EDWARD BATON, et al., Case No. 21-cv-02470-EMC
Plaintiffs, AMENDED ORDER GRANTING v. DEFENDANTS’ MOTIONS TO DISMISS LEDGER SAS, et al., Docket Nos. 55, 56, 58 Defendants.
Plaintiffs, customers who purchased a hardware wallet to protect cryptocurrency assets, bring a putative class action seeking redress for harms they allegedly suffered stemming from a data breach exposing over 270,000 pieces of personally identifiable information, including customer names, email addresses, postal addresses and telephone numbers. Docket No. 33 (First Amended Complaint or “FAC”). Now pending before the Court are Defendants Shopify USA, Shopify, Inc. and Ledger’s respective motions to dismiss the complaint for, among other reasons, lack of personal jurisdiction. Docket Nos. 55, 56, 58. For the following reasons, the Court finds that it lacks personal jurisdiction over each defendant and that jurisdictional discovery is unwarranted. Therefore, the Court GRANTS the motions to dismiss and dismisses the case with prejudice. A. Summary of Allegations in the FAC Plaintiffs are customers of Defendant Ledger SAS (“Ledger”), a French company based in (“FAC”) ¶ 2, 21. Ledger sells its hardware wallets—the Ledger Nano X and Ledger Nano S— through its e-commerce website, which operates on Defendant Shopify, Inc.’s platform. FAC ¶¶ 2, 16-17. Plaintiffs allege they, and several putative classes, each bought a Ledger hardware wallet on Ledger’s e-commerce website, through Shopify’s platform, between July 2017 and June 2020. Id. ¶¶ 16-20. When Plaintiffs made their purchases, they provided their name, email addresses, telephone numbers and postal addresses. Id. Plaintiffs’ claims arise of two security incidents involving data breaches exposing Plaintiffs’ contact information. FAC ¶¶ 78, 79, 88. First, Plaintiffs allege that between April and June 2020, rogue Shopify, Inc. employees exported a trove of data, including Ledger’s customer transactional records. Id. ¶¶ 78-79. Shopify allegedly publicly announced the theft on September 22, 2020, which involved the data of approximately 272,000 people. Id. ¶¶ 79, 82. Plaintiffs allege that Ledger did not inform them that their data was involved in the Shopify breach at that time. Id. ¶ 83. Second, Plaintiffs allege that Ledger publicly announced that an unauthorized third-party gained access to Ledger’s e-commerce database through an application programming interface key on June 25, 2020 and acquired the email addresses of one million customers and physical contact information of 9,500 customers. Id. ¶ 88. Plaintiffs allege that Ledger did not disclose that the attack on Ledger’s website and the theft of Shopify’s data were connected, that Ledger downplayed the scale of the actual attack, and, as a result, Plaintiffs and putative class members were subject to phishing scams, cyber-attacks, and demands for ransom and threats. Id. ¶¶ 95-118. Plaintiffs contend that Ledger knew that its customer list was highly valuable to hackers, because it was a list of people who have converted substantial wealth into anonymized crypto-assets that are transferrable without a trace. Id. ¶ 5. Plaintiffs allege that despite knowing the high value of its customer list and the need for confidentiality, Ledger did not implement security measures to protect its customers by regularly deleting and/or archiving the customer data to protect that information from online accessibility. FAC ¶ 136, and that Ledger failed to exercise reasonable care in obtaining, retaining, securing, safeguarding, deleting, and protecting its customers personal information that Ledger had in its unauthorized persons, id. ¶ 117. Similarly, Plaintiffs allege Shopify failed to exercise reasonable care in obtaining, retaining, securing, safeguarding, deleting, and protecting their personal information in their possession from being compromised, lost, or stolen, and from being accessed, and misused by unauthorized persons. FAC ¶¶ 78-83. Plaintiffs are five Ledger customers who reside, respectively, in California, Georgia, New York, London, United Kingdom and Tel Aviv, Israel. Id. ¶¶ 26-20. They purport to represent several classes and subclasses, ranging from customers internationally to customers in particular states who suffered particular harms. Id. ¶ 145. Plaintiffs bring claims for, among others, negligence, negligence per se, injunctive relief and remedies under California’s unfair competition law, Georgia’s Fair Business Practices Act and New York’s General Business Law. Id. ¶¶ 168- 276. B. Relevant Factual Background Contained in Jurisdictional Declarations Defendants include additional factual background relevant to the Court’s jurisdictional inquiries at the motion to dismiss stage. Shopify USA states that it is incorporated in Delaware, has its principal place of business in Ontario, Canada, and never had a business relationship with Ledger. Docket No. 55-1 (“Harris-John Decl.”) ¶¶ 3-6. Shopify Inc., explains it is a Canadian corporation that it is not registered to do business in California and, does not have any employees in California. Docket No. 56-1 (“McIntomny Decl.”) ¶¶ 2-5. It explains that the “rogue” individuals who were responsible for the data breach of Shopify, Inc.’s platform were not employees of Shopify or any of its affiliated companies, but independent contractors of a company called TaskUs, who were located in the Philippines. Id. ¶¶ 11-12. Ledger explains that it is a French company with no California or U.S. employees. Docket No. 59 (“Ricomard Decl.”) ¶¶ 5, 11, 17. C. Procedural Background Defendant Ledger Technologies was voluntarily dismissed from this case. Docket No. 36. Remaining Defendants Shopify USA, Shopify, Inc. and Ledger move to dismiss Plaintiffs’ First Amended Complaint on multiple grounds, including for lack of personal jurisdiction and failure to A. Federal Rule of Procedure 12(b)(2) A defendant may move to dismiss based on lack of personal jurisdiction pursuant to Federal Rule of Civil Procedure 12(b)(2).
In opposing a defendant's motion to dismiss for lack of personal jurisdiction, the plaintiff bears the burden of establishing that jurisdiction is proper. Where, as here, the defendant's motion is based on written materials rather than an evidentiary hearing, the plaintiff need only make a prima facie showing of jurisdictional facts to withstand the motion to dismiss. The plaintiff cannot “simply rest on the bare allegations of its complaint,” but uncontroverted allegations in the complaint must be taken as true. Mavrix Photo, Inc. v. Brand Techs., Inc., 647 F.3d 1218, 1223 (9th Cir. 2011); see also Data Disc, Inc. v. Sys. Tech. Assocs., Inc., 557 F.2d 1280, 1285 (9th Cir. 1977) (noting that “[t]he limits which the district judge imposes on the pre-trial proceedings will affect the burden which the plaintiff is required to meet”). In addition, all disputed facts are resolved in favor of the plaintiff. See Pebble Beach Co. v. Caddy, 453 F.3d 1151, 1154 (9th Cir. 2006); see also Freestream Aircraft (Berm.) Ltd. v. Aero Law Grp., 905 F.3d 597, 602 (9th Cir. 2018) (stating that “[u]ncontroverted allegations in the complaint must be taken as true, and factual disputes are construed in the plaintiff's favor”). A. Personal Jurisdiction The test for personal jurisdiction is generally stated as follows:
Where, as here, no federal statute authorizes personal jurisdiction, the district court applies the law of the state in which the court sits. California's long-arm statute, Cal. Civ. Proc. Code § 410.10, is coextensive with federal due process requirements, so the jurisdictional analyses under state law and federal due process are the same. For a court to exercise personal jurisdiction over a nonresident defendant consistent with due process, that defendant must have “certain minimum contacts” with the relevant forum “such that the maintenance of the suit does not offend ‘traditional notions of fair play and substantial justice.’” Mavrix, 647 F.3d at 1223. jurisdiction. Freestream, 905 F.3d at 602. Plaintiffs contend that the Court has general jurisdiction (and, in the alternative, specific jurisdiction) over Shopify USA and specific jurisdiction over Shopify, Inc. and Ledger. As explained below, the Court lacks general jurisdiction (and specific jurisdiction) over Shopify USA, and lacks specific jurisdiction over Shopify, Inc. and Ledger. 1. The Court Lacks General Jurisdiction Over Shopify USA Where there is general jurisdiction over a defendant, the plaintiff can bring any claim against the defendant in the forum state. Thus, in order for general jurisdiction to obtain, the defendant's contacts with the forum state must be so continuous and systematic as to render the defendant essentially at home in the forum State. See Daimler AG v. Bauman, 571 U.S. 117, 122, 128 (2014); see also Schwarzenegger v. Fred Martin Motor Co., 374 F.3d 797, 807 (9th Cir. 2004) (asking whether the defendant has continuous and systematic contacts that approximate physical presence in the forum state). “With respect to a corporation, the place of incorporation and principal place of business are ‘paradig[m] ... bases for general jurisdiction.’” Daimler, 571 U.S. at 137. General jurisdiction outside of those forums is available “[o]nly in an exceptional case,” Martinez v. Aero Caribbean, 764 F.3d 1062, 1070 (9th Cir. 2014), where the defendant’s contacts are so “continuous and systematic” as to “‘approximate physical presence’ in the forum state,” Pestmaster Franchise Network, Inc. v. Mata, 2017 WL 1956927, at *2 (N.D. Cal. 2017) (quoting Mavrix, 647 F.3d at 1223-24). Here, Plaintiffs argue that the Court has general jurisdiction over Shopify USA, but concede that Shopify USA is neither incorporated in California (it is a Delaware corporation), nor is California Shopify USA’s principal place of business (Shopify USA’s principal place of business is Ottawa, Canada). FAC ¶ 24. Instead, to support their contention that the Court has general jurisdiction over Shopify USA, Plaintiffs observe that Shopify USA previously listed San Francisco, CA as its principal place of business since 2014, including, allegedly, during the time period that the data breach took place in 2019. Opposition at 11-13. Plaintiffs point to Shopify USA’s business registration filings in various states that continued to list San Francisco as its 6, and cites litigation from 2017 and 2018 in which Shopify USA represented to courts that its principal place of business was in San Francisco, Opposition at 11-12. However, Plaintiffs’ observation that Shopify USA’s place of business at the time of the data breach was in California does not establish the Court’s general jurisdiction over Shopify USA. Courts have uniformly held that general jurisdiction is to be determined no earlier than the time of filing of the complaint. Sabre Int’l Sec. v. Torres Advanced Enter. Sols., LLC, 60 F. Supp. 3d 21, 30 (D.D.C. 2014) (collecting cases); see also Young v. Daimler AG, 228 Cal. App. 4th 855, 864 (2014) (“Unlike specific jurisdiction, general jurisdiction is determined no earlier than at the time a suit is filed.”). Plaintiffs do not dispute that at the time this case was filed, in April 2021, Spotify USA’s principal place of business was in Ottawa, Canada—not San Francisco, California. FAC ¶ 24. Plaintiffs’ citation to Delphix Corp. v. Embarcadero Technologies, Inc., an unpublished, non-precedential Ninth Circuit memorandum disposition, for the proposition that “[c]ourts must examine the defendant’s contacts with the forum at the time of the events underlying the dispute,” 749 Fed. Appx. 502, 506 (9th Cir. 2018), is unavailing. First, the language Plaintiffs cite from Delphix quotes a precedential Ninth Circuit decision, Steel v. United States, which makes explicit that its holding is about specific jurisdiction. 813 F.2d 1545, 1549 (9th Cir. 1987) (“When a court is exercising specific jurisdiction over a defendant, arising out of or related to the defendant’s contacts with the forum, the fair warning that due process requires arises not at the time of the suit, but when the events that gave rise to the suit occurred.”) (Emphasis added). There is no precedential decision holding that the same logic applies to the analysis of general jurisdiction—a point that Judge Rawlinson emphasizes in her partial dissent in Delphix, 749 Fed. Appx. at 507- 08—which is consistent with the Ninth Circuit’s caution that “[b]ecause the assertion of judicial authority over a defendant is much broader in the case of general jurisdiction than specific jurisdiction, a plaintiff invoking general jurisdiction must meet an ‘exacting standard’ for the minimum contacts required.” Ranza v. Nike, Inc., 793 F.3d 1059, 1069 (9th Cir. 2015) (citation omitted). complaint for filed for purposes of general jurisdiction, Plaintiffs’ only remaining theory for the Court to assert general jurisdiction is that this is “an exceptional case” in which general jurisdiction is available in California even though it is not one of the paradigm fora. Id. Plaintiffs are unable to show that this is such an exceptional case where Shopify USA’s contacts are so “continuous and systematic” as to “‘approximate physical presence’ in [California],” Mata, 2017 WL 1956927 at *2. Shopify USA entered evidence that it permanently closed its San Francisco office in September 2020, that its corporate officers are located in Ontario, Canada and New York, approximately three-quarters of its employees are located outside of California, and a vast majority of its business activities are conducted outside of, and have no relationship to, California. Docket No. 55-1 (“Harris-John Decl.”) ¶¶ 3, 5, 7, 8. Plaintiffs do not dispute these representations and make no allegations sufficient to show that Shopify USA is “so heavily engaged in activity in [California] as to render it essentially at home.” BNSF Ry. Co. v. Tyrell, 137 S. Ct. 1549, 1559 (2017); see also King v. Bumble Trading, Inc., 2020 WL 663741, at *2 (N.D. Cal. 2020) (finding that defendant corporation’s principal place of business was in Texas, where its “CEO[] lives and works,” notwithstanding “documents filed with the California Secretary of State” stating that its “principal executive office is in San Francisco”). Thus, the Court finds that it lacks general jurisdiction over Shopify USA. B. Specific Jurisdiction Specific jurisdiction exists in tort type cases where: (1) the defendant “purposefully directed” its activities towards California; (2) the plaintiff’s claims “arise out of” those forum- related activities; and (3) the exercise of jurisdiction is “reasonable.” See Morrill v. Scott Fin. Corp., 873 F.3d 1136, 1142 (9th Cir. 2017). The purposeful direction test applies where, as here, Plaintiffs assert primarily tort or statutory claims. See e.g., id.; Caces-Tiamson v. Equifax, No. 20- CV-00387-EMC, 2020 WL 1322889, at *3 (N.D. Cal. Mar. 20, 2020) (courts should apply a purposeful direction analysis to tort claims arising from data breaches); Matus v. Premium Nutraceuticals, LLC, No. EDCV 15-01851 DDP (DTBx), 2016 WL 3078745, at *3 (C.D. Cal. 2016) (applying purposeful direction test where the plaintiff alleged violations of the UCL, FAL, satisfying the first two prongs of the test.” Schwarzenegger, 374 F.3d at 802. A defendant “purposefully direct[s]” [its] activities at the forum if [it]: (1) committed an intentional act, (2) expressly aimed at the forum state, (3) causing harm that the defendant knows is likely to be suffered in the forum state.” Picot v. Weston, 780 F.3d 1206, 1214 (9th Cir. 2015) (internal quotations and citation omitted). “Failing to sufficiently plead any one of these three elements … is fatal to Plaintiff[s’] attempt to show personal jurisdiction.” Alexandria Real Estate Equities, Inc. v. Runlabs Ltd., No. 18-CV-07517-LHK, 2019 WL 4221590, at *7 (N.D. Cal. 2019) (internal quotations omitted). 1. The Court Lacks Specific Jurisdiction Over Shopify, Inc. and Shopify USA Plaintiffs advance several theories in order to carry their burden to show (1) that the Shopify Defendants “purposefully directed” their activities towards California, and (2) that their claims “arise out of” Shopify’s forum-related activities.1 These arguments are addressed in turn. First, Plaintiffs allege the Court has “jurisdiction over Shopify [Inc.] … because [it] solicit[s] customers and transact[s] business in California.” FAC ¶ 31. In their Opposition brief, Plaintiffs further elaborate that “Shopify, Inc. undertook to power and administer the shopping website used by Ledger to engage in the advertisements and sales in California giving rise to 7% of Ledger’s worldwide business.” Opposition at 18. Plaintiffs argue these constitute “intentional acts” that were “expressly aimed at [California].” Picot, 780 F.3d at 1214. However, a finding purposeful direction cannot “be based on the mere fact that [a company] provides services to customers nationwide, including but not limited to California.” Caces-Tiamson, 2020 WL 1322889, at *3. “‘The placement of a product into the stream of commerce, without more, is not an act the defendant purposefully directed toward the forum state.’” Id. (quoting Asahi Metal Indus. Co., Ltd. v. Super. Ct. of Cal., 480 U.S. 102, 112 (1987)). 1 Plaintiffs argue that that “Shopify USA is subject to specific jurisdiction for the same reasons as Shopify Inc.” because “Shopify USA and Shopify Inc. make no distinction between themselves in the public eye, using the same logos, trademarks, and websites, making it impossible at this juncture to know the extent of involvement in this data breach by each entity.” Opposition at 14 n.8. The Court does not address whether Plaintiffs have adequately alleged that jurisdictional contacts may be imputed between these affiliated companies, see Ranza, 793 F.3d at 1073, Yet that is the essence of Plaintiffs’ allegations herein. See FAC ¶ 156 (Plaintiffs allege that Shopify, Inc. is a “global entit[y], that conduct[s] business nationwide and globally, servicing consumers in the United States and in many foreign counties. [It] also provide[s] services in virtually every state and … target[s] world-wide customers.”). Plaintiffs’ attempt to graft the alleged “purposeful direction” of Ledger’s activity to make 7% of its global sales in California on to Shopify, Inc. does not establish the Court’s specific jurisdiction over Shopify, Inc. However, “the Supreme Court has explained that the contacts supporting purposeful direction ‘must be the defendant’s own choice.’” Cisco Sys., Inc. v. Dexon Computer, Inc., 2021 WL 2207343, at *3 (N.D. Cal. 2021) (quoting Ford Motor Co. v. Mont. Eighth Jud. Dist. Ct., 141 S. Ct. 1017, 1025 (2021)); Helicopteros Nacionales de Colombia, S.A. v. Hall, 466 U.S. 408, 417 (1984) (“[The] unilateral activity of another party or a third person is not an appropriate consideration when determining whether a defendant has sufficient contacts with a forum State to justify an assertion of jurisdiction”). Plaintiffs make no allegations that the fact that Shopify, Inc. provided “a software product” to Ledger that “allow[ed] [Ledger] to easily operate [an] online store[],” FAC ¶ 75, to sell to “consumers worldwide,” FAC ¶ 155, shows that Shopify, Inc. made a choice to direct acts towards California. Similarly, Plaintiffs’ allegation that Shopify’s “terms of service obligate it to ‘take all reasonable steps’ to protect the disclosure of confidential information, including “names, addresses and other information regarding customers and prospective customers,” FAC ¶ 77, is based on Plaintiff’s concession that the only reason Shopify had any interaction with Plaintiffs is because “Ledger used Shopify’s services,” id. ¶ 76 (emphasis added). Cf. SKAPA Holdings LLC v. Seitz, 2021 WL 672091, at *5 (D. Ariz. 2021) (When assessing specific jurisdiction, “the analysis must be [restricted to] the defendant’s ‘own contacts’ with the forum.”) (quoting Walden v. Fiore, 571 U.S. 277, 289 (2014)). Ledger’s acts cannot be imported to Shopify for jurisdictional purposes. Second, Plaintiffs contend that personal jurisdiction lies over Shopify Inc. because “substantial events leading up to the breach at issue have occurred in California.” FAC ¶ 26. Plaintiffs refer to additional facts contained in declarations asserting jurisdictional facts to California, and that conduct led directly to the breaches harming Plaintiff Seirafi and other class members in California.” Opposition at 18 (citing Docket No. 56-1 (“McIntomny Decl.”) ¶ 11). Plaintiffs further contend that “Shopify, Inc. permitted the customer data—the disclosure/loss of which gives rise to the liability—to be accessible to and accessed by at least one culpable individual who was indicted in federal court in California. Id. (citing Docket No. 67-1 (“Economides Decl.”), Exh. 10); FAC ¶ 81. Plaintiffs, however, misrepresent the content of the declarations and complaint, and fail to support their assertion that Shopify, Inc. engaged in activity in California leading up to and during the breach. The McIntomny Declaration, prepared by a Senior Clerk at Shopify, Inc., explains that Shopify, Inc. did not contract with TaskUs to process user data, but rather, Shopify International Limited, a separate entity based in Dublin, Ireland, did so. McIntomny Decl. ¶ 11. Furthermore, there is no evidence in the declaration or elsewhere that Shopify Inc. (or any other entity) “reposited [Plaintiffs’] data in California,” Opposition at 19, or “provided access to” that data in California, id. at 18. Cf. McIntomny Decl. ¶ 11. Rather, Jennifer Routledge, Senior Lead for Vendor Partnerships for Shopify, Inc. declares, “TaskUs, Inc. contracted with Shopify International Limited to provide all of its services, including services involving any Shopify Inc. data, and to remotely access any data necessary for provision of those services, only from sites outside of the United States.” Docket No. 70-1 (“Routledge Decl.”) ¶ 2 (emphasis added). Shopify, Inc.’s supplemental declarations reject Plaintiffs’ assertion that it was “a California company that then implemented the breach,” Opposition 19, and state that the breach was accomplished by independent contractors of TaskUs located in the Philippines. See McIntomny Decl. ¶¶ 11-12. And although TaskUs has a California address, Shopify Inc. included a copy of the agreement through which Shopify International Limited (headquartered in Dublin, Ireland) contracted for services to be performed by TaskUs, which states that "The Services will be provided in the Territory of the Philippines and at the following Site: 17th Floor, 24-7 McKinley Building, 24th St. 7th Ave, BGC, Taguig City, Philippines." Docket No. 54-6 at 29. Properly characterized and contextualized by the undisputed facts contained in these declarations, none of “purposefully directed” any acts towards California. Moreover, Plaintiffs’ allegation at FAC ¶ 81 does not in fact allege that “Shopify Inc. permitted the customer data … to be accessible to and accessed” by anyone in California, but rather that a California man “paid an employee of a Shopify vendor to provide him with Shopify’s merchant data.” FAC ¶ 81; see also Economides Decl., Exh 10 (Indictment in United States v. Heinrich, 8:21-cr-22-JLS (C.D. Cal. 2021), Docket No. 16). Indeed, as Plaintiffs’ allegation concedes and the criminal indictment confirms (consistent with Shopify’s declaration), the California-based defendant was not an employee of Shopify’s or even TaskUs; his connection to the data breach is that he corresponded over the internet and solicited “a Philippines-based employee of a third-party contractor who provided customer support services for the Victim Company” to steal data. United States v. Heinrich, 8:21-cr-22-JLS (C.D. Cal. 2021), Docket No. 16 at 2; see also id. at 3-13. The fact that a resident of California was indicted on allegations that he paid other individuals to steal data from Shopify Inc. in the Philippines does not show that Shopify Inc. purposefully directed acts at California. Finally, Plaintiffs argue that Shopify, Inc. purposefully directed activity towards California by omission: “Shopify, Inc. failed to warn Plaintiff Seirafi and Class Members in California about the breach, and those acts of concealment caused additional harm as those individuals were left vulnerable to hackers who had obtained the data that Ledger was supposed to protect.” Opposition at 18. This theory, too, fails to provide a basis to conclude that Shopify, Inc. purposefully directed its activity towards California. Any alleged decision to communicate—or not to communicate— with individuals affected by the data breach would presumably have been made by Shopify, Inc. at its principal place of business in Ottawa, Canada. There are no facts alleged that Shopify, Inc. made its decision regarding notification in California or that it specifically targeted California in its decision not to provide communications about the breach, nor do any facts presented by Plaintiffs suggest that California-residents were uniquely harmed or entitled to a warning about the breach more than anyone else affected by the breach residing in any other jurisdiction. See Caces- Tiamson, 2020 WL 1322889, at *3 (“Ms. Caces-Tiamson cannot establish even a prima facie case allegedly did not take with respect to its data security systems’ would presumably have occurred in Georgia, where Equifax has its principal place of business. The fact that Ms. Caces-Tiamson suffered injury in California (i.e., where she resides) as a result of Equifax's actions or omissions is not enough to support specific jurisdiction.”) (internal citations omitted). Thus, because Plaintiffs fail to show (1) that the Shopify, Inc. “purposefully directed” their activities towards California, and (2) that their claims “arise out of” Shopify’s forum-related activities demonstrate, the Court concludes that it lacks specific jurisdiction over Shopify Inc (and, correspondingly, over Shopify USA, see supra n.2). Accordingly, the Shopify Defendants are dismissed from this action. 2. The Court Lacks Specific Jurisdiction Over Ledger a. Ledger Did Not Purposefully Direct Its Activities Towards California As noted above, a defendant “purposefully direct[s]” [its] activities at the forum if [it]: (1) committed an intentional act, (2) expressly aimed at the forum state, (3) causing harm that the defendant knows is likely to be suffered in the forum state.” Picot, 780 F.3d at 1214 (internal quotations and citation omitted). Ledger concedes it committed an “intentional act” by offering hardware wallets for sale on its internationally accessible website, including to customers in California. Docket No. 58 (“Ledger MTD”) at 8; see Loomis v. Slendertone Distribution, Inc., 420 F. Supp. 3d 1046, 1068 (S.D. Cal. 2019). However, Plaintiffs fail to demonstrate the second two prongs of the purposeful direction test: they neither show that Ledger “expressly aimed” it activities at California, nor that Ledger caused harm it knew was likely to be suffered in California. b. Ledger Did Not Expressly Aim Activity At California First, Plaintiffs do not adequately allege that Ledger “expressly aimed” any acts at California. Plaintiffs allege that “[t]his Court” has personal jurisdiction over Ledger “because it solicits customers, including Plaintiffs and Class members, in the United States and California.” FAC ¶ 32. This assertion is not enough to demonstrate Ledger’s express aiming. See Asahi Metal, 480 U.S. at 112 (“The placement of a product into the stream of commerce, without more, Hendricks, No. CV 09-1870 DSF AGRX, 2009 WL 10286181, at *4 (C.D. Cal. 2009) (“The Defendants' sales to California residents were not specifically directed contacts, but instead occurred only because the purchasers of Defendants' goods happened to reside in California. There was no ‘individual[ized] targeting’ of California.”). “Operating a universally accessible website alone is generally insufficient to satisfy the express aiming requirement.” Elliot v. Cessna Aircraft Co., No. 8:20-cv-00378-SBA, 2021 WL 2153820, at *3 (C.D. Cal. 2021) (“the fact that Defendant maintains an interactive website that reaches potential customers in California does not establish specific jurisdiction”); see also Adobe Sys. Inc. v. Cardinal Camera & Video Ctr., Inc., No. 15-cv-02991-JST, 2015 WL 5834135, at *5 (N.D. Cal. 2015) (“not all material placed on the Internet is, solely by virtue of its universal accessibility, expressly aimed at every state in which it is accessed”). “A defendant is required to do ‘something more’—namely, the defendant must engage in conduct directly targeting the forum, such as to display content or advertisements that appeal to, and profit from, an audience in a particular state.” Elliot, 2021 WL 2153820, at *3 (citing Mavrix, 647 F.3d at 1231). In Mavrix, the Ninth Circuit noted the difficult of determining “whether tortious conduct on a nationally accessible website is expressly aimed at any, or all, of the forums in which the website can be viewed,” 647 F.3d at 1229, but reasoned that specific jurisdiction obtained in California because defendant “operated a very popular website with a specific focus on the California-centered celebrity and entertainment industries” and concluded that defendant “anticipated, desired, and achieved a substantial California viewer base” and “continuously and deliberately exploited the California market for its website,” id. at 1230 (emphasis added). The Mavrix Court concluded that holding the defendant there “answerable in a California court for the contents of a website whose economic value turns, in significant measure, on its appeal to Californians” did not violate due process. Id. Applying Mavrix, the Ninth Circuit recently held in AMA Multimedia v. Wanat, that a foreign defendant who operated an adult-content website did not expressly aim intentional acts at the United States to satisfy the minimum contacts test for specific jurisdiction despite allegations 19% of the site’s total visitors were U.S.-based. 970 F.3d 1201, 1210-11 (9th Cir. 2020). The Wanat Court explained that the defendant’s website and products lacked “a forum-specific focus” because that the “market for adult content is global” and that 80% of the defendant’s viewers were outside the United States. Id. at 1210. The Wanat Court further explained that the defendants use of geotargeted advertisements cannot establish specific jurisdiction because such advertisements are always directed at a specific forum: “a viewer in the United will see advertisements tailored to the United States while a viewer in Germany will see advertisements tailored to Germany,” so “absent other indicia of [defendant’s] personal direction,” the use of geotargeted advertising does not establish express aiming. Id. The Ninth Circuit summarized that specific jurisdiction did not lie in the United States because it “was not ‘the focal point’ of the website ‘and of the harm suffered.’” Id. at 1212 (quoting Walden, 571 U.S. at 287) (emphasis added). Here, Plaintiffs have not alleged enough under the Ninth Circuit’s frameworks in Mavrix and Wanat to find that Ledger “expressly aimed” its conduct at California. Plaintiff’s bare allegation that Ledger “solicits customers in the United States and California,” FAC ¶ 32, and evidence (based on a declaration Ledger introduced as an exhibit to its motion to dismiss) that 7.03% of Ledger’s worldwide revenue comes from California, is not enough to establish Ledger “anticipated, desired, and achieved a substantial” customer-base in California like the defendant in Mavrix. 647 F.3d at 1230. Nor does it demonstrate Ledger’s forum-specific focus on California, given that the “market for [its hardware products] is global.” Wanat, 930 F.3d at 1210. Indeed, more than 60% of the company’s revenue comes from outside of the U.S. and 80% of its U.S. revenue from outside of California. Opposition at 17. See also Caces-Tiamson, 2020 WL 1322889, at *3 (“Nor can specific jurisdiction be based on the mere fact that [Defendant] provides services to customers nationwide, including but not limited to California.”). The complaint also includes an allegation that Plaintiff Seirafi, who resides in Los Angeles, California, “saw advertisements for Ledger’s services and hardware” around March 2019, FAC ¶ 16, but provides no further explanation of what those advertisements consisted of, where they were placed, where Seirafi was located when he saw them, nor any other information Seirafi’s declaration submitted as an exhibit to Plaintiff’s Opposition provides some additional context – that Seirafi viewed the advertisement on Instagram – but then explains that, “Based on review of Ledger’s online advertising account [a feature that may be viewed through Instagram] in August 2021, it appears that the advertisements that [Seirafi] was seeing prior to purchasing a Ledger wallet was specifically based on U.S. area codes.” Docket No. 67-3 (“Seirafi Decl.”) ¶¶ 13-14 (emphasis added). Nothing in Seirafi’s declaration demonstrates that Ledger aimed its advertising to California. Ledge submits evidence that “Ledger SAS does not specifically direct any of its business activities or advertising at California. Its business activities, including advertising, have no particular focus on any specific state in the United States.” Docket No. 59 (“Ricomard Decl.”) ¶ 11. Plaintiffs’ insinuation that Ledger’s advertising activity was targeted at California (the complaint does not even directly make this assertion) does not provide sufficient detail of the “something more” necessary to show Ledger’s operation of a globally accessible website was also “expressly aimed” at California. Cf. Mavrix, 647 F.3d at 1231; Wanat, 930 F.3d at 1210; Erickson v. Nebraska Mach. Co., No. 15-CV-01147-JD, 2015 WL 4089849, at *4 (N.D. Cal. 2015) (“[A]lthough the complaint alleges in conclusory fashion that NMC's website is ‘highly interactive and allows visitors to purchase or rent products directly through the website’ . . . there is no evidence that the website was in any way directed at California residents.”) (citation omitted). Plaintiffs rely principally on two cases to justify their argument that Ledger expressly aimed its activity to California. They point to Lack v. Mizuho Bank to demonstrate the additional factors that courts look to when a defendant operates and interactive website to determine whether that cite has been aimed at California: “[Plaintiff] and other California users opened accounts, communicated with the customer support desk, initiated bitcoin trades, made deposits, and processed withdrawals through the website.” 2019 WL 4239128, at *5 (C.D. Cal. June 24, 2019). But Plaintiffs do not allege that Ledger’s website has any of these features or that any Californians used any such features that made the website in Lack multi-faceted and “highly interactive”—only that Ledger’s site allows customers to browse and buy hardware wallets. FAC ¶ 32. TLN, 2017 WL 1153110 (E.D. Cal. March 28, 2017), where the Court found that two sales into California through an interactive website were enough for purposeful direction. The district court in iSmile, however, did not discuss nor apply the Ninth Circuit’s controlling analysis from Mavrix (even though Mavrix had been decided six years earlier). The iSmile Court relied on the Second Circuit’s view that “an interactive website plus a single sale is sufficient to constitute ‘something more’ and meet the purposeful direction standard.” Id. (quoting Chloe v. Queen Bee Beverly Hills, LLC, 616 F.3d 158, 171 (2d Cir. 2010)). It is hard to see how the Second Circuit’s bright-line articulation of an interactive site and a single sale in a forum can be reconciled with the Ninth Circuit’s searching inquiry into the nature, intent and scope of a defendant’s expressly aimed, forum-focused activity as required by Mavrix and Wanant. See also ThermoLife Int'l, LLC v. NetNutri.com LLC, 813 F. App'x 316, 318 (9th Cir. 2020) (“ThermoLife cannot establish specific personal jurisdiction through nonspecific, nationwide sales, as, in the context of this case, any contact with Arizona would be “‘random, fortuitous, or attenuated.’” (citation omitted)). Therefore, the cases on which Plaintiffs rely are either inapposite or unpersuasive. Finally, the Supreme Court’s recent holding in Ford Motor Co. does not alter the analysis here. There the Court found that Ford was subject to specific jurisdiction in Montana and Minnesota because it “conceded ‘purposeful availment’ of the two States’ markets.”2 141 S. Ct. at 1028. Ford did so through its extensive forum-related conduct. “By every means imaginable— among them, billboards, TV and radio spots, print ads and direct mail—Ford urges Montanans and Minnesotans to buy its vehicles” including the vehicles that experienced alleged malfunctions at issue in the cases. Id. Ford cars “are available, whether new or used, throughout the States,” and the company’s dealers in Montana and Minnesota “regularly maintain and repair Ford cars” while the company “distributes replacement parts both to its own dealers and to independent auto shops in the two states.” Id. Taken together, Ford’s activities in those states “encourage[d] Montanans
2 The Supreme Court in Ford analyzed specific jurisdiction under the “purposeful availment” test for contract claims, which differs from the “purposeful direction” test applicable to the tort claims here. But even if the Court were to consider the reasoning in Ford to guide its analysis here, there and Minnesotans to become lifelong Ford drivers.” Id. “In other words,” the Court reasoned, “Ford had systematically served a market in Montana and Minnesota for the very vehicles that the plaintiffs allege malfunctioned and injured them in those States. So there is a strong ‘relationship among the defendant, the forum, and the litigation’—the ‘essential foundation’ of specific jurisdiction.” Id. (citation omitted). The Supreme Court observed that the fact that “the company sold the specific cars involved in the[] crashes [at issue in the litigation] outside the forum States, with consumers later selling them to the States’ residents” did not change the conclusion that Ford was subject to specific jurisdiction in Minnesota and Montana. Id. at 1029. The Court concluded:
In conducting so much business in Montana and Minnesota, Ford ‘enjoys the benefits and protection of [their] laws’—the enforcement of contracts, the defense of property, the resulting formation of effective markets. All that assistance to Ford's in-state business creates reciprocal obligations—most relevant here, that the car models Ford so extensively markets in Montana and Minnesota be safe for their citizens to use there. Thus our repeated conclusion: A state court's enforcement of that commitment, enmeshed as it is with Ford's government-protected in-state business, can ‘hardly be said to be undue.’ Id. at 1029-30 (internal citations omitted). By contrast, as already discussed, Plaintiffs here fail to allege that Ledger purposefully availed itself to the California market through similar forum- specific advertising, sales or services. The scale and magnitude of Ledger’s alleged activities in the California pale in comparison with that undertaken by Ford. There was no enmeshment of Ledger’s obligations to consumers with government-protected in-state business comparable to that in Ford. There are no allegations that California law or institutions have provided Ledger any “assistance” to its “in-state business” to “create reciprocal obligations” that Ledger owes to California. Id. at 1029-30. Moreover, there was a direct relationship to the cars Ford extensively marketed in Montana and Minnesota and the resulting injury – it was cars themselves which caused the harm. Here, the relationship between Ledger’s California sales of its product and the hack of the database of its customers from the files of a third party is attenuated and indirect. Hence, the “strong ‘relationship among the defendant, the forum, and the litigation’—the c. Ledger Did Not Cause Harm In California That It Knew Was Likely To Be Suffered There Second, even if Plaintiffs had sufficiently alleged that Ledger expressly aimed its sales activity to California (which they do not), Plaintiffs fail to allege that Ledger’s intentional act of offering hardware wallets for sale on its website caused harm in California nor harm that Ledger knew was likely to be suffered there. See Picot, 780 F.3d at 1214 (third prong of purposeful direction test is that defendant’s alleged intentional act was responsible for “causing harm that the defendant knows is likely to be suffered in the forum state.”); Elofson v. Bivens, No. 15-cv-05761- BLF, 2017 WL 566323, at *5 (N.D. Cal. Feb. 13, 2017) (plaintiff failed to establish purposeful direction where he did not allege any of the defendant’s actions caused him harm). Plaintiffs do not connect Ledger’s alleged forum-specific intentional act of selling hardware wallets in California to their alleged harms stemming from a data breach. The injury was caused by the data breach, not the sales. To get around this deficiency in its pleadings, Plaintiffs’ opposition brief attempts to tether Shopify’s alleged California-specific activity that gave rise to the alleged data breach to Ledger, by contending that “Ledger permitted Plaintiffs’ data—and other California class members’ data—to be possessed by TaskUs, Inc. located [in] . . . South, Santa Monica, California and the data breach then arose with TaskUs, Inc.” Opposition at 17 (citing McIntomny Decl. ¶¶ 10-11). Not only does this allegation not appear in Plaintiffs’ complaint, see Tietsworth v. Sears, Roebuck and Co., 720 F. Supp. 2d 1123, 1145 (N.D. Cal. 2010), but Plaintiffs’ theory relies on the mistaken factual assertion discussed above – there is no evidence that any party took any actions related to any Plaintiff or any other customer data in California. The data was managed by TaskUs, Inc., in the Philippines. See supra Discussion § I(B)(1). Furthermore, as discussed below, the alleged wrongful act of Ledger permitting the data to be breached could not have occurred in California, where Leger had no office or employees. Thus, because Plaintiffs cannot satisfy the second and third prongs of the purposeful direction test—that Ledger expressly aimed an intentional act at California and that intentional act caused harm that Ledger knew was likely to be suffered in the forum state—Plaintiffs fail to specific jurisdiction over Ledger. i. Plaintiffs’ Claims Do Not “Arise Out Of” Ledger’s California- Related Activities Even if Plaintiffs had demonstrated that Ledger purposefully directed its sale activities to California, they fail to satisfy the second prong to the specific jurisdiction analysis: to show that their claims “arise out of” Ledger’s forum-related activities. See Morrill, 873 F.3d at 1142. “Or put just a bit differently, ‘there must be an affiliation between the forum and the underlying controversy, principally, [an] activity or an occurrence that takes place in the forum State and is therefore subject to the State's regulation.’” Ford Motor Co., 141 S. Ct. at 1025 (citation omitted). Plaintiffs’ complaint on this prong is deficient for the same reasons it was unable to adequately alleges that Ledger caused harm in California nor harm that Ledger knew was likely to be suffered there under the purposeful direction analysis. Plaintiffs allege no facts to connect Ledger’s activity with regards to the data breach to California. See Caces-Tiamson, 2020 WL 1322889, at *3 (“A plaintiff's residency in the forum state is not the sine qua non of specific jurisdiction. Neither is where the Plaintiff experienced her injury. Rather, the Supreme Court has instructed [in Walden] that [t]he proper question is not where the plaintiff experienced a particular injury or effect but whether the defendant's conduct connects him to the forum in a meaningful way.”) (quotation marks and citations omitted) (emphasis added). Plaintiffs further contend that after the breach occurred Ledger “failed to warn or adequately assist those individuals in California to protect against hacking attacks arising from the breach.” Opposition at 18; FAC ¶¶ 82-137. But, again, this theory fails to connect any of Ledger’s actions (or allegedly deliberate inaction) to California. Ledger submitted uncontroverted evidence that it is incorporated and has its principal place of business in Paris, France, that it does not have any offices in California or anywhere else in the United States, that it does not any employees or officers located in the United States, and that it is not registered to do business in California. Docket No. 59 (“Ricomard Decl.”) ¶¶ 6-9. In light of these facts, any decisions Ledger made regarding its actions or inaction with regard to the data breaches and how to proceed Or, at the very least, there is no basis for the Court to infer that any of those decision were made in California, where Ledger does not have a single employee. Cf. Caces-Tiamson, 2020 WL 1322889, at *3 (“[Plaintiff] cannot establish even a prima facie case of specific jurisdiction because, as Equifax argues, “any and all actions which Equifax did or allegedly did not take with respect to its data security systems” would presumably have occurred in Georgia, where Equifax has its principal place of business. The fact that Ms. Caces-Tiamson suffered injury in California (i.e., where she resides) as a result of Equifax's actions or omissions is not enough to support specific jurisdiction.”) (citations omitted). Thus, because Plaintiffs fail to satisfy their burden to demonstrate that Ledger “purposefully directed” its activity at California, and that Plaintiffs’ claims “arise out of” Ledger’s California-related activities, Picot, 780 F.3d at 1214, the Court concludes that it lacks specific jurisdiction over Ledger. Thus, Defendant Ledger is dismissed from this action. C. Jurisdictional Discovery Having concluded that the Court lacks personal jurisdiction over any of the three Defendants in this case, the Court turns to Plaintiffs’ request for leave to conduct jurisdictional discovery. Opposition at 24-25. The decision whether to grant jurisdictional discovery is typically within the discretion of the district court. Wells Fargo & Co. v. Wells Fargo Exp. Co., 556 F.2d 406, 430 n.24 (9th Cir. 1977). “[W]here pertinent facts bearing on the question of jurisdiction are in dispute, discovery should be allowed.” American West Airlines, Inc. v. GPA Group, Ltd., 877 F.2d 793, 801 (9th Cir. 1989). However, “where a plaintiff's claim of personal jurisdiction appears to be both attenuated and based on bare allegations in the face of specific denials made by the defendants, the Court need not permit even limited discovery.” Pebble Beach Co. v. Caddy, 453 F.3d 1151, 1160 (9th Cir. 2006) (quoting Terracom v. Valley Nat. Bank, 49 F.3d 555, 562 (9th Cir. 1995)). Plaintiffs’ request for jurisdictional discovery articulates six issues pertaining to the Shopify Defendants and three issues pertaining to Ledger that they would seek to investigate. Economides Decl. ¶¶ 6-7. The court need not grant jurisdictional discovery, however, where v. Boeing Co., 654 F.3d 852, 860 (9th Cir. 2011). Moreover, where a defendant has already provided evidence establishing that personal jurisdiction does not exist, jurisdictional discovery is unwarranted. Frank Valli & The Four Seasons v. EMI, Music Publ’g Ltd., No. CV 17-7831-MWF (JCx), 2018 WL 6136818, *8 (C.D. Cal. May 22, 2018) (denying jurisdictional discovery where the “evidence already before the court demonstrates” that the personal jurisdiction does not exist). Accordingly, the Court reviews each of Plaintiffs’ requests for jurisdictional discovery:
Information Plaintiffs Propose to Seek Analysis from Shopify Defendants “The role and responsibilities of Vivek This request is based on “purely speculative Narayandas, an attorney employed at Shopify allegations of attenuated jurisdictional (USA) who advises Shopify Inc. as its Data contacts.” Getz, 654 F.3d at 860. This Protection Officer.” (Economides Decl. ¶ request would only be meaningful to establish 6(a)) the Court’s specific jurisdiction over Shopify USA, however, Plaintiffs makes no allegations regarding any of Shopify USA’s forum-specific activities. Instead, their theory of specific jurisdiction over Shopify USA is derivative of their theory of specific jurisdiction over Shopify, Inc. Opposition at 14 n.8. There is no basis for the Court to allow Plaintiffs to explore a theory regarding Shopify USA’s forum-related conduct that it presents for the first time in its request for discovery. “What employees were involved in working This request is based on “purely speculative with or overseeing the work done by TaskUs allegations of attenuated jurisdictional (the Shopify vendor that Shopify states was contacts.” Getz, 654 F.3d at 860. In light of responsible for the breach), where do they evidence showing that the data breach by work, and which entity did they work for.” TaskUs did not occur in California, Plaintiffs (Economides Decl. ¶ 6(b)) advance, for the first time, an unsupported theory that Shopify may have had employees in California who supervised TaskUs. There is no basis for this speculative request because evidence already in the record shows that “TaskUs, Inc. contracted with Shopify International Limited to provide all of its services, including services involving any Shopify Inc. data, and to remotely access any data necessary for provision of those services, only from sites outside of the United States.” (Routledge Decl. ¶ 2). Moreover, Shopify International Limited, an Irish company, is Information Plaintiffs Propose to Seek Analysis from Shopify Defendants indication or any allegations they have any employees in California. (McIntomny Decl. ¶ 11). “Which employees reported to Roy Sunstrum, This request is based on “purely speculative the signatory to Shopify’s contract with allegations of attenuated jurisdictional TaskUs, where do they work, and which contacts.” Getz, 654 F.3d at 860. In light of entity did they work for.” (Economides Decl. evidence showing that the data breach by ¶ 6(c)) TaskUs did not occur in California, Plaintiffs seem to advance, for the first time, an unsupported theory that Shopify may have had employees in California who supervised TaskUs and that their supervisory misconduct caused Plaintiffs’ harm. There is no basis for this speculative request. “Which employees were involved in Dispositive evidence already provided: implementing and overseeing Shopify’s “Shopify, Inc. is not registered to do business specific data security practices alleged to be in California . . . and does not have an office insufficient in the First Amended Complaint, in California. . . Shopify, Inc. has no where do they work, and which entity did employees in California.” (McIntomny Decl. they work for.” (Economides Decl. ¶ 6(d)) ¶ 5). “Which employees were involved Dispositive evidence already provided: investigating the breach and determining its “Shopify, Inc. is not registered to do business impact, size, and scope, and where do they in California . . . and does not have an office work, and which entity did they work for.” in California. . . Shopify, Inc. has no (Economides Decl. ¶ 6(e)) employees in California.” (McIntomny Decl. ¶ 5). “Which employees were involved in Dispositive evidence already provided: Shopify’s response and notification process, “Shopify, Inc. is not registered to do business where do they work, and which entity did in California . . . and does not have an office they work for.” (Economides Decl. ¶ 6(f)) in California. . . Shopify, Inc. has no employees in California.” (McIntomny Decl. ¶ 5).
Information Plaintiffs Propose to Seek Analysis from Ledger “Advertisements, sales, and/or business Dispositive evidence already provided: strategies involving the California market “Ledger SAS does not specifically direct any and/or California consumers.” (Economides of its business or advertising at California. Its Decl. ¶ 7(a)) business activities, including advertising, have no particular focus on any specific state in the United States.” (Ricomard Decl. ¶ 11.) “Practices for obtaining, storing, transmitting, Dispositive evidence already provided: When and/or protecting the personal information of consumers make purchases through California consumers.” (Economides Decl. ¶ ledger.com, they provide certain contact 7(b)) information to Ledger SAS. Ledger SAS Information Plaintiffs Propose to Seek Analysis from Ledger and marketing database. Ledger does not have any unique practices for California consumers. (Ricomard Decl. ¶¶ 5, 11.) “California-based companies, employees, Dispositive evidence already provided: independent contractors, or other agents “Ledger SAS does not have any offices in relating to Ledger SAS’s data storage and California or anywhere else in the United protection.” (Economides Decl. ¶ 7(c)) States. It also does not have any employees or officers located in the United States. All of Ledger SAS’s employees and officers are located in France and Switzerland.” (Ricomard Decl. ¶ 7.) Plaintiffs’ requested discovery is not based on any prima facie evidence that the undisputed evidence presented by Defendants are false or inaccurate. Accordingly, the Court concludes jurisdictional discovery is based on speculation and is therefore unwarranted. The Court denies Plaintiffs’ request. In light of the Court’s finding that jurisdictional discovery is unwarranted, the Court concludes that it would be futile for Plaintiffs to attempt to amend their complaint to assert personal jurisdiction over any of the three Defendants. The Court lacks personal jurisdiction over Defendants Shopify USA, Shopify, Inc., and Ledger. Accordingly, the Court GRANTS each Defendant’s respective motion to dismiss. Docket Nos. 55, 56, and 58. The Court, further, concludes that jurisdictional discovery is unwarranted and thus DENIES Plaintiffs’ request for jurisdictional discovery. For the reasons explained above, the Court finds that it would be futile for Plaintiffs to amend their complaint to attempt to assert personal jurisdiction over Defendants. Thus, the case is dismissed with prejudice. This order disposes of Docket Nos. 55, 56, and 58. The Clerk of the Court is directed to enter judgment and close the case. Dated: November 9, 2021 ______________________________________