• by Wendy Davis  @wendyndavis, May 30, 2024

A federal judge this week recommended against dismissing a lawsuit accusing Amazon of violating an Illinois biometric privacy law by providing cloud services to gaming company Take-Two Interactive, which allegedly invites users to upload photos of their faces in order to create avatars.

In a report issued Wednesday, U.S. Magistrate Judge Michelle Peterson in Seattle effectively said if the allegations against Amazon were proven true, they could support a finding that the company ran afoul of the Illinois Biometric Information Privacy Act, which regulates the collection and use of biometric data. Among other provisions, that law requires businesses to obtain people's written consent before collecting biometric identifiers -- including scans of face geometry.

Peterson's recommendation hasn't yet been accepted by U.S. District Court Judge Rita Lin, who is presiding over the litigation.

The new recommendation comes in a class-action complaint initially filed in 2021, when Illinois resident Ann Mayhall alleged that her 16-year-old son purchased the XBox One game NBA 2K21, and used Take-Two's “face scan” feature to take photos of his face. Those photos were then used to create a custom player with the teen's face, according to the lawsuit.

That complaint included an allegation that Amazon or its cloud computing division, Amazon Web Services, retrieved the face-scan data from Take-Two's server and converted it into a “face geometry” of the user.

Last year, Lin said Mayhall could proceed with that complaint. Several months later Mayhall's son -- by then, 18 -- filed an amended complaint under his own name, Dominic Mayhall.

The publicly available version of that amended lawsuit contains significant portions of blacked-out text, but Peterson elaborated on some of those details in her recommendation and report.

Unlike the original complaint, the amended lawsuit doesn't allege that Amazon was involved in extracting gamers' “face geometry,” according to Peterson's report.

Instead, Mayhall alleged in the amended complaint that Amazon violated the Illinois law by obtaining users' face geometry from Take-Two, transmitting the material through servers, and delivering it to online multiplayer game sessions, Peterson wrote.

Amazon urged Peterson to recommend dismissal of the complaint, arguing that even if the allegations were proven true, they wouldn't show that the company actually possessed gamers' biometric data. The company additionally argued that the Illinois law doesn't apply to passive cloud services providers.

Peterson rejected those contentions, writing Mayhall alleged that Amazon and Amazon Web Services “knowingly obtained users’ face geometry data from Take-Two and that it remains in their control as they disseminate and store it on their servers.”

She added: “Thus, plaintiff has at least plausibly alleged possession of biometric data, even without the previously asserted allegation that Amazon extracted plaintiff’s face geometry.”

Amazon has until June 13 to object to that recommendation.