In Chien v. Bumble Inc., 641 F. Supp. 3d 913, 927–30 (S.D. Cal. 2022), District Court Judge Gonzalo P. Curiel addressed the sufficiency of California contacts for specific personal jurisdiction in a data privacy case that includes a claim for violation of the CCPA.

In the context of a nationally accessible website, “something more” than operating a passive website is required; there must be “conduct directly targeting the forum.” AMA Multimedia, LLC v. Wanat, 970 F.3d 1201, 1210-11 (9th Cir. 2020) (quoting Mavrix Photo, 647 F.3d at 1229). The Court may consider factors such as “the interactivity of the defendant’s website,[5] … the geographic scope of the defendant’s commercial ambitions, … and whether the defendant ‘individually targeted’ a plaintiff known to be a forum resident.” Mavrix Photo, 647 F.3d at 1229. Operating a passive website without any apparent intention to target the forum is not sufficient for purposeful direction, see Pebble Beach Co. v. Caddy, 453 F.3d 1151, 1154-57 (9th Cir. 2006), but “designing the product for the market in the forum State, advertising in the forum State, establishing channels for providing regular advice to customers in the forum State, or marketing the product through a distributor who has agreed to serve as the sales agent in the forum State” can satisfy the “something more” requirement, see LNS Enters., 22 F.4th at 861 (quoting Asahi Metal Indus. Co. v. Superior Court, 480 U.S. 102, 112, 107 S.Ct. 1026, 94 L.Ed.2d 92 (1987)). In Mavrix Photo the Ninth Circuit reversed a district court’s finding that it lacked personal jurisdiction in a copyright infringement case that involved materials posted to a website. 647 F.3d at 1221, 1232. “Based on the [defendant] website’s [California] subject matter, as well as the size and commercial value of the California market,” the Ninth Circuit concluded that the defendant “anticipated, desired, and achieved a substantial California viewer base.” Id. at 1230.
Chien concedes that “simply operating a nationally accessible interactive website is not enough to establish express aiming of conduct” and argues that other factors present in this case demonstrate that Bumble Trading targeted California. (ECF No. 29 at 13-14). See Mavrix, 647 F.3d at 1229 (“[O]perating even a passive website in conjunction with ‘something more’—conduct directly targeting the forum—is sufficient.” (quoting Rio Props., Inc. v. Rio Int’l Interlink, 284 F.3d 1007, 1020 (9th Cir. 2002))). Chien alleges that this “something more” requirement is satisfied as to all defendants because Bumble utilizes a highly interactive app that deliberately gathers California users’ [PII]”, (FAC ¶¶ 35-36, 40; ECF No. 29 at 14); harvests device GPS and Wi-Fi data “each *928 time the Bumble app is opened on a California-based device,” (FAC ¶¶ 37-40); “generate[s] revenue from thousands of paying users who reside in California,” (FAC ¶¶ 41-42); and further avails itself to the California marketplace “by touting their photo verification feature to potential California-based users” and includes California-specific sections within its privacy policy, (FAC ¶¶ 43-44). He argues that Bumble’s activities aimed at California are purposeful and systemically exploit the California market such that Bumble has purposefully availed itself to the laws of California. (ECF No. 29 at 16-18.)
Bumble concedes that Bumble Trading “operates the Bumble App globally,”6 (ECF No. 24-2 at 2), but argues that personal jurisdiction in California is improper because Bumble Trading’s contacts with the forum are only incidental. (ECF No. 24-1 at 19.) It argues that the App neither specifically targets nor focuses on California and suggests that the California market is not integral to the App’s success because most users are outside of California. (ECF No. 24-1 at 20; see also ECF No. 24-2 at 2 (Rosas Decl.).) Bumble next argues that the App’s advertisements and user data collection also did not target California. (ECF No. 24-1 at 21.) Bumble compares its contacts to California with those of the defendants in AMA Multimedia in which the Ninth Circuit affirmed in relevant part that specific jurisdiction was lacking because the defendant’s website content and market was global in nature; the website advertisements were “geo-located,” meaning “all users in every forum received advertisements directed at them”; and to the extent that users entered into a contract with the defendant, the plaintiff had not alleged violations of that contract. 970 F.3d at 1210-12.
The Court concludes that Bumble Trading purposefully directed its activities at California. Bumble does not dispute that the App is highly interactive, which weighs in favor of purposeful direction. (See FAC ¶¶ 8-9, 72-73; ECF No. 29 at 14.) See Mavrix Photo, 647 F.3d at 1229. The Court is not persuaded by Bumble’s argument that the California market is not integral to the App’s success on the basis that “the vast majority of the [A]pp’s users are outside of California.” (ECF No. 24-1 at 20 (emphasis removed).) Rosas’ Declaration merely states that most users are located outside California, not that the California market is insubstantial. (ECF No. 24-2 at 2 (Rosas Decl.).) Neither the declaration nor Bumble’s arguments dispute Chien’s allegation that Bumble “generate[s] revenue from thousands of paying users [residing] in California.” (FAC ¶ 41; see also ECF No. 29 at 16; see ECF No. 1-3 at 3 (Urquiola Decl.) (“[D]uring the month of March 2020, over 75,000 unique users of the [App] were associated with registrations in the United States.”)) This factor favors finding purposeful direction in light of Supreme Court precedent. Compare Keeton v. Hustler Mag., Inc., 682 F.2d 33, 33-34, 36 (1st Cir. 1982), with Keeton, 465 U.S. at 773-74, 781, 104 S.Ct. 1473 (Supreme Court reversing and remanding finding of no personal jurisdiction when market in forum State amounted to less than one percent of total circulation within United States because dispute arose from those contacts).7 Other factors alleged *929 that favor finding that Bumble Trading has purposefully availed itself to the forum State include that it has collected personal and location information for the purpose of sending targeted “marketing information,” promotions, and advertisements. (ECF No. 30-1 at 32, 56, 58; FAC ¶¶ 8-10, 43, 59, 61.) Bumble Inc.’s December 2021 SEC filing elaborated that it leverages “machine and deep learning capabilities … to personalize the potential matches [it] display[s] and to inform [their] product pipeline” and to “target users who are likely to purchase a subscription package or in-app feature and tailor the experience for them.” (ECF 30-1 at 31-32.)
The Court additionally finds that, unlike the defendant website that lacked forum-specific subject matter in AMA Multimedia, the App here offers value to its users on the basis that its content within the forum State displays other users also presently within the forum State. (See FAC ¶ 37-40; ECF No. 30-1 at 32.) Cf. 970 F.3d at 1210 (explaining that United States-based adult content uploaded to defendant website does not mean that defendant website’s “subject matter is aimed at the U.S. market”). This presents a situation that is also somewhat distinct from Mavrix Photo because each user within each forum is viewing content specific to that forum. See 647 F.3d at 1222, 1230. Accordingly the Court finds that these factors suggest that Bumble Trading “ ‘continuously and deliberately exploited’ the California market for its website,” although to a lesser extent than the defendant in Mavrix Photo. See id. at 1230 (quoting Keeton, 465 U.S. at 781, 104 S.Ct. at 1482).
The Court is further satisfied that Bumble Trading’s “suit-related conduct … create[d] a substantial connection with the forum State,” see LNS Enters., 22 F.4th at 859, considering Chien’s uncontroverted allegations regarding the App’s unpermitted data breach. Chien avers—and presents a Forbes article in support—facts that, taken as true, suggest that a San Diego-based research group discovered vulnerabilities in the App’s platform, contacted Bumble several times, received an email response from Bumble requesting that the breach not be publicized, and yet Bumble has never notified any users of the breach. (FAC ¶¶ 101-11.) Bumble does not challenge the accuracy of these events, (see ECF Nos. 24-1, 30 (absence)), and instead argues that any “alleged data breach and collection would presumably have occurred in Texas” and “cannot arise out of any purported California contacts because Bumble Trading does not own or operate servers in California that receive, send, or store Bumble app user data,” (ECF No. 24-1 at 22-23). However, the non-forum server location does not preclude a finding of specific jurisdiction when a defendant has otherwise directed activities at the forum state. See LNS Enters., 22 F.4th at 859. Bumble informs users that their personal data will not be disclosed “except in limited circumstances,” (ECF No. 30-1 at 58) and that Bumble prides itself “on taking all appropriate security measures to help protect [user] information against loss, misuse and unauthorised access, or disclosure,” (id. at 60); it even has sections of the privacy policy specific to California users and does not single out any other States,8 (see id. at 54, 61-62). Bumble *930 Trading purposefully directed activities toward California.