Doe v. GitHub (Copilot)

What the developers allege

Doe v. GitHub was the first class action to test generative AI training in American courts, filed in November 2022 by anonymous open-source developers against GitHub, its parent Microsoft, and OpenAI, whose Codex model powers GitHub Copilot. The complaint alleges Copilot was trained on billions of lines of public code pulled from GitHub repositories, including code released under licenses such as the MIT License and GPL that require attribution, license text and copyright notices to travel with any reuse. Plaintiffs say Copilot’s suggestions frequently reproduce that code without any of it.

What makes the case unusual is what it doesn’t allege. The plaintiffs never pleaded a direct copyright infringement claim over the training or the outputs. Instead the case runs on two narrower theories: that stripping copyright management information (CMI) violates Section 1202(b) of the DMCA, and that reusing licensed code without its required notices breaches the open-source licenses themselves as contracts.

The legal question: does §1202(b) require an identical copy?

Section 1202(b) is attractive to plaintiffs precisely because it doesn’t require proving that an output infringes a copyright — only that CMI (author names, license notices, copyright statements embedded in source files) was intentionally removed or altered, and that the defendant knew or should have known this would induce infringement. The plaintiffs’ theory: Copilot ingests code with CMI attached and outputs stripped-down suggestions, satisfying the statute regardless of whether any single output is a byte-for-byte copy of a training example.

GitHub, Microsoft and OpenAI argued the statute only reaches removal of CMI from an identical copy of the same work — meaning a generated suggestion that merely resembles licensed code, without being identical to it, falls outside Section 1202(b) altogether. That reading, if it holds, would close off CMI claims against most model outputs, since generative models rarely reproduce training examples verbatim.

The ruling and its limits

Judge Tigar sided with the defendants in June 2024, dismissing the §1202(b) claims with prejudice under the identicality reading. The contract claims, however, survived: developers can still argue that Copilot’s use of their code breaches the license terms under which it was published, independent of any DMCA theory. That distinction matters, because the case didn’t end — it split into a narrower statutory fight, now on appeal, and an ongoing contract dispute over open-source license compliance.

Amici split sharply once the identicality question reached the Ninth Circuit: intellectual-property law professors filed in support of the narrower, identical-copy reading GitHub favors, while the News/Media Alliance urged the appeals court to reject it, warning that an identicality requirement would gut Section 1202(b) as a tool against AI systems trained on copyrighted works generally, not just code.

“Section 1202(b) reaches only the removal or alteration of copyright management information from an identical copy of a protected work.”— Order on Motion to Dismiss, No. 4:22-cv-06823 (N.D. Cal. June 25, 2024)

Where it stands

Tigar certified the identicality question for interlocutory appeal in September 2024, and the Ninth Circuit accepted it — a sign the district court itself viewed the question as unsettled and outcome-determinative. The panel heard oral argument on February 11, 2026. As of July 22, 2026, more than five months later, no ruling has issued, and there is no public schedule for one.

The interlocutory posture keeps the case narrow: only the identicality legal question is before the Ninth Circuit, not the underlying facts of Copilot’s training or the surviving contract claims, which remain paused in the district court pending the appeal’s outcome.

Why it matters for training-data buyers

Section 1202(b) is one of the few federal hooks available to plaintiffs that doesn’t require proving an output actually infringes — which is exactly why the identicality fight matters beyond code. If the Ninth Circuit affirms, CMI claims against training pipelines mostly collapse in that circuit, and exposure for code-trained models shifts to contract: whether a dataset complies with the license terms — attribution, notice preservation — attached to the material it draws on. If the Ninth Circuit reverses, any dataset that strips headers, license text or bylines during ingestion carries statutory-damages risk on a per-work basis, whether or not any single output resembles the source.

Either way, the practical lesson for data buyers is the same: ask whether a supplier’s pipeline preserves license and attribution metadata through ingestion, not just at the point of collection. Provenance that survives the training pipeline, not just the sourcing agreement, is what a Ninth Circuit reversal would make legally load-bearing.