In re Zappos.com, Inc., Customer Data Security Breach Litigation

Zappos.com, Inc. (Zappos) (defendant), an online retailer, had its website hacked, and customer information was compromised (the security breach). The terms and conditions on Zappos’s website (the terms) included an arbitration provision stating that any disputes must be submitted to arbitration and that a customer’s use of the website constituted agreement to the arbitration provision. The terms also stated that Zappos reserved the right to change the terms at any time without notice. The hyperlink to the terms was not prominently displayed on the website, and users were never prompted to view or accept the terms. Several customers of Zappos (the customers) (plaintiffs) separately filed suits against Zappos in multiple district courts for breach of contract regarding the security breach. The United States Judicial Panel on Multidistrict Litigation (the MDL panel) consolidated the proceedings and transferred the consolidated action to the United States District Court for the District of Nevada. Zappos filed a motion to compel arbitration and for a stay of litigation, arguing that the terms, paired with the customers’ use of the website, created an enforceable arbitration agreement. The customers subsequently filed an opposition, arguing that no such agreement existed because the customers had insufficient notice of the terms and that the contract was illusory and unenforceable nonetheless because Zappos reserved the right to unilaterally change the terms and conditions.