Consumers urge full Ninth Circuit to revive data privacy suit against Shopify

SAN FRANCISCO (CN) — At an en banc Ninth Circuit hearing Thursday morning, an attorney representing consumers who sued e-commerce platform Shopify in a data privacy suit said that California has personal jurisdiction over the suit despite Shopify being a Canadian company.

An e-commerce platform, Shopify helps businesses build and manage online stores and sell products. Lead plaintiff Brandon Briskin filed a class action against Shopify in 2021, claiming it extracted his sensitive personal and financial data without his consent when he made a purchase from a California merchant through Shopify’s platforms, in violation of California law.

A federal judge dismissed the suit for lack of jurisdiction, a decision that was affirmed by a Ninth Circuit panel last November. The plaintiffs then filed a petition to rehear the case en banc, which occurred Thursday.

In an amicus brief in July, 30 attorneys general from various states supported the efforts to revive the lawsuit, writing that the Ninth Circuit panel decision “erroneously grants websites special treatment” by requiring proof of conduct targeted at a particular state “in differential excess” from conduct aimed at other states. Mississippi Attorney General Lynn Fitch summarized the lower court’s holding as “essentially finding that because online companies do business everywhere, they can be held accountable nowhere.”

Class counsel Nicolas Sansone told the en banc panel Thursday that establishing personal jurisdiction is about Shopify’s actions and Shopify’s actions were clear.

“Shopify voluntarily and intentionally sent tracking software into California, onto the shopperss computer precisely as Shopify intended and desired. This tracking software remained on the computer indefinitely thereafter, sending a continuous stream of information about the California shoppers’ online activities out of California and directly to Shopify on an ongoing basis,” Sansone said.

Sansone said that Shopify embedded cookies on users’ devices when they entered the purchase portal on Shopify, even if they didn’t purchase an item, and used that information to compile profiles of users, which it sold to third parties. He called the practice Shopify’s “second business model” after its e-commerce business.

U.S. Circuit Judge Roopali Desai, a Joe Biden appointee, asked Sansone if he was arguing that online businesses should be subject to jurisdiction in any state they do business in.

“When a defendant makes money off of individuals in the forum state, whether that is by selling them products, whether that is by taking information from them, or taking valuable intangible property from them, and then uses that property, that intangible property to then turn a profit, selling it on to other people, other businesses, we think that is the deliberate and systematic exploitation of an in state market,” Sansone said.

U.S. Circuit Judge Kim Wardlaw, a Bill Clinton appointee, understood Sansone’s argument. She said that even if a consumer used Shopify in a different state before returning to California, that the invasion of privacy would be an ongoing injury that is happening in California.

Moez Kaba, counsel for Shopify, argued that there was no specific jurisdiction for any claim in the case. He said Shopify did not specifically aim any of its conduct at California. Kaba said Shopify processes online transactions the same way regardless of the location of the purchaser or the merchant.

“Appellant essentially argues that because an internet service can function anywhere, the company must be subject to jurisdiction everywhere. No matter that Shopify is completely forum-agnostic, has no specific focus on California and has no direct dealings with customers like appellant at all,” Kaba said.

U.S. Circuit Judge Daniel Collins, a Donald Trump appointee, was perplexed by Kaba’s argument that California had no personal jurisdiction.

“Contacting a device in California and putting something on the device in California and sending it out doesn’t occur in California?” Collins asked. “How does the conduct not occur in California?”

He then asked Kaba why Shopify wouldn’t be liable in all 50 states if it chooses to do business in them. Kaba again answered that Shopify is forum-agnostic.

U.S. Circuit Judge Mark Bennett, a Trump appointee, said that he was struggling to see any jurisdictional difference between Shopify’s supposed conduct and a hypothetical where an actor inserted a virus into a computer physically located in California to steal the data of a person in California.

U.S. Circuit Judge Michelle Friedland was also skeptical.

“If you have the ability to block California purchases, you’re putting in the cookie when you know the person is in California, once you continue to do it, isn’t that deliberate?” the Barack Obama appointee asked.

Kaba replied, “The claim occurs when the tracking software is input. That is the claim of the privacy violation, and at that moment, Shopify has not expressly aimed its conduct."

Bennett followed Friedland and said Shopify has a choice to not do business in certain jurisdictions, and that if an entity chose to do business in a jurisdiction it would likely be subject to that jurisdiction’s laws.

On rebuttal, Sansone again asked the court to revive the case and rule that California had personal jurisdiction.

“There is no other forum other than California that has an interest in this litigation, and so if specific jurisdiction is not proper in California, It’s not proper anywhere,” Sansone said.

Chief U.S. Circuit Judge Mary Murguia and U.S. Circuit Judge Morgan Christen, both Obama appointees, and U.S Circuit Judges Consuelo Callahan, a George W. Bush appointee, Johnnie Rollinson, a Bill Clinton appointee, Holly Thomas, a Biden appointee and Patrick Bumatay, a Trump appointee, also sat on the panel.