Third Circuit Adopts “Primarily and Substantially in Illinois” Limit on BIPA and Treats Voice-Authentication Vendors as GLBA-Exempt Financial Institutions

I. Introduction

Christine McGoveran v. Amazon Web Services Inc (3d Cir. May 12, 2026) arises from calls placed by Illinois residents to John Hancock about retirement accounts. John Hancock routed those calls through Amazon Connect (an Amazon Web Services product). Pindrop Security, Inc. allegedly used cloud-based voiceprint technology to authenticate callers. Plaintiffs alleged that Amazon and Pindrop collected biometric voiceprints without written consent in violation of the Illinois Biometric Information Privacy Act, 740 ILCS 14/1 et seq. (“BIPA”).

The appeal presented five clusters of issues: (1) whether Pindrop was exempt under BIPA’s “financial institution” exemption; (2) whether the District Court abused discretion by denying broad discovery extensions; (3) whether denial of a Rule 41(a)(2) voluntary dismissal for newly added plaintiffs was an abuse of discretion; (4) whether Amazon was entitled to summary judgment because BIPA could not apply extraterritorially; and (5) whether judgment on the pleadings was proper on a repleaded Section 15(d) claim after prior dismissal without prejudice and parallel state-court filing.

II. Summary of the Opinion

The Third Circuit affirmed across the board. It held:

  • Pindrop is exempt under BIPA’s financial-institution exemption because BIPA incorporates the Gramm-Leach-Bliley Act (“GLBA”) definition of “financial institution,” which includes entities engaged in “financial activities,” and federal regulation treats identity-authentication for transactions as such an activity.
  • Discovery management rulings were within the District Court’s discretion where plaintiffs sought blanket extensions and failed to show diligence or an inability to obtain crucial evidence through timely discovery.
  • Denial of Rule 41(a)(2) voluntary dismissal was not an abuse of discretion given extensive litigation history, impending dispositive motion deadlines, and the District Court’s finding of forum-shopping motive and prejudice.
  • Amazon was entitled to summary judgment on extraterritoriality because BIPA lacks an express extraterritorial reach and applies only when the relevant conduct “occurred primarily and substantially in Illinois,” which plaintiffs failed to show.
  • Judgment on the pleadings on the repleaded Section 15(d) claim was proper because plaintiffs reasserted a previously dismissed claim while also pursuing it in state court; if they intended not to revive it, they should have omitted it from the amended complaint.

III. Analysis

A. Precedents Cited (and How They Shaped the Decision)

1. Standards of Review and Procedural Posture

  • Wilson v. USI Ins. Serv. LLC, 57 F.4th 131 (3d Cir. 2023): supplied the de novo review standard for dispositive rulings (dismissal, summary judgment, and judgment on the pleadings), enabling the panel to independently assess legal sufficiency and the extraterritoriality record.
  • Turner v. Schering-Plough Corp., 901 F.2d 335 (3d Cir. 1990) (discovery motions), and Polansky v. Exec. Health Res. Inc., 17 F.4th 376 (3d Cir. 2021), aff'd, 599 U.S. 419 (2023) (Rule 41(a)(2)): anchored abuse-of-discretion review for discovery control and voluntary dismissal, framing appellate deference.

2. Dismissal on Statutory Exemption / “Affirmative Defense on the Face of the Complaint”

  • In re Adams Golf, Inc. Sec. Litig., 381 F.3d 267 (3d Cir. 2004): cited for the general proposition that defendants bear the burden on affirmative defenses and that such issues often arise at summary judgment.
  • Clean Air Council v. U.S. Steel Corp., 4 F.4th 204 (3d Cir. 2021): critical to the court’s willingness to resolve an exception/exemption at the pleading stage when it is apparent from the complaint’s allegations.
  • Leveto v. Lapina, 258 F.3d 156 (3d Cir. 2001), quoted in Jones v. Bock, 549 U.S. 199 (2007): provided the doctrinal bridge—Rule 12(b)(6) dismissal is proper if an affirmative defense (or statutory exemption) is established by the complaint itself.
  • Sister-circuit analogs reinforcing the practice: Monsarrat v. Newman, 28 F.4th 314 (1st Cir. 2022); Bell v. Eagle Mountain Saginaw Indep. Sch. Dist., 27 F.4th 313 (5th Cir. 2022); Sams v. Yahoo! Inc., 713 F.3d 1175 (9th Cir. 2013).

These authorities collectively supported affirming Pindrop’s dismissal: even if the BIPA exemption is characterized as an “affirmative defense,” the complaint’s own allegations about authentication services for financial-account calls made the exemption dispositive at Rule 12(b)(6).

3. Discovery Control, Diligence, and Rule 56(d)

  • In re Fine Paper Antitrust Litig., 685 F.2d 810 (3d Cir. 1982), and Gallas v. Sup. Ct. of Pa., 211 F.3d 760 (3d Cir. 2000): supplied the governing principle that appellate courts rarely disturb discovery management absent a showing that denial made it impossible to obtain crucial evidence, plus an implicit showing that diligent discovery was impossible.
  • Lehman Bros. Holdings, Inc. v. Gateway Funding Diversified Mortg. Servs., L.P., 785 F.3d 96 (3d Cir. 2015): emphasized the “good cause”/diligence requirement for modifying scheduling orders under Rule 16(b)(4).
  • Koplove v. Ford Motor Co., 795 F.2d 15 (3d Cir. 1986): used to justify rejecting Rule 56(d) delay requests when the party seeking delay did not pursue discovery diligently.

The panel treated the District Court’s repeated instructions (seek narrow extensions tied to “late-breaking documents,” not omnibus scheduling revisions) as central to the diligence analysis. Plaintiffs’ failure to follow those directions undermined both discovery-extension and Rule 56(d) arguments.

4. BIPA Extraterritoriality (and the “Primarily and Substantially” Test)

  • Avery v. State Farm Mut. Ins. Co., 835 N.E.2d 801 (Ill. 2005): the cornerstone Illinois authority—Illinois statutes are presumed not to apply extraterritorially absent clear legislative intent; where the statute is silent, the conduct must have “occurred primarily and substantially in Illinois.”
  • Popa v. Harriet Carter Gifts, Inc., 52 F.4th 121 (3d Cir. 2022): distinguished as interpreting Pennsylvania law and therefore offering limited guidance on Illinois extraterritoriality for BIPA.
  • Svoboda v. Amazon.com Inc., 168 F.4th 956 (7th Cir. 2026), and Patel v. Facebook, Inc., 932 F.3d 1264 (9th Cir. 2019): cited to show a converging federal appellate consensus applying the “primarily and substantially in Illinois” standard to BIPA claims.

The Third Circuit expressly “join[ed]” the Seventh and Ninth Circuits, cementing the “primarily and substantially in Illinois” requirement as the governing approach in this circuit for BIPA extraterritoriality disputes.

5. Judgment on the Pleadings and Parallel Proceedings

  • Crosley Corp. v. Westinghouse Elec. & Mfg. Co., 130 F.2d 474 (3d Cir. 1942): invoked for the principle that the court first obtaining jurisdiction over the parties and issues may proceed notwithstanding parallel litigation—supporting the District Court’s decision to dispose of the repleaded Section 15(d) claim.

B. Legal Reasoning

1. The Financial-Institution Exemption Reaches an Authentication Vendor

The court’s analysis is largely textual and incorporative:

  • BIPA exempts a “financial institution or an affiliate of a financial institution” subject to GLBA Title V. 740 ILCS 14/25(c).
  • BIPA incorporates GLBA’s definition of “financial institution,” which includes any institution engaged in “financial activities” as described in 12 U.S.C. § 1843(k). 15 U.S.C. § 6809(3)(A).
  • Federal regulation deems “authenticating the identity of persons conducting financial and nonfinancial transactions” to be an activity “closely related to banking.” 12 C.F.R. § 225.86(a)(2)(iii).

Because plaintiffs pleaded that Pindrop authenticated John Hancock customers in connection with financial-account calls, the exemption applied on the face of the complaint. The court also rejected the argument that the District Court made improper factual findings at the motion-to-dismiss stage: it merely relied on plaintiffs’ pleaded description of the service.

2. Pleading-Stage Resolution of the Exemption

Even treating the exemption as an affirmative defense, the panel held dismissal is proper when the defense is established by the complaint’s allegations. This aspect is practical: it prevents expensive merits discovery when the pleaded facts themselves place the dispute outside BIPA’s scope.

3. Discovery and Case-Management Discipline

The court emphasized that plaintiffs sought blanket extensions despite repeated judicial guidance to request narrow relief tied to concrete late-breaking developments. Applying In re Fine Paper Antitrust Litig. and Gallas v. Sup. Ct. of Pa., the panel found no showing that the rulings made it impossible to obtain crucial evidence—especially where the District Court spelled out how plaintiffs could secure additional time through properly supported, targeted requests.

4. Rule 41(a)(2) Voluntary Dismissal and Prejudice/Forum Shopping

Under Polansky v. Exec. Health Res. Inc., the District Court possessed “broad” discretion to deny dismissal or set terms. The Third Circuit credited the District Court’s finding that the timing (five days before Amazon’s summary judgment filing, after fact discovery closed) and circumstances suggested forum shopping, and that Amazon would be prejudiced given the four-year litigation history, multiple pleadings answered, and substantial discovery responses and production.

5. Extraterritoriality: Conduct, Not Residence, Drives BIPA’s Reach

The opinion’s most broadly relevant legal move is its framing of “where the conduct occurred.” Relying on Avery v. State Farm Mut. Ins. Co. and joining Svoboda v. Amazon.com Inc. and Patel v. Facebook, Inc., the Third Circuit held BIPA applies only if the relevant misconduct “occurred primarily and substantially in Illinois.” It found plaintiffs could not raise a genuine dispute because the operational facts pointed elsewhere: Amazon’s call intake and processing occurred on servers in Northern Virginia; Pindrop was in Georgia; John Hancock was in Massachusetts; and Amazon lacked Illinois-based access to biometric data. Plaintiffs’ Illinois residency and location of the “harm” could not substitute for in-state conduct by defendants.

6. Section 15(d) Repleading and Judgment on the Pleadings

The court treated plaintiffs’ reassertion of the previously dismissed Section 15(d) claim as dispositive: repleading placed the claim back before the District Court. Plaintiffs’ stated intent “not” to revive it could not override the operative pleading. The parallel state-court filing reinforced the District Court’s decision to end the reintroduced claim decisively, with Crosley Corp. v. Westinghouse Elec. & Mfg. Co. supporting the first-seized court’s authority to proceed.

C. Impact

1. A Clear Third Circuit Rule for BIPA’s Geographic Limits

By “join[ing]” other circuits, the Third Circuit strengthens a national pattern: BIPA claims in federal court will often turn on where collection/processing/authentication occurred (servers, systems, and operational decision points), not merely where a plaintiff lived or used a phone. This is especially consequential for cloud-based, multi-state communications and security stacks.

2. Expanded Practical Reach of the GLBA/BIPA Financial-Institution Exemption

The decision signals that vendors providing transaction-related identity authentication may be treated as GLBA-defined “financial institutions” for BIPA purposes when their services fit within federally defined “financial activities.” This may narrow BIPA exposure for certain fintech/security vendors—while increasing the importance of fact pleading about what, precisely, the vendor does and for whom.

3. Litigation Conduct: Discovery Diligence and Late-Stage Plaintiff Additions

The ruling reinforces that plaintiffs cannot rely on open-ended discovery extensions or Rule 56(d) delays without a record of diligence, and that late procedural maneuvers (adding plaintiffs after discovery closes, then seeking to dismiss them near dispositive deadlines) can be viewed as prejudicial forum shopping.

IV. Complex Concepts Simplified

  • BIPA Sections 15(a)–(d): rules about publishing retention/destruction policies (15(a)), obtaining written informed consent before collecting biometrics (15(b)), not profiting from biometrics (15(c)), and restrictions on disclosure (15(d)).
  • Financial-institution exemption (740 ILCS 14/25(c)): if an entity qualifies as a GLBA “financial institution” (as BIPA defines it by incorporation) and is subject to GLBA Title V privacy rules, BIPA does not apply to it.
  • Extraterritoriality: states generally regulate conduct inside their borders; under Avery v. State Farm Mut. Ins. Co., Illinois statutes apply only when the relevant conduct occurred “primarily and substantially” in Illinois unless the legislature clearly says otherwise.
  • Affirmative defense on the face of the complaint: even if a defendant normally must prove a defense later, a case can be dismissed early when the complaint’s own allegations establish the defense (here, the exemption).
  • Summary judgment: a court may end a claim when no genuine dispute of material fact exists and the movant is entitled to judgment as a matter of law.
  • Rule 56(d): permits delaying summary judgment to obtain needed discovery, but generally requires showing diligence and specific reasons discovery is necessary.
  • Rule 41(a)(2): after an answer is filed, plaintiffs need court permission to voluntarily dismiss; courts consider prejudice to defendants and may deny dismissal or impose conditions.
  • Judgment on the pleadings: a post-answer vehicle to resolve claims where the pleadings show one side is entitled to judgment as a matter of law.

V. Conclusion

Christine McGoveran v. Amazon Web Services Inc establishes two especially consequential guideposts for BIPA litigation in the Third Circuit: (1) BIPA is constrained by Illinois’s extraterritoriality doctrine and applies only when the alleged biometric collection/use “occurred primarily and substantially in Illinois,” and (2) BIPA’s GLBA-linked financial-institution exemption can reach non-bank authentication vendors when their pleaded services fall within federally recognized “financial activities.” Coupled with the court’s insistence on discovery diligence and its skepticism of late-stage procedural maneuvering, the decision materially shapes both pleading strategy and venue viability for biometric-privacy claims involving cloud and multi-state transaction systems.