With so many companies being hauled into court in California based on claims that the functionalities on their website and use of service providers for marketing or analytics purposes violate consumer privacy rights, it is important to exhaust all possible defenses available to defendants. Late last year, the Ninth Circuit issued a ruling upholding a dismissal based on a lack of personal jurisdiction over a web-based payment company. Companies operating interactive websites may be able to take advantage of this ruling as part of their defense strategy in 2024.
In Briskin v. Shopify, Inc., the plaintiff sued Shopify in California in a putative class action alleging that its collection, retention, and use of consumer data obtained from persons who made online purchases violated various California privacy and unfair competition laws. 87 F.4th 404 (9th Cir. Nov. 28, 2023). The district court dismissed plaintiff's complaint based on a lack of specific jurisdiction over the defendant, and the Ninth Circuit affirmed. Id.
The plaintiff conceded that there was no general jurisdiction over Shopify because it was neither incorporated nor maintained a principal place of business in California, but argued that Shopify was subject to specific jurisdiction based on its contractual relationships with California merchants, its operation of one physical location in California, and its knowledge that California residents were being potential injured based on the allegations. Id. at 409-10. The Ninth Circuit conducted an in-dept analysis of specific jurisdiction as it relates to claims that involve interactive websites. The court noted that in order for specific jurisdiction to exist, the defendant must either purposefully direct its activities toward the forum or the claim must be one that arises out of or relates to the defendant's forum related activities. Id. at 411. The court found that while Shopify committed an intentional act and caused harm it knew was likely to be suffered in the forum state, there was no conduct which Shopify "expressly aimed at the forum state" to create specific jurisdiction. Id. at 412.
In conducting this analysis, the court isolated the activities relevant to the specific jurisdiction analysis: Shopify's alleged collection, retention and use of consumer data obtained from online purchases processed through its platform. Id. at 415. Thus, the key issue was whether Shopify's web-based processing service is expressly aimed at California in any way. Id. The court relied on precedent involving out-of-state interactive websites finding those cases to be the most analogous to this "novel" issue. Id. at 415-20. The court noted that operation of an interactive website does not, by itself, establish express aiming but there must be something more. Id. at 418. That is, "when the website is the only jurisdictional contact, [the] analysis turns on whether the site had a forum specific focus or the defendant exhibited an intent to cultivate an audience in the forum" such as through the platform itself having a forum-specific aim, evidence showing that the website appeals to an audience of a particular state, or that the website actively targeted the forum in some way. Id. at 418-20. In reaching its conclusion, the Ninth Circuit agreed that Shopify's web payment platform did not have a forum specific focus and is indifferent to the location of the merchant or the end-consumer. Id. at 422-23. While Shopify benefits from consumers who are present in California, that alone does not answer the purposeful direction question because it does not demonstrate "express aiming." Id. at 423.
The claims alleged in Briskin are similar to those being asserted against hundreds of retailers alleging violations of various privacy laws including the California Invasion of Privacy Act. Thus, similar to Briskin, personal jurisdiction over companies based outside of California but operating an interactive website that is accessible to California residents should be analyzed under a similar specific jurisdiction framework. This is a defense that may be applicable in these cases and could provide defendants with early relief. With no clear direction being taken yet on as to the merits of these privacy claims and no slowdown in the filings of these claims under evolving theories of privacy violations, a successful personal jurisdiction argument could be an important arrow in the defense bar's quiver.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.