IP Law Daily, COPYRIGHT—9th Cir.: Failure to include copyright management information in AI-generated work does not violate the DMCA, (Sep 17, 2026)

By Matthew Hersh, J.D.

Software code assembled by Github’s large language model did not remove or alter CMI.

An artificial intelligence program offered by a leading open-source software platform did not violate the DMCA by allowing users to develop code that replicated snippets of its training corpus without attribution, the U.S. Court of Appeals for the Ninth Circuit has held. The court, in affirming a lower court’s order dismissing a class action lawsuit against the software platform and its affiliates, emphasized that the AI-driven development of software code in response to user prompts constituted a process through which it generated “new works” without that CMI rather than the removal or alteration of existing CMI (Doe v. Github, Inc., No. 24-7700 (9th Cir. Sep. 16, 2026)).

The lawsuit arises out of the practices of Github, a Microsoft-owned platform for open-source computer software. Developers who wish to publicly disseminate their software for free can upload their works to Github under specified licensing terms. Many software developers choose to upload their software under terms that allow users to freely download and use the programs so long as they attribute the programs to their developers.

But the distribution of software is not the only thing that Github facilitates. Microsoft also collaborates with its partner OpenAI to offer Github users the opportunity to create their own software through an artificial intelligence tool named Copilot. (There are actually two programs at issue, Copilot and Codex, but the court of appeals refers to both as Copilot and this writeup does too.) That AI coding was trained on the large corpus of existing code uploaded by developers to Github.

A collection of software developers, unhappy with the way that Copilot used their code, brought this class action lawsuit against Github, Microsoft and OpenAI. Their complaint, as amended, asserts that when Copilot develops code for its users, it sometimes regurgitates verbatim portions of the code that users have uploaded. In replicating that code, the complaint asserts, Copilot does not include any information attributing the code to the original authors. That conduct, the complaint asserts, constitutes the removal or alteration of copyright management under Section 1202 of the Digital Millennium Copyright Act, or DMCA.

The district court dismissed the claim in 2024, finding that the conduct at issue did not violate the DMCA. That led to this interlocutory appeal and then to this decision.

Basis for complaint. The court began by reading the complaint to assert only one theory of DMCA violation rather than two. The class action plaintiffs argued on appeal that Github violated the DMCA at two stages: first, when Copilot ingested their code without the relevant copyright management information; and second, when it spat back portions of that now-stripped code in response to user inquiries. But the plaintiffs had waived any contention over the first, the court found, as their complaint did not raise this theory except only tangentially and the district court did not address the issue in its opinion below. It was too late to raise this issue now.

Standing. The court next found that the class action plaintiffs adequately pleaded standing for their one viable theory under the DMCA. Github argued that the plaintiffs failed to plead any cognizable injury because they did not adequately allege that their code would be subject to copying by Copilot without reproduction of the accompanying CMI. But that was not true, the court found. Indeed, the court noted, the complaint alleges “a substantial risk of injury” because it states that “Copilot reproduces the code of the [class-action plaintiffs] without attribution,” “that many if not all prompts entered into Copilot will readily cause it to emit verbatim, near-verbatim, or modified copies of [l]icensed [m]aterial that violate the licenses under which the source code is published,” that “it is therefore likely if not certain that verbatim, near-verbatim or modified copies of each [p]laintiff[’s] code have already been emitted by Copilot,” and that “each day these violations must be accruing with astonishing frequency.” That was enough, the court concluded, to meet the pleading threshold.

DMCA violation. But while the complaint met the constitutional standing threshold, it did not adequately plead a DMCA violation on the merits. Section 1202(b) of the DMCA provides that “[n]o person shall, without the authority of the copyright owner or the law,” “intentionally remove or alter any copyright management information” or “distribute... works [or] copies of works,... knowing that copyright management information has been removed or altered without authority of the copyright owner or the law.” Github and its co-defendants argued that they did not “remove or alter” the software developer’s CMI because they did not reproduce the full software but rather only created derivative works from that software. The court agreed.

The plain text of the DMCA compelled this answer, the court found. The verb “remove” means “to get rid of,” the court found, while “alter” means “to cause to become different in some particular characteristic.” In context, the court observed, “both verbs imply taking an affirmative act with respect to CMI connected to a work that already exists.” As such, the court found, one who creates a new work and fails to include CMI “cannot be said to have ‘removed’ or ‘altered’ anything.” Thus, to state a claim under [the DMCA], the court concluded, “plaintiffs must therefore allege that defendants removed or altered CMI from copies of existing protected works; merely alleging that a similar or derivative work does not include the CMI, without facts showing its removal or alteration, is insufficient.”

That doctrine was fatal to the complaint, the court found. According to the complaint, the court noted, Copilot relies on a “complex probabilistic process” to predict “the most likely solution to a given prompt,” based on “the solution it has found in the most projects” answering similar questions. To be sure, the court emphasized, that output may match snippets of “code from the training data.” But the plaintiffs’ account of the algorithm’s internal process—inferring “statistical patterns governing the structure of code” and identifying the most likely completion—does not describe an action taken with respect to CMI attached to an existing work, the court found. “Instead, it describes a process through which Copilot generates new works.” If Copilot functioned like a search engine and produced outputs that were identical to plaintiffs’ code but did not contain CMI, the court noted, then the plaintiffs might have a stronger claim that Copilot had removed their CMI. “But that is not what plaintiffs have alleged,” the court concluded.

But while the court of appeals affirmed the district court’s ruling, it disagreed to some extent with the lower court’s characterization of the rule. The district court characterized the doctrine as the DMCA’s “identicality” requirement. But “identicality” is something of a misnomer, the court of appeals found, “because the DMCA does not require literal identicality between the plaintiff’s work and the allegedly infringing work.” To be sure, the fact that the original and derivative works are identical would of course be one way to determine whether CMI has been “remove[d]” from the original. But the two works need not be “literally identical,” the court emphasized, to support an inference that CMI has been removed. “Minor cosmetic changes will not necessarily protect a defendant who substantially or entirely reproduces the protected work and removes CMI.” But that doctrine did not help the class action plaintiffs, the court concluded, “because they have not alleged removal of CMI from a copy of their work, even one with minor alterations.”

The Case is No. 24-7700.

Judge: Miller, E.

Attorneys: Jesse Panuccio (Boies Schiller Flexner LLP) for J. Doe. Lisa S. Blatt (Williams & Connolly LLP) for GitHub, Inc.

Companies: GitHub, Inc.

MainStory: TopStory Copyright AlaskaNews ArizonaNews CaliforniaNews HawaiiNews IdahoNews MontanaNews NevadaNews OregonNews WashingtonNews TechnologyInternet GCNNews