Briskin v. Shopify Inc.

Opinion

1 2 3

Case No. 21-cv-06269-PJH 8 Plaintiff,

9 v. ORDER OF DISMISSAL

10 SHOPIFY INC., et al., Re: Dkt. Nos. 51, 52, 53 11 Defendants. 12

13 14 The three motions of defendants Shopify Inc., Shopify (USA) Inc., and Shopify 15 Payments (USA) Inc. to dismiss plaintiff’s second amended complaint (“SAC”) all came 16 on for hearing before this court on April 28, 2022. Plaintiff appeared through his counsel, 17 Kali Backer. Defendants appeared through their counsel, Aravind Swaminathan and 18 Thomas Fu. Having read the papers filed by the parties and carefully considered their 19 arguments and the relevant legal authority, and good cause appearing, the court hereby 20 rules as follows. 22 This putative class action for invasion of privacy concerns the collection of 23 consumer data over an online shopping platform. Plaintiff Brandon Briskin is an Internet 24 shopper and resident of Madera, California. SAC ¶ 8. Defendant Shopify Inc. is a 25 Canadian company headquartered in Ottawa, Canada. SAC ¶ 9. Defendant Shopify 26 (USA) Inc. (“Shopify USA”) is a Delaware company with its principal place of business in 27 Ottawa, Canada. SAC ¶ 14. Defendant Shopify Payments (USA) Inc. (“Shopify 1 Delaware. SAC ¶ 15. Both Shopify USA and Shopify Payments are wholly owned 2 subsidiaries of Shopify Inc. Plaintiff refers to the three defendants repeatedly and 3 collectively throughout the SAC as “Shopify.” 4 A. Allegations of defendants’ conduct with consumer data 5 Defendants run an e-commerce platform that provides payment processing 6 services to millions of merchants across the Internet. SAC ¶ 24. Defendants host 7 merchants’ websites in addition to facilitating and verifying customers’ payment 8 information. SAC ¶ 24. Plaintiff alleges that when a consumer begins the checkout 9 process with one of Shopify’s merchant customers, the software makes it appear that the 10 consumer communicates directly with the merchant, but in reality, the consumer does not 11 send any information to the merchant. SAC ¶¶ 1-2, 4, 25-35, 82. Rather, Shopify’s 12 software generates the payment form and collects all information entered into it. Id. 13 Plaintiff complains that Shopify also installs cookies on users’ browsers to track 14 consumers’ transactions across the Shopify merchant network. SAC ¶¶ 5, 38-41. 15 In June 2019, plaintiff purchased fitness apparel from IABMFG, a Shopify Inc. 16 merchant, through IABMFG’s website. SAC ¶ 57. Plaintiff alleges that he, like other 17 consumers, was uninformed of defendants’ conduct, and without consent, defendants 18 collected sensitive private information, including consumers’ full names, addresses, email 19 addresses, credit card numbers, IP addresses, the items purchased, and geolocation. 20 SAC ¶¶ 2-3, 40, 81. In defendants’ course of collecting the data, they can decipher what 21 data emanates from California because they have consumers’ billing addresses and 22 geolocations. Id. Defendants take additional steps to use consumer data and make it 23 profitable for themselves and their merchants by compiling the data into individualized 24 profiles. SAC ¶¶ 6, 42-45. Defendants share information within the profiles of 25 consumers with their merchants. Id. The information is valuable to the merchants 26 because they provide insights into consumers’ creditworthiness before the transaction is 27 final. Id. 1 When a consumer makes a purchase, defendants use the consumer’s data to 2 provide their merchants with an “analysis” of the order that cross-references the details of 3 the new transaction with the consumer’s purchase history to identify potential areas of 4 fraud. SAC ¶ 43. In addition to building profiles and analyzing their data, defendants 5 share consumer data with other non-merchant third-parties, such as Stripe and MaxMind, 6 who, in turn, use the data to feed their own profiles on consumers. SAC ¶¶ 15-16, 46-47. 7 B. Shopify’s Contacts with California 8 Plaintiff alleges that Shopify’s efforts to drive Internet-based sales in California go 9 beyond simply making its software available for use by California companies—Shopify 10 actively courts California merchants who it knows are doing business with California 11 consumers. For instance, in 2017, Shopify built Kylie Cosmetics, one of its largest online 12 merchants, a pop-up store in Los Angeles with the goal of learning more about its base of 13 consumers. SAC ¶ 10. Shopify sent members of its own team as well as hired an 14 agency to secure workers to run the store. Id. In 2018, Shopify deepened its ties with 15 California when it opened a physical store in Los Angeles to serve as a hub where its 16 merchants can learn about its products and receive “business advice” and “learn about 17 the company’s online platform.” SAC ¶¶ 11-12. As of 2018, California was home to over 18 80,000 Shopify merchants with 10,000 in Los Angeles alone. SAC ¶ 11-12. 19 C. Plaintiff’s Claims 20 Plaintiff alleges that he never granted consent for defendants to collect and use his 21 data in the methods described above, and he seeks to represent a class of similarly 22 situated consumers. His proposed class definition is as follows: “All natural persons who, 23 between August 13, 2017 and the present, submitted payment information via Shopify’s 24 software while located in California.” SAC ¶ 68. The SAC brings the following claims on 25 behalf of plaintiff and the proposed class against all three defendants, all under California 26 law: 27 1. Violation of the California Invasion of Privacy Act, California Penal Code § 631; 1 3. Invasion of Privacy Under California’s Constitution; 2 4. Intrusion Upon Seclusion; 3 5. Violation of the California Computer Data Access and Fraud Act, Cal. Penal 4 Code § 502; and 5 6. Violation of the California Unfair Competition Law, Cal. Bus. & Prof. Code 6 § 17200, et seq. 7 D. Procedural History 8 The original complaint was filed on August 13, 2021, naming only Shopify Inc. and 9 Shopify USA. Dkt. 1. Before defendants responded, plaintiff filed a first amended 10 complaint on October 29, 2021. Dkt. 17. Defendants filed separate motions to dismiss in 11 response on December 8, 2021. Dkt. 29 and 30. Rather than opposing the motions, 12 plaintiff sought leave of court to file a second amended complaint, which defendants 13 opposed. Dkt. 36-40. The court granted plaintiff leave to file, and plaintiff filed, the now- 14 operative second amended complaint, which added Shopify Payments and added some 15 allegations intended to address defects highlighted by defendants’ prior motions. Dkt. 43 16 and 44. 17 In response to the second amended complaint, the three defendants filed the 18 instant motions to dismiss. Dkt. 51, 52, and 53. All three defendants ask the court to 19 dismiss the complaint pursuant to Federal Rule of Civil Procedure 8(a)(2) for failure to 20 provide adequate notice of the claims against them, or in the alternative, pursuant to 21 Federal Rule 12(b)(2) for lack of personal jurisdiction, or in the further alternative, 22 pursuant to Federal Rule of Civil Procedure 12(b)(6) for failure to state a claim upon 23 which relief can be granted. 25 From the several grounds for dismissal offered in defendants’ moving papers, the 26 court focuses on only two grounds for dismissal: (1) whether the SAC comports with the 27 pleading requirements of Rule 8 and (2) whether the court may exercise jurisdiction over 1 A. Sufficiency of Pleading 2 1. Legal Standard 3 A motion to dismiss under Federal Rule of Civil Procedure 12(b)(6) tests for the 4 legal sufficiency of the claims alleged in the complaint. Ileto v. Glock Inc., 349 F.3d 1191, 5 1199-1200 (9th Cir. 2003). Under Federal Rule of Civil Procedure 8, which requires that 6 a complaint include a “short and plain statement of the claim showing that the pleader is 7 entitled to relief,” Fed. R. Civ. P. 8(a)(2), a complaint may be dismissed under Rule 8 12(b)(6) if the plaintiff fails to state a cognizable legal theory, or has not alleged sufficient 9 facts to support a cognizable legal theory. Somers v. Apple, Inc., 729 F.3d 953, 959 (9th 10 Cir. 2013). “A complaint which lumps together multiple defendants in one broad 11 allegation fails to satisfy the notice requirement of Rule 8(a)(2).” Adobe Sys. Inc. v. Blue 12 Source Grp., Inc., 125 F. Supp. 3d 945, 964 (N.D. Cal. 2015) (cleaned up). 13 As a general rule, “Plaintiffs’ failure to allege what role each Defendant played in 14 the alleged harm makes it exceedingly difficult, if not impossible, for individual 15 Defendants to respond to Plaintiffs’ allegations.” In re iPhone Application Litig., No. 11- 16 MD-02250-LHK, 2011 WL 4403963, at *8 (N.D. Cal. Sept. 20, 2011) (Koh, J.). 17 Accordingly, a complaint that lumps multiple defendants together in broad allegations 18 falls short of providing the necessary notice under Rule 8(a)(2). Gen-Probe, Inc. v. 19 Amoco Corp., 926 F. Supp. 948, 961 (S.D. Cal.1996). Put another way, a plaintiff’s 20 allegations must “provide sufficient notice to all of the Defendants as to the nature of the 21 claims being asserted against them,” including “what conduct is at issue.” Villalpando v. 22 Exel Direct Inc., No. 12-CV-04137 JCS, 2014 WL 1338297, at *5 (N.D. Cal. Mar. 28, 23 2014). 24 2. Analysis 25 Here, plaintiff admittedly alleges all claims against all three defendants without 26 distinguishing the conduct of any single entity, referring collectively to “Shopify.” SAC 27 ¶ 18. Plaintiff contends that the three related entities are sufficiently put on notice of the 1 claims against any specific defendant, and rather generally alleges all claims against all 2 defendants without identifying which defendant is responsible for his alleged injuries. It 3 thus fails to put any of the three defendants fairly on notice of the claims against them, 4 and the SAC must be dismissed. 5 B. Personal Jurisdiction 6 1. Legal Standard 7 A federal court may dismiss an action under Federal Rule of Civil Procedure 8 12(b)(2) for lack of personal jurisdiction. When resolving a motion to dismiss under Rule 9 12(b)(2) on written materials, the court accepts uncontroverted facts in the complaint as 10 true and resolves conflicts in affidavits in the plaintiffs’ favor. Mavrix Photo, Inc. v. Brand 11 Techs., Inc., 647 F.3d 1218, 1223 (9th Cir. 2011). The party seeking to invoke a federal 12 court’s jurisdiction bears the burden of demonstrating jurisdiction. Picot v. Weston, 780 13 F.3d 1206, 1211 (9th Cir. 2015). “Federal courts ordinarily follow state law in determining 14 the bounds of their jurisdiction over persons.” Daimler AG v. Bauman, 571 U.S. 117, 125 15 (2014); see Fed. R. Civ. P. 4(k)(1)(a). California’s long arm statute permits exercise of 16 personal jurisdiction to the fullest extent permissible under the U.S. Constitution, and 17 therefore, the court’s inquiry “centers on whether exercising jurisdiction comports with 18 due process.” Picot, 780 F.3d at 1211; see Cal. Code Civ. Pro. § 410.10. 19 The Due Process Clause of the Fourteenth Amendment “limits the power of a 20 state’s courts to exercise jurisdiction over defendants who do not consent to jurisdiction.” 21 Martinez v. Aero Caribbean, 764 F.3d 1062, 1066 (9th Cir. 2014). Due process requires 22 that the defendant “have certain minimum contacts with it such that the maintenance of 23 the suit does not offend traditional notions of fair play and substantial justice.” Int’l Shoe 24 Co. v. Washington, 326 U.S. 310, 316 (1945) (internal quotation marks omitted). Under 25 the “minimum contacts” analysis, a court can exercise either “general or all-purpose 26 jurisdiction,” or “specific or conduct-linked jurisdiction.” Daimler, 571 U.S. at 121-22 27 (citing Goodyear Dunlop Tires Operations, S.A. v. Brown, 564 U.S. 915, 919 (2011)). 1 A court may exercise specific jurisdiction over a defendant if its less-substantial 2 contacts with the forum give rise to the claim or claims pending before the court—that is, 3 if the cause of action “arises out of” or has a substantial connection with that activity. 4 Hanson v. Denckla, 357 U.S. 235, 250-53 (1958); see also Goodyear, 564 U.S. at 924- 5 25. To determine whether a defendant’s contacts with the forum state are sufficient to 6 establish specific jurisdiction, the Ninth Circuit employs a three-part test:

7 (1) The non-resident defendant must purposefully direct his activities or consummate some transaction with the forum or 8 resident thereof; or perform some act by which he purposefully avails himself of the privilege of conducting activities in the 9 forum, thereby invoking the benefits and protections of its laws; (2) the claim must be one which arises out of or relates to the 10 defendant’s forum-related activities; and (3) the exercise of jurisdiction must comport with fair play and 11 substantial justice, i.e. it must be reasonable. 12 Morrill v. Scott Fin. Corp., 873 F.3d 1136, 1142 (9th Cir. 2017). With respect to the first 13 prong, courts apply a “purposeful availment” analysis in suits sounding in contract and a 14 “purposeful direction” analysis (also known as the effects test) in suits sounding in tort. 15 Schwarzenegger v. Fred Martin Motor Co., 374 F.3d 797, 802 (9th Cir. 2004). The 16 purposeful direction test applies here because plaintiff’s claims sound in tort. 17 Under the Calder effects test, purposeful direction exists when a defendant 18 commits an act outside the forum that was intended to and does in fact cause injury in 19 the forum, meaning, the defendant must (1) commit an intentional act (2) expressly aimed 20 at the forum (3) that causes harm that the defendant knows is likely to be suffered in the 21 forum. Calder v. Jones, 465 U.S. 783, 788-89 (1984); Washington Shoe Co. v. A-Z 22 Sporting Goods Inc., 704 F.3d 668, 673 (9th Cir. 2012). The effects test focuses on “the 23 forum in which the defendant’s acts were felt, whether or not the actions themselves 24 occurred within the forum.” Mavrix, 647 F.3d at 1228. “However, referring to the Calder 25 test as an effects test can be misleading. For this reason, we have warned courts not to 26 focus too narrowly on the test's third prong—the effects prong—holding that ‘something 27 more’ is needed in addition to a mere foreseeable effect.” Pebble Beach Co. v. Caddy, 1 2. Analysis 2 Here, plaintiff offers no argument that any of the three defendants, based in either 3 Canada or Delaware, are subject to general jurisdiction in this court. The assessment 4 thus focuses on whether defendants’ conduct gives rise to specific jurisdiction. 5 Plaintiff’s allegations establish only that Shopify is IABMFG’s vendor for an online 6 sales platform. A vendor’s sale of a product to IABMFG — even if IABMFG has 7 substantial business here and the vendor knew it — does not establish specific personal 8 jurisdiction over the vendor. Further, as plaintiff alleges, “Shopify is an e-commerce 9 platform that enables merchants to sell products online.” SAC ¶ 24. Such passive 10 conduct does not represent an intentional act directed at California residents. Shopify 11 serves as an agent of IABMGF, providing hosting services for the latter’s website, which 12 falls far short of invoking the benefits and protections of California’s laws. Though 13 plaintiff makes much of Shopify’s Los Angeles-based storefront (SAC ¶¶ 10-12), even if 14 the court considered that to be purposeful availment of the benefits of this forum (it does 15 not), plaintiff still flatly fails to clarify how his Internet-based claims arise from or even 16 relate to those activities. The court does not have specific jurisdiction over Shopify Inc. or 17 Shopify USA based on these allegations. 18 Plaintiff additionally makes specific jurisdictional claims about the conduct of 19 Shopify Payments in this forum, namely, the entity’s contract with Stripe. “[T]he mere 20 existence of a contract with a party in the forum state does not constitute sufficient 21 minimum contacts for jurisdiction.” Sher v. Johnson, 911 F.2d 1357, 1362 (9th Cir. 22 1990). So too here. Shopify Payments’ contract with a forum resident is not sufficient to 23 show that the defendant expressly aimed acts at the forum state, as is necessary to fulfill 24 the express aiming prong of the purposeful direction test. See Speidel v. Markota, 2021 25 WL 3463895, at *4 (C.D. Cal. 2021). Therefore, the court lacks both general and specific 26 personal jurisdiction over these three defendants. 27 // 2 For the reasons stated above, the court GRANTS defendants’ motions to dismiss. 3 Dismissal for failure to give defendants notice of the claims alleged against each of them 4 would be with leave to amend. However, the court DISMISSES the action without leave 5 to amend because it does not have personal jurisdiction over any of the defendants. 7 Dated: May 5, 2022 8 /s/ Phyllis J. Hamilton PHYLLIS J. HAMILTON 9 United States District Judge

11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27