A federal appeals court has drawn a clear line around one of the more aggressive legal theories to emerge from the AI copyright debate. The U.S. Court of Appeals for the Ninth Circuit ruled against a group of anonymous code contributors who argued that AI companies had violated a specific section of copyright law by generating code that did not carry the contributors’ names or copyright notices. The court said no: a new work that simply lacks your copyright information is not the same as someone having removed that information from your work. That distinction matters more than it might sound.

What happened

The case, Doe v. GitHub, centered on Section 1202 of the Digital Millennium Copyright Act. In plain terms, Section 1202 is designed to stop people from stripping identifying information off a copyrighted work — things like the author’s name, the title, or a copyright notice. That kind of information is called copyright management information, or CMI. The idea behind the law is straightforward: if you take someone’s name off their work before distributing it, you are hiding the chain of ownership.

The plaintiffs argued that because AI-generated code resembled their work but did not include their copyright management information, the companies must have illegally removed it. The Ninth Circuit disagreed. Its ruling held that producing a new output without CMI is not the same legal act as removing CMI from an existing work. The statute covers removal. It does not cover the mere absence of attribution in something new.

The ruling was narrow. It did not address whether AI training on copyrighted code is lawful in general. It addressed one specific claim under one specific provision — and it held that provision to what Congress actually wrote.

Who is affected

The people most directly affected are independent software developers. They are the ones who contribute code to open-source projects, often under licenses that require attribution, and they are the ones least able to absorb the cost of federal copyright litigation. Statutory damages under copyright law can run into tens of thousands of dollars per work, which means even a small dispute carries a financial threat that is wildly disproportionate to the underlying conflict.

The rejected theory would also have exposed a wider range of people to DMCA copyright management information liability:

• Teachers and educators who adapt existing materials for classroom use
• Artists and writers who build new work on older source material
• Engineers who reverse-engineer software to understand how it works
• Search engines and indexing tools that process and reproduce content as part of their normal operation

Large technology companies are affected too, but their legal departments can sustain prolonged litigation in ways that a solo developer simply cannot. The practical threat falls hardest on people with the least protection.

Importantly, the plaintiffs in this case are not left without any legal options. Contract claims against the AI companies remain available to them, and copyright infringement claims are still possible if a model is used to directly reproduce their code verbatim.

What the real risk was

The theory the court rejected would have been a powerful tool — not because it was legally sound, but because of how copyright damages work in practice. When statutory damages are large enough, defendants often settle even when they have done nothing wrong. Litigation is expensive. Uncertainty is expensive. A settlement for a fraction of the potential damages can be the rational choice even for someone who would win at trial.

This dynamic is not unique to AI cases. It appears whenever a legal theory, however strained, carries the threat of ruinous damages. The threat itself does the work. The case never needs to go to a jury.

Had the Ninth Circuit accepted the plaintiffs’ reading, Section 1202 — a narrow anti-circumvention provision — would have become a broad instrument for challenging ordinary, lawful activity. Any output that lacked attribution could have been framed as evidence of removal. That is not what Congress wrote, and the court said so.

What to do today

If you are an independent developer or creator worried about how copyright law applies to your work, here are concrete steps you can take now.

• Read the Ninth Circuit’s opinion in Doe v. GitHub. It is a public document. It is written in legal language, but the core reasoning is followable without a law degree. Search for the case name and you will find it. Understanding what Section 1202 actually covers — and does not cover — is more useful than secondhand summaries.
• Document your process when you build on existing work. If you remix, adapt, or incorporate material from other sources, keep notes that show what you started with, what you changed, and why. If a claim is ever raised, that record helps demonstrate the transformative nature of what you did.
• Find out which organizations filed amicus briefs in this case. Amicus briefs are documents filed by outside parties who want to explain the broader stakes to a court. The organizations that do this work — digital rights groups, civil liberties organizations — often publish plain-language summaries of their arguments. Following them is a practical way to track how these legal theories are developing before they affect you.
• If you receive a copyright claim that feels like a stretch, look for public analysis before you respond. Digital rights organizations frequently publish positions on aggressive legal theories. Search the specific statute or theory being used against you. You may find that someone has already argued publicly that it does not apply the way the claimant says it does.

Why this keeps happening

Copyright holders have a structural reason to push for broader interpretations of the law. Wider liability means more leverage — in court, in settlement negotiations, and in licensing talks. Every new theory that survives a motion to dismiss becomes a bargaining chip.

Courts are the mechanism that pushes back, but they only get the chance when someone has the resources to litigate all the way to an appeals court. Most defendants do not. They settle, or they stop the activity being challenged, before a ruling is ever issued. The legal boundary only gets drawn when someone can afford to find out where it is.

Congress wrote the DMCA at a specific moment, for specific problems. The statute has not kept pace with how technology actually works. That gap creates space that litigants on all sides try to fill through court rulings, which is a slow and expensive way to make law.

There is a deeper accountability problem here too. Online systems were not built with reliable ways to tie actions to identifiable, responsible parties. Code is copied, modified, and distributed across thousands of repositories by contributors who may be anonymous. AI models are trained on data at a scale no human auditor can fully trace. When attribution is structurally absent from the environment itself, disputes about who removed what from whom become genuinely hard to resolve — and that ambiguity is exploitable. Even well-designed oversight struggles when it cannot find a clear target. The asymmetry in legal resources means that even a theory that ultimately fails in court can succeed in practice, because the cost of finding out is borne entirely by the defendant.

Frequently asked questions

Does this ruling mean AI companies can use any code they want without consequence?

No. This ruling addressed one narrow claim under one specific provision of the DMCA. It does not resolve broader questions about whether training AI models on copyrighted code constitutes copyright infringement. Those questions are still being litigated in other cases. The plaintiffs here also retain the ability to pursue contract claims and direct infringement claims if a model reproduces their code verbatim.

What is copyright management information and why does it matter?

Copyright management information is identifying data attached to a creative work — the author’s name, the title, the copyright notice, licensing terms. Section 1202 of the DMCA makes it illegal to intentionally remove that information from a work. It matters because that information tells users who owns the work and under what conditions it can be used. Stripping it can obscure ownership and make infringement harder to detect or prove.

Why would a court ever expand a law beyond what Congress wrote?

Courts generally try not to, but the line between interpreting a law and expanding it is genuinely contested. Statutes are written in words, and words have edges. When a new technology produces situations the drafters never imagined, courts have to decide how far the existing language reaches. The Ninth Circuit in this case said the language of Section 1202 had a clear meaning and that the plaintiffs’ theory went beyond it. Not every court in every case draws that line in the same place.

Related reading

• When Hacktivists Escalate: Who Answers for the Gaps
• Teaching Kids to Think Beats Banning Them from the Web

Originally reported by eff.org. This article summarises that reporting and adds practical guidance.

Scams, fraud, bots, and manufactured noise keep spreading because the internet was built with no reliable way to know who anyone actually is. Everyone deserves authenticity and accountability online, and that is the mission we are working on. Subscribe to follow the cases, rulings, and structural failures that shape what the internet is allowed to become.