Arkose Labs Holdings, Inc. v. DataDome

• Court: District Court, D. Delaware
• Decided: July 8, 2025
• Docket: 1:23-cv-01467
• Status: Unknown

Opinion

IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF DELAWARE

ARKOSE LABS HOLDINGS, INC. and ARKOSE LABS, INC., Plaintiffs, Civil Action No. 23-01467-RGA Vv. DATADOME and DATADOME SOLUTIONS, INC., Defendants.

MEMORANDUM OPINION Daniel Marcus Attaway, WOMBLE BOND DICKINSON (US) LLP, Wilmington, DE; Blake L. Holt, Christian E. Mammen, Daniel Grigore, WOMBLE BOND DICKINSON (US) LLP, San Francisco, CA, Attorneys for Plaintiffs. Andrew Colin Mayo, ASHBY & GEDDES, Wilmington, DE; Joseph Chern, ORRICK, HERRINGTON & SUTCLIFFE LLP, Irvine, CA; Pengweixi Sun, ORRICK, HERRINGTON & SUTCLIFFE LLP, Menlo Park, CA; Angela Colt, Richard F. Martinelli, Tyler Miller, ORRICK, HERRINGTON & SUTCLIFFE LLP, New York, NY, Attorneys for Defendants.

say f, 2025

Before me is Defendants’ motion to partially dismiss Plaintiffs’ first amended complaint 6) for failure to state a claim. (D.I. 9). I have reviewed the parties’ briefing and notice of supplemental authority. (D.I. 10, 15, 17, 19). For the reasons set forth below, Defendants’ motion is GRANTED in part and DENIED in part. I. BACKGROUND Plaintiffs Arkose Labs Holdings and Arkose Labs (collectively “Arkose”) brought this suit against Defendants DataDome and DataDome Solutions (collectively “DataDome”), Arkose asserts patent infringement of one or more claims of U.S. Patent Nos. 7,373,510 (“the °510 patent”), 9,148,427 (“the *427 patent”), 10,082,954 (“the °954 patent’), 10,147,049 (“the °049 patent”), 10,599,330 (“the *330 patent”), and 11,227,232 (“the ’232 patent”). (D.I. 6 § 1). Datadome moves to dismiss Counts HI—VI of Arkose’s first amended complaint, arguing that the patent, the °049 patent, the °330 patent, and the ’232 patent are invalid for lack of patentable subject matter under 35 U.S.C. § 101. (D.I. 9). DataDome moves to dismiss Count I, arguing that the °427 patent is invalid due to obviousness-type double patenting.’ (D.I. 9 at 1). DataDome moves to dismiss all allegations of willful infringement. (/d.). Arkose is a “leader in cybersecurity and fraud prevention . . . providing technology, including CAPTCHA (an acronym for ‘Completely Automated Public Turing test to tell Computers and Humans Apart’), to prevent online threats[.|” (D.I. 6 § 2). Arkose is the assignee of all right, title, and interest in the asserted patents. (/d. 4 7).

DataDome contends that the *510 patent is also invalid due to obviousness-type double patenting, but it does not argue that position in this motion. (D.I. 10 at 1 n.2).

For the purposes of Section 101, DataDome asserts that claim 1 of the ’330 patent is representative of all claims in the *330 and ’954 patents.” (D.I. 10 at 4). DataDome asserts that claim | of the patent is representative of all claims in the ’049 patent. (/d. at 11 n.10). DataDome asserts that claim 1 of the ’232 patent is representative of all claims in the ’232 patent. (/d. at 11.11). Arkose does not dispute that the claims are representative. (See generally D.I. 15). “Courts may treat a claim as representative . . . if the patentee does not present any meaningful argument for the distinctive significance of any claim limitations not found in the representative claim[.]” Mobile Acuity Ltd. v. Blippar Litd., 110 F.4th 1280, 1290 (Fed. Cir. 2024) (quoting Berkheimer v. HP Inc., 881 F.3d 1360, 1365 (Fed. Cir. 2018)). Accordingly, I treat claim 1 of the °330 patent as representative of the claims in the ?330 and ’954 patents; claim 1 of the °049 patent as representative of the claims in the ’049 patent; and claim 1 of the ’232 patent as representative of the claims in the °232 patent. Claim 1 of the ’330 patent states: 1. A method for challenging a user of a computing device, the method comprising: measuring one or more characteristics of a user action sensed by a computing device and performed by an authorized user of the computing device subsequent to the authorized user of the computing device having been identified as the authorized user of the computing device; determining that the measurements of the characteristics of the user action performed by the authorized user of the computing device subsequent to the authorized user of the computing device having been identified as the authorized user of the computing device meet a uniqueness condition with respect to measurements of corresponding characteristics of a corresponding action in a comparison set of actions; recording the user action and the measurements of the characteristics in a set of challenge actions associated with an authorized user;

* The 7330 patent is a continuation of the ’954 patent and the patents share a common specification. (D.I. 10 at 2 n.4). Likewise, the ’232 patent is a continuation of the ’049 patent and the patents share a common specification. (/d. at 2 n.3).

performing the measuring, determining, and recording for a plurality of different user actions associated with the authorized user responsive to determining that the measurements of the characteristics meet the uniqueness condition; and responsive to a challenge requirement to determine whether a current user of the computing device is the authorized user, selecting one or more of the challenge actions associated with the authorized user, prompting the current user of the computing device to perform the selected challenge actions, wherein the prompted actions performed by the current user are sensed by the computing device, measuring one or more characteristics of the prompted actions performed by the current user, and determining that the measurements of the characteristics of the prompted actions performed by the current user meet a similarity condition with respect to measurements of corresponding characteristics of the selected challenge actions, wherein the measuring, determining, recording, performing, selecting, and prompting are implemented in any of (a) computer hardware, and (b) computer software embodied in a non-transitory, computer-readable medium. (’330 patent at 8:49-9:27). Claim | of the ’049 patent states: 1. A method, comprising: for a system or application used by a plurality of users, providing an access to a memory device storing user data samples for all users of the plurality of users; selecting a target user from among the plurality of users; and using a processor on a computer and using data samples for the target user and data samples for other users of the plurality of users, generating a normal sample data set and an abnormal (anomalous) sample data set to serve as a training data set for training a model for an anomaly detection monitor for the target user such that the data samples of the target user are used to derive a normal sample data set for the training set and the data samples of other users are used to derive an abnormal sample data set for the training set. (7049 patent at 18:14—29). Claim 1 of the ’232 patent states: 1. A method, comprising:

for a system or an application used by a plurality of users, providing an access to a memory device storing user data samples of a usage of the system or the application for all users of the plurality of users; selecting a target user from among the plurality of users, using a processor on a computer, the data samples of the target user forming a cluster of data points in a data space; using the processor to take data samples for the target user to generate a normal sample data set as training data set for training a model for an anomaly detection monitor for the target user; and using a local outlier factor (LOF) function to generate an abnormal sample data set for training the anomaly detection monitor for the target user. patent at 18:22-37). Il. LEGAL STANDARD A. Motion to Dismiss The Federal Rules require a complainant to provide “a short and plain statement of the claim showing that the pleader is entitled to relief.” Fed. R. Civ. P. 8(a)(2). The Rules allow the accused party to bring a motion to dismiss the claim for failing to meet this standard. Fed. R. Civ. P 12(b)(6). A Rule 12(b)(6) motion may be granted only if, accepting the well-pleaded allegations in the complaint as true and viewing them in the light most favorable to the complainant, a court concludes that those allegations “could not raise a claim of entitlement to relief.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 558 (2007). “Though ‘detailed factual allegations’ are not required, a complaint must do more than simply provide ‘labels and conclusions’ or ‘a formulaic recitation of the elements of a cause of action.”” Davis v. Abington Mem’! Hosp., 765 F.3d 236, 241 (Gd Cir. 2014) (quoting Twombly, 550 U.S. at 555). Iam “not required to credit bald assertions or legal conclusions improperly alleged in the complaint.” Jn re Rockefeller Ctr. Props., Inc. Sec. Litig., 311 F.3d 198, 216 Gd Cir. 2002). A complaint may not be dismissed, however, “for imperfect statement of the legal theory supporting the claim asserted.” Johnson v. City of Shelby, 574 U.S. 10, 11 (2014).

A complainant must plead facts sufficient to show that a claim has “substantive plausibility.” Jd. at 12. That plausibility must be found on the face of the complaint. Ashcroft v. Igbal, 556 U.S. 662, 678 (2009). “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Jd. Deciding whether a claim is plausible is a “context-specific task that requires the reviewing court to draw on its judicial experience and common sense.” Jd. at 679. B. Patent-Eligible Subject Matter Patentability under 35 U.S.C. § 101 is a threshold legal issue. Bilski v. Kappos, 561 U.S. 593, 602 (2010). Accordingly, the section 101 inquiry is properly raised at the pleading stage if it is apparent from the face of the patent that the asserted claims are not directed to eligible subject matter. See Cleveland Clinic Found. v. True Health Diagnostics LLC, 859 F.3d 1352, 1360 (Fed. Cir. 2017). The inquiry is appropriate at this stage “only when there are no factual allegations that, taken as true, prevent resolving the eligibility question as a matter of law.” Aatrix Software, Inc. v. Green Shades Software, Inc., 882 F.3d 1121, 1125 (Fed. Cir. 2018). Section 101 of the Patent Act defines patent-eligible subject matter. It provides: “Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor,

subject to the conditions and requirements of this title.” 35 U.S.C. § 101. The Supreme Court recognizes three categories of subject matter that are not eligible for patents—laws of nature, natural phenomena, and abstract ideas. Alice Corp. v. CLS Bank Int'l, 573 U.S. 208, 216 (2014). The purpose of these exceptions is to protect the “basic tools of scientific and technological work.” Mayo Collaborative Servs. v. Prometheus Lab’ys, Inc., 566 U.S. 66, 71 (2012) (citation

omitted). Mathematical algorithms, steps that can be “performed by humans without a computer,” and “analyzing information by steps people go through in their minds” have been recognized as categories of abstract ideas. Alice, 573 U.S. at 222; Mortg. Grader, Inc. v. First Choice Loan Servs. Inc., 811 F.3d 1314, 1324 (Fed. Cir. 2016); Elec. Power Grp., LLC v. Alstom S.A., 830 F.3d 1350, 1354 (Fed. Cir. 2016). In Alice, the Supreme Court reaffirmed the framework laid out in Mayo “for distinguishing patents that claim laws of nature, natural phenomena, and abstract ideas from those that claim patent-eligible applications of those concepts.” Alice, 573 U.S. at 217. The framework is a two-step process. /d. At step one, I must decide whether the claims are drawn to a patent-ineligible concept. Jd. I determine whether the “focus” of the claims is “a specific means or method that improves the relevant technology” or rather is “directed to a result or effect that itself is the abstract idea.” Contour IP Holding LLC v. GoPro, Inc., 113 F.4th 1373, 1379 (Fed. Cir. 2024) (cleaned up) (citing McRO, Inc. v. Bandai Namco Games Am. Inc., 837 F.3d 1299, 1314 (Fed. Cir. 2016)); see Enfish, LLC v. Microsoft Corp., 822 F.3d 1327, 1335-36 (Fed. Cir. 2016). At this step, “the claims are considered in their entirety to ascertain whether their character as a whole is directed to excluded subject matter.” McRO, 837 F.3d at 1312 (quoting Internet Pats. Corp. v. Active Network, Inc., 790 F.3d 1343, 1346 (Fed. Cir. 2015)). If the claims are not directed to, or focused on, a patent-ineligible concept, then the inquiry ends, and the claims are not ineligible under section 101. /d. If the claims are directed to a patent-ineligible concept, I proceed to step two. Id. At step two, I “scrutinize the claim elements more microscopically[.]” Elec. Power Grp., 830 F.3d at 1354. I must look to “the elements of [the] claim both individually and as an

ordered combination” to see if there is an “inventive concept—i.e., an element or combination of elements that is sufficient to ensure that the patent in practice amounts to significantly more than a patent upon the ineligible concept itself” Alice, 573 U.S. at 217-18 (cleaned up). “A claim that recites an abstract idea must include additional features to ensure that the claim is more than a drafting effort designed to monopolize the abstract idea.” Jd. at 221 (cleaned up). Further, “the prohibition against patenting abstract ideas cannot be circumvented by attempting to limit the use of [the idea] to a particular technological environment.” Jd. at 222 (alteration in original) (quoting Bilski, 561 U.S. at 610). Thus, neither “the mere recitation of a generic computer” nor “vague, functional descriptions of server components” can render an abstract idea into a patentable invention. /d. at 223; TL] Commc’ns LLC v. AV Auto., L.L.C. (In re TLI Comme’ns LLC Pat. Litig.), 823 F.3d 607, 615 (Fed. Cir. 2016). Likewise, limiting the invention to a particular field does not suffice to confer patentability. See Elec. Power Grp., 830 F.3d at 1354 (finding that limiting claims to the “particular technological environment of power- grid monitoring” was insufficient alone to render abstract idea patentable). C. Obviousness Type Double Patenting The prohibition against obviousness-type double-patenting is a “judicially-created doctrine stem[ming] from 35 U.S.C. § 101, which provides that an inventor may obtain ‘a patent’ (i.e., a single patent) for an invention.” Allergan USA, Inc. v. MSN Lab’ys Private Ltd. 111 F.4th 1358, 1366-67 (Fed. Cir. 2024). “The doctrine’s primary goal is to prevent an unjustified timewise extension of patent exclusivity beyond the life of a patent.” Jd. at 1357. “A later claim that is not patentably distinct from, i.e., is obvious over or anticipated by, an earlier claim is invalid for obviousness-type double patenting.” Abbvie Inc. v. Mathilda & Terence Kennedy Inst. of Rheumatology Tr., 764 F.3d 1366, 1374 (Fed. Cir. 2014) (cleaned up) (citation omitted).

D. Willful Infringement “To establish willfulness, a patentee must show that the accused infringer had specific intent to infringe at the time of the challenged conduct.” Provisur Techs., Inc. v. Weber, Inc., 119 F.4th 948, 955 (Fed. Cir. 2024) (citation omitted). A plaintiff must plead both knowledge of the patent and knowledge of the infringement. iF7T Inc. v. Peloton Interactive, Inc., 2022 WL 609605, at *2 (D. Del. Jan. 28, 2022). “[T]he concept of ‘willfulness’ requires a jury to find no more than deliberate or intentional infringement.” SRI Int’l, Inc. v. Cisco Sys., Inc., 14 F.4th 1323, 1330 (Fed. Cir. 2021). Il. DISCUSSION DataDome moves to dismiss Counts IJI-VI of Arkose’s first amended complaint, arguing that the °954 patent, the ’049 patent, the *330 patent, and the ’232 patent are invalid for lack of patentable subject matter under 35 U.S.C. § 101. (DL. 9 at 1). DataDome moves to dismiss Count IJ, arguing that the °427 patent is invalid due to obviousness-type double patenting. (/d.). A. Section 101 1. °049 Patent and ’232 Patent The parties do not dispute that claim 1 in the ’049 patent is representative of all claims in the patent. The parties do not dispute that claim 1 of the ’232 patent is representative of all claims in the ’232 patent. The ’049 and °232 patents share a specification. I discuss both patents together. a. Alice Step One DataDome argues that claim 1 of the ’049 patent is “directed to a series of functional steps that call for either: (1) data gathering . . . or (2) data manipulation[.]” (D.I. 10 at 11).

Specifically, DataDome argues that claim 1 of the ’049 patent claims abstract mathematical concepts, “recit[ing] a series of steps for gathering and manipulating data for generating a statistical model about a target user’s system usage (normal behavior) by comparing it to other users’ usage (abnormal behavior).” (/d. at 10). DataDome argues that “‘conventional machine learning techniques that are described in broad functional terms” are also ineligible under step one. (/d. at 12). In support of this proposition, DataDome cites the District Court’s opinion in Recentive Analytics (id.), which the Federal Circuit affirmed after the briefing in this case was complete. See Recentive Analytics, Inc. v. Fox Corp., 692 F. Supp. 3d 438 (D. Del. 2023), aff'd, 134 F.4th 1205 (Fed. Cir. 2025). DataDome argues that “the ’232 Patent’s additional data gathering step and mathematical formula are just more abstract data collection and manipulation.” (D.I. 10 at 12). DataDome contends that the 049 and °232 patent claims fail to specify “how” those abstract ideas are implemented through “any particular method or technique” of training a model. at 10, 13-14). DataDome argues that the claims “do not recite any specific technology” and “can be performed entirely in the human mind or with pencil and paper.” (/d. at 13). DataDome contends that even the ’232 patent’s additional limitation of using a local outlier function could be performed “in the human mind to generate the abnormal sample data.” (/d.). Further, DataDome argues that the specification of the ’°049 patent (shared by the ’232 patent) discloses “use of a general-purpose computer to perform generic data collection and evaluation steps.” (/d. at 14 (citing ’049 patent at 15:45-47, 13:45—-51)). DataDome contends that the claims do not purport to “improve an underlying computing device.” (/d.). DataDome argues that the claims “do not even require a set of components or methods, such as measurement devices or techniques” to generate new data, but rather “merely require labeling

existing data samples” as normal and abnormal without a limit on how these samples are generated. (/d.). Arkose argues that DataDome characterizes the claims of the ’049 and ’232 patents at too high a level of abstraction. (D.I. 15 at 13). Arkose argues that its patents “are not simply directed to data gathering and manipulation” but rather are “directed to detecting and thwarting cyberattacks on computer systems through machine learning—which is a direct improvement to the computer itself.” (/d. at 15). Arkose contends that, despite DataDome’s argument that the claims “do not recite any specific technology,” the claims of the 049 and ’232 patents are similar to those found patent eligible in Koninklijke, which involved “devices generating check data.” (/d. at 17 (citing Koninklijke KPN N.V. v. Gemalto M2M GmbH, 942 F.3d 1143, 1150 (Fed. Cir. 2019))). In Koninklijke, the Federal Circuit found the claims were “directed to a non-abstract improvement in an existing technological process” despite lacking a recitation of how the “tool is applied in the overall system.” (/d. at 17-18 (quoting Koninklijke, 942 F.3d at 1150-51)). I find that both claim 1 of the ’049 patent and claim 1 of the ’232 patent are directed to the abstract idea of “collecting and manipulating data.” Under step one of the Alice framework, I “look at the focus of the claimed advance over the prior art to determine if the claim’s character as a whole is directed to excluded subject matter.” Koninklijke, 942 F.3d at 1149. I determine whether the focus of the claims is “a specific means or method that improves the relevant technology” or whether it is “a result or effect that itself is the abstract idea.” Contour IP Holding, 113 F.4th at 1379 (citation omitted). Purported improvements to technology must be captured in the language of the asserted claims themselves. Synopsys, Inc. v. Mentor Graphics Corp., 839 F.3d 1138, 1149 (Fed. Cir. 2016).

“[C]ollecting information, including when limited to particular content (which does not change its character as information)” is “within the realm of abstract ideas.” Elec. Power Grp., 830 F.3d at 1353. “[MlJerely presenting the results of abstract processes of collecting and analyzing information, without more . . . is abstract as an ancillary part of such collection and analysis.” Jd. at 1354. “[P]atents may be directed to abstract ideas where they disclose the use of an already available technology, with its already available basic functions, to use as a tool in executing the claimed process.” Recentive Analytics, 134 F.4th at 1214 (cleaned up) (citing SAP Am., Inc. v. InvestPic, LLC, 898 F.3d 1161, 1169-70 (Fed. Cir. 2018)). For software patents, including machine learning patents, I determine at step one “whether the claims focus on [a] specific asserted improvement in computer capabilities or, instead, on a process that qualifies as an abstract idea for which computers are invoked merely as a tool.” Jd. at 1212 (cleaned up) (citing Koninklijke, 942 F.3d at 1149). “[P]atents that do no more than claim the application of generic machine learning to new data environments, without disclosing improvements to the machine learning models to be applied, are patent ineligible under § 101.” Jd. at 1216. The patents in Recentive Analytics disclosed using information to train a machine learning model, then using that model to generate network maps and schedules. See id. at 1208— 1210. The Federal Circuit determined that the claims were directed to unpatentable abstract ideas because they did not “delineate steps” to effectuate improvements in the machine learning technology itself. /d. at 1213. Despite Arkose’s assertions that the ’049 and °232 claims are directed to “detecting and thwarting cyberattacks on [] computer systems through machine learning—which is a direct improvement on the computer itself,” (D.I. 15 at 14), the °232 and

°049 patent claims do not reflect this purported improvement. In fact, the ’049 and ’232 claims appear to disclose even less than those found unpatentable in Recentive Analytics. Claim 1 of the ’049 patent discloses a method of taking a “memory device” containing data samples from multiple users; selecting one target user from those users; and using a “processor” to create one data set with samples from that individual user (“normal”), and another data set with samples from other users (“abnormal”). The claim does not provide a particular method for creating these data sets. Claim 1 states that the “normal” and “abnormal” data sets are to be used as a “training data set for training a model for an anomaly detection monitor for the target user,” but fails to disclose either a step of training the model or any method for doing so. (049 patent at 18:14-29). Basically, claim 1 is directed to sorting data into two buckets. Claim 1 of the °232 patent is similar, but discloses using only the target user’s data to create the normal and abnormal data sets by “using a local outlier factor (LOF) function to generate an abnormal sample data set[.]” (232 patent at 18:35-37). Though this limitation discloses an algorithmic method for sorting the data, “mathematical algorithms, without more” are “essentially mental processes within the abstract-idea category.” Elec. Power Grp., 830 F.3d at 1354. “[T]he combination of two abstract ideas does not render an abstract idea less abstract.”

Broadband iTV, Inc. v. Amazon.com, Inc., 113 F.4th 1359, 1368 (Fed. Cir. 2024); see RecogniCorp, LLC v. Nintendo Co., 855 F.3d 1322, 1327 (Fed. Cir. 2017) (“Adding one abstract idea (math) to another abstract idea (encoding and decoding) does not render the claim non- abstract.”). Without additional limitations, a method involving taking “data sets” and “organizing this information into a new form” by “employ[ing] mathematical algorithms to manipulate existing information to generate additional information” is not patent eligible. Digitech Image Techs.,

LLC v. Elecs. for Imaging, Inc., 758 F.3d 1344, 1351 (Fed. Cir. 2014). Nothing in either claim discloses any particular way of protecting computers from cyberattacks, improving upon methods for sorting data, or improving upon methods for training a machine learning model using this data. Rather, both claims disclose steps for sorting data into “normal” and “abnormal” data sets. Therefore, I find that, when viewed as a whole, the methods of claim 1 of the ’049 patent and claim 1 of the ’232 patent are directed to the abstract idea of collecting and manipulating data. □

b. Alice Step Two At step two, I examine the claim limitations “both individually and as an ordered combination” to determine whether the claims disclose an “inventive concept sufficient to transform the claimed abstract idea into a patent-eligible application.” Alice, 573 U.S. at 217, 221 (cleaned up). Limiting claims to a “particular technological environment” is “insufficient to transform them into patent-eligible applications of the abstract idea at their core.” Elec. Power Grp, 830 F.3d at 1354. Much of the analysis at step one carries over to step two. As the Federal Circuit stated in In re Killian: We have explained that claims for methods that improve an existing technological process include an inventive concept at step two. And claims that recite a specific, discrete implementation of the abstract idea rather than preempting all ways of achieving an abstract idea using a computer may include an inventive concept. But claims to an abstract idea implemented on generic computer components, without providing a specific technical solution beyond simply using generic computer concepts in a conventional way do not pass muster at step two. Neither attempting to limit the use of the idea to a particular technological environment nor a wholly generic computer implementation is sufficient. 45 F.4th 1373, 1382-83 (Fed. Cir. 2022) (cleaned up) (internal citations omitted).

DataDome argues that the claims of the ’049 and ’232 patents “do not claim an inventive concept that is significantly more than the abstract idea of using a target user’s data and other users’ data to determine anomalous behavior.” (D.I. 10 at 15). Defendant argues that the claims recite “generic and conventional hardware”—namely a “processor on a computer” and a “memory device”—that “cannot do anything other than perform their well-understood, routine, and conventional activities previously known to the industry.” (/d. (citing, e.g, °049 patent at 15:45-47)). In response, Arkose merely attacks DataDome’s contentions as “conclusory” and “unhelpful” and argues DataDome “ignores that the claims are directed to detecting and thwarting cyberattacks on computer systems through machine learning[.]” (D.I. 15 at 18-19). Arkose does not suggest an inventive step. I agree with DataDome that the claims of both patents recite generic computer components performing in conventional ways. The claims do not recite an unconventional arrangement of components or specified means of performing the claimed activity. Even if the language of the claims hypothetically limited use of the invention to the context of “thwarting cyberattacks on computer systems,” this would merely serve to “limit the use of [the abstract idea] to a particular technological environment.” Alice, 573 U.S. at 222 (quoting Bilski, 561 U.S. at 610). Without an inventive concept detailing a technological improvement or “specific discrete implementation of the abstract idea,” the ’232 and °049 claims fail at step two. Therefore, applying the Alice two-step framework, I find that representative claim 1 of the ’049 patent and representative claim 1 of the ’232 patent (1) are directed to an abstract idea; and (2) fail to recite an inventive concept that would transform them into a patentable application of that idea. /d. at 217-18. All claims of the two patents are accordingly invalid for lack of

patentable subject matter under section 101. Counts IV and VI of Arkose’s complaint (D.I. 6) are DISMISSED. 2. °330 and ’954 Patents The parties do not dispute that claim 1 of the ’330 patent is representative of all claims in the °330 and °954 patents. a. Alice Step One DataDome argues that the °330 and ’954 patents address “the basic, well-known security ‘need to ensure that a user of a computing device is the owner of the computing device or is authorized to use the computing device.”” (D.I. 10 at 3 (quoting ’954 patent at 1:8-10)). DataDome contends that the patents are directed to the abstract idea of “noticing unique characteristics of a user’s actions and then using those characteristics as a test to confirm a user’s identity.” (/d. at 5). DataDome argues that the claims are not limited to “any sort of action or characteristic,” “any method or standard for determining uniqueness and similarity,” or any way the claimed method would be “technologically implemented.” (/d. at 4, 5, 7). Rather, DataDome argues that the claims “rely completely on conventional general-purpose computer technology” and “conventional techniques.” (/d. at 8 (citing °954 patent at 4:16—-19)). DataDome contends that the claim language could apply to “just about any human activity,” analogizing the computer’s activities to the George and Jra Gershwin song “They Can’t Take That Away From Me,” featured in the 1937 movie Shall We Dance, during which Fred Astaire notices Ginger Rogers’ unique features and remembers them later. (/d. at 5-6). More specifically, DataDome argues that the claimed process “maps to traditional authentication processes” performed by human beings, such as checking signatures or fingerprinting. (/d. at 6).

Arkose argues that the °954 and °330 patents are “directed to solving a specific problem in computing and are necessarily rooted in computer technology.” (D.I. 15 at 9). Arkose argues that the claims “are not simply directed to classifying and organizing information,” but instead are “directed to actively analyzing user authentication data to thwart cybersecurity threats.” Arkose argues that the patents do not simply implement “analog authentication techniques” on a computer, and denies that the patents allow for “any method” to assess “uniqueness or similarity.” (/d. at 8). I agree with DataDome that claim 1 of the ’330 patent is directed to the abstract idea of *using unique characteristics of a user’s actions to confirm the user’s identity.” Claim 1 recites a series of steps: (1) “measuring one or more characteristics” of an authorized user’s actions; (2) “determining” those measurements “meet a uniqueness condition” compared to other actions; (3) “recording” the user’s actions and measurements “in a set of challenge actions”; and (4) “performing” steps 1 through 3 for “a plurality of different user actions.” Then, (5) in response to a later “challenge requirement,” “selecting” one or more “challenge actions”; (6) “prompting” an unknown user to perform the “challenge actions”; (7) “measuring” the characteristics of the “challenge actions”; and (8) “determining” that those measurements meet a “similarity condition” compared with the actions known to be performed by the authorized user. The claim discloses that these steps are to be implemented with computer hardware or software. (’330 patent at 8:51-9:27). DataDome’s illustrative example from the Golden Age of Hollywood reminds me of another classic film: the 1998 version of The Parent Trap. After meeting for the first time at summer camp, twins Annie and Hallie decide to switch places to meet each other’s respective parents. Hallie teaches Annie an elaborate handshake (involving a “plurality of user actions”) so

that when Annie arrives in London and meets the family’s butler, Martin, Annie’s false identity will not be discovered. When Annie arrives in London, Martin sets her a “challenge requirement” of performing the handshake. He then “measures” her actions and “determines” that those actions meet a “similarity condition” compared with the actions performed by Hallie (the “authorized user”) before she left for summer camp. Perhaps a computer would be better or more efficient than a human butler at telling the difference between one twin masquerading as the other, or a bot masquerading as an authorized user. But “[mJethod[s] of organizing human activity,” “analyzing information by steps people go through in their minds,” and steps that can be “performed by humans without a computer” are all abstract ideas. Alice, 573 U.S. at 220; Elec. Power Grp., 830 F.3d at 1354; Moritg. Grader, 811 F.3d at 1324. The language in claim 1 of the patent does not focus on improving the functioning of computers by thwarting cyberattacks. See Synopsys, Inc., 839 F.3d at 1149. Neither is the “focus” of claim 1 “a specific means or method that improves the relevant technology.” Contour IP Holding, 113 F.4th at 1379. Instead, claim 1 is “directed to a result or effect that itself is the abstract idea.” Id. When viewed as a whole, I find that the method of claim 1 of the ’330 patent is directed to the abstract idea of using unique characteristics of a user’s actions to confirm the user’s identity. b. Alice Step Two DataDome argues that the claims do not disclose an improvement to computers or any inventive concept sufficient to survive step 2. (D.I. 10 at 9). DataDome argues the claims do not require “a new source or type of information, or new techniques for analyzing it,” “inventive

programming,” or even “an arguably inventive set of components or methods, such as measurement devices or techniques, that would generate new data.” (/d. (quoting Elec. Power Grp., 830 F.3d at 1355)). Arkose argues that the claims are “specific implementations of a system that determines that suspicious activity may be occurring then actively addresses it.” (D.I. 15 at 13). Arkose argues that claim 1 includes an inventive concept because it is “directed to improving the functioning and efficiency of the computer system” and to solving the computer-specific problem of “bot and other cyber-attacks.” (/d. at 8). “An inventive concept cannot simply be an instruction to implement or apply the abstract idea on a computer.” Univ. of Fla. Rsch. Found., Inc. v. Gen. Elec. Co., 916 F.3d 1363, 1369 (Fed. Cir. 2019) (cleaned up). A “computing device,” “computer hardware,” and “computer software embodied in a non-transitory computer-readable medium” are all generic computer components. (330 patent at 8:52, 9:25-27); see In re Killian, 45 F Ath at 1382. Arkose’s only suggested “inventive concept” merely attempts to limit the use of the abstract idea to the technological field of cybersecurity without detailing any particular implementation. See Alice, 573 USS. at 222; Elec. Power Grp., 830 F.3d at 1354. Therefore, applying the Alice two-step framework, | find that representative claim 1 of the °330 patent is (1) directed to an abstract idea; and (2) fails to recite an inventive concept that would transform it into a patentable application of that idea. Alice, 573 U.S. at 217-18. All claims in the 330 and ’954 patents are accordingly directed to unpatentable subject matter under section 101. Counts III and V of Arkose’s complaint (D.I. 6) are DISMISSED.

B. Obviousness-Type Double Patenting: ’427 Patent DataDome argues that the °427 patent is invalid for obviousness-type double patenting (“ODP”) in view of expired U.S. Patent No. 9,558,340 (“the ’340 patent”). (D.I. 10 at 16). Its argument largely depends upon the now-reversed district court opinion in Allergan USA, Inc. v. MSN Lab’ys Private Ltd., 694 F. Supp. 511 (D. Del. 2023). Before addressing patentable distinctiveness, whether a patent qualifies as an ODP reference is a threshold issue. See Novartis AG v. Ezra Ventures LLC, 909 F.3d 1367, 1375 n.4 (Fed. Cir. 2018). The °427 and ’340 patents are part of the same patent family and claim priority to the same patent application. The °340 patent is a continuation of the ’427 patent, which itself is a continuation of U.S. Patent No. 7,373,510. (427 patent at 1; °340 patent at 1-2). The application for the °427 patent was filed on May 1, 2008 and the patent issued on September 29, 2015. The application for the ’340 patent was filed on August 15, 2015 and the patent issued on January 31, 2017 subject to a terminal disclaimer over the ’427 patent. (D.I. 15 at 3 (citing D.I. 16-3, Ex. C)). The ’427 patent received a 2,019-day patent term adjustment (“PTA”). (°427 patent at 1). The °340 patent received no PTA and expired on March 8, 2021 for non-payment of fees. (D.I. 15 at 3).? To summarize, DataDome asserts a later-filed, later-issued, earlier-expiring patent as an ODP reference to invalidate an earlier-filed (but not “first-filed”), earlier-issued, later-expiring patent with the same priority date. □ For patents filed after June 8, 1995, the passage of the Uruguay Round Agreements Act of 1994 (URAA) “changed the term of a U.S. patent from 17 years from the issuance date to 20

3] think it would have expired on July 9, 2021, in any event. The exact date of expiration is irrelevant to the current dispute. 20

years from the filing date of the earliest U.S. or Patent Cooperation Treaty (PCT) application to which priority is claimed, excluding provisional patents.” Novartis Pharms. Corp. v. Breckenridge Pharm. Inc., 909 F.3d 1355, 1359 (Fed. Cir. 2018); Pub. L. No. 103-465, § 532(a), 108 Stat. 4809, 4983-85 (1994). Pre-URAA, patent expiration dates were “inextricably intertwined with the issuance date.” Gilead Scis., Inc. v. Natco Pharma Ltd., 753 F.3d 1208, 1215 (Fed. Cir. 2014). Accordingly, pre-URAA double patenting doctrine focused on issuance dates as a “reliable stand-in” for expiration. Id. However, post-URAA, a patent’s issuance date does not determine expiration date and “there are now instances . . . in which a patent that issues first does not expire first.” Jd. In Gilead, the Federal Circuit found that, when both patents are post-URAA patents, “a patent that issues after, but expires before, another patent [can] qualify as a double patenting reference for that other, later-expiring patent.” Ezra Ventures, 909 F.3d at 1374 (citing Gilead, 753 F.3d at 1211-12, 1217). However, Gilead was limited to the “circumstances of that case” and “did not address the role of filing dates.” Allergan, 111 F.4th at 1370 (cleaned up). The Federal Circuit in Gilead “focused its inquiry only on whether issuance dates should remain the most relevant benchmark for evaluating ODP post-URAA.” Jd. Another consequence of the changes effected by the URAA is that delays in prosecution now have the potential to shorten a patent term. To account for this lost time, Congress codified patent term adjustments (“PTA”). Jd. at 1367; 35 U.S.C. § 154(b((1)(A)-(B). In Jn re: Cellect, the Federal Circuit held that “ODP for a patent that has received PTA, regardless of whether or not a terminal disclaimer is required or has been filed, must be based on the expiration date of the patent after PTA has been added.” Jn re: Cellect, LLC, 81 F.4th 1216, 1229 (Fed. Cir. 2023). When evaluating ODP on a patent that has received PTA, “the relevant expiration date is the

expiration date including PTA—not the original expiration date measured twenty years from the priority date.” Allergan, 111 F.4th at 1368. DataDome argues, “Because the identical claims of the °427 Patent have not yet expired simply because the ’427 Patent received a PTA extension, without a corresponding terminal disclaimer filed in the other direction, they are invalid.” (D.I. 10 at 17). DataDome relies on the factual background of Jn re: Cellect, in which four earlier-filed patents were invalidated by a later-filed patent. (/d. at 19). Arkose argues, “The relevant issue in [Jn re:] Cellect was limited to whether PTA should be treated the same as patent term extension (“PTE”); the court did not consider the issue, uncontested by the parties, whether a later-filed, later-issued, but earlier-expired patent could be ateference patent for ODP purposes.” (D.I. 15 at 3). The Federal Circuit clarified in Allergan that Arkose’s position on Jn re: Cellect is correct. Jn re: Cellect did not address “under what circumstances can a claim properly serve as an ODP reference” as the patent owner did not challenge the propriety of the ODP reference claims. Allergan, 111 F.4th at 1368-69, 1369 n. 6. Accordingly, despite the similarity to the facts in the case at hand,’ the Federal Circuit’s affirmance in Jn re: Cellect of the PTAB’s decision invalidating claims for ODP using later-filed, later-issued, earlier-expiring reference claims does not control. See Jn re: Cellect, 81 F.4th at 1220 (discussing invalidation during ex parte reexamination of °369 patent claims by ’036 patent claims with common priority date that were later-filed, later-issued, and earlier-expiring).

‘ Like this case, the °036 and ’369 patents in Jn re: Cellect both claimed priority to a prior “first- filed” patent. Therefore, for ODP purposes, the ’369 patent was an “earlier-filed” patent rather than a “first-filed” patent. The Federal Circuit distinguished the factual situation in Jn re: Cellect from the one in Allergan, stating “[Jn re:] Cellect did not involve the situation presented here of ODP with respect to a first-filed, first-issued patent.” Allergan, 111 F.4th at 1369 n.6. 22

In Allergan, the Federal Circuit held that “a first-filed, first-issued, later-expiring claim cannot be invalidated by a later-filed, later-issued, earlier expiring reference claim having a common priority date.” Allergan, 111 F.4th at 1369. The 340 patent shares a priority date with the °427 patent, was filed later, issued later, and would have expired earlier with or without non- payment of fees. The Federal Circuit’s holding in Allergan maps onto the relationship between the ’427 patent and the °340 purported ODP reference patent, with the exception that the °427 patent was “earlier-filed,” not “first-filed.” Though the °427 patent is not the first patent in its family, the °427 patent is the parent of, shares a priority date with, was filed before, and issued before the *340 patent. See id. at 1370-71. The purpose of ODP doctrine is to “prevent patentees from obtaining a second patent on a patentably indistinct invention to effectively extend the life of a first patent to that subject matter.” Jd. at 1369. Because both patents share a priority date, requiring Arkose “to file a terminal disclaimer disclaiming any term of the parent that extends beyond that of the child... would amount to the disclaimer of only PTA.” Jd. at 1371. The °471 patent would be “limited to the . . . term of its own child”—a result the Federal Circuit has characterized as “untenable.” Jd. “[C]laims in the challenged patents are entitled to their full term, including the duly granted PTA, unless they are found to be later-filed obvious variations of earlier-filed, commonly-owned claims.” Jn re: Cellect, 81 F.4th at 1230. Another court in this district has found that challenged earlier-filed patents are “entitled to their full term, including the PTA” and declined to allow a later-filed, later-issued, earlier-expiring patent to serve as an ODP reference for an earlier-filed, earlier-issued, later-expiring patent. Acadia Pharms. Inc. v. Aurobindo Pharma Ltd., 706 F. Supp. 3d 477, 487 (D. Del. 2023), aff'd 2025 WL 1618201 (Fed. Cir. June

9, 2025) (relying upon Allergan). Like in Allergan, the ’427 patent “does not extend any period of exclusivity on the claimed subject matter.” Allergan, 111 F.4th at 1370. I find that the °340 patent is not a proper ODP reference patent for the 427 patent. DataDome’s motion to dismiss Count II of Arkose’s complaint is DENIED. C. Willful Infringement DataDome argues that Arkose does not allege any pre-suit knowledge of infringement because its pre-suit letters did not cite the patents at issue in this case. (D.I. 10 at 20). Arkose bases its willful infringement allegations on the receipt of “this Complaint,” stating that the receipt gave DataDome “notice of its infringement.” (D.I. 6 38, 54, 66, 78, 90, 102, 114). DataDome argues that this is “insufficient to state a claim for willful infringement.” (/d.). I agree. For willfulness, “when there is no pre-suit knowledge, it is not sufficient merely to allege the defendant has knowledge since the filing of the original complaint and has not ceased doing whatever the infringing behavior is alleged to be.” Wrinki, Inc. v. Facebook, Inc., 2021 WL 4477022, at *7 (D. Del. Sept. 30, 2021). Arkose states that it provided sufficient notice by letters it sent before it filed suit. (See D.I. 11-4 (510 patent); D.I. 11-3 (427 patent)). That notice is not alleged in the amended complaint. Arkose seeks leave to amend its complaint to allege willfulness. (D.I. 15 at 20 n.1). It seems plausible that Arkose can do so by alleging facts about pre-suit notice. DataDome’s motion to dismiss Arkose’s claims of willful infringement is GRANTED. Arkose is given leave to amend its complaint as to willful infringement, so long as it files an amended complaint within seven days.

IV. CONCLUSION Defendant’s motion to dismiss Count II (°427 patent) is DENIED. Defendant’s motion to dismiss Counts III (°954 patent) and V (330 patent) is GRANTED. Defendant’s motion to dismiss Count IV (’049 patent) and Count VI (’232 patent) is GRANTED. Defendant’s motion to dismiss Plaintiff's claim of willful infringement is GRANTED. I grant Plaintiff leave to amend its complaint as to willful infringement. An appropriate order will issue.