The Shopify Merchant Data Class Action, known formally as Briskin v. Shopify, Inc., is a significant privacy lawsuit filed in California alleging that Shopify installed unauthorized tracking cookies on consumers’ devices without consent and monetized their personal data by selling consumer profiles to third parties. The case centers on alleged violations of California’s privacy and wiretapping laws, initially dismissed in 2022 but dramatically revived on April 19, 2025, when the Ninth Circuit Court of Appeals voted 10-1 to reverse the dismissal and allow the lawsuit to proceed. This revival signals a major shift in how courts interpret jurisdiction over online commerce platforms and their data collection practices.
The lawsuit was initiated by Brandon Briskin, a California resident who filed the case in August 2021 after conducting a retail checkout transaction. According to the allegations, Shopify installed tracking pixels and cookies on his iPhone during the transaction, collected personally identifying information, and subsequently sold consumer profiles derived from this data to other businesses—all without his knowledge or consent. This case has broad implications for e-commerce platforms and online retailers, as it challenges the common practice of tracking and monetizing consumer behavior across digital transactions. The Ninth Circuit’s recent decision represents a watershed moment in digital commerce law. By ruling that California courts have personal jurisdiction over Shopify based on the company’s intentional targeting of California residents to obtain and use their personal data for commercial gain, the court has created a legal framework that could reshape how platforms approach data collection and privacy compliance across state lines.
Table of Contents
- What Are the Core Allegations Against Shopify?
- How Did the Ninth Circuit’s Ruling Change the Case’s Trajectory?
- What Tracking Methods Did Shopify Allegedly Deploy?
- What Are Your Legal Rights if You’re Affected by This Case?
- What Are the Broader Jurisdictional Implications?
- Case Timeline and Current Status
- What This Ruling Means for the Future of Digital Privacy and E-Commerce
What Are the Core Allegations Against Shopify?
The allegations in Briskin v. Shopify rest on three primary claims: unauthorized installation of tracking technology, collection of personal information without consent, and monetization of that data. According to the complaint, during a routine retail checkout transaction, Shopify allegedly installed tracking cookies on the plaintiff’s device without his knowledge. These cookies reportedly collected detailed personally identifying information about the consumer, creating a digital profile of the individual’s behavior and transactions.
The most damaging allegation is that Shopify did not stop at merely collecting this data—the company allegedly took the additional step of monetizing consumer profiles by selling them to third parties or using them for commercial purposes beyond the original transaction. This practice, if proven, would violate California’s strict privacy laws, which require explicit consumer consent before personal information is collected and shared. For comparison, many legitimate e-commerce platforms use analytics cookies to improve their own services, but they typically obtain user consent and do not sell raw consumer profiles to unrelated businesses. Shopify’s alleged conduct goes beyond standard analytics practices by creating and profiting from detailed consumer profiles without authorization.
How Did the Ninth Circuit’s Ruling Change the Case’s Trajectory?
When the case was first filed in 2021, it faced a significant hurdle: whether a California court had jurisdiction over Shopify, a company that operates across the entire United States and internationally. In 2022, the lower court dismissed the case on jurisdictional grounds, reasoning that Shopify did not have sufficient presence or intentional contact with California to justify state court authority over the company. This dismissal threatened to derail the entire lawsuit before it could reach the merits of the privacy allegations. On April 19, 2025, the Ninth Circuit Court of Appeals reversed this dismissal with a decisive 10-1 vote, holding that California courts do have personal jurisdiction over Shopify.
The court’s reasoning was crucial: Shopify intentionally targeted California residents specifically to obtain and use their personal data for commercial gain. This distinction is significant because it moves beyond the traditional minimum-contacts test for jurisdiction and instead focuses on whether a company’s data collection practices constitute an intentional act directed at residents of a particular state. The ruling signals that companies cannot hide behind interstate commerce to escape accountability for targeted data harvesting directed at specific state residents. This jurisdictional decision is more than procedural—it opens the door for the case to proceed to trial on the merits of the privacy allegations, where a jury could award damages for unauthorized tracking and data monetization. The decision also creates a precedent that could encourage other privacy lawsuits against platforms accused of similar practices, fundamentally altering the landscape of digital commerce regulation.
What Tracking Methods Did Shopify Allegedly Deploy?
The specific tracking mechanism at issue in this case involves cookies and pixels—small pieces of code that, once installed on a user’s device, can collect information about the user’s behavior, location, device characteristics, and transaction history. During the plaintiff’s retail checkout transaction, Shopify allegedly placed these tracking elements on his iPhone without his knowledge or explicit consent. Unlike visible cookies that users might encounter in a cookie banner, these tracking pixels can operate silently in the background. Modern e-commerce platforms typically use analytics to understand customer behavior and improve their services, and consumers have come to expect some level of tracking when shopping online.
However, there is a critical legal distinction between tracking data for internal business purposes and monetizing that data by selling it to third parties. The Briskin case alleges that Shopify crossed that line by creating detailed consumer profiles and selling access to them or the data itself to other businesses. This practice resembles the business model of data brokers, which is heavily regulated in California and increasingly scrutinized nationwide. What makes this case particularly concerning is that consumers may not have any awareness that their transaction data is being packaged and sold to unrelated third parties.
What Are Your Legal Rights if You’re Affected by This Case?
If you are a California resident who made a purchase through a Shopify-hosted store between 2015 and the present, you may fall within the potential class of claimants affected by this lawsuit. Class members could potentially recover damages for privacy violations, unauthorized use of personal data, and unjust enrichment—the money Shopify earned by monetizing consumer profiles. Under California law, particularly the California Consumer Privacy Act (CCPA) and other state privacy statutes, consumers have explicit rights to know what personal data is collected about them, how it is used, and with whom it is shared.
One important limitation to understand is that class action litigation is slow, and recovery depends on the outcome of the lawsuit. Unlike some regulatory settlements that have been concluded, this case is still in its early phases following the Ninth Circuit’s reversal of the dismissal. Eligible class members will need to monitor the case for settlement announcements or judgment outcomes, and any recovery will depend on the court’s findings or a negotiated settlement. Attorneys handling the case typically work on a contingency basis, meaning they receive a percentage of recovered damages rather than hourly fees, so there is no cost to potential claimants to participate.
What Are the Broader Jurisdictional Implications?
The Ninth Circuit’s ruling in Briskin v. Shopify carries implications far beyond this single case, reshaping how courts interpret jurisdiction over digital commerce platforms accused of privacy violations. Traditionally, courts have applied a “minimum contacts” test to determine whether a state has jurisdiction over an out-of-state company—essentially, does the company have enough business activity in the state to justify subjecting it to that state’s courts? The Shopify ruling, however, suggests that when a company intentionally targets residents of a specific state for data collection or commercial gain, that targeted activity itself may establish jurisdiction, even if the company’s overall presence in the state is limited. This shift has significant consequences for e-commerce platforms and digital service providers.
Companies can no longer assume that operating nationwide through the internet shields them from jurisdiction in any particular state where they have customers. If a company intentionally collects personal data from residents of a specific state for profit, it may now face litigation in that state’s courts. The ruling also signals that courts are increasingly willing to view data collection as a form of business activity that can establish jurisdiction, similar to traditional commercial transactions. This legal development will likely influence how platforms design their privacy practices and in which states they may face legal challenges.
Case Timeline and Current Status
Brandon Briskin filed the case in August 2021, setting in motion a legal process that has taken over four years to reach the current stage. The initial dismissal on jurisdictional grounds in 2022 appeared to be a setback that could have ended the litigation, but the Ninth Circuit’s April 2025 reversal has revived the case and allowed it to move forward. As of now, the case has been sent back to the trial court to proceed on the merits of the privacy allegations, meaning the next phase will involve discovery, settlement negotiations, or potentially a trial.
The timeline for reaching a resolution remains uncertain but will likely take several additional years. Class action lawsuits involving complex privacy issues typically move through the courts slowly as parties exchange information, file motions, and either negotiate a settlement or prepare for trial. Potential class members should monitor the case docket or legal databases for announcements of settlement agreements or major court decisions that could signal a resolution.
What This Ruling Means for the Future of Digital Privacy and E-Commerce
The Shopify decision reflects a broader shift in how courts and regulators are approaching digital privacy and the power of data-driven business models. As consumers have become more aware of how their personal information is harvested and monetized, state legislators and courts have increasingly implemented and enforced privacy protections. California, with its CCPA and the newer California Privacy Rights Act (CPRA), has led this movement, and other states have followed with their own privacy laws.
The Ninth Circuit’s willingness to establish jurisdiction based on targeted data collection suggests that courts are taking these privacy concerns seriously and are prepared to hold platforms accountable even when they operate across state lines. Looking forward, the Shopify case could accelerate the pace at which companies reevaluate their data collection and monetization practices. If Shopify is found liable or reaches a settlement, it will send a strong signal to other e-commerce platforms that generating profit by selling consumer profiles without explicit consent carries legal and financial risk. The decision may also embolden other consumers and privacy advocates to file similar suits, potentially creating a wave of data privacy litigation that forces the e-commerce and digital services industries to implement more strong consent mechanisms and data protection practices.
You Might Also Like
- Temu Consumer Data Privacy Class Action Lawsuit
- Oura Ring Health Data Privacy Class Action
- J Crew Customer Data Privacy Class Action
Open Settlements You Can Claim Now
Browse current class action settlements accepting claims — several require no proof of purchase: