Copilot's DMCA win moves the notice-stripping question onto the developer who ships the code

The Ninth Circuit issued its opinion in Doe v GitHub, number 24-7700, on Wednesday, and a unanimous panel affirmed the dismissal of the plaintiffs' DMCA section 1202(b) claim.

"We decline plaintiffs' invitation to transform run-of-the-mill copyright-infringement claims into DMCA claims," Judge Eric Miller wrote for a unanimous Ninth Circuit panel.

Anonymous programmers who publish open-source code sued GitHub, Microsoft and OpenAI over Copilot and Codex, arguing the tools reproduce their code without attribution in breach of section 1202(b) of the Digital Millennium Copyright Act.

"If Copilot functioned like a search engine and produced outputs that were identical to plaintiffs' code but did not contain CMI, then plaintiffs might have a stronger claim," Miller wrote. "But that is not what plaintiffs have alleged."

By the programmers' own account Copilot predicts a likely completion from statistical patterns, and the court took that as describing generation rather than retrieval.

The panel decided only the output theory and held the input theory, that the defendants stripped notices from the code before feeding it into training, forfeited, so it never reached the training-data question.

Asked at the hearing on the first motion to dismiss whether copying training data into Copilot breached the licences' attribution requirement, counsel for the programmers answered "Perhaps it doesn't."

The district judge observed that the "complaint is not about training. It just isn't."

A later district court order stated that the "Plaintiffs do not allege they were injured by Defendants' use of licensed code as training data", and nobody corrected it, orally or in writing.

Section 1202(b) bars intentionally removing or altering copyright management information, meaning the author's name, the copyright notice and the licence terms, which in open-source code sits in a header at the top of the file.

The certified question was whether section 1202(b) carries an identicality requirement; the panel said "identicality" is "something of a misnomer", that the DMCA does not demand literal sameness, and that the label is a gloss on the statutory words rather than a separate element.

The defendants conceded that two works need not be identical, the court agreed, and minor cosmetic changes will not protect someone who substantially reproduces a work and strips the notice.

The opinion concedes its authorities come from print media, such as defacing the title page of a book, and that those "do not map neatly onto the emerging digital technologies like artificial intelligence to which the DMCA's protections also apply", Miller wrote.

The defendants argued the programmers could not show their own code was at risk; the panel disagreed, noting the complaint cites academic research finding that large language models will sometimes "emit the memorized training data verbatim", a phenomenon that "will likely get worse as models continue[] to scale".

GitHub's duplicate-detection feature lets users block suggestions matching public code at verbatim snippets of 150 characters or more, and the court treated the existence of that filter as some evidence that Copilot does emit identical copies.

The panel was explicit that the pleading stage was enough for now and that at summary judgment the programmers would have to produce actual evidence.

The opinion's safe reasoning covers the party that generates a new completion, while the party that substantially reproduces an existing file and omits its notice remains within the conduct the panel described as actionable.