FOR PUBLICATION

UNITED STATES COURT OF APPEALS

FOR THE NINTH CIRCUIT

CLAYTON P. ZELLMER, on behalf No. 22-16925 of himself and all others similarly situated, D.C. No. 3:18-cv-01880-JD Plaintiff-Appellant,

v. OPINION

META PLATFORMS, INC.,

Defendant-Appellee.

Appeal from the United States District Court for the Northern District of California James Donato, District Judge, Presiding

Submitted February 7, 2024 San Francisco, California

Filed June 17, 2024

Before: Ryan D. Nelson, Danielle J. Forrest, and Gabriel P. Sanchez, Circuit Judges.

Opinion by Judge R. Nelson 2 ZELLMER V. META PLATFORMS, INC.

SUMMARY*

Privacy / Standing

The panel affirmed the district court’s summary judgment in favor of Facebook—now Meta Platforms, Inc.—on Clayton Zellmer’s claim alleging a violation of the Illinois Biometric Information Privacy Act (BIPA) when Facebook collected or captured his biometric identifiers when it created what Facebook called a “face signature” from uploaded photos; and affirmed the district court’s dismissal for lack of standing of Zellmer’s claim that Facebook violated BIPA when it failed to publish a written policy establishing its retention schedule for collected biometric data. Zellmer never used Facebook, and he alleged BIPA violations after his friends uploaded photographs of him to Facebook. The panel affirmed on different grounds the district court’s summary judgment in favor of Meta on Zellmer’s claim under Section 15(b) of BIPA. The district court’s decision turned on the practical impossibility of Meta’s complying with BIPA if it had to obtain consent from everyone whose photo was uploaded to Facebook before it could employ Tag Suggestions. Because the plain text of BIPA applies to everyone whose biometric identifiers or information was held by Facebook, this conclusion was wrong. Having rejected the district court’s reasons for granting summary judgment, the panel turned to whether

* This summary constitutes no part of the opinion of the court. It has been prepared by court staff for the convenience of the reader.

ZELLMER V. META PLATFORMS, INC. 3

there was a material dispute of fact as to whether Meta violated BIPA’s plain terms. On the record, there was no dispute that Facebook made a face signature of Zellmer from photos that his friends uploaded. Guided by BIPA’s statutory text, the panel concluded face signatures cannot identify and therefore are not biometric identifiers or information as defined by BIPA. The panel affirmed the district court’s dismissal of Zellmer’s claim under Section 15(a) of BIPA for lack of Article III standing. Zellmer alleged that Meta lacked written, publicly available policies identifying its retention schedules for permanently destroying any biometric identifiers or information on non-users like him in its possession. The panel held that Zellmer never explained how he or any of the proposed class members were harmed by this general duty in a “concrete and particularized” way. Nor could he have, given the panel’s conclusion that, on the record, face signatures cannot identify and therefore are not biometric identifiers or information as defined by BIPA.

COUNSEL

John Carey (argued), Carey Rodriguez LLP, Miami, Florida; David P. Milian, The Milian Legal Group, Miami, Florida; Albert Y. Chang, Bottini & Bottini Inc., La Jolla, California; for Plaintiff-Appellant. Lauren R. Goldman (argued), Michael Brandon, and Lefteri J. Christos, Gibson Dunn & Crutcher LLP, New York, New York; Michael G. Rhodes and Whitty Somvichian, Cooley LLP, San Francisco, California; John Nadolenco, Mayer 4 ZELLMER V. META PLATFORMS, INC.

Brown LLP, Los Angeles, California; for Defendant- Appellee. Roman Martinez and Jeremy L. Brown, Latham & Watkins LLP, Washington, D.C.; Gary Feinerman, Latham & Watkins LLP, Chicago, Illinois; for Amicus Curiae, Security Industry Association.

OPINION

R. NELSON, Circuit Judge:

Clayton Zellmer has never used Facebook. He sued Facebook—now Meta Platforms—for alleged violations of the Illinois Biometrics Information Privacy Act after his friends uploaded photographs of him to Facebook. He alleged that Facebook collected or captured his biometric identifiers when it created what Facebook calls a “face signature” from those uploaded photos. The district court granted summary judgment to Facebook on that claim. Zellmer also alleged that Facebook failed to publish a written policy establishing its retention schedule for collected biometric data. The district court dismissed that claim for lack of standing. We have jurisdiction under 28 U.S.C. § 1291, and we affirm. I A Under the Illinois Biometrics Information Privacy Act (BIPA), a private entity can “collect, capture, purchase, receive through trade, or otherwise obtain a person’s or a

ZELLMER V. META PLATFORMS, INC. 5

customer’s biometric identifier or biometric information” only if it:

• Informs the subject or her representative in writing of the collection or storage of her biometric identifier or information; • Informs the subject or her representative in writing of “the specific purpose and length of term” for their use; and • Receives written authorization to do so from the subject or her representative.

740 ILL. COMP. STAT. 14/15(b) (Section 15(b)). A “biometric identifier” is “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.” Id. 14/10. As potentially relevant, biometric identifiers do not include photographs. Id. For its part, “biometric information” is “any information, regardless of how it is captured, converted, stored, or shared, based on an individual’s biometric identifier used to identify an individual” and “does not include information derived from items or procedures excluded under the definition of biometric identifiers.” Id. Any company that possesses biometric identifiers or information must “develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information.” Id. 14/15(a) (Section 15(a)). The required policy must clarify that any collected biometric identifier or information will be deleted “when the initial purpose” for the collection “has been satisfied or within 3 years of the individual’s last interaction with the private entity, whichever occurs first.” Id. To ensure compliance, 6 ZELLMER V. META PLATFORMS, INC.

BIPA grants a “right of action” against an “offending party” to anyone aggrieved by a violation of its terms. Id. 14/20. B “In 2010, Facebook launched a feature called Tag Suggestions.” Patel v. Facebook, Inc., 932 F.3d 1264, 1268 (9th Cir. 2019). If a user enables Tag Suggestions, Facebook “analyze[s] whether the user’s Facebook friends are in photos uploaded by that user.” Id. If there is a match, then Facebook suggests that the user “tag” his friend. Id. The Tag Suggestions feature proceeds in four steps. The first step is the Detection Stage. Facebook analyzes the photo to determine whether it includes any human faces. If Facebook detects a human face, it produces a cropped image of the face. Nothing more is done at this stage. The next step is the Alignment Stage. Facebook takes any cropped image of a face and standardizes it by centering it, bringing it forward, and scaling it. Facebook is not always successful at standardizing a photo’s detected faces. But if alignment is successful, then Facebook moves to the third step. That step—which is the focus of this appeal—is the Representation Stage. Facebook tries to create what it calls a “face signature.” A face signature is a string of numbers that represents a particular image of a face. Face signatures do not—and cannot—reveal information about a face’s geometric information. And they neither reveal facial features nor the distances between them. They are simply numbers—an abstract, numerical representation of the aligned face crop created in previous stages. No one—not even Facebook—can reverse-engineer the numbers comprising a given face signature to derive information

ZELLMER V. META PLATFORMS, INC. 7

about a person. And even if the reverse-engineering of a face signature were technically possible, face signatures exist for only a tiny fraction of a second—they are neither saved nor stored after the final stage of the Tag Suggestions process. The final step is the Classification Stage, which occurs immediately after a face signature is created. At this point, Facebook compares the face signature to what it calls face templates, which are only created for Facebook users. Facebook does not run the new face signature against every face template it has. Instead, it compares the face signature with the face templates of users who have both enabled face recognition and are connected to the user who uploaded the photo from which Facebook created the face signature. Regardless of whether the comparison yields a match, the face signature is immediately deleted. C After Zellmer’s friends uploaded photos of him to Facebook, he sued Facebook (now Meta, which we use interchangeably) alleging violations of Sections 15(a) and 15(b) of BIPA by collecting, using, and storing biometric identifiers from photos without first obtaining written consent and establishing a public retention schedule. After discovery, the district court granted summary judgment to Meta on Zellmer’s Section 15(b) claim, finding that this statutory section did not protect the privacy interests of non-users. Zellmer v. Facebook, Inc., No. 3:18-CV- 01880-JD, 2022 WL 976981, at *5 (N.D. Cal. Mar. 31, 2022). In the district court’s view, “it would be patently unreasonable to construe BIPA to mean that Facebook was required to provide notice to, and obtain consent from, non- users who were for all practical purposes total strangers to Facebook, and with whom Facebook had no relationship 8 ZELLMER V. META PLATFORMS, INC.

whatsoever.” Id. at *3. The court considered this construction of Section 15(b) “untenable” because it deviated from the Illinois legislature’s intent and would lead to absurd results, such as putting Meta in the “impossible position” of “obtain[ing] consent from every stranger whose face happened to be caught on camera.” Id. at *3–5. And that requirement would require Meta to abandon Tag Suggestions everywhere to avoid violating the law in Illinois. Such a result, the court explained, was impossible to square with the Supreme Court of Illinois’s conclusion that BIPA “should not impose extraordinary burdens on businesses.” Id. at *5; accord id. at *3 (quoting Rosenbach v. Six Flags Ent. Corp., 129 N.E.3d 1197, 1207 (Ill. 2019)). The district court denied Meta summary judgment on the Section 15(a) claim, finding that there is a factual dispute to be resolved at trial. Id. at *5. A few months later, the district court addressed Zellmer’s standing to bring a Section 15(a) claim. Zellmer v. Facebook, Inc., No. 3:18-CV-01880-JD, 2022 WL 16924098 (N.D. Cal. Nov. 14, 2022). It held that Zellmer lacked Article III standing because he did not suffer a particularized injury and dismissed the Section 15(a) claim. Id. at *2–4. II We review “a summary judgment ruling de novo.” Guzman v. Polaris Indus. Inc., 49 F.4th 1308, 1311 (9th Cir. 2022). We review the facts in the light most favorable to the non-moving party. Scott v. Harris, 550 U.S. 372, 380 (2007). “[I]f the nonmoving party contests summary judgment, the alleged factual dispute must be both genuine and material to the nonmoving party’s claims.” Momox- Caselis v. Donohue, 987 F.3d 835, 841 (9th Cir. 2021). But the nonmoving party “may not rest upon mere allegations or

ZELLMER V. META PLATFORMS, INC. 9

denials of his pleading, but must set forth specific facts showing that there is a genuine issue for trial.” Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 256 (1986). “The mere existence of a scintilla of evidence in support of the plaintiff’s position will be insufficient; there must be evidence on which the jury could reasonably find for the plaintiff.” Id. at 252. “The judge’s inquiry, therefore, unavoidably asks whether reasonable jurors could find by a preponderance of the evidence that the plaintiff is entitled to a verdict.” Id. We “may affirm on any ground supported by the record.” Maner v. Dignity Health, 9 F.4th 1114, 1119 (9th Cir. 2021). We likewise review a grant of a motion to dismiss for lack of standing de novo. Wakefield v. ViSalus, Inc., 51 F.4th 1109, 1117 (9th Cir. 2022). In reviewing a ruling on a motion to dismiss, we accept the allegations in the complaint as true. Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009).

III

A We begin by rejecting the grounds on which the district court granted summary judgment to Meta. As we explained above, see supra Part I.C, the district court’s decision turned on the practical impossibility of Meta’s complying with BIPA if it had to obtain consent from everyone whose photo was uploaded to Facebook before it could employ Tag Suggestions. Because the plain text applies to everyone whose biometric identifiers or information is held by Facebook, this conclusion was wrong. To explain why, we look to the statutory text. See Tanzin v. Tanvir, 592 U.S. 43, 46 (2020). Since BIPA is an Illinois statute, we interpret it consistent with how it would be 10 ZELLMER V. META PLATFORMS, INC.

interpreted by Illinois courts. In Illinois, courts “regard the language of the statute as the best indication of legislative intent.” U.S. Fire Ins. Co. v. Barker Car Rental, 132 F.3d 1153, 1156 (7th Cir. 1997) (citing Abrahamson v. Ill. Dep’t of Pro. Regul., 606 N.E.2d 1111, 1118 (Ill. 1992)). “[W]hen the language of the statute is clear, it must be applied as written without resort to aids or tools of interpretation,” DeLuna v. Burciaga, 857 N.E.2d 229, 236 (Ill. 2006), “even though the consequences may be harsh, unjust, absurd or unwise,” Cothron v. White Castle Sys., Inc., 216 N.E.3d 918, 928 (Ill. 2023) (cleaned up). Here, Section 15(b)’s language is clear: “No private entity may collect, capture, purchase, receive through trade, or otherwise obtain a person’s or a customer’s” biometric data without his consent. 740 ILL. COMP. STAT. 14/15(b) (emphasis added). By delineating between persons and customers, BIPA shows that non-users are protected, regardless of any preexisting relationship with the party alleged to have violated BIPA. The only relevant question is whether Meta has collected or captured Zellmer’s biometric data without his consent. If it has, then it has violated BIPA—even if Meta lacks privity with Zellmer. Contrary to the district court’s conclusion, even if it were “patently unreasonable” to provide a cause of action to “total strangers to Facebook, and with whom Facebook had no relationship,” BIPA’s plain terms do just that. Zellmer, 2022 WL 976981, at *3. B Rejecting the district court’s reasons for granting summary judgment, however, does not resolve this case. Having determined that BIPA protects users and non-users alike, we turn to whether there is a material dispute of fact

ZELLMER V. META PLATFORMS, INC. 11

as to whether Meta violated BIPA’s plain terms. On the record before us, there is no dispute that Facebook made a face signature of Zellmer from photos that his friends uploaded. Our question, then, is whether a face signature is either a biometric identifier or biometric information for BIPA purposes. Guided by “the statutory text,” Tanzin, 592 U.S. at 46, we conclude that it is neither. 1 Meta argues that BIPA applies only to biometric identifiers and information that can identify a person. Section 15(b) of BIPA protects not only “biometric information” that identifies an individual, but also “biometric identifiers” themselves. These “identifiers” are defined as “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.” 740 ILL. COMP. STAT. 14/10. In other words, if either form of biometric data cannot identify an individual, it is not an identifier and thus not covered by BIPA. As evidence, Meta cites not only the dictionary definition of “identifiers,”1 but also case law showing that biometric identifiers must be a feature that can identify a person. Zellmer responds that, while biometric information requires the ability to “identify an individual,” biometric identifiers have no such explicit requirement. We join the other courts to have considered this issue and reject Zellmer’s argument.

1 An “identifier” is “one that identifies,” and “identify” means “to ascertain the identity of [something or someone].” Identifier, MERRIAM- WEBSTER ONLINE DICTIONARY, https://www.merriam- webster.com/dictionary/identifier; Identify, MERRIAM-WEBSTER ONLINE DICTIONARY, https://www.merriam- webster.com/dictionary/identify. 12 ZELLMER V. META PLATFORMS, INC.

Zellmer would write the term “identifier” out of BIPA. Under his reading, every “retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry” is a biometric identifier and therefore within BIPA’s reach. 740 ILL. COMP. STAT. 14/10. But this reading conflates necessary and sufficient conditions. The defined term imposes on the ordinary meaning of “biometric identifiers” a set of necessary conditions. Something that falls outside the defined statutory definition (such as a photograph) can be a biometric identifier under the term’s plain meaning, but not be covered by BIPA’s statutory definition. On the other hand, something can otherwise fall within BIPA’s specific list of potential “biometric identifiers,” but still not be covered if it cannot identify. For example, scans of face geometry fall within BIPA’s list, but are not covered by BIPA if they cannot identify a person. To understand why, we look to the Supreme Court’s explanation that “[i]n settling on a fair reading of a statute, it is not unusual to consider the ordinary meaning of a defined term, particularly when there is dissonance between that ordinary meaning and the reach of the definition.” Bond v. United States, 572 U.S. 844, 861 (2014). In Bond, the Court interpreted Congress’s defined term “chemical weapon” against the backdrop of its ordinary meaning. Id. In so doing, the Court concluded that the defendant did not engage in chemical warfare by using a chemical weapon when she “spread [common] chemicals on her car door, mailbox, and door knob” to cause her husband’s mistress to “develop an uncomfortable rash.” Id. at 852. Even though the term “chemical weapon” included “toxic chemicals” such as those used by the defendant, id. at 850, “the global need to prevent chemical warfare does not require the Federal Government to reach into the kitchen cupboard, or to treat a

ZELLMER V. META PLATFORMS, INC. 13

local assault with a chemical irritant as the deployment of a chemical weapon,” id. at 866. The Supreme Court frequently considers the ordinary meaning of a statutorily defined term. In Sackett v. Environmental Protection Agency, the Court “refused to read ‘navigable’ out” of the Clean Water Act, even though it recognized that the statutorily defined term “extends to more than traditional navigable waters.” 598 U.S. 651, 672 (2023). And the Court refused to interpret “violent felony”—statutorily defined as a crime that uses “physical force”—to require less than “force capable of causing physical pain or injury.” Johnson v. United States, 559 U.S. 133, 140 (2010). And it did so despite recognizing that “physical force” was broad enough to “have meant any force, however slight.” Bond, 572 U.S. at 862 (discussing Johnson). Applying that interpretive principle here, we conclude that the ordinary meaning of “identifier”—since it has an -er suffix—is “one that identifies.” We are persuaded that the term’s ordinary meaning informs its statutory meaning. As in Bond, where the statute’s reach was limited by the term’s ordinary meaning despite a statutory definition, applying the ordinary meaning of “identifier” would ensure that Meta is not forced to abandon key services that it offers its customers or risk perpetual liability. As Zellmer recognizes, these are the only two paths forward under his reading of the statute. The list of “biometric identifiers” that the statute lists compels the same conclusion. Each of the listed items— retina or iris scans, fingerprints, voiceprints, or scans of hand or face geometry—are unique to a person. Each can thus be used to identify a person in the proper context. Generally, the words in a list should be given similar meanings. Aguayo 14 ZELLMER V. META PLATFORMS, INC.

v. U.S. Bank, 653 F.3d 912, 927 (9th Cir. 2011). The unifying theme behind each term here is that each identifies a person. Further, as Meta and amicus explain, BIPA’s context supports a conclusion that “biometric identifiers” must identify. “[T]he statute’s language, structure, subject matter, context, and history” are all “factors that typically help courts determine a statute’s objectives and thereby illuminate its text.” Almendarez-Torres v. United States, 523 U.S. 224, 228 (1998). That principle applies with no less force in Illinois, where courts must “read[] the statute as a whole and consider[] all relevant parts.” Sylvester v. Indus. Comm’n, 756 N.E.2d 822, 827 (Ill. 2001). Other statutory definitions thus illuminate BIPA’s reach. Take “biometric information.” As Zellmer recognizes, unlike “biometric identifier,” “biometric information” applies only to information “used to identify an individual.” 740 ILL. COMP. STAT. 14/10. And Section 15(e) requires both identifiers and information to be afforded the protections given to “other confidential and sensitive information,” id. 14/15(e)(2), defined as “personal information that can be used to uniquely identify” a person, id. 14/10 (emphasis added). Both terms thus turn on the ability to identify an individual. Reading the statute “as a whole,” it makes sense to impose a similar requirement on “biometric identifier,” particularly because the ability to identify did not need to be spelled out in that term—it was readily apparent from the use of “identifier.” Sylvester, 756 N.E.2d at 827. Other courts have interpreted BIPA and reached the same conclusion. One such case, Hazlitt v. Apple, 500 F. Supp. 3d 738 (S.D. Ill. 2020), judgment vacated on other

ZELLMER V. META PLATFORMS, INC. 15

grounds sub nom. In re Apple Inc., No. 20-8033, 2021 WL 2451296 (7th Cir. Jan. 22, 2021), is particularly persuasive since it was decided in Illinois on an issue of Illinois law. The Hazlitt plaintiffs alleged that Apple analyzed photographs saved to its Photo app to “specifically identify the Apple device user” and allowed users to tag “names for each of the faces detected in the People album” on the device. Id. at 742. In its motion to dismiss, Apple argued that “these facial scans cannot qualify as biometric identifiers because Apple does not use the scans to actually identify a person.” Id. at 749 (emphasis added). The Hazlitt court rejected Apple’s interpretation as too narrow because “[t]he word ‘identifier’ modifies the word ‘biometric’ to signal that the types of data listed could be used to identify a person.” Id. (emphasis in original). Hazlitt thus recognized that, even if a company does not use face scans to identify a person, BIPA applies if it could. Given that understanding, the Hazlitt court denied the motion to dismiss because the complaint alleged “that the Photos app applies an algorithm to identify the device user,” a fact that the court took “as true, at this stage.” Id. Hazlitt reflects the broad consensus that “biometric identifiers” under BIPA must be able to identify.2 2 Meta’s argument is different from Apple’s in Hazlitt. Rather than arguing—like Apple—that Meta does not use the information it collected to identify anyone, Meta argues

2 See Rivera v. Google Inc., 238 F. Supp. 3d 1088, 1094 (N.D. Ill. 2017) (“Each specific item on the list, not surprisingly, fits within the meaning of the term ‘biometric identifier,’ that is, a biology-based set of measurements (‘biometric’) that can be used to identify a person (‘identifier’).” (emphasis added)); Vance v. Microsoft Corp., 525 F. Supp. 3d 1287, 1296 (W.D. Wash. 2021) (same). 16 ZELLMER V. META PLATFORMS, INC.

that the undisputed evidence shows that face signatures cannot identify non-users. Given our interpretation of “biometric identifiers” and the “biometric information” derived from them, if Meta is correct, then face signatures are not biometric identifiers or information under BIPA. The district court concluded, in a single sentence, that there was a dispute about whether face signatures can identify non- users. Zellmer, 2022 WL 976981, at *5. Having independently reviewed the record and the evidence cited by the parties, we conclude, contrary to the district court, that there is no material dispute of fact about whether face signatures can identify a person. See Maner, 9 F.4th at 1119. We affirm the grant of summary judgment in Meta’s favor on that basis. To support its claim that face signatures are not biometric identifiers, Meta submitted a declaration from Gary McCoy, a Product Manager at Facebook. He explained that a face signature is merely “a string of numbers that represents a particular image of a face.” Those numbers “do not reveal any geometric information about the detected face in the image, nor do they correspond to facial features like the eyes or nose, or distances between them.” Instead, a face signature is “an abstract, numerical representation of a face crop that is computed by millions of pixel comparisons performed by the proprietary algorithm that Facebook has developed,” which “cannot be reverse-engineered” and is neither “saved [n]or stored.” Because the numbers that constitute a face signature cannot be reverse engineered, McCoy explained that “faces of non-users . . . that appear in photos are anonymous to Facebook” and that “it is not possible to identify” non-users from their face signatures. The creation of face signatures “do[es] not create or store any other data from the detected faces of non-users . . . that

ZELLMER V. META PLATFORMS, INC. 17

could be used to recognize or identify them through the use of face recognition.” To dispute the McCoy declaration, Zellmer offers evidence that the face signature can predict a person’s age and gender and that Meta turns on what is called the “recognizable indicator,” which is “associated with a given face,” for face signatures. Finally, he notes that face signatures “include the geometric x and y coordinates within the photo where a person’s face appears, thus calculating the dimensions of the person’s face.” Neither piece of evidence can carry the weight Zellmer affords it. That a face signature can predict a person’s gender limits the pool of potential matches to approximately 50% of the population; this fails to identify anyone. Nor is a person’s age—standing alone or together with his or her gender—able to identify a person. Nor is the gender- identification always accurate: Zellmer himself erroneously matched to a woman from the face signatures that Meta created. As for the recognizable indicator being turned on, this means only that the image can advance to the standardization phase—Meta’s process for determining whether it can create a face signature. Put differently, the recognizable indicator allows Meta only to identify that a particular image contains a face. But this does not mean that Meta can, from that face, identify a person. Nor do the coordinates within the photos that can map out the size of a person’s face show that Meta can, from those coordinates, identify an unknown person. These are the three key facts which Zellmer relied on below. And he points to no new evidence in the record on appeal. None of these facts rebuts Meta’s showing that a face signature, which is all that was ever created for Zellmer, 18 ZELLMER V. META PLATFORMS, INC.

cannot identify him. Zellmer must identify both the evidence that creates a dispute of fact and the reasons why that evidence creates a dispute. See Anderson, 477 U.S. at 256 (nonmoving party “must set forth specific facts showing that there is a genuine issue for trial”). Zellmer has not carried that burden. There is therefore no dispute of fact on this point. And because—on the record before us—face signatures cannot identify, they are not biometric identifiers or biometric information as defined by BIPA.3 Accordingly, summary judgment to Meta was appropriate. IV We also affirm the district court’s dismissal of the Section 15(a) claim for lack of standing. Zellmer alleges that Meta lacks written, publicly available policies identifying its retention schedules for permanently destroying any biometric identifiers or information of non-users like him in its possession. Article III’s “case or controversy” requirement “limits federal courts’ subject matter jurisdiction by requiring, inter alia, that plaintiffs have standing.” Chandler v. State Farm Mut. Auto. Ins., 598 F.3d 1115, 1121 (9th Cir. 2010). A plaintiff must demonstrate standing by establishing the “irreducible constitutional minimum” of (1) an injury in fact (2) fairly traceable to the defendant’s challenged conduct (3) that is likely to be redressed by a favorable decision. Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016) (citation and quotation omitted). A plaintiff shows injury in fact if he has

3 Given this conclusion, we need not decide whether Meta’s creation— and near immediate deletion—of a face signature skirts BIPA’s prohibition on “collect[ing], captur[ing], purchas[ing], receiv[ing] through trade, or otherwise obtain[ing]” a biometric identifier. 740 ILL. COMP. STAT. 14/15(b).

ZELLMER V. META PLATFORMS, INC. 19

“suffered ‘an invasion of a legally protected interest’ that is ‘concrete and particularized’ and ‘actual or imminent, not conjectural or hypothetical.’” Id. at 339 (quoting Lujan v. Defs. of Wildlife, 504 U.S. 555, 560 (1992)). These well-trodden principles compel our conclusion that Zellmer lacks standing to bring his Section 15(a) claim. Because this claim was resolved on a motion to dismiss, we look to the operative complaint. Zellmer alleges a single sentence about Section 15(a): “Facebook does not publicly provide a retention schedule or guidelines for permanently destroying the biometric identifiers and/or biometric information of Plaintiff and the Class members.” But as the Seventh Circuit has concluded, this is a duty owed not to any particular person, but to the “public generally.” Bryant v. Compass Grp. USA, Inc., 958 F.3d 617, 626 (7th Cir. 2020); accord Fox v. Dakkota Integrated Sys., LLC, 980 F.3d 1146, 1154 (7th Cir. 2020).4 Zellmer never explained how he or any of the proposed class members are harmed by violations of this general duty in a “concrete and particularized” way. Nor could he have, given our conclusion that—on the record before us—face signatures are not biometric identifiers or information. As a result, Meta’s creation of face signatures does not lead to the

4 Meta argues that, because the Seventh Circuit “possesses greater familiarity with” Illinois law, its interpretation of BIPA is afforded greater weight. Elk Grove Unified Sch. Dist. v. Newdow, 542 U.S. 1, 16 (2004). “Our custom on questions of state law ordinarily is to defer to the interpretation of the Court of Appeals for the Circuit in which the State is located.” Id. But the “question now before us is whether, for federal-court purposes, . . . a person has suffered the kind of injury-in- fact that supports Article III standing.” Bryant, 958 F.3d at 619. As with all standing questions, we review the district court de novo—guided, as required, by the Seventh Circuit’s interpretation of BIPA. 20 ZELLMER V. META PLATFORMS, INC.

“very substantive harm targeted by BIPA.” Patel, 932 F.3d at 1275. And, as Zellmer concedes, if there is no Section 15(b) violation, he lacks standing to bring a Section 15(a) claim. Because face signatures are neither biometric identifiers nor information, Zellmer is no more harmed by Meta’s failure to have a retention schedule or guidelines related to the destruction of biometric identifiers or information than anyone else in Illinois. Our decision in Patel is not to the contrary. There, we held that BIPA established “concrete interests” in privacy, not merely procedural rights. 932 F.3d at 1274. We then considered whether the violations Patel alleged harmed those concrete interests. Id. We concluded that they did. In so concluding, we explained that plaintiffs alleged that Facebook created a “face template” of them from uploaded photos, the “very substantive harm targeted by BIPA.” Id. at 1275. This violation of Section 15(b) was sufficient to confer Article III standing. And because they had alleged a violation of Section 15(b), they could show direct and discrete harm from the alleged Section 15(a) violation. See id. at 1275–76. Zellmer has not shown that his BIPA data was ever in Meta’s possession or that he has been harmed in a particularized way different from the public generally. Thus, Patel does not resolve the allegations here. V Meta is entitled to summary judgment on the Section 15(b) claim. And Zellmer lacks standing to bring his Section 15(a) claim.

AFFIRMED.