On January 21, 2026, Judge Phyllis J. Hamilton, in the Northern District of California, addressed a class action lawsuit challenging Shopify’s data collection practices on its e-commerce platform. Plaintiff alleged that Shopify, through its software and cookies, collected sensitive consumer information—including names, addresses, emails, credit card numbers, and geolocation—without proper disclosure or consent. The complaint further claimed that Shopify profited from this data by compiling consumer profiles, sharing information with merchants and third parties, and providing fraud analysis services.
Plaintiff brought six claims under California law: violations of the California Invasion of Privacy Act (CIPA) §§ 631 and 635, invasion of privacy under the state constitution, intrusion upon seclusion, violation of the California Computer Data Access and Fraud Act (CDAFA), and violation of the Unfair Competition Law (UCL).
The court’s analysis focused on several cross-cutting issues:
- Factual Support: The complaint lacked sufficient factual support to plausibly allege that Shopify’s data collection practices in 2019 mirrored those disclosed in 2021. The plaintiff’s inference based on later disclosures was deemed speculative, and the court granted leave to amend most claims to provide more concrete allegations.
- Intent: For most claims, the court emphasized the need to allege that Shopify acted with the requisite intent to access consumer data without permission. Because Shopify’s policies required merchants to obtain consent, the complaint did not adequately allege Shopify’s willfulness or knowledge of any lack of consent.
- Statute of Limitations: While defendants argued that several claims were time-barred, the court found the real issue was the lack of factual support for the alleged conduct, rather than untimeliness.
Claim-by-Claim Outcomes:
- CIPA § 631(a): Dismissed with leave to amend. The court found insufficient allegations regarding Shopify’s intent and whether communications were intercepted “in transit.”
- CIPA § 635: Dismissed without leave to amend. The court held that the statute targets the manufacture or sale of eavesdropping devices, not their mere use, and the plaintiff could not allege injury from manufacture or sale.
- Invasion of Privacy & Intrusion Upon Seclusion: Dismissed with leave to amend for lack of intent allegations, but the court rejected Shopify’s argument that its conduct was not “highly offensive” as a matter of law.
- CDAFA: Dismissed with leave to amend for lack of intent, but the court recognized that plaintiffs may have standing under a disgorgement theory, consistent with recent Ninth Circuit authority.
Plaintiff relies primarily on a disgorgement theory, citing Smith v. Rack Room Shoes:
The SAC plausibly pleads that Plaintiffs suffered compensable “damage or loss” under the meaning of CDAFA. “California law requires disgorgement of unjustly earned profits regardless of whether a defendant’s actions caused a plaintiff to directly expend his or her own financial resources or whether a defendant’s actions directly caused the plaintiff’s property to become less valuable.” In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 600 (9th Cir. 2020).
A disgorgement theory can “constitute[ ] an injury sufficient to establish [Article III] standing to bring [a plaintiff’s] claims for CDAFA violations.” Id. at 601. Plaintiffs have a “stake in the profits garnered” unjustly from their data, and “[u]nder California law, this stake in unjustly earned profits exists regardless of whether an individual planned to sell his or her data or whether the individual’s data is made less valuable.” That logic applies equally to the issue of whether plaintiffs have suffered “damage” under CDAFA. Plaintiffs are damaged by not having received a share of the allegedly unjust profits generated from their data. That reading is also consistent with CDAFA’s statutory purpose. The legislature found that the “protection of … lawfully created … computer data is vital to the protection of the privacy of individuals, and made available equitable relief. In light of that intent, Rack Room’s alleged unjust profit from the use of Plaintiffs’ private personal information, which holds at least some financial value to Rack Room, plausibly constitutes a “damage or loss” within the meaning of CDAFA.
*9 2025 WL 2210002 (N.D. Cal. Aug, 4, 2025).
Smith relies on Ninth Circuit authority in the Facebook Tracking case, which held as follows:
Because California law recognizes a legal interest in unjustly earned profits, Plaintiffs have adequately pleaded an entitlement to Facebook’s profits from users’ personal data sufficient to confer Article III standing. Plaintiffs allege that their browsing histories carry financial value. They point to the existence of a study that values users’ browsing histories at $52 per year, as well as research panels that pay participants for access to their browsing histories.
Plaintiffs also sufficiently allege that Facebook profited from this valuable data. According to the complaint, Facebook sold user data to advertisers in order to generate revenue. Indeed, as alleged, Facebook’s ad sales constituted over 90% of the social media platform’s revenue during the relevant period of logged-out user tracking.
…
Thus, Plaintiffs sufficiently alleged a state law interest whose violation constitutes an injury sufficient to establish standing to bring their claims for CDAFA violations.
956 F.3d 589, 600-01.
That said, Shopify’s opening motion does cite other cases that support its view that the “loss of the right to control their own data, the loss of the value of their data, and the loss of the right to protection of the data” is not a cognizable loss under CDAFA. See, e.g., Cottle v. Plaid, Inc., 536 F.Supp.3d 461, 488 (N.D. Cal. 2021); see alsoDoe v. County of Santa Clara, 2024 WL 3346257 (N.D. Cal. July 8, 2024); Doe v. Meta Platforms, 690 F.Supp.3d 1064, 1081-82 (N.D. Cal. 2023).
Overall, while the court is unclear about how to square those two lines of cases, it does appear that the Ninth Circuit has concluded that plaintiffs can establish standing for both Article III and CDAFA purposes under a disgorgement theory, and Shopify hasn’t presented any convincing reason to contravene that authority.
- UCL: The court denied dismissal on standing grounds, noting a split in authority but finding that privacy harms can confer standing under certain theories, even absent monetary loss.
BRANDON BRISKIN, v. SHOPIFY INC., et al., No. 21-CV-06269-PJH, 2026 WL 161441 (N.D. Cal. Jan. 21, 2026).
