• by Wendy Davis  @wendyndavis, April 21, 2025

Siding against the e-commerce platform Shopify, a federal appeals court said Monday that the company must face suit in California for allegedly surreptitiously collecting online shoppers' personal data.

In a 10-1 ruling, the 9th Circuit Court of Appeals rejected Shopify's argument that as an out-of-state service provider headquartered in Canada (with U.S. divisions in Delaware and New York), it had not engaged in the type of activity in California that would subject it to jurisdiction in the state.

Instead, the appellate judges essentially said allegations that Shopify secretly collected data from a California resident are enough to haul the company into court in the state.

“We conclude that Shopify is subject to specific personal jurisdiction in California,” Circuit Judge Kim McLane Wardlaw wrote for the majority.

“As a part of its regular course of business, Shopify is alleged to target California consumers to extract, collect, maintain, distribute, and exploit for its own profit, not only the California consumers’ payment information that it diverts to its own servers, but also all of the other personal identifying information that it extracts from the software it permanently installs on their devices without their knowledge or consent,” Wardlaw wrote.

“Pre-internet, there would be no doubt that the California courts would have specific personal jurisdiction over a third party who physically entered a Californian’s home by deceptive means to take personal information from the Californian’s files for its own commercial gain,” the judge added.

Circuit Judge Consuelo Callahan dissented, writing that the majority opinion “creates a new traveling cookie” rule for jurisdiction.

“Under our circuit’s newly divined rule, when a company attaches cookies to a person’s electronic device, jurisdiction attaches wherever that person happens to be, and indeed, wherever that person happens to travel thereafter,” Callahan wrote.

The ruling grew out of a dispute dating to August 2021, when California resident Brandon Briskin alleged in a class-action complaint that Shopify surreptitiously installed tracking cookies on his device as he was making a purchase from the online retailer IABMFG (iambecoming.com).

Briskin alleged Shopify was then able to track his activity and purchases across its network of merchants, and also transmitted information to the payment processor Stripe, which was them able to analyze and process the information.

Additionally, he alleged that Shopify used his data to create a profile of him that was then provided to other merchants. (Shopify denies sharing data between retailers.)

The complaint included claims that Shopify violated a California wiretap law that prohibits the interception of electronic communications without both parties' consent.

U.S. District Court Judge Phyllis Hamilton in the Northern District of California dismissed the claims in May 2022, ruling that the allegations, even if proven true, wouldn't show that Shopify was subject to the jurisdiction of California courts. Instead, she said, the allegations could establish only that Shopify was a vendor for the retailer IABMFG.

A three-judge panel of the 9th Circuit initially upheld that ruling, writing that Shopify didn't specifically direct its activity toward California residents.

Briskin then asked for a majority of the circuit's judges to re-hear the case. In May 2024, the court withdrew the panel ruling and said it would reconsider the matter.

Shopify and its supporters -- including the Interactive Advertising Bureau -- argued to the 9th Circuit that the initial decision was correct.

The Interactive Advertising Bureau and others, including the Apple-backed group ACT-The App Association and The Business Software Alliance, said Shopify is only a “backend service provider” and shouldn't have to defend itself in every state where its client does business.

Attorneys general in 30 states and the District of Columbia argued for the opposite result, essentially contending in a friend-of-the-court brief that internet companies that regularly conduct business in a particular state can be sued in that state.