Commercial Litigation Update

California courts are increasingly handling class action lawsuits alleging that cookies and other web technologies violate privacy laws by collecting personal data without consent. A key issue in these cases is whether California courts can exercise personal jurisdiction over out-of-state companies operating location-neutral websites.

A recent ruling from the Ninth Circuit Court of Appeals is raising the stakes for any business that operates a website collecting user data. In Briskin v. Shopify, decided in April 2025, the court held that California courts can exercise personal jurisdiction over an out-of-state company—Shopify—for allegedly collecting personal data from a California resident without proper disclosure or consent. This decision signals a significant shift in how courts view digital jurisdiction in the age of online commerce and widespread data collection.

On January 28, 2025, the U.S. Court of Appeals for the Ninth Circuit issued a significant ruling reinforcing the Fifth Amendment’s protection against self-incrimination and clarifying the attorney-client privilege in the context of grand jury subpoenas. In In Re Grand Jury Subpoena, 127 F.4th 139 (9th Cir. 2025), the Ninth Circuit held that counsel cannot be compelled to provide a privilege log delineating all documents a client previously sent to counsel for the purpose of obtaining legal advice unless and until the court conducts an in camera review of the documents at issue to determine whether the Fifth Amendment right against self-incrimination, as announced in Fisher v. United States, 425 U.S. 391 (1976), applies.^[1]

The decision further defines the limits of government subpoenas in criminal investigations and clarifies when privilege logs themselves may be shielded from disclosure. This ruling has far-reaching implications for attorneys, clients, and government investigations, particularly in white-collar, tax fraud and corporate compliance matters.

In its recent unpublished decision, United States ex rel. Stebbins v. Maraposa Surgical Inc., 2024 WL 4947274 (3d Cir. Dec. 3, 2024), the Third Circuit clarified that the public disclosure bar prevents whistleblower False Claims Act (FCA) qui tam actions arising from information gathered solely through publicly accessible databases.

As the Third Circuit explained, “[t]he FCA punishes the submission to the Government of fraudulent claims for payment under, for example, the Medicare and Medicaid programs.”  Id. at *1.  While the FCA encourages individuals, known as relators, to report government-related fraud by way of filing a qui tam suit, the public disclosure bar prevents a relator from bringing an FCA qui tam suit “if substantially the same allegations or transactions as alleged in the action or claim were publicly disclosed” in a “Federal report” or “from the news media” unless the relator is “an original source of the information.” 31 U.S.C. § 3730(e)(4)(A).  In the Third Circuit, “the public disclosure bar applies if either Z (fraud) or both X (misrepresented facts) and Y (true facts) are publicly disclosed by way of a listed source.” Stebbins, 2024 WL 4947274, at *2 (quoting U.S. ex rel. Zizic v. Q2Administrators, LLC, 728 F.3d 228, 236 (3d Cir. 2013)). 

In United States ex rel. Stebbins v. Maraposa Surgical Inc. et al., despite having no affiliation whatsoever with the defendants, the relator filed a qui tam action alleging, inter alia, that the defendants fraudulently sought reimbursement for the arteriograms performed in a physician’s office, rather than a licensed ambulatory surgery center, which the relator asserted violates Pennsylvania’s regulations.  Without deciding whether the defendants actually engaged in any wrongdoing, the Third Circuit held that the public disclosure bar prohibited the relator from proceeding with suit because the relator drew each piece of information supporting his FCA allegations from publicly disclosed databases.