An Exact Copy or Only Copying: The Ninth Circuit Limits Section 1202(b) of the DMCA to Copies of Existing Works
On September 16, 2026, the Ninth Circuit held that a generative AI model does not “remove or alter” copyright management information (“CMI”) under Section 1202(b) of the Digital Millennium Copyright Act (“DMCA”) when its output omits attribution that the training materials carried. Doe 1 v. GitHub, Inc., No. 24-7700, 2026 WL 2728464, at *1 (9th Cir. Sept. 16, 2026). Judge Eric Miller wrote the opinion, joined by Judge Sidney Thomas and District Judge Stanley Blumenfeld, Jr. of the Central District of California, sitting by designation.
The case focused on the operation of GitHub, “the world’s largest hosting service for open-source software—that is, software whose creators choose to make its source code publicly available.” Id. at *2. Much of the open-source code in GitHub’s public repositories is licensed on conditions requiring that a copy of the license, including the author’s name and copyright notice, be included with any copy or derivative of the code. Id. Copilot, built by GitHub and OpenAI, is a large language model trained on billions of lines of code available of GitHub. Id. Plaintiffs are programmers who published licensed code on Github. The Plaintiffs sued GitHub, Microsoft (GitHub’s owner), and OpenAI, alleging that in violation of Sections 1202(b)(1) and (3), Copilot sometimes generates verbatim or near-verbatim copies of published code, stripped of the attribution, notices, and license terms that accompanied the original. Id. at *2–*3.
Judge Jon S. Tigar of the Northern District of California dismissed the DMCA claim with prejudice, reasoning that Section 1202(b) requires the copies to be “identical” and that Plaintiffs’ own examples described output that was a “modified format,” “variation[ ],” or “functional[ ] equivalent” of the licensed code. Id. at *3. Two breach-of-contract claims survived, and the court certified its dismissal order for interlocutory appeal under 28 U.S.C. § 1292(b), identifying as the controlling question of law whether Section 1202(b) imposes an identicality requirement. Id. Plaintiffs appealed, pressing two theories: an “input” theory and an “output” theory.
Plaintiffs Forfeited the Input Theory but Had Standing to Pursue the Output Theory
The input theory posited that Defendants stripped CMI from class members’ code before feeding it into Copilot as training data. Id. at *3. The panel held that Plaintiffs forfeited that theory because Plaintiffs never corrected the district court’s conclusion that the “complaint is not about training.” Id. The district court reached that conclusion after Plaintiffs’ counsel answered, “Perhaps it doesn’t,” when asked whether copying training data into Copilot violated the licenses’ attribution requirement, and it later wrote that Plaintiffs “do not allege they were injured by Defendants’ use of licensed code as training data.” Id. Plaintiffs identified nothing in their later briefing that would have put the court on notice of an input theory. Id.
According to Plaintiffs’ output theory, Copilot removes CMI when it returns memorized training data to users. Id. Because appellate jurisdiction under Section 1292(b) runs to the certified order rather than to the question the district court formulated, the panel assessed standing even though the certified order did not consider it. Id. at *4 (citing Yamaha Motor Corp., U.S.A. v. Calhoun, 516 U.S. 199, 205 (1996)). The district court had addressed standing in an earlier order, so the issue was “fairly raised by the order under review.” Id. The panel concluded that Plaintiffs had standing because they pleaded a substantial risk of future injury: the complaint cited research that large language models sometimes emit memorized training data verbatim, gave examples of verbatim reproduction of the named Plaintiffs’ code, and pointed to GitHub’s own duplicate-detection feature, which lets users block output matching public code in verbatim snippets of 150 characters or more. Id.
The Ninth Circuit then reached the merits of the output theory, which turned on the meaning of two verbs in Section 1202(b): “remove” and “alter.” The statute bars any person, without the authority of the copyright owner or the law, from “intentionally remov[ing] or alter[ing] any copyright management information” or from distributing works or copies of works “knowing that copyright management information has been removed or altered without authority of the copyright owner or the law.” Id. at *5 (quoting 17 U.S.C. § 1202(b)(1), (3)).
To “remove” is “to get rid of,” and to “alter” is “to cause to become different in some particular characteristic.” Id. (quoting Webster’s Third New International Dictionary 63, 1921 (1993)). Both presuppose an affirmative act directed at CMI on a work that already exists. “One who creates a new work and fails to include CMI cannot be said to have ‘removed’ or ‘altered’ anything.” Id.
The statutory definitions confirm the reading. CMI is information “conveyed in connection with copies … of a work,” not in connection with excerpts or derivative works, and a copy is the material object in which the work is fixed. Id. Violating Section 1202(b) therefore requires removing or altering the CMI on those material objects, such as when a photograph is reprinted with the gutter credit cropped out. Id. But alleging that a similar or derivative work lacks CMI, without facts showing its removal or alteration, is insufficient to state a claim. Id.
Plaintiffs’ own description of Copilot doomed their claim. The complaint alleged that Copilot infers “statistical patterns governing the structure of code” to identify the most likely completion to a prompt. Id. at *7. In other words, the complaint described the generation of a new work rather than an act directed at CMI attached to an existing work. The panel contrasted Copilot with a search engine, which retrieves and displays copies of material that already exists. Id. Had Copilot worked that way and returned outputs identical to Plaintiffs’ code but without CMI, the claim would have been stronger. Id.
In future cases, plaintiffs are likely to cite the Ninth Circuit’s rejection of the district court’s “identicality” framing. The panel held that identicality is merely “a gloss on the statutory terms ‘remove,’ ‘alter,’ and ‘copies’ rather than an independent (and atextual) element of a section 1202(b) claim.” Id. at *6. Identicality instead carries an evidentiary function. Where two works are otherwise the same and the only material difference is the missing CMI, a factfinder may infer removal. Id. Cosmetic changes will not necessarily protect a defendant who substantially or entirely reproduces a work and strips the CMI, while material differences may suggest a new derivative work to which a plaintiff’s CMI was never attached. Id.
The panel also explained why a contrary rule would make little sense in light of statutory copyright remedies. Many copyright cases involve a work substantially similar to the plaintiff’s but with no attribution. Id. at *7. If that were enough to violate Section 1202(b), the DMCA would supplant traditional copyright protections and expose defendants to the DMCA’s enhanced statutory damages, which run from $2,500 to $25,000 for each violation. Id. The court declined “to transform run-of-the-mill copyright-infringement claims into DMCA claims.” Id.
The Output Theory’s Line Is Between Retrieval and Generation
After Doe, the output theory is narrower but not dead. Rights holders should take care to describe the architecture of a generative AI model with care at the pleading stage. What matters is whether the generative AI model returns actual stored copies or instead merely generates output from learned parameters. A model that returns a substantially complete reproduction of an existing work without its CMI will often supply strong circumstantial evidence of removal. Id. at *6. And a model’s filtering tools cut both ways: although GitHub’s duplicate-detection feature suppresses verbatim output, Plaintiffs pointed to the feature’s existence as evidence that verbatim output occurs, and the panel credited it. Id. at *4. At bottom, Section 1202(b) reaches only defendants who remove CMI from an existing copy, a limitation that may exclude the outputs of many generative AI models.
