`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Case 4:21-cv-06269-PJH Document 60 Filed 03/16/22 Page 1 of 21
`
`
`
`
`
`GUTRIDE SAFIER LLP
`SETH A. SAFIER (SBN 197427)
`seth@gutridesafier.com
`MARIE MCCRARY (SBN 262670)
`marie@gutridesafier.com
`TODD KENNEDY (SBN 250267)
`todd@gutridesafier.com
` HAYLEY REYNOLDS (SBN 306427)
`hayley@gutridesafier.com
`100 Pine Street, Suite 1250
`San Francisco, California 94111
`Telephone: (415) 639-9090
`Facsimile: (415) 449-6469
`
`KALI BACKER (admitted pro hac vice)
`kali@gutridesafier.com
`4450 Arapahoe Ave., Suite 100
`Boulder, Colorado 80303
`Telephone: (415) 639-9090
`Facsimile: (415) 449-6469
`
`Attorneys for Plaintiff
`
`
`
`UNITED STATES DISTRICT COURT
`
`NORTHERN DISTRICT OF CALIFORNIA
`
`OAKLAND DIVISION
`
`
`BRANDON BRISKIN on behalf of himself and
`all others similarly situated,
`
`
`
`
`
`SHOPIFY INC.; SHOPIFY (USA), INC.; and
`SHOPIFY PAYMENTS (USA), INC.,
`
`
`
`
`CASE NO. 4:21-cv-06269-PJH
`
`PLAINTIFF’S OPPOSITION TO
`SHOPIFY PAYMENTS (USA) INC.’S
`MOTION TO DISMISS THE SECOND
`AMENDED COMPLAINT
`
`
`Date:
`Time:
`Judge:
`
`
`April 28, 2022
`1:30 p.m.
`Hon. Phyllis Hamilton
`
`Plaintiff,
`
`Defendants.
`
`
`
`v.
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`PL.’S OPP. TO SHOPIFY PAYMENTS (USA) INC.’S MTN. TO DISMISS SAC
`
`

`

`Case 4:21-cv-06269-PJH Document 60 Filed 03/16/22 Page 2 of 21
`
`
`
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`I.
`II.
`III.
`IV.
`
`V.
`
`
`
`
`
`
`
`
`
`L
`
`TABLE OF CONTENTS
`
`INTRODUCTION.................................................................................................................1
`BACKGROUND...................................................................................................................2
`LEGAL STANDARD...........................................................................................................4
`ARGUMENT ........................................................................................................................4
`A.
`The Court Has Personal Jurisdiction Over Shopify Payments..................................4
`Shopify Payments purposefully directed its activities toward the
`1.
`forum. ............................................................................................................5
`Plaintiff’s claims arise from Defendants’ contact with California...............9
`It is reasonable to exercise jurisdiction over Shopify Payments in
`California. ...................................................................................................10
`The SAC Gives Defendants Adequate Notice Pursuant to Rule 8..........................10
`Plaintiff Did Not Consent to Defendants’ Tortious Conduct..................................10
`Plaintiff States a Claim Under § 631(A). ................................................................11
`Plaintiff States a Claim Under § 635.......................................................................12
`Plaintiff States a Claim For Privacy Violations Under The California
`
`B.
`C.
`D.
`E.
`F.
`
`2.
`3.
`
`Constitution and California Common Law Intrusion Upon Seclusion. ..................13
`Plaintiff States a Claim Under § 502.......................................................................13
`G.
`Plaintiff States a Claim Under the UCL Against Shopify Payments. .....................14
`H.
`CONCLUSION ...................................................................................................................17
`
`
`- i -
`PL.’S OPP. TO SHOPIFY PAYMENTS (USA) INC.’S MTN. TO DISMISS SAC
`
`
`

`

`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Case 4:21-cv-06269-PJH Document 60 Filed 03/16/22 Page 3 of 21
`
`
`
`TABLE OF AUTHORITIES
`
`CASES
`Ashcroft v. Iqbal, 556 U.S. 662 (2009) .........................................................................................4
`
`Baton v. Ledger SAS, 2021 U.S. Dist. LEXIS 215793 (N.D. Cal. Nov. 8, 2021).........................9
`
`Bell Atl. Corp. v. Twombly, 550 U.S. 544 (2007) .........................................................................4
`
`Bergstein v. Parmar, 2014 WL 12586073 (C.D. Cal. June 23, 2014)..........................................7
`
`Boschetto v. Hansing, 539 F.3d 1011 (9th Cir. 2008).................................................................11
`
`Burger King v. Rudzewicz, 471 U.S. 462 (1985) ..........................................................................8
`
`Calder v. Jones, 465 U.S. 783 (1984) ...........................................................................................5
`
`College Source, Inc. v. AcademyOne, Inc., 653 F.3d 1066 (9th Cir. 2011)..................................6
`
`Collins v. eMachines, Inc., 202 Cal. App. 4th 249 (2011)..........................................................17
`
`Daugherty v. Am. Honda Motor Co., 144 Cal. App. 4th 824 (2006)..........................................17
`
`Doe v. Successfulmatch.com, 70 F. Supp.3d 1066 (N.D. Cal. 2014)..........................................18
`
`Ford Motor Co. v. Mont. Eighth Judicial Dist. Ct., 141 S. Ct. 1017 (2021) ..........................8, 10
`
`Harris Rutsky & Co. Ins. Servs., Inc. v. Bell & Clements Ltd., 328 F.3d 1122 (9th
`
`Cir. 2003) ................................................................................................................................5
`Hernandez v. Hillsides, Inc., 47 Cal. 4th 272 (2009) ..................................................................14
`Hernandez v. Path, Inc., 2012 U.S. Dist. LEXIS 151035 (N.D. Cal. Oct. 17, 2012).................15
`
`HiQ Labs, Inc. v. LinkedIn Corp., 938 F. 3d 985 (9th Cir. 2019).................................................7
`
`In re Adobe Sys. Privacy Litig., 66 F. Supp. 3d 1197 (N.D. Cal. 2014) .....................................17
`
`In re Carrier IQ, Inc., Privacy Litig., 78 F. Supp. 3d 1051 (N.D. Cal. 2015) ............................14
`
`In re Facebook Inc. Internet Tracking Litig., 956 F.3d 589 (9th Cir. 2020) ..............................13
`
`In re iPhone Application Litig., 844 F. Supp. 2d 1040 (N.D. Cal. 2012) ...................................19
`
`In re Nexus 6P Prods. Liab. Litig., 2018 U.S. Dist. LEXIS 23622 (N.D. Cal. Feb.
`
`12, 2018) ...............................................................................................................................12
`
`Kasky v. Nike, Inc., 45 P.3d 243 (Cal. 2002) ..............................................................................16
`
`Lisa McConnell, Inc. v. Idearc, Inc., 2010 WL 364172 (S.D. Cal. 2010) ...............................10
`
`Lukis v. Whitepages, Inc., 454 F. Supp. 3d 746 (N.D. Ill. 2020) ..................................................6
`
`
`
`
`- ii -
`PL.’S OPP. TO SHOPIFY PAYMENTS (USA) INC.’S MTN. TO DISMISS SAC
`
`
`L
`
`

`

`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Case 4:21-cv-06269-PJH Document 60 Filed 03/16/22 Page 4 of 21
`
`
`
`Mavrix Photo, Inc. v. Brand Techs., Inc.,647 F.3d 1218 (9th Cir. 2011) .............................5, 6, 8
`
`McCoy v. Alphabet, Inc.,2021 U.S. Dist. LEXIS 24180 (N.D. Cal. Feb. 2, 2021).....................19
`
`Myers v. Bennett Law Offices, 238 F.3d 1068 (9th Cir. 2001) ...................................................10
`
`Nguyen v. Barnes & Noble, Inc., 763 F. 3d 1171 (9th Cir. 2014)...............................................12
`
`Picot v. Weston, 780 F.3d 1206 (9th Cir. 2015)......................................................................8, 11
`
`Ranza v. Nike, Inc., 793 F.3d 1059 (9th Cir. 2015) ......................................................................4
`
`Ribas v. Clark, 696 P.2d 637 (1985)...........................................................................................18
`
`Rivera v. Peri & Sons Farms, Inc., 735 F.3d 892 (9th Cir. 2013) ..............................................12
`
`S.D. v. Hytto Ltd., 2019 WL 8333519 (N.D. Cal. May 15, 2019) ................................................7
`
`Schwarzenegger v. Fred Martin Motor Co., 374 F.3d 797 (9th Cir. 2004)..................................4
`
`Sher v. Johnson, 911 F.2d 1357 (9th Cir. 1990) .........................................................................11
`
`Silver v. Stripe, Inc., 2021 U.S. Dist. LEXIS 141090 (N.D. Cal. July 28, 2021) .................12, 15
`
`Usher v. City of Los Angeles, 828 F.2d 556 (9th Cir. 1987).........................................................4
`
`Walden v. Fiore, 134 S. Ct. 1115 (2014) ......................................................................................8
`
`WhatsApp Inc. v. NSO Grp. Techs., Ltd., 472 F. Supp. 3d 649 (N.D. Cal. 2020) ........................7
`
`Yahoo! Inc. v. La Ligue Contre Le Racisme et L’Antisemitisme, 433 F.3d 1199 (9th
`
`Cir. 2006) ................................................................................................................................5
`STATUTES
`Cal. Pen. Code § 631(a) ..............................................................................................................11
`
`Cal. Penal Code § 502...................................................................................................................1
`
`Cal. Penal Code § 635.................................................................................................................12
`
`Cal. Penal Code §§ 631 and 635 .................................................................................................13
`OTHER AUTHORITIES
`18 U.S.C. § 2511(1)(a)................................................................................................................11
`
`
`
`
`
`
`
`
`L
`
`
`- iii -
`PL.’S OPP. TO SHOPIFY PAYMENTS (USA) INC.’S MTN. TO DISMISS SAC
`
`
`

`

`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Case 4:21-cv-06269-PJH Document 60 Filed 03/16/22 Page 5 of 21
`
`INTRODUCTION
`
`
`
`I.
`
`Few types of information are more private than a person’s finances. The question at the
`
`heart of this case is whether Defendants Shopify Inc. (“Shopify”), Shopify (USA), Inc. (“Shopify
`
`USA”), and Shopify Payments (USA), Inc. (“Shopify Payments”) (collectively “Defendants”) can
`
`secretly track and collect intimate details about consumers’ financial transactions, aggregate those
`
`details into profiles, and share the information with their own merchants and third parties to
`
`consumers’ detriment. Defendants accomplish this surreptitious data collection by concealing their
`
`presence on merchants’ websites with embedded software. When consumers begin the checkout
`
`process on a merchant’s website, like IABMFG, for example, they go to a payment form that
`
`appears to belong to the merchant, and, as a result, believe they are communicating only with the
`
`merchant. In reality, however, Defendants generate the payment form and use it to intercept
`
`consumers’ information to send directly to their own servers.
`
`Because Defendants do not ask for permission from the outset, consumers have no idea
`
`what happens to their data. Behind the scenes, Defendants use it to build individual profiles and
`
`provide analysis on transactions to their merchants, thereby allowing them to profit from their
`
`unlawful conduct. Those merchants, in turn, use the information to prejudge consumers, including
`
`refusing to do business with some consumers entirely. Defendants also share consumer data with
`
`third parties, like Stripe, Inc., that also build their own consumer profiles. Because Defendants
`
`remain hidden at all points in the transaction, they deprive consumers of the right to opt out of the
`
`collection, use, and disclosure of their own data—a right protected under California law.
`
`Given the lengths to which Defendants have exploited consumer data, it should come as no
`
`surprise that they launch a litany of defenses. They claim the Court lacks personal jurisdiction over
`
`them, even though Defendants subjected themselves to this forum by committing intentional acts
`
`that targeted California consumers. Defendants also rely on three policies—two of which were not
`
`even posted on websites Plaintiff viewed—to contend that Plaintiff consented to their conduct. But
`
`these are unenforceable browsewrap policies.
`
`Defendants’ other arguments are equally flawed. Plaintiff states a claim under Cal. Penal
`
`Code § 502 because Defendants accessed his data by sending him software code that caused his
`
`
`
`
`- 1 -
`PL.’S OPP. TO SHOPIFY PAYMENTS (USA) INC.’S MTN. TO DISMISS SAC
`
`
`L
`
`

`

`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Case 4:21-cv-06269-PJH Document 60 Filed 03/16/22 Page 6 of 21
`
`
`
`device to send his private information to Defendants. Plaintiff also plausibly alleges claims for all
`
`three types of Unfair Competition Law (UCL) claims. For these reasons, the Court should deny
`
`Shopify Payments’ motion.
`II.
`
`BACKGROUND
`
`Defendants run an e-commerce platform that provides payment processing services to
`
`millions of merchants across the internet. Second Amended Complaint (SAC) ¶ 24. Defendants
`
`embed their software into merchants’ websites. Id. When a consumer begins the checkout process
`
`with one of Shopify’s merchant customers, the software makes it appear that the consumer
`
`communicates directly with the merchant. Id. at ¶¶ 1–2, 4, 25–35, 82. But, in reality, it sends no
`
`information to the merchant. Id. Rather, Defendants’ software generates the payment form and
`
`directs to themselves all information entered into it. Id. Defendants also install cookies on users’
`
`browsers that track consumers’ transactions across the Shopify merchant network. Id. ¶¶ 5, 38-41.
`
`Defendants do not inform consumers about any of this conduct. Because they conceal their
`
`involvement by omitting their branding from the payment forms, Defendants collect—without
`
`permission—sensitive private information, including consumers’ full names, addresses, email
`
`addresses, credit card numbers, IP addresses, the items purchased, and geolocation. Id. ¶¶ 22–3,
`
`40, 81.
`
`Once Defendants collect the data, they can decipher what data emanates from California
`
`because they have consumers’ billing addresses and geolocations. Id. If they wanted, they could
`
`end their intrusion there and disregard the data. Instead, Defendants take additional steps to use
`
`data from California and make it profitable for themselves and their merchants. One of the ways
`
`they do so is by compiling the data into individualized profiles. Id. ¶¶ 6, 42-45. Defendants share
`
`information within the profiles with their merchants. Id. The information is valuable to the
`
`merchants because they provide insights into consumers’ creditworthiness before the transaction is
`
`final. Id. When a consumer from California makes a purchase, Defendants use the consumer’s data
`
`to provide their merchants with an “analysis” of the order that cross-references the details of the
`
`new transaction with the consumer’s purchase history to identify potential areas of fraud. Id. ¶ 43.
`
`Some indicators Defendants flag for their merchants include: the location of the IP address used to
`
`
`
`
`- 2 -
`PL.’S OPP. TO SHOPIFY PAYMENTS (USA) INC.’S MTN. TO DISMISS SAC
`
`
`L
`
`

`

`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Case 4:21-cv-06269-PJH Document 60 Filed 03/16/22 Page 7 of 21
`
`
`
`place the order, the distance of the shipping address from the IP address, whether the billing ZIP
`
`code “matches the credit card’s registered address,” and whether “[c]haracteristics of [the] order
`
`are similar to non-fraudulent orders observed in the past.” Id. The analysis is a powerful tool; it
`
`gives Shopify merchants an advantage over retailers who do not use Defendants’ services and the
`
`ability to reject the transaction altogether. Id. ¶¶ 43-45.
`
`In addition to building profiles and analyzing their data, Defendants also use Californians’
`
`data by sharing it with other non-merchant third-parties, such as Stripe and MaxMind, who, in
`
`turn, use the data to feed their own profiles on users. Id. ¶¶ 15-16, 46–47. Through these collective
`
`actions, Defendants directly target and exploit the California market.
`
`
`
`The overall relationship among the Defendants is worth clarifying. Shopify operates the
`
`overall e-commerce platform, and Shopify USA processes consumer data from the platform. Id. at
`
`¶¶ 10, 14-15. In order to obtain Shopify’s e-commerce services, merchants must contract with
`
`Shopify directly. Id. at ¶ 10. Beyond its general e-commerce services, Shopify offers other,
`
`separate features for which merchants have to pay additional fees. One of those features is online
`
`payment processing. Id. at ¶ 15. Shopify Payments runs the payment processing feature. Id. Thus,
`
`in order to obtain payment processing, Shopify merchants must separately contract with Shopify
`Payments.1 Id. Though Shopify Payments manages Shopify’s payment processing feature, it does
`not do the actual work of processing merchants’ payments. Instead, it outsources it to Stripe. Id. at
`
`¶¶ 15-16.
`
`Shopify Payments’ terms of service with its merchants confirms Plaintiff’s allegations. See
`ECF 53 at 8,2 It establishes that “both Shopify and Stripe may collect or receive certain personal
`data about [merchants] and [their] customers.” Id. It also confirms that Shopify Payments and
`
`Stripe “collect, use, retain and disclose [] Cardholder Data that [merchants] provide to [them] or
`
`1 Shopify Payments argues that the fact that the SAC quotes from a version of the contract that
`“was not in effect at the time of Plaintiff made his purchase” somehow defeats Plaintiff’s claims.
`See ECF 53 at 8. It does not. Importantly, Shopify Payments does not dispute that it contracted
`with California merchants at the time of Plaintiff’s purchase. And, if anything, the older version
`of the contract confirms Plaintiff’s allegations, as explained below.
`2 Available at
`https://web.archive.org/web/20200212224322/https:/www.shopify.com/legal/terms-payments-us.
`
`
`
`
`- 3 -
`PL.’S OPP. TO SHOPIFY PAYMENTS (USA) INC.’S MTN. TO DISMISS SAC
`
`
`L
`
`

`

`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Case 4:21-cv-06269-PJH Document 60 Filed 03/16/22 Page 8 of 21
`
`
`
`authorize [them] to collect, including information that we may collect directly from your end users
`
`via cookies or other means.” Id. None of this conduct was disclosed to consumers in the course of
`
`their transactions on Shopify’s platform.
`III. LEGAL STANDARD
`“Where, as here, the defendant’s motion [to dismiss for lack of personal jurisdiction] is
`
`based on written materials rather than an evidentiary hearing, the plaintiff need only make a prima
`
`facie showing of jurisdictional facts to withstand” it. Ranza v. Nike, Inc., 793 F.3d 1059, 1068 (9th
`
`Cir. 2015) (citation omitted). The Court must accept Plaintiff’s uncontroverted allegations as true,
`
`and resolve any factual disputes in conflicting affidavits in the plaintiff’s favor. Schwarzenegger v.
`
`Fred Martin Motor Co., 374 F.3d 797, 800 (9th Cir. 2004).
`
`To survive a Rule 12(b)(6) motion, the claimant must allege “enough facts to state a claim
`
`to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). The
`
`court must accept all factual allegations as true and draw all reasonable inferences in favor of the
`
`plaintiff. Usher v. City of Los Angeles, 828 F.2d 556, 561 (9th Cir. 1987). A claim is facially
`
`plausible when the plaintiff pleads facts that “allow the court to draw the reasonable inference that
`
`the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009)
`
`(citation omitted). This is not akin to a “probability requirement.” Id.
`IV. ARGUMENT
`A.
`The Court Has Personal Jurisdiction Over Shopify Payments.
`California’s long-arm statute permits the exercise of personal jurisdiction to the fullest
`
`extent allowed by the Due Process Clause. Harris Rutsky & Co. Ins. Servs., Inc. v. Bell &
`
`Clements Ltd., 328 F.3d 1122, 1129 (9th Cir. 2003). Jurisdiction comports with due process when
`
`the defendant has minimum contacts with the state. Ranza, 793 F.3d at 1068. For cases involving
`
`tortious conduct, such as here, the Ninth Circuit uses the following test to determine whether a
`
`non-resident defendant is subject to specific personal jurisdiction: (1) the non-resident defendant
`
`must purposefully direct his activities toward the forum; (2) the claim must arise out of or relates
`
`to the defendant’s forum-related activities; and (3) the exercise of jurisdiction must comport with
`
`
`
`
`L
`
`
`- 4 -
`PL.’S OPP. TO SHOPIFY PAYMENTS (USA) INC.’S MTN. TO DISMISS SAC
`
`
`

`

`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Case 4:21-cv-06269-PJH Document 60 Filed 03/16/22 Page 9 of 21
`
`
`
`fair play and substantial justice, i.e., be reasonable. Mavrix Photo, Inc. v. Brand Techs., Inc., 647
`
`F.3d 1218, 1228 (9th Cir. 2011).
`
` Plaintiff bears the burden of proving the first two prongs. Id. If Plaintiff succeeds, the
`
`burden shifts to Defendants to “set forth a compelling case that the exercise of jurisdiction would
`
`not be reasonable.” Id. at 1212. Shopify Payments’ brief focuses exclusively on the first two
`
`factors, so the last prong is not in dispute. See ECF 53 at 9-14.
`1.
`Shopify Payments purposefully directed its activities toward the forum.
`The “purposeful direction” element is straightforward. All it requires is a showing that
`
`defendants (1) committed an intentional act, (2) expressly aimed at the forum state, (3) caused
`
`harm that the defendant knew was likely to be suffered in the forum state. See Calder v. Jones, 465
`
`U.S. 783, 789–90 (1984). The inquiry focuses on “where the consequences of a defendant’s
`
`actions were felt, rather than where the actions occurred.” Yahoo! Inc. v. La Ligue Contre Le
`
`Racisme et L’Antisemitisme, 433 F.3d 1199, 1205–06 (9th Cir. 2006). Thus, jurisdiction is proper
`
`even if the defendant’s “only contact with the forum state is the purposeful direction of a foreign
`
`act having effect in the forum state.” See College Source, Inc. v. AcademyOne, Inc., 653 F.3d
`
`1066, 1076–77 (9th Cir. 2011) (internal citation omitted).
`
`In Mavrix Photo, the Ninth Circuit considered when tortious conduct on a nationally
`
`accessible website is expressly aimed at a particular forum. It explained that the “maintenance of a
`
`passive website alone cannot satisfy the express aiming prong.” Mavrix Photo, Inc., 647 F. 3d at
`
`1229. But, “operating even a passive website in conjunction with ‘something more’ — conduct
`
`directly targeting the forum — is sufficient.” Id. A defendant does “something more” when a
`
`defendant “specifically targeted” consumers in a state, Rio Properties, Inc. v. Rio Intern. Interlink,
`
`284 F. 3d 1007, 1020 (9th Cir. 2002), or when a defendant exploits the state market for its own
`commercial gain, Mavrix Photo, 647 F. 3d at 1229. Defendants did both.3
`
`3 To that end, Defendants’ attempt to silo the jurisdictional analysis into two separate “theories”—
`one based on Defendants’ collection, use and disclosure of Californians’ data and the other rooted
`in Shopify Inc.’s physical contacts with California—is simply wrong. See ECF 53 at 9-14. The
`Ninth Circuit, in Mavrix Photo, made clear that all of these contacts are to be examined
`collectively as factors in determining whether a defendant has done “something more” than simply
`operate a passive website. 647 F. 3d at 1229.
`
`
`
`
`- 5 -
`PL.’S OPP. TO SHOPIFY PAYMENTS (USA) INC.’S MTN. TO DISMISS SAC
`
`
`L
`
`

`

`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Case 4:21-cv-06269-PJH Document 60 Filed 03/16/22 Page 10 of 21
`
`
`
`This case is nearly identical to Lukis v. Whitepages, Inc., 454 F. Supp. 3d 746 (N.D. Ill.
`
`2020). There, the plaintiff alleged that Whitepages “knowingly searches for and obtains private
`
`and public records regarding Illinois residents,” “profiles them in free previews,” and “sells
`
`monthly subscriptions for background reports that it prepares from those records.” 454 F. Supp. at
`
`757. The court held the “actions qualify as the kind of ‘intentional contacts… with [Illinois]’
`
`required for the exercise of specific jurisdiction.” Id.
`
`Here, just as in Lukis, Defendants knowingly obtained data from California residents
`through the software code they embedded in their merchants’ websites.4 SAC ¶¶ 1–5, 24–41. They
`knew they acquired data from California because they collected consumers’ geolocations and
`
`billing addresses. Id. ¶¶ 7, 40, 51, 59, 81. In fact, Shopify Payments specifically admits that it
`
`collects consumer data. ECF 53-1 at ¶ 6. But Defendants did much more than simply collect data
`
`through their code. Rather, Defendants then took additional steps voluntarily to make use of the
`
`data behind the scenes, while knowing the data originated from California. In doing so, they
`
`targeted Californians for their own profit. As in Lukis, Defendants compiled the data into
`
`individualized profiles. SAC ¶ 7, 42-45, 103, 115, 124. They then leveraged their ability to
`
`synthesize the data by giving their merchants an “analysis” of the details of the particular
`
`transaction and how it compares to the consumers’ purchase history. Id. The value in the analysis
`
`is due to Defendants’ aggregation of data. No single merchant could create such an analysis on
`
`their own. Only Defendants can provide such insights because they track consumers’ transactions
`
`across their entire merchant network. These direct uses of Californians’ data caused injuries that
`
`occurred in California, including the invasion of privacy. Id. at ¶¶ 81-87, 94-96, 104-05, 114–118.
`
`As explained in Plaintiff’s Opposition to Shopify’s Motion to Dismiss (ECF 58),
`
`Defendants’ contacts went beyond knowingly collecting, analyzing, and cross-referencing
`
`
`4 Purposefully embedding code on consumers’ devices to collect and compile their personal
`financial information is an intentional act. See HiQ Labs, Inc. v. LinkedIn Corp., 938 F. 3d 985,
`1001 (9th Cir. 2019) (analogizing a CFAA cause of action to a digital “breaking and entering” and
`a “trespass” offense); WhatsApp Inc. v. NSO Grp. Techs., Ltd., 472 F. Supp. 3d 649, 661–62 (N.D.
`Cal. 2020) (sending code to servers and accessing them without authorization was an intentional
`act); S.D. v. Hytto Ltd., 2019 WL 8333519, at *2–8 (N.D. Cal. May 15, 2019) (wiretapping is an
`intentional act); Bergstein v. Parmar, 2014 WL 12586073 at *3–4 (C.D. Cal. June 23, 2014)
`(recording telephone conversations is an intentional act).
`
`
`
`
`- 6 -
`PL.’S OPP. TO SHOPIFY PAYMENTS (USA) INC.’S MTN. TO DISMISS SAC
`
`
`L
`
`

`

`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Case 4:21-cv-06269-PJH Document 60 Filed 03/16/22 Page 11 of 21
`
`
`
`Californians’ data. See ECF 58 (Pl. Opp. Shop. Br.) § IV(A)(1)-(2). Defendants exploited the
`
`California market by profiting off of California consumers they knew transacted through the
`
`payment forms, just like the defendant did in Mavrix Photo. See Mavrix Photo, Inc., 647 F.3d at
`
`1225-30.
`
`Shopify Payments has additional contacts with California as well. The Supreme Court has
`
`made clear that “entering a contractual relationship that ‘envisioned continuing and wide-reaching
`
`contacts’ in the forum State’” suffices for jurisdictional purposes. Walden v. Fiore, 134 S. Ct.
`
`1115, 1122 (2014); see also Ford Motor Co. v. Mont. Eighth Judicial Dist. Ct., 141 S. Ct. 1017,
`
`1025 (2021). Since at least 2014, Shopify Payments has had an ongoing relationship with Stripe,
`
`a California-based company with its headquarters in California. SAC ¶¶ 15-16; see also ECF 58-1
`
`(Backer Decl.), Ex. 5 (ECF 58-6) at 34. To say that Stripe is a critical part of Shopify Payments’
`
`business model would be an understatement since Shopify Payments depends exclusively on
`
`Stripe to perform the actual processing of credit cards. See id. (Backer Decl.), Ex. 5 (ECF 58-6)
`
`at 34. In other words, Shopify Payments relies entirely on a California-based company to perform
`
`the cornerstone feature of its of business.
`
`Shopify Payments argues that an “allegation that defendant entered into a contract with a
`
`California resident is insufficient to show that the defendant purposefully direct[ed] activities at
`
`California.” ECF 53 at 12 (internal quotations omitted.) But, as the cases Shopify Payments relies
`
`upon explain, the rule applies when the contract is with the plaintiff who is the only connection to
`
`the forum state. See, e.g., Burger King v. Rudzewicz, 471 U.S. 462, 478 (1985) (“If the question is
`
`whether an individual’s contract with an out-of-state party alone can automatically establish
`
`sufficient minimum contacts in the other party’s home forum, we believe the answer clearly is
`
`that it cannot.”); Picot v. Weston, 780 F.3d 1206, 1212 (9th Cir. 2015) (finding “a contract alone
`
`does not automatically establish minimum contacts in the plaintiff’s home forum”; ”[r]ather, there
`
`must be actions by the defendant himself that create a ‘substantial connection’ with the forum
`
`State.”) (internal citations and quotations omitted.)
`
`
`
`
`L
`
`
`- 7 -
`PL.’S OPP. TO SHOPIFY PAYMENTS (USA) INC.’S MTN. TO DISMISS SAC
`
`
`

`

`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Case 4:21-cv-06269-PJH Document 60 Filed 03/16/22 Page 12 of 21
`
`
`
`Here, by contrast, Plaintiff alleges that Shopify Payments entered into multiple contracts
`with California third-parties, including Stripe and the California merchants5 for whom it sold its
`services. SAC ¶¶ 15-16. Those contracts—along with its knowing use and disclosure of
`
`Californians’ data—demonstrate actions that Shopify Payments voluntarily took itself to create a
`
`substantial connection with the state.
`
`Defendants’ briefs pretend as if all of their alleged contacts with California are fortuitous
`
`because they provide services “nationwide and globally,” and that the contacts result from the
`
`actions of their merchants, not themselves. ECF 51 at 9; see also ECF 53 at 12. But, as explained
`
`above, that is simply not true. Defendants knowingly take Californians’ data and further process
`
`that data for their own commercial benefit. Shopify, in particular, also markets directly to
`
`California consumers and merchants. See ECF 58-1 (Backer Decl.), Exs. 3–4 (ECF 58-4 – ECF
`
`58-5); see also SAC, ¶¶ 11-12, 36-37, 56, 62. These contacts are completely of Defendants’ own
`
`making and constitute direct and purposeful contact with the forum that gives grise to Plaintiff’s
`
`claims. See Lukis, 454 F. Supp. 3d at 757.
`
`Defendants also rely on Baton v. Ledger SAS, 2021 U.S. Dist. LEXIS 215793 (N.D. Cal.
`
`Nov. 8, 2021) to resist jurisdiction. But none of the facts asserted here were at issue in that case.
`
`In Baton, the plaintiff argued that the court had specific jurisdiction over Defendants because one
`
`of their merchants, Ledger, derived 7% of its business from California. Id. at *15–16. The court
`
`refused to graft Ledger’s contacts with California onto Shopify or Shopify USA because the
`
`“contacts must be the defendant’s own choice.” Id. Here, by contrast, Plaintiff alleges that
`
`Shopify USA had direct contacts with California through the code it sent to users, its collection of
`
`Californians’ data, its creation of profiles about Californians and use of the data. These
`
`allegations subject Shopify USA to this Court’s jurisdiction.
`
`
`5 Shopify Payments makes much of the fact that not all of Shopify’s merchants use Shopify