In a ruling that could send shockwaves through the tech world, a U.S. appeals court on Monday resurrected a Shopify data privacy lawsuit, breathing new life into a proposed class action that accuses the Canadian e-commerce titan of covertly tracking online shoppers in California.

With a decisive 10-1 vote, the 9th U.S. Circuit Court of Appeals declared that Shopify can indeed face litigation in California over its use of tracking software—known as cookies—to gather personal information from Golden State residents who made purchases on merchant websites powered by Shopify.

A Cookie Crumbles in California

At the heart of the revived lawsuit is Brandon Briskin, a California consumer who claimed Shopify installed tracking cookies on his iPhone without permission when he bought athletic apparel from the retailer "I Am Becoming." According to the lawsuit, Shopify harvested Briskin’s data to construct a consumer profile, which it then allegedly sold to other businesses—without consent, and without transparency.

Shopify had sought to sidestep California's jurisdiction, arguing its business spanned the U.S. and was not specifically targeted at the state. The Ottawa-based company claimed Briskin should instead sue in Delaware, New York, or even Canada. But the full 9th Circuit wasn’t buying it.

Court: Shopify "Deliberately Reached Out"

Writing for the majority, Circuit Judge Kim McLane Wardlaw delivered a scathing assessment of Shopify’s conduct. She asserted that the company “deliberately reached out” to California by "knowingly installing tracking software onto unsuspecting Californians’ phones," calling the practice neither “random, isolated, nor fortuitous.”

The majority ruled that this purposeful interaction justified California courts asserting jurisdiction—a precedent-setting interpretation that could shape future litigation against online platforms operating on a global scale.

A Clash Over Digital Borders

The decision wasn’t unanimous. In a fiery dissent, Circuit Judge Consuelo Callahan criticized the majority's logic, calling it a “traveling cookie rule” that could create jurisdiction “wherever the plaintiff goes.” Her dissent warned that the ruling could dangerously stretch the reach of state courts, allowing legal claims to follow internet users across borders with little restraint.

Yet the prevailing opinion resonated beyond the courtroom. Briskin’s attorney, Matt McCrary, praised the court for refusing to let global tech firms "hide in plain sight," asserting that the ruling strengthens consumer protections by confirming that doing business everywhere doesn't mean being accountable nowhere.

State Attorneys General Join the Fight

In a rare bipartisan show of force, attorneys general from 30 states and Washington, D.C., filed briefs supporting Briskin. Their argument? That states must be able to enforce their consumer protection laws when companies actively engage with their residents through the internet. In their view, the digital marketplace doesn’t grant immunity from local laws—it demands accountability.

Meanwhile, the U.S. Chamber of Commerce took Shopify’s side, cautioning that the decision could spell trouble for back-end tech service providers whose software is used worldwide. The Chamber warned that a sweeping interpretation of jurisdiction could entangle companies in lawsuits anywhere their code happens to run—regardless of intent.

Ripple Effects Beyond Shopify

The Shopify data privacy lawsuit is more than a legal spat over cookies—it’s a flashpoint in the broader debate over digital privacy, platform responsibility, and the jurisdictional limits of U.S. law in a borderless internet economy.

The ruling from the 9th Circuit—which covers nine western states, Guam, and the Northern Mariana Islands—may serve as a legal compass for other courts grappling with similar issues. As the digital age blurs geographical lines, the judiciary now faces the daunting task of defining the rules of engagement for online conduct.

With Shopify yet to publicly respond and the case headed back to lower courts, what began as a routine online purchase could end up reshaping the legal playbook for global e-commerce platforms.