Ill. Right to Publicity Class Actions May Extend Cos.' Liability
Businesses that obtain or use consumer data should be aware of a new trend in class action litigation.
Plaintiffs are increasingly filing class actions under the Illinois Right to Publicity Act[1] based on a novel theory: Companies that sell access to searchable online consumer databases are engaged in commercial use of an individual's identity under the IRPA.
Generally, businesses violate the IRPA when they use the name, likeness, distinctive voice, style, role, nickname or signature of an individual without his or her consent in advertisements or for other commercial purposes, such as using a person's picture on product packaging and using a person's image to falsely imply endorsement of a product.
However, recent class actions in Illinois seek to expand liability under the IRPA based on a less conventional understanding of identity.
Overview of the IRPA
When the IRPA became effective Jan. 1, 1999, it replaced the common law tort of appropriation of likeness.
The IRPA, which only applies to Illinois residents, prohibits the use of a person's identity for commercial purposes without previous written consent. The IRPA defines "identity" as any attribute of an individual that serves to identify him or her, including but not limited to the individual's name, signature, photograph, image, likeness or voice. "Commercial purpose" is defined as the:
The IRPA provides a private right of action and does not require plaintiffs to prove any actual damages. Under the IRPA, the rights of the individual are property rights. The consequences of violating the IRPA can be great. At minimum, a business that violates the IRPA is liable for $1,000 in fixed statutory damages even if the plaintiff did not suffer any actual harm.
Alternatively, a plaintiff can recover his or her actual damages plus the profits derived from an unauthorized use of his or her identity. Additionally, a court may award punitive damages for willful violations of the IRPA, as well as the prevailing party's attorney fees and costs.
Theory of New Cases
Recent class actions are expanding the conventional understanding of the IRPA's private right of action. Plaintiffs are using the IRPA to target companies that sell access to online databases or subscriber lists that provide individual names, phone numbers, email addresses, backgrounds and similar information. The plaintiffs' theory is that selling consumer lists is a commercial use of an individual's identity, which requires the consumer's written consent.
The same logic applies when someone searches a database and the search returns a small amount of information with an offer to gain access to more by making a purchase. The plaintiffs' argument is that their identity is being used to sell the consumer list, which is the product being advertised, because their name and address is tied to the consumer list.
For example, two class actions filed this year, Huston v. Hearst Communications Inc.[2] in the U.S. District Court for the Central District of Illinois and Duda v. Meredith Corp.[3] in the U.S. District Court for the Northern District of Illinois, allege that the defendants violated the IRPA by offering to sell mailing lists that identified the plaintiffs and other subscribers to magazine publications by name, address and other personal attributes, such as gender, age, ethnicity, income, political party, religion, charitable donation history and the title of the publication to which they subscribed.
Shortly after these new lawsuits were filed, similar class actions, Anderson v. Hearst,[4] Hicks v. Hearst[5] and Ramirez v. Hearst,[6] were filed this year in the U.S. District Court for the Southern District of New York. In addition, Burke v. Meredith[7] and Hetzel v. Meredith[8] were filed in the U.S. District Court for the Southern District of Iowa. The cases were filed under Alabama's, California's, Ohio's and Puerto Rico's right of publicity laws.[9]
The plaintiffs in these class actions based their lawsuits on the same theory used by the plaintiffs in IRPA class actions: that selling consumer lists is a commercial use of an individual's identity, which requires the consumer's written consent. Alabama's, California's, Ohio's and Puerto Rico's right of publicity laws are similar to the IRPA in that they each also provide plaintiffs with a private right of action and fixed statutory damages even if the plaintiff did not suffer any actual harm.
These new suits have some similarities with IRPA lawsuits filed in previous years against background search engines and data aggregators. Those suits generally failed because the plaintiffs could not prove that the defendant search engines actually disclosed any of the plaintiffs' information to a third party.
However, those cases differ significantly from the theory posited in the recent class actions. In those suits, in order to access the individual's personal information, a business would first have to enter that person's name into a search bar to get additional information, such as the individual's name, age, cities, relatives, etc.
In contrast, the new IRPA class actions are the first of their kind because they are based on subscriber lists provided to third parties, not searchable databases.
Similarities to Expansions in BIPA
The efforts to expand the IRPA mirror successful efforts to expand Illinois' Biometric Information Privacy Act.[10] BIPA, passed in 2008, prevents the unlawful collection and storing of biometric information. Like the IRPA, BIPA provides plaintiffs a private right of action.
The past year saw a flood of class actions alleging biometric privacy law violations. Earlier this year, plaintiffs in the U.S. District Court for the Northern District of California in In re: Facebook Biometric Information Privacy Litigation[11] were successful in securing a $650 million class action settlement from Facebook Inc. on the theory that Facebook's tag suggestions violated BIPA by collecting and storing digital scans of their faces without their notice or consent.
Similarly, plaintiffs secured a $92 million settlement from TikTok Inc. in In re: TikTok Consumer Privacy Litigation[12] in the Northern District of Illinois over alleged BIPA allegations at the end of February.
As with the IRPA, BIPA allows plaintiffs to recover $1,000 in fixed statutory damages regardless of whether the plaintiff suffered any actual damage. Given the similarities between the IRPA and BIPA, businesses should pay close attention to how liability is expanding under BIPA.
Future of IRPA Class Actions
Whether courts will find that the new IRPA claims have merit remains to be seen. There have been several such right of publicity class actions filed in states across the country in the last few weeks, and all the cases based on this novel theory of identity and commercial use are still in the early stages.
While some courts have dismissed these cases on technical and procedural grounds, such as standing under Article III of the U.S. Constitution, others are still pending. Additional defenses may be available related to the First Amendment, the commerce clause and statutory interpretation.
As this trend in IRPA and related state law litigation continues, businesses should be prepared to adjust their privacy practices and third-party vendor agreements quickly if it becomes necessary to comply with any expansion in liability under these laws.
“Ill. Right to Publicity Class Actions May Extend Cos.' Liability,” by Ana Tagvoryan, Harrison Brown, and Nicole Wentworth was published in Law360 on November 12, 2021.
[1] 765 ILCS 1075/1 et seq.
[2] Huston v. Hearst Communications, Inc. No. 1:21-cv-01196 (C.D. Ill. July 15, 2021).
[3] Duda v. Meredith Corporation, No. 1:21-cv-4531 (N.D. Ill. August 24, 2021).
[4] Anderson v. Hearst Communications, Inc., No. 1:21-cv-08895 (S.D.N.Y. October 29, 2021).
[5] Hicks v. Hearst Communications, Inc., No. 1:21-cv-09093 (S.D.N.Y. November 3, 2021).
[6] Ramirez v. Hearst Communications, Inc., No. 1:210-cv-09109 (S.D.N.Y. November 3, 2021).
[7] Burke v. Meredith Corporation, No. 4:21-cv-00335-RGE-SHL (S.D. Iowa November 2, 2021).
[8] Hetzel v. Meredith Corporation, No. 4:21-cv-00341-CRW-HCA (S.D. Iowa November 3, 2021).
[9] Ala. Code § 6-5-772 et seq.; Cal. Civ. Code § 3344 et seq.; Ohio Rev. Code. § 2741.02 et seq.; 32 L.R.P. § 3151, et seq.
[10] 740 ILCS 14/1 et seq.
[11] In re Facebook Biometric Information Privacy Litigation, No. 3:15-CV-03747-JD (N.D. Cal. February 26, 2021).
[12] In re TikTok, Inc. Consumer Privacy Litigation, No. 1:20-cv-04699 (N.D. Ill. September 30, 2021).