Kukovec v. The Estee Lauder Companies, Inc.

UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION MORGAN KUKOVEC, individually and on behalf of all others similarly situated, No. 22 CV 1988 Plaintiff, Judge Manish S. Shah v. THE ESTÉE LAUDER COMPANIES, INC., Defendant. MEMORANDUM OPINION AND ORDER Plaintiff Morgan Kukovec used a makeup try-on tool on the website of Too Faced Cosmetics, which is owned by Estée Lauder. She says the tool collected her facial-geometry data in violation of Illinois’s Biometric Information Privacy Act and she filed this lawsuit. Estée Lauder moves to dismiss the complaint based on lack of personal jurisdiction, the presence of an arbitration agreement on its website, the failure to state a claim on the merits, and the partial lack of Article III standing. The motion is granted in part and denied in part. I. Legal Standards A defendant may move to dismiss an action for lack of subject-matter jurisdiction. Fed. R. Civ. P. 12(b)(1). The plaintiff bears the burden of proving that subject-matter jurisdiction is proper, so she must allege facts sufficient to plausibly suggest that it exists. See Silha v. ACT, Inc., 807 F.3d 169 , 173–74 (7th Cir. 2015). A court lacks subject-matter jurisdiction if a plaintiff doesn’t have standing. See Taylor v. McCament, 875 F.3d 849, 853 (7th Cir. 2017). To establish standing, “a plaintiff must show (1) [she] has suffered an injury in fact that is (a) concrete and particularized and (b) actual or imminent, not conjectural or hypothetical; (2) the injury is fairly traceable to the challenged action of the defendant; and (3) it is likely, as opposed to merely speculative, that the injury will be redressed by a favorable decision.” Silha, 807 F.3d at 173 (quoting Friends of the Earth, Inc. v. Laidlaw Env’t Servs. (TOC), Inc., 528 U.S. 167 , 180–81 (2000)) (quotations omitted). Federal Rule of Civil Procedure 12(b)(2) governs dismissals based on lack of personal jurisdiction. A plaintiff need not include facts alleging personal jurisdiction in the complaint, but once a defendant moves to dismiss for lack of personal jurisdiction, the plaintiff bears the burden of establishing it. See Curry v. Revolution Labs., LLC, 949 F.3d 385, 392 (7th Cir. 2020). At the motion-to-dismiss stage, when a court relies only on the party’s pleadings to decide personal jurisdiction, and doesn’t hold an evidentiary hearing, the plaintiff only needs to make a prima facie case for personal jurisdiction to proceed. uBID, Inc. v. GoDaddy Grp., Inc., 623 F.3d 421, 423 (7th Cir. 2010); Purdue Rsch. Found. v. Sanofi-Synthelabo, S.A., 338 F.3d 773, 782 (7th Cir. 2003). Even though courts resolve all factual disputes in the plaintiff’s favor, courts accept as true all unrefuted facts in the defendant’s declarations or affidavits. GCIU-Employer Ret. Fund v. Goldfarb Corp., 565 F.3d 1018, n.1 (7th Cir. 2009). Accordingly, when a defendant challenges a fact alleged in the plaintiff’s complaint with a sworn statement, the plaintiff has an obligation to go beyond the pleadings and submit affirmative evidence supporting the exercise of jurisdiction. Purdue Research Found., 338 F.3d at 783 . Defendant moves to enforce its forum-selection clause (an agreement to arbitrate) under Federal Rule of Civil Procedure 12(b)(3). That rule governs dismissals based on improper venue. Whether a venue is “improper”, though, “depends exclusively on whether the court in which the case was brought satisfies the requirements of federal venue laws,” and has nothing to do with contractual forum-selection clauses. Atlantic Marine Const. Co., Inc. v. U.S. Dist. Ct., 571 U.S. 49, 55 (2013). Defendant’s 12(b)(3) motion is more appropriately considered as a motion to enforce the arbitration clause, perhaps through the doctrine of forum non conveniens. See Dr. Robert L. Meinders, D.C., Ltd. v. United Healthcare Servs., Inc., 7 F.4th 555, 560 (7th Cir. 2021); see also Brickstructures, Inc. v. Coaster Dynamix, Inc., 952 F.3d 887, 890 (7th Cir. 2020) (substance of motion, not its label, is what counts). The party opposing arbitration bears the burden of identifying a triable issue of fact about the existence of the arbitration agreement. Tinder v. Pinkerton Sec., 305 F.3d 728, 735 (7th Cir. 2002). As in summary judgment, a party cannot avoid compelled arbitration by generally denying facts about an arbitration agreement but must instead “identify specific evidence in the record demonstrating a material factual dispute for trial.” Id. A complaint must contain “a short and plain statement” showing that the complaining party is entitled to relief. Fed. R. Civ. P. 8(a)(2); Ashcroft v. Iqbal, 556 U.S. 662 , 677–78 (2009). To survive a Rule 12(b)(6) motion to dismiss, plaintiff must allege facts that “raise a right to relief above the speculative level.” Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 555 (2007). At this stage, I accept all factual allegations in the complaint as true and draw all reasonable inferences in plaintiff’s favor, disregarding legal conclusions or “threadbare recitals” supported by only “conclusory statements.” See Iqbal, 556 U.S. at 678 . II. Facts Too Faced Cosmetics’s try-on tool allows online shoppers to see how a product looks on them. [1] ¶¶ 19–21.1 A shopper selects a product and a “Try It On” button appears beneath a picture of the product. [1] ¶ 19. When a shopper clicks on the button, a pop-up box appears. [1] ¶ 20. It says, “TRY IT NOW,” “Your image will be used to provide you with the virtual try-on experience and to help with product selection. For information about our privacy practices, please read our Privacy Policy.” [1] ¶¶ 20 (accompanying image). Beneath the text but still inside the pop-up box, there are two buttons. [1] ¶¶ 20 (accompanying image). One for “LIVE CAMERA” and the other for “UPLOAD A PHOTO.” [1] ¶¶ 20 (accompanying image). 1 Bracketed numbers refer to entries on the district court docket. Page numbers are taken from the CM/ECF header placed at the top of filings. TRY ITP NOW Clicking the “LIVE CAMERA” button activates the user’s computer camera automatically. [1] □ 21. The user can then choose one of two display options: overlaying the product on the user’s entire face or overlaying it on half of the face for a split-screen, before-and-after effect. [1] 4 21. From there, the user can download the image or post it to social media. [1] 4 22. Plaintiff, an Illinois resident, used the tool in Illinois to try on various foundations but didn’t end up buying anything. [1] 4 3134, The Biometric Information Privacy Act regulates private entities’ possession and use of biometrics. 740 ILCS 14. Facial-geometry scans are a type of biometric identifier. 740 ILCS 14/10. The act requires entities that possess biometric data to develop a publicly available written policy establishing a retention schedule and guidelines for permanently destroying biometric data. 740 ILCS 14/15(a). It also bars private entities from collecting or capturing a person’s biometric data unless the entity tells the subject that the data is being collected, tells the subject the purpose of collection and how long the data is being stored, and receives written consent from the subject. 740 ILCS 14/15(b). Plaintiff alleges that the virtual try-on tool captures users’ facial geometry and does so without telling the user how that data is collected, used, or retained, in violation of Section 15(b) of the act. [1] ¶¶ 23–24, 27. What’s more, defendant doesn’t make publicly available a written policy establishing a retention schedule and guidelines for permanently destroying consumers’ biometric data, perhaps because (according to plaintiff) defendant hasn’t developed such a written policy in the first place, in violation of Section 15(a) of the act. [1] ¶¶ 28–29. Plaintiff wants to represent a class of people who used the try-on tool not just on the Too Faced website, but also on four other websites associated with Estée Lauder brands. [1] ¶ 41. Defendant removed the case to federal court, asserting diversity jurisdiction and jurisdiction under the Class Action Fairness Act. [1] at 2–5. Defendant now moves to dismiss on four grounds: lack of personal jurisdiction under Federal Rule of Civil Procedure 12(b)(1), improper venue under Rule 12(b)(3) (though really a motion to enforce an arbitration clause), failure to state a claim under Rule 12(b)(6), and lack of standing under Rule 12(b)(1) as to the websites plaintiff didn’t use. [31]. III. Analysis A. Personal Jurisdiction With exceptions not relevant here, personal jurisdiction is governed by the law of the forum state. Fed. R. Civ. P. 4(k)(1). Illinois’s long-arm jurisdiction statute permits the exercise of personal jurisdiction to the full extent allowed by federal due process, so the state statutory and federal constitutional inquiries merge. Tamburo v. Dworkin, 601 F.3d 693, 700 (7th Cir. 2010). Personal jurisdiction comes in the form of general or specific jurisdiction. Ford Motor Co. v. Montana Eighth Judicial Dist. Ct., 141 S. Ct. 1017, 1024 (2021) (citing Goodyear Dunlop Tires Operations, S.A. v. Brown, 564 U. S. 915, 919 (2011)). A court has general jurisdiction only over a defendant who has “continuous and systematic” contacts with the forum state, Helicopteros Nacionales de Colombia, S.A. v. Hall, 466 U.S. 408, 416 (1984), and so is “essentially at home” there, Ford Motor Co., 141 S. Ct. at 1024 . Usually this means that the defendant is incorporated in or has its principal place of business in the forum state. See Daimler AG v. Bauman, 571 U.S. 117, 139 (2014). Plaintiff doesn’t argue that Estée Lauder is subject to general jurisdiction in Illinois, but instead that the company is subject to specific jurisdiction for its suit-related contacts with the state. [35] at 2–4. Specific jurisdiction exists when (1) the defendant has purposefully directed its activities at the forum state or purposefully availed itself of the privilege of conducting business in that state, and (2) the alleged injury “arise[s] out of or relate[s] to the defendant’s contacts” with the forum. See Ford Motor Co., 141 S. Ct. at 1024– 25 (quoting Bristol-Myers Squibb Co. v. Superior Ct., 582 U.S. ----, ----, 137 S. Ct. 1773, 1780 (2017)); Tamburo, 601 F.3d at 702 (citing Burger King Corp. v. Rudzewicz, 471 U.S. 462, 472 (1985)). In other words, when the defendant’s suit-related conduct “create[s] a substantial connection with the forum state.” Walden v. Fiore, 571 U.S. 277, 284 (2014). The exercise of specific jurisdiction must also “comport with traditional notions of fair play and substantial justice as required by the Fourteenth Amendment’s Due Process Clause.” Tamburo, 601 F.3d at 702 (citing Int’l Shoe Co. v. Washington, 326 U.S. 310, 316 (1945)). Defendant argues that there’s no specific jurisdiction here because the try-on tool is “geography neutral.” [31] at 13. It does not target Illinois customers and it operates the same way, regardless of where a customer accesses it. [31] at 13. Plaintiff doesn’t dispute this, nor does she argue that the virtual try-on tool by itself would necessarily establish personal jurisdiction. (It wouldn’t—a defendant can’t be “haled into court simply because [it] owns or operates a website that is accessible in the forum state, even if that site is interactive.” Advanced Tactical Ordnance Sys., LLC v. Real Action Paintball, Inc., 751 F.3d 796, 803 (7th Cir. 2014) (quotations and citation omitted).)2 Plaintiff instead argues that Estée Lauder purposefully avails itself of the state by selling cosmetics in Illinois and employing people there. [35] at 2. It also recruits Illinois-based employees to work as makeup artists, counter managers, sales associates, beauty advisors, and retail managers, among other jobs. [35-1]. Given all that, plaintiff characterizes defendant’s forum-related activities as “the sale of cosmetics.” [35] at 3. The Virtual Try-On tool’s “only purpose” is to sell and market defendant’s products, so the alleged BIPA violations—all of which stem from the 2 Defendant also argues that it’s not subject to jurisdiction in Illinois because the tool isn’t hosted on and doesn’t run on an Estée Lauder server or a server that Estée Lauder controls. [31] at 14. But Estée Lauder “itself set the system up this way,” uBid, Inc., 623 F.3d at 430 , and the tool appears on Estée Lauder’s site. If the try-on tool relates to defendant’s contacts with Illinois, the fact that the tool is hosted on a server somewhere else wouldn’t affect the personal-jurisdiction analysis. tool—are necessarily connected to defendant’s purposeful availment of the Illinois makeup market, plaintiff says. [35] at 3. Defendant responds that whether it sells cosmetics in Illinois, has employees there, or recruits there is irrelevant. [37] at 8. To establish specific jurisdiction, the defendant’s “suit-related conduct must create a substantial connection” with the forum state, and none of the Illinois conduct plaintiff points to is related to this suit. [37] at 8 (quoting Advanced Tactical Ordnance Sys., LLC, 751 F.3d at 801 ). Defendant’s objection to jurisdiction is based on what it sees as a mismatch between the misconduct (implementation of the cosmetics try-on tool) and defendant’s forum contacts (selling cosmetics). But that is an overly narrow reading of Ford’s “arise out of or relate to” standard. 141 S. Ct. at 1026 . The try-on tool is part of Estée Lauder’s cosmetics marketing and sales strategy. That’s why, as plaintiff notes, a customer who pulls up the try-on tool is also presented with “add to cart,” “add to bag,” and “send as a gift” buttons. [35] at 3 (citing [1-1] ¶¶ 19–25 (accompanying screenshots)). Finding personal jurisdiction here doesn’t stray from the holdings in Advanced Tactical and be2 LLC & be2 Holding v. Ivanov, 642 F.3d 555 (7th Cir. 2011). Those cases held that the operation of an interactive website by itself was not enough to confer specific jurisdiction in any state where the website could be accessed. See be2 LLC, 642 F.3d at 558–59; Advanced Tactical, 751 F.3d at 803 (“The interactivity of a website is…a poor proxy for adequate in-state contacts.”). The key difference here is that defendant was using its website (and the virtual try-on tool that appears on it) in order to purposefully avail itself of the Illinois cosmetics market. Nor is plaintiff’s theory so broad as to eliminate the distinction between general and specific jurisdiction. Defendant’s suit-related conduct—its alleged capture of facial geometry through its website—relates to its sale of cosmetics and it purposefully avails itself of Illinois to sell cosmetics; there is a substantial connection (marketing) between the conduct and the forum. Defendant is therefore subject to jurisdiction in Illinois for its use of the try-on tool. B. Arbitration Defendant next argues that plaintiff’s claims are subject to arbitration. [31] at 15–17. To enforce an arbitration clause, I must decide that 1) there is an agreement to arbitrate, 2) the dispute at issue is within the scope of that agreement, and 3) a party refuses to arbitrate. Druco Rests., Inc. v. Steak N Shake Enters., Inc., 765 F.3d 776, 781 (7th Cir. 2014). Under the Federal Arbitration Act, an arbitration agreement must be enforced if the agreement is valid and the claims in the lawsuit are within its scope. 9 U.S.C. § 4 ; see also Lamps Plus, Inc. v. Varela, 139 S. Ct. 1407, 1412 (2019). State contract law governs decisions on the validity and scope of arbitration agreements. Gupta v. Morgan Stanley Smith Barney, LLC, 934 F.3d 705 , 710–11 (7th Cir. 2019). Plaintiff doesn’t contest that the terms and conditions contain an arbitration agreement.3 The only issue is whether she agreed to be bound by those terms and 3 The arbitration provision provides, “ANY DISPUTE RELATING IN ANY WAY TO YOUR USE OF THE SITE OR THESE TERMS AND CONDITIONS…SHALL BE SUBMITTED TO CONFIDENTIAL BINDING ARBITRATION IN NEW YORK AND YOU AGREE TO conditions in the first place. “Formation of a contract requires mutual assent,” and Illinois courts analyze assent using an objective standard. Sgouros v. TransUnion Corp., 817 F.3d 1029, 1034 (7th Cir. 2016).4 In the online context, the formation analysis comprises two questions: “whether the web pages presented to the consumer adequately communicate[d] all the terms and conditions of the agreement, and whether the circumstances support[ed] the assumption that the purchaser receive[d] reasonable notice of those terms,” either via actual knowledge or constructive knowledge. See id. Neither party claims plaintiff had actual knowledge of the agreement, so only constructive knowledge is at issue. The constructive-knowledge inquiry hinges in part on whether the terms and conditions were presented in clickwrap or browsewrap form. See Sgouros v. TransUnion Corp., 2015 WL 507584 , at *4–6 (N.D. Ill. Feb. 5, 2015), aff’d, 817 F.2d 1029 (7th Cir. 2016). Clickwrap agreements require a customer to affirmatively indicate assent by clicking or checking a box. See id.; Van Tassell v. United Mktg. Grp., LLC, 795 F. Supp. 2d 770 , 790–91 (N.D. Ill. 2011). In browsewrap agreements, though, simply continuing to use the website is taken as assent, albeit passive, to the SUBMIT YOURSELF TO THE JURISDICTION AND PROCEEDINGS THEREOF. YOU AGREE THAT YOU MAY BRING CLAIMS AGAINST US ONLY IN YOUR INDIVIDUAL CAPACITY AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS OR REPRESENTATIVE PROCEEDING.” [37-2] at 5–6. 4 Defendant says the contract-formation question is governed by New York law because the terms and conditions contain a New York choice-of-law provision, but notes that the result would be the same under New York or Illinois law because the two are “consistent on all material matters concerning contract formation.” [37] at n.7 (quoting Behrens v. JPMorgan Chase Bank N.A., 2019 WL 1437019 , at n.14 (S.D.N.Y. Mar. 31, 2019)). Given that, I do not conduct a choice-of-law analysis, and as a federal court sitting in diversity jurisdiction apply the law of the forum state (Illinois). See Thomas v. Guardsmark, Inc., 381 F.3d 701, 705 (7th Cir. 2004). site’s terms and conditions. See Sgouros, 2015 WL 507584 , at *4–6; Van Tassell, 795 F. Supp. 2d at 790 . Courts generally find assent in cases with clickwrap agreements but conduct a more detailed inquiry with browsewrap agreements. See Sgouros, 2015 WL 507584 , at *4–6; Van Tassell, 795 F. Supp. 2d at 790 . Too Faced’s terms and conditions appear in browsewrap form on some pages and clickwrap form on others. Plaintiff didn’t access any of the pages with clickwrap agreements, though, so only the browsewrap agreement is at issue.5 That agreement states, [31] at 15–17 (citing [37-3] at 5): By accessing or using the Site, you are acknowledging that you have read, understand, and agree, without limitation or qualification, to be bound by these Terms of Website Use. IF YOU DO NOT AGREE TO THE TERMS OF WEBSITE USE, YOU MAY NOT USE THE SITE. A user can find these terms by clicking on a “Terms and Conditions” link at the bottom of each page of the website. [35] at 6; [37-3] at 3. The link, which sits in the middle of fifteen links to other pages on the site and six links to social media platforms, is shown below. [35] at 6; [37-3] at 3. 5 The clickwrap agreements appear on a number of pages. Someone logging in as a new customer, for instance, must click a box agreeing to the Terms and Conditions. [37-3] at 7. The same is true for a customer on the payment page. [37-3] at 11. And signing in with a preexisting account or proceeding to the checkout page as a guest sometimes requires a customer’s agreement, though only if the customer continues via Facebook. [37-3] at 8, 10. cnn = ey According to defendant, a user can also find the terms-and-conditions page via the pop-up notification that appears when a user pulls up the virtual try-on tool. [37-3] at 13. The pop-up links to Too Faced’s privacy policy and not its terms and conditions, [37-3] at 13, but defendant says that the privacy-policy page itself has a link to the terms-and-conditions page. [37] at 12. Defendant offers no exhibits that show this and the cited part of the complaint, [1] 4 25; 37, doesn’t support this either. At the motion-to-dismiss stage, I disregard this factual allegation from defendant and consider only whether the terms-and-conditions link at the bottom of each page provides constructive notice. This is a “fact-intensive inquiry,” Sgouros, 817 F.3d at 1034—35, that “depends on the design and content” of the website and, specifically, the “conspicuousness and placement” of the terms-and-conditions link. Nguyen v. Barnes & Noble Inc., 763 F.3d 1171, 1177 (9th Cir. 2014); see also Starke v. SquareTrade, Inc., 913 F.3d 279 , 289-— 92 (2d Cir. 2019).6 To determine whether terms and conditions are displayed 6 Because California, New York, and Illinois law assess constructive notice under an objective standard, see n. 4 above, Nguyen and Starke’s analyses are helpful here. See DeLeon v. Verizon Wireless, LLC, 207 Cal. App. 4th 800, 813 (2012) (mutual consent necessary for [13] conspicuously, courts look at a number of factors, including: whether the hyperlink’s font is adequately contrasted by the color of its background; how cluttered the webpage is (i.e., whether other things obscure the relevant link); and whether a page’s entire screen is visible at once, so that users don’t have to scroll to find terms and conditions. Starke, 913 F.3d at 289–94 (comparing the court’s finding of no constructive notice in one case with a finding of constructive notice in another); Hussein v. Coinabul, LLC, 2014 WL 7261240 , at *3 (N.D. Ill. Dec. 19, 2014). Defendant argues that the link here was clear and conspicuous, noting that it is located under a “PRIVACY & TERMS” heading that’s in bold, all caps, and in a contrasting color. [37] at 12. Plaintiff responds that users can’t see the link unless they scroll to the very bottom of the page. [35] at 6 & n.1 (linking to an archived version of the site as it existed in November 2021). What’s more, it’s placed in the middle of fifteen links to other Too Faced pages and six links to Too Faced’s social media sites. [35] at 6. A website design that requires users to scroll all the way to the bottom to even become aware of the site’s terms and conditions, then requires them to click on a buried link to learn the content of those terms and conditions, does not put a user on constructive notice. See Nguyen, 763 F.3d at 1177–78; Soliman v. Subway Franchisee Ad. Fund Tr., Ltd., 999 F.3d 828, 836 (2d Cir. 2021). A user could easily try the tool without once confronting the terms-and-conditions link. formation of a contract “is determined under an objective standard applied to the outward manifestations or expressions of the parties”) (citation omitted); Starke, 913 F.3d at 289 (“objective meeting of the minds”). Even so, defendant says, plaintiff was on constructive notice for another reason: she had recently filed two other BIPA suits—one against TikTok and another against L’Oreal, the latter filed on the same day as this suit. [37] at 14 (citing [37-4] ¶ 91 and [37-5] ¶ 31). She allegedly accessed the TikTok and L’Oreal websites before accessing the Too Faced website. Id. By the time she did, she was an “avid and prodigious Internet app and tool user who…[knew] that websites routinely contain terms of use accessible to users via hyperlinks,” and that those terms of use may contain arbitration and class-action waiver provisions. [37] at 14. Her “attempt to feign ignorance” of these facts should be rejected, defendant says. [37] at 14. The Ninth Circuit addressed a similar argument in Nguyen. There, defendant Barnes & Noble said plaintiff was familiar with browsewrap agreements on other sites, including his own website. But that fact had no bearing on whether plaintiff was on constructive notice about the terms and conditions on Barnes & Noble’s website, the court said. 763 F.3d at 1179 . The same is true here. A user is not automatically on notice that any website she visits likely has terms and conditions just because she’s visited other websites that had them. More importantly, she isn’t on notice about what a site’s terms and conditions say just because other websites had terms and conditions (whose contents she may or may not have read). Because plaintiff adequately disputed the conspicuousness of the terms-and-conditions link, the arbitration clause cannot be enforced against her at this stage of the case. C. Sufficiency of the Allegations Defendant next argues that I should dismiss the complaint because it provides only conclusory legal statements and “naked assertions devoid of further factual enhancement.” [31] at 17 (quoting Iqbal, 556 U.S. at 678 ). Defendant says plaintiff doesn’t adequately allege that the try-on tool captured users’ facial geometry; defendant collected users’ biometric data; and defendant’s conduct was negligent, reckless, or intentional. [31] at 17–19. But plaintiff “present[s] a story that holds together,” Swanson v. Citibank, N.A., 614 F.3d 400, 404 (7th Cir. 2010), and does more than simply parrot the elements of a BIPA claim. Specifically, she explains how the try-on tool works: using facial-geometry scans from a user’s uploaded picture or live camera, the tool “identif[ies] the shape and features of the user’s face in order to accurately overlay the virtual makeup product onto the image provided.” [1] ¶ 23. With that description of the technology, it is reasonable to infer that collection of biometric data is necessary for it to work. And at this stage, the fact that plaintiff’s allegations are made on information and belief isn’t a problem because those facts “are peculiarly within the knowledge of the defendants.” Huon v. Denton, 841 F.3d 733, 743 (7th Cir. 2016) (citation omitted) (“[P]otentially meritorious claims could be prematurely and improperly dismissed if we were to accept [defendant’s] position, since the information necessary to prove or refute allegations like [plaintiff’s] is typically available only to defendants.”). Defendant responds that other cases from this court required plaintiffs to show more than they do here. [37] at 15–16. In four of those cases, though, plaintiffs sued the third-party providers of the data-collection technology at issue—not the companies using the technology. See Heard v. Becton, Dickinson & Co., 440 F. Supp. 3d 960 , 963–64 (N.D. Ill. 2020); Namuwonge v. Kronos, Inc., 418 F. Supp. 3d 279 , 282 (N.D. Ill. 2019); Kloss v. Acuant, Inc., 462 F. Supp. 3d 873 , 877 (N.D. Ill. 2020); Jacobs v. Hanwha Techwin America, Inc., 2021 WL 3172967 , at *2 (N.D. Ill. July 27, 2021). This difference is relevant because the same set of facts may be enough to establish liability of one defendant but not another. The Namuwonge court, for instance, explained that although the complaint didn’t adequately allege BIPA violations by the third party, the same factual allegations would have been enough to allege that plaintiff’s employer impermissibly collected biometric data. 418 F. Supp. 3d at 286. Here, plaintiff has alleged enough to infer that the defendant captured her biometric information and no intermediary separated the defendant from the collection of plaintiff’s facial geometry. Defendant next argues that the cases plaintiff relies on involved complaints that were more detailed. [37] at 16 (citing Neals v. PAR Tech. Corp., 419 F. Supp. 3d 1088 (N.D. Ill. 2018) and Pruitt v. Par-A-Dice Hotel Casino, 2020 WL 5118035 (C.D. Ill. Aug. 31, 2020)). To the contrary, the allegations in Pruitt were skeletal compared to those here. Plaintiffs only alleged that when they went to defendant’s casino, the casino’s video-surveillance cameras captured their facial geometry and then compared it to scans in an internal database. Pruitt, 2020 WL 5118035 , at *1. Those bare facts were enough; at that stage in the litigation, plaintiffs didn’t need to allege “how they knew [d]efendants were conducting facial geometry scans or plead technical details about the devices or software used.” Pruitt, 2020 WL 5118035 , at *3. If the casino defendants weren’t using equipment that collected and stored biometric data—as Estée Lauder claims here, [31] at 18 (“Plaintiff voluntarily ran the tool without Estée Lauder obtaining, possessing, or collecting any biometric data.”)—that fact would come to light in discovery, the court said. Pruitt, 2020 WL 5118035 , at *3. Nor did the complaint in Neals provide more information about defendant’s data collection than plaintiff does here. The complaint merely alleged that defendant, a third-party provider that sold fingerprint scanners to plaintiff’s employer, operated a cloud-based point of sale system that enabled businesses to track their employees’ time with fingerprint scanners, and that plaintiff was required to scan her fingerprints into that system. Neals, 419 F. Supp. 3d at 1090. She didn’t need to “substantiate” her allegations that defendant collected biometric data, as defendant argued. Id. at 1091. She’d presented a “story that [held] together,” and that was enough. Id. So too here. At this stage, it’s enough that plaintiff alleged the use of the try-on tool on defendant’s website, and that defendant possessed and collected biometric data through use of the tool. Still, defendant says, plaintiff hasn’t adequately alleged that defendant acted negligently, recklessly, or intentionally. [31] at 19; [37] at 17. That argument is only relevant to plaintiff’s request for damages. Under the act, plaintiffs are entitled either to actual damages or liquidated damages of $1,000 per negligent violation and $5,000 per reckless or intentional violation, whichever is greater. 740 ILCS 14/20(1), (2). There is no state-of-mind requirement for injunctive relief, though, 740 ILCS 14/20(4), so even if plaintiff failed to adequately allege negligence, recklessness, or intent, she could proceed on her claim. [1] ¶¶ 54–57, 58(e), 66–69, 70(e) (requesting injunctive relief). I agree with defendant that plaintiff hasn’t adequately alleged recklessness or intent. States of mind can be alleged generally, Fed. R. Civ. P. 9(b), but “a plaintiff still must point to details sufficient to render [the] claim plausible.” Pippen v. NBCUniversal Media, LLC, 734 F.3d 610 (7th Cir. 2013). The complaint lacks those details. Plaintiff doesn’t mention defendant’s state of mind until the very end of the complaint, where she requests statutory damages. And no other facts in the complaint point to recklessness or intent—e.g., knowledge of BIPA’s requirements or statements about purposefully not complying with the law. Plaintiff has adequately alleged negligence, though. Under Illinois law, “violation of a statutory standard of care is prima facie evidence of negligence.” Cuyler v. United States, 362 F.3d 949, 952 (7th Cir. 2004). In the context of BIPA, this means that as long as a plaintiff adequately alleges impermissible data possession and collection, she doesn’t need to separately allege negligence. Plaintiff has adequately alleged a negligent violation of Sections 15(a) and (b) of the act and can proceed on that theory. Her claim of intentional and reckless conduct is dismissed, though she may amend her complaint to cure that deficiency if she can allege the requisite detail. See Barry Aviation, Inc. v. Land O’Lakes Mun. Airport Comm’n, 377 F.3d 682, 687 (7th Cir. 2004). D. Standing Finally, defendant argues that because plaintiff only used the Too Faced website, she lacks standing to sue on behalf of users who visited other Estée Lauder sites. [31] at 19-20; [37] at 18-20. A plaintiffs individual claim cannot reach beyond her own injuries, and so in cases involving injuries from purchased products, courts often limit the case or controversy to the products plaintiff bought. See Flaherty v. Clinique Labs. LLC, 2021 WL 5299773 (N.D. Ill. Nov. 15, 2021); Brodsky v. Aldi Inc., 2021 WL 4439304 (N.D. IIL. Sep. 28, 2021); Porter v. NBTY, Inc., 2016 WL 6948379 (N.D. Ill. Nov. 28, 2016); Pearson v. Target Corp., 2012 WL 7761986 (N.D. IIL. Nov. 9, 2012)). But that does not decide the scope of a potential class represented by a plaintiff or the plaintiff's suitability to be a class representative. See Payton v. Cty. of Kane, 308 F.3d 673, 677 , 681—82 (7th Cir. 2002). At this stage of the case, there is no class and I ask only whether I have subject-matter jurisdiction over plaintiffs individual claim. This is not a purchased-product case, and plaintiff alleges an injury from a technology apparently deployed across multiple websites. Her injury is traceable to defendant and can be redressed by a decision in her favor. No more need be said to establish standing. IV. Conclusion The motion to dismiss, [30], is granted in part and denied in part. ENTER: hA SCA Manish 8S. Shah United States District Judge Date: November 7, 2022