7 ms·
Ninth Circuit Takes a Wrecking Ball to Internet Personal Jurisdiction Law
- hn_acker 2y agoThe full title is: > Ninth Circuit Takes a Wrecking Ball to Internet Personal Jurisdiction Law–Briskin v. Shopify
- topspin 2y agoWhat law was wrecked? The outcome appears to be the upholding of a CA law.
- Aloisius 2y agoCase law on internet-specific personal jurisdiction made by the district court, presumably.
- topspin 2y agoSo no "law" at all. Just more "here today, gone tomorrow" precedents.
- Aloisius 2y agoCase law is law in the US.
- dredmorbius 2y agoMore generally, in the British legal tradition. Also known as "common law". There are exceptions. I believe Napoleonic Law (France, Spain, Mexico, etc.) follows a different model, as does German law, where court decisions do not establish precedent, see e.g., <https://paperity.org/p/232486962/on-the-role-of-precedents-and-legal-certainty-in-german-private-law https://paperity.org/p/232486962/on-the-role-of-precedents-a...>.
- Alupis 2y agoI suspect this has something to do with "Shop Pay", Shopify's own payment system used on most (all?) Shopify stores. It enables you to have saved payment information for any Shopify store you come across, facilitating one-click checkout even if you have never shopped on that particular brand/website before. Webshop operators love it because it is very good at fraud detection (due to the pooled data on the backend), and removes barriers at checkout (needing your wallet, fill out an address form, etc). As far as I'm aware, it's optional on the Shopify platform. Using Shop Pay for payment is optional on the consumer level. I suspect Shopify's terms inform their customers (webshop operators) that they are responsible for disclosure, etc and being compliant with state privacy laws - however since majority of web shops are exempt (due to small size, revenue, etc), these shops did not (knowingly or otherwise) publish these terms. That's just speculation on my part... If this is true, I find this case troubling and weak, and hope it is overturned. It is squarely on the shop operator to be compliant - Shopify is just a platform vendor and shoppers are not Shopify customers; rather, they are customers of the shop. This seems to be akin to suing Google because a website uses Google Analytics but didn't disclose it in their privacy statement - silly... This particular case gives me ADA and Prop65 vibes... lots of bottom-feeding lawyers using serial plaintiffs to extort businesses out of money. At least in this case they're going after someone with deep pockets and not just small businesses...
- deleted 2y ago[deleted]
- chocolatkey 2y agoStripe also has a version of this called “Link”, which uses SMS authentication. Based on Stripe data on multiple platforms I have access to, quite a high percentage of people use it, probably due to how hard it’s pushed by the UI when adding a payment method
- ndriscoll 2y agoI'm not familiar enough with California's law to know whether companies like Shopify/Google are meant to be liable (in the sense that the law says so), but certainly it would be a great thing if the companies actually performing the mass surveillance (Google, Shopify) were liable even if the payload deliverer is small. Absolutely what is needed is law saying that Google can be sued (or better, held criminally liable for harassment/stalking) for spying on people through its Google Analytics program, among others. Relentlessly stalking millions of people makes it millions of times worse than stalking one person, not somehow okay.
- getcrunk 2y agoBackstory from eff: https://www.eff.org/deeplinks/2024/07/courts-should-have-jurisdiction-over-foreign-companies-collecting-data-local https://www.eff.org/deeplinks/2024/07/courts-should-have-jur...
- ang_cire 2y agoFor anyone not clicking through, EFF supports the 9th Circuit in this case.
- abtinf 2y agoUnfortunately, EFF is not principled. Had the facts of this case been slightly different—say, state law were to require some privacy invading practice that the foreign company does’t want—then EFF would take the opposite stand.
- ang_cire 2y agoThe EFF has been consistently on the side of consumer online rights, regardless of who is opposing them.
- abtinf 2y agoWell then, be sure to thank EFF one day when one of the conservative states passes a law requiring service providers to retailers to report sales of sex toys to the government, and the legal challenge is lost citing this case as precedent.
- ang_cire 2y agoThis kind of 'legal bulwark' argument is naive. No precedent is needed for SCOTUS or 5th Circuit Federal to do whatever the hell bs they want. The important thing is what protections are gained now, directly as a result. Also, sales tax already goes to the state where a good is delivered to. Texas already knows when you buy from Good Vibrations, if you live there.
- nickff 2y agoThis seems like a very strange reading of "express aiming"; instead of those words meaning that a person has done something to 'target', it means that the person did not 'expressly avoid'? I am not sure that "expressly aim" has much meaning at all in this reading. I don't have any horse in this race, though I know the EFF is very popular on HN, and that many people here are also against data collection.
- 3np 2y agoI guess it's just a coincidence that the California Shopify meetup groups are abandoned without notice?
- 3np 2y ago> What Could Shopify Have Done Differently? For completion I think "cease to insecurely extract, aggregate and abuse all that user data" should also be mentioned as an alternative to the different ways they could skirt regulation.
- johnea 2y agoI was going to quote, and respond in almost the exact same way. The only change I would make to your suggestion would be to remove the word "insecurely". They shouldn't extract or aggregate user data in any fashion whatsoever.
- clucas 2y agoYou’re misunderstanding the question - he’s asking how Shopify could avoid jurisdiction, not avoid this suit. Jurisdiction is a threshold question before you get to the merits… maybe Shopify did the bad thing, maybe they didn’t, but before we decide that, we need to determine if California law even applies to Shopify. The author seems to think that there should be some way for Shopify to avoid jurisdiction while still offering services in California, but I don’t really understand why he thinks so.
- otterley 2y agoAs a former student of the author, I don't think he's saying they should be able to avoid jurisdiction. I think he was musing on whether it would even be possible under this new Ninth Circuit framework/test. He concludes it's unlikely, and hence for Shopify (or any other company putting cookies in browsers) to have any chance of avoiding it, they're going to have to appeal to SCOTUS.
- xbar 2y agoNot at all. I think he rightly concludes that jurisdiction is completely avoidable by geoblocking California. It is baffling to hear the author ask the question “did Shopify ‘expressly aim an intentional act at California?” And subsequently conclude that Shopify’s entire business model is in doubt if it doesn’t do business in California.
- dpifke 2y agoThe "online retailer" (IABMFG) in this case is based in California. A company in California, selling to a customer in California, shouldn't be able to say "California law doesn't apply because my payment processor is Canadian." And if Shopify wants to take a cut of every sale from retailers based in California, they should be willing to comply with California law as well, at least insofar as it applies to the services provided via those California-based retailers' web sites. (The actual opinion is linked at the bottom of the submission; I humbly suggest folks commenting here should read it first: https://cdn.ca9.uscourts.gov/datastore/opinions/2025/04/21/22-15815.pdf https://cdn.ca9.uscourts.gov/datastore/opinions/2025/04/21/2...)
- otterley 2y agoTo be clear, this isn't a choice-of-law case. It's not about whether California law applies. It's about whether a court in California has jurisdiction; that is, whether it can hear the case at all.
- dpifke 2y agoCould a tort claim under California state law be heard in any other court (assuming no accompanying Federal claims)?
- otterley 2y agoYes. Choice-of-law terms are frequently found in contracts. When interpreting the law, the court with jurisdiction will do its best to refer to and interpret existing law of the state in question to the case.
- deleted 2y ago[deleted]
- deleted 2y ago[deleted]
- deleted 2y ago
- healsdata 2y ago> then more privacy-protective option are not feasibly available to Shopify I haven't laughed that hard in awhile. Poor Shopify, they couldn't possibly protect the privacy and data of their customers.
- ls612 2y agoHow will you operate a secure payment system without cookies?
- healsdata 2y ago1) You can use cookies without being anti-privacy, pro-data selling. 2) Why do you need cookies to operate a secure payment system? At it's core, a payment system is a form. Yes, many bells and whistles around that form are powered by cookies/local storage, but they aren't necessary.
- djoldman 2y agoThe part where many may object: > First, the majority might say that Shopify should not engage in privacy-invasive activities. I didn’t invest the energy to figure out the irreducible privacy elements of the plaintiffs’ claims, but if using cookies to track users is an essential part of the claim, then more privacy-protective option are not feasibly available to Shopify.
- Glyptodon 2y agoMaybe the line of reasoning offered and argued against is dubious. But IMO there are literally dozens of other arguments that will come to the same conclusion if you want to avoid hand waving about the particular bits the author raises. By and large states having different laws is a pain, but arguing that you can do business in every state while only following the laws of one state is a very messy rejection of state's rights, and leads to using the commerce clause to basically negate most state level regulations and jurisdiction.
- ang_cire 2y agoThis ruling is correct, and good. > If a company develops a web-based business for the purpose of conducting online transactions in all 50 States, it should not be surprised that it may be sued in any State for unlawful transactions that may occur within that State. Obviously. But the author calls this "chilling". Without this, companies could circumvent state laws, to conduct actions that are illegal in that state within that state, simply by headquartering or hosting in another. That would be absurd. It would create a race-to-the-bottom of consumer rights, where states wanting business tax revenue are incentivized to make their states surveillance/ data harvesting/ consumer exploitation havens, whose businesses could then operate across all other states freely.
- mmooss 2y agoThink of the mom & pop handmade craft business selling ceramics online. They couldn't afford to sell their state.
- cthalupa 2y agoThe ruling explicitly addressees this by talking about the scale and scope of Shopify's business in California. Read the 'express aiming' portions. Trying to conflate a mom & pop shop vs. shopify is silly and not something that the court attempted to do.
- ang_cire 2y agoWhy is a mom and pop ceramics business violating consumer privacy laws? Shopify is trying to avoid California having jurisdiction (to try them for privacy violations), because Shopify *knows* they're violating California consumer privacy laws. The idea that enforcing consumer protection laws will somehow result in an explosion of frivolous lawsuits, or the death of business confidence, or will chill business development, is just a lie that companies push to fearmonger away consumer protections.
- mmooss 2y agoI understand Shopify's tactics, but the results are the same for Mom & Pop regardless of how they came about. > just a lie That's just some words; how will it not affect Mom & Pop? > Why is a mom and pop ceramics business violating consumer privacy laws? Because they don't have a legal department to make sure they comply with the rules in 50 states and N countries.
- TrueDuality 2y agoI was with you until this paragraph: > The broadest possible interpretation of this ruling is that any website that downloads any digital asset–cookies, javascript, heck maybe even HTML–onto a California resident’s computer can be sued in California, even if the website doesn’t know where the users are. If this is correct, the majority effectively would be saying: if you place a cookie on a reader’s device, you’ve done something more than passive publishing (i.e., you can passively publish without the cookie) and must accept the jurisdictional consequences. This feels so close, but a little off my interpretation. In Collin's concurrence, he specifically calls out that the required parties "minimum-contacts" in the transaction were both in the state as part of the reason for the unambiguous jurisdiction, with Stripe being a third unexpected party to the information. To insert themselves is in effect inserting themselves into the jurisdiction as well. This paragraph: > When a State specifically regulates the conduct of electronic systems with respect to transactions within its borders, the as-intended operation of those systems within that State is the relevant tortious conduct for minimum-contacts purposes, and that conduct is attributable to those persons who deliberately intended that such systems reach into that State and operate in that manner when they do so... For me, this implies that third-party services not required or expected when a user interacts with a site that run scripts or set cookies for anything outside that "minimum-contacts" requirement is liable for what they do with that data, access, and what that code does.
- emorning3 2y agoThey made a decision, now let them enforce it