A federal judge in Washington state last Friday refused to dismiss a lawsuit brought by the mother of a 16-year-old boy against Amazon for storing and sharing his 3D face geometry for use in the popular video game series, NBA 2K.
The case is brought by Ann Mayhall of Illinois and centers on NBA 2K’s publisher, Take-Two Interactive, enabling video game players to elect a “Scan Your Face” feature on a Take-Two app. The feature uses a mobile device’s camera to take 13 different photographs of a gamer’s face then compresses and uploads the photos, enabling faces to appear in the game as customized players.
Take-Two is not alleged to have engaged in any wrongdoing. The purported roles played by Amazon (and its cloud-computing subsidiary, Amazon Web Services or AWS) in collecting facial features to construct a 3D face geometry and transmitting it to gaming platforms are instead at issue.
As told in Mayhall’s complaint, Amazon retrieves face-scan data from a Take-Two server and “converts” that data “into a face geometry of the user on the AWS and/or Amazon servers, using AWS and/or Amazon computing power.”
This geometry is precise enough that it “can be used to identify the person.” Amazon also allegedly stores the face data on its own server.
Amazon, Mayhall argues, has violated Illinois’s Biometric Information Privacy Act (BIPA). The act regulates the collection, storing and sharing of “biometric identifiers,” a term that includes face geometry scans and more broadly refers to data that distinguishes human beings. Mayhall says Amazon failed to (1) inform her or her son about its use of biometric identifiers; (2) create a retention policy and (3) permanently delete his biometric identifiers—all alleged BIPA and privacy violations. Mayhall wants the case to become certified as a class action on behalf of others who use the game’s Scan Your Face technology.
Amazon has aggressively rebutted the allegations, stressing in court documents that Mayhall’s son “voluntarily took pictures of his face” and “affirmatively consented to insert an avatar created using those photos onto a player in the game.”
The company further contends that Mayhall has “incorrectly sued” Amazon and AWS. These are “two companies that never interacted with [the son],” Amazon says. Amazon depicts itself as merely providing “computing and storage services” to Take-Two and thus it “did not commit or control” the data use problems Mayhall describes.
In denying Amazon’s motion to dismiss, federal judge Tana Lin took issue with Amazon “trying to portray” itself as “simply offering cloud storage services when biometric data is merely” on servers. It could be inferred, the judge reasoned, that Amazon “had control” over the face data and that Take-Two relied on Amazon’s computing power to construct face geometry and transmit it to gaming platforms.
As Judge Lin sees it, some of the “facts” establish Amazon “did not merely passively store information, but actively possessed it.” She added that Mayhall’s son “could not consent, as a minor.”
Amazon can still win the case as more evidence is introduced, but its attempt for an early dismissal has come up short.
