Court Expands When Companies Using Online Customer Data Could Face Privacy Claims

A recent Ninth Circuit ruling raised the bar for data privacy. It could allow courts to hold companies liable for consumer privacy violations in any state where users access their services.

The ruling has far-reaching implications beyond just e-commerce companies. It sets a precedent that could affect any industry relying on cookies and tracking technologies to collect consumer data.

In the wake of this ruling, businesses may need to update their privacy policies, vendor assessments and tracking technology consent agreements to limit legal risk.

The Ninth Circuit Court of Appeals issued a landmark decision in Briskin v. Shopify, Inc. This ruling significantly broadened the scope of specific personal jurisdiction over e-commerce companies. In this case, Brandon Briskin, a California resident, claimed that Shopify, a Canadian e-commerce platform, unlawfully collected and monetized his personal data through tracking cookies installed during an online transaction. The court held that Shopify's installation of tracking cookies on Briskin’s device, coupled with its knowledge of his California location, constituted “express aiming” sufficient to establish jurisdiction.

This decision marks a shift in how courts previously applied requirements for e-commerce companies using tailored targeting approaches to reach customers. It allows courts to exercise jurisdiction based on a company’s choice to engage with users in a certain state, regardless of the company’s nationwide focus.

When Does Personal Jurisdiction Apply? 

Personal jurisdiction refers to a court’s authority to hear a case involving a defendant. It ensures that a defendant is not unfairly brought into a court in a location with which they have little or no connection. Traditionally, courts require a defendant to have “minimum contacts” with the state where a lawsuit is filed, called a forum state, to satisfy due process.

The Supreme Court derived an “effects test” in Calder v. Jones that courts often use to decide if a defendant is connected to a forum state. The test requires that the defendant commit an intentional act that is expressly aimed at the forum state and causes harm that the defendant knows will be suffered there. However, the digital age, with its borderless nature, has complicated the application of these principles, particularly for e-commerce businesses.

Expanding the Scope of Personal Jurisdiction 

In this case, Briskin argued that Shopify purposefully directed its conduct at California by embedding tracking technology in devices located in the state and using that data for commercial gain. He contended that Shopify’s actions met the “purposeful direction” requirement for specific personal jurisdiction because the company knowingly engaged with California consumers and monetized their data without consent.

Conversely, Shopify argued against jurisdiction by asserting that its platform operates nationwide without specifically targeting California. Shopify maintained that a California consumer using its platform was not enough to establish jurisdiction and that the platform was agnostic to the location of its users. Shopify warned that subjecting it to jurisdiction in California could lead to jurisdiction in all 50 states, which it deemed unreasonable.

The Ninth Circuit sided with Briskin. It ruled that Shopify’s conduct constituted express aiming at California, satisfying the requirements for specific personal jurisdiction.

The Future of Data Privacy Litigation 

E-commerce, advertising, social media and technology services businesses that collect consumer data online should watch this ruling carefully. It could leave these companies subject to litigation in any state where customers access their services. The decision emphasizes the importance of transparency and consent in data collection practices. Failure to adequately disclose and obtain user consent could lead to increased legal exposure in multiple jurisdictions.

Strategic Considerations for Businesses 

In light of the Briskin decision, businesses should consider the following strategies:

• Transparency and Consent: Update privacy policies and implement clear cookie consent mechanisms to inform users about data collection practices.
• Forum Selection Clauses: Incorporate robust forum selection and choice of law provisions in terms of service agreements to limit exposure to unfavorable jurisdictions.
• Vendor Management: Conduct thorough assessments of third-party vendors to comply with data privacy standards and allocate responsibilities for obtaining user consent.
• Geofencing and Data Minimization: Consider implementing geofencing technologies to limit data collection in high-risk jurisdictions and adopt data minimization principles to reduce the scope of collected information.

The Ninth Circuit’s decision in Briskin v. Shopify represents a significant change in the intersection of e-commerce and data privacy law. Businesses must adapt their practices to align with legal requirements and minimize litigation risks. Consulting with legal counsel to evaluate and enhance compliance measures is essential in this new era of digital commerce.

Contact Chris Bach or any member of the Phelps cybersecurity, privacy and data protection or litigation teams if you have questions or need compliance advice and guidance.