ORDER GRANTING MOTION FOR PRELIMINARY INJUNCTION

ROBERT S. LASNIK, District Judge.

This matter comes before the Court on plaintiff's "Motion for Preliminary Injunction" (Dkt. # 2) and defendant's "Motion for Expedited Discovery" (Dkt. # 9). Plaintiff is a New Zealand non-profit corporation that regulates the use of the .nz top level domain, including registering new domain names and responding to inquiries regarding registrants. Defendant collects domain and registrant information from around the world, stores the information, and uses its current and historic databases to sell monitoring and investigative services and products to the public. Plaintiff alleges that the way defendant accessed,1 stores, and/or uses .nz domain and registrant information constitutes a breach of contract and violates the Computer Fraud and Abuse Act and the Washington Consumer Protection Act. It seeks a preliminary injunction precluding defendant from accessing the .nz register, downloading .nz data into its own database,2 and publishing certain .nz data (including all historical information). Defendant opposes the motion and seeks discovery it deems critical to its ability to respond to the request for preliminary relief.

Having reviewed the memoranda, declarations, and exhibits submitted by the parties3 and having heard the arguments of counsel, the Court finds as follows:

A. Preliminary Injunction Standard

Preliminary relief — ordered at the outset of the case and before any discovery has occurred — is an "extraordinary remedy never awarded as of right." Winter v. Nat. Res. Def. Council, 555 U.S. 7, 24 (2008). In order to obtain preliminary injunctive relief, plaintiffs must establish that "(1) they are likely to succeed on the merits; (2) they are likely to suffer irreparable harm in the absence of preliminary relief; (3) the balance of equities tips in their favor, and (4) an injunction is in the public interest." Short v. Brown, 893 F.3d 671, 675 (9th Cir. 2018) (2008). In the Ninth Circuit, "if a plaintiff can only show that there are serious questions going to the merits — a lesser showing than likelihood of success on the merits — then a preliminary events made it absolutely clear that the allegedly wrongful behavior could not reasonably be expected to recur." Friends of the Earth, Inc. v. Laidlaw Envtl. Servs. (TOC), Inc., 528 U.S. 167, 189 (2000) (internal quotation marks, citations, and alterations omitted). That is not the case here. injunction may still issue if the balance of hardships tips sharply in the plaintiff's favor, and the other two Winter factors are satisfied." Feldman v. Ariz. Sec. of State's Office, 843 F.3d 366, 375 (9th Cir. 2016) (quoting Shell Offshore, Inc. v. Greenpeace, Inc., 709 F.3d 1281, 1291 (9th Cir. 2013)) (internal quotation marks omitted, emphasis in original).

In this case, plaintiff is seeking an order that would require defendant to take affirmative action, namely to alter its products and services so that they do not include or reveal certain .nz registrant information as they have in the past. Such injunctions are considered "mandatory," go "well beyond simply maintaining the status quo pendente lite[, and are] particularly disfavored. Stanley v. Univ. of S. Cal., 13 F.3d 1313, 1320 (9th Cir. 1994). A mandatory injunction will not issue in doubtful cases: the moving party bears the demanding burden of showing "that the law and facts clearly favor [its] position, not simply that [it] is likely to succeed." Garcia v. Google, Inc., 786 F.3d 733, 740 (9th Cir. 2015).

B. Breach of Contract4

Prior to June 26, 2016, when a person made a query regarding an .nz domain name or registrant, plaintiff appended to the response a notice that using multiple queries or the responses thereto "to enable or effect a download of part or all of the .nz Register" is "strictly forbidden." Dkt. # 4 at 75.5 After June 26, 2016, the terms of use ("TOU") were altered to expressly prohibit, among other things:

Dkt. # 4 at 71. Plaintiff alleges that defendant submitted enough queries through Port 43 to create a secondary or shadow register, in effect downloading and storing the .nz register data for its commercial purposes, in violation of both versions of the TOU.

1. Likelihood of Success on the Merits

Defendant argues that plaintiff is not likely to succeed on its breach of contract claim because there was no mutual assent to support an enforceable agreement.6 "While new commerce on the Internet has exposed courts to many new situations, it has not fundamentally changed the principles of contract" (Register.com, Inc. v. Verio, Inc., 356 F.3d 393, 403 (2d Cir. 2004)), and mutual manifestation of assent remains the touchstone of the analysis (Nguyen v. Barnes & Nobel Inc., 763 F.3d 1171, 1175 (9th Cir. 2014)). Plaintiff has chosen to utilize a form of contract known as "browsewrap," where the website's TOU are simply posted (sometimes through a hyperlink), with no requirement that the user click an "I agree" button or otherwise make an affirmative indication of assent to the terms. When browsewrap is deemed sufficient to form a contract, it is generally under the theory that a party manifests assent to the terms by using the website and/or accessing the services provided. This theory can be validly applied only where the circumstances suggest an intent or willingness on the user's part to be bound, however. Courts have been willing to draw such an inference when the user has actual or constructive knowledge of the TOU and understands that its access to the services, information, or applications within the website is conditioned on its agreement to those terms. Nguyen, 763 F.3d at 1176.

If defendant were a one-time or sporadic user of plaintiff's services, it would be very difficult to find mutual assent based on the existing record. Such a user would likely have no idea that his or her ability to query the website was subject to any terms or conditions. A domain search can be accomplished from the landing page without any indication that a contract is in the offing. It is not until information is returned in response to a query that the TOU are presented and the user is informed that by submitting the request, he or she entered into an agreement. At that point it is too late to undo the transaction or to avoid onerous terms, and it is unlikely that the TOU would be enforceable against such a user.

Defendant is not, however, a one-time or sporadic user. Rather, it has been querying plaintiff's system for years, and the responses have all included the TOU and a clear notification that submitting a query results in a contract with plaintiff on the specified terms. When defendant produces .nz register data to its own customers, it excises the TOU. There is, therefore, significant evidence that defendant was aware of the TOU, and it has not denied knowledge in this litigation. The Second Circuit dealt with this exact scenario and reasoned:

Register.com, 356 F.3d at 401. Every time defendant submitted a query to obtain .nz register data, it received the requested data with notice of the terms on which plaintiff makes the data available. It cannot reasonably argue that when it made its 100th or 10,000th query, it was unaware that plaintiff offered access and the requested information with restrictions. Defendant "is no more free to take [plaintiff's] data without being bound by the terms on which [plaintiff] offers it, than D was free, in the example, once he became aware of the terms of P's offer, to take P's apples without obligation to pay the 50 cent price at which P offered them." Id. at 402.

When applied to the facts in the existing record,7 the law clearly favors plaintiff on the merits of its contract claim. Defendant's access to the information in the .nz register was subject to certain limitations, including a prohibition on using "multiple" or "high volume" queries to download (i.e., copy from one computer system to another) part or all of the register. Plaintiff will likely be able to show that defendant violated the TOU when it downloaded plaintiff's data to create a private version of the register. Once defendant became aware of the amended TOU, its downloads and use of the stored data in its products and services constituted additional violations.

2. Likelihood of Irreparable Harm

The next issue is whether plaintiff is likely to suffer irreparable harm if an injunction is not issued. A number of plaintiff's alleged harms have either not been proven (plaintiff has not shown that it ever made a promise to registrants that it would retract or otherwise undo past disclosures) or are not irreparable (funds and time expended in investigating and curtailing defendant's actions could be compensated with a monetary award). Plaintiff has, however, shown that it faces irreparable harm to its customer base and business prospects — in short, its ability to attract individuals and entities to the .nz domain — if it is unable to enforce its TOU and provide the privacy upgrades the market is demanding. In October 2015, plaintiff began a review of its practice of providing personal information about a registrant in response to a query of the.nz register. The review was prompted by an increasing awareness that New Zealanders were concerned about on-line privacy issues and believed that personal information was too readily available. The review involved five consultative processes where plaintiff took and considered comments from the public. Plaintiff came to understand that, in addition to general concerns regarding privacy, at-risk and vulnerable people feared for their personal safety if their contact information were publicized. Plaintiff concluded that it was no longer appropriate to compel the public disclosure of contact information for individual registrants: in November 2017, it created an option for non-commercial registrants to request that their information not be available. At oral argument, plaintiff represented that more than 23,000 registrants chose to enroll in the program during its first nine months.

The record shows that plaintiff's ability to attract and retain registrants depends, at least in part, on responding adequately to the market demand for more privacy when using the .nz domain. Plaintiff was told by current registrants and the public at large that its public disclosure of contact information had prompted or would prompt customers to choose a different domain, one which allowed registration by proxy and/or did not disclose contact information when queried. See Dkt. # 4 at 165-177. By way of example, one former .nz registrant stated, "I canceled my .nz domains a while ago when I realized the consequences of you publishing far too much of my personal information . . . The current system, with proposed changes, makes it far too dangerous for me to consider having a .nz domain again and means I will continue to recommend people not to use it." Dkt. # 4 at 174. Plaintiff has taken steps to remedy the privacy and safety concerns of its customers and potential customers, and over 23,000 individual registrants requested more stringent privacy controls when given the option. Defendant is sabotaging plaintiff's efforts by continuing to publish the contact information and historic data it collected in violation of the TOU. Plaintiff has shown that it is likely to suffer irreparable harm to its business interests if defendant is not enjoined from using the information stored in its database.

Defendant argues that it needs to take discovery regarding whether its activities have had any impact on .nz registrants' perception of plaintiff and/or plaintiff's ability to register .nz domains. Dkt. # 9 at 9. The proposed interrogatories and requests for production that relate to these issues seek:

Dkt. # 11-1 at 21-26; # 11-2 at 2-7. Defendant also seeks a half day 30(b)(6) deposition to probe plaintiff's allegations of irreparable harm. Dkt. # 11-3 at 4. While some of the requested information may be relevant to determining the extent of the harm plaintiff suffers as a result of defendant's violations of the TOU, it does not alter the fact that plaintiff has shown a likelihood of irreparable injury. The evidence shows that the publication of personal data has affected consumer choice in the past, and it is no leap to conclude that, if plaintiff cannot enforce the TOU and defendant continues to publish the information it collected over the years, the disclosures will continue to adversely impact plaintiff's ability to obtain and retain registrants. A showing that irreparable harm is likely in the absence of an injunction is all that is required to satisfy the second element of the Winter analysis.

3. Balance of Hardships

Defendant argues that it would face severe hardship if a preliminary injunction is granted. In support, it offers the declaration of its vice president of research and development who states:

Dkt. # 24 at ¶ 15. Defendant's proposed course of action is overly complicated. Plaintiff is not seeking the deletion of all .nz data from defendant's database, so the assertion that an order requiring deletion would cause hardship is unhelpful. In addition, there does not appear to be any need to individually review .nz registrations or to determine whether information linked to the.nz register was also obtained from other registries. Plaintiff seeks an injunction precluding defendant from (a) accessing the .nz register while its authorization to do so is revoked and (b) publishing any of the non-current or historical .nz register data defendant had previously downloaded and stored in its databases. This request for relief would essentially require defendant to adjust its search criteria or, in the alternative, scrub from search results any and all information with a .nz top level domain. Defendant can presumably filter the .nz data using relatively simple database tools. If defendant obtained the same information from another top level domain — if, for example, plaintiff had not only registered at http://www.dcn.org.nz but had also registered at http://www.dcn.info — the injunction would not apply to whatever registrant information was produced by the .info register because it was not obtained in violation of the TOU.

Defendant obliquely argues that it would be inequitable for plaintiff to allow defendant to collect and store .nz register information for years and then compel defendant to spend "thousands of person-hours to disaggregate this publicly-available data." Dkt. # 23 at 30. Defendant makes no attempt to establish the elements of a waiver or estoppel defense and, as discussed above, complying with the proposed injunction would not require an extraordinary amount of time.

Finally, defendant argues that a preliminary injunction in this case could start an avalanche of litigation as other registers attempt to protect the privacy of their registrants. If defendant built a business by downloading, storing, and using data from other registers in violation of the terms that governed its access to that data, defendant may be correct — other registers may be encouraged to pursue a breach of contract claim if plaintiff is successful here. It would be ironic, however, if a plaintiff who has shown a likelihood of success and irreparable injury were deprived of preliminary relief simply because defendant may have acted wrongfully toward others as well.

4. Public Interest

With regard to the fourth element of the Winter analysis, defendant argues that the products it creates from its meticulously collected register data are critical cybersecurity resources and that the public interest would be harmed if the reports provided to government, financial, and law enforcement entities were incomplete because the .nz data were excised. The.nz register is comparatively small, however (approximately 710,000 domains compared with over 135,000,000 .com domains), and the defendant and its customers can access the registration information directly through plaintiff's website if it appears that a bad actor is using an .nz domain. On the other hand, the .nz registrants' privacy and security interests are compromised as long as defendant is publishing non-current or historical .nz information out of its database. The Court finds that the public has an interest in the issuance of an injunction.

C. Statutory Claims

Because an injunction is warranted on the breach of contract claim, the Court need not consider whether plaintiff is likely to succeed on the merits of its Computer Fraud and Abuse Act or Consumer Protection Act claims.

D. Bond

Defendant requests that the Court require a $3.5 million bond to compensate it for the time it will spend reviewing each .nz registrant, cross-referencing other registries and registrars, and reworking database files and file pointers to ensure that .nz data is not provided to customers. As discussed above, the individual record review and cross-referencing that are driving defendant's calculation should not be necessary. Defendant will undoubtedly incur some costs in altering its search parameters and/or scrubbing .nz data from search results. It may also lose customers because its reports will be less complete if it cannot produce its stored .nz data. Defendant provides no way to estimate these costs, however, and the Court declines to guess. A nominal bond of $1,000 will be required.

For all of the foregoing reasons, plaintiff's motion for a preliminary injunction (Dkt. # 2) is GRANTED and defendant's motion for expedited discovery (Dkt. # 9) is DENIED. Defendant DomainTools, LLC, and its officers, agents, servants, employees, and all others acting in active concert with them who receive actual notice of this order are hereby enjoined from accessing the.nz register while DomainTools' limited license remains revoked and/or publishing any .nz register data DomainTools had stored or compiled in its own databases while this action remains pending or until further order of the Court. Plaintiff shall obtain a bond of $1,000.