A federal appeals panel has agreed a class action accusing Shopify of improperly sharing customer data cannot continue, finding an online shopper in California cannot file lawsuits in state court against every company involved in obtaining personal information in connection with an online transaction.
U.S. District Judge Phyllis Hamilton dismissed the complaint of Brandon Briskin, who accused Shopify, an online payment processor based in Ottawa, Ontario, Canada, of intentionally concealing its role in certain transactions in violation of state privacy and unfair competition laws. Briskin challenged that ruling before the U.S. Ninth Circuit Court of Appeals.
Ninth Circuit Judge Daniel Bress wrote the panel’s opinion, published Nov. 28; Judges Consuelo Callahan and Bridget Bade concurred.
U.S. Ninth Circuit Court of Appeals Judge Daniel Bress
| Ballotpedia
According to the opinion, Briskin used his phone in June 2019 to buy fitness apparel from IABMFG, a California-based retailer that used Shopify technology to process orders and payments. Briskin said Shopify installed cookies on his phone, connected his Safari browser to its network, stored his credit card information and sent it to Stripe, also a payment processor, then used his transaction to create a consumer profile it shared with business partners.
In his August 2021 lawsuit, Briskin called for creating a class of additional plaintiffs including anyone who submitted payment information through a Shopify service as far back as Aug. 13, 2017. To establish his right to sue Shopify in state court, Baskin noted the company opened a physical location in Los Angeles in 2018; has more than 80,000 merchant customers in California — including some of the largest on its platform; and has at least one in-state fulfillment center.
Furthermore, Briskin alleged Shopify USA had an office in San Francisco and has a quarter of its employees in the state. He also said Stripe is based in California. However, Judge Hamilton dismissed Briskin’s second amended complaint for lack of personal jurisdiction without leave to amend. The Ninth Circuit panel agreed that was proper, saying the primary question was whether Shopify “expressly aimed” business activities at California.
“When a company operates a nationally available e-commerce payment platform and is indifferent to the location of end-users, the extraction and retention of consumer data, without more, does not subject the defendant to specific jurisdiction in the forum where the online purchase was made,” Bress wrote.
Although Briskin offered several examples of Shopify conducting business in California, the panel said, he failed to connect the specific nature of his allegations to his state of residence as distinct from other shoppers who use Shopify platforms.
“There is no such causal relationship between Shopify’s broader California business contacts and Briskin’s claims because these contacts did not cause Briskin’s harm,” Bress wrote. “Indeed, Briskin himself acknowledges in his opening brief that ‘the direct, unmediated interactions between Shopify and California shoppers through an interactive web-based payment platform are what form the basis for (his) claims.’ It is readily apparent there will be causes of action that do arise out of Shopify’s broader business contacts with California (such as claims by a California merchant). But Briskin’s claims are not among them.”
To the extent Briskin suffered legal damage, the panel continued, it would’ve been the same had he bought items from a retailer based in a different state, or had he been away from home while shopping online. The panel noted it hasn’t analyzed the legal issue of a payment platform coming in between a California resident and a California business, but said case law involving other “out-of-state interactive websites” established the importance of ascertaining if a defendant created the conditions at question in a given legal forum.
The panel said Briskin failed to show how Shopify specifically targeted California and noted the importance of “due process constraints on the assertion of personal jurisdiction over non-resident defendants who operate through the internet.” The judges further rejected his argument that Shopify extracted consumer data in outsized proportion to other interactive websites that have been the subject of litigation.
“While Shopify does have a sizeable merchant base in California, its extraction and retention of consumer data depends on the actions of third-party merchants who are engaged in independent transactions that themselves do not depend on consumers being present in California,” Bress wrote. "The problems with Briskin’s theory of personal jurisdiction are endemic to the nature of his claims and Shopify’s business structure.”
Representing Briskin were attorneys from Public Citizen Litigation Group, of Washington, D.C., and Gutride Safier, of San Francisco. Gutride Safier did not respond to a request for comment.
Shopify’s representatives included attorneys from the Hueston Hennigan firm's offices in Los Angeles, Newport Beach and New York.