OPINION
COLE, Circuit Judge.
Plaintiff Community Trust Bancorp, Inc. asks us to find specific personal jurisdiction over out-of-state defendants solely because the Defendants provided passwords to access online banking services to a handful of in-state residents. As the Plaintiff's cause of action only tangentially related to the Defendants' acts within the forum state, we REVERSE the district court's judgment finding personal jurisdiction.
I.
The facts of this case are not in dispute. The Plaintiff, Community Trust Bancorp, Inc., is a Kentucky corporation that provides banking and financial services. Since at least 1995, the Plaintiff has used the mark "COMMUNITY TRUST" to promote its services; it included this mark on its website since 1998. The Defendants are Community Trust Financial Corporation, and two of its wholly-owned subsidiaries, Community Trust Bank and Community Trust Bank of Texas. The first two are Louisiana corporations, while the last is a Texas corporation. The Defendants also provide banking and financial services, use the marks "COMMUNITY TRUST" and "COMMUNITY TRUST BANK," and display these marks on their website.
The Defendants' contacts with Kentucky are limited. They have branch offices exclusively in Texas, Louisiana, and Mississippi and limit their advertising and marketing campaigns to those states. As such, they have no officers, directors, employees, agents, or any other physical presence in Kentucky. Nevertheless, they do have customers who reside in Kentucky; even though accounts can only be opened in branch offices, nine account owners moved to Kentucky and continue to maintain their bank accounts from there. Three or four account owners, while residing in Kentucky, requested passwords to access the Defendants' online banking website.
The Plaintiff alleges that the Defendants' use of the "COMMUNITY TRUST" mark is likely to confuse customers and lead customers to believe erroneously that the Plaintiff is affiliated with the Defendants' banking and financial services. On that basis, the Plaintiff brought a claim of trademark infringement against the Defendants under the Lanham Act, 15 U.S.C. § 1114(1) and state law. The Plaintiff also raised a claim under 15 U.S.C. § 1119, asserting that the Defendants' use of the marks constitutes false designation of origin and requesting an order canceling the Defendants' U.S. Service Mark Registration for the mark "COMMUNITY TRUST BANK."
The Defendants moved to dismiss the complaint under Federal Rule of Civil Procedure 12(b)(2) for lack of personal jurisdiction and to dismiss the Plaintiff's state law claims under Rule 12(b)(6) for failure to state a claim. The district court denied the Defendants' motions. The Defendants moved the district court to certify for immediate appeal the district court's finding that the Plaintiff had established a prima facie case of personal jurisdiction. Recognizing the evolving nature of personal jurisdiction in the internet context, the district court certified that issue for immediate appeal.
II.
We review a district court's denial of a Rule 12(b)(2) motion to dismiss for lack of personal jurisdiction de novo. Kroger Co. v. Malease Foods Corp., 437 F.3d 506, 510 (6th Cir.2006). When a federal court has "federal question [jurisdiction], personal jurisdiction over a defendant exists if the defendant is amenable to service of process under the [forum] state's long-arm statute and if the exercise of personal jurisdiction would not deny the defendant[] due process." Bird v. Parsons, 289 F.3d 865, 871 (6th Cir.2002) (second alteration in original) (internal quotation marks omitted). The district court already deemed the Kentucky long-arm statute satisfied and did not certify that issue for interlocutory appeal; therefore, we need only assess whether personal jurisdiction over the Defendants is proper as a matter of federal due process.
To determine whether a plaintiff's exercise of jurisdiction satisfies due process, we apply a three-part specific jurisdiction analysis:
First, the defendant must purposefully avail himself of the privilege of acting in the forum state or causing a consequence in the forum state. Second, the cause of action must arise from the defendant's activities there. Finally, the acts of the defendant or consequences caused by the defendant must have a substantial enough connection with the forum state to make the exercise of jurisdiction over the defendant reasonable.
S. Mach. Co. v. Mohasco Indus., Inc., 401 F.2d 374, 381 (6th Cir.1968).
As "the constitutional touchstone" of personal jurisdiction, Burger King Corp. v. Rudzewicz, 471 U.S. 462, 474, 105 S.Ct. 2174, 85 L.Ed.2d 528 (1985), the purposeful availment requirement ensures that the defendant's actions create a "substantial connection" to the forum state, such that the defendant "should reasonably anticipate being haled into court there," Neogen Corp. v. Neo Gen Screening, Inc., 282 F.3d 883, 889 (6th Cir.2002) (internal quotation marks omitted). Such a requirement protects a defendant from being "haled into a jurisdiction solely as a result of random, fortuitous, or attenuated contacts, or of the unilateral activity of another party or a third person." Id. (quoting Burger King Corp., 471 U.S. at 475, 105 S.Ct. 2174) (internal quotation marks omitted). The Defendants contend that they did not purposefully avail themselves of the benefits of doing business in Kentucky when they granted passwords and online banking access to preexisting customers residing in Kentucky. They allege that their customers' decisions to move to Kentucky and access online banking from that state is nothing more than a "random, fortuitous, or attenuated contact," which is precisely the kind of unilateral activity that cannot be the basis for personal jurisdiction.
While true that the mere existence of accounts with Kentucky-based owners is, by itself, insufficient for the district court to exercise jurisdiction over the Defendants, the Defendants do have additional contacts with Kentucky — ones that result from their own intentional activities, not just their customers' decisions to move north. In response to requests from their out-of-state customers, the Defendants supplied them with passwords to access online banking. The Defendants granted these passwords only after processing the customers' applications, which included their Kentucky addresses and new service contracts specific to online banking. After processing these applications, the Defendants chose to grant passwords and online access to these Kentucky customers, allowing them to continue to conduct business with the Defendants.
We need not answer whether the issuance of a handful of passwords constitutes purposeful availment so as to satisfy due process, as the Plaintiff is unable to meet the second requirement of personal jurisdiction — that the cause of action arises from the Defendants' activities in the forum state. Even if a defendant purposefully avails himself to the benefits of doing business in a forum, the exercise of specific jurisdiction only complies with due process if "the cause of action ... ha[s] a substantial connection with the defendant's in-state activities." Bird, 289 F.3d at 875 (internal quotation marks omitted). The defendant's contacts with the forum state must relate to the operative facts and nature of the controversy. Id. (citing CompuServe, Inc. v. Patterson, 89 F.3d 1257, 1267 (6th Cir.1996)).
The Plaintiff fails to meet this burden: there is no substantial connection between three or four Kentucky residents accessing their online banking and the underlying trademark infringement claim. Even assuming that the grant of passwords for online banking constitutes in-state activity, the Defendants' only activity in Kentucky is permitting a handful of Kentucky residents to access their online banking website. This activity is, at best, tangentially related to the allegation that the Defendants' use of the Plaintiff's trademark is confusing and may lead Kentucky residents to the inaccurate conclusion that the two banks are affiliated. It is hard to fathom that when these three or four Kentucky customers log-on to the Defendants' online banking website — a website they specifically requested access to — that they will experience confusion arising from the Defendants' use of the "COMMUNITY TRUST" logo. It is not enough that there be some connection between the in-state activity and the cause of action — that connection must be substantial. The Plaintiff fails to meet this standard. Consequently, personal jurisdiction over the Defendants is improper and we need not address the third Mohasco prong — that the substantial connection makes jurisdiction over the Defendant reasonable.
III.
The district court's judgment finding personal jurisdiction over the Defendants is REVERSED.
