Sulla responsabilità degli Internet Service Provider (ISP)

Safe harbour per Vimeo contro i giganti della musica del gruppo EMI Records (dopo la vittoria del 2025 è arrivata una modestissima liquidazione di spese di lite)

Qui però riferisco solo della sentenza del 2025 sul merito, non avendolo fatto allora, essendo alquanto interessante la discussione sulle red flags di violazione copyrights e sulla invocabilità del safe harbor ex DMCA sec. 512(c).

Si tratta dell’appello del 2° Circuito in Capitol REcords e altri v. Vimeo Inc, 13.01.2025, Docket Nos. 21-2949(L), 21-2974(Con), di cui ci diede notizia Eric Goldman e che ci viene oggi ricordata per le questione delle spese. Questione qui irrilevante, come detto; mi limito a ricordare la notazione del prof. Goldman secondo cui , a fronte di una battaglia giudiziaria di 17 anni e a spese legali per 6 milioni di dollari , il Tribunale di New York in questo settembre ha liquidato solo 16.000 dollari , così motivando: “Vimeo itself has previously recognized, this case raised “many difficult or new” issues….An award of attorneys’ fees to Vimeo, however, would not serve the purposes of the Copyright Act. Plaintiffs asserted reasonable claims that raised novel, complex questions of law, and they litigated those claims reasonably and in good faith. This case also presents little need for either compensation or deterrence“).

Andiamo dunque al merito accertato nel 2025.

La domanda venne respinta perchè Vimeo nè aveva notizia di violazioni specifiche sui video allegati nè ricevette financial benefit diretto dalle violazioni. REquisiti che sono i pretesi danneggiati a dover provare.

Il passaggio più interessante è quello sulle red flags:

<<Even if a person without specialized knowledge would have intuited a likelihood that many of the posted videos were not authorized, that would not make it obvious that a particular video lacked authorization to use the music [esatto: è il punto centrale, di solito trascuirato da dottrina e giurisprueenza italiane]. This is all the more true in view of the uncontested fact that, since 2011, Vimeo had run a store from which users could purchase licenses to use music in videos. Accordingly, Vimeo employees were aware of the existence of simplified opportunities available to purchase licenses. Furthermore, because Plaintiffs have not proved that Vimeo employees had specialized knowledge of the music industry, those employees’ awareness that music found on their videos was under copyright did not show that they knew whether the music they heard on user videos came from EMI or another label. Plaintiffs’ evidence does not support it being apparent to Vimeo employees that the music they heard on any particular video came from a label that did not offer licenses through Vimeo’s store or otherwise.

information their employees may have acquired that might suggest the presence of infringements in user postings, and to undertake monitoring investigations whenever some level of suspicion was surpassed, . . . would largely undo the value of § 512(m)”).

Even if we concluded that Vimeo had red flag knowledge that EMI’s music in user videos was not authorized or licensed, that would be insufficient to satisfy Plaintiffs’ burden. Plaintiffs needed in addition to show that it would be apparent to a person without specialized knowledge of copyright law, or, alternatively, persons who have been demonstrated to possess specialized knowledge of copyright law, that the particular use of the music in the Videos-in-Suit was not fair use. Plaintiffs contend that they showed that the Vimeo staff had “legal acumen” as to copyright laws. See Appellants’ Br. at 59. We disagree. Their argument rests solely on Vimeo’s having told its employees not to produce videos containing copyrighted music and Vimeo’s having communicated to users that using copyrighted music “generally (but not always) constitutes copyright infringement.” Id.

Those facts do not support the conclusion that a Vimeo employee, absent familiarity with copyright laws, would have a basis for knowing whether the

use of copyrighted music in a particular video was or was not a fair use. Plaintiffs’ argument goes too far; it would require Vimeo employees to assume that uses of copyrighted material are never fair use. Vimeo’s exercise of prudence in instructing employees not to use copyrighted music and advising users that use of copyrighted music “generally (but not always) constitutes copyright infringement” did not educate its employees about how to distinguish between infringing uses and fair use.

Furthermore, at least during the period in question, the boundaries of fair use were not so well settled as to make clear even to persons well acquainted with copyright law whether and when a dancing, acting, or lip-dubbing performance of copyrighted music might pass muster as a fair use.

The difficulty distinguishing fair use from infringement at the time in question is illustrated by the Supreme Court’s subsequent consideration of Andy Warhol Foundation for the Visual Arts, Inc. v. Goldsmith, 598 U.S. 508 (2023). The question presented to the Court in that case was whether the first statutory factor for a finding of fair use—“the purpose and character of the use,” 17 U.S.C. § 107(1)—favored a finding of fair use for a portrait of the singer Prince, created by Andy Warhol in 1984, which incorporated a

copyright-protected photograph of Prince taken by photographer Lynn Goldsmith, while making changes to the original. See Warhol, 598 U.S. at 516-18.

More than 40 copyright experts, as “Copyright Law Professors” and “Art Law Professors,” filed amicus briefs in their own names supporting a finding of fair use and consequently no infringement.10 At the same time, approximately 18 intellectual property professors filed amicus briefs arguing that the copying did not represent fair use.11 The Court itself also proved to be bitterly divided. In the majority opinion, seven Justices rejected the arguments passionately advanced by two dissenters that Warhol’s changes to

10 See Br. of Amici Curiae Copyright Law Professors in Support of Petitioner, Warhol, 598 U.S. 508; Br. of Art Law Professors as Amici Curiae in Support of Petitioner, Warhol, 598 U.S. 508.

11 See Br. of Professors Peter S. Menell, Shyamkrishna Balganesh, and Jane C. Ginsburg as Amici Curiae in Support of Respondents, Warhol, 598 U.S. 508; Br. of Amicus Curiae Jeffrey Sedlik, Professional Photographer and Photography Licensing Expert, in Support of Respondents, Warhol, 598 U.S. 508; Br. of Amicus Curiae Prof. Zvi S. Rosen in Support of Respondents, Warhol, 598 U.S. 508; Br. of Professor Guy A. Rub as Amici Curiae in Support of Respondents, Warhol, 598 U.S. 508; Br. of Amici Curiae Institute for Intellectual Property and Social Justice and Intellectual-Property Professors in Support of Respondents, Warhol, 598 U.S. 508; Br. of Professor Terry Kogan as Amicus Curiae in Support of Respondents, Warhol, 598 U.S. 508.

the original Goldsmith photograph were transformative and that the ultimate creation was a fair use. See Warhol, 598 U.S. at 548-50.

Where academic scholars specialized in the study of the fair use question and the Justices of the Supreme Court are so divided, we cannot conclude that it was “apparent,” as required by Section 512(c)(1)(A)(ii), to untutored employees of Vimeo that dancing, acting, or lip-dubbing performances of copyrighted music uses posted by Vimeo users were not fair use>>.

L’autorizzazione per la comunicazone al pubblico dell’opera protetta, ottenuta dal provider, copre anche la riproduzione a ciò tecnicamente necessaria (sia dal suo punto di vista sia da quello dell’utente uploader)

Esatte conclusioni dell’AG Emiliou 26.03.2026, causa C-579/24, su questione pregiudiziale posta da Trib. austriaco.

<<83. In primo luogo, dalla prospettiva dei prestatori di servizi di condivisione di contenuti online, l’articolo 17, paragrafo 1, della direttiva 2019/790 si riferisce soltanto ad «un’autorizzazione (…) al fine di comunicare al pubblico o rendere disponibili al pubblico opere o altri materiali». Qualora la Corte concludesse che la realizzazione di copie digitali di contenuti protetti sui server di detti prestatori di servizi che sono tecnicamente necessarie per poter dare al pubblico accesso a tali contenuti può essere subordinata ad un’autorizzazione distinta, che non è affatto menzionata dall’articolo 17, ne deriverebbe un significativo grado di incertezza giuridica per i prestatori di servizi di condivisione di contenuti online. A questo proposito, ricordo che, come rilevato al paragrafo 40 supra, il legislatore dell’Unione, quando ha adottato tale disposizione, mirava tra l’altro a ridurre l’incertezza giuridica che circonda la responsabilità dei suddetti prestatori di servizi per i contenuti protetti caricati dagli utenti. Mi pare di capire che esso non intendeva trattare solo una parte di tale responsabilità (vale a dire solo la responsabilità dei prestatori di servizi di condivisione di contenuti online per gli atti di comunicazione o di messa a disposizione del pubblico, ad esclusione degli atti di riproduzione tecnicamente necessari a tal fine).

84. Inoltre, se l’autorizzazione necessaria ai sensi dell’articolo 17, paragrafo 1, della direttiva 2019/790 non includesse la realizzazione di tali copie digitali, detta autorizzazione diverrebbe praticamente inutile. Tali prestatori di servizi potrebbero comunque dover affrontare azioni dei titolari dei diritti per violazioni del loro diritto esclusivo di riproduzione, come tutelato dall’articolo 2 della direttiva 2001/29, per il semplice fatto che vengono automaticamente realizzate sui loro server copie digitali di contenuti protetti ogni qual volta un utente mette in rete siffatti contenuti protetti.

85. Ne consegue che, sotto il profilo della certezza del diritto, l’unica soluzione coerente è che l’autorizzazione necessaria ai sensi dell’articolo 17, paragrafo 1, della direttiva 2019/790 include necessariamente tali copie.

86. In secondo luogo, dalla prospettiva dei titolari dei diritti, se l’autorizzazione necessaria ai sensi dell’articolo 17, paragrafo 1, della direttiva 2019/790 non si estendesse alla realizzazione di tali copie, l’obiettivo di garantire una migliore remunerazione per l’utilizzo di contenuti protetti sulle piattaforme di condivisione di contenuti online sarebbe seriamente compromesso. I prestatori di servizi di condivisione di contenuti online sarebbero poco incentivati a chiedere una siffatta autorizzazione, dal momento che potrebbero comunque essere esposti alla responsabilità per gli atti di riproduzione non coperti da detta autorizzazione.

87. Inoltre, la questione della responsabilità di tali prestatori per gli atti di riproduzione in parola reintrodurrebbe, in sostanza, le stesse incertezze esaminate dalla Corte nella causa che ha dato luogo alla sentenza YouTube e Cyando relativamente al diritto di comunicazione o di messa a disposizione del pubblico, in un momento in cui non si applicava ancora il regime specifico istituito dall’articolo 17 della direttiva 2019/790. In particolare, il prestatore sarebbe responsabile in via principale ai sensi dell’articolo 2 della direttiva 2001/29? Potrebbe avvalersi dell’«approdo sicuro» di cui all’articolo 14, paragrafo 1, della direttiva 2000/31 (50)? A seconda della risposta, i prestatori di servizi di condivisione di contenuti online potrebbero essere pienamente responsabili o non esserlo affatto. (…)ù

96. In terzo luogo, dalla prospettiva degli utenti dei servizi di condivisione di contenuti online, ricordo che il regime di responsabilità specifico previsto all’articolo 17 della direttiva 2019/790 è inteso anche a tutelare gli interessi e i diritti di detti utenti, quando caricano contenuti sulle piattaforme dei prestatori di tali servizi.

97. Da un punto di vista tecnico, è pacifico che la realizzazione di copie digitali di contenuti protetti sui server dei prestatori di servizi di condivisione di contenuti online viene avviata dagli utenti di siffatti servizi quando premono il pulsante di caricamento. Si deve quindi ritenere che tali utenti effettuino del pari atti di riproduzione, ai sensi dell’articolo 2 della direttiva 2001/29. Come ho spiegato al paragrafo 42 supra, l’articolo 17, paragrafo 2, della direttiva 2019/790 chiarisce che gli utenti effettuano essi stessi atti di comunicazione o di messa a disposizione del pubblico, ai sensi dell’articolo 3 della direttiva 2001/29, quando caricano contenuti protetti sulle piattaforme online di tali prestatori.

98. Tuttavia, la menzionata disposizione indica altresì che, qualora un prestatore di servizi di condivisione di contenuti online abbia ottenuto un’autorizzazione da un titolare dei diritti, a norma dell’articolo 17, paragrafo 1, della direttiva 2019/790, tale autorizzazione «includ[e] anche gli atti compiuti dagli utenti dei servizi che rientrano nell’ambito di applicazione dell’articolo 3 della direttiva [2001/29]», purché essi «non agiscano su base commerciale o qualora la loro attività non generi ricavi significativi». Di conseguenza, in una situazione del genere, gli utenti non devono ottenere essi stessi un’autorizzazione e possono liberamente caricare i contenuti protetti di cui trattasi.

99. Per quanto riguarda gli atti di riproduzione rientranti nell’ambito di applicazione dell’articolo 2 della direttiva 2001/29, rilevo che l’articolo 17, paragrafo 2, della direttiva 2019/790 non li menziona espressamente. Tuttavia, il considerando 69 della direttiva 2019/790, che è formulato in termini più ampi rispetto a tale disposizione, indica che le autorizzazioni ottenute dai prestatori di servizi di condivisione di contenuti online dovrebbero includere «gli atti rilevanti per il diritto d’autore relativi ai contenuti caricati dagli utenti nell’ambito dell’autorizzazione concessa ai prestatori di servizi» (57). Tale riferimento agli «atti rilevanti per il diritto d’autore» in generale, e non solo agli atti di comunicazione o di messa a disposizione del pubblico, avvalora la tesi secondo cui l’ambito di applicazione dell’articolo 17, paragrafo 2, della direttiva 2019/790 non è necessariamente limitato agli «atti compiuti dagli utenti dei servizi che rientrano nell’ambito di applicazione dell’articolo 3 della direttiva [2001/29]», ma potrebbe estendersi agli atti di riproduzione compiuti da detti utenti>>.

Dato il ragionamento precedente, l’autorizzazione al provider non può che coprire pure l’utente / uploader:

<<112. Come ho già rilevato al paragrafo 97 supra, è pacifico che la realizzazione di copie digitali di contenuti protetti sui server dei prestatori di servizi di condivisione di contenuti online viene avviata dagli utenti di tali servizi allorché premono il pulsante di caricamento in relazione al contenuto di cui trattasi. Di conseguenza, si deve ritenere che tali utenti compiano non solo un atto di comunicazione al pubblico ai sensi dell’articolo 3 della direttiva 2001/29, ma altresì un atto di riproduzione ai sensi dell’articolo 2 di detta direttiva.

113. Se l’articolo 17, paragrafo 1, della direttiva 2019/790 non includesse la realizzazione di copie digitali di contenuti protetti sui server dei prestatori di servizi di condivisione di contenuti online, a mio avviso si applicherebbe per analogia il ragionamento della Corte nella causa che ha dato luogo alla sentenza YouTube e Cyando, esposto al paragrafo 88 supra. Ne conseguirebbe che i contenuti protetti dovrebbero essere considerati caricati sulla piattaforma interessata non dal gestore, bensì dagli utenti, che sarebbero quindi tenuti ad ottenere un’autorizzazione per realizzare essi stessi siffatte copie digitali.

114. Tuttavia, per le ragioni illustrate nella sezione precedente, ritengo che, così come l’autorizzazione che i prestatori di servizi di condivisione di contenuti online devono ottenere a norma dell’articolo 17, paragrafo 1, della direttiva 2019/790, ai fini della comunicazione o della messa a disposizione del pubblico di contenuti protetti, include necessariamente la realizzazione di copie digitali di tali contenuti sui loro server, se siffatte copie sono tecnicamente necessarie a tal fine, lo stesso valga per l’articolo 17, paragrafo 2, di detta direttiva. In altri termini, tale disposizione disciplina la questione della responsabilità degli utenti di servizi di condivisione di contenuti online non solo in relazione agli atti che rientrano nell’ambito di applicazione dell’articolo 3 della direttiva 2001/29 (ossia gli atti di comunicazione o di messa a disposizione del pubblico di contenuti protetti), ma anche in relazione agli atti di riproduzione, consistenti nella realizzazione di copie digitali di contenuti protetti sui server dei prestatori di servizi di condivisione di contenuti online che sono tecnicamente necessarie per la realizzazione di tali atti>>.

Si tratta di piana interpretazione del contratto secondo buona fede, consacrata ad es in questa materia dall’art. 119 ult. co. l. aut. Difficile che la Corte di Giustizia la contraddica

La Suprema Corte USA sulla responsabilità (indiretta) del provider per violazione di copyright

La Corte Suprema 25.03.2026, n. 24-171, Cox v. Sony, chiarisce, con arresto di significativa importanza, che il sapere del (possibile o anche certo) uso del proprio servizio per fini illeciti non rende corresponsabile l’internet provider.

Si tratta dell’istituto della contributory liability, che presuppone volontà di uso illecito dei propri servizi. Volontà che può estrinsecarsi in due modi: il copyright owner can show the requisite intent in two ways. First, it can show that a party affirmatively induced the infringement. Ibid. Second, it can show that the party sold a service tailored to infringement. Id., at 942 (Ginsburg, J., concurring). [dal syllabus]

Ebbene il provider Cox , pur ricevendo 163.148 segnalazioni dal software MarkMonitor di Sony e poi chiudendo solo 32 abbonamenti, non è corresponsabile.

<<Thus, Cox is not contributorily liable for the infringement
of Sony’s copyrights. Cox provided Internet service to its
subscribers, but it did not intend for that service to be used
to commit copyright infringement. Holding Cox liable
merely for failing to terminate Internet service to infringing
accounts would expand secondary copyright liability be-
yond our precedents.
Cox neither induced its users’ infringement nor provided
a service tailored to infringement. As for inducement, Cox
did not “induce” or “encourage” its subscribers to infringe in
any manner. Id., at 930. Sony provided no “evidence of ex-
press promotion, marketing, and intent to promote” in-
fringement. Id., at 926. And, Cox repeatedly discouraged
copyright infringement by sending warnings, suspending
services, and terminating accounts. As for providing a ser-
vice tailored to infringement, Cox’s Internet service was
clearly “capable of ‘substantial’ or ‘commercially significant’
noninfringing uses.” Id., at 942 (Ginsburg, J., concurring).
Cox did not tailor its service to make copyright infringe-
ment easier. Cox simply provided Internet access, which is
used for many purposes other than copyright infringement.>>

L’errore della corte di appello:
<<The Fourth Circuit found otherwise based only on its Cir-
cuit precedent establishing a new form of contributory lia-
bility. The court did not suggest that Cox induced its users
to infringe. 93 F. 4th, at 235, n. 4. And, it did not deny that
Cox’s service was “capable of substantial lawful use and not
designed to promote infringement.” Id., at 236. Rather, the
court held that “supplying a product with knowledge that
the recipient will use it to infringe copyrights is . . . suffi-
cient for contributory infringement.” Ibid.; see also BMG,
881 F. 3d, at 311–312. The Fourth Circuit’s holding thus
went beyond the two forms of liability recognized in Grok-
ster and Sony. It also conflicted with this Court’s repeated
admonition that contributory liability cannot rest only on a
provider’s knowledge of infringement and insufficient ac-
tion to prevent it. See Kalem Co., 222 U. S., at 62; Sony,
464 U. S., at 439; Grokster, 545 U. S., at 939, n. 12>>

La sentenza è importante: sapere che i propri servizi saranno (possibilmente/probabilmente/certamente: è da distinguere?) usati a fini illeciti, non rende correponsabili.

Connesso è il tema della responsabilità dell’intelligenza artificiale per le riproduzioni illecite da essa causate in base a prompt dell’utente. E’ responsabile l’ente che gestisce il LLM o l’utente? Sono per la seconda Bonadio E. – Frosio G. – Geiger Ch. – Guadamuz A. – Karapapa S. – Stamatoudi I. A., Preserving Balance in the EU Digital Single Market: How Like Company Could Reframe Copyright and Innovation in the Generative AI Era (March 02, 2026) https://ssrn.com/abstract=6326401 , saggio approfondito, relativo al rinvio pregiudiziale alla Corte di Giustizia, caso C-250/2025, Like Company vs Google, § 7.

Breve nota critica del prof. Paul Goldstein, autore del monumentale Goldstein on Copyright, Third Edition, nel sito di Eric Goldman.

Nel medesimo sito, considerazioni meno critiche (nel senso che non tutto è perso per i titolari di diritti, se avranno l’accortezza di ben manovrare gli strumenti offerti loro dall’ordinamento) sono proposte dal prof. Guy Rub.

SAfe harbour per una piattaforma di vendita/licenza di fotografie ?

L’appello del 2° circuito 10.02.2026, causa 23-7652, McGuchen v. Shutterstock, affronta il tema dell’applicabilita del porto sicuro ex § 512.(c). US Code title 17 in una lite azionat da un fotografo che vi aveva individuato molte sue fotografie.

I requisiti generali sono ravvisati .

La Corte invece propende per escludere i) quello per cui deve essere un trattamento sotto la direzione dell’utente (ivi, sub (1) IN GENERAL) e, ii) quello simile della assenza di beneficio economico se il “service provider has the right and ability to control such activity” (ivi, sub 1.B);

Sul primo , sub i) :

<<There is evidence in the record that suggests Shutterstock’s review of user images is neither cursory nor automatic. To begin, when a user submits an image to Shutterstock, the image does not immediately appear on the website; rather, the contributor must wait, sometimes for hours, until they receive an email from Shutterstock letting them know which of their images were accepted. See J. App’x at 1293, 1302, 1316. That fact is not dispositive, but it suggests some intervention by Shutterstock between a user upload and the appearance of material on the platform. Moreover, Shutterstock’s website states that it “has high standards and only accepts a portion of the images submitted to be included in [its] collection.” Id. at 1071. Indeed, Shutterstock maintains a page on its website that explains why an image might be rejected and provides advice for successful submissions. Id. at 1071–88. There are “30-odd” reasons that an image might be rejected by a Shutterstock reviewer, id. at 1294–95, which include focus, exposure, lighting, and noise, id. at 1071–75.
The record also contains evidence that Shutterstock’s reviewers exercise some subjective discretion even when applying seemingly rote and straightforward criteria. For instance, when considering an image’s focus, Shutterstock reviewers are “trained to know the difference between something that’s just out of focus and something that’s more intentional.” Id. at 1341–42. And according to Shutterstock, a reviewer may still accept an image that has focus issues if it is “a really unique shot” or a “hard shot to get.” Id. at 1297. That is because, as Shutterstock has explained, “there’s no way to predict what a customer is looking for,” so although “Shutterstock wants to have a high-quality library[,] . . . [t]here’s a lot of value in . . . shots that might not be perfect.” Id. at 1296–97; see also id. at 1366 (Shutterstock employee explaining that reviewers apply “a base guideline . . . but at the same time, it’s not a black-and-white standard”); id. at 1367 (“As our reviewers are humans, they obviously can think for [themselves]. We give them guidelines and we try to give them the best tools possible to review photos and to use their best judgment based on the guidelines we give them.”). In the end, as Shutterstock itself concedes, “photography is an art . . . you can’t just say, ‘This is yes, this is no.’” Id. at 1362. Together, these statements could lead a factfinder to conclude that Shutterstock’s reviewers exercise a considerable degree of case-by-case aesthetic or editorial judgment when determining which images to allow on the platform>>.

Ciò in applicazione del criterio astratto (importante ed espressamente enunciato) per cui <<if a service provider engages in manual, substantive, and discretionary review of user content—if, on a case-by-case basis, it imposes its own aesthetic, editorial, or marketing judgment on the content that appears on its platform—then its storage of infringing material is no longer “at the direction of a user.” In other words, “extensive, manual, and substantive” front-end screening of user content is not “accessibility-enhancing” and is not protected by the § 512(c) safe harbor. Mavrix, 873 F.3d at 1056. That is because, where service providers engage in their own discretionary screening of user content, they can no longer be said to be acting “solely to facilitate access by users.”>>

Sul secondo aspetto, sub ii):

<<There is evidence in the record suggesting “intrusions into user autonomy over their posts” that exceed the bounds set by Congress for the § 512(c) safe harbor. Vimeo II, 125 F.4th at 425. As an initial matter, Shutterstock screens every image before it appears on the platform—this screening determines whether an image ever gets on the platform. By way of contrast, in Vimeo II, “[c]alling attention to selected videos by giving them a sign of approval or displaying them on a Staff Picks channel . . . did not restrict the freedom of users to post whatever videos they wished.” Id. Also in contrast to Vimeo II, there is evidence here that Shutterstock’s image review goes beyond the limited purposes of restricting the site to “selected categories of consumer preferences” and excluding unlawful images. Id. Rather than engaging in categorical content screening—like accepting only holiday-themed images, or images that feature animals—Shutterstock appears to screen user images for their overall aesthetic quality. Curating a “collection,” J. App’x at 1071, of high-quality images is not the same as designing a website “that would be appealing to users with particular interests,” Vimeo II, 125 F.4th at 425.
Further, as McGucken has argued, there is some evidence in the record that Shutterstock extensively advises potential contributors on the types of images it is likely to accept. See J. App’x at 1071–88. That is unlike the service provider in Vimeo II, which “encouraged users to create certain types of content,” but did not condition their ability to post material on whether they created the provider’s preferred types of content. Vimeo II, 125 F.4th at 416. Indeed, in Vimeo II, we cited a website’s practice of giving “its users extensive advice on content” as one fact that can distinguish a service provider that has the right and ability to control infringing activity from one that does not. Id. at 423 (citing Cybernet, 213 F. Supp. 2d at 1173). Accordingly, on the current record, a reasonable factfinder might conclude that the advice and instruction Shutterstock provides its contributors, coupled with its image screening process, are sufficiently coercive to constitute substantial influence.

Finally, for the same reasons articulated above, the duration of Shutterstock’s image review and its 93 percent approval rate are relevant facts, but they are not dispositive. See supra Section II.B.3. Ultimately, it is the factfinder’s role to determine the degree and significance of Shutterstock’s solicitation and screening of user content.>>

Le funzioni di hash-matching dei video, usate da Youtube, producono sempre red flags nel caso di violazioni copyright, tali da far perdere a Youtube il safe harbour ex DMCA § 512(c)?

E’ negativa la risposta dell’ 11° circuito 07 gennaio 2026, caso n. 23-13156, Athos c. Youtube :

<<In sum, as to curation and moderation technologies, the rec-
ord reflects agreement between the parties that YouTube can algo-
rithmically suggest and auto-play videos, can remove users and vid-
eos from the site, and can set its own guidelines for users and up-
loaded content on the site.
With respect to the hashing technologies, the record does
not support Athos’ factual assertions. YouTube does not run Con-
tent ID (or any of its other copyright management tools) automat-
ically or universally for all videos uploaded to the YouTube website.
Athos, moreover, has offered no evidence that any of YouTube’s
video-hash-matching or other tools have any functionality to per-
form a legal analysis of whether an identified video-hash match
constitutes copyright infringement. In fact, YouTube has pre-
sented unrebutted evidence that all of its copyright management
tools were designed with user input and management in mind be-
cause it would be unfeasible for YouTube to operate the tools by
itself without such input. Athos simply has not identified any ma-
terial facts in dispute>>. p. 16.

Poi: <<So the simple accumulation of adequately-addressed DMCA
takedown requests alone cannot amount to red flag knowledge of
other infringing activity which precludes safe-harbor protection.
See id. And “the copyright owner cannot short-circuit the notifica-
tion procedure through a blanket notification;” the DMCA consid-
ers such an attempt a failed notification “and therefore counts it as
of no effect.” Id. at 12B-82–83. Because Athos bases its red flag
knowledge argument on the volume of DMCA takedown requests
it has submitted to YouTube, and on YouTube’s refusal to remove
additional content not noticed in those takedown requests, see Ap-
pellant’s Br. at 19–20, Nimmer’s criticism of Viacom and UMG has
no effect on our resolution of the red flag knowledge issue in this
case>>, p. 23.

Ancora: << The record reflects that the copyright management tools
could not have provided YouTube with actual knowledge because
they were never used in the manner Athos suggests. As discussed
earlier, Athos has not presented evidence that any of the video-
hash-matching tools it argues were designed to provide actual
knowledge are operated automatically or universally by YouTube.
Even if it had made such a showing, the video-hash matches gen-
erated by YouTube’s technologies, as we understand them from
this record, cannot give YouTube actual knowledge of infringing
material because the tools do not perform any analysis to deter-
mine whether the hash matches they generate are legally infringing
or not.
Without any kind of additional analysis being performed by
the copyright management tools or YouTube employees,
YouTube cannot have “actually or ‘subjectively’ [known] of spe-
cific infringement,” because the tools at most produce lists of possible infringement. See Viacom, 676 F.3d at 31. See also BWP Me-
dia USA, Inc. v. Clarity Digit. Grp., LLC, 820 F.3d 1175, 1181 (10th Cir.
2016) (explaining that “if the infringing content has merely gone
through a screening or automated process, the [internet service
provider] will generally benefit from the safe harbor’s protection”).
To require YouTube to not only run its copyright management
tools in the manner Athos suggests, but to then analyze the fruits
of those tools to locate other instances of infringement, would
amount to requiring YouTube to “affirmatively [seek] facts indicat-
ing infringing activity,” in direct contravention of the balance es-
tablished by Congress in the DMCA. See § 512(m)(1). Athos has
not shown that YouTube failed to expeditiously remove any in-
fringing material it had actual knowledge of>>, p. 24/5.

Sub B c’è una breve ma chiara spiegazione tecnica delle funzioni di hash-matching predisposte da Youtube.

La sentenza è utile anche per noi, dato che la disciplina posta (ora) dall’art. 6 del DSA reg. UE 2022/2065 non è così diversa.

Ancora sulla responsabilità delle piattaforme per violazione di copyright e sul safe harbour ex § 512 DMCA

Il 9 circuito 13.01.2025, 21-2949(L) Capitol Records v. Vimeo nega la resp. di Vimeo specificando la red flag data dalla competenza di un dipendente.

Ribadisce inoltre che serve la conoscenza della illiceità dei file contestati, non di una generica possibile/probabile illiceità all’interno di tutti i materiali ospitati.

<<However, we also acknowledged in Vimeo I that it is “entirely possible that an employee of the service provider who viewed a video did have expertise or knowledge with respect to the market for music and the laws of copyright.” Id. at 97 (emphasis added). Thus, as an alternative way to establish red flag knowledge, a plaintiff could produce evidence to demonstrate that an employee (1) was not an “ordinary person” unfamiliar with these fields, and (2) was aware of facts that would make infringement objectively obvious to a person possessing such specialized knowledge. See id.
We noted, though, that “[e]ven an employee who was a copyright expert cannot be expected to know when use of a copyrighted song has been licensed,” id., and, as discussed below, even a copyright expert may similarly struggle to identify instances of fair use.
Thus, in order to carry their burden of demonstrating that Vimeo had actual or red flag knowledge of the specific instances of infringement, Plaintiffs needed to show that Vimeo employees were aware of facts making it obvious to (a) a person who has no specialized knowledge or (b) a person that Plaintiffs have demonstrated does possess specialized knowledge that: (1) the videos contained copyrighted music; (2) the use of the music was not licensed; and (3) the use did not constitute fair use>>.

Poi

<<The fact that licensing music, as a general matter, can be challenging or confusing does not make it obvious that music accompanying a particular user-uploaded video was not licensed. Even if a person without specialized knowledge would have intuited a likelihood that many of the posted videos were not authorized, that would not make it obvious that a particular video lacked authorization to use the music.

This is all the more true in view of the uncontested fact that, since 2011, Vimeo had run a store from which users could purchase licenses to use music in videos. Accordingly, Vimeo employees were aware of the existence of simplified opportunities available to purchase licenses. Furthermore, because Plaintiffs have not proved that Vimeo employees had specialized knowledge of the music industry, those employees’ awareness that music found on their videos was under copyright did not show that they knew whether the music they heard on user videos came from EMI or another label. Plaintiffs’ evidence does not support it being apparent to Vimeo employees that the music they heard on any particular video came from a label that did not offer licenses through Vimeo’s store or otherwise.

Plaintiffs also rely on the contention that EMI’s cease-and-desist letter, sent to Vimeo in 2008, put Vimeo employees on notice that any EMI music used on the website was unauthorized. Plaintiffs cite EMI Christian Music Grp., Inc. v. MP3tunes, LLC, 844 F.3d 79, 93 (2d Cir. 2016), where we explained that the defendant’s subjective awareness that there had been no legal online distribution of Beatles songs could support red flag knowledge that any online electronic copies of Beatles songs on defendant’s servers were unlicensed. But the same logic does not necessarily apply here. As the district court pointed out, an awareness that EMI sent a letter in the past demanding removal of its music gave no assurance that EMI did not thereafter make contracts licensing the use of its music, especially in view of evidence that some users who posted the videos containing EMI music asserted that EMI had provided them with authorization to use the music. The DMCA does not require service providers to perform research on mere suspicion of a user’s infringement to determine the identity of the music in the user’s video, identify its source, and determine whether the user acquired a license. See Vimeo I, 826 F.3d at 98-99 (explaining, in the context of a contention of willful blindness, that requiring service providers “constantly to take stock of all information their employees may have acquired that might suggest the presence of infringements in user postings, and to undertake monitoring investigations whenever some level of suspicion was surpassed, . . . would largely undo the value of § 512(m)”).
Even if we concluded that Vimeo had red flag knowledge that EMI’s music in user videos was not authorized or licensed, that would be insufficient to satisfy Plaintiffs’ burden. Plaintiffs needed in addition to show that it would be apparent to a person without specialized knowledge of copyright law, or, alternatively, persons who have been demonstrated to possess specialized knowledge of copyright law, that the particular use of the music in the Videos-in-Suit was not fair use>>.

(segnalazione e link offerti dal blog di Eric Goldman)

Corresponsabilità (contributory infringement) nella violazione del copyright a carico dell’internet provider

L’appello del 5 Distretto 09.10.2024, No. 23-50162, UMG Recordings, Capitol Records ed altre majorts della musica c. Grande Communications Network, decide un caso di corrsponsabilità di tipo P2P, confermando la condanna di prim grado (nell’an, non nel quantum),

Nel caso specifico la correpopnsabilità non era contestabile, dato che l’ISP era stato notiziato della violazione e nulla ha fatto.

Ma cìè staa battaglia comunque su due dei quattro requisiti di legge (<< Plaintiffs had to show (1) that Plaintiffs own or have exclusive control over valid copyrights and (2) that those copyrights were directly infringed by Grande’s subscribers. See BWP Media USA, 852 F.3d at 439. To further prove that Grande was secondarily liable for its subscribers’ conduct, Plaintiffs had to demonstrate (3) that Grande had knowledge of its subscribers’ infringing activity and (4) that Grande induced, caused, or materially contributed to that activity>>): precisamente sul 2 e sul 4. Nessuna invece sul n. 3, implicitamente ammmettendosi la willful blindness.

Qui contano spt. le tattiche di forensics: (1) ad es col software Audible Magic: Plaintiffs’ trade association, the Recording Industry Association of America, Inc.
(“RIAA”), used an industry-standard software program called Audible
Magic—which forensically analyzes the contents of digital audio files to
determine if those files match the contents of files in a database that contains
authorized authentic copies of Plaintiffs’ sound recordings—to verify that
Rightscorp in fact downloaded each work at issue,.

(2) Oppure col soggetto terzo incaricato da esse di indagini, Rightscorp: .

“To crack down on copyright infringement, third-party companies
have developed technologies to infiltrate BitTorrent and identify infringing
users by their IP addresses. One such company is Rightscorp, Inc.
(“Rightscorp”). Rightscorp’s proprietary technology:
• Interacts with BitTorrent users and obtains their agree-
ment to distribute unauthorized copies of copyrighted
works
• Records the relevant available details of that agreement,
such as the user’s IP address and what the infringed
content is
• Cross-references the user’s IP address against publicly
available databases to identify which ISP is affiliated
with that IP address
• Generates and sends infringement notices to the rele-
vant ISPs so that they can identify their infringing sub-
scribers and take appropriate action; and
• Frequently reconnects with the identified infringing IP
addresses and downloads copies of the copyrighted
works at issue directly from those users
In other words, Rightscorp identifies infringing conduct on
BitTorrent by engaging with BitTorrent users, documents that conduct, and
uses the information available to it to notify ISPs of its findings so that the
ISP can take appropriate action”.

Sintesi finale:

<< The evidence at trial demonstrated that Grande provided its
subscribers with the tools necessary to infringe (i.e., high-speed internet
access) and that Grande’s subscribers used those tools to infringe Plaintiffs’
copyrights.14 See BMG, 881 F.3d at 306-08. Based on the consistency of the
trial evidence, the district court determined that there was “no question that
[Grande] intentionally continued to provide Internet service” to its
infringing subscribers.
Grande’s affirmative choice to continue providing its services to
known infringing subscribers—rather than taking simple measures to
prevent infringement—distinguishes this case from Cobbler Nevada, LLC v.
Gonzales, 901 F.3d 1142 (9th Cir. 2018), on which Grande relies. There, the
Ninth Circuit considered a claim alleging that a subscriber of internet
services who received infringement notices failed to “secure, police and protect” his account from third parties who used his internet access to
infringe. Cobbler, 901 F.3d at 1145-46. The direct infringers were never
identified. See id. at 1145 n.1. Because the pleading premised liability
exclusively on the subscriber’s failure to take action against unknown third-
party infringers, it was insufficient to state a claim. See id. at 1147-49. Here,
Plaintiffs proved at trial that Grande knew (or was willfully blind to) the
identities of its infringing subscribers based on Rightscorp’s notices, which
informed Grande of specific IP addresses of subscribers engaging in
infringing conduct. But Grande made the choice to continue providing
services to them anyway, rather than taking simple measures to prevent
infringement. Additionally, Cobbler addressed only inducement liability
under Grokster; it did not opine on the evidence required for establishing
material contribution. See id. The court in Cobbler rejected the plaintiff’s
invitation to create “an affirmative duty for private internet subscribers to
actively monitor their internet service for infringement,” id. at 1149; it did
not absolve ISPs like Grande that continue providing services to known
infringing subscribers.
The evidence at trial demonstrated that Grande had a simple measure
available to it to prevent further damages to copyrighted works (i.e.,
terminating repeat infringing subscribers), but that Grande never took it. On
appeal, Grande and its amici make a policy argument—that terminating
internet services is not a simple measure, but instead a “draconian
overreaction” that is a “drastic and overbroad remedy”—but a reasonable
jury could, and did, find that Grande had basic measures, including
termination, available to it. See Amazon.com, 508 F.3d at 1172. And because
Grande does not dispute any of the evidence on which Plaintiffs relied to
prove material contribution, there is no basis to conclude a reasonable jury
lacked sufficient evidence to reach that conclusion.

In sum, because (1) intentionally providing material contribution to
infringement is a valid basis for contributory liability; (2) an ISP’s continued
provision of internet services to known infringing subscribers, without taking
simple measures to prevent infringement, constitutes material contribution;
and (3) the evidence at trial was sufficient to show that Grande engaged in
precisely that conduct, there is no basis to reverse the jury’s verdict that
Grande is liable for contributory infringement >>.

Interessante infine è la riduzine del quantum, dovendosi determinare il danno statutory non per singolo brano ma per albums., Ma ciò dipende da specifica norma del 17 US Code § 504 (“for the purposes of this subsection, all the parts of a compilation or derivative work constitute one work”).

(Notizia e link dal blog di Eric Goldman)

L’algoritmo di Tiktok , decidendo il feed degli utenti,. fa si che la piattaforma sia corresponsabile dei loro conteuti

Eric Goldman ci informa sull’appello del 3 circuito n. 22-3061,TAWAINNA ANDERSON, v. TIKTOK, INC.; BYTEDANCE, INC, 27.08.2024. relativo ad uno dei purtroppo frequenti demenziali video di challenge, che spingono giovani e giovanissimi a sfide pericolosissime (asfissia)

Per il collegio, il fatto che il newsfeed sia governato da TikTok fa si che i materiali caricati siano attribuibili non solo all’utente, ma anche a Tik Tok, ai fini del safe harbour ex §230 CDA.

Si tratta quindi non di third-party speech ma di first-party speech.

Tesi che, dice il 3 Circ. , è confermata dalla sentenza della Corte Suprema Moody v. NetChoice, LLC del 2024, per la quale spetta alle piattaforme la tutela del diritto di parola: ne sopportino allora le coerenti conseguenze circa il § 230 CDA.

DA noi l’art. 6 del DSA (reg. UE 2022/2065) ha diversa formulazione: irresponsabilità per “informazioni memorizzate su richiesta di un destinatario”, purchè non sappia o rimuova immediatamente.

Ma il tema si pone lo stesso, alla luce della copiosa giurisprudenza nazionale ed europea sul punto, pur legata alla precedenti disposizioni (d lgs 70 del 2003 e dir. UE 2000/31) (v concetto di hosting provider “attivo”)

Ancora sulla responsabilità degli internet provider per le violazioni copyright dei loro utenti (con un cenno a Twitter v. Taamneh della Corte Suprema USA, 2023)

Approfondita sentenza (segnalata e linkata da Eric Goldman, che va sempre ringraziato) US BANKRUPTCY COURT-SOUTHERN DISTRICT OF NEW YORK, In re: FRONTIER COMMUNICATIONS CORPORATION, et al., Reorganized Debtors, Case No. 20-22476 (MG), del 27 marzo 2024.

Si v. spt. :

-sub III.A, p. 13 ss, “Secondary Liability for Copyright Infringement Is a Well-Established Doctrine”;

– sub III.B “Purpose and Effect of DMCA § 512”, 24 ss.

– sub III.D “Twitter Did Not Silently Rewrite Well-Established Jurisprudence on Secondary Liability for Copyright Infringement” p. 31 ss sul rapporto tra la disciplina delle violazioni copyright e la importante sentenza della Corte Suprema Twitter, Inc. v. Taamneh, 598 U.S. 471 (2023).

Di quest’ultima riporto due passaggi dal Syllabus iniziale:

– la causa petendi degli attori contro Twitter (e Facebook e Google):

<< Plaintiffs allege that defendants aided and abetted ISIS in the
following ways: First, they provided social-media platforms, which are
generally available to the internet-using public; ISIS was able to up-
load content to those platforms and connect with third parties on them.
Second, defendants’ recommendation algorithms matched ISIS-re-
lated content to users most likely to be interested in that content. And,
third, defendants knew that ISIS was uploading this content but took
insufficient steps to ensure that its content was removed. Plaintiffs do
not allege that ISIS or Masharipov used defendants’ platforms to plan
or coordinate the Reina attack. Nor do plaintiffs allege that defend-
ants gave ISIS any special treatment or words of encouragement. Nor
is there reason to think that defendants carefully screened any content
before allowing users to upload it onto their platforms>>

– La risposta della SCOTUS:

<<None of plaintiffs’ allegations suggest that defendants culpably “associate[d themselves] with” the Reina attack, “participate[d] in it as
something that [they] wishe[d] to bring about,” or sought “by [their]
action to make it succeed.” Nye & Nissen, 336 U. S., at 619 (internal
quotation marks omitted). Defendants’ mere creation of their media
platforms is no more culpable than the creation of email, cell phones,
or the internet generally. And defendants’ recommendation algorithms are merely part of the infrastructure through which all the content on their platforms is filtered. Moreover, the algorithms have been presented as agnostic as to the nature of the content. At bottom, the allegations here rest less on affirmative misconduct and more on passive nonfeasance. To impose aiding-and-abetting liability for passive nonfeasance, plaintiffs must make a strong showing of assistance and scienter. Plaintiffs fail to do so.
First, the relationship between defendants and the Reina attack is
highly attenuated. Plaintiffs make no allegations that defendants’ relationship with ISIS was significantly different from their arm’s
length, passive, and largely indifferent relationship with most users.
And their relationship with the Reina attack is even further removed,
given the lack of allegations connecting the Reina attack with ISIS’ use
of these platforms. Second, plaintiffs provide no reason to think that
defendants were consciously trying to help or otherwise participate in
the Reina attack, and they point to no actions that would normally
support an aiding-and-abetting claim.
Plaintiffs’ complaint rests heavily on defendants’ failure to act; yet
plaintiffs identify no duty that would require defendants or other communication-providing services to terminate customers after discovering that the customers were using the service for illicit ends. Even if
such a duty existed in this case, it would not transform defendants’
distant inaction into knowing and substantial assistance that could
establish aiding and abetting the Reina attack. And the expansive
scope of plaintiffs’ claims would necessarily hold defendants liable as
having aided and abetted each and every ISIS terrorist act committed
anywhere in the world. The allegations plaintiffs make here are not
the type of pervasive, systemic, and culpable assistance to a series of
terrorist activities that could be described as aiding and abetting each
terrorist act by ISIS.
In this case, the failure to allege that the platforms here do more
than transmit information by billions of people—most of whom use the
platforms for interactions that once took place via mail, on the phone,
or in public areas—is insufficient to state a claim that defendants
knowingly gave substantial assistance and thereby aided and abetted
ISIS’ acts. A contrary conclusion would effectively hold any sort of
communications provider liable for any sort of wrongdoing merely for
knowing that the wrongdoers were using its services and failing to stop
them. That would run roughshod over the typical limits on tort liability and unmoor aiding and abetting from culpability>>.

La norma asseritamente violata dalle piattaforme era il 18 U.S. Code § 2333 (d) (2), secondo cui : <<2) Liability.— In an action under subsection (a) for an injury arising from an act of international terrorism committed, planned, or authorized by an organization that had been designated as a foreign terrorist organization under section 219 of the Immigration and Nationality Act (8 U.S.C. 1189), as of the date on which such act of international terrorism was committed, planned, or authorized, liability may be asserted as to any person who aids and abets, by knowingly providing substantial assistance, or who conspires with the person who committed such an act of international terrorism>>.

Trib. Roma sulla responsabilità del provider per materuiali caricati dagli utenti

Eleonora Rosati su IPKat ci notizia di (e ci linka a) due sentenza 2023 di Trib. Roma sez. spec. impr. sull’oggetto, entrambe tra RTI (attore) e una piattaforma di hosting files (Vimeo e V Kontacte).

Le domande sono respinte, alla luce del precedente della Corte di Giustizia Cyando del 2021.

Si tratta di :

– Trib. Roma 07.04.2023 n. 5700/2023, RG 59780/2017, Giudice rel. Picaro, RTI c. Vimeo;

– Trib. Roma 12.10.2023 n. 14531/2023, RG 4341/2027, giud. rel.: Cavaliere, RTI v. V Kontakte;

Per Rosati la lettura del pcedente europeo è errata.

Qui io solo evidenzio che i) civilisticamente non ha dignità giuridica da noi la distinzine tra responsabilità primaria e secondaria/indiretta nel caso di materiali illeciti caricati dagli utenti e ii) il safe harbour copre ogni responsabilità da esso conseguente.

Il punto più importante è che, per perdere il safe harbour, bisogna che il provider avesse contezza dell’esistenza degli specifici illeciti azionati, non di una loro generica possibilità.

Altra questione poi è quella del livello di dettaglio della denuncia al provider da parte del titolare dei diritti. Per il Trib. deve essere elevato: ed è esatto, stante il principio per cui onus probandi incumbit ei qui dicit , regola processuale che va applicata anche alla denuncia de qua (nè c’è ragione per caricare il provider di attività faticose e incerte, a meno che tali non siano più per ragioni ad es. di avanzamento tecnologico).