A federal judge in Oakland on October 16, 2026 refused to hold NSO Group in civil contempt of the permanent injunction that bars it from WhatsApp, ruling that a single declaration from a Meta threat intelligence investigator, which attributed 23 new WhatsApp accounts and a series of malicious links to the Israeli spyware maker without disclosing how, fell short of the "clear and convincing evidence" the law requires.

In Short

A court had already ordered NSO, the company behind the Pegasus spyware, to stay off WhatsApp, and WhatsApp asked the judge to punish NSO for breaking that order. The judge said no, because WhatsApp kept the details of how it spotted NSO secret, so the court could not check the claims for itself. That leaves platforms with a hard choice: show the court exactly how they catch attackers, which also shows the attackers, or keep the methods hidden and risk losing in court.

The order

Judge Phyllis J. Hamilton of the US District Court for the Northern District of California signed the 11-page order, Document 884 in case 4:19-cv-07123-PJH, on October 16, 2026. It resolves the contempt motion filed as Docket 854, along with the supplemental briefs filed as Dockets 879 and 880. The motion was argued on August 20, 2026. Micah Block, Luca Marzorati, Antonio Perez-Marques and Greg Andres appeared for WhatsApp Inc. and its co-plaintiffs. Kellen Dwyer appeared for NSO Group Technologies Limited and its co-defendants.

The conclusion takes one line: "For the foregoing reasons, plaintiffs' motion for contempt (Dkt. 854) is DENIED."

The reasoning runs across eight pages, and it matters more than the result. Hamilton did not find that NSO had complied with the injunction. She found that WhatsApp had not proved, to the required standard, that it had not. The distinction is the whole case.

How the case got here

The litigation began in October 2019, after NSO used a vulnerability in WhatsApp's voice calling feature in May 2019 to install Pegasus on about 1,400 devices. In December 2024, PPC Land reported that Hamilton granted summary judgment to WhatsApp, finding violations of the Computer Fraud and Abuse Act, California's Comprehensive Computer Data Access and Fraud Act and WhatsApp's terms of service. That ruling found NSO's WhatsApp Installation Server had sent messages through WhatsApp's California servers 43 times in May 2019.

A San Francisco jury then awarded $167.3 million in punitive damages and $444,719 in compensatory damages in May 2025. On October 18, 2025, Hamilton cut the punitive award to about $4 million, applying a 9-to-1 ratio, and on the same day issued the permanent injunction barring NSO from targeting WhatsApp or its users. WhatsApp went back to court on June 8, 2026, alleging new spear-phishing attempts and publishing three malicious domains as threat indicators. That filing is the motion Hamilton has now denied.

The new order summarizes the history in one clause: "After plaintiffs prevailed at trial on their CFAA, CDAFA, and breach of contract claims, plaintiffs sought a permanent injunction against defendants." The injunction itself is Docket 809.

The three provisions at issue

Three parts of the injunction were in play.

Paragraph 3(a) prohibits "Developing, using, selling, offering for sale, distributing, transferring, or licensing, whether directly or through a third party, intermediary, or proxy, any technology that interacts with or emulates any aspect of the WhatsApp Platform in any way, including as a method or approach used to install and deploy the technology (an 'installation vector'), without first requesting and obtaining Plaintiffs' express written permission."

Paragraph 3(d) prohibits "Creating accounts, whether directly or through a third party, intermediary, or proxy, on the WhatsApp Platform, without first requesting and obtaining Plaintiffs' express written permission."

Paragraph 4 requires NSO and the other prohibited parties "to delete and destroy any and all computer code or technologies that use, access, or depend on the WhatsApp Platform, including the WhatsApp Installation Server ('WIS')," to delete all data obtained from the platform, and "to disable customer access to any and all computer code or technologies maintained by the Prohibited Parties that use, access, or depend on the WhatsApp Platform."

WhatsApp's opening motion alleged two kinds of violation: creating and operating WhatsApp accounts, and deploying one-click malicious URLs through the platform. After NSO's opposition drew a line between creating new accounts and using accounts that already existed, WhatsApp's reply split the first category in two. The court ended up ruling on three categories. A footnote records that WhatsApp tried to add a fourth at the hearing, and that the court refused "because the defendants had no opportunity to meaningfully respond to a newly-raised argument."

The standard of proof

Before reaching the evidence, Hamilton spent roughly three pages settling a procedural dispute that, in the end, decided the motion.

The baseline is not in question. Quoting the Ninth Circuit in FTC v. Enforma Natural Products (2004), the order states that "[t]he moving party has the burden of showing by clear and convincing evidence that the contemnors violated a specific and definite order of the court. The burden then shifts to the contemnors to demonstrate why they were unable to comply." The order also cites the Ninth Circuit's 2025 ruling in Epic Games v. Apple for the definition of civil contempt and for the principle that "a decree will not be expanded by implication or intendment beyond the meaning of its terms."

WhatsApp's position moved over the course of the briefing. Its opening motion did not ask for an evidentiary hearing and rested on a declaration by Andrew Blaich, described in the order as "a security engineer investigator on the 'threat intelligence' team at Meta." Only in its reply did WhatsApp offer that "Mr. Blaich is available to testify at any evidentiary hearing the court may wish to hold," and argue for the first time that the court could grant contempt on the papers. For that, it relied on two Ninth Circuit decisions, Peterson v. Highland Music (1998) and Hoffman ex rel. NLRB v. Beer Drivers & Salesmen's Local Union No. 888 (1977), which allow a court to "treat as true the facts set forth in uncontroverted affidavits."

At the hearing, WhatsApp's counsel argued that Peterson "stands for the very clear proposition at the Ninth Circuit that you do not need an evidentiary hearing." If the court was not persuaded, they said, the "correct next step is an order to show cause" directing NSO to rebut the evidence. Hamilton ordered supplemental briefs. In its brief, WhatsApp again asked the court to "find NSO in contempt on the papers," and proposed in the alternative that the court "need only find that there has been a 'sufficient preliminary showing' of contempt to require the alleged contemnor to come forward with evidence."

The order notes that this "sufficient preliminary showing" standard appeared for the first time in that supplemental brief. WhatsApp's authority for it was a 2024 order in Epic Games v. Apple, case 20-cv-5640. Hamilton read that order differently. The Epic court, she wrote, "did not purport to set out a new legal standard," and when it found Epic had made "a sufficient preliminary showing" that Apple's changes undermined the injunction, "it was implicitly applying the 'clear and convincing evidence' standard." Three other Northern District cases cited by WhatsApp - Hernandez v. City of Monterey, Vasquez v. Libre and Facebook v. Power Ventures - got the same treatment. In each, the court found the clear and convincing standard met before ordering further proceedings.

The holding on this point is unambiguous: "The court has found no lower, preliminary standard that applies to the decision to issue an order to show cause." The clear and convincing threshold applies first. Only if it is met does the court choose between an order to show cause and granting contempt outright, as in Peterson and Hoffman.

Category one: 23 new accounts

According to the Blaich declaration, NSO created at least 23 new WhatsApp accounts after the injunction took effect. Those accounts, he stated, bore "technical and behavioral signatures that Meta has previously associated with NSO testing, including account registration patterns, device and other related information, and connections to known NSO-controlled infrastructure."

NSO's response was that WhatsApp had not supplied account names, phone numbers or any other identifying information for the 23 accounts. Without that, NSO argued, the evidence could not be clear and convincing.

WhatsApp did not dispute that the details were missing. It explained why. At the hearing, its counsel said WhatsApp was "very concerned about disclosing to NSO the precise tools" used to "track their activity," and that it "would be problematic" to "force us [i.e., plaintiffs] to give up the specific markers by which we were able to identify these particular accounts." Its approach, in counsel's words: "what we've done here is say, 'Here is an affidavit. If you can controvert it, please go ahead.'"

Hamilton called that "a calculated risk." The benefit was that WhatsApp limited what NSO learned about its tracking. "However, the downside is that the lack of specificity in the Blaich declaration prevents the court from being able to conclude that they have met the 'clear and convincing evidence' standard." The court adopted NSO's characterization: WhatsApp was asking it to "simply accept Mr. Blaich's assurance that he has looked at Whatsapp's undisclosed internal evidence and concluded, 'with high confidence,' that NSO created new Whatsapp accounts." The declaration, the order adds, "provides little detail about what those 'technical and behavioral signatures' actually are."

The court declined to issue an order to show cause and found that the evidentiary gap also distinguished the case from Peterson and Hoffman. The motion was denied as to new accounts.

Category two: accounts that already existed

The second category turned on language rather than evidence. NSO argued that the injunction "does not bar NSO employees from using pre-existing Whatsapp accounts." Paragraph 3(d) covers creating accounts, and nothing else.

WhatsApp shifted to paragraph 3(a), contending that operating existing accounts amounts to "using . . . any technology that interacts with or emulates any aspect of the WhatsApp Platform in any way." It added a fallback: if the WhatsApp app could not itself be the "technology," then the phones running it could.

NSO's answer was that WhatsApp could have drafted the injunction to bar use "for any purpose" and did not, and that ambiguity should be resolved against the drafter. Who drafted it is the detail that settled the point. Hamilton wrote that, "Though a close call," the injunction is "ambiguous at best in prohibiting all uses of pre-existing Whatsapp accounts," and that the ambiguity runs against WhatsApp, which "at the court's request, due to the complexity of and the secrecy surrounding the technology, drafted the injunction's language."

The language that follows is blunt for a federal order. WhatsApp's reading of paragraph 3(a) "is a tortured one, and not what the court had in mind by issuing an order that prohibited using 'any technology that interacts with or emulates any aspect of the WhatsApp Platform in any way.'" Denied.

The third category comes closest to the conduct that started the litigation. According to the Blaich declaration, in February and April 2026 an NSO-affiliated WhatsApp account sent malicious URLs to targets over WhatsApp. Blaich attributed the activity to NSO on five factors, which the order lists:

  • URL infrastructure, meaning the format of the URLs
  • URL redirect behavior
  • lure design, with message templates similar to those NSO had used before
  • targeting profile, with targets located in areas where Pegasus has been used
  • continuity with prior NSO conduct

WhatsApp argued this breached paragraph 3(a) and the paragraph 4 obligation to disable customer access to code that depends on the platform. NSO made two arguments: the evidence was insufficient, and the injunction does not stop sovereign governments from using WhatsApp to send URLs to targets of their operations.

Hamilton took the sovereign customer argument first and refused NSO the blanket ruling it wanted - that an "independent decision by an NSO customer to text a malicious URL to a target via Whatsapp" falls outside the injunction automatically. "Simply put, there are not enough details before the court about the division of labor between defendants and their sovereign customers," she wrote, and then posed the questions the record does not answer: "to what extent are defendants involved in the technical operations that occur after the URL is clicked? To what extent do defendants operate and maintain the software that is downloaded onto the target's device?" If NSO participates in those steps, the conduct falls within the injunction. If it is solely the customer's act, it does not.

That part of the order leaves the door open. The evidence part closes the motion. "As with the evidence regarding the creation of new Whatsapp accounts," the court concluded, "the details provided in the Blaich declaration are simply not enough to meet the demanding 'clear and convincing evidence' standard."

Hamilton also described what she saw as WhatsApp's strategy: "to err on the side of under-disclosing details at first, hoping that the court would allow them a second bite at the apple by supplementing their evidence later, including through the order to show cause procedure." The Ninth Circuit, the order says, "has not provided for a procedure where a plaintiff may make a 'placeholder' evidentiary showing at first, and then supplement it later." Denied.

What the order does not decide

Several questions remain open after October 16. The order makes no finding that NSO complied with the injunction. It does not rule on whether NSO's sovereign customers sit outside the injunction; it says only that the record is too thin to decide. It does not say WhatsApp is barred from filing again with more detailed evidence, though it is explicit that a placeholder showing followed by supplementation is not a route the Ninth Circuit recognizes. And it leaves untouched the question of how any future motion would handle the confidentiality of Meta's detection methods, whether under seal or otherwise. None of those issues is addressed in the 11 pages.

The detection dilemma

Natalia K., who identifies herself on LinkedIn as Senior Tech Legal Counsel at Access Now and is based in Germany, posted about the ruling on LinkedIn. The captured post shows it as one day old and carries no exact date. "Bad news," she wrote. "US District Court denied WhatsApp's motion to hold NSO in contempt for continuing to hack WhatsApp users after a court order barred it from doing so. The evidence wasn't 'clear and convincing' enough."

Her objection is about what proof would cost. "If showing 'enough' evidence means walking the court through exactly how WhatsApp's threat intel team detects NSO, it will help NSO figure out how it got caught. And NSO isn't the only one reading these filings. Foreign intelligence services, exploit developers, and criminal hackers also study them closely."

She extended the point beyond Meta: "Tech companies face the same dilemma as civil society investigators. The evidence you need to win in court is exactly what you can't reveal without helping the adversary. Apple dropped its own lawsuit against NSO because of this." The attached documents do not describe Apple's case further. Her post also links to her own earlier piece for Just Security on discovery in spyware litigation.

Her conclusion is pointed. "Requiring platforms to burn their detection methods to hold spyware makers to account isn't accountability. It's impunity for the entire spyware industry."

The order and the post describe the same trade-off from opposite ends. Hamilton framed WhatsApp's choice as a calculated risk that did not pay off; Natalia K. frames the evidentiary demand itself as the problem. The order does not engage with the security argument beyond recording WhatsApp's concern about disclosing its "specific markers," and it applies the standard as the Ninth Circuit has set it.

Why this matters beyond spyware

For the marketing and advertising community, the ruling is less about NSO than about a pattern PPC Land has followed across platform enforcement cases: the signals platforms use to identify bad actors are worth more when they stay secret, and courts tend to want to see them.

Meta's account-level detection is the same machinery the company describes when it reports enforcement against fraud. On October 13, 2026, PPC Land reported that Meta removed more than 3.7 million West African scam accounts, Pages and Groups in an operation with the UK National Crime Agency, the US Department of Justice and the FBI. The Blaich declaration rests on the same kind of inputs - registration patterns, device information, infrastructure links, lure templates - that underpin takedowns of phishing operations and scam advertisers. Those signals hold value only while adversaries do not know them, a logic close to that of a trade secret. In PPC Land's reading, the October 16 order shows what happens when a platform tries to convert that private confidence into a court finding without exposing the inputs: the attribution stays an assertion.

The Computer Fraud and Abuse Act, the statute under which WhatsApp won at trial, has also become central to disputes over automated access in advertising and commerce. In September 2026, PPC Land reported that the Ninth Circuit had freed Perplexity's shopping agent from Amazon's CFAA claim, holding that the user, not the agent's developer, does the accessing. Winning on liability is one step; holding a defendant to an injunction afterwards turns on a separate burden of proof, and the WhatsApp order shows that burden is not light.

The surveillance market itself has also shifted in ways PPC Land has covered. In May 2026, PPC Land reported on a Haaretz investigation showing that Israeli firms located and sometimes identified Starlink users by combining commercial datasets, including advertising identifiers, rather than relying on device exploits of the Pegasus type. In August 2025, the European Media Freedom Act became fully applicable, restricting member states from using spyware against journalists except for serious offences with judicial authorization.

The injunction remains in place. What the order establishes is the price of enforcing it: WhatsApp can prove NSO's presence on its platform only by showing the court, and NSO, how it knows.

Timeline

Summary

Who: WhatsApp Inc. and its co-plaintiffs, NSO Group Technologies Limited and its co-defendants, US District Judge Phyllis J. Hamilton, Meta threat intelligence investigator Andrew Blaich, and Access Now's Natalia K., who commented on the ruling.

What: The court denied WhatsApp's motion to hold NSO in civil contempt of the permanent injunction, finding the Blaich declaration too vague to prove by clear and convincing evidence that NSO created 23 new accounts or sent malicious URLs, and reading the injunction as not covering use of pre-existing accounts.

When: The order was signed on October 16, 2026, after an August 20, 2026 hearing. The alleged malicious URL campaigns took place in February and April 2026.

Where: The US District Court for the Northern District of California, case 4:19-cv-07123-PJH, Document 884.

Why: WhatsApp withheld the specific markers it used to identify NSO to avoid revealing its detection methods, and the court held that the Ninth Circuit allows no lower preliminary standard or placeholder showing to be supplemented later. The ruling sets out the cost platforms face when enforcing court orders against sophisticated adversaries: disclosure of detection methods, or an unproven case.