Abstract background
Our Work

Winning Dismissal for X Corp. in Illinois Biometric Information Privacy Act Putative Class Action

July 8, 2024
Federal court’s decision affirms data must be capable of identifying an individual to qualify as a “biometric identifier” or “biometric information” and thus be subject to BIPA’s requirements.

Latham litigators secured a critical win for X Corp. (formerly known as Twitter) in a putative class action in the Northern District of Illinois alleging that X violated the Illinois Biometric Information Privacy Act (BIPA) in connection with its use of PhotoDNA software to identify and remove images of child exploitation from the X platform.

The plaintiff alleged that when he uploaded an image of himself to the X platform, X used PhotoDNA to create a unique digital signature for the image, which is referred to as a “hash.” X then compared that hash to hashes for known images of child exploitation so as to stop such images from circulating on X. The plaintiff alleged that this process violated BIPA because PhotoDNA supposedly collects biometric identifiers in the form of facial geometry scans of individuals depicted in images that are analyzed by PhotoDNA.

On June 13, 2024, Judge Sunil R. Harjani of the Northern District of Illinois dismissed all claims against X for failure to state a claim under BIPA. Judge Harjani determined that the plaintiff did not plausibly allege that PhotoDNA collects facial geometry scans or any other type of biometric identifier, including because the mere fact that PhotoDNA creates hashes from images uploaded to X does not necessarily mean that PhotoDNA also scans the facial geometries of individuals depicted in those images. More significantly, Judge Harjani agreed with X’s position that under BIPA, data can qualify as a “biometric identifier” only if it can be used to identify a person. The plaintiff did not allege that PhotoDNA could be used to identify individuals depicted in analyzed images, which provided an independent reason for dismissing all claims against X.

The decision affirms that data must be capable of identifying an individual to qualify as a “biometric identifier” and be subject to BIPA’s requirements — a favorable ruling for other companies facing BIPA claims.

The Latham team included partners Robert C. Collins III in Chicago and Michele D. Johnson in Orange County, with associate Kathryn Running in Chicago.

Endnotes