Phelps Dunbar

On April 21, 2025, the Ninth Circuit Court of Appeals, sitting en banc, issued a landmark decision in Briskin v. Shopify, Inc. This ruling significantly broadened the scope of specific personal jurisdiction over e-commerce platforms. The case involved Brandon Briskin, a California resident, who alleged that Shopify, a Canadian e-commerce platform, unlawfully collected and monetized his personal data through tracking cookies installed during an online transaction. The court held that Shopify's installation of tracking cookies on Briskin's device, coupled with its knowledge of his California location, constituted "express aiming" sufficient to establish jurisdiction. This decision marks a departure from previous requirements for differential targeting, allowing courts to exercise jurisdiction based on the defendant's choice to engage with users in a forum state, regardless of a nationwide focus.

Understanding Personal Jurisdiction

Personal jurisdiction refers to a court's authority to hear a case involving a defendant, ensuring that the defendant is not unfairly brought into a court in a location with which they have little or no connection. Traditionally, courts require a defendant to have "minimum contacts" with the forum state to satisfy due process. The "effects test," derived from the Supreme Court's decision in Calder v. Jones, requires that the defendant commit an intentional act that is expressly aimed at the forum state and causes harm that the defendant knows will be suffered there. However, the digital age, with its borderless nature, has complicated the application of these principles, particularly for tech-driven businesses.

Arguments on Personal Jurisdiction

In the case, Briskin argued that Shopify purposefully directed its conduct at California by embedding tracking technology in devices located in the state and using that data for commercial gain. He contended that Shopify's actions met the "purposeful direction" requirement for specific personal jurisdiction because the company knowingly engaged with California consumers and monetized their data without consent.

Conversely, Shopify argued against jurisdiction by asserting that its platform operates nationwide without specific targeting of California. Shopify maintained that the mere happenstance of a California consumer using its platform was insufficient to establish jurisdiction and that the platform was agnostic to the location of its users. Shopify warned that subjecting it to jurisdiction in California could lead to jurisdiction in all 50 states, which it deemed unreasonable.

The Ninth Circuit ultimately sided with Briskin, ruling that Shopify's conduct constituted express aiming at California, thereby satisfying the requirements for specific personal jurisdiction.

Implications for Data Privacy Practices

This ruling has far-reaching implications beyond just e-commerce companies. It sets a precedent that could affect any tech industry relying on cookies and tracking technologies to collect consumer data. Businesses in sectors such as advertising, social media, and technology services that utilize these tools could find themselves subject to litigation in any state where their services are accessed. The decision underscores the importance of transparency and consent in data collection practices, as failure to adequately disclose and obtain user consent could lead to increased legal exposure in multiple jurisdictions.

Strategic Considerations

In light of the Briskin decision, technology professionals should consider the following strategies to navigate the evolving legal landscape:

• Transparency and Consent: Implement clear cookie consent mechanisms and update privacy policies to inform users about data collection practices.

• Vendor Management: Ensure thorough assessments of thirdparty vendors to verify compliance with data privacy standards and allocate responsibilities for obtaining user consents.

• Geofencing and Data Minimization: Consider geofencing technologies to limit data collection in high-risk jurisdictions and adopt data minimization principles to reduce the scope of collected information.

The Ninth Circuit's decision in Briskin v. Shopify represents a significant shift in the intersection of technology and data privacy law. In order to minimize litigation risks associated with litigating in foreign or hostile forums, technology professionals should consider adapting their practices to consider Briskin’s broad scope. Collaboration with legal counsel to evaluate and enhance compliance measures is essential in this new era of digital commerce.