David KAUFFMAN, individually and on Case No.: 23-cv-0259-AGS-AHG behalf of all others similarly situated, ORDER GRANTING IN PART AND DENYING IN PART MOTION TO Plaintiff, DISMISS (ECF 16) AND CLOSING v. CASE Defendant. Plaintiff sued Home Depot, claiming it surreptitiously recorded his actions while on its website. But because this Court lacks personal jurisdiction over Home Depot, which is headquartered and incorporated outside California, the case must be dismissed. According to plaintiff David Kauffman, while he was “in California,” he used his cell phone to visit Home Depot’s “website . . . to shop for products” and ultimately made some purchases. (ECF 13, at 9.) Unbeknownst to him, Home Depot had partnered with Quantum Metric to maintain software on its website that it calls “session replay”—and that Kauffman calls “spyware.” (Id. at 2.) Kauffman claims that as soon as Home Depot’s “site loaded on Plaintiff’s cell phone,” this software intercepted and recorded all the “words and text [that] were typed,” including personal information like his name and “credit card number.” (ECF 13, at 10.) This data was then allegedly forwarded “to Quantum’s servers,” permitting Quantum “to view in real-time the users’ entire visits to [Home Depot]’s website.” (Id. at 4, 11.) Kauffman sued Home Depot for violating California’s wiretapping laws, and he seeks to represent himself and any other Californian who used the website. (See generally ECF 13.) For its part, Home Depot characterizes session-replay monitoring as “benign conduct” that “allow[s] a website operator to diagnose and correct errors the user encounters on its website,” and it moves to dismiss on several grounds. (See ECF 16, at 7.) Because the personal-jurisdiction analysis resolves this case, the Court need not reach the other aspects of Home Depot’s motion.1 “Personal jurisdiction comes in two varieties: general and specific.”2 Briskin v. Shopify, Inc., 87 F.4th 404, 411 (9th Cir. 2023). “General jurisdiction extends to any and all claims brought against a defendant,” but typically only applies to a corporate defendant “in its state of incorporation and the state where it maintains its principal place of business.” Id. Because Home Depot “is a Delaware entity with its principal place of business located in Georgia” (ECF 13, at 7), Kauffman does not claim general jurisdiction applies. (See ECF 13, at 8 (discussing jurisdictional allegations); ECF 17, at 13–16 (same).) Instead, Kauffman relies on specific personal jurisdiction. (See ECF 17, at 13.) “Specific jurisdiction covers defendants less intimately connected with a State, but only as to a narrower class of claims.” Briskin, 87 F.4th at 411 (cleaned up). “For specific jurisdiction to exist over a non-resident defendant,” plaintiff must show that defendant (1) “purposefully direct[ed] his activities toward the forum” and (2) “the claim must be one which arises out of or relates to the defendant’s forum-related activities.” Id. (cleaned up).
1 Among other things, Home Depot asserts that Kauffman sued the wrong entity, naming the parent company Home Depot, Inc., rather than retailer Home Depot U.S.A, Inc. (See ECF 16-1, at 8 n.2.) But Home Depot does not move to dismiss on this ground. Nevertheless, this distinction makes no difference to the Court’s analysis. The Court will presume Kauffman sued the retailer, even if he has listed its name inaccurately. If he meant to sue the parent company, there is even less basis for personal jurisdiction. 2 Technically, “[t]wo authorities govern a federal court’s exercise of personal jurisdiction over a defendant: the Fourteenth Amendment’s Due Process Clause”—which is where the specific and general jurisdictional issues arise—“and the long arm statute of the state in which the district court sits.” Briskin v. Shopify, Inc., 87 F.4th 404, 411 (9th Cir. 2023). But in this case, those “requirements are coterminous . . . because California’s long arm statute allows courts to exercise jurisdiction on any ground not inconsistent with due process.” See id. Even if those requirements are met, defendant may still defeat personal jurisdiction by establishing that the “exercise of jurisdiction” does not “comport with fair play and substantial justice.” Id. A. Purposeful Direction To make out purposeful direction, “the defendant allegedly must have (1) committed an intentional act, (2) expressly aimed at the forum state, (3) causing harm that the defendant knows is likely to be suffered in the forum state.” Briskin, 87 F.4th at 412. The primary question here is whether plaintiff has sufficiently alleged Home Depot “expressly aimed” its website at California. Unlike passive websites, an “interactive website”—that is, a website where “users can exchange information with the host computer”—can satisfy the “express aiming” requirement, “but not always.” Id. Conduct showing a defendant is “operating a website in conjunction with something more—conduct directly targeting the forum—is sufficient to satisfy” the requirement. Id. (cleaned up). That “something more” is where Kauffman comes up short. At bottom, Kauffman argues that Home Depot maintained a website that Kauffman “placed an order” from, starting a chain of events that ended with a product being “shipped to California.” (See ECF 17, at 15.) Kauffman’s reliance on this point is understandable, as the Ninth Circuit has held that “if a defendant, in its regular course of business, sells a physical product via an interactive website and causes that product to be delivered to the forum, the defendant ‘expressly aimed’ its conduct at that forum.” Herbal Brands, Inc. v. Photoplaza, Inc., 72 F.4th 1085, 1093 (9th Cir. 2023); (see also ECF 17, at 15). But, after the briefing in this case was complete, the Ninth Circuit expressly limited Herbal Brands to claims arising from “defendant’s sale of a physical product to a consumer in the forum state via an interactive website.” Briskin, 87 F.4th at 422. It “does not extend to the extraction of consumer data” that forms the basis of privacy-related claims. Id. After all, Kauffman doesn’t object to the product he received or its shipment; he complains that his actions on the website were captured. By his own admission, that claim accrued “the moment Plaintiff and Class Members visited Defendant’s website,” even before he made any purchases. (See ECF 13, at 4.) So, Kauffman’s primary attempt to show “something more” fails. His other arguments fare no better. First, he contends that the “expressly aimed” prong “is easily satisfied,” as Home Depot “operates numerous retail stores in California and integrates the website with those stores.” (ECF 17, at 15.) Yet the Ninth Circuit has refused to credit this very argument in data-extraction cases. Briskin, 87 F.4th at 413 (rejecting plaintiff’s reliance on Shopify’s “Los Angeles ‘store’” or “its California fulfillment center” to satisfy the “expressly aimed” prong in a privacy case based on “data extraction, retention, and processing”). Next, Kauffman argues that Home Depot knew he was in California at the time of the data recording, and he points out that the privacy violation occurred in California. But these also do not move the needle in the “expressly aimed” analysis. See id. at 416–17 (holding that “Shopify did not expressly aim its conduct towards California” simply because it knew “the whereabouts” of “customers through the data it collects from them and the tracking tools it deploys” nor because “Briskin resided there, made his online purchase while located in California, and sustained his privacy- based injuries in that state” (cleaned up)). Although not mentioned in his briefing, Kauffman’s complaint alleges one more
Free access — add to your briefcase to read the full text and ask questions with AI
David KAUFFMAN, individually and on Case No.: 23-cv-0259-AGS-AHG behalf of all others similarly situated, ORDER GRANTING IN PART AND DENYING IN PART MOTION TO Plaintiff, DISMISS (ECF 16) AND CLOSING v. CASE Defendant. Plaintiff sued Home Depot, claiming it surreptitiously recorded his actions while on its website. But because this Court lacks personal jurisdiction over Home Depot, which is headquartered and incorporated outside California, the case must be dismissed. According to plaintiff David Kauffman, while he was “in California,” he used his cell phone to visit Home Depot’s “website . . . to shop for products” and ultimately made some purchases. (ECF 13, at 9.) Unbeknownst to him, Home Depot had partnered with Quantum Metric to maintain software on its website that it calls “session replay”—and that Kauffman calls “spyware.” (Id. at 2.) Kauffman claims that as soon as Home Depot’s “site loaded on Plaintiff’s cell phone,” this software intercepted and recorded all the “words and text [that] were typed,” including personal information like his name and “credit card number.” (ECF 13, at 10.) This data was then allegedly forwarded “to Quantum’s servers,” permitting Quantum “to view in real-time the users’ entire visits to [Home Depot]’s website.” (Id. at 4, 11.) Kauffman sued Home Depot for violating California’s wiretapping laws, and he seeks to represent himself and any other Californian who used the website. (See generally ECF 13.) For its part, Home Depot characterizes session-replay monitoring as “benign conduct” that “allow[s] a website operator to diagnose and correct errors the user encounters on its website,” and it moves to dismiss on several grounds. (See ECF 16, at 7.) Because the personal-jurisdiction analysis resolves this case, the Court need not reach the other aspects of Home Depot’s motion.1 “Personal jurisdiction comes in two varieties: general and specific.”2 Briskin v. Shopify, Inc., 87 F.4th 404, 411 (9th Cir. 2023). “General jurisdiction extends to any and all claims brought against a defendant,” but typically only applies to a corporate defendant “in its state of incorporation and the state where it maintains its principal place of business.” Id. Because Home Depot “is a Delaware entity with its principal place of business located in Georgia” (ECF 13, at 7), Kauffman does not claim general jurisdiction applies. (See ECF 13, at 8 (discussing jurisdictional allegations); ECF 17, at 13–16 (same).) Instead, Kauffman relies on specific personal jurisdiction. (See ECF 17, at 13.) “Specific jurisdiction covers defendants less intimately connected with a State, but only as to a narrower class of claims.” Briskin, 87 F.4th at 411 (cleaned up). “For specific jurisdiction to exist over a non-resident defendant,” plaintiff must show that defendant (1) “purposefully direct[ed] his activities toward the forum” and (2) “the claim must be one which arises out of or relates to the defendant’s forum-related activities.” Id. (cleaned up).
1 Among other things, Home Depot asserts that Kauffman sued the wrong entity, naming the parent company Home Depot, Inc., rather than retailer Home Depot U.S.A, Inc. (See ECF 16-1, at 8 n.2.) But Home Depot does not move to dismiss on this ground. Nevertheless, this distinction makes no difference to the Court’s analysis. The Court will presume Kauffman sued the retailer, even if he has listed its name inaccurately. If he meant to sue the parent company, there is even less basis for personal jurisdiction. 2 Technically, “[t]wo authorities govern a federal court’s exercise of personal jurisdiction over a defendant: the Fourteenth Amendment’s Due Process Clause”—which is where the specific and general jurisdictional issues arise—“and the long arm statute of the state in which the district court sits.” Briskin v. Shopify, Inc., 87 F.4th 404, 411 (9th Cir. 2023). But in this case, those “requirements are coterminous . . . because California’s long arm statute allows courts to exercise jurisdiction on any ground not inconsistent with due process.” See id. Even if those requirements are met, defendant may still defeat personal jurisdiction by establishing that the “exercise of jurisdiction” does not “comport with fair play and substantial justice.” Id. A. Purposeful Direction To make out purposeful direction, “the defendant allegedly must have (1) committed an intentional act, (2) expressly aimed at the forum state, (3) causing harm that the defendant knows is likely to be suffered in the forum state.” Briskin, 87 F.4th at 412. The primary question here is whether plaintiff has sufficiently alleged Home Depot “expressly aimed” its website at California. Unlike passive websites, an “interactive website”—that is, a website where “users can exchange information with the host computer”—can satisfy the “express aiming” requirement, “but not always.” Id. Conduct showing a defendant is “operating a website in conjunction with something more—conduct directly targeting the forum—is sufficient to satisfy” the requirement. Id. (cleaned up). That “something more” is where Kauffman comes up short. At bottom, Kauffman argues that Home Depot maintained a website that Kauffman “placed an order” from, starting a chain of events that ended with a product being “shipped to California.” (See ECF 17, at 15.) Kauffman’s reliance on this point is understandable, as the Ninth Circuit has held that “if a defendant, in its regular course of business, sells a physical product via an interactive website and causes that product to be delivered to the forum, the defendant ‘expressly aimed’ its conduct at that forum.” Herbal Brands, Inc. v. Photoplaza, Inc., 72 F.4th 1085, 1093 (9th Cir. 2023); (see also ECF 17, at 15). But, after the briefing in this case was complete, the Ninth Circuit expressly limited Herbal Brands to claims arising from “defendant’s sale of a physical product to a consumer in the forum state via an interactive website.” Briskin, 87 F.4th at 422. It “does not extend to the extraction of consumer data” that forms the basis of privacy-related claims. Id. After all, Kauffman doesn’t object to the product he received or its shipment; he complains that his actions on the website were captured. By his own admission, that claim accrued “the moment Plaintiff and Class Members visited Defendant’s website,” even before he made any purchases. (See ECF 13, at 4.) So, Kauffman’s primary attempt to show “something more” fails. His other arguments fare no better. First, he contends that the “expressly aimed” prong “is easily satisfied,” as Home Depot “operates numerous retail stores in California and integrates the website with those stores.” (ECF 17, at 15.) Yet the Ninth Circuit has refused to credit this very argument in data-extraction cases. Briskin, 87 F.4th at 413 (rejecting plaintiff’s reliance on Shopify’s “Los Angeles ‘store’” or “its California fulfillment center” to satisfy the “expressly aimed” prong in a privacy case based on “data extraction, retention, and processing”). Next, Kauffman argues that Home Depot knew he was in California at the time of the data recording, and he points out that the privacy violation occurred in California. But these also do not move the needle in the “expressly aimed” analysis. See id. at 416–17 (holding that “Shopify did not expressly aim its conduct towards California” simply because it knew “the whereabouts” of “customers through the data it collects from them and the tracking tools it deploys” nor because “Briskin resided there, made his online purchase while located in California, and sustained his privacy- based injuries in that state” (cleaned up)). Although not mentioned in his briefing, Kauffman’s complaint alleges one more fact that could potentially provide the necessary “something more.” Specifically, he claims that Home Depot “included California-specific provisions in its privacy policy in recognition that California citizens would be using Defendant’s website while in California and that such use, as well as Defendant’s own conduct, was subject to California law.” (ECF 13, at 9.) But references to state law in website policies do not establish express aiming. See AMA Multimedia, LLC v. Wanat, 970 F.3d 1201, 1212 (9th Cir. 2020) (“The TOS [Terms of Service] therefore does not establish any targeting of the U.S. market; it at most suggests Wanat knew [the] ePorner [website] might have U.S. traffic.”); see also L-Nutra, Inc. v. Prevail Sols., LLC, No. 2:21-CV-04564-SB-KK, 2021 WL 6103084, at *3 (C.D. Cal. Oct. 12, 2021) (collecting cases and rejecting the argument “that Defendant’s website explicitly targets California consumers because its Terms of Use” mention and contain waivers of California law). In short, Kauffman failed to carry his burden to show that Home Depot “expressly aimed” its website at California, so he cannot prove purposeful direction. B. “Relates To” or “Arises Out Of” Even if Kauffman could show purposeful direction, he would still need to establish that his claim “arises out of or relates to” Home Depot’s forum-related activities. See Briskin, 87 F.4th at 411. Kauffman relies mostly on a “relates to” theory. He urges this Court to consider the interplay between Home Depot’s stores and its website, as well as the “critical part” that data capture plays in Home Depot’s “coordinated efforts to maximize sales revenue in California.” (ECF 17, at 16.) For the “relates to” test, plaintiff must show “a strong, direct connection between the defendant’s forum-related activities and the plaintiff’s claims.” Briskin, 87 F.4th at 414. Unfortunately for Kauffman, the Ninth Circuit ruled that almost identical forum-related activities did not “relate to” data-capture privacy claims. The Briskin court held that a plaintiff’s privacy-related causes of action based on Shopify’s “extraction and processing” of personal data had “nothing to do with Shopify’s brick-and-mortar operations in the state.” Id. And Briskin also dispenses with Kauffman’s broader “coordinated efforts” argument. It rejected a similar suggestion that “Shopify’s broader business actions in California set the wheels in motion for Shopify to eventually inflict privacy-related harm on him in California,” noting that “such a butterfly effect theory of specific jurisdiction would be far too expansive to satisfy due process.” Id. at 415. Thus, Kauffman has not shown that his claims relate to Home Depot’s California contacts. That leaves the “arising out of” prong. In a single sentence, Kauffman asserts that his “claim arises out of his ordering of a physical product to be shipped to California.” (ECF 17, at 16.) “The ‘arising out of’ portion of the specific jurisdiction formula ‘asks about causation.’” Briskin, 87 F.4th at 413 (quoting Ford Motor Co. v. Mont. Eighth Jud. Dist. Ct., 141 S. Ct. 1017, 1026 (2021)). “In other words, an injury arising out of a defendant’s forum contacts requires “but for’ causation, in which a direct nexus exists between a defendant’s contacts with the forum state and the cause of action.” /d. (cleaned As discussed above, his purchase of a physical product did not cause his data capture; that began as soon as he entered the website. (See ECF 13, at 4.) Kauffman’s claims do not “arise out of” his online purchase. Thus, Kauffman has not carried his burden to show that any claim “arises out of or relates to” defendant’s forum-related activities. And this problem cannot be cured in discovery. As “he did not request jurisdictional discovery,” Kauffman has “waived” any right to it. See Hatset v. Century 21 Gold Coast Realty, 649 F. App’x 400, 403 (9th Cir. 2016). So, this Court may not exercise personal jurisdiction over Home Depot. Home Depot’s motion to dismiss is GRANTED for lack of personal jurisdiction and DENIED AS MOOT on all other grounds. The Clerk is directed to issue a judgment and close this case. Dated: January 19, 2024 i Hon. rew G. Schopler United States District Judge