A U.S. appeals court has revived a proposed data privacy class action against Shopify (SHOP.TO), a move that could significantly broaden American courts’ authority over internet-based companies.
In a 10-1 decision, the 9th U.S. Circuit Court of Appeals ruled that the Canadian e-commerce giant can be sued in California for allegedly collecting personal identifying information from residents who made purchases on California-based retailers’ websites.
The lawsuit, brought by California resident Brandon Briskin, alleges that Shopify installed tracking software, known as cookies, on his iPhone without his consent after he bought athletic wear from the retailer I Am Becoming. Briskin claims Shopify used the collected data to build a profile it could market to other merchants.
Shopify had argued that it should not be sued in California, asserting that its operations were nationwide and not specifically directed at the state. The Ottawa-based company suggested that Briskin should instead pursue claims in Delaware, New York, or Canada.
While a lower court judge and a three-judge panel initially sided with Shopify, the full appeals court reversed that decision, finding that Shopify “expressly aimed” its conduct at California.
“Shopify deliberately reached out … by knowingly installing tracking software onto unsuspecting Californians’ phones so that it could later sell the data it obtained, in a manner that was neither random, isolated, or fortuitous,” Circuit Judge Kim McLane Wardlaw wrote for the majority.
A Shopify spokesperson criticized the ruling, saying it “attacks the basics of how the internet works,” and warned that it could pull entrepreneurs into distant courtrooms far from where they operate. The company has not yet announced its next legal steps.
Brandon Briskin’s attorney, Matt McCrary, praised the decision, stating that the court strengthened accountability for internet-based firms by rejecting the argument that a company cannot be sued in any particular state simply because it operates everywhere.
A bipartisan coalition of 30 states and Washington, D.C. supported Briskin, arguing that states must retain the power to enforce consumer protection laws against companies that actively engage with local markets online.
Meanwhile, the U.S. Chamber of Commerce backed Shopify, warning that broadening jurisdiction could unfairly burden global service providers.
Circuit Judge Consuelo Callahan dissented, criticizing the majority’s “traveling cookie rule” as improperly creating jurisdiction based merely on where a consumer is located.
The 9th Circuit’s jurisdiction spans nine western U.S. states, Guam, and the Northern Mariana Islands.
The case is Briskin v. Shopify, Inc. et al, 9th U.S. Circuit Court of Appeals, No. 22-15815.
