Supreme Court Limits Secondary Copyright Liability for Internet Service Providers

Supreme Court Limits Secondary Copyright Liability for Internet Service Providers

Supreme Court Limits Secondary Copyright Liability for Internet Service Providers

April 7, 2026 (LSB11416)

On March 25, 2026, the Supreme Court issued its decision in Cox Communications v. Sony Music Entertainment (Cox), which limited the liability of internet service providers (ISPs) for the copyright infringements of their users. Cox clarified the legal standard for contributory infringement, a doctrine under which a party can sometimes be held responsible for copyright infringement committed by another person. Cox held that that contributory copyright infringement requires intent, which can be shown "only if the party induced the infringement or the provided service is tailored to that infringement."

The plaintiffs in Cox had obtained a $1 billion jury verdict against the ISP based on evidence that Cox had continued to provide internet access to certain subscribers after these accounts had been repeatedly flagged for illegally downloading copyrighted works. The Supreme Court held that this evidence was legally insufficient to show the necessary intent, explaining that "merely providing a service to the general public with knowledge that it will be used by some to infringe copyrights" does not make an ISP liable for copyright infringement.

In effect, the ruling in Cox confines the doctrine of contributory copyright infringement to two theories that the Court previously recognized in Metro-Goldwyn-Mayer Studios Inc. v. Grokster, Ltd. (Grokster) and Sony Corp. of America v. Universal City Studios, Inc. (Sony). Following Cox, it will generally be harder for copyright owners to hold online platforms like ISPs, artificial intelligence (AI) companies, or e-commerce websites liable for the infringing activities of their users.

The decision in Cox was unanimous in reversing the lower-court jury verdict. Justice Thomas wrote the opinion of the Court. Justice Sotomayor, joined by Justice Jackson, concurred only in the judgment, agreeing with the result but arguing that the Court's opinion "unnecessarily limits secondary liability."

This Sidebar reviews the copyright law underlying the dispute in Cox, the history of the case in the lower courts, the Court's March 2026 decision, and selected considerations for Congress.

Copyright Infringement and the Internet

Copyright Basics

Copyright law grants the authors of original creative works (e.g., books, visual art, music, movies) a set of exclusive rights in their creations, including the exclusive right to copy, adapt, perform, or distribute the work. A person who takes one of these actions without the copyright holder's permission is said to infringe the copyright and may be liable for monetary damages or other legal remedies. In addition to damages based on actual economic harm, the Copyright Act allows successful plaintiffs to seek statutory damages of between $750 and $30,000 per work infringed, or up to $150,000 per infringed work if the defendant's infringement is "willful."

Secondary Liability for Copyright Infringement

Cox involved the purported liability of ISPs for the actions of a third party: the ISP's subscribers, some of whom used the internet access provided by the ISP to illegally download music. The Copyright Act does not explicitly provide a standard for "secondary" copyright-infringement liability, that is, the circumstances under which one person may be held legally responsible for the infringing acts of another person (the "direct" infringer). Federal courts have nonetheless developed standards for secondary liability by relying on common law principles or analogies to patent law.

Over time, federal courts have developed two distinct doctrines of secondary liability for copyright infringement, although the line between them is not always "clearly drawn." The first doctrine, called vicarious liability, imposes liability "when the defendant profits directly from the infringement and has a right and ability to supervise the direct infringer." Defendants need not actually know about the specific infringing conduct to be vicariously liable, but they must directly profit from the infringement while "declining to exercise a right to stop or limit it." Under this theory, courts have held the owner of an entertainment venue liable for infringing musical performances held in the venue.

The other doctrine, contributory infringement, is premised on "intentionally inducing or encouraging" another person's infringement. Prior to Cox, lowers courts had understood contributory infringement to allow liability when a party "with knowledge of the infringing activity, induces, causes or materially contributes to the infringing conduct of another." For example, lower courts relied on contributory infringement to hold an agency liable when it knowingly advertised infringing works.

The Supreme Court has decided two contributory infringement cases under the Copyright Act of 1976 (the current copyright statute). In its 1984 Sony decision, the Court addressed whether the manufacturer of the Betamax videocassette recorder (VCR) could be held liable for the copyright infringement of some Betamax purchasers. While a VCR has infringing uses (e.g., making a copy of a movie shown on TV in order to sell it), the Court found that VCRs had noninfringing uses as well (including "time-shifting," the noncommercial home recording of a broadcast television program to watch it at a more convenient time). Borrowing from patent law's "staple article of commerce" principle, the Court held that the seller of a device with both infringing and noninfringing uses could not be held secondarily liable if the device (like the VCR) was "capable of substantial noninfringing uses."

The Court's 2005 decision in Grokster also involved a "dual-use" technology (i.e., a device with both infringing and noninfringing uses), but the Court reached a different conclusion than it had in Sony. The defendant in Grokster was a distributor of peer-to-peer networking software that allowed users to share computer files with each other directly, as opposed to through a central server. Although in theory this software might be used to exchange any type of digital information, in practice Grokster (like the unrelated but similar program Napster) was primarily used to distribute copyrighted music and video files. Distinguishing Sony, the Supreme Court held that Grokster was contributorily liable for its users' copyright infringement on an inducement theory. Specifically, the Court found Grokster liable based on the "active steps" it took to "encourage direct infringement" by its users—for example, by marketing its software to Napster users.

The "Safe Harbors" of the Digital Millennium Copyright Act of 1998

In 1998, Congress enacted the Digital Millennium Copyright Act (DMCA) to adapt copyright law to the emerging digital age. The DMCA sought to balance the concerns of copyright holders (who feared that the ease and speed of digital copying would fuel widespread copyright infringement) with those of internet technology companies (who feared that legal uncertainty over whether ISPs were liable for infringing material online would stifle technological innovation).

The DMCA's "safe harbor" provisions for online "service providers" (broadly defined to include ISPs such as Cox as well as online "platforms" such as YouTube) were part of this compromise. The safe harbors provide that online service providers will not be secondarily liable for copyright infringement based on certain activities (e.g., transmitting information through a network or storing user-generated material on an online platform) if they meet a number of statutory requirements. One of those requirements is that the service provider must adopt and "reasonably implement" a policy to terminate users who are repeat infringers. Another key requirement for a widely used safe harbor is that the service provider must implement a "notice-and-takedown" system, which allows copyright holders to notify service providers about infringing content on their platform and seek to remove that content. Although online service providers may choose to follow the DMCA's requirements to take advantage of the safe harbors, they are neither required to do so nor necessarily liable for copyright infringement if they do not meet the DMCA's conditions.

The Lower Court Decisions in Cox

In 2018, a group of music-industry copyright holders sued Cox for infringement in the U.S. District Court for the Eastern District of Virginia, alleging that the ISP was liable for downloads of copyrighted music files made by its subscribers using BitTorrent protocol (or similar methods of peer-to-peer file sharing). Specifically, Sony and the other plaintiffs alleged that some of Cox's subscribers illegally downloaded thousands of copyrighted works, that Cox had knowledge of its users' infringements based on DMCA notices sent to Cox, and that Cox had consistently failed to terminate the internet access of known repeat infringers. An earlier ruling by the U.S. Court of Appeals for the Fourth Circuit (Fourth Circuit) had already established that Cox could not rely on the DMCA's safe harbors during the relevant time period because it lacked a reasonable policy to terminate repeat infringers. The case went to trial, and a jury found Cox liable for both contributory and vicarious infringement, awarding $1 billion in statutory damages based on a finding that Cox's infringement was willful.

Cox appealed to the Fourth Circuit, which affirmed in part. The appeals court agreed with Cox that the ISP was not vicariously liable for its users' copyright infringement as a matter of law. Because Cox charged its subscribers "a flat monthly fee for their internet access no matter what they did online" the court concluded that Cox did not "profit directly" from the infringement, as required for vicarious liability. The Fourth Circuit affirmed the jury's verdict on contributory infringement, however. It upheld the lower court's finding that Cox had constructive knowledge of particular users' repeat infringements based on the notices that rightsholders had sent to Cox. As to Cox's "material contribution" to the infringement, the court found the evidence sufficient for the jury to conclude that continuing to provide internet access "with knowledge that the recipient will use it to infringe copyrights is exactly the sort of culpable conduct sufficient for contributory infringement."

The Supreme Court's Ruling in Cox

Both Cox and Sony sought review from the Supreme Court. While the Supreme Court denied Sony's petition to review the vicarious-liability issue, it granted Cox's petition to review the question of whether Cox's actions were sufficient for contributory infringement.

Justice Thomas's opinion for the Court, joined by six other Justices, viewed the case as a straightforward application of the Court's precedents in Sony and Grokster. Although secondary liability is long established in copyright case law, the Court's opinion observed that "[o]rdinarily, when Congress intends to impose secondary liability, it does so expressly [i.e., in statutory text]." For that reason, the Court was "loathe to expand [secondary] liability beyond" its own precedents. Justice Thomas's opinion therefore only examined whether Cox's actions were sufficient for inducement under Grokster or lacked any "substantial noninfringing use" under Sony—as opposed to other formulations of contributory liability recognized by lower courts.

Under that approach, the Court held that Cox was not contributorily liable for its subscribers' infringements. As to Grokster-type inducement, the Court found that Cox may have had knowledge of its users' infringements, but it did not intend for its internet service to be used to infringe, nor did it directly "promot[e]" or "market[]" infringing uses. As to liability under the Sony doctrine, the Court observed that internet access, like VCRs, is capable of many substantial noninfringing uses besides copyright infringement. Cox's actions were therefore insufficient under either Grokster or Sony.

The Court thus rejected the Fourth Circuit's view that supplying a service with the knowledge that a particular user will use it to infringe suffices for contributory liability. Cox further rejected any other basis for contributory liability that goes "beyond the two forms of liability recognized in Grokster and Sony." Additionally, the Court dismissed Sony's argument that the DMCA safe harbors would have "no effect" if ISPs lacked any obligation to terminate repeat copyright infringers. The Court reasoned that the safe harbors were irrelevant because they are only a defense to liability, and do not create any liability themselves.

Justice Sotomayor's concurring opinion, joined by Justice Jackson, agreed with the majority that Cox was not liable because it lacked the requisite intent to aid its users' infringement. That said, the concurrence criticized the majority opinion's "artificial limiting of secondary liability" doctrine to Grokster and Sony "without any meaningful explanation." The concurrence explained that Sony and Grokster had themselves "left open the possibility that other common-law theories of such liability, like aiding and abetting, could apply in the copyright context." The majority opinion in Cox was therefore, in the concurrence's view, inconsistent with the precedents it relied upon. Additionally, the concurrence argued that the majority's rule "upends" the balance Congress struck between online service providers and copyright holders through the DMCA safe harbors. Given Cox's relatively narrow construction of secondary liability, the concurrence averred that "ISPs no longer face any realistic probability of secondary liability" and therefore have little reason to continue to comply with the DMCA.

Considerations for Congress

Copyright infringement liability, whether direct or secondary, is based on an act of Congress: the Copyright Act of 1976. Historically, Congress has chosen not to codify specific statutory standards for secondary copyright liability, leaving the scope of these doctrines to the courts to develop in a common-law fashion. If Congress disagrees with the result in Cox or the limits on secondary liability adopted by the Court, it could consider amending the Copyright Act to more precisely delineate the scope of secondary liability in statute, as it has done in the Patent Act. For example, such amendments might define what constitutes "materially contributing" to infringement, clarify the level of intent or knowledge required for contributory infringement, or set out the sorts of evidence sufficient to demonstrate intent.

Congress may also consider whether to modify the DMCA's safe harbors in response to Cox. As the majority in Cox stated, the DMCA safe harbors do not themselves impose liability. Their requirements are optional for online service providers who do not wish or need to rely on a safe harbor from secondary liability. Congress may thus consider conducting oversight to determine whether, as feared by the concurrence in Cox, online service providers will respond to the decision by choosing to stop complying with the DMCA's requirements. Should Congress conclude that its intent in the DMCA has been undermined by Cox, Congress could consider changing the incentives for online service providers to comply with the DMCA or making the DCMA's requirements mandatory in some cases.

The impact of Cox is not likely to be limited to the liability of ISPs. Analogous secondary liability issues may arise, for example, if users of generative AI use those tools to generate content that infringes on existing creative works, if social media users distribute infringing works on those platforms, or if infringing content is sold by third parties using e-commerce platforms. By rejecting any basis for contributory liability beyond Grokster and Sony, the decision in Cox makes it more difficult to win lawsuits against technology companies that do not themselves infringe copyrights, but make tools or platforms that some users employ for infringement. Congress may consider whether Cox's rule strikes the right balance between allowing dual-use technologies and open online platforms, and preserving copyright holders' ability to enforce their rights.