Coupang's Two Faces: How a Tech Giant Plays Jurisdiction Against Its Own Users

The Split Personality of Coupang

Coupang has two identities, and it deploys each one strategically depending on which room it’s walking into.

In New York, the company’s lawyers are arguing before Eastern District Judge Anne M. Donnelly that a data breach affecting 33.7 million people falls outside US jurisdiction because the incident occurred on a Korean platform. Coupang Inc., the Delaware-incorporated parent, is a separate legal entity from Korean Coupang, its lawyers maintain — meaning an American court has no business adjudicating what happened to Korean consumers on a Korean service.

In Washington, however, Coupang introduces itself very differently. It describes itself as an American-based employer, a job creator, a company contributing to US exports. In the first quarter alone, it reported spending $1.09 million on lobbying activities directed at the White House, the Vice President’s office, Congress, the Commerce Department, and the Office of the United States Trade Representative.

The same company. Two contradictory citizenships. A jurisdiction that benefits the corporation wherever it needs to land.

Why This Hearing Matters

The pre-trial conference held on September 1 in New York was not about the merits of the breach itself. It was about whether the American legal system has any authority to hear the case at all. That threshold question will determine the fate of roughly 7,800 people who have already signaled intent to join what started as a two-plaintiff suit filed on February 6 by Korean law firm Daeryun and its US partner, SJKP.

The plaintiffs’ claim is blunt: Coupang Inc. breached its duty of care and its obligation to protect personal information. They are seeking approximately $500 million in damages. Two representative plaintiffs reside in the Eastern District of New York, giving the court a foothold for personal jurisdiction over at least some of the named parties.

Judge Donnelly did not hide her skepticism. She pressed both sides to explain why this case belongs in her courtroom rather than a Korean one. Her questions cut to the core of the dispute: why should a New York federal court adjudicate a data breach that occurred on a platform operating in Korea, involving primarily Korean consumers?

That is the precise question Coupang wants answered affirmatively — but only when it suits the company’s interests.

The Plaintiffs’ Counterargument

The plaintiffs are not starting from zero. Their case rests on three pillars that attempt to pierce the corporate veil between Coupang Inc. and its Korean subsidiary.

First, Coupang Inc. is listed on the New York Stock Exchange. Its financial disclosures, executive decisions, and corporate governance flow through an American regulatory framework. Second, the parent company’s management exercises influence over the Korean subsidiary — a structural reality that separates Coupang from the arm’s-length corporate relationship it claims in court. Third, and perhaps most concretely, Coupang Inc. reported the data breach to the Securities and Exchange Commission, voluntarily entering the case into the American regulatory record.

That last point is significant. When a company discloses a material event to the SEC, it is effectively telling American regulators and investors that the event is its responsibility. You cannot simultaneously claim that relationship exists for regulatory compliance and deny it for legal liability. That is the contradiction the plaintiffs are trying to exploit.

Who Wins, Who Loses

If Judge Donnelly dismisses the case for lack of subject-matter or personal jurisdiction, the lawsuit ends immediately. There will be no trial on the merits, no finding of negligence, no determination of whether Coupang failed its users. The 33.7 million people whose data was exposed will have no American legal recourse, regardless of how the underlying facts look.

That outcome would reinforce a pattern already visible across the tech industry: platforms incorporate in jurisdictions that maximize their flexibility and minimize their exposure, then invoke those same structures to shield themselves from accountability wherever harm occurs.

If the case proceeds, the implications extend far beyond Coupang. A ruling that allows the lawsuit to move forward would establish that a US-incorporated, US-listed parent company can be held responsible for data protection failures at its foreign subsidiaries — even when the breach occurred overseas and involved predominantly foreign users. That would narrow the loophole Coupang is currently exploiting and signal to other tech platforms that corporate structure alone cannot insulate them from legal consequences.

The stakes for users are equally concrete. Korean consumers currently face a domestic legal system that may or may not provide adequate remedies for a breach of this scale. American consumers who join the suit are betting that US courts offer a more favorable path. Neither group is well served by a system where the company’s legal personality changes depending on who is asking the question.

The Bigger Picture: Treaty Shopping as Business Model

What Coupang is doing — pushing and pulling between legal regimes to land in whichever one offers the most favorable terms — is sometimes called “treaty shopping” when it involves international agreements, but the mechanism is identical when applied to corporate jurisdiction. The company lobbies in Washington as a domestic economic actor because that position yields protection, influence, and favorable policy. It litigates in New York as a foreign entity because that position yields insulation.

This is not unique to Coupang. It is a structural feature of an era in which tech companies operate globally but answer to no single jurisdiction comprehensively. Platforms Incorporated in Delaware, listed in New York, operated from Seoul or Singapore or Dublin, and claiming to serve every market simultaneously while resisting accountability in all of them.

The clock is now ticking. Judge Donnelly has ordered additional briefs due by October 6. After that, she will decide whether her court has the authority to hear this case at all. Until then, 33.7 million people are waiting to find out whether their data broker can choose its citizenship.

The answer will matter far beyond Korea.