Platforms may now be exposed to litigation in any state in which they take deliberate action to gather data.
In a groundbreaking decision, the Ninth Circuit Court of Appeals has redefined the boundaries of personal jurisdiction in the context of e-commerce and digital interactions. The case, Briskin v. Shopify, Inc., centers on whether Shopify, a global e-commerce platform, can be subject to specific personal jurisdiction in California for allegedly violating state privacy laws. The court’s en banc ruling has significant implications for businesses operating in the digital space.
“The Supreme Court has considered and rejected the argument that because a nationwide company is everywhere, it is jurisdictionally nowhere except in its principal place of business and state of incorporation,” the court wrote, citing Ford Motor Co. v. Montana Eighth Judicial District Court, 592 U.S. 351 (2021).
Plaintiff Brandon Briskin, a California resident, filed a class action lawsuit against Shopify after purchasing athletic wear online. Briskin alleged that Shopify installed tracking cookies on his device without his knowledge or consent, collected sensitive personal data, and used this information to compile consumer profiles for commercial gain. Shopify argued that its actions were not expressly aimed at California, contending that its business model operates on a nationwide scale without targeting specific states.
The district court initially dismissed the case, citing lack of personal jurisdiction and insufficient pleading under Federal Rule of Civil Procedure 8(a)(2). However, the Ninth Circuit reversed, holding that Shopify’s conduct deliberately targeted California consumers and violated state privacy laws.
Expanding the Scope of Specific Personal Jurisdiction
The court concluded that Shopify’s actions—installing cookies, collecting data, and monetizing consumer profiles—constituted purposeful direction toward California. Shopify’s geolocation technology allowed it to identify Briskin’s location in California, and its business model relied on extracting data from California consumers. This deliberate targeting satisfied the “Calder effects test,” which requires that a defendant’s conduct be expressly aimed at the forum state.
The Calder test is based on the Supreme Court’s decision in Calder v. Jones, 465 U.S. 783 (1984) which examines whether a defendant committed an intentional act expressly aimed at the forum state, and that harm caused by the act was foreseeable in that forum.
The Ninth Circuit rejected the notion that a company must demonstrate “differential targeting” of a specific state to establish jurisdiction. Instead, it held that a business operating nationwide can be subject to jurisdiction in any state where its conduct causes harm, provided the contacts are not “random, fortuitous, or attenuated.”
The court emphasized that traditional principles of jurisdiction apply to online interactions, but the unique characteristics of e-commerce—such as tracking cookies and data collection—require careful consideration. Shopify’s actions were likened to a physical intrusion into California, as its software entered Briskin’s device and extracted personal information.
“Pre-internet,” the court wrote, “there would be no doubt that the California courts would have specific personal jurisdiction over a third party who physically entered a Californian’s home by deceptive means to take personal information from the Californian’s files for its own commercial gain.” The panel held that “an interactive platform ‘expressly aims’ its wrongful conduct toward a forum state when its contacts are its ‘own choice and not ‘random, isolated, or fortuitous,’ even if that platform cultivates a ‘nationwide audience[] for commercial gain.'”
Dissent Raises the “Traveling Cookie”
The dissenting opinion raised concerns about the implications of the majority’s ruling, suggesting it could lead to jurisdiction in any state where a consumer happens to use their device. However, the majority clarified that jurisdiction hinges on the defendant’s deliberate actions, not the plaintiff’s location. This distinction is critical for businesses seeking to understand their exposure to litigation across multiple jurisdictions.
Commentary
The Ninth Circuit’s decision in Briskin v. Shopify fundamentally reshapes the application of personal jurisdiction principles in the digital age. By eliminating the requirement for differential targeting and emphasizing the deliberate nature of Shopify’s conduct, the ruling lowers the threshold for litigation exposure.
As digital commerce increasingly blurs traditional geographic boundaries, companies must prioritize transparency in their privacy policies and carefully evaluate their data collection and tracking practices, including the use of geolocation technologies, to mitigate risk.
By the same token, individuals and organizations potentially harmed by privacy violations should know that, just because they use a platform operated from another state, they are not necessarily prohibited from filing suit.
Contact Mogin Law LLP
Attorneys, if you wish to speak to us about a legal matter, write to us at Info@MoginLawLLP.com. Editors, if you have a question about this post or other privacy and antitrust topics, write to us at Media@MoginLawLLP.com. We can also be reached at 619.687.6611.