Wood, Circuit Judge.

Daniel Martin Feeney, Attorney, MILLER, SHAKMAN LEVINE & FELDMAN LLP, Kevin M. Forde, Attorney, Chicago, IL, David S. Golub, Attorney, SILVER GOLUB & TEITELL, Stamford, CT, for Plaintiffs - Appellees.

Clifford Berlow, Attorney, David P. Saunders, Attorney, Howard S. Suskin, Attorney, JENNER & BLOCK LLP, Chicago, IL, Lee S. Wolosky, Attorney, Andrew J. Lichtman, Attorney, JENNER & BLOCK LLP, Floyd Abrams, Attorney, Joel Kurtzberg, Attorney, CAHILL, GORDON & REINDEL, New York, NY, for Defendant - Appellant.

Before Easterbrook, Wood, and Hamilton, Circuit Judges.

Wood, Circuit Judge. Illinois's Biometric Information Privacy Act, familiarly known as BIPA, provides robust protections for the biometric information of Illinois residents. See 740 ILCS 14/1 et seq . It does so by regulating the collection, retention, disclosure, and destruction of biometric identifiers or information—for example, retinal scans, fingerprints, or facial geometry. In recent years, the use of biometric data has exploded. Predictably, that development has been followed by a spate of litigation testing the limits of the law's protections. Not all of those cases, however, have proven to be justiciable in federal court: some plaintiffs have failed to demonstrate that they have standing to sue as required by Article III of the Constitution.

The question now before us is whether, on the allegations of the operative complaint, the plaintiffs—Melissa Thornley and others, on behalf of themselves and a proposed class—have shown standing. (For convenience, we refer only to Thornley, unless the context requires otherwise.) Oddly, Thornley insists that she lacks standing, and it is the defendant, Clearview AI, Inc., that is championing her right to sue in federal court. That peculiar line-up exists for reasons that only a civil procedure buff could love: the case started out in an Illinois state court, but Clearview removed it to federal court. Thornley wants to return to state court to litigate the BIPA claims, but Clearview prefers a federal forum. The case may stay in federal court, however, only if the more stringent federal standards for standing can be satisfied; Illinois (as is its right) has a more liberal attitude toward the kinds of cases its courts are authorized to entertain. The district court held that Thornley has alleged only a bare statutory violation, not the kind of concrete and particularized harm that would support standing, and thus ordered the action remanded to the state court. Because the case meets the criteria of the Class Action Fairness Act, 28 U.S.C. § 1332(d), Clearview sought permission to appeal from that order. See 28 U.S.C. § 1453(c). We agreed to take the appeal, § 1453(c)(1), and we now affirm the decision of the district court.

I

Our description of the factual background of the case is necessarily brief because we have only the pleadings before us. We accept Thornley's account for present purposes. Clearview is in a business that would have been impossible to imagine a generation ago. Founded in 2017, it designed a facial recognition tool that takes advantage of the enormous amount of information that floats around the Internet. Users may download an application ("App") that gives them access to Clearview's database.

Clearview uses a proprietary algorithm to "scrape" pictures from social media sites such as Facebook, Twitter, Instagram, LinkedIn, and Venmo. The materials that it uses are all publicly available. The scraping process is not designed, however, simply to store photographs. Instead, Clearview's software harvests from each scraped photograph the biometric facial scan and associated metadata (for instance, time and place stamps), and that information is put onto its database. The database, which is stored on servers in New York and New Jersey, at this point contains literally billions of entries.

Clearview offers access to this database for users who wish to find out more about someone in a photograph—perhaps to identify an unknown person, or perhaps to confirm the identity of a person of interest. Many, though not all, of its clients are law-enforcement agencies. The user purchases access to Clearview's resources and, using the App, uploads her photograph to its site. Clearview then creates a digital facial scan of the person in the photograph and compares the new facial scan to those in its vast database. If it finds a match, it returns a geotagged photograph (not the facial scan) to the user, and it informs the user of the source social-media site for the photograph.

In the beginning, Clearview appears to have kept a rather low profile. But on January 18, 2020, The New York Times published an article about Clearview and its extensive database. See Kashmir Hill, "The Secretive Company That Might End Privacy as We Know It," The New York Times , Jan. 18, 2020, https://www.nytimes.com/2020/01/18/technology/clearview-privacy-facial-recognition.html. A rash of lawsuits followed in the wake of the article. See, e.g., Mutnick v. Clearview AI, Inc. , No. 1:20-cv-00512 (N.D. Ill.); Roberson v. Clearview AI, Inc. , No. 1:20-cv-00111 (E.D. Va.); Calderon v. Clearview AI, Inc. , No. 1:20-cv-01296 (S.D.N.Y.); Burke v. Clearview AI, Inc. , No. 3:20-cv-00370 (S.D. Cal.). This case was one of them. Notably, Thornley did not choose a federal forum; instead, she filed her case in state court—specifically, the Circuit Court of Cook County. Her initial complaint, filed on behalf of herself and a class on March 19, 2020, asserted violations of three subsections of BIPA: 740 ILCS 14/15(a), (b), and (c). (We explain below the scope of each of these provisions.) Clearview removed that case to federal court, see 28 U.S.C. § 1441, but shortly after the removal Thornley voluntarily dismissed the action.

In certain circumstances, met here, plaintiffs are entitled to take that action without leave of court should they so desire. See FED. R. CIV. P. 41(a)(1). Granted, if the plaintiff previously has dismissed either a federal- or a state-court action based on the same claim, "a notice of dismissal operates as an adjudication on the merits." Id. Rule 41(a)(1)(B). Thornley, however, had taken no such earlier action, and so her dismissal was without prejudice. She was thus within her rights when she returned to the Circuit Court of Cook County on May 27, 2020, with a new, significantly narrowed, action against Clearview. The new action was more focused in two respects: first, it alleged only a violation of BIPA § 15(c), 740 ILCS 14/15(c) ; and second, the class definition was much more modest. Clearview again removed the case to the federal court. This time, Thornley filed a motion to remand, see 28 U.S.C. § 1447(c), in which she asserted that the violation of section 15(c) she described was only a "bare procedural violation, divorced from any concrete harm," see Spokeo, Inc. v. Robbins , ––– U.S. ––––, 136 S. Ct. 1540, 1549, 194 L.Ed.2d 635 (2016), and thus did not support Article III standing. As we noted earlier, the district court agreed with her and ordered the case remanded to state court. II

Ordinarily, it is the plaintiff who bears the burden of demonstrating that the district court has subject-matter jurisdiction over her case and that it falls within "the Judicial Power" conferred in Article III. But more generally, the party that wants the federal forum is the one that has the burden of establishing the court's authority to hear the case. See Schur v. L.A. Weight Loss Centers, Inc. , 577 F.3d 752, 758 (7th Cir. 2009) ; Brill v. Countrywide Home Loans, Inc. , 427 F.3d 446, 447 (7th Cir. 2005). As applied here, that means that Clearview must show that Thornley (as well as her co-plaintiffs) has Article III standing.

The Supreme Court's most recent restatement of the rules governing standing appears in Thole v. U.S. Bank N.A. , ––– U.S. ––––, 140 S. Ct. 1615, 207 L.Ed.2d 85 (2020) :

To establish standing under Article III of the Constitution, a plaintiff must demonstrate (1) that he or she suffered an injury in fact that is concrete, particularized, and actual or imminent, (2) that the injury was caused by the defendant, and (3) that the injury would likely be redressed by the requested judicial relief.

Id. at 1618, citing Lujan v. Defenders of Wildlife , 504 U.S. 555, 560–61, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992). See also Spokeo, 136 S. Ct. at 1547. In the case before us, there is no serious dispute about the second and third of those requirements: whatever injury Thornley suffered occurred at Clearview's hands, and one can imagine a number of ways in which that injury could be remedied by a court. We say this not because the parties have agreed on those points. No such agreement would be binding on the court. But the record tells us enough about the nature and source of the injury to support this conclusion. We thus focus exclusively on the injury-in-fact requirement.

This appeal is far from our first encounter with BIPA, though we have not had occasion in the past to consider section 15(c). Our earlier cases, however, provide important context for our consideration of the standing issue presented here, and so we take a moment to review their central holdings.

The first in this line was Miller v. Southwest Airlines Co. , 926 F.3d 898 (7th Cir. 2019). The immediate question was whether employees of Southwest Airlines who contended that the company had violated BIPA in the operation of its timekeeping system had to present their claims to an adjustment board, as spelled out in the Railway Labor Act, or if the court was the proper forum. Id . at 900. Before the court could reach that issue, however, it had to decide whether the employees had standing under Article III to pursue the litigation. It concluded that they did. If there were some problem in the use of the timekeeping system, it would be possible for either an adjustment board or a court to remedy that problem:

The prospect of a material change in workers’ terms and conditions of employment gives these suits a concrete dimension that Spokeo , Groshek [v. Time Warner Cable, Inc., 865 F.3d 884 (7th Cir. 2017) ], and Casillas [v. Madison Ave. Assocs., Inc. , 926 F.3d 329 (7th Cir. 2019) ] lacked. Either the discontinuation of the practice, or the need for the air carriers to agree to higher wages to induce unions to consent, presents more than a bare procedural dispute. See Robertson v. Allied Solutions, LLC , 902 F.3d 690, 697 (7th Cir. 2018) ("Article III's strictures are met not only when a plaintiff complains of being deprived of some benefit, but also when a plaintiff

complains that she was deprived of a chance to obtain a benefit.").

Id . at 902. The Miller opinion did not distinguish further among the various subsections of BIPA § 15.

We returned to BIPA in Bryant v. Compass Group USA, Inc. , 958 F.3d 617 (7th Cir. 2020). There the plaintiff's employer had installed in its cafeteria some "Smart Market" vending machines owned by the defendant, Compass Group. In order to use the machines, a patron had to establish an account using her fingerprint. Section 15(a) of BIPA requires collectors of biometric information to make publicly available a retention schedule and guidelines for permanently destroying the information they obtain. Section 15(b) of BIPA requires the collector to inform those from whom it is collecting information that it is doing so, and to disclose the purpose of the collection and the length of the retention. It also requires the collector to obtain written consent from the affected person. Bryant alleged that Compass had violated both section 15(a) and 15(b), 740 ILCS 14/15(a), (b).

Our decision hewed closely to the facts and allegations before us. As amended on the petition for rehearing, the opinion emphasized that Bryant's claim under section 15(a) rested exclusively on Compass's failure to develop a "written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information[.]’’ Id. § 15(a). We found that this duty is "owed to the public generally, not to particular persons whose biometric data the entity collects." 958 F.3d at 626. In other words, Bryant's injury in this respect was not particularized, and thus it did not demonstrate injury-in-fact for Article III purposes. We left open the question whether a different allegation under section 15(a)—one based on the language requiring a collector to comply with its established retention and destruction criteria—might call for a different result. Finally, we found that Bryant's allegations that Compass had violated section 15(b)’s requirement both to inform those from whom it was collecting data that it was doing so and why, and to obtain their written consent, was both concrete and particularized, and thus were enough to support standing.

The question under section 15(a) that we reserved in Bryant did not remain unexamined for long. In Fox v. Dakkota Integrated Systems, LLC , 980 F.3d 1146 (7th Cir. 2020), plaintiff Fox contended that Dakkota, her former employer, had violated section 15(a) by failing to comply with its data retention and destruction policies. As in this case, Fox had initiated her action in state court, Dakkota had removed to federal court, and the question before us was whether the case had to be remanded to state court on Article III standing grounds. After reviewing many of the same cases we have highlighted here, we concluded that "[a]n unlawful retention of biometric data inflicts a privacy injury in the same sense that an unlawful collection does." Id. at 1154. We thus held that "an unlawful retention of a person's biometric data is as concrete and particularized an injury as an unlawful collection of a person's biometric data. If the latter qualifies as an invasion of a ‘private domain, much like an act of trespass would be,’ Bryant , 958 F.3d at 624, then so does the former." Id. at 1155. We thus reversed the district court's order sending the case back to state court and remanded for further proceedings.

Two other points are important to understanding our approach to these cases. First, an important corollary to the rule that injury-in-fact must be both concrete and particularized, see Spokeo , 136 S. Ct. at 1548–49, is the requirement that "the plaintiff must clearly allege facts demonstrating each element." Id. at 1547 (cleaned up). In other words, allegations matter. One plaintiff may fail to allege a particularized harm to himself, while another may assert one. For example, in Casillas (which dealt with the Fair Debt Collection Practices Act, not BIPA), we gave dispositive weight to the fact that the plaintiff had not pleaded that her receipt of a letter that allegedly failed to comply with the statute had caused her any harm—indeed, had any effect whatsoever on her. 926 F.3d at 334–35. As the case reached us, "Casillas had no more use for the notice than she would have had for directions accompanying a product that she had no plans to assemble." Id. at 334. That was not enough to support her standing to sue, but nothing in the opinion implied that every recipient of a similarly nonconforming letter would be in the same position. Similarly, as the difference between the treatment of section 15(a) in Bryant and Fox illustrates, the result of the standing inquiry for the identical section of a statute will depend on what that section provides and what the plaintiff has alleged.

Second, the fact that a "bare procedural violation" does not suffice to support an injury-in-fact made some people wonder whether there is a distinction between alleged procedural injuries and alleged substantive injuries. We clarified in Larkin v. Finance System of Green Bay, Inc. , 982 F.3d 1060, 1066 (7th Cir. 2020), that no such line exists. Article III must be satisfied no matter what kind of violation is asserted.

III

Thornley's complaint raises only one claim under BIPA: that Clearview violated section 15(c). (The fact that she had filed the earlier action and then voluntarily dismissed it is of no legal relevance, except for purposes of the two-dismissal rule, which has not been triggered here.) That subpart reads as follows:

(c) No private entity in possession of a biometric identifier or biometric information may sell, lease, trade, or otherwise profit from a person's or a customer's biometric identifier or biometric information.

740 ILCS 14/15(c). Thornley and her co-plaintiffs, Deborah Benjamin-Koller and Josue Herrera, all of whom maintained social media accounts on sites such as Facebook, Instagram, LinkedIn, Venmo, and YouTube, filed their complaint in the state court on behalf of themselves and as representatives of the following class:

All current Illinois citizens whose biometric identifiers or biometric information were [sic ], without their knowledge, included in the Clearview AI Database at any time from January 1, 2016 to January 17, 2020 (the "Class Period") and who suffered no injury from Defendant's violation of Section 15(c) of BIPA other than statutory aggrievement....

Similarly, the complaint concedes that none of the named plaintiffs, and no class member, "suffered any injury as a result of the violations of Section 15(c) of BIPA other than the statutory aggrievement alleged in Paragraph 38." Complaint, ¶ 39.

Taking the position that these allegations did not suffice to show a lack of Article III standing, Clearview removed the case to federal court. The district court saw things differently. Noting that a plaintiff is the master of her own complaint, the court held that the particular allegations before it raised questions only about a general regulatory rule found in BIPA: no one may profit in the specified ways from another person's biometric identifiers or information. On appeal, Clearview urges us to equate a person's potential injury from the sale (or lease, etc.) of her data with the injury from retention of that data that we recognized in Fox , or the injury we recognized in Bryant from the collection of that data and the failure to obtain written consent. We have no quarrel with the idea that a different complaint might reflect that type of equivalence. A plaintiff might assert, for example, that by selling her data, the collector has deprived her of the opportunity to profit from her biometric information. Or a plaintiff could assert that the act of selling her data amplified the invasion of her privacy that occurred when the data was first collected, by disseminating it to some unspecified number of other people. Perhaps a plaintiff might assert that the scraping of data from social media sites raises the cost of using those sites in some respect (though they are nominally free, in the same sense that network television or conventional radio is free—ads pay for these outlets, and the viewers are the "product" that the advertiser is buying).

Without any such allegations of concrete and particularized harm to the plaintiffs, we are left with a general rule that prohibits the operation of a market in biometric identifiers and information. If it is not profitable to collect or hold that data, one can assume that the incentive to collect it or hold it will be significantly reduced. Much the same rationale supports other laws that are directed against market transactions. Regulations implementing the Eagle Protection Act and the Migratory Bird Treaty Act, for example, permit the possession or transportation of certain migratory birds, and their parts, nests, or eggs, but they state that these items "may not be imported, exported, purchased, sold, bartered, or offered for purchase, sale, trade, or barter." Andrus v. Allard, 444 U.S. 51, 54, 100 S.Ct. 318, 62 L.Ed.2d 210 (1979) (citing 50 C.F.R. § 21.2(a) (1978) ). The Supreme Court understood this as a regulatory prohibition against commerce in the covered birds and bird parts, and it upheld the regulations. A similar rationale lay behind the Court's decision in Ashcroft v. Free Speech Coalition , 535 U.S. 234, 122 S.Ct. 1389, 152 L.Ed.2d 403 (2002), to uphold a prohibition on child pornography produced with real children on the ground that it furthers the government's effort to eliminate the market for such material. Id. at 254, 122 S.Ct. 1389. (At the same time, the Court held that the market-deterrence theory did not save a prohibition against materials created with computerized images or young-looking adults. But that was because the underlying conduct could not be criminalized consistently with the First Amendment.)

Section 15(c) of BIPA is another such statute, albeit one enacted by Illinois rather than the federal government. It addresses only the regulated entity—the collector or holder of the biometric data—and flatly prohibits for-profit transactions. No one in this case has asked us to decide whether this prohibition violates some other law, such as the Takings Clause, substantive due process, or a federal statute, and so we express no opinion on any such theory. For our purposes, it is enough to say that this is the same kind of general regulation as the duty to create and publish a retention and destruction schedule found in section 15(a), at least when the plaintiff asserts no particularized injury resulting from the commercial transaction. See Bryant , 958 F.3d at 626.

One final question remains: may the plaintiffs, by seeking to represent a class that includes only persons who suffered no injury from the alleged violation of section 15(c), prevent the district court from taking a broader view of the case? We wondered whether such a holding would be consistent with the Supreme Court's decision in Standard Fire Insurance Co. v. Knowles , 568 U.S. 588, 133 S.Ct. 1345, 185 L.Ed.2d 439 (2013). That case involved a putative class action that was commenced in an Arkansas state court against Standard Fire; plaintiffs alleged that underpayments had injured "hundreds, and possibly thousands" of policyholders. Id. at 591, 133 S.Ct. 1345. Relying on the Class Action Fairness Act, which confers jurisdiction on the district courts in cases where minimal diversity exists and the amount in controversy exceeds $5,000,000, 28 U.S.C. § 1332(d)(2), Standard Fire removed the action to the district court. Once it was there, but before class certification, the plaintiff filed a statement stipulating that he and the class would not seek damages in excess of $5,000,000. On the basis of that stipulation, plaintiff then sought to have the case remanded to state court for lack of jurisdiction.

The Supreme Court held that the stipulation was not, and could not be, binding on the plaintiff class, and thus that it was ineffective to defeat the removal. It explained that "a plaintiff who files a proposed class action cannot legally bind members of the proposed class before the class is certified." Id. at 593, 133 S.Ct. 1345. Because the district court had not evaluated the adequacy of the amount in controversy independently from the stipulation, the Court remanded for further proceedings.

The situation in Thornley's case is different. She does not contest either the existence of minimal diversity (she is a citizen of Illinois, and Clearview is a citizen of Delaware and New York) or the fact that more than $5,000,000 is at stake. Instead, she has simply offered a class definition that is narrower than it might have been. We have no reason to believe that the district court, acting on its own initiative, would certify a different and broader class; to that extent, the rule that the plaintiff controls her own case applies. And unlike the situation in Standard Fire , people who fall outside Thornley's class definition are totally unaffected by this litigation. If they wish to sue Clearview, either alone or under a class definition that includes an allegation of injury, they are free to do so. Indeed, as we noted earlier, there are a number of class actions pending against Clearview, many of which appear to be broader than this one. We know of nothing that would prevent a putative class representative from taking a conservative approach to class definition. And if the plaintiffs change their tune in the state court, Clearview will be able to attempt to remove again to federal court, though we do not predict the outcome of such an effort. See 28 U.S.C. § 1446(b)(3), (c).

IV

Our job is to decide whether Thornley and her co-plaintiffs have Article III standing to pursue the case they have presented in their complaint. We have concluded that they do not: they have described only a general, regulatory violation, not something that is particularized to them and concrete. It is no secret to anyone that they took care in their allegations, and especially in the scope of the proposed class they would like to represent, to steer clear of federal court. But in general, plaintiffs may do this. As long as their allegations are in good faith, they may include non-diverse parties as defendants. Outside of the clumsily named area of "complete preemption," they may choose to rely exclusively on state law and avoid federal-question jurisdiction. And here, they may take advantage of the fact that Illinois permits BIPA cases that allege bare statutory violations, without any further need to allege or show injury. See Rosenbach v. Six Flags Entertainment Corp. , 2019 IL 123186 ¶¶ 22–23, 432 Ill.Dec. 654, 129 N.E.3d 1197.

We express no opinion on the adequacy of Thornley's complaint as a matter of Illinois law. That will be for the state court to address. We hold only that on the basis of the allegations of this complaint, the district court correctly decided that Thornley and the other plaintiffs did not present a case that lies within the boundaries set by Article III, and so the court properly remanded the case to the state court.

AFFIRMED .

HAMILTON, Circuit Judge, concurring.

I join Judge Wood's careful and persuasive opinion for the panel. I write separately to emphasize a critical point in the panel opinion and to add two broader cautions about standing issues under consumer-protection statutes.

First, our decision has been determined by the choices that these plaintiffs have made to narrow both their claims and the scope of their proposed class. Judge Wood's opinion recognizes that other plaintiffs might well establish standing for other alleged violations of Section 15(c). Ante at –––– – ––––. Add to those possibilities a person who has consented to collection, retention, and use of her biometric information, perhaps for non-profit scientific research, but who objects to the sale of her data to a third party. The resulting injury in such cases would be comparable to injuries in invasion-of-privacy and unjust enrichment cases that the law has long recognized. See Restatement (Second) of Torts § 652C (1977) (appropriation of another's name or likeness for one's own use or benefit); Restatement of Restitution § 136 (1937) ("A person who has tortiously used a trade name, trade secret, franchise, profit a prendre, or other similar interest of another, is under a duty to restitution for the value of the benefit received thereby."); see also Robertson v. Allied Solutions, LLC , 902 F.3d 690, 697 (7th Cir. 2018) (plaintiff may show standing by alleging she was deprived of a benefit but also by alleging she was deprived of a chance to obtain a benefit). In fact, the misuse of a person's biometric information presents an especially dangerous modern version of these traditional injuries. A victim of identity theft can obtain a new email address or even Social Security number, but "biometric identifiers ... are immutable, and once compromised, are compromised forever." Fox v. Dakkota Integrated Systems LLC , 980 F.3d 1146, 1155 (7th Cir. 2020).

Second, the opinion's emphasis on the allegations of these plaintiffs has a procedural corollary. Standing is an issue that federal courts have an obligation to raise in any civil case. When the trial or appellate court raises questions about the sufficiency of a plaintiff's allegations to plead standing, fairness requires the court to give the plaintiff a reasonable opportunity to elaborate on her initial allegations. See, e.g., Larkin v. Finance System of Green Bay, Inc ., 982 F.3d 1060, 1066 (7th Cir. 2020) (explaining opportunities for plaintiff's attorney to identify injury to support standing under Fair Debt Collection Practices Act); Doermer v. Callen , 847 F.3d 522, 526 (7th Cir. 2017) (affirming dismissal for lack of standing where plaintiff never took opportunities to offer amended complaint or to explain possible amendments to remedy lack of standing).

Third, the briefs in this case address very recent decisions by this court finding that private plaintiffs lacked standing when they alleged intangible harm based on violations of other consumer-protection statutes. See Nettles v. Midland Funding, LLC , ––– F.3d ––––, 2020 WL 7488610 (7th Cir. 2020) (FDCPA); Bazile v. Finance System of Green Bay, Inc. , 983 F.3d 274 (7th Cir. 2020) (FDCPA); Spuhler v. State Collection Service, Inc ., 983 F.3d 282 (7th Cir. 2020) (FDCPA); Gunn v. Thrasher, Buschmann & Voelkel, P.C., 982 F.3d 1069 (7th Cir. 2020) (FDCPA); Brunett v. Convergent Outsourcing, Inc. , 982 F.3d 1067 (7th Cir. 2020) (FDCPA); Larkin , 982 F.3d at 1066 ; Groshek v. Time Warner Cable, Inc. , 865 F.3d 884 (7th Cir. 2017) (Fair Credit Reporting Act). The most recent cases under the Fair Debt Collection Practices Act rely on our decision creating a circuit split in Casillas v. Madison Avenue Associates, Inc. , 926 F.3d 329, 335–36 (7th Cir. 2019), disagreeing with Macy v. GC Services Ltd. P'Ship , 897 F.3d 747 (6th Cir. 2018) ; see also Casillas , 926 F.3d at 339–43 (Wood, C.J., dissenting from denial of en banc review).

On the other side of this issue over standing for intangible harms to consumers, see our previous cases under the Biometric Information Privacy Act discussed in Judge Wood's opinion, including Fox v. Dakkota Integrated Systems, LLC , 980 F.3d 1146 (7th Cir. 2020) ; Bryant v. Compass Group USA, Inc. , 958 F.3d 617 (7th Cir. 2020) ; and Miller v. Southwest Airlines Co. , 926 F.3d 898 (7th Cir. 2019), as well as Gadelhak v. AT&T Services, Inc ., 950 F.3d 458, 462–63 (7th Cir. 2020) (unwelcome text messages under Telephone Consumer Protection Act), and Lavallee v. Med-1 Solutions , 932 F.3d 1049, 1053 (7th Cir. 2019) (omitted notice of rights under FDCPA). I confess that I have not yet been able to extract from these different lines of cases a consistently predictable rule or standard.

Much of the debate over standing in these cases stems from the Supreme Court's decision in Spokeo, Inc. v. Robins , ––– U.S. ––––, 136 S. Ct. 1540, 194 L.Ed.2d 635 (2016), a decision on standing under the Fair Credit Reporting Act. The Court told us that standing requires "concrete" injury but that "intangible injuries can nevertheless be concrete." Id . at 1548–49. This Delphic instruction raised more questions than it answered. Many arise under federal consumer-protection statutes that use common regulatory techniques: ensure that the consumer/debtor/borrower/investor/retiree has accurate and reliable information for her decisions, and require specific procedures, including notice and opportunity to respond before adverse action is taken that may affect her.

The lower federal courts have already spilled a great deal of ink interpreting the Supreme Court's statement in Spokeo that the plaintiff could not satisfy Article III standing "by alleging a bare procedural violation." Id . at 1550. Given the number of cases in this and other lower courts finding only "bare procedural violations," it is worth emphasizing that the only example the Court actually provided was utterly trivial: an incorrect zip code in the information about a debtor under the Fair Credit Reporting Act.

At the same time, Spokeo taught that "both history and the judgment of Congress play important roles" in determining whether an intangible injury can be sufficiently concrete to support standing. Id . at 1549, discussing Lujan v. Defenders of Wildlife , 504 U.S. 555, 578, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992) (Congress "may elevat[e] to the status of legally cognizable injuries concrete, de facto injuries that were previously inadequate in law"), and id . at 580, 112 S.Ct. 2130 (opinion of Kennedy, J.) ("Congress has the power to define injuries and articulate chains of causation that will give rise to a case or controversy where none existed before.").

The legislative power of Congress to protect consumers (and debtors, borrowers, investors, etc.) by granting informational and procedural rights, as well as private rights of action to enforce them, has enormous practical importance. That importance is only growing with the pace of technological change. To illustrate, one need only imagine Congress soon trying to draft a federal cousin to the Illinois statute we consider here. It will need to decide whether to create a private right of action to enforce individual rights rather than leave enforcement entirely to a federal agency. Many post- Spokeo decisions in this and other circuits impose constitutional limits that will make that a difficult task.

With respect, I believe that several of our recent opinions take Spokeo too far. Those opinions do not give sufficient weight to Spokeo ’s endorsement of standing where Congress has chosen to provide procedural and informational rights to reduce the risk of more substantive harm for consumers and others, and has created private rights of action to enforce them. We have also too quickly invoked Spokeo to deny concrete injury even in cases alleging core substantive violations. In general, Congress is entitled to greater legislative leeway than we have allowed in Casillas , Larkin , and Nettles , for example. By denying standing in those and similar cases, we impose constitutional limits that undermine legislative discretion to enforce federal law through private rights of action. The obvious alternative path for Congress will be to rely more heavily on enforcement through federal bureaucracies, which will face no standing obstacles.

I will not belabor the point further here, particularly in light of the time constraints imposed on deciding this appeal under 28 U.S.C. § 1453(c)(2). Judge Wood's dissent from the denial of rehearing in Casillas , the Sixth Circuit's opinion in Macy , 897 F.3d at 747, and the Ninth Circuit's opinion on remand in Spokeo , 867 F.3d 1108 (9th Cir. 2017), express my concerns well. Sooner or later, though, I hope, the Supreme Court will revisit the problem of standing in private actions based on intangible injuries under a host of federal consumer-protection statutes.