The Ninth Circuit reversed the District Court’s judgment and the panel’s decision, finding that the District Court had specific personal jurisdiction over Shopify.
On April 21, 2025, the U.S. Court of Appeals for the Ninth Circuit, sitting en banc, issued an opinion in Briskin v. Shopify,—F.4th—, 2025 WL 1154075 (9th Cir. Apr. 21, 2025), which could significantly increase the number of jurisdictions in which e-commerce companies can be sued, even when the company’s globally or nationally accessible website does not have a forum-specific focus.
Background
Plaintiff Brandon Briskin is a California resident who used his iPhone’s browser to purchase athletic wear from an online storefront, IAB MFG. He alleges that during the checkout process, the online platform required him to submit personal identifying information, including his name, address, phone number and credit card. Allegedly believing that the storefront generated the payment form over a secure connection, he submitted the personal identifying information, unaware that, by doing so, he was submitting his private data not only to IAB MFG but also to Shopify. Briskin additionally alleges that, although he never viewed the relevant “Privacy Policy,” had he done so, the policy would not have mentioned Shopify, “an e-commerce platform that facilitates online sales for merchants,” and that Shopify had installed “cookies” on his mobile device when he first viewed an item for purchase. These cookies allegedly tracked and stored Briskin’s personal information, including his geolocation data, the identity of his browser, his IP address, his payment information and the location where the transaction was completed. Briskin alleges that Shopify then shared his private data with third parties without disclosure.
Briskin’s putative class action complaint, filed in the U.S. District Court for the Northern District of California, alleges that Shopify’s conduct violated data privacy and access laws and constituted unfair deceptive practices. The District Court, however, dismissed the case on the ground that it lacked specific personal jurisdiction over Shopify (Briskin had not asserted general personal jurisdiction).
On appeal, a three-judge panel of the Ninth Circuit affirmed the District Court’s ruling. The panel found that Shopify, in operating a nationwide platform, did not “expressly aim [its] suit-related conduct at [California].” The panel held that:
When a company operates a nationally available e-commerce payment platform and is indifferent to the location of end-users, the extraction and retention of consumer data, without more, does not subject the defendant to specific jurisdiction in the forum where the online purchase was made.
The Ninth Circuit voted to rehear the appeal en banc. A bipartisan group of 30 states and Washington, D.C., as amici curiae, sided with Briskin, arguing that, absent jurisdiction over e-commerce companies like Shopify, they would be unable to enforce their consumer protection laws against such companies, which use the internet to avail themselves of local marketplaces.
The Ninth Circuit’s En Banc Analysis
The Ninth Circuit reversed the District Court’s judgment and the panel’s decision, finding that the District Court had specific personal jurisdiction over Shopify. In arriving at that decision, the court applied the “effects test” drawn from the Supreme Court’s decision in Calder v. Jones, 465 U.S. 783 (1984), which requires that the defendant commit an intentional act that is (i) expressly aimed at the forum state and (ii) causes harm that the defendant knows will be suffered in the forum state. The parties disputed only the second prong of this test, and the court found that Shopify “expressly aimed its conduct at California through its extraction, maintenance, and commercial distribution of the California consumers’ personal data in violation of California laws.”
Shopify argued that it did not expressly aim its conduct at California because it operates nationwide and thus was “agnostic as to the location in which it data-mines the consumers’ personal identifying information.” But the Ninth Circuit rejected this argument, holding that the “express aiming” prong of the Calder test does not require “differential targeting,” i.e., conduct focused on a particular forum. In so holding, the court overruled AMA Multimedia, LLC v. Wanat, 970 F.3d 1201 (9th Cir. 2020), which had required a “forum-specific focus.” The court also emphasized that Shopify conceded that its geolocation technology allowed it to know that Briskin’s device was in California when the cookies were installed.
Moreover, the court rejected Shopify’s argument, based on Walden v. Fiore, 571 U.S. 277, 283–84 (2014), that the relevant jurisdictional contacts must be “the defendant’s contacts with the forum State itself, not its contacts with persons who reside there.” The Ninth Circuit found that, unlike Walden, where the plaintiffs were “the only link” between the defendant and the forum state, Shopify was meaningfully connected with the forum state in a more than “random, isolated, or fortuitous way” because it:
[K]nows about its California consumer base, conducts its regular business in California, contacts California residents, interacts with them as an intermediary for its merchants, installs its software onto their devices in California, and continues to track their activities.
The Ninth Circuit also found that Briskin’s claims arise out of Shopify’s contact with Briskin’s device, which Shopify allegedly knew was in California, and that the claims also relate to Shopify’s California contacts because the alleged injury would tend to be caused by Shopify’s contacts with California merchants and consumers.
Lastly, the Ninth Circuit found that the District Court’s exercise of specific personal jurisdiction over Shopify would not violate traditional concepts of fair play and substantial justice. Specifically, the court rejected Shopify’s argument that personal jurisdiction in this context would be unfair because it “could lead to specific jurisdiction in all 50 states.” Although Shopify’s argument “may be true,” the court explained, expansive jurisdiction is “not unfair [] if the contacts Shopify makes in all 50 states are like its California contacts.”
Takeaways
Briskin could have far-reaching effects for e-commerce companies that collect data through a globally or nationally accessible website. Within the Ninth Circuit, such companies could subject themselves to specific personal jurisdiction in a forum whenever they provide services to consumers in that location, regardless of their platform’s geographical focus or lack thereof. And as the Ninth Circuit acknowledged, e-commerce platforms could be subject to litigation in every forum in the country, at least when the site operator has technology allowing the operator to know a user’s location or when the site operator extracts a user’s data for commercial purposes.
The Ninth Circuit’s analysis, however, represents a departure from courts’ typical reluctance to find personal jurisdiction where products offered nationwide enter the forum due to a purchaser’s actions alone. Although Briskin is now established law in the Ninth Circuit, it remains to be seen whether courts in other jurisdictions will follow suit. E-commerce companies would do well to monitor such developments and consider whether they can distinguish the jurisdictional facts of the case from those that were dispositive in Briskin.
For More Information
If you have any questions about this Alert, please contact Michael A. Cabin, Brad D. Feldman, any of the attorneys in our Trial Practice Group, any of the attorneys in our Securities Litigation Group or the attorney with whom you are regularly in contact.
Disclaimer: This Alert has been prepared and published for informational purposes only and is not offered, nor should be construed, as legal advice. For more information, please see the firm's full disclaimer.