• by Wendy Davis  @wendyndavis, April 4, 2023

Amazon must face a lawsuit alleging it violated an Illinois biometric privacy law by providing services to gaming company Take-Two Interactive, which allegedly invites users to upload photos of their faces in order to create avatars.

In a decision issued late last week, U.S. District Court Judge Tana Lin in the Western District of Washington rejected Amazon's request to dismiss the case before trial.

Lin ruled that if the allegations were proven true, they could show that Amazon and its Amazon Web Services division ran afoul of an Illinois law that regulates the collection and use of biometric data. Among other provisions, that law requires companies to obtain people's written consent before collecting biometric identifiers -- including scans of face geometry.

The ruling comes in a class-action complaint filed in 2021, when Ann Mayhall alleged that her 16-year-old son purchased the XBox One game NBA 2K21, and used Take-Two's “face scan” feature to take photos of his face; those photos were then used to create a custom player with the teen's face, according to the lawsuit.

The complaint alleges that when Mayhall's son, identified only as “D.M.,” created an avatar for use in the game, his Xbox One sent a request to Amazon servers, which retrieved the face-scan data.

Amazon or Amazon Web Services then allegedly used its “computing power and software to collect facial feature vectors” from the face-scan data; those vectors were used to construct his face geometry, according to the complaint.

Amazon argued that even if the allegations were true, its role in the creation of a faceprint would be too limited to warrant a lawsuit.

“Plaintiff alleges that the process of creating D.M.’s avatar involved the collection of his biometric data ... That is false, but even if it were true, plaintiff sued the wrong parties,” Amazon wrote, adding that Take-Two “owns and operates the NBA 2K software and possesses and controls all the data associated with it.”

The company argued that it has no relationship with D.M., and that merely providing cloud computing and storage services shouldn't create liability for alleged violations of the Illinois biometric privacy law.

“Finding otherwise would break new ground in ways with far-reaching and untenable consequences for cloud services providers,” Amazon added.

Lin rejected that argument for now.

“The complaint alleges that defendants use their computing power not only to collect facial features vectors from face-scan data for Take 2 but also to construct a 3D face geometry of the user, which defendants then transmit to the players’ gaming platforms,” the judge wrote. “These allegations more than suffice to infer defendants had control over plaintiff’s biometric data -- and, therefore, possessed the data ... for the purposes of a motion to dismiss.”