Court Opinion

ID: 9905001
Source: CourtListenerOpinion
Date Created: 2023-11-28 17:01:43.247075+00
Date Added: 2024-06-11T09:22:54.417806
License: Public Domain

FOR PUBLICATION

   UNITED STATES COURT OF APPEALS
        FOR THE NINTH CIRCUIT

BRANDON BRISKIN, on behalf of              No. 22-15815
himself and those similarly situated,
                                         D.C. No. 4:21-cv-
               Plaintiff-Appellant,         06269-PJH

 v.
                                             OPINION
SHOPIFY, INC.; SHOPIFY (USA),
INC.; SHOPIFY PAYMENTS (USA),
INC.,

               Defendants-Appellees.

       Appeal from the United States District Court
          for the Northern District of California
       Phyllis J. Hamilton, District Judge, Presiding

          Argued and Submitted August 16, 2023
                San Francisco, California

                 Filed November 28, 2023

   Before: Consuelo M. Callahan, Bridget S. Bade, and
            Daniel A. Bress, Circuit Judges.

                  Opinion by Judge Bress
2                     BRISKIN V. SHOPIFY, INC.

                          SUMMARY *

                     Specific Jurisdiction

    The panel affirmed the district court’s dismissal, due to
lack of specific personal jurisdiction over the defendants, of
a putative class action alleging that Shopify, Inc. violated
various California privacy and unfair competition laws
because it deliberately concealed its involvement in certain
consumer transactions.
    Defendants offer a web-based payment processing
platform to merchants nationwide. When processing
payments, defendants obtain the personal information of
those merchants’ customers.
    For specific jurisdiction to exist over Shopify, plaintiff’s
claim must arise out of or relate to Shopify’s forum-related
activities. The panel held that there was no causal
relationship between Shopify’s broader business contacts in
California and plaintiff’s claims because these contacts did
not cause plaintiff’s harm. Nor did plaintiff’s claims “relate
to” Shopify’s broader business activities in California
outside of its extraction and retention of plaintiff’s data.
    Because there was an insufficient relationship between
plaintiff's claims and Shopify’s broader business contacts in
California, the activities relevant to the specific jurisdiction
analysis were those that caused plaintiff’s injuries: Shopify’s
collection, retention, and use of consumer data obtained

*
 This summary constitutes no part of the opinion of the court. It has
been prepared by court staff for the convenience of the reader.
                    BRISKIN V. SHOPIFY, INC.                  3

from persons who made online purchases while in
California.
    The panel held that Shopify, which provides nationwide
web-based payment processing services to online merchants,
did not expressly aim its conduct toward California. The
panel held that plaintiff’s California connection—plaintiff
resides in California and was physically located in California
when he used Shopify’s e-commerce payment system—did
not matter to the analysis of whether Shopify expressly
aimed its activities toward California. When analyzing
whether a court has personal jurisdiction over a web-based
payment processor in a suit alleging the unlawful extraction,
retention, and sharing of consumer data, the legal framework
and principles that should be brought to bear are those found
in the court’s personal jurisdiction cases involving
interactive websites. Applying those principles to this case,
the panel held that Shopify did not expressly aim its suit-
related conduct toward California.
    The panel held that the district court’s effective denial of
plaintiff’s request for jurisdictional discovery of Shopify
was not an abuse of discretion.

                         COUNSEL

Nicolas A. Sansone (argued), Allison M. Zieve, and Scott L.
Nelson, Public Citizen Litigation Group, Washington, D.C.;
Seth A. Safier, Matthew T. McCrary, and Todd Kennedy,
Gutride Safier LLP, San Francisco, California; for Plaintiff-
Appellant.
Moez Kaba (argued), Hueston Hennigan LLP, Los Angeles,
California; Sourabh Mishra, Hueston Hennigan LLP,
4                  BRISKIN V. SHOPIFY, INC.

Newport Beach, California; Adam Minchew, Huestan
Hennigan LLP, New York, New York; for Defendants-
Appellees.

                        OPINION

BRESS, Circuit Judge:

     The defendants in this case offer a web-based payment
processing platform to merchants nationwide. When
processing payments, the defendants obtain the personal
information of those merchants’ customers. In this case of
first impression, we are asked to decide whether defendants’
extracting and retaining of consumer data and their tracking
of customers exposes them to personal jurisdiction in
California, where a consumer made his online purchase. We
hold that the defendants are not subject to specific
jurisdiction in California because they did not expressly aim
their suit-related conduct at the forum state. When a
company operates a nationally available e-commerce
payment platform and is indifferent to the location of end-
users, the extraction and retention of consumer data, without
more, does not subject the defendant to specific jurisdiction
in the forum where the online purchase was made. We
affirm the dismissal of the plaintiff’s complaint.
                              I
   The plaintiff in this case is Brandon Briskin, a resident
of California. In June 2019, Briskin, while present in
California, used his iPhone’s Safari browser to navigate to
the website of California-based retailer IABMFG to
purchase fitness apparel. Although Briskin claims he did not
                    BRISKIN V. SHOPIFY, INC.                 5

know it at the time, IABMFG’s website used software and
code from Shopify, Inc. to process customer orders and
payments.
    Shopify, Inc. is a Canadian corporation with its
headquarters in Ottawa, Canada.            Shopify provides
participating merchants with a sales platform that enables the
processing of online purchases. As part of its business,
Shopify obtains, processes, stores, analyzes, and shares the
information of consumers who complete transactions on
Shopify’s merchant-customers’ websites. Although Briskin
believed he was dealing only with IABMFG, in fact it was
Shopify’s e-commerce platform that was operating behind
the scenes to facilitate Briskin’s purchase.
    When completing his online order, Briskin input his
personal identification information (name, address, etc.) and
credit card number into IABMFG’s website. Shopify
collected this information. Shopify also installed cookies
onto Briskin’s phone, connected his browser to its network,
generated payment forms requiring Briskin to enter private
identifying information, and stored Briskin’s personal and
credit card information for later use and analysis. Shopify
also transmitted Briskin’s payment information to a second
payment processor, Stripe, for additional storage, analysis,
and processing. Shopify used the customer information it
received to create consumer profiles, which Shopify also
shared with its merchant and other business partners.
    In August 2021, Briskin filed this putative class action in
the United States District Court for the Northern District of
California, alleging that Shopify violated various California
privacy and unfair competition laws because it deliberately
concealed its involvement in the consumer transactions. The
complaint defined the proposed class as “[a]ll natural
6                     BRISKIN V. SHOPIFY, INC.

persons who, between August 13, 2017 and the present,
submitted payment information via Shopify’s software
while located in California.”
    Briskin’s complaint named as defendants Shopify, Inc.
and two of its wholly owned subsidiaries, Shopify (USA)
Inc. (“Shopify USA”) and Shopify Payments (USA), Inc.
(“Shopify Payments”). Briskin alleges that Shopify USA is
a Delaware corporation with its principal place of business
in Canada. 1 Shopify Payments is a Delaware corporation
with its principal place of business in Delaware. In this
opinion, we use “Shopify” to refer to all three defendants,
collectively.
    In his operative complaint, Briskin provided additional
allegations about Shopify’s contacts with California.
Although the parties dispute the jurisdictional relevance of
these contacts, Briskin alleges that Shopify not only reaches
into California to extract consumers’ personal data, but also
directly contracts with California merchants, including
IABMFG. According to the complaint, some of the largest
merchants on Shopify’s platform are California-based
companies. In 2018, Shopify, Inc. opened a physical
location in Los Angeles to expand its access to the California
market and enhance relationships with Shopify’s over
80,000 merchant-customers in the state. Briskin further
alleges that Shopify, Inc. has at least one fulfillment center
in California that stores goods from merchants and ships
them to consumers, including those located in California.
   The complaint also alleges some jurisdictional facts
specific to the two Shopify subsidiaries. Shopify USA,

1
  The defendants represent that Shopify USA has its principal place of
business in New York.
                   BRISKIN V. SHOPIFY, INC.                7

which serves as a subprocessor of user data, is registered to
do business in California, at one point had an office in San
Francisco, has a quarter of its employees in California, and
provides services to thousands of California businesses.
Shopify Payments, meanwhile, contracts with thousands of
California merchants to enable them to accept online credit
and debit payments. Shopify Payments and its contractual
partner Stripe, which has its principal place of business in
California, then process those payments. As part of this
collaboration, Shopify Payments shares California
consumers’ personal information with Stripe, which then
uses the information to create profiles on consumers.
    After Briskin twice amended his complaint as part of
bolstering his allegations about Shopify’s contacts with
California, Shopify moved to dismiss the complaint for lack
of personal jurisdiction.     The district court agreed,
dismissing the second amended complaint without leave to
amend.
    Briskin timely appealed.       The district court had
jurisdiction under 28 U.S.C. § 1332(d)(2)(A), and we have
jurisdiction under 28 U.S.C. § 1291. We review the district
court’s dismissal for lack of personal jurisdiction de novo.
Ayla, LLC v. Alya Skin Pty. Ltd., 11 F.4th 972, 978 (9th Cir.
2021). In doing so, we “take as true all uncontroverted
allegations in the complaint and resolve all genuine factual
disputes in the plaintiff’s favor.” Glob. Commodities
Trading Grp., Inc. v. Beneficio de Arroz Choloma, S.A., 972
F.3d 1101, 1106 (9th Cir. 2020).
                              II
    To situate our analysis, we begin with a primer on the
basic rules of personal jurisdiction. Two authorities govern
a federal court’s exercise of personal jurisdiction over a
8                   BRISKIN V. SHOPIFY, INC.

defendant: the Fourteenth Amendment’s Due Process
Clause and the long arm statute of the state in which the
district court sits. See Ford Motor Co. v. Mont. Eighth Jud.
Dist. Ct., 141 S. Ct. 1017, 1024 (2021); Impossible Foods
Inc. v. Impossible X LLC, 80 F.4th 1079, 1086 (9th Cir.
2023). These requirements are coterminous in our case
because California’s long arm statute allows courts to
exercise jurisdiction on any ground not inconsistent with due
process. See Yahoo! Inc. v. La Ligue Contre Le Racisme Et
L’Antisemitisme, 433 F.3d 1199, 1205 (9th Cir. 2006) (en
banc); Impossible Foods, 80 F.4th at 1086; Cal. Civ. Proc.
Code § 410.10. Due process permits a court to exercise
personal jurisdiction over a defendant only when “the
defendant has sufficient ‘minimum contacts’ with the forum
state ‘such that the maintenance of the suit does not offend
traditional notions of fair play and substantial justice.’”
Impossible Foods, 80 F.4th at 1086 (quoting LNS Enters.
LLC v. Cont’l Motors, Inc., 22 F.4th 852, 858 (9th Cir.
2022)); see also Ford Motor Co., 141 S. Ct. at 1024 (citing
Int’l Shoe Co. v. Washington, 326 U.S. 310, 316–17 (1945)).
    Personal jurisdiction comes in two varieties: general and
specific. General jurisdiction “extends to ‘any and all
claims’ brought against a defendant,” but it is appropriate
only “when a defendant is ‘essentially at home’ in the State.”
Ford Motor Co., 141 S. Ct. at 1024 (quoting Goodyear
Dunlop Tires Operations, S.A. v. Brown, 564 U.S. 915, 919
(2011)). A corporate defendant is considered at home in its
state of incorporation and the state where it maintains its
principal place of business. See Daimler AG v. Bauman, 571
U.S. 117, 137 (2014). Briskin does not argue that Shopify is
subject to general jurisdiction in California.
   Specific jurisdiction “covers defendants less intimately
connected with a State, but only as to a narrower class of
                    BRISKIN V. SHOPIFY, INC.                 9

claims.” Ford Motor Co., 141 S. Ct. at 1024. For specific
jurisdiction to exist over a non-resident defendant, three
conditions must be met. First, “the defendant must either
‘purposefully direct his activities’ toward the forum or
‘purposefully avail[] himself of the privileges of conducting
activities in the forum’”; second, “the claim must be one
which arises out of or relates to the defendant’s forum-
related activities”; and third, “the exercise of jurisdiction
must comport with fair play and substantial justice, i.e. it
must be reasonable.” Axiom Foods, Inc. v. Acerchem Int’l,
Inc., 874 F.3d 1064, 1068 (9th Cir. 2017) (quoting Dole
Food Co. v. Watts, 303 F.3d 1104, 1111 (9th Cir. 2002))
(alteration in original). The plaintiff bears the burden on the
first two prongs. Ayla, 11 F.4th at 979. If they are met, then
the defendant “must come forward with a ‘compelling case’
that the exercise of jurisdiction would not be reasonable.”
Id. (quoting Boschetto v. Hansing, 539 F.3d 1011, 1016 (9th
Cir. 2008)).
    At prong one of the specific jurisdiction analysis, courts
must determine whether a defendant has purposefully
directed its activities towards the forum state, purposefully
availed itself of the privilege of conducting activities in the
forum state, or some combination of the two. See Yahoo!,
433 F.3d at 1206. For claims that sound in tort, we “most
often employ a purposeful direction analysis,” asking
“whether a defendant ‘purposefully direct[s] his activities’ at
the forum state . . . .” Mavrix Photo, Inc. v. Brand Techs.,
Inc., 647 F.3d 1218, 1228 (9th Cir. 2011) (first citing
Schwarzenegger v. Fred Martin Motor Co., 374 F.3d 797,
802 (9th Cir. 2004); and then quoting Yahoo!, 433 F.3d at
1206); see also Glob. Commodities Trading Grp., 972 F.3d
at 1107 (“Purposeful availment generally provides a more
useful frame of analysis for claims sounding in contract,
10                  BRISKIN V. SHOPIFY, INC.

while purposeful direction is often the better approach for
analyzing claims in tort.”). Although a rigid analytical
distinction between purposeful direction and purposeful
availment is not always helpful or appropriate, see
Impossible Foods, 80 F.4th at 1088–89; Davis v. Cranfield
Aerospace Sols., Ltd., 71 F.4th 1154, 1162 (9th Cir. 2023),
in this case Briskin’s claims sound classically in tort and are
most naturally analyzed under the purposeful direction
framework. The parties agree on this point. We thus
proceed to the purposeful direction analysis.
    We evaluate purposeful direction under the Calder
effects test, see Calder v. Jones, 465 U.S. 783 (1984), which
focuses on whether the effects of the defendant’s actions
were felt in the forum state. See also Walden v. Fiore, 571
U.S. 277, 286–88 (2014); Burri Law PA v. Skurla, 35 F.4th
1207, 1213 (9th Cir. 2022). Under this test, “the defendant
allegedly must have (1) committed an intentional act, (2)
expressly aimed at the forum state, (3) causing harm that the
defendant knows is likely to be suffered in the forum state.”
Mavrix Photo, 647 F.3d at 1228 (quoting Brayton Purcell
LLP v. Recordon & Recordon, 606 F.3d 1124, 1128 (9th Cir.
2010), as amended, abrogated on other grounds as
recognized by Axiom Foods, 874 F.3d at 1069–70).
    Shopify’s conduct satisfies the first Calder element. We
“construe ‘intent’ in the context of the ‘intentional act’ test
as referring to an intent to perform an actual, physical act in
the real world . . . .” Schwarzenegger, 374 F.3d at 806. Acts
undertaken using technology can qualify as intentional acts.
See, e.g., Herbal Brands, Inc. v. Photoplaza, Inc., 72 F.4th
1085, 1091 (9th Cir. 2023) (noting that the defendant’s sale
of a product via an interactive website was an intentional
act); Will Co. v. Lee, 47 F.4th 917, 922 (9th Cir. 2022)
(explaining that operating a website, purchasing a domain
                    BRISKIN V. SHOPIFY, INC.               11

name, and purchasing domain privacy services are
intentional acts). By generating payment forms, executing
code on consumers’ devices, creating consumer profiles,
processing consumer information, installing cookies, and
sharing payment information, Shopify has committed
intentional acts. And we are willing to conclude that Briskin
has fairly alleged the third Calder element as well, namely,
that Shopify caused privacy-related harm that it knew was
likely to be suffered in the forum state.
     The issue here, and the crux of this case, lies in Calder
prong two: whether Shopify “expressly aimed” its activities
at the forum state. It is to that question that we now turn.
                              III
    To determine whether Shopify expressly aimed its
activities toward California so as to purposefully direct its
activities there, we must first identify which of Shopify’s
California contacts are relevant to the analysis. We evaluate
that issue in Section A below. In Section B, and in the
absence of any controlling authority on the personal
jurisdiction implications of an online payment platform, we
examine our specific jurisdiction cases involving interactive
websites, the most analogous precedents. From these cases,
we distill key principles to govern the express aiming inquiry
in a consumer data collection and retention case such as this.
Finally, in Section C, we apply these principles to explain
why Shopify has not expressly aimed its activities toward
California for purposes of Briskin’s claims.
                              A
    We begin by narrowing Briskin’s allegations to the
conduct relevant to the specific jurisdiction inquiry. Recall
that Briskin points to several features of Shopify’s business
12                  BRISKIN V. SHOPIFY, INC.

to support personal jurisdiction in California. The most
pertinent of these are the data extraction, retention, and
processing that give rise to Briskin’s claims. Setting this
aspect of the case aside for the moment, Briskin also argues
that Shopify does extensive business in the state. He points
to Shopify’s contracts with California merchants, its Los
Angeles “store” that promotes merchant relations, its
California fulfillment center, the Shopify partnership with
Stripe (a California company), and Shopify USA’s presence
in the state (business registration, employees, etc.).
Although Briskin does not argue that these contacts are so
pervasive as to create all-purpose general jurisdiction, he
does suggest they are at least relevant to the specific
jurisdiction analysis.
    That is not correct. For specific jurisdiction to exist over
Shopify, Briskin’s claim “‘must be one which arises out of
or relates to the defendant’s forum-related activities.’”
Axiom Foods, 874 F.3d at 1068 (quoting Dole Food Co., 303
F.3d at 1111) (emphasis added). This is a claim-tailored
inquiry that requires us to examine the plaintiff’s specific
injury and its connection to the forum-related activities in
question. See Bristol-Myers Squibb Co. v. Superior Ct. of
Cal., S.F. Cnty., 582 U.S. 255, 262 (2017) (explaining that
“there must be ‘an affiliation between the forum and the
underlying controversy’” (quoting Goodyear, 564 U.S. at
919)); Williams v. Yamaha Motor Co. Ltd., 851 F.3d 1015,
1022–23 (9th Cir. 2017) (“In order for a court to have
specific jurisdiction over a defendant, ‘the defendant’s suit-
related conduct must create a substantial connection with the
forum State.’” (quoting Walden, 571 U.S. at 284)).
    We think it clear that Briskin’s claims do not “arise out
of” Shopify’s broader forum-related activities in the state (its
contracts with California merchants, physical Shopify
                     BRISKIN V. SHOPIFY, INC.                 13

offices, and so on). The “arising out of” portion of the
specific jurisdiction formula “asks about causation.” Ford
Motor Co., 141 S. Ct. at 1026. In other words, an injury
arising “out of a defendant’s forum contacts require[s] ‘but
for’ causation, in which ‘a direct nexus exists between a
defendant’s contacts with the forum state and the cause of
action.’” Yamashita v. LG Chem, Ltd., 62 F.4th 496, 504
(9th Cir. 2023) (quoting In re W. States Wholesale Nat. Gas
Antitrust Litig., 715 F.3d 716, 742 (9th Cir. 2013)) (brackets
omitted).
     There is no such causal relationship between Shopify’s
broader California business contacts and Briskin’s claims
because these contacts did not cause Briskin’s harm. Indeed,
Briskin himself acknowledges in his opening brief that “[t]he
direct, unmediated interactions between Shopify and
California shoppers through an interactive web-based
payment platform are what form the basis for [his] claims.”
It is readily apparent there will be causes of action that do
arise out of Shopify’s broader business contacts with
California (such as claims by a California merchant). But
Briskin’s claims are not among them.
    Nor do Briskin’s claims “relate to” Shopify’s broader
business activities in California outside of its extraction and
retention of Briskin’s data. Focusing on the disjunctive “or”
in the doctrinal formulation, the Supreme Court in Ford
clarified that “relate to” in the phase “arising out of or relate
to” does “contemplate[] that some relationships will support
jurisdiction without a causal showing.” 141 S. Ct. at 1026;
see also Impossible Foods, 80 F.4th at 1093–94, 1097.
Briskin passingly suggests that Shopify’s broader California
contacts “relate to” his claims under Ford, but that is wrong.
The Supreme Court in Ford was clear that the “related to”
test still “incorporates real limits, as it must to adequately
14                  BRISKIN V. SHOPIFY, INC.

protect defendants foreign to a forum.” 141 S. Ct. at 1026.
At minimum, the plaintiff must show “that the instant
litigation ‘relate[s] to’” the contacts in question. LNS
Enters., 22 F.4th at 864 (alteration in original).
    Case law demonstrates the bounded reach of the “related
to” variable of the personal jurisdiction equation. In Ford,
for example, the Supreme Court held that Ford in product
liability cases could be subject to specific personal
jurisdiction in states where it did not make, sell, or design
the particular vehicle involved in an accident, but that was
because Ford had “systematically served a market” in those
states through comprehensive sales, marketing, and auto
servicing efforts there. 141 S. Ct. at 1028–29. Similarly, in
Yamashita v. LG Chem, Ltd., 62 F.4th 496 (9th Cir. 2023),
we explained that a plaintiff could demonstrate that a claim
“relates to” a defendant’s forum-related activities based on a
causation-by-proxy theory. Id. at 505. Specifically, we
postulated that “if similar injuries will tend to be caused by
those contacts,” and “if the defendant should have foreseen
the risk that its contacts might cause injuries like that of the
plaintiff,” the “related to” test may be met, provided there is
“a close connection between contacts and injury.” Id. at
505–06. Likewise, in Impossible Foods Inc. v. Impossible X
LLC, 80 F.4th 1079 (9th Cir. 2023), we held that a
declaratory judgment action for trademark non-infringement
sufficiently “related to” the defendant’s contacts in the
forum state. But that was because the defendant was
formerly headquartered there and its trademark-building
activities in the state “establish[ed] the asserted legal rights
that [we]re at the center of th[e] dispute.” Id. at 1097.
   These cases and examples all involved a strong, direct
connection between the defendant’s forum-related activities
and the plaintiff’s claims. What we have here is very
                    BRISKIN V. SHOPIFY, INC.                 15

different.    Briskin’s injuries are based on Shopify’s
extraction and processing of his personal information. His
claims have nothing to do with Shopify’s brick-and-mortar
operations in the state. Nor do they relate to Shopify’s
contracts with merchants in California. Briskin would have
suffered the same injury regardless of whether he purchased
items from a California merchant or was physically present
in California when he did so. To the extent Briskin suggests
that Shopify’s broader business actions in California set the
wheels in motion for Shopify to eventually inflict privacy-
related harm on him in California, such a butterfly effect
theory of specific jurisdiction would be far too expansive to
satisfy due process. That position is directly contrary to
Ford, which cautioned that “relates to” “does not mean
anything goes.” 141 S. Ct. at 1026.
                               B
    Because there is an insufficient relationship between
Briskin’s claims and Shopify’s broader business contacts in
California, the activities relevant to the specific jurisdiction
analysis in this case are those that caused Briskin’s injuries:
Shopify’s collection, retention, and use of consumer data
obtained from persons who made online purchases while in
California. Briskin argues that Shopify through these
activities    effectively     “reached      into”    California
(electronically) and inserted itself (technologically) into a
transaction between a California consumer and a California
merchant. The issue is whether Shopify, which provides
web-based payment processing services to online merchants
throughout the nation (and the world), thereby expressly
aimed its conduct toward California.
    This type of personal jurisdiction question involving an
online payment platform is novel. We have never addressed
16                  BRISKIN V. SHOPIFY, INC.

such a situation, nor, to our knowledge, have other circuits.
In the sections below, we first explain why our focus here
cannot be either Briskin’s presence in California or the fact
that he sustained an alleged injury there. We next turn to our
personal jurisdiction cases involving claims against out-of-
state interactive websites, explaining why these
precedents—and not precedents involving the distribution of
physical products—provide the right foundation for
analyzing personal jurisdiction in this case. From our
interactive website cases, we then derive core principles to
govern the personal jurisdiction inquiry in cases such as this
based on the extraction of consumer data.
                               1
    Briskin is a resident of California, and he was physically
located in California when he purchased merchandise using
Shopify’s e-commerce payment system. Does Briskin’s
California connection matter to the analysis of whether
Shopify expressly aimed its activities toward California?
The answer is no.
    The key authority is Walden v. Fiore, 571 U.S. 277
(2014). In Walden, a Georgia police officer deputized as a
federal law enforcement agent seized nearly $100,000 in
cash from two travelers at the Hartsfield-Jackson
International Airport in Atlanta, Georgia. Id. at 279–80. The
travelers, residents of both California and Nevada who were
en route to Las Vegas, sued the Georgia officer in Nevada,
claiming the seizure violated their Fourth Amendment
rights. Id. at 280. They argued that a Nevada court had
personal jurisdiction because the officer “knew his allegedly
tortious conduct in Georgia would delay the return of funds
to plaintiffs with connections to Nevada.” Id. at 279.
                    BRISKIN V. SHOPIFY, INC.                17

    The Supreme Court disagreed. Applying Calder, the
Court held that the district court could not exercise personal
jurisdiction over the Georgia defendant. Id. at 291. The
Court’s holding turned on two fundamental principles of
law. First, the relationship between a defendant and the
forum state “must arise out of contacts that the ‘defendant
himself’ creates with the forum . . . .” Id. at 284 (quoting
Burger King Corp. v. Rudzewicz, 471 U.S. 462, 475 (1985))
(emphasis in original). That explained why the Supreme
Court had “consistently rejected attempts to satisfy the
defendant-focused ‘minimum contacts’ inquiry by
demonstrating contacts between the plaintiff (or third
parties) and the forum State.” Id. (first citing Helicopteros
Nacionales de Colombia, S.A. v. Hall, 466 U.S. 408, 417
(1984); and then citing Hanson v. Denckla, 357 U.S. 235,
253–54 (1958)). Second, and relatedly, the “‘minimum
contacts’ analysis looks to the defendant’s contacts with the
forum State itself, not the defendant’s contacts with persons
who reside there.” Id. at 285. As the Court explained, “a
defendant’s contacts with the forum State may be
intertwined with his transactions or interactions with the
plaintiff or other parties. But a defendant’s relationship with
a plaintiff or third party, standing alone, is an insufficient
basis for jurisdiction.” Id. at 286. For these reasons, it was
insufficient that the plaintiffs in Walden experienced injury
in Nevada or that the Georgia officer might have known that
his conduct would produce foreseeable harm there. Id. at
288–90.
    We considered Walden most definitively in Picot v.
Weston, 780 F.3d 1206 (9th Cir. 2015). In Picot, as relevant
here, a California plaintiff sued a Michigan resident in
California, seeking a declaration that the defendant had
tortiously interfered with the plaintiffs’ contract with HMR,
18                  BRISKIN V. SHOPIFY, INC.

a Delaware corporation with offices in Ohio. Id. at 1210,
1215. The complaint alleged that the defendant while in
Michigan had made statements to an Ohio resident that
caused HMR to cease making payments on the contract into
two trusts located in Wyoming and Australia. Id. at 1215.
    We held that under Walden, the defendant’s conduct was
not expressly aimed at California. Id. The defendant had
not acted tortiously in California, and the challenged conduct
in fact did not have “anything to do with California itself.”
Id. (quoting Walden, 571 U.S. at 1125) (brackets omitted).
We also thought it critical that the plaintiff’s injury, “an
inability to access out-of-state funds, [wa]s not tethered to
California in any meaningful way.” Id. We said that because
the plaintiff’s “injury is entirely personal to him and would
follow him wherever he might choose to live or travel,”
“[t]he effects of [the defendant’s] actions are therefore ‘not
connected to the forum State in a way that makes those
effects a proper basis for jurisdiction.’” Id. (quoting Walden,
571 U.S. at 1125).
    Walden and Picot confirm that Shopify did not expressly
aim its conduct toward California simply because Briskin
resided there, made his online purchase “while located in
California,” and sustained his privacy-based injuries in that
state. Under Walden, it is the defendant’s contacts with the
forum state, not the plaintiff’s, that matter, and it is the
defendant’s contacts with the state itself, and not persons
there, that must drive the inquiry. See Walden, 571 U.S. at
284–86.
    Briskin’s injuries, meanwhile, were “entirely personal to
him and would follow him wherever he might choose to live
or travel.” Picot, 780 F.3d at 1215; see also Walden, 571
U.S. at 290 (explaining that the Nevada plaintiffs’ injury in
                    BRISKIN V. SHOPIFY, INC.               19

Nevada did not create personal jurisdiction because the
plaintiffs “would have experienced th[e] same lack of
access” to seized funds “in California, Mississippi, or
wherever else they might have traveled and found
themselves wanting more money than they had”). Although
Briskin emphasizes that Shopify knows the whereabouts of
its merchants’ customers through the data it collects from
them and the tracking tools it deploys, Shopify did not
expressly aim its conduct toward California “simply because
[it] allegedly directed [its] conduct at plaintiffs whom [it]
knew had [California] connections.” Walden, 571 U.S. at
289.
                               2
    Having bracketed out what our analysis cannot turn on,
we now move to the principles that we think should govern
our review. Because Shopify operates a web-based
platform, and for reasons we will explain below, our
personal jurisdiction cases involving interactive websites
provide the closest analogy to the case at hand. The parties
effectively agree on this point, as they have devoted the bulk
of their briefing to these precedents. A careful discussion of
our circuit’s precedent in this area is therefore important to
understanding the contours of the personal jurisdiction
problem in this case.
    Almost as soon as the internet became a thing, we were
confronted with personal jurisdiction questions involving
internet-based businesses. Because websites can be viewed
from anywhere, we had to resolve whether and when web-
based operations were sufficiently “purposeful” to generate
specific jurisdiction. Our approach to that problem has not
been to allow personal jurisdiction anywhere that a web
platform can be accessed. Instead, we have recognized that
20                  BRISKIN V. SHOPIFY, INC.

there are due process constraints on the assertion of personal
jurisdiction over non-resident defendants who operate
through the internet. Over the course of decades, we have
gone about delineating and refining legal rules to govern
when an assertion of personal jurisdiction over an out-of-
state internet platform exceeds the bounds of due process.
    We made clear early on that a purely “passive” website
that merely hosts information “does not qualify as
purposeful activity invoking the benefits and protections” of
the fora in which the website may be viewed. Cybersell, Inc.
v. Cybersell, Inc., 130 F.3d 414, 420 (9th Cir. 1997); see also
Herbal Brands, 72 F.4th at 1091 (“It is well settled that
‘[m]ere passive operation of a website is insufficient to
demonstrate express aiming.’” (quoting Will Co., 47 F.4th at
922) (alteration in original)). But an “interactive website”—
in which “users can exchange information with the host
computer,” Cybersell, 130 F.3d at 418—presents different
considerations.
    That kind of web platform, our cases instruct, can satisfy
the express aiming requirement. But not always. Driving
our decision-making in this area has been the need to draw
some lines to avoid subjecting web platforms to personal
jurisdiction everywhere. Were it otherwise, “every time a
seller offered a product for sale through an interactive
website, the seller would be subjecting itself to specific
jurisdiction in every forum in which the website was
visible . . . .” Herbal Brands, 72 F.4th at 1091. “That
result,” we have said, “would be too broad to comport with
due process.”        Id. (citing CollegeSource, Inc. v.
AcademyOne, Inc., 653 F.3d 1066, 1075–76 (9th Cir. 2011));
see also Cybersell, 130 F.3d at 420 (similar). For this
reason, “operation of an interactive website does not, by
                    BRISKIN V. SHOPIFY, INC.                21

itself, establish express aiming.” Herbal Brands, 72 F.4th at
1091.
    What is needed is “something more.” Id. at 1092. Thus,
we have held that “operating a website ‘in conjunction with
“something more”—conduct directly targeting the forum—
is sufficient’” to satisfy the express aiming requirement. Id.
(quoting Mavrix Photo, 647 F.3d at 1229). And “[w]hen the
website itself is the only jurisdictional contact, our analysis
turns on whether the site had a forum-specific focus or the
defendant exhibited an intent to cultivate an audience in the
forum.” Id.
    Three cases—Mavrix Photo, Inc. v. Brand Techs., Inc.,
647 F.3d 1218 (9th Cir. 2011), AMA Multimedia, LLC v.
Wanat, 970 F.3d 1201 (9th Cir. 2020), and Will Co. v. Lee,
47 F.4th 917 (9th Cir. 2022)—represent our key precedents
in this area. Mavrix involved a Florida-based celebrity photo
agency, Mavrix Photo, Inc., which sold candid photos of
celebrities to popular magazines. 647 F.3d at 1221–22.
Mavrix, which also had an office in California, alleged that
Brand Technologies, Inc., an Ohio corporation, had
infringed Mavrix’s copyrights by posting Mavrix’s photos
on Brand’s website, celebrity-gossip.net. Id. at 1221–23.
Mavrix filed suit in federal court in the Central District of
California, which raised the question of whether Brand was
subject to personal jurisdiction in California. Id. at 1221.
    We held that the district court could exercise specific
jurisdiction over Brand. Id. at 1232. Relevant to our
analysis was that Brand knew “either actually or
constructively” that it had a “California user base” and that
Brand sought to exploit that California base “for commercial
gain by selling space on its website for advertisements” that
were “directed to Californians” and “targeted” them. Id. at
22                  BRISKIN V. SHOPIFY, INC.

1230. We found further evidence of Brand’s express aiming
in the subject matter of its website, which had “a specific
focus on the California-centered celebrity and entertainment
industries.” Id.; see also id. at 1231 (explaining that Brand’s
website “appeals to, and profits from, an audience in a
particular state”).
    We determined that Brand had thereby expressly aimed
intentional acts at California when it “used Mavrix’s
copyrighted photos as part of its exploitation of the
California market for its own commercial gain.” Id. at 1229.
Ultimately, “[b]ased on the website’s subject matter, as well
as the size and commercial value of the California market,”
“Brand anticipated, desired, and achieved a substantial
California viewer base.” Id. at 1230. It thus “d[id] not
violate due process to hold Brand answerable in a California
court for the contents of a website whose economic value
turn[ed], in significant measure, on its appeal to
Californians.” Id.
    Contrast Mavrix with AMA Multimedia. In AMA, the
defendants operated ePorner, an internationally available
website that hosted adult videos uploaded by individual
users. 970 F.3d at 1204. ePorner made money through
geotargeted advertisements that would show users ads based
on their location throughout the world. Id. at 1210–11.
AMA Multimedia, a Nevada-based company, sued the
Polish operators of ePorner over the use of AMA’s adult
video content on ePorner’s website. Id. at 1204–05. AMA
argued that specific jurisdiction existed in Nevada because
U.S. visitors comprised approximately 20% of ePorner’s
userbase and because ePorner featured geotargeted
advertisements, had terms of service agreements with U.S.
customers, and used a U.S. domain name server. Id. at
1210–12. Although the case involved the federal long arm
                    BRISKIN V. SHOPIFY, INC.                23

provision, see Fed. R. Civ. P. 4(k)(2), the same due process
requirements applied. See AMA, 970 F.3d at 1207–08.
    We held that the district court did not have specific
jurisdiction over ePorner’s Polish operators. That was
because the case differed from Mavrix in several material
respects relevant here. Id. at 1210. First, unlike the website
in Mavrix, ePorner’s subject matter did not have a “forum-
specific focus.” Id. Instead, it was a global website with
80% of its viewers located outside of the United States. Id.
Second, it was individual users, not ePorner, that uploaded
U.S.-generated content, so the popularity of that content was
a consequence of users’ actions rather than evidence of
ePorner’s intention to target the U.S. market. Id. Although
the defendants “may have foreseen that ePorner would
attract a substantial number of viewers in the United States,”
this was not sufficient to establish express aiming. Id. Third,
the use of geo-located advertisements did not constitute
express aiming when users in every forum—including
forums outside of the United States—would receive ads
targeted to their locations. Id. at 1211. “If such geo-located
advertisements constituted express aiming,” we reasoned,
“ePorner could be said to expressly aim at any forum in
which a user views the website.” Id. (emphasis in original).
This, too, was different than Mavrix, which involved
advertisements that specifically “targeted California
residents.” Id. ePorner’s “advertising structure” presented
another key difference because ePorner used “a third-party
advertising company” and did not “control the
advertisements shown on the site.” Id. In sum, because “the
United States was not ‘the focal point’ of the website ‘and of
the harm suffered,’” there was no express aiming. Id. at
1212 (quoting Walden, 571 U.S. at 287).
24                  BRISKIN V. SHOPIFY, INC.

    The third case in this line is Will Co. See 47 F.4th 917.
Will Co. was a Japanese entertainment producer that made
adult videos. Id. at 919. It sold its copyrighted videos in the
United States. Id. Will Co. later learned that ThisAV.com,
a video-hosting site based in Hong Kong, was displaying its
videos without permission. Id. Will Co. then sued the
owners of ThisAV.com for copyright infringement in federal
court. Id.
    We held that ThisAV.com’s operators were subject to
personal jurisdiction in the United States. Id. at 927; see
generally Fed. R. Civ. P. 4(k)(2). Unlike in AMA, there were
key features of ThisAV.com’s business model that evinced
a forum-specific focus. Important to our analysis was that
the company hosted its website on servers in Utah and
purchased content delivery network services for North
America, which made its website load faster in the United
States than in other countries. 47 F.4th at 924–95. This
helped the defendant increase its success in the U.S. market
and showed that it was “motivated to appeal to viewers in
the United States more than any other geographical
location.” Id. at 925. In addition, we noted that the legal
compliance materials on ThisAV.com’s website were
“relevant almost exclusively to viewers in the United
States.” Id. From the combination of U.S.-focused
technology and U.S.-focused compliance materials, we
inferred that the platform operators “prepared for U.S.
visitors to the exclusion of all others,” and on this basis
found express aiming at the United States. Id. at 926.
    Taking Mavrix, AMA, and Will Co. together, a few
through-lines emerge. First, the fact that a broadly
accessible web platform knowingly profits from consumers
in the forum state is not sufficient to show that the defendant
                     BRISKIN V. SHOPIFY, INC.                 25

is expressly aiming its intentional conduct there. See AMA,
970 F.3d at 1210; see also Will Co., 47 F.4th at 926.
    Second, to establish the “something more” needed to
demonstrate express aiming in suits against internet
platforms, Herbal Brands, 72 F.4th at 1092, the plaintiff
must allege that the defendant platform has a “forum-
specific focus.” AMA, 970 F.3d at 1210. Alternatively, the
plaintiff must allege that the defendant is specifically
“appeal[ing] to . . . an audience in a particular state,” Mavrix,
647 F.3d at 1231, or “actively target[ing]” the forum state,
Will Co., 47 F.4th at 923. This express aiming can be shown
in different ways, such as through the subject matter of the
website, see AMA, 970 F.3d at 1210; Mavrix, 647 F.3d at
1230; the defendant’s advertising, see AMA, 970 F.3d at
1210–11; Mavrix, 647 F.3d at 1230; or other aspects of its
business model, see Will Co., 47 F.4th at 924–25. What is
needed, though, is some prioritization of the forum state,
some differentiation of the forum state from other locations,
or some focused dedication to the forum state which permits
the conclusion that the defendant’s suit-related conduct
“create[s] a substantial connection” with the forum. Walden,
571 U.S. at 284. And that “substantial connection” must be
something substantial beyond the baseline connection that
the defendant’s internet presence already creates with every
jurisdiction through its universally accessible platform.
    Third, the specific nature and structure of the defendant’s
business matters. That is consistent with a fundamental
precept of personal jurisdiction doctrine, which is that a
defendant should be allowed to “‘structure its primary
conduct’ to lessen or avoid exposure to a given State’s
courts.” Ford, 141 S. Ct. at 1025 (quoting World-Wide
Volkswagen Corp. v. Woodson, 444 U.S. 286, 297 (1980))
(brackets omitted). Thus, under our cases, how the
26                  BRISKIN V. SHOPIFY, INC.

defendant operates and organizes its web-based platform
affects the “something more” analysis. See Will Co., 47
F.4th at 924–25 (concluding that “two key” features of the
defendant’s technology and legal compliance regime were
highly relevant); AMA, 970 F.3d at 1211 (treating as material
certain differences in website content and “advertising
structure” as compared to Mavrix).
    On this score, when considering a defendant’s business
structure, the role of third parties is important. Particularly
relevant to the defendant’s intent to aim activity toward the
forum state and its control over that activity is the role of
third parties in carrying out the defendant’s business
operations, whether that be through the website content,
advertising, or some other means. See AMA, 970 F.3d at
1210–11 (treating as less indicative of express aiming the
fact that the website’s content was uploaded by third parties
and that the defendant did not “personally control the
advertisements shown on the site”). Actions of third parties
that the defendant does not control, even those of the
defendant’s contractors, tend to be less reflective of the
defendant’s own express aiming toward the forum because
they invite a greater degree of attenuation between the
plaintiff’s injuries and the defendant’s jurisdictional
contacts. See id. at 1211.
                               3
    We think that these precedents and principles should
apply as well to a personal jurisdiction inquiry involving a
broadly accessible back-end web platform like Shopify that
processes consumer payments. We say so for several
reasons.
   The first is that Shopify’s web platform, which secures
consumer information, is not so different from the other
                    BRISKIN V. SHOPIFY, INC.                27

interactive websites we have previously considered. In
Mavrix, for example, the defendant celebrity gossip website
had various interactive features that involved the acquisition
of viewer information, such as consumer polls and requests
to subscribe to email newsletters and membership clubs. See
647 F.3d at 1222. And in AMA, the defendant evidently
received information about end-user location so that it could
deploy “geo-located advertisements, which tailor
advertisements based on the perceived location of the
viewer.” 970 F.3d at 1211; see also id. at 1220 n.2 (Gould,
J., dissenting) (explaining that ePorner is “more than a
purely passive website because it has interactive features,”
including consumers agreeing to terms and conditions of
use).
     To the extent Briskin argues that an online payment
platform’s extraction of consumer data reflects more
“active” engagement with the forum state than the conduct
at issue in our past interactive website cases, we do not think
those differences call for application of a fundamentally
different legal framework than the one set forth in Mavrix,
AMA, and Will Co. If forum-specific differences do exist in
a given case between an internet platform that obtains
purchaser information and one that obtains other user
information (such as their email addresses), those
differences can be accounted for when applying the
principles we have laid out above. They do not require a
completely different set of legal rules.
    The second main reason that we think Mavrix, AMA, and
Will Co. provide the right legal framework for this type of
case is that the due process concerns animating our internet-
activity personal jurisdiction cases apply here as well. As
we discussed above, our cases have consistently rejected the
suggestion that operating a website that is viewable
28                   BRISKIN V. SHOPIFY, INC.

anywhere means that the defendant is suable everywhere.
See Herbal Brands, 72 F.4th at 1091; CollegeSource, 653
F.3d at 1075–76; Cybersell, 130 F.3d at 420. Although there
are some differences between an interactive web platform
that predominantly offers content and one that processes
consumer transactions, the nationwide availability of these
platforms provides a common denominator that raises
consonant due process concerns.
    Briskin protests that, by this logic, Shopify will be able
to direct its activities to all fifty states and yet be free from
specific jurisdiction in each of them. That is not quite right
considering that Shopify will be subject to personal
jurisdiction in other fora, such as the jurisdictions where the
Shopify defendants are either incorporated or based. And
that is to say nothing of suits that plaintiffs could likely bring
against California merchants in California, who could in turn
seek relief against Shopify, as appropriate. But the broader
point is that Briskin’s objection would apply just as well to
the activities of any web-based business that operates
nationwide. Although Briskin’s objection is not without
force, our law has long recognized that as a matter of due
process, web-based platforms cannot be subject to specific
jurisdiction in any forum from which they are accessible,
which would lead to “the eventual demise of all restrictions”
on personal jurisdiction. CollegeSource, 653 F.3d at 1076
(quoting World-Wide Volkswagen Corp., 444 U.S. at 294).
    We also reject Briskin’s assertion that we should analyze
this case as if it involved the sale of physical goods through
an interactive website. In Herbal Brands, Inc. v. Photoplaza,
Inc., 72 F.4th 1085 (9th Cir. 2023), we held that “if a
defendant, in its regular course of business, sells a physical
product via an interactive website and causes that product to
be delivered to the forum, the defendant has purposefully
                    BRISKIN V. SHOPIFY, INC.                 29

directed its conduct at the forum such that the exercise of
personal jurisdiction may be appropriate.” Id. at 1088.
    Herbal Brands was a suit brought in Arizona against
New York defendants who had made allegedly unauthorized
sales of the plaintiff’s products in Arizona using Amazon’s
online storefront platform. Id. at 1088–89. We held the
defendants were subject to personal jurisdiction in Arizona
because “they created and maintained a distribution network
that reached the relevant forum by choosing to operate on a
universally accessible website that accepts orders from
residents of all fifty states and delivers products to all fifty
states.” Id. at 1094–95. We further made clear that in the
case of the online sale of physical goods, “the express aiming
inquiry does not require a showing that the defendant
targeted its advertising or operations at the forum,” although
the defendant still did have to “exercise some level of control
over the ultimate distribution of its products beyond simply
placing its products into the stream of commerce.” Id. at
1094.
    Herbal Brands does not govern the personal jurisdiction
inquiry here. Herbal Brands was clear that its “holding
answers only the narrow question whether a defendant’s sale
of a physical product to a consumer in the forum state via an
interactive website constitutes conduct expressly aimed at a
forum.” Id. at 1095. We specifically indicated in Herbal
Brands that “[i]f other internet activity is allegedly the
source of personal jurisdiction, cases such as Mavrix, AMA,
and Will Co. would continue to apply.” Id. (emphasis
added). Herbal Brands thus directed application of the very
precedents we have held should apply here.
   That guidance makes sense considering the logic of
Herbal Brands itself.    Herbal Brands specifically
30                  BRISKIN V. SHOPIFY, INC.

differentiated the online sales of physical products from
other internet-related activities. See id. at 1093–94. In
Herbal Brands, we explained that a different set of legal
rules should apply in the case of the online sale of physical
items because “[p]re-internet, the ‘distribution in the forum
state of goods originating elsewhere’ was a paradigmatic
example of conduct purposefully directed at the forum
state.” Id. at 1093 (quoting Schwarzenegger, 374 F.3d at
803). The Supreme Court’s decision in Keeton v. Hustler
Magazine, Inc., 465 U.S. 770 (1984), on which Briskin
relies, is similarly distinguishable because it too involved the
distribution of products into the forum state. Under Herbal
Brands, the sale of physical items through the internet is
simply different from other forms of internet activity, based
on long-held understandings about the jurisdictional
significance of physical shipments into a forum. That
traditional legal backdrop, however, does not extend to the
extraction of consumer data through an online transaction
involving a back-end payment processor.
    We thus hold that when analyzing whether a court has
personal jurisdiction over a web-based payment processor in
a suit alleging the unlawful extraction, retention, and sharing
of consumer data, the legal framework and principles that
should be brought to bear are those from Mavrix, AMA, and
Will Co.
                               C
   We now apply those principles to this case and hold that
Shopify has not expressly aimed its suit-related conduct
toward California.
    Shopify’s web payment platform does not have a
“forum-specific focus.” AMA, 970 F.3d at 1210. Nor has
Briskin alleged facts showing that Shopify is specifically
                    BRISKIN V. SHOPIFY, INC.               31

“appeal[ing] to . . . an audience in” California, Mavrix, 647
F.3d at 1231, or “actively target[ing]” the forum state, Will
Co., 47 F.4th at 923. Shopify’s platform is accessible across
the United States, and the platform is indifferent to the
location of either the merchant or the end consumer. No one
has alleged that Shopify alters its data collection activities
based on the location of a given online purchaser. It did not
prioritize consumers in California or specifically cultivate
them. Briskin would have suffered the same injury
regardless of whether IABMFG was a California company
and regardless of whether Briskin was physically located in
California when he made his purchase. As Briskin
acknowledged in his opening brief, Shopify “chose to extract
personal data from IABMFG’s customer’s—wherever
located—through the payment portal it created and
maintained.” (Emphasis added).
    Shopify, to be sure, no doubt benefits from consumers
who are present in California. But that California is a large
market does not answer the purposeful direction question
because a defendant foreseeably profiting from persons
making online purchases in California does not demonstrate
express aiming. See Walden, 571 U.S. at 289 (“Petitioner’s
actions in Georgia did not create sufficient contacts with
Nevada simply because he allegedly directed his conduct at
plaintiffs whom he knew had Nevada connections.”); AMA,
970 F.3d at 1210 (“Although [the defendants] may have
foreseen that ePorner would attract a substantial number of
viewers in the United States, this alone does not support a
finding of express aiming.”). And while Shopify does have
a sizeable merchant base in California, its extraction and
retention of consumer data depends on the actions of third-
party merchants who are engaged in independent
transactions that themselves do not depend on consumers
32                  BRISKIN V. SHOPIFY, INC.

being present in California. Cf. AMA, 970 F.3d at 1210
(“ePorner’s content is primarily uploaded by its users, and
the popularity or volume of U.S.-generated adult content
does not show that [the defendants] expressly aimed the site
at the U.S. market.”).
    Briskin offers some inventive hypotheticals in response,
but they are off target. Briskin asserts that what Shopify did
here was no different than physically placing a surveillance
device at a cash register in a California store and using it to
intercept customers’ payment details. He also analogizes
Shopify to a hypothetical food truck with a surveillance
device that operates in both California and Nevada but is
agnostic as to which state the truck is located.
    These hypotheticals fail to grasp the significance of
Shopify operating a broadly accessible web-based platform.
The nature of such an operation leads to due process
concerns when the implication of Briskin’s position is that
Shopify is subject to specific jurisdiction in every state.
Contrary to Walden’s clear command, Briskin would
effectively tie personal jurisdiction to the unilateral activity
of consumers or Shopify’s contacts with individual persons.
See Walden, 571 U.S. at 284. And unlike Briskin’s
hypotheticals, Shopify, by the allegations of the complaint,
did not place any kind of physical device in California. Cf.
Herbal Brands, 72 F.4th at 1093. It did not focus its efforts
on any particular location. And it did not interact with
consumers except as a result of the third-party decisions of
its merchants. Briskin’s hypotheticals involve a degree of
express aiming that is simply not present on the facts alleged.
    In holding that Shopify is not subject to specific
jurisdiction for Briskin’s claims, we do not suggest that the
extraction and retention of consumer data can never qualify
                    BRISKIN V. SHOPIFY, INC.               33

as express aiming. As we discussed above, the nature and
structure of a defendant’s business can affect the personal
jurisdiction analysis. In view of the “fact-intensive nature”
of the personal jurisdiction inquiry, Herbal Brands, 72 F.4th
at 1096, we have set forth the governing legal principles and
applied them to the facts alleged. But we do not purport to
decide how these principles may apply to online payment
platforms that are set up differently.
                              IV
    As a fallback, Briskin argues that if we conclude
personal jurisdiction is lacking, we should remand to allow
him the opportunity to take jurisdictional discovery of
Shopify. We review the denial of jurisdictional discovery
for abuse of discretion. Yamashita, 62 F.4th at 507. We will
not reverse a district court’s refusal to allow jurisdictional
discovery “except upon the clearest showing that denial of
discovery results in actual and substantial prejudice to the
complaining litigant.” Id. (quoting Boschetto, 539 F.3d at
1020).
    These demanding standards are not met here. In the
court below, Briskin requested leave to take jurisdictional
discovery in only two curt footnotes in his opposition briefs
to Shopify’s motions to dismiss. Briskin provided no
supporting argument in favor of this desired discovery. Nor
has Briskin explained what jurisdictional discovery would
accomplish or how it would change the result of this case.
See Yamashita, 22 F.4th at 507 (“[A] mere hunch that
discovery might yield jurisdictionally relevant facts, or bare
allegations in the face of specific denials, are insufficient
reasons for a court to grant jurisdictional discovery.”
(quoting LNS Enters., 22 F.4th at 864–65)). The problems
with Briskin’s theory of personal jurisdiction are endemic to
34                   BRISKIN V. SHOPIFY, INC.

the nature of his claims and Shopify’s business structure.
Although the district court did not explicitly address
Briskin’s request for discovery, the district court’s effective
denial of this request was not an abuse of discretion.
    Because we conclude that Shopify is not subject to
specific jurisdiction, we need not address the district court’s
additional determination that the complaint failed to comply
with Federal Rule of Civil Procedure 8 by insufficiently
detailing how each Shopify defendant had wronged Briskin.
                       *        *       *
     The judgment of the district court is
     AFFIRMED.