Can a business be sued in a state where it doesn’t operate?

Defining Personal Jurisdiction: Why Location Matters Even Without Physical Presence

At its core, personal jurisdiction is a power dynamic. It answers a fundamental question of fairness: can a state’s courts compel you to appear and defend yourself? For businesses, this isn’t merely a procedural rule; it’s a direct operational and financial risk. The misconception that a physical storefront or office is the sole trigger for legal exposure is one of the most expensive errors a business can make. Modern law recognizes that economic activity and intentional targeting can create a legally significant presence long before a physical one exists.

WHY this matters: The principle exists to prevent forum shopping—where a plaintiff seeks the most favorable court, regardless of connection—while ensuring a defendant isn’t subjected to the undue burden of defending in a distant, inconvenient location with no relationship to the dispute. The U.S. Supreme Court has consistently held that forcing a defendant into an unreasonably hostile forum violates the Due Process Clause of the Fourteenth Amendment. For a business, this isn’t abstract; an adverse jurisdictional ruling means facing trial in a state with unfamiliar laws, incurring massive travel and local counsel costs, and potentially facing a jury pool that may be unsympathetic to an “outsider” corporation.

HOW it works: The analysis is a two-step filter. First, the state must have a long-arm statute authorizing its courts to reach beyond its borders. Most states have statutes that extend to the maximum limits allowed by the Constitution. Second, the exercise of jurisdiction must comply with constitutional Due Process, which is where the minimum contacts doctrine comes in. Crucially, “operating” in a state is a legal term of art distinct from having a physical presence. Courts assess the quality and nature of a business’s connections. For example, a SaaS company with no employees in California but thousands of paying subscribers there, coupled with targeted online ads to Californians, is likely “operating” there in the eyes of the law for a dispute related to its service.

WHAT 99% of articles miss: They treat jurisdiction as a binary, on-off switch based on obvious factors. The reality is far more nuanced. Jurisdiction can be specific (limited to claims arising from the defendant’s in-state activities) or general (covering any claim against the defendant, as if they were “at home” there). Most out-of-state businesses will only ever face specific jurisdiction. However, a business that systematically and continuously targets a state’s market can sometimes be deemed to have rendered itself “at home” there, opening the door to general jurisdiction for any lawsuit—a catastrophic risk rarely planned for. Furthermore, by voluntarily registering to do business in a state and appointing a registered agent, a business often consents to general jurisdiction, a trade-off many make without realizing its full implications.

The Minimum Contacts Doctrine: Beyond Physical Borders to Purposeful Availment

The Minimum Contacts Doctrine is the constitutional compass for fairness. It asks whether the defendant purposefully established contacts with the forum state such that they should reasonably anticipate being haled into court there. This shifts the focus from where you are to what you did and where you aimed your conduct. For internet-based businesses, this doctrine is the primary source of legal exposure, transforming a website from a passive brochure into a potential magnet for nationwide lawsuits.

WHY this matters: It directly links business strategy to legal liability. A decision to “sell everywhere” via a website is also a decision to potentially “be sued anywhere” a customer resides. The doctrine protects a business that accidentally and passively interacts with a state (e.g., a single, unsolicited order from a state you don’t target) while exposing a business that actively courts a state’s market. It creates a powerful, hidden incentive to be deliberate about market expansion and to understand the legal geography of your customer base.

HOW it works: Courts apply a three-part test for specific jurisdiction based on minimum contacts:

1. Purposeful Availment: Did the defendant deliberately direct activities toward the state or derive benefits from it? Examples include: executing a contract to be performed there, advertising specifically in that state’s media, designing a product for its market, or operating an interactive website that transacts with its residents.
2. Relatedness: Does the plaintiff’s claim arise out of or relate to the defendant’s forum-related activities? A breach of contract suit from a sale to a Colorado resident relates to Colorado contacts. A shareholder dispute over internal governance likely does not.
3. Reasonableness/Fairness: Even if contacts exist, would exercising jurisdiction be fundamentally unfair? Courts weigh the burden on the defendant, the forum state’s interest, and the plaintiff’s interest in convenient relief.

WHAT 99% of articles miss: They stop at the “purposeful availment” analysis for websites, using the outdated “passive vs. interactive” framework. The cutting-edge debate centers on data as a contact. When a business collects data (including location data, IP addresses, or shipping info) from a resident of a state, that act itself can constitute a purposeful contact, especially if the data collection is integral to the business model. Furthermore, the rise of economic nexus laws for sales tax is creating a parallel legal landscape where a business’s economic presence (e.g., surpassing a revenue or transaction threshold in a state) is being used by plaintiffs’ attorneys to argue for personal jurisdiction, blurring the line between tax compliance and litigation vulnerability. Finally, contracts often contain hidden jurisdictional consent clauses. A standard clickwrap agreement or a boilerplate forum selection clause in terms of service can constitute a waiver of jurisdictional objections, binding a business to a specific state’s courts regardless of the minimum contacts analysis.

Modern Examples of “Purposeful Availment” for Digital Businesses

Business Activity	Jurisdictional Argument	Potential Risk Level
Using geo-targeted online ads (Google Ads, Facebook) focused on a specific state.	Demonstrates intentional solicitation of that state’s market.	High – Strong evidence of purposeful direction.
Operating an e-commerce site that ships products nationwide, including to the forum state.	Regular, sustained commercial activity with residents satisfies minimum contacts for product-related claims.	High – Well-established precedent.
Providing a “free” app that collects user location data from state residents, monetized via ads.	The deliberate derivation of economic benefit from the forum state creates a contact.	Medium-High – Evolving area of law.
Having a website accessible everywhere but with a disclaimer stating “we do not sell to State X.”	May defeat purposeful availment if the disclaimer is effective and adhered to.	Low – If truly passive and no transactions occur.
Engaging a third-party marketplace (Amazon FBA, Etsy) that warehouses and ships your goods into a state.	You may be availing yourself of the state’s benefits through your agent’s physical presence. See marketplace seller obligations.	Medium – Courts may impute the marketplace’s contacts to you.

Long-Arm Statutes in Action: The Hidden Triggers That Pull You Into Court

Long-arm statutes are the legislative engines that power a state’s ability to reach beyond its borders. While the federal minimum contacts doctrine sets the constitutional ceiling, state statutes define the practical floor for personal jurisdiction over out-of-state business. The critical nuance most analyses miss is that these statutes are not uniform; they are a patchwork of strategic legislative choices that create distinct risk profiles for businesses. Understanding this variability isn’t just academic—it dictates where you can be forced to mount a costly defending lawsuit in foreign state.

For example, California’s statute (Cal. Civ. Proc. Code § 410.10) is famously broad, allowing jurisdiction on any basis “not inconsistent” with the Constitution. This grants courts immense interpretive leeway, often leading to jurisdiction being found based on a “transaction of any business” within the state, which can include a single contract negotiation call. Conversely, Texas’s statute (Tex. Civ. Prac. & Rem. Code Ann. § 17.042) enumerates specific acts, like committing a tort “in whole or in part” within Texas. This seeming specificity contains a trap: if a product sold online causes harm to a Texas resident, the argument that the tort was “partially” committed in Texas can establish jurisdiction, even if the business never shipped anything there directly.

The most pervasive and overlooked pitfall, however, is the interaction between long-arm statutes and the simple act of registering to do business in a state. Many businesses register as a “foreign entity” in a new state solely to comply with corporate formalities. What they often fail to realize is that this act of registration can, under the statutes and case law of some states, be construed as consent to general personal jurisdiction for any lawsuit, even those arising from activities completely unrelated to the state. This transforms a routine compliance task into a major liability exposure. For a deeper understanding of this requirement, see what a registered agent is and why it is required.

State	Statutory Approach	Key Trigger Often Missed	Strategic Implication
California	Broad “Doing Business”	Interactive website + single sale to resident.	Low threshold for suit; high litigation risk.
New York	Transacts Business / Tort	Solicitation of business via persistent website.	Marketing efforts alone can establish jurisdiction.
Texas	Enumerated Acts	“Committing tort in part” via economic injury felt in-state.	Product liability & online disputes pose high risk.
Delaware	Narrow & Specific	Registration as a foreign corporation may = consent to general jurisdiction.	Corporate compliance directly increases litigation exposure.

The practical takeaway is that a one-size-fits-all national strategy is a liability. Businesses must conduct a state-by-state analysis of their activities mapped against specific long-arm language. This is not merely about sales volume; it’s about the nature of the contact. A single, high-value contract negotiation aimed at California can be riskier than dozens of passive sales into a state with a stricter statute.

Internet Business Jurisdiction: The Sliding Scale of Digital Contacts

The digital realm is the primary battleground for modern jurisdictional disputes. The classic “passive vs. active website” dichotomy is dangerously outdated. Courts now employ a fact-intensive “sliding scale” analysis, scrutinizing the nature and quality of commercial interactivity. For internet business jurisdiction, the question has evolved from “Do you have a website?” to “How does your digital ecosystem intentionally cultivate and monetize relationships with users in a forum state?”

We can break this down into a three-tier framework of digital interactivity that courts implicitly use:

1. Level 1: Informational Presence. A static “brochure” website. Traditionally low risk, but modern tools like geo-targeted ads or content personalization based on IP address can be used to argue for purposeful direction.
2. Level 2: Transactional Interactivity. This includes e-commerce platforms that ship goods, SaaS companies with subscription logins, or apps processing payments. This almost always satisfies the minimum contacts test for suits arising from those transactions. The legal requirements for these operations are complex; learn more in our guide to e-commerce legal requirements.
3. Level 3: Targeted Engagement & Data Monetization. This is the frontier. Here, jurisdiction can be established even without a direct sale. Examples include:
   • A free app that collects precise location data from users in a state to sell targeted advertising.
   • A website using cookies and tracking pixels to build detailed profiles of visitors for ad retargeting campaigns, as seen in cases like In re Facebook, Inc..
   • An API that allows third-party developers in a specific state to integrate with your service, creating an ongoing business relationship.

A critically underreported vector is the app store. Listing your app on a global platform like Apple’s App Store or Google Play, while necessary, can be framed by plaintiffs as an intentional act to serve every market, including those where you have no physical presence. Courts are split, but the argument adds litigation cost and uncertainty.

The actionable defense is a “Digital Footprint Audit.” Map every point of interaction a user in any state can have with your business online. For each, ask: Are we intentionally deriving commercial benefit from users in this state? If the answer is yes, you have likely established the “purposeful availment” needed for jurisdiction over related claims. Data practices are central to this risk; understanding state data privacy laws is now intertwined with jurisdictional defense.

Emerging Digital Frontiers: Crypto, SaaS, and the Remote Work Wildcard

The legal frameworks for jurisdiction are straining under new business models. Cryptocurrency ventures, SaaS platforms, and distributed remote teams operate in a fundamentally borderless way, creating novel and often unpredictable long-arm statute examples in real-time.

Cryptocurrency & Decentralized Protocols: The pseudonymous and decentralized nature of blockchain technology poses a direct challenge to traditional jurisdiction. Can a decentralized autonomous organization (DAO) with token holders globally be sued in a specific state? Regulators and courts are asserting jurisdiction based on several contact points: the location of core developers, the IP addresses of node operators, or, most commonly, the residence of users who are allegedly harmed. A business operating in this space must assume that any interaction with a U.S.-based user—through a token sale, NFT minting platform, or DeFi protocol—creates a jurisdictional hook. The evolving legal status of DAOs in the United States is a testament to this uncertainty.

Software-as-a-Service (SaaS) & The “Use” Location Problem: For a traditional e-commerce business, the contact is clear: a product is shipped to a physical address in a state. For SaaS, the “use” of the service is the product, and that use can occur anywhere. A company based in Delaware sells a project management SaaS to a New York corporation. The New York employees use it daily, but the servers are in Oregon, and the contract was signed by a manager working remotely from Florida. Where is the tort or transaction occurring? Courts are increasingly looking to the center of gravity of the business relationship and where the service is substantially utilized, not just the billing address. This creates multi-state exposure from a single B2B contract.

The Remote Work Complication: The proliferation of remote work has turned a traditional defensive shield—”we have no employees or office there”—into a potential vulnerability. If you employ a full-time remote worker in North Carolina, that individual’s daily activities on behalf of the company can establish a persistent “presence” in the state, potentially satisfying long-arm statutes for a wider range of claims. This isn’t just about payroll taxes; it’s about creating a continuous, deliberate contact with the forum state through human capital. This blurs the line between physical and digital presence, making a company’s internal HR decisions a direct input into its jurisdictional risk profile. The legal classification of these workers is paramount; missteps can lead to severe penalties outlined in our analysis of the legal consequences of not paying business taxes.

The through-line in all these frontiers is that technical architecture and business model choices are now de facto jurisdictional choices. Building a decentralized protocol, choosing not to geo-block certain states, or hiring a remote employee are all acts with latent legal consequences that can pull a business into an unexpected courtroom thousands of miles away.

Defending Against Improper Personal Jurisdiction: Strategic Motions and Procedural Counterplay

Successfully challenging a court’s authority to hear a case—a motion to dismiss for lack of personal jurisdiction—is a decisive early victory. It avoids the immense cost and leverage loss of litigating on foreign turf. The strategy moves beyond simple denials into a procedural counteroffensive designed to exploit the plaintiff’s burden of proof.

The Initial Salvo: The Special Appearance and Rule 12(b)(2) Motion

Your first move is critical. You must respond to the summons without inadvertently submitting to the court’s authority. This is done through a “special appearance,” a filing that participates in the case solely to contest jurisdiction. The core weapon is a Motion to Dismiss under Federal Rule of Civil Procedure 12(b)(2) (or its state equivalent). This motion argues the court lacks power over your business.

Why this matters: Filing a general answer or other substantive pleading can be construed as waiving your jurisdictional defense. This procedural forfeiture is a common and costly pitfall.

How it works: The motion must be your first response. It is supported by a declaration or affidavit from a company officer detailing the lack of minimum contacts with the forum state: no physical office, employees, bank accounts, targeted advertising, or direct sales stream into the state. The goal is to create a factual dispute the plaintiff must overcome.

What 99% of articles miss: The power of forcing the plaintiff into “jurisdictional discovery.” If your motion creates doubt, you can request limited discovery into the plaintiff’s claims of your contacts. This can mean demanding their evidence of your server logs, marketing analytics, or customer data. Often, plaintiffs lack this concrete proof, and their case for jurisdiction collapses under scrutiny.

Advanced Tactical Leverage: Beyond the Basic Motion

For the sophisticated defendant, several less-obvious procedural avenues can turn defense into offense.

• The TCPA Shield: If the lawsuit stems from telephone, text, or fax communications (e.g., a marketing-related claim), the Telephone Consumer Protection Act (TCPA) provides a unique defense. A TCPA lawsuit can only be brought in the district where the called party is located, or in any district where the call was transmitted. This federal law can preempt a state’s long-arm statute, forcing a transfer or dismissal. See 47 U.S.C. § 227(b)(3).
• Forum Non Conveniens: Even if jurisdiction technically exists, you can argue the chosen forum is severely inconvenient for witnesses and evidence, and another forum (often your home state) is vastly more appropriate. The 2013 Supreme Court case Atlantic Marine Constr. Co. v. U.S. Dist. Court strengthened this motion where parties have a valid forum selection clause, but it remains a viable, data-driven argument. Courts examine factors like witness access, evidence location, and public interest.
• Strategic Removal to Federal Court: If the plaintiff is from a different state and the amount in controversy exceeds $75,000, you may remove the case from state to federal court. Federal judges often apply jurisdictional standards more rigorously. This resets procedural timelines and can change the litigation dynamic, potentially making a subsequent motion to dismiss more effective.

Proactive Risk Mitigation: Jurisdictional Mapping and Contractual Safeguards

Litigation defense is a failure of prevention. The modern business must proactively map its jurisdictional exposure and engineer it away through structure and contract. This is not about avoiding lawful service but about managing predictable risk.

Conducting a Jurisdictional Risk Audit

Begin by treating jurisdiction as a quantifiable risk, not a legal abstraction. Create a “Jurisdictional Heat Map” for your operations. This audit scores each U.S. state based on several vectors:

Risk Vector	Low-Risk Indicators	High-Risk Indicators
Economic Nexus	Revenue under state’s economic nexus threshold (often $100k or 200 transactions).	Sales volume or transaction count exceeding threshold, creating sales tax nexus and a strong jurisdictional hook.
Digital Targeting	General, nationwide marketing.	Geo-targeted ads, state-specific landing pages, paid search campaigns for “[State] + [your service]”.
Human Capital	Fully remote team with no employees residing in-state.	Even one remote employee residing in a state can constitute “purposeful availment,” especially if they serve customers.
Contractual Privity	Standard online clickwrap terms with a neutral forum clause.	Negotiated contracts with in-state entities without a venue clause, or contracts governed by that state’s law.
Data & Infrastructure	Cloud servers in neutral locations.	Use of a CDN node or third-party service provider (e.g., a payment processor) physically located in the state.

This map identifies “hot” states where your minimum contacts are strongest, guiding where you might need to foreign qualify or, conversely, where you should dial back targeted activity.

Engineering Exposure Through Contract and Structure

With the risk map in hand, you can deploy structural and contractual defenses.

1. Entity Structuring: For high-risk, high-volume activities in a particular state, consider forming a separate, properly registered subsidiary or LLC to ring-fence liability. This entity becomes the proper target for lawsuits arising from that state’s activities. Understand the limits of this, however, as courts can sometimes pierce the corporate veil if the entities are not truly separate.
2. The Fortified Forum Selection Clause: Every customer, vendor, and partner agreement must contain a mandatory forum selection and choice-of-law clause. The language is paramount. It should read: “Any dispute arising from this agreement shall be brought exclusively in the state or federal courts located in [County], [Your Home State]. The parties hereby consent to the personal jurisdiction of such courts.” Post-Atlantic Marine, these clauses are given powerful deference, effectively overriding a plaintiff’s choice of forum unless they can show extraordinary, compelling reasons.
3. Terms of Service as a Shield: For online businesses, your Terms of Service are a primary line of defense. They must include:
   • A binding arbitration clause with a defined venue (e.g., “arbitration shall be conducted in [Your City, State]”).
   • A class-action waiver.
   • An express waiver of the user’s right to sue in their home court.
   • A clickwrap acceptance mechanism proven to be enforceable.
4. Operational Discipline: Avoid creating accidental contacts. Do not let sales staff travel to trade shows in high-risk states without a clear strategy. Do not retain customer service logs that could pinpoint user location if unnecessary. Be cautious with “cookie-cutter” marketing that auto-generates state-specific content.

The final, critical layer is ensuring your registered agent in your home state is reliable and that you maintain good standing there. When sued in a foreign state, your home-state court is your sanctuary. Keeping that sanctuary secure is the foundation of all proactive jurisdictional defense.