4810-8178-6105.3

IN THE UNITED STATES DISTRICT COURT 

FOR THE NORTHERN DISTRICT OF ILLINOIS 

EASTERN DIVISION 

FREDY SOSA, individually, and on behalf of 

all others similarly situated, 

 Plaintiff, 

v. 

ONFIDO, INC., a Delaware corporation, 

 Defendant. 

) 

) 

) 

) 

) 

) 

) 

) 

) 

) 

Case No. 1:20-cv-04247 

Hon. Marvin E. Aspen 

DEFENDANT’S MEMORANDUM OF LAW IN SUPPORT OF ITS RULE 12(b)(6) 

MOTION TO DISMISS FOR FAILURE TO STATE A CLAIM 

 

Bonnie Keane DelGobbo (bdelgobbo@bakerlaw.com) 

Amy L. Lenz (alenz@bakerlaw.com) 

BAKER & HOSTETLER LLP 

1 North Wacker Drive, Suite 4500 

Chicago, IL 60606 

Telephone: (312) 416-6200 

Facsimile: (312) 416-6201 

Joel Griswold (jcgriswold@bakerlaw.com) 

BAKER & HOSTETLER LLP

SunTrust Center 

200 S. Orange Ave., Suite 2300 

Orlando, FL 32801-3432 

Telephone: (407) 649-4088 

Case: 1:20-cv-04247 Document #: 46 Filed: 09/15/21 Page 1 of 20 PageID #:515
i 

TABLE OF CONTENTS 

Page 

INTRODUCTION ...........................................................................................................................1 

BACKGROUND .............................................................................................................................2 

ARGUMENT ...................................................................................................................................3 

I. BIPA ........................................................................................................................3 

II. Legal Standard .........................................................................................................4 

III. Plaintiff Does Not State A Claim For Any Relief Because BIPA Expressly 

States That Photographs And Information Derived From Photographs Are 

Not Covered By BIPA. ............................................................................................4 

IV. Plaintiff Does Not State A Claim For $5,000 In Liquidated Damages Because 

Plaintiff Does Not Plead Facts From Which To Reasonably Infer That 

Defendant Intentionally or Recklessly Violated BIPA. ...........................................6 

V. Plaintiff Does Not State A Claim For $1,000 In Liquidated Damages Because 

Plaintiff Does Not Plead Facts From Which To Reasonably Infer That 

Defendant Negligently Violated BIPA. ...................................................................8 

VI. BIPA Violates The First Amendment. .....................................................................9 

a. BIPA Is An Unconstitutional Restraint on Commercial Speech. ................9 

b. Alternatively, BIPA Is A Content-Based Restriction Subject To Strict 

Scrutiny. .....................................................................................................12 

CONCLUSION ..............................................................................................................................13 

Case: 1:20-cv-04247 Document #: 46 Filed: 09/15/21 Page 2 of 20 PageID #:516
ii 

TABLE OF AUTHORITIES 

 Page(s) 

Cases 

Ashcroft v. Iqbal, 

556 U.S. 662 (2009) ...................................................................................................................4 

Bell Atl. Corp. v. Twombly, 

550 U.S. 544 (2007) ...................................................................................................................4 

Bruns v. City of Centralia, 

2014 IL 116998 ......................................................................................................................8, 9 

Central Hudson Gas & Elec. Corp. v. Pub. Serv. Comm'n of New York, 

447 U.S. 557 (1980) .................................................................................................................11 

Chiriboga v. Nat'l R.R. Passenger Corp., 

687 F. Supp. 2d 764 (N.D. Ill. 2009) .........................................................................................9 

Cupp v. Murphy, 

412 U.S. 291 (1973) .................................................................................................................11 

Daniel v. Cantrell, 

375 F.3d 377 (6th Cir. 2004) ...................................................................................................12 

Huggins v. SpaClinic, LLC, 

No. 09 C 2677, 2010 WL 963924 (N.D. Ill. Mar. 11, 2010) .....................................................8 

Komorowski v. All-American Indoor Sports, Inc., 

No. 13-2177, 2013 WL 4766800 (D. Kan. Sept. 4, 2013) .........................................................7 

Mijatovich v. Columbia Sav. & Loan Ass’n, 

168 Ill. App. 3d 313 (1st Dist. 1988) .........................................................................................7 

Nat’l Inst. of Family & Life Advocates v. Becerra, 

138 S. Ct. 2361 (2018) .............................................................................................................13 

Neuberg v. Michael Reese Hosp. & Med. Ctr., 

60 Ill. App. 3d 679 (1st Dist. 1978) ...........................................................................................7 

People v. Sequoia Books, Inc., 

127 Ill. 2d 271 (1989) ..............................................................................................................11 

Plocar v. Dunkin’ Donuts of Am., Inc., 

103 Ill. App. 3d 740 (1st Dist. 1981) .........................................................................................6 

Case: 1:20-cv-04247 Document #: 46 Filed: 09/15/21 Page 3 of 20 PageID #:517
iii 

4810-8178-6105.3

Pub. Fin. Corp. v. Davis, 

66 Ill. 2d 85 (1976) ....................................................................................................................6 

Reed v. Town of Gilbert, 

576 U.S. 155 (2015) .................................................................................................................12 

Rogers v. CSX Intermodal Terminals, Inc., 

409 F.Supp.3d 612 (N.D. Ill. 2019) ..........................................................................................7 

Sea v. CCCJV Am. Holdings, Inc., 

No. CV 11-05031, 2011 WL 4946507 (C.D. Cal. Oct. 18, 2011) .............................................8 

Smith v. Daily Mail Pub. Co., 

443 U.S. 97 (1979) ...................................................................................................................11 

Smith v. Maryland, 

442 U.S. 735 (1979) .................................................................................................................13 

Sorrell v. IMS Health, Inc., 

564 U.S. 552 (2011) .............................................................................................................9, 10 

State v. Madrigal, 

241 Ill. 2d 463 (2011) ..............................................................................................................12 

Tobolt v. Allstate Ins. Co., 

75 Ill. App. 3d 57 (1st Dist. 1979) .........................................................................................6, 7 

U.S. West, Inc. v. FCC, 

182 F.3d 1224 (10th Cir. 1999) ...........................................................................................9, 10 

United States v. Caira, 

833 F.3d 803 (7th Cir. 2016) ...................................................................................................13 

United States v. Dionisio, 

410 U.S. 1 (1973) .....................................................................................................................11 

United States v. Emmett, 

321 F.3d 669 (7th Cir. 2003) ...................................................................................................11 

Vidoni v. Acadia Corp., 

No. 11-cv-00448, 2012 WL 1565128 (D. Me. Apr. 27, 2012) ..................................................7 

Ziarko v. Soo Line R. Co., 

161 Ill. 2d 267 (Ill. 1994) ...........................................................................................................6 

Statutes 

740 ILCS 14/1 ............................................................................................................................3, 11 

Case: 1:20-cv-04247 Document #: 46 Filed: 09/15/21 Page 4 of 20 PageID #:518
iv 

4810-8178-6105.3

740 ILCS 14/10 ...................................................................................................................... passim

740 ILCS 14/15(b) ...........................................................................................................................3 

740 ILCS 14/20 ............................................................................................................................4, 6 

740 ILCS 14/20 (1) ..........................................................................................................................1 

740 ILCS 14/20 (2) ......................................................................................................................1, 8 

740 ILCS 14/25 ..............................................................................................................................10 

Rules 

Fed. R. Civ. P. 12(b)(6)............................................................................................................1, 4, 5 

Case: 1:20-cv-04247 Document #: 46 Filed: 09/15/21 Page 5 of 20 PageID #:519
Plaintiff Fredy Sosa’s (“Plaintiff”) putative Class Action Complaint (Doc. 1-1 at PageID 

#13-27) (“Complaint”) must be dismissed with prejudice pursuant to Rule 12(b)(6) of the Federal 

Rules of Civil Procedure because Plaintiff has not pled facts plausibly demonstrating a BIPA 

claim. 

INTRODUCTION 

BIPA expressly states that photographs are not covered by the Act. They are expressly 

carved out of the definition of biometric identifier and biometric information. 740 ILCS 14/10 

(“biometric identifiers do not include ... photographs...” ; “Biometric information” is “any 

information, regardless of how it is captured, converted, stored, or shared, based on an individual’s 

biometric identifier used to identify an individual.”; “Biometric information does not include 

information derived from items or procedures excluded under the definition of biometric 

identifiers.”) Accordingly, Defendant did not violate BIPA at all, and the Complaint should be 

dismissed in its entirety and with prejudice. 

Alternatively, even if the Court determines that Plaintiff has stated a claim that Defendant 

violated BIPA, Plaintiff certainly does not allege facts from which a reasonable inference could be 

drawn that Defendant intentionally, recklessly, or negligently violated BIPA – as is necessary to 

state a claim for liquidated damages under 740 ILCS 14/20 (1) & (2). This is particularly true in 

light of BIPA’s express carveout language pertaining to photographs. Accordingly, at a minimum, 

Plaintiff’s claims for liquidated damages should be dismissed with prejudice. 

Furthermore, BIPA is an unconstitutional restraint on speech in violation of the First 

Amendment. The statute cannot survive either strict scrutiny or heightened scrutiny and 

consequently is invalid. 

Case: 1:20-cv-04247 Document #: 46 Filed: 09/15/21 Page 6 of 20 PageID #:520
2 

4810-8178-6105.3

BACKGROUND 

 Plaintiff alleges1 that “Defendant Onfido markets and sells biometric software that purports 

to help businesses identify and register customers.” (Compl. ¶ 1.) Plaintiff alleges he “is a member 

of an online marketplace where consumers buy and sell goods” and “the online marketplace 

partnered up with Onfido to establish its users’ identities.” (Compl. ¶¶ 33-34.) In particular, 

Plaintiff alleges he “established his identity through the online marketplace’s mobile application 

by uploading a photograph of his driver’s license and a photograph of his face” and “Onfido 

subsequently used biometric identification technology to extract his biometric information and 

compare the two photographs.” (Compl. ¶ 35.) Plaintiff alleges that Onfido’s “biometric software 

extracts and compares numerical biometric data from facial images to understand whether two 

faces are likely to be a match” and “checks whether uploaded facial images show signs of fraud 

by, for example, comparing a person’s numerical biometric data to the biometric data of known 

masks.” (Compl. ¶¶ 24-25.) 

 Based on these allegations, Plaintiff asserts individual and putative class claims for alleged 

violations of BIPA. (Compl. ¶¶ 46-58.) He seeks to represent “[a]ll residents of the State of Illinois 

who had their biometric identifiers or biometric information, including faceprints, collected, 

captured, received, otherwise obtained, or disclosed by Onfido while residing in Illinois.” (Compl. 

¶ 41.) 

Plaintiff does not allege that he was unaware his faceprint was being used for identification 

and fraud protection. To the contrary, Plaintiff knowingly submitted a photograph of his driver’s 

1

 Onfido’s arguments and use of terms in this brief are based on Plaintiff’s allegations, which must 

be taken as true at the pleading stage. Onfido does not admit that Plaintiff’s allegations and 

characterizations in the Complaint are accurate, and, for example, denies the system at issue uses 

“biometric identifiers,” “biometric information,” “facial geometry,” or “faceprints” as defined by 

BIPA. 

Case: 1:20-cv-04247 Document #: 46 Filed: 09/15/21 Page 7 of 20 PageID #:521
3 

4810-8178-6105.3

license and a photograph of his face when he signed up to use the online marketplace. (Compl. 35 

(“On or around April 2020, Plaintiff Sosa established his identity through the online marketplace’s 

mobile application by uploading a photograph of his driver’s license and a photograph of his 

face.”)) Instead, he alleges only that Onfido failed to give notice and obtain Plaintiff’s consent “in 

writing.” (E.g., Compl. ¶¶ 36-38.) 

ARGUMENT 

I. BIPA 

BIPA regulates a private entity’s collection, capture, purchase, receipt through trade or 

otherwise obtaining a “biometric identifier” and “biometric information.” 740 ILCS 14/1 et seq. 

A “biometric identifier” is “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face 

geometry,” but, significantly, “biometric identifiers do not include ... photographs...” 740 

ILCS 14/10 (emphasis added). “Biometric information” is “any information, regardless of how it 

is captured, converted, stored, or shared, based on an individual’s biometric identifier used to 

identify an individual.” Id. (emphasis added). “Biometric information does not include 

information derived from items or procedures excluded under the definition of biometric 

identifiers.” Id. (emphasis added). 

Specifically, BIPA provides that: 

No private entity may collect, capture, purchase, receive through trade, or 

otherwise obtain a person’s or a customer’s biometric identifier or biometric 

information, unless it first: 

(1) informs the subject or the subject’s legally authorized representative in writing 

that a biometric identifier or biometric information is being collected or stored; 

(2) informs the subject or the subject’s legally authorized representative in writing 

of the specific purpose and length of term for which a biometric identifier or 

biometric information is being collected, stored, and used; and 

(3) receives a written release executed by the subject of the biometric identifier or 

biometric information or the subject’s legally authorized representative. 

740 ILCS 14/15(b). 

Case: 1:20-cv-04247 Document #: 46 Filed: 09/15/21 Page 8 of 20 PageID #:522
4 

4810-8178-6105.3

BIPA provides that “[a]ny person aggrieved by a violation” of BIPA can obtain the 

following relief: 

(1) against a private entity that negligently violates a provision of this Act, 

liquidated damages of $1,000 or actual damages, whichever is greater; 

(2) against a private entity that intentionally or recklessly violates a provision of 

this Act, liquidated damages of $5,000 or actual damages, whichever is greater; 

(3) reasonable attorneys’ fees and costs, including expert witness fees and other 

litigation expenses; and 

(4) other relief, including an injunction, as the State or federal court may deem 

appropriate. 

740 ILCS 14/20 (emphasis added). BIPA does not provide strict liability for a damages claim. Id. 

II. Legal Standard 

To survive a motion to dismiss under Rule 12(b)(6), a complaint must “state a claim to 

relief that is plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). A 

pleading is required to contain “factual content that allows the court to draw the reasonable 

inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 

678 (2009). Moreover, “threadbare recitals of the elements of the cause of action, supported by 

mere conclusory statements, do not suffice.” Id. Here, Plaintiff’s Complaint must be dismissed 

pursuant to Rule 12(b)(6) because Plaintiff has not pled facts plausibly demonstrating a BIPA 

claim. 

III. Plaintiff Does Not State A Claim For Any Relief Because BIPA Expressly States That 

Photographs And Information Derived From Photographs Are Not Covered By 

BIPA. 

Plaintiff does not state a claim for any relief because Defendant has not violated BIPA. In 

the Complaint, Plaintiff seeks: (1) class certification, (2) a declaratory judgment that Defendant 

violated BIPA, (3) statutory damages for each willful or negligent violation of BIPA, (4) 

“injunctive and other equitable relief ... including an Order requiring Defendant to collect, store, 

and use biometric identifiers or information in compliance with the BIPA,” (5) reasonable 

Case: 1:20-cv-04247 Document #: 46 Filed: 09/15/21 Page 9 of 20 PageID #:523
5 

4810-8178-6105.3

attorneys’ fees and costs, (6) pre- and post-judgment interest, and (7) “other and further relief as 

equity and justice may require.” (Compl. pp. 14-15). 

BIPA does not apply to Onfido’s software because BIPA’s plain language expressly 

excludes both photographs and information derived from photographs. BIPA covers two 

categories of information: (1) original sources of information about a person (“biometric 

identifiers,” defined as a “retina or iris scan, fingerprint, voiceprint, or scan of hand or face 

geometry”) and (2) data derived from those original sources (“biometric information,” defined as 

“information . . . based on an individual’s biometric identifier”). 740 ILCS 14/10. BIPA’s 

definition of “biometric identifiers” expressly excludes “photographs,” and BIPA only covers a 

“scan of...face geometry,” not a scan of a photograph. Id. Moreover, BIPA’s definition of 

“biometric information” excludes “information derived from items or procedures excluded under 

the definition of biometric identifiers,” such as photographs. Id. 

Here, Plaintiff’s claim that Onfido violated BIPA is based on his allegations that Onfido’s 

software captures information from photographs submitted by users. (See, e.g., Compl. ¶¶ 22, 24 

(alleging that “a consumer establishing his or her identity through Onfido must upload a copy of 

his or her identification . . . and a photo of his or her face” and that Onfido’s “biometric software 

‘extract[s] and compare[s] numerical biometric data from facial images to understand whether two 

faces are likely to be a match’”). The Illinois legislature expressly excluded both photographs and 

information derived from photographs from BIPA’s reach. Because Onfido only collects 

photographs and information derived therefrom, Onfido is outside the scope of BIPA, and 

Plaintiff’s claim must be dismissed pursuant to Rule 12(b)(6). 

Case: 1:20-cv-04247 Document #: 46 Filed: 09/15/21 Page 10 of 20 PageID #:524
6 

4810-8178-6105.3

IV. Plaintiff Does Not State A Claim For $5,000 In Liquidated Damages Because Plaintiff 

Does Not Plead Facts From Which To Reasonably Infer That Defendant Intentionally 

or Recklessly Violated BIPA. 

Even if Plaintiff has stated a claim for a violation of BIPA (he has not), Plaintiff’s claim 

for $5,000 in liquidated damages for each violation must be dismissed because Plaintiff does not 

allege facts showing that Defendant “intentionally or recklessly” committed such alleged violation. 

740 ILCS 14/20. 

The Illinois Supreme Court holds that “tort intent means a desire to cause consequences or 

at least a substantially certain belief that the consequences will result.” Ziarko v. Soo Line R. Co., 

161 Ill. 2d 267, 272–73 (Ill. 1994) (internal quotation and alteration marks omitted). Furthermore, 

“reckless conduct which will support a cause of action...is conduct from which the actor knows 

[injury] is certain or substantially certain to result” or “situations in which there is a high degree 

of probability that [injury] will follow and the actor goes ahead in conscious disregard of it.” Pub. 

Fin. Corp. v. Davis, 66 Ill. 2d 85, 90 (1976) (affirming dismissal of tort claims as inadequately 

pled); see also Plocar v. Dunkin’ Donuts of Am., Inc., 103 Ill. App. 3d 740, 745-46 (1st Dist. 1981) 

(same); Ziarko, 161 Ill. 2d at 273 (equating “willful and wanton” conduct with “reckless” conduct 

and explaining it consists of “a failure, after knowledge of impending danger, to exercise ordinary 

care to prevent the danger, or a failure to discover the danger through carelessness when it could 

have been discovery by the exercise of ordinary care”) (internal quotation and alteration marks 

omitted). 

Significantly, “[a] mere statement that an act was done with a certain purpose or intent, 

without a statement of facts showing such purpose or intent, is a conclusion of law” and is not 

sufficient to state a claim for intentional or reckless conduct. Tobolt v. Allstate Ins. Co., 75 Ill. 

App. 3d 57, 63 (1st Dist. 1979). Tobolt, like this case, involved a complaint that repeatedly 

characterized the defendant’s actions as “willful, wanton, malicious, reckless and intentional,” but 

Case: 1:20-cv-04247 Document #: 46 Filed: 09/15/21 Page 11 of 20 PageID #:525
7 

4810-8178-6105.3

did not include any factual allegations supporting that characterization. Id. at 66-68. The court 

dismissed claims as inadequately pled, holding “[t]he allegations that defendant’s acts were 

willful, wanton, malicious, reckless, intentional or in bad faith are not factual allegations; nor are 

they supported by factual allegations.” Id. at 71; see also Mijatovich v. Columbia Sav. & Loan 

Ass’n, 168 Ill. App. 3d 313, 316 (1st Dist. 1988) (“mere addition of phrases such as ‘willful and 

wanton,’ or similar terms, is not sufficient to allege reckless conduct....”); Neuberg v. Michael 

Reese Hosp. & Med. Ctr., 60 Ill. App. 3d 679, 684–85 (1st Dist. 1978) (“merely adding that such 

actions were done ‘willfully, wantonly, and with a reckless disregard for the health, well-being 

and safety of plaintiffs...cannot take the place of a clear statement that defendants committed the 

alleged acts with the intention of inflicting severe emotional distress upon plaintiffs”). Indeed, in 

another BIPA case, this Court dismissed plaintiff’s complaint which pled in a similarly conclusory 

fashion that defendant’s “violations of BIPA . . . were knowing and willful,” finding that the 

allegations were insufficient to allow the court to infer that defendant acted intentionally or 

recklessly. Rogers v. CSX Intermodal Terminals, Inc., 409 F.Supp.3d 612, 618-19 (N.D. Ill. 2019) 

(Aspen, J.). 

Cases holding that plaintiffs failed to adequately plead “willful,” “reckless,” or 

“intentional” violations under federal statutes likewise abound. See, e.g., Komorowski v. AllAmerican Indoor Sports, Inc., No. 13-2177, 2013 WL 4766800, at *3 (D. Kan. Sept. 4, 2013) 

(“Merely alleging that a defendant should be aware of a statute and fails to comply with it...is 

insufficient to state a claim for willfulness.”); Vidoni v. Acadia Corp., No. 11-cv-00448, 2012 WL 

1565128, at *4 (D. Me. Apr. 27, 2012) (“Merely being aware of a statute, then, is insufficient to 

state a claim for willfulness. In cases where the Defendant is aware of a statute’s requirements, 

the Plaintiff must also allege that there was something more than a negligent violation, i.e., a 

Case: 1:20-cv-04247 Document #: 46 Filed: 09/15/21 Page 12 of 20 PageID #:526
8 

4810-8178-6105.3

voluntary, deliberate or intentional violation.”); Sea v. CCCJV Am. Holdings, Inc., No. CV 11-

05031, 2011 WL 4946507, at *2 (C.D. Cal. Oct. 18, 2011) (holding that mere allegations of facts 

showing that information about a statute was available to defendant did nothing to support “naked 

assertion” that defendant was notified of statute’s provisions and knowingly ignored them); 

Huggins v. SpaClinic, LLC, No. 09 C 2677, 2010 WL 963924, at *2 (N.D. Ill. Mar. 11, 2010) 

(granting motion to dismiss because allegations that statute was well-publicized and known in the 

industry “are not specific to the defendant” and “do not permit the inference that [defendant]’s 

conduct was anything more than negligent”). 

Here, the plain language of BIPA expressly states that photographs and information derived 

from photographs are not covered by BIPA. 740 ILCS 14/10 (“biometric identifiers do not include 

... photographs...”; “Biometric information” is “any information, regardless of how it is captured, 

converted, stored, or shared, based on an individual’s biometric identifier used to identify an 

individual.”; “Biometric information does not include information derived from items or 

procedures excluded under the definition of biometric identifiers.”) Plaintiff does not include any 

factual allegations in his Complaint supporting the conclusory assertions that Defendant 

intentionally or recklessly violated BIPA, much less in light of BIPA’s plain language expressly 

carving out “photographs.” Accordingly, Plaintiff’s claim for $5,000 in liquidated damages per 

violation pursuant to 740 ILCS 14/20(2) should be dismissed. 

V. Plaintiff Does Not State A Claim For $1,000 In Liquidated Damages Because Plaintiff 

Does Not Plead Facts From Which To Reasonably Infer That Defendant Negligently 

Violated BIPA. 

To support a claim for a negligent violation of BIPA, Plaintiff must allege facts showing 

the “existence of a duty owed by the defendant to the plaintiff, a breach of that duty, and injury 

proximately resulting from the breach.” Bruns v. City of Centralia, 2014 IL 116998, ¶ 12. A 

plaintiff cannot plead a negligence claim if no duty existed, and a duty only exists to act as a 

Case: 1:20-cv-04247 Document #: 46 Filed: 09/15/21 Page 13 of 20 PageID #:527
9 

4810-8178-6105.3

reasonably prudent person. Id. at ¶ 14. “Duties can arise from common law, statute, ordinance, or 

regulation.” Chiriboga v. Nat'l R.R. Passenger Corp., 687 F. Supp. 2d 764, 768 (N.D. Ill. 2009). 

Here, the duties that Plaintiff alleges Onfido was required to follow but did not arise from statute, 

i.e., from BIPA. 

Regardless of whether Plaintiff’s actions of “uploading a photograph of his driver’s license 

and a photograph of his face” imposed duties upon Onfido under BIPA, Plaintiff has not alleged 

facts showing that it was unreasonable to assume that photographs and information derived from 

photographs were not covered by BIPA. The plain language of BIPA states that “biometric 

identifiers do not include ... photographs...” and that, for information to be covered “biometric 

information,” it must be “based on an individual’s biometric identifier.” 740 ILCS 14/10 

(emphasis added). Additionally, the BIPA expressly states that “[b]iometric information does 

not include information derived from items or procedures excluded under the definition of 

biometric identifiers.” Id. (emphasis added). 

Because BIPA specifies that a biometric identifier does not include photographs, it is 

reasonable as a matter of law for Onfido to conclude that any information derived from 

photographs does not constitute biometric information. Therefore, Plaintiff’s claim for any 

negligent violation of BIPA fails to state a claim upon which relief can be granted. 

VI. BIPA Violates The First Amendment. 

a. BIPA Is An Unconstitutional Restraint on Commercial Speech. 

“[I]nformation is not in itself harmful....” Sorrell v. IMS Health, Inc., 564 U.S. 552, 578 

(2011) (internal quotation marks omitted). “Facts, after all, are the beginning point for much of 

the speech that is most essential to advance human knowledge and to conduct human affairs.” Id.

at 570. Restrictions on access to information in private hands, such as customer data, violate the 

First Amendment. Id. at 576; see also U.S. West, Inc. v. FCC, 182 F.3d 1224 (10th Cir. 1999) 

Case: 1:20-cv-04247 Document #: 46 Filed: 09/15/21 Page 14 of 20 PageID #:528
10 

4810-8178-6105.3

(invalidating law that restricted use of customer information for marketing purposes). In IMS 

Health, the Supreme Court held a state statute restricting pharmacies from selling retained 

information about drug prescribing habits violated the First Amendment. Specifically, the Court 

explained that: 

...Vermont has imposed a restriction on access to information in private 

hands....[W]e do have ‘a case in which the government is prohibiting a speaker 

from conveying information that the speaker already possesses.’ The difference 

[between that and government information] is significant. An individual’s right to 

speak is implicated when information he or she possesses is subjected to ‘restraints 

on the way in which the information might be used’ or disseminated. 

IMS Health, 564 U.S. at 568. 

In U.S. West, the Tenth Circuit held an FCC regulation violated the First Amendment where 

it restricted telecommunication carriers from using customer information “‘made available to the 

carrier by the customer solely by virtue of the carrier-customer relationship.’” U.S. West, 182 F.3d 

at 1228 n.1. The FCC contended the regulation did not affect “speech” because it only regulated 

use of data. Id. at 1232. The court rejected this argument and held the regulation did restrict 

speech because it made speech more difficult by limiting the ability of carriers to target their speech 

to a particular audience. Id. 

Like the information at issue in IMS Health and U.S. West, the information at issue here—

factual information voluntarily provided by consumers to identify themselves as marketplace 

users—is commercial speech.2 As such, any restriction on that speech must meet three conditions 

2

 BIPA is also a speaker-based restriction on speech because it explicitly does not apply to certain 

groups of people. In particular, BIPA exempts “a financial institution or an affiliate of a financial 

institution that is subject to Title V of the federal Gramm-Leach-Bliley Act” and “a contractor, 

subcontractor, or agent of a State agency or local unit of government when working for that State 

agency or local unit of government.” 740 ILCS 14/25. In other words, BIPA regulates speech 

differently based on the identity of the speaker. Under Sorrell, speaker-based restrictions are 

likewise subject to heightened scrutiny. Sorrell, 564 U.S. at 569-70. 

Case: 1:20-cv-04247 Document #: 46 Filed: 09/15/21 Page 15 of 20 PageID #:529
11 

4810-8178-6105.3

in order to survive: (1) the government must have a “substantial interest” in regulating the speech, 

(2) the regulation must directly and materially advance that interest, and (3) the regulation must 

be “no[] more extensive than is necessary to serve that interest.” Central Hudson Gas & Elec. 

Corp. v. Pub. Serv. Comm’n of New York, 447 U.S. 557, 566 (1980); see also People v. Sequoia 

Books, Inc., 127 Ill. 2d 271, 281 (1989) (same).

BIPA does not meet any of these conditions. First, the government has no “substantial 

interest” in restricting the collection, handling, or disclosure of facial geometry. The Supreme 

Court has held that a person has no reasonable expectation of privacy in his or her “physical 

characteristics” that “are constantly exposed to the public.” United States v. Dionisio, 410 U.S. 1, 

14 (1973). Person’s faces are physical characteristics constantly exposed to the public. Cupp v. 

Murphy, 412 U.S. 291, 295 (1973). See also United States v. Emmett, 321 F.3d 669, 672 (7th Cir. 

2003) (“[W]e think it clear that a person has no expectation of privacy in a photograph of his 

face.”). Indeed, people show their faces throughout the day every day. Therefore, once “truthful 

information [is] ‘publicly revealed’ or ‘in the public domain,’ a court may not constitutionally 

restrain its dissemination.” Smith v. Daily Mail Pub. Co., 443 U.S. 97, 103 (1979). 

Second, even if the government were deemed to have a “substantial” interest in preventing 

the collection, handling, or disclosure of information, requiring a company to “develop a written 

policy, made available to the public,” to provide disclosures “in writing,” and to obtain “a written 

release” does not directly and materially advance that interest. See 740 ILCS 14/1 et seq. 

Plaintiff admits that he voluntarily provided his photo and driver’s license and 

subsequently uploaded his photo and driver’s license to increase his own reputation and 

trustworthiness on the online marketplace. (Compl. ¶¶ 33, 35.) Plaintiff understood that his 

photograph would be used to “register [his] identit[y]” and would be stored because he 

Case: 1:20-cv-04247 Document #: 46 Filed: 09/15/21 Page 16 of 20 PageID #:530
12 

4810-8178-6105.3

“established his identity through the online marketplace’s mobile application by uploading a 

photograph of his driver’s license and a photograph of his face.” (Id.) There are no allegations that 

his photographs were disclosed or used in any manner other than the one for which he voluntarily 

provided them. BIPA’s requirement that disclosures be made and releases obtained “in writing” 

does not materially advance any interest because—as this case illustrates—others forms of 

disclosure and consent are equally effective. 

For the same reasons, BIPA’s requirements are far “more extensive than necessary to serve 

that interest” of preventing identity theft. As the Sixth Circuit noted in Daniel v. Cantrell: 

Just because Congress’ goal was to prevent the disclosure of private information, 

does not mean that Congress intended the implementation of every conceivable 

method of preventing disclosures. Printing all personal information in 

hieroglyphics instead of English would also help prevent the disclosure of such 

information. 

375 F.3d 377, 383-384 (6th Cir. 2004). Converting the information to “hieroglyphics” would also 

protect it but would be more extensive than necessary. Id. at 384. Prohibiting companies from 

collecting and using factual identifying information without making certain disclosures and 

obtaining written consent is even more extensive, because it restricts companies from engaging in 

wholly permissible activities. See id.; see also, e.g., State v. Madrigal, 241 Ill. 2d 463, 473 (2011) 

(“what is wrongful is not the gathering of such information by using a person’s name or address, 

but rather gathering or using such information for the purpose of committing identity theft.”). 

Because Plaintiff’s claim is premised on BIPA, which is unconstitutional, the Complaint must be 

dismissed in its entirety. 

b. Alternatively, BIPA Is A Content-Based Restriction Subject To Strict 

Scrutiny. 

Alternatively, BIPA is a content-based restriction on speech because it targets only certain 

categories of information that can be used to identify a person. See 740 ILCS 14/10; Reed v. Town 

Case: 1:20-cv-04247 Document #: 46 Filed: 09/15/21 Page 17 of 20 PageID #:531
13 

4810-8178-6105.3

of Gilbert, 576 U.S. 155, 163 (2015) (content-based statute is one which “target[s] speech based 

on its communicative content”). Such content-based regulations “are presumptively 

unconstitutional and may be justified only if the government proves that they are narrowly tailored 

to serve compelling state interests.” Nat’l Inst. of Family & Life Advocates v. Becerra, 138 S. Ct. 

2361, 2371 (2018) (internal quotation marks omitted). 

BIPA cannot meet this standard for the same reasons it cannot survive heightened scrutiny. 

As explained above, a person has no reasonable expectation of privacy in his or her facial 

geometry, which is simply a physical characteristic that is constantly exposed to the public. Supra

§ VI(a). The government consequently has no compelling interest in regulating the collection, use, 

and storage of such information. Moreover, even if the government did have an interest in 

regulating this information, BIPA is certainly not narrowly tailored. There is no need for the statute 

to require that disclosures be made and releases obtained “in writing” when other forms of 

disclosure and consent are equally effective. Supra § VI(a). Indeed, Plaintiff explicitly alleges 

that he knowingly and voluntarily provided “a photograph of his driver’s license and a photograph 

of his face.” (Compl. ¶ 35.) In other words, he voluntarily relinquished any right to control that 

information. See Smith v. Maryland, 442 U.S. 735, 743-44 (1979) (“This Court consistently has 

held that a person has no legitimate expectation of privacy in information he voluntarily turns over 

to third parties.”); United States v. Caira, 833 F.3d 803, 806 (7th Cir. 2016) (no expectation of 

privacy in information disclosed to third parties). 

CONCLUSION 

 WHEREFORE, Defendant Onfido, Inc. respectfully requests that this Court dismiss 

Plaintiff’s Complaint with prejudice and for any other relief as the court deems just. 

Case: 1:20-cv-04247 Document #: 46 Filed: 09/15/21 Page 18 of 20 PageID #:532
14 

4810-8178-6105.3

Date: September 15, 2021 Respectfully submitted, 

/s/Bonnie Keane DelGobbo 

Bonnie Keane DelGobbo 

Amy L. Lenz 

BAKER & HOSTETLER LLP 

One N. Wacker Dr., Suite 4500 

Chicago, IL 60606 

Telephone: (312) 416-6200 

Facsimile: (312) 416-6201 

bdelgobbo@bakerlaw.com 

alenz@bakerlaw.com 

Joel Griswold 

BAKER & HOSTETLER LLP

200 S. Orange Ave., Suite 2300 

Orlando, FL 32801-3432 

Telephone: (407) 649-4088 

jcgriswold@bakerlaw.com

Attorneys for Defendant Onfido, Inc 

 

Case: 1:20-cv-04247 Document #: 46 Filed: 09/15/21 Page 19 of 20 PageID #:533
15 

4810-8178-6105.3

CERTIFICATE OF SERVICE 

I hereby certify that on September 15, 2021, I electronically filed the foregoing document 

with the Clerk of Court using the CM/ECF system, which will send notification of such filing to 

all Counsel of Record. Parties may access this filing through the Court’s system. 

/s/ Bonnie Keane DelGobbo 

Case: 1:20-cv-04247 Document #: 46 Filed: 09/15/21 Page 20 of 20 PageID #:534