In a well-reasoned and encouraging decision to Internet businesses, the Northern District of Illinois recently found that even operating one of the largest, most popular websites in the world is not enough to create personal jurisdiction everywhere the site can be accessed. See Gullen v. Facebook, Inc., Case No. 15-cv-07681 (Jan. 21, 2016 N.D. Ill.). The court relied heavily on the Supreme Court’s decision in Walden v. Fiore, 134 S. Ct. 1115 (2014), and the Seventh Circuit’s decision in Advanced Tactical Ordnance Sys. LLC v. Real Action Paintball, LLC, 751 F.3d 796 (7th Cir. 2014), to hold that the Northern District of Illinois lacked specific personal jurisdiction over defendant Facebook.

The plaintiff in Gullen alleged that Facebook had unlawfully obtained and stored his biometric information without authorization. Id. At 2. To support personal jurisdiction, the plaintiff argued that Facebook was registered to do business in Illinois, had a sales and advertising office in Illinois, and “target[s] its facial recognition technology to millions of users who are residents of Illinois.” Id. at 3-4. The court found these alleged contacts insufficient to confer specific personal jurisdiction because the plaintiff had not connected the allegedly wrongful conduct to the Illinois business registration or office and had tacitly admitted that Facebook’s alleged collection of biometric information was not targeted at Illinois residents but instead applied to Facebook users generally. Id. “[T]he Seventh Circuit has rejected the notion that an online merchant’s operation of an interactive site is sufficient to confer specific jurisdiction on it in every state from which the site can be accessed. . . . Because plaintiff does not allege that Facebook targets its alleged biometric collection activities at Illinois residents, the fact that its site is accessible to Illinois residents does not confer specific jurisdiction over Facebook.” Id. at 4-5.

Facebook is, of course, a global social media presence with substantial connections to Illinois. Nevertheless, the court emphasized that the contacts must be contacts that the defendant (not the plaintiff or a third party) created. Id. at 3 (“We have consistently rejected attempts to satisfy the defendant-focused ‘minimum contacts’ inquiry by demonstrating contacts between the plaintiff (or third parties) and the forum State.”). The court found there was no personal jurisdiction because “plaintiff does not, and could not plausibly, allege that Facebook knew an Illinois resident would upload a photo of him and tag his name to it, thereby (allegedly) giving Facebook access to plaintiff’s biometric information.” Id. at 5.

In light of Walden, Advanced Tactical and Gullen, defendants in cases arising from alleged online conduct should carefully consider challenging personal jurisdiction. If a site like Facebook with “millions” of in-state contacts is not subject to personal jurisdiction, many other Internet companies should be able to successfully challenge personal jurisdiction based on the rationale laid out in these decisions.