[co-author: Courtland Cuevas]

On April 21, 2025, the United States Court of Appeals for the Ninth Circuit, sitting en banc, issued a watershed decision in Briskin v. Shopify, Inc., fundamentally altering the landscape of specific personal jurisdiction as applied to online platforms. Breaking with decades of established precedent limiting exercises of personal jurisdiction over nationally operating businesses, Briskin represents a dramatic shift for e-commerce entities. Plaintiffs are expected to aggressively push for broader assertions of jurisdiction, especially in privacy and data-collection cases involving online services. The decision has already drawn criticism for its impact on the existing framework for internet jurisdiction and lowering the threshold companies must meet to face litigation.

The case arose from a dispute brought by Brandon Briskin, a California resident, who alleged that Shopify, Inc., a Canadian-based e-commerce platform, along with two of its American subsidiaries, violated his privacy rights. When Briskin used his mobile device to purchase athletic apparel from a Shopify-hosted online storefront, he alleges Shopify not only facilitated payment processing but also embedded tracking cookies onto his device. These cookies allegedly harvested detailed personal information, including his geolocation, IP address, and browser identity, which Shopify subsequently shared with its merchant partners and third parties.

Briskin contended that Shopify’s conduct, carried out with knowledge of his California location, amounted to wrongful exploitation of consumer data without informed consent. Shopify, in turn, moved to dismiss the lawsuit for lack of personal jurisdiction, arguing that it operated a nationwide platform without targeting or directing any specific conduct toward California. The district court agreed, dismissing the complaint. A three-judge panel of the Ninth Circuit affirmed, finding that under existing law, a defendant’s operation of an accessible, nationwide platform, without differential targeting of a forum state, was insufficient to establish specific jurisdiction.

But upon rehearing en banc, the Ninth Circuit reversed course, adopting a much more expansive view of how personal jurisdiction principles apply to online businesses.

In its en banc opinion, the Ninth Circuit issued three principal determinations that together mark a notable shift in internet jurisdiction doctrine.

First, the court concluded that Shopify had purposefully directed its conduct toward California, despite its nationwide operations model. Rejecting the necessity of differential targeting (i.e., state specific targeting), the court reasoned that an interactive platform can “expressly aim” conduct at a forum state if it knowingly engages with consumers located there, even absent forum-specific marketing or outreach. The court emphasized that Shopify’s extraction, storage, and commercialization of California residents’ data were deliberate and foreseeable consequences of its business operations, not merely random or fortuitous contact.

This rejection of differential targeting represents a significant doctrinal shift. Historically, courts had been reluctant to find personal jurisdiction where a defendant’s online presence was generalized or passive. Briskin does away with that standard, and holds that deliberate operation of an interactive platform accessible in a forum, combined with the collection of sensitive user information, satisfies the minimum contacts analysis.

Second, the Ninth Circuit found a sufficient causal nexus between Shopify’s forum-related conduct and Briskin’s claims. The court explained that the injuries alleged, arising from unauthorized data collection and distribution, directly related to Shopify’s contacts with California. Shopify’s interaction with the plaintiff’s California-based device during a transaction, and the subsequent alleged misuse of personal data, provided the necessary connection to the forum state to satisfy the “arising out of or relating to” element required for specific jurisdiction.

Third, the court determined that exercising jurisdiction over Shopify in California was fair and reasonable. Shopify had argued that extending jurisdiction under these facts would expose it to litigation in all 50 states, creating an untenable risk for nationally operating platforms. The court dismissed these concerns, reasoning that if a company’s conduct similarly injures residents across multiple states, it should anticipate being subject to suit in each of those jurisdictions. Furthermore, the availability of alternative forums was deemed irrelevant to the fairness analysis.

The Ninth Circuit’s approach substantially reduces the burden for plaintiffs seeking to establish jurisdiction over online platforms and significantly raises the jurisdictional exposure for digital businesses.

Briskin is already prompting concern among legal scholars and practitioners. Without the limitations afforded to defendants under traditional differential targeting, any platform operating interactively and reaching consumers nationwide could theoretically be sued wherever users reside, regardless of whether the defendant intended to cultivate business in that jurisdiction. By deemphasizing the need for targeted conduct, the court effectively treats the mere accessibility and foreseeable use of an interactive platform as sufficient to establish jurisdiction. This expansion of scope will likely subjecting platforms to unpredictable and widespread litigation risk.

Briskin significantly alters the risk calculus for businesses operating online platforms accessible to consumers in multiple states.

In the wake of Briskin, digital businesses should consider exploring jurisdictional risk mitigation strategies, such as adjusting platform terms of service, seeking stronger user consents regarding data collection, or limiting certain platform functionalities based on user geography.

[View source.]