If you are the owner of material that is protected by copyright law, under the Digital Millennium Copyright Act (“DMCA”), there is a procedure for demanding that your copyrighted material be taken down from an internet website or other places of publication. Generally, these are called “Takedown Notices.” Most internet providers and website hosting companies immediately respond to Takedown Notices and quickly remove content that is alleged to be infringing. This allows providers, hosts and website owners to avoid legal liability for contributory copyright infringement. This, in turn, helps companies avoid the high cost of defending infringement litigation and, potentially, being on the hook for huge judgments if they are found to have contributed to the infringement of their users.

But, the truth is, there are a lot of fake Takedown Notices sent and there is a significant problem with abuse of the Takedown system. In late November 2021, for example, the South Korean pop band BTS was the victim of hundreds of fake Takedown Notices sent to various websites, providers and hosting companies. See media report here. The Notices were sent as a political protest and caused a significant amount of BTS-related content to be taken down. While the problems were eventually resolved, for good reason, the band and their fans were upset.

Another abuse of the system occurs when Hackers and other cybercriminals use fake Takedown Notices as part of email phishing scams. One solution is to make sure that your company has experienced internet lawyers who can offer solid, legally-based advice and counsel when a Takedown Notice is received.

Another solution is to understand what is legally required for a Takedown Notice to be legitimate. If some of the required information is missing, then the Takedown Notice might be fake. A legitimate DMCA Takedown Notice must be a “written communication” and must be directed to the service provider. See 17 U.S.C. § 512. Thus, a phone call or voicemail is not a legitimate Takedown Notice. Further, the written communication must contain the following:

(i) A physical or electronic signature of a person authorized to act on behalf of the owner of an exclusive right that is allegedly infringed

(ii) Identification of the copyrighted work claimed to have been infringed, or, if multiple copyrighted works at a single online site are covered by a single notification, a representative list of such works at that site

(iii) Identification of the material that is claimed to be infringing or to be the subject of infringing activity and that is to be removed or access to which is to be disabled, and information reasonably sufficient to permit the service provider to locate the material

(iv) Information reasonably sufficient to permit the service provider to contact the complaining party, such as an address, telephone number, and, if available, an electronic mail address at which the complaining party may be contacted

(v) A statement that the complaining party has a good faith belief that use of the material in the manner complained of is not authorized by the copyright owner, its agent, or the law

(vi) A statement that the information in the notification is accurate, and under penalty of perjury, that the complaining party is authorized to act on behalf of the owner of an exclusive right that is allegedly infringed.

If the Takedown Notice does NOT contain ALL of these elements, then it is possible that the Takedown Notice is a fake and might be a scam, political stunt, phishing or other cybercriminal activity.

What should you do?

As noted, the best course of action is to obtain counsel from an experienced internet and DMCA attorney. The Takedown Notice might be fake, but it also might be a legitimate Takedown Notice that mistakenly or inadvertently omits required information.

If you have legal questions about consumer privacy, data security or other legal issues related to internet law, contact the trusted internet lawyers at Revision Legal at 231-714-0100.

The Full Legal Requirements for a Valid DMCA Takedown Notice

Understanding the complete legal requirements for a valid DMCA takedown notice is the first line of defense against both fake notices and improper responses to legitimate ones. Under 17 U.S.C. § 512(c)(3), a compliant takedown notification must be a written communication directed to the designated agent of the service provider (whose registration with the Copyright Office is required under § 512(c)(2)) and must contain all of the following:

• A physical or electronic signature of a person authorized to act on behalf of the copyright owner
• Identification of the copyrighted work claimed to be infringed, or if multiple works are covered by a single notification, a representative list of such works
• Identification of the material claimed to be infringing and information reasonably sufficient to permit the service provider to locate the material (typically a URL)
• Information reasonably sufficient to permit the service provider to contact the complaining party—address, telephone number, and email address
• A statement that the complaining party has a good faith belief that use of the material in the manner complained of is not authorized by the copyright owner, its agent, or the law
• A statement that the information in the notification is accurate, and under penalty of perjury, that the complaining party is authorized to act on behalf of the copyright owner

Counter-Notifications: How to Challenge a DMCA Takedown

When a service provider removes content pursuant to a DMCA takedown notice, the user whose content was removed has the right to file a counter-notification under 17 U.S.C. § 512(g). A valid counter-notification must contain: the user’s physical or electronic signature; identification of the material that was removed and the location where it appeared before removal; a statement under penalty of perjury that the user has a good faith belief that the material was removed by mistake or misidentification; the user’s contact information; and the user’s consent to federal court jurisdiction in their district.

Upon receipt of a valid counter-notification, the service provider must notify the complaining party and reinstate the material within 10 to 14 business days unless the complaining party files a federal court action seeking a court order restraining the user from infringing activity. If no court action is filed within that window, the material must be restored. This process effectively shifts the burden back to the copyright owner to either file litigation or accept reinstatement of the allegedly infringing content.

Penalties for Filing False Takedown Notices

The DMCA includes significant penalties for abuse of the takedown system. Under 17 U.S.C. § 512(f), any person who knowingly materially misrepresents that material is infringing, or that material was removed by mistake or misidentification, is liable for any resulting damages, including costs and attorney’s fees incurred by the alleged infringer, copyright owner, or service provider. Courts have applied § 512(f) to hold takedown notice filers liable when they failed to conduct a meaningful fair use analysis before filing, as held in Lenz v. Universal Music Corp., 815 F.3d 1145 (9th Cir. 2016), the famous ‘dancing baby’ case.

In the context of the BTS fan account situation described above—where hundreds of takedown notices were filed as a political protest—each false notice potentially triggers liability under § 512(f). While coordinated abuse of this magnitude presents enforcement challenges, the statute’s penalty provisions create meaningful deterrence against systematic bad-faith abuse by sophisticated commercial actors.

Phishing Schemes Using Fake Takedown Notices

Cybercriminals have weaponized the DMCA takedown process as a vector for phishing attacks. A common scheme involves sending an email that appears to be a DMCA takedown notice, often impersonating a well-known law firm or copyright enforcement organization. The fake notice typically contains a link that the recipient is told to click to ‘review the infringing content’ or ‘submit a response’—but the link leads to a credential harvesting site or malware download.

Several indicators suggest a takedown notice may be fraudulent: it was delivered by phone call or voicemail rather than in writing; the ‘authorized agent’ email address uses a free email service rather than a law firm or company domain; the notice lacks the perjury declaration required by § 512(c)(3)(B)(vi); the notice is addressed to you personally rather than to the designated agent of your service provider; or the notice requests payment to resolve the claim (legitimate DMCA process does not involve direct payment to the complainant).

Best Practices for Handling Takedown Notices

Every business that hosts user-generated content, operates a website with third-party content, or uses images and media from third-party sources should have a documented DMCA compliance policy. This policy should designate a DMCA agent with the Copyright Office under § 512(c)(2), establish a procedure for evaluating the validity of received takedown notices, and identify counsel who can quickly assess whether a counter-notification is appropriate.

If you have received a takedown notice and are unsure whether it is legitimate, or if your content has been taken down pursuant to a notice you believe is false, the copyright attorneys at Revision Legal can evaluate the notice, advise on your legal options, and prepare a counter-notification if appropriate. Contact us today.