphasized that this ruling was based on the specific record before it and might not apply in other circumstances.

Section 15(a) Data-Retention-Policy Claim

The court denied summary judgment on the Section 15(a) portion of Zellmer’s claim. Facebook did not say that it had a publicly available written policy establishing the required retention schedule and related practices. Instead, Facebook sought judgment based on factual arguments that it did not possess biometric identifiers or biometric information covered by BIPA.

The parties disputed what Facebook’s facial-recognition system produced and whether that data constituted scans of face geometry. They also disputed whether Facebook’s “face signatures” could identify non-users. Facebook presented evidence that face signatures were useless for identifying unknown faces because they could be used only with Facebook’s existing face templates; Zellmer contended that the evidence showed otherwise.

The court characterized these as material factual disputes requiring a trial. It therefore denied Facebook’s request for summary judgment on Section 15(a).

Disposition and Next Steps

The court had previously stayed and administratively closed the case. It ordered that the case be reopened and set a status conference for May 26, 2022, at 10:00 a.m. in Courtroom 11 in San Francisco. The parties were ordered to file a joint case-management statement by May 19, 2022. The court directed them to be prepared to discuss whether the absence of a Section 15(a) policy would constitute one violation warranting one damages award or support another remedy.