District of Massachusetts Has Personal Jurisdiction Over Out-of-State Adtech Defendant in Geolocation Case

Earlier this fall, the District of Massachusetts issued another notable decision in the growing wave of privacy litigation that, as discussed, raises difficult questions concerning standing, jurisdiction, and statutory interpretation. In Lionetta v. InMarket Media, LLC, Judge Kobick denied a motion to dismiss a putative class action alleging that InMarket Media, LLC collected and sold Massachusetts users’ precise geolocation data through software development kits (SDKs) embedded in third-party mobile applications. The ruling highlights the court’s willingness to exercise personal jurisdiction over out-of-state defendants whose business models rely on the collection and sale of Massachusetts-based location data.

Plaintiffs Allege InMarket Collected and Sold Their Precise Location Data Without Consent

InMarket aggregates consumer data through its own mobile apps and through an SDK integrated into over 300 third-party apps, installed on more than 390 million devices. The SDK allegedly collects detailed behavioral and geolocation information, which InMarket then sells to retailers and brands for targeted advertising and location-based push notifications.

The plaintiffs, both Massachusetts residents, used apps such as CVS, Stop & Shop, and Dunkin’, which they allege contained InMarket’s SDK. They claim they never provided informed consent for InMarket to collect, use, or monetize their location data. They assert claims for unjust enrichment and violation of Chapter 93A, seeking to represent a class of Massachusetts residents whose personal information was collected without informed consent.

InMarket moved to dismiss for lack of personal jurisdiction and failure to state a claim.

Why Lionetta is Different from Rosenthal: Forum Targeting and Data Use

Judge Kobick found specific jurisdiction under the First Circuit’s three-part due process test: relatedness, purposeful availment, and reasonableness.

On relatedness, the plaintiffs’ claims arose directly from InMarket’s allegedly Massachusetts-focused conduct. InMarket did not merely make its software accessible in Massachusetts. The SDK collected data from Massachusetts devices, and InMarket used that data to deliver targeted ads and push notifications to those same consumers, sometimes triggered by their proximity to local stores. This was sufficient to create a nexus between the forum, the defendant, and the alleged injury.

Purposeful availment was also satisfied. InMarket allegedly earned substantial revenue from Massachusetts-derived data and used that data to target Massachusetts consumers. The company is registered to do business in Massachusetts and employs remote workers here. These contacts made it foreseeable that InMarket could be haled into court in the Commonwealth.

The court addressed how this case differed from Rosenthal v. Bloomingdales.com, LLC, in which the First Circuit held that a retailer’s use of session-replay code on a national website did not create specific jurisdiction in Massachusetts. In Rosenthal, the website was not targeted to the Commonwealth, and the alleged tracking occurred uniformly across all visitors, regardless of location. The only Massachusetts connection in Rosenthal was the user’s action.

By contrast, InMarket’s conduct allegedly targeted the physical locations of Massachusetts residents and generated revenue from retailers’ interest in reaching those consumers in Massachusetts stores. The court emphasized that InMarket monetized the data precisely because it enabled Massachusetts-specific, real-world targeting. InMarket did not merely place its SDK in the stream of commerce but had an intent to serve Massachusetts customers. That forum-directed commercial activity, absent in Rosenthal, was critical to establishing specific jurisdiction.

Finally, the court found jurisdiction reasonable given Massachusetts’ strong interest in protecting residents’ privacy and InMarket’s failure to identify any unusual burden associated with litigating in the forum.

Unjust Enrichment Based on Monetization of Geolocation Data Does Not Require a Direct Transfer

The court held that plaintiffs plausibly stated an unjust enrichment claim. Even though the data flowed indirectly through third-party apps, Massachusetts law does not require a direct transfer. Plaintiffs alleged that their geolocation data was valuable, that InMarket profited from it, and that they reasonably expected but received no compensation. Relying on Tyler v. Michaels Stores, the court noted that misappropriation and monetization of personal data can constitute a cognizable benefit subject to restitution and disgorgement of a company’s profits can be an appropriate means of calculating damages for the unauthorized collection of private data.

Geolocation-Data Collection Without Informed Consent May Be Unfair or Deceptive

The Chapter 93A claim also survived. The court accepted that collecting and selling consumers’ geolocation data without informed consent could be unfair or deceptive. The court was guided again by Tyler, in which the Supreme Judicial Court held that a  merchant’s unlawful and deceptive collection of a personal information was an invasion of the consumer’s personal privacy that violated Chapter 93A. The Lionetta plaintiffs likewise adequately alleged injury by asserting loss of privacy and the sale of their data on the open market. Causation was satisfied because InMarket’s alleged conduct—the unauthorized collection and sale—directly produced the injury.

Key Takeaways: Geolocation Collection and Monetization Creates Unique Forum Contacts

Lionetta reinforces that Massachusetts courts will assert personal jurisdiction over out-of-state defendants when their business models involve targeted use of Massachusetts residents’ information. The decision also illustrates how plaintiffs might attempt to distinguish Rosenthal by pleading forum-specific targeting, local monetization, and real-time geolocation-driven advertising.

Although the court in Lionetta accepted allegations that plaintiffs ascribed value to their data and expected compensation, defendants should continue to challenge speculative and unspecified allegations, particularly when plaintiffs fail to plead facts about value or how and at what price they would sell their data. Defendants can also target factual allegations that fail to tie enrichment to the plaintiffs’ individual data (not just an aggregated or de-identified cohort). Companies collecting precise location data through SDKs or mobile integrations should expect heightened scrutiny under both unjust enrichment and Chapter 93A theories, and should reassess disclosures, consent practices, and Massachusetts-specific data operations accordingly.