Copilot's DMCA win moves the notice-stripping question onto the developer who ships the code

Copyright management information in open-source code sits in a header at the top of the file: the author's name, the copyright notice, the licence terms ^[5]. Section 1202(b) makes it unlawful to intentionally remove or alter that header ^[5]. So the practical question inside a pull request is how a header goes missing.

The Ninth Circuit answered it by asking where the text came from. A search engine retrieves and displays stored information, meaning copies of things that already exist ^[7]. By the programmers' own account, Copilot predicts a likely completion from statistical patterns, and the panel read that as generation ^[9]. "One who creates a new work and fails to include CMI cannot be said to have 'removed' or 'altered' anything," the opinion says ^[6]. Judge Eric Miller added that "If Copilot functioned like a search engine and produced outputs that were identical to plaintiffs' code but did not contain CMI, then plaintiffs might have a stronger claim" ^[8].

That is a holding about the tool, not about the commit that follows. The defendants conceded that two works need not be identical, the panel agreed, and Miller wrote that minor cosmetic changes will not protect someone who substantially reproduces a work and strips the notice ^[11]. A completion long enough to be a substantial reproduction of a real file, accepted and pushed without the header the original carried, lands inside that description ^[1]. GitHub generated the text and your repository holds the copy ^[1].

What is left of Doe v GitHub is contract. Two breach-of-contract claims against GitHub, Microsoft and OpenAI are still running ^[4]. The programmers' other theory, that the defendants stripped notices from the code before feeding it into training, never got decided, because the panel held it forfeited ^[13]. At the hearing on the first motion to dismiss, the district court asked whether copying training data into Copilot breached the licences' attribution requirement, and counsel for the programmers answered "Perhaps it doesn't." ^[14] The judge then observed that the "complaint is not about training. It just isn't." ^[15] A later order recorded that the "Plaintiffs do not allege they were injured by Defendants' use of licensed code as training data", and nobody corrected it, orally or in writing ^[16].

For a team rolling these tools out, the review is two questions per repository. One is whether anything being shipped reproduces a substantial part of a file somebody else wrote. The other is whether that file's licence required a name or a notice the commit did not carry over. Both answers show up in a diff, which is where the header lives ^[5]. The statutory route through the vendor is closed ^[2], and the licence obligation stays with whoever redistributes the file ^[1].

Miller was candid that the statute's own authorities come from print media, such as defacing the title page of a book, and that they "do not map neatly onto the emerging digital technologies like artificial intelligence to which the DMCA's protections also apply" ^[12]. He also wrote, for the panel, that it declined "plaintiffs' invitation to transform run-of-the-mill copyright-infringement claims into DMCA claims" ^[2].