Any website that allows users to post or upload images, audio, video, or text content may be concerned about being liable for illegal content such as copyright infringement, illegal porn, or other illegal content. This affects website owners, internet service providers, SaaS companies, social media, and hosting companies. Fortunately, there is a relatively easy way to avoid liability – even if illegal material gets hosted through your website.

Protecting Yourself under DMCA Safe Harbor Rule

In 1998, Congress passed the On-Line Copyright Infringement Liability Limitation Act (OCILLA) in an effort to protect Interest service providers from liability for the activities of its users. Codified as section 512 of the Digital Millennium Copyright Act (DMCA), the law exempts on-line service providers that meet certain requirements from claims of copyright infringement made against them resulting from the conduct of their customers. If a service provider qualifies for the safe harbor exemption, only the individual infringing is liable for monetary damages; the service provider’s network that was used for the infringing activity is not liable. There are two safe-harbor provisions within the DMCA that potentially apply to online publishing activities. Both of these require that certain criteria are met.

Requirements for Protection

The first safe-harbor provision relates to materials posted to your blog or website at the direction of a user. This safe-harbor provision is found in section 512(c), and it states that, as the administrator of a website or other service, you will not be held liable for money damagesfor infringing content posted “at the direction of a user.” This could include a file (e.g., a photograph, a film clip, an audio file) that a user posts to a comment section on your site or to a forum thread. There are many other possible examples but the key factor is that the material was posted by a user.

The second safe-harbor provision relates to links you post to other online material located elsewhere. This safe-harbor provision is found in section 512(d), and it states that an online service provider will not be held liable for money damages “for infringement of copyright by reason of the provider referring or linking users to an online location containing infringing material or infringing activity, by using information location tools, including a directory, index, reference, pointer, or hypertext link.” (emphasis added). If you linked to material without knowing that it infringed copyright, the section relives you of liability.

Both of these provisions also require that certain other criteria are also met in order for safe-harbor to be in effective. These include:

  • The service providers lacks actual knowledge of the infringing material hosted or posted on its system or network.
  • In the absence of actual knowledge, the service provider is not aware of facts or circumstances from which infringing activity is apparent.
  • Where the service provider has the right and ability to control the infringing activity, it must not derive a financial benefit directly attributable to that activity.
  • Upon receiving proper notification of claimed infringement, the service provider must act “expeditiously” to remove or block access to material.
  • The service provider must designate an agent to receive notifications of claimed infringement. The contact information for this agent must be filed with the Register of Copyrights and also be displayed to the public on the service provider’s website.
  • Service provider must publish a statement on the site giving notice to users of the service provider’s DMCA agent’s contact information and its policies regarding copyright infringement and the consequences of repeated infringing activity.

These last three requirements are further discussed below.

Designating a Proper Agent

The owner of the website is required to designate an agent to receive copyright infringement notifications. Since December 1, 2016, designating a proper agent under 37 C.F.R. § 201.38 requires the service provider to:

  1. Register the agent’s information electronically with the United States Copyright Office. Paper filings are no longer accepted.
  2. Display the same information on the web site on a page accessible to the public.
  3. Keep the registration current, updating it whenever the information changes, and renew the designation at least once every three years. A designation that is not renewed expires and becomes invalid.

The registration and the public posting must contain the agent’s full legal name, physical street address, phone number, and electronic mail address, any alternate names the public would reasonably use to search for the service provider, and other contact information the Register of Copyrights deems appropriate. A pre-2016 paper designation that was not re-filed electronically expired and became invalid after December 31, 2017. A service provider relying on an outdated or unrenewed designation has no valid designation, and no safe harbor, under 17 U.S.C. § 512(c).

In order to qualify for the safe harbor protections, you must publish a statement on the site giving notice to users of your DMCA agent’s contact information and the policies regarding copyright infringement and the consequences of repeated infringing activity. The notice can be a part of the website’s terms of use or some other notice displayed prominently on the site. The statement should explain that you respond expeditiously to notices of claimed copyright infringement and terminate users or account holders who are “repeat infringers.” A service provider might also consider detailing the proper form for a notice of claimed infringement, as discussed below.

Eligibility for the safe harbor does not depend solely on whether a copyright owner has sent a notice. A service provider can lose the safe harbor by having actual knowledge or red-flag awareness of infringing material, or by failing to maintain a repeat-infringer policy, whether or not any notice is ever sent. A copyright owner may also submit a “Proper notification,” or take-down notice, identifying material claimed to be infringing. Such notification is defined in the statute as a copyright owner providing:

  1. A physical or electronic signature (i.e., /s/NAME) of a person authorized to act on behalf of the owner of the copyright that is allegedly infringed.
  2. Identification of the copyrighted work claimed to have been infringed.
  3. Identification of the material that is claimed to be infringing and information reasonably sufficient to permit the service provider to locate the material.
  4. Information reasonably sufficient to permit the service provider to contact the complaining party, such as an address, telephone number, and, if available, an electronic mail address at which the complaining party may be contacted.
  5. A statement that the complaining party has a good faith belief that use of the material in the manner complained of is not authorized by the copyright owner.
  6. A statement that the information in the notification is accurate, and under penalty of perjury, that the complaining party is authorized to act on behalf of the owner of the copyright that is allegedly infringed.

Keep in mind that even if they fail to send a completely formal DMCA notification, it may be in your best interest to immediately respond to a simple polite email. Upon receiving a compliant notification, the service provider must act expeditiously to remove or disable access to the infringing material in order to retain the safe harbor. Receipt of the notice does not itself end the safe harbor; failing to act expeditiously does.

Embedded YouTube Video

One of the most common questions website owners encounter concerns embedding YouTube videos on their website. This is actually, for the most part, completely acceptable and legal. The current YouTube Terms of Service, in the section titled “Rights you Grant – License to Other Users,” state:

You also grant each other user of the Service a worldwide, non-exclusive, royalty-free license to access your Content through the Service, and to use that Content, including to reproduce, distribute, prepare derivative works, display, and perform it, only as enabled by a feature of the Service (such as video playback or embeds). For clarity, this license does not grant any rights or permissions for a user to make use of your Content independent of the Service. – YouTube Terms of Service, “Rights you Grant – License to Other Users” (effective December 15, 2023)

This license means the uploader automatically grants you a limited license to embed the video on your site through the Service’s embed feature, but it grants no rights to use the content independent of the Service.

Original YouTube Uploader Infringing

There is still however, a problem if the person that uploaded the video to youTube was copyright infringing. In such a case, that person had no legal position to give out a license. Thus, by embedding their youTube video you are also copyright infringing.

This sounds worse than it is though. While you are technically committing copyright infringement in such a situation, so are youTube and the original uploader. Anyone trying to enforce their rights would almost certainly go after youTube or the uploader first. More importantly, the DMCA’s safe harbor protection will still provide you protection – so long as you actually take the infringing material down once notified. Of course, they are

DMCA Protection Applying for YouTube Videos

The technical point to keep in mind is that an embedded video is just a link. If you are just embedding a youTube video, there is no copy of the video being stored on your server, just the HTML code for the embed video. Therefore, you can still claim the protection of the safe harbor found in 17 U.S.C. § 512(d), discussed above.