The Ninth Circuit filed its anticipated en banc opinion on personal jurisdiction last week, and the result is the broadening of Internet-based personal jurisdiction in an age of ubiquitous online commerce.  The district court in Briskin v. Shopify, Inc., No. 22-15815, 2025 U.S. App. LEXIS 9410 (9th Cir. Apr. 21, 2025), had ruled that there was no personal jurisdiction in California over a Canada-based Internet payment service provider merely because a consumer in California made a purchase, and a three-judge panel affirmed.  An en banc panel, however, disagreed and published an opinion that holds the defendant to answer purportedly because it “expressly aimed” its services at California, allegedly through its use of “cookies.’ 

The defendant in Briskin is an e-commerce platform that facilitates online sales.  Merchants use the defendant’s software and infrastructure to set up and manage their online stores, and the defendant processes payments and, in some cases, ships products to purchasers.  Throughout the transactions, the defendant’s participation is invisible to consumers, who allegedly see only the online seller when making their purchases.  Id. at *14-*15.

A key fact for the Ninth Circuit majority was that, during the plaintiff’s transactions, the defendant installed tracking cookies on the plaintiff’s phone—software files that allegedly allowed the defendant to track the plaintiff’s behavior, including geolocation, payment information, IP address, etc.  In his class action complaint filed in California, the plaintiff alleged that the defendant gathered and shared private information in violation of California law.  Id. at *15-*18. 

The defendant was actually a group of defendants—a Canadian corporation based in Ottawa and two subsidiaries incorporated in Delaware with principal places of business in New York and Delaware.  So they moved to dismiss for lack of personal jurisdiction, arguing that their platform was agnostic to California (and every other state) and that the mere happenstance that a California consumer made a purchase was insufficient to support personal jurisdiction.  In other words, if they were subject to jurisdiction in California, they would be subject to jurisdiction everywhere.

An unsympathetic Ninth Circuit started with International Shoe and followed a “purposeful direction analysis,” which “focuses on the forum in which the defendant’s actions were felt, whether or not the actions themselves occurred within the forum.”  Id. at *20-*23.  That analysis, in turn, came down to whether the defendants “expressly aimed” an intentional act that causes harm that the defendant knows will be suffered in the forum state.  Think the old law school hypothetical of an archer who fires an arrow across state lines.  That is an intentional harmful act expressly aimed at another forum. 

So what do we do with that in a time when packets of data are traveling across borders (usually without any particular aim) and not arrows?  It is by now established that mere passive nationwide accessibility to cyberspace does not demonstrate “express aiming” at everyone everywhere.  There has to be “something more.”  Id. at *26.  It is not entirely clear to us what the “something more” has to be, other than it must be more than just a foreseeable effect in the forum state.

For the defendants in Briskin, the Ninth Circuit’s majority opinion found express aiming at California because the plaintiff alleged that the defendants “targeted” California consumers to collect and exploit payment information and other personal identifying information “that it extracts from the software it permanently installs on their devices.”  Id. at *34-*35.  According to the majority, it was not mere “happenstance” that California consumers chose to do business with online merchants who used the defendants’ platform. 

Instead, “it is clear that [Defendant] expressly aimed its conduct at California through its extraction, maintenance, and commercial distribution of the California consumers’ personal data in violation of California laws.”  Id. at *36.  We are not sure how clear that is, but for the Ninth Circuit majority, the analogy was to someone who physically entered a Californian’s home to take personal information for its own commercial gain.  In that case, there would be “no doubt” over specific personal jurisdiction in California.  Id. at *37. 

The obvious problem with the Ninth Circuit’s conclusion is that the defendants operate nationwide without differentiation and thus did not “target” California any more than they “targeted” anywhere else.  The Ninth Circuit was again unsympathetic and rejected the notion that a nationwide company can do business everywhere, but be jurisdictionally nowhere except its principal place of business and state of incorporation.  Id. at *37-*38.  The court also expressly overruled cases requiring some sort of differential treatment of the forum state before finding “express aiming” sufficient to support specific personal jurisdiction.”  Id. at *40-*41.  “Express aiming” thus seems not to require any aiming at all. 

The defendants justifiably protested that the Ninth Circuit’s ruling could lead to specific jurisdiction in all 50 states.  The majority’s response was blunt:  “That may be true, but not unfair.” 

There were two concurring opinions.  For one concurring judge, the majority did not go far enough.  When the alleged conduct is purely automated, the operation of the automated system is the relevant tortious conduct, which occurred in California.  That forum conduct is sufficient to support specific personal jurisdiction.  There is no need for “something more.”  Id. at *56-*64.  Another concurring judge looked to the Constitution and due process and searched for analogies to physical presence.  Through that lens, it does not matter whether a defendant targeted the forum state over others, so long as the defendant is sufficiently present in the forum state through its alleged business operations.  Id. at *66-*77.

Finally, there was one dissent, who condemned the majority’s reliance on the defendants’ knowledge of the plaintiff’s location when they installed cookies on his phone.  Personal jurisdiction turns on the defendant’s contacts with the forum state—and not the people who reside there.  The dissenter also roundly mocked the majority for pegging jurisdiction on something as transient as software files on a mobile device. What if the plaintiff made his purchase in California, then traveled to Nevada or Oregon, toting his phone and his cookies all along the way?  Is there personal jurisdiction now in those states, too (“traveling cookie” jurisdiction)?  If the defendants’ inroads in California are so strong, then why not general jurisdiction—a position that not even the plaintiff has advanced?  Id. at *77-*84.

It is easy to view the Briskin opinion as California’s latest attempt to make every controversy justiciable in California, and maybe that is what it is.  Regardless, “something more” is still required to establish specific personal jurisdiction based on e-commerce, and Briskin will not be the last word.