background. Id. at 1020. So although the links are merely underscored, the presentation of the Terms & Conditions hyperlink provided reasonably conspicuous notice to Perry-Hudson.1 2. Twilio can enforce Perry-Hudson’s arbitration agreement with Keeps based on equitable estoppel. There are two circumstances in which a party can be equitably estopped from avoiding arbitration with a nonsignatory to the arbitration agreement:

1 In a post-hearing letter, Perry-Hudson appeared to abandon his factual argument that he was not presented with working hyperlinks to the Terms & Conditions and Privacy Policy and disavowed his desire to seek discovery on the issue of the formation of the arbitration agreement. The record, as it exists now, supports a conclusion that Perry-Hudson was presented with working hyperlinks. (1) when a signatory must rely on the terms of the written agreement in asserting its claims against the nonsignatory or the claims are intimately founded in and intertwined with the underlying contract, and (2) when the signatory alleges substantially interdependent and concerted misconduct by the nonsignatory and another signatory and the allegations of interdependent misconduct are founded in or intimately connected with the obligations of the underlying agreement. Kramer v. Toyota Motor Corp., 705 F.3d 1122, 1128–29 (9th Cir. 2013) (cleaned up). The first circumstance applies here: Perry-Hudson’s claims are intimately founded in and intertwined with the Terms & Conditions and the Privacy Policy. This inquiry boils down to whether the substance of Perry-Hudson’s claims against Twilio are so intertwined with Perry- Hudson’s agreement with Keeps that it would be unfair for Perry-Hudson to avoid arbitration. See Franklin v. Community Regional Medical Center, 998 F.3d 867, 875 (9th Cir. 2021). To determine whether equitable estoppel should apply, “we look at the relationship between the parties and their connection to the alleged violations.” Herrera v. Cathay Pacific Airways Ltd., 104 F.4th 702, 707 (9th Cir. 2024) (citing Franklin, 998 F.3d at 875) (cleaned up). The question is whether Perry-Hudson’s claims are “fully viable without reference to” the underlying agreement. See Goldman v. KPMG, LLP, 173 Cal. App. 4th 209, 230 (2009); see, e.g., Ma v. Golden State Renaissance Ventures, LLC, No. 3:21-CV-00856-WHO, 2021 WL 2190912, at *9 (N.D. Cal. May 31, 2021). Perry-Hudson’s claims are rooted in whether Twilio’s use of his personal information was unlawful, and those claims turn on whether Perry-Hudson consented to disclosure of his personal information to Twilio. Each claim requires Perry-Hudson to plead (and ultimately prove) that he did not consent to Twilio’s interception. But Keeps’s Privacy Policy discusses disclosure of personal information to third-party vendors. Exhibit A to Twilio’s Motion to Compel Arbitration, Dkt. No. 15-2, Previous Keeps Privacy Policy 2023.09.23 to 2024.05.12, at 2. This policy, which is incorporated into the Keeps Terms & Conditions, lays out how Keeps “collects, uses, and shares” information about its users. Id. Keeps repeatedly notes that it will obtain consent when sharing information “where legally required” or “to the extent required by applicable law.” Id. at 2. And Keeps says that it provides information to third-party vendors, but that when it does so, it “implement[s] contractual protections to limit their use of that information to help us provide our Service and support our interactions with you.” Id. Although the agreement was between Perry-Hudson and Keeps, the alleged misconduct here is connected to that agreement because it governed Perry-Hudson’s relationship with—and data-sharing to— Keeps. So, even though Perry-Hudson brings suit only against Twilio, his claims are intimately founded in and intertwined with his agreement with Keeps because consent is an element to each claim, and Twilio asserts that Perry-Hudson consented to having Keeps share his data to Twilio through his agreement to the Terms & Conditions. And while Perry-Hudson does not mention the Privacy Policy or the Terms & Conditions in his Complaint, parties may not plead around equitable estoppel. Franklin, 998 F.3d at 87; Herrera, 104 F.4th at 706–09; Ma, No. 3:21-CV- 00856-WHO, 2021 WL 2190912, at *9. The second circumstance in which a party can be equitably estopped from avoiding arbitration applies here as well: this case involves allegations of interdependent and concerted misconduct by Twilio and Keeps that is intimately connected with the obligations of the underlying agreement. Perry-Hudson alleges that he gave his health information to Keeps believing that the only use of that data would be to obtain a recommendation for a prescription hair growth medication. Compl. ¶ 17. He asserts that sending personal health information to a third-party vendor can violate the law, which he contends that Keeps knew because it received a letter from the government warning against that violation. Compl. ¶ 24. He alleges that, even after that warning, Keeps continued to disclose users’ personal health information to Twilio. Compl. ¶¶ 34–35. And he asserts that he did not know Twilio had access to his information. Compl. ¶ 51. He then alleges that those disclosures form the basis of the allegedly illegal interceptions performed by Twilio. Indeed, Perry-Hudson even says that the data-sharing agreement between Twilio and Keeps was an “agreement . . . to wiretap” his communications. Compl. ¶ 56. These are allegations of interdependent and concerted misconduct. They “also establish that [Perry-Hudson’s] claims against [Twilio] are intimately founded in and intertwined with the obligations imposed by the contract containing the arbitration clause.” Murphy v. DirecTV, Inc., 724 F.3d 1218, 1231 (9th Cir. 2013). Perry-Hudson is asserting that Twilio and Keeps made an agreement to permit Twilio to wiretap and intercept his data without his consent. And as noted above, the language in the Privacy Policy seems to speak directly to Keeps’s obligations with respect to Perry-Hudson’s data and his consent to sharing that data. So, in this case, because Perry-Hudson is asserting that he did not consent for his data to be shared with Twilio, and those assertions form the bases of his privacy claims, his allegations of misconduct are intimately connected with the obligations Keeps imposed on itself in the Privacy Policy related to obtaining consent and the scope of any disclosure of data. “The linchpin for equitable estoppel is equity—fairness.” Goldman, 173 Cal. App. 4th at 220 (quoting Grigson v. Creative Artists Agency, LLC, 210 F.3d 524, 528 (Sth Cir. 2000)) (cleaned up). Permitting Twilio to equitably enforce the arbitration agreement in this case would be fairer than permitting Perry-Hudson to skirt its agreement with Keeps by suing only Twilio based on allegations that center on Keeps’s disclosure of Perry-Hudson’s information to Twilio. Put another way: Perry-Hudson could have also sued Keeps on essentially the same set of allegations. And had he done so, the arbitration agreement would no doubt apply. Equitable estoppel thus prevents Perry-Hudson from sidestepping that agreement by bringing claims solely against Twilio. The motion to compel is granted, the motion to dismiss is denied as moot, and the case is stayed pending arbitration. See Smith v. Spizzirri, 601 U.S. 472, 478 (2024). The parties are ordered to file a joint status report every 120 days until the arbitration is terminated. If the parties prefer to avoid this obligation, they may stipulate to dismiss this action without prejudice and that the defendant waives any statute of limitations defense based on the period the dispute is with the arbitrator.

IT IS SO ORDERED.

Dated: December 2, 2024

VINCE CHHABRIA

United States District Judge