When you manage creators, run an agency with a protection offering, or represent rights holders, copyright enforcement stops being an occasional errand and becomes an operational workflow. A DMCA takedown for agencies run ad hoc eats an hour per case and invites mistakes in the sworn statements every notice contains. Run as a system, standing authorizations, standard evidence packs, batch filing, the same work takes minutes and scales to hundreds of clients.
This guide is that system: the paperwork to collect before the first notice, whose details go where, how to batch, how to price it, and the liability rules that protect your signature when you act on someone else's behalf.
Step zero: authorization, in writing, on file
Every notice you send for a client contains a sworn statement that you are authorized to act on the owner's behalf. Make that literally true and provable before the first filing, not after the first challenge. The instrument can be a standalone one-page authorization letter or a takedown-enforcement clause in your management agreement. Either works if it names the client's legal name or entity, names your agency as enforcement agent, defines the scope of works and platforms, states how revocation happens, and carries a dated signature.
Scope matters more than most agencies expect. A mandate limited to specific URLs expires the moment pirates post somewhere new, so authorize enforcement for the whole catalog, not case by case. Keep every signed mandate in a master file: hosts occasionally ask for proof of agency, some platforms verify agents on first filing, and producing the signed page on demand closes that question fast.
Agents qualify to file without a lawyer, the standing rules are laid out in who can file a DMCA takedown. The one-page mandate answers the only question a skeptical host or opposing lawyer will ever raise about your authority, and it takes five minutes per client to collect.
Whose details go where in the notice
A takedown notice has three slots where names and addresses go, and agencies blur them at their peril.
The copyright owner slot gets the client's legal name or entity, it identifies whose right is infringed and must match the evidence. The contact slot gets yours, as the authorized agent: replies should route to the people running the case, not to your client's personal inbox. Use the agency address, never a home address. Notices sent to Google are mirrored to the public Lumen Database, and GitHub publishes the notices it receives in a public repository, so whatever contact details you file can end up visible to anyone, pirates included.
The signature is where agencies stumble most. The law requires the signature of the owner or of a person authorized to act on the owner's behalf (17 U.S.C. § 512(c)(3)), so sign as authorized agent of the named owner, your name, your title, the owner's name, never the client's name as though you were them.
The per-client evidence pack
Ninety percent of filing speed is preparation. For each client, maintain one folder with five things: a works registry (titles, publication dates, canonical URLs), originals or high-resolution masters with metadata intact, proof of first publication, any registration certificates, and the signed authorization. When new infringement appears, notice drafting becomes template-filling, not archaeology.
Keep unedited masters in one place, because re-encoded copies are what you will compare against; how timestamps hold up as evidence covers what reviewers actually accept. Registration is optional for filing, copyright exists the moment a work is fixed, but whether registration pays for itself deserves a deliberate decision per client, since it changes what is possible when a case escalates.
Add one document most agencies learn about the hard way: a partner whitelist of licensed resellers, approved re-posters, and affiliates, so a sweep never flags your client's own partners as pirates. Build the whole pack around what actually proves content ownership, because that is what review teams weigh.
From detection to filed notice: the case assembly line
Every case should run the same short rail. Identify the work in the registry and confirm ownership is clean. Verify each infringing URL resolves, pirates move pages, and a notice full of dead links invites rejection. Capture the pages (screenshot, URL, date) before removal destroys the evidence. Fill the standard template: each required element of a notice has a fixed job, and a notice that misses statutory elements may not count as notice at all, which leaves the host off the clock until a compliant filing arrives. Treat the standard filing mechanics as your quality bar, not trivia. Compliance also drives the other side: DMCA safe harbor protects providers that expeditiously remove material once properly notified, which is why a well-formed notice gets acted on even by hosts that have never heard of your client.
Before sending, run the two-minute verification pass, a pre-filing evidence checklist takes the judgment calls out of it, then file through the right channel and log the case: work, URLs, recipient, date filed, status, any deadline. Rejections happen even on clean notices; most are fixable formatting or routing problems, and fixing a rejected notice is a one-day loop when the evidence pack is intact.
Batch by work, by recipient, by calendar
Batching is the difference between an enforcement desk and a person who files takedowns when there happens to be time. Three axes matter.
Batch by work. Fifteen pirate copies of one video are one notice with fifteen URLs, not fifteen notices. Hosts and platforms accept multi-URL filings for a single work, and one coherent notice is easier for a reviewer to process than a drip-feed.
Batch by recipient. Sort targets by who can actually act. Large platforms run their own copyright forms, Instagram and TikTok have theirs, and YouTube's is a separate process again. Independent sites need host notices: the Website Detective maps domains to their hosts in bulk, and how abuse desks process notices shows what the person on the other end needs to see. Whatever survives at the source gets its own pass, through removing URLs from Google's index. Since pirate sites are often hosted abroad, know how takedowns work across borders, the notice travels fine even where local obligations differ.
Batch by calendar. Repeat theft is the norm for popular catalogs, and discovery is what clients are worst at, they find copies when a fan emails them. Run scheduled sweeps: weekly for hot catalogs, monthly otherwise. Continuous monitoring removes even the scheduling question; our protection plans scan around the clock and queue detections with one-click filing. Enforcement compounds, too: repeat-infringer policies are a condition of safe harbor under 17 U.S.C. § 512(i), so a steady stream of takedowns eventually ends accounts, not just posts.
Price it as a service, not a favor
Per-notice cost falls with volume, ours drops from $99 into the low eighties as monthly filings pass 10 and 26 notices, and the volume tiers show where the breaks sit. At real volume, the API feeds your own tooling, detections, complaint status, and account data in and out of your case tracker, so nothing lives in two systems. Read what a notice actually costs before you set a margin, because underpricing enforcement is how it becomes a favor again.
Reselling works three ways. Bundled into a management retainer, enforcement becomes a line item clients stop questioning. As a per-case item with a handling margin, it suits clients who file irregularly. As a monitoring-plus-enforcement monthly package, it converts reactive pain into recurring revenue. All three beat the model most agencies actually run: unbilled ad hoc hours and stale cases nobody tracks. Price the coverage and the response time, not the individual notice, clients buy the outcome, and they rarely comparison-shop per filing.
Law firms building a formal practice area rather than an ops service should look at the lawyer program, which covers the referral and partnership structure.
The liability lines you cannot cross
Your signature goes on the notice, so the exposure under 17 U.S.C. § 512(f) follows it: knowingly misrepresenting that material is infringing can make the sender liable for damages, costs, and attorney's fees. This is not theoretical. In Online Policy Group v. Diebold, a court found that a takedown sender had knowingly misrepresented its copyright claims in notices aimed at leaked internal documents, and ordered it to pay the recipients' fees and costs. Bad claims arrive looking exactly like good ones; verification is the only filter.
Build a two-minute habit per client, per work: who created it, what does the contract say, does the client hold exclusive rights? The traps are consistent. Work commissioned but never assigned in writing. Content the client licensed non-exclusively, which generally carries no enforcement rights to delegate. Video built on third-party music, where the client owns the edit but not the track, the licensing rules for music on video platforms draw the line your notice must respect. An approved reseller mistaken for a pirate because nobody checked the partner list. And fair use, which is a real analysis rather than an obstacle to push through; when a takedown is the wrong tool should be required reading for anyone on the team who touches a notice.
That two-minute check is the difference between an enforcement program and a malpractice file.
Counter-notices are a routing decision, not an insult
A counter-notice is not an insult or a failure; for a working catalog it is a scheduled event. The moment one arrives, the clock starts: under 17 U.S.C. § 512(g), the host restores the material within 10 to 14 business days unless the owner files a court action and notifies the provider. That is not a deadline to improvise mid-case. Decide in the client agreement, before the first notice goes out, who authorizes litigation, who pays for it, and what the default is when no one does.
What happens after a counter-notice walks through the full cycle, including how strikes stack up on an account, strike systems are platform policy rather than statute, and they behave differently on every service.
If a client escalates to court, registration is the gate: US law generally bars an infringement suit until the work is registered or registration has been refused, and timely registration, before infringement begins, or within three months of first publication, preserves statutory damages and attorney's fees. This is why the evidence pack collects certificates. For disputes too modest for full litigation, the Copyright Claims Board offers a small-claims-style forum.
Frequently asked questions
Does every takedown need a new client authorization?
No. A standing authorization covering the client's whole catalog is standard practice and what hosts expect from agencies; per-notice authorizations slow every case without adding protection. The notice itself must still carry the sworn authorization statement, so keep the signed mandate on file and ready to produce whenever a host or platform asks for proof of agency.
Can an agency sign a DMCA takedown on a client's behalf?
Yes. The statute calls for the signature of the copyright owner or of a person authorized to act on the owner's behalf, and an agency holding a signed mandate fits the second category. Sign as authorized agent of the named owner, your name, your title, and never sign the client's own name as though you were them.
How many infringing URLs can one notice cover?
No statutory cap. The standard pattern is one notice per work, listing every known infringing URL for that work together. Some platform forms cap how many URLs a submission accepts, in which case you split the list across filings for the same work; what you avoid is one notice per copy.
What happens if the counter-notice deadline passes without a lawsuit?
The host restores the material, typically within 10 to 14 business days of the counter-notice, once no court action has been filed and reported. The case is not over: the URLs can still be chased through de-indexing, monitoring will catch re-uploads, and litigation stays open if the client registers and proceeds.
Does the client's copyright need to be registered before we can file?
No. Copyright exists once a work is fixed in tangible form, and no certificate is required to send a DMCA notice. Registration matters one level up: US courts generally require it before an infringement suit proceeds, and timely registration preserves statutory damages and fees. Register flagship works to keep the litigation option open.
Your 30-minute setup
- Add a one-page agent authorization to your onboarding stack, and collect signatures retroactively from existing clients.
- Build the evidence-pack template: works registry, masters, publication proof, partner whitelist, and the mandate itself.
- Standardize the notice template and the case-log fields so any teammate runs a case the same way.
- Set up filing channels: platform form bookmarks, a managed channel for messy cases, and an escalation log per client.
- Put sweeps on the calendar and volume pricing into your rate card.
- Brief everyone who touches notices on the § 512(f) verification habit and the fair-use check before filing.
That is the whole machine. Agencies protecting catalogs worth millions are not doing anything more exotic than this, they run it weekly, on rails, with a paper trail that answers every question before anyone thinks to ask it.