Doe v. GitHub: the Ninth Circuit affirms dismissal of DMCA section 1202(b) claims over Copilot output

What the court decided

Judge Eric D. Miller wrote the published opinion for a panel that included Judge Sidney R. Thomas and District Judge Stanley Blumenfeld, Jr., sitting by designation. The case was argued on February 11, 2026, and the opinion was filed on September 16, 2026. It reached the Ninth Circuit as an interlocutory appeal under 28 U.S.C. § 1292(b) from Judge Jon S. Tigar's order in the Northern District of California, No. 4:22-cv-06823-JST.

The panel held that the plaintiffs adequately alleged Article III standing at the pleading stage, but that they do not state a claim under 17 U.S.C. § 1202(b), the Digital Millennium Copyright Act provision that bars removing or altering copyright management information, or CMI. It affirmed the dismissal of the DMCA claim.

The claims

The plaintiffs are programmers who published code on public GitHub repositories under open-source licenses, many of which require attribution. They filed a putative class action against GitHub, Microsoft, and OpenAI over GitHub Copilot and OpenAI's Codex, tools built on large language models trained on public code. According to the opinion, after two rounds of dismissals and amendments the complaint was down to one DMCA claim and two breach-of-contract claims.

The DMCA claim rests on the allegation that Copilot sometimes produces "identical copies of code Copilot was trained on" without the attribution, copyright notices, or license terms that came with the code. The district court dismissed that claim with prejudice, reasoning that section 1202(b) claims require identical copies, and it certified the question "whether Sections 1202(b)(1) and (b)(3) of the DMCA impose an identicality requirement." The district court denied the motion to dismiss the contract claims, which remain pending.

Standing: a plausible substantial risk was enough

The defendants argued that any risk Copilot would reproduce these plaintiffs' code, rather than someone else's, was conjecture. The panel disagreed. It pointed to what the complaint alleges and cites: academic research on models emitting memorized training data, a GitHub duplicate-detection feature that lets users block suggestions matching public code in verbatim snippets of 150 characters or more, and examples of Copilot reproducing portions of the named plaintiffs' code verbatim. The court said those allegations "make it plausible that plaintiffs face a substantial risk, and that is enough to survive a motion to dismiss," while noting that at summary judgment the plaintiffs would need evidence.

The training theory was forfeited

On appeal the plaintiffs also argued that the defendants removed CMI when they fed code into training, which the court called the "input" theory. The panel declined to consider it. The district court had said the "complaint is not about training. It just isn't," and the plaintiffs never told the court it had misread their claim. So the Ninth Circuit did not decide whether stripping CMI from training data violates section 1202(b).

The output theory failed on the statute's text

On the merits, the court wrote: "The complaint describes an AI tool that does not look up and reproduce stored work but rather creates new work." The words "remove" and "alter" imply an act on CMI attached to a work that already exists, and "One who creates a new work and fails to include CMI cannot be said to have 'removed' or 'altered' anything." The statutory definition points the same way: CMI is "information conveyed in connection with copies . . . of a work."

The court then addressed the district court's "identicality" rule. It said the DMCA "does not require literal identicality between the plaintiff's work and the allegedly infringing work," and that identicality "is best understood as a gloss on the statutory terms 'remove,' 'alter,' and 'copies' rather than an independent (and atextual) element of a section 1202(b) claim." Comparing works is evidence. A copy that matches the original except for the missing CMI supports an inference of removal, as in Friedman v. Live Nation Merchandise, Inc. (9th Cir. 2016), and "Minor cosmetic changes will not necessarily protect a defendant who substantially or entirely reproduces the protected work and removes CMI." Material differences, on the other hand, may suggest a new derivative work that never carried the plaintiff's CMI.

Applying that test, the court held the plaintiffs had not alleged removal of CMI from a copy of their work, even a slightly altered one. It contrasted Copilot with a search engine that retrieves stored copies: "If Copilot functioned like a search engine and produced outputs that were identical to plaintiffs' code but did not contain CMI, then plaintiffs might have a stronger claim that Copilot had removed their CMI. But that is not what plaintiffs have alleged."

The court was explicit about what it did not decide: "We express no view on whether that similarity would allow plaintiffs to assert a claim for copyright infringement." It noted that the DMCA permits statutory damages of up to $25,000 per violation and declined "to transform run-of-the-mill copyright-infringement claims into DMCA claims."

What it means for code owners and AI developers

In the Ninth Circuit, a CMI claim aimed at AI output needs facts showing that CMI was removed or altered from a copy of the owner's work. In the court's words, "merely alleging that a similar or derivative work does not include the CMI, without facts showing its removal or alteration, is insufficient." The opinion leaves open whether removing CMI at the training stage violates section 1202(b) and whether Copilot's output infringes copyright, and the license-based contract claims remain before Judge Tigar.