Shopify Checkout Data Privacy Lawsuit, Were You Affected? — Briskin v. Shopify Inc., No. 4:21-cv-06269-PJH

If you checked out on a small retailer’s website and Shopify was quietly running the payment page behind it — this is about you. On July 30, 2026, a California federal judge refused to throw out a class action claiming Shopify secretly collected your name, address, email, and card details and used them for its own purposes. The case has been through a district court dismissal, a full trip to the Ninth Circuit, and two more rounds of motions to dismiss. It’s still alive. Here’s what that means and whether you’re covered.

Quick Facts

Field	Detail
Lawsuit Filed	August 13, 2021
Defendant	Shopify Inc., Shopify (USA) Inc., and Shopify Payments (USA), Inc.
Alleged Harm	Secretly collecting and using shoppers’ checkout data — name, address, email, payment info, IP address, geolocation — without their knowledge or consent
Law Alleged	California Invasion of Privacy Act (CIPA) §631, California’s constitutional right to privacy, intrusion upon seclusion, the California Computer Data Access and Fraud Act (CDAFA), and the state’s Unfair Competition Law (UCL)
Who Is Affected	Consumers who made a purchase on a Shopify-powered merchant website without knowing Shopify handled and tracked their checkout data
Court & Case Number	U.S. District Court, Northern District of California, Oakland Division — No. 4:21-cv-06269-PJH
Current Stage	Third motion to dismiss denied July 30, 2026 — case proceeds toward discovery and class certification
Lead Plaintiff Deadline	N/A — this is not a securities case
Settlement Status	No settlement. No claim form exists.
Last Updated	August 18, 2026

Who Is Shopify and Why Are They Being Sued Over This?

Shopify doesn’t sell you anything directly. It builds and runs the checkout software sitting behind millions of “independent” online stores — everything from big-name brands down to one-person shops selling fitness apparel. When you type your card number into what looks like a small retailer’s site, you’re often typing it straight into Shopify’s system instead. Because Shopify writes that code and controls the cookies, the plaintiff argues the company — not the merchant you thought you were buying from — is the one actually collecting, storing, and potentially profiting from your information. That gap between who you think you’re dealing with and who’s actually processing your data is the entire case.

What Did Shopify Do to Shoppers, and When?

The case traces back to a single purchase. In June 2019, California resident Brandon Briskin used his iPhone to buy fitness apparel from a small retailer, IABMFG, at iambecoming.com. He had no idea Shopify was involved at all. According to his complaint, Shopify’s software generated the payment form he typed into and quietly installed tracking cookies on his device — cookies that, he alleges, didn’t just process that one order but followed him across other stores running on Shopify’s network, building a profile the company could use commercially.

Briskin says he only learned about Shopify’s role in 2021, when IABMFG finally updated its privacy policy to disclose it. He sued that August, arguing Shopify’s conduct amounted to illegal wiretapping under California law — the theory being that Shopify intercepted his communications with the merchant in real time, without his permission, the same way a third party might tap a phone line. It’s the same legal theory now driving checkout-tracking suits against other major retailers, including Best Buy.

That distinction is not a technicality — it’s the whole ballgame. If courts treat Shopify as a third party secretly listening in on the transaction, the wiretapping claims hold up. If courts treat Shopify as just a vendor the merchant hired to process the sale, the case collapses. Every ruling in this litigation, going back to 2022, has essentially been a fight over which of those two boxes Shopify belongs in.

Related article: Cone Health MyChart Settlement, Check If You Qualify — Singh v. The Moses H. Cone Memorial Hospital Operating Corp., No. 1:24-cv-00558

This case has also had an unusually long road to get here. The district court initially threw it out entirely in 2022, ruling it didn’t even have jurisdiction to hear the claims against Shopify, a Canadian company. Briskin appealed, and in a rare move, the full Ninth Circuit agreed to rehear the case en banc — meaning the entire bench of judges, not just a three-judge panel, weighed in. In April 2025, that en banc court reversed course and revived the case, finding that Shopify’s own alleged conduct — deliberately using geolocation data to know Briskin was in California when it installed tracking cookies on his device — was enough to justify hauling the company into a California courtroom. Attorneys general from 30 states and the District of Columbia, plus several California city attorneys, filed briefs backing Briskin, arguing the case mattered well beyond his individual claim because it would determine how enforceable state consumer-protection laws are against companies operating nationally online.

Once the case returned to the district court, Judge Phyllis J. Hamilton got to work on the merits. In January 2026, she granted Shopify’s motion to dismiss in part and denied it in part on Briskin’s second amended complaint. Most of his claims survived in some form but were sent back for more specific pleading — the court found he hadn’t yet shown enough facts tying what he learned about Shopify’s practices in 2021 back to what was actually happening in 2019, when he made his purchase. One claim, though, was killed outright and can’t be refiled: a claim under CIPA §635, which only covers the manufacture or sale of eavesdropping devices, not their use. Briskin filed a third amended complaint to fix the rest, and on July 30, 2026, Judge Hamilton ruled the new version cleared the bar. The case moves forward.

Are You Part of the Shopify Checkout Privacy Lawsuit?

Here’s exactly how to know if this case could include you.

• Shoppers who bought something from a Shopify-powered merchant site without ever being told Shopify — not just the store — was collecting their checkout data
• Anyone whose name, address, email, phone number, or payment details were entered into a Shopify-generated checkout form on a third-party retailer’s website
• People who noticed the same product ads following them across completely unrelated small-business sites after checking out on just one of them
• Shoppers whose information ended up in a Shopify-run customer profile they never opted into

This isn’t a certified class yet, and the court hasn’t defined an exact class period. The case so far centers on a 2019 transaction, but the alleged conduct — Shopify’s checkout software collecting and tracking shopper data across its merchant network — is described as ongoing, not a one-time event. Anyone who checked out on a Shopify-powered site without a clear disclosure of Shopify’s role could potentially fall within the eventual class definition.

Shopify Shoppers Outside California — Are You Still Covered?

Right now, every live claim in this case rests on California law: the state’s wiretapping statute, its constitutional privacy protections, and its unfair competition law. If your purchase happened while you were physically in California, or the transaction otherwise touched the state, you’re squarely within scope of this specific lawsuit. Shoppers in other states aren’t automatically covered here — but you’re not without options. Similar wiretapping-style tracking claims are moving forward against other companies under comparable state privacy laws, and several states have their own version of California’s wiretapping statute.

Not sure if you qualify for the Shopify checkout data privacy lawsuit? A free consultation with a data privacy attorney can help you figure out where you stand before the class definition is finalized — and can flag whether a separate case in your own state might apply to you instead.

What Are Shopify Shoppers Asking the Court to Award?

No money yet. No claim form yet. The complaint asks the court to award damages under CIPA and the other California statutes named above, along with an injunction — a court order stopping Shopify from continuing the alleged tracking practices going forward. Until a class is certified and the case either settles or goes to trial, there is no dollar figure attached to this case, and anyone claiming otherwise is getting ahead of the facts.

What Could Affected Shoppers Receive If This Case Resolves?

Impossible to predict at this stage. Payouts in a case like this would depend on how many people end up in a certified class, what turns up during discovery, and whether Shopify chooses to settle or fight the case through trial. Because part of the case rests on California’s wiretapping statute, which allows for statutory damages rather than requiring proof of actual financial loss, the math here could end up looking different than a typical data-breach settlement — but that’s speculation this early, not a promise. Talk to a class action attorney if you want a grounded read on your own situation rather than a guess.

What Should Shopify Shoppers Do Right Now?

1. Don’t panic — there’s no deadline today. No class has been certified. If and when one is, most affected shoppers are typically included automatically without having to file anything.
2. Save your records now. Order confirmations, receipts, and any emails from small retailers that later disclosed Shopify’s involvement in processing your purchase.
3. Write down anything unusual you remember noticing — like ads for one store’s products showing up on unrelated websites shortly after you checked out somewhere. Specific, dated recollections hold up better than vague memories later.
4. Lead plaintiff deadline: doesn’t apply here. That’s a securities-fraud concept. This is a consumer privacy class action, so there’s no separate deadline to step forward as the named plaintiff.
5. Monitor the docket yourself. The case is filed in the Northern District of California under No. 4:21-cv-06269-PJH, before Judge Phyllis J. Hamilton — that number is the fastest way to verify anything you read about this case, including this article.
6. Consider filing your own individual lawsuit only if your losses are unusually large and well documented. For most shoppers, letting the class action run its course and joining once it’s certified is the more practical path.

Shopify Checkout Data Privacy Lawsuit — Full Timeline

Milestone	Date
Disputed purchase — Briskin buys from IABMFG	June 2019
Plaintiff learns of Shopify’s role via updated privacy policy	2021
Lawsuit filed	August 13, 2021
District court dismisses case for lack of personal jurisdiction	May 5, 2022
Ninth Circuit, sitting en banc, reverses and revives the case	April 21, 2025
Judge grants in part, denies in part second motion to dismiss; CIPA §635 claim dismissed permanently	January 21, 2026
Plaintiff files third amended complaint	UNVERIFIED — exact filing date not confirmed in available public reporting
Judge denies motion to dismiss third amended complaint — case proceeds	July 30, 2026
Next scheduled hearing	UNVERIFIED — not yet published on the public docket
Class certification decision	UNVERIFIED — no briefing schedule confirmed yet
Expected resolution	UNVERIFIED — no trial date has been set

Worth sitting with for a second: this isn’t just about one shopper’s apparel order from 2019. A federal court hearing an entirely separate checkout-tracking case — against the parent companies of Arby’s and Jimmy John’s — already cited this exact Shopify ruling in its own analysis this June. What happens in Judge Hamilton’s Oakland courtroom is actively shaping how other checkout-tracking cases against other companies get decided across the country. If you’ve ever wondered whether “everyone does this, it’s just how e-commerce works” is actually a legal defense — this is the case testing that argument in real time.

Shopify Checkout Data Privacy — Frequently Asked Questions, No. 4:21-cv-06269-PJH

Is there a class action lawsuit against Shopify for checkout data collection right now?

 Yes. Briskin v. Shopify Inc., No. 4:21-cv-06269-PJH, is active in the U.S. District Court for the Northern District of California. Judge Phyllis J. Hamilton denied Shopify’s motion to dismiss the third amended complaint on July 30, 2026, so the case is moving forward.

Do I need to do anything right now to be part of the Shopify lawsuit?

 No. The class hasn’t been certified yet, so there’s no claim form to file and nothing to sign up for. If you qualify once a class is certified, you’ll typically be included automatically without lifting a finger.

When will the Shopify checkout data case settle?

 There’s no timeline, and there may not be a settlement at all. The case just cleared its third round of motions to dismiss. Class certification and discovery still lie ahead, and privacy class actions of this size and complexity often take one to three years — sometimes longer — to reach any resolution.

Can I file my own lawsuit against Shopify instead of joining the class? 

You can, but it usually only makes sense if your individual losses are large, specific, and well documented — not just a general sense that your privacy was violated. For most shoppers, letting the class action proceed and joining it once certified is simpler and less expensive. A data privacy attorney can help you weigh whether your situation is the exception.

How will I find out if the Shopify case settles? 

Watch the public docket under case No. 4:21-cv-06269-PJH, or check back here — AllAboutLawyer.com tracks and updates this article as the case develops, including if it converts from an active lawsuit into a settlement with a claim form.

What does “lead plaintiff” mean for the Shopify case, and why does the deadline matter? 

It doesn’t apply here at all. “Lead plaintiff” deadlines are a securities-fraud concept tied to a specific federal law governing stock-related class actions. This is a consumer privacy case, so there’s no separate deadline for anyone to step forward as the named plaintiff — Briskin already holds that role.

What specific laws does Shopify allegedly violate?

 The claims still active are under California’s wiretapping statute (CIPA §631), the state’s constitutional right to privacy, intrusion upon seclusion, and the California Computer Data Access and Fraud Act. A related wiretapping claim under CIPA §635 was dismissed permanently in January 2026 because that statute only covers manufacturing or selling eavesdropping tools, not using them.

How much could affected shoppers get if this case settles? 

There’s genuinely no way to know yet. No settlement exists, and any specific dollar figure floating around online right now is a guess dressed up as a fact — it would depend on the eventual class size, what discovery uncovers, and how the case resolves.

Sources Used in This Shopify Checkout Data Privacy Article

• Court Order — MLex, “Shopify privacy class action survives renewed US dismissal bid,” July 30, 2026: https://www.mlex.com/mlex/data-privacy-security/articles/2508056
• Court Order Summary — Law360, “Shopify Must Face Revived California Data Privacy Suit,” July 31, 2026: https://www.law360.com/articles/2508192/shopify-must-face-revived-california-data-privacy-suit
• Court Order Summary — Mealey’s, “Judge Says Data-Sharing Class Claims Sufficiently Pleaded Against Shopify,” August 3, 2026: https://www.mealeys.com/mealeys/mealeys-class-actions/articles/2509040
• Prior Ruling Analysis — National Law Review / Troutman Amin LLP, “Click, Buy, Sue? Shopify Pushes Back on CIPA At Checkout,” January 23, 2026: https://natlawreview.com/article/click-buy-sue-shopify-pushes-back-cipa-checkout
• Case Docket — PacerMonitor, Briskin v. Shopify Inc. et al, No. 4:21-cv-06269: https://www.pacermonitor.com/public/case/41778704/Briskin_v_Shopify_Inc_et_al
• Ninth Circuit Opinion — Briskin v. Shopify, Inc., 135 F.4th 739 (9th Cir. 2025): https://cdn.ca9.uscourts.gov/datastore/opinions/2025/04/21/22-15815.pdf
• Case Background — Public Citizen Litigation Group, “Briskin v. Shopify Inc.”: https://www.citizen.org/litigation/briskin-v-shopify-inc/
• Related Precedent Citation — Courthouse News, order in a separate tracking-data case citing Briskin, June 8, 2026: https://www.courthousenews.com/wp-content/uploads/2026/06/arbys-jimmy-johns-tracking-data.pdf

Researched and written by Israr Ahmad, legal content researcher and founder of AllAboutLawyer.com. All facts verified against MLex, Law360, and Mealey’s court reporting on the July 30, 2026 order, the Ninth Circuit’s published opinion, and the case’s public docket, on August 18, 2026. Last Updated: August 18, 2026.

This article is for informational purposes only and does not constitute legal advice. Laws vary by state and individual circumstances differ. For advice about your specific situation, consult a qualified attorney.