Summary
noting that, under Will, express aiming is shown when there is "some differentiation of the forum state from other locations"
Summary of this case from Doe v. WebGroup Czech Republic, A.S.Opinion
No. 22-15815
11-28-2023
Brandon BRISKIN, on behalf of himself and those similarly situated, Plaintiff-Appellant, v. SHOPIFY, INC.; Shopify (USA), Inc.; Shopify Payments (USA), Inc., Defendants-Appellees.
Nicolas A. Sansone, (argued), Allison M. Zieve, and Scott L. Nelson, Public Citizen Litigation Group, Washington, D.C.; Seth A. Safier, Matthew T. McCrary, and Todd Kennedy, Gutride Safier LLP, San Francisco, California; for Plaintiff-Appellant. Moez Kaba (argued), Hueston Hennigan LLP, Los Angeles, California; Sourabh Mishra, Hueston Hennigan LLP, Newport Beach, California; Adam Minchew, Huestan Hennigan LLP, New York, New York; for Defendants-Appellees.
Appeal from the United States District Court for the Northern District of California Phyllis J. Hamilton, District Judge, Presiding, D.C. No. 4:21-cv-06269-PJH
Nicolas A. Sansone, (argued), Allison M. Zieve, and Scott L. Nelson, Public Citizen Litigation Group, Washington, D.C.; Seth A. Safier, Matthew T. McCrary, and Todd Kennedy, Gutride Safier LLP, San Francisco, California; for Plaintiff-Appellant.
Moez Kaba (argued), Hueston Hennigan LLP, Los Angeles, California; Sourabh Mishra, Hueston Hennigan LLP, Newport Beach, California; Adam Minchew, Huestan Hennigan LLP, New York, New York; for Defendants-Appellees.
Before: Consuelo M. Callahan, Bridget S. Bade, and Daniel A. Bress, Circuit Judges.
OPINION
BRESS, Circuit Judge:
The defendants in this case offer a web-based payment processing platform to merchants nationwide. When processing payments, the defendants obtain the personal information of those merchants' customers. In this case of first impression, we are asked to decide whether defendants' extracting and retaining of consumer data and their tracking of customers exposes them to personal jurisdiction in California, where a consumer made his online purchase. We hold that the defendants are not subject to specific jurisdiction in California because they did not expressly aim their suit-related conduct at the forum state. When a company operates a nationally available e-commerce payment platform and is indifferent to the location of end-users, the extraction and retention of consumer data, without more, does not subject the defendant to specific jurisdiction in the forum where the online purchase was made. We affirm the dismissal of the plaintiff's complaint.
I
The plaintiff in this case is Brandon Briskin, a resident of California. In June 2019, Briskin, while present in California, used his iPhone's Safari browser to navigate to the website of California-based retailer IABMFG to purchase fitness apparel. Although Briskin claims he did not know it at the time, IABMFG's website used software and code from Shopify, Inc. to process customer orders and payments.
Shopify, Inc. is a Canadian corporation with its headquarters in Ottawa, Canada. Shopify provides participating merchants with a sales platform that enables the processing of online purchases. As part of its business, Shopify obtains, processes, stores, analyzes, and shares the information of consumers who complete transactions on Shopify's merchant-customers' websites. Although Briskin believed he was dealing only with IABMFG, in fact it was Shopify's e-commerce platform that was operating behind the scenes to facilitate Briskin's purchase.
When completing his online order, Briskin input his personal identification information (name, address, etc.) and credit card number into IABMFG's website. Shopify
collected this information. Shopify also installed cookies onto Briskin's phone, connected his browser to its network, generated payment forms requiring Briskin to enter private identifying information, and stored Briskin's personal and credit card information for later use and analysis. Shopify also transmitted Briskin's payment information to a second payment processor, Stripe, for additional storage, analysis, and processing. Shopify used the customer information it received to create consumer profiles, which Shopify also shared with its merchant and other business partners.
In August 2021, Briskin filed this putative class action in the United States District Court for the Northern District of California, alleging that Shopify violated various California privacy and unfair competition laws because it deliberately concealed its involvement in the consumer transactions. The complaint defined the proposed class as "[a]ll natural persons who, between August 13, 2017 and the present, submitted payment information via Shopify's software while located in California."
Briskin's complaint named as defendants Shopify, Inc. and two of its wholly owned subsidiaries, Shopify (USA) Inc. ("Shopify USA") and Shopify Payments (USA), Inc. ("Shopify Payments"). Briskin alleges that Shopify USA is a Delaware corporation with its principal place of business in Canada. Shopify Payments is a Delaware corporation with its principal place of business in Delaware. In this opinion, we use "Shopify" to refer to all three defendants, collectively.
The defendants represent that Shopify USA has its principal place of business in New York.
In his operative complaint, Briskin provided additional allegations about Shopify's contacts with California. Although the parties dispute the jurisdictional relevance of these contacts, Briskin alleges that Shopify not only reaches into California to extract consumers' personal data, but also directly contracts with California merchants, including IABMFG. According to the complaint, some of the largest merchants on Shopify's platform are California-based companies. In 2018, Shopify, Inc. opened a physical location in Los Angeles to expand its access to the California market and enhance relationships with Shopify's over 80,000 merchant-customers in the state. Briskin further alleges that Shopify, Inc. has at least one fulfillment center in California that stores goods from merchants and ships them to consumers, including those located in California.
The complaint also alleges some jurisdictional facts specific to the two Shopify subsidiaries. Shopify USA, which serves as a subprocessor of user data, is registered to do business in California, at one point had an office in San Francisco, has a quarter of its employees in California, and provides services to thousands of California businesses. Shopify Payments, meanwhile, contracts with thousands of California merchants to enable them to accept online credit and debit payments. Shopify Payments and its contractual partner Stripe, which has its principal place of business in California, then process those payments. As part of this collaboration, Shopify Payments shares California consumers' personal information with Stripe, which then uses the information to create profiles on consumers.
After Briskin twice amended his complaint as part of bolstering his allegations about Shopify's contacts with California, Shopify moved to dismiss the complaint for lack of personal jurisdiction. The district
court agreed, dismissing the second amended complaint without leave to amend.
Briskin timely appealed. The district court had jurisdiction under 28 U.S.C. § 1332(d)(2)(A), and we have jurisdiction under 28 U.S.C. § 1291. We review the district court's dismissal for lack of personal jurisdiction de novo. Ayla, LLC v. Alya Skin Pty. Ltd., 11 F.4th 972, 978 (9th Cir. 2021). In doing so, we "take as true all uncontroverted allegations in the complaint and resolve all genuine factual disputes in the plaintiff's favor." Glob. Commodities Trading Grp., Inc. v. Beneficio de Arroz Choloma, S.A., 972 F.3d 1101, 1106 (9th Cir. 2020).
II
To situate our analysis, we begin with a primer on the basic rules of personal jurisdiction. Two authorities govern a federal court's exercise of personal jurisdiction over a defendant: the Fourteenth Amendment's Due Process Clause and the long arm statute of the state in which the district court sits. See Ford Motor Co. v. Mont. Eighth Jud. Dist. Ct., 592 U.S. —, 141 S. Ct. 1017, 1024, 209 L.Ed.2d 225 (2021); Impossible Foods Inc. v. Impossible X LLC, 80 F.4th 1079, 1086 (9th Cir. 2023). These requirements are coterminous in our case because California's long arm statute allows courts to exercise jurisdiction on any ground not inconsistent with due process. See Yahoo! Inc. v. La Ligue Contre Le Racisme Et L'Antisemitisme, 433 F.3d 1199, 1205 (9th Cir. 2006) (en banc); Impossible Foods, 80 F.4th at 1086; Cal. Civ. Proc. Code § 410.10. Due process permits a court to exercise personal jurisdiction over a defendant only when "the defendant has sufficient 'minimum contacts' with the forum state 'such that the maintenance of the suit does not offend traditional notions of fair play and substantial justice.'" Impossible Foods, 80 F.4th at 1086 (quoting LNS Enters. LLC v. Cont'l Motors, Inc., 22 F.4th 852, 858 (9th Cir. 2022)); see also Ford Motor Co., 141 S. Ct. at 1024 (citing Int'l Shoe Co. v. Washington, 326 U.S. 310, 316-17, 66 S.Ct. 154, 90 L.Ed. 95 (1945)).
Personal jurisdiction comes in two varieties: general and specific. General jurisdiction "extends to 'any and all claims' brought against a defendant," but it is appropriate only "when a defendant is 'essentially at home' in the State." Ford Motor Co., 141 S. Ct. at 1024 (quoting Goodyear Dunlop Tires Operations, S.A. v. Brown, 564 U.S. 915, 919, 131 S.Ct. 2846, 180 L.Ed.2d 796 (2011)). A corporate defendant is considered at home in its state of incorporation and the state where it maintains its principal place of business. See Daimler AG v. Bauman, 571 U.S. 117, 137, 134 S.Ct. 746, 187 L.Ed.2d 624 (2014). Briskin does not argue that Shopify is subject to general jurisdiction in California.
Specific jurisdiction "covers defendants less intimately connected with a State, but only as to a narrower class of claims." Ford Motor Co., 141 S. Ct. at 1024. For specific jurisdiction to exist over a non-resident defendant, three conditions must be met. First, "the defendant must either 'purposefully direct his activities' toward the forum or 'purposefully avail[] himself of the privileges of conducting activities in the forum'"; second, "the claim must be one which arises out of or relates to the defendant's forum-related activities"; and third, "the exercise of jurisdiction must comport with fair play and substantial justice, i.e. it must be reasonable." Axiom Foods, Inc. v. Acerchem Int'l, Inc., 874 F.3d 1064, 1068 (9th Cir. 2017) (quoting Dole Food Co. v. Watts, 303 F.3d 1104, 1111 (9th Cir. 2002)) (alteration in original).
The plaintiff bears the burden on the first two prongs. Ayla, 11 F.4th at 979. If they are met, then the defendant "must come forward with a 'compelling case' that the exercise of jurisdiction would not be reasonable." Id. (quoting Boschetto v. Hansing, 539 F.3d 1011, 1016 (9th Cir. 2008)).
At prong one of the specific jurisdiction analysis, courts must determine whether a defendant has purposefully directed its activities towards the forum state, purposefully availed itself of the privilege of conducting activities in the forum state, or some combination of the two. See Yahoo!, 433 F.3d at 1206. For claims that sound in tort, we "most often employ a purposeful direction analysis," asking "whether a defendant 'purposefully direct[s] his activities' at the forum state...." Mavrix Photo, Inc. v. Brand Techs., Inc., 647 F.3d 1218, 1228 (9th Cir. 2011) (first citing Schwarzenegger v. Fred Martin Motor Co., 374 F.3d 797, 802 (9th Cir. 2004); and then quoting Yahoo!, 433 F.3d at 1206); see also Glob. Commodities Trading Grp., 972 F.3d at 1107 ("Purposeful availment generally provides a more useful frame of analysis for claims sounding in contract, while purposeful direction is often the better approach for analyzing claims in tort."). Although a rigid analytical distinction between purposeful direction and purposeful availment is not always helpful or appropriate, see Impossible Foods, 80 F.4th at 1088-89; Davis v. Cranfield Aerospace Sols., Ltd., 71 F.4th 1154, 1162 (9th Cir. 2023), in this case Briskin's claims sound classically in tort and are most naturally analyzed under the purposeful direction framework. The parties agree on this point. We thus proceed to the purposeful direction analysis.
We evaluate purposeful direction under the Calder effects test, see Calder v. Jones, 465 U.S. 783, 104 S.Ct. 1482, 79 L.Ed.2d 804 (1984), which focuses on whether the effects of the defendant's actions were felt in the forum state. See also Walden v. Fiore, 571 U.S. 277, 286-88, 134 S.Ct. 1115, 188 L.Ed.2d 12 (2014); Burri Law PA v. Skurla, 35 F.4th 1207, 1213 (9th Cir. 2022). Under this test, "the defendant allegedly must have (1) committed an intentional act, (2) expressly aimed at the forum state, (3) causing harm that the defendant knows is likely to be suffered in the forum state." Mavrix Photo, 647 F.3d at 1228 (quoting Brayton Purcell LLP v. Recordon & Recordon, 606 F.3d 1124, 1128 (9th Cir. 2010), as amended, abrogated on other grounds as recognized by Axiom Foods, 874 F.3d at 1069-70).
Shopify's conduct satisfies the first Calder element. We "construe 'intent' in the context of the 'intentional act' test as referring to an intent to perform an actual, physical act in the real world...." Schwarzenegger, 374 F.3d at 806. Acts undertaken using technology can qualify as intentional acts. See, e.g., Herbal Brands, Inc. v. Photoplaza, Inc., 72 F.4th 1085, 1091 (9th Cir. 2023) (noting that the defendant's sale of a product via an interactive website was an intentional act); Will Co. v. Lee, 47 F.4th 917, 922 (9th Cir. 2022) (explaining that operating a website, purchasing a domain name, and purchasing domain privacy services are intentional acts). By generating payment forms, executing code on consumers' devices, creating consumer profiles, processing consumer information, installing cookies, and sharing payment information, Shopify has committed intentional acts. And we are willing to conclude that Briskin has fairly alleged the third Calder element as well, namely, that Shopify caused privacy-related harm that it knew was likely to be suffered in the forum state.
The issue here, and the crux of this case, lies in Calder prong two: whether Shopify
"expressly aimed" its activities at the forum state. It is to that question that we now turn.
III
To determine whether Shopify expressly aimed its activities toward California so as to purposefully direct its activities there, we must first identify which of Shopify's California contacts are relevant to the analysis. We evaluate that issue in Section A below. In Section B, and in the absence of any controlling authority on the personal jurisdiction implications of an online payment platform, we examine our specific jurisdiction cases involving interactive websites, the most analogous precedents. From these cases, we distill key principles to govern the express aiming inquiry in a consumer data collection and retention case such as this. Finally, in Section C, we apply these principles to explain why Shopify has not expressly aimed its activities toward California for purposes of Briskin's claims.
A
We begin by narrowing Briskin's allegations to the conduct relevant to the specific jurisdiction inquiry. Recall that Briskin points to several features of Shopify's business to support personal jurisdiction in California. The most pertinent of these are the data extraction, retention, and processing that give rise to Briskin's claims. Setting this aspect of the case aside for the moment, Briskin also argues that Shopify does extensive business in the state. He points to Shopify's contracts with California merchants, its Los Angeles "store" that promotes merchant relations, its California fulfillment center, the Shopify partnership with Stripe (a California company), and Shopify USA's presence in the state (business registration, employees, etc.). Although Briskin does not argue that these contacts are so pervasive as to create all-purpose general jurisdiction, he does suggest they are at least relevant to the specific jurisdiction analysis.
That is not correct. For specific jurisdiction to exist over Shopify, Briskin's claim "'must be one which arises out of or relates to the defendant's forum-related activities.'" Axiom Foods, 874 F.3d at 1068 (quoting Dole Food Co., 303 F.3d at 1111) (emphasis added). This is a claim-tailored inquiry that requires us to examine the plaintiff's specific injury and its connection to the forum-related activities in question. See Bristol-Myers Squibb Co. v. Superior Ct. of Cal., S.F. Cnty., 582 U.S. 255, 262, 137 S.Ct. 1773, 198 L.Ed.2d 395 (2017) (explaining that "there must be 'an affiliation between the forum and the underlying controversy'" (quoting Goodyear, 564 U.S. at 919, 131 S.Ct. 2846)); Williams v. Yamaha Motor Co. Ltd., 851 F.3d 1015, 1022-23 (9th Cir. 2017) ("In order for a court to have specific jurisdiction over a defendant, 'the defendant's suit-related conduct must create a substantial connection with the forum State.'" (quoting Walden, 571 U.S. at 284, 134 S.Ct. 1115)).
We think it clear that Briskin's claims do not "arise out of" Shopify's broader forum-related activities in the state (its contracts with California merchants, physical Shopify offices, and so on). The "arising out of" portion of the specific jurisdiction formula "asks about causation." Ford Motor Co., 141 S. Ct. at 1026. In other words, an injury arising "out of a defendant's forum contacts require[s] 'but for' causation, in which 'a direct nexus exists between a defendant's contacts with the forum state and the cause of action.'" Yamashita v. LG Chem, Ltd., 62 F.4th 496, 504 (9th Cir. 2023) (quoting In re W. States Wholesale Nat. Gas Antitrust Litig.,
715 F.3d 716, 742 (9th Cir. 2013)) (brackets omitted).
There is no such causal relationship between Shopify's broader California business contacts and Briskin's claims because these contacts did not cause Briskin's harm. Indeed, Briskin himself acknowledges in his opening brief that "[t]he direct, unmediated interactions between Shopify and California shoppers through an interactive web-based payment platform are what form the basis for [his] claims." It is readily apparent there will be causes of action that do arise out of Shopify's broader business contacts with California (such as claims by a California merchant). But Briskin's claims are not among them.
Nor do Briskin's claims "relate to" Shopify's broader business activities in California outside of its extraction and retention of Briskin's data. Focusing on the disjunctive "or" in the doctrinal formulation, the Supreme Court in Ford clarified that "relate to" in the phase "arising out of or relate to" does "contemplate[] that some relationships will support jurisdiction without a causal showing." 141 S. Ct. at 1026; see also Impossible Foods, 80 F.4th at 1093-94, 1097. Briskin passingly suggests that Shopify's broader California contacts "relate to" his claims under Ford, but that is wrong. The Supreme Court in Ford was clear that the "related to" test still "incorporates real limits, as it must to adequately protect defendants foreign to a forum." 141 S. Ct. at 1026. At minimum, the plaintiff must show "that the instant litigation 'relate[s] to'" the contacts in question. LNS Enters., 22 F.4th at 864 (alteration in original).
Case law demonstrates the bounded reach of the "related to" variable of the personal jurisdiction equation. In Ford, for example, the Supreme Court held that Ford in product liability cases could be subject to specific personal jurisdiction in states where it did not make, sell, or design the particular vehicle involved in an accident, but that was because Ford had "systematically served a market" in those states through comprehensive sales, marketing, and auto servicing efforts there. 141 S. Ct. at 1028-29. Similarly, in Yamashita v. LG Chem, Ltd., 62 F.4th 496 (9th Cir. 2023), we explained that a plaintiff could demonstrate that a claim "relates to" a defendant's forum-related activities based on a causation-by-proxy theory. Id. at 505. Specifically, we postulated that "if similar injuries will tend to be caused by those contacts," and "if the defendant should have foreseen the risk that its contacts might cause injuries like that of the plaintiff," the "related to" test may be met, provided there is "a close connection between contacts and injury." Id. at 505-06. Likewise, in Impossible Foods Inc. v. Impossible X LLC, 80 F.4th 1079 (9th Cir. 2023), we held that a declaratory judgment action for trademark non-infringement sufficiently "related to" the defendant's contacts in the forum state. But that was because the defendant was formerly headquartered there and its trademark-building activities in the state "establish[ed] the asserted legal rights that [we]re at the center of th[e] dispute." Id. at 1097.
These cases and examples all involved a strong, direct connection between the defendant's forum-related activities and the plaintiff's claims. What we have here is very different. Briskin's injuries are based on Shopify's extraction and processing of his personal information. His claims have nothing to do with Shopify's brick-and-mortar operations in the state. Nor do they relate to Shopify's contracts with merchants in California. Briskin would have suffered the same injury regardless of whether he purchased items from a California merchant or was physically
present in California when he did so. To the extent Briskin suggests that Shopify's broader business actions in California set the wheels in motion for Shopify to eventually inflict privacy-related harm on him in California, such a butterfly effect theory of specific jurisdiction would be far too expansive to satisfy due process. That position is directly contrary to Ford, which cautioned that "relates to" "does not mean anything goes." 141 S. Ct. at 1026.
B
Because there is an insufficient relationship between Briskin's claims and Shopify's broader business contacts in California, the activities relevant to the specific jurisdiction analysis in this case are those that caused Briskin's injuries: Shopify's collection, retention, and use of consumer data obtained from persons who made online purchases while in California. Briskin argues that Shopify through these activities effectively "reached into" California (electronically) and inserted itself (technologically) into a transaction between a California consumer and a California merchant. The issue is whether Shopify, which provides web-based payment processing services to online merchants throughout the nation (and the world), thereby expressly aimed its conduct toward California.
This type of personal jurisdiction question involving an online payment platform is novel. We have never addressed such a situation, nor, to our knowledge, have other circuits. In the sections below, we first explain why our focus here cannot be either Briskin's presence in California or the fact that he sustained an alleged injury there. We next turn to our personal jurisdiction cases involving claims against out-of-state interactive websites, explaining why these precedents—and not precedents involving the distribution of physical products—provide the right foundation for analyzing personal jurisdiction in this case. From our interactive website cases, we then derive core principles to govern the personal jurisdiction inquiry in cases such as this based on the extraction of consumer data.
1
Briskin is a resident of California, and he was physically located in California when he purchased merchandise using Shopify's e-commerce payment system. Does Briskin's California connection matter to the analysis of whether Shopify expressly aimed its activities toward California? The answer is no.
The key authority is Walden v. Fiore, 571 U.S. 277, 134 S.Ct. 1115, 188 L.Ed.2d 12 (2014). In Walden, a Georgia police officer deputized as a federal law enforcement agent seized nearly $100,000 in cash from two travelers at the Hartsfield-Jackson International Airport in Atlanta, Georgia. Id. at 279-80, 134 S.Ct. 1115. The travelers, residents of both California and Nevada who were en route to Las Vegas, sued the Georgia officer in Nevada, claiming the seizure violated their Fourth Amendment rights. Id. at 280, 134 S.Ct. 1115. They argued that a Nevada court had personal jurisdiction because the officer "knew his allegedly tortious conduct in Georgia would delay the return of funds to plaintiffs with connections to Nevada." Id. at 279, 134 S.Ct. 1115.
The Supreme Court disagreed. Applying Calder, the Court held that the district court could not exercise personal jurisdiction over the Georgia defendant. Id. at 291, 134 S.Ct. 1115. The Court's holding turned on two fundamental principles of law. First, the relationship between a defendant and the forum state "must arise out of contacts that the 'defendant
himself' creates with the forum...." Id. at 284, 134 S.Ct. 1115 (quoting Burger King Corp. v. Rudzewicz, 471 U.S. 462, 475, 105 S.Ct. 2174, 85 L.Ed.2d 528 (1985)) (emphasis in original). That explained why the Supreme Court had "consistently rejected attempts to satisfy the defendant-focused 'minimum contacts' inquiry by demonstrating contacts between the plaintiff (or third parties) and the forum State." Id. (first citing Helicopteros Nacionales de Colombia, S.A. v. Hall, 466 U.S. 408, 417, 104 S.Ct. 1868, 80 L.Ed.2d 404 (1984); and then citing Hanson v. Denckla, 357 U.S. 235, 253-54, 78 S.Ct. 1228, 2 L.Ed.2d 1283 (1958)). Second, and relatedly, the "'minimum contacts' analysis looks to the defendant's contacts with the forum State itself, not the defendant's contacts with persons who reside there." Id. at 285, 134 S.Ct. 1115. As the Court explained, "a defendant's contacts with the forum State may be intertwined with his transactions or interactions with the plaintiff or other parties. But a defendant's relationship with a plaintiff or third party, standing alone, is an insufficient basis for jurisdiction." Id. at 286, 134 S.Ct. 1115. For these reasons, it was insufficient that the plaintiffs in Walden experienced injury in Nevada or that the Georgia officer might have known that his conduct would produce foreseeable harm there. Id. at 288-90, 134 S.Ct. 1115.
We considered Walden most definitively in Picot v. Weston, 780 F.3d 1206 (9th Cir. 2015). In Picot, as relevant here, a California plaintiff sued a Michigan resident in California, seeking a declaration that the defendant had tortiously interfered with the plaintiffs' contract with HMR, a Delaware corporation with offices in Ohio. Id. at 1210, 1215. The complaint alleged that the defendant while in Michigan had made statements to an Ohio resident that caused HMR to cease making payments on the contract into two trusts located in Wyoming and Australia. Id. at 1215.
We held that under Walden, the defendant's conduct was not expressly aimed at California. Id. The defendant had not acted tortiously in California, and the challenged conduct in fact did not have "anything to do with California itself." Id. (quoting Walden, 571 U.S. at 289-91, 134 S.Ct. at 1125) (brackets omitted). We also thought it critical that the plaintiff's injury, "an inability to access out-of-state funds, [wa]s not tethered to California in any meaningful way." Id. We said that because the plaintiff's "injury is entirely personal to him and would follow him wherever he might choose to live or travel," "[t]he effects of [the defendant's] actions are therefore 'not connected to the forum State in a way that makes those effects a proper basis for jurisdiction.'" Id. (quoting Walden, 571 U.S. at 289-91, 134 S.Ct. at 1125).
Walden and Picot confirm that Shopify did not expressly aim its conduct toward California simply because Briskin resided there, made his online purchase "while located in California," and sustained his privacy-based injuries in that state. Under Walden, it is the defendant's contacts with the forum state, not the plaintiff's, that matter, and it is the defendant's contacts with the state itself, and not persons there, that must drive the inquiry. See Walden, 571 U.S. at 284-86, 134 S.Ct. 1115.
Briskin's injuries, meanwhile, were "entirely personal to him and would follow him wherever he might choose to live or travel." Picot, 780 F.3d at 1215; see also Walden, 571 U.S. at 290, 134 S.Ct. 1115 (explaining that the Nevada plaintiffs' injury in Nevada did not create personal jurisdiction because the plaintiffs "would have experienced th[e] same lack of access" to seized funds "in California, Mississippi, or wherever else they might have traveled and found themselves wanting more money
than they had"). Although Briskin emphasizes that Shopify knows the whereabouts of its merchants' customers through the data it collects from them and the tracking tools it deploys, Shopify did not expressly aim its conduct toward California "simply because [it] allegedly directed [its] conduct at plaintiffs whom [it] knew had [California] connections." Walden, 571 U.S. at 289, 134 S.Ct. 1115.
2
Having bracketed out what our analysis cannot turn on, we now move to the principles that we think should govern our review. Because Shopify operates a web-based platform, and for reasons we will explain below, our personal jurisdiction cases involving interactive websites provide the closest analogy to the case at hand. The parties effectively agree on this point, as they have devoted the bulk of their briefing to these precedents. A careful discussion of our circuit's precedent in this area is therefore important to understanding the contours of the personal jurisdiction problem in this case.
Almost as soon as the internet became a thing, we were confronted with personal jurisdiction questions involving internet-based businesses. Because websites can be viewed from anywhere, we had to resolve whether and when web-based operations were sufficiently "purposeful" to generate specific jurisdiction. Our approach to that problem has not been to allow personal jurisdiction anywhere that a web platform can be accessed. Instead, we have recognized that there are due process constraints on the assertion of personal jurisdiction over non-resident defendants who operate through the internet. Over the course of decades, we have gone about delineating and refining legal rules to govern when an assertion of personal jurisdiction over an out-of-state internet platform exceeds the bounds of due process.
We made clear early on that a purely "passive" website that merely hosts information "does not qualify as purposeful activity invoking the benefits and protections" of the fora in which the website may be viewed. Cybersell, Inc. v. Cybersell, Inc., 130 F.3d 414, 420 (9th Cir. 1997); see also Herbal Brands, 72 F.4th at 1091 ("It is well settled that '[m]ere passive operation of a website is insufficient to demonstrate express aiming.'" (quoting Will Co., 47 F.4th at 922) (alteration in original)). But an "interactive website"—in which "users can exchange information with the host computer," Cybersell, 130 F.3d at 418—presents different considerations.
That kind of web platform, our cases instruct, can satisfy the express aiming requirement. But not always. Driving our decision-making in this area has been the need to draw some lines to avoid subjecting web platforms to personal jurisdiction everywhere. Were it otherwise, "every time a seller offered a product for sale through an interactive website, the seller would be subjecting itself to specific jurisdiction in every forum in which the website was visible...." Herbal Brands, 72 F.4th at 1091. "That result," we have said, "would be too broad to comport with due process." Id. (citing CollegeSource, Inc. v. AcademyOne, Inc., 653 F.3d 1066, 1075-76 (9th Cir. 2011)); see also Cybersell, 130 F.3d at 420 (similar). For this reason, "operation of an interactive website does not, by itself, establish express aiming." Herbal Brands, 72 F.4th at 1091.
What is needed is "something more." Id. at 1092. Thus, we have held that "operating a website 'in conjunction with "something more"—conduct directly targeting the forum—is sufficient'" to satisfy the express aiming requirement. Id. (quoting Mavrix Photo, 647 F.3d at 1229). And
"[w]hen the website itself is the only jurisdictional contact, our analysis turns on whether the site had a forum-specific focus or the defendant exhibited an intent to cultivate an audience in the forum." Id.
Three cases—Mavrix Photo, Inc. v. Brand Techs., Inc., 647 F.3d 1218 (9th Cir. 2011), AMA Multimedia, LLC v. Wanat, 970 F.3d 1201 (9th Cir. 2020), and Will Co. v. Lee, 47 F.4th 917 (9th Cir. 2022)—represent our key precedents in this area. Mavrix involved a Florida-based celebrity photo agency, Mavrix Photo, Inc., which sold candid photos of celebrities to popular magazines. 647 F.3d at 1221-22. Mavrix, which also had an office in California, alleged that Brand Technologies, Inc., an Ohio corporation, had infringed Mavrix's copyrights by posting Mavrix's photos on Brand's website, celebrity-gossip.net. Id. at 1221-23. Mavrix filed suit in federal court in the Central District of California, which raised the question of whether Brand was subject to personal jurisdiction in California. Id. at 1221.
We held that the district court could exercise specific jurisdiction over Brand. Id. at 1232. Relevant to our analysis was that Brand knew "either actually or constructively" that it had a "California user base" and that Brand sought to exploit that California base "for commercial gain by selling space on its website for advertisements" that were "directed to Californians" and "targeted" them. Id. at 1230. We found further evidence of Brand's express aiming in the subject matter of its website, which had "a specific focus on the California-centered celebrity and entertainment industries." Id.; see also id. at 1231 (explaining that Brand's website "appeals to, and profits from, an audience in a particular state").
We determined that Brand had thereby expressly aimed intentional acts at California when it "used Mavrix's copyrighted photos as part of its exploitation of the California market for its own commercial gain." Id. at 1229. Ultimately, "[b]ased on the website's subject matter, as well as the size and commercial value of the California market," "Brand anticipated, desired, and achieved a substantial California viewer base." Id. at 1230. It thus "d[id] not violate due process to hold Brand answerable in a California court for the contents of a website whose economic value turn[ed], in significant measure, on its appeal to Californians." Id.
Contrast Mavrix with AMA Multimedia. In AMA, the defendants operated ePorner, an internationally available website that hosted adult videos uploaded by individual users. 970 F.3d at 1204. ePorner made money through geotargeted advertisements that would show users ads based on their location throughout the world. Id. at 1210-11. AMA Multimedia, a Nevada-based company, sued the Polish operators of ePorner over the use of AMA's adult video content on ePorner's website. Id. at 1204-05. AMA argued that specific jurisdiction existed in Nevada because U.S. visitors comprised approximately 20% of ePorner's userbase and because ePorner featured geotargeted advertisements, had terms of service agreements with U.S. customers, and used a U.S. domain name server. Id. at 1210-12. Although the case involved the federal long arm provision, see Fed. R. Civ. P. 4(k)(2), the same due process requirements applied. See AMA, 970 F.3d at 1207-08.
We held that the district court did not have specific jurisdiction over ePorner's Polish operators. That was because the case differed from Mavrix in several material respects relevant here. Id. at 1210. First, unlike the website in Mavrix, ePorner's subject matter did not have a "forum-specific focus." Id. Instead, it was a global website with 80% of its viewers
located outside of the United States. Id. Second, it was individual users, not ePorner, that uploaded U.S.-generated content, so the popularity of that content was a consequence of users' actions rather than evidence of ePorner's intention to target the U.S. market. Id. Although the defendants "may have foreseen that ePorner would attract a substantial number of viewers in the United States," this was not sufficient to establish express aiming. Id. Third, the use of geo-located advertisements did not constitute express aiming when users in every forum—including forums outside of the United States—would receive ads targeted to their locations. Id. at 1211. "If such geo-located advertisements constituted express aiming," we reasoned, "ePorner could be said to expressly aim at any forum in which a user views the website." Id. (emphasis in original). This, too, was different than Mavrix, which involved advertisements that specifically "targeted California residents." Id. ePorner's "advertising structure" presented another key difference because ePorner used "a third-party advertising company" and did not "control the advertisements shown on the site." Id. In sum, because "the United States was not 'the focal point' of the website 'and of the harm suffered,'" there was no express aiming. Id. at 1212 (quoting Walden, 571 U.S. at 287, 134 S.Ct. 1115).
The third case in this line is Will Co. See 47 F.4th 917. Will Co. was a Japanese entertainment producer that made adult videos. Id. at 919. It sold its copyrighted videos in the United States. Id. Will Co. later learned that ThisAV.com, a video-hosting site based in Hong Kong, was displaying its videos without permission. Id. Will Co. then sued the owners of ThisAV.com for copyright infringement in federal court. Id.
We held that ThisAV.com's operators were subject to personal jurisdiction in the United States. Id. at 927; see generally Fed. R. Civ. P. 4(k)(2). Unlike in AMA, there were key features of ThisAV.com's business model that evinced a forum-specific focus. Important to our analysis was that the company hosted its website on servers in Utah and purchased content delivery network services for North America, which made its website load faster in the United States than in other countries. 47 F.4th at 924-95. This helped the defendant increase its success in the U.S. market and showed that it was "motivated to appeal to viewers in the United States more than any other geographical location." Id. at 925. In addition, we noted that the legal compliance materials on ThisAV.com's website were "relevant almost exclusively to viewers in the United States." Id. From the combination of U.S.-focused technology and U.S.-focused compliance materials, we inferred that the platform operators "prepared for U.S. visitors to the exclusion of all others," and on this basis found express aiming at the United States. Id. at 926.
Taking Mavrix, AMA, and Will Co. together, a few through-lines emerge. First, the fact that a broadly accessible web platform knowingly profits from consumers in the forum state is not sufficient to show that the defendant is expressly aiming its intentional conduct there. See AMA, 970 F.3d at 1210; see also Will Co., 47 F.4th at 926.
Second, to establish the "something more" needed to demonstrate express aiming in suits against internet platforms, Herbal Brands, 72 F.4th at 1092, the plaintiff must allege that the defendant platform has a "forum-specific focus." AMA, 970 F.3d at 1210. Alternatively, the plaintiff must allege that the defendant is specifically "appeal[ing] to ... an audience
in a particular state," Mavrix, 647 F.3d at 1231, or "actively target[ing]" the forum state, Will Co., 47 F.4th at 923. This express aiming can be shown in different ways, such as through the subject matter of the website, see AMA, 970 F.3d at 1210; Mavrix, 647 F.3d at 1230; the defendant's advertising, see AMA, 970 F.3d at 1210-11; Mavrix, 647 F.3d at 1230; or other aspects of its business model, see Will Co., 47 F.4th at 924-25. What is needed, though, is some prioritization of the forum state, some differentiation of the forum state from other locations, or some focused dedication to the forum state which permits the conclusion that the defendant's suit-related conduct "create[s] a substantial connection" with the forum. Walden, 571 U.S. at 284, 134 S.Ct. 1115. And that "substantial connection" must be something substantial beyond the baseline connection that the defendant's internet presence already creates with every jurisdiction through its universally accessible platform.
Third, the specific nature and structure of the defendant's business matters. That is consistent with a fundamental precept of personal jurisdiction doctrine, which is that a defendant should be allowed to "'structure its primary conduct' to lessen or avoid exposure to a given State's courts." Ford, 141 S. Ct. at 1025 (quoting World-Wide Volkswagen Corp. v. Woodson, 444 U.S. 286, 297, 100 S.Ct. 559, 62 L.Ed.2d 490 (1980)) (brackets omitted). Thus, under our cases, how the defendant operates and organizes its web-based platform affects the "something more" analysis. See Will Co., 47 F.4th at 924-25 (concluding that "two key" features of the defendant's technology and legal compliance regime were highly relevant); AMA, 970 F.3d at 1211 (treating as material certain differences in website content and "advertising structure" as compared to Mavrix).
On this score, when considering a defendant's business structure, the role of third parties is important. Particularly relevant to the defendant's intent to aim activity toward the forum state and its control over that activity is the role of third parties in carrying out the defendant's business operations, whether that be through the website content, advertising, or some other means. See AMA, 970 F.3d at 1210-11 (treating as less indicative of express aiming the fact that the website's content was uploaded by third parties and that the defendant did not "personally control the advertisements shown on the site"). Actions of third parties that the defendant does not control, even those of the defendant's contractors, tend to be less reflective of the defendant's own express aiming toward the forum because they invite a greater degree of attenuation between the plaintiff's injuries and the defendant's jurisdictional contacts. See id. at 1211.
3
We think that these precedents and principles should apply as well to a personal jurisdiction inquiry involving a broadly accessible back-end web platform like Shopify that processes consumer payments. We say so for several reasons.
The first is that Shopify's web platform, which secures consumer information, is not so different from the other interactive websites we have previously considered. In Mavrix, for example, the defendant celebrity gossip website had various interactive features that involved the acquisition of viewer information, such as consumer polls and requests to subscribe to email newsletters and membership clubs. See 647 F.3d at 1222. And in AMA, the defendant evidently received information about end-user location so that it could deploy "geo-located advertisements, which tailor advertisements based on the perceived location of
the viewer." 970 F.3d at 1211; see also id. at 1220 n.2 (Gould, J., dissenting) (explaining that ePorner is "more than a purely passive website because it has interactive features," including consumers agreeing to terms and conditions of use).
To the extent Briskin argues that an online payment platform's extraction of consumer data reflects more "active" engagement with the forum state than the conduct at issue in our past interactive website cases, we do not think those differences call for application of a fundamentally different legal framework than the one set forth in Mavrix, AMA, and Will Co. If forum-specific differences do exist in a given case between an internet platform that obtains purchaser information and one that obtains other user information (such as their email addresses), those differences can be accounted for when applying the principles we have laid out above. They do not require a completely different set of legal rules.
The second main reason that we think Mavrix, AMA, and Will Co. provide the right legal framework for this type of case is that the due process concerns animating our internet-activity personal jurisdiction cases apply here as well. As we discussed above, our cases have consistently rejected the suggestion that operating a website that is viewable anywhere means that the defendant is suable everywhere. See Herbal Brands, 72 F.4th at 1091; CollegeSource, 653 F.3d at 1075-76; Cybersell, 130 F.3d at 420. Although there are some differences between an interactive web platform that predominantly offers content and one that processes consumer transactions, the nationwide availability of these platforms provides a common denominator that raises consonant due process concerns.
Briskin protests that, by this logic, Shopify will be able to direct its activities to all fifty states and yet be free from specific jurisdiction in each of them. That is not quite right considering that Shopify will be subject to personal jurisdiction in other fora, such as the jurisdictions where the Shopify defendants are either incorporated or based. And that is to say nothing of suits that plaintiffs could likely bring against California merchants in California, who could in turn seek relief against Shopify, as appropriate. But the broader point is that Briskin's objection would apply just as well to the activities of any web-based business that operates nationwide. Although Briskin's objection is not without force, our law has long recognized that as a matter of due process, web-based platforms cannot be subject to specific jurisdiction in any forum from which they are accessible, which would lead to "the eventual demise of all restrictions" on personal jurisdiction. CollegeSource, 653 F.3d at 1076 (quoting World-Wide Volkswagen Corp., 444 U.S. at 294, 100 S.Ct. 559).
We also reject Briskin's assertion that we should analyze this case as if it involved the sale of physical goods through an interactive website. In Herbal Brands, Inc. v. Photoplaza, Inc., 72 F.4th 1085 (9th Cir. 2023), we held that "if a defendant, in its regular course of business, sells a physical product via an interactive website and causes that product to be delivered to the forum, the defendant has purposefully directed its conduct at the forum such that the exercise of personal jurisdiction may be appropriate." Id. at 1088.
Herbal Brands was a suit brought in Arizona against New York defendants who had made allegedly unauthorized sales of the plaintiff's products in Arizona using Amazon's online storefront platform. Id. at 1088-89. We held the defendants were subject to personal jurisdiction in Arizona because "they created and maintained a distribution network that reached the relevant
forum by choosing to operate on a universally accessible website that accepts orders from residents of all fifty states and delivers products to all fifty states." Id. at 1094-95. We further made clear that in the case of the online sale of physical goods, "the express aiming inquiry does not require a showing that the defendant targeted its advertising or operations at the forum," although the defendant still did have to "exercise some level of control over the ultimate distribution of its products beyond simply placing its products into the stream of commerce." Id. at 1094.
Herbal Brands does not govern the personal jurisdiction inquiry here. Herbal Brands was clear that its "holding answers only the narrow question whether a defendant's sale of a physical product to a consumer in the forum state via an interactive website constitutes conduct expressly aimed at a forum." Id. at 1095. We specifically indicated in Herbal Brands that "[i]f other internet activity is allegedly the source of personal jurisdiction, cases such as Mavrix, AMA, and Will Co. would continue to apply." Id. (emphasis added). Herbal Brands thus directed application of the very precedents we have held should apply here.
That guidance makes sense considering the logic of Herbal Brands itself. Herbal Brands specifically differentiated the online sales of physical products from other internet-related activities. See id. at 1093-94. In Herbal Brands, we explained that a different set of legal rules should apply in the case of the online sale of physical items because "[p]re-internet, the 'distribution in the forum state of goods originating elsewhere' was a paradigmatic example of conduct purposefully directed at the forum state." Id. at 1093 (quoting Schwarzenegger, 374 F.3d at 803). The Supreme Court's decision in Keeton v. Hustler Magazine, Inc., 465 U.S. 770, 104 S.Ct. 1473, 79 L.Ed.2d 790 (1984), on which Briskin relies, is similarly distinguishable because it too involved the distribution of products into the forum state. Under Herbal Brands, the sale of physical items through the internet is simply different from other forms of internet activity, based on long-held understandings about the jurisdictional significance of physical shipments into a forum. That traditional legal backdrop, however, does not extend to the extraction of consumer data through an online transaction involving a back-end payment processor.
We thus hold that when analyzing whether a court has personal jurisdiction over a web-based payment processor in a suit alleging the unlawful extraction, retention, and sharing of consumer data, the legal framework and principles that should be brought to bear are those from Mavrix, AMA, and Will Co.
C
We now apply those principles to this case and hold that Shopify has not expressly aimed its suit-related conduct toward California.
Shopify's web payment platform does not have a "forum-specific focus." AMA, 970 F.3d at 1210. Nor has Briskin alleged facts showing that Shopify is specifically "appeal[ing] to ... an audience in" California, Mavrix, 647 F.3d at 1231, or "actively target[ing]" the forum state, Will Co., 47 F.4th at 923. Shopify's platform is accessible across the United States, and the platform is indifferent to the location of either the merchant or the end consumer. No one has alleged that Shopify alters its data collection activities based on the location of a given online purchaser. It did not prioritize consumers in California or specifically cultivate them. Briskin would have suffered the same injury regardless of whether IABMFG was a California company and
regardless of whether Briskin was physically located in California when he made his purchase. As Briskin acknowledged in his opening brief, Shopify "chose to extract personal data from IABMFG's customer's—wherever located—through the payment portal it created and maintained." (Emphasis added).
Shopify, to be sure, no doubt benefits from consumers who are present in California. But that California is a large market does not answer the purposeful direction question because a defendant foreseeably profiting from persons making online purchases in California does not demonstrate express aiming. See Walden, 571 U.S. at 289, 134 S.Ct. 1115 ("Petitioner's actions in Georgia did not create sufficient contacts with Nevada simply because he allegedly directed his conduct at plaintiffs whom he knew had Nevada connections."); AMA, 970 F.3d at 1210 ("Although [the defendants] may have foreseen that ePorner would attract a substantial number of viewers in the United States, this alone does not support a finding of express aiming."). And while Shopify does have a sizeable merchant base in California, its extraction and retention of consumer data depends on the actions of third-party merchants who are engaged in independent transactions that themselves do not depend on consumers being present in California. Cf. AMA, 970 F.3d at 1210 ("ePorner's content is primarily uploaded by its users, and the popularity or volume of U.S.-generated adult content does not show that [the defendants] expressly aimed the site at the U.S. market.").
Briskin offers some inventive hypotheticals in response, but they are off target. Briskin asserts that what Shopify did here was no different than physically placing a surveillance device at a cash register in a California store and using it to intercept customers' payment details. He also analogizes Shopify to a hypothetical food truck with a surveillance device that operates in both California and Nevada but is agnostic as to which state the truck is located.
These hypotheticals fail to grasp the significance of Shopify operating a broadly accessible web-based platform. The nature of such an operation leads to due process concerns when the implication of Briskin's position is that Shopify is subject to specific jurisdiction in every state. Contrary to Walden's clear command, Briskin would effectively tie personal jurisdiction to the unilateral activity of consumers or Shopify's contacts with individual persons. See Walden, 571 U.S. at 284, 134 S.Ct. 1115. And unlike Briskin's hypotheticals, Shopify, by the allegations of the complaint, did not place any kind of physical device in California. Cf. Herbal Brands, 72 F.4th at 1093. It did not focus its efforts on any particular location. And it did not interact with consumers except as a result of the third-party decisions of its merchants. Briskin's hypotheticals involve a degree of express aiming that is simply not present on the facts alleged.
In holding that Shopify is not subject to specific jurisdiction for Briskin's claims, we do not suggest that the extraction and retention of consumer data can never qualify as express aiming. As we discussed above, the nature and structure of a defendant's business can affect the personal jurisdiction analysis. In view of the "fact-intensive nature" of the personal jurisdiction inquiry, Herbal Brands, 72 F.4th at 1096, we have set forth the governing legal principles and applied them to the facts alleged. But we do not purport to decide how these principles may apply to online payment platforms that are set up differently. IV
As a fallback, Briskin argues that if we conclude personal jurisdiction is lacking, we should remand to allow him the opportunity to take jurisdictional discovery of Shopify. We review the denial of jurisdictional discovery for abuse of discretion. Yamashita, 62 F.4th at 507. We will not reverse a district court's refusal to allow jurisdictional discovery "except upon the clearest showing that denial of discovery results in actual and substantial prejudice to the complaining litigant." Id. (quoting Boschetto, 539 F.3d at 1020).
These demanding standards are not met here. In the court below, Briskin requested leave to take jurisdictional discovery in only two curt footnotes in his opposition briefs to Shopify's motions to dismiss. Briskin provided no supporting argument in favor of this desired discovery. Nor has Briskin explained what jurisdictional discovery would accomplish or how it would change the result of this case. See Yamashita, 62 F.4th at 507 ("[A] mere hunch that discovery might yield jurisdictionally relevant facts, or bare allegations in the face of specific denials, are insufficient reasons for a court to grant jurisdictional discovery." (quoting LNS Enters., 22 F.4th at 864-65)). The problems with Briskin's theory of personal jurisdiction are endemic to the nature of his claims and Shopify's business structure. Although the district court did not explicitly address Briskin's request for discovery, the district court's effective denial of this request was not an abuse of discretion.
Because we conclude that Shopify is not subject to specific jurisdiction, we need not address the district court's additional determination that the complaint failed to comply with Federal Rule of Civil Procedure 8 by insufficiently detailing how each Shopify defendant had wronged Briskin.
* * *
The judgment of the district court is