Freeman v. 3commas Technologies Ou

NOT FOR PUBLICATION FILED UNITED STATES COURT OF APPEALS MAR 2 2026 FOR THE NINTH CIRCUIT MOLLY C. DWYER, CLERK U.S. COURT OF APPEALS

CHARLES FREEMAN, individually and on No. 24-6158 behalf of all others similarly situated; D.C. No. TIGRAN MELKONYAN; ARI SHOFET; 3:23-cv-00101-RFL SHAWN MALL; BENJAMIN FERRIS; BRYAN CHAPMAN; NANDAN ARORA; SHAFIQ RAJANI; VIJAY MEMORANDUM* CHRISTOPHER; MARC ASHBY; VINCENT VAN BUSKIRK; LAWRENCE MANICKAM; EDMUNDO PENA, Plaintiffs - Appellants, v. 3COMMAS TECHNOLOGIES OU, an Estonian Private Limited Company, Defendant - Appellee.

Appeal from the United States District Court for the Northern District of California Rita F. Lin, District Judge, Presiding Argued and Submitted December 4, 2025 San Francisco, California Before: RAWLINSON, MILLER, and SANCHEZ, Circuit Judges.

Dissent by Judge MILLER.

* This disposition is not appropriate for publication and is not precedent except as provided by Ninth Circuit Rule 36-3.

Plaintiffs appeal the district court’s dismissal of their class action against 3Commas Technologies OÜ (“3Commas”) for lack of personal jurisdiction in California. We have jurisdiction under 28 U.S.C. § 1291. Reviewing “de novo the district court’s conclusion that it lacks personal jurisdiction” over a defendant, Briskin v. Shopify, Inc., 135 F.4th 739, 749–50 (9th Cir. 2025) (en banc), we reverse and remand.

1. Specific jurisdiction exists over a non-resident defendant only when “(1) the defendant either purposefully directs its activities [at the forum] or purposefully avails itself of the benefits afforded by the forum’s laws; (2) the claim arises out of or relates to the defendant’s forum-related activities; and (3) the exercise of jurisdiction comports with fair play and substantial justice, i.e., it is reasonable.” Williams v. Yamaha Motor Co., 851 F.3d 1015, 1023 (9th Cir. 2017) (cleaned up). Purposeful direction requires that “the defendant expressly aimed acts at the forum state knowing that they would harm the plaintiff there,” while purposeful availment requires that “the defendant has taken deliberate action within the forum state or has created continuing obligations to forum residents.”

Impossible Foods Inc. v. Impossible X LLC, 80 F.4th 1079, 1088 (9th Cir. 2023). “[A]n interactive platform ‘expressly aims’ its wrongful conduct toward a forum state when its contacts are its ‘own choice and not random, isolated, or fortuitous.’” Briskin, 135 F.4th at 757–58 (quoting Ford Motor Co. v. Montana

2 24-6158 Eighth Jud. Dist. Ct., 592 U.S. 351, 359 (2021)). Thus, “a company’s internet activity may subject the company to specific personal jurisdiction in a given forum if the company knows—either actually or constructively about its customer base there and exploits that base for commercial gain.” Id. at 757 (quotation marks omitted).

3Commas has exploited the California market by soliciting California investors, contracting with California businesses, and selling services to California residents. As a software provider for cryptocurrency trading, 3Commas contracts with Cloudflare, a California-based data server, to “optimize and maintain the availability of its website,” and its contract with Cloudflare contains choice of law and forum selection clauses for California. See Burger King Corp. v. Rudzewicz, 471 U.S. 462, 482 (1985) (“Rudzewicz ‘purposefully availed himself of the benefits and protections of Florida’s laws’ by entering into contracts expressly providing that those laws would govern . . . .”).

At the time of the complaint, 3Commas’s website had a Privacy Policy page which included a section on California Privacy Rights. The Privacy Policy page expressly stated that 3Commas collects its users’ “[f]inancial information, such as billing and mailing address” and “[g]eographical data, such as city of [their] location identified by [their] IP address.” That 3Commas did not disclose or even mention any other jurisdiction’s legal requirements indicates that 3Commas

3 24-6158 intentionally directed its activities toward California consumers. See Will Co. v. Lee, 47 F.4th 917, 924–25 (9th Cir. 2022) (holding that a Japanese company expressly aimed its contacts within the United States in part because its Privacy Policy page addressed legal compliance issues “relevant almost exclusively to viewers in the United States”).

Other evidence in the record indicates that 3Commas was aware that at least some of its users were California residents. 3Commas’s Chief Legal Officer testified that “3Commas sees user IP addresses, which may allow for inferences regarding the user’s general location.” For users like Plaintiffs who purchased its service plans, 3Commas charges value added tax based on their location, which “is automatically determined by IP address of [the user’s] device and/or manually provided by [the user] to 3commas when entering billing address.” Although 3Commas disputes whether it is able to track when its software users are California residents, we must resolve factual disputes in Plaintiffs’ favor. Mavrix Photo, Inc. v. Brand Techs., Inc., 647 F.3d 1218, 1223 (9th Cir. 2011); Will Co., 47 F.4th at 921. We conclude that 3Commas “knows about its California consumer base, conducts its regular business in California, contacts California residents, [and] interacts with them as an intermediary” for cryptocurrency trades. Briskin, 135 F.4th at 759. These contacts are not random or fortuitous but rather reflect 3Commas’s intention to “appeal[] to, and profit[] from, an audience” in California.

4 24-6158 Mavrix, 647 F.3d at 1231. They constitute sufficient minimum contacts with California from which Plaintiffs’ data breach claims arise.

2. Exercising jurisdiction over 3Commas comports with fair play and substantial justice. First, 3Commas’s “purposeful direction of its regular business activities” at California favor the assertion of jurisdiction. Briskin, 135 F.4th at 761. Second, the burden on 3Commas of defending in California is limited, given that it has already agreed to resolve any disputes with Cloudflare in California, under California law. Third, litigating in California is unlikely to undermine the sovereignty of Estonia, where 3Commas is based, because Plaintiffs only assert claims under U.S. state law. Ayla, LLC v. Alya Skin Pty. Ltd., 11 F.4th 972, 984 (9th Cir. 2021). Fourth, “California maintains a strong interest in providing an effective means of redress for its residents tortiously injured.” Sinatra v. Nat’l Enquirer, Inc., 854 F.2d 1191, 1200 (9th Cir. 1988). Finally, “[b]ecause [Plaintiffs’] claims rest on the law of California and [other U.S. states]”, a U.S. forum like California “would provide ‘the most efficient judicial resolution of the controversy,’ as well as better provide [Plaintiffs] ‘convenient and effective relief.’” Ayla, 11 F.4th at 984.

REVERSED and REMANDED.

5 24-6158 FILED Freeman, et al. v. 3Commas Technologies OÜ, No. 24-6158 MAR 2 2026 MOLLY C. DWYER, CLERK MILLER, Circuit Judge, dissenting: U.S. COURT OF APPEALS

Plaintiffs seek to subject 3Commas Technologies OÜ, an Estonian software developer, to personal jurisdiction in California. They allege that some of 3Commas’ customers were California residents, but they allege no facts suggesting that 3Commas knew that those customers were located in California. 3Commas lacks other contacts with California that would justify asserting jurisdiction. Thus, the complaint as presently drafted does not establish personal jurisdiction.

For specific personal jurisdiction to exist over a non-resident defendant, “the defendant must either ‘purposefully direct his activities’ toward the forum or ‘purposefully avail[] himself of the privileges of conducting activities in the forum.’” Axiom Foods, Inc. v. Acerchem Int’l, Inc., 874 F.3d 1064, 1068 (9th Cir. 2017) (alteration in original) (quoting Dole Food Co. v. Watts, 303 F.3d 1104, 1111 (9th Cir. 2002)). Because 3Commas’ conduct primarily took place outside California, the purposeful-direction inquiry, which asks “whether the defendant expressly aimed acts at the forum state knowing that they would harm the plaintiff[s] there,” is a better fit for this case. Impossible Foods Inc. v. Impossible X LLC, 80 F.4th 1079, 1088 (9th Cir. 2023).

In Briskin v. Shopify, Inc., we held that an e-commerce platform “expressly aimed” its conduct at California because it knew that the plaintiff was located in California when it installed a tracking cookie on his phone. 135 F.4th 739, 756 (9th Cir. 2025) (en banc). Plaintiffs seek to analogize their case to Briskin by pointing out that 3Commas acknowledges that it “sees user IP addresses, which may allow for inferences regarding a user’s general location,” and that its privacy policy states that it may collect “[g]eographical data.” But although plaintiffs allege that three plaintiffs live in California, they do not allege that they ever provided 3Commas with any information that would have allowed it to identify them as California residents. They do not allege, for instance, that they provided 3Commas with a billing address or that they paid California sales tax on their purchases. They do not even allege that they accessed 3Commas’ website from a California IP address, rather than through a VPN. Thus, unlike the defendant in Shopify, 3Commas cannot be said to have known that any of the plaintiffs were in California.

Plaintiffs point to 3Commas’ contract with Cloudflare, a global cloud services company headquartered in San Francisco, as evidence that 3Commas has exploited the California market. But “a contract alone does not automatically establish minimum contacts.” Boschetto v. Hansing, 539 F.3d 1011, 1017 (9th Cir. 2008). Even if Cloudflare performed its contractual obligations in California, that fact “cannot, standing alone, justify the exercise of jurisdiction over another party to the contract.” Picot v. Weston, 780 F.3d 1206, 1213 (9th Cir. 2015). Plaintiffs do not explain how the Cloudflare contract envisions any “continuing and wide- reaching contacts” by 3Commas in California. Burger King Corp. v. Rudzewicz, 471 U.S. 462, 480 (1985). Nor have they shown how their claims arise out of or are related to the Cloudflare contract.

Plaintiffs also point to 3Commas’ privacy policy, which contained a reference to California privacy laws. To be sure, a defendant’s claim to be compliant with the laws of a particular forum is at least some evidence of express aiming at that forum. See Will Co. v. Lee, 47 F.4th 917, 925–26 (9th Cir. 2022). But it is only weak evidence, and it is not sufficient by itself. As courts have recognized, “compliance with California’s privacy policy does not by itself demonstrate that Defendant intentionally targeted consumers in California.” Cole- Parmer Instrument Co. v. Professional Labs., Inc., No. 20-cv-8493, 2021 WL 3053201, at *6 (N.D. Cal. July 20, 2021) (Koh, J.) (internal quotation marks omitted). Most companies engaging in commerce on the Internet have a privacy policy with similar provisions about California privacy rights, just as they do about Europe’s GDPR. Holding that such provisions are enough to show purposeful direction would mean that a wide range of defendants who otherwise lack California contacts could be unexpectedly forced to litigate in California.

* * * Plaintiffs bear the burden of showing that 3Commas expressly aimed its conduct at California, Briskin, 135 F.4th at 751, and their complaint does not do so.

That said, plaintiffs drafted their complaint—and the district court resolved this case—before we decided Briskin. Plaintiffs suggest that in an amended complaint, they might be able to allege facts showing that 3Commas knew that they were located in California, thus establishing personal jurisdiction under the standards we articulated in Briskin. I would therefore vacate the district court’s decision and remand to allow plaintiffs to amend their complaint in light of Briskin.