Shueisha Inc. v. DMCA Subpoena to Cloudflare, Inc. — Entry #16: Joint Discovery Letter Brief re: Protective Order [pursuant to D.E

Case 4:25-mc-80147-YGR           Document 16       Filed 11/13/25     Page 1 of 5


November 13, 2025


Hon. Yvonne Gonzalez Rogers, United States District Judge
1301 Clay St.
Courtroom 1 – 4th Floor
Oakland, CA 94612

VIA ECF

RE:    In Re. 17 U.S.C. §512(h) Subpoena to Cloudflare, Inc. (Shueisha Inc.),
       Case No. 4:25-mc-80147-YGR
       Joint Discovery Letter re: Protective Order

Dear Hon. Judge Gonzalez Rogers:

       Pursuant to D.E. 14, Non-Party John Doe and Petitioner Shueisha Inc. jointly submit this
discovery letter regarding a proposed protective order.

       Counsel for the parties met and conferred via telephone and video conference on October
23, 2025 and November 4, 2025. The parties were unable to reach agreement on a single protective
order. Each party sets forth their respective position below. Additionally, filed concurrently
herewith the parties submit their own proposed protective orders for the Court’s review and
determination.


Sincerely,
 KRONENBERGER ROSENFELD, LLP                     GAMMA LAW, P.C.

 s/ Leah Rosa Vulić                              s/ Marco Martemucci
 Leah Rosa Vulić (SBN 343520)                    Marco Martemucci (SBN 255054)
 548 Market St. #85399                           One Sansome Street, Suite 1400
 San Francisco, CA 94104                         San Francisco, California 94104
 Telephone: (415) 955-1155                       Tel.: 415.901.0510
 Facsimile: (415) 955-1158                       Fax: 415.901.0512
 leah@kr.law                                     MMartemucci@gammalaw.com
 Attorneys for Non-Party John Doe                Attorneys for Shueisha Inc.


       Case Gonzalez
Hon. Yvonne  4:25-mc-80147-YGR
                     Rogers                       Document 16           Filed 11/13/25          Page 2 of 5
November 13, 2025
Page 1


John Doe’s Position
        John Doe respectfully submits that the terms set forth in his version of the Proposed
Protective Order are necessary and appropriate for a pre-suit DMCA §512(h) identification
proceeding, as required by Fed. R. Civ. P. 26(c), to address unique privacy and due process
concerns here. The Court expressly ordered the parties to submit a proposed protective order,
prohibiting the disclosure and use of John Doe’s identity for any purpose unrelated to the
purpose of the subpoena. (D.E. 14, 4:13-16.) The only purpose of the subpoena is to obtain Doe’s
identity for use in protecting Shueisha’s copyrights under U.S. copyright law. 17 U.S.C.
§512(h)(2)(C); see Braun v. Primary Distrib. Doe No. 1, 2012 WL 6087179, at *8 (N.D. Cal. Dec.
6, 2012). Any further use of Doe’s identity, such as for actions outside the U.S. necessarily outside
the scope of U.S. copyright laws, must be prohibited. See Signature Mgmt. Team, LLC v.
Automattic, Inc., 941 F. Supp. 2d 1145, 1159 (N.D. Cal. 2013). Shueisha refuses this limitation.
However, §512(h) expressly limits use of disclosed information to prosecuting claims of copyright
infringement under U.S. law. 17 U.S.C. The DMCA does not contemplate use of subpoenaed
information in foreign proceedings or for other purposes—or to notify completely absent third
parties of an alleged infringer’s identity. Shueisha’s stated intentions blatantly exceed the scope.
        Shueisha claims that there is no good cause for a protective order. But Shueisha’s position
and proposed order make clear its intent to expose Doe publicly for purposes unrelated to its own
rights. And, courts allow protective orders, including with AEO provisions, in DMCA subpoena
cases. See In re DMCA Subpoena To Reddit, Inc., 383 F. Supp. 3d 900, 916 (N.D. Cal. 2019) (court
ordered protective order keeping a Doe’s identity under seal, AEO, including in any later-filed
infringement lawsuit; Article III judge later quashed subpoena entirely) (R&R rejected on other
grounds, 441 F. Supp. 3d 875 (N.D. Cal. 2020)). Shueisha’s own submission shows a protective
order is necessary. Shueisha outright admits it wants to use Doe’s identity to “notify others whose
works were infringed”— a purpose outside of a DMCA subpoena. Shueisha thus admits that its
goals exceed identifying Doe, including to expose him to others for alleged infringement that isn’t
substantiated at all.1 This is precisely why a robust protective order is necessary: to prevent the
improper use of Doe’s identity. Notably, the protective order only applies to John Doe and not any
other alleged infringer; Shueisha is free to do whatever it wants with other identifying data
disclosed by Cloudflare, unrelated to Doe. Further, to the extent Shueisha complains that it may
not be able to definitively identify Doe from information provided by Cloudflare, based on the
limited time frame when allegedly infringing material was posted, Shueisha may have issued its
DMCA takedown to the actual host of the websites, not a pass-through provider such as Cloudflare.
1.      Attorneys’-Eyes-Only (“AEO”) Designation (§§1.2, 5.1, 6.1, 7.1)
        John Doe’s identity information should be designated “HIGHLY CONFIDENTIAL –
ATTORNEYS’ EYES ONLY.” Disclosure of identity beyond outside counsel creates real risk of
harassment, reputational harm, and loss of anonymity, especially given Shueisha’s admitted stated
intent of sharing Doe’s identity with others. Once such information is disclosed outside the most
essential persons on a need-to-know basis, there is risk of irreversible harm if information is
misused, publicly disseminated, or transmitted cross-border. See Art of Living Found. v. Does 1-
10, 2011 WL 5444622, at *9 (N.D. Cal. Nov. 9, 2011) (the disclosure of one’s identity is itself
irreparable harm). No subsequent court order can undo that exposure, especially across borders
where this Court’s supervisory power is limited.
        The AEO limitation is narrowly confined to identity information (§2.1), grants full outside
counsel access, and does not prejudice litigation — while serving as the least-restrictive means to
1
    Shueisha’s characterization of Doe’s website as a “massive piracy website” is unfounded, subjective, and irrelevant.


       Case Gonzalez
Hon. Yvonne  4:25-mc-80147-YGR
                     Rogers               Document 16        Filed 11/13/25       Page 3 of 5
November 13, 2025
Page 2


avoid foreseeable harassment and reputational damage, including online spillover risks. AEO
protection does not impede rights to file and serve U.S. litigation, and is essential given the absence
of pending U.S. action and uncertainties about intended use. In the alternative, Doe requests that
the Court order that Shueisha’s U.S. counsel plus up to two Shueisha management personnel, may
review Cloudflare’s production, after signing the Acknowledgment and Agreement to be bound.
2.       Scope of Information (§2.1), Time Frame (§3.4), & Doe-Linked URLs (§§2.3, 3.3)
         Doe does not object to production of name and postal address, but notes that phone numbers
and similar information should be excluded unless specifically ordered by the Court pursuant to a
particularized showing. In addition, the time period of the disclosure must be limited to the dates
the specific images were available at the identified URLs; and the URLs must be limited to only
the URLs identified in Shueisha’s Subpoena linked to Doe (lines 1 and 2).
         In particular, requests for billing and payment information, hosting providers, IP logs,
others hosting content or contracting parties, and access log information are vastly overbroad and
not limited to identifying John Doe. Indeed, such information could lead to identifying any private
individual who ever accessed the images, without any notice to these individuals.
3.       Additional Subpoenas (§1.2(f), 8.1)
         Additional subpoenas should be governed by Court order, not by right. Doe’s Proposed
Protective Order prohibits chained, open-ended subpoenas and specifies that any additional requests
must be explicitly approved—under seal, limited to minimal identifiers, non-content only, and
subject to an objection window. The addition of safeguards addresses concerns about fishing
expeditions, proportionality, and compliance with the narrow aims of §512(h) and Rule 26(c).
4.       Limiting Use to U.S. Proceedings and the 180-Day Period (§§1.2(a), 13.5)
         Doe’s Proposed Protective Order restricts use of identity information to U.S.-based
litigation/service, solely in connection with the URLs in Ex. A and only within 180 days of
disclosure, unless further extended upon a showing of good cause. Braun v. Primary Distrib. Doe
No. 1, 2012 WL 6087179 at *8 (limiting service of lawsuit to 120 days after discovery of identity).
This tracks the DMCA §512(h) oath (providing only for use in protecting rights under Title 17),
ensures that compelled disclosure is not used for unrelated or foreign matters, and respects the
principle that any foreign discovery should proceed with judicial oversight. The limitations provide
clarity, accountability, and due process protection, while allowing extensions if justified.
         Notably, Shueisha has filed numerous requests for §512(h) subpoenas, which do not appear
to have resulted in subsequent copyright infringement cases in the U.S. A search of Pacer shows
only one U.S. copyright infringement case actually brought by Petitioner Shueisha, and it was
against John Does, seeking identifying information, and was not prosecuted against a named
defendant (No. 1:19-cv-08227-LJL-SN, S.D.N.Y.). This supports a reasonable inference that
compelled identity information is not exclusively used to bring U.S. copyright cases, reinforcing
the need for strict use, audience, geography, and time limited in the protective order.
5.       U.S.-Only Storage, No Disclosure to Client Personnel/Abroad (§§1.3, 7.2)
         The restriction against access, storage, transfer, or disclosure of protected information
outside the U.S. (and beyond outside U.S.-admitted counsel) ensures effective Court supervision
and protection against misuse, especially given data protection and privacy implications across
different jurisdictions. A reading room or audit-logged secure U.S. data repository could best
balance practical needs against legitimate privacy and cross-border risks, keeping supervision
within reach of this Court.
         For these reasons, Doe urges the Court to adopt Doe’s Proposed Protective Order.
Shueisha Inc.’s Position


       Case Gonzalez
Hon. Yvonne  4:25-mc-80147-YGR
                     Rogers                     Document 16           Filed 11/13/25         Page 4 of 5
November 13, 2025
Page 3


        Shueisha seeks to identify non-party John Doe for the sole purpose of pursuing its
copyright enforcement options against Doe. This is entirely in line with the purpose of 17 U.S.C.
§ 512(h), aptly titled “[s]ubpoena to identify infringer.” Doe now seeks to effectively invalidate
both this Court’s denial of Doe’s motion to quash the subpoena and undercut the DMCA’s clear
purpose of publicly identifying copyright pirates. Doe’s proposed protective order is impossible to
adopt without going against the purpose of 17 U.S.C. § 512(h) and copyright enforcement policy.
1.      There Is No Good Cause for a Rule 26(c) Protective Order
        Protective orders are exceptional measures justified only by concrete harm that the
requesting party has the burden to establish. See In re Violation of Rule 28(D), 635 F.3d 1352,
1358 (Fed. Cir. 2011). Even when potential specific harm is found, the court must balance “the
public and private interests to decide whether a protective order is necessary.” In re Roman Cath.
Archbishop of Portland in Oregon, 661 F.3d 417, 424 (9th Cir. 2011) (citing Glenmede Tr. Co. v.
Thompson, 56 F.3d 476, 483 (3d Cir. 1995) (“Broad allegations of harm, unsubstantiated by
specific examples, do not satisfy Rule 26(c).” and listing factors to balance).
        Here, Doe has not articulated a plausible, particularized harm. Doe is simply attempting to
avoid legal consequences that should result their operation of a massive piracy website.2 Does has
not articulated a single harm it faces other its desire to avoid copyright enforcement.
        Doe baselessly speculates that the relative lack of Shueisha copyright complaints filed in
U.S. courts suggests some other, inappropriate use of the subpoenaed information. However, Doe
ignores that Shueisha can use infringer identity information to issue cease-and-desist letters,
negotiate licensing arrangements, obtain pre-litigation settlement, and assess and drop matters
deemed not cost-effective for litigation. These are some of the valuable enforcement options that
should remain available to Shueisha; none of which would have been found on court dockets.
        Courts have found the interest of copyright holders to seek limited discovery from a third
party to establish a potential infringer’s identity outweighs any privacy interest infringers may
have in protecting their identities. See Strike 3 Holdings, LLC v. Doe, 2019 WL 935390, at *4-*5
(E.D. Cal. Feb. 26, 2019) (denying infringer’s motion to quash in order to allow plaintiff to
determine whether it can obtain the identity of the proper defendant, and noting defendant could
raise any factual innocence claim in a motion to dismiss); Strike 3 Holdings, LLC v. Doe, No.
EDCV182496TJHSPX, 2019 WL 12446430, at *4 (C.D. Cal. Mar. 29, 2019)(finding infringer’s
privacy interest in personally identifiable information to be minimal).
        There is no good cause for a protective order, least of all for Doe’s restrictive version.
2.      A Broad Protective Order Frustrates Enforcement and Rewards Concealment
        Granting an infringer’s request for sweeping protective order restrictions inverts the logic
of Rule 26(c) and the purpose of the DMCA subpoena process. Protective orders are meant to
shield sensitive personal information, trade secrets, or competitive data, not to insulate willful
infringers from accountability. The DMCA subpoena process is intended to unmask infringers to
allow enforcement against them. Doe will have the opportunity to defend on the merits in litigation.
        Doe’s proposal would obstruct further lawful investigation and litigation. Shueisha must
be free to use identifying information to pursue claims wherever appropriate, coordinate with law
enforcement, seek additional subpoenas if the identifying information in the production is
insufficient, or notify others whose works were infringed. Doe’s proposed order would prevent
such uses and would improperly convert the subpoena into a one-time, sealed transaction, contrary

2
  Under Fed. R. Evid. 201 the Court may take judicial notice of the publicly reported scale of Doe’s infringement
operation. See, e.g., https://www.cbr.com/mangajikan-manga-piracy-site-shut-down-185-million-monthly-users/
(reporting Doe’s website had 185 million monthly users prior to Shueisha’s enforcement efforts).


       Case Gonzalez
Hon. Yvonne  4:25-mc-80147-YGR
                     Rogers              Document 16         Filed 11/13/25      Page 5 of 5
November 13, 2025
Page 4


to Rule 26 and the DMCA’s enforcement goals. Specifically, Doe’s request for a 180-day limit on
the use of the data conflicts with the statute of limitations for copyright actions. Doe’s request to
limit enforcement to the United States ignores that Doe may be located abroad beyond the reach
of U.S. Courts. Doe’s proposal would also restrict Shueisha from using the subpoenaed data to
identify and pursue potential other infringers identifiable. None of these outcomes are acceptable.
         In addition, Doe’s proposal would impose unnecessary administrative burdens on the
Court. Doe’s overly complex proposal will undoubtedly spawn disputes over compliance, access,
and inadvertent disclosure. Applying an automatic Attorney’s Eyes-Only designation to all
produced documents and restricting Shueisha’s ability to request additional subpoenas or serve
process on Doe without prior court approval are just two examples of just how far Doe is reaching.
Moreover, forcing Shueisha to unnecessarily pursue additional subpoenas in support of foreign
litigation, if necessary, under 28 U.S.C. 1782, to obtain the exact same information sought in the
pending subpoena would be a waste of judicial resources. These issues are entirely avoidable by
forgoing a protective order or, if the Court deems it necessary, by utilizing Shueisha’s more
narrowly tailored proposed order.
3.       Public Interest Strongly Favors Transparency and Accountability
         Federal courts recognize a presumption of openness in judicial proceedings. See Nixon v.
Warner Commc’ns, Inc., 435 U.S. 589, 597 (1978). This presumption carries special force where,
as here, the underlying conduct affects the integrity of the copyright system and the economic
viability of creative industries. The public has a legitimate interest in knowing who operates large-
scale piracy sites and how the DMCA process vindicates statutory rights. Sealing or concealing
those identities under an expansive and restrictive protective order would erode public confidence
in both the DMCA and the Court’s enforcement role.
4.       Limited, Targeted Protections Adequately Address Any Legitimate Concern
         If the Court finds any basis for a protective order at all, it should confine the order’s
restrictions to the minimum necessary to prevent misuse of personal data, as proposed in
Shueisha’s proposed protective order, which includes the following components:
     • Permitting use of the information solely for purposes of investigating and prosecuting
         infringement, while allowing public disclosure as necessary for filings or enforcement;
     • Allowing redaction of sensitive contact information from publicly filed documents;
     • Prohibiting use of information for purposes unrelated to copyright enforcement.
         These narrow provisions would satisfy Rule 26(c)’s requirement of proportionality without
granting the infringer the de facto anonymity that Congress expressly refused to guarantee in
§ 512(h). Anything broader would improperly allow infringers like Doe to use protective orders
as a mechanism of continued immunity from enforcement.
Conclusion
         Because the anonymous infringer, Doe, has no specific, good-cause basis for extensive
confidentiality protections or limitations on Shueisha’s ability to pursue its copyrights, and because
broad restrictions would contradict both Rule 26(c)’s limited purpose and the DMCA’s
enforcement design, the Court should not issue a protective order. If the court finds that good cause
and specific non-enforcement-related harms to Doe exist, the Court should grant only the narrowly
tailored protections limited to redacting personal identifiers or genuinely sensitive information
prior to the onset of litigation reflected in Shueisha’s proposed protective order. Doe’s request for
sweeping protections for their infringing activities should be denied.