United States Court of Appeals For the First Circuit

No. 23-1683

SCOTT ROSENTHAL,

Plaintiff, Appellant,

v.

BLOOMINGDALES.COM, LLC,

Defendant, Appellee.

APPEAL FROM THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF MASSACHUSETTS

[Hon. Nathaniel M. Gorton, U.S. District Judge]

Before

Gelpí, Selya, and Thompson, Circuit Judges.

Jamisen A. Etzel, with whom Lynch Carpenter, LLP, Brian C. Gudmundson, Rachel K. Tack, Zimmerman Reed LLP, Joseph P. Guglielmo, Carey Alexander, Ethan S. Binder, and Scott+Scott Attorneys at Law LLP were on brief, for appellant. Mark W. Mosier, with whom Emily Johnson Henn, Eric C. Bosset, Kendall T. Burchard, Grace Pyo, and Covington & Burling LLP were on brief, for appellee.

May 9, 2024 SELYA, Circuit Judge. The prevalence of various

software applications in modern commercial life has given rise to

a host of novel legal questions. This appeal poses a

jurisdictional question of that genre. Concluding, as we do, that

the district court appropriately determined that specific personal

jurisdiction over the defendant was lacking in the forum state

notwithstanding the defendant's use of session replay code (SRC),

we affirm the district court's dismissal of the action for want of

jurisdiction.

I

We briefly rehearse the relevant facts and travel of the

case. Given that this appeal follows the district court's grant

of a motion to dismiss for want of personal jurisdiction based on

a prima facie record, we "take the facts from the pleadings and

whatever supplemental filings (such as affidavits) are contained

in the record, giving credence to the plaintiff's version of

genuinely contested facts" and embracing "undisputed facts put

forth by the defendant." Baskin-Robbins Franchising LLC v.

Alpenrose Dairy, Inc.,

(1st Cir. 2016).

Plaintiff-appellant Scott Rosenthal is a resident and

citizen of Massachusetts. Defendant-appellee Bloomingdales.com,

LLC (Bloomingdales) is an Ohio limited liability company with its

principal place of business in New York. The sole member of

Bloomingdales is Bloomingdale's, LLC, of which the sole member is

- 2 - Macy's Retail Holdings, LLC (Macy's RH). In turn, the sole member

of Macy's RH is Macy's, Inc., a Delaware corporation that maintains

its principal place of business in New York.

On November 15, 2022, the plaintiff filed a putative

class action in the United States District Court for the District

of Massachusetts alleging that Bloomingdales had unlawfully

intercepted and used information about his activity on its website.

According to the plaintiff's complaint, the plaintiff regularly

visited Bloomingdales' website, including while in Massachusetts.

Bloomingdales, the complaint alleged, had commissioned third-party

vendors (sometimes called "session replay providers" or "SRPs"),

such as the Georgia-based company FullStory, to embed snippets of

JavaScript computer code on its website. Unbeknownst to the

plaintiff, this SRC was deployed onto his internet browser while

he visited Bloomingdales' website in order to intercept, record,

and map his electronic communications with the website.

Bloomingdales and the SRPs then used these communications to

recreate the plaintiff's visits to the website and to assemble for

analysis a video replay of his behavior on the website. By

secretly "looking over [his] shoulder," the plaintiff's complaint

alleged, Bloomingdales transgressed both the Massachusetts

Wiretapping Act,

, and the

Massachusetts Invasion of Privacy Statute,

.

- 3 - On August 11, 2023, the district court, ruling on a

motion filed pursuant to Federal Rule of Civil Procedure 12(b)(2),

dismissed the plaintiff's complaint for lack of specific personal

jurisdiction over Bloomingdales. See Rosenthal v. Bloomingdale's,

Inc., No. 22-11944,

, at *3 (D. Mass. Aug. 11,

2023). In addition to concluding that the "defendant's conduct

which forms the basis of plaintiff's claims occurred outside of

Massachusetts," the district court determined that Bloomingdales

had not "initiate[d] contact with the forum state."

.

Because "the complaint fails to identify a 'demonstrable nexus'

between the plaintiff's claims and Bloomingdale's contacts with

Massachusetts," the district court determined that there was no

basis for specific jurisdiction over Bloomingdales.

.

This timely appeal followed.

II

It is well-settled that the burden of proving that

personal jurisdiction may be exercised in the forum state rests

with the party seeking to invoke that jurisdiction. See Motus,

LLC v. CarData Consultants, Inc.,

, 121 (1st Cir.

2022). Because the jurisdictional determination in this case was

made at the inception of the litigation — without the benefit of

either pretrial discovery or an evidentiary hearing — the classic

prima facie approach applies. See Foster-Miller, Inc. v. Babcock

- 4 - & Wilcox Can.,

(1st Cir. 1995); Boit v. Gar-Tec

Prods., Inc.,

(1st Cir. 1992).

We review the district court's order of dismissal for

lack of specific personal jurisdiction based on the prima facie

record de novo. See Baskin-Robbins,

. In conducting

this tamisage, we are not bound by the district court's reasoning

but, rather, remain free to uphold the judgment on any rationale

made manifest by the record. See

Under the prima facie approach, "an inquiring court must

ask whether the plaintiff has 'proffer[ed] evidence which, taken

at face value, suffices to show all facts essential to personal

jurisdiction.'" Chen v. U.S. Sports Acad., Inc.,

, 54

(1st Cir. 2020) (alteration in original) (quoting Baskin-Robbins,

). To establish such a showing, the plaintiff must

"go beyond the pleadings and make affirmative proof." United Elec.

Radio & Mach. Workers of Am. (UE) v. 163 Pleasant St. Corp.,

(1st Cir. 1993) (quoting Boit,

); see

United States v. Swiss Am. Bank, Ltd.,

(1st Cir.

2001). We mine the relevant facts from "the pleadings and whatever

supplemental filings (such as affidavits) are contained in the

record, giving credence to the plaintiff's version of genuinely

contested facts." Baskin-Robbins,

. We do not,

however, "credit conclusory allegations or draw farfetched

- 5 - inferences." Ticketmaster-N.Y., Inc. v. Alioto,

(1st Cir. 1994).

Because we are sitting in diversity jurisdiction, see

(d), we act as "the functional equivalent of a state

court sitting in the forum state." Astro-Med, Inc. v. Nihon Kohden

Am., Inc.,

(1st Cir. 2009) (quoting N. Laminate

Sales, Inc. v. Davis,

(1st Cir. 2005)). In that

posture, the plaintiff must show that our exercise of jurisdiction

over Bloomingdales satisfies both the strictures of the Due Process

Clause, see U.S. Const. amend. XIV, § 1, and the requirements of

the Massachusetts long-arm statute, see Mass. Gen. Laws ch. 223A,

§ 3. Although the reach of the Massachusetts long-arm statute may

not be identical to the reach of the Due Process Clause, see Copia

Commc'ns, LLC v. AMResorts, L.P.,

(1st Cir. 2016),

we do not need to inquire into any such distinctions here: the

plaintiff's attempted assertion of jurisdiction over Bloomingdales

does not satisfy the constitutional minimum demanded by the Due

Process Clause, see A Corp. v. All Am. Plumbing, Inc.,

(1st Cir. 2016).

The Due Process Clause insists that a defendant "have

certain minimum contacts with [the forum state] such that the

maintenance of the suit does not offend 'traditional notions of

fair play and substantial justice.'" Int'l Shoe Co. v. Washington,

(1945) (quoting Milliken v. Meyer,

,

- 6 - 463 (1940)). This test "is flexible and fact-specific, 'written

more in shades of grey than in black and white.'" Baskin-Robbins,

(quoting Phillips Exeter Acad. v. Howard Phillips

Fund, Inc.,

(1st Cir. 1999)).

A court may exercise in personam jurisdiction over an

out-of-state defendant "by virtue of either general or specific

jurisdiction." Mass. Sch. of L. at Andover, Inc. v. Am. Bar Ass'n,

(1st Cir. 1998). A state holds general

jurisdiction over a defendant when the defendant maintains

contacts that are "so 'continuous and systematic' as to render

[the defendant] essentially at home in the forum State." Goodyear

Dunlop Tires Operations, S.A. v. Brown,

(2011)

(quoting Int'l Shoe,

). Bloomingdales operates

stores in Massachusetts, but — given that the plaintiff has not

pursued a claim of general jurisdiction regarding Bloomingdales —

any claim of jurisdiction based on the operation of these stores

has been waived. See United States v. Zannino,

(1st Cir. 1990). The plaintiff's case thus stands or falls on

whether the defendant's use of SRC, in the manner chosen by

Bloomingdales, can support a claim of specific jurisdiction. We

turn, then, to that inquiry.

To establish that a court has specific jurisdiction over

a defendant, a litigant must satisfy three criteria. "First, the

plaintiff's claim must directly arise from or relate to the

- 7 - defendant's activities in the forum." Chen, 956 F.3d at 59.

"Second, the defendant's forum-state contacts must 'represent a

purposeful availment of the privilege of conducting activities in

that state.'" Id. (quoting Scottsdale Cap. Advisors Corp. v. The

Deal, LLC,

(1st Cir. 2018)). "Third, the exercise

of specific jurisdiction in the forum must be reasonable under the

circumstances."

All three criteria must be satisfied to

establish specific jurisdiction over a particular defendant in a

particular state. See

III

On appeal, the plaintiff argues that the district court

erred in both its relatedness and purposeful availment analyses.

Given that "[i]n website cases, we have recognized that the

'purposeful availment' element often proves dispositive," Motus,

23 F.4th at 124, we begin — and end — our examination at that

point.

Under the purposeful availment requirement, "there must

be 'some act by which the defendant purposefully avails itself of

the privilege of conducting activities within the forum State,

thus invoking the benefits and protections of its laws.'"

Cossaboon v. Me. Med. Ctr.,

(1st Cir. 2010)

(quoting Hanson v. Denckla,

(1958)). Here, that

act must relate to the insertion of SRC into Bloomingdales'

website. This purposeful availment inquiry "focus[es] on the

- 8 - defendant's intentionality" and rests on two cornerstones:

"voluntariness" and "foreseeability." A Corp.,

.

"Achieving voluntariness demands that the defendant's contacts

with the forum result proximately from its own actions." Chen,

956 F.3d at 59. Achieving foreseeability, meanwhile, demands that

"the defendant's conduct and connection with the forum State [must

be] such that he should reasonably anticipate being haled into

court there." Id. (alteration in original) (quoting Burger King

Corp. v. Rudzewicz,

(1985)).

In cases in which a defendant's website is the primary

forum contact, we have noted that there may be "'plus' factors

evincing a corporate defendant's deliberate attempt to serve the

forum state, that is, factors indicating something over and above

the defendant's mere awareness that its products were entering a

given market in the stream of commerce." Motus, 23 F.4th at 124-

25 (quoting Chen, 956 F.3d at 59-60). Here, however, we need not

concern ourselves with determining whether the plaintiff has

established the presence of such plus factors. The plain truth is

that he has not adduced facts concerning Bloomingdales' use of SRC

sufficient to satisfy the voluntariness and foreseeability

requirements.

According to the plaintiff, Bloomingdales' conduct

fulfilled the voluntariness and foreseeability requirements of the

purposeful availment test because the defendant "cultivated a

- 9 - market in Massachusetts, sought to expand that market through the

use of SRC, and benefited from that market." Thus, the plaintiff

says, our statements in Plixer International, Inc. v. Scrutinizer

GmbH,

(1st Cir. 2018), and Knox v. MetalForming, Inc.,

(1st Cir. 2019), make it apparent that he has

sufficiently pleaded that Bloomingdales' conduct satisfies the

voluntariness and foreseeability requirements. We do not agree.

Plixer is simply inapposite. The sole issue there, which

centered on a German company's purported trademark infringement,

was fundamentally different from that in question here. The Plixer

court asked whether the exercise of specific personal jurisdiction

over the foreign defendant in the United States violated the Due

Process Clause under Federal Rule of Civil Procedure 4(k)(2). See

. Inasmuch as the crux of that analysis — which

requires a showing that a defendant is not subject to the personal

jurisdiction of any state court of general jurisdiction for

purposes of Rule 4(k)(2) — is not at issue here, we decline the

plaintiff's invitation to treat Plixer as the guiding precedent

for purposes of this case.

Knox, too, offers the plaintiff insufficient support.

There, we held that it was foreseeable that a German manufacturer

would be haled into a Massachusetts court for a product-liability

lawsuit that arose out of an injury caused by one of its custom-

made machines. See Knox,

. Yet, as we emphasized,

- 10 - that holding "rest[ed] . . . on the totality of [the defendant's]

activities, voluntarily undertaken, that connect[ed] [it] to

Massachusetts."

. These connections included a sixteen-

year-long relationship between the defendant and various

Massachusetts-based customers, the defendant's practice of

individually approving and manufacturing machines according to the

in-state customers' specifications, and its maintenance of direct

connections with the customers when it came to purchasing

replacement parts and obtaining assistance with troubleshooting

and repairs. See

. It was the combination of these

factors — all of which had been adequately pleaded — that steered

us to our conclusion.

The facts pleaded in the case at hand lead to a different

outcome. Whereas the record in Knox clearly established that the

defendant knowingly and voluntarily produced, offered, and sold

maintenance services to in-state customers, the complaint in this

case merely alleges that Bloomingdales commissioned SRPs to deploy

SRC in a manner that would be recognized by the internet browsers

of users located anywhere in the world (including Massachusetts).

Even though we credit these allegations, they do not establish

that the totality of Bloomingdales' voluntary activities

connecting it to Massachusetts rose to a level comparable to that

undertaken by the defendant in Knox. In turn, we hold that these

alleged contacts fail to demonstrate that Bloomingdales maintained

- 11 - sufficient linkages with Massachusetts to support a claim of

specific jurisdiction.

Our decision in Chen,

, is much more

instructive. In Chen, we considered whether we had in personam

jurisdiction over an Alabama-based online educational provider

that was sued by a Massachusetts-based graduate student. See

. We held that, although the defendant maintained an

interactive online learning platform that was accessible (and

allegedly accessed by the plaintiff) in Massachusetts, personal

jurisdiction was lacking. See

. Crucial to our

determination was the plaintiff's "fail[ure] to show that [the

defendant] deliberately used its online learning platform (or any

other component of its online presence) to target him while he was

in Massachusetts."

.

So, too, the plaintiff here has failed to provide

"affirmative proof," Swiss Am. Bank,

, that

Bloomingdales purposefully deployed SRC to intentionally target

users in Massachusetts. Although the allegations and evidence

that the plaintiff does provide do show that Bloomingdales

intentionally targeted the plaintiff when he happened to be in

Massachusetts, they do not affirmatively prove that Bloomingdales

knew that it was targeting him in Massachusetts. See Motus, 23

F.4th at 126 (explaining that, in cases involving websites,

foreseeability requires that defendant know "of both the existence

- 12 - of a potential victim and the victim's likely whereabouts"). That

is, the plaintiff does not plead how Bloomingdales knew that it

was intentionally operating its website — and the accompanying SRC

— in Massachusetts.1

This holds true even with respect to the plaintiff's

allegations that, "[a]t all relevant times, Defendant knew that

its practices would directly result in collection of information

from Massachusetts citizens while those citizens browsed" its

website. After all, the plaintiff admits that "[b]oth desktop and

mobile versions of Bloomingdale's website allow a user to search

for nearby stores by providing the user's location." Even assuming

that this feature does in fact inform Bloomingdales about the

location of a given user,2 there is not a shred of evidence in the

present record that the plaintiff himself entered his location

1 The fact that Bloomingdales presumably knew that its website was being accessed by users located in Massachusetts given that it operated a nationally available website is beside the point. What is crucially lacking here is that Bloomingdales had the specific knowledge and intent that it was operating its website and its SRC on the plaintiff's Massachusetts-based browser when it allegedly gave rise to the injuries in the complaint. See Plixer Int'l,

("[A] website operator does not necessarily purposefully avail itself of the benefits and protections of every state in which its website is accessible."). 2 The plaintiff does not consider the obvious fact that there

is nothing stopping a user located outside of Massachusetts from entering a location within the state on Bloomingdales' website. It follows, therefore, that this feature on Bloomingdales' website does not necessarily serve to inform the defendant of users' actual locations.

- 13 - into the website when he accessed it. This silence is

unsurprising: after all, the plaintiff also fails to allege that

he visited any of Bloomingdales' stores in the state, which would

explain why he never searched for nearby stores. More importantly,

this insufficiency bolsters our conclusion that the plaintiff has

not proffered the requisite evidence to establish that

Bloomingdales knew that it was targeting him when he was in

Massachusetts, thus fulfilling the voluntariness and

foreseeability requirements. We therefore conclude that, on the

record before us, the plaintiff has not sufficiently established

that Bloomingdales purposefully availed itself of what

Massachusetts has to offer.3

IV

We need go no further. For the reasons elucidated above,

the judgment of the district court is

Affirmed.

—Concurring Dubitante Opinion Follows—

In light of this holding, we do not reach the parties' 3

numerous other — and, arguably, thornier — arguments regarding either the contours of the relatedness prong of the specific personal jurisdiction inquiry or the scope of the Massachusetts Wiretapping Act and the Massachusetts Invasion of Privacy Statute.

- 14 - THOMPSON, Circuit Judge, concurring dubitante. Given

the Supreme Court and First Circuit cases spotlighted above, I

cannot confidently say that we are wrong to rule that plaintiff

fell short on the purposeful-availment element of specific

personal jurisdiction.4 But I am worried about where the law is

in this area and where it might go (keeping in mind all the privacy-

invading tech already out there, with more surely to come). And

so I chose this unusual but not unheard-of form (concurring

dubitante) to express my concerns.

I'll start with something everyone can agree on.

Personal jurisdiction is — as Winston Churchill said of the Soviet

Union — "a riddle wrapped in a mystery inside an enigma."

Donatelli v. Nat'l Hockey League,

(1st Cir.

1990). And we felt that way long before things like the internet

and online shopping really exploded.

A mishmash "of nineteenth-century natural justice and

natural rights, early twentieth-century substantive due process,

and general law," personal jurisdiction often turns on the non-

resident defendants' "contacts" with a particular state and

whether those contacts show the defendants "purposefully

avail[ed]" themselves of the privilege of acting there. See Jay

As the lead opinion notes, there are two kinds of personal 4

jurisdiction — general and specific. See Mass. Sch. of L. at Andover, Inc. v. Am. Bar Ass'n,

(1st Cir. 1998). And like the lead opinion, my focus is on the second kind.

- 15 - Conison, What Does Due Process Have to Do with Jurisdiction?,

, 1209 (1994) (first quote, with emphases

added); Int'l Shoe Co. v. Washington,

(1945)

(second quote); Hanson v. Denckla,

(1958) (third

quote).5 The contacts cannot be so "random, isolated, or

fortuitous" that defending a lawsuit in that forum would insult

due process. See Ford Motor Co. v. Mont. Eighth Jud. Dist. Ct.,

, 359 (2019) (quoting Keeton v. Hustler Mag., Inc.,

(1984)). Instead those contacts "must show that

the defendant[s] deliberately 'reached out beyond' [their] home,"

say by "'exploi[ting] a market' in the forum State or entering a

contractual relationship centered there."

(third alteration

in original) (quoting Walden v. Fiore,

(2014)).

An underlying concept of personal-jurisdiction law is

that territorial borders matter. But the internet transcends all

borders (state and national), with practically anyone able to view

a website from practically anywhere. See, e.g., Dig. Equip. Corp.

v. AltaVista Tech., Inc.,

(D. Mass. 1997)

(Gertner, J.) (noting — commonsensically — that "[t]he Internet

has no territorial boundaries," and "paraphras[ing]" — brilliantly

— "Gertrude Stein" to make the point that, "as far as the Internet

5 FYI, my citing to some parts of a law review article does not necessarily amount to an endorsement of every other part of the article.

- 16 - is concerned, not only is there perhaps 'no there there,' the

'there' is everywhere where there is Internet access"). And these

days "the prevalence of internet interactions makes it harder and

less meaningful to tell who is reaching out to whom." John

Leubsdorf, Against Personal Jurisdiction Law,

, 69 (2022) (emphasis added).

I get the need to draw lines so operators of websites

and digital platforms (I'm no techie, but you see where I'm going)

aren't unfairly exposed to personal jurisdiction everywhere. But

I worry that the Bloomingdaleses of the world will be able to

launch online platforms accessible in all fifty states yet still

be held not to have sufficient contacts in any of them to trigger

personal jurisdiction (remember I'm talking about specific

personal jurisdiction).6 The personal-jurisdiction requirement —

which already "favors defendants" — should not be so easy "to

manipulate and evade." See

.

Perhaps the Supreme Court will step in with more guidance

(there are plenty of test cases making their way through the

system). Or perhaps Congress will act. See, e.g.,

(discussing what Congress can do); Stephen E. Sachs, How Congress

Should Fix Personal Jurisdiction,

, 1302-

6 Note that I haven't even mentioned artificial intelligence and bots!

- 17 - 04 (2014) (ditto, and also including a draft bill). But for now

our hands appear tied.

- 18 -