In a decision last week, the Ninth Circuit Court of Appeals affirmed dismissal of a putative class action concerning allegations that Shopify violated various California privacy and unfair competition laws by purportedly concealing its involvement in online consumer transactions.  Briskin v. Shopify, Inc., No. 22-15815, 2023 WL 8225346 (9th Cir. Nov. 28, 2023).  In this ruling of first impression, the Ninth Circuit outlined several “key principles” to govern the assessment of whether personal jurisdiction exists as to online platforms in consumer data collection and retention cases going forward.  Read on to learn more.

Case Background

Plaintiff in Briskin is a California resident who, allegedly while physically present in California, used his iPhone to purchase fitness apparel.  Plaintiff alleged in the Complaint that unknown to him, the company he purchased clothing from usedsoftware and code from Shopify, Inc. to process customer orders and payments.

Shopify is a Canadian corporation with its headquarters in Canada.  It provides participating merchants with a sales platform that enables the processing of online purchases.  As alleged in the Complaint, Shopify obtains, processes, stores, analyzes, and shares the information of consumers who complete transactions on Shopify’s merchant-customers’ websites.  Plaintiff in this case asserted that when he provided his personal information and credit card information for purposes of ordering fitness apparel online, Shopify: (i) “collected this information”; (ii) “installed cookies onto [Plaintiff’s] phone, connected his browser to its network, generated payment forms requiring [Plaintiff] to enter private identifying information, and stored [Plaintiff’s] personal and credit card information for later use and analysis; (iii) “transmitted [Plaintiff’s] payment information to a second payment processor”; and (iv) “used the customer information it received to create consumer profiles, which Shopify also shared with its merchant and other business partners.”

Plaintiff filed a putative class action in California federal court, asserting that Shopify violated various California privacy and unfair competition laws because it deliberately concealed its involvement in the consumer transactions.  Plaintiff sought to represent a putative class defined as “[a]ll natural persons who, between August 13, 2017 and the present, submitted payment information via Shopify’s software while located in California.”  Shopify and two of its wholly owned subsidiaries (neither of which were headquartered or had their principal place of business in California) were named as defendants.  Defendants moved to dismiss Plaintiff’s claims for lack of personal jurisdiction.

Overview of General vs. Specific Jurisdiction

Federal courts have limited jurisdiction, and generally may not exercise judicial power over defendants that do not reside in the forum.  In any case, the plaintiff bears the burden of establishing personal jurisdiction over a defendant.

Consistent with Supreme Court precedent, a court’s power to exercise personal jurisdiction manifests in two basic ways: general or all-purpose jurisdiction, and specific or case-linked jurisdiction. For a corporation, the paradigm forum for the exercise of general jurisdiction is one in which the corporation is fairly regarded as at home—which encompasses the corporation’s place of incorporation and its principal place of business.  By contrast, specific jurisdiction is narrower.  It covers defendants less intimately connected with a State, but only as to a narrower class of claims.  There are three requirements for a court to exercise specific jurisdiction over a defendant in a litigation.  First, the defendant must have “purposefully availed” itself of “the benefits and protections of the forum’s laws.” Burger King Corp. v. Rudzewicz, 471 U.S. 462, 475-76 & 482 (1985) (citation omitted).  Generally, this requires “some act by which the defendant purposefully avails itself of the privilege of conducting activities within the forum State.”  Hanson v. Denckla, 357 U.S. 235, 253 (1958).  Second, the plaintiff’s claims “must arise out of or relate to the defendant’s contacts” with the forum.  Ford Motor Co., 141 S. Ct. at 1025.  Third, the court must assess the reasonableness and substantial justice of exercising jurisdiction over the defendant in the particular case.

The Ninth Circuit’s Ruling on Personal Jurisdiction

Plaintiff in this case did not argue that there was general jurisdiction over Shopify or its subsidiaries named as Defendants.  Instead, the issue before the Ninth Circuit was whether the District Court had correctly dismissed the case for lack of specific jurisdiction on the basis that the Shopify “expressly aimed” its activities at the forum state so as to satisfy the second prong required for the exercise of specific jurisdiction in the litigation.

In addressing this issue, the Court noted that “[f]or specific jurisdiction to exist over Shopify, [Plaintiff’s] claim “must be one which arises out of or relates to the defendant’s forum-related activities.” (citation omitted).  As such, “[t]his is a claim-tailored inquiry that requires [the Court] to examine the plaintiff’s specific injury and its connection to the forum-related activities in question.”  On this basis, the Court held that the central jurisdictional inquiry boiled down to the question of causation, finding that [Plaintiff’s] claims do not “arise out of” Shopify’s broader forum-related activities in the state (its contracts with California merchants, physical Shopify offices, and so on)”  Rather, an injury arising “out of a defendant’s forum contacts require[s] ‘but for’ causation, in which ‘a direct nexus exists between a defendant’s contacts with the forum state and the cause of action.’”

As such, the Court determined that “[t]here is no such causal relationship between Shopify’s broader California business contacts and [Plaintiff’s] claims because these contacts did not cause [Plaintiff’s] harm.”  Nor, the Court held, did Plaintiff’s claims “relate to” Shopify’s “broader business activities in California outside of its extraction and retention of [Plaintiff’s] data.”  The Ninth Circuit reasoned that:

[Plaintiff] would have suffered the same injury regardless of whether he purchased items from a California merchant or was physically present in California when he did so.  To the extent [Plaintiff] suggests that Shopify’s broader business actions in California set the wheels in motion for Shopify to eventually inflict privacy-related harm on him in California, such a butterfly effect theory of specific jurisdiction would be far too expansive to satisfy due process.
(emphasis supplied).

Other Principles Set Forth by the Ninth Circuit to Guide Other Cases

The Ninth Circuit framed the core issue presented in this question was a novel one, concerning “whether Shopify, which provides web-based payment processing services to online merchants throughout the nation (and the world), thereby expressly aimed its conduct toward California.” 

Because Shopify operates a web-based platform, the Court found (and the parties agreed) that Ninth Circuit personal jurisdiction cases involving interactive websites should govern the jurisdictional inquiry as to Shopify and litigations other involving a broadly accessible back-end web platform.  The Court stated the core principles governing the personal jurisdiction inquiry were the following:

• “First, the fact that a broadly accessible web platform knowingly profits from consumers in the forum state is not sufficient to show that the defendant is expressly aiming its intentional conduct there.” (emphasis supplied).

• “Second, to establish the ‘something more’ needed to demonstrate express aiming in suits against internet platforms, the plaintiff must allege that the defendant platform has a forum-specific focus.”  In the alternative, “the plaintiff must allege that the defendant is specifically ‘appeal[ing] to … an audience in a particular state’ or ‘actively target[ing]’” the forum state (citations omitted).  The Court explained that what is needed in either instance, however, is “differentiation of the forum state from other locations . . . which permits the conclusion that the defendant’s suit-related conduct ‘create[s] a substantial connection” with the forum.’” (citations omitted).

• “Third, the specific nature and structure of the defendant’s business matters.”  The Court explained that “how the defendant operates and organizes its web-based platform” and how the defendant interacts with relevant third parties all affect the “something more” analysis.

Conclusion

In ruling that Shopify was not subject to specific jurisdiction for Plaintiff’s claims, the Court cautioned that it was not suggested “that the extraction and retention of consumer data can never qualify as express aiming” for purposes of establishing specific jurisdiction over a defendant.  The Court noted that because “the nature and structure of a defendant’s business can affect the personal jurisdiction analysis,” personal jurisdiction in all instances depends on a “fact-intensive” assessment.  Therefore, the Court’s ruling in this case was based on an application to the facts as alleged in Plaintiff’s Complaint.  However, the principles set forth in the decision will undoubtably guide consumer privacy litigations in the Ninth Circuit going forward, and will be persuasive authority to defendants in other cases.  For more, stay tuned.  Privacy World will be there to keep you in the loop.