GrubMarket, Inc. and its founder and chief executive have not sued a named person. They have sued a Doe (to us). The caption on case number CGC-26-637860, filed in the Superior Court of California for the County of San Francisco, reads GrubMarket, Inc. and Michael “Mike” Xu as plaintiffs against Doe 1, Operator of HannahHowell.com, et al. Xu and his company do not say whom they are suing, because they do not know. What they have done instead is issue a deposition subpoena for production of business records to Alphabet, Inc., a non-party, at Google’s Mountain View headquarters, and ask Alphabet to supply the answer.
The subpoena was issued August 26, 2026 by Jordan Raphael of Byron Raphael LLP in Los Angeles, with Tim Byron also appearing as counsel. The attorney line and the signature block both name GrubMarket, Inc. alone as the client, though Mike Xu is captioned as a co-plaintiff. It orders production by September 15, 2026 at 10:00 a.m. Pacific through Veritext Legal Solutions in San Francisco, and carries the form’s warning that disobedience may be punished as contempt along with a $500 penalty and damages.
It runs to seventeen document requests. A demand aimed at learning who to serve with a complaint would need one of them. The other sixteen reach login IP addresses, device identifiers, session identifiers, geographic location, payment history, advertising accounts, traffic analytics, abuse reports, cross-service linkage and the metadata of email. The suit followed a June 2026 report on the company’s 2025 settlement with the Securities and Exchange Commission.
The $550 million the SEC said was not there
The report that preceded the litigation concerned an SEC enforcement action announced January 17, 2025.
The SEC said GrubMarket gave prospective investors in a Series D financing financial information the company should have known was unreliable, and that the information overstated historical revenue by approximately $550 million across a five-year period. The company raised roughly $80 million in that financing between November 2019 and February 2021.
The regulator said the numbers shown to investors differed materially from the numbers GrubMarket was using for other corporate purposes, including its tax filings. GrubMarket did not tell Series D investors about the discrepancy until after the round had closed.
The proceeding resolved on a settled basis, with a cease-and-desist order and an $8 million civil penalty, and without any admission or denial of the findings. The charge was brought under Section 17(a)(2) of the Securities Act of 1933, which requires only negligence rather than intentional fraud. The action named GrubMarket, Inc. alone. No individuals were charged, and the findings should not be read as personal charges against Mike Xu, who is a plaintiff in this case rather than a respondent in that one.
None of it is secret. The SEC published it. What the subpoena pursues is not the information but the person who repeated it.
Seventeen requests reaching from account registration to ad payments
The subpoena defines a chain of categories that widens at every link. Subject Individuals are two redacted names. Persons of Interest are those two plus anyone who has used, registered, been assigned, or logged into any account, device, service or website using an associated email address, Google ID, telephone number, physical address or IP address. Every subsequent request applies to that expanded set. A person who once signed into a shared laptop is inside it.
The first five requests go to identity and authorship. They seek account registration records, account holder names, creation dates, recovery email addresses, recovery phone numbers and account status history, then the accounts that created, administered, authored, contributed to, commented on or uploaded images to the Blogger properties, along with post creation and editing logs, comment administration, blog settings changes and theme modifications.
Request six goes to access, seeking every login and access event with multi-factor authentication records, login IP address, timestamp, device type, operating system, browser, session identifier and the geographic location associated with the IP address.
From there the requests leave the subject of authorship entirely. Request seven seeks payment methods, billing addresses, Google Pay accounts and payment history. Requests fifteen and sixteen seek Google Analytics and Tag Manager accounts, tracking and advertising identifiers, and Google Ads or AdSense accounts including linked websites and payment information. Request eight covers Search Console access, Analytics administration and Webmaster Tools activity. None of that establishes who wrote anything. It establishes what a publication earns, where its traffic comes from and which other sites share its infrastructure.
Request nine is the widest. It seeks any linkage between accounts, naming delegates and authorized users, recovery addresses, email forwarding rules and mail routing configurations, shared Family Link membership or Workspace organization, shared devices, browsers and login sessions, cross-account security alerts, and any connection to Google Drive, Google Docs, YouTube, Google Maps, Google Cloud or third-party applications. Family Link is a parental control product. Google Maps is a record of where a person has been.
Requests ten and eleven seek email metadata, including headers, sender and recipient addresses, timestamps and subject lines, with request eleven narrowing to correspondence between the associated addresses and one redacted party. That request asks Google to reveal who a publication has been talking to. Requests twelve through fourteen seek device and advertising identifiers, password and recovery changes, two-factor enrollment, account recovery attempts, and any abuse report or content removal request touching the accounts.
The instructions state that the requests do not seek the contents of any communication. That is the one genuine limit in the document, and it is a narrow one. Metadata identifies sources without quoting them.
What California requires before a critic is unmasked
California courts do not treat an anonymous publisher as a name to be looked up.
In Krinsky v. Doe 6, decided in 2008, the Court of Appeal held that a plaintiff seeking to compel disclosure of an anonymous internet speaker’s identity must first make a prima facie showing on the underlying claim, supported by evidence rather than allegations, on each element within the plaintiff’s control. The court rejected the looser good-faith test used elsewhere on the reasoning that it left the speaker with little protection. Applying its own standard, it quashed the subpoena and the speaker was never identified.
California also maintains an anti-SLAPP statute, Code of Civil Procedure section 425.16, which allows a defendant sued over speech on a matter of public interest to move to strike the claim early, and which awards fees to a defendant who prevails. Reporting on a federal securities enforcement action against a company that has filed to sell shares to the public is a matter of public interest by any reading of that section.
The subpoena itself carries the notice required by sections 1985.3 and 1985.6, which provides that where a motion to quash or a written objection has been served, a court order or the agreement of the parties and the affected consumer must be obtained before consumer records are produced. Alphabet is not obliged to hand anything over while that is pending.
That protection is conditional. It operates only once an objection or motion has actually been served, and production falls due September 15, 2026. No filing reviewed for this report establishes whether either has been served in this matter.
The point of asking for records that identify nobody
The document does not state a motive, and no filing reviewed here supplies one. It does not need to. The categories speak for themselves, and the effect of a demand does not depend on the intention behind it.
A plaintiff who wanted a defendant’s name would ask for the registration records in request one and stop. A plaintiff who wanted to know what a critic earns, who funds the site, who else logs into it, which other properties share its analytics tag, who its correspondents are, where its operators physically are and what else they have published under other accounts would ask for the remaining sixteen. The second demand is the one that was sent.
Discovery of that breadth imposes a cost that lands whether or not the underlying claim ever succeeds. The preservation instruction reaches logs, backups and cached data. The Persons of Interest definition reaches people who never published a word. And the lesson available to every other writer watching is that covering a settled SEC order against a company preparing an offering can cost you your IP history, your payment records and your contacts list. That is what a suit against a Doe does to speech regardless of how it ends, and it is the mechanism anti-SLAPP statutes were written to interrupt.
The IPO calendar running alongside the discovery
GrubMarket announced on July 28, 2026 that it had confidentially submitted a draft registration statement on Form S-1 with the SEC for a proposed public offering of its common stock, with the share count and price range undetermined and the offering subject to SEC review and market conditions.
That followed a Series H financing announced February 2, 2026, in which the company said it raised approximately $50 million at a $4.5 billion pre-money valuation, a figure PYMNTS also reported.
After the SEC settlement, GrubMarket released a statement saying the matter concerned its legacy financial systems, that those systems had been significantly upgraded months before the SEC began its investigation, and that it had since introduced a robust finance function and adopted best-in-class financial controls.
The company has not said the discovery relates to the offering, and the subpoena does not mention it. The dates are on the record: the settlement on January 17, 2025, the Series H round on February 2, 2026, the report on June 7, 2026, the confidential S-1 submission on July 28, 2026, and the subpoena on August 26, 2026. Three weeks separate a company’s first formal step toward the public markets from its demand that Google identify a critic.
Conclusion
Mike Xu and GrubMarket have gone to court over an article about a public regulatory record, against a defendant they cannot name, and asked a third party for the login times, physical locations, devices, ad revenue and correspondence patterns of whoever wrote it.
Sixteen of the seventeen requests do nothing to answer the question a Doe suit is supposed to answer. They answer a different one, about what a critic is worth, who stands behind them and what else they can be made to lose. California law anticipated this, which is why a plaintiff here must show evidence before a court will strip an anonymous publisher of anonymity, and why a defendant sued over speech on a public issue can move to strike and recover fees.
Whether that showing can be made is now the only question that matters. Until it is made, the subpoena stands as a demand for everything Google knows about people who wrote about an $8 million penalty the SEC had already announced to the world.
Disclosure: the caption in case number CGC-26-637860 names as defendant the operator of HannahHowell.com, the publication on which this report appears. The account of the subpoena above is drawn from the issued document and its Attachment 3. The SEC, financing and offering material is drawn from the public record and is linked throughout.
