A narrow statute, tested against a big theory
On September 16, 2026, the Ninth Circuit affirmed dismissal of the core copyright claims in Doe v. GitHub, Inc., No. 24-7700 — a case that began in 2022 when anonymous programmers sued GitHub, Microsoft, and OpenAI over how GitHub Copilot and Codex were trained on public repositories (Gibson Dunn). The plaintiffs' theory under Section 1202(b) of the Digital Millennium Copyright Act was that because Copilot's suggestions could echo their code without reproducing the author's name, license terms, or copyright notice, the tool had unlawfully "removed" that copyright management information (CMI).
The panel didn't buy it. As Gibson Dunn's client alert on the ruling summarizes, the court found that Copilot and Codex "simply generated new code that never contained CMI, rather than removing or altering CMI from copies of the plaintiffs' existing code" — and Section 1202(b) requires an affirmative act of stripping information from an existing copy, not the absence of information in a new one. That distinction is not a technicality. Reporting on the case has noted the plaintiffs' exposure theory ran into the billions given the DMCA's per-violation statutory damages, compared with ordinary copyright's per-work cap — a gap that made §1202 an attractive vehicle for claims that traditional infringement law couldn't easily support (ppc.land).
The steelman: CMI protects a real interest
Before dismissing the plaintiffs' theory, it's worth taking their underlying concern seriously. Copyright management information exists so that downstream users — a company deciding whether it's safe to ship code, an academic tracing provenance, a court weighing willfulness — can identify who wrote something and on what terms. Open-source licenses like the GPL or MIT license are enforceable because attribution and notice travel with the code. If a widely used tool could launder that information away at scale simply by outputting stylistically similar code, the practical effect on license enforcement could be corrosive even without a single line being copied verbatim. Programmers who release code expecting attribution have a legitimate interest the DMCA was partly written to protect, and it's reasonable to ask whether generative tools should get a pass just because the mechanism of loss is generation rather than deletion.
Why the court's line still makes sense
But the Ninth Circuit's holding tracks the statute's actual text rather than its broadest plausible purpose. Section 1202(b) prohibits removing or altering CMI "knowing" it will conceal infringement — language that presupposes an existing copy with CMI attached, from which something is then stripped. As the Electronic Frontier Foundation argued in its amicus effort and detailed in its post-ruling analysis, accepting the plaintiffs' theory "would have created a brand-new source of liability for otherwise perfectly lawful activities" — remixing, classroom adaptation, reverse engineering, and search indexing all routinely produce outputs that lack the CMI of their inputs without doing anything close to what Congress meant by "removal" (EFF). EFF's brief also flagged an equity point worth taking seriously: an expansive §1202 would burden independent developers and small tool-builders who can't absorb prolonged litigation, while large incumbents can — the opposite of what a pro-innovation, evidence-based copyright regime should produce.
Crucially, the ruling doesn't immunize AI companies from copyright law generally. The panel expressly preserved the plaintiffs' breach-of-contract claims tied to open-source license terms, which continue in the Northern District of California before Judge Jon Tigar. If Copilot's training or output genuinely breaches the conditions under which code was licensed, that's a live contract dispute — just not a DMCA one. Traditional infringement claims for verbatim copying also remain a separate, available track. The court simply refused to let §1202 become a strict-liability shortcut around the harder factual questions those other doctrines actually require plaintiffs to prove.
The proportionate reading
This outcome is consistent with the broader institutional response to generative AI's copyright questions, which has favored calibrated inquiry over blunt liability expansion. The U.S. Copyright Office's multi-part AI initiative — a Notice of Inquiry that drew over 10,000 comments, followed by reports on digital replicas, output copyrightability, and (in a still-pending Part 3) generative AI training itself — reflects the same instinct: these are genuinely hard lines to draw, and they deserve statutory and regulatory precision rather than litigants stretching a narrow anti-circumvention provision to cover training-data grievances it wasn't built for (U.S. Copyright Office).
For the AI industry, Doe v. GitHub forecloses one aggressive damages theory but leaves the more defensible ones — contract, and infringement where copying is actually alleged — intact. For open-source maintainers, the message is that license enforcement still has teeth, just through the license itself rather than a repurposed DMCA provision. That's the right allocation: it keeps courts from criminalizing the ordinary behavior of generative tools while preserving the actual bargain — attribution for use — that open-source licensing was built on.