Ninth Circuit Rules on GitHub Copilot and Copyright Attribution

The Ninth Circuit affirmed dismissal of the plaintiffs’ DMCA claim.

But the court’s reasoning is more nuanced than saying that the defendants broadly won or that AI-generated code is legally safe.

The court first held that the programmers had adequately alleged Article III standing at the pleading stage. Their complaint plausibly alleged a substantial risk that Copilot could reproduce their code without accompanying attribution information.²

The claim nevertheless failed on the merits.

The court concluded that the complaint described Copilot as a system that learns patterns from existing code and then generates new works. Under that theory, the system was not taking an existing copy containing CMI and removing that information from the copy.

Instead, the generated work allegedly never contained the original CMI in the first place. That distinction was decisive under the particular DMCA theory presented.³

This is the central legal point.

Section 1202(b) prohibits certain acts of removing or altering copyright-management information. The Ninth Circuit reasoned that those words imply an affirmative act directed at CMI already connected to an existing work.

In plain English: if someone takes an existing copyrighted photograph and crops out the photographer’s credit, that may look like removal of CMI.

But if an AI system creates a new output that resembles existing material and never includes attribution in the first place, the legal analysis may be different.

The court held that merely failing to include CMI in a newly generated work is not necessarily the same thing as removing CMI from an existing copy.

The Ninth Circuit also clarified an important point. The district court had referred to an “identicality” requirement, but the appellate court said that term can be misleading.

A plaintiff does not necessarily need to show that the allegedly infringing work is literally identical to the original. Minor changes do not automatically defeat a § 1202 claim.⁴

If the evidence supports a reasonable inference that the defendant actually copied an existing work and removed the attached CMI, small changes to the copied work may not protect the defendant.

The real question is whether CMI was actually removed or altered from a copy of an existing protected work. That is different from asking whether two works are perfectly identical.

This may be the most important part of the decision for founders and developers.

The Ninth Circuit expressly declined to decide whether AI-generated output that is substantially similar to existing code could support an ordinary copyright-infringement claim.⁵

The court noted that copyright law separately addresses situations where a new work may be substantially similar to protected expression.

The ruling therefore does not mean that AI-generated code cannot infringe copyright, copyrighted code may freely be used without consequence, open-source license obligations disappear, attribution requirements no longer matter, or AI companies were broadly cleared of copyright liability.

The decision resolved a particular DMCA § 1202(b) theory. That is much narrower.

The plaintiffs also argued that copyright-management information may have been removed from code before the material was used for training.

The Ninth Circuit called this the plaintiffs’ “input” theory. But the court did not decide whether that theory would succeed.

Instead, it concluded that the plaintiffs had forfeited the argument because it had not been properly preserved in the district court.⁶

A court declining to decide a theory for procedural reasons is not the same as rejecting the theory on its merits.

The programmers also asserted breach-of-contract claims. Those claims were not dismissed in the ruling being appealed and remain pending in the district court.

That matters because many open-source licenses impose conditions on use, copying, modification, or distribution.

A dispute involving open-source code may involve several different questions at once: whether CMI was removed or altered under the DMCA; whether protected expression was unlawfully copied; whether open-source license conditions were followed; and whether enforceable contractual obligations were breached.

Those theories should not be treated as interchangeable. Mahrouyan Law advises on selected copyright and intellectual-property disputes, while related licensing or contract disputes may also implicate business-litigation strategy.

The practical takeaway is not that founders should stop using generative-AI coding tools. It is that AI-assisted development does not eliminate ordinary IP diligence.

Businesses using AI-generated code should still consider where important code originated; whether generated output closely resembles known third-party code; whether open-source licenses apply; whether required notices or attribution have been preserved; whether employees and contractors properly assign IP; and whether important code is documented before fundraising, licensing, or acquisition.

For early-stage companies, these issues can become especially important during investment due diligence, acquisitions, enterprise contracting, licensing, IP audits, and ownership disputes.

Clear founder IP ownership and assignments are also part of sound startup and business transactions planning.

AI may make code generation faster. It does not make intellectual-property risk disappear.

Doe v. GitHub draws an important line.

A claim that an AI system generated something without attribution is not automatically the same as a claim that the system removed attribution from an existing copy.

That distinction defeated the plaintiffs’ DMCA output theory. But the ruling leaves other questions open—including ordinary copyright infringement, open-source licensing, and pending contract claims.

For founders, developers, and creators, the useful takeaway is straightforward: the dismissal of one copyright-related theory does not mean AI-generated output is legally risk-free.