/>iIn a landmark ruling, the Ninth Circuit expanded the application of specific personal jurisdiction principles to the realm of nationwide e-commerce. On April 21, 2025, an en banc panel issued a 10–1 decision ruling that allegations that Shopify embedded cookies that tracked a California consumer’s location data were sufficient to establish specific personal jurisdiction over Shopify in California (reversing the Court’s prior opinion on this exact issue). In the wake of this decision, businesses may face increased legal challenges in various states. To protect against far-flung lawsuits in unwanted jurisdictions, e-commerce businesses should, if practicable, refrain from collecting location data and engaging in other online activities that may be seen as targeting consumers of a particular state.
The case—Brandon Briskin v. Shopify, Inc.—involves Brandon Briskin, a California resident, who accused Shopify, Inc., a Canadian corporation, along with its U.S. subsidiaries, of privacy violations during an online transaction. Briskin alleged that Shopify unlawfully collected and used his personal information, including location data, without consent, focusing on Spotify allegedly installing tracking cookies and creating consumer profiles from collected data. The district court dismissed the case for lack of specific personal jurisdiction, ruling that an e-commerce platform such as Shopify, which operates nationwide, does not specifically target California residents. The Ninth Circuit affirmed the district court’s ruling but later agreed to reconsider the personal jurisdiction determination en banc.
Applying traditional personal jurisdiction principles to Shopify’s e-commerce activities, the Ninth Circuit panel held that because Shopify’s geolocation technology allowed it to know where Briskin’s smartphone was located in California when it installed cookies on his device, Shopify’s conduct of intercepting Briskin’s information deliberately targeted a California resident, meeting the purposeful direction requirement for specific personal jurisdiction. Accordingly, per the Ninth Circuit, an interactive platform “expressly aims” its wrongful conduct toward a forum state when its contacts are its “own choice and not ‘random, isolated, or fortuitous,’” even if that platform cultivates a “nationwide audience[] for commercial gain.
A significant aspect of the decision was the panel’s rejection of the necessity for “differential targeting,” which refers to the concept that a defendant’s actions within a forum state create specific personal jurisdiction only if the defendant acted with “some prioritization of the forum state”—rather than a general, nationwide focus. This ruling indicates that a business model like Shopify’s, which operates nationwide and utilizes consumer data, can be subject to jurisdiction in any state where it (1) gathers data from a resident of such state and (2) the business has some indication of the resident’s physical location when interacting with the business.
Judge Callahan dissented, expressing concerns that Shopify’s conduct was not expressly aimed at California. The dissent cautioned that the majority’s approach could lead to companies facing jurisdiction based solely on the plaintiff’s location during transactions and noted “[b]y holding that California courts can exert specific jurisdiction over Shopify because Briskin used his iPhone while ‘located in California,’ […] the majority opinion departs from the longstanding principle that jurisdiction turns on ‘the defendant’s contacts with the forum State itself, not the defendant’s contacts with persons who reside there.’”
Putting it Into Practice: The Ninth Circuit’s decision is a major sea change to personal jurisdiction of businesses in the digital age, particularly e-commerce businesses. This ruling serves as a reminder for e-commerce platforms to consider their interactions with consumers in various states, as their business activities may subject them to jurisdictions across the map. To lessen the impact of the Shopify ruling and the likelihood of personal jurisdiction being established in states in the Ninth Circuit businesses can consider geofencing, refraining from collecting online location data, and making sure that other aspects of the business’s online activities are not purposefully directed at a particular state.
