Background
Gunnar Optiks manufactures eyeglasses marketed to relieve digital eye strain. The company offered a “virtual try on” feature that used customers’ device cameras to scan facial geometry and display images of how the glasses would look when worn. William Clements sued, alleging that Gunnar violated Illinois’ Biometric Information Privacy Act (BIPA) by collecting facial data without consent.
BIPA prohibits collection of biometric identifiers—including scans of face geometry—without informed written consent. Gunnar moved to dismiss, arguing that a HIPAA-based exclusion in BIPA shielded its data collection. The exclusion exempts “information collected, used, or stored for health care treatment, payment, or operations under the federal Health Insurance Portability and Accountability Act of 1996.” The district court granted the motion, dismissing the complaint under Rule 12(b)(6). An Illinois appellate court had previously rejected Gunnar’s alternative argument under the first clause of the exclusion.
The Court’s Holding
The Seventh Circuit vacated and remanded. The court identified multiple fatal flaws in the district court’s dismissal. First, accepting Gunnar’s unproven factual assertion that its glasses relieve eye strain was inconsistent with the Rule 12(b)(6) standard, which does not require complaints to anticipate and refute potential defenses. Such factual disputes belong at summary judgment, not the pleading stage.
Second, the court rejected the core legal argument. Even assuming the glasses reduce eye strain, the data collection itself was not “for” medical treatment. Facial geometry data served Gunnar’s acknowledged purpose: showing the glasses’ appearance. The “virtual try on” feature was aesthetic, not medical. The court noted that under federal regulations, medical device sales count as health care only “in accordance with a prescription”—a requirement Gunnar’s glasses did not satisfy.
Third, the exclusion itself requires compliance with HIPAA’s numerous consent and confidentiality requirements. Whether Gunnar meets those obligations cannot be determined from the complaint alone and must be resolved through discovery. The court emphasized that Gunnar provides no evidence it complies with HIPAA, and the complaint suggests it may not even view digital eye strain relief as medical care.
Key Takeaways
- The HIPAA exemption to BIPA is narrow: it requires both that data collection serve medical treatment and that the collecting entity comply with HIPAA’s regulatory framework.
- Aesthetic features of products—even health-related ones—do not constitute medical treatment merely because the product itself has health benefits.
- Factual questions about regulatory compliance (e.g., HIPAA compliance) cannot resolve dismissal motions and must proceed to discovery.
- Medical device classification under federal law requires a prescription; over-the-counter health products do not automatically qualify as medical treatment.
Why It Matters
This decision significantly constrains the HIPAA exemption to BIPA and will impact companies selling health-adjacent consumer products. Manufacturers of wearables, wellness devices, and over-the-counter health products cannot rely on the health care exclusion simply because their products address a health concern. The holding requires a genuine medical purpose and documented regulatory compliance, not just a claimed health benefit.
The ruling also reinforces that Rule 12(b)(6) dismissals cannot rest on factual assertions or unstated compliance with regulatory regimes. For any company collecting biometric data in Illinois, the decision signals that privacy litigation will proceed beyond the pleading stage unless the exemption’s legal requirements are clearly evident from the complaint itself. Companies marketing health products must carefully delineate which features are medical (and thus potentially exempt) and which are consumer-oriented.