Chien v. Bumble Inc.

CourtDistrict Court, S.D. California
DecidedNovember 17, 2022
Docket3:22-cv-00020
StatusUnknown

This text of Chien v. Bumble Inc. (Chien v. Bumble Inc.) is published on Counsel Stack Legal Research, covering District Court, S.D. California primary law. Counsel Stack provides free access to over 12 million legal documents including statutes, case law, regulations, and constitutions.

Bluebook
Chien v. Bumble Inc., (S.D. Cal. 2022).

Opinion

1 2 3 4 5 6 7 8 UNITED STATES DISTRICT COURT 9 SOUTHERN DISTRICT OF CALIFORNIA 10 RYAN CHIEN, individually and on behalf Case No.: 3:22-cv-00020-GPC-NLS of all others similarly situated, 11 JUDGMENT AND ORDER: Plaintiffs, 12 v. (1) GRANTING IN PART 13 DEFENDANTS’ MOTION TO BUMBLE INC., BUZZ HOLDINGS L.P., 14 DISMISS FOR LACK OF PERSONAL and BUMBLE TRADING LLC, JURISDICTION 15 Defendants. 16 (2) GRANTING DEFENDANTS’ MOTION TO COMPEL 17 ARBITRATION 18 [ECF No. 24] 19

20 Before the Court is a Motion to Dismiss, or in the alternative to Compel Arbitration, 21 Plaintiff Ryan Chien’s First Amended Complaint, filed by Defendants Bumble Inc., Buzz 22 Holdings L.P., and Bumble Trading LLC (collectively referred to as “Bumble” except 23 where otherwise indicated). (ECF No. 24.) For the reasons set forth below, the Court 24 GRANTS IN PART Defendants’ motion to dismiss for lack of personal jurisdiction and 25 GRANTS Defendants’ motion to compel arbitration. 26

28 1 I. BACKGROUND 2 Plaintiff Ryan Chien filed his putative class action complaint against Bumble Inc. 3 and Buzz Holdings L.P. (Buzz Holdings) on November 24, 2021 in the Superior Court of 4 California. (ECF No. 1-2 at 7.1) Defendants Bumble Inc. and Buzz Holdings removed the 5 action to this Court on January 6, 2022. (ECF No. 1.) Chien amended his complaint in 6 April to include Bumble Trading LLC (Bumble Trading) as a defendant, (ECF No. 18), 7 after Bumble Inc. and Buzz Holdings challenged this Court’s jurisdiction in March. (ECF 8 No. 16.) 9 Chien’s operative First Amended Class Action Complaint (“Complaint” or “FAC”) 10 concerns several privacy-related torts. (See FAC ¶¶ 152-224.) The causes of action arise 11 from the allegedly unauthorized collection, use, and disclosure of users’ personally 12 identifiable information (“PII”) and biometric information. (Id. at ¶ 1.) The medium 13 through which these data were collected and used was an internet-based dating application 14 called Bumble (“App”). (See FAC ¶ 2.) The App is free to download on mobile or desktop 15 devices but has premium features available for purchase via subscription or in-app 16 purchases. (FAC ¶ 24; ECF Nos. 30-1 at 31; 16-3 at 2.) 17 “Bumble Trading . . . is responsible for decision making and marketing the . . . [A]pp 18 in the United States.” (ECF No. 30-1 at 6; see also ECF No. 24-2 at 2 (“Bumble Trading 19 LLC operates the Bumble App globally . . . .”).) Chien alleges that “Bumble Inc. directs 20 and controls the operations of [Bumble Trading],” (FAC ¶ 27), whereas Bumble denies 21 that either Bumble Inc. or Buzz Holdings have ever “owned, operated, or controlled the 22 app, or collected, stored, managed, used or disclosed Bumble app user information,” (ECF 23 Nos. 24-1 at 12, 16; 24-2 at 3). Bumble instead alleges that Bumble Inc. and Buzz Holdings 24 “are holding companies that do not conduct any operational activities in the United States.” 25 (ECF No. 24-1 at 16.) 26

27 1 Page numbers are based on the CM/ECF pagination. 28 1 The App is primarily used for dating and relationships, (FAC ¶¶ 2-3), though there 2 are different versions intended for establishing new friendships as well as for professional 3 networking, (FAC ¶ 50). Users create an account by providing PII including their name, 4 username, email address, mobile number, gender identity, date of birth, sexual preference, 5 photograph, geographic location, and various social media account information. (FAC ¶ 6 6.) In addition to uploading photographs to their profiles, users may share other personal 7 information with other users such as personal photographs as well as their “name, age, 8 education, smoking and drinking preferences, voting status, political preference, religious 9 beliefs[,] and zodiac sign.” (FAC ¶ 7.) As of March 2020 Bumble estimates that there 10 were “over 75,000 unique users of the Bumble app . . . associated with registrations in the 11 United States.” (ECF No. 1-3 at 2.) Chien estimates “[u]pon information and belief” that 12 Bumble generates “revenue from thousands of paying users [residing] in California,” 13 including the Southern District of California. (FAC ¶ 41.) 14 The Complaint alleges that Bumble “unlawful[ly] and intentional[ly] collect[ed] and 15 use[d] . . . users’ [PII], including biometric information . . . , without their consent and [had 16 a] subsequent unauthorized disclosure of that information in violation of state law.” (FAC 17 ¶¶ 1, 12.) The Complaint identifies the types of information it alleges Bumble collected 18 and sometimes shared for profit: device and payment information, (FAC ¶¶ 8, 61); click 19 statistics, (FAC ¶ 8, 61); geolocation, (FAC ¶ 10); and PII and biometric information as 20 described above, (see FAC ¶¶ 11, 60-68). The Complaint alleges that much of this 21 information qualifies as “personal information” as defined by the California Consumer 22 Protection Act. (FAC ¶ 62; see also ECF No. 30-1 at 54.) Bumble allegedly “deriv[es] 23 significant benefit from customers’ PII” by “collect[ing], retain[ing], and us[ing] that data 24 to maximize profits through predictive marketing and other targeted marketing practices.” 25 (FAC ¶ 59.) 26 27 28 1 In addition to collecting and using the above-described information allegedly 2 without adequate user consent, (FAC ¶¶ 79-88), the Complaint details a data breach2 from 3 March 2020, (see FAC ¶¶ 101-11). With relative ease a San Diego-based research group3 4 was able to access “Bumble’s entire user database of nearly 100 million users and bypassed 5 paying for the app’s premium services by finding and exploiting the app’s security 6 vulnerabilities.” (FAC ¶101.) The group “was able to reverse engineer [Bumble’s] web 7 [Application Program Interface (“API”)] to intercept all of its incoming and outgoing” 8 communications. (FAC ¶¶ 102-04.) Because Bumble’s API allegedly did not conduct 9 security checks that are typical in the industry, the group was able to “repeatedly probe the 10 server for information on Bumble users.” (FAC ¶¶ 103-04.) “The leaked data on each user 11 included their public profile descriptions . . . .”; their “activity on the app, . . . sexual 12 orientation and their ‘wish’—the types of people they are looking to date based on their 13 ‘swiping’ record”; as well as their pictures and Facebook account information if connected 14 to their Bumble account. (FAC ¶¶ 106-07.) The Complaint also alleges that whether a 15 user was “online in real-time, and their distance in miles from the person accessing the 16 data” would have been accessible in the breach. (FAC ¶ 108.) 17 The group notified Bumble of the App’s vulnerabilities four times between March 18 2020 and July 2020 but did not hear back until they asked about publishing the information. 19 (FAC ¶ 109.) At least until November 1 the group reported that all the vulnerabilities still 20

21 2 At the motion hearing, Bumble challenged whether “data breach” is an appropriate term for the alleged 22 events. (ECF No. 34 at 6 (Transcript).) Although unclear at this juncture whether any users’ data were 23 leaked to individuals with bad intentions, “data breach” appears to be the correct legal terminology given the data were “subject to use and misuse by” at least the researchers. See Data Breach, Black’s 24 Law Dictionary (11th ed. 2019) (“A failure in cybersecurity whereby sensitive information stored in a computer or in the cloud is subject to use and misuse by those who should have no access to it.”). 25 3 The Complaint provides a hyperlink to an online Forbes article describing the data breach as well as 26 the researchers that discovered the App’s vulnerability. (FAC ¶ 104 n.21). Thomas Brewster, Bumble Vulnerabilities Put Facebook Likes, Locations and Pictures of 95 Million Daters at Risk, Forbes (Nov.

Free access — add to your briefcase to read the full text and ask questions with AI

Related

Milliken v. Meyer
311 U.S. 457 (Supreme Court, 1941)
International Shoe Co. v. Washington
326 U.S. 310 (Supreme Court, 1945)
Keeton v. Hustler Magazine, Inc.
465 U.S. 770 (Supreme Court, 1984)
Calder v. Jones
465 U.S. 783 (Supreme Court, 1984)
Helicopteros Nacionales De Colombia, S. A. v. Hall
466 U.S. 408 (Supreme Court, 1984)
Dean Witter Reynolds Inc. v. Byrd
470 U.S. 213 (Supreme Court, 1985)
At&T Technologies, Inc. v. Communications Workers
475 U.S. 643 (Supreme Court, 1986)
First Options of Chicago, Inc. v. Kaplan
514 U.S. 938 (Supreme Court, 1995)
United States v. Patrick
248 F.3d 11 (First Circuit, 2001)
Goodyear Dunlop Tires Operations, S. A. v. Brown
131 S. Ct. 2846 (Supreme Court, 2011)
Al Alwi v. Obama
653 F.3d 11 (D.C. Circuit, 2011)
Mavrix Photo, Inc. v. Brand Technologies, Inc.
647 F.3d 1218 (Ninth Circuit, 2011)
Kathy Keeton v. Hustler Magazine, Inc.
682 F.2d 33 (First Circuit, 1982)
Sher v. Johnson
911 F.2d 1357 (Ninth Circuit, 1990)

Cite This Page — Counsel Stack

Bluebook (online)
Chien v. Bumble Inc., Counsel Stack Legal Research, https://law.counselstack.com/opinion/chien-v-bumble-inc-casd-2022.