StartupsLegalFundraising

What a $18.3M Damages Award Teaches Startups About Contract Drafting and IP Protections

UUnknown

2026-03-09

10 min read

The EDO–iSpot $18.3M verdict is a wake-up call for adtech and SaaS founders—use this checklist to harden contracts, IP, and APIs now.

Hook: One $18.3M verdict — and the contracts your adtech or SaaS startup thought were "good enough" suddenly aren’t

Startups and scaleups in adtech and SaaS face a relentless stream of operational decisions — product roadmaps, growth channels, pricing models — while legal risk quietly compounds in the background. The January 2026 jury verdict that awarded iSpot $18.3 million against EDO for breaching a data-use contract is a wake-up call: a single contract breach over proprietary measurement data can wreck valuations, derail fundraising or IPO plans, and saddle a small company with litigation costs that dwarf its runway.

Top takeaways up front (actionable)

Immediate action: Audit all data access controls, API keys, and licensed dashboards this quarter — revoke unused keys and tighten scopes.
Contract essentials: Add explicit, granular license language, audit rights, and tailored indemnities for data misuse by partners or licensees.
IP and employee controls: Ensure assignment of inventions, data-handling policies, and secure onboarding/offboarding for engineers working with sensitive datasets.
Insurance and caps: Revisit E&O and cyber policies and align liability caps and carve-outs to reflect realistic litigation exposure.
IPO readiness: Treat contract hygiene as a material disclosure item—investors and underwriters will demand it in 2026.

Why the EDO–iSpot judgment matters for adtech and SaaS founders

In the U.S. District Court for the Central District of California, a jury found EDO liable for breaching its contract with iSpot after allegedly accessing and scraping iSpot’s TV ad airings data for uses beyond the licensed scope. iSpot sought up to $47 million and received an $18.3 million award. That outcome is not just a headline — it maps to a set of practical risks every startup must manage:

Monetary exposure: Jury awards can exceed damages estimates and insurance limits.
Valuation and fundraising impact: Pending litigation or recognized liabilities are material to investors and underwriters.
Reputational harm: Accusations of data scraping or IP misappropriation undermine trust with enterprise customers and publishers.
Operational disruption: Discovery often forces product changes (removing features or revoking access) and diverts engineering resources.

Context: 2025–2026 legal and regulatory trends that raise the stakes

The EDO–iSpot award sits inside a broader shift that has accelerated since late 2025:

Heightened enforcement against data misuse and unauthorized scraping—state attorneys general, the FTC, and private plaintiffs have been more willing to pursue large technology firms and mid-market vendors alike.
Investor scrutiny: Due diligence teams ask deeper questions about data sources, license terms, and third-party dependencies as a standard part of IPO readiness checks.
AI training and model-risk concerns: With more SaaS and adtech firms leveraging machine learning, rights to use datasets for model training have become contentious and must be expressly addressed.
Jury attitudes: Recent cases suggest juries and judges are treating proprietary datasets and measurement platforms similarly to traditional IP and trade secrets.

What this means for startups

If your product ingests third-party telemetry, publisher logs, or licensed measurement feeds, you must treat licensing as a core product and legal risk control — not a boilerplate add-on.

Practical legal checklist for adtech and SaaS startups (operational & contractual controls)

Below is an actionable checklist you can implement in the next 90 days. Each item aligns with the lessons from EDO–iSpot and evolving 2026 trends.

1) Contracts and license drafting — make permissions explicit

Define the licensed dataset precisely: Avoid umbrella terms like “data” or “platform access.” Specify tables, fields, time windows, and permitted derivative uses (reporting vs. model training vs. resale).
Permitted uses clause: Demarcate allowed purposes (e.g., "film box-office analysis only") and include negative covenants against scraping, re-selling, or combining with other proprietary datasets without consent.
Granular scope & technical limits: Couple contractual scope with technical enforcement: scoped API keys, rate limits, and per-endpoint permissions enforce the legal limits.
Data retention & deletion obligations: Require the licensee to delete or return data on termination and certify deletion periodically.
Audit rights: Reserve the right to third-party or internal audits, with clear notice periods and scope. Include remedies for noncompliance (suspension of access, liquidated damages).

2) Intellectual property protection — beyond patents

Explicit ownership clauses: State that datasets, measurement methodologies, dashboards, and derived benchmarks are the licensor’s IP unless explicitly assigned.
Derivative works and model-training rights: Control whether licensees may use the data to train models. If you permit training, require attribution, no commercialization without a separate license, or a royalty structure.
Trade secret protection: Add contractual non-disclosure and marking requirements and implement internal policies to maintain secrecy (access logs, limited access).
Employee and contractor agreements: Ensure invention assignment and confidentiality obligations cover data-handling, model IP, and analytics code.

3) Liability allocation and insurance

Indemnities: Use tightly scoped indemnities that require the indemnitor to cover claims arising from unauthorized data use, IP infringement, or violations of privacy laws.
Limitation of liability: Caps matter — but don’t over-rely on blanket caps. For IP and willful misconduct carve-outs, consider removing caps or setting higher limits.
Insurance: Maintain and review Errors & Omissions (E&O), cyber liability, and media liability policies. Confirm coverage for data scraping disputes and IP misappropriation suits.

4) Technical and operational controls

API governance: Issue scoped keys with short lifespans, granular scopes, and rotation policies. Log all calls and make logs immutable for a defined retention period.
Monitoring & anomaly detection: Deploy rate-limit alerts and abnormal-use detectors that flag mass-export or scraping patterns.
Least privilege: Apply role-based access control (RBAC) and require privileged access reviews quarterly.
Data minimization: Avoid packaging more fields than needed; apply pseudonymization and hashing where feasible.

5) Vendor & partner management

Master services agreements (MSA): Add explicit downstream licensing limits and audit remedies for subcontractors.
Subprocessor controls: Require vendor chains to replicate your contractual IP and data restrictions.
Onboarding checklist: Require legal, security, and product sign-off before granting production access to any partner.

6) Discovery readiness & litigation playbook

Preservation protocols: Define a legal holds process and retention map so you can rapidly preserve relevant logs and communications.
Evidence readiness: Keep immutable logging, access control lists, and change histories to support your compliance or defense in court.
Budgeting for litigation: Model potential damages scenarios and ensure your board understands downside ranges — prepare for settlement vs. trial trade-offs.

Sample clause language (guidance — customize with counsel)

Below are concise examples you can adapt with your legal team. These are templates, not legal advice.

Permitted Use: "Licensee may access and use the Data solely for [specified purpose]. Any other use, including resale, redistribution, or training of machine learning models without Licensor's prior written consent, is prohibited."
Audit Right: "Licensor may, upon five (5) business days' notice and no more than once per calendar year, audit Licensee's use of the Data; Licensee shall cooperate and provide reasonable access to records and systems."
Deletion Certification: "Within thirty (30) days of termination, Licensee shall delete all copies of the Data and certify in writing that deletion is complete."
Indemnity for Unauthorized Use: "Licensee shall indemnify Licensor for claims arising from Licensee's use of the Data outside the scope permitted by this Agreement, including reasonable attorneys' fees and damages."

IPO and M&A implications — why clean contracts are non-negotiable

When preparing for an IPO or a strategic sale, buyers and underwriters perform legal diligence on material contracts, particularly data and IP licenses. The EDO–iSpot verdict crystallizes several buyer concerns:

Material contract liability: A damages award or ongoing litigation must be disclosed and can materially affect deal terms or require escrow/indemnity arrangements.
Underwriting risk: Underwriters will flag weak ownership assertions over proprietary datasets and may demand indemnities from founders or adjust valuations accordingly.
Post-close integration risk: If third-party data providers restrict downstream use, the acquirer may lose product capabilities post-transaction, decreasing deal value.

Board-level governance: bring legal risk to the top

Founders often think contract risk is a back-office problem. It’s not. Boards and CFOs must track contract risk as part of enterprise risk management:

Include legal contract risk in quarterly board materials.
Report active audits, expired licenses, and high-exposure countersignatures (resellers, data providers).
Set thresholds for mandatory outside counsel review (e.g., any contract with uncapped IP indemnity or over $1M of potential exposure).

When things go wrong: pragmatic steps after a claim or demand

Preserve evidence: Immediately implement a legal hold and preserve access logs, API tokens, and communications with the counterparty.
Contain technically: Rotate keys, revoke repositories or dashboards implicated, and restrict further access to the disputed datasets.
Notify insurers: Alert E&O and cyber carriers and comply with notice requirements to preserve coverage.
Assess settlement vs. defense: Run a rapid damages and reputational analysis with counsel—benchmarks like EDO show jury awards can be substantial.
Communicate to stakeholders: Brief the board, lead investors, and key customers with a concise remediation plan.

Case lens: what EDO–iSpot reveals about proof and damages

The jury’s award to iSpot illustrates three litigation realities startups must plan for:

Technical evidence matters: Access logs, IP addresses, and scraping patterns are central to proving misuse. Immutable logging policies are invaluable.
Scope of damages: Plaintiffs will attempt to tie unauthorized use to lost revenues, lost licensing opportunities, and downstream market harm — ensure your agreements limit or allocate these risks.
Public messaging: Plaintiffs leverage reputational claims; have a PR and customer communication plan ready if data misuse allegations surface.

"We are in the business of truth, transparency, and trust. Rather than innovate on their own, EDO violated all those principles, and gave us no choice but to hold them accountable." — iSpot spokesperson (January 2026)

Implementation roadmap: 90-day plan for founders and legal teams

Week 1–2 — Rapid inventory: Catalog all datasets, dashboards, APIs, and third-party feeds. Record contract dates, scope, renewal, and technical access vectors.
Week 3–4 — Contract triage: Identify high-risk agreements (broad licensees, missing audit rights, no deletion clause) and prioritize renegotiation or technological controls.
Month 2 — Technical hardening: Implement scoped API keys, rotate secrets, enable immutable logging, and deploy anomaly detection for scraping.
Month 3 — Policy and insurance: Update employee NDAs, assign invention rights, and confirm insurance coverage aligns with new exposures.
Ongoing — Board reporting: Add a legal-risk line item to quarterly board packets and present remediation progress until all high-risk items are closed.

Advanced strategies for mature scaleups

Data escrow for critical feeds: For marquee customers, consider a neutral data escrow to reduce counterparty friction and provide continuity assurances.
Dynamic licensing: Employ usage-based licenses with built-in audit triggers and tiered pricing to monetize legitimate downstream model training.
IP monetization: Package measurement methodologies as separate licensed modules with stronger legal protections.
Pre-IPO legal due diligence: Run mock diligence with outside counsel to identify disclosure gaps and material contract weaknesses well before filing.

Conclusion: Treat contracts as product — and act now

The EDO–iSpot judgment is a practical lesson: proprietary data and measurement platforms are valuable IP, litigable and monetizable. For adtech and SaaS startups, contract drafting and IP protections are not legal niceties — they are core product controls that preserve valuation, enable scaling, and reduce startup risk and litigation costs.

Call to action

Startups and scaleups: schedule a legal-and-product contract audit this quarter. Begin with the 90-day roadmap above, and engage outside counsel for clause-level review of any high-exposure agreements. If you want a checklist template tailored for adtech or SaaS licensing, subscribe to our legal-diligence pack or contact a qualified attorney to convert the checklist into enforceable contract language and operational controls.

Unknown

Contributor

Senior editor and content strategist. Writing about technology, design, and the future of digital media. Follow along for deep dives into the industry's moving parts.