Connie Johnson v. Beyond, Inc., et al.

Opinion

CONNIE JOHNSON, No. 2:25-cv-03327-DJC-CSK Plaintiff, v. ORDER BEYOND, INC., et al., Defendants. Plaintiff Connie Johnson filed a putative class action in the Solano County Superior Court alleging Defendants Overstock.com and Shopify, Inc. violated two criminal statutes — California’s Invasion of Privacy Act and the Computer Data Access and Fraud Act — as well as the right to privacy under the California Constitution. After removal to this Court, Defendants now move to compel arbitration of Plaintiff’s claims and request a stay pending arbitration. For the reasons discussed below, Defendants’ Motion to Compel Arbitration is GRANTED. //// //// //// //// //// As the facts and procedural history are known to the parties, the Court will not recount it except as necessary. After removal to this Court, Defendants filed a Motion to Compel Arbitration (Mot. (ECF No. 18)) on January 22, 2026. The Motion is fully briefed. (Opp’n (ECF No. 19); Reply (ECF No. 20).) The Court held oral argument on March 19, 2026, and took the matter under submission. (ECF No. 21.) The Federal Arbitration Act (“FAA”) governs arbitration agreements. 9 U.S.C. § 2. The FAA affords parties the right to obtain an order directing that arbitration proceed in the manner provided for in the agreement. Id. § 4. Under the FAA, federal courts must apply state-law principles that govern the formation of contracts when determining whether the specific dispute between the parties is one that they agreed to arbitrate. Chabolla v. ClassPass Inc., 129 F.4th 1147, 1154 (9th Cir. 2025). To decide on a motion to compel arbitration, a court must determine: (1) whether a valid agreement to arbitrate exists and, if it does, (2) whether the agreement encompasses the dispute at issue. Boardman v. Pac. Seafood Grp., 822 F.3d 1011, 1017 (9th Cir. 2016). Arbitration is a matter of contract, and the FAA requires courts to honor parties’ expectations. AT&T Mobility LLC v. Concepcion, 563 U.S. 333, 351 (2011) (citing Rent- A-Center, W., Inc. v. Jackson, 561 U.S. 63, 67–69 (2010)). However, parties may use general contract defenses to invalidate an agreement to arbitrate. See id. at 339. Thus, a court should order arbitration of a dispute only where satisfied that neither the agreement's formation nor its enforceability or applicability to the dispute is at issue. See Granite Rock Co. v. Int'l Bhd. of Teamsters, 561 U.S. 287, 299–300 (2010). “Where a party contests either or both matters, ‘the court’ must resolve the disagreement.” Id. at 299. If a valid arbitration agreement encompassing the dispute exists, arbitration is mandatory. See Dean Witter Reynolds, Inc. v. Byrd, 470 U.S. 213 (1985). Under section 3 of the FAA, a court, “upon being satisfied that the issue involved . . . is referable to arbitration under such an agreement, shall on application of one of the parties stay the trial of the action until such arbitration has been had in accordance with the terms of the agreement . . . .” 9 U.S.C. § 3. The party seeking to compel arbitration bears the burden of proving by a preponderance of the evidence the existence of a valid agreement to arbitrate. See Ashbey v. Archstone Prop. Mgmt., Inc., 785 F.3d 1320, 1323 (9th Cir. 2015). In resolving a motion to compel arbitration, “[t]he summary judgment standard [of Federal Rule of Civil Procedure 56] is appropriate because the district court's order compelling arbitration ‘is in effect a summary disposition of the issue of whether or not there had been a meeting of the minds on the agreement to arbitrate.’” Hansen v. LMB Mortg. Servs., Inc., 1 F.4th 667, 670 (9th Cir. 2021) (quoting Par-Knit Mills, Inc. v. Stockbridge Fabrics Co., 636 F.2d 51, 54 n.9 (3d Cir. 1980)). Under this standard of review, “[t]he party opposing arbitration receives the benefit of any reasonable doubts and the court draws reasonable inferences in that party's favor, and only when no genuine disputes of material fact surround the arbitration agreement's existence and applicability may the court compel arbitration.” Smith v. H.F.D. No. 55, Inc., No. 2:15- cv-01293-KJM-KJN, 2016 WL 881134, at *4 (E.D. Cal. Mar. 8, 2016). A material fact is genuine if “the evidence is such that a reasonable jury could return a verdict for the nonmoving party.” Hanon v. Dataproducts Corp., 976 F.2d 497, 500 (9th Cir. 1992) (quoting Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 248 (1986)). Conversely, “[w]here the record taken as a whole could not lead a rational trier of fact to find for the nonmoving party, there is no ‘genuine issue for trial.’” Id. (quoting Matsushita Elec. Indus. Co. v. Zenith Radio Corp., 475 U.S. 574, 587 (1986)). I. Claims Against Overstock The Court will grant the motion to compel arbitration as to Defendant Overstock. In her Opposition brief, Plaintiff states that she “opposes the motion to the extent it seeks to compel arbitration of Plaintiff’s claims against [Defendant] Shopify and to stay those claims pending any arbitration.” (Opp’n (ECF No. 19) at 4.) Elsewhere, Plaintiff asserts that she “does not concede” the formation, validity, or enforceability of her arbitration agreement with Overstock (id. at 7), but she does not develop this argument in any substantive fashion and focuses her brief only on her claims against Shopify. See Massimo v. Saul, 817 F. App’x 411, 413 (9th Cir. 2020) (unpublished) (finding waiver where party offered “cursory argument without substantive analysis”); see also Leva v. BMW of N.A., LLC, No. 1:20-cv-01102-NONE- JLT, 2021 WL 4033208, at *1 (E.D. Cal. Sept. 3, 2021) (granting unopposed motion to compel arbitration after briefly examining relevant authorities). In sum, Overstock has adequately established that Plaintiff both consented to an arbitration agreement when she enrolled in email communications on April 10, 2024 and July 4, 2024, and failed to exercise her right to opt-out. (Love Decl. (ECF No. 18-1) ¶¶ 7, 9); see Oberstein v. Live Nation Ent., Inc., 60 F.4th 505, 515 (9th Cir. 2023) (providing that a valid contract exists where the website provides reasonably conspicuous notice of the terms and a user unambiguously manifests agreement by, for example, clicking a button). The arbitration agreement also contains a clear and unmistakable delegation clause, which provides that “[t]he arbitrator shall have exclusive authority to resolve any Dispute, including, without limitation, disputes regarding the interpretation or application of the Arbitration Agreement, including the enforceability, revocability, scope, or validity of the Arbitration Agreement or any portion of the Arbitration Agreement.” (Love Decl. Ex. 2 at 12.)1 Plaintiff does not meaningfully rebut the applicability of the delegation clause as to Overstock. (Opp’n at 7 (conceding that the Federal Arbitration Act “governs Plaintiff’s arbitration agreement with Overstock”).) Plaintiff has also not challenged the delegation clause on any unconscionability grounds. Accordingly, the Motion to Compel Arbitration as to Overstock is GRANTED.

1 The delegation clause also provides that disputes relating to any claims for class-wide relief are exempt and should be decided by a court of competent jurisdiction. (Love Decl. Ex. 2 at 12.) II. Claims Against Shopify The parties disagree whether Plaintiff’s claims against Shopify are intertwined with Overstock’s Terms and Conditions, which contain the arbitration agreement and privacy policy, such that Shopify, a nonsignatory, may also compel arbitration. Plaintiff contends that her claims against Shopify are distinct from those against Overstock because the Shopify claims are “grounded in statutory and common law duties, not in any contract.” (Opp’n at 9.) In rebuttal, Shopify asserts it may enforce the arbitration agreement as a nonsignatory because the doctrine of equitable estoppel applies. (Reply at 7.) As explained below, the Court agrees with Shopify. A. Equitable Estoppel The parties disagree whether the doctrine of equitable estoppel applies such that Plaintiff’s claims must go to arbitration. (See generally Mot., Opp’n.)2 Where a nonsignatory seeks to enforce an arbitration clause, the doctrine of equitable estoppel applies in two circumstances: (1) when a signatory must rely on the terms of the written agreement in asserting its claims against the nonsignatory or the claims are “intimately founded in and intertwined with” the underlying contract, Goldman v. KPMG LLP, 173 Cal. App. 4th 209, 221 (2009) (quoting Metalclad Corp. v. Ventana Env’t Org. P'ship, 109 Cal. App.4th 1705, 1713 (2003)), and (2) when the signatory alleges substantially interdependent and concerted misconduct by the nonsignatory and another signatory and “the allegations of interdependent misconduct [are] founded in or intimately connected with the obligations of the underlying agreement.” Goldman, 173 Cal. App. 4th at 219. Shopify argues that this case satisfies both prongs of the Goldman test, (Mot. at 20), but Plaintiff maintains that

2 The Terms and Conditions specify that Utah law applies to disputes arising from the parties’ agreement. That provision states “[i]f you access the Sites from anywhere in the United States or Canada, you agree that the laws of the State of Utah, USA, without regard to principles of conflict of laws, will govern these Terms and any dispute of any sort that might arise between you and [Overstock].” (Terms & Conditions at 9.) However, both parties cite to and generally rely on California law in their briefing and have not identified any particular differences between Utah and California law such that the outcome would be different. The Court therefore applies California law to this case. if her claims against Shopify can stand independently or if the alleged collusion between Shopify and Overstock does not implicate any contractual duty, then “there is no inequity in refusing to compel arbitration with a nonsignatory,” (Opp’n at 5–6). 1. Prong One of the Goldman Test The first Goldman prong evaluates whether a plaintiff’s claims are “intimately founded in and intertwined with” the contract that contains the arbitration clause. Houghton v. Leshner, No. 22-cv-07781-WHO, 2024 WL 5154071, at *5 (N.D. Cal. Nov. 25, 2024); see also Kramer v. Toyota Motor Corp., 705 F.3d 1122, 1128 (9th Cir. 2013). Plaintiff asserts that she never signed or agreed to any contract with Shopify, and because Shopify is neither mentioned in the Terms and Conditions nor expressly identified as a third-party beneficiary, she cannot be compelled to arbitrate her claims against Shopify. (Opp’n at 7–8.) On the other hand, Shopify contends the Terms and Conditions of the arbitration agreement expressly cover Plaintiff’s claims against Shopify, which ultimately concern Overstock and Shopify’s alleged misuse of her data. (Reply at 10 (“Simply put, it is impossible to adjudicate Plaintiff’s claims against Shopify without passing on the validity and scope of Overstock’s Term and Privacy policy.”).) Plaintiff’s claims against Shopify are essentially threefold: that Shopify (and Overstock) (1) installed a pen register or trap and trace device (“Tracker”) without first obtaining a court order in violation of the California Invasion of Privacy Act, Penal Code §§ 630–638; (2) knowingly accessed and without permission altered and used Plaintiff’s and Class Members’ data and computer systems in violation of California’s Computer Data Access and Fraud Act, Penal Code § 502; and (3) violated Plaintiff’s and Class Members’ reasonable expectation of privacy by the foregoing unauthorized acts in violation of Article 1, section 1, of the California Constitution. (See generally i. The Contents of the Terms & Conditions and Privacy Policy Plaintiff’s claims against Shopify essentially derive from her use of Overstock’s website and applications. Overstock expressly informed Plaintiff about — and obtained her consent to — such potential use of her personal data, not only by Overstock but also by unnamed third parties such as Shopify. The Terms and Conditions and incorporated Privacy Policy plainly advertise this potential use in several ways. Beginning with the arbitration provision in Overstock’s Terms & Conditions, it provides that, “[Y]ou and [Overstock] agree that any disagreement, controversy, or claim between you and [Overstock] arising out of or relating in any way to your access to and use of the Sites . . . will be resolved by binding arbitration[.]” (Terms & Conditions (ECF No. 18-3) at 9.) First, the Terms & Conditions inform users that Overstock “may disclose any Content or electronic communication of any kind . . . if such disclosure is necessary or appropriate to operate the [web]Sites.” (Id. at 7.) Next, the incorporated Privacy and Security Policy (“Privacy Policy”) (ECF No. 18-4) explains that Overstock “may disclose your personal information to a third party for a business purpose, or sell or share your personal information, subject to your right to opt out of those sales as outlined herein.” (Privacy Policy at 17.) Overstock also identifies different types of third parties:

We share your personal information with the following categories of third parties: • Service Providers (legal entities that “process information on behalf of a business and to which the business discloses a consumer’s personal information for a business purpose pursuant to a written contract”)

• Contractors (legal entities to whom the business makes available a consumer’s personal information for a business purpose) (Id.) These third parties also include “data aggregators.” (Id. at 18.) Overstock also informs prospective users that “[e]ntering the Sites constitutes [Plaintiff’s] acceptance and agreement to the terms contained in this Privacy Policy. If you do not agree with the terms set forth in this Privacy Policy, please do not enter the Sites.” (Id. at 2.) The Privacy Policy states that “personal data” information is collected directly from users, indirectly from users, through observing users’ actions on the sites, and through “collection from third parties.” (Id. at 2, 5.) The personal data collected from users such as Plaintiff includes the following broad categories: • Identifiers; • Personal information; • Protected classification characteristics; • Commercial information; • Internet or other similar network activity; • Geolocation data; • Inferences drawn from other personal information; and • Sensitive personal information (if expressly submitted by consumer) (Id. at 3–5.) The Privacy Policy also explains Overstock’s process for collecting such personal data through “tracking pixels/web beacons, cookies and or other technologies to receive and store certain types of information,” and, through the use of third-party cookies, Overstock also “allow[s] third-party companies to collect non- personally identifiable information when [users] visit the Sites . . . [and] [t]hese parties may use a cookie or a third party web beacon, or other technologies, to collect this information.” (Id. at 6.) Importantly, the Privacy Policy then provides users with a link and instructions on how to opt out of third-party vendors’ cookies. (Id.) Additionally, the Privacy Policy also provides extensive information on how to “Request to Opt Out of Sale or Sharing of Personal Information,” how to “Request to Receive or Correct Information,” and how to “Request to Delete Personal Information.” (Id. at 18–20.) Users are also offered several methods for exercising these privacy rights, including through a link to a webpage (https:///www.bedbathandbeyond.com/privacyrequest), a phone number to call, and an email address for email requests (privacy@beyond.com). Against this factual backdrop, Plaintiff’s causes of action directly implicate the contents of the Terms & Conditions and Privacy Policy as the Court discusses next. ii. Plaintiff’s Claims are Intertwined with the Terms & Conditions and Privacy Policy Plaintiff’s claims in the FAC expressly concern Overstock’s and Shopify’s alleged misuse of her personal data and directly implicate the Terms & Conditions and Privacy Policy. For example, Plaintiff alleges that Shopify “does not inform consumers that: • (i) Shopify will intercept communications that consumers believe are being sent exclusively to Overstock; • (ii) its software code is causing their devices to connect to Shopify’s computer servers; • (iii) Shopify is placing tracking cookies on consumers’ computers; • (iv) its software code is rendering the payment forms that are displayed to consumers; • (v) the sensitive information in the payment forms will be sent to Shopify; • (vi) sensitive information not expressly input by the consumer—such as IP address, operating system, geolocation data, and item(s) purchased—will also be collected from the consumer by Shopify; • (vii) Shopify will indefinitely store that sensitive information; • (viii) Shopify will use consumers’ information to assign risk scores to consumers, which could subsequently be communicated to other merchants and used to deny consumers’ future payment attempts; • (ix) Shopify will track consumers’ behavior over one million websites; • (x) Shopify will make consumers’ sensitive information available to any of its millions of customers who will accept payment—or have already accepted payment—from those consumers; and • (xi) Shopify will share consumer data with third-parties, such as Stripe, Inc. and MaxMind, Inc.” (FAC ¶ 79.) But as detailed above, by agreeing to the Terms & Conditions and the Privacy Policy, Plaintiff appears to have been on notice that her personal data was subject to collection and distribution through trackers and cookies including third- party cookies. She was also informed that Overstock used service providers, contractors, and data aggregators as part of its business operations (Privacy Policy at 10, 17–18), and that Overstock “may use, sell, share, or disclose the personal information we collect for . . . business purposes” with these entities, (id. at 9). At the very least, the Terms & Conditions and the Privacy Policy will be squarely at issue in the claims against both Shopify and Overstock. Plaintiff relies on SolarPark Korea Company, Limited v. Solaria Corporation for the statement that the Federal Arbitration Act “does not authorize a court to compel arbitration of issues or parties not covered in the arbitration agreement.” No. 23-cv- 01181-AMO, 2023 WL 4983159, at *13 (N.D. Cal. Aug. 2, 2023). However, in SolarPark, the nonsignatory entity in that case was not seeking to compel arbitration against the plaintiff whereas here, Shopify is seeking just that. Additionally, the nonsignatory entity in SolarPark was not involved with the signatory defendant until years after the arbitration agreements at issue between the contracting parties were signed. 2023 WL 4983159, at *1 (setting out factual history of the relationship between the parties and nonsignatory entity). In contrast, here, Plaintiff was notified at the time she agreed to the Terms & Conditions and the Privacy Policy that Overstock worked with various business partners, including service providers, contractors, and data aggregators, to use and share consumers’ data. (See generally Love Decl.) Moreover, Plaintiff’s statement that her claims “are not intertwined with any contract” is similarly incorrect because her claims directly relate to the potential customer data uses and collection activities described in the Terms & Conditions and Privacy Policy. Thus, SolarPark is distinguishable. So too with Goldman. There, the court found that the doctrine of equitable estoppel did not apply because the contractual obligations in the operating agreements were unrelated to the plaintiffs’ claims against the nonsignatory accountants and lawyers. 173 Cal. App. 4th at 214. Unlike in Goldman, here, the gravamen of Plaintiff's case is that Overstock and Shopify allegedly misused her personal customer data, but the scope of this potential data use is extensively discussed in the Privacy Policy, which Plaintiff consented to. “The sine gua non for allowing a nonsignatory to enforce an arbitration clause based on equitable estoppel is that the claims the plaintiff asserts against the nonsignatory are dependent on or inextricably bound up with the ... obligations of the agreement containing the arbitration clause.” Id. at 213-14. This case meets that test. A final brief comment: Plaintiff stresses that her complaint does not rely on any contractual terms and that arbitration is inappropriate because this case is “grounded in statutory and common law duties.” (Opp’n at 9.) However, Plaintiff's allegations that she did not consent to Defendants’ “secretly capturing user data” and that she never agreed to share information with Shopify is contradicted by the plain advertisement of the Privacy Policy that such data is captured, used, and shared. Accordingly, because the Court concludes that prong one of the Goldman test is satisfied, equitable estoppel applies. The Court need not address the second prong. See Murphy v. DirecTV, Inc., 724 F.3d 1218, 1230 (9th Cir. 2013) (observing equitable estoppel applies when either of the two Goldman prongs are satisfied). For the foregoing reasons, IT IS HEREBY ORDERED THAT Defendants’ Motion to Compel Arbitration (ECF No. 18) is GRANTED. This matter will be STAYED pending resolution of the arbitration. Defendants shall file a notice of completion with the Court within thirty (30) days of the completion of arbitration. . Dated: April 20, 2026 “Danel A Cob bnetto— THE HONORA' DANIEL J. CALABRETTA UNITED STATES DISTRICT JUDGE