In the recent decision of Perry-Hudson v. Twilio, Inc., 24-cv-03741-VC (N.D. Cal. Dec. 2, 2024), a federal court ruled that a third-party software vendor that sold user information from a website could compel arbitration. The plaintiff alleged that the vendor unlawfully collected and shared his personal data without consent, but the court found that the his claims were covered by the website's Terms & Conditions, which included an arbitration clause. Applying the doctrine of equitable estoppel, the court determined that the plaintiff could not sidestep his agreement with the website company by suing only the third-party vendor, as the claims were fundamentally linked to the site's privacy policy and data-sharing practices.
Background Facts
Jonathan Perry Hudson, a customer of Keeps, filed a proposed class action lawsuit against Twilio, alleging that the company improperly collected and shared his information while facilitating targeted ads for Keeps' hair loss treatments. Although Hudson did not sue Keeps, he claimed Twilio violated privacy laws and California common law.
Twilio seeks to compel arbitration, arguing that Hudson agreed to Keeps' Terms and Conditions- which include an arbitration clause- when using Keeps' website. Hudson, however, disputes the applicability of the arbitration agreement on two grounds: (1) Keeps' website did not provide clear notice of the terms, meaning he never agreed to arbitration, and (2)Twilio, as a non-signatory to the agreement, cannot enforce it. Both parties agreed that California law governs the case.
Was Hudson Under Inquiry Notice of the Terms and Conditions and Thereby the Arbitration Agreement?
The court determined that Perry Hudson was on inquiry notice of Keeps' Terms and Conditions, which included an arbitration agreement. Under Berman v. Freedom Financial Network, LLC, 30 F.4th 849 (9th Cir. 2022), a contract can be enforced based on inquiry notice if:
- The website provides reasonably conspicuous notice of the terms, and
- The User takes an action, such as clicking a button that clearly indicates assent.
Hudson did not dispute the completion of the second requirement. The Keeps website presented a "Continue" button, directly below which was a statement that read, "By continuing, you agree to accept out Terms & Conditions and Privacy Policy." Despite this, Hudson argued that the site failed to provide reasonably conspicuous notice of the hyperlink to the Terms and Conditions because the links were not a different color from the surrounding text. He relies again on Berman, which noted that merely underscoring text is often insufficient to alert users to a clickable link.
However, the court looked at the broader context, as outlined in Keebaugh v. Warner Bros., Entertainment, Inc., 100 F.4th 1005 (9th Cir. 2024), which emphasized that factors like hyperlink placement affect whether a reasonably prudent user would notice it. Here, the Terms and Conditions link was positioned directly beneath the "Continue" button, the sign-in screen was uncluttered, and the black font contrasted against a plain white background. Given these design elements, the court found that the hyperlink provided reasonably conspicuous notice to Hudson.
The Arbitration Agreement was Enforceable Pursuant to the Doctrine of Equitable Estoppel
The court ruled that Twilio could enforce Perry Hudson's arbitration agreement with Keeps under the doctrine of equitable estoppel. The court noted this principle applies in two circumstances, as established in Kramer v. Toyota Motor Corp., 705 F.3d 1122 (9th Cir. 2013):
- When a signatory's claims against a non-signatory rely on or are deeply intertwined with the underlying contract.
- When the signatory alleges interdependent and coordinated misconduct between the non-signatory and another signatory, and that misconduct is connected to the contractual obligations.
The court found that the first circumstance applied in the current case because Hudson's claims against Twilio are closely tied to Keeps' Terms & Conditions and Privacy Policy. His claims hinge on whether he consented to Twilio's use of his data, and Keeps' privacy policy explicitly addresses data collection, usage, and third-party sharing. The policy states that Keeps shares information with third-party vendors, including contractual protections governing that use. Since consent is central to Hudson's claims, and the Privacy Policy outlines how Keeps manages data, the court determined that his claims are fundamentally linked to the agreement he had with Keeps. Importantly, a party cannot avoid equitable estoppel by simply omitting references to the contract in their complaint.
The court found also that the second circumstance applied, as Hudson alleged that Twilio and Keeps engaged in coordinated misconduct. He claimed he provided health information to Keeps solely for a hair loss treatment recommendation but was unaware that Keeps shared his data with Twilio. He further asserted that Keeps continued disclosing user health information despite a government warning about potential violations. Hudson even described the data-sharing agreement between Keeps and Twilio as an arrangement to wiretap his communications. These allegations demonstrated interdependent misconduct between Keeps and Twilio, reinforcing the connection between his claims and Keeps' contractual obligations regarding consent and data sharing.
Ultimately, the court held that fairness, the cornerstone of equitable estoppel, supported allowing Twilio to enforce the arbitration agreement. Goldman v. KPMG, LLP. 173 Cal.App.4th 209 (2009). If Hudson had sued Keeps directly, arbitration would apply. His attempt to disregard the agreement by suing only Twilio when his claims revolve around Keeps disclosure of his data failed. The court determined that equitable estoppel prevented him from bypassing his contractual obligations.
Based on these conclusions, the court granted the motion to compel and the case was stayed pending arbitration.
Key Takeaway
This ruling underscores the power of arbitration agreements and the doctrine of equitable estoppel in disputes involving third-party data sharing. The court's decision highlights that plaintiffs cannot evade arbitration simply by suing a non-signatory when their claims are deeply intertwined with a contract containing an arbitration clause. As data privacy litigation continues to evolve, this case serves as a critical precedent for companies relying on third-party service providers and reinforces the importance of clear, conspicuous consent mechanisms in online agreements.