The Ninth Circuit did not rule that generative AI is free to copy copyrighted code and strip away attribution.
In its September 16, 2026 published opinion in Doe v. GitHub, Inc., the court affirmed dismissal of one Digital Millennium Copyright Act theory against GitHub, Microsoft and OpenAI. The programmers had alleged that GitHub Copilot and OpenAI’s Codex could reproduce code without the copyright-management information, or CMI, that accompanied the source material. Under the plaintiffs’ own description of how the systems worked, however, the court concluded that the output was generated as a new work that never contained the original CMI, rather than as an existing copy from which CMI had been "removed" or "altered." The Ninth Circuit’s published opinion is precedential within the circuit on the question it decided.
But the ruling is substantially narrower than "AI can remove attribution."
The panel did not adopt a literal-identicality rule. It said two works need not be perfectly identical for Section 1202 liability, and minor cosmetic changes do not automatically defeat a claim. It did not decide the separate training-stage theory that defendants stripped CMI from source material before or during training, because the plaintiffs had forfeited that theory below. It expressly declined to decide ordinary copyright infringement. And two breach-of-contract claims remain pending.
The most useful way to understand Doe v. GitHub is to separate four different legal questions that are often compressed into one phrase: "AI used copyrighted code without attribution."
| Legal lane | What it asks | What Doe v. GitHub did |
|---|---|---|
| Output-stage DMCA §1202 | Did AI output result from removing or altering CMI on an existing copy? | Rejected on the pleaded theory |
| Training-stage DMCA §1202 | Was CMI stripped from copies before or during dataset construction or training? | Not decided; the theory was forfeited |
| Ordinary copyright infringement | Does a particular output reproduce protectable expression closely enough to infringe? | Expressly left open |
| Open-source licensing / contract | Did defendants violate contractual obligations attached to licensed code? | Two contract claims remain pending |
That distinction is the real significance of the decision.
What is copyright-management information?
Section 1202 of the DMCA protects certain copyright management information, commonly called CMI.
Under 17 U.S.C. §1202, CMI can include a work’s title, the author’s or copyright owner’s identity, copyright notices, terms and conditions for use, and certain identifying numbers or links.
Section 1202(b) addresses the intentional removal or alteration of CMI and certain distribution of works when the required knowledge conditions are satisfied.
That creates a distinction that becomes crucial in an AI case:
Failing to provide attribution is not necessarily the same act as removing attribution.
If someone takes an existing photograph with a photographer credit and crops out the credit, there is a straightforward factual act to examine: an existing copy carried CMI, and the CMI disappeared from that copy.
A generative system presents a different factual question. If it creates a new output that resembles an existing work but the new output never contained the original work’s CMI, the absence of attribution alone does not establish that the system removed CMI from an existing copy.
That is the line the Ninth Circuit drew in Doe.
What the programmers alleged
The plaintiffs are programmers who published copyrighted code in public GitHub repositories under open-source licenses. They alleged that Copilot and Codex could sometimes reproduce their code without accompanying attribution, copyright notices or license terms.
Those are allegations, not findings that the defendants infringed the plaintiffs’ copyrights or breached their licenses.
The appellate court took the complaint’s factual allegations as required at the pleading stage. It noted that the operative complaint included examples in which Copilot allegedly reproduced portions of named plaintiffs’ code "essentially verbatim," while omitting the attribution and other information that accompanied the source code.
The appeal concerned whether those allegations stated a claim under Section 1202. It did not decide whether the examples ultimately constitute copyright infringement.
The Ninth Circuit separated an "input" theory from an "output" theory
The opinion’s most useful analytical move is its separation of two different points in the AI pipeline.
The input theory: CMI allegedly removed before or during training
Under what the court called the input theory, the plaintiffs argued that defendants violated Section 1202 by removing CMI from source code before feeding stripped copies into the training process.
The Ninth Circuit did not decide whether that conduct would violate the DMCA.
Instead, it held that the plaintiffs had forfeited the theory. The district court had made clear that it did not understand the case as asserting injury from the use of licensed code as training data, and the plaintiffs did not adequately preserve a contrary position.
That distinction matters. A theory can be unavailable in a particular appeal for procedural reasons without the appellate court deciding whether the theory is legally valid on its merits.
The output theory: generated code appears without the source CMI
The output theory was the theory the Ninth Circuit actually resolved.
The plaintiffs argued that when Copilot generated code derived from training material but did not include the source attribution, copyright notice or license terms, the AI system had effectively removed CMI.
The court rejected that theory based on the process alleged in the complaint.
As the plaintiffs themselves described Copilot, the model learned statistical patterns from large amounts of source code and generated likely completions in response to prompts. The court concluded that this description did not depict Copilot retrieving an existing copy and deleting information attached to it. It depicted a process generating new work.
That difference was fatal to the Section 1202 output theory.
No, the Ninth Circuit did not require a perfectly identical copy
This is one of the easiest parts of the decision to get wrong.
The district court had described Section 1202 as containing an "identicality" requirement. The Ninth Circuit said that label was "something of a misnomer."
The statute does not create a separate rule under which an allegedly copied work must be 100 percent identical to the original before CMI can be considered removed.
Instead, similarity can be evidence of what happened.
If almost all of an existing work reappears while the CMI that accompanied it is gone, that can support an inference that someone copied the work and removed the CMI. The Ninth Circuit expressly said minor cosmetic changes do not necessarily shield a defendant who substantially or entirely reproduces a protected work and removes its CMI.
So this shorthand is wrong:
"If AI changes the work even slightly, Section 1202 cannot apply."
The more accurate rule is:
A plaintiff must plausibly connect the missing CMI to removal or alteration of CMI from a copy of an existing work. Literal identity is not required, but similarity plus missing attribution does not automatically prove removal.
The court’s search-engine example shows where the factual line may be
The Ninth Circuit offered a useful hypothetical.
It contrasted the generative process alleged in Doe with a traditional search engine that retrieves and displays stored material.
If Copilot had functioned like a search engine and returned an existing copy of the plaintiffs’ code while omitting CMI that had accompanied that copy, the court said the plaintiffs might have had a stronger removal theory.
That does not mean every retrieval system automatically violates Section 1202. The statute still contains intent and knowledge requirements.
But the comparison shows why the technical mechanism matters.
A system that generates a new work without CMI and a system that retrieves an existing copy and strips CMI can present very different Section 1202 questions even if the user sees similar-looking output.
That distinction may matter increasingly as AI products combine generative models with search, retrieval, databases and retrieval-augmented generation.
The court did not decide whether Copilot output can infringe copyright
The Ninth Circuit explicitly left ordinary copyright infringement open.
The opinion acknowledged that Copilot output may sometimes be substantially similar to existing code. It then said it expressed no view on whether that similarity could support a copyright-infringement claim.
That boundary is important because ordinary infringement and Section 1202 address different conduct.
A copyright-infringement claim can ask whether protected expression was unlawfully reproduced. A Section 1202 claim asks additional questions about copyright-management information and whether it was removed, altered or distributed under the circumstances specified by the statute.
The Ninth Circuit warned against turning every ordinary infringement dispute involving missing attribution into a DMCA claim carrying Section 1202’s separate statutory-damages regime.
So the ruling does not mean:
"The code was different, therefore there can be no copyright infringement."
It means:
"These allegations did not establish this particular DMCA removal theory."
For the broader distinction between training and output liability, see sherafy.com‘s analysis of the Justice Department’s LLM fair-use position and our examination of OpenAI’s 95-million-output regurgitation evidence.
The ruling did not decide whether AI training is fair use
Doe v. GitHub is not a fair-use decision.
The Ninth Circuit did not rule that using copyrighted code to train an AI model is lawful, unlawful or fair use. The appeal concerned Section 1202 and missing CMI.
That is another reason "AI copyright case" is too broad a label to explain what happened.
An AI system can raise separate legal questions at different stages:
- how source material was acquired;
- what copies were made or modified during training;
- whether CMI was removed from those copies;
- what the model later generates;
- whether a particular output infringes;
- whether contracts or open-source license conditions were violated.
Doe resolved only part of that landscape.
The contract claims did not disappear
The appellate opinion states that the case had been narrowed to one DMCA claim and two breach-of-contract claims, and that the district court had declined to dismiss the contract claims.
Earlier district-court orders identify the contract theories as claims for alleged open-source-license violations and a separate contract claim against GitHub concerning the alleged sale of licensed materials. The January 2024 district-court order provides the procedural background, while the later Ninth Circuit opinion confirms that two contract claims remained pending when the appeal was decided.
Those claims are still allegations. The courts have not held that GitHub, Microsoft or OpenAI actually breached the licenses.
But their survival matters because it defeats another overly broad takeaway:
"The Ninth Circuit ruled that Copilot does not have to comply with open-source licenses."
It did not.
GitHub itself still warns users about third-party licenses
GitHub’s own current terms make the practical distinction unusually clear.
The GitHub Terms of Service state that AI output may contain material resembling code or content in model training data and may be subject to third-party copyright or open-source license terms. GitHub says users are responsible for determining whether use of an output requires a third-party license and for complying with that license.
GitHub also operates a Copilot code-referencing system that checks suggestions for matches with public code. Depending on the product and settings, matching code may be blocked or accompanied by references to source repositories and available licensing information.
GitHub says those references can help a developer decide what attribution to use or whether to remove matching code from a project.
Those product terms and safeguards do not determine what the law requires. But they reinforce the narrower point: dismissal of one Section 1202 theory does not make downstream copyright and license-compliance questions disappear.
Other AI cases show why the training-stage distinction matters
The most important context outside Doe is that courts have allowed training-stage Section 1202 theories to survive in other generative-AI cases.
The Intercept v. OpenAI
In The Intercept Media, Inc. v. OpenAI, the Southern District of New York allowed a Section 1202(b)(1) claim against OpenAI to survive a motion to dismiss. The court dismissed The Intercept’s Section 1202(b)(3) claim and dismissed the claims against Microsoft.
The surviving theory alleged removal of CMI from copies used in the development and training process. The February 2025 opinion in The Intercept v. OpenAI did not find that OpenAI actually violated the DMCA. It held that the relevant allegations were sufficient to proceed beyond the pleading stage.
Ziff Davis v. OpenAI
A similar theory survived in Ziff Davis, Inc. v. OpenAI.
There, the Southern District of New York declined to dismiss a Section 1202(b)(1) claim alleging that OpenAI intentionally removed CMI while copying Ziff Davis works to build training datasets. The December 2025 Ziff Davis decision likewise was not a finding of ultimate liability.
The comparison matters:
| Case / theory | Alleged point where CMI disappeared | Relevant result |
|---|---|---|
| Doe v. GitHub output theory | Generated output did not contain source CMI | Dismissal affirmed |
| Doe v. GitHub input theory | CMI allegedly removed from training copies | Not decided; forfeited |
| The Intercept v. OpenAI | CMI allegedly removed from copies used in AI development | §1202(b)(1) survived dismissal against OpenAI |
| Ziff Davis v. OpenAI | CMI allegedly removed when works were copied into training datasets | §1202(b)(1) survived dismissal |
Those New York district-court decisions are not binding on the Ninth Circuit, and the Ninth Circuit’s published decision does not automatically control courts in the Second Circuit.
But together they make one point difficult to miss:
"AI removed attribution" is not a single legal theory. Where and how the information disappeared can change the analysis.
The programmers did clear one hurdle: standing
The plaintiffs lost the Section 1202 claim on the merits of the pleaded output theory, but the Ninth Circuit rejected the defendants’ argument that the programmers lacked Article III standing at the motion-to-dismiss stage.
The court concluded that the complaint plausibly alleged a substantial risk that Copilot could reproduce the named plaintiffs’ code without the accompanying CMI. It pointed to the complaint’s allegations, cited research on model memorization, examples involving portions of plaintiffs’ code, and GitHub’s duplicate-detection functionality.
That is a limited procedural conclusion.
The court specifically noted that if the case reached summary judgment, the plaintiffs would need evidence sufficient to create a genuine factual dispute about the asserted risk. The appellate panel did not decide whether the evidence cited in the complaint would ultimately satisfy that later standard.
So:
Verified: the plaintiffs plausibly alleged standing at the pleading stage.
Not established: that Copilot actually reproduced their code with the frequency alleged or that they could prove injury at summary judgment or trial.
Does Doe v. GitHub apply beyond computer code?
Potentially, but not mechanically.
Section 1202 is not a software-only statute. Its definition of CMI covers information associated with copyrighted works generally, and the Ninth Circuit drew on cases involving photographs, books and other works when explaining removal.
That means the court’s interpretation can matter in disputes involving AI-generated text, images and other media.
But the factual mechanism still matters.
A model generating text similar to an article without reproducing its byline presents a different Section 1202 question from a system retrieving the article itself and deleting the byline. And an allegation that a developer removed authorship information from stored training copies before processing them presents a third question.
The opinion is therefore important beyond source code, but it is not a blanket rule that all generative-AI output without attribution is outside Section 1202.
How broad is the precedent?
Because the Ninth Circuit designated the opinion for publication, it is binding precedent for federal courts within the Ninth Circuit on the legal question the panel actually decided, unless later superseded or overruled.
The Ninth Circuit covers Alaska, Arizona, California, Hawaii, Idaho, Montana, Nevada, Oregon, Washington, Guam and the Northern Mariana Islands.
Courts elsewhere may find the reasoning persuasive, but they are not bound by the Ninth Circuit in the same way. That matters when comparing Doe with AI copyright litigation proceeding in the Southern District of New York.
It also matters that Doe came to the Ninth Circuit through an interlocutory appeal. The district court had certified its DMCA dismissal for immediate review before the rest of the litigation ended. The September 2024 certification order stayed the district-court proceedings while the appeal was considered.
The appellate ruling therefore resolves the disputed Section 1202 issue on appeal while the surviving contract litigation remains a separate part of the case.
What would a stronger Section 1202 claim look like after Doe?
The opinion itself provides much of the roadmap.
A stronger claim would need facts connecting the defendant to an existing copy carrying CMI and plausibly showing that the defendant took an action that removed or altered that CMI.
Literal identity is not required. Substantial reproduction with the CMI conspicuously missing can be circumstantial evidence of removal.
A retrieval system that fetches an existing copy and strips attribution could also look materially different from the generative process alleged in Doe.
And a training-stage theory alleging that source copies entered an AI-development pipeline with CMI and were deliberately transformed into copies without it remains a separate issue that this appeal did not decide.
Even then, proving that information disappeared is not enough by itself. Section 1202 contains intent and knowledge requirements that must also be satisfied.
What Doe v. GitHub actually changes
The Ninth Circuit has now placed a meaningful limit on one way plaintiffs can use Section 1202 against generative AI.
Within the Ninth Circuit, a plaintiff cannot simply point to AI output resembling a copyrighted work, note that the original attribution is missing, and treat the absence itself as proof that CMI was removed from an existing copy.
There must be a plausible factual connection between the CMI attached to a copy of the protected work and an act that removed or altered that information.
But the ruling does not establish that:
- AI developers may lawfully strip CMI from training copies.
- AI training is fair use.
- substantially similar AI output cannot infringe copyright.
- open-source license obligations no longer matter.
- every generative model necessarily creates a legally "new work" under every factual scenario.
- Section 1202 can never apply to generative AI.
The lasting lesson is more precise.
"AI used copyrighted material without attribution" does not identify the legal issue.
The first question now has to be:
Where, exactly, did the attribution disappear?
If it disappeared from an existing copy during collection or training, that can present one Section 1202 theory. If it was never present on a newly generated output, Doe says that is not automatically the same thing. If the output reproduces protected expression, ordinary copyright law may still supply a different claim. And if licensed code was used contrary to enforceable license conditions, contract law may create another path altogether.
That four-way distinction is what Doe v. GitHub actually adds to the emerging law of generative AI.
References and Further Reading
Primary Law and Court Records
Doe v. GitHub, Inc., No. 24-7700, Ninth Circuit published opinion, September 16, 2026
The controlling appellate opinion. It separates the input and output theories, rejects literal identicality as an independent Section 1202 requirement, leaves ordinary infringement unresolved, and confirms that the two contract claims remained pending.
17 U.S.C. §1202 — Integrity of Copyright Management Information
The statutory text defining CMI and the prohibited removal, alteration and distribution conduct at issue in the case.
Doe v. GitHub district-court order, January 22, 2024
Provides procedural background and identifies the open-source-license and selling-licensed-materials contract theories.
Doe v. GitHub order certifying the interlocutory appeal, September 27, 2024
Explains why the district court allowed immediate Ninth Circuit review and stayed district-court proceedings pending the appeal.
Related AI Section 1202 Decisions
The Intercept Media, Inc. v. OpenAI, Inc., opinion and order, February 20, 2025
Allowed The Intercept’s Section 1202(b)(1) claim against OpenAI to proceed beyond dismissal while dismissing its Section 1202(b)(3) theory and the claims against Microsoft.
Ziff Davis, Inc. v. OpenAI, Inc., decision addressing Section 1202, December 2025
Allowed a Section 1202(b)(1) theory alleging CMI removal from copies used to build training datasets to proceed past the pleading stage.
GitHub’s Current AI and Licensing Guidance
GitHub Terms of Service
GitHub’s current terms state that AI output may resemble third-party code or be subject to open-source license terms, and place responsibility on users to evaluate and comply with applicable licenses.
GitHub Copilot Code Referencing
Explains GitHub’s system for identifying certain Copilot suggestions that match public code and surfacing source and license information.
Related sherafy.com Analysis
DOJ Says LLM Training on Copyrighted Text Is Fair Use. Here’s What That Actually Means
Explains why acquisition, training and model outputs can raise different copyright questions.
OpenAI Found 14 Book Matches in 95 Million Outputs. Does That Prove Fair Use?
Examines model memorization, regurgitation and what empirical output evidence does and does not establish.
Seattle Times and Newsday Got $500K AI Grants. Did That License Their Journalism?
Examines licensing, training, copyright-management information and related claims in publisher litigation involving OpenAI and Microsoft.
Editorial currency note: This article reflects the published Ninth Circuit opinion and publicly accessible records reviewed through September 22, 2026. The appeal was decided only days earlier, so later rehearing, mandate, remand or district-court activity may change the procedural posture.
