## Facts

- Zappos experienced a January 2012 security breach in which a hacker accessed customer information stored on its servers.
- Potentially compromised data included customer names, account numbers, encrypted passwords, email addresses, billing and shipping addresses, phone numbers, and the last four digits of credit card numbers; full credit card numbers were not exposed.
- Zappos notified customers by email and advised password changes.
- Customers filed multiple federal lawsuits alleging inadequate security and asserting state-law claims such as negligence, breach of contract, and consumer-protection violations.
- The cases were centralized in an MDL in the District of Nevada.
- Zappos moved to compel arbitration and stay the MDL based on an arbitration clause in website Terms of Use.
- The Terms of Use were presented as a browsewrap hyperlink at the bottom of webpages; users were not required to click “I agree” to create an account or make purchases.
- The Terms of Use included a unilateral modification clause allowing Zappos to change terms at any time without notice.

## Issues

1. Whether customers were bound to arbitrate when the Terms of Use were presented only via browsewrap hyperlink without affirmative assent or adequate notice.
2. Whether the arbitration clause was unenforceable as illusory because Zappos reserved the right to unilaterally modify the Terms of Use at any time without notice.

## Decision

- The court denied the motion to compel arbitration and denied a stay of the action.
- The court held customers were not bound by the browsewrap Terms of Use because they lacked actual or constructive notice and did not manifest assent.
- Alternatively, even if assent were assumed, the court held the arbitration provision was illusory and unenforceable due to Zappos’s unilateral, no-notice modification power.

## Legal Principles

- Arbitration under the Federal Arbitration Act requires a valid agreement to arbitrate, determined by ordinary contract formation principles.
- Browsewrap terms are enforceable only when the user has actual or constructive knowledge of the terms and manifests assent; mere placement of a hyperlink, without reasonably conspicuous notice or required action indicating agreement, is insufficient.
- A contractual promise to arbitrate may be illusory and unenforceable when one party retains an unrestricted right to unilaterally change the agreement at any time without notice, defeating mutuality of obligation.

## Conclusion

The court refused to compel arbitration in the data-breach MDL because the website’s browsewrap presentation did not establish customer assent to the Terms of Use, and because Zappos’s unilateral, no-notice modification clause independently rendered the arbitration promise nonbinding.


In re Zappos.com, Inc., Customer Data Security Breach Litigation, 893 F. Supp. 2d 1058 (D. Nev. 2012)