In re Zappos.com, Inc., Customer Data Security Breach Litigation

<h2 id="background">Background</h2>
Zappos has a customer base of over 24 million people. In January 2012, Zappos suffered a <a href="/facts/Data_breach/xGxRFY1A">data security breach</a> that gave hackers personal information of their customers. While the security breach exposed names, addresses, and phone numbers of Zappos customers, it did not expose the customers' credit card information. 
After Zappos became aware of the security breach, Zappos sent an email to its customers notifying them of the security breach and advised that they change their login credentials on the site.<a class="footnote-ref" id="fnref:3" href="#fn:3">3</a>
Several Zappos customers independently filed suit against Zappos claiming that their business model did not protect the valuable information of their customers.<a class="footnote-ref" id="fnref:4" href="#fn:4">4</a><a class="footnote-ref" id="fnref:5" href="#fn:5">5</a>
Plaintiffs listed twelve <a href="/facts/Causes_of_action/9bjtMseG">causes of action</a> for the suit accusing Zappos of not taking adequate measures to safeguard customers' personally identifiable information.<a class="footnote-ref" id="fnref:6" href="#fn:6">6</a> 
By June 2012, there were nine lawsuits in progress, originating from five court districts.<a class="footnote-ref" id="fnref:7" href="#fn:7">7</a> 
After the lawsuits multiplied, Zappos moved to consolidate these pre-trial proceedings into a centralized forum.
The <a href="/facts/Judicial_Panel_on_Multidistrict_Litigation/jcF39vMr">Judicial Panel on Multidistrict Litigation</a> agreed that centralization would help move the cases along by avoiding duplicate work. The most time-saving implementation being a resolution of the facts involved in the case and series of events leading to and following the security breach.
Because of the location of the plaintiffs, many suggested their home districts for the centralized proceedings: the <a href="/facts/United_States_District_Court_for_the_District_of_Nevada/cqjCqnqq">District of Nevada</a>, the <a href="/facts/United_States_District_Court_for_the_Western_District_of_Kentucky/8vUUNcI1">Western District of Kentucky</a>, the <a href="/facts/United_States_District_Court_for_the_Southern_District_of_Florida/NBvXgE65">Southern District of Florida</a>, and the <a href="/facts/United_States_District_Court_for_the_District_of_Massachusetts/VfTFcdLI">District of Massachusetts</a>.
The Judicial Panel concluded that the District of Nevada was most appropriate because the breached Zappos servers and their administrators were based in Hendersonville, Nevada.<a class="footnote-ref" id="fnref:8" href="#fn:8">8</a>
On 14 June 2012, Zappos filed a motion to compel <a href="/facts/Arbitration/LukKEywe">arbitration</a> and <a href="/facts/Stay_of_proceedings/Gvp2dVv6">stay</a> action.
Such a motion would require that the Court stop proceedings on the consolidated suits that were arranged to take place in a single class action. Zappos would now require each individual plaintiff to go through an arbitration process.
This motion was held in a clause in Zappos's terms of use, which declared that disputes shall be resolved through confidential arbitration.<a class="footnote-ref" id="fnref:9" href="#fn:9">9</a>

<blockquote>
Any dispute relating in any way to your visit to the Site ... shall be submitted to confidential arbitration in Las Vegas, Nevada, .... You hereby consent to, and waive all defense of lack of personal jurisdiction in the state and federal courts of Nevada.

</blockquote>
Zappos argued that its customers were required to go through arbitration instead of personal jurisdiction because they automatically agreed to the terms of use when they used the Zappos.com website.
<a href="/facts/Browsewrap/6SM2RFKA">Browsewrap</a> agreements such as this are created when the user does not have to click a button or check a box to indicate that they have accepted the terms of service for a particular website.<a class="footnote-ref" id="fnref:10" href="#fn:10">10</a>

<blockquote>
ACCESSING, BROWSING, OR OTHERWISE USING THE SITE INDICATES YOUR AGREEMENT TO ALL THE TERMS AND CONDITIONS IN THIS AGREEMENT

</blockquote>
The difference between a <a href="/facts/Clickwrap/y43KbGPm">clickwrap</a> agreement and a browsewrap agreement is that in a browsewrap agreement, the visitor to a site accepts the terms of service simply by visiting the website.<a class="footnote-ref" id="fnref:11" href="#fn:11">11</a>

<h2 id="opinion-of-the-court">Opinion of the Court</h2>
The Court denied Zappos's motion to compel arbitration and stay action for two reasons: 1. the plaintiffs did not assent to the terms of use, and 2. the arbitration requirement is unenforceable.<a class="footnote-ref" id="fnref:12" href="#fn:12">12</a>
The Court started by citing the <a href="/facts/Federal_Arbitration_Act/pVeYLJbX">Federal Arbitration Act</a> and pointed out that the right to compel arbitration relied on a valid contract, which that element was highly contested.
Judge Jones cited several cases supporting the procedure of determining whether the parties formed a contract before deciding whether or not to compel arbitration including Chiron Corp. v. Ortho Diagnostics Sys., Inc., 207 F.3d 1126 (2000).<a class="footnote-ref" id="fnref:13" href="#fn:13">13</a>
In other words, the right to compel arbitration requires an enforceable contract, and an enforceable contract requires mutual assent.
This brought the nature of Zappos's terms of use into question and whether the user had actually entered a contract with Zappos under the browsewrap agreement.<a class="footnote-ref" id="fnref:14" href="#fn:14">14</a>
In a browsewrap agreement, the user must know of the website's terms and conditions in order to accept them.
The Court points out that on the Zappos website, a link to the terms of use is towards the bottom of each page; "when the Zappos.com homepage is printed to hard copy, the link appears on page 3 of 4." The link did not have any distinguishing features that set it apart from surrounding links. This embedding of terms did not make it reasonably obvious to the user where and how to find the terms, indicating the user experience was flawed. 
Additionally, the site did not give special mention of the terms of use when a user would sign up, log in, or make a purchase, further indicating that there was no mutual agreement once the user gave Zappos personal and private information.
From this, the Court concluded that the Plaintiffs may not have known about the terms of use, arguing that "No reasonable user" would have clicked the link.<a class="footnote-ref" id="fnref:15" href="#fn:15">15</a>
The Court also highlighted a clause in Zappos's terms of use, which declared, "We reserve the right to change this Site and these terms and conditions at any time."
This would give Zappos the right to choose whether to pursue arbitration, and its customers would be bound by its decision automatically. 
The Court wrote that this kind of agreement would give Zappos an "escape hatch" that it could use "if it determined arbitration was no longer in its interest."
Because of this, the Court found that the arbitration agreement is <a href="/facts/Illusory_contract/AEJMcGez">illusory</a> and would not be enforced in this case.<a class="footnote-ref" id="fnref:16" href="#fn:16">16</a>
Zappos argued that, under the <a href="/facts/Equitable_estoppel/JBlASTnc">equitable estoppel</a> doctrine, the plaintiffs may not sue for breach of contract trying to avoid the terms of use by not submitting to arbitration.
The Court declined to apply the doctrine, stating that the plaintiffs were not aware of the terms of use, and they were suing based on "other statements and guarantees found on the website."<a class="footnote-ref" id="fnref:17" href="#fn:17">17</a>

<h2 id="subsequent-developments">Subsequent developments</h2>
Zappos did not make any changes to its terms of use following the Court decision.
Law blogger William Carleton reported on 8 November 2012, two months after the decision, that Zappos's terms of use was identical to an archived copy from May 2011.
Carleton also tried registering for the site and placing an order.
He noted that there was still no salient presentation of the terms of service nor any dedicated "accept" button.<a class="footnote-ref" id="fnref:18" href="#fn:18">18</a>
On 9 September 2013, the Court dismissed most of the common law claims against Zappos.
The Court also dismissed a few of the statutory claims, some with leave to amend.<a class="footnote-ref" id="fnref:19" href="#fn:19">19</a>
A settlement was reached in October 2019. Customers received a 10% discount on one order. Zappos denied wrongdoing, but is expected to pay $1.6 million in court costs.<a class="footnote-ref" id="fnref:20" href="#fn:20">20</a>

<h2 id="commentary-from-law-blogs">Commentary from law blogs</h2>
Many law blogs posted advisories to businesses in response to this decision.
One common theme was the recommendation of clickwrap over browserwrap, in which the site explicitly obtains assent when a user clicks an "accept" button.<a class="footnote-ref" id="fnref:21" href="#fn:21">21</a><a class="footnote-ref" id="fnref:22" href="#fn:22">22</a><a class="footnote-ref" id="fnref:23" href="#fn:23">23</a>
Another common recommendation was for businesses to revise or remove any language from its terms of use that would allow it to change the terms of use without notice.<a class="footnote-ref" id="fnref:24" href="#fn:24">24</a><a class="footnote-ref" id="fnref:25" href="#fn:25">25</a><a class="footnote-ref" id="fnref:26" href="#fn:26">26</a>
Law firm Lewis Roca Rothgerber pointed out that this decision does not declare all browsewrap contracts unenforceable.
This case decided that Zappos's particular implementation of their terms of use, and the arbitration clause in particular were unenforceable.
The law firm stated that browsewrap agreements have been enforced in other courts.
It also suggests that businesses that want to continue to use browsewrap agreements should provide a conspicuous link to their agreements, "Front and Center."<a class="footnote-ref" id="fnref:27" href="#fn:27">27</a>
Law firm Stanfield Hiserodt suggested that the size of the case, with 24 million claimants in the class action, may have played a role in the decision.
Stanfield drew attention to the impossibility of having all 24 million individuals visit Nevada for arbitration.

<h2 id="external-links">External links</h2>
<ul><li>Text of In re Zappos.com, Inc., Customer Data Security Breach Litigation is available from: <a href="https://www.courtlistener.com/docket/4317225/21/mdl-no-2357-in-re-zapposcom-inc-customer-data-security-breach/">CourtListener</a> <a href="https://scholar.google.com/scholar_case?case=14024221140019970917">Google Scholar</a> <a href="http://docs.justia.com/cases/federal/district-courts/nevada/nvdce/3:2012cv00325/88233/21">Justia</a> <a href="https://www.leagle.com/decision/inadvfdco130619000108">Leagle</a> <a href="http://digitalcommons.law.scu.edu/cgi/viewcontent.cgi?article=1152&context=historical">Santa Clara Law Digital Commons</a> <a href="https://archive.org/details/gov.uscourts.nvd.88233">RECAP Archive</a> </li>
<li>Other filings in the case: <a href="https://www.courtlistener.com/docket/4317225/mdl-no-2357-in-re-zapposcom-inc-customer-data-security-breach/">CourtListener</a> <a href="http://dockets.justia.com/docket/nevada/nvdce/3:2012cv00325/88233/">Justia Dockets & Filings</a></li>
<li>Similar opinions, cited in the Zappos opinion, on browsewrap: <a href="https://scholar.google.com/scholar_case?case=16322454073167032785&hl=en&as_sdt=2006">Hines v. Overstock. com, Inc.</a>, <a href="http://dockets.justia.com/docket/illinois/ilndce/1:2010cv02675/242929/">Van Tassell et al v. United Marketing Group, LLC et al</a></li></ul>

<h2 id="references">References</h2>

<ol>
<li id="fn:1">Goldman, Eric. "How Zappos' User Agreement Failed In Court and Left Zappos Legally Naked". Forbes. Retrieved 1 October 2013. <a href="https://www.forbes.com/sites/ericgoldman/2012/10/10/how-zappos-user-agreement-failed-in-court-and-left-zappos-legally-naked/print/" target="_blank">https://www.forbes.com/sites/ericgoldman/2012/10/10/how-zappos-user-agreement-failed-in-court-and-left-zappos-legally-naked/print/</a> <a href="#fnref:1" class="footnote-back-ref">↩</a></li>
<li id="fn:2">"WSGR Alert: Federal District Court Refuses to Compel Arbitration, Holding That Zappos.com's "Browsewrap" Agreement Was Not a Valid Contract". Wilson Sonsini Goodrich & Rosati. Retrieved 1 October 2013. <a href="http://www.wsgr.com/WSGR/Display.aspx?SectionName=publications/PDFSearch/wsgralert-browsewrap-agreement.htm" target="_blank">http://www.wsgr.com/WSGR/Display.aspx?SectionName=publications/PDFSearch/wsgralert-browsewrap-agreement.htm</a> <a href="#fnref:2" class="footnote-back-ref">↩</a></li>
<li id="fn:3">Hsieh, Tony. "Security Email". Retrieved 2 October 2013. <a href="http://blogs.zappos.com/securityemail" target="_blank">http://blogs.zappos.com/securityemail</a> <a href="#fnref:3" class="footnote-back-ref">↩</a></li>
<li id="fn:4">Boyd, Gregory S. "Court Invalidates Zappos' Browsewrap Agreement". Retrieved 1 October 2013. <a href="http://www.mondaq.com/unitedstates/x/216616/advertising+marketing+branding/Court+Invalidates+Zappos+Browsewrap+Agreement" target="_blank">http://www.mondaq.com/unitedstates/x/216616/advertising+marketing+branding/Court+Invalidates+Zappos+Browsewrap+Agreement</a> <a href="#fnref:4" class="footnote-back-ref">↩</a></li>
<li id="fn:5">Goldman, Eric. "How Zappos' User Agreement Failed In Court and Left Zappos Legally Naked". Forbes. Retrieved 1 October 2013. <a href="https://www.forbes.com/sites/ericgoldman/2012/10/10/how-zappos-user-agreement-failed-in-court-and-left-zappos-legally-naked/print/" target="_blank">https://www.forbes.com/sites/ericgoldman/2012/10/10/how-zappos-user-agreement-failed-in-court-and-left-zappos-legally-naked/print/</a> <a href="#fnref:5" class="footnote-back-ref">↩</a></li>
<li id="fn:6">Jones, Robert C. "ORDER". Justia Dockets & Filings. Retrieved 27 October 2013. <a href="http://docs.justia.com/cases/federal/district-courts/nevada/nvdce/3:2012cv00325/88233/114" target="_blank">http://docs.justia.com/cases/federal/district-courts/nevada/nvdce/3:2012cv00325/88233/114</a> <a href="#fnref:6" class="footnote-back-ref">↩</a></li>
<li id="fn:7">Heyburn II, John G. "TRANSFER ORDER". Justia Dockets & Filings. Retrieved 26 October 2013. <a href="http://docs.justia.com/cases/federal/district-courts/nevada/nvdce/3:2012cv00325/88233/1" target="_blank">http://docs.justia.com/cases/federal/district-courts/nevada/nvdce/3:2012cv00325/88233/1</a> <a href="#fnref:7" class="footnote-back-ref">↩</a></li>
<li id="fn:8">Heyburn II, John G. "TRANSFER ORDER". Justia Dockets & Filings. Retrieved 26 October 2013. <a href="http://docs.justia.com/cases/federal/district-courts/nevada/nvdce/3:2012cv00325/88233/1" target="_blank">http://docs.justia.com/cases/federal/district-courts/nevada/nvdce/3:2012cv00325/88233/1</a> <a href="#fnref:8" class="footnote-back-ref">↩</a></li>
<li id="fn:9">Goldman, Eric. "How Zappos' User Agreement Failed In Court and Left Zappos Legally Naked". Forbes. Retrieved 1 October 2013. <a href="https://www.forbes.com/sites/ericgoldman/2012/10/10/how-zappos-user-agreement-failed-in-court-and-left-zappos-legally-naked/print/" target="_blank">https://www.forbes.com/sites/ericgoldman/2012/10/10/how-zappos-user-agreement-failed-in-court-and-left-zappos-legally-naked/print/</a> <a href="#fnref:9" class="footnote-back-ref">↩</a></li>
<li id="fn:10">Jones, Robert C. "ORDER". Justia Dockets & Filings. Retrieved 27 October 2013. <a href="http://docs.justia.com/cases/federal/district-courts/nevada/nvdce/3:2012cv00325/88233/114" target="_blank">http://docs.justia.com/cases/federal/district-courts/nevada/nvdce/3:2012cv00325/88233/114</a> <a href="#fnref:10" class="footnote-back-ref">↩</a></li>
<li id="fn:11">Stanfield, Paul. "Zappos Gets Zapped. Browsewrap Agreements Are Collateral Damage". Austin Technology Blog. Archived from the original on 17 September 2014. Retrieved 1 October 2013. <a href="http://www.austintechnologylawblog.com/2013/08/articles/zappos-gets-zapped-browsewrap-agreements-are-collateral-damage/" target="_blank">http://www.austintechnologylawblog.com/2013/08/articles/zappos-gets-zapped-browsewrap-agreements-are-collateral-damage/</a> <a href="#fnref:11" class="footnote-back-ref">↩</a></li>
<li id="fn:12">Jones, Robert C. "Order". Justia Dockets & Filings. Retrieved 27 October 2013. <a href="http://docs.justia.com/cases/federal/district-courts/nevada/nvdce/3:2012cv00325/88233/21" target="_blank">http://docs.justia.com/cases/federal/district-courts/nevada/nvdce/3:2012cv00325/88233/21</a> <a href="#fnref:12" class="footnote-back-ref">↩</a></li>
<li id="fn:13">McKeown, M. Margaret. "CHIRON CORP. v. ORTHO DIAGNOSTIC SYSTEMS, INC". Legale. Retrieved 27 October 2013. <a href="http://www.leagle.com/decision/20001333207F3d1126_11182" target="_blank">http://www.leagle.com/decision/20001333207F3d1126_11182</a> <a href="#fnref:13" class="footnote-back-ref">↩</a></li>
<li id="fn:14">Jones, Robert C. "Order". Justia Dockets & Filings. Retrieved 27 October 2013. <a href="http://docs.justia.com/cases/federal/district-courts/nevada/nvdce/3:2012cv00325/88233/21" target="_blank">http://docs.justia.com/cases/federal/district-courts/nevada/nvdce/3:2012cv00325/88233/21</a> <a href="#fnref:14" class="footnote-back-ref">↩</a></li>
<li id="fn:15">Jones, Robert C. "Order". Justia Dockets & Filings. Retrieved 27 October 2013. <a href="http://docs.justia.com/cases/federal/district-courts/nevada/nvdce/3:2012cv00325/88233/21" target="_blank">http://docs.justia.com/cases/federal/district-courts/nevada/nvdce/3:2012cv00325/88233/21</a> <a href="#fnref:15" class="footnote-back-ref">↩</a></li>
<li id="fn:16">Jones, Robert C. "Order". Justia Dockets & Filings. Retrieved 27 October 2013. <a href="http://docs.justia.com/cases/federal/district-courts/nevada/nvdce/3:2012cv00325/88233/21" target="_blank">http://docs.justia.com/cases/federal/district-courts/nevada/nvdce/3:2012cv00325/88233/21</a> <a href="#fnref:16" class="footnote-back-ref">↩</a></li>
<li id="fn:17">Jones, Robert C. "Order". Justia Dockets & Filings. Retrieved 27 October 2013. <a href="http://docs.justia.com/cases/federal/district-courts/nevada/nvdce/3:2012cv00325/88233/21" target="_blank">http://docs.justia.com/cases/federal/district-courts/nevada/nvdce/3:2012cv00325/88233/21</a> <a href="#fnref:17" class="footnote-back-ref">↩</a></li>
<li id="fn:18">Carleton, William. "Zappos terms of use still "browsewrap"". Counselor @ Law. Retrieved 1 October 2013. <a href="http://www.wac6.com/wac6/2012/11/zappos-terms-of-use-still-browsewrap.html" target="_blank">http://www.wac6.com/wac6/2012/11/zappos-terms-of-use-still-browsewrap.html</a> <a href="#fnref:18" class="footnote-back-ref">↩</a></li>
<li id="fn:19">Jones, Robert C. "ORDER". Justia Dockets & Filings. Retrieved 27 October 2013. <a href="http://docs.justia.com/cases/federal/district-courts/nevada/nvdce/3:2012cv00325/88233/114" target="_blank">http://docs.justia.com/cases/federal/district-courts/nevada/nvdce/3:2012cv00325/88233/114</a> <a href="#fnref:19" class="footnote-back-ref">↩</a></li>
<li id="fn:20">Nickelsburg, Monica (22 November 2019). "Zappos settles major data breach lawsuit with 10% discounts for customers through end of year". GeekWire. Retrieved 23 July 2024. <a href="https://www.geekwire.com/2019/zappos-settles-major-data-breach-lawsuit-10-discounts-customers-end-year/" target="_blank">https://www.geekwire.com/2019/zappos-settles-major-data-breach-lawsuit-10-discounts-customers-end-year/</a> <a href="#fnref:20" class="footnote-back-ref">↩</a></li>
<li id="fn:21">"WSGR Alert: Federal District Court Refuses to Compel Arbitration, Holding That Zappos.com's "Browsewrap" Agreement Was Not a Valid Contract". Wilson Sonsini Goodrich & Rosati. Retrieved 1 October 2013. <a href="http://www.wsgr.com/WSGR/Display.aspx?SectionName=publications/PDFSearch/wsgralert-browsewrap-agreement.htm" target="_blank">http://www.wsgr.com/WSGR/Display.aspx?SectionName=publications/PDFSearch/wsgralert-browsewrap-agreement.htm</a> <a href="#fnref:21" class="footnote-back-ref">↩</a></li>
<li id="fn:22">Boyd, Gregory S. "Court Invalidates Zappos' Browsewrap Agreement". Retrieved 1 October 2013. <a href="http://www.mondaq.com/unitedstates/x/216616/advertising+marketing+branding/Court+Invalidates+Zappos+Browsewrap+Agreement" target="_blank">http://www.mondaq.com/unitedstates/x/216616/advertising+marketing+branding/Court+Invalidates+Zappos+Browsewrap+Agreement</a> <a href="#fnref:22" class="footnote-back-ref">↩</a></li>
<li id="fn:23">Goldman, Eric. "How Zappos' User Agreement Failed In Court and Left Zappos Legally Naked". Forbes. Retrieved 1 October 2013. <a href="https://www.forbes.com/sites/ericgoldman/2012/10/10/how-zappos-user-agreement-failed-in-court-and-left-zappos-legally-naked/print/" target="_blank">https://www.forbes.com/sites/ericgoldman/2012/10/10/how-zappos-user-agreement-failed-in-court-and-left-zappos-legally-naked/print/</a> <a href="#fnref:23" class="footnote-back-ref">↩</a></li>
<li id="fn:24">Boyd, Gregory S. "Court Invalidates Zappos' Browsewrap Agreement". Retrieved 1 October 2013. <a href="http://www.mondaq.com/unitedstates/x/216616/advertising+marketing+branding/Court+Invalidates+Zappos+Browsewrap+Agreement" target="_blank">http://www.mondaq.com/unitedstates/x/216616/advertising+marketing+branding/Court+Invalidates+Zappos+Browsewrap+Agreement</a> <a href="#fnref:24" class="footnote-back-ref">↩</a></li>
<li id="fn:25">"WSGR Alert: Federal District Court Refuses to Compel Arbitration, Holding That Zappos.com's "Browsewrap" Agreement Was Not a Valid Contract". Wilson Sonsini Goodrich & Rosati. Retrieved 1 October 2013. <a href="http://www.wsgr.com/WSGR/Display.aspx?SectionName=publications/PDFSearch/wsgralert-browsewrap-agreement.htm" target="_blank">http://www.wsgr.com/WSGR/Display.aspx?SectionName=publications/PDFSearch/wsgralert-browsewrap-agreement.htm</a> <a href="#fnref:25" class="footnote-back-ref">↩</a></li>
<li id="fn:26">"Zappos and its effect on "browsewrap" agreements". August 2013. Retrieved 2 October 2013. <a href="http://www.lexology.com/library/detail.aspx?g=36b5e969-e644-4db5-8555-b6930448c075" target="_blank">http://www.lexology.com/library/detail.aspx?g=36b5e969-e644-4db5-8555-b6930448c075</a> <a href="#fnref:26" class="footnote-back-ref">↩</a></li>
<li id="fn:27">"Zappos and its effect on "browsewrap" agreements". August 2013. Retrieved 2 October 2013. <a href="http://www.lexology.com/library/detail.aspx?g=36b5e969-e644-4db5-8555-b6930448c075" target="_blank">http://www.lexology.com/library/detail.aspx?g=36b5e969-e644-4db5-8555-b6930448c075</a> <a href="#fnref:27" class="footnote-back-ref">↩</a></li>
</ol>

In re Zappos.com, Inc., Customer Data Security Breach Litigation open-in-new

In re Zappos.com, Inc., Customer Data Security Breach Litigation