Changeflow GovPing Trade & Export Ninth Circuit Expands Personal Jurisdiction Ove...

Priority review Enforcement Amended Final

Ninth Circuit Expands Personal Jurisdiction Over Foreign Tech Platforms

JD Supra Trade Law

Filed March 2nd, 2026

Detected March 6th, 2026

Summary

The Ninth Circuit expanded personal jurisdiction over foreign tech companies in data breach cases in Freeman v. 3Commas Technologies OÜ. The ruling allows foreign companies with significant digital activities and knowledge of California customers to be sued in California courts, reversing a lower court's dismissal.

View original document View source feed page

What changed

The U.S. Court of Appeals for the Ninth Circuit, in Freeman v. 3Commas Technologies OÜ, has significantly expanded the scope of personal jurisdiction over foreign technology companies in data breach cases. The court reversed a district court's dismissal, holding that the Estonian software company 3Commas had sufficient minimum contacts with California to be sued there. Key factors included contracting with a California-based service provider with choice-of-law clauses, including California-specific privacy disclosures on its website, and demonstrating knowledge of its California user base through IP addresses and VAT collection.

This decision provides crucial guidance for foreign technology companies operating online, indicating that digital activities, knowledge of customer locations, and commercial exploitation of those customers can subject them to jurisdiction in California courts. Companies with an online presence targeting U.S. consumers, particularly those with California customers, should review their privacy policies, data collection practices, and contractual agreements. Failure to comply with jurisdictional requirements could lead to litigation in U.S. courts, even for entities based abroad.

What to do next

Review online presence and data collection practices for potential California consumer targeting.
Assess privacy disclosures and terms of service for California-specific language.
Evaluate contractual agreements for choice-of-law and forum selection clauses.

Source document (simplified)

March 5, 2026

Ninth Circuit Expands Personal Jurisdiction Over Foreign Tech Platforms in Data Breach Cases

Matt Danaher, Jeff DeGroot, Andrew Serwin DLA Piper + Follow Contact LinkedIn Facebook X Send Embed

On March 2, 2026, the U.S. Court of Appeals for the Ninth Circuit issued a significant decision, in Freeman v. 3Commas Technologies OÜ, reversing a district court’s dismissal of a class action against an Estonian software company for lack of personal jurisdiction. [1] The ruling provides valuable guidance on when foreign technology companies can be haled into California courts based on their digital activities and online presence.

Background of the Case

The plaintiffs brought a putative class action in the Northern District of California against 3Commas Technologies OÜ (“3Commas”), an Estonian private limited company that provides software services for cryptocurrency trading, based on an alleged data breach. The district court dismissed the case, finding it lacked personal jurisdiction over the foreign defendant. The plaintiffs appealed.

The Majority’s Analysis: Finding Purposeful Direction Toward California

A majority of the Ninth Circuit panel—Judges Rawlinson and Sanchez—reversed the district court’s decision and held 3Commas had sufficient minimum contacts with California, which supported the exercise of specific personal jurisdiction.

The court applied the well-established three-part test for specific jurisdiction, requiring that: (1) the defendant either purposefully directs activities at the forum or purposefully avails itself of the forum’s laws; (2) the claim arises out of or relates to forum-related activities; and (3) the exercise of jurisdiction comports with fair play and substantial justice. [2]

Drawing from its recent en banc decision in Briskin v. Shopify, Inc., [3] the majority emphasized that “a company’s internet activity may subject the company to specific personal jurisdiction in a given forum if the company knows—either actually or constructively about its customer base there and exploits that base for commercial gain.” [4]

Key Contacts Supporting Jurisdiction

The court identified several contacts demonstrating 3Commas purposefully directed its activities at California:

Contracts with California Businesses. 3Commas contracted with Cloudflare, a California-based data server company, to optimize and maintain the availability of its website. Significantly, that contract contained choice-of-law and forum selection clauses designating California. [5]

California-Specific Privacy Disclosures. 3Commas’s website featured a Privacy Policy page that included a dedicated section on California Privacy Rights. The court found it telling that 3Commas did not disclose legal requirements of any other jurisdiction, indicating intentional targeting of California consumers. [6]

Knowledge of User Locations. 3Commas collected users’ financial information, including billing addresses, and geographical data based on IP addresses. The company’s Chief Legal Officer testified that 3Commas “sees user IP addresses, which may allow for inferences regarding the user’s general location.” [7] Additionally, the company charged value-added taxes based on user location, which the company automatically determined by IP addresses or manually entered billing addresses. [8]

Taken together, the court concluded that 3Commas “knows about its California consumer base, conducts its regular business in California, contacts California residents, [and] interacts with them as an intermediary” for cryptocurrency trades. [9]

Fair Play and Substantial Justice

The court also found that exercising jurisdiction over 3Commas comported with fair play and substantial justice, citing several factors: [10]

The burden on 3Commas of defending in California is limited because it had already agreed to resolve disputes with Cloudflare in California.
Litigating in California is unlikely to undermine Estonian sovereignty because the claims are based only on U.S. state law.
California maintains a strong interest in providing redress for its residents who are tortiously injured.
Because the claims rest on California and other U.S. state law, California would provide the most efficient judicial resolution.

The Dissent: A Narrower View of Purposeful Direction

Judge Miller dissented, arguing that the plaintiffs failed to demonstrate that 3Commas actually knew any of the plaintiffs were California residents. The dissent emphasized that plaintiffs did not allege they provided 3Commas with a billing address, paid California sales tax, or even accessed the website from a California IP address (rather than through a VPN). [11]

Regarding the Cloudflare contract, Judge Miller noted that “a contract alone does not automatically establish minimum contacts” and that plaintiffs failed to explain how the contract envisioned continuing and wide-reaching contacts by 3Commas with California. [12]

As for the privacy policy, Judge Miller acknowledged that compliance with California privacy laws is “some evidence” of express aiming at the forum but characterized it as only “weak evidence” that is insufficient by itself. [13] The dissent warned that holding there is personal jurisdiction “would mean that a wide range of defendants who otherwise lack California contacts could be unexpectedly forced to litigate in California.” [14]

Takeaways for Technology Companies

This decision underscores the expanding reach of personal jurisdiction over foreign companies operating online platforms. They should be mindful of the following:

Contracts with U.S.-based service providers can create jurisdictional exposure. Choice of law and forum selection clauses in vendor contracts may be used as evidence of purposeful availment.

Privacy policies may matter for jurisdictional purposes. Including specific references to California privacy rights can be construed as evidence of intentionally targeting California consumers.

Data collection practices create a paper trail. If a company collects IP addresses, billing addresses, or location data that could reveal users are California residents, courts may infer constructive knowledge of a California customer base.

As the digital economy continues to globalize, decisions like Freeman v. 3Commas Technologies will shape the contours of when foreign companies can be brought into U.S. courts.

[1] See generally Freeman v. 3Commas Techs. OÜ, No. 24-6158 (9th Cir. 2026). The following pincites are keyed to the Ninth Circuit’s decision available here.

[2] Id. at 2.

[3] See generally Briskin v. Shopify, Inc., 135 F.4th 739 (9th Cir. 2025).

[4] Id. at 3.

[5] See id. at 3.

[6] See id. at 3-4.

[7] Id. at 4-5.

[8] See id. at 4.

[9] Id.

[10] See id. at 5.

[11] See id. at 1-2 (Miller, J., dissenting).

[12] Id. at 2.

[13] Id. at 3.

[14] Id. at 3.

[View source.]

Send Print Report

Latest Posts

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.
Attorney Advertising.

Written by:

DLA Piper Contact + Follow Matt Danaher + Follow Jeff DeGroot + Follow Andrew Serwin + Follow more less

What do you want from legal thought leadership?

Please take our short survey – your perspective helps to shape how firms create relevant, useful content that addresses your needs:

Take the survey now »

Published In:

California + Follow Class Action + Follow Cryptocurrency + Follow Cybersecurity + Follow Data Breach + Follow Data Collection + Follow Data Privacy + Follow Dismissals + Follow Foreign Defendants + Follow Information Technology + Follow Online Platforms + Follow Personal Jurisdiction + Follow Reversal + Follow Software + Follow Civil Procedure + Follow Consumer Protection + Follow International Trade + Follow Privacy + Follow Science, Computers & Technology + Follow more less

DLA Piper on:

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra: Sign Up Log in ** By using the service, you signify your acceptance of JD Supra's Privacy Policy.* - hide - hide