Ninth Circuit Takes a Wrecking Ball to Internet Personal Jurisdiction Law

4/23/2025 at 8:26:26 PM

The "online retailer" (IABMFG) in this case is based in California.

A company in California, selling to a customer in California, shouldn't be able to say "California law doesn't apply because my payment processor is Canadian." And if Shopify wants to take a cut of every sale from retailers based in California, they should be willing to comply with California law as well, at least insofar as it applies to the services provided via those California-based retailers' web sites.

(The actual opinion is linked at the bottom of the submission; I humbly suggest folks commenting here should read it first: https://cdn.ca9.uscourts.gov/datastore/opinions/2025/04/21/2...)

by dpifke

4/23/2025 at 9:32:07 PM

To be clear, this isn't a choice-of-law case. It's not about whether California law applies. It's about whether a court in California has jurisdiction; that is, whether it can hear the case at all.

by otterley

4/24/2025 at 5:35:14 AM

That seems like a meaningless distinction. If you can't have a case heard by a state court, then that state's laws can't be applied, by definition.

by ajross

4/24/2025 at 5:51:37 AM

That is not true. State courts can apply foreign state laws, and federal courts can apply any state’s laws.

by otterley

4/24/2025 at 7:34:08 PM

Sort of yes, sort of no.

For example, imagine an American tourist visiting the UK drives dangerously and kills a motorcyclist, then escapes to the US before being caught.

A UK criminal court can order jail and a driving ban, but has no way to enforce the sentence unless the tourist decides to return to the UK, or the US decides to extradite.

A US criminal court can't do anything, the crime took place outside of their jurisdiction.

The victim's family can sue the tourist in a US civil court, and that court can take UK law into account - but can basically only impose a cash settlement that gets paid out of the tourist's insurance. They don't actually lose a cent.

So in a sense one state's courts can apply foreign state laws. But in terms of results, i.e. days spent in jail, laws don't appear to apply across borders.

by michaelt

4/24/2025 at 9:45:05 PM

In American law, a "foreign state" is a term of art meaning another U.S. state or territory. It does not mean a foreign nation like the UK. International law is a whole other ball of wax, as you suggest.

by otterley

4/24/2025 at 6:21:22 AM

Again that seems needlessly pedantic. Has there ever been a case where a court applied a law from a regime where that regime's own courts lack jurisdiction? Again, in practice "laws apply" and "courts have jurisdiction" are isomorphic states. Complaining about an article making the very reasonable conflation seems nitpicky and silly.

by ajross

4/24/2025 at 1:56:29 PM

The article didn’t make that conflation at all. The author, a former professor of mine in law school, knows what he’s talking about (as do I). It was the commenter who was confused (as are you).

Jurisdiction has nothing to do with whether laws are applicable to a case. It has to do with whether a particular court can hear a case. Personal jurisdiction questions go back hundreds of years to resolve issues like “is it just to force a defendant to travel hundreds of miles by horse and carriage to defend himself?” versus allowing him to defend himself closer to home.

If the plaintiff sued Shopify in New York, this issue wouldn't have come up at all. (And, yes, a New York court can apply California law.)

This stuff is all covered in first-year civil procedure in law school.

by otterley

4/24/2025 at 1:35:43 PM

I don't know how it is within the US but in Europe this is a common occurrence. Contracts with choice of law, international succession procedures, civil liabilities... even arbitration.

by soco

4/24/2025 at 12:37:32 AM

It also isn't against the Californian company. It was Shopify which is not a Californian company.

Seems bizarre to me that several lower courts ruled in favor of Shopify though..

by Quarrel

4/24/2025 at 12:49:53 AM

Shopify on behalf of a california company

by bluGill

4/23/2025 at 9:35:59 PM

Could a tort claim under California state law be heard in any other court (assuming no accompanying Federal claims)?

by dpifke

4/23/2025 at 9:36:20 PM

Yes. Choice-of-law terms are frequently found in contracts. When interpreting the law, the court with jurisdiction will do its best to refer to and interpret existing law of the state in question to the case.

by otterley

4/23/2025 at 11:09:34 PM

(I deleted my original reply, which was maybe conflating several different arguments. I'll try to restate my point more succinctly. IANAL, so it's quite possible I'm misunderstanding the legal issues at play.)

The linked opinion's discussion of jurisdiction seems to be about whether the case can be heard in any court, not if there's an alternate venue that would be more proper. FWIW, the retailer's web site[0] does not seem to contain a terms of service or anything with a choice-of-law provision. If the argument is that no court has jurisdiction in which the plaintiff can seek redress, that seems equivalent to saying that the law doesn't apply to the defendants.

Shopify already exercises a huge amount of discretion as to which businesses it's willing to provide services for, and how much it charges them. It does not seem unreasonable to me that the company would either a) be willing to answer to California courts, or b) stop selling its services to California retailers.

[0]: https://www.iambecoming.com/pages/who-we-are

by dpifke

4/24/2025 at 5:46:21 AM

There is definitely one state, which is New York (where its U.S. HQ is). Another is possibly Delaware in which its U.S. entity is incorporated.

That’s why the author said that when the court stated that it would be absurd if there were no state that had jurisdiction, the court was being misleading, because there is always at least one state in which a U.S. entity is subject to jurisdiction.

by otterley

4/23/2025 at 11:19:08 PM

> And if Shopify wants to take a cut of every sale from retailers based in California, they should be willing to comply with California law as well,

For the moment, for purpose of consumer protections, fine. But on longer time scales, I'm not sure. Does it really make sense for legacy states to be able to bind transacations on the internet? Doesn't that just make it a very large intranet?

Obviously information refuses to be stopped by borders. Are we going to have a situation where states of various sizes try to claim jurisdiction, but only those with sufficiently violent tendencies (and thus the ability to achieve compliance by fear) succeed? Won't that corrupt the internet even worse than an absence of state-based consumer protections?

If two people who live 500 miles apart in the area currently claimed by the State of California, but do not recognize the State of California, and regard themselves as citizens of the internet, and, who is right, them, of the government of California?

Most of us will probably say that there is some social contract by which, for better or worse, the State of California is right.

But what if, in 100 years, California goes bankrupt. Does that change the calculus? If so, why? And does it change retroactively, for the purposes of historical classification of internet transactions? The diplomatic and economic affairs of state don't change the operation of internet protocols. It's hard to even fully imagine how to create an internet whose shapes are coterminous with the boundaries asserted by various states.

I'm broadly skeptical of any judicial rulings which extend the laws of the legacy states onto the internet, even if they appear to be on the side of short-term justice. This whole thing is starting to feel like a bandaid better ripped off quickly.

by jMyles

4/24/2025 at 12:04:50 AM

> Does it really make sense for legacy states to be able to bind transacations on the internet?

Yes.

We have a problem right now where the only place democracy, sensible laws and due process take place is in meatspace.

The internet - insomuch as it’s a real place, is a feudal society. It’s made up of small fiefdoms (websites) and some larger kingdoms which exert tyrannical power within their borders. They watch everything you do - usually to advertise to you. And they can banish you at a moments notice if doing so would result more profit for their rulers.

There’s an interesting argument you can make that the internet should be its own sovereign space. “Information wants to be free” and all that. Maybe if the internet was created 200 years ago, during the period of time when constitutions were being written everywhere, we would have created one for the internet. And then, maybe, the internet could have policies and courts and rules that uphold the rights of people. But that hasn’t happened. We have, through our collective inaction, delegated judicial oversight of the internet to sovereign states in meatspace. And thank goodness. Somebody needs to tell internet companies that my personal data is not for sale. Or tell Apple that they aren’t entitled to 15-30% of Netflix’s revenue after already selling a user their phone. (And don’t they dare redirect users to their website!)

If us technologists won’t govern ourselves, we delegate that important job to the state of California. To the European Union. To Australia’s department of fair trade & ACCC. And so on. It means we get a fractured Internet. But people have inalienable rights that need to be defended. Those rights must not be undermined just because we’re online and there’s a profit to be made.

by josephg

4/24/2025 at 1:49:18 AM

Laws are also the most effective tool for destroying rights, arguably much more so than protecting them.

So the flip side of your position that someone needs to be subject to a foreign law when dealing with a foreign party because otherwise that parties right might be stommped is that they also need the means to block interactions with that foreign party so their own rights aren't potentially stomped.

In the case where there are sales you might actually know where the other parties reside, but in the majority of interactions online you don't and there is no great means to control your exposure to other jurisdictions.

by nullc

4/24/2025 at 2:47:58 AM

they also need the means to block interactions with that foreign party so their own rights aren't potentially stomped

Yes. That's the point. If you choose to do business with someone you also accept the jurisdiction of their local courts and laws. If you don't want that risk then do business locally.

by gamblor956

4/24/2025 at 9:06:05 PM

This exposure however isn't limited just to 'business'. When you make comments online or publish open source code you're also potentially exposing yourself to other jurisdictions and their laws.

by nullc

4/24/2025 at 5:01:08 AM

> Does it really make sense for legacy states to be able to bind transacations on the internet?

Sites like paypal and escrow.com need licenses for every state in the US to carry on business (Mostly called money transmission licenses, but there are a few other names and regulations depending on the state). Yes, it is just as big a compliance nightmare as you'd expect.

So yes, it does happen.

And anyway, as this case shows, if you have customers in a state you need to follow the laws of that state. This is why Pornhub have stopped servicing various states.

by Quarrel

4/23/2025 at 11:58:27 PM

[dead]

by thunderfork

4/23/2025 at 11:20:02 PM

This ruling is correct, and good.

> If a company develops a web-based business for the purpose of conducting online transactions in all 50 States, it should not be surprised that it may be sued in any State for unlawful transactions that may occur within that State.

Obviously. But the author calls this "chilling". Without this, companies could circumvent state laws, to conduct actions that are illegal in that state within that state, simply by headquartering or hosting in another. That would be absurd.

It would create a race-to-the-bottom of consumer rights, where states wanting business tax revenue are incentivized to make their states surveillance/ data harvesting/ consumer exploitation havens, whose businesses could then operate across all other states freely.

by ang_cire

4/24/2025 at 1:59:15 AM

Think of the mom & pop handmade craft business selling ceramics online. They couldn't afford to sell their state.

by mmooss

4/24/2025 at 2:31:21 AM

The ruling explicitly addressees this by talking about the scale and scope of Shopify's business in California. Read the 'express aiming' portions.

Trying to conflate a mom & pop shop vs. shopify is silly and not something that the court attempted to do.

by cthalupa

4/24/2025 at 8:09:20 AM

Why is a mom and pop ceramics business violating consumer privacy laws?

Shopify is trying to avoid California having jurisdiction (to try them for privacy violations), because Shopify *knows* they're violating California consumer privacy laws.

The idea that enforcing consumer protection laws will somehow result in an explosion of frivolous lawsuits, or the death of business confidence, or will chill business development, is just a lie that companies push to fearmonger away consumer protections.

by ang_cire

4/24/2025 at 8:17:47 PM

I understand Shopify's tactics, but the results are the same for Mom & Pop regardless of how they came about.

> just a lie

That's just some words; how will it not affect Mom & Pop?

> Why is a mom and pop ceramics business violating consumer privacy laws?

Because they don't have a legal department to make sure they comply with the rules in 50 states and N countries.

by mmooss

4/23/2025 at 8:19:33 PM

> What Could Shopify Have Done Differently?

For completion I think "cease to insecurely extract, aggregate and abuse all that user data" should also be mentioned as an alternative to the different ways they could skirt regulation.

by 3np

4/23/2025 at 9:14:30 PM

You’re misunderstanding the question - he’s asking how Shopify could avoid jurisdiction, not avoid this suit. Jurisdiction is a threshold question before you get to the merits… maybe Shopify did the bad thing, maybe they didn’t, but before we decide that, we need to determine if California law even applies to Shopify.

The author seems to think that there should be some way for Shopify to avoid jurisdiction while still offering services in California, but I don’t really understand why he thinks so.

by clucas

4/23/2025 at 9:43:37 PM

As a former student of the author, I don't think he's saying they should be able to avoid jurisdiction. I think he was musing on whether it would even be possible under this new Ninth Circuit framework/test. He concludes it's unlikely, and hence for Shopify (or any other company putting cookies in browsers) to have any chance of avoiding it, they're going to have to appeal to SCOTUS.

by otterley

4/23/2025 at 11:35:58 PM

Not at all. I think he rightly concludes that jurisdiction is completely avoidable by geoblocking California.

It is baffling to hear the author ask the question “did Shopify ‘expressly aim an intentional act at California?” And subsequently conclude that Shopify’s entire business model is in doubt if it doesn’t do business in California.

by xbar

4/24/2025 at 5:03:08 AM

I think the one plausible argument for Shopify is that the California law is unconstitutional since this might be interstate commerce.

by adgjlsfhk1

4/24/2025 at 5:47:33 AM

That’s possible, but they haven’t even gotten there yet because they’re still arguing over the jurisdictional question.

by otterley

4/24/2025 at 5:48:22 AM

They’re not going to geo block California customers. It makes no business sense.

by otterley

4/23/2025 at 9:08:26 PM

I was going to quote, and respond in almost the exact same way.

The only change I would make to your suggestion would be to remove the word "insecurely".

They shouldn't extract or aggregate user data in any fashion whatsoever.

by johnea

4/23/2025 at 8:01:53 PM

Backstory from eff:

https://www.eff.org/deeplinks/2024/07/courts-should-have-jur...

by getcrunk

4/23/2025 at 11:38:07 PM

For anyone not clicking through, EFF supports the 9th Circuit in this case.

by ang_cire

4/24/2025 at 2:32:14 AM

Unfortunately, EFF is not principled. Had the facts of this case been slightly different—say, state law were to require some privacy invading practice that the foreign company does’t want—then EFF would take the opposite stand.

by abtinf

4/24/2025 at 8:08:12 AM

The EFF has been consistently on the side of consumer online rights, regardless of who is opposing them.

by ang_cire

4/24/2025 at 1:12:12 PM

Well then, be sure to thank EFF one day when one of the conservative states passes a law requiring service providers to retailers to report sales of sex toys to the government, and the legal challenge is lost citing this case as precedent.

by abtinf

4/24/2025 at 7:37:26 PM

This kind of 'legal bulwark' argument is naive. No precedent is needed for SCOTUS or 5th Circuit Federal to do whatever the hell bs they want.

The important thing is what protections are gained now, directly as a result.

Also, sales tax already goes to the state where a good is delivered to. Texas already knows when you buy from Good Vibrations, if you live there.

by ang_cire

4/23/2025 at 9:25:03 PM

Maybe the line of reasoning offered and argued against is dubious. But IMO there are literally dozens of other arguments that will come to the same conclusion if you want to avoid hand waving about the particular bits the author raises.

By and large states having different laws is a pain, but arguing that you can do business in every state while only following the laws of one state is a very messy rejection of state's rights, and leads to using the commerce clause to basically negate most state level regulations and jurisdiction.

by Glyptodon

4/23/2025 at 8:00:02 PM

I suspect this has something to do with "Shop Pay", Shopify's own payment system used on most (all?) Shopify stores. It enables you to have saved payment information for any Shopify store you come across, facilitating one-click checkout even if you have never shopped on that particular brand/website before. Webshop operators love it because it is very good at fraud detection (due to the pooled data on the backend), and removes barriers at checkout (needing your wallet, fill out an address form, etc). As far as I'm aware, it's optional on the Shopify platform. Using Shop Pay for payment is optional on the consumer level.

I suspect Shopify's terms inform their customers (webshop operators) that they are responsible for disclosure, etc and being compliant with state privacy laws - however since majority of web shops are exempt (due to small size, revenue, etc), these shops did not (knowingly or otherwise) publish these terms. That's just speculation on my part...

If this is true, I find this case troubling and weak, and hope it is overturned. It is squarely on the shop operator to be compliant - Shopify is just a platform vendor and shoppers are not Shopify customers; rather, they are customers of the shop. This seems to be akin to suing Google because a website uses Google Analytics but didn't disclose it in their privacy statement - silly...

This particular case gives me ADA and Prop65 vibes... lots of bottom-feeding lawyers using serial plaintiffs to extort businesses out of money. At least in this case they're going after someone with deep pockets and not just small businesses...

by Alupis

4/23/2025 at 8:24:55 PM

I'm not familiar enough with California's law to know whether companies like Shopify/Google are meant to be liable (in the sense that the law says so), but certainly it would be a great thing if the companies actually performing the mass surveillance (Google, Shopify) were liable even if the payload deliverer is small. Absolutely what is needed is law saying that Google can be sued (or better, held criminally liable for harassment/stalking) for spying on people through its Google Analytics program, among others.

Relentlessly stalking millions of people makes it millions of times worse than stalking one person, not somehow okay.

by ndriscoll

4/23/2025 at 9:39:01 PM

Or hold enough of those small actors to account that nobody wants to do business with Google Analytics in its current form.

It disgusts me that companies who want to transact with me don't vet their partners better. Off-Meta is another one that's despicable. Companies like my bank or their partners have NO business uploading lists of their users to third parties like that (even if it was induced by use of their analytics SDK's).

by rkagerer

4/23/2025 at 9:17:32 PM

> It is squarely on the shop operator to be compliant - Shopify is just a platform vendor and shoppers are not Shopify customers; rather, they are customers of the shop.

I disagree energetically. If Shopify wants to run a service identifying people between every site that it serves as a backend to, it should ask those people if they want to be included in that. The only alternative to stop the illegal activity otherwise is to print a list of Shopify's customers, and visit (and sue) them one by one in California. Shopify is running the service, and the shop owner probably doesn't even know how it works.

I'd even think that a shop owner sued over this should in turn be able to sue Shopify. If Shopify knows that something it does is not legal in California, it should tell its clients who may do business in California.

by pessimizer

4/23/2025 at 9:25:50 PM

You opt-into using Shop Pay, as a consumer. By default you are in "guest" mode.

> If Shopify knows that something it does is not legal in California

This is what is being debated. This ruling is mostly expected out of the 9th... we'll see what happens when a real court hears this case.

by Alupis

4/23/2025 at 10:04:57 PM

What are the odds the Supreme Court hears this?

by Aloisius

4/23/2025 at 10:31:11 PM

Your guess is as good as mine. I doubt Shopify will let this rest, since the consequences are fairly huge.

by Alupis

4/23/2025 at 9:49:27 PM

> If this is true, I find this case troubling and weak, and hope it is overturned. It is squarely on the shop operator to be compliant - Shopify is just a platform vendor and shoppers are not Shopify customers; rather, they are customers of the shop. This seems to be akin to suing Google because a website uses Google Analytics but didn't disclose it in their privacy statement - silly...

Most of my work is in the Shopify app dev ecosystem, and while I haven't been following this case very closely, I do think it's ironic how Shopify is behaving here given the privacy standards they enforce on their app developers.

Some context: all Shopify app developers are required to follow the EU's GDPR rules for customer data, full stop. Your app must implement Shopify's mandatory GDPR webhooks. You must delete customer data when a shop's customer is deleted; you must produce all data you store on a shop's customer within 7 days upon receipt of a certain GDPR webhook; and you must delete all the data you store on the shop itself after the shop uninstalls your app.

Additionally, if your app requires access to any customer data (whether its via the Customer API, or via other APIs e.g. to get the name of a customer who placed an order), you need to apply for access to that data on an app-by-app basis – replete with an explanation for why your app needs the data. Shopify's app store staff has to manually review and approve that data access application before you can publish your app on their app store.

To be clear, I think these restrictions are a good thing†, as apps used to have access to a veritable firehose of private customer data. But it's ironic to see Shopify enforce such standards on their app developers, while at the same time arguing that they should be able to track their own potential customers anywhere and everywhere across the internet regardless of privacy laws.

† Though I think it's a little odd that a Canadian company is making me, an American app developer, think about/adhere to the EU's GDPR rules. Not to mention other privacy laws like the one in California. Why not just call it "Shopify's Privacy Standards?"

by nozzlegear

4/23/2025 at 11:54:12 PM

Shopify is not enforcing those rules out of the goodness of its heart. It is in Shopify's best interest that retailers have as little information about their customers as possible and that it's as difficult as possible to export the data they do have out of Shopify, because that ties retailers to the Shopify ecosystem.

by decimalenough

4/23/2025 at 8:17:59 PM

Stripe also has a version of this called “Link”, which uses SMS authentication. Based on Stripe data on multiple platforms I have access to, quite a high percentage of people use it, probably due to how hard it’s pushed by the UI when adding a payment method

by chocolatkey

4/23/2025 at 8:38:59 PM

> then more privacy-protective option are not feasibly available to Shopify

I haven't laughed that hard in awhile. Poor Shopify, they couldn't possibly protect the privacy and data of their customers.

by healsdata

4/24/2025 at 4:10:11 PM

How will you operate a secure payment system without cookies?

by ls612

4/23/2025 at 7:09:02 PM

The full title is:

> Ninth Circuit Takes a Wrecking Ball to Internet Personal Jurisdiction Law–Briskin v. Shopify

by hn_acker

4/23/2025 at 10:03:40 PM

What law was wrecked? The outcome appears to be the upholding of a CA law.

by topspin

4/23/2025 at 10:08:10 PM

Case law on internet-specific personal jurisdiction made by the district court, presumably.

by Aloisius

4/24/2025 at 12:23:19 AM

So no "law" at all. Just more "here today, gone tomorrow" precedents.

by topspin

4/24/2025 at 1:31:44 AM

Case law is law in the US.

by Aloisius

4/24/2025 at 9:01:30 PM

More generally, in the British legal tradition. Also known as "common law".

There are exceptions. I believe Napoleonic Law (France, Spain, Mexico, etc.) follows a different model, as does German law, where court decisions do not establish precedent, see e.g., <https://paperity.org/p/232486962/on-the-role-of-precedents-a...>.

by dredmorbius

4/24/2025 at 12:09:30 AM

I was with you until this paragraph:

> The broadest possible interpretation of this ruling is that any website that downloads any digital asset–cookies, javascript, heck maybe even HTML–onto a California resident’s computer can be sued in California, even if the website doesn’t know where the users are. If this is correct, the majority effectively would be saying: if you place a cookie on a reader’s device, you’ve done something more than passive publishing (i.e., you can passively publish without the cookie) and must accept the jurisdictional consequences.

This feels so close, but a little off my interpretation. In Collin's concurrence, he specifically calls out that the required parties "minimum-contacts" in the transaction were both in the state as part of the reason for the unambiguous jurisdiction, with Stripe being a third unexpected party to the information. To insert themselves is in effect inserting themselves into the jurisdiction as well. This paragraph:

> When a State specifically regulates the conduct of electronic systems with respect to transactions within its borders, the as-intended operation of those systems within that State is the relevant tortious conduct for minimum-contacts purposes, and that conduct is attributable to those persons who deliberately intended that such systems reach into that State and operate in that manner when they do so...

For me, this implies that third-party services not required or expected when a user interacts with a site that run scripts or set cookies for anything outside that "minimum-contacts" requirement is liable for what they do with that data, access, and what that code does.

by TrueDuality

4/23/2025 at 8:15:49 PM

This seems like a very strange reading of "express aiming"; instead of those words meaning that a person has done something to 'target', it means that the person did not 'expressly avoid'? I am not sure that "expressly aim" has much meaning at all in this reading.

I don't have any horse in this race, though I know the EFF is very popular on HN, and that many people here are also against data collection.

by nickff

4/23/2025 at 8:28:37 PM

I guess it's just a coincidence that the California Shopify meetup groups are abandoned without notice?

by 3np

4/23/2025 at 9:23:16 PM

The part where many may object:

> First, the majority might say that Shopify should not engage in privacy-invasive activities. I didn’t invest the energy to figure out the irreducible privacy elements of the plaintiffs’ claims, but if using cookies to track users is an essential part of the claim, then more privacy-protective option are not feasibly available to Shopify.

by djoldman

4/24/2025 at 4:11:36 PM

They made a decision, now let them enforce it

by emorning3