DMCA - Digital Millennium Copyright Act

If your website or mobile app allows users from the U.S. to post content, you need to be in compliance with the DMCA as it exists now.

It will likely undergo reform at some point, but until then, there are requirements you need to follow to avoid defending copyright infringement claims.

Here's how to comply with the DMCA requirements and protect your business interests.

What is the DMCA

The DMCA (Digital Millennium Copyright Act) is an American copyright law enacted in 1998. It implemented two World Intellectual Property Organization treaties that criminalized services and products designed to circumvent digital copyright protection measures.

The first section addressed this issue and the intention was to protect the new digital media of that time.

The second section affects service providers, including developers like you who offer online services and apps. Called the "safe harbor" provisions, it allows you to avoid copyright infringement liability if you follow certain procedures.

These "notice and takedown" requirements give users a means to bring copyright infringement to your attention so you can address the matter accordingly by asking the alleged infringer to change the content or take it down.

If that user does not comply, you are allowed to remove the material and revoke that user's membership to your site or app if there are repeated violations.

Users who receive a notice of copyright infringement can challenge it with a counter notice. If they take this step, then you cannot remove the material.

Your next step is to send the counter notice to the original complainant. If they disagree with the counter notice, they can pursue damages for copyright infringement in civil court.

However, as the service provider, you are protected from liability in these proceedings because you provided the notice process.

Who must comply with DMCA

The safe harbor provisions apply to online service providers.

This broad term applies to any company or developer who supplies a service on the Internet. It includes email, news, music, and entertainment providers.

If you have an Internet service that allows users to display content, you need to have a DMCA policy.

This does not apply if you merely have an Internet presence.

For example, a law firm with a website that only discusses the firm and does not sign up users or give them a means to present content does not need to have a DMCA policy. You have to provide an online service and that does not include merely maintaining a website.

How to comply with DMCA

The DMCA should be addressed in two ways.

One, in your Terms of Service (TOS) or Terms and Conditions (T&C).

Clauses that explain your DMCA policies will allow transparency but also offer instructions on copyright notices and counter notices.

Second, you should also consider forms or at least a detailed instruction page on how to file a notice and takedown should someone feel their copyright ownership has been violated.

In your Terms & Conditions

Detail varies between companies. GitHub makes a very short and sweet reference in its Terms of Service:

However, it makes up for this by posting several pages explaining the DMCA. The same pages also move to detailed descriptions on how to submit a notice as well as submitting counter notices.

While the Terms of Service of GitHub does not discuss the DMCA in detail, it is apparent with all the other website content, that GitHub is compliant with the law.

Companies that face a high risk of DMCA violations may take a more detailed approach.

YouTube is basically a free-for-all video sharing service where copyright violations are always possible.

In fact, it faced legal action under the DMCA for the mere existence of its service. Even when lawsuits turn out in favor for YouTube, those efforts are often time consuming and expensive.

It is understandable then why YouTube has a detailed section in its Terms of Service agreement regarding the DMCA:

In addition to this description in the Terms of Service, it also has a clear process for submitting a takedown notice that leaves users no doubt as to how to address an infringement:

Tumblr offers a similar type of anarchy in its platform where users can post nearly everything and the risk of copyright infringement is high. Like YouTube, it also offers a detailed description in its Terms of Service page:

The Terms of Service of Tumblr also includes a description regarding counter notices. This likely due to the free exchange platform being vulnerable to false claims:

One thing to note with YouTube and Tumblr is that they offer multiple ways to contact them regarding copyright infringement. A mailing address, email, and even fax number is made available. There are also direct links to the forms for making complaints.

Making this easy for users or third parties who find their content misused on your service makes it more apparent that you satisfied your requirements under the DMCA.

Forms provided to users

Not all companies offer forms but in the very least, they give a structure for notice and takedown requests.

GitHub is form dependent, as we discussed earlier. It offers a very clear opportunity to present a notice and takedown:

YouTube offers a similar approach that walks users through each step of the notice. Click on "Submit a Copyright Complaint" and it takes you through a series of questions:

In addition to the form, GitHub also offers instructions on how to reach them via email regarding copyright complaints:

Websites do not appear to provide forms for counter complaints. There are descriptions on how to file one, although on some websites, that information is lacking. That may be because the instructions are provided to the users with a copy of the notice and takedown, but some companies, like GitHub, also explain how to reach them via email with a counter notice:

There is also the option with the notice and takedown to bypass forms and only provide clear instructions.

Pandora provides instructions and contact information for notice and takedown reports and counter notices:

There are no requirements regarding whether you provide forms or just detailed instructions on emailing this information. You mainly are required to offer the means to submit notice and allow counter notices.

That said, there are best practices to assure you comply with the DMCA.

DMCA compliance best practices

The primary component for complying with the DMCA is how well you explain the notice process to your users and those who may feel their copyright protection was violated on your site. Good explanations increase accessibility to your process which is important for managing these instances.

Follow this checklist to implement best practices for DMCA compliance:

1. Communicate your process clearly.

Even if your users accepted your Terms of Service, that does not hold a third party who found their copyrighted material on your service.

Not everyone who makes that discovery is one of your registered users. In addition to having a DMCA policy in your legal agreements, also make it accessible in a website section.

Include links to your DMCA policy and instructions for sending a notice. You do not only want these policies available to your users but to anyone who happens to be surfing the web.

2. Provide multiple links.

Link to your DMCA policy from the Terms of Service agreement, any copyright-related FAQs or wherever else someone may arrive to by mistake while seeking your DMCA-related material.

This not only increases accessibility but also allows transparency. If you offer a higher-risk service like YouTube does, consider making the link conspicuous on your front page.

3. Provide complete contact information.

A mailing address, email, fax number or any other type of contact information that will allow copyright notices to be processed efficiently should be provided.

Consider setting up a separate email for DMCA purposes to assure quick handling of notices like 500px does in its Terms of Service:

4. Help users give a complete report.

The notice and takedown should include the name of the copyright owner or their representative, the work allegedly infringed, links to work that should be taken down, any current licenses, and any alternatives to removal, like changes that user can make. Have the user sign their full name to make the document legally binding.

You can either offer this structure for an email or make it an interactive form that asks these questions like Dropbox does in its DMCA policy page:

5. Prevent perjury - or at least the appearance of it.

False reports are actionable under the DMCA. In order to further protect your interests ask your users to end the report with a statement that resemble the following:

"I have a good faith belief that use of the copyrighted materials described above on the infringing web pages is not authorized by the copyright owner, or its agent, or the law. I have taken fair use into consideration" and "I swear, under penalty of perjury, that the information in this notification is accurate and that I am the copyright owner, or am authorized to act on behalf of the owner, of an exclusive right that is allegedly infringed."

This way, if the report is false, it shows you accepted it in good faith.

6. Consider click-wrap regarding your DMCA policy.

If you have a form, consider that the complainant acknowledge your DMCA policy before allowing submission.

This could be as easy a check box indicating,

"I have read the DMCA policy and understand and accept those terms."

The DMCA has stringent requirements but is flexible on how you meet them.

Find policies that consider the risk of your services and corporate comfort level in addressing them, and you will likely find a reliable way to successfully address DMCA notice and takedown requests.