SUMMARY A recent federal court ruling has set a precedent that could expose dealerships to litigation in states where they don’t have a physical presence. The case, Briskin v. Shopify Inc., established a “traveling cookie” rule, meaning a company can be subject to jurisdiction in any state where a consumer’s device with an installed tracking cookie travels. This decision, combined with the increasing number of states passing strict data privacy laws like the new Maryland Online Data Privacy Act (MODPA), means dealerships must ensure their websites are compliant with a wider range of state laws to avoid potential penalties. GET THE LATEST Brick-and-mortar dealerships are the heart and soul of the dealership model, but dealerships are living in a digital age. Recently, the United States Court of Appeals for the 9th Circuit issued a decision that could impact dealerships nationwide and how dealerships comply with state data privacy and perhaps even other state consumer protection laws. One recent case highlights the issues courts are struggling with in an age where online commerce is the norm. In the case Briskin v. Shopify Inc., Briskin, a California resident, purchased clothes from a California merchant’s website powered by Shopify’s e-commerce platform. Shopify Inc. is a Canadian corporation headquartered in Ottawa, with two subsidiaries wholly owned in the United States as Delaware corporations. Shopify’s software automatically installed tracking cookies on Briskin’s phone, gathering Briskin’s personal data without his knowledge or consent. Plaintiffs brought claims under California privacy and other state laws. Shopify argued that jurisdiction was improper and that Briskin unilaterally acted on his own, which resulted in the taking of his personal data, not through any intentional acts of Shopify itself. The 9th Circuit Court found that California had jurisdiction over the case and that Shopify violated California state law by collecting, maintaining and selling Briskin’s personal data, even if Shopify did not intend to obtain Briskin’s personal data specifically. In essence, the court created a new “traveling cookie” rule: When a company attaches cookies to a person’s electronic device, jurisdiction attaches wherever that person happens to be and wherever that person happens to travel thereafter. The 9th Circuit has ruled that interactive platforms, such as websites that are available nationwide, and that automatically monitor or gather the personal data of interacting users, are expressly aiming wrongful conduct towards other states that have stricter state consumer privacy laws. This decision could set a precedent for the concept that dealerships are subject to jurisdictions in California, or other states with stricter consumer privacy and related laws, simply by virtue of a website that interacts with consumers from those states. Dealerships may be roped into litigation simply based on the fact that a consumer accessed their website/advertisement, cookies were automatically attached to the consumer’s device without the consent of the consumer and personal data was taken and/or sold in violation of a state’s privacy laws. Living in the Digital Age By BARRIE CHARAPP BEATY, Charapp & Weiss LLP with BRAD MILLER, Chief Executive Officer/Chief Legal Officer, ComplyAuto 6 Virginia Auto Dealer
RkJQdWJsaXNoZXIy MTg3NDExNQ==