Beyond Borders: Shopify Ruling Redraws Legal Map for Online Businesses
By:
Lauren Farrugia was a summer 2025 Litigation Clerk at Washington Legal Foundation and is a Juris Doctor candidate at the George Washington University School of Law.
* * *
The Ninth Circuit’s recent en banc decision in Briskin v. Shopify, Inc. is reverberating across the digital economy. In a sweeping reinterpretation of personal jurisdiction doctrine, the court held that Shopify, a Canada-based e-commerce platform, could be sued in California for allegedly collecting user data without consent. This ruling substantially broadens the jurisdictional reach of state courts over online businesses, and it carries profound implications for how companies handle data collection, privacy compliance, and nationwide operations.
The Case Background
Brandon Briskin, a California resident, made a purchase through a third-party merchant powered by Shopify. He brought suit not due to a faulty product, but because he alleged that Shopify tracked his location, collected payment and behavioral data, and built a profile about him, all without his knowledge or content. Although Shopify does not sell products directly and had no physical presence in California, it facilitated the transaction and embedded tracking tools that allegedly siphoned Mr. Briskin’s data.
On May 5, 2022, the Northern District Court of California dismissed the suit for lack of personal jurisdiction. In November 2023, a three-judge Ninth Circuit Panel affirmed the district court’s dismissal. Upon rehearing, however, the en banc panel of the Ninth Circuit reversed course in April 2025. The en banc court held that Shopify purposefully directed its conduct at California residents through its platform design and data collection practices. The court held that engaging in extensive data-driven activity affecting Californians created a sufficient nexus for personal jurisdiction, even absent overt marketing or state-specific campaigns.
Key Legal Shift
The Briskin court directly overruled prior Ninth Circuit’s precedent, most notably AMA Multimedia, LLC v. Walmart, which required “something more” than a nationwide website and general accessibility to establish personal jurisdiction. In AMA, the court held that passive website access and incidental commercial benefits from users in a state were insufficient to show purposeful direction without targeted outreach or intentional engagement with that forum. The en banc panel rejected this restrictive view, stating that in the digital age, a platform’s knowing collection and monetization of user data from a forum state constitutes sufficient purposeful availment. This decision contrasts sharply with decisions by other courts and represents a sea change in the law.
Immediate Legal Influence
Briskin is already reshaping litigation. Just days after the Briskin ruling, the Central District of California revisited its earlier dismissal in Los Angeles Turk Club v. U.S. Racing. Citing Briskin as an “intervening change in controlling law,” the court granted reconsideration and allowed plaintiffs to amend their complaint to meet the newly expanded jurisdictional standard. This swift application underscores how Briskin is altering judicial outcomes and breathing new life into previously dismissed privacy claims. Expect more of the same in federal litigation in all the States that make up the Ninth Circuit, including California, the Nation’s most populous and wealthy.
Influence Outside the Ninth Circuit
While no federal appellate court outside the Ninth Circuit has formally adopted Briskin, its reasoning is already rippling through pending litigation. In the First Circuit, the court dismissed Rosenthal v. Bloomingdales.com in May 2024 for lack of personal jurisdiction. The court applied a traditional, restrictive standard, ruling that mere access to a national website from Massachusetts did not establish jurisdiction.
In June 2025, however, in an almost identical case, Mikulsky v. Bloomingdales, but in a different circuit—the Ninth Circuit—the court cited Briskin as a basis to find personal jurisdiction. This split in circuit court decisions has renewed the debate over forum shopping. Plaintiffs are increasingly incentivized to file privacy and consumer protection suits in West Coast courts, where Briskin now offers a more favorable path past jurisdictional hurdles. Legal analysts note that this growing circuit split creates a patchwork landscape, where the same national retailer can face liability in California but avoid suit entirely in Massachusetts.
National law firms such as Dechert, McDonald Hopkins, and Wiley are already advising clients to prepare for this trend. Plaintiffs’ lawyers are citing Briskin as persuasive authority in non-Ninth Circuit jurisdiction, testing whether courts will begin importing its logic despite the lack of binding precedent—one may eventually bite. But even if other courts hold the line, Briskin has changed the game. Either the Supreme Court will have to step in, or we will face a fractured, regionalized landscape for e-commerce in the United States.
Implications for Online Businesses
Online businesses, especially those engaged in data tracking and analytics, face increased exposure to lawsuits in any state where their users reside, fundamentally altering the risk calculus for platforms that have traditionally relied on uniform privacy policies. As a result, business must now carefully evaluate whether their data collection and cookie policies comply, not only with federal regulations, but also with the diverse and increasingly stringent consumer protection laws for individual states, such as California’s Consumer Privacy Act (CCPA). This expanded jurisdictional reach may also discourage companies from operating in certain states or encourage them to adopt geo-blocking as a defensive tactic to avoid being subject to unfavorable jurisdictions.
To mitigate these risks, companies will need to bolster transparency in their privacy policies and implement clear, affirmative opt-in mechanisms for data collection, especially for residents of states with robust privacy frameworks like California, Colorado and Connecticut, making user consent a critical component of future compliance strategies.
Divided Reactions from the Legal Community
The decision has garnered both praise and concern. Privacy advocates and state attorneys general from 30 States and the District of Columbia hailed the ruling as a victory for consumer protection, arguing it holds powerful digital actors accountable. Conversely, Shopify and several amici curiae warn that the ruling could lead to a flood of litigation and impose a chilling effect on innovation.
Legal analysts from firms like Proskauer Rose note that the decision sets a precedent for expansive jurisdiction based solely on passive data harvesting, an approach that could destabilize the jurisdictional predictability upon which many online platforms rely.
Conclusion
The Briskin v. Shopify decision marks a pivotal moment in e-commerce jurisdiction jurisprudence. It signals that courts are willing to hold online platforms accountable wherever their digital footprint extends, particularly when consumer data is involved.
For e-commerce the message is clear: if your platform touches consumers in a State, you may be subject to that state’s laws. The future of internet litigation may no longer be constrained by where you operate, but by where your data travels.