If You’re Everywhere, Can You Be Sued Anywhere? A Circuit Split on Online Jurisdiction

Companies operating websites and deploying virtual tracking technologies may ask: when a company markets to customers nationwide, can it be subject to personal jurisdiction—and thus amenable to suit—in every state? An apparent Circuit split between the Third and Ninth Circuits means it may depend. 

Federal courts have long agreed that due process under the Fourteenth Amendment limits a court’s exercise of personal jurisdiction on state-law or diversity claims to defendants who maintain “certain minimum contacts” with the forum state.  The “minimum contacts” test is intended to ensure that “traditional notions of fair play and substantial justice” are respected. International Shoe Co. v. Washington, 326 U. S. 310, 316 (1945). 

The Supreme Court has since established that, at least for claims sounding in tort, specific jurisdiction may exist even where an out-of-state defendant’s conduct occurs entirely outside the forum state: under the Calder v. Jones “effects” test, a court may exercise specific jurisdiction over a defendant in certain instances if the defendant’s intentional conduct is “expressly aimed” at that state and causes harm there. 465 U.S. 783 (1984). This inquiry focuses on the defendant’s own conduct and whether it “meaningfully” connects with the forum state. Walden v. Fiore, 571 U.S. 277, 284-85 (2014).  “[T]the plaintiff cannot be the only link between the defendant and the forum.” Id. at 285. 

Critically, the Supreme Court left “for another day” resolution of what kind of virtual contacts with a state will qualify as providing the necessary minimum connection. Id. at 290, n. 9. The Supreme Court’s silence on that question has prompted the Ninth and Third circuits to disagree on the answer. 

Briskin v. Shopify

In Briskin v. Shopify, 135 F.4th 739 (9th Cir. 2025), the Ninth Circuit considered whether Shopify, an e-commerce platform that provides payment processing services nationally, was subject to personal jurisdiction in California.  The plaintiff argued that jurisdiction was proper based on Shopify allegedly installing permanent tracking cookies on the plaintiff’s device without his consent in violation of California data privacy laws. The district court and a three-judge panel of the Ninth Circuit concluded that Shopify was not subject to personal jurisdiction because “Shopify’s platform is accessible across the United States, and the platform is indifferent to the location of either the merchant or the end consumer.” Id. at 422. In other words, the Ninth Circuit reasoned that “Shopify’s web payment platform does not have a ‘forum-specific focus[,]’” is not “specifically ‘appeal[ing] to … an audience in’ California[,]” and is not “‘actively target[ing]’ the forum state.” Id. 

After the Ninth Circuit granted rehearing en banc, the parties agreed that Shopify’s conduct was intentional and caused harm in California but disputed whether Shopify had “expressly aimed” its conduct at the state or was mere “happenstance arising from [Briskin’s] choice to do business with a merchant that has contracted with Shopify.” 135 F.4th at 756. Relying on AMA Multimedia, LLC v. Wanat, 970 F.3d 1201 (9th Cir. 2020), Shopify argued it did not expressly aim its conduct at California because it operates nationwide and was thus “agnostic” as to the location of its data-mining activities. Accordingly, Shopify claimed it lacked a “forum-specific” focus. 

The full Ninth Circuit disagreed, overruling AMA Multimedia to set out a new rule: an interactive platform “expressly aims” its conduct at a forum state “when its contacts are its own choice and not random, isolated, or fortuitous, even if the platform cultivates a nationwide audience for commercial gain.” 135 F.4th at 758.  Requiring differential targeting, i.e., some “differential treatment of the forum state,” the court reasoned, “would have the perverse effect of allowing a corporation to direct its activities toward all 50 states yet to escape specific personal jurisdiction in each of those states” for claims arising from any harm resulting from its activities in those states. Id. However, the court was careful to note that while differential targeting is no longer a prerequisite for a finding of express aiming, “such treatment may serve as evidence that a defendant expressly aimed its conduct toward the forum state.” Id.

The court also distinguished Walden, emphasizing that Shopify is “meaningfully” connected to California because, unlike in Walden—where the plaintiffs were “the only link” between the defendant and the forum—Shopify “knows about its California consumer base, conducts its regular business in California, contacts California residents, interacts with them as an intermediary for its merchants, installs its software onto their devices in California, and continues to track their activities.” Id. at 759. The court also did not regard Shopify’s conduct as happenstance due to its “[alleged knowledge of] the location of consumers like [plaintiff] either prior to or shortly after installing its initial tracking software onto their devices.”  Id. at 756.  Analogizing to our pre-internet world, the Ninth Circuit reasoned “there would be no doubt that the California courts would have specific personal jurisdiction over a third party who physically entered a Californian’s home by deceptive means to take personal information from the Californian’s files for its own commercial gains.” Briskin, 135 F.4th at 756.

As to the concern that its ruling could expose Shopify to jurisdiction in all 50 states, the court was unmoved: “That may be true, but not unfair, if the contacts Shopify makes in all 50 states are like its California contacts.” Id. at 761.

Hasson v. FullStory

In Hasson v. FullStory, 114 F.4th 181 (3d Cir. 2024), the Third Circuit considered two consolidated appeals of class actions involving customer analytics company FullStory and allegations that it produced code that wiretapped users’ online communications without their consent. Plaintiffs sued FullStory and Papa John’s International (trading as Papa Johns), which had deployed FullStory’s code on its own website. 

In their appeal, plaintiffs challenged the district court’s finding that it lacked jurisdiction over the defendants. The Third Circuit agreed with the district court, finding that plaintiffs failed to demonstrate that Papa Johns expressly aimed the code at Pennsylvania, the forum state. Hasson, 114 F.4th at 191-192. The court noted that merely operating a website accessible in Pennsylvania does not constitute express aiming, especially when the website targets a national audience. Id. Unlike the Ninth Circuit in Briskin, the Third Circuit reasoned that Papa Johns’ “transmission of Session Replay Code onto [plaintiff’s] browser” in Pennsylvania “present[ed] … very different questions [of] whether and how a defendant’s virtual ‘presence’ and conduct translate into ‘contacts’ with a particular State.” Id. at 191. The plaintiffs’ allegations did not show that Papa Johns knew users were in Pennsylvania before deploying the code, nor did they demonstrate that the company tailored its website content specifically for Pennsylvania. In fact, the court found “[a]t a minimum, [plaintiff] had to allege that Papa Johns knew that a given user was in Pennsylvania before it sent the code to that user’s browser.” Hasson, 114 F.4th at 191. Thus, the court “decline[d] to hold that Papa Johns’ use of Session Replay Code constitutes a physical entry into Pennsylvania sufficient to support the exercise of jurisdiction” because Papa Johns did not expressly aim its use of FullStory’s code at Pennsylvania.[1]  Id.

Similar Facts, Different Outcomes

These two decisions highlight a potential tension between the Third and Ninth Circuits on the question of whether a business “expressly aims” its conduct towards a specific forum when it has a virtual nationwide presence. Under Briskin, a company with a website that is knowingly and specifically targeted at users within the Ninth Circuit, and which tracks or collects personal information should assume it may face jurisdiction there for privacy or other tort-related claims.  Where a website creates contacts with a state through the company’s “own choice” and not random or fortuitous occurrences—via third-party users and operators, for example—Ninth Circuit precedent now supports the exercise of personal jurisdiction. Under Hasson, that same conduct may not give rise to personal jurisdiction, at least where the plaintiff does not allege pre-conduct knowledge of the plaintiff’s physical location. The fact that a consumer may suffer harm from a company in a certain state, without more, does not mean that the business targeted the forum state. 

What This Means for Businesses

In light of this landscape, businesses should consider the following: 

• Tracking technology can lead to jurisdictional exposure. Companies deploying cookies, pixels, session replay tools, or similar code on nationally accessible websites may be subject to jurisdiction in California—and potentially any Ninth Circuit state—for claims arising from that technology. The Third Circuit offers a more protective framework for now, but its durability is uncertain.
• Personal jurisdiction remains a fact-intensive question. Both Briskin and Hasson underscore that personal jurisdiction based on the effects test may hinge on specific business decisions and whether they demonstrate that a company intended to target a specific state. In Will Co., Ltd. v. Lee, 47 F.4th 917 (9th Cir. 2022), for example, the Ninth Circuit concluded that the defendants, who operated a website, had met the “purposefully directed” prong of the effects test because they “intent[ed] to cultivate an audience in the United States”: the website was structured to reduce the time it would take to load in the United States, the company partnered with network providers to improve the United States audience experience, and the company addressed its terms and conditions towards a United States-based audience. Businesses should assess their business practices in light of this reasoning.
• Supreme Court review is plausible. Both opinions cite Walden’s reservation of “virtual contacts” questions. Their different reasoning and ultimate conclusions based on similar facts may create a strong vehicle for certification of this question before the Supreme Court. The question the Supreme Court left for “another day” may soon demand an answer.

To receive the latest insights on US legal developments, subscribe to the Freshfields A Fresh Take Blog.