Atkins v. Amplitude, Inc.

• Court: District Court, N.D. California
• Decided: September 2, 2025
• Docket: 3:24-cv-04913
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF CALIFORNIA

KYLE ATKINS, et al., Case No. 24-cv-04913-RFL

Plaintiffs, ORDER GRANTING MOTION TO v. COMPEL ARBITRATION AND DENYING AS MOOT MOTION TO AMPLITUDE, INC., DISMISS Defendant. Re: Dkt. Nos. 30, 36

Plaintiffs Kyle Atkins and Michael Luo (“Plaintiffs”) bring this class action against Defendant Amplitude, Inc. (“Amplitude”), alleging that Amplitude embedded its software development kits (“SDKs”) in various apps to “surreptitiously track[] consumers’ sensitive locations and captur[e] their in-app activities,” in violation of (1) the Wiretap Act, 18 U.S.C. § 2510, (2) the California Invasion of Privacy Act, Cal. Penal Code § 638.51, (3) the California Comprehensive Computer Data Access and Fraud Act, Cal. Penal Code § 502, and (4) the California Wiretap Act, Cal. Penal Code § 631. (Dkt. No. 23 (“Compl.”) at 1.)1 Specifically, Plaintiffs allege that Amplitude “contracted with DoorDash to provide its SDK to be embedded in the DoorDash food delivery app,” and that Plaintiffs’ information was collected through their use of the DoorDash app as a result. (Id. ¶¶ 21, 34, 38.) Now, Amplitude moves to compel arbitration of Plaintiffs’ claims based on arbitration agreements executed between Plaintiffs and DoorDash, seeking to enforce the agreements as a non-party. (Dkt. No. 36.) In the alternative, Amplitude moves to dismiss Plaintiffs’ claims. (Dkt. No. 30.) For the reasons stated below, the motion to compel arbitration is GRANTED, and the motion to dismiss is DENIED. This order

1 Citations to page numbers refer to the ECF pagination. assumes that the reader is familiar with the facts of the case, the applicable legal standards, and the parties’ arguments. I. MOTION TO DISMISS Amplitude moved in the alternative to dismiss the case against it, requesting that the Court rule on its motion to compel arbitration first. However, in its motion to dismiss, Amplitude argues that Plaintiffs lack Article III standing to assert their claims because they have not suffered a concrete, particularized harm and, in any event, that they consented to DoorDash’s collection practices. Because the Court is required to ensure that it has subject matter jurisdiction over the case prior to entering rulings, standing is addressed at the outset. To establish standing, “a plaintiff must show that (i) [they] suffered an injury in fact that is concrete, particularized, and actual or imminent; (ii) that the injury was likely caused by the defendant; and (iii) that the injury would likely be redressed by judicial relief.” TransUnion LLC v. Ramirez, 594 U.S. 413, 423 (2021). Plaintiffs sufficiently allege that they suffered a concrete privacy harm as to establish Article III standing to assert their claims. “Central to assessing concreteness is whether the asserted harm has a ‘close relationship’ to a harm traditionally recognized as providing a basis for lawsuits in American courts.” Id. at 424 (quoting Spokeo, Inc. v. Robins, 578 U.S. 330, 340- 41 (2016)). “Violations of the right to privacy have long been actionable at common law.” In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 598 (9th Cir. 2020) (quoting Patel v. Facebook, 932 F.3d 1264, 1272 (9th Cir. 2019)). Here, Plaintiffs allege that their private information—e.g., timestamped geolocation information, device IDs, device fingerprint data, information about other apps they were using on their device, search terms input to the app, products placed in their cart, and other restaurants and products they viewed—was collected and disseminated. (Compl. ¶¶ 34, 38.) Furthermore, Plaintiffs allege that the collection of this data “may reveal, for instance, a consumer’s religious affiliation, sexual orientation, medical condition, and even whether the consumer is part of an at-risk population.” (Id. ¶ 27.) Disclosure of facts that allegedly reveal this highly sensitive information is sufficient to allege a concrete privacy harm analogous to those actionable under common law privacy torts. See Popa v. Microsoft Corp., No. 24-cv-00014, 2025 WL 2448824, at *6, *8 (9th Cir. Aug. 26, 2025) (recognizing the continuing viability of In re Facebook based on the alleged compilation of “personally identifiable browsing history” that was tracked “no matter how sensitive” the content was). Moreover, assuming without deciding that consent is pertinent to the standing inquiry, Plaintiffs have sufficiently alleged that they did not consent to the dissemination of their private information to Amplitude. Although DoorDash’s Privacy Policy2 discloses that DoorDash may share the information it collects from users with service providers, including those that support its marketing and analytics, Plaintiffs are alleging that Amplitude used the information for its own purposes—which is conduct plausibly alleged to be beyond the scope of Plaintiffs’ consent. Thus, because Plaintiffs have sufficiently alleged that they suffered a concrete and particularized privacy injury, they have Article III standing to assert their claims. For the reasons explained in greater detail below, the motion to compel arbitration is granted. Thus, the remainder of Amplitude’s motion to dismiss is denied as moot. II. MOTION TO COMPEL ARBITRATION For the following reasons, the motion to compel arbitration is granted. A. Equitable Estoppel Amplitude is entitled to enforce the arbitration agreement against Plaintiffs under the doctrine of equitable estoppel. Notwithstanding the delegation clause contained in the arbitration agreement, “[t]he court, not the arbitrator, decides questions of arbitrability involving judicial doctrines and non-signatories.” Nutanix, Inc. v. Tessell, Inc., No. 24-cv-01729-AMO, 2025 WL 793652, at *4 (N.D. Cal. Mar. 12, 2025) (citing Kramer v. Toyota Motor Corp., 705 F.3d 1122, 1127 (9th Cir. 2013)); see also Young v. ByteDance, Inc., 700 F. Supp. 3d 808, 813 (N.D. Cal. 2023) (“[I]t’s not clear how a nonparty to an arbitration agreement could ever invoke a

2 Amplitude’s unopposed request for judicial notice (Dkt. No. 31) is granted, as these documents were incorporated by reference in Plaintiffs’ complaint. delegation provision when seeking to compel arbitration based only on equitable estoppel.”). Under California law, “[w]hen a nonsignatory seeks to enforce an arbitration clause, the doctrine of equitable estoppel applies in two circumstances: (1) when a signatory must rely on the terms of the written agreement in asserting its claims against the nonsignatory or the claims are intimately founded in and intertwined with the underlying contract, and (2) when the signatory alleges substantially interdependent and concerted misconduct by the nonsignatory and another signatory and the allegations of the interdependent misconduct are founded in or intimately connected with the obligations of the underlying agreement.” Kramer, 705 F.3d at 1128-29 (cleaned up). Both circumstances apply. To determine whether a plaintiff’s claims are intimately founded in and intertwined with the terms of the written agreement, courts look at “the relationship between the parties and their connection to the alleged violations.” Herrera v. Cathay Pac. Airways Ltd., 104 F.4th 702, 707 (9th Cir. 2024) (quotation omitted). “The purpose behind equitable estoppel is to prevent a party from ‘relying on an agreement for one purpose while disavowing the arbitration clause of the agreement.’” Bender v. Twilio Inc., No. 24-cv-04914-AMO, 2025 WL 2308484, at *5 (N.D. Cal. Aug. 11, 2025) (quoting Goldman v. KPMG, LLP, 92 Cal. Rptr. 3d 534, 551 (Ct. App. 2009)). Thus, the Court considers whether Plaintiffs claims are “fully viable without reference to” the terms of the agreement. Goldman, 92 Cal. Rptr. 3d at 551. Plaintiffs’ theory of liability is that DoorDash’s SDK transmitted their personal information to Amplitude without Plaintiffs’ consent. “Each claim requires [Plaintiffs] to plead (and ultimately prove) that [they] did not consent to [Amplitude’s] interception.” Perry-Hudson v. Twilio, Inc., No. 24-cv-03741-VC, 2024 WL 4933332, at *2 (N.D. Cal. Dec. 2, 2024). But DoorDash’s Privacy Policy expressly discusses the manner by which “DoorDash may provide or disclose Personal Information” to third-parties. (Dkt. No. 30-5 at 7.) Therefore, because consent is an element of each claim, how the policy discusses the disclosure of information to third- parties “is [] critical to the issue of consent.” Bender, 2025 WL 2308484, at *6. The second circumstance applies as well. This case involves allegations of interdependent and concerted misconduct by Amplitude and DoorDash. Plaintiffs allege in their complaint that Amplitude “contracted with DoorDash to provide its SDK to be embedded in the DoorDash food delivery app,” and that “Amplitude designed the SDK so that Amplitude could collective sensitive consumer data from consumers, including DoorDash users, despite Amplitude not having their consent to collect such data.” (Compl. ¶ 21.) As Plaintiffs explain, “[t]he problem with Amplitude is that consumers do not know that by interacting with an app which has embedded Amplitude’s SDK that their sensitive data is being surreptitiously siphoned off by an unknown third party.” (Id. ¶ 22.) That is because “[c]onsumers are never informed about Amplitude’s SDK being embedded into the app” and “they never consent to Amplitude’s data collection practices.” (Id.) By Plaintiffs’ own admissions, DoorDash and Amplitude entered into an agreement to embed Amplitude’s SDK in DoorDash’s app, which enabled Amplitude to intercept and collect Plaintiffs’ sensitive data. And it was DoorDash’s failure to inform consumers about the existence of the SDK (and to obtain their consent) that gave rise to the allegedly surreptitious and unlawful practice. Thus, because Amplitude’s misconduct was facilitated by, and would not have been possible without, DoorDash, the two entities’ misconduct is interdependent. Additionally, Plaintiffs’ allegations demonstrate that the interdependent misconduct is connected to the obligations contained in DoorDash’s Privacy Policy, which is expressly incorporated into DoorDash’s Terms & Conditions—the broader agreement containing the arbitration provision. Core to Plaintiffs’ theory is that, “[w]hen enabling location services within an app—for example a dating app or a shopping app that necessarily requires the consumer to share his or her location with the app—the consumer grants consent for only the mobile app to use his or her location.” (Id. ¶ 23 (emphasis in complaint).) And “[i]n the case of DoorDash, consumers are not informed by DoorDash, Amplitude, or anyone else that Amplitude’s SDK is collecting their geolocation information and In-App Activity, nor are consumers prompted to grant Amplitude permission to access or collect any data whatsoever.” (Id. ¶ 24.) Thus, “because [Plaintiffs are] asserting that [they] did not consent for [their] data to be shared with [Amplitude], and those assertions form the bases of [their] privacy claims, [their] allegations of misconduct are intimately connected with the obligations [DoorDash] imposed on itself in the Privacy Policy related to obtaining consent and the scope of any disclosure of data.” Perry- Hudson, 2024 WL 4933332, at *3. In that regard, to determine the merits of Plaintiffs’ claims, it will be necessary to look to the Privacy Policy. This is not an arbitration-specific defense, but instead, is an application of the general equitable principle of contract law to the arbitration context. The “overriding concern in equitable estoppel cases” is fairness. Ballesteros v. Ford Motor Co., 331 Cal. Rptr. 3d 232, 249 (Ct. App. 2025), aff’d on other grounds, 570 P.3d 857 (Cal. 2025). “[T]he point of equitable estoppel is that the purchaser—although not expecting at the time of contracting to have to arbitrate with a nonsignatory—should thereafter reasonably expect to arbitrate if it decides to sue the nonsignatory on a claim clearly tethered to the contract and there exists a sufficient relationship between the nonsignatory and a signatory.” Id. (citation omitted). As detailed above, it would not be fair to let Plaintiffs avoid the effect of their arbitration agreement with DoorDash by suing only Amplitude, when the complaint is directed toward conduct in which DoorDash and Amplitude allegedly engaged in concert, and the claims are intertwined with, and indeed rely upon, the absence of disclosures in DoorDash’s Privacy Policy. Under the doctrine of equitable estoppel, Plaintiffs are bound to arbitrate with Amplitude, based on their agreement to arbitrate with DoorDash. B. Unconscionability Plaintiffs also argue that even if Amplitude can enforce the arbitration provision as a nonsignatory, the agreement to delegate the issue of enforceability to the arbitrator is unconscionable, as is the underlying arbitration agreement. To analyze unconscionability as it applies to a delegation clause, courts “must be able to interpret the provision in the context of the agreement as a whole, which may require examining the underlying arbitration agreement as well.” Bielski v. Coinbase, Inc., 87 F.4th 1002, 1012 (9th Cir. 2023). “[T]he party asserting unconscionability as a defense to the enforcement of the arbitration agreement . . . bears the burden of proving unconscionability.” Ronderos v. USF Reddaway, Inc., No. 21-cv-55685, 2024 WL 3894525, at *3 (9th Cir. Aug. 22, 2024). Plaintiffs have not carried their burden. Unconscionability requires both a “procedural” and “substantive” component, which are evaluated on a sliding scale. “[T]he more substantively oppressive the contract term, the less evidence of procedural unconscionability is required to come to the conclusion that the term is unenforceable, and vice versa.” Armendariz v. Found. Health Psychcare Servs., Inc., 6 P.3d 669, 690 (Cal. 2000). The arbitration agreement, including the delegation provision, has minimal procedural unconscionability. Although the agreement carries several hallmarks of a contract of adhesion— i.e., it is a standardized contract, drafted by the party with superior bargaining power, that allows the individual to only accept or reject it—users are provided with the opportunity to opt out of the arbitration agreement. See, e.g., Circuit City Stores, Inc. v. Ahmed, 283 F.3d 1198, 1199 (9th Cir. 2002) (finding that individual was “not presented with a contract of adhesion because he was given the opportunity to opt-out . . . by mailing in a simple one-page form”). Additionally, the record does not show that the agreement involved significant surprise. Although DoorDash reserves the right to unilaterally modify the terms of the agreement, the agreement requires that notice be provided as to “any material changes” to the terms. (Dkt. No. 36-3 at 4.) The record does not indicate that DoorDash has repeatedly done so since Plaintiffs agreed to its terms (see, e.g., Dkt. No. 36-1 (“Cramer Decl.”) ¶¶ 15, 33), in a manner that renders it oppressive, see Merkin v. Vonage America Inc., No. 13-cv-08026, 2024 WL 457942, at *7 (C.D. Cal. Feb. 3, 2024), rev’d on other grounds, 639 F. App’x 481 (9th Cir. 2016). Similarly, the agreement does not have a high degree of substantive unconscionability. First, it is not substantively unconscionable to allow Amplitude to enforce the agreement as a nonsignatory, since the claims Plaintiffs are asserting clearly fall within the scope of the arbitration agreement. Additionally, the “batch arbitration provision” at issue in this case is not unconscionable under Heckman v. Live Nation Entertainment, Inc., 120 F.4th 670 (9th Cir. 2024). In Heckman, the batching provision was found unconscionable because it used “bellwether cases” to bind parties who had not had any prior opportunity to be heard. Id. at 684. DoorDash’s batch arbitration provision does no such thing. By contrast, the agreement provides: [I]n the event 100 or more similar arbitration demands against DoorDash, presented by or with the assistance or involvement of the same law firm or organization, are submitted to an arbitration provider selected in accordance with the rules described above within a 30-day period: (A) the parties shall cooperate to group the arbitration demands into randomized batches of no more than 100 demands per batch (plus, to the extent there are fewer than 100 arbitration demands left over after the batching described above, a final batch consisting of the remaining demands); (B) claimants’ counsel shall organize and present the batched demands to the arbitration provider in a format as directed by the arbitration provider; (C) the arbitration provider shall provide for resolution of each batch as a single arbitration with one set of filing and administrative fees and one arbitrator assigned per batch; and (D) the arbitration provider shall send one set of disclosures per batch and will set up one Arbitration Management Conference per batch. (Dkt. No. 36-4 at 22.) In effect, DoorDash’s provision facilitates the efficient coordination of cases so that they may be heard together. However, the agreement expressly states that rulings “shall be binding only among the parties and shall have no preclusive effect in any other arbitration or other proceeding involving a different party.” (Id. at 21.) Thus, each party still has an opportunity to be heard. Finally, the asymmetrical effects of certain terms in the appeal provision are insufficient, without more, to make this agreement highly substantively unconscionable. Although those terms may be one-sided in their consequences, substantive “unconscionability in this context requires a one-sided result along with the absence of a justification for it.” Ramirez v. Charter Commc’ns, 551 P.3d 520, 535 (Cal. 2024). Here, awards exceeding $100,000 and awarding injunctive relief are significant, and there are ample reasons why limiting appellate review to the proceedings may be justified. In sum, Plaintiffs have failed to carry their burden to demonstrate that the delegation provision of the arbitration agreement is unenforceable as unconscionable. Accordingly, any other disputes about the agreement’s enforceability are validly delegated to the arbitrator. Conclusion. Based on the foregoing reasons, the motion to dismiss for lack of Article III standing is denied, and the remainder of that motion is denied without prejudice pending arbitration. The motion to compel arbitration is granted, and the case is stayed pending arbitration. The parties are ordered to file a joint status report every 120 days until the arbitration is resolved, and within 14 days of the proceeding’s completion.

IT IS SO ORDERED. Dated: September 2, 2025

RITA F. LIN United States District Judge