Key Takeaways

• In a recent decision by the Ninth Circuit in Briskin, the court ruled that e-commerce platform Shopify purposefully directed its conduct toward California because of its nationwide operations, rejecting the need for differential targeting of a forum state.
• Notably, the court found a direct causal nexus between Shopify’s conduct and Briskin’s claims, deeming an exercise of specific jurisdiction over Shopify in California fair and reasonable.
• Legal scholars are concerned that the decision could broadly expand the scope of specific personal jurisdiction and increase litigation risks for online platforms.
• Companies should reassess their data practices and anticipate forum shopping by plaintiffs following Briskin.

On April 21, 2025, the United States Court of Appeals for the Ninth Circuit, sitting en banc, issued a watershed decision in Briskin v. Shopify, Inc., fundamentally altering the landscape of specific personal jurisdiction as applied to online platforms. Breaking with decades of established precedent limiting exercises of personal jurisdiction over nationally operating businesses, Briskin represents a dramatic shift for e-commerce entities. Plaintiffs are expected to aggressively push for broader assertions of jurisdiction, especially in privacy and data-collection cases involving online services. The decision has already drawn criticism for its impact on the existing framework for internet jurisdiction and lowering the threshold companies must meet to face litigation.

Background of the Case

The case arose from a dispute brought by Brandon Briskin, a California resident, who alleged that Shopify, Inc., a Canadian-based e-commerce platform, along with two of its American subsidiaries, violated his privacy rights. When Briskin used his mobile device to purchase athletic apparel from a Shopify-hosted online storefront, he alleges Shopify not only facilitated payment processing but also embedded tracking cookies onto his device. These cookies allegedly harvested detailed personal information, including his geolocation, IP address, and browser identity, which Shopify subsequently shared with its merchant partners and third parties.

Briskin contended that Shopify’s conduct, carried out with knowledge of his California location, amounted to wrongful exploitation of consumer data without informed consent. Shopify, in turn, moved to dismiss the lawsuit for lack of personal jurisdiction, arguing that it operated a nationwide platform without targeting or directing any specific conduct toward California. The district court agreed, dismissing the complaint. A three-judge panel of the Ninth Circuit affirmed, finding that under existing law, a defendant’s operation of an accessible, nationwide platform, without differential targeting of a forum state, was insufficient to establish specific jurisdiction.

But upon rehearing en banc, the Ninth Circuit reversed course, adopting a much more expansive view of how personal jurisdiction principles apply to online businesses.

The Ninth Circuit’s Analysis

In its en banc opinion, the Ninth Circuit issued three principal determinations that together mark a notable shift in internet jurisdiction doctrine.

Purposeful Direction Toward California

First, the court concluded that Shopify had purposefully directed its conduct toward California, despite its nationwide operations model. Rejecting the necessity of differential targeting (i.e., state specific targeting), the court reasoned that an interactive platform can “expressly aim” conduct at a forum state if it knowingly engages with consumers located there, even absent forum-specific marketing or outreach. The court emphasized that Shopify’s extraction, storage, and commercialization of California residents’ data were deliberate and foreseeable consequences of its business operations, not merely random or fortuitous contact.

This rejection of differential targeting represents a significant doctrinal shift. Historically, courts had been reluctant to find personal jurisdiction where a defendant’s online presence was generalized or passive. Briskin does away with that standard, and holds that deliberate operation of an interactive platform accessible in a forum, combined with the collection of sensitive user information, satisfies the minimum contacts analysis.

Nexus Between Shopify’s Conduct and Plaintiff’s Claims

Second, the Ninth Circuit found a sufficient causal nexus between Shopify’s forum-related conduct and Briskin’s claims. The court explained that the injuries alleged, arising from unauthorized data collection and distribution, directly related to Shopify’s contacts with California. Shopify’s interaction with the plaintiff’s California-based device during a transaction, and the subsequent alleged misuse of personal data, provided the necessary connection to the forum state to satisfy the “arising out of or relating to” element required for specific jurisdiction.

Reasonableness of Exercising Jurisdiction

Third, the court determined that exercising jurisdiction over Shopify in California was fair and reasonable. Shopify had argued that extending jurisdiction under these facts would expose it to litigation in all 50 states, creating an untenable risk for nationally operating platforms. The court dismissed these concerns, reasoning that if a company’s conduct similarly injures residents across multiple states, it should anticipate being subject to suit in each of those jurisdictions. Furthermore, the availability of alternative forums was deemed irrelevant to the fairness analysis.

The Ninth Circuit’s approach substantially reduces the burden for plaintiffs seeking to establish jurisdiction over online platforms and significantly raises the jurisdictional exposure for digital businesses.

Broader Implications and Emerging Concerns

Briskin is already prompting concern among legal scholars and practitioners. Without the limitations afforded to defendants under traditional differential targeting, any platform operating interactively and reaching consumers nationwide could theoretically be sued wherever users reside, regardless of whether the defendant intended to cultivate business in that jurisdiction. By deemphasizing the need for targeted conduct, the court effectively treats the mere accessibility and foreseeable use of an interactive platform as sufficient to establish jurisdiction. This expansion of scope will likely subjecting platforms to unpredictable and widespread litigation risk.

What This Means Moving Forward

Briskin significantly alters the risk calculus for businesses operating online platforms accessible to consumers in multiple states.

• Companies can no longer rely on the absence of intentional forum targeting to shield themselves from exercises of jurisdiction. Operating a nationwide or globally accessible platform, or collecting consumer data as part of ordinary business operations, may now suffice to establish jurisdiction.
• Moving forward, companies must carefully assess their data collection, tracking, and storage practices, particularly where those practices involve personal information of users residing in the United States.
• Businesses can anticipate an increase in forum shopping by plaintiffs seeking to sue in perceived plaintiff-friendly jurisdictions, especially those operating within or adjacent to the Ninth Circuit’s reach should be especially vigilant.

In the wake of Briskin, digital businesses should consider exploring jurisdictional risk mitigation strategies, such as adjusting platform terms of service, seeking stronger user consents regarding data collection, or limiting certain platform functionalities based on user geography.

Courtland Cuevas contributed to this article