Opinion
Case No. 1:21-cv-02906
2022-01-13
Shannon CARPENTER, individually and on behalf of similarly situated individuals, Plaintiff, v. MCDONALD'S CORPORATION, Defendant.
Andrew T. Heldut, Colin Primo Buscarini, Eugene Y. Turin, Timothy Patrick Kingsbury, McGuire Law, P.C., Chicago, IL, for Plaintiff. Michael J. Gray, Efrat R. Schulman, Jennifer Wilcynski Plagman, Katherine Stallings Bailey, Thomas W. Ritchie, Jones Day, Chicago, IL, for Defendant.
Andrew T. Heldut, Colin Primo Buscarini, Eugene Y. Turin, Timothy Patrick Kingsbury, McGuire Law, P.C., Chicago, IL, for Plaintiff.
Michael J. Gray, Efrat R. Schulman, Jennifer Wilcynski Plagman, Katherine Stallings Bailey, Thomas W. Ritchie, Jones Day, Chicago, IL, for Defendant.
ORDER
CHARLES RONALD NORGLE, Judge
Defendant's motion to dismiss for failure to state a claim [15] is granted in part and denied in part. Plaintiff's Section 15(d) claim is dismissed without prejudice.
MEMORANDUM OPINION
Plaintiff Shannon Carpenter brings this putative class action against Defendant McDonald's Corporation ("McDonald's") pursuant to the Illinois Biometric Information Privacy Act, 740 ILCS 14/1, et seq. ("BIPA" or the "Act"). According to Plaintiff, McDonald's deploys an artificial intelligence voice assistant in the drive-through lanes of various McDonald's restaurants that uses voice recognition technology to allow customers to place orders without interacting with a person. Plaintiff brings a single count against Defendant, alleging that McDonald's violates BIPA by collecting customers’ voiceprint biometrics via the voice assistant technology and storing, disclosing, and disseminating biometric information without their customers’ consent. Defendant has filed a motion to dismiss for failure to state a claim pursuant to Federal Rule of Civil Procedure 12(b)(6), arguing in part that Plaintiff's complaint does not allege sufficient facts to plausibly allege that McDonald's collects its customers’ voiceprints whatsoever. The Court agrees that Plaintiff does not sufficiently plead a claim pursuant to 740 ILCS 14/15(d), so that claim is dismissed without prejudice. However, Plaintiff's allegations plausibly state a claim pursuant to 740 ILCS 14/15(b), so the Court finds that Plaintiff's complaint is sufficient at this early stage of litigation. Discovery should proceed expeditiously.
I. Standard
To survive a motion to dismiss under Rule 12(b)(6), the complaint must contain a "short and plain statement of the claim showing that the pleader is entitled to relief." Fed. R. Civ. P. 8(a) ; Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 554-557, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007). This statement must provide sufficient plausible facts to put a defendant on notice of the claims against him. Brooks v. Ross, 578 F. 3d 574, 581 (7th Cir. 2009). The complaint "must provide enough factual information to ‘state a claim to relief that is plausible on its face’ and ‘raise a right to relief above a speculative level.’ " Doe v. Village of Arlington Heights, 782 F.3d 911, 914 (7th Cir. 2015) (quoting Twombly, 550 U.S. at 555, 570, 127 S.Ct. 1955 ). Rule 8 "demands more than an unadorned, the-defendant-unlawfully-harmed-me accusation." Ashcroft v. Iqbal, 556 U.S. 662, 129 S. Ct. 1937, 1949, 173 L.Ed.2d 868 (2009). "A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Id. (citations and quotation marks omitted). In reviewing a plaintiff's claim, the court "must construe all of the plaintiff's factual allegations as true, and must draw all reasonable inferences in the plaintiff's favor." Virnich v. Vorwald, 664 F.3d 206, 212 (7th Cir. 2011).
II. Background
In passing BIPA, the Illinois Legislature stated that "biometrics are unlike other unique identifiers that are used to access finances or other sensitive information. For example, even sensitive information like Social Security numbers can be changed. Biometrics, however, are biologically unique to each individual and, once compromised, such individual has no recourse, is at a heightened risk for identity theft, and is likely to withdraw from biometric facilitated transactions." 740 ILCS 14/5. "Biometrics" in the Act refers to "biometric identifiers" and "biometric information." BIPA defines "biometric identifier" by listing examples, including "a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry." 740 ILCS 14/10. In other words, a biometric identifier is a unique personal feature that can be used to identify a person. Rivera v. Google Inc., 238 F. Supp. 3d 1088, 1096 (N.D. Ill. 2017) (biometric identifier, including a voiceprint, "is a set of measurements of a specified physical component ... used to identify a person."). The term "biometric information" means "any information, regardless of how it is captured, converted, stored, or shared, based on an individual's biometric identifier used to identify an individual." 740 ILCS 14/10. BIPA does not define the term "voiceprint," but the dictionary defines it as a "distinctive pattern of curved lines and whorls made by a machine that measures human vocal sounds for the purpose of identifying an individual speaker." Voiceprint, Black's Law Dictionary (11th ed. 2019). Therefore, as the Illinois Office of the Attorney General states, "a voiceprint, which is a record of mechanical measurement, is not the same as a simple recording of a voice." Public Access Opinion No. 17-011, 2017 WL 10084298, at *3 (Ill. A.G. Aug. 14, 2017). As relevant here, the Act states that: (1) "No private entity may collect, capture, purchase, receive through trade, or otherwise obtain a person's or a customer's biometric identifier or biometric information" without informed consent. 740 ILCS 14/15(b) ("Section 15(b)"); and (2) "No private entity in possession of a biometric identifier or biometric information may disclose, redisclose, or otherwise disseminate a person's or a customer's biometric identifier or biometric information," subject to limited exceptions. 740 ILCS 14/15(d) ("Section 15(d)").
Plaintiff's complaint makes claims pursuant to 740 ILCS 14/15(a) and 740 ILCS 14/15(c) as well, but the Court remanded those claims to the Circuit Court of Cook County, Illinois. Dkt. 25.
Plaintiff makes the following relevant allegations in his complaint. Dkt. 1-1 at 5-12. In 2019, McDonald's purchased the technology company "Apprente," which specialized in creating artificial intelligence ("AI") voice assistants that utilize machine learning and intelligent AI to interpret and understand individuals’ voice interactions. Compl. ¶ 16. In addition, "[u]nlike common ‘speech-to-text’ systems that simply transcribe voice interactions into a useable transcript that is then interpreted, Apprente's technology uses ‘speech-to-meaning’ technology that analyzes speech signals in real-time to obtain a ‘result.’ " Id. ¶ 18. McDonald's employs the AI at certain drive-through restaurants. Because the AI's voice recognition technology allows customers to place orders without any actual human interaction, it helps McDonald's reduce staff requirements and streamline operations. See id. ¶ 20 (alleging that McDonald's incorporates "machine-learning routines" that combine voiceprint recognition with license plate scanning technology "to identify unique customers regardless of which location they visit and present them certain menu items based on their past visits."). The AI voice assistant allegedly "collects customers’ voiceprint biometrics in order to be able to correctly interpret customer orders and to identify repeat customers to provide a tailored experience" and "determine[s] such unique features of the customer's voice as pitch, volume, duration, as well as to obtain identifying information such as the customer's age, gender, accent, nationality, and national origin." Compl. ¶¶ 8, 19. Crucially, McDonald's allegedly "does not notify its customers" that "their voiceprint biometric information is being used and collected, nor does McDonald's obtain their consent to do so." Id. ¶ 9. Plaintiff asserts that he had his voiceprint biometrics collected without his consent when he visited a McDonald's restaurant in Lombard, Illinois in early 2020 and interacted with the AI voice assistant.
III. Discussion
Defendant argues that the allegations and sources in the complaint make clear that Defendant's technology does not obtain biometric identifiers or information and that McDonald's in fact did not collect his voiceprint. Relatedly, Defendant asserts that Plaintiff fails to sufficiently plead facts to support his allegations that McDonald's collects voiceprints. Defendant first points to the patent for its AI technology, which it argues belies any allegations that the technology identifies the individual speaking or extracts biometrics. Dkt. 16-1 (Exhibit A, U.S. Patent No. 10,555,299) ("the Patent"). Instead, says Defendant, the Patent merely describes "a software program that interprets and responds to statements made by users in ordinary natural language." Dkt. 16-1 at 5. McDonald's states the technology uses machine learning—a form of artificial intelligence—to train software to recognize speech and imitate intelligent human behaviors, but does not extract biometrics. Although Defendant states that the Patent "discloses methods for modifying synthetic training data by ... identifying speaker characteristics such as accents, speech patterns, gender, age, etc.," Defendant says the technology only takes vocal utterances and creates the information necessary to initiate a food order in accordance with the speaker's intent. Dkt. 16 at 3 (citing the Patent at 6-7). Neither does the Patent disclose any use of license plate scanning or any other technology to identify unique customers at the drive-through. Id.
As an initial matter, Plaintiff's complaint references the Patent by citing to it with a hyperlink, and the Patent is central to Plaintiff's allegations. Compl. ¶ 19 n.2; see, e.g., dkt. 27 (Response Brief) at 5 (Plaintiff argues that the Patent explains the AI's extraction of biometric data points by describing the voice assistant as a "conversational agent that utilizes an ‘acoustic model ... trained to ... output sequences of non-phonemic or prosodic features’ such as ‘pitch, volume, duration, and so on.’ ") (quoting the Patent). The Patent is therefore appropriate to consider on the present 12(b)(6) motion. Fed. R. Civ. P. 10(c) ; Geinosky v. City of Chicago, 675 F.3d 743, 745 n.1 (7th Cir. 2012) ; Wright v. Associated Ins. Cos. Inc., 29 F.3d 1244, 1248 (7th Cir. 1994) ("[D]ocuments attached to a motion to dismiss are considered part of the pleadings if they are referred to in the plaintiff's complaint and are central to his claim. Such documents may be considered by a district court in ruling on the motion to dismiss."); see Zablocki v. Merchants Credit Guide Co., 968 F.3d 620, 623 (7th Cir. 2020) ("when the plaintiff relies on a document attached to the complaint and does not deny its accuracy, the facts communicated by that document control over allegations to the contrary.").
While the Court accepts the Patent as appropriate to consider at this stage of litigation, the Court cannot conclude as a matter of law that Defendant does not collect voiceprints via its AI voice assistant technology. True, voice characteristics like pitch, volume, duration, accent and speech pattern, and other characteristics like gender, age, nationality, and national origin—individually—are not biometric identifiers or voiceprints. They surely can help confirm or negate a person's identity, but one cannot be identified uniquely by these characteristics alone, so they cannot constitute a "set of measurements of a specified physical component ... used to identify a person." Rivera v. Google Inc., 238 F. Supp. 3d 1088, 1096 (N.D. Ill. 2017). But the fact that the Patent states that the technology may capture characteristics like accent, speech pattern, gender, or age for the purpose of training the AI does not preclude the possibility that the technology allows McDonald's to collect, collate, or "otherwise obtain" a voiceprint. 740 ILCS 14/15(b).
Ultimately, the Court finds that Plaintiff has alleged enough factual content to plausibly allege that Defendant collected his voiceprint. The fact that the technology can effectively interpret and understand customer orders shows that it detects and analyzes human speech in a way that a mere recording device does not. Plaintiff alleges that Defendant's AI voice assistant is able to extract voice information including pitch, volume, and duration along with identifying information like age, gender, nationality, and national origin. Compl. ¶¶ 8, 17, 19. Defendant argues that Plaintiff provides no facts supporting the claim that the AI collects pitch, volume, or duration, or is trained to recognize accents, speech patterns, gender, age, nationality, and geographic region. But those claims are not legal conclusions and the Court "must construe all of the plaintiff's factual allegations as true." Virnich v. Vorwald, 664 F.3d 206, 212 (7th Cir. 2011). Plaintiff also highlights that the AI voice assistant utilizes an "acoustic model ... trained to receive an input comprising acoustic features from an audio waveform that represents an utterance of a speaker," which bolsters Plaintiff's claim that the AI performs mechanical measurement. Dkt. 27 at 5 (citing the Patent at 6). Plaintiff states that an audio waveform is a graphical representation, measurement, or illustration of acoustic patterns. Dkt. 27 at 5 n.2. And Defendant admits that the technology can "learn to recognize speech" and "output a sequence of phonemes." Dkt. 16 at 2. Finally, and importantly, Plaintiff alleges that McDonald's uses the AI and data to actually identify unique individuals. Compl. ¶ 20 (alleging AI is used "to identify unique customers regardless of which location they visit and present them certain menu items based on their past visits."; id. ¶ 8 (alleging that the AI collects voiceprints "to identify repeat customers to provide a tailored experience.").
Based on the facts pleaded in the complaint, including the referenced Patent, it is reasonable to infer—though far from proven—that Defendant's technology mechanically analyzes customers’ voices in a measurable way such that McDonald's has collected a voiceprint from Plaintiff and other customers. Virnich v. Vorwald, 664 F.3d 206, 212 (7th Cir. 2011) (the court "must draw all reasonable inferences in the plaintiff's favor."). Discovery may show that Defendant's technology cannot or does not collect any vocal information that could be used to uniquely identify an individual, in which case summary judgment may be appropriate. But Plaintiff has alleged sufficient factual information to make a plausible claim at this early stage. Supreme Auto Transp. LLC v. Arcelor Mittal, 238 F. Supp. 3d 1032, 1036 (N.D. Ill. 2017) ("A complaint should not be dismissed for failure to state [a] claim unless it appears beyond doubt that the plaintiff is unable to prove any set of facts which would entitle the plaintiff to relief.")
To the extent that Defendant argues that it must have actually used Plaintiff's voiceprint and "identified him as speaking to the voice assistant" to implicate BIPA, the Court disagrees. In the Court's view, pursuant to the plain language of the statute, a defendant may violate BIPA by collecting a voiceprint that merely could be used to identify a plaintiff. The collection of a voiceprint—which is explicitly included in the definition of "biometric identifier"—without consent, even if not collected for the purpose of identifying that person, is a violation of the statute. 740 ILCS 14/15(b) ("No private entity may collect, capture, purchase, receive through trade, or otherwise obtain a person's or a customer's biometric identifier or biometric information, unless it first" obtains consent); 740 ILCS 14/10 (" ‘Biometric identifier’ means a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry."); see Vance v. Int'l Bus. Machines Corp., No. 20 C 577, 2020 WL 5530134, at *5 (N.D. Ill. Sept. 15, 2020) ("Plaintiffs allege that IBM extracted biometric information from photographs to create their DIF Dataset. The DIF Dataset includes biometric measurements that can be used to identify Plaintiffs. Thus, IBM's alleged actions implicate BIPA ... what's important is the potential intrusion on privacy posed by the unrestricted gathering of biometric information.").
Defendant cites Namuwonge v. Kronos, Inc., 418 F. Supp. 3d 279 (N.D. Ill. 2019) and Heard v. Becton, Dickinson & Co., 440 F. Supp. 3d 960 (N.D. Ill. 2020) in support of its argument that Plaintiff's pleading is insufficient to support its Section 15(b) and Section 15(d) claims. In Namuwonge, the court held that the plaintiff failed to allege a plausible section 15(b) claim against a third-party vendor (a timekeeping tracking company) that collected information based on plaintiff clocking in via her fingerprints as required by her employer. 418 F. Supp. 3d at 286. The court reasoned that the complaint's allegations made clear that it was the employer, not the vendor itself, that collected the biometric data. In Heard, the plaintiff sued the manufacturer of a medication dispensing device that dispensed medication when a medical employee provided his or her fingerprint. The court originally dismissed the plaintiff's Section 15(b) claim because Section 15(b), as opposed to Sections 15(a), (c), (d), and (e) of BIPA, applies only to entities that "collect, capture, purchase, receive through trade, or otherwise obtain" biometrics, rather than entities that are merely "in possession of" biometrics. 740 ILCS 14/15(a) - (e). The court held therefore that Section 15(b) only applies to entities that "take an active step" to collect biometrics. 440 F. Supp. 3d at 966. Because the plaintiff had not alleged "how, when, or any other factual detail" regarding the defendant manufacturer's active collection, the claim failed. Id. Further, in dismissing the Section 15(a) and Section 15(d) claims, the court found the allegation that the defendant "subsequently stored [the] fingerprint in their systems" inadequate to allow the court to draw the reasonable inference that the defendant was "in possession" of the biometric data. Id. at 968 (plaintiff failed to allege that the defendant "exercised any dominion or control over [his] biometric data ... or that it held that data at its disposal ... [the allegation] does not say whether [the defendant] could freely access the data or even how [the defendant] allegedly received it.") (cleaned up) (emphasis in original). Defendant argues that Plaintiff here similarly does not allege that the McDonald's technology used biological characteristics or measured his vocal sounds to verify his identity. But unlike Namuwonge and Heard, Plaintiff here is not suing a third party or manufacturer. He alleges that Defendant used the technology to directly collect biometrics from individual customers and to uniquely identify them. McDonald's allegedly owns the technology company Apprente that specialized in creating AI voice assistants, so Plaintiff here has alleged more facts, which allow the plausible inference that McDonald's exercises control over the data. "In contrast to Namuwonge and consistent with the reasoning of Heard II, the [complaint] here asserts that [McDonald's] collects the data for its own use." Naughton v. Amazon.com, Inc., No. 20-CV-6485, 2022 WL 19324, at *3 (N.D. Ill. Jan. 3, 2022) ("As explained above, by requiring that [Plaintiff] submit to scans disclosing his facial geometry, [Defendant] has taken the requisite ‘active step’ in collecting, and thus also possessing, the data."). In addition, Plaintiff specifically alleges that McDonald's collected his voiceprint in Lombard, Illinois in early 2020 when Plaintiff provided his order to the AI voice assistant, the voice assistant understood and processed his order, and the voice assistant provided verbal confirmation of the order. Compl. ¶¶ 23-26. It is plausible, based on the Patent and other factual allegations, that Defendant actively collected or otherwise obtained Plaintiff's voiceprint. 740 ILCS 14/15(b).
The Court agrees with Defendant, however, that Plaintiff's Section 15(d) claim fails for the "independent reason" that Plaintiff offers "no basis for the allegation that [the defendant] disclosed his biometric data." Id. at 969. Section 15(d) generally prohibits private entities from disclosing, redisclosing, or otherwise disseminating BIPA information without consent. 740 ILCS 14/15(d). In Heard, the plaintiff relied solely on "information and belief" of disclosure, which was insufficient:
Heard has not satisfied the court that BD alone has possession of the facts necessary to Heard's Section 15(d) claim. If Heard has a legitimate reason to suspect that BD disclosed his biometric data or that of the putative class members, he surely possesses information of some kind that triggered his suspicion—such as reports that BD has unlawfully disseminated biometric data in the past, or indications that Heard or the putative class members experienced identify theft after they used their employers’ Pyxis systems.
440 F. Supp. 3d at 969. Here, all of Plaintiff's allegations regarding disclosure, redisclosure, or dissemination are conclusions that parrot BIPA's language. Dkt. 1-1 at 7 ("biometric information is used"); id. at 10 (Plaintiff "never provided written consent permitting Defendant to capture, store, or disseminate his voiceprint biometrics."); id. at 14 ("Defendant failed to obtain informed consent to disclose or disseminate[.]"). Without more factual support, this claim must fail. Namuwonge v. Kronos, Inc., 418 F. Supp. 3d 279, 285 (N.D. Ill. 2019) (dismissing Section 15(d) claim when plaintiff "pleaded on information and belief that [the defendant] ... disclosed her fingerprints to other third parties that host the data").
IV. Conclusion
Taking Plaintiff's factual allegations as true, the Court concludes that Plaintiff's Section 15(b) claim should proceed to discovery. Plaintiff has pleaded sufficient facts to put Defendant on notice of the Section 15(b) claim against it. The same cannot be said of the Section 15(d) claim, so that claim fails and is dismissed without prejudice.
IT IS SO ORDERED.