IN THE UNITED STATES DISTRICT COURT

FOR THE NORTHERN DISTRICT OF ILLINOIS, EASTERN DIVISION

FREDY SOSA, individually and on behalf of 

all others similarly situated,

Plaintiff,

v.

ONFIDO, INC., a Delaware corporation,

Defendant.

 Case No.: 20-cv-04247

 Honorable Marvin E. Aspen

PLAINTIFF’S RESPONSE TO DEFENDANT’S MOTION TO DISMISS

Case: 1:20-cv-04247 Document #: 49 Filed: 10/15/21 Page 1 of 17 PageID #:539
1

INTRODUCTION

Having delayed this litigation for well over a year with its baseless attempt to compel 

arbitration, Defendant Onfido, Inc. returns with similarly baseless arguments in support of its 

motion to dismiss Plaintiff Fredy Sosa’s claim under the Biometric Information Privacy Act, 740 

ILCS 14. First, Onfido contends that its actions are not covered by BIPA because it extracted 

biometric data from photographs, but it fails to provide any textual support for this analysis, 

which has been rejected by every court to consider it. Next, Onfido complains that Sosa has not 

sufficiently pleaded its state of mind and asks the Court to dismiss a portion of Sosa’s claim. 

However, Rule 12 does not permit piecemeal dismissals, pleading a BIPA claim does not require 

allegations regarding state of mind, and Onfido ignores the fact that Sosa included such 

allegations anyway. Finally, Onfido offers a lengthy yet vague argument challenging the 

constitutionality of BIPA under the First Amendment, in which it identifies no speech that it is 

prohibited from engaging in and which depends on the incorrect premise that there is no state 

interest in protecting consumer privacy. These arguments should all be rejected, and the case 

should—at long last—proceed to discovery.

FACTUAL BACKGROUND

Onfido contracts with online marketplaces to identify people using their facial geometry. 

(Compl. ¶¶ 1, 33-34.) Although Onfido operates the services, it allows its customers to embed 

Onfido software into their own websites in a way that conceals its own involvement and makes it

difficult for the end-user consumers to understand that they are dealing with Onfido, not the 

business whose website they visited. (Id. ¶ 3.)

Plaintiff Fredy Sosa used the mobile application of one of Onfido’s customers to 

establish his identity. (Id. ¶ 35.) After Sosa uploaded a photograph of his Illinois driver’s license

Case: 1:20-cv-04247 Document #: 49 Filed: 10/15/21 Page 2 of 17 PageID #:540
2

and another photograph of his face, Onfido used biometric identification technology to scan 

Sosa’s face and extract a numeric representation of his facial geometry—often called a 

“faceprint.” (See id. ¶¶ 23-24, 35, 51.) This faceprint is not a photograph of Sosa, but a numeric 

representation of the shape of Sosa’s face that computers can use to identify him automatically.

(See id. ¶¶ 24-25, 27.) Onfido then kept Sosa’s unique faceprint in a database and accessed it 

every time another person used Onfido’s verification process. (Id. ¶ 27.)

Onfido did not obtain Sosa’s consent to use his biometric data in this manner, violating 

740 ILCS 14/15(a). (Id. ¶ 36.) In addition, Onfido never informed Sosa of any biometric data 

retention policy it developed, nor whether it will ever delete the unique biometric data it took 

from his face, which violates 740 ILCS 14/15(a). (Id. ¶ 37.) Sosa now seeks relief.

ARGUMENT

I. Plaintiffs Properly Allege that Onfido Collects Biometric Identifiers from 

Photographs.

Onfido begins with the atextual argument that its conduct is “outside the scope of BIPA” 

because it collects faceprints from photographs. “This is not the first—or second, or third, or 

even fourth—time that defendants have challenged BIPA’s applicability to facial scans derived 

from photographs. Every court has rejected [Onfido’s] argument.” See Vance v. Microsoft Corp., 

No. 20-cv-1082, 2021 WL 963485, at *6 (W.D. Wash. Mar. 15, 2021) (collecting cases). 

Because BIPA’s definition of “biometric identifier” plainly includes a scan of face geometry 

collected from a photograph, this Court should do the same.

Section 15(b) of BIPA prohibits private entities from collecting or “otherwise 

obtain[ing]” biometric identifiers without providing information about how the biometric 

identifiers will be used and securing a written release. BIPA defines a biometric identifier as “a 

retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.” 740 ILCS 14/10. 

Case: 1:20-cv-04247 Document #: 49 Filed: 10/15/21 Page 3 of 17 PageID #:541
3

“The Act goes on, in the same long paragraph as the affirmative definition, to list a catalogue of

things that are not biometric identifiers.” Rivera v. Google Inc., 238 F. Supp. 3d 1088, 1094

(N.D. Ill. 2017) (Chang, J.). Relevant to this case, the definition provides that “[b]iometric 

identifiers do not include ... photographs[.]” 740 ILCS 14/10.

Onfido contends that because its facial scans come from photographs, they are

categorically excluded from BIPA. But Sosa “‘do[es] not claim that simply possessing a

photograph of a face violates BIPA,’ and thus the exclusion of photographs as biometric

identifiers has little bearing.” See Vance, 2021 WL 963485, at *6. Rather, he alleges that Onfido 

scanned a photograph of his face, then extracted a numerical value from that photograph that 

could be used to identify Sosa’s face as compared to other faces, all without his written, 

informed consent. While Sosa is not yet privy to the exact technical details of how the Onfido

face scan works, he is entitled to the inference that it has to do with the shape (or “geometry” in 

BIPA parlance) of his face, and Onfido does not suggest otherwise. Accordingly, Sosa has 

plausibly alleged that the numerical representation that Onfido derives from its scan of Sosa’s 

face is a “scan of ... face geometry” and therefore a biometric identifier under BIPA.

Onfido tries to avoid that conclusion by pivoting to a wholly separate definition, that of

biometric information, which provides that:

“Biometric information” means any information, regardless of how it is captured, 

converted, stored, or shared, based on an individual’s biometric identifier used to 

identify an individual. Biometric information does not include information derived 

from items or procedures excluded under the definition of biometric identifiers. 

740 ILCS 14/10. To be clear, BIPA bans nonconsensual collection of both biometric identifiers 

and biometric information, meaning that Sosa only needs to plead that Onfido collected one or 

the other to state a claim. See 740 ILCS 14/15(b). Conflating the two definitions, Onfido 

suggests “that if biometric information cannot be ‘based on’ something from the biometricCase: 1:20-cv-04247 Document #: 49 Filed: 10/15/21 Page 4 of 17 PageID #:542
4

identifier paragraph’s ‘do not include’ list (for example, ‘photographs’), then an identifier may 

also not be ‘based on’ something from that same list.” See Rivera, 238 F. Supp. 3d at 1096. “The 

problem with this argument is that there is no textual or structural clue to support it.” Id. Onfido

points to nothing in the text, structure, context, or purpose of the statute that would permit the 

conclusion that even though the Illinois legislature did not include “‘based on’ or ‘derived from’ 

language in the definition of ‘biometric identifier,’” it somehow meant to do so. See id. at 1097. 

Absent any such indication, it is simply “not sensible to use the photograph exclusion to back-fill 

an interpretation of biometric identifier—unless, of course, the proposed identifier in question is 

simply a photograph. But a photograph is just that—a photograph, not a scan of face geometry, 

which is a set of biology-based measurements.” Id.; see also In re Facebook Biometric Info.

Privacy Litig., 185 F. Supp. 3d 1155, 1171 (N.D. Cal. 2016).

In sum, although Onfido’s “facial scans may not qualify as biometric information—

because they are ‘derived from items ... excluded under the definition of biometric identifiers,’ 

namely, photographs—there is no textual support for the contention that these scans could not be

biometric identifiers themselves.” See Vance, 2021 WL 963485, at *6. And because BIPA 

forbids nonconsensual collection of a biometric identifier, Sosa states a claim. See id. at *7.

II. BIPA’s State of Mind Requirements Provide No Basis for Dismissal at this Stage.

Next, Onfido argues that Plaintiff’s complaint lacks sufficient allegations that its 

violations of BIPA were negligent, reckless, or intentional. Onfido improperly tries to split 

Sosa’s single claim into pieces, arguing first that the Court should forbid Sosa from seeking

liquidated damages based on intentional or reckless conduct, then, separately, that Sosa should 

be prohibited from seeking liquidated damages for negligent conduct. Rule 12(b)(6) does not 

permit such piecemeal dismissals. Even if the Court considers Onfido’s substantive arguments at 

Case: 1:20-cv-04247 Document #: 49 Filed: 10/15/21 Page 5 of 17 PageID #:543
5

this stage, they are wanting. BIPA’s use of the term “negligently” does not import the pleading 

standard for a separate common law tort, and the complaint contains sufficient allegations to 

render it plausible that Onfido acted either negligently or recklessly.

A. BIPA Plaintiffs Do Not Need to Plead State of Mind.

As a threshold matter, “[a] motion to dismiss under Rule 12(b)(6) doesn’t permit 

piecemeal dismissals of parts of claims; the question at this stage is simply whether the 

complaint includes factual allegations that state a plausible claim for relief.” BBL, Inc. v. City of 

Angola, 809 F.3d 317, 325 (7th Cir. 2015). “A claim is the aggregate of operative facts which 

give rise to a right enforceable in the courts. One claim supported by multiple theories does not 

somehow become multiple claims” that the Court can split up and analyze individually. See 

Sojka v. Bovis Lend Lease, Inc., 686 F.3d 394, 399 (7th Cir. 2012) (quotation marks and citation 

omitted); see also BBL, 809 F.3d at 324 (questioning district court’s decision to “split a single 

claim into multiple components based on the elements of the applicable ... test”). In this respect, 

federal procedure differs sharply from the rules applied in the Illinois cases that Onfido cites, 

which do permit portions of a pleading to be stricken. See 735 ILCS 5/2-615.

Here, Sosa has pleaded a single cause of action for violations of BIPA. That cause of 

action comes from Section 20 of BIPA, which provides a cause of action to “Any person

aggrieved by a violation of this Act,” without limitation. 740 ILCS 14/20. It then provides “four

remedies available to prevailing plaintiffs in BIPA cases.” Bradenberg v. Meridian Senior

Living, LLC, No. 20-CV-03198, 2021 WL 4494275, at *5 (C.D. Ill. Sept. 30, 2021). “Two of the

four remedies in Section 14/20 are liquidated damages in the event a defendant acts with a

specific state of mind when violating BIPA”—$1,000 per negligent violation and $5,000 per 

intentional or reckless violation. Id. The other remedies, “[r]ecovery of attorneys’ fees and

Case: 1:20-cv-04247 Document #: 49 Filed: 10/15/21 Page 6 of 17 PageID #:544
6

costs—740 ILCS 14/20(3)—and any ‘other relief, including an injunction,’ the Court may deem

proper, 740 ILCS 14/20(4) can ... be awarded without state of mind requirements.” Id. Critically, 

“[t]he menu of remedies in Section 14/20 is just that: a menu of remedies. It is not, as Defendant

argues, a list of the necessary elements of a BIPA claim.” Id. 

As permitted by Section 20, Sosa “has requested various forms of relief for each alleged 

violation [of BIPA], not only statutory damages but also declaratory relief and injunctive relief.” 

See Cothron v. White Castle Sys., Inc., 467 F. Supp. 3d 604, 615 (N.D. Ill. 2020); (Compl. ¶ 58.) 

Accordingly, “if the complaint plausibly pleads violations of Section 15(b) ... then, even absent

specific allegations about [Onfido’s] mental state with respect to each of those claims, it has

stated a claim entitling [Sosa] to litigation expenses and injunctive relief under Section 20,

whether or not [he] proves an entitlement to damages based on negligent, reckless, or intentional

conduct.” See Cothron, 467 F. Supp. 3d at 615. As discussed above, Onfido’s only argument 

regarding BIPA’s substantive prohibition is legally wrong. Sosa has therefore stated a claim and 

at this stage is not required to demonstrate entitlement to a certain kind of relief by pleading state 

of mind. See id.; Bradenberg, 2021 WL 4494275, at *6; Burlinski v. Top Golf USA Inc., No. 19-

CV-06700, 2020 WL 5253150, at *8 (N.D. Ill. Sept. 3, 2020) (Chang, J.) (“[T]o the extent that

recklessness is a prerequisite for certain types of statutory remedies, it is premature to raise the

issue at the pleading stage.”); Stauffer v. Innovative Heights Fairview Heights, LLC, No. 3:20-

CV-00046-MAB, 2020 WL 4815960 (S.D. Ill. Aug. 19, 2020). No further analysis regarding 

state of mind is required to deny this motion to dismiss.

B. Sosa Pleaded Facts Sufficient to Permit the Court to Conclude that Onfido 

Acted with a Negligent State of Mind.

Nevertheless, for the sake of completeness, Sosa will briefly address Onfido’s illsupported arguments that Sosa has failed to plead a negligent state of mind.

Case: 1:20-cv-04247 Document #: 49 Filed: 10/15/21 Page 7 of 17 PageID #:545
7

Onfido begins by confusing the state of mind requirement in BIPA with the standalone 

tort of negligence and suggesting that the requirements of that tort need to be proved to state a 

claim under BIPA. (Mot. at 8-9.) But the term “negligently” as used in BIPA is a generic term

that reflects a degree of culpability, not a reference to a specific common law tort. Cf. Ill. Pattern

Jury Instructions 10.01 (“When I use the word ‘negligence’ in these instructions, I mean the

failure to do something which a reasonably careful person would do....”). Indeed, the Illinois 

legislature routinely uses that term in statutes that have nothing to do with the common law tort

of negligence. See Thurman v. Northshore Univ. Health Sys., No. 18 CH 3544, 2019 WL 

7249205, at *12 (Cir. Ct. Cook Cnty., Dec. 12, 2019) (Valderrama, J.) (citing 510 ILCS 68/5-40, 

which prohibits negligent or intentional release of non-indigenous herptiles). The effect is to 

avoid imposing damages for wholly blameless conduct (such as unwittingly relying on a written 

release that turns out to be fraudulently signed), not to “graft requirements not provided for by

the plain language of the text.” See id. (“A statutory cause of action is not a negligence cause of

action.”); Rosenbach v. Six Flags Ent. Corp., 129 N.E.3d 1197, 1204 (Ill. 2019) (refusing to add 

unexpressed limitations to BIPA).

Onfido also contends that Sosa’s claim should be dismissed because he did not “allege[] 

facts showing that it was unreasonable to assume that photographs and information derived from 

photographs were not covered by BIPA.” (Mot. at 9.) Effectively, the argument is that Onfido 

believed that it wasn’t collecting biometric identifiers because it supposedly interpreted BIPA a 

certain way, so it’s off the hook. Most obviously, this argument is improper on a motion to 

dismiss because it finds no support in the complaint. To accept Onfido’s argument, the Court 

needs to assume that before collecting Sosa’s faceprint, Onfido considered BIPA and then, acting 

Case: 1:20-cv-04247 Document #: 49 Filed: 10/15/21 Page 8 of 17 PageID #:546
8

reasonably, concluded that BIPA did not apply to this situation. Those purported facts are wholly 

absent from the complaint and therefore cannot be raised on a motion to dismiss. 

Even if what Onfido says is true, it still doesn’t preclude the award of liquidated damages 

for negligent violations of BIPA. Sosa alleges that Onfido collected his biometric data in April 

2020, after several courts had already examined its photograph-exception theory and found it to 

be legally wrong. Onfido has unearthed no authority whatsoever, other than its own incorrect 

reading of the statute, to support the purported reasonableness of its reading. Its argument really 

“amounts to a claim that ignorance of the law excuses non-compliance” and “is at odds with

centuries of Anglo-American jurisprudence.” United States v. Roberts, No. 6:07 CR 70031, 2007

WL 2155750, at *2 (W.D. Va. July 27, 2007); accord Lexington Ins. Co. v. Rugg & Knopp, Inc.,

165 F.3d 1087, 1094 (7th Cir. 1999) (“That Lexington had failed to apprise itself of the state and

effect of [state] law is unfortunate—for Lexington, anyway—but does not relieve Lexington of

its statutory liability.”). If pleading a negligent state of mind is required, Sosa has done it.

C. Sosa Pleaded Facts Sufficient to Conclude that Onfido Acted Recklessly or 

Intentionally.

Because Sosa pleaded facts sufficient to make it plausible that Onfido acted negligently, 

there is no reason for the Court to consider, at this stage, whether Onfido acted recklessly or 

intentionally. See Figueroa v. Kronos Inc., 454 F. Supp. 3d 772, 786 (N.D. Ill. 2020) (“It is

unnecessary to decide whether the complaint alleges facts sufficient to raise an inference of

recklessness. BIPA provides that recklessness offers a basis for greater liquidated damages, not

for a separate claim.”). Further, improperly “dismissing” this theory would have no practical 

effect. Sosa will seek the same type of discovery and proffer the same type of evidence to 

demonstrate that Onfido had acted negligently as he would to demonstrate that it had acted 

recklessly. See Doe v. Catholic Bishop of Chicago, 82 N.E.3d 1229, 1233-34 (Ill. App. Ct. 2017)

Case: 1:20-cv-04247 Document #: 49 Filed: 10/15/21 Page 9 of 17 PageID #:547
9

(noting that the “same set of facts” can support both a negligence finding and a finding that the 

defendant acted with a more culpable state of mind). And when that evidence comes up, Sosa 

will be permitted to obtain the requisite relief, regardless of what his complaint says. See 

Bontkowski v. Smith, 305 F.3d 757, 762 (7th Cir. 2002) (quoting Fed. R. Civ. P. 54(c)) (“[A] 

prevailing party may obtain any relief to which he’s entitled even if he ‘has not demanded such

relief in [his] pleadings.’”).

To the extent the Court considers recklessness a substantive part of a BIPA claim that 

needs to be pleaded, Sosa satisfies Rule 8(a). “BIPA has been in effect for more than 10 years,

and [Sosa has] clearly alleged that [Onfido] has failed to comply with the requirements of the

statute.” See Burlinski, 2020 WL 5253150, at *8. “Beyond that, it is not necessary ... to plead

details regarding what [Onfido] knew or did not know and when.” See id. (cleaned up). Yet, 

there are still more details in the complaint. Sosa alleged that Onfido collected his biometric 

identifier not just from any photo, but from his Illinois driver’s license, which says the word 

“ILLINOIS” in large letters and displays an Illinois address. (Compl. ¶ 35.) See Jesse White, 

Central Issuance Driver’s Licenses/ID Cards, https://cite.law/UBM4-CH87; Menominee Indian

Tribe of Wisconsin v. Thompson, 161 F.3d 449, 456 (7th Cir. 1998) (“Judicial notice of ...

documents contained in the public record ... is proper.”). While a defendant who just didn’t 

bother to check which state a person was from before collecting biometrics might be merely 

careless, one who pulls biometric data from an identification document issued by the State of 

Illinois is plausibly acting recklessly. On top of that, Sosa alleges that Onfido took steps to 

conceal its involvement in the collection of biometric data. (Compl. ¶¶ 3, 36.) On a motion to 

dismiss, the Court can infer that Onfido purposefully obscured that it was the entity collecting 

Sosa’s biometric data—intentional conduct directly opposite to the purpose of the statute. 

Case: 1:20-cv-04247 Document #: 49 Filed: 10/15/21 Page 10 of 17 PageID #:548
10

At summary judgment, there will no doubt be a further exploration of Onfido’s state of 

mind in collecting biometric data. At this point, however, Rule 12 does not permit the Court to 

dismiss a portion of Sosa’s claim, nor does it permit the Court to require detailed allegations 

regarding Sosa’s legal theory. The pleading is sufficient.

III. The First Amendment Does Not Prevent this Suit from Proceeding Because Onfido 

Fails Any Protected Speech.

The remainder of Onfido’s argument is dedicated to its view that BIPA is an 

unconstitutional restraint on speech. Onfido never expressly states whether it is raising a facial or 

as-applied challenge, but it appears to be the latter. Onfido requests only that the Court dismiss 

the lawsuit against it, not that it strike down the statute, and it couches its arguments in terms of 

its own conduct, not the conduct of others. To the extent that Onfido is attempting to raise a 

facial challenge, it cites none of the case law applicable to facial challenges, makes no attempt to 

explain which standard it is attempting to meet, and offers no analysis as to why it might meet 

that standard. See Wash. State Grange v. Wash. State Republican Party, 552 U.S. 442, 449-50 & 

n.6 (2008). The Court should not consider such an ill-developed argument.

As far as the as-applied challenge, the question is: where’s the speech? While BIPA 

contains restrictions on disclosing biometric data, those restrictions aren’t at issue in this case.

The only substantive provisions of BIPA at issue here—sections 15(a) and (b)—do not restrict

Onfido’s speech. Section 15(a) requires private entities to develop a data retention policy and 

adhere to it, and Section 15(b) restricts the collection of biometric data. Both involve conduct, 

not speech.1

1 BIPA’s required disclosures could in theory be viewed as compelled speech, but Onfido 

does not suggest that it has been compelled to speak in a manner that it does not want to. It only 

argues that its speech has been curtailed. Any argument regarding compelled speech is forfeited.

Case: 1:20-cv-04247 Document #: 49 Filed: 10/15/21 Page 11 of 17 PageID #:549
11

Undeterred, Onfido complains that BIPA “restricts companies from engaging in wholly

permissible activities,” (Mot. at 12), without explaining what those activities are or how they are 

speech. That’s a serious problem, because the First Amendment “right to speak and publish does

not carry with it the unrestrained right to gather information.” John K. MacIver Inst. for Pub.

Policy, Inc. v. Evers, 994 F.3d 602, 612 (7th Cir. 2021) (quoting Zemel v. Rusk, 381 U.S. 1, 17

(1965)). For example, Trustees of Indiana University v. Curry, 918 F.3d 537, 538 (7th Cir. 

2019), examines a state statute that criminalizes “intentionally acquir[ing], receiv[ing], sell[ing],

or transfer[ring] fetal tissue[.]” The plaintiffs, university researchers, argued that the statute 

violated their First Amendment rights because it prevented them from gathering the data that 

“could lead to speech, in classrooms or research paper.” Id. at 543. Calling the argument “a nonstarter,” the Seventh Circuit explained that “a desire to obtain an input into speech does not

convert regulation of conduct into regulation of speech.” Id. Similarly, a statute that restricts the 

collection of individuals’ personal information does not trigger First Amendment scrutiny unless 

it bans a “common, indeed ubiquitous, instrument of communication” like taking a photograph 

or making a sound recording. See Dahlstrom v. Sun-Times Media, LLC, 777 F.3d 937, 948 (7th

Cir. 2015) (emphasis and citation omitted). BIPA does not.

Onfido’s position here is no different than the failed arguments in Curry and Dahlstrom. 

It suggests that it wants to engage in unspecified “activities” down the line, but that it is 

restricted from doing so because BIPA prohibits it from “collect[ing], captur[ing], purchas[ing],

receiv[ing] through trade, or otherwise obtain[ing] a person’s or a customer’s biometric identifier

or biometric information” without permission. Even if those “activities” are speech (Onfido 

never says), that puts it at best in the same position as the plaintiffs in Curry. Nor does Onfido 

suggest it is prohibited from taking a picture, making a sound recording, or otherwise employing

Case: 1:20-cv-04247 Document #: 49 Filed: 10/15/21 Page 12 of 17 PageID #:550
12

a common instrument of communication. Rather, the statute bans it from using its advanced 

facial recognition software to extract individuals’ personal biometric data from photographs

without consent—“hardly such an instrument.” See Dahlstrom, 777 F.3d at 948. Because the 

portions of BIPA relevant to this case involve conduct restrictions, not speech restrictions, 

Onfido’s First Amendment rights are not implicated.

IV. BIPA’s Restrictions Are Constitutional As Applied to Onfido.

Imagining that Onfido could identify some way in which the portions of BIPA at issue in 

this case restrict its speech, its arguments are legally incorrect because BIPA’s restrictions are 

constitutional. Onfido offers two options for how its purported speech (which, again, it fails to 

identify) could be protected by the First Amendment: strict scrutiny and the lesser protection 

afforded commercial speech. Seventh Circuit law precludes the application of strict scrutiny, and 

BIPA easily survives the lower level of scrutiny afforded to commercial speech.

A. Strict Scrutiny Does Not Apply to BIPA.

According to Onfido, BIPA is subject to strict scrutiny because it “targets only certain

categories of information that can be used to identify a person.” (Mot. at 12.) But “the principal

inquiry in determining content neutrality is whether the government has adopted a regulation of

speech because of agreement or disagreement with the message it conveys.” Dahlstrom, 777

F.3d at 950 (cleaned up). A statute that restricts use of personal information is not a contentbased restriction where it has been enacted to further public safety without regard for the 

message communicated, if any. Id. (“Congress crafted the DPPA’s limitation on disclosure of

personal information not because it disagreed with the message communicated by drivers’ 

personal details, but in order to keep individuals’ identifying information out of the hands of

potential stalkers.”). Here, BIPA does not concern itself with the message, if any even exists, 

Case: 1:20-cv-04247 Document #: 49 Filed: 10/15/21 Page 13 of 17 PageID #:551
13

communicated by a person’s biometric identifiers or biometric information. The goal is strictly 

one of public safety. Rosenbach, 129 N.E.3d at 1207 (noting that the “point of the law” is to 

prevent the “substantial and irreversible harm that could result if biometric identifiers and

information are not properly safeguarded; and the public welfare, security, and safety will be

advanced”). This is not a content-based regulation on speech, and strict scrutiny does not apply.

B. To the Extent BIPA Regulates Speech, It Does Not Violate the First 

Amendment. 

Onfido’s other constitutional attack is that BIPA is an unconstitutional regulation of its 

commercial speech. To analyze commercial speech, courts apply the following four-part test:

At the outset, we must determine whether the expression is protected by the First 

Amendment. For commercial speech to come within that provision, it at least must 

concern lawful activity and not be misleading. Next, we ask whether the asserted 

governmental interest is substantial. If both inquiries yield positive answers, we 

must determine whether the regulation directly advances the governmental interest 

asserted, and whether it is not more extensive than is necessary to serve that interest.

Greater New Orleans Broad. Ass’n, Inc. v. United States, 527 U.S. 173, 183 (1999) (quoting 

Cent. Hudson Gas & Elec. Corp. v. Pub. Serv. Comm’n of New York, 447 U.S. 557, 566 (1980)).

Onfido leaves out the first step, whether the purported speech concerns lawful activity 

and is not misleading. BIPA is designed to make sure that consumers know exactly who has their 

biometric data and what those entities are using it for. But Sosa alleges that Onfido takes steps to 

conceal its involvement in the collection of biometric data, making it difficult to tell that Onfido 

is even involved. This is misleading, and it is not protected by the First Amendment. 

Next, Onfido insists that there is no substantial government interest in protecting an 

individual’s biometric data. That is nonsense. BIPA is a consumer privacy statute, Bryant v.

Compass Group USA, Inc., 958 F.3d 617, 619 (7th Cir. 2020), and “[n]o one questions that

protecting consumer privacy qualifies as a legitimate and ‘genuine’ interest for the government

Case: 1:20-cv-04247 Document #: 49 Filed: 10/15/21 Page 14 of 17 PageID #:552
14

to pursue,” Barr v. Am. Ass’n of Political Consultants, Inc., 140 S. Ct. 2335, 2364 (2020) 

(Gorsuch, J., concurring in the judgment and dissenting in part); accord id. at 2348 (plurality 

opinion). That should settle the matter.

Nevertheless, Onfido argues that because faces are exposed to the public view, the 

constitution forbids any restraint on use of photographs of anyone’s face. None of the 1970s 

search-and-seizure cases Onfido relies upon come close to supporting this argument. Rather, 

whether the First Amendment’s speech clause can be used as a defense to a state law tort suit 

depends “largely on whether [the regulated] speech is of public or private concern, as determined

by all the circumstances of the case.” Snyder v. Phelps, 562 U.S. 443, 451 (2011). “[S]peech on

public issues occupies the highest rung of the hierarchy of First Amendment values, and is

entitled to special protection.” Id. at 452; see also Smith v. Daily Mail Pub. Co., 443 U.S. 97, 103

(1979) (“[I]f a newspaper lawfully obtains truthful information about a matter of public

significance then state officials may not constitutionally punish publication of the information.”).

By contrast, “restricting speech on purely private matters does not implicate the same

constitutional concerns as limiting speech on matters of public interest.” Snyder, 562 U.S. at 452.

For example, a “particular individual’s credit report concerns no public issue” and is a matter of 

purely private concern. Id. at 453 (quotation marks omitted). 

BIPA contains no restrictions on speech that can conceivably be considered a public 

concern. To the extent that any restriction on speech is implicated here, it relates to as private a 

concern as it is possible to imagine: the intrinsic and immutable characteristics of a person’s own 

body, which can only be extracted through the use of non-public technologies. See ACLU v.

Clearview AI, Inc., No. 20 CH 4353, 2021 WL 4164452, at *9 (Cir. Ct. Cook Cnty., Aug. 27,

2021). The state interest in protecting the privacy of this sensitive, personal data is significant.

Case: 1:20-cv-04247 Document #: 49 Filed: 10/15/21 Page 15 of 17 PageID #:553
15

As far as whether the regulation advances the interest asserted, the issue is whether “the

harms [BIPA] recites are real and that its restriction will in fact alleviate them to a material

degree.” See Greater New Orleans Broad. Ass’n, 527 U.S. at 188. There can be no real question 

that the harm identified (losing control of one’s biometric data) is real and is alleviated by a 

regulation that requires informed consent before collecting that data. Rosenbach, 129 N.E.3d at 

1206-07 (explaining that the injuries inflicted upon consumers by entities’ failure to comply with 

BIPA are “real and significant” and that the enforcement regime creates the “strongest possible

incentive to ... prevent problems before they occur and cannot be undone.”). 

Finally, for the fourth part of the test, the Court considers whether the “restriction is not

more extensive than necessary to serve the interests that support it.” Greater New Orleans

Broad. Ass’n, 527 U.S. at 188. To be clear, this rule does not require “the least restrictive means

conceivable,” but rather “a fit that is not necessarily perfect, but reasonable; that represents not

necessarily the single best disposition but one whose scope is in proportion to the interest

served.” Id. (cleaned up). The restrictions here are minimal. The purpose of the statute is 

informed consent, so BIPA requires provision of a certain, limited set of factual and 

uncontroversial information that the legislature has deemed important. See Ent. Software Ass’n v. 

Blagojevich, 469 F.3d 641, 652 (7th Cir. 2006). Onfido briefly suggests that “other forms of 

disclosure” (Mot. at 13), would be sufficient, but it never explains what forms or how, nor does it 

explain why the restrictions chosen by the legislature are unreasonable or disproportionate.

As applied in this case, BIPA does not restrict Onfido’s speech. If speech is somehow 

implicated, the restrictions are consistent with the First Amendment.

CONCLUSION

The motion to dismiss should be denied.

Case: 1:20-cv-04247 Document #: 49 Filed: 10/15/21 Page 16 of 17 PageID #:554
16

Respectfully submitted,

FREDY SOSA, individually and on behalf of all 

others similarly situated,

Dated: October 15, 2021 By: /s/ J. Eli Wade-Scott

One of Plaintiff’s attorneys

Benjamin H. Richman

brichman@edelson.com

J. Eli Wade-Scott

ewadescott@edelson.com

Schuyler Ufkes

sufkes@edelson.com

EDELSON PC

350 North LaSalle Street, 14th Floor

Chicago, Illinois 60654

Tel: 312.589.6370

Case: 1:20-cv-04247 Document #: 49 Filed: 10/15/21 Page 17 of 17 PageID #:555