On November 29, 2023, a Ninth Circuit panel affirmed the lower court’s decision in Briskin v. Shopify, limiting the court’s jurisdictional reach against e-commerce platforms alleged to have violated privacy and unfair competition laws. In a case of first impression, the court was asked to decide whether defendant Shopify’s data collection and tracking practices exposed it to personal jurisdiction in California. The court decisively held that “[w]hen a company operates a nationally available e-commerce payment platform and is indifferent to the location of end-users, the extraction and retention of consumer data, without more, does not subject the defendant to specific jurisdiction in the forum where the online purchase was made.”
Briskin is a California resident who claims that Shopify deliberately concealed its involvement in transactions between consumers and third-party online retailers. In August 2021, he filed a putative class action in California federal court, alleging that Shopify’s data collection and tracking practices violated California privacy and unfair competition laws. Shopify, a Canada-based e-commerce payment platform, moved to dismiss the claims on personal jurisdiction grounds. The district court agreed and dismissed the case. Briskin appealed.
There are three requirements for establishing specific personal jurisdiction: (1) the defendant must either purposefully direct his activities toward the forum or purposefully avail himself of the privileges of conducting activities in the forum; (2) the claim must be one that arises out of or relates to the defendant’s forum-related activities; and (3) the exercise of jurisdiction must be reasonable. Where, as here, the claims sound in tort, courts generally analyze the first prong under a “purposeful direction” framework (as opposed to a “purposeful availment” framework, which is more appropriate for contract claims).
Courts evaluate purposeful direction under the “effects test” articulated in Calder v. Jones. Under this test, the plaintiff must allege that (1) the defendant committed an intentional act, (2) the act was expressly aimed at the forum state, and (3) the act caused harm that the defendant knew was likely to be suffered in the forum state.
The court resoundingly disagreed with Briskin’s contention that Shopify’s broader business activities in California—like its contracts with local merchants or its California fulfillment center—were relevant to the specific jurisdiction analysis in this case because Briskin’s claims did not “arise out of or relate” to those contacts. The “arise out of” portion of the specific jurisdiction inquiry requires but-for causation—that is, a direct nexus between the defendant’s contacts with the forum state and the cause of action. The court held that there was no such causal relationship between Shopify’s broad California business contacts and Briskin’s claims because these contacts did not cause Briskin’s injury.
Similarly, Briskin’s claims did not “relate to” Shopify’s broader business activities in California. Although the Supreme Court recently clarified that the phrase “relate to” does not necessarily require a causal showing, the test still “incorporates real limits” that Briskin failed to meet. Simply put, Briskin’s injuries were based on Shopify’s data collection and tracking practices—not its contracts with local merchants, or its brick-and-mortar operations in the state.
Finding that there was an insufficient relationship between Briskin’s claims and Shopify’s broader business contacts in California, the court turned to Briskin’s argument that, by collecting, retaining, and using data obtained from purchasers in California, Shopify effectively “reached into” the forum and inserted itself into a transaction between two California residents.
The court’s analysis was twofold. First, it made clear that under the Supreme Court’s ruling in Walden v. Fiore, “it is the defendant’s contacts with the forum state, not the plaintiff’s, that matter, and it is the defendant’s contacts with the state itself, and not persons there, that must drive the inquiry.” Accordingly, Briskin’s California connection—i.e., the fact that he resides in California and was physically located in California when he used Shopify’s e-commerce payment system—was irrelevant to whether Shopify expressly aimed its activities toward California.
Second, the court declared that the Ninth Circuit’s personal jurisdiction precedents involving interactive websites, such as Mavrix Photo, Inc. v. Brand Technologies., Inc., et al., or AMA Multimedia, LLC v. Wanat, should control the inquiry here because Shopify is, after all, a web-based platform. Under that line of cases, a purely passive website that merely hosts information would not be sufficient to satisfy the express aiming requirement, but an interactive website where users can exchange information with the host computer could be. Even then, however, the Ninth Circuit has generally required some additional conduct directly targeting the forum or seeking to cultivate an audience there; otherwise, operating a website that users may interact with from anywhere would mean that the defendant can be sued everywhere. The express aiming requirement can be evidenced in various ways, including via the subject matter of the website, the defendant’s advertising, or other aspects of its business model. But “[a]ctions of third parties that the defendant does not control, even those of the defendant’s contractors, [will generally] be less reflective of the defendant’s own express aiming toward the forum because they invite a greater degree of attenuation between the plaintiff’s injuries and the defendant’s jurisdictional contacts.”
On these principles, the court held that Shopify’s collection, retention, and use of consumer data was not expressly aimed toward California because Shopify’s web platform does not have a “forum-specific focus” and Briskin did not allege facts showing that Shopify specifically sought to cultivate an audience in California. In fact, Shopify’s platform is accessible across the United States, and it is indifferent to the location of either the merchant or the end consumer. Moreover, Shopify did not interact with consumers except as a result of the third-party decisions of its merchants. Briskin would have suffered the same injury regardless of whether he purchased from a California company or was physically located in California when he made his purchase, and Shopify’s data collection practices cannot form the basis for the court’s jurisdiction.