Ninth Circuit revives Shopify data privacy suit (2025)

The en banc Ninth Circuit found Shopify deliberately targeted consumers in California, giving California personal jurisdiction.

SAN FRANCISCO (CN) — An en banc Ninth Circuit panel ruled Monday that a federal court erred when it dismissed a data privacy suit filed by a class ofplaintiffs who purchased items on the Canada-based e-commerce platform Shopify on jurisdictional grounds.

The panel ruled 10-1 that the case can be litigated in California even though Shopify is a Canadian business, because the company actively pursued customers in the Golden State.

Lead plaintiff Brandon Briskin filed a class action against Shopify in 2021, claiming it extracted his sensitive personal and financial data without his consent when he made a purchase from a California merchant through Shopify’s platforms, in violation of California law. Shopify partners with online merchants to build and manage online stores and sell products. Briskin claims Shopify used the data to compile consumer profiles of shoppers and sell them without consent.

A federal judge dismissed the suit, ruling that California did not have jurisdiction, and a Ninth Circuit panel affirmed the dismissal in November 2023. The plaintiffs petitioned for an en banc rehearing, which occurred in September 2024.

Throughout the case’s procedural history, Shopify has argued that it should not be sued in California as it operates nationwide and did not target its conduct specifically toward California or any other state.

In reversing the federal court and remanding the case, the panel ruled that Shopify deliberately targeted Briskin in California, so jurisdiction was proper.

“Applying our traditional personal jurisdiction precedent to the ever-evolving world of e-commerce, we conclude that jurisdiction is proper because Shopify’s allegedly tortious actions deliberately targeted Briskin in California: (1) Shopify concedes that its geolocation technology allowed it to know that Briskin’s device was located in California when it installed cookies on Briskin’s device; and (2) the complaint alleges that Shopify uses the data gathered by its cookies to compile consumer profiles and then sells them without the consumer’s knowledge or consent,” wrote U.S. Circuit Judge Kim Wardlaw, a Bill Clinton appointee.

Wardlaw wrote that as a regular course of its business, Shopify, through the use of cookies that it embeds on users’ devices, targets California consumers’ payment information and other personally identifying information for its own personal monetary gain.

“Accordingly, through those business activities, Shopify allegedly tortiously violated consumers’ privacy through its collection, maintenance, and sale of valuable personal data from California consumers, like Briskin,” Wardlaw wrote.

Wardlaw noted that before the internet there would be no doubt that a California court would have personal jurisdiction over third parties that entered a Californian's home by deceptive means to take personal information for monetary gain, and that online commercial platforms must be held to the same standard.

U.S. Circuit Judge Consuelo Callahan, a George W. Bush appointee, wrote in a dissent that she “fundamentally disagrees” with the majority.

“According to the majority opinion, because Shopify ‘knew the location’ of plaintiff Brandon Briskin before installing cookies onto his device, Shopify ‘expressly aimed’ its conduct toward the state of California. But a company knowing where we happen to be when using its service, and then attaching a cookie to our device, has nothing to do with the state we’re in,” she wrote. “That interaction forms a relationship between the company and the individual that is not ‘tethered’ to the state.”

Callahan said the majority’s ruling may open up unforeseen consequences by impermissibly manufacturing jurisdiction no matter where a plaintiff goes.

“Imagine if Briskin goes on vacation the next time he makes an online purchase using Shopify. As he’s driving from his house in California up to Lake Tahoe, he views an item online that he’s interested in. He keeps browsing the website as he makes his way around the lake, and by the time he’s in Nevada, he clicks the ‘pay now’ button. Then, after spending a day or two in Nevada, Briskin drives up to Oregon, and as he crosses into the state he visits another website looking for the best wines in Oregon’s Willamette Valley, which Shopify adds to Briskin’s ‘user profile.’ Would the majority say that California, Nevada, or Oregon has jurisdiction over Shopify? Probably all of them, and that is precisely the problem with today’s decision,” Callahan wrote.

Chief U.S. Circuit Judge Mary Murguia and Circuit Judges Morgan Christen and Michelle Friedland, all Barack Obama appointees, Circuit Judge Johnnie Rawlinson, a Bill Clinton appointee, Circuit Judges Holly Thomas and Roopali Desai, both Joe Biden appointees, and Circuit Judges Daniel Collins, Mark Bennett, and Patrick Bumatay, all Donald Trump appointees, rounded out the panel.

Lawyers for Shopify and Briskin did not immediately respond to requests for comment.