On December 29, 2018, Google won summary judgment in Rivera v. Google, a privacy class action alleging violations of the Illinois Biometric Information Privacy Act (BIPA). The case involved “face grouping,” a feature that enables Google Photos to automatically sort and group the photographs in a user’s private account based on visual similarities between the images of faces in the photos. The court held that any alleged collection of “biometric information” or “biometric identifiers” stemming from this feature did not cause an injury-in-fact sufficient to confer Article III standing. The Rivera v. Google decision demonstrates that, even in the context of claims arising out of privacy statutes, like Illinois’ BIPA, a defendant can prevail on a challenge to subject matter jurisdiction if it can demonstrate that the alleged violation did not result in any concrete injury to the plaintiffs. Some states impose similar requirements to bringing suit in state court. As states continue to enact privacy legislation, corporations that collect private information can mitigate risk by considering and enhancing their available Article III defenses, including by documenting how they protect potential plaintiffs’ information from disclosure.