Delgado v. Meta Platforms, Inc.

Background

Natalie Delgado alleges that Meta Platforms, Inc., which operates Facebook and Messenger, collected her voiceprint without complying with the Illinois Biometric Information Privacy Act, or BIPA. She filed a proposed class action on behalf of herself and Illinois residents from whom Meta allegedly created, collected, captured, received, obtained, or stored digital voice information. She seeks statutory damages, an injunction, and attorneys’ fees and costs.

Meta moved to dismiss under Federal Rule of Civil Procedure 12(b)(6), which allows dismissal when a complaint does not plausibly state a claim for relief. Meta argued that California law governed under the Facebook and Messenger terms of service; that Delgado alleged only the collection of voice recordings, not voiceprints; and that her claims under BIPA Sections 15(c) and 15(e) were inadequately pleaded.

Choice of Law

The court applied California’s choice-of-law rules because the case was in federal court based on diversity jurisdiction and the parties agreed that California rules governed the choice-of-law analysis. The court concluded that applying California law would conflict with Illinois’s fundamental policy of protecting its residents’ biometric privacy. It also concluded that Illinois had a materially greater interest in the dispute. The court therefore applied Illinois law to Delgado’s claims.

Voiceprint Allegations

The court held that Delgado plausibly alleged that Meta collected her voiceprint. The complaint described Meta patents concerning technology that analyzes voices and creates digital voiceprints, Meta’s privacy notice stating that voice recordings may be used to identify users, and alleged methods by which Meta captured, processed, and stored voice data. At the motion-to-dismiss stage, the court treated the complaint’s factual allegations as true and drew reasonable inferences in Delgado’s favor.

The court also concluded that Delgado did not need to allege that Meta actually used her voice data to identify her. The court relied on decisions interpreting “voiceprint” as data unique to an individual that could be used for identification. It further found that Delgado’s allegations concerning collection through other Facebook or Messenger users and third parties were sufficient at that stage. Whether Meta actually used the technology described in its patents, and whether those patents concerned Facebook or Messenger, were factual questions for a later stage.

Section 15(c) Claim

Section 15(c) prohibits a private entity possessing biometric data from selling, leasing, trading, or otherwise profiting from it. The court explained that the provision generally requires both sharing or providing access to biometric data and receiving something of value in return.

The court found Delgado’s allegations insufficient. She alleged that Meta used voice-recognition technology and biometric data to improve its products, provide targeted content and advertising, and create business opportunities. But she did not allege facts showing that Meta created a product from her biometric data, marketed a product containing it, or incorporated her voiceprint into its technology so that selling the technology necessarily sold access to her data. The court therefore granted the motion to dismiss the Section 15(c) claim, with leave to amend. The court also noted that the parties had not briefed Article III standing and stated that Delgado could add allegations addressing standing in an amended complaint.

Section 15(e) Claim

Section 15(e) requires a private entity to store, transmit, and protect biometric information using reasonable industry care and protections at least as strong as those used for other confidential information.

The court found Delgado’s allegations conclusory and insufficient to identify the conduct being challenged. The complaint alleged that Meta had been subject to cyberattacks, expected future intrusions, and might not discover every intrusion, but it did not explain how Meta stored biometric data or how its practices failed to meet the required standard of care. The court therefore granted the motion to dismiss the Section 15(e) claim, with leave to amend.

Disposition

The court granted in part and denied in part Meta’s motion to dismiss. The Section 15(c) and Section 15(e) claims were dismissed, with leave to amend. The balance of the motion was denied. The court ordered that any amended complaint be filed no later than March 15, 2024.