DKYC: Sony Music Leisure v. Cox Communications and the Finish of Significant Secondary Legal responsibility for Web Service Suppliers
On March 25, 2026, the Supreme Courtroom handed down its determination in Cox Communications, Inc. v. Sony Music Leisure, No. 24-171, reversing a billion-dollar jury verdict in opposition to Cox, one of many nation’s largest web service suppliers. The bulk opinion, written by Justice Thomas, held that merely offering web service to subscribers identified to be engaged in copyright infringement doesn’t give rise to contributory copyright legal responsibility. The choice is a seismic shift in copyright legislation—one which for no good motive successfully immunizes ISPs from secondary legal responsibility, renders the DMCA’s already absurd protected harbor provisions meaningless, and ignores the fact that ISPs have each the flexibility and the duty to deal with repeat infringement on their networks.
The details of the case weren’t sympathetic to Cox. Over a roughly two-year interval, copyright holders despatched Cox 163,148 notices figuring out IP addresses on its community related to infringement. Cox’s response was, to place it charitably, tepid at finest. Throughout all the claims interval, Cox terminated solely 32 subscribers for copyright infringement—whereas terminating a whole bunch of 1000’s for nonpayment. You get the concept. There’s a sample creating. The one factor I’d prefer to have seen is what number of card carrying members of the EFF had been employed at Cox.
Inner communications revealed that Cox workers had been pissed off by the amount of notices and reluctant to behave on them, preferring to guard subscriber income. Ya assume? A jury discovered Cox chargeable for each contributory and vicarious copyright infringement, discovered the infringement willful, and awarded $1 billion in statutory damages. The Fourth Circuit affirmed on contributory legal responsibility, and the Supreme Courtroom took the case.
Now it have to be stated that seems like some huge cash, however contemplate that the maximums for willful infringement had been set in 1999 to discourage CD ripping. Simply sayin.
The Majority’s Framework: Data Is By no means Sufficient
Justice Thomas’s majority opinion held that contributory copyright legal responsibility can come up in solely two methods. First, beneath the inducement principle from MGM Studios, Inc. v. Grokster, Ltd., a supplier might be liable if it actively inspired infringement via affirmative acts comparable to promotion and advertising and marketing. Second, beneath the framework of Sony Corp. v. Common Metropolis Studios (the sainted Betamax case), a supplier might be liable if its services or products is “not able to ‘substantial’ or ‘commercially vital’ noninfringing makes use of”. (a phrase I might dwell with out ever listening to once more). As a result of Cox didn’t actively induce infringement and since web service plainly has substantial lawful makes use of, the bulk concluded that Cox couldn’t be held liable—full cease. So suck on that, Hollywood.
The bulk’s central premise is that “mere information” of infringement is inadequate to determine contributory legal responsibility. However this framing basically mischaracterizes what occurred right here; there was nothing “mere” about it. Cox didn’t possess some generalized consciousness that just a few of its tens of millions of subscribers is perhaps infringing copyrights. Cox acquired 163,148 particular notices figuring out particular IP addresses—addresses that Cox might and did hint to particular subscriber accounts. There’s a world of distinction between realizing that some customers of a general-purpose product may infringe and receiving repeated, individualized, documented discover that specific accounts are getting used for ongoing infringement which was the entire concept behind DMCA notices, children. The bulk collapses that distinction completely.
The Willful Blindness Downside the Courtroom Ignored
Maybe essentially the most troubling facet of each the bulk opinion and Justice Sotomayor’s concurrence—which agreed within the outcome however not the reasoning—is the remedy of Cox’s claimed ignorance about which particular person at a given IP handle dedicated infringement. The bulk notes that ISPs “have restricted information about how their Web providers are used and who makes use of them” and that they “can’t distinguish one particular person person from one other.” Justice Sotomayor equally emphasizes that “Cox doesn’t truly know that particular customers will commit infringement utilizing Cox’s community” as a result of notices establish solely the connection, not the person. Properly, OK Boomer, that’s incorrect.
However don’t you assume this confuses doesn’t know with has structured its enterprise in order to not know? In just about each different regulated context, an organization that intentionally avoids studying about its clients’ identities or actions to insulate itself from legal responsibility faces extra scrutiny, not much less, except someone snuck in a “Don’t Know Your Buyer” rule on me someplace. The doctrine of willful blindness exists exactly for this example—the place a celebration takes deliberate steps to keep away from confirming details it strongly suspects to be true. There’s no DKYC rule for banks, for instance. Banks can’t keep away from anti-money-laundering obligations by selecting to not monitor transactions. Pharmaceutical distributors can’t keep away from legal responsibility for fueling the opioid disaster by selecting to not monitor suspicious orders. But the Supreme Courtroom has now instructed ISPs that they will keep away from copyright legal responsibility by selecting to not establish which of their subscribers are answerable for repeated, documented infringement—even after they maintain the subscriber’s title, billing handle, and cost info.
Cox knew which subscriber account was related to every flagged IP handle. It had contractual phrases prohibiting subscribers from utilizing the service “to publish, copy, transmit, or disseminate any content material that infringes the patents, copyrights . . . or proprietary rights of any social gathering.” It selected to not implement these phrases in any significant method. That’s not ignorance. That may be a enterprise determination to revenue from infringement whereas sustaining believable deniability. Mrs. Palsgraf may say that’s fairly foreseeable.
The Multi-Consumer IP Deal with Purple Herring
Justice Sotomayor’s concurrence leans closely on the situation of a espresso store, dormitory, or regional ISP the place many customers share a single connection, arguing that Cox can’t know which particular person dedicated the infringement. It is a truthful level in these particular, slim contexts. Nevertheless it doesn’t describe the everyday residential broadband subscriber, which constitutes the overwhelming majority of Cox’s buyer base. For a single-family house, Cox is aware of the account holder. It has their title, their handle, and their bank card quantity. Even Sotomayor acknowledges that after three notices, Cox “would know solely that that house’s connection is considerably sure for use once more sooner or later to commit infringement.” The concurrence then dismisses this by noting Cox wouldn’t know which family member is accountable—however that is the incorrect query. The account holder agreed to Cox’s phrases of service. The account holder is answerable for the exercise on their connection. Utilizing edge instances involving army bases and universities to craft a rule that immunizes particular person residential accounts is permitting the toughest instances to swallow the simple ones.
The DMCA Protected Harbor: A Statutory Cut price the Courtroom Simply Voided
The strongest critique of the bulk opinion—and the one Justice Sotomayor presses most forcefully—considerations the DMCA’s protected harbor provisions. Congress enacted 17 U.S.C. § 512(i)(1)(A) to require ISPs to undertake and fairly implement “a coverage that gives for the termination in applicable circumstances of subscribers and account holders” who “are repeated infringers.” This was a deal: take cheap steps to deal with repeat infringement, and also you get safety from secondary legal responsibility.
The bulk’s response to this argument is remarkably skinny. It says the DMCA “doesn’t expressly impose legal responsibility” however “merely creates new defenses from legal responsibility,” and factors to § 512(l), which supplies that failure to qualify for the protected harbor “shall not bear adversely upon” a service supplier’s protection. However this studying renders all the protected harbor incoherent. Why would Congress create an elaborate incentive construction—requiring ISPs to undertake repeat-infringer insurance policies, implement notice-and-takedown procedures, and designate brokers—if ISPs confronted no lifelike prospect of legal responsibility within the first place? As Sotomayor observes, and as Cox’s personal counsel conceded at oral argument, the protected harbor won’t “d[o] something in any respect” going ahead beneath the bulk’s rule.
The canon in opposition to surplusage calls for that courts give impact to each clause and phrase of a statute. Congress selected to not grant ISPs blanket immunity from secondary copyright legal responsibility. It selected a conditional protected harbor, which essentially presupposes that there’s something to be “protected” from. If the bulk is true that ISPs offering common web service can by no means face contributory legal responsibility, then Congress enacted a meaningless provision. That’s not statutory interpretation. It’s statutory nullification, the proverbial lifeless letter.
If You Wish to See This Executed Proper, Have a look at Greater Schooling
The irony of the Courtroom’s determination is that we have already got a working mannequin of ISPs being required to police their networks for copyright infringement—and it really works. The Greater Schooling Alternative Act of 2008 requires schools and universities receiving federal monetary assist to develop and implement plans to “successfully fight the unauthorized distribution of copyrighted materials” on their campus networks. Establishments should use “quite a lot of technology-based deterrents” and supply annual disclosures to college students about copyright legislation and institutional insurance policies.
Universities—establishments that face precisely the sort of multi-user, shared-IP-address challenges that Sotomayor’s concurrence treats as insurmountable—have been complying with these necessities for practically 20 years. They use bandwidth administration instruments, deep packet inspection, and graduated response methods to establish and handle infringing exercise. They terminate community entry for repeat infringers. They usually accomplish that whereas nonetheless offering web service to tens of millions of scholars, college, and workers engaged in overwhelmingly lawful exercise.
If a college can establish and handle repeat infringement on a campus community serving tens of 1000’s of customers who share IP addresses, rotate units, and use VPNs, it strains credulity to counsel that Cox Communications—an organization with the subscriber’s title, house handle, and billing info—merely can’t do the identical. The distinction isn’t functionality. The distinction is that universities are required by statute to attempt, and ISPs, after this determination, usually are not.
The Discover Futility Downside
Your entire structure of the DMCA contemplates a system by which copyright holders ship notices, ISPs obtain and act on them, and ISPs that accomplish that responsibly obtain protected harbor safety. That was the deal. If an ISP that receives over 163,000 notices in two years faces no legal responsibility no matter whether or not it acts on them, what’s the objective of the discover regime? The bulk’s rule tells copyright holders that notices are a lifeless letter—ISPs could obtain them, could ignore them, and can face no penalties both method.
Sotomayor is true that almost all’s rule “permits ISPs to promote an web connection to each single infringer who desires one with out worry of legal responsibility and with out lifting a finger to forestall infringement,” and that “Cox is free to desert its present coverage of responding to copyright infringement.” The bulk provides no significant response to this consequence as a result of there’s none obtainable inside its framework.
What Comes Subsequent
The Courtroom’s determination in Cox Communications is a present to ISPs and a blow to copyright holders, but it surely might not be the final phrase. Justice Sotomayor’s concurrence expressly leaves open the chance that Congress might act to shut the hole the bulk has created—and, certainly, Congress has each motive to take action. The Greater Schooling Act demonstrates that statutory necessities to police networks for infringement are each workable and efficient. There is no such thing as a principled motive why an analogous obligation couldn’t be prolonged to business ISPs, notably people who obtain particular, individualized discover of repeat infringement at recognized accounts.
Within the meantime, the choice creates a perverse set of incentives. ISPs now have each motive to dismantle their repeat-infringer insurance policies, ignore copyright notices, and do as little as attainable—as a result of the Supreme Courtroom has instructed them that none of it issues. The DMCA’s fastidiously calibrated cut price between copyright holders and repair suppliers has been rendered a lifeless letter. It will likely be as much as Congress to revive it—or to acknowledge that the Courtroom has, in impact, granted ISPs the blanket immunity that the DMCA’s drafters intentionally selected to not present.
