US judge lets a porn studio unmask torrent users through Gmail and Yahoo

A US federal judge has allowed adult studio FlavaWorks to subpoena Google, Yahoo, Microsoft and three other companies to identify users of the private torrent tracker Gay-Torrents.org. The studio will not track them down through IP addresses from torrent swarms. It will go through the email accounts they used to register on the site. Judge John Robert Blakey of the Northern District of Illinois granted the request on 14 October. TorrentFreak reported the order on 27 October.

FlavaWorks sued the tracker's operators and 325 of its users earlier this year. The site went offline soon after, and the studio later narrowed the case to 39 users. Most of them, and several administrators, are still listed as anonymous John Does.

What the subpoenas can demand

The order covers Google, Yahoo, Microsoft, AT&T, Cloudflare and Newfold Digital, the owner of Bluehost. Each subpoena is limited to the email addresses of defendants hosted by that provider. For the period from 1 January 2025, the companies can be asked for:

• Identity: the subscriber's name, mailing address and phone number.
• Linked addresses: any secondary, recovery or two-factor authentication email addresses on file.
• Last login: the most recent IP address used to access the account, with its date and time.

According to the studio's own list, 22 defendants use Gmail, nine use Yahoo, three use Hotmail and one uses AT&T. Two more use private domains registered through Cloudflare and Bluehost. The judge refused part of the request: FlavaWorks also wanted billing names and addresses from the email providers and a subpoena to payment processor Stripe, and got neither.

Why the studio skipped IP addresses

Rightsholders in torrent cases usually log IP addresses in a swarm and ask internet providers who paid for the connection. FlavaWorks says it has IP data on the defendants too, but chose email accounts instead, using an argument that defendants normally make. "An IP address identifies an Internet subscription, not a person," the studio wrote. It "resolves to whoever pays the bill for a household, an office, a university network, or a shared carrier-grade address pool, and it can be masked by a VPN." An email account, the studio argues, belongs to one person.

That is the weak spot for anyone who hides their IP but signs up with a personal address. A VPN does not change what Gmail or Yahoo already know about the account holder: the phone number, the recovery address and the IP of the last login if the user once signed in without the VPN.

One administrator is missing from the list. That person used a ProtonMail address, and a US civil subpoena does not reach the Swiss company directly. Proton works under Swiss law, and its VPN service has refused all 47 court orders to unmask users because it keeps no logs.

How the studio got the emails

On an invite-only tracker, members' email addresses are normally visible only to staff. The court filings do not say how FlavaWorks got them. In a September status report, the studio said it "has also obtained the cooperation of an individual with direct knowledge of the Site's operation". The member defendants were picked because the email on their tracker account matched an account on one of FlavaWorks' own sites.

The data will not be handed over at once. The order lets the users and the providers ask the court to quash the subpoenas, though the docket shows no such motion yet. Google raised First Amendment objections to a similar FlavaWorks subpoena earlier this year, but according to the studio it later produced subscriber data in that case. Some members have already settled, including one defendant in a separate FlavaWorks racketeering lawsuit against 75 users of the same tracker.