DataDome SA v. Arkose Labs Holdings Inc

1. Case Identification

• Case #: IPR2025-00694
• Patent #: 9,148,427
• Filed: March 14, 2025
• Petitioner(s): DataDome S.A. and DataDome Solutions, Inc.
• Patent Owner(s): Arkose Labs Holdings, Inc.
• Challenged Claims: 1-17

2. Patent Overview

• Title: System and Method for Implementing a Robot Proof Web Site
• Brief Description: The ’427 patent describes systems and methods for distinguishing between human users and automated bots attempting to access a web resource. The technology involves presenting an "enforcement code," which includes an interactive challenge, to a user device and validating the user's response to determine whether to grant access.

3. Grounds for Unpatentability

Ground 1: Obviousness over Golle and Chellapilla - Claims 1-5, 10-14, and 16-17 are obvious over Golle in view of Chellapilla.

• Prior Art Relied Upon: Golle (Patent 8,549,637) and Chellapilla (Application # 2008/0127333).
• Core Argument for this Ground:
  • Prior Art Mapping: Petitioner argued that Golle discloses the core elements of independent claims 1 and 10, including a server system that receives a request from a user, generates a challenge (what Golle calls a "CAPTCHA"), transmits it to the user, receives a response, and validates it to allow or deny access. Petitioner contended that while Golle teaches a basic challenge-response system, it does not explicitly disclose collecting and analyzing user interaction telemetry during the challenge. Chellapilla was asserted to cure this deficiency by teaching a system that collects user interaction data (e.g., mouse movements, click timing) to analyze user behavior and distinguish humans from bots. Petitioner mapped the limitations of dependent claims, such as using images in the challenge and session identifiers, to explicit disclosures within Golle.
  • Motivation to Combine: A Person of Ordinary Skill in the Art (POSITA) would have been motivated to combine Golle's challenge-response framework with Chellapilla's telemetry analysis to create a more robust bot detection system. Petitioner asserted that by 2012, it was well-known that bots were becoming more sophisticated at solving simple CAPTCHAs, and adding a secondary layer of analysis based on user behavior, as taught by Chellapilla, was a logical and predictable improvement to enhance the security of the system disclosed in Golle.
  • Expectation of Success: A POSITA would have had a reasonable expectation of success in this combination, as it involved applying a known data analysis technique (Chellapilla's telemetry) to a known security framework (Golle's CAPTCHA system), which would have yielded predictable results.

Ground 2: Obviousness over Golle, Chellapilla, and Jakobsson - Claims 6-9 and 15 are obvious over Golle in view of Chellapilla and further in view of Jakobsson.

• Prior Art Relied Upon: Golle (’637 patent), Chellapilla (’333 application), and Jakobsson ("On the Security of Robot-Resistant Interfaces," a 2009 conference paper).

• Core Argument for this Ground:

  • Prior Art Mapping: This ground built upon the combination of Golle and Chellapilla from Ground 1 to address the limitations of claims 6-9 and 15, which relate to dynamically selecting or modifying the interactive challenge based on a risk assessment. Petitioner argued that the base combination of Golle and Chellapilla provided a risk signal (i.e., the telemetry analysis). Jakobsson was introduced because it explicitly teaches adjusting the difficulty or type of a user challenge based on a perceived risk level associated with a user or session. Therefore, Petitioner contended that Jakobsson teaches the missing element of using the risk data from the Chellapilla component to dynamically adjust the challenge from the Golle component.
  • Motivation to Combine: A POSITA, having already combined Golle and Chellapilla, would be motivated to incorporate the teachings of Jakobsson to improve the user experience and system efficiency. A static, difficult challenge for all users creates unnecessary friction. Jakobsson's teaching of adaptive challenges based on risk would allow the system to present easier challenges to low-risk users and reserve more difficult ones for high-risk sessions, a well-understood design goal in usability and security engineering.
  • Expectation of Success: The integration was argued to be predictable, as it involved using the output of one known technique (risk scoring) as the input for another known technique (adaptive challenge selection), with no technical barriers to implementation.

• Additional Grounds: Petitioner asserted additional obviousness challenges based on combinations including Von Ahn (Patent 7,657,933) and other secondary references, but relied on similar arguments regarding the combination of known CAPTCHA elements with behavioral analysis and adaptive difficulty.

4. Key Claim Construction Positions

• "enforcement code" (claims 1, 10): Petitioner argued this term should be construed under its plain and ordinary meaning as "a set of instructions and data transmitted to a user device for presenting an interactive challenge." This construction is broad and does not require a specific format, encryption, or single-package delivery. Petitioner contended this construction is necessary because the prior art discloses sending challenge components (e.g., images, scripts) that collectively function to present the challenge, which falls within the claim scope under this interpretation.

5. Arguments Regarding Discretionary Denial

• Petitioner argued that discretionary denial under §314(a) and the Fintiv factors would be inappropriate. The petition was filed early in the co-pending litigation, Arkose Labs Holdings, Inc. v. DataDome, No. 1:23-cv-01467-RGA (D. Del.), before substantial discovery has occurred and well before any potential trial date. Petitioner asserted that an inter partes review (IPR) provides a more efficient and expert forum for resolving the patentability issues, which are based on highly technical prior art combinations, and that a final written decision (FWD) would simplify issues for the district court.

6. Relief Requested

• Petitioner requests institution of IPR and cancellation of claims 1-17 of the ’427 patent as unpatentable under 35 U.S.C. §103.