MELZER v. JOHNSON & JOHNSON CONSUMER INC.

NOT FOR PUBLICATION UNITED STATES DISTRICT COURT DISTRICT OF NEW JERSEY HELENE MELZER, individually and on behalf of all those similarly situated, Plaintiff, Civil Action No. 22-3149 (MAS) (RLS) y MEMORANDUM OPINION JOHNSON & JOHNSON CONSUMER INC., Defendant. SHIPP, District Judge This matter comes before the Court on Defendant Johnson & Johnson Consumer Inc.’s (“JJCI”) Motion to Dismiss Plaintiff Helene Melzer’s (“Melzer”) First Amended Complaint (the “FAC,” ECF No. 21). (ECF No. 25.) Melzer opposed (ECF No. 30), and JJCI replied (ECF No. 37). The Court has carefully considered the parties’ submissions and decides the matter without oral argument pursuant to Local Civil Rule 78.1. For the reasons stated below, the Court grants in part and denies in part JJCI’s Motion. 1. BACKGROUND! This is a class action case about the privacy concerns that come with the alleged use of biometric information and identifiers. JICI’s Neutrogena Skin360 (“Skin360”) is a technology that provides consumers with “a personalized at-home skin assessment” by scanning a consumer’s face and analyzing the facial scan to diagnose skin health issues, and then recommending a skin care ' For purposes of the instant Motion, the Court accepts all factual allegations in the FAC as true. See Phillips v. County of Allegheny, 515 F.3d 224, 233 (3d Cir. 2008). regimen consisting of Neutrogena products. (FAC ¥ 66.) In creating this assessment, Skin360 requires consumers, like Melzer, to turn on and use their live camera for 180-degree selfie scans. (Id. § 67.) Skin360 deploys the Perfect Corp.’s YouCam technology, which is integrated with the Skin360 application and captures over 200 facial landmark points. id. § 33.) In or around December 2021 or January 2022, Illinois resident Melzer, while located in Illinois, was one such consumer who used the Skin360 application on her mobile device to obtain a personalized at-home skin assessment. (See id. § 66.) Melzer alleges that in creating this assessment, the Skin360 technology scanned, collected, captured, used, and stored in an electronic database digital copies of Melzer’s unique facial geometry. (Id. J 67.) Yet prior to taking these biometric identifiers and/or biometric information (as Melzer puts it), JJ CI did not inform Melzer in any form that her biometrics were being captured, collected, stored, used or disseminated. (/d. 68.) Thus, JJCI neither sought, nor did Melzer ever provide, informed consent relating to the use of her biometrics, and JJCI did not publish any policy specifically about biometric use. (/d.) Importantly, Melzer alleges that this biometric data is tied to individuals’ names, birthdates, and other personally identifying information. (Ud. § 6.) Melzer brings this class action suit on behalf of herself and other Illinois consumers for JICI’s alleged violations of the Illinois Biometric Information Privacy Act (“BIPA”), 740 ILCS 14/1, et seg. Ud. 1-2.) Specifically, Melzer alleges that JJCI violated BIPA in numerous 2 See Neutrogena Skin360 App, https://www.neutrogena.com/skin360app.html (last visited Feb. 1, 2023) (cited at FAC {{ 32). The Court may consider documents “integral to or explicitly relied upon in the complaint” on a motion to dismiss. In re Burlington Coat Factory Sec. Litig., 114 F.3d 1410, 1426 (3d Cir. 1997) (quoting Shaw v, Dig. Equip. Corp., 82 F.3d 1194, 1220 (1st Cir. 1996)). Melzer expressly relies on several Neutrogena websites and uses screenshots from those websites to frame the FAC (see FAC {ff 31-32, 34-35, 38), and this Court may appropriately consider those sources. NJ. Second Amend. Soc’y v. N.J. Press Ass'n, No. 20-5228, 2021 WL 4822050 , at *5 (D.N.J. Oct. 15, 2021) (considering websites cited in complaint on a motion to dismiss). capacities, such as failing to inform Melzer and class members in writing that their biometric information and/or biometric identifiers were being captured, collected, or stored, among other alleged privacy concerns. (/d. 7-9.) Melzer initially filed a Complaint on May 26, 2022 (see ECF No. 1), which JJCI moved to dismiss under Federal Rule of Civil Procedure 12(b)(6).? (ECF No. 17.) Melzer then filed the instant FAC on August 11, 2022. (See generally FAC.) The FAC adds that Skin360’s facial assessments were “unique to an individual and used to identify them.” (Ud. § 37.) The FAC alleges five claims: four violations of BIPA Sections 15(a)-(d) (all contained within Count I), and an unjust enrichment claim premised on the same allegations (Count Il). (See id. Ff 81-101.) Now before the Court is JJCI’s Motion to Dismiss the FAC. (ECF No. 25.) JJCI seeks to dismiss Count I for failure to state a claim under any provision of BIPA—namely, for failure to state any facts permitting a plausible inference that Skin360 collects biometric information that can identify an individual. (See Def.’s Moving Br. 7, ECF No 25-1.) JJCI also contends that Melzer’s Count I claims pursuant to BIPA Sections 15(c) and 15(d) must be dismissed for additional, independent reasons, including, respectively, Melzer’s failure to allege that: (1) JJCI profited from transactions involving biometric data; and (2) that JJCI disseminated biometric data to a third party. (/d. at 2.) JICI moves to dismiss Count II because Melzer’s unjust enrichment claim relies upon her allegedly deficient BIPA allegations. (/d. at 1-2.). JJCI’s Motion to Dismiss is ripe for resolution. IL. LEGAL STANDARD Rule 8(a)(2) “requires only ‘a short and plain statement of the claim showing that the pleader is entitled to relief,’ in order to ‘give the defendant fair notice of what the... claim is and the grounds upon which it rests.” Bell Ail. Corp. v. Twombly, 550 U.S. 544, 555 (2007) (alteration 3 Hereinafter, all references to a “Rule” or “Rules” refer to the Federal Rules of Civil Procedure. in original) (quoting Conley v. Gibson, 355 US. 41, 47 (1957)). A district court conducts a three-part analysis when considering a motion to dismiss pursuant to Rule 12(b)(6). Malleus v. George, 641 F.3d 560, 563 (3d Cir. 2011), as amended (June 6, 2011). “First, the [C]ourt must ‘tak[e] note of the elements a plaintiff must plead to state a claim.’” /d. (alteration in original) (quoting Ashcroft v. Iqbal, 556 U.S. 662, 675 (2009)). Second, the court must accept as true all of a plaintiffs well-pleaded factual allegations and construe the complaint in the light most favorable to the plaintiff. Fowler v. UPMC Shadyside, 578 F.3d 203, 210 (3d Cir. 2009) (citation omitted). In doing so, however, the court is free to ignore legal conclusions or factually unsupported accusations that merely state “the-defendant-unlawfully-harmed-me.” Iqbal, 556 US. at 678 (citing Twombly, 550 U.S. at 555 ). Finally, the court must determine whether “the facts alleged in the complaint are sufficient to show that the plaintiff has a ‘plausible claim for relief.’” Fowler, $78 F.3d at 211 (quoting Iqbal, 556 U.S. at 679 ). A facially plausible claim “allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” 7d. at 210 (quoting Igbal, 556 U.S. at 678 ). “Threadbare recitals of the elements of a cause of action, supported by mere conclusory statements, do not suffice.” Iqbal, 556 U-S. at 678 (citing Twombly, 550 U.S. at 555 ). On a motion to dismiss for failure to state a claim, the “defendant bears the burden of showing that no claim has been presented.” Hedges v. United States, 404 F.3d 744, 750 (3d Cir. 2005) (citing Kehr Packages, Inc. vy. Fidelcor, Inc., 926 F.2d 1406 , 1409 (3d Cir. 1991)). Ill. DISCUSSION As mentioned, Melzer’s claims primarily arise under BIPA, an Illinois state law enacted in 2008 that “regulat[es] the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information.” 740 ILCS 14/5(g). A biometric identifier is particularly sensitive because, unlike a social security number, it cannot be “changed,” which means that “once [it is] compromised, the individual has no recourse.” 740 ILCS 14/5(c). Recognizing this concern and the growing use of biometric technology, Illinois adopted BIPA to protect the privacy of biometric information. See Rosenbach v. Six Flags Entm’t Corp., 129 N.E.3d 1197, 1206 (Il. 2019) (“[O]ur General Assembly has codified that individuals possess a right to privacy in and control over their biometric identifiers and biometric information.”) (citation omitted). Specifically, the FAC alleges violations of Sections 15(b), 15(c), and 15(d) of BIPA. (See generally FAC.) Section 15(b) provides that, in order to collect a person’s biometric information or biometric identifier a private entity must: (1) inform the individual that the data is being collected or stored; (2) inform the individual of the “specific purpose and length of term” for which the data is being collected, stored, and used; and (3) receive a written release from the individual. 740 ILCS 14/15(b). Section (c) prohibits a private entity from selling, leasing, trading, or otherwise profiting from an individual’s biometric data. Id. § 14/15(c). Section 15(d) provides that, in order to disclose or otherwise disseminate an individual’s biometric data, a private entity must obtain the individual’s consent. Id. § 14/15(d). BIPA allows a private right of action by “[a]ny person aggrieved by a violation.” Id. § 14/20. A. Melzer Sufficiently Alleges that JJCI Collects Biometric Identifiers. JICI first contends that Melzer cannot state a claim under BIPA, and, thus, all of Melzer’s claims must fail, because Skin360 does not collect biometric identifiers or biometric information within the meaning of BIPA’s statutory definitions which require that the biometric data collected “be used to identify an individual.” (Def.’s Moving Br. 7.) Because the statutory definition of “biometric information” requires that the information be “used to identify an individual,” 740 ILCS 14/10, JICI posits that the statutory text and structure, legislative purpose, and case law all show that BIPA’s regulation of “biometric identifiers” similarly imposes such a condition. (/d. at 7-8.) And because the FAC only includes barebone allegations that Skin360’s facial scans are “unique to an individual and can be used to identify them,” the FAC is fundamentally deficient. (id. at 12.) Melzer responds, unsurprisingly, that based on existing case law and statutory interpretation, BIPA does not require that a “biometric identifier” be used to identify an individual. (Pl.’s Opp’n Br. 3-11, ECF No 30.) The Court agrees with Melzer. BIPA prohibits private entities from collecting or using “biometric identifier[s]” or “biometric information” without notice and consent. 740 ILCS § 14/15. A “biometric identifier” is “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.” 740 ILCS § 14/10 (emphasis added). “Biometric information” means “any information, regardless of how it is captured, converted, stored, or shared, based on an individual’s biometric identifier used to identify an individual.” Jd. The parties expend much ink on the proper construction of the statute, yet cutting through the analysis with Occam’s razor, the Court finds that the simplest explanation of BIPA is the best one, which is that the plain meaning of “biometric identifiers” under BIPA does not require that they be used to identify an individual. (See Def.’s Moving Br. 8-11; PL’s Opp’n Br. 5-11.) Here, Melzer plausibly alleges, citing to sources including Neutrogena’s own website, that Skin360 takes a scan of its consumers’ facial geometry. (See, e.g., FAC ¥ 35 (“Skin360’s algorithms scan, detect, align, and process a consumer’s facial image at specific coordinates.”); see also FAC ff 31-44.) A commonsense interpretation, as other courts have found, compels a finding that the facial scans captured and collected by Skin360 fall within BIPA’s definition of a “biometric identifier,” which explicitly includes a scan of facial geometry—a term that this Court views as unambiguously clear. See, e.g., Rivera v. Google, Inc., 238 F. Supp. 3d 1088, 1095 (N.D. Ill. 2017) (explaining that a face template is a“scan of . . . face geometry” constituting a biometric identifier); Sosa v. Onfido, Inc., 600 F. Supp. 3d 859 , 871 (N.D. Ill. Apr. 25, 2022) (“[Defendant’s] software scans identification cards and photographs to locate facial images and extracts a unique numerical representation of the shape or geometry of each facial image . . . [-] The faceprints extracted by [defendant] plausibly constitute scans of face geometry and, therefore, ‘biometric identifiers’ under BIPA.”); see also Wilk v. Brainshark, No. 21-4794, 2022 WL 4482842 , at #1, *5 (NLD. ILL Sept. 27, 2022) (rejecting argument that “scan of face geometry” is unclear) (collecting cases). Indeed, several courts have flatly rejected the same argument now raised by JJCI. See, e.g., Hazlitt v. Apple Inc., 500 F. Supp. 3d 738 , 749 (S.D. Ill. 2020), vacated on other grounds, In re Apple Inc., No. 20-8033, 2021 WL 2451296 (7th Cir. Jan. 22, 2021) (rejecting defendant’s argument that “facial scans cannot qualify as biometric identifiers because [defendant] does not use the scans to actually identify a person”), Brainshark, Inc., 9022 WL 4482842 , at *5. And even considering some of the other canons of statutory construction, such as legislative intent, numerous other courts have consistently found that BIPA’s omission of the “used to identify” condition in the “biometric identifier” definition was intentional and thus renders the definition distinct from that of “biometric information.” See e.g., Dana Tank Container, Inc. vy. Human Rights Comm’n, 687 N.E. 2d 102, 104 (Ill. App Ct. 1997) (“Where the legislature uses certain words in one instance and different words in another, it intended different results.”); Vance v. Microsoft Corp., 525 F. Supp. 3d 1287 , 1296 (W.D. Wash. 2021) (refusing to apply the conditions of “biometric information” to the definition of “biometric identifier”); Sosa, 2022 WL 1211506 , at *8 (same); Monroy v. Shutterfly, Inc., No. 16-10984, 2017 WL 4099846 , at *2.5 (N.D. Ill. Sept. 15, 2017) (same). Thus, it is a simple conclusion that BIPA does not require a “biometric identifier” to be used to identify an individual. Even assuming that JJCI is correct in imposing this statutory condition, Melzer’s BIPA claims would still survive the minimal pleading requirements of Rule 8. Melzer explains in detail over several paragraphs how Skin360 extracts and creates a unique identifier in the form of a faceprint. (FAC {ff 30-40.) As Melzer also explains, once a person’s face is scanned and its unique facial geometry is captured, computers can store this information and use it to identify that individual, including any other time that person’s face appears on the internet or in public. (See id. {J 16-17.) Courts have found, in the context of BIPA, that “all [pllaintiffs must do is allege that [d]efendants collected, captured, purchased, received or obtained their [biometric identifier] without complying with BIPA’s requirements.” Roberson v. Maestro Consulting Servs., 507 F. Supp. 3d 998 , 1018 (S.D. Ill. 2020); see also King v. PeopleNet Corp., No. 21-2774, 2021 WL 5006692 , at *8 (N.D. Ill. Oct. 28, 2021) (same). That is exactly what Melzer does here by alleging, for example, that JJCI collects and possesses her biometric identifiers without obtaining informed written consent. (FAC at 8, 15.) The court in Powell v. Shiseido Americas Corp., No. 21-2295, recently denied a similar motion to dismiss, finding plausible the plaintiff's allegations that a virtual make-up tool created a geometric map of the user’s face in a way that amounted to the defendant’s capturing of biometric identifiers under BIPA. (See Powell Order 12, Mendelsohn Decl. Ex. A, ECF No. 30-1 (explaining that “[p]laintiffs allegation that such a map was created through [d]efendant’s website amounts to a plausible allegation that [d]efendant actively captured and/or collected biometric identifiers”).) Notably, the face scan in Powell was powered by Perfect Corp.’s YouCam technology—the same technology that Melzer alleges powers Skin360. (See id.; FAC 4 33.) The Court, thus, denies the motion to dismiss based on JJCI’s arguments as they pertain to definitions under BIPA.* B. Melzer Sufficiently Alleges a BIPA Section 15(c) Claim. JJCI next contends that, in addition to the reasons stated above, Melzer’s BIPA Section 15(c) claim independently fails because Melzer does not sufficiently allege that JJCI sold, leased, traded, or otherwise profited from her alleged biometric identifier or biometric information, as required by this section of the statute. (Def.’s Moving Br. 16.) Melzer responds that she has sufficiently alleged that JICI has profited through sharing her and the class members’ biometric identifiers and information. (P1.’s Opp’n Br. 21.) BIPA Section 15(c) provides that “[n]Jo private entity in possession of a biometric identifier or biometric information may sell, lease, trade, or otherwise profit from a person’s or a customer’s biometric identifier or biometric information.” 740 ILCS 14/15(c). Section 15(c) “does not require a direct sale of biometric data.” Mayhall v. Amazon Web Servs., No. 21-1473, 2022 WL 2718091 , at *12 (W.D. Wash. May 24, 2022) (citation omitted). “Section 15(c) applies to transactions with two components: ‘(1) access to biometric data is shared or given to another; and (2) in return for that access, the entity receives something of value.’” Id. (quoting Vance v. Amazon.com Inc., 534 4 The Court is aware of the supplemental authority——Daichendt v. CVS Pharmacy, Inc., No. 22-3318, 2022 WL 17404488 , at *1 (N.D. Ill. Dec. 2, 2022)—submitted by JJCI, as well as Melzer’s response to it. (ECF Nos. 39, 40.) In Daichendt, the court granted the defendant’s motion to dismiss the plaintiffs’ claim under BIPA Section 15(b) where the plaintiffs did not sufficiently allege that the defendant was capable of using the alleged scan of face geometry to identify the plaintiffs. Daichendt, 2022 WL 17404488 , at *5. Those facts, however, are distinguishable from the ones alleged in this case. In Daichendt, the plaintiffs failed to allege in their complaint that the defendant could determine their identity through defendant’s collection of plaintiffs’ biometric data. (See id.) Here, as mentioned, Melzer has expressly alleged that the biometric identifiers collected by JJCI “can be used to identify” them. (See FAC 37.) Thus, the Court remains unconvinced by JJCI’s argument on this point. F. Supp. 3d 1314, 1321 (W.D. Wash. 2021)). The value received need be only “some sort of gain, whether pecuniary or not.” Jd. (citation omitted). Here, the Court finds that Melzer plausibly alleges a Section 15(c) claim. Melzer alleges, on information and belief, that JJCI commercially disseminates her and the class members’ biometric identifiers and biometric information to JICI’s affiliates and other third parties for its own benefit. (FAC { 61-65.) Supporting this claim, Melzer points to a notice JJCI issued in California, in which JJCI acknowledged that it may have sold such data as defined under California law. (Id. { 62.) At this stage of the litigation, that is enough for Melzer to sustain a Section 15(c) claim. See Mahmood v. Berbix, Inc., No. 22-2456, 2022 WL 3684636 , at *2-3 (N.D. Ill. Aug. 25, 2022) (holding that acknowledgment in a company’s privacy policy that it may disseminate data was sufficient to support an information and belief dissemination claim). As such, the Court denies the Motion to Dismiss as to this point. C. Melzer Sufficiently Alleges that JJCI Disseminated Protected Information. JICI also seeks dismissal of Melzer’s Section 15(d) claim on the additional independent ground that she does not plausibly allege that JJCI disclosed, redisclosed, or otherwise disseminated her alleged biometric data to a third party without her consent. (Def.’s Moving Br. 19.) Melzer responds that she has alleged sufficient facts to support her claim, pointing to her allegations that JJCI disseminates her and class members’ biometric data directly to JJCI’s affiliates and third-party partners. (PI.’s Opp’n Br. 17.) The Court finds that, at this stage of the litigation, Melzer has plausibly alleged facts to support her Section 15(d) claim. Section 15(d) prohibits disclosure of biometric identifiers or biometric information without consent. 740 ILCS § 14/15(d). Here, Melzer alleges, again on snformation and belief, that JICI disseminates her biometric data directly to JJCI affiliates and third-party partners through its use of third-party technology from Perfect Corp., and shares consumer data with its affiliates and third-party providers. (PI.’s Opp’n Br. 17, FAC 33, 61-64, 87.) Melzer further alleges that JJCI acknowledged to its “California consumers that it collected their personal information, including biometric information, and shared it with its affiliates and unidentified partners in transfers that could be considered ‘sales’ under California law during the prior year.” (FAC § 62.) And JICI concedes that “a plaintiff might be able to state a claim based on allegations pleaded only upon information and belief—for example, if ‘the requisite factual information is peculiarly within the defendant’s knowledge or control.’” (Def.’s Moving Br. 20 (citing Verify Smart Corp. v. Bank of Am., N.A., No. 17-4248, 2020 WL 3542430 , at *4 (D.N.J. June 29, 2020)).) The Court finds that what JJCI does or does not do with the biometric identifiers is exactly the type of information “peculiarly within” JJCI’s knowledge or control. Indeed, numerous courts have found that allegations concerning a defendant's use of third-party technology as well as biometric data sharing to affiliates and third-party providers can create a plausible inference of dissemination or disclosure. See, e.g., Cothron v. White Castle Sys. Inc., 467 F. Supp. 3d 604 , 618 (N.D. Ill. 2020) (sustaining a dissemination claim where plaintiff alleged a particular third-party’s known involvement provided a basis to suspect that defendant disseminated the biometric data); see also Heard y. Becton, Dickinson & Co., 440 F. Supp. 3d 960 , 969 (N.D. Ill. 2020) (noting that reports of past dissemination can provide legitimate reason to suspect disclosure). Furthermore, courts have found that a plaintiff plausibly alleges dissemination of protected information without the plaintiff's consent where the defendant has acknowledged potential transfers of data through a notice on its website, as JICI has allegedly done here. See Mahmood, 2022 WL 3684636 , at *3 (holding a defendant's privacy policy notifying individuals that it may share personal data with third parties was sufficient to support an information and belief claim). Thus, at this stage in the litigation, the Court denies the Motion to Dismiss as to this point. D. Melzer Fails to Sufficiently Allege an Unjust Enrichment Claim. Finally, JJCI contends that Melzer has failed to sufficiently allege an unjust enrichment claim. UCI first contends that dismissal is appropriate because this claim “is premised on the same allegations as her BIPA claims,” yet the Court, as discussed above, rejects JICI’s interpretation of BIPA. (See Def.’s Moving Br. 22.) Thus, the Court instead turns to JICI’s secondary argument, which is that Melzer fails to allege the elements of unjust enrichment. (See id.) In order to address the merits of JICI’s argument, the Court must first determine the applicable substantive law. JICI acknowledges that New Jersey and Illinois “define[] the elements of unjust enrichment slightly differently,” yet contends that the “standards are essentially the same,” and, thus, the Court should apply New Jersey law. (Id. (citation omitted).) Melzer responds by identifying a conflict in the pleading requirements: under New Jersey law, a plaintiff must plead actual economic loss to sustain an unjust enrichment claim, and under Illinois law, a plaintiff does not necessarily have to do so. (Pl.’s Opp’n Br. 26.) New Jersey’s choice of law rules follow the Restatement (Second) of Conflict of Laws. See P. V. v. Camp Jaycee, 962 A.2d 453, 460-61 (N.J. 2008). “(T]he first step is to determine whether an actual conflict exists.” Jd. at 460. An “actual conflict” exists when choosing between two states’ laws would be “outcome determinative.” McCarrell v. Hoffmann-La Roche, Inc., 153 A.3d 207, 216 (N.J. 2017) (citing Schmelzle v. ALZA Corp., 561 F. Supp. 2d 1046, 1048 (D. Minn. 2008)); see also Camp Jaycee, 962 A.2d at 460-61 (finding conflict where New Jersey law made charitable organizations immune from most forms of tort liability whereas Pennsylvania law subjected charitable organizations to tort liability). The Court must determine whether a conflict exists “on an issue-by-issue basis.” Rowe v. Hoffmann-La Roche, Inc., 917 A.2d 767, 771 (N.J. 2007) (quotations and citation omitted). “If there is no actual conflict, then the choice-of-law question is inconsequential,” and the Court would apply the law of the forum state—here, New Jersey—“to resolve the disputed issue.” Jd. If a conflict exists, “the Court must determine which state has the most significant relationship to the claim, by weigh[ing] the factors set forth in the Restatement section corresponding to the plaintiffs cause of action.” Arlandson v. Hartz Mountain Corp., 792 F. Supp. 2d 691, 699 (D.N.J. 2011) (alteration in original) (internal quotations and citation omitted). “In an action for a personal injury, the local law of the state where the injury occurred determines the rights and liabilities of the parties, unless, with respect to the particular issue, some other state has a more significant relationship .. . [.]” Restatement (Second) of Conflict of Laws § 146; see Camp Jaycee, 962 A.2d at 460 (“[T}he law of the state of the injury is applicable unless another state has a more significant relationship to the parties and issues.”). Here, the Court makes a preliminary determination that New Jersey law should apply. “Notably[,] . . . this Court is not the first to search for conflicts in unjust enrichment claims between New Jersey and Illinois.” Sharma v. Gupta, No. 20-3446, 2022 WL 970544 , at *5 (D.N.J. Mar. 31, 2022). In Sharma, which is instructive here, the Court concluded that “no real conflict exists,” and that, regardless, the result would be the same. Jd. As this Court sits in New Jersey, the Court, accordingly, will apply New Jersey law to Melzer’s unjust enrichment claim. The Court finds that Melzer fails to sufficiently allege her unjust enrichment claim. Under New Jersey law, “a plaintiff must show both that defendant received a benefit and that retention of that benefit without payment would be unjust and that the plaintiff expected remuneration and the failure to give remuneration unjustly enriched the defendant.” EnviroFin. Grp., LLC v. Env't Barrier Co., 113 A.3d 775, 790 (N.J. Super. Ct. App. Div. 2015) (internal quotations and citation omitted). On its face, the unjust enrichment claim must fail because Melzer did not expect remuneration from JICL Indeed, Melzer did not expect any of her biometric information or identifiers to be used by JICI in the first place, which is why she alleges that this data were taken from her without her consent. (FAC at 8.) In addition, although Melzer alleges that JICI benefited from her alleged biometric data (id. {{ 95-101), she does not sufficiently allege that this purported enrichment caused her to suffer any real loss or damages. Vague references to “heightened risk of privacy and informational harms” and loss of “control over [her] biometric data” (id. J 96) do not suffice under New Jersey law. See In re Am. Med. Collection Agency, Inc. Customer Data Sec. Breach Litig., No. 19-2904, 2021 WL 5937742 , at *18 (D.N.J. Dec. 16, 2021) (holding plaintiff failed to state a claim for unjust enrichment where “beyond vague allegations that [djefendants collected information for ‘commercial gain,’ the [complaint] contain[s] no facts showing how [djefendants reaped monetary benefits or otherwise profited from [p]laintiffs’ [pJersonal [ilnformation”) (citations omitted); see also Mount v. PulsePoint, Inc., 684 F. App’x 32, 36 (2d Cir. 2017) (finding no conflict between New Jersey and New York law with respect to unjust enrichment and that “plaintiffs” failure to allege specific loss or deprivation of opportunity to profit from [personal] information warranted dismissal of their [unjust enrichment] claim”). The result would be the same even if the Court were to apply Illinois law, which requires that “a plaintiff must show a detriment, and a connection between that detriment and the defendant’s retention of a benefit.” Hogan v. Amazon.com, Inc., No. 21-3169, 2022 WL 952763 , at *7-8 (N.D. Ill. Mar. 30, 2022) (citing Cleary v. Philip Morris Inc., 656 F.3d 511, 518 (7th Cir. 2011)) (dismissing unjust enrichment claim where “alleged detriment is [defendant’s] violation of BIPA”). On the facts before it, the Court finds that the FAC fails to sufficiently allege that the retention of Melzer’s data “specifically enriched” JICI. See id. Because Melzer fails to sufficiently allege the elements of her unjust enrichment claim, the Court, accordingly, dismisses it. IV. CONCLUSION For the foregoing reasons, the Court grants in part and denies in part JICI’s Motion to Dismiss. The Court will enter an order consistent with this Memorandum Opinion. /s/ Michael A. Shipp MICHAEL A. SHIPP UNITED STATES DISTRICT JUDGE