Secondary Copyright Liability Risk Checklist: A Practical Checklist

How to use this checklist

Run this review once a year, whenever you launch a material feature or pricing change, and immediately after any demand letter. Phases 0 through 7 are for service operators: ISPs, hosts, platforms, marketplaces, app stores, payment companies, and AI tool providers. Phase 8 is for rightsholders. Phase 9 applies to both once a dispute is live. Rightsholders should also read the operator phases, since they show what a target's counsel will be checking.

The order is deliberate. Since Cox Communications, Inc. v. Sony Music Entertainment, 607 U.S. 583 (2026), knowledge and continued service do not establish contributory liability, so the review begins with what the company itself does, moves to what it says and builds, and only then turns to the safe harbor.

The doctrine is explained in Contributory and Vicarious Copyright Liability After Cox v. Sony: Who Pays When Someone Else Infringes, the sequence and worked examples are in Assessing and Reducing Secondary Copyright Liability: A Practical Guide, and the fillable forms are in Secondary Liability Toolkit: Repeat Infringer Policies, Notice Workflows, and Inducement Audits.

Law is stated as of 3 November 2026. Post-Cox authority is mostly from district courts, and several points below are unsettled.

Phase 0: Set up the review

• Decide whether this review is privileged. Have counsel direct it and state its legal purpose, and limit distribution. Facts and ordinary business records stay discoverable. Consider Fed. R. Evid. 502 before sharing results with insurers, investors, or auditors. Note: A review run by the marketing team and shared widely is unlikely to be protected. Decide this before the first interview, not after the first bad finding.
• Check whether a preservation duty already exists. A specific demand or threatened suit usually triggers one; failure to preserve electronically stored information is governed by Fed. R. Civ. P. 37(e). Note: Fixing a page going forward is usually fine. Purging old versions, tickets, or chat history is the problem. Suspend auto-delete for relevant custodians first.
• Identify the business owners. Name one person each for product, marketing, sales, support, trust and safety, finance, and engineering. Those are your likely Fed. R. Civ. P. 30(b)(6) witnesses later.
• Collect prior disputes. Demand letters, notices by top senders, subpoenas, injunctions served, insurer correspondence, and license negotiations with rightsholders.

Red flag: Someone proposes "cleaning up Slack" as the first step. Stop them, and bring in counsel.

Phase 1: Map functions

• List each product by function. Conduit, caching, storage, linking, sale or license as principal, payment, software distribution, hosted model. Each 17 U.S.C. § 512 harbor is assessed separately under § 512(n).
• Answer four system questions for each product. Where does the material reside? Who initiates each copy? Who selects what appears? How does money flow when an infringing item is used or sold?
• Flag anything your company handles beyond automated processing. Human review, curation, editing, printing, shipping, featuring in emails. Note: These are the facts that made McGucken v. Shutterstock, Inc., No. 23-7652 (2d Cir. Feb. 10, 2026), a jury question on two § 512(c) requirements.
• Confirm where your customers and users sit. Note non-US exposure. Cox does not govern the EU; see Complying With the DSA and DMA: A Practical Guide.

Phase 2: Direct infringement

• Identify every copy, display, performance, or distribution your own system makes for your own purposes. Thumbnails, transcodes, previews, recommendation assets, training sets. 17 U.S.C. § 106.
• Apply the causation test. Does your system respond automatically to users, or do your people choose? Cartoon Network LP v. CSC Holdings, Inc., 536 F.3d 121 (2d Cir. 2008); Perfect 10, Inc. v. Giganews, Inc., 847 F.3d 657 (9th Cir. 2017); VHT, Inc. v. Zillow Group, Inc., 918 F.3d 723 (9th Cir. 2019).
• Check moderators and contractors. If they approve content, ask whether they act as your agents. Mavrix Photographs, LLC v. LiveJournal, Inc., 873 F.3d 1045 (9th Cir. 2017).
• If you sell physical goods, identify your role in the sale. Title, shipping, printing. Milo & Gabby LLC v. Amazon.com, Inc., 693 F. App'x 879 (Fed. Cir. 2017) (nonprecedential; Amazon held not a seller on those facts). Note: A company that prints the item is making the copy. Do not read a fulfillment case to cover manufacturing.
• If you embed or frame, check your circuit. Emmerich Newspapers, Inc. v. Particle Media, Inc., No. 25-60550 (5th Cir. Aug. 27, 2026); Perfect 10, Inc. v. Amazon.com, Inc., 508 F.3d 1146 (9th Cir. 2007).
• If you offer an AI model, separate training from output. Record provenance of training data, and decide who the actor is when a user prompts for a protected work. Cox does not address either point. See Copyright Infringement Claims Against Generative AI: The New York Times, Getty, and What Comes Next.

Red flag: Staff hand-pick user content for a homepage, newsletter, or ad. That activity may be direct infringement, and it falls outside "storage at the direction of a user."

Phase 3: Inducement

Standard: a provider "induces infringement if it actively encourages infringement through specific acts." Cox; Metro-Goldwyn-Mayer Studios Inc. v. Grokster, Ltd., 545 U.S. 913 (2005); Columbia Pictures Industries, Inc. v. Fung, 710 F.3d 1020 (9th Cir. 2013).

• Review all external marketing for infringing use cases. Website, ads, keyword purchases, comparison pages, app store text, demo reels, screenshots. Note: Advertising is one example of an inducing act, not a requirement, according to Nazemian v. NVIDIA Corp., No. 24-cv-01454-JST, ECF No. 303 (N.D. Cal. May 5, 2026).
• Review tutorials, docs, and sample code. Instructions that show how to obtain or reproduce protected works are the classic Grokster evidence. Check sample prompts and example datasets.
• Review affiliate, reseller, and influencer content. Determine what you paid for or approved. Weibley relied on the operator's own advertising and posted reviews: Amazon Content Services LLC v. Weibley (M.D. Pa. June 10, 2026).
• Sample support tickets and community forums. Search titles, artists, "free," "torrent," "rip," "bypass," "takedown," "strike." Note: Grokster counted responses to users asking for help locating and playing copyrighted material.
• Review sales scripts and deal notes. Look for reassurance about enforcement ("no one will bother you").
• Review product tickets and roadmaps for stated purpose. Features that help users evade detection, re-upload after removal, hide from rightsholders, or strip copyright information.
• Check whether payment or status changes enforcement. Any paid tier or verified status that buys leniency. See the practice alleged in Concord Music Group, Inc. v. X Corp. (M.D. Tenn. Mar. 5, 2024).
• Check who you target. Are you seeking users of a shuttered pirate service? Grokster treated that as evidence of unlawful purpose.
• Read internal metrics and board materials. Does anyone attribute growth to infringing content? Grokster says the revenue model alone is not enough but matters in context.
• Record why filtering decisions were made. A failure to filter alone does not create liability, as Cox confirms by quoting Grokster's footnote 12, but internal reasons can be evidence of intent.
• Train the people who produce messages. Marketing, sales, support, developer relations, and community managers. Note: A "like" alone was not inducement in Ravazzani v. C K Collection, Inc. (S.D.N.Y. Sept. 28, 2026), but do not plan around how little you can get away with.

Red flag: A marketing asset features a recognizable character, song, or film to show what the product can do. Treat it as urgent, whatever the license situation is assumed to be.

Red flag: Someone writes "we should not look at this too closely." That email can matter under the willful blindness standard of Global-Tech Appliances, Inc. v. SEB S.A., 563 U.S. 754 (2011), and under § 512(c).

Phase 4: Tailoring

Standard: "not capable of 'substantial' or 'commercially significant' noninfringing uses." Cox; Sony Corp. of America v. Universal City Studios, Inc., 464 U.S. 417 (1984).

• Test the service as a whole. List actual lawful uses. Most general services pass. United King Film Distribution (1990) Ltd. v. MoonPay USA LLC (S.D. Fla. July 13, 2026) (capability, not actual use).
• Test each separable feature, script, plug-in, or integration. Could it be described as a standalone tool, and what else does it do? Nazemian analyzed scripts rather than the larger framework. Note: MoonPay and Nazemian point in different directions on the unit of analysis. Assume a plaintiff will pick the narrowest unit.
• Retain evidence of lawful use. Customer documentation, usage samples, and support records for features most likely to be singled out.
• Add a launch gate. New features that interact with third-party content get a brief copyright review before release.

Red flag: A feature's only documented example involves content the company has no rights in, or the engineering ticket describes its purpose as getting around a rights restriction.

Phase 5: Vicarious liability

Standard: right and ability to supervise plus a direct financial interest, with no knowledge required. Grokster, n.9; Shapiro, Bernstein & Co. v. H. L. Green Co., 316 F.2d 304 (2d Cir. 1963). Cox did not address the merits of this theory.

• List your sources of legal control. Terms, seller agreements, developer agreements, and removal rights.
• List your practical ability. Can you identify and stop the specific activity, or only cut off an account? Amazon.com; Perfect 10, Inc. v. Visa International Service Ass'n, 494 F.3d 788 (9th Cir. 2007); Luvdarts, LLC v. AT&T Mobility, LLC, 710 F.3d 1068 (9th Cir. 2013) (current system, not a hypothetical one). Note: Concord and Nazemian both rejected vicarious claims for lack of control. A marketplace with pre-publication review is in a different place from an open social feed.
• Trace the money. Flat fee, commission, ad share, or per-use. Ask whether revenue would change if infringement stopped. Sony Music Entertainment v. Cox Communications, Inc., 93 F.4th 222 (4th Cir. 2024).
• Look for draw evidence. Marketing, surveys, and internal analysis showing users come for infringing content. Fonovisa, Inc. v. Cherry Auction, Inc., 76 F.3d 259 (9th Cir. 1996); Ellison v. Robertson, 357 F.3d 1072 (9th Cir. 2004); EMI Christian Music Group, Inc. v. MP3tunes, LLC, 844 F.3d 79 (2d Cir. 2016). Note: Giganews requires a link to the plaintiff's own works, not to infringement in general.
• Identify people with personal exposure. Founders and officers who direct activity and have an obvious financial stake (MP3tunes).

Red flag: A percentage commission on each sale, plus pre-publication review, plus marketing that features sellers' top items. That combination should be presented to counsel even if no one has complained.

Phase 6: Section 512 eligibility

• Decide, deliberately, which harbor each function relies on. 17 U.S.C. § 512(a) to (d); § 512(n). Note: Pure conduits should weigh the reduced need against the injunction limits and the evidentiary value of warnings. Do not let this get decided by default.
• Confirm the service provider definition. § 512(k)(1). The narrow (A) definition applies to § 512(a). McGucken read (B) broadly.
• Confirm agent designation is current. On your site and in the Copyright Office directory. § 512(c)(2); 37 C.F.R. § 201.38, in 37 C.F.R. Part 201. Note: Designations expire after three years unless renewed. Check the current fee schedule. Calendar renewal with two owners.
• Confirm the repeat infringer policy is adopted and communicated. § 512(i)(1)(A).
• Confirm it is reasonably implemented, with data. Pull counts of notices, strikes, warnings, and terminations. BMG Rights Management (US) LLC v. Cox Communications, Inc., 881 F.3d 293 (4th Cir. 2018); Perfect 10, Inc. v. CCBill LLC, 488 F.3d 1102 (9th Cir. 2007); Ventura Content, Ltd. v. Motherless, Inc., 885 F.3d 597 (9th Cir. 2018); McGucken. Note: Termination counts that are near zero, or terminations followed by reactivation, are the facts that cost Cox the harbor. Adjudication is not required.
• Measure takedown speed. Median and slowest responses. Four days was expeditious in McGucken; there is no statutory number.
• Confirm red-flag handling. Staff know to escalate specific obvious infringement. Viacom International, Inc. v. YouTube, Inc., 676 F.3d 19 (2d Cir. 2012); Capitol Records, LLC v. Vimeo, LLC, 826 F.3d 78 (2d Cir. 2016).
• Check right and ability to control. Review curation and editorial influence. Capitol Records, LLC v. Vimeo, Inc., 125 F.4th 409 (2d Cir. 2025); Athos Overseas Ltd. v. YouTube, Inc., No. 23-13156 (11th Cir. Jan. 7, 2026). Note: Encouraging particular kinds of infringing posts can be argued as control under Grokster, per the rehearing order in Capitol Records v. Vimeo (2d Cir. Sept. 9, 2025).
• Run the counter-notice process correctly. Prompt notice to the user, then restoration in not less than 10 and not more than 14 business days absent suit. § 512(g)(2).
• Accommodate standard technical measures. § 512(i)(1)(B).
• Confirm you are not relying on § 512 where it does not fit. Physical goods, staff-selected content, generated output.

Red flag: "We stopped enforcing after Cox." For a host, that decision may eliminate the harbor for every direct and vicarious claim. Find out who decided it and when.

Red flag: Notices are capped, deduplicated by day, or reset on a schedule. Those features appear in the BMG description of Cox's system.

Phase 7: Orders, subpoenas, contracts, and governance

• Create one intake path for court orders. Ask who is enjoined, whether your customer is that party, and what is required. Fed. R. Civ. P. 65(d)(2). Note: Weibley reached registrars and hosts by order. MoonPay recounts a denied contempt motion where the intermediary had no relationship with the pirate.
• Check whether § 512(j) limits apply if you are named. § 512(j).
• Set the subscriber-information process. Rule 45 subpoenas, cable subscriber notice, and § 512(h) limits. Fed. R. Civ. P. 45; 47 U.S.C. § 551(c)(2)(B); In re Subpoena of Internet Subscribers of Cox Communications, LLC (9th Cir. Aug. 15, 2025).
• Align public statements with what you do. Do not overpromise enforcement. MoonPay rejected deception and negligence claims on the merits but held them not preempted under 17 U.S.C. § 301.
• Review seller, customer, and vendor terms. Warranties, indemnities, and removal rights. Note that a broad removal right also supports a control argument.
• Check insurance. Confirm whether media liability or cyber coverage responds to copyright claims and statutory damages. Notify carriers on time.
• Check trademark separately. Inwood Laboratories, Inc. v. Ives Laboratories, Inc., 456 U.S. 844 (1982); Y.Y.G.M. SA v. Redbubble, Inc., 75 F.4th 995 (9th Cir. 2023). Cox did not change that standard. See Online Marketplace Trademark Enforcement Checklist: A Practical Checklist.
• Remember that section 230 will not help. Federal intellectual property claims are excluded by 47 U.S.C. § 230(e)(2). See Platform Content Moderation Checklist: A Practical Checklist for the wider moderation review.
• Assign a recurring owner. Set a quarterly marketing sample and an annual full review.

Phase 8: Rightsholder pre-suit review

• Confirm ownership and registration. 17 U.S.C. § 411(a); Fourth Estate Public Benefit Corp. v. Wall-Street.com, LLC, 586 U.S. 296 (2019). See Copyright Infringement Claim Evaluation Checklist: A Practical Checklist.
• Check timing for statutory damages and fees. 17 U.S.C. § 412; 17 U.S.C. § 504(c); 17 U.S.C. § 505.
• Check limitations. 17 U.S.C. § 507(b); Warner Chappell Music, Inc. v. Nealy, 601 U.S. 366 (2024).
• Identify the direct infringer, with evidence. A theory of secondary liability requires one. A bare IP address is not enough. Cobbler Nevada, LLC v. Gonzales, 901 F.3d 1142 (9th Cir. 2018).
• Assess a direct claim against the intermediary first. Curation, printing, featured display, training copies.
• Collect specific acts of encouragement. Date, speaker, audience, and connection to your works. Capture them in an authenticated way.
• Decide whether you can honestly plead tailoring. Name the function. Drop it if the only theory is that some use infringes. Fed. R. Civ. P. 11.
• Collect vicarious evidence. Commission flow, draw tied to your works, actual exercise of control.
• Keep sending compliant notices. § 512(c)(3). Consider fair use first. Lenz v. Universal Music Corp., 815 F.3d 1145 (9th Cir. 2016); § 512(f). See Filing a DMCA Takedown Notice: A Practical Checklist.
• Log repeat offenders. Provider inaction is your § 512(i) argument.
• Do not use § 512(h) against a conduit. In re Subpoena; RIAA v. Verizon Internet Services, Inc., 351 F.3d 1229 (D.C. Cir. 2003).
• Weigh the injunction route. Sue the operator, get the order, serve it on infrastructure. Draft to Rule 65's limits.
• Update the demand template. Remove knowledge-plus-material-contribution as a standalone theory.

Red flag: The complaint's only link between defendant and infringement is the volume of notices. Cox involved 163,148 of them. Plead something else or do not file against this defendant.

Red flag: Your theory of "draw" relies on a percentage of traffic. The Fourth Circuit rejected that in Sony because the evidence did not show customers subscribed in order to infringe.

Phase 9: When a dispute is live (both sides)

• Issue or confirm the hold. Rule 37(e). Include marketing, product, sales, support, and executive custodians, since intent evidence lives there.
• Operators: process the notice first and argue second. Takedown within your normal time, then a narrow written response citing Cox. Forms are in the toolkit.
• Operators: calendar the response date and evaluate the Rule 12 motion. Fed. R. Civ. P. 12. Target notice-based contributory claims and conclusory draw and control allegations.
• Operators: plan the safe harbor for summary judgment. Fed. R. Civ. P. 56. The provider must raise it and show eligibility. Gather logs early.
• Both: negotiate custodians and search terms. Fed. R. Civ. P. 26(b)(1). Prepare corporate designees carefully. See Deposition Conduct and Objection Checklist: A Practical Checklist.
• Both: cite Cox to the court. At least one post-Cox default judgment recited the old formula without mentioning it: Broadcast Music, Inc. v. QM Entertainment, LLC (W.D. Wash. Apr. 10, 2026).
• Both: check for new appellate authority. The remand in UMG Recordings, Inc. v. Grande Communications Networks, LLC, 118 F.4th 697 (5th Cir. 2024), vacated 146 S. Ct. 2152 (2026), and appeals from the early district court decisions could change points in this list.
• Both: review fee exposure. § 505. Consider an early letter identifying a foreclosed theory, or an early offer of judgment analysis.

Red flag: Senior staff begin writing their theories of the case in email or chat. Move the conversation to counsel.

This checklist is general information and is not legal advice for a specific situation.

Related Documents

Related Articles

• Contributory and Vicarious Copyright Liability After Cox v. Sony: Who Pays When Someone Else Infringes: the doctrine behind each phase.
• Copyright Infringement Claims Against Generative AI: The New York Times, Getty, and What Comes Next: AI training and output issues.

Related Guides

• Assessing and Reducing Secondary Copyright Liability: A Practical Guide: the same steps explained, with worked examples.
• Complying With the DSA and DMA: A Practical Guide: the European obligations a US review misses.

Related Checklists

• DMCA Safe Harbor Compliance Checklist: A Practical Checklist: a deeper check of the section 512 conditions.
• Filing a DMCA Takedown Notice: A Practical Checklist: for notice senders.
• Copyright Infringement Claim Evaluation Checklist: A Practical Checklist: evaluating the underlying claim.
• Online Marketplace Trademark Enforcement Checklist: A Practical Checklist: the trademark parallel.
• Platform Content Moderation Checklist: A Practical Checklist: wider moderation issues.
• Deposition Conduct and Objection Checklist: A Practical Checklist: for corporate witness depositions (same batch).
• Federal Jurisdiction and Removal Checklist: A Practical Checklist: forum checks when state-law claims accompany a copyright claim (same batch).

Related Toolkits

• Secondary Liability Toolkit: Repeat Infringer Policies, Notice Workflows, and Inducement Audits: the forms and templates for this review.