Briskin v. Shopify Inc.

Background

Brandon Briskin brought a proposed class action concerning the collection of consumer data through Shopify’s online shopping platform. The opinion states that Briskin is an Internet shopper and resident of Madera, California. Shopify Inc. is described as a Canadian company headquartered in Ottawa, Canada. Shopify (USA) Inc. is described as a Delaware company with its principal place of business in Ottawa, Canada, and Shopify Payments (USA) Inc. is described as a company in Delaware. Shopify Payments and Shopify USA are wholly owned subsidiaries of Shopify Inc.

Briskin alleged that Shopify’s software generated payment forms, collected information entered by consumers, installed browser cookies to track transactions across Shopify’s merchant network, created individualized consumer profiles, analyzed purchases for potential fraud, and shared data with merchants and other third parties. The information allegedly included names, addresses, email addresses, credit card numbers, Internet Protocol addresses, purchased items, and geolocation information.

Briskin alleged that he purchased fitness apparel in June 2019 through the website of IABMFG, a Shopify Inc. merchant. He alleged that he did not consent to the collection or use of his data and sought to represent a class of California consumers who submitted payment information through Shopify’s software while located in California. The second amended complaint asserted claims under the California Invasion of Privacy Act, the California Constitution’s privacy protections, the common-law tort of intrusion upon seclusion, the California Computer Data Access and Fraud Act, and California’s Unfair Competition Law.

Motions to dismiss

The three defendants each moved to dismiss under Federal Rule of Civil Procedure 8(a)(2), arguing that the complaint did not provide adequate notice of the claims against them. In the alternative, they moved under Rule 12(b)(2) for lack of personal jurisdiction, meaning that the court lacked legal power over the defendants. They also alternatively invoked Rule 12(b)(6), which concerns whether a complaint states a legally sufficient claim.

The court focused on the pleading and personal-jurisdiction grounds. Under Rule 8(a)(2), a complaint must provide a short and plain statement showing that the plaintiff is entitled to relief. The court explained that a complaint generally fails this requirement when it combines multiple defendants in broad allegations without identifying each defendant’s role in the alleged harm.

Court’s analysis

The court found that Briskin alleged all claims against all three defendants while referring to them collectively as “Shopify.” According to the court, the second amended complaint did not identify which defendant was responsible for the alleged injuries. The court therefore concluded that the complaint failed to give each defendant fair notice of the claims.

The court separately analyzed personal jurisdiction. It stated that Briskin did not argue that any defendant was subject to general jurisdiction in California, so the analysis concerned specific jurisdiction—jurisdiction based on conduct connected to the claims. For Shopify Inc. and Shopify USA, the court found that the allegations showed only that Shopify was IABMFG’s vendor for an online sales platform. The court concluded that providing hosting services and operating an e-commerce platform did not show intentional conduct directed at California residents. The court also found that Briskin did not explain how Shopify’s Los Angeles activities related to his Internet-based claims.

As to Shopify Payments, the court considered the entity’s contract with Stripe. It held that the mere existence of a contract with a party in California was not enough to establish the required contacts with California. The court therefore concluded that it lacked both general and specific personal jurisdiction over all three defendants.

Disposition

Judge Hamilton granted defendants’ motions to dismiss. The court stated that dismissal based on inadequate notice of the claims would be with leave to amend. However, it dismissed the action without leave to amend because the court did not have personal jurisdiction over any defendant. The opinion does not state that the court reached the merits of whether the alleged data practices violated California law.