Doe v. GitHub is a putative class action by programmers who published code on GitHub under open-source licences, against GitHub, its owner Microsoft, and OpenAI, over the AI coding tools GitHub Copilot and OpenAI Codex. The plaintiffs allege that the tools sometimes reproduce their code without the attribution, copyright notices or licence terms that accompanied it. On 2026-09-16 the Ninth Circuit affirmed dismissal of their claim under section 1202(b) of the Digital Millennium Copyright Act (DMCA), holding that the tools “do not ‘remove or alter’ copyright management information (CMI) from a copy of an existing protected work but instead create new works that never contained that information”.[1] Two claims for breach of contract remain pending in the district court.[1]
Background
As the Ninth Circuit described it, much of the code in public GitHub repositories is made available under open-source licences, and “one of the most common conditions is attribution”, meaning that a copy of the licence, including the author’s name and copyright notice, must accompany any copy or derivative of the code.[1] Copilot is a paid subscription service developed by GitHub and OpenAI that uses a modified version of Codex to produce code in response to prompts; according to the complaint, it was trained on billions of lines of public code, including “all available public GitHub repositories”.[1] How Copilot is sold is described in GitHub Copilot licensing.
The dispute
The action was filed on 2022-11-03 before Judge Jon S. Tigar.[3] After two rounds of dismissals and amendments, the complaint was reduced to one DMCA claim and two breach of contract claims. The DMCA claim alleged that Copilot will sometimes produce “identical copies of code Copilot was trained on” without the attribution, copyright notices or licence terms, in violation of 17 U.S.C. § 1202(b).[1]
The district court dismissed the DMCA claim, first with leave to amend and then, on 2024-06-24, with prejudice, reasoning that section 1202(b) claims require the copies to be “identical” and that the plaintiffs’ examples were modified versions or functional equivalents of their code. It denied the motion to dismiss the contract claims.[1][3] On 2024-09-27 the court certified for interlocutory appeal the question “whether Sections 1202(b)(1) and (b)(3) of the DMCA impose an identicality requirement”, noting that district courts had reached differing conclusions, and stayed the case pending appeal.[2] The Ninth Circuit granted permission to appeal on 2024-12-19.[3]
Decision or outcome
The panel (Judges Thomas and Miller and District Judge Blumenfeld; opinion by Judge Miller) held that the plaintiffs had Article III standing, because the complaint plausibly alleged a substantial risk that Copilot would emit their code without CMI. It noted the complaint’s reference to GitHub’s duplicate-detection feature, which lets users block suggestions matching public code of 150 characters or more, as some evidence that Copilot can emit identical code.[1] It declined to consider an “input” theory, that CMI was stripped from code used as training data, as forfeited.[1]
On the merits, the court held that “remove” and “alter” imply an act on CMI attached to an existing copy, and that “one who creates a new work and fails to include CMI cannot be said to have ‘removed’ or ‘altered’ anything”. It described “identicality” as “something of a misnomer”: near-identical reproduction can be strong evidence of removal, but the plaintiffs’ own allegations described a model that generates new works from learned statistical patterns rather than retrieving stored copies.[1] It expressed no view on whether the output could support a copyright infringement claim, and declined “to transform run-of-the-mill copyright-infringement claims into DMCA claims”.[1]
Significance for software licensing and SAM practice
The decision limits DMCA attribution claims against generative AI tools in the Ninth Circuit where the output is a new work rather than a copy with its notices stripped.[1] It does not decide whether using or distributing AI-generated code that matches licensed code complies with that code’s licence; the contract claims based on the licences were not dismissed and remain to be decided.[1] For organisations using such tools, the open-source conditions described in GNU GPL, LGPL and AGPL obligations and open-source software licensing continue to apply to code they distribute.
Lessons learned
- Attribution is a licence condition. The court described attribution, including the author’s name and copyright notice, as one of the most common conditions of open-source licences on GitHub, and the plaintiffs’ case rests on its omission from Copilot output.[1]
- Contract exposure survived. The DMCA claim failed, but the district court denied the motion to dismiss the breach of contract claims, which remain pending.[1]
- Tool settings are relevant evidence. The court relied on the complaint’s description of GitHub’s filter for suggestions matching public code, which shows that the configuration of AI coding tools can matter in a dispute.[1]