Background
Programmers who published copyrighted open-source code in public GitHub repositories brought a putative class action against GitHub, Microsoft, and OpenAI. They alleged that GitHub Copilot and OpenAI Codex, which were trained on public GitHub code, sometimes generated verbatim, near-verbatim, or modified versions of their code without the accompanying attribution, copyright notices, and license terms.
After earlier amendments and dismissals, the district court dismissed the plaintiffs’ Digital Millennium Copyright Act claim with prejudice under Rule 12(b)(6), while allowing two contract claims to remain pending. It certified the DMCA ruling for interlocutory appeal under 28 U.S.C. § 1292(b).
The Court’s Holding
The Ninth Circuit held that the plaintiffs plausibly alleged Article III standing. Their complaint alleged a substantial risk that Copilot would reproduce their code without attribution, supported by examples involving named plaintiffs’ code, research on model memorization, and GitHub’s duplicate-detection feature.
But the court affirmed dismissal of the DMCA claim. Section 1202(b) requires the removal or alteration of copyright management information from a copy of an existing protected work. Plaintiffs’ output theory instead described Copilot and Codex as generating new works through a probabilistic process, even when an output may resemble or reproduce training-data code. Failing to include attribution in a new work is not, without more, removal or alteration of information attached to an existing copy. The court also declined to consider the plaintiffs’ separate training-stage “input” theory because they forfeited it in the district court.
Key Takeaways
- A plaintiff may establish standing at the pleading stage by plausibly alleging a substantial risk that an AI tool will reproduce the plaintiff’s code without attribution.
- DMCA liability under Section 1202(b) requires removal or alteration of copyright management information from an existing copy; omission alone is insufficient.
- Literal identity is not an independent DMCA requirement, but similarity between works may help show that copyright management information was removed from a copied work.
Why It Matters
The decision draws a line between a DMCA claim based on stripping attribution from an existing copy and a traditional copyright claim based on allegedly infringing AI-generated output. AI output that is substantially similar to protected code may raise other copyright issues, but it does not state a Section 1202(b) claim merely because it lacks attribution.