UNITED STATES DISTRICT COURT

NORTHERN DISTRICT OF ILLINOIS

EASTERN DIVISION

FREDY SOSA, individually and on behalf of 

all others similarly situated,

)

)

)

Plaintiff, )

) No. 20-cv-4247

 v. )

) Judge Marvin E. Aspen

ONFIDO, INC., )

)

Defendant. )

MEMORANDUM OPINION AND ORDER

MARVIN E. ASPEN, District Judge:

Defendant Onfido, Inc. (“Onfido”) moves to dismiss Plaintiff Fredy Sosa’s Complaint 

under Federal Rule of Civil Procedure 12(b)(6). (See Defendant’s Rule 12(b)(6) Motion to 

Dismiss (“Mot.”) (Dkt. No. 45); Defendant’s Memorandum of Law in Support of Its Rule 

12(b)(6) Motion to Dismiss for Failure to State a Claim (“Mem.”) (Dkt. No. 46).)1

 For the 

following reasons, we deny Onfido’s motion. 

FACTUAL BACKGROUND

We take the following facts from the Complaint, “documents attached to the [Complaint], 

documents that are critical to the [Complaint] and referred to in it, [] information that is subject 

to proper judicial notice[,]” and any additional facts set forth in Sosa’s response, “so long as 

those facts are consistent with the pleadings.” Phillips v. Prudential Ins. Co. of Am., 714 F.3d 

1017, 1019–20 (7th Cir. 2013) (quotation marks omitted). We have accepted as true all well1 For ECF filings, we cite to the page number(s) set forth in the document’s ECF header unless 

citing to a particular paragraph or other page designation is more appropriate. 

Case: 1:20-cv-04247 Document #: 58 Filed: 04/25/22 Page 1 of 37 PageID #:588
2

pleaded factual allegations and drawn all reasonable inferences in Sosa’s favor. O’Brien v. Vill.

of Lincolnshire, 955 F.3d 616, 621 (7th Cir. 2020).

Onfido, a Delaware corporation with its principal place of business in England,2 markets 

and sells proprietary facial recognition software that is used by online businesses to verify 

consumers’ identities. (Class Action Complaint and Demand for Jury Trial (“Compl.”) (Dkt. No. 

1-1) ¶¶ 1, 2, 9.) To verify a consumer’s identity using Onfido’s software, the consumer first 

uploads a copy of his or her identification and a photograph of his or her face. (Id. ¶ 22.) 

Onfido’s software then scans the identification and photograph to locate the facial images on 

each document; extracts a unique numerical representation of the shape or geometry of each 

facial image, which is often called a “faceprint”; compares the faceprints from the consumer’s 

identification and photograph; and generates a score based on the similarity of the faceprints. 

(See id. ¶¶ 2, 23, 24, 41; Plaintiff’s Response to Defendant’s Motion to Dismiss (“Resp.”) (Dkt. 

No. 49) at 3.) Onfido’s software also can compare the faceprints obtained from a consumer’s 

identification or photograph with other biometric data in Onfido’s database, such as the 

biometric data of known masks or other consumers’ photographs. (Compl. ¶¶ 2, 25, 27.) Online 

businesses can integrate Onfido’s software into their products and mobile apps in such a way that 

consumers seeking to verify their identities likely do not know that they are interacting with and 

providing their sensitive information to Onfido, a third party. (Id. ¶¶ 3, 4, 21.) 

Sosa, an Illinois citizen, is a member of OfferUp, an online marketplace that partnered 

with Onfido to verify its users’ identities using Onfido’s software. (Id. ¶¶ 8, 33, 34); Sosa v. 

Onfido, 8 F.4th 631, 634–35 (7th Cir. 2021). In April 2020, Sosa verified his identity with

2 In a declaration filed at the outset of the case, Onfido’s Chief Product Officer stated that 

Onfido’s headquarters and principal place of business are in California. (Declaration of Kevin 

Trilli (“Trilli Decl.”) (Dkt. No. 1-4) ¶¶ 1, 3.) 

Case: 1:20-cv-04247 Document #: 58 Filed: 04/25/22 Page 2 of 37 PageID #:589
3

OfferUp by using OfferUp’s mobile application to “upload[] a photograph of his driver’s license 

and a photograph of his face.” (Compl. ¶ 35); Sosa, 8 F.4th at 635. Onfido used its software to 

scan Sosa’s face, extract Sosa’s faceprints, and compare the two photographs. (Compl. ¶ 35; 

Resp. at 3.) “Onfido then kept Sosa’s unique faceprint in a database and accessed it every time 

another person used Onfido’s verification process.” (Resp. at 3.)

Onfido did not inform “Sosa that it would collect, store, or use his biometric identifiers 

derived from his face,” and Sosa never signed a written release allowing Onfido to do so. 

(Compl. ¶¶ 36, 38.) Nor did Onfido inform Sosa about a biometric data retention policy or 

whether it would “ever permanently delete the biometric identifiers derived from his face.” (Id.

¶ 37.) In fact, “there was almost no notice whatsoever that Onfido [was] even involved in the 

process.” (Id. ¶ 36.) 

PROCEDURAL HISTORY

Sosa filed suit against Onfido in the Circuit Court of Cook County, Illinois, alleging that 

Onfido violated Illinois’s Biometric Information Privacy Act (“BIPA”), 740 Ill. Comp. Stat. 14/1 

et seq. (See generally Compl.) Sosa seeks to represent himself and a putative class of Illinois 

residents “who had their biometric identifiers or biometric information, including faceprints, 

collected, captured, received, otherwise obtained, or disclosed by Onfido while residing in 

Illinois.” (Id. ¶ 41.) Sosa alleges that Onfido violated sections 15(a) and 15(b) of BIPA and 

requests, on behalf of himself and the putative class, (1) injunctive and equitable relief that 

requires Onfido to comply with “BIPA’s requirements for the collection, storage, and use of 

biometric identifiers and biometric information”; (2) “liquidated damages of $5,000 for each 

willful and/or reckless violation” of BIPA or, alternatively, “liquidated damages of $1,000 for 

each negligent violation” of BIPA; and (3) “reasonable attorneys’ fees, costs, and expenses.” 

(Id. ¶¶ 47–49, 53–56, 58.)

Case: 1:20-cv-04247 Document #: 58 Filed: 04/25/22 Page 3 of 37 PageID #:590
4

Onfido removed Sosa’s lawsuit to this Court based on diversity jurisdiction and the Class 

Action Fairness Act (“CAFA”).

3

 (Notice of Removal (Dkt. No. 1) at 3–9.) Onfido then filed a 

motion to compel arbitration. (Dkt. No. 20.) We denied Onfido’s motion (Dkt. No. 31), and the 

Seventh Circuit affirmed our decision. Sosa, 8 F.4th at 634–35. After the case returned to us 

from the Seventh Circuit, Onfido moved to dismiss Sosa’s Complaint under Rule 12(b)(6) 

arguing, among other things, that BIPA violates the United States Constitution’s First 

Amendment. (See Mot. at 1.) Because Onfido’s motion challenged the constitutionality of a 

state statute, we gave Illinois the opportunity to intervene and defend BIPA’s constitutionality 

(Dkt. No. 50), but it has declined to do so. We also directed the parties to submit supplemental 

briefing regarding Sosa’s standing to assert that Onfido violated section 15(a) of BIPA, which 

the parties have done. (See Dkt. Nos. 52, 54, 55.) Onfido’s motion to dismiss is now ripe for 

decision. 

3 We are satisfied that we have jurisdiction over Sosa’s lawsuit. The citizenship of the named 

parties is completely diverse—Sosa is a citizen of Illinois, and Onfido is incorporated in 

Delaware and maintains its principal place of business in either California or England (Compl. 

¶¶ 8, 9; Trilli Decl. ¶ 3)—and the amount in controversy is more than $75,000 because it would 

cost Onfido at least $80,000 to re-engineer its services in response to Sosa’s request for 

injunctive relief (Notice of Removal at 4–5; Trilli Decl. ¶ 4); see Tropp v. W.-S. Life Ins. Co., 

381 F.3d 591, 595 (7th Cir. 2004) (explaining that “the cost a defendant incurs in complying 

with injunctive relief is a legitimate consideration” in determining whether the amount in 

controversy exceeds $75,000 as required for diversity jurisdiction). We therefore have diversity 

jurisdiction over this case. See 28 U.S.C. § 1332(a); Page v. Democratic Nat’l Comm., 2 F.4th 

630, 634–36 (7th Cir. 2021) (discussing the requirements for diversity jurisdiction). We also 

have jurisdiction under the CAFA. First, the parties’ complete diversity of citizenship satisfies 

the CAFA’s minimal diversity requirement. Roppo v. Travelers Com. Ins. Co., 869 F.3d 568, 

578 (7th Cir. 2017); Johnson v. Bankers Life & Cas. Co., 973 F. Supp. 2d 950, 954 (W.D. Wis. 

2013). Second, the putative class consists of at least 501 members (see Trilli Decl. ¶ 6), which 

exceeds CAFA’s 100-member threshold. Roppo, 869 F.3d at 578. Finally, the aggregate amount 

in controversy exceeds “$5 million, exclusive of interest and costs.” Id. Sosa alleges that 

Onfido has violated two subsections of BIPA, section 15(a) and section 15(b), and seeks up to 

$5,000 for each violation. (Compl. ¶¶ 47–49, 53–58.) Thus, each of the at least 501 putative 

class members could be entitled to $10,000 ($5,000 for each BIPA violation), which makes the 

aggregate amount in controversy at least $5,010,000.

Case: 1:20-cv-04247 Document #: 58 Filed: 04/25/22 Page 4 of 37 PageID #:591
5

LEGAL STANDARD

A motion to dismiss under Rule 12(b)(6) challenges the sufficiency of the complaint, not 

its merits. Gibson v. City of Chicago, 910 F.2d 1510, 1520 (7th Cir. 1990). In considering a 

Rule 12(b)(6) motion, we accept as true all well-pleaded facts in the plaintiff’s complaint and 

draw all reasonable inferences in the plaintiff’s favor. Kubiak v. City of Chicago, 810 F.3d 476, 

480–81 (7th Cir. 2016). To survive a Rule 12(b)(6) motion, the complaint must assert a facially 

plausible claim and provide fair notice to the defendant of the claim’s basis. Ashcroft v. Iqbal, 

556 U.S. 662, 678, 129 S. Ct. 1937, 1949 (2009); Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555, 

127 S. Ct. 1955, 1964 (2007); Adams v. City of Indianapolis, 742 F.3d 720, 728–29 (7th Cir. 

2014). A claim is facially plausible “when the plaintiff pleads factual content that allows the 

court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” 

Iqbal, 556 U.S. at 678, 129 S. Ct. at 1949. “If the well-pleaded allegations plausibly suggest—as 

opposed to possibly suggest—that the plaintiff[] [is] entitled to relief, the case enters discovery.” 

Alarm Detection Sys., Inc. v. Vill. of Schaumburg, 930 F.3d 812, 821 (7th Cir. 2019).

ANALYSIS

In response to growing public concern about the increased commercial use of biometric 

data, the Illinois General Assembly enacted BIPA in 2008 “to help regulate ‘the collection, use, 

safeguarding, handling, storage, retention, and destruction of biometric identifiers and

information.’” Cothron v. White Castle Sys., Inc., 20 F.4th 1156, 1159 (7th Cir. 2021); 

Rosenbach v. Six Flags Ent. Corp., 2019 IL 123186, ¶ 19, 129 N.E.3d 1197, 1203 (quoting 740 

Ill. Comp. Stat. 14/5(g)). To that end, section 15 of BIPA “imposes on private entities . . . 

various obligations regarding the collection, retention, disclosure, and destruction of biometric 

identifiers and biometric information.” Rosenbach, 2019 IL 123186, ¶ 20, 129 N.E.3d at 1203. 

Section 20, in turn, “provides a right of action for persons aggrieved by a violation” of section 

Case: 1:20-cv-04247 Document #: 58 Filed: 04/25/22 Page 5 of 37 PageID #:592
6

15, as well as remedies for any such violations. Fox v. Dakkota Integrated Sys., LLC, 980 F.3d 

1146, 1148 (7th Cir. 2020); Bradenberg v. Meridian Senior Living, LLC, --- F. Supp. 3d ----, 

2021 WL 4494275, at *5 (C.D. Ill. Sept. 30, 2021). 

Onfido’s arguments for dismissal require us to address the scope and meaning of sections 

15 and 20 of BIPA, as well as whether BIPA runs afoul of the United States Constitution. 

Before we can reach these arguments, however, we must assure ourselves that Sosa has standing 

to maintain his lawsuit in this Court. See Persinger v. Sw. Credit Sys., L.P., 20 F.4th 1184, 1189

(7th Cir. 2021) (addressing “the jurisdictional question of whether [the plaintiff] has standing to 

sue” before addressing the merits of the case). 

I. Standing

“Article III of the Constitution limits the jurisdictional reach of the federal courts to 

‘Cases’ and ‘Controversies.’” Cothron, 20 F.4th at 1160 (quoting U.S. Const. art. III, § 2). 

“Essential to this limitation is the requirement that a plaintiff have standing to sue in federal 

court.” Id. The party invoking federal jurisdiction bears the burden of demonstrating the 

plaintiff’s standing to sue under Article III. Bryant v. Compass Grp. USA, Inc., 958 F.3d 617, 

620 (7th Cir. 2020). Onfido bears that burden here because it removed Sosa’s case from state 

court. Fox, 980 F.3d at 1151.

“At the pleading stage, standing requires allegations of a concrete and particularized 

injury in fact that is traceable to the defendant’s conduct and redressable by judicial relief.” 

Cothron, 20 F.4th at 1160. There is no dispute that “whatever injury [Sosa] suffered occurred at 

[Onfido’s] hands” or that a court can remedy the injury by, for instance, awarding statutory 

damages. See Thornley v. Clearview AI, Inc., 984 F.3d 1241, 1244 (7th Cir. 2021); Bryant, 958 

F.3d at 620–21. Thus, for purposes of our standing inquiry, we consider only whether the 

Complaint establishes an injury in fact. See Thornley, 984 F.3d at 1244.

Case: 1:20-cv-04247 Document #: 58 Filed: 04/25/22 Page 6 of 37 PageID #:593
7

Sosa’s Complaint alleges that Onfido has violated sections 15(a) and 15(b) of BIPA. 

(Compl. ¶¶ 47–49, 53–56.) We must consider whether Sosa’s allegations establish that he has 

standing to seek relief based on section 15(a) and, separately, whether they establish that he has 

standing to seek relief based on section 15(b). See TransUnion LLC v. Ramirez, 141 S. Ct. 2190, 

2208 (2021) (“[S]tanding is not dispensed in gross; rather, plaintiffs must [have] standing for 

each claim that they press[.]”); see also Bryant, 958 F.3d at 626 (holding that the plaintiff had 

standing to pursue her section 15(b) claim but not her section 15(a) claim). 

We begin our standing analysis with Sosa’s section 15(a) allegations. Section 15(a) 

requires “[a] private entity in possession of biometric identifiers or biometric information” to 

develop and make publicly available a written policy “establishing a retention schedule and 

guidelines for permanently destroying biometric identifiers and biometric information.” 740 Ill. 

Comp. Stat. 14/15(a). It also requires the entity to “comply with its established retention 

schedule and destruction guidelines” “[a]bsent a valid warrant or subpoena” to the contrary. Id. 

Sosa alleges that Onfido does not comply with section 15(a)’s mandates requiring “companies in 

possession of biometric data” to “(i) make publicly available a written policy establishing a 

retention schedule and guidelines for permanent deletion of biometric data (i.e., when the 

business relationship ends); and (ii) actually adhere to that retention schedule and actually delete 

the biometric information.” (Compl. ¶¶ 48, 49, 56.) 

Whether a plaintiff has standing to sue for a § 15(a) violation depends on how the 

defendant allegedly violated § 15(a). See Thornley, 984 F.3d at 1246 (“[A]s the difference 

between the treatment of section 15(a) in Bryant and Fox illustrates, the result of the standing 

inquiry for the identical section of a statute will depend on what that section provides and what 

the plaintiff has alleged.”). For instance, the plaintiff in Bryant did not have standing to pursue

Case: 1:20-cv-04247 Document #: 58 Filed: 04/25/22 Page 7 of 37 PageID #:594
8

her section 15(a) claim because it was based solely on an alleged violation of the provision

requiring a collector to make a data retention and destruction schedule publicly available. 958

F.3d at 626. Because this provision imposed a duty “owed to the public generally, not to

particular persons whose biometric information [an] entity collects,” the defendant’s alleged

violation of this provision, without more, did not establish that the plaintiff suffered a

particularized harm. See id. In contrast, the plaintiff in Fox accused the defendant of violating 

section 15(a) “by failing to develop, publicly disclose, and comply with a data-retention schedule 

and guidelines for the permanent destruction of biometric data.” 980 F.3d at 1154 (emphasis in 

original). The defendant’s failure to comply with the retention schedule meant that it was 

unlawfully retaining the plaintiff’s biometric data, which inflicted a concrete and particularized 

privacy injury on the plaintiff. Id. at 1154–55. Thus, the plaintiff had standing to pursue her 

section 15(a) claim. Id. at 1149, 1156.

Similar to the plaintiff in Fox, Sosa alleges that Onfido failed to “make publicly available 

a written policy establishing a retention schedule and guidelines for permanent deletion of 

biometric data” and failed to “adhere to that retention schedule and actually delete the biometric 

information.” (Compl. ¶¶ 48, 49.) Under Fox, Onfido’s alleged failure to delete biometric 

information in compliance with a data-retention schedule constitutes an unlawful retention of 

Sosa’s information sufficient to establish an injury in fact. See Fox, 980 F.3d at 1149, 1154–56. 

Sosa has standing to pursue his section 15(a) allegations before us. 

That leaves Sosa’s section 15(b) allegations. Section 15(b) prohibits the collection of 

biometric identifiers or biometric information unless the collector first (1) informs the person “in 

writing that a biometric identifier or biometric information is being collected or stored”;

(2) informs the person “in writing of the specific purpose and length of term for which a 

Case: 1:20-cv-04247 Document #: 58 Filed: 04/25/22 Page 8 of 37 PageID #:595
9

biometric identifier or biometric information is being collected, stored, and used”; and 

(3) obtains a written release from the person. 740 Ill. Comp. Stat. 14/15(b). Sosa alleges that 

Onfido violated section 15(b) by failing to comply with these three requirements. (Compl.

¶¶ 53–55.) 

The Seventh Circuit’s decision in Bryant “resolved the standing question for claims under 

section 15(b)” by holding that “a violation of section 15(b) inflicts an Article III injury.” 

Cothron, 20 F.4th at 1160–61. In Bryant, the plaintiff alleged that the defendant had violated 

section 15(b) by failing to (1) inform her in writing that her biometric identifier was being 

collected or stored; (2) inform her in writing of the specific purpose and length of term for which 

her identifier was being collected, stored, and used; and (3) obtain the plaintiff’s written release 

to collect, store, and use the identifier. 958 F.3d at 619. The Seventh Circuit held that the 

plaintiff had standing to pursue her section 15(b) claim because a defendant’s failure to follow 

section 15(b) “leads to an invasion of personal rights that is both concrete and personalized.” Id.

at 619, 626–27. Sosa similarly alleges that Onfido violated section 15(b) by failing to inform 

him and the Class in writing that it was collecting and storing their information, failing to inform 

him and the Class in writing of the purpose and length of term for which the information was 

being collected, stored, and used, and failing to obtain written releases from him and the Class. 

(Compl. ¶¶ 53–55.) Sosa’s section 15(b) allegations fall squarely within Bryant’s holding, so he 

has standing to pursue these allegations before us as well. 

Case: 1:20-cv-04247 Document #: 58 Filed: 04/25/22 Page 9 of 37 PageID #:596
10

Sosa has standing to pursue both his section 15(a) and section 15(b) allegations in federal 

court at this stage of the litigation.

4

 We now turn to the merits of Onfido’s arguments for 

dismissal. 

II. Onfido’s Motion to Dismiss

Onfido makes three arguments for dismissal. First, Onfido argues that Sosa has not 

stated a BIPA claim because the information Onfido allegedly collects—photographs and 

information derived from photographs—is not protected by BIPA. (Mem. at 9–10.) Second, 

Onfido argues that Sosa has not stated claims for liquidated damages because he has not alleged

facts from which we can reasonably infer that Onfido intentionally, recklessly, or negligently 

violated BIPA. (Id. at 11–14.) Third, Onfido argues that BIPA violates the First Amendment. 

(Id. at 14–18.) We consider Onfido’s non-constitutional arguments first and proceed to its First 

Amendment argument only if it is necessary to resolve Onfido’s motion to dismiss. See ISI Int’l,

Inc. v. Borden Ladner Gervais LLP, 256 F.3d 548, 552 (7th Cir. 2001) (“[F]ederal courts are 

supposed to do what they can to avoid making constitutional decisions, and strive doubly to 

avoid making unnecessary constitutional decisions.”). 

A. Information Protected by BIPA

Section 15 of BIPA imposes “various obligations regarding the collection, retention, 

disclosure, and destruction of biometric identifiers and biometric information.” Rosenbach, 2019 

IL 123186, ¶ 20, 129 N.E.3d at 1203. According to Onfido, Sosa has failed to state a claim for 

relief under section 15 because he alleges “that Onfido’s software captures information from 

photographs submitted by users,” and neither photographs nor information derived from 

4 Nonetheless, “[t]he Article III standing inquiry remains open to review at all stages of the 

litigation.” Persinger, 20 F.4th at 1189 (quotation marks omitted). If later developments in the 

case suggest that Sosa does not actually have standing to pursue either his section 15(a) or 

section 15(b) allegations at trial, the parties should bring any such developments to our attention.

Case: 1:20-cv-04247 Document #: 58 Filed: 04/25/22 Page 10 of 37 PageID #:597
11

photographs are covered by BIPA. (Mem. at 9–10.) Sosa responds that Onfido’s software 

creates “a scan of face geometry collected from a photograph,” which is encompassed by BIPA’s 

definition of “biometric identifiers.” (Resp. at 3.) 

We interpret BIPA using the same principles that Illinois courts would apply. K-S

Pharmacies, Inc. v. Am. Home Prods. Corp., 962 F.2d 728, 730 (7th Cir. 1992). Under Illinois 

law, we look first to the plain meaning of the statutory language. People v. Porter, 156 Ill. 2d 

218, 222, 620 N.E.2d 381, 384 (1993). Where the statutory language “is clear and unambiguous, 

we will apply it as written” without “consider[ing] other interpretive aids.” Raab v. Frank, 2019 

IL 124641, ¶ 18, 157 N.E.3d 470, 474; Ultsch v. Ill. Mun. Ret. Fund, 226 Ill. 2d 169, 184, 874 

N.E.2d 1, 10 (2007). 

Our analysis starts with section 10 of BIPA, which expressly defines “biometric 

information” and “biometric identifier.” People v. Olsson, 2011 IL App (2d) 091351, ¶ 6, 958 

N.E.2d 356, 359 (“When an act defines its own terms, those terms must be construed according 

to the definitions given to them in the statute.”). Section 10 defines a “biometric identifier” as “a 

retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry” and “biometric 

information” as “any information, regardless of how it is captured, converted, stored, or shared, 

based on an individual’s biometric identifier used to identify an individual.” 740 Ill. Comp. Stat. 

14/10. Section 10 also lists items that do not constitute “biometric identifiers” or “biometric 

information.” See id. Relevant here, biometric identifiers do not include photographs, and 

biometric information “does not include information derived from items or procedures excluded 

under the definition of biometric identifiers.” Id. 

Because BIPA excludes photographs from its definition of biometric identifiers, 

information “derived from” photographs does not constitute biometric information. See id. 

Case: 1:20-cv-04247 Document #: 58 Filed: 04/25/22 Page 11 of 37 PageID #:598
12

Thus, the data Onfido obtains when scanning uploaded photographs likely does not fall within

BIPA’s definition of “biometric information.” See Vance v. Microsoft Corp., 525 F. Supp. 3d 

1287, 1296 (W.D. Wash. 2021) (acknowledging that facial scans of photographs “may not 

qualify as biometric information” under BIPA “because they are ‘derived from items . . . 

excluded under the definition of biometric identifiers,’ namely, photographs”); Monroy v. 

Shutterfly, Inc., No. 16 C 10984, 2017 WL 4099846, at *3 (N.D. Ill. Sept. 15, 2017) (“[T]he data 

extracted from [the plaintiff’s] photograph cannot constitute ‘biometric information’ within the 

meaning of [BIPA].”). But section 15 regulates the collection, retention, disclosure, and 

destruction of both biometric information and biometric identifiers. See 740 Ill. Comp. Stat. 

14/15; Rosenbach, 2019 IL 123186, ¶ 20, 129 N.E.3d at 1203. Even if the data Onfido obtains is 

not biometric information, it can still subject Onfido to liability if it constitutes a biometric 

identifier. That is precisely what Sosa contends: that the data obtained by Onfido constitutes a 

“scan of . . . face geometry,” which qualifies as a “biometric identifier.” (Resp. at 3–5.) As 

such, the dispositive question is whether the information Onfido allegedly obtains plausibly 

constitutes a scan of face geometry. 

We conclude that it does. As alleged in Sosa’s Complaint and response to Onfido’s 

motion to dismiss, Onfido’s software scans identification cards and photographs to locate facial 

images and extracts a unique numerical representation of the shape or geometry of each facial 

image, which Sosa refers to as a “faceprint.” (See Compl. ¶¶ 2, 22–24, 41; Resp. at 3–4.) The

faceprints extracted by Onfido plausibly constitute scans of face geometry and, therefore, 

“biometric identifiers” under BIPA. See, e.g., Vance, 525 F. Supp. 3d at 1295 (holding that 

“facial scans are ‘biometric identifiers’ under BIPA”); Rivera v. Google Inc., 238 F. Supp. 3d 

1088, 1091, 1095 (N.D. Ill. 2017) (scanning an uploaded photograph, locating the plaintiff’s 

Case: 1:20-cv-04247 Document #: 58 Filed: 04/25/22 Page 12 of 37 PageID #:599
13

face, and zeroing “in on its unique contours to create a ‘template’ that maps and records her

distinct facial measurements” constituted a scan of face geometry); In re Facebook Biometric 

Info. Priv. Litig., 185 F. Supp. 3d 1155, 1171 (N.D. Cal. 2016) (scanning “user-uploaded 

photographs to create a ‘unique digital representation of the face . . . based on [the] geometric 

relationship of [] facial features” constituted a scan of face geometry); ACLU v. Clearview AI,

Inc., No. 20 CH 4353, 2021 WL 4164452, at *1, *5 (Ill. Cir. Ct. Aug. 27, 2021) (creating a 

faceprint by scanning a photograph, measuring and recording “data such as the shape of the 

cheekbones and the distance between eyes, nose, and ears,” and assigning “that data a numerical 

value” constituted a scan of face geometry).

Onfido’s arguments to the contrary are unavailing. (See Mem. at 9–10; Defendant’s 

Reply in Further Support of Its Rule 12(b)(6) Motion to Dismiss for Failure to State a Claim 

(“Reply”) (Dkt. No. 51) at 2–5.) First, Onfido argues that BIPA “expressly excludes both 

photographs and information derived from photographs” from its reach. (Mem. at 10.) This is 

not accurate. True, section 10 expressly excludes photographs from the definition of “biometric 

identifier” and information derived from photographs from the definition of “biometric 

information.” 740 Ill. Comp. Stat. 14/10. But nothing in section 10 expressly excludes 

information derived from photographs from the definition of “biometric identifiers.” See id.; 

Vance, 525 F. Supp. 3d at 1296 (“[W]hile these facial scans [derived from photographs] may not 

qualify as biometric information[,] . . . there is no textual support for the contention that these 

scans could not be biometric identifiers themselves.”); Monroy, 2017 WL 4099846, at *3–5 

Case: 1:20-cv-04247 Document #: 58 Filed: 04/25/22 Page 13 of 37 PageID #:600
14

(rejecting the defendant’s argument that data obtained from a photograph cannot constitute a 

“biometric identifier”). BIPA does not exclude photograph-derived information from its reach.5

Second, Onfido argues that the information it allegedly obtains cannot be a “scan of face 

geometry” because it “was not the scan of Plaintiff’s actual face, but rather, a scan of a 

photograph of his face.” (Mem. at 10; Reply at 4.) Nothing in BIPA’s text, however, supports 

Onfido’s contention that a scan of face geometry must be an “in person” scan. Rivera, 238 F. 

Supp. 3d at 1095 (BIPA’s definition of “biometric identifier” does not “say whether a scan of 

face geometry has to be in person or may be generated from a photograph or a video”). We 

therefore join those courts that have rejected similar arguments. See, e.g., id. at 1095–98 

(rejecting the defendant’s argument that “face-scan measurements derived from a photograph do 

not qualify as biometric identifiers”); Vance, 525 F. Supp. 3d at 1296 (rejecting the defendant’s 

argument “that only scans taken in-person, not from photographs, are biometric identifiers”); In 

re Facebook Biometric Info. Priv. Litig., 185 F. Supp. 3d at 1171–72 (rejecting the defendant’s 

argument “that the only way to reconcile [BIPA’s] inclusion of ‘scan’ and exclusion of 

‘photographs’ is to read the word ‘scan’ to mean in-person scan”). 

Third, Onfido argues that “it is not clear what the BIPA intended to cover as a ‘scan of 

face geometry’” because BIPA’s text and legislative history do not define “scan” or “face 

geometry,” and dictionaries do not provide a workable definition for “scan of face geometry.” 

5 We need not consider whether BIPA excludes photographs from its reach because Sosa does 

not contend that Onfido violated BIPA by merely obtaining photographs; he contends that 

Onfido violated BIPA by scanning photographs and extracting faceprints from them. (Resp. at 

3–4; Mem. at 10 (recognizing that Sosa’s BIPA claim “is based on his allegations that Onfido’s 

software captures information from photographs submitted by users” (emphasis added))); see

Vance, 525 F. Supp. 3d at 1296 (“Plaintiffs do not claim that simply possessing a photograph of 

a face violates BIPA, and thus the exclusion of photographs as biometric identifiers has little 

bearing.” (quotation marks omitted)). 

Case: 1:20-cv-04247 Document #: 58 Filed: 04/25/22 Page 14 of 37 PageID #:601
15

(Reply at 2–3.)6 If the meaning of “scan of face geometry” is unclear, though, how can we 

definitively say—as a matter of law—that the information Onfido allegedly obtains cannot 

plausibly satisfy this meaning? At any rate, what constitutes a “scan of face geometry” is

sufficiently clear for us to determine, at this early stage of litigation, that the information 

allegedly obtained by Onfido plausibly satisfies this definition.

Fourth, Onfido argues that if “a ‘scan of face geometry’ can be derived from a 

photograph[,]” this “could lead to the absurd result where one becomes in possession of a ‘scan

of face geometry’ simply by examining a photograph and creating a depiction, i.e. a drawing or 

portrait, based on the shape or form of the face in the photograph.” (Reply at 4.) Sosa does not 

allege that Onfido derives information from photographs in this manner, however, so Onfido’s 

hypothetical result (absurd or not) is irrelevant.

Finally, Onfido argues that allowing information derived from a photograph to constitute 

a “biometric identifier” renders the definition of “biometric information,” which excludes 

information derived from biometric identifiers, meaningless and redundant. (Id. at 4–5.) 

According to Onfido, this is because the definition of “biometric identifiers” covers original 

sources of information about a person and the definition of “biometric information” covers data 

derived from those original sources. (Id. at 4.) We are not persuaded. Initially, it is unclear

what Onfido means by “original” sources of information. If Onfido means that biometric 

identifiers must be obtained only via in-person processes, it is incorrect, as “the scanning of 

6 Onfido makes this argument, as well as the arguments we address in the remainder of this 

section, for the first time in its reply. We have considered these arguments, but the parties risk 

forfeiting arguments in the future by failing to raise and develop them in their opening papers. 

See Rexing Quality Eggs v. Rembrandt Enters., Inc., 996 F.3d 354, 365–66 n.52 (7th Cir. 2021) 

(a party’s failure to fully develop a contention until its reply brief risked waiver); O’Neal v.

Reilly, 961 F.3d 973, 974 (7th Cir. 2020) (“[D]istrict courts are entitled to treat an argument 

raised for the first time in a reply brief as waived.”).

Case: 1:20-cv-04247 Document #: 58 Filed: 04/25/22 Page 15 of 37 PageID #:602
16

biometric identifiers is often based on an image or photograph.” In re Facebook Biometric Info.

Priv. Litig., 185 F. Supp. 3d at 1171; see also Monroy, 2017 WL 4099846, at *4 (noting that 

fingerprints and retinal scans, which are biometric identifiers, apparently “can be obtained from 

images and photographs”). Moreover, because BIPA does not say “one way or the other, how

the biometric measurements must be obtained . . . to meet the definition of ‘biometric 

identifier,’” the items identified as biometric identifiers can “be collected in various ways 

without altering the fact that the measurements still are biometric identifiers.” Rivera, 238 F. 

Supp. 3d at 1095. In short, Onfido’s argument relies upon a flawed premise. 

What is more, Onfido does not explain how allowing faceprints derived from 

photographs to qualify as “biometric identifiers” would render BIPA’s definition of “biometric 

information” redundant or meaningless. (Reply at 4–5.) Nor does Onfido identify a single case 

that has come to this conclusion, let alone at the motion to dismiss stage. (Id.) To the contrary,

Rivera—a case cited by Onfido (id. at 5)—cast aside an argument similar to Onfido’s. In Rivera, 

the defendant argued that the definitions of “biometric identifier” and “biometric information” 

“distinguish the ‘source of the content’” and that allowing a face template based on a photograph

to constitute a “biometric identifier” would render this distinction meaningless. 238 F. Supp. 3d 

at 1096. Essentially, the defendant argued “that if biometric information cannot be ‘based on’ 

something from the biometric-identifier paragraph’s ‘do not include’ list (for example, 

‘photographs’), then an identifier may also not be ‘based on’ something from that same list.” Id. 

The defendant’s argument, however, had “no textual or structural clue to support it.” Id. As the 

Rivera court explained, there is a meaningful distinction between biometric identifiers and 

biometric information: the items identified as “biometric identifiers” are “specific, biology-based 

measurements used to identify a person, without reference to how the measurements were 

Case: 1:20-cv-04247 Document #: 58 Filed: 04/25/22 Page 16 of 37 PageID #:603
17

taken,” whereas the definition of “biometric information” ensures “that private entities cannot do 

an end-around [BIPA] by converting biometric identifiers into some other format.” Id. at 1097. 

We likewise see nothing to suggest that allowing faceprints derived from photographs to qualify 

as “biometric identifiers” would render BIPA’s definition of “biometric information” redundant 

or meaningless. 

In conclusion, we join the “Illinois courts [that] have uniformly rejected the argument

that BIPA exempts biometric data extracted from photographs.” In re Clearview AI, Inc. 

Consumer Priv. Litig., No. 21-cv-0135, 2022 WL 444135, at *5 (N.D. Ill. Feb. 14, 2022); see 

also Vance, 525 F. Supp. 3d at 1295 (“This is not the first—or second, or third, or even fourth—

time that defendants have challenged BIPA’s applicability to facial scans derived from 

photographs. Every court has rejected Microsoft’s argument.”). By alleging that Onfido’s 

software scans identification cards and photographs to locate facial images and extracts a unique 

numerical representation of the shape or geometry of each facial image, Sosa has plausibly 

alleged that Onfido obtains “biometric identifiers” as defined by BIPA. 

B. Liquidated Damages

We turn next to Onfido’s contention that we must dismiss Sosa’s requests for liquidated 

damages. BIPA authorizes a prevailing party to recover the greater of actual damages or $1,000 

in liquidated damages for each negligent BIPA violation, and the greater of actual damages or 

$5,000 in liquidated damages for each intentional or reckless BIPA violation. 740 Ill. Comp. 

Stat. 14/20(1), (2). Among other things, Sosa seeks liquidated damages of $5,000 for each 

willful and/or reckless BIPA violation or, alternatively, liquidated damages of $1,000 for each 

negligent BIPA violation. (Compl. ¶ 58.) According to Onfido, we must dismiss these claims 

because Sosa has failed to allege facts from which we can reasonably infer that Onfido 

negligently, recklessly, or intentionally violated the BIPA. (Mem. at 11–14.) In response, Sosa 

Case: 1:20-cv-04247 Document #: 58 Filed: 04/25/22 Page 17 of 37 PageID #:604
18

argues that he does not need to plead Onfido’s state of mind, and even if he did, he has alleged

facts sufficient to plead that Onfido was negligent, intentional, or reckless. (Resp. at 5–11.) 

We agree with Sosa that dismissing his requests for liquidated damages is not warranted. 

Sosa’s requests for liquidated damages are requests for a particular type of remedy should he

prevail on his underlying BIPA claim. See Bradenberg, 2021 WL 4494275, at *5 (“Section 

14/20 of BIPA contains four remedies available to prevailing plaintiffs in BIPA cases. Two of 

the four remedies in Section 14/20 are liquidated damages in the event a defendant acts with a 

specific state of mind when violating BIPA.” (internal citation omitted)); Cothron v. White

Castle Sys., Inc., 467 F. Supp. 3d 604, 615 (N.D. Ill. 2020) (BIPA plaintiff’s requests for

statutory damages, declaratory relief, and injunctive relief for each alleged statutory violation 

were requests for “various forms of relief” that stemmed from the same claim). Sosa seeks other 

remedies authorized by BIPA as well—injunctive relief and reasonable attorneys’ fees, costs, 

and expenses. (Compl. ¶ 58); see 740 Ill. Comp. Stat. 14/20(3), (4). These remedies are distinct 

from Sosa’s underlying claim for relief based on BIPA. See Davis v. Passman, 442 U.S. 228, 

239, 99 S. Ct. 2264, 2274 (1979) (“[W]hether a litigant has a ‘cause of action’ is analytically 

distinct and prior to the question of what relief, if any, a litigant may be entitled to receive.”); 

Jones v. Butler, 663 F. App’x 468, 470 (7th Cir. 2016) (a demand for relief “is not itself a part of 

the plaintiff’s claim” (quotation marks omitted)); Onyango v. Downtown Ent., LLC, 525 F. 

App’x 458, 460 (7th Cir. 2013) (“An injunction is a type of remedy, as distinct from an 

underlying claim for relief[.]” (internal citations omitted)). Federal Rule of Civil Procedure 8 

recognizes this distinction by requiring “a short and plain statement of the claim showing that the 

pleader is entitled to relief” at subsection (a)(2) and, separately, “a demand for the relief sought” 

at subsection (a)(3). Fed. R. Civ. P. 8(a)(2), (3) (emphases added). 

Case: 1:20-cv-04247 Document #: 58 Filed: 04/25/22 Page 18 of 37 PageID #:605
19

In other words, Sosa’s requests for liquidated damages are not “claims,” as Onfido 

contends, but demands for relief. Sosa need not plead facts (such as facts plausibly suggesting 

negligence, recklessness, or intentional conduct) that show his entitlement to these precise forms 

of relief.7 See Ibarra v. Prospera, LLC, No. 20 C 7015, 2021 WL 1921015, at *4 (N.D. Ill. May 

12, 2021) (“Rule 8(a)(3) requires plaintiffs to include a ‘demand for the relief sought’ but does 

not require damages to be alleged plausibly or with particularity.”); Cothron, 467 F. Supp. 3d at 

615 (“Rule 12(b)(6) does not require [the plaintiff] to plead the facts that will determine the 

amount of actual damages she may be entitled to recover [under sections 15(b) and 15(d) of 

BIPA].”); Peatry v. Bimbo Bakeries USA, Inc., No. 19 C 2942, 2020 WL 919202, at *6 (N.D. Ill. 

Feb. 26, 2020) (“Rule 8 does not require a plaintiff to plead damages with particularity and 

instead only requires ‘a demand for the relief sought.’” (quoting Fed. R. Civ. P. 8(a)(3)); see also

Wolf v. Walker, No. 14-cv-64-BBC, 2014 WL 1729098, at *3 (W.D. Wis. Apr. 30, 2014) (noting 

that Twombly and Iqbal did not address the detail necessary for a request for relief). 

Nor does Sosa need to allege facts suggesting any level of culpability to plausibly state a 

BIPA claim in the first place. “BIPA imposes liability . . . regardless of the violator’s state of 

mind,” Snider v. Heartland Beef, Inc., 479 F. Supp. 3d 762, 772 (C.D. Ill. 2020), and “the need 

to demonstrate negligence, intentional action, or recklessness impacts a plaintiff’s recovery, not 

7 We came to a contrary conclusion in Rogers v. CSX Intermodal Terminals, Inc., where we 

dismissed a BIPA plaintiff’s “claim of intentional and reckless conduct” because he alleged in 

conclusory fashion that the defendant’s BIPA violations were knowing and willful. 409 F. Supp. 

3d 612, 618–19 (N.D. Ill. 2019). But Rogers does not bind us. Camreta v. Greene, 563 U.S. 

692, 709, 131 S. Ct. 2020, 2033 n.7 (2011). And although we strive to rule consistently from 

case to case, we will not hesitate to depart from a ruling in a previous case if we determine that it 

is appropriate to do so. Cf. Hangzhou Aoshuang E-Commerce Co. v. 008Fashion, 336 F.R.D. 

154, 155–57 (N.D. Ill. 2020) (rejecting the defendants’ suggestion that the court had to adhere to 

an opinion it issued eight years before, “no matter how erroneous”). Here, several decisions that 

we did not consider in Rogers (and many of which did not issue until after Rogers) have

convinced us that our conclusion today is the correct one. 

Case: 1:20-cv-04247 Document #: 58 Filed: 04/25/22 Page 19 of 37 PageID #:606
20

the underlying substantive violation of BIPA,” Peatry, 2020 WL 919202, at *6. As the Supreme 

Court of Illinois has explained, a violation of section 15, “in itself, is sufficient to support the 

individual’s or customer’s statutory cause of action,” and “[n]o additional consequences need be 

pleaded or proved.” Rosenbach, 2019 IL 123186, ¶ 33. For instance, Sosa may obtain injunctive 

relief or attorneys’ fees—as he has requested (Compl. ¶ 58)—regardless of whether Onfido’s 

actions are proven to be negligent, reckless, or intentional. 740 Ill. Comp. Stat. 14/20(3), (4); 

Stauffer v. Innovative Heights Fairview Heights, LLC, 480 F. Supp. 3d 888, 907 (S.D. Ill. 2020); 

Cothron, 467 F. Supp. 3d at 615. Sosa, therefore, is not required to plead facts showing 

negligence, recklessness, or intentional conduct to state a BIPA claim either. Smith v. Signature 

Sys., Inc., No. 2021-CV-02025, 2022 WL 595707, at *5 (N.D. Ill. Feb. 28, 2022) (rejecting 

argument that the plaintiff had to plead negligence, recklessness, or intent to state a BIPA claim); 

Bradenberg, 2021 WL 4494275, at *6 (“Plaintiff need not plead facts showing Defendant’s 

mental state to state a claim for relief [under BIPA].”); Ibarra, 2021 WL 1921015, at *4 

(“[P]laintiff does not need to include additional allegations of defendant’s mental state in order to 

state the underlying BIPA claim[.]”); Stauffer, 480 F. Supp. 3d at 907 (the plaintiff was not 

required to assert facts regarding the defendant’s “negligent, reckless, or intentional actions to 

bring a BIPA cause of action”); Snider, 479 F. Supp. 3d at 770 (“[A] BIPA plaintiff need not 

plead facts showing the defendant’s mental state to state a claim for relief.”); Cothron, 467 F. 

Supp. 3d at 615 (“[A]llegations of scienter or no, Ms. Cothron’s complaint states a plausible 

claim for relief under sections 15(b) and 15(d) [of BIPA].”). 

C. First Amendment

Because Onfido’s non-constitutional arguments do not persuade us to dismiss Sosa’s 

Complaint, we now consider Onfido’s contention that BIPA violates the First Amendment. 

Onfido argues that BIPA is a restraint on commercial speech that fails intermediate scrutiny or, 

Case: 1:20-cv-04247 Document #: 58 Filed: 04/25/22 Page 20 of 37 PageID #:607
21

alternatively, that BIPA is a content-based restriction that fails strict scrutiny.8 (Mem. at 14–18.) 

Sosa argues that the BIPA provisions at issue, sections 15(a) and 15(b), do not violate the First 

Amendment because they restrict conduct, not speech. (Resp. at 11–13.) But even if sections 

15(a) and 15(b) restrict speech, Sosa continues, they are not subject to strict scrutiny and satisfy 

intermediate scrutiny. (Id. at 13–16.) 

We begin by defining the scope of our constitutional inquiry, keeping in mind that we 

should “avoid making unnecessary constitutional decisions.” ISI Int’l, 256 F.3d at 552. Onfido 

suggests in its briefing that the entirety of BIPA is unconstitutional. (See, e.g., Mem. at 6 

(“BIPA is an unconstitutional restraint on speech in violation of the First Amendment . . . and 

consequently is invalid.”).) Yet Sosa accuses Onfido of violating only subsections (a) and (b) of 

section 15. (Compl. ¶¶ 47–49, 53–56.) Furthermore, Onfido does not contend that section 15(a) 

unconstitutionally restricts speech. Onfido argues only that BIPA restricts speech by regulating

its collection of “factual information voluntarily provided by consumers to identify themselves as 

marketplace users.” (See Mem. at 14–15; Reply at 8–9.) Section 15(b) regulates the collection 

of this information; section 15(a) does not. Compare 740 Ill. Comp. Stat. 14/15(b) (requiring an 

individual’s informed consent before collecting the individual’s biometric information or 

identifiers), with id. § 15(a) (requiring the development of a publicly available written dataretention policy and compliance with the policy). We therefore limit our First Amendment 

analysis to section 15(b). 

8 Onfido also contends in a footnote that BIPA is a speaker-based restriction on speech that is 

subject to heightened scrutiny. (Mem. at 15 n.2.) But Onfido neither identifies the level of 

scrutiny at issue nor explains why BIPA would fail that scrutiny. (See id.) We decline to 

consider whether a duly enacted statute is unconstitutional based on Onfido’s undeveloped 

contention. See United States v. Berkowitz, 927 F.2d 1376, 1384 (7th Cir. 1991) (“[P]erfunctory 

and undeveloped arguments, and arguments that are unsupported by pertinent authority, are 

waived (even where those arguments raise constitutional issues).”).

Case: 1:20-cv-04247 Document #: 58 Filed: 04/25/22 Page 21 of 37 PageID #:608
22

We also consider Onfido’s First Amendment challenge as applied to the facts of this case. 

Onfido does not dispute that its challenge is “as applied,” and treating Onfido’s First 

Amendment argument as an as-applied challenge comports with our duty to avoid deciding 

unnecessary constitutional questions. See Hegwood v. City of Eau Claire, 676 F.3d 600, 603 

(7th Cir. 2012); ISI Int’l, 256 F.3d at 552. Thus, “we examine the facts of the case before us 

exclusively,” Hegwood, 676 F.3d at 603, and ask whether section 15(b) impermissibly abridges 

Onfido’s right to free speech, see HH-Indianapolis, LLC v. Consol. City of Indianapolis & Cnty.

of Marion, 889 F.3d 432, 439 (7th Cir. 2018) (“[t]he critical inquiry” in the plaintiff’s as-applied 

challenge was whether the ordinance abridged the plaintiff’s First Amendment rights).

As we will discuss, section 15(b) does not violate Onfido’s First Amendment rights for 

two reasons. First, section 15(b) does not restrict Onfido’s speech, so the First Amendment does 

not apply. Second, even if section 15(b) restricts Onfido’s speech, it is a content-neutral 

restriction that survives the applicable level of First Amendment scrutiny.

1. Section 15(b) Does Not Restrict Onfido’s Speech

“The First Amendment, applicable to the States through the Fourteenth Amendment, 

prohibits the enactment of laws” that restrict speech or inherently expressive conduct. Reed v. 

Town of Gilbert, 576 U.S. 155, 163, 135 S. Ct. 2218, 2226 (2015); Tagami v. City of Chicago, 

875 F.3d 375, 378 (7th Cir. 2017). If a statute does not regulate the ability to engage in speech 

or inherently expressive conduct, the First Amendment does not come into play. See, e.g.,

Cornelius v. NAACP Legal Def. & Educ. Fund, Inc., 473 U.S. 788, 797, 105 S. Ct. 3439, 3446 

(1985) (explaining that the Court “need go no further” in its First Amendment analysis if the 

solicitation at issue was not “speech protected by the First Amendment”); Doe v. City of 

Lafayette, 377 F.3d 757, 764 (7th Cir. 2004) (en banc) (finding First Amendment doctrine 

inapplicable “because there [was] no expression at issue”). Accordingly, we begin by asking 

Case: 1:20-cv-04247 Document #: 58 Filed: 04/25/22 Page 22 of 37 PageID #:609
23

whether section 15(b) regulates Onfido’s speech.9 See Cablevision Sys. Corp. v. FCC, 570 F.3d 

83, 96 (2d Cir. 2009) (“As a threshold matter, a party alleging violation of its First Amendment

rights must show that the challenged government action actually regulates protected speech.”). 

We start with section 15(b)’s text. See Sorrell v. IMS Health Inc., 564 U.S. 552, 562, 131 

S. Ct. 2653, 2662 (2011) (starting its First Amendment analysis with the text of the challenged 

statutory provision). Section 15(b) states:

No private entity may collect, capture, purchase, receive through 

trade, or otherwise obtain a person’s or a customer’s biometric 

identifier or biometric information, unless it first:

(1) informs the subject or the subject’s legally authorized 

representative in writing that a biometric identifier or 

biometric information is being collected or stored;

(2) informs the subject or the subject’s legally authorized 

representative in writing of the specific purpose and length 

of term for which a biometric identifier or biometric 

information is being collected, stored, and used; and

(3) receives a written release executed by the subject of the 

biometric identifier or biometric information or the subject’s 

legally authorized representative.

740 Ill. Comp. Stat. 14/15(b). Section 15(b) thus prohibits a private entity from obtaining an 

individual’s biometric data10 unless the entity satisfies three prerequisites designed to obtain the 

individual’s informed consent. See id.; Fox, 980 F.3d at 1150. Section 15(b), however, does not

prohibit or otherwise restrict what a private entity may do with an individual’s biometric data 

once the data is obtained. Compare 740 Ill. Comp. Stat. 14/15(b), with id. § 15(c) (prohibiting 

the sale of biometric data), and id. § 15(d) (restricting the disclosure of biometric data). 

9 Onfido does not contend that BIPA regulates inherently expressive conduct.

10 For purposes of our First Amendment analysis, we use the term “biometric data” to refer to 

“biometric identifiers” and “biometric information” collectively.

Case: 1:20-cv-04247 Document #: 58 Filed: 04/25/22 Page 23 of 37 PageID #:610
24

Applied here, section 15(b) regulates Onfido’s ability to obtain an individual’s biometric 

data by requiring Onfido to acquire the individual’s informed consent before doing so. The 

question is whether this requirement regulates Onfido’s speech. Onfido says that it does because 

“factual information voluntarily provided by consumers to identify themselves as marketplace 

users” is commercial speech. (Mem. at 14–15; Reply at 8–9.) Sosa disagrees; it contends that 

section 15(b) regulates conduct, not speech. (Resp. at 11–13.) 

The Seventh Circuit’s decision in Dahlstrom v. Sun-Times Media, LLC, 777 F.3d 937 

(7th Cir. 2015), cited by Sosa, leads us to conclude that section 15(b) does not restrict Onfido’s 

speech. In Dahlstrom, the Seventh Circuit addressed the Driver’s Privacy Protection Act 

(“DPPA”), which “prohibits individuals from knowingly obtaining or disclosing ‘personal 

information’ from a motor vehicle record.” 777 F.3d at 939. Five Chicago police officers sued 

Sun-Times Media, LLC, arguing that it “violated the DPPA by obtaining each officer’s birth 

date, height, weight, hair color, and eye color from the Illinois Secretary of State’s motor vehicle 

records” and then publishing that information in a newspaper article. Id. Sun-Times moved to 

dismiss the officers’ complaint, arguing, among other things, that the DPPA’s “prohibition on 

acquiring and disclosing personal information from driving records violates the First 

Amendment’s guarantees of free speech and freedom of the press.” Id. 

Evaluating Sun-Times’s First Amendment challenge “as applied to the facts of [the] 

case,” the Seventh Circuit addressed the DPPA’s prohibition on “obtaining personal information 

from driving records,” and then addressed the DPPA’s prohibition on “disclosing that 

information.” Id. at 946. The Dahlstrom court concluded that the “prohibition on obtaining 

information from driving records” did not restrict speech because it limited only “access to 

information.” Id. at 947–49 (emphasis in original). The court then concluded that the 

Case: 1:20-cv-04247 Document #: 58 Filed: 04/25/22 Page 24 of 37 PageID #:611
25

prohibition on disclosing personal information from driving records, while “a direct regulation of 

speech,” id. at 949, survived intermediate scrutiny and did not violate Sun-Times’s First 

Amendment rights, id. at 949–54.

Like the first DPPA provision at issue in Dahlstrom, section 15(b) burdens a party’s 

ability to access certain information. In determining “that the DPPA’s limitation on obtaining 

personal information [was] not a restriction on speech at all,” 777 F.3d at 949, the Dahlstrom

court found unpersuasive Sun-Times’s argument that this limitation burdened its speech, “albeit 

at an earlier point in the speech process,” by restricting its “ability to gather and report the 

news,” id. at 947–48. Onfido makes a similar argument here; it contends that section 15(b) 

burdens its speech by restricting its ability to obtain biometric data from consumers. (See Mem. 

at 14–15; Reply at 8–9.) Based on Dahlstrom, Onfido’s argument cannot carry the day. If the 

DPPA’s prohibition on obtaining personal information is not a restriction on speech (as the 

Seventh Circuit has held), neither is section 15(b)’s regulation on obtaining biometric data. 

Onfido does not attempt to reconcile its position with Dahlstrom. (See Reply at 8–10

(failing to address Dahlstrom after Sosa cited it in his response).) Rather, Onfido rests its 

contention on a Tenth Circuit decision, U.S. West, Inc. v. FCC, 182 F.3d 1224 (10th Cir. 1999), 

and the Supreme Court’s decision in Sorrell. (Mem. at 14–15.) But even if U.S. West supported 

Onfido’s contention, it does not bind us, and it cannot compel a conclusion at odds with 

Dahlstrom. See United States v. Glaser, 14 F.3d 1213, 1216 (7th Cir. 1994). And although 

Sorrell is binding precedent, it is distinguishable. 

At issue in Sorrell was a Vermont statutory provision, section 4631(d), that restricted the 

sale, disclosure, and use of pharmacy records that revealed doctors’ prescribing practices (known 

as prescriber-identifying information). 564 U.S. at 557–58, 131 S. Ct. at 2659. Pharmacies sold 

Case: 1:20-cv-04247 Document #: 58 Filed: 04/25/22 Page 25 of 37 PageID #:612
26

prescriber-identifying information to data miners; data miners, in turn, analyzed the information, 

produced reports on prescriber behavior, and leased these reports to pharmaceutical 

manufacturers; and representatives of the manufacturers (known as detailers) used these reports 

to help promote and market their manufacturers’ drugs to doctors. Id., 131 S. Ct. at 2659–60. 

Section 4631(d) generally prohibited, absent the prescriber’s consent, (1) pharmacies and similar 

entities from selling prescriber-identifying information; (2) pharmacies and similar entities from 

disclosing prescriber-identifying information for marketing purposes; and (3) pharmaceutical 

manufacturers and detailers from using prescriber-identifying information for marketing. Id. at 

558–60, 131 S. Ct. at 2660. The Supreme Court held that section 4631(d) violated the First 

Amendment. Id. at 557, 131 S. Ct. at 2659. In doing so, the Court rejected the State’s 

contention that the statute “regulate[d] not speech but simply access to information.” Id. at 567–

70, 131 S. Ct. at 2665–66. As the Court explained, the statute burdened the speech of the data 

miners and pharmaceutical manufacturers because “restrictions on the disclosure of governmentheld information can facilitate or burden the expression of potential recipients and so transgress 

the First Amendment.” Id. at 561, 569, 131 S. Ct. at 2661, 2666. 

Sorrell differs from our case in two key respects. First, central to the Sorrell Court’s 

analysis was the fact that the detailers’ inability to obtain prescriber-identifying information 

burdened their subsequent ability to use the information to communicate with physicians. See, 

e.g., id. at 564, 131 S. Ct. at 2663 (“But § 4631(d) leaves detailers no means of purchasing, 

acquiring, or using prescriber-identifying information. . . . Vermont’s law thus has the effect of 

preventing detailers—and only detailers—from communicating with physicians in an effective 

and informative manner.”). Indeed, in rejecting the State’s “access to information” argument, 

the Court relied upon the burden section 4631(d) imposed on potential recipients’ expression. Id.

Case: 1:20-cv-04247 Document #: 58 Filed: 04/25/22 Page 26 of 37 PageID #:613
27

at 569–70, 131 S. Ct. at 2666. As Sosa points out, though, Onfido does not identify any speech it 

wishes to undertake once it obtains individuals’ biometric data. (Resp. at 12.) So, unlike in 

Sorrell, the party challenging the statute’s constitutionality here has not identified how the statute 

burdens its own ability to engage in speech or expression.

Second, the statutory provisions addressed in Sorrell substantively differ from section 

15(b). Each of the three provisions at issue in Sorrell expressly restricted the sale, disclosure, or

use of prescriber-identifying information. 564 U.S. at 558–59, 563–64, 131 S. Ct. at 2660, 2663. 

As such, each provision undoubtedly restricted speech. See id. at 570, 131 S. Ct. at 2667 (“This 

Court has held that the creation and dissemination of information are speech within the meaning 

of the First Amendment.”); Dahlstrom, 777 F.3d at 949 (“[T]he [DPPA’s] prohibition on 

disclosing [personal] information is a direct regulation of speech.”). In contrast, section 15(b) 

does nothing to restrict an entity’s sale, disclosure, or use of biometric data once the data is 

obtained. Thus, section 15(b) is much more like the DPPA prohibition on obtaining information 

at issue in Dahlstrom, which does not restrict speech, than the provisions at issue in Sorrell, 

which do restrict speech.

In sum, Dahlstrom is much closer to the facts before us than Sorrell. Based on 

Dahlstrom, we find that section 15(b) does not restrict Onfido’s speech and is not subject to the 

First Amendment. But for the sake of completeness, we also consider whether—assuming 

section 15(b) restricts Onfido’s speech—section 15(b) survives First Amendment scrutiny.

2. Even if Section 15(b) Restricts Onfido’s Speech, It Survives 

First Amendment Scrutiny

Assuming that section 15(b) restricts Onfido’s speech, we must determine what level of 

First Amendment scrutiny applies. United States v. Kokinda, 497 U.S. 720, 725, 110 S. Ct. 

3115, 3118 (1990) (plurality opinion); Deida v. City of Milwaukee, 176 F. Supp. 2d 859, 864 

Case: 1:20-cv-04247 Document #: 58 Filed: 04/25/22 Page 27 of 37 PageID #:614
28

(E.D. Wis. 2001). Onfido argues that section 15(b) is a restraint on commercial speech that fails 

intermediate scrutiny or, alternatively, that section 15(b) is a content-based restriction that fails 

strict scrutiny. (Mem. at 14–18.) Although Onfido makes its strict scrutiny argument in the 

alternative, we address that argument first, as section 15(b) is “much less likely to survive 

[Onfido’s] First Amendment challenge” if strict scrutiny applies. Deida, 176 F. Supp. 2d at 864. 

a. Strict Scrutiny

“Content-based laws—those that target speech based on its communicative content—are 

presumptively unconstitutional” and “can stand only if they survive strict scrutiny.” Reed, 576 

U.S. at 163, 171, 135 S. Ct. at 2226, 2231. In Reed, the Supreme Court recognized two types of 

content-based laws: (1) laws that, on their face, make distinctions based on “the topic discussed 

or the idea or message expressed”; and (2) facially content-neutral laws that “cannot be justified 

without reference to the content of the regulated speech, or that were adopted by the government 

because of disagreement with the message the speech conveys.” Id. at 163–64, 135 S. Ct. at 

2227 (alteration and quotation marks omitted); Ill. Republican Party v. Pritzker, 973 F.3d 760, 

768 (7th Cir. 2020). Thus, “strict scrutiny applies either when a law is content based on its face 

or when the purpose and justification for the law are content based.” Reed, 576 U.S. at 166, 135 

S. Ct. at 2228. For a content-based restriction to survive strict scrutiny, it must “further[] a 

compelling interest and [be] narrowly tailored to achieve that interest.” Id. at 171, 135 S. Ct. at 

2231 (quotation marks omitted). 

Section 15(b) regulates the collection of an individual’s “biometric identifier or biometric 

information.” 740 Ill. Comp. Stat. 14/15(b). Based on BIPA’s definitions for these terms, this 

means that section 15(b) regulates the collection of some types of information but not others. 

See id. § 10 (identifying types of information that do and do not constitute a “biometric 

identifier” or “biometric information”). Onfido contends that because BIPA “targets only certain 

Case: 1:20-cv-04247 Document #: 58 Filed: 04/25/22 Page 28 of 37 PageID #:615
29

categories of information that can be used to identify a person,” it is “a content-based restriction 

on speech.” (Mem. at 17–18.) Not so, says Sosa. He contends that “BIPA does not concern 

itself with the message, if any even exists, communicated by a person’s biometric identifiers or 

biometric information.” (Resp. at 13–14.) 

Sosa has the better argument. We do not see—and Onfido does not explain—how the 

different categories of information set forth in BIPA’s definitions for “biometric identifier” and 

“biometric information” relate to the communicative content of that information. If BIPA 

regulated the use of, for example, face geometry scans of people yelling but not the face 

geometry scans of people smiling, that could be a content-based regulation, but “BIPA does 

nothing of the sort.” Clearview AI, 2021 WL 4164452, at *7 (rejecting the defendant’s argument 

“that BIPA is content-based because it targets specific content—biometric information such as 

faceprints, but not other content such as photos”). Nor does Onfido argue that although BIPA is 

content neutral on its face, “the purpose and justification” for its regulation of some categories of 

information (but not others) is content based. See Reed, 576 U.S. at 164, 166, 135 S. Ct. at 

2227–28. Because section 15(b) is a content-neutral restriction, we evaluate it using 

intermediate scrutiny. See Clearview AI, 2021 WL 4164452, at *7–8 (finding that BIPA’s 

restrictions are content neutral and subject to intermediate scrutiny). 

b. Intermediate Scrutiny

“The Supreme Court uses several variations of intermediate scrutiny in its free-speech 

cases.” ACLU v. Alvarez, 679 F.3d 583, 604 (7th Cir. 2012). Here, both parties base their 

intermediate scrutiny arguments on the framework for evaluating restrictions on commercial 

speech set forth by the Supreme Court in Central Hudson Gas & Electric Corp. v. Public Service 

Commission of New York, 447 U.S. 557, 100 S. Ct. 2343 (1980). (See Mem. at 15–17; Resp. at 

14–16); see also Fla. Bar v. Went For It, Inc., 515 U.S. 618, 623, 115 S. Ct. 2371, 2375–76 

Case: 1:20-cv-04247 Document #: 58 Filed: 04/25/22 Page 29 of 37 PageID #:616
30

(1995) (characterizing the Central Hudson framework as intermediate scrutiny). We therefore 

analyze Onfido’s First Amendment challenge using Central Hudson’s framework. See Andy’s

Rest. & Lounge, Inc. v. City of Gary, 466 F.3d 550, 552–53 (7th Cir. 2006) (using the framework 

relied upon by the parties to address First Amendment challenge); see also United States v.

Sineneng-Smith, 140 S. Ct. 1575, 1579 (2020) (explaining that federal courts “rely on the parties 

to frame the issues for decision” (quotation marks omitted)). 

The Central Hudson analysis has four prongs. See Cent. Hudson, 447 U.S. at 566, 100 S. 

Ct. at 2351. First, “we ask as a threshold matter whether the commercial speech concerns 

unlawful activity or is misleading.” Thompson v. W. States Med. Ctr., 535 U.S. 357, 367, 122 S. 

Ct. 1497, 1504 (2002). “If so, then the speech is not protected by the First Amendment.” Id. “If 

the speech concerns lawful activity and is not misleading, however, we next ask ‘whether the 

asserted governmental interest is substantial.’” Id. (quoting Cent. Hudson, 447 U.S. at 566, 100 

S. Ct. at 2351). “If it is, then we ‘determine whether the regulation directly advances the 

governmental interest asserted,’ and, finally, ‘whether it is not more extensive than is necessary 

to serve that interest.’” Id. (quoting Cent. Hudson, 447 U.S. at 566, 100 S. Ct. at 2351). “Each 

of these latter three inquiries must be answered in the affirmative for the regulation to be found 

constitutional.” Id.; see also Fla. Bar, 515 U.S. at 623–24, 115 S. Ct. at 2376 (reciting a slightly 

different formulation for the Central Hudson analysis). 

(i) Is the Speech Unlawful or Misleading?

We first consider “whether the commercial speech concerns unlawful activity or is 

misleading.” Thompson, 535 U.S. at 367, 122 S. Ct. at 1504. It does not. Obtaining an 

individual’s biometric data, although regulated, is not unlawful, and Sosa does not argue to the 

contrary. (See Resp. at 14.) Nor is there anything inherently misleading about biometric data 

itself or the act of obtaining biometric data. Moreover, even if a company could misleadingly 

Case: 1:20-cv-04247 Document #: 58 Filed: 04/25/22 Page 30 of 37 PageID #:617
31

obtain biometric data in some circumstances, section 15(b) does not make a distinction based on 

this possibility. Stated differently, section 15(b) regulates both the misleading and nonmisleading collection of biometric data. Section 15(b) therefore must satisfy the remainder of 

the Central Hudson test. Edenfield v. Fane, 507 U.S. 761, 768–69, 113 S. Ct. 1792, 1799 (1993) 

(“[W]here . . . truthful and nonmisleading expression will be snared along with fraudulent or 

deceptive commercial speech, the State must satisfy the remainder of the Central Hudson

test[.]”); FTC v. Trudeau, 662 F.3d 947, 953 (7th Cir. 2011) (requirement that the defendant post 

a bond before participating in an infomercial, regardless of whether the informercial contained a 

misleading statement, triggered intermediate scrutiny under Central Hudson).

Sosa disagrees, arguing that Onfido’s actions are misleading because it “takes steps to 

conceal its involvement in the collection of biometric data, making it difficult to tell that Onfido 

is even involved.” (Resp. at 14.) But we do not read Sosa’s Complaint as alleging active 

concealment by Onfido, and Sosa fails to identify any allegation from the Complaint that

supports his assertion. (Id.) Sosa also does not cite any case suggesting that either the 

integration of Onfido’s software into third-party products or consumers’ unawareness of this 

integration (e.g., Compl. ¶¶ 3, 4, 21) amounts to “misleading” speech that brings our Central 

Hudson analysis to a halt. We therefore proceed to the second prong of the analysis.

(ii) Is There a Substantial Governmental Interest?

We next ask whether section 15(b) is supported by a substantial governmental interest. 

See Fla. Bar, 515 U.S. at 624, 115 S. Ct. at 2376. Section 15(b) is intended to protect 

consumers’ rights to privacy in and control over their biometric data. Bryant, 958 F.3d at 619, 

626; Rosenbach, 2019 IL 123186, ¶¶ 33–34, 129 N.E.3d at 1206. Illinois has a substantial 

interest in protecting consumers, and more specifically, protecting their privacy in and control 

over their biometric data. See Trudeau, 662 F.3d at 953 (“The protection of consumers is a 

Case: 1:20-cv-04247 Document #: 58 Filed: 04/25/22 Page 31 of 37 PageID #:618
32

substantial interest.”); Abbas v. Selling Source, LLC, No. 09 CV 3413, 2009 WL 4884471, at *7–

8 (N.D. Ill. Dec. 14, 2009) (protecting consumer privacy was a substantial government interest); 

see also Nat’l Cable & Telecomms. Ass’n v. FCC, 555 F.3d 996, 1001 (D.C. Cir. 2009) 

(recognizing that “protecting the privacy of consumer credit information is a substantial

governmental interest” under Central Hudson (quotation marks omitted)). Section 15(b) satisfies 

this prong of the Central Hudson inquiry.

According to Onfido, however, “the government has no ‘substantial interest’ in 

restricting the collection, handling, or disclosure of facial geometry” because a person has no 

reasonable expectation of privacy in her face, which is constantly exposed to the public. (Mem. 

at 16 (emphasis added); Reply at 8–9.) But Onfido’s argument erroneously equates viewing a 

person’s face with scanning facial geometry. Although the naked eye can perceive general 

aspects of a person’s face, it cannot perceive detailed information about the face’s geometry, 

such as a unique numerical representation of the face’s shape. This is the type of information 

collected when companies obtain scans of facial geometry. (Compl. ¶¶ 2, 23, 24; Resp. at 3–4); 

see, e.g., Rivera, 238 F. Supp. 3d at 1091, 1095 (scanning photographs and zeroing in on the 

unique contours of a face “to create a ‘template’ that maps and records [] distinct facial 

measurements” was a scan of face geometry); In re Facebook Biometric Info. Priv. Litig., 185 F. 

Supp. 3d at 1171 (scanning “user-uploaded photographs to create a ‘unique digital representation 

of the face . . . based on [the] geometric relationship of [] facial features” constituted a scan of 

face geometry); Clearview AI, 2021 WL 4164452, at *1, *5 (scanning a photograph, measuring 

and recording “data such as the shape of the cheekbones and the distance between eyes, nose, 

and ears,” and assigning “that data a numerical value” constituted a scan of face geometry). We 

Case: 1:20-cv-04247 Document #: 58 Filed: 04/25/22 Page 32 of 37 PageID #:619
33

have no trouble finding that the government has a substantial interest in protecting consumers’ 

rights to privacy in and control over this type of information. 

(iii) Does Section 15(b) Directly Advance the Governmental Interest?

Third, we ask whether section 15(b) “directly advances” the governmental interest. Cent.

Hudson, 447 U.S. at 566, 100 S. Ct. at 2351. For this prong to be met, the harms identified by 

Illinois must be real and the restriction at issue must in fact “alleviate them to a material degree.” 

Fla. Bar, 515 U.S. at 625–26, 115 S. Ct. at 2377 (quotation marks omitted). 

Both parts of this prong are satisfied. In enacting BIPA, the Illinois General Assembly 

found that the immutability of an individual’s biometric data means that once it is compromised, 

the individual suffers an irreparable privacy harm and is at heightened risk for identity theft. See

740 Ill. Comp. Stat. 14/5(c); Fox, 980 F.3d at 1149; Bryant, 958 F.3d at 619. We have no reason 

to question the existence of these harms, and Onfido gives us none. Section 15(b) materially 

alleviates these real harms by preventing them from occurring in the first place. See Rosenbach, 

2019 IL 123186, ¶ 36, 129 N.E.3d at 1206 (“The strategy adopted by the General Assembly 

through enactment of [BIPA] is to try to head off [problems caused by the use of biometric data] 

before they occur.”). Section 15(b)’s informed-consent regime seeks to protect consumers’ 

rights in their biometric data “before they are or can be compromised” by ensuring that 

consumers understand how their biometric data will be used, disclosed, or retained before they 

relinquish control over it. Id., 129 N.E.3d at 1206–07; Bryant, 958 F.3d at 626. Indeed, the 

power to refuse to provide biometric data after being informed of the potential consequences is a 

key part of consumers’ right to control their data, and when a company does not allow a 

consumer to exercise this power, the consumer’s right to maintain his “biometric privacy 

vanishes into thin air.” See Rosenbach, 2019 IL 123186, ¶ 34, 129 N.E.3d at 1206 (quotation 

marks omitted); Bryant, 958 F.3d at 621. By allowing a company to collect a consumer’s 

Case: 1:20-cv-04247 Document #: 58 Filed: 04/25/22 Page 33 of 37 PageID #:620
34

biometric data only after the consumer can make an informed choice about whether to allow the 

collection, section 15(b) directly advances the government’s interest in protecting consumers’ 

rights to privacy in and control over their biometric data. 

Onfido does not agree. It first contends that Sosa voluntarily uploaded his photograph 

and driver’s license and understood that his photograph would be stored. (Mem. at 16–17.) It 

then contends that requiring a company to make certain disclosures and obtain a release in 

writing, as section 15(b) does, fails to “materially advance any interest because—as this case 

illustrates—other[] forms of disclosure and consent are equally effective.” (Id. at 17.) Taking 

these contentions together, Onfido appears to argue that (1) Sosa consented to Onfido’s 

collection of his photograph by voluntarily uploading it with the understanding that the 

photograph would be stored, and (2) this consent is “equally effective” as the disclosures and 

consent required by section 15(b). 

This argument is a non-starter. Consenting to Onfido’s collection of a photograph is not 

the same as consenting to Onfido’s collection of biometric data—here, a scan of face geometry. 

Because section 15(b) is concerned with obtaining consumers’ informed consent for the 

collection of their biometric data, not their photographs, see 740 Ill. Comp. Stat. 14/10, 14/15(b),

Sosa’s purported consent in the case at hand does nothing to advance the government’s interest 

in protecting consumers’ rights in their biometric data. Nor does Onfido identify any other forms 

of disclosure or consent that are purportedly as effective as disclosures and consent 

memorialized in writing. (Mem. at 16–17; Reply at 10.) But even if Onfido had identified 

available and equally effective forms of non-written informed consent, it would not have 

impacted whether section 15(b)’s “in writing” requirement directly advances the governmental 

interest in protecting consumer privacy. At best, the availability and effectiveness of alternative 

Case: 1:20-cv-04247 Document #: 58 Filed: 04/25/22 Page 34 of 37 PageID #:621
35

forms would affect the “fit” between section 15(b) and the government’s interest, which is 

addressed as part of the last Central Hudson prong, not the current one. See Fla. Bar, 515 U.S. 

at 632, 115 S. Ct. at 2380; Trudeau, 662 F.3d at 953.

(iv) Is Section 15(b) More Extensive Than Necessary? 

Finally, we come to the fourth Central Hudson prong: is section 15(b) “more extensive 

than [] necessary to serve” the government’s interest? Cent. Hudson, 447 U.S. at 566, 100 S. Ct. 

at 2351. To answer this question, “we examine the relationship between the [government’s] 

interests and the means chosen to serve them.” Fla. Bar, 515 U.S. at 632, 115 S. Ct. at 2380. 

The “fit” between the government’s interests and the restriction at issue need not be perfect or 

the least restrictive means available. Id. The fit only needs to be reasonable, i.e., “one whose 

scope is in proportion to the interest served.” Id. (quotation marks omitted).

Section 15(b) meets this standard. First, it does not outright prohibit companies like 

Onfido from obtaining biometric data; it merely requires them to obtain informed consent before 

doing so. Second, it is not too onerous to require a company that wants to collect a consumer’s 

sensitive and immutable biometric data to obtain the consumer’s consent before doing so. See

740 Ill. Comp. Stat. 14/15(b)(3). Similarly, we do not see anything unduly burdensome about 

the amount and type of information—the fact that biometric data is being collected or stored and 

the purpose and length of term for which the data is being collected, stored, and used—that must 

be provided to ensure that the consumer’s consent is informed. Id. § 15(b)(1), (2). “Compliance 

should not be difficult; whatever expenses a business might incur to meet [these] requirements 

are likely to be insignificant compared to the substantial and irreversible harm that could result if 

biometric identifiers and information are not properly safeguarded.” Rosenbach, 2019 IL 

123186, ¶ 37, 129 N.E.3d at 1207. Third, section 15(b)’s “in writing” requirement guarantees 

that there is a record of the required disclosures and release should the consumer’s biometric data 

Case: 1:20-cv-04247 Document #: 58 Filed: 04/25/22 Page 35 of 37 PageID #:622
36

later become compromised, or some other dispute between the consumer and the collector arises. 

Finally, and as already noted, Onfido does not identify any other forms of disclosure and consent 

that are as equally effective as those required by section 15(b). The fit between section 15(b)’s 

requirements and the government’s interest in protecting consumers’ rights to privacy in and 

control over their biometric data is certainly reasonable.

Onfido’s argument to the contrary again does not persuade us. Onfido contends that 

section 15(b) is more extensive than necessary to prevent identity theft “because it restricts 

companies from engaging in wholly permissible activities.” (Mem. at 17; Reply at 10.) But the 

government’s interest is broader than simply preventing identity theft; it is protecting consumers’ 

rights to privacy in and control over their biometric data. More to the point, any restriction that 

proceeds past the first Central Hudson prong curbs lawful activities in some way. See Fla. Bar, 

515 U.S. at 623–24, 115 S. Ct. at 2376; Cent. Hudson, 447 U.S. at 563–64, 566, 100 S. Ct. at 

2350–51. Yet this does not mean that the restriction fails the fourth and final Central Hudson 

prong. See, e.g., Fla. Bar, 515 U.S. at 632–34, 115 S. Ct. at 2380–81 (bar regulation satisfied the 

final Central Hudson prong); Trudeau, 662 F.3d at 952–54 (same for bond requirement). So too 

here: section 15(b)’s restrictions are not more extensive than necessary simply because they 

regulate the otherwise permissible act of obtaining biometric data.

* * *

In conclusion, we deny Onfido’s motion to dismiss based on the First Amendment 

because section 15(b) does not restrict Onfido’s speech, and even if it does, it is a content-neutral 

restriction that satisfies Central Hudson’s intermediate level of scrutiny.

Case: 1:20-cv-04247 Document #: 58 Filed: 04/25/22 Page 36 of 37 PageID #:623
37

CONCLUSION

For the foregoing reasons, we deny Onfido’s motion to dismiss (Dkt. No. 45). Onfido 

shall answer Sosa’s Complaint by May 16, 2022. It is so ordered.

____________________________________

Marvin E. Aspen

United States District Judge

Dated: April 25, 2022

Case: 1:20-cv-04247 Document #: 58 Filed: 04/25/22 Page 37 of 37 PageID #:624