Section 1201 of the United States Copyright Act, added by the Digital Millennium Copyright Act (DMCA) in 1998, makes it unlawful to circumvent a technological measure that effectively controls access to a copyrighted work, and to traffic in tools designed for that purpose.[1][3] Because software is a copyrighted work, the section applies to licence keys, activation servers, dongles and similar technology that a vendor uses to decide who may run a program. Violation of the section does not require infringement of the underlying copyright. The section also contains exemptions, one of which, for reverse engineering to achieve interoperability, is specific to computer programs.
History
Congress added section 1201 in 1998 as part of the DMCA. The Copyright Office describes the triennial rulemaking in the section as a “fail-safe” mechanism that ensures the prohibition does not adversely affect the public’s ability to make lawful uses of works, including fair uses.[3]
Before the section existed, courts dealt with reverse engineering under copyright’s fair use doctrine. In Sega Enterprises v. Accolade (1992), the Ninth Circuit held that disassembly of a program was a fair use where it was the only way to reach unprotected functional elements and the purpose was legitimate.[10] See Sega v. Accolade. The 1998 statute then added a specific interoperability exemption, in subsection (f), tied to non-infringement.[1]
Scope and definitions
The statute defines the key terms as follows.[1]
- To circumvent a technological measure means to descramble a scrambled work, decrypt an encrypted work, or otherwise avoid, bypass, remove, deactivate or impair the measure, without the authority of the copyright owner.
- A measure effectively controls access to a work if, in the ordinary course of its operation, it requires the application of information, a process or a treatment, with the authority of the copyright owner, to gain access to the work.
- A measure effectively protects a right of a copyright owner if, in the ordinary course of its operation, it prevents, restricts or otherwise limits the exercise of a right of the copyright owner under the Copyright Act.
The statute does not mention licence keys, activation or software metering. Whether a particular licence check is a measure of this kind is decided under these definitions, case by case.
How the prohibitions work
The section contains three distinct prohibitions.[1]
- Act of circumvention (section 1201(a)(1)(A)). No person may circumvent a technological measure that effectively controls access to a protected work.
- Access-control trafficking (section 1201(a)(2)). No person may manufacture, import, offer to the public, provide or otherwise traffic in a technology, product, service, device, component or part that is primarily designed for circumventing an access control, has only limited commercially significant purpose other than circumvention, or is marketed for circumvention.
- Copy-control trafficking (section 1201(b)(1)). The same trafficking prohibition applies to tools that circumvent protection afforded by a measure that effectively protects a right of the copyright owner, such as a copy control.
There is no ban on the act of circumventing a copy control. Section 1201(c)(1) states that the section does not affect rights, remedies, limitations or defenses to copyright infringement, including fair use.[1] Section 1201(c)(3) adds that designers of consumer electronics, telecommunications or computing products are not required to respond to any particular technological measure.[1]
Permanent exemptions
Section 1201 contains several permanent exemptions. They cover nonprofit libraries, archives and educational institutions deciding whether to acquire a work (subsection (d)); lawful government investigative, protective, information security and intelligence activity (subsection (e)); encryption research (subsection (g)); and the protection of personally identifying information (subsection (i)).[1]
Reverse engineering for interoperability (section 1201(f))
Subsection (f) is the provision most directly relevant to software. It permits a person who has lawfully obtained the right to use a copy of a computer program to circumvent an access control for the sole purpose of identifying and analysing those elements of the program that are necessary to achieve interoperability of an independently created program with other programs, and that have not previously been readily available to that person. It applies only “to the extent” the acts do not constitute infringement.[1]
Further paragraphs allow the person to develop and use technological means for that purpose, if necessary to achieve interoperability, and to share the information or means with others, but only to enable interoperability of an independently created program and without infringing or violating other law. The statute defines interoperability as the ability of computer programs to exchange information and mutually to use the information exchanged.[1]
In Davidson & Associates v. Jung, the Eighth Circuit applied the exemption to a server emulator that let Blizzard games run multiplayer without the vendor’s CD key checks. It held that the exemption failed because the circumvention constituted infringement: the emulator did not check whether a key was valid or in use, so unauthorised copies were freely played on it.[6] See Davidson v. Jung.
Temporary exemptions: the triennial rulemaking
Every three years the Librarian of Congress, on the recommendation of the Register of Copyrights, determines in a rulemaking whether users of particular classes of works are, or are likely to be, adversely affected in their ability to make noninfringing uses. The resulting exemptions apply to the access-control ban for the following three years. They do not apply to the trafficking prohibitions, and the statute says the exemptions cannot be used as a defence to any other claim under the Copyright Act.[1] The exemptions are published in 37 CFR 201.40.[2]
Current exemptions relevant to software
The current text of 37 CFR 201.40, as amended by the 2024 final rule, includes the following classes involving computer programs.[2]
| Paragraph | Class (summary) |
|---|---|
| (b)(8) | Programs that enable wireless devices to connect to a network, for connection authorised by the network operator |
| (b)(9) to (b)(12) | Programs that enable smartphones, smart televisions, voice assistants, and routers and dedicated network devices to run lawfully obtained applications, solely for interoperability or removal of software |
| (b)(13) and (b)(14) | Programs in lawfully acquired vehicles and vessels, for diagnosis, repair or lawful modification, and for access to operational data |
| (b)(15) to (b)(17) | Programs in consumer devices, retail-level food preparation equipment and medical devices, for diagnosis, maintenance or repair |
| (b)(18) | Computer programs, for good-faith security research on lawfully acquired devices or with the owner’s authorisation |
| (b)(19) | Lawfully acquired video games, where the owner has ceased to provide the authentication server, to restore gameplay, and preservation of games by eligible libraries, archives and museums |
| (b)(20) | Computer programs, except video games, no longer reasonably available commercially, for preservation by eligible libraries, archives and museums |
| (b)(21) | Programs that operate 3D printers, solely to use alternative material |
| (b)(22) | Computer programs, solely to investigate potential infringement of free and open source programs, by a party with standing to bring a breach of licence or copyright claim |
Several of these have conditions. The repair and jailbreaking classes exclude circumvention for the purpose of gaining unauthorised access to other copyrighted works, and the security research class states that it is not a safe harbour from other law such as the Computer Fraud and Abuse Act.[2] The wording of each class controls, and the table is a summary only.
The 2024 rule and the next proceeding
The ninth triennial rule was published on 2024-10-28 and took effect that day. In it the Librarian adopted exemptions on the Register’s recommendation. The Register recommended denying a proposed exemption for generative AI trustworthiness research, finding that the adverse effects identified arose from third-party control of online platforms rather than from section 1201.[3] The Copyright Office publishes the recommendation, the rule and the National Telecommunications and Information Administration letter on its 2024 proceeding page.[4]
The Office has opened the tenth triennial proceeding. Its notice of inquiry is dated 2026-06-09. Petitions to renew current exemptions and for new exemptions were due 2026-08-24, and comments on renewal petitions were due 2026-09-28. Exemptions renewed in this proceeding remain in force for the three years from October 2027 to October 2030.[5] Until the final rule is published, 37 CFR 201.40 as it stands is the operative text.
Licence keys, activation and licence-enforcement technology
The following is commentary on how the cited authorities treat licence-enforcement mechanisms, not a statement of settled law. The courts of appeals have not applied the definitions uniformly.
Key and handshake checks can be access controls. In Davidson, the court held that Blizzard’s “secret handshake” using CD keys effectively controlled access to the Battle.net mode of its games, and that the emulator allowed access without a valid or unique key.[6]
A check that leaves the code readable may not be. In Lexmark v. Static Control, the Sixth Circuit held that a printer authentication sequence did not “control access” to the printer engine program, because anyone who bought a printer could read the program’s code directly from its memory. The court said a lock on the back door does not control access to a house whose front door is unlocked, and that the statute does not naturally apply to otherwise readily accessible works.[7] A licence check that runs only after a program is installed and readable on disk may be analysed the same way.
Courts differ on whether infringement must be linked. The Federal Circuit in Chamberlain v. Skylink held that section 1201 prohibits only forms of access that bear a reasonable relationship to the protections the Copyright Act affords, and required the copyright owner to show that relationship.[8] The Ninth Circuit in MDY v. Blizzard rejected an infringement nexus requirement. It found that Blizzard’s Warden software did not effectively control access to the game’s literal elements, which sat on the player’s hard drive, but did so for its dynamic non-literal elements, which could be reached only by connecting to Blizzard’s servers. It found no liability under section 1201(b)(1) because Warden did not protect a right of the copyright owner.[9] See MDY v. Blizzard.
Server-dependent activation has its own exemption. Paragraph (b)(19) of 37 CFR 201.40 covers lawfully acquired video games for which the owner has ceased to provide the external server needed for the authentication process, so that players may restore access for personal, local gameplay.[2] The Federal Register notice records that the exemption was renewed in 2024 without opposition.[3] No class in the current rule covers circumvention of licence keys or activation for business software generally.[2]
What this means in practice
- Tools that bypass a licence check, such as key generators or emulated licence servers, may fall within the trafficking prohibitions if they are primarily designed for circumvention, have limited other commercial use or are marketed for it, as in Davidson and MDY.[1][6][9]
- A licensee’s breach of a licence term is a different question from circumvention. Section 1201 applies to defeating a technological measure, and the cases above turn on the technology involved.
- The reverse-engineering exemption protects work aimed at interoperability, and does not extend to circumvention that enables infringement.[1][6]
Relationship to other topics
Section 1201 operates alongside copyright infringement and contract law. Reverse engineering that is a fair use under Sega can still be restricted by contract, as in Davidson, and can still raise a circumvention question if it defeats an access control. The Second Circuit’s approach to what in a program is protectable, in Computer Associates v. Altai, concerns infringement and not circumvention. For the contract side see Software license, and for disputes more generally see Software licensing litigation.
Out of scope
This article does not cover the law of other jurisdictions (including the EU Software Directive), criminal penalties, civil remedies under section 1203, or the contractual terms of any particular vendor. It does not assess whether any specific product’s licence mechanism qualifies as an access control.