Digital Millennium Copyright Act

If you host user content or third-party content on your website, you could be liable as a publisher if that content breaches copyright. The Digital Millennium Copyright Act (DMCA) gives you some protection against this liability so long as you follow specific rules.

Here's what you need to know about the DMCA and what it requires you to do.

What is the Digital Millennium Copyright Act (DMCA)?

The Digital Millennium Copyright Act (DMCA) is a federal U.S. law passed in 1998 with the broad aim of updating copyright rules for the Internet age.

Among other measures, it addresses how copyright works with online publishers and service providers. This includes giving copyright holders the right to demand infringing material be taken down promptly. This is addressed by section 512 of the DMCA.

What is the Digital Millennium Copyright Act (DMCA) Safe Harbor?

The Digital Millennium Copyright Act (DMCA) contains a "safe harbor" provision for publishers and service providers who unintentionally host or publish copyright-infringing material that was put there by a third party.

This includes user generated content. This includes people posting messages, blogs, social media posts, articles or anything else on your site. What matters is that it's the site user posting the material, not you (the site owner or operator).

The provision shields you from monetary liability and limits your copyright infringement liability as long as you follow certain requirements, which we'll detail later.

Remember that the safe harbor only applies to infringement of U.S. copyright law by end users. It doesn't cover any material you have actively posted yourself such as ordinary web pages. It also doesn't cover trademark infringement, privacy or other legal issues such as defamation.

To recap with a simple example: You run a website that includes a discussion forum. A user posts something on the forum that breaches somebody else's copyright. As long as you follow the DMCA's rules, you won't be held liable for the breach.

What Happens if I Don't Comply With the Digital Millennium Copyright Act (DMCA)?

If you do not follow the DMCA requirements, you will lose the safe harbor provision. This means you could be held responsible for copyright infringement, even though it was a user who generated the content.

Even if you aren't found to have infringed the copyright willfully, you could face statutory damages of up to $30,000 for every infringement.

You may have to pay more than this if a court decides the actual financial damage caused to the copyright holder is higher. You could also be held responsible for costs and legal fees.

How Does The Safe Harbor Process Work In Practice?

The safe harbor works through takedown requests as follows:

• The copyright holder files a takedown notice with you (the site operator).
• You must promptly remove or disable access to the infringing material and then tell the user who posted it that you've taken it down.
• The user who posted the material can file a counter-notice saying the original takedown notice was invalid, usually because the copyrighted material or copyright holder was misidentified.
• If you receive a counter-notice, you must restore the material at some point between 10 and 14 business days later. This deadline applies unless the person who filed the original takedown notice says they have filed court action against the user who posted the content. If this happens, you do not have to reinstate the content.

How Do I Comply With the Digital Millennium Copyright Act (DMCA)?

To comply with DMCA and enjoy the safe harbor provision you must take the following steps:

• Designate somebody to handle takedown requests. Register this person with the US Copyright Office.
• Create and publish policies on how copyright holders can notify you of an alleged breach and how users can dispute this allegation.
• Create and enforce a policy dealing with users who repeatedly breach copyright.

Let's break this down in more detail.

DMCA Registration

You must designate an agent to receive takedown requests. The agent can be an employee or somebody outside of your business, as long as they have the authority and ability to deal with the requests.

You must then register with the US Copyright Office and give the details of your agent. This registration is now online-only through a dedicated system, found here.

Here's how the NCRC lists details of its designated agent:

Publish a DMCA Notification Policy

A DMCA Notification Policy tells copyright holders what they need to do to request a takedown of their material. It must list your designated agent and their contact details. It should also list the information the copyright holder must provide to make their takedown request valid. Normally this should include:

• Specific details of what copyrighted material they want removed
• Clear details of where to find it on your site, usually as a direct link
• The copyright holder's contact details (or those of the person filing the takedown on their behalf)
• A clear statement that the copyright holder has not authorized the use of this material
• A clear statement that everything the copyright holder (or the person filing the takedown on their behalf) says is true, under penalty of perjury

For added clarity, say whether the copyright holder must complete a specific form or simply contact your agent.

The DMCA specifically says you must follow and enforce your DMCA Notification Policy. It's not enough to simply publish a policy and then ignore it.

Wiley Periodicals covers the key points in its DMCA Notification Policy:

Create a DMCA Counter Notice Policy

Strictly speaking you don't have to publish a DMCA Counter Notice Policy, though doing so will bring legal certainty for all involved. Even if you don't publish the policy on your site, you should have the information ready to send when you inform a user you have taken down their content.

The DMCA Counter Notice Policy should include the following:

• The criteria for filing a counter notice, namely "a good faith belief that the material was removed or disabled as a result of mistake or misidentification of the material to be removed or disabled."
• The person filing the counter notice should explain what mistake they think the takedown notice makes.
• The person filing the counter notice must confirm everything in it is true, under penalty of perjury.
• What you will do next, namely wait 10-14 days and then restore the content unless the copyright holder tells you they have started legal action against the alleged infringer.

Here's how Twitch details what it requires in a counter notice:

Accommodate Standard Technical Measures

The DMCA says that to qualify for the safe harbor, your site or service must work in a way that "accommodates and does not interfere with standard technical measures" for copyright identification.

Standard technical measures are:

"Technical measures that are used by copyright owners to identify or protect copyrighted works and - (A) have been developed pursuant to a broad consensus of copyright owners and service providers in an open, fair, voluntary, multi-industry standards process; (B) are available to any person on reasonable and nondiscriminatory terms; and (C) do not impose substantial costs on service providers or substantial burdens on their systems or networks."

Create and Publish a Repeat Infringer Policy

One of the conditions for getting the safe harbor protection is that you have and publish a policy on how repeat infringers will be dealt with.

It's up to you to set the precise details but the main point is that people who post copyright-infringing material a certain number of times will be banned from using your site. You could simply set a threshold for the number of infringements, or you could say it depends on the nature and severity of the infringements. You should also say if you have any appeals process for such a ban.

The DMCA specifically says you must follow and enforce your Repeat Infringer Policy. It's not enough to simply publish a policy and then ignore it.

Third Iron makes clear the specific criteria for a ban will vary from case to case:

How to Display Your Digital Millennium Copyright Act (DMCA) Policies

Usually, it's easiest to publish all your DMCA information (your agent details, the DMCA Notification Policy, the DMCA Counter Notice Policy and the Repeat Infringer Policy) as a single web page.

Make sure this is easy to find by including a clear link in your navigation system, for example including it in a "legal" section. For added certainty, include it in a navigation menu accessible on every page.

Juniper includes a link in its site-wide footer menu:

You could put some elements elsewhere on your site as well as, or in place of, including them in your main DMCA information page. For example, your Repeat Infringer Policy could also be part of your Terms of Use agreement.

Here's how Intercom covers repeat infringers in its Terms of Use:

Summary

The DMCA protects you against liability for copyright infringement material posted by users of your site, as long as you follow specific rules. These include registering a DMCA agent with the Copyright office, publishing a policy for takedown requests, following the rules on counter notices, and publishing a policy for dealing with repeat copyright infringers.

You can publish these various policies as a single document or build them into other documents such as a Terms of Use agreement.