Assessing and Reducing Secondary Copyright Liability: A Practical Guide

The letter arrives on a Tuesday, addressed to the general counsel of a forty-person company that lets people upload and sell digital templates. A law firm says its client's works appear at the 4,812 URLs in the attached spreadsheet, that the company has "knowledge" and is "materially contributing," and that statutory damages run to $150,000 per work. By lunchtime, the CTO has forwarded a news story with the subject line "Cox means we're fine, right?" The head of growth has asked whether the trust and safety team can stop processing takedowns now, since they slow down seller onboarding. And someone in marketing has just scheduled a post celebrating the most popular templates of the year, several of which look a lot like the items in the spreadsheet.

Each of those three reactions is a problem. The CTO is about half right. The growth lead's plan could cost the company its best protection against the claims that survive. The marketing post is the sort of thing that, in the wrong context, plaintiffs now build cases around.

This guide is for that general counsel, and for her counterpart on the other side: the licensing executive, photographer, or publisher deciding what can still be done about a service that profits while infringement happens. For the doctrine and how it got here, read Contributory and Vicarious Copyright Liability After Cox v. Sony: Who Pays When Someone Else Infringes. This document is about what to do.

The short answer

If you operate a service:

• Knowledge of infringement and continued service no longer establish contributory liability under Cox Communications, Inc. v. Sony Music Entertainment, 607 U.S. 583 (2026). Plaintiffs must show that you induced infringement through specific acts or that your service is tailored to it.
• Your remaining exposure is in four places: what your own systems copy or display, what your people say and build, whether you profit directly from infringement you have the right and ability to stop, and court orders that reach you after someone else loses.
• Keep the DMCA program unless you are a pure conduit and have made a deliberate decision with counsel. For hosts and marketplaces, it is still the main defense against direct and vicarious money claims, and its operation is now evidence that you discouraged infringement.
• Review marketing, sales scripts, support macros, and product features before someone else does in discovery. Do this through counsel, and never delete anything once a dispute is foreseeable.

If you own rights:

• Stop relying on notice volume as your liability theory. Notices still remove content and still matter under section 512, but they will not carry a contributory claim.
• Choose defendants by what they did. Direct infringers and operators of pirate services first. Intermediaries only with evidence of encouragement, a function with no real lawful use, or commission-style profit plus control.
• Plead facts, not formula. Courts are dismissing conclusory draw and control allegations, and they will do the same with "induced."
• Use injunctions against the direct infringer, served on infrastructure providers, as a remedy that does not depend on proving secondary liability against them.

Part One: For service operators

Step 1: Map what your service actually does

Liability attaches to functions, not to company labels. A single company can be a conduit for one product, a host for another, and a seller for a third. Section 512(n) makes the same point for the safe harbors: each one describes a separate function and is assessed separately.

Start with a one-page map listing each product and answering four system-level questions. Does the material reside on infrastructure you control, and for how long? Who initiates each copy, a user or your system? Who selects what appears? How does money flow when an infringing item is used or sold?

Do not skip this step because the answer feels obvious. In McGucken v. Shutterstock, Inc., No. 23-7652 (2d Cir. Feb. 10, 2026), Shutterstock cleared the threshold requirements but lost summary judgment because fact questions remained on whether its review and licensing process meant the infringement occurred "by reason of the storage at the direction of a user," and on the right and ability to control. Business reality decides these questions, whatever the terms of service say.

Step 2: Assess direct infringement first

Everyone wants to talk about Cox. Start somewhere else, because Cox does nothing for you if your own system is the copier.

Direct infringement requires causation, which courts call volitional conduct. Operating a system that automatically responds to user commands generally does not make the operator the copier, as in Cartoon Network LP v. CSC Holdings, Inc., 536 F.3d 121 (2d Cir. 2008), and Fox Broadcasting Co. v. Dish Network L.L.C., 747 F.3d 1060 (9th Cir. 2013). Exercising control over content can change that. VHT, Inc. v. Zillow Group, Inc., 918 F.3d 723 (9th Cir. 2019), separated user-uploaded listing photos, where Zillow was not the direct actor, from a curated product where it made selections. Work through these questions:

• Do employees or contractors select, edit, tag, or feature specific works? Mavrix Photographs, LLC v. LiveJournal, Inc., 873 F.3d 1045 (9th Cir. 2017), turned on whether volunteer moderators acted as the platform's agents, which is a useful warning for anyone relying on community moderators.
• Does your system make a persistent copy of user content for your own purposes, such as thumbnails, transcodes, training sets, or recommendation features?
• Do you sell, license, print, or ship the item as principal?
• Do you ingest works yourself, for example by scraping or by acquiring a dataset? In that case there is no third party standing between you and the copy. If you acquired it through scraping, access claims may arise as well; see Bringing or Defending a Civil Computer Fraud and Abuse Act Claim: A Practical Guide.
• Do you embed or frame from someone else's server? The Fifth Circuit held in Emmerich Newspapers, Inc. v. Particle Media, Inc., No. 25-60550 (5th Cir. Aug. 27, 2026), that this framing did not transmit a display. District courts elsewhere have disagreed about the Ninth Circuit's server test, so the answer depends on the forum.

Write down the answer for each product. A claim you cannot get out of under this step does not get easier because of Cox.

Step 3: Run the inducement review

Inducement is the part of the contributory analysis you control, since it depends on what you do. "A provider induces infringement if it actively encourages infringement through specific acts." One federal court has already held that advertising is "an example of an inducing act, not a pre-requisite" (Nazemian v. NVIDIA Corp., No. 24-cv-01454-JST, ECF No. 303 (N.D. Cal. May 5, 2026)). Another found a claim adequately pleaded against an IPTV operator who offered cheap access, concealed payments, and moved domains after notice (Amazon Content Services LLC v. Weibley (M.D. Pa. June 10, 2026)). The review should cover these areas:

External messages. Website copy, ads, keyword buys, comparison pages, app store descriptions, demo content, tutorials, webinars, affiliate and influencer briefs, and social posts. Ask whether any of them show or suggest protected works as the use case, or praise the absence of enforcement. Look especially at search terms purchased and at the examples in product screenshots.

Sales and partnerships. Sales decks, reseller materials, and what account reps actually say. Inducing messages are often unofficial and are often the most damaging for it. The fact that a statement came from a junior person affects its weight, not its discoverability.

Support. Metro-Goldwyn-Mayer Studios Inc. v. Grokster, Ltd., 545 U.S. 913 (2005), counted responses to users asking how to find and play copyrighted material. Search your ticketing system for titles, artist names, and words like "torrent," "free," "rip," "bypass," and "takedown."

Product decisions. Roadmaps and tickets where someone explains why a feature exists. A feature that helps uploaders recover from takedowns, hides listings from rightsholder search, rotates links, or strips copyright information needs a documented lawful purpose or should go away. Stripping copyright management information can also raise a separate claim under 17 U.S.C. § 1202.

Paid tiers. If higher payment affects how your infringement policy is applied, stop and call a lawyer. Concord Music Group, Inc. v. X Corp. (M.D. Tenn. Mar. 5, 2024), a pre-Cox decision, let a claim proceed on an allegation that users could pay for more forgiving treatment.

Revenue model. Do your metrics reward volume that you know to be largely infringing? Grokster said this does not justify an inference of intent standing alone but matters in context. A dashboard is harmless. A board deck that says growth depends on the infringing category is not.

Filtering. Cox quoted Grokster's footnote 12: a court cannot find liability "merely based on a failure to take affirmative steps to prevent infringement." That means you need not build a filter to avoid contributory liability. It does not make the record of why you decided against one irrelevant. An email that says "don't add matching, it would hurt our Top 40 traffic" is an entirely different document from one that says "matching would produce too many false positives on fair use."

What to do with what you find. Remove or fix bad external messages going forward. Do not rewrite history: preserve old versions if a dispute is reasonably foreseeable, and think about Fed. R. Civ. P. 37(e) before cleaning up any system. Train the people who write the messages. Conduct the review at counsel's direction so that privilege is available, recognizing that underlying facts and ordinary business documents are not privileged, and consider Fed. R. Evid. 502 if anything will be shared. The working audit forms are in Secondary Liability Toolkit: Repeat Infringer Policies, Notice Workflows, and Inducement Audits.

Step 4: Test whether anything is tailored to infringement

The legal test is whether the service is "not capable of 'substantial' or 'commercially significant' noninfringing uses." For most businesses the answer at the service level is plainly no, and this takes five minutes.

Spend the time at the feature level instead. United King Film Distribution (1990) Ltd. v. MoonPay USA LLC (S.D. Fla. July 13, 2026), looked at the service as a whole and said the inquiry is about capability, not actual use. Nazemian looked at specific scripts inside a broad framework and let the claim proceed. Until appellate courts sort this out, you should assume a plaintiff will try to isolate the narrowest thing you built.

For each feature that could be singled out, ask three questions. Can it be separately identified and used? What lawful uses does it have, with examples that exist today? Is there a record, such as customer documentation or usage data, showing those uses? Keep that last point in perspective, because MoonPay rejected the argument that the defendant had to prove actual noninfringing use. But in a court that slices narrowly, usage data will be persuasive, and it is cheap to collect.

Step 5: Work through vicarious exposure honestly

This is where a Cox victory lap is most likely to embarrass you. Vicarious liability needs no knowledge. It requires a right and ability to supervise and a direct financial interest.

Control worksheet. Do your terms reserve the right to remove content or terminate accounts? Do you in fact review items before they go live? Can you locate and remove the infringing item, or only cut off an account? Perfect 10, Inc. v. Amazon.com, Inc., 508 F.3d 1146 (9th Cir. 2007), asks for both a legal right and a practical ability. Perfect 10, Inc. v. Visa International Service Ass'n, 494 F.3d 788 (9th Cir. 2007), holds that being able to make infringement harder is not the same thing. Luvdarts, LLC v. AT&T Mobility, LLC, 710 F.3d 1068 (9th Cir. 2013), evaluates a system as it currently exists. Concord found insufficient control over social platform users. By contrast, the operator of the premises in Fonovisa, Inc. v. Cherry Auction, Inc., 76 F.3d 259 (9th Cir. 1996), had control because it could expel vendors and patrolled the grounds. Your facts will sit somewhere between these.

Benefit worksheet. Would your revenue change if all infringement stopped? Flat fees for access point toward no direct benefit, as the Fourth Circuit held in Sony Music Entertainment v. Cox Communications, Inc., 93 F.4th 222 (4th Cir. 2024), where Cox "would receive the same monthly fees even if all of its subscribers stopped infringing." Percentage commissions on the sale of the item point the other way, as in Shapiro, Bernstein & Co. v. H. L. Green Co., 316 F.2d 304 (2d Cir. 1963). Advertising revenue falls in between and depends on evidence. Does your marketing feature the disputed content? Does your data show users come for it? EMI Christian Music Group, Inc. v. MP3tunes, LLC, 844 F.3d 79 (2d Cir. 2016), upheld a finding of vicarious liability against a founder with evidence that free music was used as a marketing hook, and instructed that a draw need not be primary or even significant. Perfect 10, Inc. v. Giganews, Inc., 847 F.3d 657 (9th Cir. 2017), helps defendants by requiring that the draw connect to the plaintiff's works.

Founders and officers. MP3tunes imposed vicarious liability on a chief executive personally, and publishers have named a chief executive on a contributory theory in an AI case, as the transfer order in Elsevier Inc. v. Meta Platforms, Inc. (S.D.N.Y. Sept. 25, 2026), recounts (that order decided venue, not the merits). Individual exposure is real when someone personally directs the activity and has a financial stake.

Options if the score is bad. You can change a commission structure for high-risk categories, add review only where it reduces real risk (review can itself support a control argument, so this is a judgment call), require licensing warranties from sellers, or shift risk by contract and insurance. Keep in mind that no contract stops a third party from suing you.

Step 6: Decide your section 512 posture, deliberately

The Supreme Court's discussion of the DMCA runs one paragraph and is often misunderstood. It held that the safe harbors do not imply liability. It did not repeal them. Your decision depends on your function.

Hosts, platforms, marketplaces. Keep the program, and keep it working. You need all of the following under 17 U.S.C. § 512(c) and (i):

1. A designated agent, listed on your site and registered in the Copyright Office directory (§ 512(c)(2); 37 C.F.R. § 201.38, in 37 C.F.R. Part 201). Designations expire three years after registration unless renewed. The Copyright Office's published fee has been $6 per designation, but it is reviewing its fees, so check the current schedule. A lapsed registration is an unforced error and one of the first things plaintiffs check.
2. A working process for responding expeditiously. McGucken held removal within four days of a compliant notice was enough.
3. A repeat infringer policy that is adopted, communicated to users, and reasonably implemented. Under Perfect 10, Inc. v. CCBill LLC, 488 F.3d 1102 (9th Cir. 2007), that takes a working notification system and a procedure for dealing with compliant notices, without actively preventing owners from collecting what they need. Termination must occur in appropriate circumstances for those who repeatedly or blatantly infringe.
4. No interference with standard technical measures.
5. No actual or red-flag knowledge of specific infringing material left in place, and no direct financial benefit in a case where you have the right and ability to control the infringing activity.

Do not treat the policy as boilerplate. BMG Rights Management (US) LLC v. Cox Communications, Inc., 881 F.3d 293 (4th Cir. 2018), stripped Cox of the harbor because it did not enforce its policy in any meaningful way, and its holding that repeat infringers need not be adjudicated still stands. On the other side, Ventura Content, Ltd. v. Motherless, Inc., 885 F.3d 597 (9th Cir. 2018), accepted a site operator's judgment-based approach without written details, and McGucken excused one miss among millions of contributors.

Operators with sophisticated tools should read Athos Overseas Ltd. v. YouTube, Inc., No. 23-13156 (11th Cir. Jan. 7, 2026), which held that having hash-matching technology does not by itself produce knowledge of specific infringing material, or impose a duty to run it against everything, given § 512(m). You are not punished for building a tool.

Pure conduits. You have a real decision. After Cox, a contributory claim based on notices should fail, and a vicarious claim faces serious obstacles. Justice Sotomayor said a conduit may now abandon its program, and Cox's counsel agreed the safe harbor would do little going forward. Before you dismantle anything, consider four things. Your warnings and terminations were part of why the Court found no inducement. The harbor limits injunctions under § 512(j)(1)(B), and it is the only protection that does not depend on winning a merits argument. Contracts with upstream providers or content partners may require a program. And foreign law, such as the EU's Digital Services Act discussed in The Digital Services Act and Digital Markets Act: What US Companies Actually Have to Do, is not governed by Cox. A reasonable middle ground is a lighter program that forwards notices and acts on the most egregious repeat cases, adopted after advice and documented with its reasons.

Tool and model distributors. Section 512 may not fit at all, because the alleged infringement may not occur "by reason of" storage or transmission on your system. Do not assume a host's safe harbor covers a product that generates output.

Keep the safe harbor and merits analyses separate. Columbia Pictures Industries, Inc. v. Fung, 710 F.3d 1020 (9th Cir. 2013), said the two inquiries should be conducted independently, and that inducing behavior can defeat particular conditions. Also remember that § 512(l) cuts in your favor: losing the harbor does not count against you on the merits.

The provider must raise the safe harbor and show that it took the steps necessary for eligibility, though in the Second Circuit the owner carries the burden on disqualifying knowledge (Capitol Records, LLC v. Vimeo, LLC, 826 F.3d 78 (2d Cir. 2016)). Build the record now: notice logs, response times, termination data, and the policy version history.

Step 7: Handle a demand letter

Here is a sensible first week after a letter like the one that opened this guide.

Day 1: preserve and route. Issue a litigation hold if a claim is reasonably foreseeable, which a specific demand generally makes it. Route the letter to counsel and tell people to stop speculating in chat. Pause any planned marketing featuring the content at issue.

Days 1 to 3: sort the content. Is the letter a § 512(c)(3) compliant notification? It needs a signature, identification of the work, identification and location of the material, contact information, a good faith statement, and a statement of accuracy under penalty of perjury as to authority. A spreadsheet of URLs signed by an authorized agent can qualify. If it substantially complies with the work, location, and contact elements only, § 512(c)(3)(B)(ii) requires you to reach out promptly in order to keep the benefit of the defect. Process the takedown first and argue later. Removing the material costs little, and it ends the conduct the letter complains about. Follow the § 512(g) counter-notice process for affected users, which requires restoration in not less than 10 and not more than 14 business days after a counter notice unless the notifier files suit. For mechanics, see How to File a DMCA Takedown Notice (And Respond to One) and Responding to a DMCA Takedown with a Counter-Notice: A Practical Checklist.

Days 3 to 7: test the claim. Ask for registration certificates (17 U.S.C. § 411(a) requires registration before suing on United States works; see Fourth Estate Public Benefit Corp. v. Wall-Street.com, LLC, 586 U.S. 296 (2019)). Check registration dates against 17 U.S.C. § 412, since that determines whether statutory damages and fees are in play. Identify which theory the letter actually asserts. Check what your own systems did with each item. Then check repeat offenders on the list: if the same accounts appear, process them under your policy now.

Respond in writing, narrowly. A short response can look like this:

We received your letter dated [date]. We have processed the identified items under our copyright policy and removed or disabled access to [number] items as of [date]. [Number] items could not be located; please provide the working URL. To the extent your letter asserts that continued operation of our service with knowledge of alleged infringement gives rise to contributory liability, we disagree. See Cox Communications, Inc. v. Sony Music Entertainment, 607 U.S. 583 (2026). Please provide registration information for the works identified. This response is not a complete statement of our position, and we reserve all rights and defenses.

Do not volunteer why infringement happens on your site, how much of it you think there is, or what the plaintiff "should" do. A worse response explains that the content is hugely popular with users and the company is doing all it can without hurting traffic.

Step 8: Handle an injunction or subpoena aimed at someone else

Intermediaries increasingly receive orders from cases they were never part of. Fed. R. Civ. P. 65(d)(2) binds only parties, their officers and agents, and others "in active concert or participation" who get actual notice. Courts in pirate-streaming cases have issued orders naming registrars and hosting providers, as in Weibley. MoonPay recounts a court in New York refusing to hold MoonPay in contempt where the pirate had no account with it and MoonPay did not know which wallets were the pirate's.

If you receive one, do not ignore it and do not treat it as an automatic command either. Identify who the enjoined party is, whether your customer is that party, and what the order asks. Disable service to an identified customer where the order clearly reaches you and the customer is plainly the enjoined party. Where the order is vague, or would require you to monitor, get counsel involved quickly and consider asking the issuing court for clarification. Your § 512(j) position is relevant if you qualify. A separate process exists for subscriber information: subpoenas under Fed. R. Civ. P. 45, and for cable operators, the court order and notice provisions of 47 U.S.C. § 551(c)(2)(B).

Step 9: Defend early and pick your motions

If suit is filed, the defense has more options than it did a year ago. The initial response is generally due 21 days after service under Fed. R. Civ. P. 12(a), or later if service is waived.

Move to dismiss the contributory count. Under Rule 12(b)(6), attack any claim that rests on notice and continued service as squarely foreclosed. Attack inducement allegations for lack of specific acts, lack of connection to infringement of the plaintiff's works, and lack of causation. Point out that Cox itself treated anti-infringement measures as inconsistent with inducement. Expect resistance. Nazemian shows that a plausible story about a specific tool survives, and press reports say the studios' secondary claims in the MiniMax case did as well.

Move on vicarious. Conclusory allegations of draw and control are vulnerable. Nazemian dismissed them, with leave to amend.

Do not count on Rule 12 for the safe harbor. It is an affirmative defense and usually needs a record. Plan for early summary judgment under Fed. R. Civ. P. 56 and try to phase discovery accordingly.

Fight discovery scope. Now that intent is the key, plaintiffs will seek broad access to marketing, product, and executive communications. Negotiate custodians and terms under Fed. R. Civ. P. 26(b)(1). Prepare a corporate witness on infringement practices with particular care; a Rule 30(b)(6) deposition of your trust and safety lead can decide the case. MC Law's Handling Objections, Coaching, and Misconduct at a Deposition: A Practical Guide covers conduct at those depositions.

Look at state-law add-ons. Plaintiffs may add deceptive practices or negligence counts. MoonPay held those claims were not preempted by 17 U.S.C. § 301 there, because they rested on alleged misrepresentations and duty, but they failed on the merits. Avoid overpromising about enforcement in public statements, since that is what supplies those claims. If a state court case is filed, see Getting Into or Staying Out of Federal Court: A Practical Guide to Jurisdiction and Removal for removal issues; copyright claims are exclusively federal under 28 U.S.C. § 1338(a).

Evaluate fee-shifting. 17 U.S.C. § 505 allows a prevailing party to recover fees, and a defendant facing a claim that Cox forecloses may want to say so in writing early. After the vacatur, Grande reportedly asked the Fifth Circuit to enter judgment in its favor, and the parties' remand letters also address costs.

Worked example one: Tidewrack, a mid-market host

Suppose Tidewrack leases servers to about 9,000 customers. Rightsholders have sent seventy notices about one customer, Reel Harbor, which appears to be a pirate streaming site. Tidewrack has forwarded each notice and has taken down individual files when asked, but Reel Harbor is still a customer, paying a flat monthly fee.

Direct: The customer selected and uploaded the content, so a direct claim is weak. Inducement: Nothing suggests encouragement, until a reviewer finds that Tidewrack's sales rep negotiated a discount for Reel Harbor with the note "great, happy to host you guys, we don't really look at content, no one will bother you." Tailoring: Hosting has obvious lawful uses. Vicarious: Fixed fees and ordinary contract rights, so no direct financial benefit from infringement without more. Safe harbor: Tidewrack is a § 512(c) provider, but the policy says it terminates repeat infringers, and it has received seventy notices about one account.

The advice: On contributory liability, notices and continued hosting alone would now fail, and Justice Sotomayor's concurrence effectively describes the majority's rule as allowing even service to a known pirate. But the sales note gives a plaintiff a specific act directed to a specific infringer, so that is what the company should worry about. On the safe harbor, seventy notices is hard to reconcile with reasonable implementation, and terminating the account is the obvious step. It costs one customer's fee and buys back protection against the 8,999 others. Terminate under the policy, train the sales team, preserve the note, and do not celebrate.

Worked example two: Marrow & Vine, a print-on-demand marketplace

Suppose Marrow & Vine lets artists upload designs that it prints on mugs and shirts, keeps 40 percent, and ships under its own brand. A photographer finds her images on mugs.

Here the analysis runs almost opposite to Tidewrack. Cox barely helps. Marrow & Vine prints and ships goods, so a direct reproduction and distribution claim looks strong regardless of who uploaded the file. Direct liability has no intent element. The 40 percent commission is the H.L. Green fact. Its terms reserve full rights, and a review step or category rules would feed the control argument. The § 512(c) harbor is doubtful for physical goods, since it covers infringement "by reason of the storage" of material. Even a good notice program does not address the mugs already sold. The trademark overlay, if brand names appear, is governed by a different standard (Y.Y.G.M. SA v. Redbubble, Inc., 75 F.4th 995 (9th Cir. 2023)), and Enforcing Trademarks Against Online Sellers and Platforms: A Practical Guide explains how brand owners use it.

The advice: Treat this as a direct infringement problem. Improve preflight screening and seller warranties, carry insurance, and price the risk into the category. Don't rely on a Cox argument as a main defense.

Worked example three: Benthic, an AI coding assistant

Suppose Benthic offers a code completion tool, hosted by the company, and customers occasionally receive output that matches open source code without its license notice.

Input: If Benthic copied training data itself, that is a direct infringement and fair use question, covered in Fair Use After Warhol: A Practical Guide to the Four Factors in the Age of AI, and Cox is no help. Output: If a user prompts for a function and receives matching code, who made the copy? The volition cases favor treating the user as the actor when the system responds automatically to commands, though a hosted model that generates the text itself gives a plaintiff a better argument than a VCR does. Assume plaintiffs plead in the alternative. Inducement: A general coding assistant isn't inducing by failing to filter. But a "Copy any library in one prompt" tutorial, or a settings page that suppresses license warnings with a tooltip saying "skip the attribution hassle," would be a specific act. Tailoring: The product overall obviously has lawful uses, but consider Nazemian before shipping a separate script that pulls in a known unlicensed dataset for customers. Vicarious: Subscription fees are flat, control over what users do with outputs is limited, and Nazemian dismissed a similar claim. Hosted generation may give a better control argument to plaintiffs than local software does, because the provider can refuse output at inference time.

The advice: Keep a similar-code detection feature if you have one, since it is evidence of discouragement and, under Athos-type reasoning, should not itself establish knowledge of specific infringement. Review marketing. Check contracts: customers will ask for indemnity, and the AI licensing materials in AI Licensing Toolkit: Data Provenance Records, License Terms, and Indemnity Clauses are relevant. Mind that the law here is extremely unsettled, and that Ziff Davis v. OpenAI (S.D.N.Y. Aug. 6, 2026), left open inducement and tailoring theories for stayed models.

Part Two: For rightsholders

Step 1: Choose your defendants by conduct

Before anything else, map the chain from the infringing copy back to the first person who made it. Ask who can actually stop it, who has money, and who did something beyond being there.

Do not sue a conduit because it is solvent. Doing so invites a dismissal and potentially a fee motion under 17 U.S.C. § 505.

Step 2: Collect the evidence that matters now

The evidence you collected for a knowledge case is not what you need for an intent case. Reorganize your collection around the theories that survive.

Public messaging. Capture and timestamp web pages, ads, tutorials, app store text, social posts, and videos, using a process you can authenticate later. Note the date because content changes after a complaint is filed, and archived versions can show changes. Search for your works and for infringement-related terms in the defendant's ads and SEO.

Product behavior. Test what the product does. For an AI product, keep prompts, outputs, dates, model versions, and account details, and test as an ordinary user would. Expect the defense to say your outputs are the only outputs, since the MiniMax reply brief argued that outputs generated by plaintiffs were not "resulting acts" of third parties. Look for and capture third-party infringing use too.

Third-party use. Direct infringement by someone else is an element. Find it, identify it by work and date, and connect it to the defendant's service. Avoid relying on bare IP data for identity: Cobbler Nevada, LLC v. Gonzales, 901 F.3d 1142 (9th Cir. 2018), held that registered-subscriber status alone does not state a claim.

Connection. Show that people actually received the encouragement and acted, such as comments and forum posts that mention the tutorial, or referral traffic. Grokster treated proof of a message as a good way of showing infringement took place by using the device, and Fung lists causation as an element.

Money and draw. Marketing that features your works, pricing tied to transactions, and customer statements about why they use the service. Conclusory statements will not do, and Giganews requires a link to your works. Consider a survey or a Fed. R. Evid. 702 expert for draw, knowing that the defense in Sony succeeded in part because Sony's own expert could not say why anyone bought a higher tier.

Registration and ownership. Thin proof of ownership nearly caused trouble for the plaintiffs in MoonPay. Get the chain of title and certificates together before you file. See Copyright Infringement Claim Evaluation Checklist: A Practical Checklist.

Step 3: Keep sending notices, with a different purpose

Notices are still how you remove content and how you test a host's safe harbor. They still create knowledge for § 512(c)(1)(A) and they supply the data on repeat infringers. They also matter for injunctive relief, since an unresponsive provider looks different in equity.

A few practical rules. Before sending, consider fair use: under Lenz v. Universal Music Corp., 815 F.3d 1145 (9th Cir. 2016), a copyright holder must consider it, and a knowing material misrepresentation creates liability under § 512(f). Identify locations specifically, since general notices do not create specific knowledge. Send to the designated agent. And keep your own log, since a defendant's failure to act on repeat offenders is your best argument that it fell outside § 512(i).

If you want a subscriber's identity from a conduit, do not use § 512(h). In re Subpoena of Internet Subscribers of Cox Communications, LLC (9th Cir. Aug. 15, 2025), and RIAA v. Verizon Internet Services, Inc., 351 F.3d 1229 (D.C. Cir. 2003), rule that out. Use a Doe suit and early discovery instead. See John Doe Litigation Toolkit: Early Discovery Motions, Platform Subpoenas, and Motions to Quash.

Step 4: Plead each theory on its own facts

Fed. R. Civ. P. 8 requires a plausible claim, and Rule 11 requires an inquiry first. These are the elements to meet.

Inducement. Direct infringement by identified third parties; specific acts of encouragement, with dates, speakers, and audiences; the object of promoting infringement; causation. Sample allegation:

On or about [date], Defendant published on its official channel a video titled "[title]" that demonstrates, step by step, how to use the [feature] to obtain [plaintiff's work] without authorization. The video has been viewed approximately [number] times. Comments posted beneath the video by users identified as [handles] state that they followed these instructions to obtain [work]. Defendant has not removed the video, and on [date] its employee [name] responded to a user's question about obtaining [work] by [content of response]. Through these specific acts, Defendant actively encouraged infringement of Plaintiff's works, with the object of increasing use of its service.

Tailoring. Identify the function, why it is separable, and why it has no substantial or commercially significant lawful use. Do not plead this against a general-purpose product just to have a second count; MoonPay granted summary judgment partly because plaintiffs did not dispute general capability.

Defendant separately developed, documented, and distributes [named script or function]. The sole function of [name] is to [retrieve and process the identified collection of unauthorized copies]. [Name] has no substantial or commercially significant use other than obtaining those copies, and Defendant does not describe any other use in its documentation.

Vicarious. Allege the source of the right to stop, the practical means to do so, and the causal link between infringement of your works and money.

Defendant takes [percentage] of each sale made through its marketplace, including each sale of goods bearing Plaintiff's works, and therefore receives revenue from each infringing transaction that it would not otherwise receive. Defendant's seller agreement gives it the right to remove any listing and terminate any seller. Defendant reviews each listing before publication and removed listings on [dates] within [time]. Defendant's advertising on [dates] featured [Plaintiff's work] to attract buyers.

Knowledge. Plead it, specifically, even though Cox did not make it the test. Two courts have retained it as an element, and it supports willfulness under 17 U.S.C. § 504(c)(2).

Preservation of alternatives. You may plead in the alternative that a defendant is directly liable. If your facts satisfy Justice Sotomayor's demanding version of aiding and abetting, you can plead them and preserve the point. But do not build a case on it, because seven Justices said the list has two entries.

Step 5: Consider the remedy path first

Ask what you want. If the goal is to stop a pirate service, the fastest route may be a direct suit against the operator and a default judgment with a carefully drafted 17 U.S.C. § 502 injunction, served on registrars and hosts. Weibley is a useful recent model. MoonPay shows the limit, so aim the order at those genuinely acting in concert, and expect resistance from intermediaries with no relationship to the pirate. If the goal is compensation from a business with assets, you need a theory that reaches it, so return to Steps 1 and 2. For small individual claims, The Copyright Claims Board: Small Claims Copyright Litigation Under the CASE Act describes a lower-cost forum, though respondents can opt out.

Worked example four: Odalys, a photographer

Suppose Odalys finds forty of her registered photographs on Larchmont Prints, a wall art marketplace that charges sellers a 25 percent commission and promotes "trending art" in email campaigns. She has sent two takedown notices; Larchmont removed the items within a week each time. New copies keep appearing from the same five seller accounts.

A pre-Cox lawyer would have led with knowledge and material contribution. That theory is gone. Better facts are available. Larchmont's email campaign featured two of her photographs, which helps on draw and could show direct display if Larchmont made those emails itself. The commission is a direct financial interest in each sale. Its agreement permits removal, and it actually has acted, which helps on control. The repeat appearance from five accounts challenges the § 512(i) implementation, though McGucken shows one or two misses are not enough, so she needs to show a pattern with data. If its advertising was curated by staff, § 512(c)'s "at the direction of a user" element is in question too.

Her plan: confirm registration dates under § 412, because statutory damages are the only way the economics work; preserve the emails; notify again with specific URLs and identify the repeat sellers; and send a demand aimed at direct display and vicarious liability, without mentioning material contribution. Her template is in the secondary liability toolkit. If she is considering an image enforcement firm, see Image Copyright Demand Letters: How Photo Licensing Enforcement Works and What Claims Are Really Worth.

Cost, timing, and trade-offs

These are general orders of effort, not quotes.

Common mistakes

For operators

Reading Cox as immunity. It removes one theory. A company that responds by ignoring notices can lose the safe harbor and still face direct and vicarious claims, now with bad facts.

Dismantling the program without a decision. The growth lead in the opening scene is not alone. If you are a host, stopping takedowns gives up your best money defense in order to save a small operating cost.

Treating the review as a one-time exercise. Marketing and sales staff change constantly, and inducing messages tend to appear when someone is chasing a number.

Deleting the awkward stuff. Removing a bad page going forward is fine. Purging messages after a demand letter creates spoliation exposure under Rule 37(e) that may be worse than the document.

Overpromising enforcement. "We never allow infringement" in a public statement is an invitation to a state law claim, even if one failed in MoonPay. Say what you do.

Assuming the safe harbor covers everything you do. A marketplace selling physical goods, a curated feed, and a hosted model each have serious § 512(c) questions.

Forgetting the agent renewal. It takes minutes and has a three-year clock.

Forgetting trademark. Inwood Laboratories, Inc. v. Ives Laboratories, Inc., 456 U.S. 844 (1982), still governs contributory trademark claims and includes continuing to supply someone you know or have reason to know is infringing. A notice from a brand owner is not a Cox problem.

For rightsholders

Sending the old letter. A demand built on knowledge and material contribution now tells your opponent that you have not read the case.

Suing the deep pocket with nothing specific. A conclusory inducement count is unlikely to get to discovery and may draw a fee request.

Overlooking the direct claim. If the defendant curated, printed, displayed, or copied, lead with that.

Confusing volume with evidence. A hundred thousand notices proved nothing about intent in Cox. One tutorial may prove more.

Ignoring causation and specificity. A complaint needs to connect the encouragement to infringements of your works. Courts have held plaintiffs to that link on draw, and defendants are pressing it on inducement.

Filing without registration. The claim waits on the certificate, and late registration can eliminate statutory damages and fees.

Waiting too long. The limitations period is three years under 17 U.S.C. § 507(b), and Warner Chappell Music, Inc. v. Nealy, 601 U.S. 366 (2024), addressed recovery of damages for timely claims while assuming, not deciding, that a discovery rule applies.

Where the law could move next

Watch for several things as of 3 November 2026. An appellate ruling on whether "tailored" applies to a whole service or a feature. Whether courts of appeals retain a knowledge element. What the Fifth Circuit does with UMG Recordings, Inc. v. Grande Communications Networks, LLC, 118 F.4th 697 (5th Cir. 2024), on remand. How vicarious liability is argued against commission marketplaces and hosted AI models. And whether Congress responds. MC Law will update this guide as those questions are answered.

This guide is general information and is not legal advice for a specific situation. If you are holding a demand letter, a takedown backlog, or an enforcement decision and would like a second set of eyes, a short conversation with counsel early usually costs less than a long one later.

Related Documents

Related Articles

• Contributory and Vicarious Copyright Liability After Cox v. Sony: Who Pays When Someone Else Infringes: the doctrine and close reading of the opinion.
• Copyright Infringement Claims Against Generative AI: The New York Times, Getty, and What Comes Next: the broader AI litigation.
• How to File a DMCA Takedown Notice (And Respond to One): notice mechanics for both sides.
• The Digital Services Act and Digital Markets Act: What US Companies Actually Have to Do: European obligations that Cox does not affect.
• Image Copyright Demand Letters: How Photo Licensing Enforcement Works and What Claims Are Really Worth: what image claims are worth.

Related Guides

• Digital Millennium Copyright Act Safe Harbors for Online Service Providers: the safe harbor conditions in depth.
• Running a Platform That Hosts User Content: A Practical Guide: broader platform operations.
• Enforcing Trademarks Against Online Sellers and Platforms: A Practical Guide: the trademark parallel for marketplaces.
• Handling Objections, Coaching, and Misconduct at a Deposition: A Practical Guide: conduct at corporate witness depositions (same batch).
• Getting Into or Staying Out of Federal Court: A Practical Guide to Jurisdiction and Removal: forum choices when state-law claims are added (same batch).

Related Checklists

• Secondary Copyright Liability Risk Checklist: A Practical Checklist: this guide's steps as a desk checklist.
• DMCA Safe Harbor Compliance Checklist: A Practical Checklist: safe harbor conditions in checklist form.
• Copyright Infringement Claim Evaluation Checklist: A Practical Checklist: evaluating a claim before sending a demand.

Related Toolkits

• Secondary Liability Toolkit: Repeat Infringer Policies, Notice Workflows, and Inducement Audits: the policy, workflow, audit, and demand templates that accompany this guide.
• Platform Liability Toolkit: Terms of Service, Notice Procedures, and Litigation Defenses: terms and notice language for platforms.
• John Doe Litigation Toolkit: Early Discovery Motions, Platform Subpoenas, and Motions to Quash: identifying anonymous infringers.