Report from Reuters
In Brief – The Ninth US Circuit Court of Appeals has ruled that online commerce platform Shopify, based in Canada, could face a class action lawsuit in California for allegedly violating state privacy laws. An en banc panel overturned an earlier ruling that said the digital company could not be sued in the state because it did not specifically target its services to California-based online retailers. The consumer lawsuit claims that Shopify violated state law when its payments service used by online retailers downloaded tracking cookies to the phones of buyers, including those in California, and the data was later used by Shopify to bolster online advertising. The earlier courts had ruled that online retailers who made sales to state residents may be subject to state law, but Shopify was not because its payment service was offered online generally without targeting California shoppers. The en banc panel ruled 10-1 in the other direction, determining that Shopify “expressly aimed” its conduct toward Californians by “knowingly installing tracking software onto unsuspecting Californians’ phones so that it could later sell the data it obtained”. A spokesman for Shopify, which is based in Canada and operates from Delaware and New York as well, said the decision “attacks the basics of how the internet works,” and Circuit Judge Consuelo Callahan, the lone dissenter, criticizing the majority’s new “traveling cookie rule” because it “impermissibly manufactures jurisdiction wherever the plaintiff goes.”
Context – Expanding state “jurisdiction” over digital platforms selling third-party business services would likely be immensely disruptive. This case highlights the current difference in the standard for “jurisdiction” in state law liability cases between companies that sell physical products online that are then delivered into a state, which the Ninth Circuit has held does create jurisdiction for the company in the state, and the standard for third-party services that are offered on the internet, which has heretofore not established jurisdiction for a service provider if services are offered online without targeting the state. It is well understood that requiring legal and regulatory compliance in more places benefits larger businesses over smaller ones.