Shopify Faces Landmark Privacy Lawsuit Over Customer Data Collection

TL;DR

Shopify is facing a significant data privacy lawsuit in the US, which could redefine how globally active companies are held accountable for data collection practices. The lawsuit, revived by the 9th Circuit Court, alleges that Shopify installed tracking cookies without consent and used the collected data to create profiles for sale. This decision has broad implications for internet-based companies and consumer protection laws.

Introduction

Shopify, a leading global commerce platform, is currently embroiled in a data privacy class action lawsuit in the United States. This lawsuit has the potential to reshape how globally active companies are held accountable for their data collection practices. The case, which was previously dismissed, has been revived by the full 9th Circuit Court of Appeals, setting a precedent that could impact internet-based platforms worldwide.

Background of the Lawsuit

Shopify’s Global Operations

Shopify, headquartered in Ottawa, Canada, provides essential infrastructure and tools for businesses of all sizes to manage their retail operations, both online and offline. To facilitate these services, Shopify collects personally identifiable information (PII) from buyers. This data includes:

• Names
• Email addresses
• Phone numbers
• Shipping and billing addresses
• IP addresses
• Device information
• Behavioral data

Shopify emphasizes that this data is collected solely to enhance the commerce experience and is protected by robust security measures in compliance with relevant privacy laws, including GDPR.

Allegations Against Shopify

Brandon Briskin, a California resident, alleges that Shopify installed tracking cookies on his iPhone without his consent during an online purchase. These cookies were purportedly used to create a profile that Shopify could sell to other merchants. Initially, the case was dismissed after Shopify argued that it should not be sued in California due to its nationwide operations.

However, the dismissal was overturned when judges found that Shopify’s actions were deliberate and targeted, stating:

“Shopify deliberately reached out … by knowingly installing tracking software onto unsuspecting Californians’ phones so that it could later sell the data it obtained, in a manner that was neither random, isolated, nor fortuitous.”

Implications of the Ruling

Shopify’s Response

A Shopify spokesperson told Reuters that the decision could make online retailers vulnerable to lawsuits anywhere, potentially disrupting the fundamental workings of the internet. The spokesperson expressed concern that this ruling could drag entrepreneurs running online businesses into distant courtrooms, regardless of their operational locations.

Legal and Regulatory Impact

The decision has been hailed as a significant step in holding internet-based companies accountable. Briskin’s lawyer emphasized that the court’s ruling rejects the notion that companies operating everywhere are jurisdictionally ‘nowhere.’ Many US states have supported this decision, asserting the need to enforce local consumer protection laws against companies operating through the internet.

The ruling could make it easier for American courts to assert jurisdiction over internet-based platforms. The majority of the 9th Circuit, which includes nine western US states, Guam, and the Northern Mariana Islands, adhered to the “traveling cookie rule” because it “impermissibly manufactures jurisdiction wherever the plaintiff goes.”

Conclusion

The lawsuit against Shopify highlights the growing scrutiny around data privacy and the collection of PII. As the digital landscape evolves, companies must navigate complex regulatory environments while ensuring consumer trust and compliance with privacy laws. This case serves as a reminder that data privacy is a critical concern for both businesses and consumers alike.

---

Additional Resources

For further insights, check:

• Malwarebytes Personal Data Remover
• Reuters Article on Shopify Lawsuit

References