When a user adds an unlicensed song to something they make on your platform, the user is the direct infringer. Your platform can still be pulled in through secondary liability, and DMCA safe harbor is the shield against money damages for what users upload, but only if you meet its conditions. That shield is built around material stored at a user's direction, so music your platform supplies itself is a separate question.
If people drop tracks onto videos, posts, or ads inside your product, this is the part of the copyright conversation that lands on your side of the table. The creator-side basics, like what the DMCA is, are covered elsewhere.
This guide covers how liability splits between users and platforms, what safe harbor requires, what the Supreme Court changed in March 2026, why a built-in music library is different, how the EU handles it, and how to reduce exposure. It's an overview, not legal advice. Talk to your own counsel.
Supply music you don't have to defend
Put 116,000 tracks inside your editor through an API built for platforms where users make video.
Who's liable when a user adds a song to your platform?
The person who copies or shares a song without permission is the direct infringer. A platform can also be liable for that user's infringement in two ways the Supreme Court recognizes. Contributory liability means the platform intended its service to be used to infringe. Vicarious liability means it profited directly from infringement it had the right and ability to supervise.
A recorded song carries two separate copyrights, one in the composition and one in the sound recording, so the composition owner and the recording owner can each act on the same upload. That's the basic shape of music copyright.
What DMCA safe harbor protects, and what it asks of you
DMCA safe harbor is a defense written into Section 512 of the Copyright Act. Under 512(c), a service provider isn't liable for money damages for infringement that happens because a user stored material on its system, as long as the provider meets a set of conditions. It doesn't license anything. The song is still unlicensed; the platform just isn't paying damages for it.
The conditions you have to meet
- No actual knowledge of the infringement, and no awareness of facts that make it apparent (often called red flag knowledge). Once you are aware, you remove the material quickly.
- No financial benefit directly tied to the infringement in cases where you have the right and ability to control it.
- Quick removal when a valid takedown notice arrives.
- A designated agent for notices, listed on your site and registered with the Copyright Office. The designation expires unless it's renewed every three years.
- A repeat infringer policy that you adopt, reasonably enforce, and tell users about.
- No interference with the standard technical measures copyright owners use to identify their works.
The statute doesn't require you to monitor your service. It requires you to respond. On YouTube, the fingerprinting system creators run into is Content ID.
What Cox v. Sony changed for platforms, and what it didn't
On March 25, 2026, the Supreme Court decided Cox Communications v. Sony Music Entertainment and narrowed contributory liability. A service provider is contributorily liable for a user's infringement only if it induced the infringement or provided a service tailored to it. Knowing that some users infringe, and continuing to serve them, isn't enough. The result was unanimous: seven Justices joined the opinion and two concurred in the judgment.
The case started with a $1 billion jury verdict against Cox, an internet provider sued by major music companies. The Court also counted Cox's warnings, suspensions, and account terminations as evidence that it discouraged infringement rather than inducing it. Enforcement still matters. For how these cases move through court, see copyright infringement lawsuits.
What Cox left open
The Court didn't review vicarious liability, so a platform that profits from music-driven engagement and controls what gets posted can still face that theory. Holland & Knight's read of the ruling's limits notes that it doesn't reach direct liability for a company that hosts or distributes the material itself. Design and marketing still count: a feature promoted as a way to use popular songs for free can read as inducement.
The publishers' case against X shows how this plays out. They sued in 2023 over unlicensed music on the platform. In March 2024, the court dismissed the direct and vicarious claims but let part of the contributory claim proceed, including an allegation that X treated paying verified users more leniently. After Cox, the two sides ended their dispute in July 2026 with no terms disclosed.
Why music your platform supplies is a different problem
Safe harbor covers material a user stores on your system. When your platform hosts and serves the tracks itself, through a built-in music library, a sound picker, or background music applied by default, the platform is the one copying and distributing the music. That's direct liability territory, and the user-upload defense wasn't built for it.
Litigation already treats the two differently. In Capitol Records v. Vimeo, decided on appeal in January 2025, Vimeo kept its safe harbor for videos users uploaded. Videos uploaded by Vimeo's own employees were treated separately in the case, as a disputed question of whether they had been stored at a user's direction at all.
The practical fix is to supply music that's already licensed for the way your users publish. In video, that means rights covering sync licensing, the pairing of music with picture. A music API is one way to deliver that catalog inside your editor.
How the EU handles platform liability differently
The EU flips the default. Under Article 17 of the EU copyright directive, an online content-sharing service that gives the public access to user uploads is treated as communicating those works itself, and it must seek authorization from rightholders, for example through a license. Without one, it's liable unless it shows best efforts to license, best efforts to keep notified works unavailable, and quick removal on notice. Details vary by member state.
How to reduce your platform's exposure to music claims
- Register a DMCA agent with the Copyright Office and put the renewal on the calendar.
- Write a repeat infringer policy and enforce it evenly. Lenient treatment of paying users was one of the allegations that kept part of the X case alive.
- Act on valid notices quickly, and keep a record of what you removed.
- Keep product copy and onboarding from encouraging users to bring commercial songs.
- Give users licensed music inside the product so they have a cleared option, as with the licensed music inside Shopee's video tools.
Give users a better option than their playlist
Offer 116,000 tracks in your product, searchable by mood and genre, so users stop reaching for hits.
Frequently asked questions
A DMCA safe harbor is a defense in Section 512 of the Copyright Act that protects online service providers from money damages for certain infringement by their users. The one that applies to user uploads, 512(c), covers material users store on the service, as long as the provider meets conditions such as a designated agent, a repeat infringer policy, and quick removal on notice.
Remove or disable access to the material quickly. Safe harbor under 512(c) depends on responding expeditiously to a valid notice sent to your designated agent. The statute also sets out a counter-notice process: if the user responds, the material can be restored 10 to 14 business days later unless the sender tells you it has filed suit.
Yes. Rightsholders can claim contributory or vicarious liability against the platform. Since the Supreme Court's 2026 Cox v. Sony ruling, contributory claims require inducement or a service tailored to infringement, and a platform that meets the DMCA safe harbor conditions is shielded from money damages for what users upload.
In March 2026, the Court held that a service provider is contributorily liable for users' infringement only if it induced the infringement or provided a service tailored to it. Knowing that some users infringe isn't enough. The decision didn't review vicarious liability, and it doesn't address direct liability for material a platform hosts or distributes itself.
Not on the same terms. The 512(c) safe harbor covers material stored at the direction of a user. Music a platform selects and serves through its own library is the platform's own copying and distribution, so it needs to be licensed for the uses the platform's users make of it.
