Flores-Mendez v. Zoosk, Inc.

Background

Juan Flores-Mendez and Amber Collins alleged that they used Zoosk’s dating platform, provided personal information to create profiles, and were affected by a data breach in early 2020. They alleged that hackers obtained information and that Zoosk learned of the breach in May 2020 but notified users about 22 days later. They claimed losses including lost time, anxiety, loss of privacy, risk of embarrassment, and an increased risk of identity theft.

Zoosk, Inc. operates the dating platform. Spark Networks, SE, is Zoosk’s parent company and maintains its principal business office in Berlin, according to the opinion. Spark challenged personal jurisdiction under Federal Rule of Civil Procedure 12(b)(2), while Zoosk did not. The parties presented conflicting information about Spark’s physical presence in California, its relationship with Zoosk, and the extent to which Spark controlled or operated Zoosk.

Personal Jurisdiction and Discovery

The court found that the conflicting allegations, declarations, and other documents justified discovery about personal jurisdiction over Spark. The court allowed the plaintiffs to conduct expedited discovery concerning both specific and general jurisdiction and their theory that Spark and Zoosk operated as an alter ego. The plaintiffs could take up to three depositions of seven hours each and serve up to 12 narrowly drawn and reasonable document requests. They were required to complete the discovery and submit a supplemental brief by April 1, 2021, at noon. Spark’s Rule 12(b)(2) motion was held in abeyance rather than decided.

Rule 12(b)(6) Claims Against Zoosk

A Rule 12(b)(6) motion tests whether a complaint states a legally sufficient claim. The court ruled on the claims as follows:

- Negligence: The court concluded that Flores-Mendez and Collins plausibly alleged a duty of care, breach, causation, and damages. The court reasoned that a dating application contains sensitive information and that a breach could plausibly cause blackmail, embarrassment, and privacy-related harms. It also concluded that the economic-loss rule did not bar the claim because the plaintiffs alleged more than purely economic losses, including lost time, anxiety, privacy loss, and increased identity-theft risk. - California unfair competition claim under Section 17200: The court found that the plaintiffs had not alleged the required personal loss of money or property. They did not allege that they had purchased credit-monitoring services or adequately alleged the value of their time as an opportunity cost. - Declaratory judgment: The plaintiffs sought a declaration that Zoosk’s security measures did not comply with its obligations concerning their personal information. The court found that a dispute remained about any continuing risk to the plaintiffs and similarly situated Zoosk users, so dismissal of this relief would be premature. The motion for declaratory judgment was denied. - California Consumer Privacy Act claim: The plaintiffs agreed to dismiss this claim without prejudice. The court therefore denied as moot the Rule 12(b)(6) motion directed at that claim.

The court stated that the plaintiffs could amend all of the claims discussed above.

Disposition

The court held Spark’s Rule 12(b)(2) motion to dismiss in abeyance, granted the plaintiffs’ request for discovery concerning personal jurisdiction over Spark, and denied in part and granted in part Zoosk’s motion to dismiss. The court separately denied the motion for declaratory judgment. Judge William Alsup signed the order on January 30, 2021.