Legal Actions & Lawsuits

A consumer law firm opened an investigation into Dropbox Plus auto-renewals in 2025, as strengthened automatic-renewal laws in California and New York raised the bar for consent, reminders, and easy cancellation.

A federal judge compelled the users suing over the 2024 Dropbox Sign breach into individual arbitration — finding that by clicking 'I agree' to sign a document they had accepted Dropbox's terms — and then denied reconsideration, effectively shutting the class action out of court.

A pension fund shareholder sued Dropbox and its leadership in the Delaware Court of Chancery in 2025 over the company's plan to reincorporate in Nevada, alleging the move favored controlling stockholder and CEO Andrew Houston — in what was reported as the first court challenge to Delaware's controversial SB 21 corporate-law amendments.

Activist investor Half Moon Capital pressed Dropbox to dismantle the dual-class share structure that gives co-founder Drew Houston majority voting control, arguing that entrenched founder control and slowing growth were holding back value as the stock languished near multi-year lows.

After Dropbox disclosed the April 2024 Dropbox Sign breach, affected users filed proposed class actions in federal court alleging Dropbox negligently failed to protect their data and did not give prompt, adequate notice; the claims are allegations and the consolidated litigation followed in the Northern District of California.

Patent-assertion entity Daedalus Blue, holder of former IBM patents, sued Dropbox in August 2024, accusing the Dropbox API, the Magic Pocket storage system, and the Nautilus search engine of infringement; Dropbox's eligibility challenge was granted only in part, leaving the case alive.

Within weeks of the Dropbox Sign breach disclosure, users filed a proposed class action in California federal court alleging Dropbox failed to protect their data and was slow to notify them.

Following the 2024 Dropbox Sign breach, affected users filed proposed class-action lawsuits accusing Dropbox of failing to secure their data and of notifying victims too slowly. Dropbox has contested the claims, arguing the exposed data poses no identity-theft risk.

Dropbox's Terms of Service require binding individual arbitration and waive your right to join a class action — so even after a breach or billing dispute, most users cannot sue Dropbox or band together in court.

Patent-assertion entity Motion Offense accused Dropbox's file-sharing and Smart Sync features of infringing four patents and sought roughly $35.7 million; a Waco, Texas jury returned a defense verdict in May 2023, finding no infringement and all four patents invalid.

After nearly four years of litigation, a Texas jury found Dropbox did not infringe four file-sharing patents asserted by Motion Offense LLC, defeating a roughly $35 million damages demand — part of a wider patent fight Dropbox largely won.

Datanet LLC sued Dropbox in October 2022 over two patents on automatic real-time file management; Dropbox challenged the patents at the patent office, and the district-court docket closed in March 2024.

Entangled Media sued Dropbox over two patents on cloud-based file systems; the patent office declined to review the patents, and in 2025 the court issued a mixed summary-judgment ruling, leaving the dispute contested rather than resolved.

Italy's competition and consumer authority opened proceedings against Dropbox in 2020 over its cloud-storage terms; in 2021 it closed one case after Dropbox committed to clearer disclosures and, in a second, found several contract clauses unfair and ordered their removal — in both cases without a fine on Dropbox.

Topia Technology sued Dropbox and other cloud-storage companies over two file-synchronization patents; rather than fight in court, Dropbox and Box challenged the patents at the Patent Trial and Appeal Board, which found the claims unpatentable — a result later affirmed by the Federal Circuit.

When the EU's top court struck down the EU–US Privacy Shield in 2020, Dropbox — which had self-certified under the framework — was among the US cloud services left exposed to European data-protection regulators questioning whether personal data could lawfully be transferred to the United States.

Express Mobile sued Dropbox along with eight other technology companies over website-builder patents in 2020; the suit against Dropbox was resolved by dismissal, consistent with a settlement, rather than a court ruling on the merits.

The EU's 2020 Schrems II ruling struck down the Privacy Shield framework over US surveillance, leaving EU organizations that store data with US providers like Dropbox needing extra safeguards — and unable to fully escape US legal reach.

Patent-assertion entity SynKloud Technologies sued Dropbox in the Western District of Texas over patents on wireless-device access to remote storage; Dropbox's bid to move the case to California was denied, while SynKloud's broader patent campaign unraveled at the patent office.

Investors who bought stock tied to Dropbox's March 2018 IPO alleged the registration statement concealed a slowdown in converting free users to paying ones; after an initial dismissal, the case settled for $1.38 million with no admission of wrongdoing.

Dropbox's March 2018 IPO created a multi-class share structure concentrating voting power with co-founders Drew Houston and Arash Ferdowsi, limiting ordinary shareholders' say over the company's direction.

Four California district attorneys accused Dropbox of violating the state's Automatic Renewal Law for its Dropbox Pro subscriptions; Dropbox settled for $2.15 million and agreed to change its renewal disclosures, without admitting liability.

The 2018 CLOUD Act amended US law so that a US-based provider like Dropbox can be compelled to produce a user's data regardless of which country the data is physically stored in — meaning a US warrant can reach an overseas user's files.

Before Dropbox acquired HelloSign in 2019, a patent-assertion entity called Digital Verification Systems had sued HelloSign over an electronic-signature patent — one of a wave of near-identical suits — leaving Dropbox to inherit the dispute along with the company.

Synchronoss Technologies accused Dropbox of infringing three data-synchronization patents; Dropbox won summary judgment of non-infringement and invalidity in 2019, and the Federal Circuit affirmed in 2021.

After a review of the cloud-storage sector, the UK's Competition and Markets Authority secured voluntary commitments from providers including Dropbox in 2016 to improve unfair contract terms — covering notice of price and service changes, cancellation and refunds, and auto-renewal transparency.

Thru Inc. claimed it had used the term 'Dropbox' since 2004 and threatened the company's trademark; Dropbox sued first for declaratory relief, won summary judgment, and the Ninth Circuit affirmed — with a roughly $2.3 million attorneys'-fee award against Thru.

Years before the California district attorneys' 2018 settlement, a private plaintiff brought a class action alleging Dropbox enrolled users in automatic subscription renewals without proper consent under California's Automatic Renewal Law; the case was removed to federal court and ended in a stipulated dismissal.

A July 2011 terms-of-service and privacy-policy update used broad licensing language that many users read as Dropbox asserting ownership-like rights over their files, forcing the company to publicly clarify and walk back the wording.

Security researcher Christopher Soghoian filed a complaint with the U.S. Federal Trade Commission alleging that Dropbox made deceptive claims about its encryption, because Dropbox employees could in fact access users' files.

Security researcher Christopher Soghoian filed an FTC complaint alleging Dropbox had told users their files were inaccessible even to Dropbox employees, while its actual architecture — and a quietly revised Terms of Service — made clear the company could decrypt and hand over files.

Days after Dropbox disclosed the June 2011 bug that briefly let anyone sign into any account with any password, a plaintiff filed a class action alleging privacy and consumer-protection violations; the case was terminated within four months.