On April 21, 2025, a Ninth Circuit en banc panel revived (by a 10-1 decision) a putative class action against Shopify, Inc. alleging violations of privacy and data rights via use of cookies. In reversing both the district court and the original Ninth Circuit three-judge panel, the en banc panel adopted an alarmingly expansive view of specific personal jurisdiction over Internet-based companies. We hope Shopify seeks and the U.S. Supreme Court grants certiorari.
As Judge Callahan wrote in dissent: “[T]he majority opinion creates a new ‘traveling cookie’ rule for in personam jurisdiction. Under our circuit’s newly divined rule, when a company attaches cookies to a person’s electronic device, jurisdiction attaches wherever that person happens to be, and, indeed, wherever that person happens to travel thereafter.” Briskin v. Shopify, Inc., 2025 WL 1154075, at *25 (9th Cir. Apr. 21, 2025) (Callahan, C., dissenting). That newly divined rule flies in the face of the U.S. Supreme Court’s admonition against universal jurisdiction. See J. McIntyre Mach., Ltd. v. Nicastro, 564 U.S. 873, 884 (2011) (“[P]ersonal jurisdiction requires a forum-by-forum, or sovereign-by-sovereign, analysis. The question is whether a defendant has followed a course of conduct directed at the society or economy existing within the jurisdiction of the given sovereign, so that the sovereign has the power to subject the defendant to judgment concerning that conduct.”); see also id. at 892 (“And a rule like the New Jersey Supreme Court suggests would require every product manufacturer, large or small, selling to American distributors to understand not only the tort law of every State, but also the wide variance in the way courts within different States apply that law.”) (Justices Breyer and Alito, concurring). The Shopify majority en banc opinion also gives undue weight to plaintiff locale. See Walden v. Fiore, 571 U.S. 277, 291 (2014) (finding that the well-established principals of personal jurisdiction require consideration of the defendants’ contacts with the forum state and that the court has consistently rejected attempts to establish personal jurisdiction based on the plaintiff’s contacts with the forum state).
Plaintiff Brandon Briskin, a California resident, originally sued Shopify and U.S.-based subsidiaries in the U.S. Northern District of California. Shopify is an Ottawa, Ontario-based company, and none of its U.S.-based subsidiaries is a citizen of California. Briskin alleged that Shopify violated various California privacy and business laws; Article 1, Section 1 of the California Constitution; and the Fourth Amendment of the U.S. Constitution when Shopify installed tracking software via Internet cookies on his iPhone without his consent.
Briskin alleged that Shopify installed the cookies on his iPhone after he purchased athletic wear from a retailor that utilized Shopify’s online retail platform. The retailer’s checkout page and privacy policy contained no mention of Shopify or the specific cookies, according to Briskin. These cookies allegedly remained on Briskin’s iPhone, tracked his physical location and collected personally identifiable information along with online shopping habits.
In 2022, the district court held that it lacked specific personal jurisdiction over Shopify and its U.S.-based subsidiaries and dismissed the case (general jurisdiction wasn’t argued by Briskin). Briskin, 2025 WL 1154075, at *5. Briskin appealed the dismissal to the Ninth Circuit in 2023, and a unanimous three-judge panel affirmed the district court’s dismissal. Id. But a majority of the judges on the Ninth Circuit voted to rehear the appeal en banc.
In the majority en banc opinion reversing the original Ninth Circuit panel, Judge Wardlaw wrote that the court’s opinion was rooted in “traditional personal jurisdiction precedent” as it is applied to the “ever-evolving world of e-commerce.” Purportedly under these precedents, the court found that Shopify purposefully targeted consumers in California through its alleged misconduct of obtaining and commercializing California consumers’ personal data. The majority opinion rejected Shopify’s argument that its nationwide market makes it “agnostic as to the location in which it data-mines.” According to the majority opinion, Shopify could not evade personal jurisdiction in California because Shopify knowingly targeted consumers in California by allegedly installing tracking software on consumer’s devices and monetizing the data it obtained.
Astonishingly, neither the majority opinion nor the concurrences directly address the U.S. Supreme Court’s admonition against universal personal jurisdiction. Nicastro, 564 U.S. at 884, 892. Nor do the majority opinion or the concurrences properly analyze the fact that the defendants’ volitional contacts with the forum are what matter in the personal jurisdiction analysis, not the fact that a plaintiff just so happens to be in the forum. Walden, 571 U.S. at 285 (“But the plaintiff cannot be the only link between the defendant and the forum. Rather, it is the defendant’s conduct that must form the necessary connection with the forum State that is the basis for its jurisdiction over him.”).
As the dissent reasoned, the majority opinion essentially adopts a notion of universal jurisdiction where Internet companies such as Shopify would be subject to specific personal jurisdiction everywhere. Briskin, 2025 WL 1154075, at *25-26 (Callahan, C., dissenting). As the dissent further reasoned, the majority opinion “creates a traveling cookie that ultimately crumbles when held up against Supreme Court precedent because it detaches the jurisdictional inquiry from the contacts the ‘defendant himself’ creates with the State.” Id. at *25 (Callahan, C., dissenting) (quoting Burger King Corp. v. Rudzewicz, 471 U.S. 462, 475 (1985)) (emphasis in original).
Because the majority opinion effectively found that cookie placement universally available and agnostic to geographic location yielded specific jurisdiction in California simply because the user subject to the cookie happened to be in California, cookie placement, under the majority’s view, essentially creates jurisdiction wherever a user happens to be at any given time. That is tantamount to a notion of universal jurisdiction, which the U.S. Supreme Court has cautioned against. We thus look forward to potential U.S. Supreme Court review of this extremely important jurisdictional issue in our Internet-driven age.