Appeal from the U.S. District Court, D. Del. Judge Stephanos Bibas, No. 1:20-cv-01399

Before: PORTER, MONTGOMERY-REEVES, and BOVE, Circuit Judges Submitted Apr. 7, 2026; Decided May 12, 2026

OPINION OF THE COURTPage 2 PORTER, Circuit Judge .

Plaintiffs are Illinois citizens who called the financial services company John Hancock, which routed their calls through Amazon Connect, a product of Amazon Web Services. Pindrop Security then used cloud-based biometric technology to authenticate those callers using their voiceprints. They allege that Amazon and Pindrop violated the Illinois Biometric Information Privacy Act, 740 ILCS 14/1 et seq. (“BIPA”) , by collecting the callers’ biometric voiceprint s without consent. On appeal, Plaintiffs challenge the District Court’s resolution of several dispositive motions, discovery motions, and a voluntary dismissal motion. For the reasons below, we will affirm the District Court.

BIPA is a 2008 Illinois law that protects consumer biometric data, subject to exemptions for certain industries. Designed to address '[t]he use of biometrics' in 'financial transactions and security screenings,' BIPA 'regulat[es] the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information' by private entities in Illinois.¹ Id. 14/5(a), (g). Section 15(a) requires applicable private entities to “develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers Page 3and biometric information.' 14/15(a). These private entities may not “collect” biometric data without first getting written informed consent. 14/15(b). They also may not 'sell, lease, trade, or otherwise profit from” biometric data. 14/15(c). Nor may they “disclos e, redisclose, or otherwise disseminate a person’s or a customer’s biometric identifier or biometric infor -mation.' 14/15(d). Section 25(c) exempts from BIPA any 'financial institution that is subject to Title V of the federal Gramm-Leach-Bliley Act of 1999 [and its associated regulations].” 14/25(c).

In 2019, Plaintiffs filed a putative class action lawsuit against Amazon in Illinois state court, alleging violations of BIPA Sections 15(a) – (d). They allege that Plaintiffs individually called John Hancock to discuss their retirement accounts, and that John Hancock routed the calls through Amazon for processing. In turn, Amazon employed technology from Pindrop to authenticate the callers using their voiceprints. Amazon’s voiceprint authentication, according to Plaintiffs, occurred without their consent, in violation of BIPA.

Amazon removed the case to federal court, and the United States District Court for the Southern District of Illinois dismissed it for lack of personal jurisdiction because the only activity occurring in Illinois was Plaintiffs ’ use of their phones. McGoveran v. Amazon Web Servs., Inc. , 488 F. Supp. 3d 714, 721 – 23 (S.D. Ill. 2020). So Plaintiffs tried again by filing a substantively similar complaint in the United States District Court for the District of Delaware, this time naming both Amazon and Pindrop. The District Court granted Defendants’ motion to dismiss on extraterritoriality grounds. McGoveran v. Amazon Web Servs., Inc. , No. 1:20-cv-1399, 2021 WLPage 4 4502089 (D. Del. Sept. 30, 2021). Plaintiffs filed an amended complaint.

Amazon and Pindrop moved again to dismiss. This time, the District Court granted the motion as to Pindrop in its entirety, under the financial-institution exemption, and as to Amazon on all claims except the Section 15(b) claim for collecting biometric data without written consent. McGoveran v. Amazon Web Servs., Inc. , No. 1:20-cv-1399, 2023 WL 2683553 (D. Del. Mar. 29, 2023).

Plaintiffs filed a second amended complaint, adding more plaintiffs. But the District Court granted Amazon ’s motion for judgment on the pleadings for the Section 15(d) claim that it had dismissed before Plaintiffs repleaded it. It also awarded summary judgment to Amazon and closed the case. McGoveran v. Amazon Web Servs., Inc. , No. 1:20-cv-01399, 2024 WL 4626253 (D. Del. Oct. 30, 2024). Plaintiffs timely appealed.

The District Court had jurisdiction under 28 U.S.C. § 1332. We have jurisdiction under 28 U.S.C. § 1291.

We review de novo dispositive motions, including the District Court’s dismissal, summary judgment, and judgment on the pleadings. Wilson v. USI Ins. Serv. LLC , 57 F.4th 131, 139 – 40 (3d Cir. 2023). We review the District Court’s resolu -tion of discovery and voluntary dismissal motions for abuse of discretion. See, e.g. , Turner v. Schering-Plough Corp. , 901 F.2d 335, 341 n.4 (3d Cir. 1990) (discovery motions); Polansky v. Exec. Health Res. Inc. , 17 F.4th 376, 392 (3d Cir. 2021), aff’d , 599 U.S. 419 (2023) (Rule 41(a)(2) voluntary dismissal).

Page 5Plaintiffs raise five issues on appeal: whether the District Court (1) erred by granting Pindrop’s motion to dismiss under BIPA's financial -institution exemption; (2) abused its discretion by denying certain discovery motions; (3) abused its discretion by refusing to grant the newly added plaintiffs’ motion for voluntary dismissal; (4) erred by granting Amazon summary judgment on the Section 15(b) claim; and (5) erred in granting Amazon judgment on the pleadings for the renewed Section 15(d) claim. We will affirm on each issue.

Plaintiffs argue that the financial-institution exemption does not apply to Pindrop because (1) it is a technology company rather than a financial institution; (2) the District Court improperly relied on facts at the motion to dismiss stage; and (3) the exemption is an affirmative defense rather than a ground for dismissal. But the District Court correctly granted Pindrop's motion to dismiss under the financial-institution exemption.

BIPA 's financial-institution exemption provides that “[n] othing in this Act shall be deemed to apply in any manner to a financial institution or an affiliate of a financial institution that is subject to Title V of the federal Gramm-Leach-Bliley Act of 1999 and the rules promulgated thereunder. ” 740 ILCS 14/25(c). Although it is not immediately apparent that Pindrop is a “financial institution,” the operative language for applying the financial-institution exemption is in the statutory framework.

Page 6BIPA incorporates the definition of 'financial institu -tion” from the Gramm-Leach-Bliley Act of 1999 : “ [A]ny institution the business of which is engaging in financial activities as described in section 1843(k) of title 12.' 15 U.S.C. § 6809(3)(A). Section 1843(k), in turn, enumerates financial activities that include “any activity that the [Federal Reserve Board] has determined, by order or regulation . . . , to be so closely related to banking or managing or controlling banks as to be a proper incident t hereto.” 12 U.S.C. § 1843(k)(4)(F). The Federal Reserve Board determined by regulation that 'authenticating the identity of persons conducting financial and nonfinancial transactions ” is an “ activity that . . . [is] so closely related to banking as to be a proper incident thereto .” 12 C.F.R. § 225.86(a)(2)(iii).

Pindrop contends — and Plaintiffs concede — that Pindrop engages in authentication services for John Hancock’s customers conducting financial transactions. Because these authentication services fall squarely within BIPA’s incorporated definition of “ financial activities, ” Pindrop is exempt from BIPA.

Plaintiffs contend that the District Court improperly relied on factual findings when it concluded that “Pindrop pro -vides authentication services specifically for banking. ” Appellants ’ Br. at 27. That argument is unavailing. The District Court did not make factual findings on the nature of Pindrop’s business. Rather, it summarized Plaintiffs ' own pleadings, which alleged that individuals called John Hancock to discuss their financial accounts and Pindrop authenticated the call audio relayed by Amazon. McGoveran , 2023 WL 2683553, at *7. Then the District Court applied BIPA 's statutory Page 7framework to determine that Pindrop was a “financial institution” because it engaged in “authenticating the identity of persons conducting financial and nonfinancial transactions.” Id. (citing 12 C.F.R. § 225.86(a)(2)(iii)).

Plaintiffs ’ final argument over the financial-institution exemption is that, because they believe the exemption is an affirmative defense, the District Court erred by dismissing the case. The defendant has the burden of proving an affirmative defense. In re Adams Golf, Inc. Sec. Litig. , 381 F.3d 267, 277 (3d Cir. 2004). And affirmative defenses are usually teed up at summary judgment. Id. ; Clean Air Council v. U.S. Steel Corp. , 4 F.4th 204, 211 (3d Cir. 2021) (“ True, courts rarely consider affirmative defenses on motions to dismiss. But sometimes we do.” (internal citation omitted)). But “a complaint may be subject to dismissal under Rule 12(b)(6) when an affirmative defense appears on its face .” Leveto v. Lapina , 258 F.3d 156, 161 (3d Cir. 2001) (citation modified), quoted in Jones v. Bock , 549 U.S. 199, 215 (2007) (“ Whether a particular ground for opposing a claim may be the basis for dismissal for failure to state a claim depends on whether the allegations in the complaint suffice to establish that ground .”).

Here, assuming that the financial-institution exemption is an affirmative defense, Plaintiffs pleaded Pindrop’s authen -tication services on the face of the complaint. Their allegations plainly implicate the financial-institution exemption. Cf. Clean Air Council , 4 F.4th at 211 (affirming dismissal based on a statutory exception applicable on the face of the complaint). Indeed, our sister circuits have dismissed complaints based on analogous statutory exceptions. Cf. Monsarrat v. Newman , 28 F.4th 314, 317, 325 (1st Cir. 2022); Bell v. Eagle Mountain Page 8Saginaw Indep. Sch. Dist. , 27 F.4th 313, 326 (5th Cir. 2022); Sams v. Yahoo! Inc. , 713 F.3d 1175, 1183 (9th Cir. 2013). We will do likewise.

Plaintiffs challenge the District Court’s rulings denying blanket requests to extend discovery deadlines beyond the period the parties agreed to for fact discovery during the four years spanning the initial complaint and first motion for summary judgment. As a general rule, “matters of docket control and conduct of discovery are committed to the sound discretion of the district court.” In re Fine Paper Antitrust Litig. , 685 F.2d 810, 817 (3d Cir. 1982). So “ [w]e will not upset a district court ' s conduct of discovery procedures absent a demonstration that the court ’ s action made it impossible to obtain crucial evidence, and implicit in such a showing is proof that more diligent discovery was impossible.” Gallas v. Sup. Ct. of Pa. , 211 F.3d 760, 778 (3d Cir. 2000) (quoting Fine Paper , 685 F.2d at 817).

Plaintiffs argue that the District Court abused its discretion by denying additional time for discovery because “ the court’s action made it impossible to obtain crucial evidence.” Appellants ’ Br. at 34 (citing Fine Paper , 685 F.2d at 818). But as Plaintiffs admit, they must show diligence as “good cause” for modifying a discovery schedule. Lehman Bros. Holdings, Inc. v. Gateway Funding Diversified Mortg. Servs., L.P. , 785 F.3d 96, 102 (3d Cir. 2015) (quoting Fed. R. Civ. P. 16(b)(4)). Not only was more diligent discovery possible , but the District Court outlined exactly what Plaintiffs needed to do to obtain it. See Fine Paper , 685 F.2d at 818.

Page 9The District Court repeatedly warned the parties that they needed to move discovery along and to ask only for narrowly tailored extensions on 'particular depositions,' sup -ported by an explanation of why the need for such depositions “ hinged on late-breaking documents .” Appendix at 355 – 57. But rather than following the District Court’s instructions and presenting a narrower request, Plaintiffs proposed a broad omnibus amended scheduling order. Plaintiffs disregarded the District Court’s repeated warnings about time management in extension requests, and the District Court did not abuse its discretion by denying Plaintiffs ’ motions under these circumstances.

After the District Court denied the discovery motions, Plaintiffs moved for reconsideration, or, in the alternative, for voluntary dismissal of the recently added plaintiffs under Federal Rule of Civil Procedure 41. The District Court denied the motion. Plaintiffs contend that the denial contravened the court's ' liberal policy ” in granting voluntary dismissals and prejudicially kept them in the forum they selected a few months prior. Appellants’ Br. at 30 – 33. Amazon, they argued, would not be prejudiced if the court allowed the dismissal because the case was still in its “early stages.” Id.

Because Amazon had already filed an answer, Plaintiffs could voluntarily dismiss their claims “only by court order, on terms that the court considers proper. ” Fed. R. Civ. P. 41(a)(2). Thus, district c ourts have 'broad . . . discretion to shape the proper terms of dismissal.” Polansky , 17 F.4th at 393 (internal quotation marks omitted).

Page 10Here, the District Court agreed with Amazon that Plaintiffs “seek to remove these three people from the case so that they can forum shop to a more favorable venue.' McGoveran v. Amazon Web Servs., Inc. , No. 1:20-CV-01399, 2024 WL 4533598, at *5 (D. Del. Oct. 18, 2024). Plaintiffs sought removal just five days before Amazon moved for summary judgment on the deadline set by the long-established dispositive-motion schedule. They also added the new plaintiffs after fact discovery closed, despite the District Court ’s repeated warnings that it was not going to grant any blanket discovery extensions.

Despite Plaintiffs’ representations that Amazon would not be prejudiced, the District Court reasonably determined the opposite. The litigation had been ongoing for more than 4 years, and Amazon already answered 3 pleadings, responded to 56 document requests and 25 interrogatories, and produced 36,000 pages in discovery. The District Court did not abuse its discretion in refusing to grant Plaintiffs’ eleventh-hour motion to voluntarily dismiss the newly added plaintiffs.

Nor did the District Court err by granting summary judgment to Amazon on the grounds that the extraterritoriality Page 11doctrine bars Plaintiffs’ BIPA claims.² It is a “ long-standing rule of construction ” that Illinois state laws are ' without extraterritorial effect unless a clear intent in this respect appears from the express provisions of the statute.” Avery v. State Farm Mut. Ins. Co. , 835 N.E.2d 801, 852 (Ill. 2005) (internal quotation marks omitted). BIPA contains no such express provisions, so it applies only to conduct within the state. See generally 740 ILCS 14/1 et seq.

To survive summary judgment, Plaintiffs had to show a genuine dispute of material fact as to whether Amazon’s alleged misconduct underlying their BIPA claims 'occurred primarily and substantially in Illinois.” Avery , 835 N.E.2d at 854. They did not. Plaintiffs point to one case from our circuit. See Appellants’ Br. at 45 – 50 (citing Popa v. Harriet Carter Gifts, Inc. , 52 F.4th 121 (3d Cir. 2022)). But that case interpreting Pennsylvania law rather than Illinois law is too meager. See Popa , 52 F.4th at 131. Rather, every circuit to consider extraterritoriality in this context has held that BIPA only applies if the relevant activities “ occurred primarily and substantially in Illinois.” See Svoboda v. Amazon.com Inc. , 168 F.4th 956, 959 (7th Cir. 2026); Patel v. Facebook, Inc. , 932 F.3d 1264, 1275 (9th Cir. 2019). We will join them.

Page 12Plaintiffs argue that the District Court erred by focusing on “the geographic location of Amazon’s servers rather than the location of the harmed Plaintiffs. ” Appellants ’ Br. at 45. But the District Court’s emphasis was spot on. Amazon had no interaction with Illinois whatsoever. Amazon received calls (routed from AT&T) on its servers in Northern Virginia. From there, it sometimes asked Pindrop, a Georgia company, to authenticate those calls using the caller’s voiceprint . Then it sent reports and connected calls to John Hancock, a Massachusetts company. No Amazon employee in Illinois had access to any biometric data and Amazon did not store any biometric identifiers. Even if it had stored biometric identifiers, it could not have done so in Illinois because the relevant servers were in Virginia.

Lacking evidence, Plaintiffs fail to create a genuine dispute of material fact that the relevant activities here occurred outside of Illinois. So the extraterritoriality doctrine bars application of BIPA.

Finally, the District Court did not err in granting judgment on the pleadings on the Section 15(d) claim. The District Court dismissed Plaintiffs ’ Section 15(d) claim without preju -dice. About six weeks later, Plaintiffs “ran off to state court” and filed a Section 15(d) claim. App. 348. Then, while adding new plaintiffs, they repleaded the same Section 15(d) claim in an amended complaint. So the District Court entered judgment on the pleadings and dismissed Plaintiffs ’ Section 15(d) claim with prejudice.

Plaintiffs principally complain that their second amended complaint was only “ filed for the sole purpose of add- Page 13ing new class representatives, ” and that they were not reviving their previously-dismissed Section 15(d) claim. Appellants’ Br. at 54. Their “expressly stated intention” notwithstanding, id. at 55, that is exactly what they did by reasserting the claim in the second amended complaint. Plaintiffs repleaded their Section 15(d) claim and thereby placed it before the District Court again. If they did not want to revive the claim, they should have removed it.³ The District Court, as the “court first obtaining jurisdiction of the parties and issues” rightly granted Amazon judgment on the pleadings. Cf. Crosley Corp. v. Westinghouse Elec. & Mfg. Co. , 130 F.2d 474, 475 (3d Cir. 1942).

* * *

Because the District Court correctly dismissed Pindrop under the financial-institution exemption, properly granted summary judgment and judgment on the pleadings in favor of Amazon, and did not abuse its discretion in resolving the other challenged motions, we will affirm.

Andrew D. Schlichter Sean E. Soyars SCHLICHTER BOGARD LLC Counsel for Appellants Christine McGoveran, Joseph Valentine, Amelia Rodriguez, Richard Dresser, Fred Spagat, Donna Winandy, Michelle Whalen, Steven Page 14Talmontas, Aliki Marianos, Jeffrey Whalen, Traci Thompson, Robert Ritter Jody C. Barillare Elizabeth B. Herrington Michael E. Kenneally Jordan McCrary Kyle P. Nodes Ari M. Selman MORGAN LEWIS & BOCKIUS LLP Counsel for Appellee Amazon Web Services, Inc.

Andrew B. Bloomer Jack B. Blumenfeld Megan E. Dellinger George W. Hicks, Jr. Diana Torres KIRKLAND & ELLIS LLP Counsel for Appellee Pindrop Security, Inc.