Page 1
Ninth Circuit:
Canada’s Shopify May Be Sued in District Court for California
11-Member En Banc Court Tackles Issue of Jurisdiction Over Entity Present in State Only Electronically
By a MetNews Staff Writer
The Ninth U.S. Circuit Court of Appeals, sitting en banc, held yesterday that a district court in California erroneously dismissed, for lack of jurisdiction, an action brought by a resident of the state against a Canadian company, Shopify, and two subsidiary Delaware corporations which, he alleges, implanted cookies on his computer when he made an online purchase, without his consent, and then tracked his buying patterns.
Circuit Judge Kim Wardlaw wrote for the majority, joined by Chief Judge Mary H. Murguia. and Judges Johnnie B. Rawlinson, Morgan Christen, Michelle T. Friedland, Mark J. Bennett, Holly A. Thomas, and Roopali H. Desai. Judges Daniel P. Collins and Patrick J. Bumatay each authored a concurring opinion and Circuit Judge Consuelo M. Callahan dissented.
The entities sued were e-commerce company Shopify, Inc. headquartered in Ottawa, and Delaware corporations Shopify USA, with its principal place of business in New York, and Shopify Payments (USA), Inc., located in Delaware. Shopify acts on behalf of merchants in processing online payments.
A three-judge panel had, on Nov. 28, 2023, affirmed the dismissal by District Court Judge Phyllis J. Hamilton of the Northern District of California of a putative class action filed by Brandon Briskin, a resident of the City of Madera in Madera County, located in the San Joaquin Valley. In an opinion by Ninth Circuit Judge Daniel Aaron Bress, joined by Judge Bridget S. Bade and by Callahan, it said:
“We hold that the defendants are not subject to specific jurisdiction in California because they did not expressly aim their suit-related conduct at the forum state. When a company operates a nationally available e-commerce payment platform and is indifferent to the location of end-users, the extraction and retention of consumer data, without more, does not subject the defendant to specific jurisdiction in the forum where the online purchase was made.”
Basis of Jurisdiction
Yesterday’s majority saw it differently. Wardlaw wrote:
“Applying our traditional personal jurisdiction precedent to the ever- evolving world of e-commerce, we conclude that jurisdiction is proper because Shopify’s allegedly tortious actions deliberately targeted Briskin in California: (1) Shopify concedes that its geolocation technology allowed it to know that Briskin’s device was located in California when it installed cookies on Briskin’s device; and (2) the complaint alleges that Shopify uses the data gathered by its cookies to compile consumer profiles and then sells them without the consumer’s knowledge or consent.”
The jurist applied California’s long-arm statute which has maximum reach, within the confines of the due-process requirement of a defendant having minimal contacts with the forum state.
1997 Decision
She pointed to the Ninth Circuit’s 1997 decision in Cybersell, Inc. v. Cybersell, Inc., saying:
“Cybersell… recognized two significant concepts that advanced our thinking about specific personal jurisdiction as applied to conduct occurring in cyberspace. First, it recognized that contacts with the forum state could be in the form of electronic contacts, and second, it established that ‘something more’ than mere passive nationwide accessibility was required to show express aiming at the forum state and. thus, satisfy due process.”
Wardlaw said the court has applied the “something more” test to various factual scenarios. Examining the present circumstances, she said:
“Briskin has made a prima facie showing of jurisdictional facts sufficient to establish that Shopify purposely directed its conduct toward California. As a part of its regular course of business. Shopify is alleged to target California consumers to extract, collect, maintain, distribute, and exploit for its own profit, not only the California consumers’ payment information that it diverts to its own servers, but also all of the other personal identifying information that it extracts from the software it permanently installs on their devices without their knowledge or consent. Thus. Shopify’s business model is to perform the payment processing services it contracts to provide for its merchants and. in the course of doing so. to obtain valuable personal data about California consumers for its own commercial gain. Accordingly, through those business activities. Shopify allegedly tortiously violated consumers’ privacy through its collection, maintenance, and sale of valuable personal data from California consumers, like Briskin.”
‘Relevant Contact’
The circuit judge remarked:
“Pre-internet. there would be no doubt that the California courts would have specific personal jurisdiction over a third party who physically entered a Californian’s home by deceptive means to take personal information from the Californian’s files for its own commercial gain….Here, though Shopify’s entry into the state of California is by electronic means, its surreptitious interception of Briskin’s personal identifying information certainly is a relevant contact with the forum state.”
Wardlaw pointed out in a footnote:
“The parties agree among themselves that we need not develop an internet-specific standard for personal jurisdiction. We also agree.”
She began her opinion by observing:
“Since 1994. when the first shoppers in the United States turned to the “World Wide Web” to search for and make purchases online, what is now known as “e-commerce” has grown exponentially. Just last year, on Cyber Monday. U.S. consumers spent over thirteen billion dollars in online purchases on a single day, and U.S. online purchases were expected to exceed forty billion dollars through Cyber Week. And as e-commerce has proliferated, it has also evolved to incorporate new technology, devices, and platforms that participate in various ways to profit from this lucrative market. One such way is to gather and disseminate the personal identifying information that an individual necessarily submits when searching for a sought-after item, completing a transaction, or creating an account.”
That, she noted, is the activity of which Briskin complains.
Collins’s Opinion
Collins said in his concurring opinion that the standard for assertion of personal jurisdiction over the defendants “is readily satisfied here, because each Defendant allegedly committed, or is responsible for. tortious conduct within California.”
He added:
“Even assuming that there are any cases in which a tortfeasor can make a compelling showing that federal court jurisdiction in the place of the tortious conduct is unreasonable—and I doubt that there are3—this is certainly not such a case.”
Also concurring, Bumatay wrote:
“Given the allegations made against the Shopify entities here—that they pilfered Brandon Briskin’s private data while he bought a piece of clothing in California and that they continue to operate in this way (while, for some Shopify entities, agreeing to receive process in California and maintaining some physical operations in the State)—the Shopify entities are sufficiently present in California to not require any targeting of the State to assert personal jurisdiction over them.”
Dissenting Opinion
Callahan dissented, maintaining that “Shopify’s allegedly tortious conduct was not ‘expressly aimed’ at California.”
She set forth:
“Imagine if Briskin goes on vacation the next time he makes an online purchase using Shopify. As he’s driving from his house in California up to Lake Tahoe. he views an item online that he’s interested in. He keeps browsing the website as he makes his way around the lake, and by the time he’s in Nevada, he clicks the “Pav now” button. Then, after spending a day or two in Nevada. Briskin drives up to Oregon, and as he crosses into the State he visits another website looking for the best wines in Oregon’s Willamette Valley, which Shopify adds to Briskin’s “user profile.” Would the majority say that California. Nevada, or Oregon has jurisdiction over Shopify? Probably all of them, and that is precisely the problem with today’s decision.2 It creates a traveling cookie that ultimately crumbles when held up against Supreme Court precedent because it detaches the jurisdictional inquiry from contacts the ‘defendant himself creates with the State.’ ”
Wardlaw commented in a footnote:
“That Shopify allegedly committed its tortious activity knowing Briskin’s device was in California renders inapposite the ‘travelling cookie’ hypotheticals discussed in Judge Consuelo M. Callahan’s dissent.”
The case is Briskin v. Shopify, Inc., 22-15815.
Copyright 2025, Metropolitan News Company