Sifuentes v. Dropbox, Inc.

Background

David Angel Sifuentes, who represented himself, sued Dropbox, Inc. He alleged that his Dropbox account was compromised in a 2012 data breach, that Dropbox failed to notify him, and that hackers and cyber criminals stole and used his personal information. He asserted claims including invasion of privacy, negligence, intentional infliction of emotional distress, conversion, and violations of federal and state laws. He sought $550,000 in damages.

Dropbox moved to compel arbitration under the Federal Arbitration Act. Dropbox argued that Sifuentes agreed to terms of service requiring arbitration when he created his account and later continued using Dropbox after the terms were updated. Dropbox said the original signup process required him to check a box agreeing to the terms and that it sent him an email about the 2014 addition of an arbitration provision.

Sifuentes did not dispute agreeing to the original 2011 terms of service. He argued that those terms did not contain an arbitration provision and that he never agreed to later versions, read the updated terms, or opened emails about the changes.

Court’s Analysis

The court explained that Dropbox had to prove, by a greater-than-50-percent standard, that an arbitration agreement existed. The court first found that Sifuentes had agreed to the 2011 terms because the signup process required him to check a box stating that he agreed to Dropbox’s terms, and the terms were linked next to the checkbox. The 2011 terms, however, did not require arbitration.

The court then considered whether Sifuentes agreed to later terms containing mandatory arbitration provisions. It found that Dropbox had not shown that Sifuentes actually knew about the updated terms. Although Dropbox said it mass-emailed users about the changes, the record did not show that Sifuentes saw or read the email, such as through a record that he opened it.

The court also found that Dropbox did not establish that Sifuentes had sufficient notice through his use of the service or that he took an unambiguous action showing agreement to the later terms. The record did not show that he had to agree to the new terms before continuing to use Dropbox, that he was advised of the changes while using the service, or that Dropbox tracked whether he opened the email. Because Dropbox did not prove actual or constructive notice, the later terms did not create an enforceable arbitration agreement.

Disposition

The court denied Dropbox’s motion to compel arbitration. It did not decide the merits of Sifuentes’s underlying claims in this order. The court also set an initial telephone case-management conference for July 19, 2022, and directed the parties to file a joint case-management statement by July 12, 2022.