In Briskin v. Shopify, Inc., No. 22-15815, 2023 WL 8225346 (9th Cir. Nov. 28, 2023), the United States Court of Appeals for the Ninth Circuit held that the Canada-based company Shopify, Inc. (“Shopify”), which provides a web-based payment processing platform to online merchants across the United States (and the world), is not subject to specific personal jurisdiction in California courts under California data privacy laws based solely upon Shopify’s collection, retention and use of customer data from California residents. In making this ruling, the Ninth Circuit became the first Circuit in the nation to address this type of personal jurisdiction question involving a global online payment platform.
An individual who resides in California, while present in California, purchased goods online through his iPhone from a California-based retailer that, unknown to him at the time, utilized Shopify’s payment system. Shopify collected that individual’s personal and payment information as part of facilitating the transaction, and subsequently used his customer information to create a consumer profile that it shared with its merchant and other business partners. The individual filed a class action lawsuit in against Shopify in the United States District Court for the Northern District of California, alleging violations of various California state privacy and unfair competition laws because, he alleged, Shopify purportedly “deliberately concealed” its involvement in the purchase.
Shopify moved to dismiss the complaint for lack of personal jurisdiction in California courts. The district court agreed, dismissing the operative complaint without leave to amend. Plaintiff appealed.
The Ninth Circuit began its analysis of personal jurisdiction by explaining the differences between “general jurisdiction” and “specific jurisdiction.” General jurisdiction applies when a defendant is essentially “at home” in the forum state (e.g., the state where a defendant is incorporated or headquartered). Specific jurisdiction applies to defendants less connected with the forum state, but who have purposefully directed their activities, or purposefully availed themselves of the privileges, of the forum state. Because Shopify’s contacts with California were not sufficiently pervasive to support general jurisdiction, the Court focused its analysis on specific jurisdiction.
The Ninth Circuit ultimately held that Shopify’s data collection activities alone did not make it subject to specific jurisdiction in California, holding that Shopify did not expressly aim its activities at the forum state. The Court held that “[w]hen a company operates a nationally available e-commerce payment platform and is indifferent to the location of end-users, the extraction and retention of consumer data, without more, does not subject the defendant to specific jurisdiction in the forum where the online purchase was made.” The Court determined that even though the plaintiff resided in California and made his purchase while located in California, “it is the defendant’s contacts with the forum state, not the plaintiff’s, that matter, and it is the defendant’s contacts with the state itself, and not the persons there, that must drive the inquiry.”
The Court analogized to principles from its past rulings involving “interactive websites,” where users exchange information with the host computer, as distinguished from “passive websites” that merely host information, and determined that there must be “something more” demonstrating a specific targeting of the forum, such as advertising directed at state residents.
The Court distinguished the online sale of physical goods, which can establish jurisdiction, from Shopify’s web payment services, finding that the distribution of products into the forum state is categorically distinguishable. Instead, it held the proper analysis was whether Shopify specifically appealed to or cultivated a California user base, rather than just passively processing transactions from California residents. On the facts alleged, Shopify’s platform had no California focus and was indifferent to customer locations.
While noting that data collection could potentially create jurisdiction if the business was structured in a manner that actually targeted California, the Court ruled that was not the case based upon how Shopify operated its payment platform. The Court concluded that due process constraints prevented finding jurisdiction exists everywhere an internet business collects user data. However, the Court left open how this analysis would apply if the web platform was set up differently.
The Ninth Circuit’s ruling establishes that universal data collection through a website accessible nationwide does not necessarily make the site operator subject to specific jurisdiction wherever its users are located. Instead, in determining specific jurisdiction, courts will look at issues including site content, advertising, technology structure and intent to appeal to the forum state’s residents in determining whether a web-based payment platform will be subject to specific jurisdiction in a particular forum.
UPDATE: On May 14, 2024, the Court ordered that Brisken be reheard en banc, vacating the panel opinion. We will provide a further update after the en banc Court issues its decision.