Full Opinion

In the United States Court of Appeals For the Seventh Circuit ____________________ No. 24-2982 NORMA CISNEROS, Plaintiff-Appellant, v. NUANCE COMMUNICATIONS, INC., Defendant-Appellee. ____________________ Appeal from the United States District Court for the Northern District of Illinois, Eastern Division. No. 1:21-cv-04285 — John J. Tharp, Jr., Judge. ____________________ ARGUED OCTOBER 27, 2025 — DECIDED AUGUST 28, 2026 ____________________ Before EASTERBROOK, SCUDDER, and KOLAR, Circuit Judges. EASTERBROOK, Circuit Judge. Charles Schwab, a broker- dealer in securities, allows customers to authenticate tele- phonic requests using voice-ID technology. The system checks the caller’s voice against a mathematical representa- tion of the customer’s known voice and processes the caller’s request if the system concludes that the caller is who he claims to be. Schwab contracted with Nuance Communications to provide this voice-ID service. 2 No. 24-2982 Norma Cisneros, one of Schwab’s customers, contends that neither Schwab nor Nuance obtained the kind of written consent required by the Biometric Information Privacy Act, 740 ILCS 14/1 to 14/99 (BIPA or the Act), and that neither Schwab nor Nuance publishes (or adheres to) retention and deletion schedules required by the Act. The suit was filed as a putative class action and is in federal court under 28 U.S.C. §1332(d) because the aggregate stakes exceed $5 million and minimal diversity of citizenship exists. The district court granted judgment on the pleadings to Nuance without certi- fying a class and without considering whether the abstention doctrine in §1332(d)(3) applies. Nuance is the only defendant, because Schwab is subject to federal regulation as a financial institution and therefore is exempt from the Act. Section 25(c), 740 ILCS 14/25(c), exempts any “financial institution or an affiliate of a financial institu- tion that is subject to Title V of the federal Gramm-Leach-Bli- ley Act of 1999 and the rules promulgated thereunder.” Nu- ance also claims the benefit of this exemption, and the district court held that it, too, is a financial institution (or affiliate) be- cause it works for Schwab. 2024 U.S. Dist. LEXIS 244589 (N.D. Ill. Oct. 4, 2024). There is a potential problem with standing, because Cis- neros never dealt directly with Nuance. Schwab is exempt from the Act and therefore did not need to obtain Cisneros’s written consent. Nuance might be required to publish and comply with data-retention schedules, but it is hard to see how Cisneros suffers injury from the absence of these sched- ules. She does not contend that any of her data has been leaked—or that a leak could cause loss. (As far as we can see, the data that Nuance retains can be used to check whether a caller is who she claims to be but cannot be used to imitate No. 24-2982 3 that caller’s voice. One-way systems of this kind are inher- ently secure.) Bryant v. Compass Group USA, Inc., 958 F.3d 617, 626 (7th Cir. 2020), holds that plaintiffs lack standing under the Act’s subsection dealing with disclosure of retention schedules, and this appeal potentially poses the question whether retaining data that would be harmless if leaked creates a justiciable con- troversy. We know from TransUnion LLC v. Ramirez, 594 U.S. 413 (2021), that many kinds of risk are not justiciable when they do not track ordinary tort principles, and in the law of torts many kinds of unrealized risk cannot lead to damages. See, e.g., Metro-North Commuter R.R. v. Buckley, 521 U.S. 424 (1997) (risk of cancer from exposure to asbestos not actiona- ble, even if accompanied by fear of manifesting cancer). We need not pursue this inquiry to a conclusion, however. Justiciability comes ahead of the merits, see Steel Co. v. Citizens for a Better Environment, 523 U.S. 83 (1998), but Cisneros has standing on at least one legal theory: that Nuance had to ob- tain her personal written consent before collecting her voice- ID data. That theory rests on §15(b) of the Act, and Bryant holds that plaintiffs have standing to vindicate rights under that section. A data-collection claim against Nuance may fail on the merits, but it cannot be rejected for lack of standing. But if that claim does fail on the merits because Nuance is ex- empt under §25(c), any claim based on data schedules and re- tention vanishes and need not be addressed. The district court’s conclusion that Nuance is exempt re- lies on the reasoning of a decision by a district court in Dela- ware. That decision was recently affirmed by the Third Cir- cuit. McGoveran v. Amazon Web Services, Inc., 175 F.4th 434 (3d Cir. 2026). To rule in favor of Cisneros we would need to 4 No. 24-2982 create a conflict among the circuits on a question of Illinois law. That is not an attractive prospect. McGoveran’s reasoning is straightforward. The Act incor- porates the definition of “financial institution” from the Gramm-Leach-Bliley Act: “[A]ny institution the business of which is engaging in financial activities as described in sec- tion 1843(k) of title 12.” 15 U.S.C. §6809(3)(A). Section 1843(k) includes “any activity that the [Federal Reserve Board] has determined, by order or regulation … , to be so closely related to banking or managing or controlling banks as to be a proper incident thereto”. 12 U.S.C. §1843(k)(4)(F). The Federal Re- serve determined by regulation that “authenticating the iden- tity of persons conducting financial and nonfinancial transac- tions” is an “activity that … [is] so closely related to banking as to be a proper incident thereto”. 12 C.F.R. §225.86(a)(2)(iii). It follows that Nuance is exempt under §25(c) to the extent that it authenticates the identity of Schwab’s customers in fi- nancial transactions. Cisneros insists that Nuance “waived” this contention, but we don’t see how. It relied on §25(c) in the district court—not initially, perhaps, but while the case was under way. It brought McGoveran to the district judge’s attention after the judge in Delaware issued his opinion. We have neither a waiver nor a problem under the party presentation principle. See Margolin v. National Association of Immigration Judges, 608 U.S. 339 (2026). Cisneros also contends that §25(c) is an affirmative de- fense, for the purpose of Fed. R. Civ. P. 8(c)(1), which Nuance did not plead at the suit’s beginning. But §25(c) is not on the list in Rule 8(c) and is not similar to things on the list, such as contributory negligence, laches, and release. Whether or not an affirmative defense is forfeited by omission from the No. 24-2982 5 answer—a subject before the Supreme Court in Younge v. Ful- ton Judicial Circuit District Attorney’s Office, No. 25–352 (cert. granted Mar. 30, 2026)—a contention that a statutory excep- tion blocks a plaintiff’s claim may be raised without the need to plead it as an affirmative defense. Calling one rule of law an exception to another rule of law does not turn it into an affirmative defense. Some statutory exceptions may take the form of affirmative defenses, see Reed v. Columbia St. Mary’s Hospital, 915 F.3d 473, 477 (7th Cir. 2019), but not necessarily all. What’s more, Nuance has yet to file an answer. It moved to dismiss under Fed. R. Civ. P. 12(b)(6), a step that precedes the answer. Rule 8(c) lacks bite when the answer has yet to come due. So maybe what Cisneros means is that the district court should not have dismissed the complaint under Rule 12(b)(6). This is a stronger argument. The complaint states a claim un- der §15(b) of the Act, and complaints need not anticipate or plead around either statutory exceptions or affirmative de- fenses. Gomez v. Toledo, 446 U.S. 635 (1980); Richards v. Mitcheff, 696 F.3d 635 (7th Cir. 2012). The district judge should have invoked Rule 12(c), which authorizes judgment on the plead- ings, rather than Rule 12(b)(6). There would be little point, however, in remanding this case just so that the district judge could cite a different subsection of Rule 12. The parties joined issue on the meaning of §25(c), and the litigation does not en- tail a factual dispute that would require a trial or even the pro- cedures to award summary judgment. AFFIRMED