WhatsApp and Meta Platforms sued Israeli spyware maker NSO Group in federal court in California, alleging NSO used a zero-click exploit to deliver Pegasus spyware to about 1,400 users. The court held NSO liable, entered a $4.45M judgment, and permanently enjoined NSO from targeting WhatsApp. NSO’s Ninth Circuit appeal is fully briefed, and on October 16, 2026, the court denied WhatsApp’s motion to hold NSO in contempt.
Latest development Oct 16, 2026
On October 16, 2026, Judge Phyllis J. Hamilton denied WhatsApp’s and Meta’s motion to hold NSO Group in civil contempt for allegedly violating the permanent injunction. The court found that the plaintiffs’ evidence, which rested on a declaration identifying 23 suspect WhatsApp accounts, did not meet the clear-and-convincing standard because WhatsApp did not disclose its detection methodology. NSO’s Ninth Circuit appeal remains pending.
Why it matters
The appeal will decide whether a commercial spyware maker can be held liable under federal and California computer-fraud law for hacking a U.S. platform’s users. The permanent injunction, which NSO also appeals, threatens NSO’s business more directly than the $4.45M judgment.
Background
WhatsApp LLC and Meta Platforms, Inc. sued NSO Group Technologies Ltd. and Q Cyber Technologies Ltd. in the U.S. District Court for the Northern District of California in October 2019. They brought claims under the federal Computer Fraud and Abuse Act (CFAA) and California’s Comprehensive Computer Data Access and Fraud Act. WhatsApp alleged that NSO’s Pegasus spyware exploited a WhatsApp vulnerability to target roughly 1,400 users, including journalists and activists.
In December 2024, Judge Phyllis J. Hamilton found NSO liable on summary judgment. In May 2025, a jury awarded $444,719 in compensatory damages and about $167.25M in punitive damages. On October 17, 2025, Judge Hamilton held the punitive award unconstitutionally excessive and remitted it to $4,002,471, nine times the compensatory award. WhatsApp accepted the remittitur on October 31, 2025.
On November 12, 2025, the court entered a final judgment of $4,447,190 and a permanent injunction barring NSO from targeting WhatsApp, reverse-engineering the service, or possessing its code. On November 19, 2025, NSO appealed the liability finding, the damages, and the injunction to the U.S. Court of Appeals for the Ninth Circuit (No. 25-7380). It sought a stay of the injunction, which was not granted. Civil-society amici filed briefs in May 2026 urging the Ninth Circuit to keep the injunction, and briefing closed with NSO’s reply on July 1, 2026. No Ninth Circuit argument date has been set.
On June 8, 2026, WhatsApp moved to hold NSO in contempt for allegedly continuing to target its users after the injunction. At NSO’s request, the hearing was continued from July 16 to August 20, 2026, when Judge Hamilton heard the motion and took it under submission. The parties filed supplemental submissions on August 27 and September 3, 2026, and reported on post-judgment discovery on September 10. On October 16, 2026, Judge Hamilton denied the motion. The court found that WhatsApp’s evidence, which rested on a declaration identifying 23 suspect accounts, did not meet the clear-and-convincing standard because WhatsApp did not disclose its detection methodology.
Timeline 11 events
-
JudgmentJudge Hamilton denies WhatsApp’s contempt motion against NSO
The district court ruled that WhatsApp and Meta had not shown by clear and convincing evidence that NSO violated the permanent injunction. It faulted WhatsApp for not disclosing its detection methodology for 23 allegedly spyware-linked accounts.
WhatsApp loses contempt bid against NSO over 23 alleged spyware accountsWhatsApp loses contempt motion against NSO; US judge says evidence too thinMeta loses contempt motion against NSO over claims of spyware injection
-
HearingJudge Hamilton hears contempt motion and takes it under submission
The hearing followed a continuance from July 16. The court ordered a joint status report, and WhatsApp and NSO filed supplemental submissions on August 27 and September 3, 2026.
-
FilingWhatsApp files reply brief in support of contempt motion against NSO
WhatsApp rebutted NSO’s argument that it had not adequately linked the alleged violative conduct to NSO. It countered that NSO itself built the anonymizing infrastructure that creates this uncertainty.
WhatsApp files reply in support of contempt order against NSO in US
-
OrderWhatsApp files contempt motion over alleged renewed targeting
WhatsApp asked the district court to hold NSO in contempt for allegedly continuing to target its users after the injunction.
WhatsApp takes NSO Group back to court for violating its spyware ban
-
OrderCivil-society groups file amici to preserve the injunction
Access Now, the Knight Institute and others urged the Ninth Circuit to keep the injunction in place.
-
AppealNSO appeals liability, damages and injunction to the Ninth Circuit
NSO docketed an appeal (No. 25-7380) and sought to stay the permanent injunction pending review.
-
JudgmentCourt enters permanent injunction and $4.45M final judgment
The court barred NSO from targeting WhatsApp, reverse-engineering the service, or possessing its code, and entered final judgment for $4,447,190.
-
JudgmentCourt remits punitive damages to $4,002,471
Judge Hamilton held the $167.25M punitive award excessive and remitted it to nine times compensatory damages. WhatsApp accepted the remittitur on October 31, 2025.
NSO Ordered to Stop Hacking WhatsApp, but Damages Cut to $4 Million
-
AwardJury awards $444,719 compensatory and $167.25M punitive damages
A California jury found NSO liable for damages over the hacking of roughly 1,400 WhatsApp users.
NSO Ordered to Stop Hacking WhatsApp, but Damages Cut to $4 Million
-
JudgmentCourt finds NSO liable on summary judgment
Judge Hamilton held NSO liable under the Computer Fraud and Abuse Act (CFAA) and California law for unauthorized access to WhatsApp’s systems.
NSO Ordered to Stop Hacking WhatsApp, but Damages Cut to $4 Million
-
FilingWhatsApp sues NSO Group over Pegasus exploit
WhatsApp alleged NSO used a zero-click WhatsApp vulnerability to deliver Pegasus spyware to about 1,400 users.
Experimental AI forecast
How it is madeHow will the Ninth Circuit resolve NSO’s appeal of the liability finding, $4.45 million judgment, and permanent injunction by March 31, 2028?
- Ninth Circuit affirms WhatsApp’s win55%
- Still pending on March 31, 202822%
- Liability upheld, injunction or damages cut12%
- NSO settles or drops its appeal6%
- Ninth Circuit reverses NSO liability5%
- Resolves by
- Mar 31, 2028in 17 months
- Record confidence
- Medium
The Ninth Circuit is most likely to affirm NSO’s liability, the $4.45 million judgment, and the permanent injunction by March 31, 2028 (55%). Affirmance rates in private civil appeals are high, and NSO’s threshold immunity defense has already failed at every level. Delay is the main alternative, since no argument date has been set.
How it resolves. Resolves on the Ninth Circuit’s disposition in No. 25-7380 as shown on the public docket by March 31, 2028. “Affirms” means liability, damages, and the injunction are upheld in full. “Liability upheld, relief cut” means liability stands but the court vacates, narrows, or remands the injunction or damages. “Reverses liability” means the court vacates or reverses the CFAA and California liability findings, including remand for a new liability trial. “Settles or drops” means NSO voluntarily dismisses the appeal or the parties file a settlement before decision. Otherwise, still pending.
Reasoning
Starting point. Federal courts of appeals reviewing final civil judgments in private commercial cases, especially Ninth Circuit appeals of summary-judgment liability and injunctions: Federal appellate courts reverse roughly 10% to 15% of private civil appeals in whole or part. The Ninth Circuit’s median time from notice of appeal to decision runs about 13 to 20 months, longer when argued.
Federal appellate courts affirm most private civil judgments, with full or partial reversal in roughly 10% to 15% of cases. NSO faces a judgment built on summary-judgment liability, a jury verdict, and a remittitur that WhatsApp accepted, which narrows the damages issues on appeal. The earlier immunity fight ended against NSO, leaving mainly CFAA scope, extraterritoriality, and injunction-breadth arguments. The injunction’s reach over a foreign company’s conduct is the most plausible ground for partial relief, so a narrowing outcome holds 12%. Briefing closed July 1, 2026, but no argument date is set, and Ninth Circuit calendaring plus decision time could push a ruling past March 31, 2028, so pending holds 22%. Settlement is unlikely because the money is small but the injunction threatens NSO’s business, and Meta has little reason to compromise a precedent it sought. The October 16, 2026, contempt denial concerns enforcement in the district court, not the appellate merits, so no number moved from the September 24, 2026, forecast. The leading alternative to affirmance is that the appeal remains undecided on the resolution date.
High affirmance rates for private civil judgments on appeal · No Ninth Circuit argument date set after July 2026 briefing · Injunction scope over a foreign firm invites partial narrowing · Remittitur accepted, limiting damages issues on appeal · Contempt denial affects enforcement, not appellate merits
Generated automatically by Claude Opus 5.5 on Oct 20, 2026 from this case’s record on this site, and published without editorial review. The probabilities are the model’s judgment, not measured frequencies, and they are scored publicly as cases resolve. Not legal or investment advice. How the forecasts are made
Disclosure: Anthropic, which makes the model that wrote this forecast, competes with or has commercial ties to a party to this case.