Legalytics Report (4/24/2025): Shopify in the 9th Circuit and Top Tobacco in the 11th
An appellate opinion and oral argument this week tested the legal reach of code and courts—from online tracking in California to trademark penalties in Georgia.
Opinion in Briskin v. Shopify, Inc. (CA9 4/21/2025)
In a sweeping decision that could reshape how courts handle online data privacy disputes, the Ninth Circuit has ruled that Shopify can be hauled into California court for allegedly planting tracking software on consumers’ devices without their consent—even though Shopify isn’t based in California. The ruling marks a major development in the law of personal jurisdiction in the digital age.
What the Case is About
At the heart of this case is a routine online shopping trip that turned into a constitutional showdown. California resident Brandon Briskin used his iPhone to buy athletic wear from a local clothing retailer, IABMFG, through what he thought was a secure, merchant-operated checkout page. What he didn’t know, according to the complaint, was that Shopify—a Canadian e-commerce giant operating behind the scenes—had embedded itself into the transaction, collecting a trove of his personal information and secretly installing cookies to monitor his online behavior.
Briskin filed a class action lawsuit in federal court, accusing Shopify of violating California's robust consumer privacy laws by harvesting user data without consent. But before the case could move forward, the district court threw it out. Its reasoning: Shopify wasn’t sufficiently tied to California to be sued there, and the complaint didn’t clearly pin the alleged wrongdoing on specific corporate entities within Shopify’s web of subsidiaries.
That dismissal was initially upheld by a three-judge panel on appeal. But the Ninth Circuit reversed course after rehearing the case en banc—meaning all active judges on the circuit weighed in. In a forceful opinion, the court said Shopify had made itself subject to California’s jurisdiction by knowingly reaching into the state to collect data from residents like Briskin.
What the Court Decided
The Ninth Circuit didn’t just reverse the lower court—it sent a loud message about the future of digital privacy litigation. In an 11-judge en banc ruling, the court found that Shopify can be sued in California for its role in allegedly collecting and monetizing Californians’ personal information without consent.
Two major legal hurdles stood in Briskin’s way:
Personal jurisdiction — Could Shopify, headquartered in Canada and with U.S. subsidiaries based in New York and Delaware, be sued in California just because a California resident used its services?
Pleading sufficiency — Did Briskin’s complaint do enough to specify which Shopify entity was responsible for which actions?
On both counts, the court said yes.
The judges found that Shopify’s behind-the-scenes role in processing Briskin’s transaction—and its alleged use of tracking cookies and data-harvesting software—was not incidental or passive. Instead, Shopify had purposefully inserted itself into the devices and transactions of California consumers. The company, the court said, knew exactly where its users were, and used that data as part of a for-profit surveillance model embedded in its standard business practices.
Because Shopify allegedly tracked, stored, and shared personal data from California consumers while they were in California, the court ruled that it could reasonably be held accountable in California courts. This met the constitutional requirement that a defendant have “minimum contacts” with the state where it’s being sued.
And on the second issue, the court found that Briskin’s complaint was specific enough to survive. While it described a joint operation involving multiple Shopify entities, the complaint provided sufficient detail about each one's role in the alleged data collection scheme—enough, at least, to give them fair notice of the claims.
In sum: California courts have the green light to hear Briskin’s case, and Shopify must face the allegations head-on.
How the Court Got There
The Ninth Circuit didn’t just rely on gut instinct or a broad sense of digital justice. It rooted its ruling in decades of legal precedent—but with a distinctly modern twist. The court essentially asked: When a company reaches into your phone from thousands of miles away, is that the same as being there? The answer: Legally, yes.
The Legal Framework
To exercise specific personal jurisdiction, the court used a well-established three-part test:
Purposeful direction: Did Shopify intentionally direct its conduct at California?
Arising from: Do Briskin’s claims arise out of that California-targeted conduct?
Reasonableness: Is it fair and just to make Shopify defend itself in a California court?
For the first prong, the court relied on the “Calder effects” test, drawn from a 1984 Supreme Court case. That test says a company purposefully directs its actions at a state if it:
commits an intentional act,
expressly aims that act at the forum state, and
knows the harm will be felt there.
Shopify, the court found, hit all three.
Shopify Knew What It Was Doing
The judges emphasized that Shopify’s technology wasn’t just “available” in California—it was knowingly embedded in transactions happening in California, using geolocation tools and scripts to track user behavior. Shopify allegedly:
installed cookies on Briskin’s device knowing it was in California,
collected personal data during the purchase,
and sold or used that data for commercial gain, all while hiding its involvement.
That’s more than incidental contact, the court said—it’s deliberate digital intrusion.
Rejecting the “Nowhere Is Somewhere” Defense
Shopify argued that because it operates everywhere, it can’t be pinned to any one state. The court dismissed that as a kind of digital jurisdiction shell game. Just because Shopify has a national (or global) reach doesn’t mean it’s immune from state-level lawsuits when it targets and affects people in specific places.
In doing so, the Ninth Circuit overruled one of its own earlier cases, AMA Multimedia v. Wanat, which had suggested a company must “prioritize” or “focus” on a particular state to be sued there. The en banc court declared that standard too high—and fundamentally out of step with modern digital commerce. Now, if a company knowingly engages with consumers in a state, that’s enough.