Appeal from the United States District Court for the Northern District of Illinois, Eastern Division. No. 1:21-cv-04285 — John J. Tharp, Jr. , Judge .

ARGUED OCTOBER 27, 2025 — DECIDED AUGUST 28, 2026

Before EASTERBROOK, SCUDDER, and KOLAR, Circuit Judges . EASTERBROOK, Circuit Judge . Charles Schwab, a brokerdealer in securities, allows customers to authenticate telephonic requests using voice-ID technology. The system checks the caller’s voice against a mathematical representation of the customer’s known voice and processes the caller’s request if the system concludes that the caller is who he claims to be. Schwab contracted with Nuance Communications to provide this voice-ID service.

Page 2Norma Cisneros, one of Schwab's customers, contends that neither Schwab nor Nuance obtained the kind of written consent required by the Biometric Information Privacy Act, 740 ILCS 14/1 to 14/99 (BIPA or the Act), and that neither Schwab nor Nuance publishes (or adheres to) retention and deletion schedules required by the Act. The suit was filed as a putative class action and is in federal court under 28 U.S.C. §1332(d) because the aggregate stakes exceed $5 million and minimal diversity of citizenship exists. The district court granted judgment on the pleadings to Nuance without certifying a class and without considering whether the abstention doctrine in §1332(d)(3) applies.

Nuance is the only defendant, because Schwab is subject to federal regulation as a financial institution and therefore is exempt from the Act. Section 25(c), 740 ILCS 14/25(c), exempts any 'fi nancial institution or an affiliate of a financial institution that is subject to Title V of the federal Gramm-Leach-Bliley Act of 1999 and the rules promulgated thereunder.” Nuance also claims the benefit of this exemption, and the district court held that it , too, is a financial institution (or affiliate) because it works for Schwab. 2024 U.S. Dist. LEXIS 244589 (N.D. Ill. Oct. 4, 2024).

There is a potential problem with standing, because Cisneros never dealt directly with Nuance. Schwab is exempt from the Act and therefore did not need to obtain Cisneros’s written consent . Nuance might be required to publish and comply with data-retention schedules, but it is hard to see how Cisneros suffers injury from the absence of these schedules. She does not contend that any of her data has been leaked—or that a leak could cause loss. (As far as we can see, the data that Nuance retains can be used to check whether a caller is who she claims to be but cannot be used to imitate Page 3that caller's voice. One-way systems of this kind are inherently secure.)

Bryant v. Compass Group USA, Inc. , 958 F.3d 617, 626 (7th Cir. 2020), holds that plaintiffs lack standing under the Act's subsection dealing with disclosure of retention schedules, and this appeal potentially poses the question whether retaining data that would be harmless if leaked creates a justiciable controversy. We know from TransUnion LLC v. Ramirez , 594 U.S. 413 (2021), that many kinds of risk are not justiciable when they do not track ordinary tort principles, and in the law of torts many kinds of unrealized risk cannot lead to damages. See, e.g., Metro-North Commuter R.R. v. Buckley , 521 U.S. 424 (1997) (risk of cancer from exposure to asbestos not actionable, even if accompanied by fear of manifesting cancer).

We need not pursue this inquiry to a conclusion, however. Justiciability comes ahead of the merits, see Steel Co. v. Citizens for a Better Environment , 523 U.S. 83 (1998), but Cisneros has standing on at least one legal theory: that Nuance had to obtain her personal written consent before collecting her voice -ID data. That theory rests on §15(b) of the Act, and Bryant holds that plaintiffs have standing to vindicate rights under that section. A data-collection claim against Nuance may fail on the merits, but it cannot be rejected for lack of standing. But if that claim does fail on the merits because Nuance is exempt under §25(c), any claim based on data schedules and retention vanishes and need not be addressed.

The district court’s conclusion that Nuance is exempt relies on the reasoning of a decision by a district court in Delaware. That decision was recently affirmed by the Third Circuit. McGoveran v. Amazon Web Services, Inc ., 175 F.4th 434 (3d Cir. 2026). To rule in favor of Cisneros we would need to Page 4create a conflict among the circuits on a question of Illinois law. That is not an attractive prospect.

McGoveran ’s reasoning is straightforward. The Act incorporates the definition of 'fi nancial institution ' from the Gramm-Leach-Bliley Act: “[A]ny institution the business of which is engaging in financial activities as described in section 1843(k) of title 12.” 15 U.S.C. §6809(3)(A). Section 1843(k) includes “any activity that the [Federal Reserve Board] has determined, by order or regulation … , to be so closely related to banking or managing or controlling banks as to be a proper incident thereto'. 12 U.S.C. §1843(k)(4)(F). The Federal Reserve determined by regulation that “authenticating the identity of persons conducting financial and nonfinancial transactions” is an “activity that … [is] so closely related to banking as to be a proper incident thereto”. 12 C.F.R. §225.86(a)(2)(iii). It follows that Nuance is exempt under §25(c) to the extent that it authenticates the identity of Schwab's customers in financial transactions.

Cisneros insists that Nuance “waived” this contention, but we don’t see how. It relied on §25(c) in the district court—not initially, perhaps, but while the case was under way. It brought McGoveran to the district judge’s attention after the judge in Delaware issued his opinion. We have neither a waiver nor a problem under the party presentation principle. See Margolin v. National Association of Immigration Judges , 608 U.S. 339 (2026).

Cisneros also contends that §25(c) is an affirmative defense, for the purpose of Fed. R. Civ. P. 8(c)(1), which Nuance did not plead at the suit’s beginning. But §25(c) is not on the list in Rule 8(c) and is not similar to things on the list, such as contributory negligence, laches, and release. Whether or not an affirmative defense is forfeited by omission from the Page 5answer—a subject before the Supreme Court in Younge v. Fulton Judicial Circuit District Attorney's Office , No. 25-352 (cert. granted Mar. 30, 2026)—a contention that a statutory exception blocks a plaintiff's claim may be raised without the need to plead it as an affirmative defense. Calling one rule of law an exception to another rule of law does not turn it into an affirmative defense. Some statutory exceptions may take the form of affirmative defenses, see Reed v. Columbia St. Mary’s Hospital , 915 F.3d 473, 477 (7th Cir. 2019), but not necessarily all. What’s more , Nuance has yet to file an answer. It moved to dismiss under Fed. R. Civ. P. 12(b)(6), a step that precedes the answer. Rule 8(c) lacks bite when the answer has yet to come due.

So maybe what Cisneros means is that the district court should not have dismissed the complaint under Rule 12(b)(6). This is a stronger argument. The complaint states a claim under §15(b) of the Act, and complaints need not anticipate or plead around either statutory exceptions or affirmative defenses. Gomez v. Toledo , 446 U.S. 635 (1980); Richards v. Mitcheff, 696 F.3d 635 (7th Cir. 2012). The district judge should have invoked Rule 12(c), which authorizes judgment on the pleadings, rather than Rule 12(b)(6). There would be little point, however, in remanding this case just so that the district judge could cite a different subsection of Rule 12. The parties joined issue on the meaning of §25(c), and the litigation does not entail a factual dispute that would require a trial or even the procedures to award summary judgment.

AFFIRMED