Amazon must face a lawsuit alleging it violated an Illinois biometric privacy law by providing services to gaming company Take-Two Interactive, which allegedly invites users to upload photos of
their faces in order to create avatars.
In a decision issued late last week, U.S. District Court Judge Tana Lin in the Western District of Washington rejected Amazon's request to dismiss the
case before trial.
Lin ruled that if the allegations were proven true, they could show that Amazon and its Amazon Web Services division ran afoul of an Illinois law that regulates the
collection and use of biometric data. Among other provisions, that law requires companies to obtain people's written consent before collecting biometric identifiers -- including scans of face
geometry.
The ruling comes in a class-action complaint filed in 2021, when Ann Mayhall alleged that her 16-year-old son purchased the XBox One game NBA 2K21, and used Take-Two's “face
scan” feature to take photos of his face; those photos were then used to create a custom player with the teen's face, according to the lawsuit.
The complaint alleges that when Mayhall's
son, identified only as “D.M.,” created an avatar for use in the game, his Xbox One sent a request to Amazon servers, which retrieved the face-scan data.
Amazon or Amazon Web
Services then allegedly used its “computing power and software to collect facial feature vectors” from the face-scan data; those vectors were used to construct his face geometry, according
to the complaint.
Amazon argued that even if the allegations were true, its role in the creation of a faceprint would be too limited to warrant a lawsuit.
“Plaintiff alleges that
the process of creating D.M.’s avatar involved the collection of his biometric data ... That is false, but even if it were true, plaintiff sued the wrong parties,” Amazon wrote, adding
that Take-Two “owns and operates the NBA 2K software and possesses and controls all the data associated with it.”
The company argued that it has no relationship with D.M., and that
merely providing cloud computing and storage services shouldn't create liability for alleged violations of the Illinois biometric privacy law.
“Finding otherwise would break new ground
in ways with far-reaching and untenable consequences for cloud services providers,” Amazon added.
Lin rejected that argument for now.
“The complaint alleges that defendants
use their computing power not only to collect facial features vectors from face-scan data for Take 2 but also to construct a 3D face geometry of the user, which defendants then transmit to the
players’ gaming platforms,” the judge wrote. “These allegations more than suffice to infer defendants had control over plaintiff’s biometric data -- and, therefore, possessed
the data ... for the purposes of a motion to dismiss.”