Brandon Briskin v. Shopify, Inc.
FOR PUBLICATION (En Banc) (2025)
Premium Feature
Subscribe to Lexplug to listen to the Case Podcast.
Rule of Law:
A non-resident e-commerce platform is subject to specific personal jurisdiction in a forum state where it, as part of its nationwide business model, knowingly directs allegedly tortious conduct, such as installing tracking cookies and collecting data, toward a consumer's device located within that state, even if the platform does not differentially target the forum state over others.
Facts:
- Brandon Briskin, a California resident, used his iPhone while in California to purchase clothing from IABMFG, a merchant using Shopify's e-commerce platform.
- Without Briskin's knowledge or consent, Shopify installed tracking cookies on his device when he first viewed an item on the merchant's website.
- Shopify conceded that its geolocation technology allowed it to know that Briskin's device was located in California at the time.
- To complete the purchase, Briskin submitted his name, address, phone number, and credit card information through a payment form that appeared to be from the merchant but was secretly generated by Shopify.
- The payment form and subsequent confirmation email omitted any mention of Shopify's involvement in the transaction.
- Briskin alleged that Shopify intercepted his personal data, tracked his online behavior across its merchant network, and used the collected information to create a consumer profile which it then sold or shared for its own commercial gain.
Procedural Posture:
- Brandon Briskin filed a putative class action lawsuit against Shopify, Inc. and its subsidiaries in the U.S. District Court for the Northern District of California.
- The Shopify defendants filed motions to dismiss the Second Amended Complaint for lack of personal jurisdiction and for failure to state a claim under Fed. R. Civ. P. 8(a)(2).
- The district court granted the defendants' motion, dismissing the complaint for lack of specific personal jurisdiction and, alternatively, for improper collective pleading.
- Briskin, as appellant, appealed the dismissal to the U.S. Court of Appeals for the Ninth Circuit, with Shopify as the appellee.
- A three-judge panel of the Ninth Circuit affirmed the district court’s dismissal on personal jurisdiction grounds.
- The Ninth Circuit subsequently voted to rehear the appeal en banc, which vacated the three-judge panel's opinion.
Premium Content
Subscribe to Lexplug to view the complete brief
You're viewing a preview with Rule of Law, Facts, and Procedural Posture
Issue:
Does a federal court have specific personal jurisdiction over a non-resident e-commerce platform that, as part of its nationwide business model, knowingly installs tracking cookies on and collects personal data from a consumer's device located within the forum state, even if the platform does not differentially target that state over others?
Opinions:
Majority - Judge Wardlaw
Yes, a court has specific personal jurisdiction over the e-commerce platform. The exercise of jurisdiction is proper because Shopify’s allegedly tortious actions deliberately targeted Briskin in California. Applying the Calder effects test, Shopify committed an intentional act (installing cookies and collecting data) that it knew would cause harm (privacy violations) in California. The crucial 'express aiming' prong is satisfied because Shopify used geolocation technology to know Briskin was in California when it directed its tortious conduct at his device. This case overrules the precedent from AMA Multimedia, LLC v. Wanat that required a plaintiff to show 'differential targeting' or a 'forum-specific focus' to establish express aiming, as such a rule would perversely allow nationwide companies to evade jurisdiction everywhere. Unlike in Walden v. Fiore, Shopify's conduct of installing software on a device was a direct electronic contact with the forum state itself, not merely contact with a resident who happened to be connected to the forum.
Concurring - Judge Collins
Yes, jurisdiction is proper, but the analysis should be more direct. The case is not about the 'effects' of out-of-state conduct, but rather about tortious conduct that Shopify itself committed within California. When Shopify's software, by design, intercepted data and installed cookies on a device physically located in California, it committed an 'automated tort' within the forum state. This direct, in-state tortious activity is sufficient to establish minimum contacts. The court correctly overruled the 'differential targeting' requirement, and should go further to discard the confusing 'something more' than an interactive website test from prior Ninth Circuit precedent.
Concurring - Judge Bumatay
Yes, jurisdiction is proper based on an originalist understanding of the Due Process Clause. The historical touchstone for jurisdiction is 'physical presence.' For modern corporations operating in cyberspace, the analysis should focus on whether their activities are analogous to physical presence. Here, Shopify's activities—including data collection, ongoing tracking, and maintaining physical operations in California—are sufficiently analogous to physical presence to justify jurisdiction without needing to resort to a 'differential targeting' analysis.
Dissenting - Judge Callahan
No, the court lacks specific personal jurisdiction over Shopify. The majority's holding improperly focuses on the plaintiff's location rather than the defendant's contacts with the forum state itself, contrary to the Supreme Court's holding in Walden v. Fiore. Shopify's contact was with Briskin's device, a contact that would have been identical regardless of where Briskin was located; his presence in California was merely a fortuitous circumstance. This decision creates an unworkable 'traveling cookie' rule, where jurisdiction follows the plaintiff anywhere they go, which impermissibly allows the plaintiff's unilateral activity to drive the jurisdictional analysis. The proper inquiry might have been about general jurisdiction based on Shopify's broader presence in California, but that was not the issue before the court.
Analysis:
This en banc decision significantly reshapes specific personal jurisdiction doctrine in the Ninth Circuit for e-commerce and internet platforms. By formally overruling the 'differential targeting' requirement, the court has made it more difficult for nationwide companies to argue that their ubiquitous presence insulates them from jurisdiction in any particular state. The holding clarifies that a defendant's knowledge of a user's location, coupled with allegedly tortious electronic acts directed at that user, constitutes sufficient 'express aiming' toward the forum. This will likely expand the ability of plaintiffs to bring privacy and data-related lawsuits against large tech companies in their home states, aligning the circuit's jurisprudence with the Supreme Court's reasoning in Ford Motor Co. that a company serving a national market can be sued where its activities cause injury.
