In the Shopify case, a U.S. district court refused to dismiss allegations that the company's checkout tools collected California consumers' personal, payment, location, and browsing data to build consumer profiles, violating California privacy law including the California Invasion of Privacy Act. The plaintiff, California shopper Brandon Briskin, challenged the dismissal after earlier jurisdictional and pleading disputes in the Ninth Circuit. The court found the allegations sufficient to establish Shopify's intent and allow the case to proceed.
The NBA faces a separate class action over tracking tools embedded on nba.com from Google, Amplitude, and other vendors. The complaint alleges these tools collect browsing and identifying data as users access schedules, tickets, player pages, and highlights. The plaintiff argues the NBA's cookie banner creates a false sense of user control because trackers may load immediately upon page arrival and some scripts may continue operating even after users opt out.
The significance lies in a broader litigation trend: courts are now examining what embedded scripts, pixels, cookies, and checkout systems actually do operationally, rather than relying solely on privacy policy language. For Shopify, the question is whether hidden data collection by a commerce platform creates liability across its entire merchant network. For the NBA, the issue is whether consent banners actually stop tracking in practice. Attorneys should monitor how courts define "meaningful consent" and what technical evidence proves or disproves it.