DCT

1:23-cv-01467

Arkose Labs Holdings Inc v. DataDome

Log In
Key Events
Amended Complaint

I. Executive Summary and Procedural Information

  • Parties & Counsel:
  • Case Identification: 1:23-cv-01467, D. Del., 07/14/2025
  • Venue Allegations: Venue is alleged to be proper in the District of Delaware because Defendant DataDome USA is incorporated in the district, has committed acts of infringement there, and is directed and controlled by its French parent company, DataDome.
  • Core Dispute: Plaintiff alleges that Defendant’s CAPTCHA and bot detection products infringe two patents related to methods for creating a "robot proof" website by distinguishing human users from automated bots.
  • Technical Context: The technology at issue involves challenge-response systems (CAPTCHAs) used to prevent automated bots from engaging in fraudulent activities like account takeovers and credential stuffing, a critical component of modern cybersecurity infrastructure.
  • Key Procedural History: This Second Amended Complaint follows a court order on a motion to dismiss. The original complaint, filed December 27, 2023, asserted six patents. On July 8, 2025, the Court granted Defendant’s motion to dismiss with respect to four of those patents, finding them directed to ineligible subject matter under 35 U.S.C. § 101, but denied the motion as to the '427 Patent. The Court also dismissed the original willfulness claims but granted Plaintiff leave to amend to allege additional facts, which this complaint does.

Case Timeline

Date Event
2001-07-09 '510 Patent Priority Date
2008-05-01 '427 Patent Priority Date
2008-05-13 '510 Patent Issue Date
2015-09-29 '427 Patent Issue Date
2022-Summer Accused CAPTCHA Product Allegedly First Deployed
2022-10-06 Plaintiff's Counsel Sends First Letter to Defendant
2023-03-01 Defendant Allegedly on Notice of '427 Patent
2023-08-08 Defendant Allegedly on Notice of '510 Patent
2023-12-27 Original Complaint Filed
2024-03-14 First Amended Complaint Filed
2024-05-08 Defendant Files Motion to Partially Dismiss
2025-07-08 Court Issues Order on Motion to Dismiss
2025-07-14 Second Amended Complaint Filed

II. Technology and Patent(s)-in-Suit Analysis

U.S. Patent No. 7,373,510 - "System and Method for Implementing a Robot Proof Web Site," Issued May 13, 2008

The Invention Explained

  • Problem Addressed: The patent describes the problem of automated bots or web crawlers accessing websites, noting that while user registration can deter bots, it also deters legitimate human users (Compl. ¶84; ’510 Patent, col. 1:16-2:20).
  • The Patented Solution: The invention proposes a method to prevent bot access without requiring user registration. It involves responding to an initial request from an "undefined originator" with a challenge. Based on whether the challenge is fulfilled, the system either processes further requests or stops them. For unfulfilled challenges, the system employs specific technical steps, including logging the originator's IP address, starting a timer, and dropping or redirecting the TCP connection for subsequent requests from that IP address until the timer expires (’510 Patent, col. 2:24-32, 3:16-45; Compl. ¶83-84).
  • Technical Importance: This approach provides a technical filter to distinguish human users from bots without the high friction of a formal registration system, which was a significant operational hurdle for websites at the time (Compl. ¶84).

Key Claims at a Glance

  • The complaint asserts at least independent Claims 1 and 20 (Compl. ¶82).
  • The essential elements of independent Claim 1 include:
    • Receiving an initial request from an undefined originator and responding with a challenge.
    • Receiving a response and determining if the challenge is fulfilled.
    • If fulfilled, processing further requests.
    • If not fulfilled, stopping further requests by a multi-step process: dropping or redirecting a TCP connection, logging the source IP address, starting a timer, and then managing subsequent requests from that IP based on the timer's status.

U.S. Patent No. 9,148,427 - "System and Method for Implementing a Robot Proof Web Site," Issued September 29, 2015

The Invention Explained

  • Problem Addressed: Like its predecessor, the patent addresses the need to deter web crawlers and bots without the negative user experience of mandatory registration (Compl. ¶96; ’427 Patent, col. 1:23-2:25).
  • The Patented Solution: The invention refines the challenge-response method by specifying a particular format for the challenge. The system provides a challenge that includes "a plurality of graphical forms" along with "an accompanying textual expression describing one of the plurality of graphical forms." The user's response must include an "identification of a location of the described one" of the forms to be deemed successful (’427 Patent, col. 2:46-57; Compl. ¶95).
  • Technical Importance: This patent claims a specific type of visual and text-based CAPTCHA, representing a particular technical implementation of the broader human-verification concept that aims to be difficult for bots to parse (Compl. ¶96).

Key Claims at a Glance

  • The complaint asserts at least independent Claims 1 and 11 (Compl. ¶94).
  • The essential elements of independent Claim 1 include:
    • Receiving an initial request from an undefined originator.
    • Responding with a challenge that prompts a response.
    • Receiving the response, wherein the challenge includes: a plurality of graphical forms, and an accompanying textual expression describing one of those forms.
    • The response must include an identification of the location of the described graphical form.

III. The Accused Instrumentality

  • Product Identification: The "DataDome Accused Products" are identified as Defendant's "suite of online authentication, bot detection, API protection, fraud detection, and CAPTCHA products and services" (Compl. ¶5). A specific product, "Device Check," is also mentioned (Compl. ¶72).
  • Functionality and Market Context: The accused products are alleged to provide cybersecurity by protecting websites from bot and online fraud attacks using methods that include CAPTCHA, IP address monitoring, and analysis of behavioral biometrics (Compl. ¶71). The "Device Check" product is described as a challenge-response system that validates users by analyzing computational effort expended by the user's device, without a visible interaction (Compl. ¶72). Defendant’s counsel stated the accused CAPTCHA product was first deployed in the summer of 2022 and is not independently charged for (Compl. ¶22).

IV. Analysis of Infringement Allegations

The complaint does not include claim charts but states that the infringement allegations for the ’510 and ’427 patents are detailed in Exhibits G and H, respectively, which were not publicly filed with the complaint (Compl. ¶85, ¶97). The narrative infringement theory is summarized below.

  • '510 Patent Infringement Allegations: Arkose alleges that the DataDome Accused Products perform the method of Claim 1 by receiving requests, issuing challenges to "undefined originators," and then either permitting or blocking further access based on the response (Compl. ¶83, 85). The complaint does not specify which features of the Accused Products perform the detailed steps of IP logging, timer initiation, and TCP connection management required by the claim for failed challenges.
  • '427 Patent Infringement Allegations: Arkose alleges that DataDome's CAPTCHA products infringe Claim 1 by presenting a challenge that includes multiple graphical forms and a textual description requiring the user to identify the location of the correct form (Compl. ¶95, 97). The complaint provides a visual example of an Arkose Labs Inc CAPTCHA challenge, which instructs a user to rotate a 3D animal model to match a target orientation presented by a hand gesture (Compl. p. 14). This visual illustrates the type of interactive, graphical challenge technology central to the patent's claims.
  • Identified Points of Contention:
    • Technical Questions ('510 Patent): A primary question will be whether discovery reveals evidence that the DataDome Accused Products, including the "invisible" Device Check system, perform the highly specific sequence of actions recited for failed challenges in Claim 1—namely, the combination of logging an IP address, starting a timer, checking the timer on subsequent requests from that IP, and dropping or redirecting the TCP connection.
    • Scope Questions ('427 Patent): The infringement analysis will likely focus on the scope of the claim term "an accompanying textual expression describing one of the plurality of graphical forms." A key question is whether this language can be construed to cover modern CAPTCHAs that provide instructional text (e.g., "rotate the animal") rather than purely descriptive text (e.g., "click the cat").

V. Key Claim Terms for Construction

  • Term: "undefined originator" (’510 Patent, Claim 1)

    • Context and Importance: This term defines the user population subject to the patented method. Its construction is critical because if it is interpreted narrowly, it may not apply to all users that Defendant's system processes, potentially limiting the scope of infringement.
    • Intrinsic Evidence for a Broader Interpretation: The patent's focus on avoiding user registration suggests the term applies to any user whose status as human or bot has not yet been verified in a given session, regardless of prior history (Compl. ¶84).
    • Intrinsic Evidence for a Narrower Interpretation: The term could be interpreted to mean only a first-time visitor for whom no session data or cookies exist, which could exclude returning users from the scope of the claim.

  • Term: "an accompanying textual expression describing one of the plurality of graphical forms" (’427 Patent, Claim 1)

    • Context and Importance: This term is the central, defining feature of the specific CAPTCHA technology claimed in the '427 Patent. The entire infringement case for this patent may hinge on whether Defendant's challenges fall within the scope of this phrase. Practitioners may focus on this term because its construction will determine if the patent covers modern interactive challenges or is limited to a more simplistic "select the described image" format.
    • Intrinsic Evidence for a Broader Interpretation: The patent’s overall goal of distinguishing humans from bots may support an interpretation where any textual instruction that directs a user to select or manipulate a specific graphical element from multiple options serves to "describe" the target element or its state (Compl. ¶95-96).
    • Intrinsic Evidence for a Narrower Interpretation: The plain language of "describing" could be argued to require a literal description (e.g., "the image of a boat") rather than an instruction for manipulation (e.g., "rotate the animal"), potentially narrowing the claim's reach to an older style of CAPTCHA.

VI. Other Allegations

  • Indirect Infringement: The complaint alleges that DataDome induces infringement by configuring its products for customers and encouraging their use in a manner that DataDome knows is infringing (Compl. ¶86, ¶98).
  • Willful Infringement: The complaint alleges willful infringement based on pre-suit knowledge. It details a series of letters and communications between the parties' counsel starting on October 6, 2022, which allegedly put DataDome on notice of the '427 Patent by March 1, 2023, and the '510 Patent by August 8, 2023 (Compl. ¶6, ¶9-20). Arkose alleges that DataDome continued its infringing conduct despite this notice (Compl. ¶25).

VII. Analyst’s Conclusion: Key Questions for the Case

  • A key evidentiary question will be one of technical proof: does discovery show that DataDome’s accused products perform the specific, multi-part process for handling failed challenges—including IP logging, timer initiation, and TCP connection management—as strictly required by the '510 patent?
  • A central issue will be one of definitional scope: can the '427 patent's claim term "textual expression describing one of the plurality of graphical forms" be construed broadly enough to encompass the instructional text used in modern, interactive CAPTCHAs, or is it limited to a more literal, descriptive format?
  • Given the detailed allegations of pre-suit correspondence, a critical question for damages will be one of objective recklessness: did DataDome’s decision to continue its allegedly infringing conduct after receiving specific notice of the patents rise to the level of willfulness, which could justify an award of enhanced damages?