International Business Machines Corporation v. Zillow Group, Inc.; Zillow, Inc.

Opinion

WESTERN DISTRICT OF WASHINGTON INTERNATIONAL BUSINESS MACHINES CORPORATION, Plaintiff, C20-0851 TSZ v. ORDER ZILLOW GROUP, INC.; and ZILLOW, INC., Defendants. THIS MATTER comes before the Court on a motion for summary judgment, docket no. 270, brought by defendants Zillow Group, Inc. and Zillow, Inc. (collectively, “Zillow”), and a related motion to compel discovery, docket no. 272, brought by plaintiff International Business Machines Corporation (“IBM”). Having reviewed all papers filed in support of and in opposition to Zillow’s motion for summary judgment, the Court concludes that the dispositive motion should be denied and that IBM’s related motion to compel discovery may therefore be stricken as moot.1

1 After considering the parties’ respective views, as set forth in their Joint Status Report dated January 30, 2026, docket no. 264, the Court (i) set a deadline for Zillow to file a motion asserting noninfringement based on the absence of a “single-sign-on operation,” and (ii) allowed IBM to conduct depositions concerning the contents of any declaration or affidavit and/or attachment thereto that Zillow submitted in support of its motion for summary judgment. See Minute Order Background This case has been pending in this District for over six years, and the Court is well

acquainted with the remaining patent-in-suit, namely U.S. Patent No. 7,631,346 (“the ’346 Patent”).2 The ’346 Patent survived two separate challenges under 35 U.S.C. § 101, one in the District of Delaware and one in this District, see Int’l Bus. Machs. Corp. v. The Priceline Grp. Inc., No. 15-137, 2016 WL 626495 (D. Del. Feb. 16, 2016), adopted, 2016 WL 1253472 (D. Del. Mar. 30, 2016); Int’l Bus. Machs. Corp. v. Zillow Grp., Inc., 549 F. Supp. 3d 1247, 1273–75 (W.D. Wash. 2021), but it was subsequently held unpatentable

(docket no. 269). In conjunction with its dispositive motion, Zillow submitted the declaration of one of its attorneys, attached to which were several exhibits. See Shih Decl. (docket no. 270-1). IBM sought to depose a Zillow designee pursuant to Federal Rule of Civil Procedure 30(b)(6), but Zillow refused because the exhibits appended to its counsel’s declaration were not Zillow’s documents, but rather (a) materials produced by IBM in this litigation or in connection with patent prosecution or inter partes review proceedings, or (b) public webpages of third parties. See Defs.’ Resp. at 2 (docket no. 274). IBM filed a motion to compel, asking the Court to direct Zillow to submit to a Rule 30(b)(6) deposition and to make its source code available for inspection. See Pl.’s Mot. at 7 (docket no. 272). On June 15, 2026, IBM timely submitted a substantive response to Zillow’s motion for summary judgment. See Pl.’s Resp. (docket nos. 277 & 279). Zillow has filed a reply, docket no. 280, and the motion for summary judgment is fully briefed and ready for consideration. In light of the Court’s ruling on the dispositive motion, which is favorable to IBM, the Court need not address IBM’s related discovery motion. 2 This action began in September 2019 in the Central District of California with allegations that Zillow infringed seven (7) different patents. See Compl. (docket no. 1). Two of those patents were declared invalid on the ground that they were not directed to eligible subject matter. Int’l Bus. Machs. Corp. v. Zillow Grp., Inc., 549 F. Supp. 3d 1247, 1260–68 (W.D. Wash. 2021), aff’d, 50 F.4th 1371 (Fed. Cir. 2022). Another patent was declared invalid on the basis of indefiniteness; partial judgment was entered, and the Court’s decision was not appealed. See Int’l Bus. Machs. Corp. v. Zillow Grp., Inc., No. C20-851, 2022 WL 16532550, at *3–4 & 9 (W.D. Wash. Oct. 28, 2022); see also Partial Judgment (docket no. 238). IBM’s claims as to three other patents, one of which was declared invalid in part based on ineligible subject matter, see Chewy, Inc. v. Int’l Bus. Machs. Corp., 94 F.4th 1354, 1364–68 (Fed. Cir. 2024), and another of which was invalidated in toto because of patent-ineligible subject matter, see Int’l Bus. Machs. Corp. v. Zynga Inc., 642 F. Supp. 3d 481 (D. Del. 2022), were dismissed with prejudice upon the parties’ stipulation. Minute Order at ¶ 1 (docket no. 254). in part, with respect to Claims 1–4, 12–16, and 18–19, which were deemed obvious in light of prior art, see Ebates Performance Mktg., Inc. v. Int’l Bus. Machs. Corp.,

IPR2022-646, 2023 WL 7358027 (P.T.A.B. Oct. 11, 2023), aff’d sub nom. Int’l Bus. Machs. Corp. v. Zillow Grp., Inc., 160 F.4th 1360 (Fed. Cir. 2025). In this action, IBM asserts that Zillow’s websites (including www.zillow.com and www.zillowgroupmedia.com) and mobile applications (“Apps”) infringe Claims 5, 8, and 10 of the ’346 Patent. See 2d Am. Compl. at ¶¶ 156–70 (docket no. 156); see also Joint Status Report at 1:26–27 (docket no. 257). Claim 5 depends from Claim 1, and Claims 8

and 10 depend from Claim 5. See ’346 Patent at 45:10, 28, & 34 (docket no. 1-2 at 40). Thus, to prevail on its claim of infringement, IBM must establish, at a minimum, that at least one of Zillow’s platforms (i.e., a website or a mobile application) employs all the elements of the method set forth in independent Claim 1 of the ’346 Patent. In moving for summary judgment, Zillow focuses on only one limitation in Claim 1, namely

“single-sign-on operation,” which the Court previously construed as meaning a process by which a user is not required [to] take an action that provides credentials, or that plays a role in launching a provision of credentials on the user’s behalf, to gain access to a second entity’s resources after the user has been authenticated with a first entity. Order at 13 (docket no. 240). Zillow was provided notice and an opportunity to show cause, see Minute Order at ¶ 1(a)(i) (docket no. 269), why the Court should not reconsider its earlier ruling and adopt the interpretation proposed by IBM, namely a process by which a user is authenticated at a first entity and subsequently not required to perform another authentication before accessing a protected resource at a second entity. Pl.’s Opening Br. at 8 (docket no. 203). Having considered the parties’ respective arguments, the Court is persuaded that, under the Court’s prior construction, Zillow has not established it is entitled to judgment

as a matter of law and that, given Zillow’s noninfringement analysis, the Court’s earlier definition of “single-sign-on operation” is manifestly erroneous and must be corrected. See Local Civil Rule 7(h)(1).3 Discussion A. The ’346 Patent The ’346 Patent is aimed at reducing the burdens on World Wide Web or Internet

users who wish to switch between applications controlled by different enterprises that have erected authentication barriers, which are designed to protect their systems, as well as their users’ privacy and/or confidential information. See ’346 Patent at 1:9–2:48 & 10:16–20 (docket no. 1-2). The specification4 of the ’346 Patent defines “authentication” as “the process of validating a set of credentials” that are provided by or on behalf of a

3 Although IBM has not moved for reconsideration of the Court’s claim construction ruling, it has expressly reserved its right to appeal the Court’s interpretation of “single-sign-on operation” in the event that the Court’s original definition leads to a finding of noninfringement. See Joint Status Report at 2 (docket no. 264). Moreover, in response to Zillow’s motion for summary judgment, IBM argues that the Court should “clarify” its previous decision and adopt IBM’s proposed construction. See Pl.’s Resp. at 22–24 (docket no. 277). 4 In construing the terms of a patent claim, the Court must consider the intrinsic evidence in the record, meaning the claims, the specification, and the prosecution history. Markman v. Westview Instruments, Inc., 52 F.3d 967, 979 (Fed. Cir. 1995). The specification is “the single best guide to the meaning of a disputed term.” Phillips v. AWH Corp., 415 F.3d 1303, 1315 (Fed. Cir. 2005). The words of a patent claim are generally assigned their “ordinary and customary meaning,” id. at 1312, namely, the definition ascribed by “a person of ordinary skill in the art in question at the time of the invention,” id. at 1313, but if the specification reveals a different construction, then the inventor’s lexicography overrides the common understanding, id. at 1316. user. See id. at 9:50–51. Authentication credentials may consist of (i) something that a user knows (for example, a username-and-password combination), (ii) something that a

user possesses (perhaps, a smart phone or smartcard), and/or (iii) a physical characteristic about the user (i.e., a fingerprint or other biometric information). See id. at 9:51–67. The invention set forth in the ’346 Patent attempts to address the “frustration” that users generally experience when “having to authenticate to multiple domains for a single transaction.” See id. at 10:14–16. The first (now invalid) claim of the ’346 Patent reads as follows:

1. A method for managing user authentication within a distributed data processing system, wherein a first system and a second system interact within a federated computing environment and support single-sign-on operations in order to provide access to protected resources, at least one of the first system and the second system comprising a processor, the method comprising: triggering a single-sign-on operation on behalf of the user in order to obtain access to a protected resource that is hosted by the second system, wherein the second system requires a user account for the user to complete the single-sign-on operation prior to providing access to the protected resource; receiving from the first system at the second system an identifier associated with the user; and creating a user account for the user at the second system based at least in part on the received identifier associated with the user after triggering the single-sign-on operation but before generating at the second system a response for accessing the protected resource, wherein the created user account supports single-sign-on operations between the first system and the second system on behalf of the user. Id. at 44:39–61 (emphasis added). The term “single-sign-on operation” appears in singular or plural form five times in Claim 1. On two occasions, the phrase (preceded by either an indefinite or definite article) directly follows the word “triggering.” These two instances suggest that some action must occur to launch the “single-sign-on operation.” See Webster’s 3d New Int’l Dictionary 2444 (1981) (the verb “trigger” means “to initiate,

actuate, or set off”). The ’346 Patent differentiates between an authentication “credential,” which “is presented by a user as part of an authentication protocol sequence,” and an authentication “assertion,” which “is a statement about the successful presentation and validation of a user’s authentication credentials.” ’346 Patent at 9:67–10:6 (docket no. 1-2). An assertion “provides indirect evidence of some action,” whereas a token “provides direct

evidence of a successful operation.” Id. at 8:49 & 58 (emphasis added). A “token” is “produced by the entity that performs the operation.” Id. at 8:50. For example, an authentication token is generated, “after a successful authentication operation,” by the system that performed the authentication. Id. at 8:51–52. In contrast, an authentication assertion may be transferred “by an entity that is not the authentication service but that

listened to the authentication service.” Id. at 8:62–64. The ’346 Patent contemplates that a user may authenticate with a first system, which will then issue an authentication token or assertion to a second system, thereby allowing the user to access the second system’s protected resources without having to supply authentication credentials to the second system. Id. at 11:28–35. The first system is known as the “issuing party,” and the second

system is denominated as the “relying party.” See id. The issuing party “is usually, but not necessarily, the user’s home domain or the user’s identity provider,” id. at 11:67–12:1 (emphasis added), which, respectively, has authenticated or will authenticate the user during the course of the transaction, id. at 11:56–60, or provides identity and attribute information about the user, identity or authentication assertions, or identity services, id. at 12:34-39. B. Zillow’s Websites and Apps Zillow operates websites and Apps that offer services to users who are searching for real estate. See Thompson Decl. at § 28, Ex. 6 to Rodd Decl. (docket no. 278 at 489). Zillow requires that users “sign in” before accessing protected resources, including, for example, a search-result-saving function. See id. According to IBM’s expert, Zillow uses the OAuth 2.0 Authorization Framework (“OAuth 2.0”)° to allow single-sign-on operations from third-party platforms like Apple, Facebook, and Google. /d. Zillow disagrees and, in moving for summary judgment, it argues that a user’s actions, which launch a Zillow website or App (the second system) from Apple, Facebook, or Google (the first system), signify that Zillow is not engaging in a “single-sign-on operation.” Sign in or register to save home * For support, Zillow relies on screenshots (like the one to the left) that were incorporated in IBM’s infringement contentions. See 2d Am. Or connect with: Infringement Contentions, Ex. D2 to Joint Status Report (docket no. 265 at 2) (citing IBM-ZILLOW 10000603° at 0:48) (red box annotation in original). 5 OAuth 2.0 is a standard promulgated by the Internet Engineering Task Force (“IETF”). See Thompson Decl. at § 20 (docket no. 278 at 487). The IETF’s standards are “voluntary,” and the IETF does not “control, or even patrol, the Internet.” https://www.ietf.org/about/introduction/. 6 IBM-ZILLOW 10000603 and IBM-ZILLOW10000841 are apparently video files that were produced by IBM in discovery and that Zillow intended to submit along with its motion for

Rather than entering an email address to sign in or register with Zillow, users may click one of the buttons that would allow them to continue with Apple, Facebook, or Google, respectively. Doing so takes them to a webpage on which the first system (also known as the identity provider) prompts them to sign in and then asks for consent to share information with Zillow. For example, Google displays the following dialog boxes: & Signin with Google G Signin with Google

Sign in Zillow wants to access your Google Account to continue to Zillow © chrismaraanatytics. cow □□□ eure This will allow Zillow to: k See and download all of your Google Account email addresses: @ 0 Fangot emai To continue, Google will share your name, email address, language preference, and Make sure you trust dillow ] ] e picture vith Zillow. Before using this apo you cen review Zillaw's You may be sharing sensitive info with this-site cm app. Learn about how Zillow will privacy policy and tenms of service handle your date by rewewing its tera of service and privacy policies. You can aRWGYS SOT OF FQMOVD GGOGSS I your Google AceoUnt, ] 2 Create account ae eee Cancel English (linited States) ~ Help Privacy Terms English (Unted Sates) + Hoip Privacy Tarms

Zd. (docket no. 265 at 16 & 98) (citing IBM-ZILLOW10000603 at 1:03 & IBM-ZILLOW 10000841° at 1:26). Zillow contends that, because the first system (for example, Google) does not transmit any identifiers to the second system (i.e., Zillow) until after the user consents, summary judgment. See Shih Decl. at § 2 (docket no. 270-1) (referencing video files designated as Exhibits F1—F6, but not provided to the Court). Unaware that the video files were not actually filed with the Court, IBM has also relied on them in its response. See Pl.’s Resp. at 7 n.1 (docket no. 277). Because the parties have supplied screenshots of the videos, the Court has proceeded without requesting or reviewing the video files.

the user must be viewed as taking an action that “plays a role” in launching a provision of credentials on the user’s behalf. According to Zillow, because the user must click the

“Allow” button, its OAuth 2.0 protocol does not qualify as a “single-sign-on operation,” as defined in the Court’s Order entered October 28, 2022, docket no. 240. C. Triggering Zillow’s analysis ignores the verb “triggering,” which appears before “single-sign- on operation” in two ways: (i) as the first word following the preamble of Claim 1, and (ii) in identifying a required sequence of steps. The preamble indicates that the invention

is a “method comprising” inter alia “triggering a single-sign-on operation on behalf of the user.” ’346 Patent at 44:45–46 (docket no. 1-2) (emphasis added). The method at issue involves a triggering step, a receiving stage, and a creating phase. See id. at 44:46– 61. With respect to the latter, the creation of a user account at the second system is based “at least in part on the received identifier associated with the user after triggering the

single-sign-on operation but before generating at the second system a response for accessing the protected resource.” Id. at 44:54–58 (emphasis added). Zillow fails to explain why a user’s approval, indicated by clicking dialog box buttons, is not simply an act of “triggering” the single-sign-on operation. Zillow has attempted to exploit the lack of precision in, and duplicative nature of,

the phrase “plays a role,” as used in the Court’s previous construction of “single-sign-on operation.” Importantly, however, Zillow does not dispute that, in the “Continue with Facebook” or “Continue with Google” scenario, a user “is not required to take an action that provides credentials” to the second system (Zillow), and thus, the quoted portion of the “single-sign-on operation” definition is satisfied. With regard to the “plays a role” language, the user’s actions on which Zillow relies to assert noninfringement do not

themselves convey credentials. Instead, they initiate (or trigger) the process by which the first system (Apple, Facebook, or Google) will offer the necessary information (an authentication token or assertion) to the second system (Zillow) so that the second system (Zillow) can complete the receiving and creating steps of the method at issue. Indeed, Zillow’s own documents reflect its understanding that “OAuth implements ‘single sign on’ in the sense that there is one site that does user authentication and that[,] if a user is

authenticated on that site, then OAuth clients can get access to their data without forcing them to authenticate again.” Ex. 8 to Rodd Decl. (docket no. 279-4 at 10); see also Ex. 7 to Rodd Decl. (docket no. 279-3 at 2) (indicating that, if a user logs in with a social media account, Zillow requests information from the social media platform, e.g., Apple, Facebook, or Google, as opposed to the user, to create a Zillow account that does not

have a password).7 Thus, under Zillow’s preferred construction of “single-sign-on operation,” which the Court originally adopted, Zillow has not established that it is

7 Exhibits 7 and 8 to the Declaration of Benjamin Rodd were filed under seal. Given that OAuth 2.0 is a publicly-known authorization protocol, the Court does not view Zillow’s written statement about it and/or its predecessors as satisfying the criteria for maintaining secrecy. See Kamakana v. City & County of Honolulu, 447 F.3d 1172, 1180 (9th Cir. 2006) (requiring “compelling reasons” for sealing documents relating to dispositive motions). Similarly, Zillow’s summary of how its websites and Apps interact with social media does not meet the test for restricting public access. Moreover, this general information is set forth in the parties’ publicly available filings. Thus, the Court declines to redact the quoted or paraphrased passages in the above text or to file the unredacted version of this Order under seal. entitled to judgment as a matter of law, and its dispositive motion is DENIED. See Fed. R. Civ. P. 56(a).

D. Single-Sign-On Operation Zillow has also failed to show cause why the Court should not reconsider and revise its interpretation of “single-sign-on operation.” The Court’s prior construction of the claim term incorporated wording from International Business Machines Corp. v. Iancu, 759 F. App’x 1002 (Fed. Cir. 2019). In that matter, IBM appealed from a decision of the Patent Trial and Appeal Board (“PTAB”) that invalidated certain claims of the

’346 Patent because they were anticipated by either a Japanese publication known as Sunada and/or U.S. Patent No. 7,680,819 (Mellmer). Id. at 1003. The Federal Circuit vacated the PTAB’s decision with respect to its reliance on Sunada, which is not relevant to the issue now before the Court, and reversed the PTAB’s decision with respect to the preclusive effect of Mellmer. See id. at 1012. Mellmer described a “basic architecture

for managing digital identity information in a network,” and taught techniques for “securely logging in to multiple sites with a single password.” Id. at 1009 (quoting Mellmer at Abstract). Mellmer’s invention involved a “DigitalMe” system, which eased a user’s access to various independent websites that participated in the system. Id. The initial log in to the DigitalMe site constituted a first authentication. Id. The subsequent

steps depended on whether the user had an account on, or “accessCard” with, the target site. Id. The various possibilities are shown in a flowchart that spans five different figures in the patent, which the Federal Circuit combined into one diagram. See id. at 1009–10 (citing Mellmer at Figs. 31-35). IBM and Andrei Iancu, former Director of the U.S. Patent and Trademark Office, agreed that the question of whether Mellmer taught the single-sign-on limitation reduced to “whether a second user authentication action is involved in the steps taken when ‘no’ is the answer to “User has an account on this site?’ and the target site has a relationship with DigitalMe.” Jd. at 1010. The portion of the flowchart that relates to this scenario is as follows: User has an Is the site account on digitalme- this site? ? Digitalme sends aware Site cenerates no blank user login yes ne g credentials with new sant unique ID accoun Digitalme Digitalme logs Mellmer at Fig. 34 (red box constructs an || User picks in with new Logged in annotation added), Ex. 5 to accessCard ameCard account to site Rodd Decl. (docket no. 278 at 449). As noted by the Federal Circuit, in the DigitalMe system, when a user does not have an account on the target site, “the user’s picking of a meCard for association with an accessCard 1s essential to the successful login to the target site.” 759 F. App’x at 1010. The PTAB viewed Mellmer as being silent concerning what information is included in an accessCard or a meCard, and it therefore concluded Mellmer did not teach that an accessCard or a meCard includes credentials. Jd. at 1011. The Federal Circuit, however, held that the PTAB erred in drawing an inference from silence, which would not “suffice . . . to meet [the] burden to prove, by a preponderance of the evidence, that there was no user authentication action in this scenario.” /d. (emphasis in original). The Federal 92 Circuit ruled that no substantial evidence supported the PTAB’s finding that Mellmer

taught the single-sign-on limitation of the ’346 Patent claims challenged in the inter partes review (“IPR”) proceeding. Id. at 1012.

Having in mind this procedural history, and now having in focus Zillow’s non- infringement arguments, the Court believes that, in its prior order interpreting the term “single-sign-on operation,” the verbiage adopted from the Federal Circuit’s decision was taken out of context. First, the Federal Circuit did not disagree with, call into doubt, or deem erroneous the PTAB’s interpretation of “single-sign-on operation” as meaning a process by which a user is authenticated at a first entity and subsequently not required to perform another authentication before accessing a protected resource at a second entity. Id. at 1008. This construction is identical to IBM’s proposal. Second, the “takes an action . . . that plays a role in launching” language concerned circumstances in which a user participates in an authentication; the verbiage, which the Federal Circuit deduced from the positions of the parties, does not appear to have been intended as a substitute for

the PTAB’s definition of “single-sign-on operation.” See id. at 1009 (“It is undisputed before us that, under those definitions, a user ‘perform[s]’ an authentication when the user takes an action . . . that plays a role in launching a provision of credentials on the user’s behalf, to obtain access to resources.” (alteration in original, emphasis added)). Third, the Federal Circuit’s analysis indicates that the correlation between the user’s

action and the provision of credentials must be something more than just “plays a role.” In the IPR proceeding at issue, the petitioner was required to establish that Mellmer taught a “single-sign-on operation,” and the Federal Circuit held that the IPR petitioner failed to do so because it did not disprove that the user’s action (in the DigitalMe system) of selecting a meCard provided authentication credentials. See id. at 1011. Finally, the Federal Circuit was not required to and did not examine the importance of the word

“triggering,” which twice in Claim 1 precedes the term “single-sign-on operation,” and contemplates that a user must do something (like clicking buttons labeled “Continue with Google,” “Next,” and “Allow”) to initiate the “single-sign-on operation.” The Court concludes that including the “plays a role” verbiage in the definition of “single-sign-on operation” was inappropriate,8 and it ADOPTS the PTAB’s construction of “single-sign-on operation,” which the Federal Circuit did not disturb. This amended

interpretation of “single-sign-on operation,” which is consistent with IBM’s originally proposed meaning, provides an independent, alternative basis for denying Zillow’s motion for summary judgment. Conclusion For the foregoing reasons, the Court ORDERS as follows:

(1) Zillow’s motion for summary judgment, docket no. 270, is DENIED. (2) IBM’s related motion to compel discovery, docket no. 272, is STRICKEN as moot.

8 The Court acknowledges that another district court has incorporated the “plays a role” wording in its construction of “single-sign-on operation.” See Int’l Bus. Machs. Corp. v. Zynga Inc., No. 22-590, 2023 WL 7129859, at *6 (D. Del. Oct. 30, 2023). The Court notes, however, that the proceedings there involving the ’346 Patent were stayed, while the matter proceeded to trial on two other patents-in-suit, resulting in a roughly $45 million verdict in favor of IBM, and that the parties subsequently reached a settlement and the case was dismissed. See Order, Partial Judgment, and Stip. of Dismissal & Order, D. Del. Case No. 22-cv-590, docket nos. 210, 539, & 572. In light of the procedural posture of the District of Delaware action, in which the parties did not litigate past the claim construction stage with respect to the ’346 Patent, and given that the meaning ascribed in that matter to “single-sign-on operation” will not be tested on appeal, the Court declines to adhere to the reasoning set forth in Zynga. (3) The stay of discovery imposed by Minute Order entered March 26, 2026, docket no. 269, remains in effect pending the parties’ settlement negotiations and

mediation efforts, which must be completed by July 8, 2026. (4) If the parties have not reached a settlement in principle by July 13, 2026, they shall file a Joint Status Report indicating when they will be prepared for trial, how long a trial is anticipated to last, what further discovery, if any, the parties need to conduct, and what additional dispositive motion practice, if any, the parties propose. (5) The Clerk is directed to send a copy of this Minute Order to all counsel of

record. Dated this 30th day of June, 2026. A

Thomas S. Zilly United States District Judge