Section 1201 of the Copyright Act makes it unlawful to break a digital lock that controls access to a copyrighted work, and to sell or distribute tools built to break one. Congress added it through the Digital Millennium Copyright Act in 1998. What makes it strange, and what most people get wrong, is that it protects the lock rather than the work behind it: you can violate section 1201 without ever copying, distributing, or performing anything.
That separation is the whole point. Traditional copyright law asks whether you reproduced a work or made a derivative of it. Section 1201 asks a different question, whether you got past the technological measure guarding it. The two inquiries can come out opposite ways in the same case.
Section 1201 is often described as one rule. It is really three, and they cover different conduct:
Note the gap that structure creates. There is no prohibition in 1201 on the act of circumventing a copy control. Congress left that hole deliberately, reasoning that once you have lawful access, whether your subsequent copying is permitted is a question for ordinary infringement law and its fair use defense. The lock on the door is protected. The lock on the filing cabinet inside, once you are lawfully in the room, is not.
Because 1201 stands apart from the exclusive rights in section 106, the defenses that attach to those rights do not automatically travel with it. Fair use under section 107 is a defense to infringement. It is not, on the face of the statute, a general defense to circumvention. The Second Circuit said as much in Universal City Studios v. Corley, 273 F.3d 429 (2d Cir. 2001), the DeCSS case, rejecting both a fair use argument and a First Amendment challenge to the trafficking ban even though computer code is expressive.
Congress’s answer to that gap was not fair use but a set of carve-outs. Sections 1201(d) through (j) create permanent exceptions of narrow scope: nonprofit library review of works before acquisition, reverse engineering for interoperability of an independently created program under 1201(f), good-faith encryption research under 1201(g), protection of personally identifying information under 1201(i), and security testing under 1201(j). Each carries conditions strict enough that practitioners rarely rely on them alone.
The most consequential open question in this area is whether a 1201 plaintiff must connect the circumvention to actual or potential infringement.
In Chamberlain Group v. Skylink Technologies, 381 F.3d 1178 (Fed. Cir. 2004), a garage door opener maker sued a rival that sold a universal remote able to talk to Chamberlain’s rolling-code system. The Federal Circuit held that Chamberlain had to show a nexus between the access gained and the protection copyright actually affords, and refused to read 1201 as creating a free-floating right to control access untethered from infringement. Homeowners had an implied right to open their own garage doors, so nothing infringing followed. The Sixth Circuit reached a related result on different reasoning in Lexmark International v. Static Control Components, 387 F.3d 522 (6th Cir. 2004), holding that a toner cartridge authentication handshake did not “effectively control access” to the program at issue.
The Ninth Circuit went the other way. In MDY Industries v. Blizzard Entertainment, 629 F.3d 928 (9th Cir. 2010), the maker of the Glider bot for World of Warcraft got past Blizzard’s Warden anti-cheat system. The court expressly declined to follow Chamberlain, holding that the text of 1201(a) creates a new anti-circumvention right distinct from infringement, and that adding a nexus requirement would collapse the deliberate structural difference between subsection (a) and subsection (b). Under MDY, no infringement need be shown for an (a)(2) claim at all.
The split is live. Forum matters, and the same product can be lawful in one circuit and not in another.
Congress knew 1201(a)(1) would sweep in conduct nobody meant to punish, so it built in a safety valve. Under 1201(a)(1)(C), the Librarian of Congress, acting on the Register of Copyrights’ recommendation, conducts a rulemaking every three years to exempt classes of works where the ban is causing an adverse effect on noninfringing uses.
The current exemptions issued from the Ninth Triennial Proceeding, effective October 28, 2024, and run until the next cycle in 2027. They cover, among other things, repair and diagnosis of motorized land vehicles, consumer devices, and certain medical and commercial equipment; good-faith security research; text and data mining of literary works and motion pictures by researchers; short film clips used in teaching, criticism, and commentary; and assistive uses for readers with print disabilities.
Two limits matter more than the list itself. First, exemptions expire. Every cycle, proponents must petition again, and renewal is not automatic even if it is usually granted. Second, and more damaging in practice, the Librarian’s authority reaches only 1201(a)(1), the act of circumvention. It cannot touch the trafficking bans. So the rulemaking may lawfully permit you to repair your tractor while leaving it unlawful for anyone to sell you the tool that makes the repair possible. Critics call this the paradox of a right without a means.
Section 1202 is 1201’s quieter neighbor and is increasingly where litigation lands, particularly in disputes over scraped images and AI training data.
CMI means information identifying a work: the title, the author, the copyright owner, terms and conditions of use, and identifying numbers or symbols. It counts whether it sits in a visible credit line, an embedded watermark, or IPTC or EXIF metadata. Section 1202(a) bars knowingly providing or distributing false CMI with intent to induce or conceal infringement. Section 1202(b) bars intentionally removing or altering CMI, or distributing works knowing CMI has been removed.
The scienter bar is high and defendants often win on it. Both prongs of 1202(b) require knowledge or reasonable grounds to know that the removal will “induce, enable, facilitate, or conceal” an infringement. The Ninth Circuit enforced that double-scienter requirement in Stevens v. CoreLogic, 899 F.3d 666 (9th Cir. 2018), where photographers could not show that stripping metadata from real estate listing photos was tied to any specific infringement.
The remedies are why plaintiffs try. Under 1203(c)(3), statutory damages for a 1201 violation run from $200 to $2,500 per act, while a 1202 violation runs from $2,500 to $25,000 per violation, with no registration prerequisite of the kind section 411 imposes on infringement claims. Section 1204 adds criminal liability for willful violations for commercial advantage or private financial gain, up to $500,000 or five years for a first offense.
What is DMCA section 1201 anti-circumvention? Section 1201 of the Copyright Act, added by the Digital Millennium Copyright Act in 1998, makes it unlawful to circumvent a technological measure that controls access to a copyrighted work, and to traffic in tools primarily designed to circumvent access controls or copy controls. It protects the lock rather than the work behind the lock, so a violation can occur even where no copying happens.
Is circumventing DRM illegal if you own the copy? Often yes. Section 1201(a)(1) bans the act of circumventing an access control without regard to who owns the physical copy or disc, and lawful ownership is not a defense. Fair use is a defense to infringement under section 107, not a general defense to circumvention. Relief comes instead from the permanent statutory exceptions in 1201(d) through (j) and from the temporary exemptions the Librarian of Congress grants every three years.
Do you need to prove infringement to win a 1201 claim? The circuits disagree. The Federal Circuit in Chamberlain v. Skylink (2004) required a plaintiff to show a nexus between the circumvention and infringement of a copyright right. The Ninth Circuit in MDY v. Blizzard (2010) expressly declined to follow that reading and held that 1201(a) creates a new, independent right to control access. Which court hears the case can decide the outcome.
What is copyright management information under section 1202? CMI is identifying information conveyed with a work: title, author, copyright owner, terms of use, and identifying numbers or symbols, including material in a digital watermark or metadata. Section 1202(b) bars intentionally removing or altering CMI, and 1202(a) bars knowingly providing false CMI. Statutory damages run from $2,500 to $25,000 per violation under 1203(c)(3)(B).
Going further: How a DMCA takedown notice works, step by step .
This page is general legal information, not legal advice, and it does not create an attorney-client relationship.
The Third Circuit held a photographer's printed gutter credit is copyright management information, so DMCA Section 1202 reaches ordinary credits too.
The Ninth Circuit held a Section 1202(b) plaintiff must prove the defendant knew stripping copyright metadata would likely induce or conceal infringement.
Judge Rakoff let The Intercept's DMCA § 1202(b)(1) copyright-management-information claim against OpenAI survive dismissal while tossing the § 1202(b)(3) claim, splitting from Raw Story v. OpenAI on standing and reshaping CMI litigation in AI-training cases.
How the Second Circuit upheld the DMCA's anti-trafficking ban against a DeCSS publisher, holding that computer code is speech but its functional distribution can still be regulated.
A cryptographer and a hardware hacker argued that the DMCA's anti-circumvention rules censor lawful research and tinkering; the D.C. Circuit held that § 1201 regulates conduct and survives the First Amendment.
The Ninth Circuit split the DMCA's anti-circumvention provisions in two, holding that § 1201(a) protects access independently of infringement, and that a World of Warcraft cheat maker violated it.
The Federal Circuit refused to let a copyright owner use § 1201 as a tool to lock out an aftermarket competitor, holding that anti-circumvention liability requires a nexus to actual copyright infringement.
