Ashley Madison’s owners have been sending numerous takedown notices to platforms like Twitter, Reddit, and others in an attempt to stop the dissemination of millions of names and email addresses of the site’s users.
This statement was originally published on eff.org on 24 August 2015.
Copyright is a poor tool for making embarrassing information disappear from the Internet. It rarely succeeds, and often draws more attention to whatever was embarrassing or harmful. Copyright isn’t designed for keeping secrets (in fact, it was generally meant to do the exact opposite by encouraging disclosure). Yet people keep trying to use copyright law, in part because takedown notices under the Digital Millennium Copyright Act (DMCA) are quick and easy, and because the rhetoric of “theft” and threats of ridiculously large penalties can be quite scary.
The latest to abuse the DMCA is Avid Life Media, the owner of the Ashley Madison website, which bills itself as “the most famous name in infidelity and married dating.” Ashley Madison’s owners have been sending numerous DMCA takedown notices to platforms like Twitter, Reddit, and others in an attempt to stop the dissemination of millions of names and email addresses of the site’s users. The data was posted publicly this week following a hack of the site in July. While there’s no doubt that the leak is embarrassing and potentially disastrous for the millions of people who have been revealed as users of a site that promotes marital infidelity, Ashley Madison’s attempts to use the DMCA to put the genie back in the bottle are misguided, and in some cases, may violate the DMCA itself.
The DMCA creates a “safe harbor” that protects user-generated content websites against liability for copyright infringement by their users. To qualify for the safe harbor, sites have to accept notices of alleged infringement containing certain information and the signature of a responsible party. Upon receiving a notice, a site needs to “expeditiously” disable access to the material identified as infringing in order to receive the protection of the safe harbor. (There are other requirements as well.) The user who posted the material can send a counter-notice if they believe the posting was lawful. After a counter-notice, the site is supposed to put the material back up within 10 to 14 business days. At that point, the rightsholder must file a lawsuit against the poster to have the material taken down.
Although the law doesn’t require websites to use the DMCA process, many choose to do so to get the protection of the safe harbor. It’s become a standard practice for websites based in the U.S. and sometimes in other countries. Importantly, the DMCA process applies only to copyright claims. It can’t be used for other complaints like defamation, invasion of privacy, trademark infringement, trade secret disclosures, or violations of a website’s terms of use or community guidelines.
The DMCA process is relatively quick and easy. Instead of filing a lawsuit or tracking down the poster, all it requires is an email to the site, or filling out a Web form. After that, the material disappears for at least ten days, and often permanently. This ease of use makes it incredibly tempting to use the DMCA as a tool for censoring online speech that someone doesn’t like, for any number of reasons, from political to personal, but often having no connection to copyright infringement. Sending DMCA notices for material that’s not infringing is against the law, and it can leave the sender liable for damages. But claims for takedown abuse that actually make it to court are rare, and the temptation to use the DMCA as a quick way to get “stuff I don’t like” off of the Internet remains strong.
Over the past week, Avid Life has been using DMCA notices to try to contain a damaging and highly embarrassing disclosure of personal information. Regardless of whether their goal is a noble one, their use of the DMCA is problematic. Avid Life probably doesn’t have any copyrights in most of the material the company is trying to suppress. According to news reports, the data leak contained names, addresses, phone numbers, encrypted passwords, and e-mail addresses of Ashley Madison users, as well as users’ own descriptions of what they were looking for on the site. Mere facts, like names, addresses, and phone numbers, aren’t copyrightable.
Biographical descriptions or pickup lines written by users can be copyrightable, but the copyright belongs to the users, not the site owners. While it might be possible for a website to have its users transfer their copyrights to the site’s owner, this is relatively difficult and rarely done, and we would be surprised if Avid Life successfully did this to Ashley Madison users. It’s more likely that users simply gave the site a “non-exclusive license” to store and post their material, but that sort of license doesn’t give the site any authority to send DMCA takedowns on users’ behalf.
It’s possible for the site to have a copyright in the “selection and arrangement” of users’ data, but only if they used some creativity in selecting users or putting their database in order. Obvious forms of organization like an alphabetical listing don’t give the database owner any copyright. To claim this form of copyright, Avid Life would have to show that someone copied not just the user data but Avid’s creative arrangement of the data. This is also unlikely.
According to reports, Avid’s DMCA takedown notices were vague about the claims they were making. The notices contained statements like “Avid owns all intellectual property in the data.” But without a valid claim of copyright infringement, a DMCA takedown notice isn’t valid, and websites don’t need to comply with it. While some reposts and discussions of the Ashley Madison leak have been taken down, others remain up, and Avid’s DMCA campaign is unlikely to curtail access to the data very much.
There are likely millions of people who would like to see the Ashley Madison user data disappear from the Internet, including the site’s owner. Undoubtedly, the leak has done and will do great damage. But DMCA notices are not a tool for putting the genie back in the bottle. Using them for non-copyright purposes is against the law, and encourages more abuse, such as censoring political commentary and criticism. If Avid Life doesn’t actually hold any copyrights in the user data—the most likely scenario—then their use of the DMCA is not only ineffective but wrong.
