Shopify, the Canadian e-commerce giant, has just been pulled into a case that could redraw the map for how internet companies face accountability in the United States.
A U.S. federal appeals court has ruled that the company can be sued in California over how it allegedly tracks and profits from users’ data—despite not being based there.
Brandon Briskin, a resident of California, claims Shopify secretly planted tracking cookies on his iPhone when he shopped online at I Am Becoming, a local retailer using Shopify’s services. Those cookies allegedly harvested his personal data and helped Shopify build a profile it could sell to other businesses.
Shopify didn’t deny placing the tracking software. Instead, the company argued it shouldn’t be dragged into court in California. It insisted that any legal action should happen in places where it has stronger legal ties—like Delaware, New York, or back home in Canada.
But the 9th U.S. Circuit Court of Appeals in San Francisco wasn’t having it. In a strong 10-1 decision, the court said Shopify aimed its data-gathering practices directly at Californians—and that’s enough to be held accountable in the state.
“Shopify deliberately reached out … by knowingly installing tracking software onto unsuspecting Californians’ phones so that it could later sell the data it obtained, in a manner that was neither random, isolated, or fortuitous,” wrote Circuit Judge Kim McLane Wardlaw, siding with the majority.
That statement alone slices through all the legal fog. Shopify’s actions weren’t vague or incidental. The court said they were intentional and targeted—and that has consequences.
A lower court had previously tossed the case, agreeing with Shopify’s argument. Even a three-judge panel from the same appeals court had said the lawsuit didn’t belong in California. But this full bench decision reversed all of that and signalled that courts are now willing to take a harder stance when companies reach across borders through the internet.
Unsurprisingly, Shopify isn’t thrilled. A company spokesperson said the decision “attacks the basics of how the internet works,” suggesting it could force small online businesses to defend themselves in faraway courtrooms just because someone clicked from a different state.
If courts begin to take this position broadly, internet-based companies won’t be able to hide behind the argument that “we operate everywhere, so you can’t sue us anywhere.”
Matt McCrary, Briskin’s lawyer, welcomed the decision. He said the court made it clear that businesses can’t operate in digital marketplaces without also being subject to the laws of those markets. “The idea that a company is jurisdictionally ‘nowhere’ because it does business ‘everywhere’—that argument doesn’t hold up anymore,” he said.
Backing Briskin in this case was a coalition of 30 states and Washington, D.C. Their concern? If companies like Shopify are allowed to operate without being answerable to local laws, consumer protections become meaningless.
These states want the power to hold internet giants accountable when their residents are targeted, no matter where the company’s headquarters may be.
But not everyone agreed. Judge Consuelo Callahan, the lone dissenter, warned that the majority had opened the floodgates. She criticised what she called a “traveling cookie rule,” which she argued would allow lawsuits to pop up anywhere a user travels, turning jurisdiction into a guessing game.
On a business level, Shopify has been doing well. It reported a 31% revenue increase in Q4 of 2024, hitting $2.81 billion. Full-year revenue was up 26% to $8.88 billion, and subscription income grew by over 9%.
That growth has come with deeper market penetration too. “In the U.S. alone, Shopify is now over 12% of the eCommerce market share,” said President Harley Finkelstein. “And we continue to grow rapidly in places like Europe and Japan.”
Still, these numbers may not shield Shopify from what comes next. The court ruling could influence dozens of pending and future cases. Tech companies handling consumer data across state lines can be held to account where users live, not just where your offices are.
