Colossus Media, LLC v. Adalytics Research, LLC

Opinion

IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF MARYLAND

: COLOSSUS MEDIA, LLC :

v. : Civil Action No. DKC 24-1402

: ADALYTICS RESEARCH, LLC :

MEMORANDUM OPINION Presently pending and ready for resolution in this false advertising and defamation case is the motion to quash or for protective order filed by Plaintiff Colossus Media, LLC (“Colossus” or “Plaintiff”) regarding subpoenas issued to two third parties: (1) BidSwitch, Inc. (“BidSwitch”); and (2) Basis Global Technology, Inc. (“Basis”) (collectively, “Third Parties”). (ECF No. 59). The issues have been briefed, and the court now rules, no hearing being deemed necessary. Local Rule 105.6. For the following reasons, the motion will be denied. I. Background A. Factual Background The facts giving rise to this dispute are set forth in previous opinions. (ECF Nos. 24; 44). In short, Colossus, a “sell- side platform (“SSP”),” has sued Defendant Adalytics Research, LLC (“Adalytics” or “Defendant”), a company that “purports to conduct advertising analytics,” relating to a May 2024 blog post published by Adalytics. (ECF No. 9 ¶¶ 1, 16, 23). Colossus’s parent company Direct Digital Holdings, Inc. (“DRCT”) is not a party to the litigation. According to the amended complaint, the at-issue “post portrayed [Colossus] as mis-declaring user IDs in its bid requests

for the purpose of selling ad space at higher prices to ad buyers seeking to serve advertisements to a targeted audience.” (Id. ¶ 24). Colossus states that it “utilizes proprietary technology to automate the sale of ad inventory between advertisers and agencies, a process which involves matching up a cookie-based user ID to a demand side platform (“DSP”) user ID to make sure that ads are displayed to their respective target audiences.” (ECF No. 59-1, at 6). According to Colossus, third-party BidSwitch is “an intermediary that helps connect SSPs,” including Colossus itself, “with DSPs”; “Colossus handles at least 12 billion . . . ad requests on any given day, many of them flowing through” BidSwitch. (Id. at 6). Also as part of its operations, Colossus uses the

programming of third-party Basis. Colossus states that each request it executes through Basis’s programming takes “less than half a second.” (Id.). B. Procedural Background Discovery began in early April this year. At the end of the month, Adalytics served its first set of requests for production on Colossus. (ECF No. 59-2). Beginning in mid-May, Adalytics 2 served on each of the Third Parties a subpoena to produce documents. (ECF Nos. 59-3; 59-4). Colossus challenged both subpoenas in the United States District Court for the District of

Columbia on June 17, 2026. Pursuant to Fed.R.Civ.P. 45 (“Rule 45”), that court transferred the motion to this court, after obtaining consent from the Third Parties.1 By August 4, 2026, all pertinent motion papers were entered on this docket. (See ECF Nos. 58-63). The day before, the parties’ joint motion to extend deadlines was granted. (ECF No. 57). The Third Parties have not challenged the subpoenas. C. The Basis Subpoena Adalytics’ document subpoena to Basis contains five requests, covering November 1, 2023, to December 31, 2024, commanding production of: 1) All communications between You and Colossus relating to mismatched Advertising IDs, including, but not limited to, any business issues or concerns arising from such mismatches.

2) All communications between You and DRCT relating to mismatched Advertising IDs, including, but not limited to, any

1 Pursuant to Rule 45(f), if the court where compliance is required did not issue the subpoena, it may transfer the motion to the issuing court. After deciding the motion, the issuing court may then transfer the order to the court where the motion was made to enforce its decision. 3 business issues or concerns arising from such mismatches.

3) Any aggregation queries of log-level data concerning inconsistencies between user IDs declared by Colossus or DRCT in bid requests, on the one hand, and actual user IDs mapped by Basis using browser cookie identifiers, on the other.

4) All communications between You and Colossus relating to any irregularities or anomalies in Colossus or DRCT publishing advertising information, including, but not limited to, communications regarding Colossus’s compliance or non-compliance with Basis Rules, DRCT’s compliance or non-compliance with Basis Rules, or Non- Compliant Inventory.

5) All communications between You and DRCT relating to any irregularities or anomalies in Colossus or DRCT publishing advertising information, including, but not limited to, communications regarding Colossus’s compliance or non-compliance with Basis Rules, DRCT’s compliance or non-compliance with Basis Rules, or Non- Compliant Inventory.

(ECF No. 59-3, at 11–12). D. The BidSwitch Subpoena Adalytics’ document subpoena to BidSwitch contains six document requests for materials between May 5, 2024, and August 31, 2024, unless otherwise indicated: 1) Provide the BidSwitch Terms of Supply Partners with Colossus and/or DRCT in effect on May 1, 2024.

2) All communications between You and Colossus between May 1, 2024 and August 4 31, 2024 relating to Colossus’s compliance or non-compliance with BidSwitch Rules, including, but not limited to, communications regarding Colossus’s supply quality or Non-Compliant Inventory, including mismatches in the “buyer user ID” or “user ID” field of an ad auction bid request.

3) All communications between You and DRCT between May 1, 2024 and August 31, 2024 relating to Colossus’s compliance or non- compliance with BidSwitch Rules, including, but not limited to, communications regarding Colossus’s supply quality or Non-Compliant Inventory, including mismatches in the “buyer user ID” or “user ID” field of an ad auction bid request

4) All communications between You and any BidSwitch customers between May 1, 2024 and August 31, 2024 regarding Colossus’s compliance or non-compliance with BidSwitch Rules, including, but not limited to, communications regarding Colossus’s supply quality or Non-Compliant Inventory, including mismatches in the “buyer user ID” or “user ID” field of an ad auction bid request.

5) All communications between You and any BidSwitch customers between September 30, 2023 and August 31, 2024 regarding a request to pause or restrict bid requests submitted by Colossus.

6) All documents relating to the Report, including communications between You and any third-party regarding the Report between May 1, 2024 and August 31, 2024.

(ECF No. 59-4, at 12–13). 5 C. The Pending Motion Colossus contends that the subpoenas (1) place an undue burden on the non-parties; (2) seek irrelevant information; and (3) seek confidential commercially sensitive information. (See ECF No. 59-

1, at 10, 12, 15). It moves either to quash the subpoenas, or for the entry of a protective order.2 Also, due to the undue burden Adalytics has allegedly saddled upon the Third Parties, Colossus asks the court to “award appropriate sanctions” pursuant to Rule 45(d)(1). (Id. at 12). Overall, Colossus contends that the subpoenas are unjustified and were served for the singular reason of “further sow[ing] distrust between Colossus and its partners in the industry and to cause additional reputational harm to Colossus.” (Id. at 6). II. Standard of Review Under Rule 26, in certain circumstances, a court must limit the frequency or extent of otherwise allowable discovery,

including where “the discovery sought is unreasonably cumulative or duplicative, or can be obtained from some other source that is more convenient, less burdensome, or less expensive[.]” Fed.R.Civ.P. 26(b)(2)(C)(i). Rule 26 further grants district courts “‘broad discretion “to decide when a protective order is

2 The contents of the requested protective order are not otherwise specified, except for a reference to Fed.R.Civ.P. 26(c). 6 appropriate and what degree of protection is required.”’” Green v. iMentor, Inc., No. 24-cv-2567-RDB, 2026 WL 1074003, at *3 (D.Md. Apr. 21, 2026) (quoting Hugler v. Chimes Dist. of Columbia, Inc.,

No. 15-cv-3315-RDB, 2017 WL 1322109, at *1 (D.Md. Apr. 6, 2017) (citation omitted)). It is likewise within the discretion of a district court to determine whether a third-party subpoena under Rule 45 seeks irrelevant information or imposes an undue burden. In re Am. Med. Sys., MDL No. 2325, 2016 WL 307790, at *3 (S.D.W.Va. May 31, 2016) (citing Jones v. Hirschfeld, 219 F.R.D. 71, 74 (S.D.N.Y. 2003) (citations omitted)). In the absence of a ground to quash a third- party subpoena, a court may consider issuing a protective order, applying “the Rule 26 factors, including relevance, in deciding the motion.” See Sirpal v. Wang, No. 12-cv-0365-WDQ, 2012 WL 2880565, at *4 n.12 (D.Md. July 12, 2012) (citing Washington v. Thurgood Marshall Acad., 230 F.R.D. 18, 22 (D.D.C.), on reconsideration, 232 F.R.D. 6 (D.D.C. 2005)).

III. Analysis A. Burden Generally, a court must quash a subpoena when, among other things, the subpoena “subjects a person to undue burden.” Fed.R.Civ.P. 45(d)(3)(A)(iv). That lament, however, belongs to the party directed to produce the documents. CineTel Films, Inc. 7 v. Does 1-1,052, 853 F.Supp.2d 545, 556 (D.Md. 2012) (citing Third Degree Films, Inc. v. Does 1-108, No. 11-cv-3007-DKC, 2012 WL 669055, at *3 (D.Md. Feb. 28, 2012) (citation omitted)) (“[T]he

undue burden contemplated by Rule 45 is one placed on the direct recipient of the subpoena[.]”). Thus, Colossus lacks standing to make this argument. B. Relevance “‘[T]he scope of discovery allowed under a subpoena is the same as the scope of discovery allowed under Rule 26.’” Green, 2026 WL 1074003, at *3 n.4 (quoting HDSherer LLC v. Nat. Molecular Testing Corp., 292 F.R.D. 305, 308 (D.S.C. 2013)); see also Cook v. Howard, 484 F. App’x 805, 812 n.7 (4th Cir. 2012) (stating that Rule 45’s requirement to quash a subpoena that subjects a person to undue burden “encompasses situations where the subpoena seeks information irrelevant to the case”). “Consistent with Rule 26, Rule 45 subpoenas may be used to discover ‘any nonprivileged matter that is relevant to any party’s claim or defense.’” Davis v. Safety Holdings, Inc., No. 25-cv-02011-GLR, 2026 WL 709751, at *2

(D.Md. Mar. 13, 2026) (quoting Boykin Anchor Co. Inc. v. Wong, No. 10-cv-591-FL, 2012 WL 27328, at *2 (E.D.N.C. Jan. 4, 2012) (quoting Fed.R.Civ.P. 26(b)(1)). Rule 26(b)(1) imposes a proportionality requirement that calls for consideration of “the importance of the issues at stake in the action, the amount in controversy, the 8 parties’ relative access to relevant information, the parties’ resources, the importance of the discovery in resolving the issues, and whether the burden or expense of the proposed discovery

outweighs its likely benefit.” Fed.R.Civ.P. 26(b)(1). “The proportionality analysis is ‘more demanding’ when considering a subpoena to a non-party.” EEOC v. D.R. Horton, Inc., No. 24-cv- 2757-GLR, 2026 WL 2576504, at *2 (D.Md. Sept. 1, 2026) (quoting Virginia Dep’t of Corr. v. Jordan, 921 F.3d 180, 189 (4th Cir. 2019)). For good cause, a court where the action is pending may issue an order to “protect a party or person from annoyance, embarrassment, oppression, or undue burden or expense[.]” Fed.R.Civ.P. 26(c)(1). Rule 26(c) “imposes a high burden on movants: they must show ‘good cause’ by ‘set[ting] forth specific and particular facts, rather than broad conclusory statements as to why a protective order should issue.’” Santos v. Crowell, No.

15-cv-3907-GLR, 2016 WL 6068082, at *3 (D.Md. Oct. 17, 2016) (quoting Innovative Therapies, Inc. v. Meents, 302 F.R.D. 364, 377 (D.Md. 2014) (citing Baron Fin. Corp. v. Natanzon, 240 F.R.D. 200, 202 (D.Md. 2006)). Colossus has not demonstrated the requisite good cause. Colossus did not supply any affidavits in support of its motion to quash or for protective order. In support of its irrelevancy 9 argument, Colossus asserts that the subpoenas seeking communications “discussing Colossus’s compliance or non-compliance with generalized private vendor rules have no bearing on whether

Adalytics’ statements about Colossus’s conduct are actually true.” (ECF No. 59-1, at 15). This argument misses how each of these requests touch on what Adalytics describes as its defenses, “including whether the statements in Adalytics’ Report are true; whether Colossus in fact had issues with mismatching user IDs; and whether any suspensions by The Trade Desk or BidSwitch occurred as a result of Colossus’s performance rather than the Report, as Colossus alleges.” (ECF No. 60 at 31). Furthermore, Colossus has not squarely addressed the proportionality of the document requests “to the needs of the case,” Fed.R.Civ.P. 26(b)(1), beyond statements like “[t]he [s]ubpoenas ask for a universe of documents that go far beyond the

precise factual issues relevant to this case,” (ECF No. 59-1, at 15). This second half of Rule 26(b)(1)’s permissible scope of discovery has not been challenged by the Third Parties either, who have not joined Colossus’s motion. Instead, Colossus asserts that “Adalytics’ onerous and unnecessary subpoenas risk straining two of Colossus’s closest business relationships,” which should be “avoided, as Adalytics should first seek all of this information directly from Colossus.” (Id. at 12). And while Colossus 10 characterizes the document requests as overbroad, the requests are relevant and narrowed to cover about a year and a couple months at most (Basis subpoena (see ECF No. 59-3, at 11)), or four months or so (BidSwitch subpoena (see ECF No. 59-4, at 11)). The subpoenas

will not be quashed on relevance grounds. C. Confidential Commercial Information A court may also quash a subpoena “[t]o protect a person subject to or affected by a subpoena” if the subpoena requires disclosing “a trade secret or other confidential research, development, or commercial information[.]” Fed.R.Civ.P. 45(d)(3)(B)(i). “[A] party generally ‘does not have standing to challenge a subpoena issued to a nonparty unless the party claims some personal right or privilege in the information sought by the subpoena.’” Ringdahl v. Afsharjavan, No. 18-cv-01006-PX, 2019 WL 2270693, at *3 (D.Md. May 24, 2019) (quoting United States v. Idema, 118 F. App’x 740, 744 (4th Cir. 2005)). At least two

district courts in this circuit have found that a party does have a personal right in its confidential commercial information. Lyman v. Greyhound Lines, Inc., No. 20-cv-01812-DCN, 2021 WL 3811298, at *3 (D.S.C. Aug. 26, 2021) (citing In re Bos. Sci. Corp. Pelvic Repair Sys. Prod. Liab. Litig., No. MDL 2326, 2014 WL 1329944, at *1 n.1 (S.D.W.Va. Mar. 31, 2014)).

11 The entity seeking to quash a subpoena on the basis of confidential commercial information bears the initial burden of demonstrating that the sought-after information is confidential or

proprietary, as well as showing “the recipient’s historical efforts to protect it from disclosure.” In re Am. Med. Sys., 2016 WL 307790, at *3 (first citing Gonzales v. Google, Inc., 234 F.R.D. 674, 684 (N.D.Cal. 2006); and then citing Compaq Computer Corp. v. Packard Bell Elecs., 163 F.R.D. 329, 338 (N.D. Cal. 1995)). After that showing has been made, “the burden shifts to the requesting party to establish a substantial need for the information that cannot be met without undue hardship.” Id. (citations omitted). “Confidential commercial information, within the meaning of [Rule 45(d)(3)(B)(i)] and its counterpart [Rule 26(c)(1)(G)], is more than just routine business data[.]” Id.. Confidential commercial information includes “customer lists and revenue

information . . . ; product design and development and marketing strategy . . .; labor costs . . .; and commercial financial information[.]” Id. (citations omitted). Additionally, “‘[p]ricing and marketing information are widely held to be confidential business information that may be subject to a protective order.’” Id. (quoting Uniroyal Chem. Co. v. Syngenta Crop Prot., 224 F.R.D. 53, 57 (D. Conn. 2004)).

12 Colossus argues that Adalytics’ subpoenas “seek a wide net of information from Colossus’s closest business partners, including closely held information about how Colossus’s proprietary

technology works, the identities of Colossus’s customers, and how Colossus and its customers target and reach certain consumers.” (ECF No.59-1, at 13). Furthermore, Colossus contends that information including Colossus’s “customer lists, marketing strategy and information, and proprietary information about Colossus’s product design” would be ensnared within the subpoenas. (Id.) Adalytics, in its opposition, argues that Colossus does not even attempt to specify what information sought – among the requested communications with and between third-parties and the internal data and analyses of Basis and Colossus – would constitute ‘confidential and competitively sensitive’ information of Colossus or how production of that particular information would cause significant harm when it is already in the possession of other entities.

(ECF No. 60, at 27–28). It also argues that “Colossus does not explain which of the 11 document requests in the Subpoenas seek this information, nor how the documents requested are ‘closely held’ and ‘proprietary’ when they are in the possession of (and sometimes created by) Basis, BidSwitch, and other third-parties, such as BidSwitch customers.” (Id. at 26). 13 In its reply, Colossus asserts that the subpoenas request communications that “likely contain[]” information that it argues qualifies as commercially sensitive information such as

“Colossus’[s] bid traffic” which includes “the details of specific customers, specific bid auctions and the pricing and deal information applicable for each.” (ECF No. 53, at 8). Adalytics and Colossus are not direct competitors. Still, Colossus argues that “[w]hile Adalytics and Colossus may not be competitors in the traditional sense, Adalytics, like a traditional competitor, stands to benefit from the misuse of Colossus’[s] information.” (Id.). This lack of a competitive relationship somewhat diminishes the risk of disclosure of possible confidential commercial information. See Insulate Am. v. Masco Corp., 227 F.R.D. 427, 433 (W.D.N.C. 2005) (citing Coca-Cola Bottling Co. v. Coca-Cola Co., 107 F.R.D. 288, 293 (D.Del. 1985))

(“Courts have concluded that disclosure to a competitor is more harmful than disclosure to a non-competitor[.]”). Additionally, each of the cases Colossus cites regarding types of confidential commercial information that merit the quashing of a subpoena describe types of information that are not squarely implicated by Adalytics’ subpoenas. See, e.g., In re Am. Med. Sys., 2016 WL 307790, at *3, *5 (collating examples of confidential commercial information including, among other things, 14 labor costs and customer lists, and stating “[t]he subpoenas do not evidence a crusade against the nonparties’ business practice.”); Richards v. Octane Environmental, LLC, 18-CV-00157,

2020 WL 13111139, at *1 (N.D.W.Va. Mar. 12, 2020) (financial information, including total revenues by month by customer); CSX Transp., Inc. v. Norfolk S. Ry. Co., No. 18-cv-530, 2020 WL 12862961, at *1 (E.D.Va. Feb. 10, 2020) (movant’s customer contracts which it described as including rates and terms and conditions). Colossus has not demonstrated that the subpoenas actually implicate its confidential commercial information. In both its motion and reply, Colossus fails to identify which document requests within each subpoena implicate confidential commercial information and how they do so. (See ECF Nos. 59-1, at 12–14 (motion); 53, 7–9 (reply)). See Lyman, 2021 WL 3811298, at *3.

For example, request 1 in the Basis subpoena seeks communications between Basis and Colossus, including about “any business issues or concerns arising from” potential “mismatched Advertising IDs.” (ECF No. 59-3, at 11). The closest apparent comparator of confidential commercial information sought here might be information regarding “product design and development and marketing strategy,” In re Am. Med. Sys., 2016 WL 307790, at *3, but Colossus neglects to explain how this request would sweep in 15 such information as it is seemingly limited to “business issues.” See id. (defining confidential commercial information as “more than just routine business data[.]”). As for the other ten

requests across both subpoenas, Colossus likewise does not specify what requested information may be confidential commercial information. As a result, Colossus has not carried its initial burden of showing that the sought-after information is confidential or proprietary. Colossus alternatively seeks a protective order to secure its alleged confidential commercial information under Rule 26. Pursuant to Rule 26, a court may issue a protective order “requiring that a trade secret or other confidential research, development, or commercial information not be revealed or be revealed only in a specified way[.]” Fed.R.Civ.P. 26(c)(1)(G). The entity seeking a protective order to limit the disclosure

of alleged confidential commercial information “to a competitor” bears the initial burden of demonstrating that the “‘documents sought actually concern . . . confidential . . . commercial information, and that disclosure might be harmful.’” BioConvergence LLC v. Emergent Biosolutions, Inc., No. 21-cv- 01959-CCB, 2023 WL 3866411, at *2 (D.Md. June 7, 2023) (quoting M- Edge Accessories LLC v. Amazon.com Inc., No. 11-cv-3332-MJG, 2013 WL 12241898, at *2 (D.Md. May 14, 2013) (citation omitted)). In 16 doing so, the movant must supply a “‘particular and specific demonstration of fact,’ and may not rely on ‘stereotyped and conclusory statements.’” M-Edge Accessories, 2013 WL 12241898, at *2 (quoting Natanzon, 240 F.R.D. at 202 (citation omitted)).

Because of the above finding that Colossus failed to carry its burden of showing that the third-party subpoenas implicate its confidential commercial information in the Rule 45 context, Colossus cannot demonstrate a protective order should be entered for good cause. Fed.R.Civ.P. 26(c)(1)(G). D. Sanctions In a single sentence in its motion, Colossus asks the court to “award appropriate sanctions,” (ECF No. 59-1, at 12); in its reply, Colossus devotes a few more sentences to this argument, (ECF No. 53, at 16). Rule 45(d)(1) states that A party or attorney responsible for issuing and serving a subpoena must take reasonable steps to avoid imposing undue burden or expense on a person subject to the subpoena. A court for the district where compliance is required must enforce this duty and impose an appropriate sanction—which may include lost earnings and reasonable attorney’s fees—on a party or attorney who fails to comply.

Fed.R.Civ.P. 45(d)(1). Adalytics, however, has “been in touch” with both of the Third Parties according to counsel for Adalytics’s declaration in 17 support of its opposition. (ECF No. 62 ¶ 24 (“In a meet-and- confer with counsel for BidSwitch and an email to counsel for Basis, counsel for Adalytics indicated a willingness to work to

address any potential issues with overbreadth of document requests in the Subpoenas.”)). Courts have generally declined to impose Rule 45 sanctions where “a serving party engages in good faith negotiations to resolve a conflict over its subpoena and to avoid imposing undue burden” and it has not been shown that “the subpoena was issued in bad faith, for an improper purpose, or in a manner inconsistent with existing law.” In re Am. Kidney Fund, Inc., No. 17-cv-1787-TDC, 2019 WL 1894248, at *6 (D.Md. Apr. 29, 2019). Elsewhere in its motion—and not in its section requesting sanctions—Colossus argues that Adalytics “served [the subpoenas] for one reason: to further sow distrust between Colossus and its partners in the industry and to cause additional reputational harm

to Colossus.” (ECF No. 59-1, at 6). To the contrary, the requests do not appear to have been issued for this purpose—let alone “an improper purpose.” Id. Thus, Colossus’s request for “recouped attorney’s fees and costs,” (ECF No. 53, at 16), is not appropriate and is denied.

18 IV. Conclusion The motion will be denied in its entirety. A separate order will follow.

/s/ DEBORAH K. CHASANOW United States District Judge