Section 1201 of the Digital Millennium Copyright Act, passed in 1998 and codified at 17 U.S.C. § 1201, bans two things the rest of copyright law leaves alone: the act of breaking a technical lock on a copyrighted work, and the building or distribution of tools designed for that purpose. You can violate it without copying a single protected file. Congress wrote it to implement the 1996 WIPO Copyright Treaty, and it operates as a self-contained system with its own penalties, its own case law, and its own exemption process.
Most people arrive here for one of three reasons: a takedown notice has cited § 1201 against something they published, they need to bypass a technical measure for a legitimate reason, or they hold rights in work behind a technical gate and want to know what enforcement looks like. This page covers all three, using the cases that actually govern how the statute reads.
What Section 1201 Prohibits, in Plain Terms
The statute targets technological measures, code or hardware that requires decryption, a password, an authentication handshake, or some other process to reach the work. It splits those measures into two kinds.
Access controls decide whether you can reach the work at all: a paywall login, DVD encryption, the license check inside a software installer, the handshake between a console and a game disc. Section 1201(a)(1) makes the act of circumventing an access control unlawful on its own, even if you never infringe the underlying copyright afterward. Reading a lawfully purchased ebook on a different device can be a § 1201 violation if an access control stood in the way and you defeated it.
Copy controls are different. They protect a right of the copyright owner, such as the right to prevent copying, and here the statute is asymmetric. There is no ban on the act of circumventing a copy control, but § 1201(b)(1) bans manufacturing, selling, or offering tools that defeat copy controls. You may defeat the measure yourself; you may not supply the means to others.
That asymmetry explains the enforcement pattern you see everywhere: rights holders go after tools and their distributors rather than individual users, and the exemption process, which reaches only the access-circumvention ban, leaves exempt users without a lawful way to obtain the tool they need.
The Anti-Trafficking Ban and the Three-Prong Tools Test
Section 1201(a)(2) forbids manufacturing, importing, offering to the public, providing, or otherwise trafficking in any technology, product, service, device, or component that:
- is primarily designed or produced to circumvent,
- has only limited commercially significant purpose or use other than circumvention, or
- is marketed for use in circumventing.
Meeting one prong is enough, and § 1201(b)(1) repeats the same structure for copy controls. This is the provision with teeth. A circumvention claim requires catching someone in the act; a trafficking claim reaches whoever built or distributed the tool, long before anyone touches a protected work.
The early test was Universal City Studios v. Corley in the Second Circuit, decided in 2001. Eric Corley's magazine published DeCSS, the code that defeats DVD encryption, and the court upheld an injunction against posting or linking to it, rejecting his First Amendment defense. Criminal exposure is real as well: Dmitry Sklyarov, a Russian programmer, was arrested in 2001 after presenting an ebook-decryption tool at a Las Vegas conference, and his employer ElcomSoft stood trial before a jury acquitted it in 2002. The pattern from both cases still holds, the trafficking ban survives serious constitutional challenges, and enforcement concentrates on distributors rather than users.
What a Section 1201 Violation Costs
Section 1203 supplies the civil remedies: injunctions, impoundment of devices, actual damages and profits, or statutory damages between $200 and $2,500 per violation, with attorneys' fees possible. Violations are counted per act, per device, per offer, a distributor can stack them fast.
Section 1204 adds criminal liability for conduct that is both willful and done for commercial advantage or private financial gain: up to five years and a $500,000 fine for a first offense, doubling to ten years and $1,000,000 for a repeat.
These penalties stack on top of ordinary infringement remedies, not in place of them. For the infringement side of the ledger, see our breakdown of copyright infringement penalties.
Use Controls Versus Access Controls: The Chamberlain and Lexmark Line
The most important limit on § 1201 came from two cases decided in 2004, and both turned on the difference between controlling access and controlling use.
Lexmark International v. Static Control Components, Sixth Circuit. Lexmark put a small authentication program on its toner cartridges so printers would reject third-party replacements. The court held the measure did not control access to a copyrighted work in the statutory sense; § 1201 targets access to protected material, not aftermarket parts, and it did not create a new property right in functional goods. The replacement chip won.
Chamberlain Group v. Skylink Technologies, Federal Circuit. Chamberlain encrypted the signal between its garage door openers and its doors, and a competitor sold universal remotes. The court held that a plaintiff must show a real connection, a nexus, between the circumvention and copyright infringement. When circumvention simply lets authorized owners do things copyright law permits, the claim fails.
Both decisions rest on the same insight: a measure that restricts what an owner may do with a product is not an access control. Does the measure gate the protected work, or does it gate a market? The first is § 1201 territory; the second usually is not.
Two cautions. Courts outside those circuits have not uniformly adopted this reasoning, the Ninth Circuit in MDY Industries v. Blizzard (2010) upheld trafficking liability for a bot that evaded a game's anti-cheat system even though the court found the players had not infringed copyright. And on the filing side, a takedown built on § 1201 is weak from the start if the measure does not really gate access; pressing it can mean targeting conduct fair use would permit, a scenario we cover in when fair use should stop a DMCA notice.
The Triennial Exemption Process
Because circumventing an access control is unlawful regardless of what happens next, Congress built a pressure valve: every three years, the Librarian of Congress, on the Register of Copyrights' recommendation and after public hearings, designates classes of works whose users may lawfully circumvent. The exemptions live in the Code of Federal Regulations, last exactly three years, and lapse unless renewed by petition.
The history shows how it behaves. In 2003, the first rulemaking exempted ebooks whose access controls disabled screen readers and read-aloud functions for blind readers. In 2006, film professors won the right to excerpt DVDs for teaching, and handset owners won the right to activate phones on other carriers. In 2010, smartphone jailbreaking was exempted, and the DVD exemptions reached documentary and noncommercial video creators. In 2012, the carrier-switching exemption was denied; the backlash was loud enough that Congress passed a law in 2014 restoring it for handsets, and that fall the Librarian readopted it by rulemaking and extended it to tablets. In 2015, security researchers won exemptions for testing cars and medical devices. The most recent rulemaking concluded in October 2024, renewing most existing exemptions and adjusting others.
Three structural limits matter to anyone relying on this. An exemption authorizes the act of circumvention only, never trafficking, so a person with the legal right to circumvent may have to build the tool personally. The burden sits on the public: every exemption must be re-proposed and defended each cycle, over rights-holder objection. And exemptions apply prospectively only. The Copyright Office has recommended legislative fixes to make recurring exemptions permanent; Congress has not acted.
The youtube-dl Takedown: A Cautionary Tale
In October 2020, the RIAA sent GitHub a takedown notice targeting youtube-dl, an open-source command-line tool that downloads YouTube videos. The notice leaned on § 1201, claiming the tool circumvented YouTube's rolling cipher, a measure governing how streams are delivered. GitHub removed the repository, a heavily forked, widely used project, and the project sat in limbo.
In November 2020, GitHub restored it, citing its own review and a letter from the Electronic Frontier Foundation. The analysis cut against the notice on the ground we just covered: YouTube videos are available to anyone who visits the site, so the rolling cipher did not control access to protected works the way § 1201 requires, and the notice did not show the connection to infringement a trafficking claim needs. GitHub then stood up a legal defense fund for developers and created a separate review process for future § 1201 claims, because the standard counter notice under Section 512 was built for infringement claims, not circumvention claims.
Two lessons. If you publish a tool, public availability of the material is a strong defense, but a platform may act first and ask questions later, and a repository can stay dark for weeks no matter how the law reads. If you are a rights holder, a § 1201 claim that misdescribes an access control gets reversed, costs credibility with the platform, and burns time an ordinary infringement notice would have spent removing actual copies. We walk through the full sequence in our account of the youtube-dl and RIAA GitHub takedown, and in more detail on how GitHub handles DMCA takedown notices.
Where Section 1201 Appears in Everyday Enforcement
Most § 1201 disputes never reach a courtroom; they surface in takedown notices, and four patterns account for most of what we see.
Software cracking is the classic. A crack defeats a license check, which is an access control, so distributing it implicates the trafficking ban on top of whatever infringement follows. Notices aimed at pirated software often plead both theories; our guide to stolen and cracked software covers the filing sequence.
Games come next. Anti-tamper and anti-cheat systems are technical measures, and trainers, console modifications, and cheat tools sit close to the line, as MDY v. Blizzard showed. Game developers working this area have a dedicated playbook.
Stream ripping and IPTV enforcement is the third. Rights holders have built an ongoing practice around stream-ripper lawsuits, where the strongest claims allege distribution of ripped copies rather than the defeat of a delivery mechanism.
The fourth is gated content, subscription platforms, course portals, member sites where the paywall itself is the access control. When that content leaks, the leak often travels with a tool that defeated the gate, and the takedown can follow the tool. Security research remains the recurring edge case: the vehicle and device exemptions cover the act, not the tools, and researchers still face threats in the gap.
What Section 1201 Means for You
If you publish tools, answer one question in writing before anyone else asks it: does any measure you interact with actually gate access to protected material? Document your answer. Do not count on the Chamberlain nexus in every circuit, and do not count on a platform giving you the benefit of the doubt. If your code lives abroad, note that the EU's InfoSoc Directive carries its own anti-circumvention rules, and platforms enforce their policies regardless of jurisdiction.
If you are a rights holder, verify that your measure genuinely controls access before citing § 1201, and ask whether an ordinary infringement claim would do the job faster and cleaner. Most removals we handle require no § 1201 theory at all; the mechanics of filing a DMCA takedown notice are the same either way. Where the product is the gate, software, an app, a platform, our work on software and app protection addresses how to layer the theories.
If you received a notice citing § 1201, slow down. A counter notice under Section 512 addresses infringement claims and does not automatically fit a circumvention claim, and some platforms process the two under separate procedures. Read which subsection the notice invokes and whether the measure named actually controls access; that single question decides most of these disputes. Our guide to what to do after receiving a DMCA notice walks through the triage.
Frequently asked questions
Does circumventing DRM violate the law even if I never infringe?
Yes. Section 1201(a)(1) makes the act of circumventing an access control unlawful on its own, separate from infringement. You can break the lock, read nothing, copy nothing, and still face civil liability. The escape routes are an exemption from the triennial rulemaking, or a showing that the measure is not an access control at all.
Does fair use protect circumvention?
No. Courts have not recognized fair use as a defense to the act of circumventing an access control, which is why the triennial exemption process exists. Fair use still governs what you do after access, quoting, parody, commentary, analysis, but it does not legalize defeating the measure itself.
What is the difference between an access control and a copy control?
An access control decides whether you can reach the work at all: a password, a decryption key, a license check. A copy control limits what you can do once you have it, such as preventing copying. Circumventing an access control is banned as an act; circumventing a copy control is not, though distributing tools for either is.
Can someone go to prison under Section 1201?
Only under narrow conditions. Section 1204 requires conduct that is both willful and done for commercial advantage or private financial gain. A first offense carries up to five years and a $500,000 fine; a repeat offense doubles both. Prosecutions are rare, but the ElcomSoft case in the early 2000s shows they happen.
What should I do if a takedown notice cites Section 1201?
Read which subsection the notice invokes and whether the measure it names actually controls access to protected material. Many of these notices misfire on exactly that point, as the youtube-dl episode showed. Respond through the platform's process for circumvention claims, which is often separate from the standard counter-notice route, and get advice before restoring anything.
Your Next Steps
- Place your situation on the use-versus-access line first. That distinction drives most § 1201 outcomes.
- If you publish a tool, write down today your account of what the measure at issue actually gates. That memo becomes your defense.
- If you received a notice, identify the subsection invoked and the measure described before responding or restoring anything.
- If you are considering filing, confirm the measure really controls access, and gather proof of ownership before drafting.
- Check the current exemptions in the regulation at 37 C.F.R. § 201.40 before assuming any circumvention is unlawful.
- If the stakes justify professional help, review our pricing and our guidance on when it is time to hire a copyright lawyer.