WP Engine, Inc. V. Automattic Inc. Et Al.  🔗 **Source:** [WP Engine, Inc. V. Automattic Inc. Et Al.](https://storage.courtlistener.com/recap/gov.uscourts.cand.437474/gov.uscourts.cand.437474.302.0.pdf) > [!note]+ Document Notes > tags: [wp-engine-automattic, discovery-dispute, acf-plugin, deposition, spoliation, wordpress-governance, plugin-directory, corporate-representative] > author: Joint filing (WP Engine and Defendants) > source: CourtListener RECAP - N.D. Cal. 4:24-cv-06917-AMO > filing_type: joint letter brief > docket: 302.0 > > # 🏷️ Discovery Dispute Over ACF Plugin Data and WordPress.org User Information > > # 🧭 Table of Contents > - [References](#-references) > - [Summary](#-summary) > - [Main Content](#-main-content) > - [Governance Digest](#-governance-digest) > - [Hypotheses](#-hypotheses) > - [Implications](#-implications) > > # 🔗 References > **Dockets:** 302.0, 272 > **Rules:** Fed. R. Civ. P. 30(b)(6), 26(e)(1); Civil Local Rule 5-1(i)(3) > **RFPs:** 13, 15, 59, 77, 108, 109, 124, 172-176, 212 > **Cases:** Adidas Am., Inc. v. TRB Acquisitions LLC, 324 F.R.D. 389, 397 (D. Or. 2017) > **Key Witnesses:** Iain Poulson (WP Engine), Barry Abrahamson (Defendants) > > # 📝 Summary > This joint letter brief to Magistrate Judge Krishnan reveals a heated discovery dispute over ACF plugin data that exposes critical WordPress governance vulnerabilities. WP Engine seeks to compel production of business records showing ACF plugin performance metrics, while Defendants counter-demand WordPress.org user identification data that may have been automatically deleted. The dispute centers on documents from WP Engine's Rule 30(b)(6) corporate representative Iain Poulson, who testified about various ACF tracking systems. Both sides claim spoliation—WP Engine alleging Defendants failed to preserve WordPress.org user data, Defendants claiming WP Engine withheld key business documents until the final hour of discovery. The filing reveals that WordPress.org systems automatically delete user identification data after 48 hours "to protect user privacy," raising questions about evidence preservation in future WordPress governance disputes. > > # 📖 Main Content > <!-- deep-read:sections start --> ## 🗒️ Notes ### Defendants' Discovery Demands - **Google Document underlying Exhibit 9**: WP Engine now claims privilege over underlying document to email chain WPE00511012 between Poulson and brand team - **Monthly ACF Dashboard**: Produced as WPE00639499 at 11:25 PM PT on May 14 (final hour of discovery); Defendants claim file corrupted - **Refund-Reasons Log**: Produced as WPE00639500 in final hour; appears limited to 2023+ data, Defendants want back to 2021 - **BI Team/Data-Warehouse Reports**: WP Engine claims "moot" because data populated in Monthly ACF Dashboard - **Google Analytics Data**: Tracks ACF website traffic and in-plugin upsell clicks; WP Engine alleges 15% of ACF PRO subscriptions originated from standard plugin page click-throughs - **Annual ACF User Survey Data**: 2023 and 2024 produced (1,300+ respondents in 2024); no 2022 survey; 2025 survey "not yet complete" - **Brand Studies on Reputational Harm**: WP Engine claims none exist after "reasonable search" ### WP Engine's Counter-Demands - **WordPress.org Plugin Data**: Seeks user identification data including IP addresses, site URLs, hostnames sent during plugin updates - **Preservation Declaration**: Demands sworn statement about what user data was collected, preserved, and whether auto-delete functions were disabled - **Spoliation Claims**: Alleges Defendants' systems recorded ACF user identities after preservation obligations arose (October 12, ten days post-lawsuit filing) ### Technical Architecture Revelations - WordPress.org doesn't require authentication for plugin downloads - Only aggregate plugin-install data maintained in "stats" database - User identification data automatically deleted after 48 hours for privacy protection - Barry Abrahamson testified about system capabilities during Rule 30(b)(6) deposition # 📚 References - WP Engine Third Amended Complaint ¶¶ 156, 187-188 - Keohane Declaration ¶¶ 2-5 - Abrahamson Deposition Transcript Vol. 2, 608:7-21, 136:16-20 - Document productions: WPE00639499, WPE00639500, WPE00615201, WPE00511012, WPE00480347, WPE00480324 # 🗣️ Paraphrase WP Engine and Automattic are fighting over who should produce what documents about the ACF plugin takeover. WP Engine's product manager testified about various tracking systems and business reports, but WP Engine didn't produce many of these documents until the last possible moment. Meanwhile, WP Engine wants data about WordPress.org users who downloaded ACF, but Automattic says their systems automatically delete that information after two days for privacy reasons. Both sides are accusing the other of hiding or destroying important evidence. # 📰 Governance Digest The WordPress.org plugin directory's privacy-first architecture is colliding with litigation discovery demands, creating a precedent-setting dispute over data preservation. While the 48-hour auto-deletion of user identification data reflects sound privacy practices, it's now being weaponized in court as potential spoliation. This case may force WordPress.org to choose between user privacy and legal compliance, potentially reshaping how the directory tracks plugin usage. The revelation that 15% of ACF PRO conversions came from wordpress.org click-throughs also highlights the directory's massive commercial influence—and why controlling plugin listings is worth fighting over. # 🧪 Hypotheses 1. **Privacy vs. Preservation Conflict**: WordPress.org's 48-hour data deletion policy will become legally problematic as more commercial disputes arise around plugin governance 2. **Directory Commercial Value**: The 15% conversion rate from wordpress.org to ACF PRO demonstrates quantifiable commercial value of plugin directory control 3. **Evidence Preservation Gap**: Current WordPress.org architecture cannot adequately support litigation holds without compromising privacy principles 4. **Corporate Representative Preparation**: WP Engine's Poulson testimony reveals existence of extensive plugin performance tracking that wasn't produced 5. **Timing-Based Spoliation Claims**: The October 12 ACF takeover date (post-lawsuit) creates strong evidence preservation obligations for user identification data 6. **Plugin Ecosystem Monetization**: The dispute reveals sophisticated tracking of plugin-to-premium conversion funnels across WordPress.org # 📊 Methodology Based on Rule 30(b)(6) corporate representative depositions of Iain Poulson (WP Engine Principal Product Manager for ACF) and Barry Abrahamson (Defendants' technical witness). Evidentiary basis includes specific document productions, RFP responses, and witness testimony under oath. Keohane Declaration provides personal knowledge basis for WP Engine's document search and privilege claims. No methodology concerns identified. # ❓ Questions - How will WordPress.org balance user privacy with litigation preservation obligations in future commercial disputes? - What commercial tracking capabilities does WordPress.org actually maintain beyond aggregate download statistics? - Will courts require WordPress.org to modify its privacy-protective architecture to support evidence preservation? - How extensive is WP Engine's plugin performance tracking, and what does it reveal about commercial WordPress ecosystem monitoring? - Could the 48-hour deletion policy be challenged as insufficient for regulatory compliance beyond litigation contexts? # 🔮 Future Research - **Litigation**: Expert witness battles over damages methodologies using the disputed ACF performance data; potential sanctions motions over spoliation claims - **WordPress Governance**: WordPress Foundation's response to litigation-driven pressure on wordpress.org privacy policies; community reaction to commercial data preservation demands - **Technical Architecture**: Potential changes to plugin directory logging and retention policies; implementation of litigation hold capabilities - **Commercial Ecosystem**: Broader implications for how WordPress.org plugin listings influence premium product conversion rates # 💡 Implications **Practice**: WordPress businesses must implement litigation holds covering wordpress.org interaction data; plugin developers should document conversion tracking methodologies **Policy**: WordPress.org may need litigation hold procedures that balance privacy with legal compliance **Security**: Current privacy-protective deletion policies may conflict with regulatory data retention requirements **Education**: WordPress community needs understanding of how directory interactions create commercial evidence **Funding**: Potential costs for WordPress.org infrastructure changes to support evidence preservation without compromising privacy # 🧠 Learning Styles Assessment **Visual**: Document production timelines and system architecture descriptions support visual learners **Aural**: Legal argument structure follows oral advocacy patterns **Verbal**: Heavy use of legal terminology requires strong reading skills **Kinesthetic**: Limited hands-on elements; mostly procedural descriptions **Logical**: Strong logical progression through discovery dispute elements **Social**: Joint brief format shows collaborative legal process **Solitary**: Dense legal analysis suitable for individual study **Naturalistic**: Pattern recognition in discovery dispute tactics **Reading Level**: Graduate/professional (legal document complexity) # 📊 Accessibility Assessment **Format**: Text-extractable PDF with standard legal formatting **Structure**: Clear section headings and numbered paragraphs aid navigation **Artifacts**: Minimal formatting issues; standard court filing structure **WCAG 2.2 AA**: Adequate contrast and structure, though legal complexity limits broader accessibility # 🌍 DEIB Assessment **Cultural Breadth**: US-centric legal framework; limited global perspective **Inclusive Language**: Standard legal terminology without exclusionary language **Neurodiversity Support**: Dense legal format challenging for diverse processing styles **Representation**: Corporate legal representatives; limited stakeholder diversity **Psychological Safety**: Adversarial legal context inherently challenging for psychological safety # ✅ Logical Validity **Strong Reasoning**: Both sides present coherent arguments about document production obligations and technical limitations **Fallacies**: WP Engine's "suspicious" claim about privilege timing approaches ad hominem without substantive basis **Tone**: Professional legal advocacy with appropriate adversarial edge; no significant logical failures identified # 🛡️ DARVO Analysis **Pattern Present**: Both sides employ DARVO tactics **Deny**: WP Engine denies withholding (claims "moot"); Defendants deny user data exists **Attack**: WP Engine attacks Defendants' spoliation; Defendants attack WP Engine's last-minute production **Reverse**: Each side positions themselves as victim of other's discovery abuse **Assessment**: Standard adversarial discovery tactics rather than systematic DARVO manipulation # 🎯 Conclusion This discovery dispute exposes a fundamental tension between WordPress.org's privacy-protective architecture and commercial litigation demands. The automatic deletion of user identification data after 48 hours reflects sound privacy practices but creates evidence preservation challenges that could reshape WordPress governance. WP Engine's last-minute document production and the revelation of extensive ACF performance tracking highlight the commercial stakes involved in plugin directory control. Watch for potential court orders requiring WordPress.org infrastructure changes and broader implications for open-source platform governance in commercial disputes. # 🧱 Refactor Appendix ## 📚 Literature Atoms > [!quote] WordPress.org Privacy Architecture > "Because wordpress.org does not require authentication to download plugins and does not log personal user data, the only information maintained in the 'stats' database is aggregate plugin-install data... The identities of ACF users are irrelevant to this case and WordPress.org's systems were designed not to retain such identifying information for more than 48 hours to protect user privacy." > [!quote] Commercial Impact Quantification > "WP Engine alleges the hijacking 'suspended a channel for generating new customers' because 15% of ACF PRO subscriptions originated from click-throughs on the standard ACF plugin page." > [!quote] Last-Minute Production Pattern > "That it produced certain responsive spreadsheets (WPE00639499 and WPE00639500) at 11:25 pm PT on May 14—in the last hour before the close of fact discovery, after all its witnesses had been deposed, and after Defendants had been demanding these documents for months—only underscores the prejudice." ## 🧠 Permanent Candidates #### Privacy-vs-Litigation Architecture Conflict WordPress.org's 48-hour data deletion policy creating evidence preservation challenges in commercial disputes #### Plugin Directory Commercial Quantification 15% conversion rate from wordpress.org ACF page to ACF PRO subscriptions demonstrating measurable commercial value #### Corporate Representative Knowledge Gap Rule 30(b)(6) witnesses testifying about document existence without prior production coordination ## ✏️ Fleeting Queue - Connection between wordpress.org privacy policies and broader open-source platform governance models - Potential regulatory implications beyond litigation context for data retention - Pattern of last-minute document production in high-stakes WordPress commercial disputes <!-- deep-read:sections end --> 📄 **Full text:** ![[Full Document Contents/Articles/WP Engine, Inc. V. Automattic Inc. Et Al..md|WP Engine, Inc. V. Automattic Inc. Et Al. by Ajay S. Krishnan, Iain Poulson]] ## Highlights - Stunningly, Defendants admit their systems store the requested ACF user identifying information—but then delete it—purportedly "to protect user privacy." There is no "user privacy" exception to the law against spoliation; any deletion after 48 hours should have been disabled after Defendants' preservation obligations arose, confirming the spoliation of this highly relevant data. Defendants' contention that this identifying information is "irrelevant to this case" is belied by Defendants' own questioning of Mr. Poulson at his deposition where Defendants asked Mr. Poulson to identify specific, lost ACF customers at least 12 times (Keohane Decl. \P 5)information that we now know was expressly recorded by Defendants' systems. Defendants' claim that "the data was gone...long before WP Engine filed this lawsuit" makes no sense. Defendants hijacked WPE's ACF plugin on October 12—ten days *after* WPE filed the instant lawsuit. According to Defendants' own admissions, therefore, their systems would have recorded the identity of all ACF users after Defendants' preservation obligations arose. The Court has already required one sworn declaration from Defendants because it found their document preservation efforts "concerning." Dkt. 272. It should do so again here. ([View Highlight](https://read.readwise.io/read/01ksfva9qq8z5brt49dxhvbe69)) - Note: Docket 302: WPE's spoliation argument — ACF user data recorded then deleted on 48-hr cycle. - Tags: legal, wp-engine-automattic