On April 21, 2026, the Electronic Frontier Foundation published Copyright and DMCA Best Practices for Fediverse Operators, a plain-language guide telling the hosts of Mastodon servers, Bluesky instances, and RSS mirrors exactly how to shield themselves from ruinous copyright liability for content their users upload. The guidance is unglamorous — designate an agent, honor takedowns, terminate repeat infringers — but it quietly demonstrates something important about US intermediary-liability law: the rules that protect a billion-dollar platform also protect a hobbyist running a server out of a closet, and they do so for the price of a sandwich.
The bargain Section 512 actually offers
The Digital Millennium Copyright Act's Section 512, enacted in 1998, gives online hosts a 'safe harbor' from monetary liability for user infringement in exchange for cooperation with rights holders. Per the US Copyright Office, a qualifying host must do three things. First, designate an agent to receive infringement notices and register that agent in the Office's public directory. Second, respond to valid notices by expeditiously removing flagged material — while honoring user counter-notices and restoring content after a 10-business-day waiting period if no lawsuit follows. Third, adopt and reasonably implement a policy of terminating 'repeat infringers' in appropriate circumstances.
What EFF's guide makes vivid is how low the compliance floor sits. Registering a designated agent with the Copyright Office costs $6 and lasts three years before renewal. There is no filtering mandate, no obligation to proactively monitor uploads, and no requirement to adjudicate whether a contested work is actually infringing. A volunteer operator can satisfy the statute with an afternoon of paperwork and a published email address. That is the genius of the 1998 design: it allocates the cost of policing to the party that holds the copyright and knows what infringement looks like, not to the conduit that merely passes bits.
Steelmanning the critics
Rights holders have a real grievance worth stating fairly. Decentralization makes notice-and-takedown feel like whack-a-mole: an infringing file removed from one Mastodon server can be 'boosted' across hundreds of federated instances, each with its own absent or unresponsive operator, forcing a copyright owner to chase the same work across a sprawl of small hosts that may never have registered an agent at all. The Copyright Office's own May 21, 2020 Section 512 study concluded that the notice-and-takedown balance had 'tilted askew,' with creators bearing disproportionate enforcement burdens. On a federated network, that burden multiplies. These are legitimate frictions, not bad-faith complaints.
But the cure many propose — staydown filters, proactive monitoring duties, or stripping immunity from operators who can't afford content-ID systems — would not fix the friction. It would simply delete the open social web. The European Union's Article 17 of the 2019 Copyright Directive already pushed larger platforms toward upload filtering; importing that logic into US law would impose costs that Meta and Google absorb easily and that a volunteer Mastodon admin cannot survive. The predictable result is consolidation: smaller hosts shut down, users funnel back to a handful of corporate platforms, and the decentralization that critics and regulators claim to want evaporates. Proportionality cuts the other way.
Why the timing matters
EFF's guidance lands three weeks after the Supreme Court reshaped the surrounding liability landscape. In Cox Communications v. Sony Music Entertainment, decided unanimously on March 25, 2026, Justice Thomas wrote that a company 'is not liable as a copyright infringer for merely providing a service to the general public with knowledge that it will be used by some to infringe copyrights.' As Holland & Knight noted, the Court reframed the DMCA as creating 'defenses from liability' rather than new duties — a meaningful signal that courts will not casually deputize intermediaries as copyright police.
That ruling matters most for operators who can't reach the safe harbor. The repeat-infringer requirement remains the sharpest hook: in BMG v. Cox (4th Cir. 2018), Cox lost its safe harbor and faced a $1 billion verdict precisely because, as EFF documented, it had not meaningfully enforced its stated termination policy. A fediverse host without a real repeat-infringer policy is exposed in the same way. EFF's guide is, in effect, a map for staying inside the harbor and a reminder that — even outside it — Cox v. Sony now makes mere knowledge insufficient for contributory liability.
The policy lesson
The fediverse is small — Mastodon's monthly active users have hovered under a million, against a broader fediverse of roughly 11 million total accounts — but it is the clearest live test of whether US law still makes room for non-corporate infrastructure. Section 512's answer, twenty-eight years on, is yes: the same three obligations bind everyone, and the entry fee is $6. Lawmakers tempted to 'modernize' the DMCA with filtering mandates should study EFF's checklist first. The reason a volunteer can run a public square at all is that the rules were written to be cheap to follow. Keep them that way.