US Digital Millennium Copyright Act: Safe Harbor, Takedowns, Penalties

The Digital Millennium Copyright Act is a 1998 federal law that updated U.S. copyright rules for the internet age by making it illegal to break digital locks on copyrighted works, creating the notice-and-takedown system that lets copyright owners get infringing content removed from online platforms, and shielding those platforms from liability for what their users post. It sits in Title 17 of the United States Code and carries civil damages that can reach tens of thousands of dollars per violation, plus criminal penalties of up to ten years in prison for willful commercial violations.

Breaking Digital Locks Is Its Own Offense

Section 1201 makes it illegal to bypass a technology that controls access to a copyrighted work. Encryption, password gates, authentication handshakes, and similar measures all qualify as digital locks. The act of getting past one is a standalone violation, separate from whether you copy or distribute anything afterward. Picking the lock is the crime; you do not have to take anything off the shelf.¹

The law separates two kinds of protection. Access controls keep you from reaching the work at all, and the DMCA bans both breaking them and selling tools designed to break them. Copy controls stop you from reproducing or distributing a work you already have. For copy controls, the statute bans trafficking in circumvention tools but does not separately punish the act of bypassing them. Stripping DRM from an e-book you bought is treated differently from cracking a streaming service you never paid for.¹

The trafficking ban is broad. A product fails the test if it is mainly built for circumvention, has no meaningful commercial use besides circumvention, or is marketed for that purpose. This rule applies to both access controls and copy controls.

When Bypassing a Lock Is Allowed

Congress wrote several permanent exceptions directly into Section 1201 so the ban would not swallow legitimate work. If you lawfully obtained a computer program, you can bypass its access controls to figure out what you need to make an independent program work with it, and you can share what you learn with collaborators for that same interoperability purpose. Encryption researchers can bypass access controls on a lawfully obtained published work when circumvention is necessary for the research, they made a good-faith effort to get permission first, and the research itself does not infringe. Security testers can bypass controls solely to find and fix vulnerabilities, but only with the system owner’s authorization. Nonprofit libraries, archives, and educational institutions can bypass a control solely to decide whether to acquire a commercially available work, and only when the same work is not reasonably available in another form.¹

None of these permanent exceptions lets you build and sell circumvention tools to the public. The trafficking prohibition still applies.

Beyond the permanent list, the Librarian of Congress runs a rulemaking every three years to grant temporary exemptions for lawful, non-infringing uses that the ban would otherwise block. Existing exemptions have to be re-justified each cycle or they expire.² The rulemaking finalized in October 2024 renewed and expanded exemptions running through 2027 for things like short film clips used in criticism, documentary work, and education; adding captions or audio descriptions for accessibility; repair of cars, farm equipment, marine vessels, and medical devices; jailbreaking smartphones and other personal devices to install third-party software; text and data mining by researchers at nonprofit institutions; and preservation work by qualifying libraries, archives, and museums.³

An exemption only legalizes the circumvention itself. It does not authorize distributing circumvention tools, and it does not override other law. If the underlying use would infringe copyright even without a lock in the way, the exemption does not save it.

Safe Harbor for Online Platforms

Section 512 is the reason platforms can host user uploads without being sued out of existence every time someone posts an infringing file. It shields qualifying service providers from monetary damages for infringement carried out by their users, in exchange for cooperating with copyright owners to remove infringing material.⁴

Before any safe harbor kicks in, the platform has to meet two baseline conditions. It must adopt and reasonably implement a policy for terminating users who repeatedly infringe, and it must tell users about that policy. It also must not interfere with standard technical measures copyright owners use to identify their works.⁵ The repeat-infringer piece is where platforms lose cases. Having a policy on paper is not enough; courts expect platforms to actually track notices back to accounts and terminate the ones that keep collecting strikes.

The safe harbor breaks down into four covered activities: pure data transmission by an internet service provider, temporary caching to speed delivery, hosting of user-uploaded content, and linking or search. Each has its own conditions, but the hosting and linking rules are the ones most disputes turn on: the provider must lack actual knowledge of infringement, must not be aware of obvious red flags, must not profit directly from specific infringing material it could control, and must act quickly on valid takedown notices.⁵ Running ads next to user content does not by itself cost a platform its safe harbor. The financial-benefit test targets direct profit from specific infringing material the provider had the right and ability to control.

How a Takedown Notice Works

The notice-and-takedown system is the mechanism copyright owners use to get infringing material off a platform. To trigger the platform’s obligation to act, the notice must go in writing to the platform’s designated agent and include every one of these elements:

A physical or electronic signature of someone authorized to act for the copyright owner.
Identification of the copyrighted work being infringed. A representative list is fine if many works on one site are at issue.
Identification of the infringing material, with enough detail for the platform to find it.
Contact information for the sender, such as address, phone, and email.
A statement of good-faith belief that the use is not authorized.
A statement, under penalty of perjury, that the information is accurate and that the sender is authorized to act for the copyright owner.

⁵

Every platform seeking safe harbor must register a designated agent with the U.S. Copyright Office and publish that agent’s contact information on its own website. The Copyright Office keeps a searchable directory. Send your notice to the wrong address and the platform has no legal duty to act on it.⁶ A notice missing required elements is defective, and while many large platforms process imperfect notices anyway, that is a courtesy rather than a legal obligation.

Fighting a Takedown: Counter-Notification

Once a platform removes material, it must promptly tell the user who posted it. A user who believes the takedown was a mistake can file a counter-notification with the platform’s designated agent. A valid counter-notification includes the user’s signature, identification of the removed material and its former location, a statement under penalty of perjury of a good-faith belief that removal was a mistake or misidentification, the user’s contact information, and a statement consenting to the jurisdiction of a specified federal district court and agreeing to accept service of process from the claimant.⁵

That last element matters. Filing a counter-notification tells a federal court it can hear a copyright case against you in that district. If the copyright holder sues, you have already agreed to appear.

After a valid counter-notification arrives, the platform forwards it to the original claimant and warns that the material will go back up in 10 business days. The material must then be restored no earlier than 10 and no later than 14 business days after the counter-notification, unless the claimant files suit and notifies the platform of a court order. The platform itself is protected from user lawsuits over a good-faith removal, as long as it follows the counter-notification procedure.⁵

Liability for a False Takedown

Section 512(f) creates a check on abuse of the system. Anyone who knowingly makes a material misrepresentation in a takedown notice or a counter-notification is liable for damages, and the rule runs both ways: a copyright owner who falsely claims material is infringing and a user who falsely claims a removal was a mistake both face exposure.⁷

The injured party can recover damages caused by the misrepresentation, plus costs and attorneys’ fees. If a bogus takedown costs a creator revenue or legal fees, the sender can be on the hook for those losses. The keyword is “knowingly,” and courts have read it as a subjective standard: the sender had to actually know the claim was false or be willfully blind to the truth. Honest mistakes, even careless ones, generally do not trigger 512(f) liability. Federal appellate courts have also held that copyright owners must consider whether the targeted material qualifies as fair use before sending a takedown notice, and skipping that step can be enough to establish bad faith.

Subpoenas to Unmask Anonymous Users

Section 512(h) lets a copyright owner ask the clerk of any federal district court to issue a subpoena compelling a service provider to hand over information identifying an alleged infringer. The request has to include a copy of a valid takedown notification, a proposed subpoena, and a sworn declaration that the information will be used only to protect copyright.⁵

If the paperwork is in order, the clerk issues the subpoena without judicial review. The provider then turns over what identifying information it has. The process is faster than a standard civil subpoena by design and has drawn criticism for making it easy to pressure anonymous speakers. Courts have limited its scope in some contexts, especially for providers that only transmit data rather than host it.

Copyright Management Information

Section 1202 protects the identifying information tied to a creative work. The statute defines copyright management information broadly: title, author’s name, copyright owner’s name, names of performers and directors in audiovisual works, terms and conditions of use, and identifying numbers, symbols, or links that point to that information.⁸ In practice this covers photographer metadata embedded in image files, watermarks on stock photos, and credit information in video files. Social handles and website URLs count too when they serve to identify the copyright owner.

The law creates two prohibitions. No one may knowingly distribute false copyright management information with intent to enable infringement. No one may intentionally strip out or alter this information without permission, or distribute a work knowing that its management information has been removed or altered. Both require the person to know what they are doing and to know or have reasonable grounds to know their actions will enable infringement.⁹ The definition explicitly excludes personal information about a user of the work; the statute protects information about who made and owns it, not about who consumed it.

Civil and Criminal Penalties

For anti-circumvention violations under Section 1201, a court may award statutory damages of $200 to $2,500 per act of circumvention or per device or service involved. For copyright management information violations under Section 1202, statutory damages run from $2,500 to $25,000 per violation. In either case the plaintiff can elect statutory damages instead of proving actual losses, and the court can add costs and attorneys’ fees.¹⁰ Courts can also grant injunctions and order impounding or destruction of infringing devices. Innocent violators who had no reason to know their conduct was unlawful may see damages reduced or eliminated at the court’s discretion.

Criminal prosecution requires proof that the violation was willful and committed for commercial advantage or private financial gain. A first offense carries a maximum fine of $500,000 and up to five years in prison. A second or subsequent offense doubles both: up to $1,000,000 and up to ten years.¹¹ Nonprofit libraries, archives, and educational institutions are exempt from criminal liability for anti-circumvention violations. The criminal provisions cover both Section 1201 and Section 1202, so distributing false copyright management information for profit can also be prosecuted.

1
Office of the Law Revision Counsel. 17 U.S. Code 1201 – Circumvention of Copyright Protection Systems
2
U.S. Copyright Office. Eighth Triennial Section 1201 Proceeding
3
Federal Register. Exemption to Prohibition on Circumvention of Copyright Protection Systems for Access Control Technologies
4
U.S. Copyright Office. Section 512 of Title 17 – Resources on Online Service Provider Safe Harbors and Notice-and-Takedown System
5
Office of the Law Revision Counsel. 17 U.S.C. 512 – Limitations on Liability Relating to Material Online
6
U.S. Copyright Office. DMCA Designated Agent Directory
7
Office of the Law Revision Counsel. 17 U.S. Code 512 – Limitations on Liability Relating to Material Online
8
Office of the Law Revision Counsel. 17 U.S.C. 1202 – Integrity of Copyright Management Information
9
Office of the Law Revision Counsel. 17 U.S. Code 1202 – Integrity of Copyright Management Information
10
Office of the Law Revision Counsel. 17 U.S. Code 1203 – Civil Remedies
11
Office of the Law Revision Counsel. 17 U.S.C. 1204 – Criminal Offenses and Penalties