Briskin v. Shopify Inc.

Opinion

Case No. 21-cv-06269-PJH Plaintiff,

v. ORDER OF DISMISSAL

SHOPIFY INC., et al., Re: Dkt. Nos. 51, 52, 53 Defendants.

The three motions of defendants Shopify Inc., Shopify (USA) Inc., and Shopify Payments (USA) Inc. to dismiss plaintiff’s second amended complaint (“SAC”) all came on for hearing before this court on April 28, 2022. Plaintiff appeared through his counsel, Kali Backer. Defendants appeared through their counsel, Aravind Swaminathan and Thomas Fu. Having read the papers filed by the parties and carefully considered their arguments and the relevant legal authority, and good cause appearing, the court hereby rules as follows. This putative class action for invasion of privacy concerns the collection of consumer data over an online shopping platform. Plaintiff Brandon Briskin is an Internet shopper and resident of Madera, California. SAC ¶ 8. Defendant Shopify Inc. is a Canadian company headquartered in Ottawa, Canada. SAC ¶ 9. Defendant Shopify (USA) Inc. (“Shopify USA”) is a Delaware company with its principal place of business in Ottawa, Canada. SAC ¶ 14. Defendant Shopify Payments (USA) Inc. (“Shopify Delaware. SAC ¶ 15. Both Shopify USA and Shopify Payments are wholly owned subsidiaries of Shopify Inc. Plaintiff refers to the three defendants repeatedly and collectively throughout the SAC as “Shopify.” A. Allegations of defendants’ conduct with consumer data Defendants run an e-commerce platform that provides payment processing services to millions of merchants across the Internet. SAC ¶ 24. Defendants host merchants’ websites in addition to facilitating and verifying customers’ payment information. SAC ¶ 24. Plaintiff alleges that when a consumer begins the checkout process with one of Shopify’s merchant customers, the software makes it appear that the consumer communicates directly with the merchant, but in reality, the consumer does not send any information to the merchant. SAC ¶¶ 1-2, 4, 25-35, 82. Rather, Shopify’s software generates the payment form and collects all information entered into it. Id. Plaintiff complains that Shopify also installs cookies on users’ browsers to track consumers’ transactions across the Shopify merchant network. SAC ¶¶ 5, 38-41. In June 2019, plaintiff purchased fitness apparel from IABMFG, a Shopify Inc. merchant, through IABMFG’s website. SAC ¶ 57. Plaintiff alleges that he, like other consumers, was uninformed of defendants’ conduct, and without consent, defendants collected sensitive private information, including consumers’ full names, addresses, email addresses, credit card numbers, IP addresses, the items purchased, and geolocation. SAC ¶¶ 2-3, 40, 81. In defendants’ course of collecting the data, they can decipher what data emanates from California because they have consumers’ billing addresses and geolocations. Id. Defendants take additional steps to use consumer data and make it profitable for themselves and their merchants by compiling the data into individualized profiles. SAC ¶¶ 6, 42-45. Defendants share information within the profiles of consumers with their merchants. Id. The information is valuable to the merchants because they provide insights into consumers’ creditworthiness before the transaction is final. Id. When a consumer makes a purchase, defendants use the consumer’s data to provide their merchants with an “analysis” of the order that cross-references the details of the new transaction with the consumer’s purchase history to identify potential areas of fraud. SAC ¶ 43. In addition to building profiles and analyzing their data, defendants share consumer data with other non-merchant third-parties, such as Stripe and MaxMind, who, in turn, use the data to feed their own profiles on consumers. SAC ¶¶ 15-16, 46-47. B. Shopify’s Contacts with California Plaintiff alleges that Shopify’s efforts to drive Internet-based sales in California go beyond simply making its software available for use by California companies—Shopify actively courts California merchants who it knows are doing business with California consumers. For instance, in 2017, Shopify built Kylie Cosmetics, one of its largest online merchants, a pop-up store in Los Angeles with the goal of learning more about its base of consumers. SAC ¶ 10. Shopify sent members of its own team as well as hired an agency to secure workers to run the store. Id. In 2018, Shopify deepened its ties with California when it opened a physical store in Los Angeles to serve as a hub where its merchants can learn about its products and receive “business advice” and “learn about the company’s online platform.” SAC ¶¶ 11-12. As of 2018, California was home to over 80,000 Shopify merchants with 10,000 in Los Angeles alone. SAC ¶ 11-12. C. Plaintiff’s Claims Plaintiff alleges that he never granted consent for defendants to collect and use his data in the methods described above, and he seeks to represent a class of similarly situated consumers. His proposed class definition is as follows: “All natural persons who, between August 13, 2017 and the present, submitted payment information via Shopify’s software while located in California.” SAC ¶ 68. The SAC brings the following claims on behalf of plaintiff and the proposed class against all three defendants, all under California law: 1. Violation of the California Invasion of Privacy Act, California Penal Code § 631; 3. Invasion of Privacy Under California’s Constitution; 4. Intrusion Upon Seclusion; 5. Violation of the California Computer Data Access and Fraud Act, Cal. Penal Code § 502; and 6. Violation of the California Unfair Competition Law, Cal. Bus. & Prof. Code § 17200, et seq. D. Procedural History The original complaint was filed on August 13, 2021, naming only Shopify Inc. and Shopify USA. Dkt. 1. Before defendants responded, plaintiff filed a first amended complaint on October 29, 2021. Dkt. 17. Defendants filed separate motions to dismiss in response on December 8, 2021. Dkt. 29 and 30. Rather than opposing the motions, plaintiff sought leave of court to file a second amended complaint, which defendants opposed. Dkt. 36-40. The court granted plaintiff leave to file, and plaintiff filed, the now- operative second amended complaint, which added Shopify Payments and added some allegations intended to address defects highlighted by defendants’ prior motions. Dkt. 43 and 44. In response to the second amended complaint, the three defendants filed the instant motions to dismiss. Dkt. 51, 52, and 53. All three defendants ask the court to dismiss the complaint pursuant to Federal Rule of Civil Procedure 8(a)(2) for failure to provide adequate notice of the claims against them, or in the alternative, pursuant to Federal Rule 12(b)(2) for lack of personal jurisdiction, or in the further alternative, pursuant to Federal Rule of Civil Procedure 12(b)(6) for failure to state a claim upon which relief can be granted. From the several grounds for dismissal offered in defendants’ moving papers, the court focuses on only two grounds for dismissal: (1) whether the SAC comports with the pleading requirements of Rule 8 and (2) whether the court may exercise jurisdiction over A. Sufficiency of Pleading 1. Legal Standard A motion to dismiss under Federal Rule of Civil Procedure 12(b)(6) tests for the legal sufficiency of the claims alleged in the complaint. Ileto v. Glock Inc., 349 F.3d 1191, 1199-1200 (9th Cir. 2003). Under Federal Rule of Civil Procedure 8, which requires that a complaint include a “short and plain statement of the claim showing that the pleader is entitled to relief,” Fed. R. Civ. P. 8(a)(2), a complaint may be dismissed under Rule 12(b)(6) if the plaintiff fails to state a cognizable legal theory, or has not alleged sufficient facts to support a cognizable legal theory. Somers v. Apple, Inc., 729 F.3d 953, 959 (9th Cir. 2013). “A complaint which lumps together multiple defendants in one broad allegation fails to satisfy the notice requirement of Rule 8(a)(2).” Adobe Sys. Inc. v. Blue Source Grp., Inc., 125 F. Supp. 3d 945, 964 (N.D. Cal. 2015) (cleaned up). As a general rule, “Plaintiffs’ failure to allege what role each Defendant played in the alleged harm makes it exceedingly difficult, if not impossible, for individual Defendants to respond to Plaintiffs’ allegations.” In re iPhone Application Litig., No. 11- MD-02250-LHK, 2011 WL 4403963, at *8 (N.D. Cal. Sept. 20, 2011) (Koh, J.). Accordingly, a complaint that lumps multiple defendants together in broad allegations falls short of providing the necessary notice under Rule 8(a)(2). Gen-Probe, Inc. v. Amoco Corp., 926 F. Supp. 948, 961 (S.D. Cal.1996). Put another way, a plaintiff’s allegations must “provide sufficient notice to all of the Defendants as to the nature of the claims being asserted against them,” including “what conduct is at issue.” Villalpando v. Exel Direct Inc., No. 12-CV-04137 JCS, 2014 WL 1338297, at *5 (N.D. Cal. Mar. 28, 2014). 2. Analysis Here, plaintiff admittedly alleges all claims against all three defendants without distinguishing the conduct of any single entity, referring collectively to “Shopify.” SAC ¶ 18. Plaintiff contends that the three related entities are sufficiently put on notice of the claims against any specific defendant, and rather generally alleges all claims against all defendants without identifying which defendant is responsible for his alleged injuries. It thus fails to put any of the three defendants fairly on notice of the claims against them, and the SAC must be dismissed. B. Personal Jurisdiction 1. Legal Standard A federal court may dismiss an action under Federal Rule of Civil Procedure 12(b)(2) for lack of personal jurisdiction. When resolving a motion to dismiss under Rule 12(b)(2) on written materials, the court accepts uncontroverted facts in the complaint as true and resolves conflicts in affidavits in the plaintiffs’ favor. Mavrix Photo, Inc. v. Brand Techs., Inc., 647 F.3d 1218, 1223 (9th Cir. 2011). The party seeking to invoke a federal court’s jurisdiction bears the burden of demonstrating jurisdiction. Picot v. Weston, 780 F.3d 1206, 1211 (9th Cir. 2015). “Federal courts ordinarily follow state law in determining the bounds of their jurisdiction over persons.” Daimler AG v. Bauman, 571 U.S. 117, 125 (2014); see Fed. R. Civ. P. 4(k)(1)(a). California’s long arm statute permits exercise of personal jurisdiction to the fullest extent permissible under the U.S. Constitution, and therefore, the court’s inquiry “centers on whether exercising jurisdiction comports with due process.” Picot, 780 F.3d at 1211; see Cal. Code Civ. Pro. § 410.10. The Due Process Clause of the Fourteenth Amendment “limits the power of a state’s courts to exercise jurisdiction over defendants who do not consent to jurisdiction.” Martinez v. Aero Caribbean, 764 F.3d 1062, 1066 (9th Cir. 2014). Due process requires that the defendant “have certain minimum contacts with it such that the maintenance of the suit does not offend traditional notions of fair play and substantial justice.” Int’l Shoe Co. v. Washington, 326 U.S. 310, 316 (1945) (internal quotation marks omitted). Under the “minimum contacts” analysis, a court can exercise either “general or all-purpose jurisdiction,” or “specific or conduct-linked jurisdiction.” Daimler, 571 U.S. at 121-22 (citing Goodyear Dunlop Tires Operations, S.A. v. Brown, 564 U.S. 915, 919 (2011)). A court may exercise specific jurisdiction over a defendant if its less-substantial contacts with the forum give rise to the claim or claims pending before the court—that is, if the cause of action “arises out of” or has a substantial connection with that activity. Hanson v. Denckla, 357 U.S. 235, 250-53 (1958); see also Goodyear, 564 U.S. at 924- 25. To determine whether a defendant’s contacts with the forum state are sufficient to establish specific jurisdiction, the Ninth Circuit employs a three-part test:

(1) The non-resident defendant must purposefully direct his activities or consummate some transaction with the forum or resident thereof; or perform some act by which he purposefully avails himself of the privilege of conducting activities in the forum, thereby invoking the benefits and protections of its laws; (2) the claim must be one which arises out of or relates to the defendant’s forum-related activities; and (3) the exercise of jurisdiction must comport with fair play and substantial justice, i.e. it must be reasonable. Morrill v. Scott Fin. Corp., 873 F.3d 1136, 1142 (9th Cir. 2017). With respect to the first prong, courts apply a “purposeful availment” analysis in suits sounding in contract and a “purposeful direction” analysis (also known as the effects test) in suits sounding in tort. Schwarzenegger v. Fred Martin Motor Co., 374 F.3d 797, 802 (9th Cir. 2004). The purposeful direction test applies here because plaintiff’s claims sound in tort. Under the Calder effects test, purposeful direction exists when a defendant commits an act outside the forum that was intended to and does in fact cause injury in the forum, meaning, the defendant must (1) commit an intentional act (2) expressly aimed at the forum (3) that causes harm that the defendant knows is likely to be suffered in the forum. Calder v. Jones, 465 U.S. 783, 788-89 (1984); Washington Shoe Co. v. A-Z Sporting Goods Inc., 704 F.3d 668, 673 (9th Cir. 2012). The effects test focuses on “the forum in which the defendant’s acts were felt, whether or not the actions themselves occurred within the forum.” Mavrix, 647 F.3d at 1228. “However, referring to the Calder test as an effects test can be misleading. For this reason, we have warned courts not to focus too narrowly on the test's third prong—the effects prong—holding that ‘something more’ is needed in addition to a mere foreseeable effect.” Pebble Beach Co. v. Caddy, 2. Analysis Here, plaintiff offers no argument that any of the three defendants, based in either Canada or Delaware, are subject to general jurisdiction in this court. The assessment thus focuses on whether defendants’ conduct gives rise to specific jurisdiction. Plaintiff’s allegations establish only that Shopify is IABMFG’s vendor for an online sales platform. A vendor’s sale of a product to IABMFG — even if IABMFG has substantial business here and the vendor knew it — does not establish specific personal jurisdiction over the vendor. Further, as plaintiff alleges, “Shopify is an e-commerce platform that enables merchants to sell products online.” SAC ¶ 24. Such passive conduct does not represent an intentional act directed at California residents. Shopify serves as an agent of IABMGF, providing hosting services for the latter’s website, which falls far short of invoking the benefits and protections of California’s laws. Though plaintiff makes much of Shopify’s Los Angeles-based storefront (SAC ¶¶ 10-12), even if the court considered that to be purposeful availment of the benefits of this forum (it does not), plaintiff still flatly fails to clarify how his Internet-based claims arise from or even relate to those activities. The court does not have specific jurisdiction over Shopify Inc. or Shopify USA based on these allegations. Plaintiff additionally makes specific jurisdictional claims about the conduct of Shopify Payments in this forum, namely, the entity’s contract with Stripe. “[T]he mere existence of a contract with a party in the forum state does not constitute sufficient minimum contacts for jurisdiction.” Sher v. Johnson, 911 F.2d 1357, 1362 (9th Cir. 1990). So too here. Shopify Payments’ contract with a forum resident is not sufficient to show that the defendant expressly aimed acts at the forum state, as is necessary to fulfill the express aiming prong of the purposeful direction test. See Speidel v. Markota, 2021 WL 3463895, at *4 (C.D. Cal. 2021). Therefore, the court lacks both general and specific personal jurisdiction over these three defendants. // For the reasons stated above, the court GRANTS defendants’ motions to dismiss. Dismissal for failure to give defendants notice of the claims alleged against each of them would be with leave to amend. However, the court DISMISSES the action without leave to amend because it does not have personal jurisdiction over any of the defendants. Dated: May 5, 2022 /s/ Phyllis J. Hamilton PHYLLIS J. HAMILTON United States District Judge