[co-author: Stephanie Kozol]*
Introduction
On Thursday, March 20, a federal judge in the Northern District of Illinois granted final approval to a settlement agreement under which Clearview AI (Clearview) agreed to pay an estimated $51.75 million to a nationwide class if one of several contingencies takes place. This approved settlement agreement resolves In Re: Clearview AI, Inc. Consumer Privacy Litigation, No. 1:21-cv-00135 (N.D. Ill.), a multidistrict suit alleging that the company’s automatic collection, storage, and use of biometric data violated various privacy laws, including Illinois’ Biometric Information Privacy Act (BIPA). The unorthodox settlement not only preserves Clearview’s business model, but may also insulate Clearview from subsequent or parallel regulatory investigations without requiring the company to jeopardize the liquidity necessary for continued growth. Ultimately, this settlement seems to represent a good outcome for the company, especially in light of the fact that that it was achieved over the objections from 23 state attorneys general (AG). U.S. District Judge Sharon Johnson Coleman stated that the settlement is fair, reasonable, and adequate.
Clearview develops facial recognition software used primarily by law enforcement and retail to identify individuals who have purportedly committed a crime (or to exonerate individuals wrongly accused of a crime). This software has been the subject of controversy due to its ability to identify any individual using a database of publicly available images scraped from the internet, which could be considered — according to some advocates — a privacy violation. The New York Times published an article in January 2020 explaining how law enforcement and private companies use Clearview’s services. After the article was published, concerned consumers filed numerous lawsuits against Clearview. These lawsuits alleged various violations of state privacy laws, including BIPA. Eleven of these pending actions were consolidated into a multidistrict litigation (MDL) in order to streamline the proceedings. At the same time, the American Civil Liberties Union (ACLU) filed a complaint against Clearview in Illinois State Court, seeking injunctive relief under BIPA.
BIPA
The class action complaint alleged that Clearview violated numerous consumer privacy laws, including: (1) BIPA; (2) Virginia statutes prohibiting the unauthorized use of a person’s name or image and the Virginia Computer Crimes Act; (3) California’s Unfair Competition Law, California’s Commercial Misappropriation statute, California common law, and California state constitution protections against invasion of privacy; (4) New York’s protections against invasion of privacy; and (5) declaratory relief under the federal Declaratory Judgment Act.
Seven of the complaint’s 16 causes of action arise under Illinois’ BIPA. Enacted in 2008, BIPA regulates the collection, storage, and distribution of biometric information in response to the growing trend of businesses utilizing biometric data for various purposes. BIPA imposes a range of requirements before a company can lawfully collect, retain, sell, and/or disclose biometric information, including the obligation to obtain an individual’s affirmative consent. For example, 740 ILCS 14/15(b) requires the written consent of the individual before collecting biometric data; 740 ILCS 14/15(c) prohibits the sale or profiting off of consumer biometric data; 740 ILCS 14/15(d) prohibits the disclosure or redisclosure of biometric data except in limited circumstances; and 740 ILCS 14/15(e) requires companies to store biometric data using a reasonable standard of care.
BIPA also includes a private right of action which allows individuals to recover $1,000 or actual damages for each negligent violation and up to $5,000 or actual damages for intentional or reckless violation, plus reasonable attorneys’ fees and costs, and injunctive relief (if appropriate). A violation of BIPA results in per se liability for the company even if a consumer cannot demonstrate actual damages, leading to significant settlements for what the industry perceives as a process violation.
The Clearview Settlement
This settlement agreement is rather unprecedented, likely due to the nature of Clearview’s business. The lawsuit concerns Clearview’s “collection, storage, and use of biometric data,” defined as data that may lead to the “automated recognition of individuals based on their biological and behavioral characteristics” such as fingerprints, voiceprints, or other physical features. The specific privacy concern is that compromised biometric data, unlike a Social Security number or credit card account number, cannot be reissued if such data falls into the hands of a bad actor.
Clearview’s founders identified a market for facial recognition software. In 2017, they developed a proprietary tool to “scrape” publicly accessible websites for photographs, indexing biometric facial geometry into a database. Clearview then sold access to the database to law enforcement agencies and private corporations. Users upload a photo of the individual they wish to identify to Clearview’s platform, which then compares facial recognition biomarkers with the photographs in the database to identify the individual.
Clearview’s database includes as many as 50 billion images which it scraped from the web, meaning that the potential class of litigants includes “virtually any individual whose face had been posted on the internet prior to and during the period of Clearview’s operation.” With such a broad class, statutory penalties and costs of litigation under BIPA alone could potentially bankrupt Clearview entirely, leaving the putative class without any monetary relief. Plaintiffs and defendants recognized this possibility and decided to pursue alternative dispute resolution before having the case sent to trial.
The parties engaged in several rounds of mediation, ultimately concluding that the only way the class could receive adequate relief and avoid Clearview’s bankruptcy would be for Clearview to provide the class with “a meaningful equity stake” in the company. After six months of negotiating, the parties agreed that the class would receive a 23% equity stake in Clearview, which as of January 2024 was worth approximately $51.75 million. The 23% stake in the company was carefully tailored to satisfy several objectives. If the equity percentage were too high, investors would avoid investing in Clearview moving forward, thereby hindering the company’s continued growth. If the percentage were too low, the class members (settlement class) would not receive sufficient relief. Additionally, the 23% interest held by the settlement class is insufficient to influence the company’s ethical considerations or alter the fundamental nature of its business operations by shareholder vote.
The settlement fund will be paid out upon the triggering of one of four events: “(1) the occurrence of an IPO [initial public offering]; (2) the occurrence of a liquidation event, such as a merger or consolidation or sale of all or substantially all of Clearview’s assets; (3) a payment by Clearview of an amount equal to 17% of Clearview’s GAAP recognized revenue for the period commencing on the date of final settlement approval and ending with the election of this option, which expires on September 30, 2027; or (4) the amount the Settlement Class will receive if it elects to sell its right to receive the Settlement Stake payment.” The settlement class may choose whichever right to relief it believes is most advantageous as future events unfold. Attorneys’ fees will be paid out at 39.1% of the liquidated equity if or when the liquidation occurs.
Objections
State AGs from 22 states and the District of Columbia AG (amici states) objected to the settlement using their authority under the Class Action Fairness Act (CAFA), which requires class plaintiffs to notify state AGs of a proposed settlement, thus enabling the state AGs to review the terms and raise any concerns if they believe the settlement might negatively impact their constituents. The state AGs objected on several grounds, purportedly in an effort to protect their constituents, but possibly also to preserve their own options for investigations, enforcement actions, or litigation against Clearview in the future.
Characterized by the court as “the most common objection brought by the… Amici States,” the states objected to the lack of injunctive relief in “the form of a nationwide injunction or a California-specific injunction preventing Clearview from future operations.” Judge Coleman quickly disposed of this argument, stating that “the wishes of the objectors at settlement must be balanced against the realities of the case during litigation.” The lawsuit was based on a patchwork of state biometric data privacy protection statutes, and the “novel and untested nature” of the California, Virginia, New York, and federal law claims meant that wide-spanning injunctive relief that the objectors sought would not be appropriate — even if the case were litigated to a final judgment. While BIPA provides a basis for injunctive relief in this situation, the injunctive provisions of BIPA are not “expressly intend[ed] to operate extraterritorially such that it could be used as the basis for nationwide or state-specific injunctive relief.”
In addition, the court pointed to Clearview’s settlement with the ACLU in Illinois, under which agreement Clearview agreed to a permanent nationwide injunction prohibiting Clearview from offering access to the Clearview app by any entity other than a local, state, or federal law enforcement agency acting in its official capacity. The settlement also barred Clearview from granting access to Illinois local and state agencies (and their contractors and/or employees) and any other private entities (even if permitted under BIPA) in Illinois for a period of five years. The court found that the “expansive reach and scope of the ACLU settlement” with Clearview meant that any further injunctive relief would not be effective to meaningfully change the position of the settlement class.
The amici states also objected to the fairness of the settlement on the basis that relief is provided through an indeterminate equity stake in Clearview, rather than a direct payment to the settlement class. Specifically, the amici states objected to the fact that the settlement class does not know “the true valuation of Clearview and whether there will be any monetary payment to class members at all.” In response, Judge Coleman stated that this method of payment is required given the contours of the case, emphasizing that providing equity to satisfy a financial obligation in settlement is not a new concept to the law. While this is the first time a BIPA settlement has included equity-based monetary relief, she plainly stated that “necessity is the mother of invention.” Clearview’s optimism regarding its potential growth led the judge to hold that the equity stake is significant enough to provide adequate relief. As further security to the settlement class, the court will administer the equity stake by overseeing the fund and acting on behalf of the settlement class.
The state AGs also objected to the policy underlying the settlement, stating that this agreement leaves unresolved the question of “whether the collection of publicly available biometric information for use by private or government entities — even when done in accordance with the law — is reconcilable with constitutional privacy rights.” The amici states argued that the settlement “has severe flaws that undermine consumers’ fundamental right to privacy,” and that the amount of the settlement is not enough to deter Clearview’s business practices. While Judge Coleman acknowledged that the use of biometric information presents certain dangers to consumers, she stated that the action before her did not permit her to determine “whether Clearview’s past, present, or future conduct is fundamentally violative of the privacy rights provided by the federal Constitution or state constitutions;” rather, all she could decide was the fairness, reasonableness, and adequacy of the settlement agreement. Deciding whether Clearview’s practices should be allowed would exceed the scope of Judge Coleman’s duties, violating the separation of powers doctrine.
On April 25, only five weeks after Judge Coleman approved the settlement over the AGs’ objections, Vermont re-filed its lawsuit against Clearview AI in Vermont state court. This should come as no surprise because Vermont has been one of the more outspoken opponents to Clearview AI and was counsel of record for the AG amici brief opposing the settlement. The lawsuit alleges violations of the Vermont Consumer Protection Act based primarily upon Clearview AI’s alleged use of biometric data without the knowledge or consent of Vermont citizens. Vermont AG Charity Clark is seeking remedies, including but not limited to, a declaration that Clearview AI violated the Vermont Consumer Protection Act; permanent injunctions against most of Clearview AI’s business practices as they relate to Vermonters; civil penalties, restitution and disgorgement, and costs. Vermont’s lawsuit threatens to effectively preclude Clearview AI from operating within the state. Clearview AI’s business model will be tested if other states follow Vermont’s lead and file suit in their own right. Given that monetary relief to class members is contingent upon Clearview AI’s continued success, it will be interesting to observe how states like Vermont use their power to pursue policy and political objectives while doing what they perceive to be best for their constituents.
Takeaway
Through the settlement, Clearview achieved a realignment of interests that will insulate it from regulatory and litigation risk during a critical time in the company’s lifecycle. Specifically, by providing equity in Clearview to the nationwide class of litigants, Clearview aligned the success of its adversaries with its own. The class litigants’ recovery under the settlement terms is directly linked to the success of Clearview’s business model. Consequently, it is now in the plaintiffs’ and their lawyers’ interests for local, state, and federal government law enforcement agencies to increase their adoption of Clearview’s product, thereby enhancing the plaintiffs’ equity position. Essentially, the value of the plaintiffs’ position increases as the government’s use of Clearview’s product, which allegedly initiated the lawsuit, expands.
The structure of the settlement also impedes the state AGs’ regulatory oversight and investigative abilities because any enforcement action by a multistate coalition that results in a significant geographic injunction could materially devalue the plaintiffs’ anticipated monetary relief. For example, if the 22 state AGs who objected to the settlement banded together, they could severely restrict, if not entirely shut down, Clearview’s business — at least within their jurisdictions. Doing so, however, would dilute the class plaintiffs’ potential recovery, which would lead to additional legal challenges. Additionally, state AGs may face a challenge if they condemn Clearview while a growing number of government entities in their jurisdictions subscribe to the Clearview product. In other words, regulators do not have a simple path forward to investigate or bring claims against Clearview in the future.
Finally, companies must understand that even though data and images are publicly available, subsequent actions by those companies may implicate the privacy rights of individuals under state and federal law. In this instance, the billions of photographs in question are essentially de-identified and relatively useless data scraped at random from the web. However, Clearview’s algorithm gives those random images context they otherwise lack, effectively re-identifying them with unique individuals, including their associations with other people and places. Importantly, this is done without consent. Litigants and regulators have speculated about and feared the re-identification of otherwise de-identified data for years, which places a regulatory target on the backs of companies who engage in such behaviors.
*Senior Government Relations Manager
