Your track is on someone else's channel, a free-download blog, or a playlist you never approved. Under US law you own that recording from the moment you fixed it in a tangible form, 17 U.S.C. § 102, and enforcement requires no registration first. Removing stolen music online is the most routine category of takedown work there is: the platforms built their forms around it, and music rights holders have more tools than any other kind of creator.
The order that works: map every copy, build one reusable notice, then hit the platform, the hosting provider, and the search listings, in that sequence. Fingerprinting and monitoring take over the parts manual filing can't reach. Everything below follows that plan.
What you own before you touch any form
Music carries two copyrights, not one: the composition, the underlying song, and the sound recording, your master, under 17 U.S.C. § 102(a)(2) and (7). A straight upload of your released track infringes both. A cover or a remix raises a different, licensing-shaped problem, and the distinction changes who files and what you can claim; how composition and recording licensing differ is worth ten minutes before you send anything.
Ownership itself is automatic. What registration adds is courtroom power: you generally need it to bring an infringement suit in US court, and registering before infringement, or within three months of publication, makes statutory damages and attorney's fees available instead of provable losses. Whether registering is worth the fee depends on your catalog and your plans.
Standing is the quiet trap. Only a rights holder or an authorized agent can send a valid notice, so if you co-wrote the song or share rights with a producer under a split agreement, sort out who files before anything goes out. The rules on who may file a DMCA notice are short: a notice from the wrong person gets rejected even when the theft is obvious.
Map the theft before you file anything
File against every copy, or you will be doing this again next month. Pirate uploads get retitled, "untitled.mp3," misspelled artist names, "official audio" on a stranger's channel, so plain title search misses most of the problem. Search the exact title in quotes alongside terms like "free download," "mp3," "zip," and "leak." For vocal tracks, distinctive lyric phrases in quotes catch copies that no longer carry your name. Run a song-recognition app over suspicious videos, DJ sets, and mixes; audio identification finds what text search cannot.
Theft also pools in group-chat platforms: Telegram channels and Discord servers circulate new releases constantly, and both take copyright reports, Telegram copyright removal and the Discord takedown process cover the specifics.
If you already have Content ID or distributor-side fingerprinting, check your claims dashboard before you search by hand; automated claims surface uses you never knew about. Keep a simple inventory as you go, URL, platform, date found, status, because copies resurface, and the inventory makes the second pass fast.
One habit to adopt: file before you call anyone out publicly. A warned uploader re-posts faster than a platform removes.
One notice, built to survive
Every route you will take uses the same core document. Under 17 U.S.C. § 512(c)(3), a valid takedown notice contains:
- Your signature, physical or electronic
- Identification of the copyrighted work
- Identification of the infringing material, with its URL
- Your contact information
- A statement of good-faith belief that the use is not authorized by the copyright owner, its agent, or the law
- A statement, under penalty of perjury, that the information is accurate and you are authorized to act
Platforms collect these elements through their own webforms, so the drafting work mostly matters for hosts. For music, specificity is what gets pages pulled: the ISRC and UPC, the release date, and the exact timestamp where your track starts inside a long video such as a mix, a live set, or a podcast episode. One URL per line, no duplicates, notices die on sloppy URL lists.
The other way notices die is overclaiming. Listing works you don't own, a co-writer's share, a sample you licensed, a track you only distributed, creates liability for misrepresentation under 17 U.S.C. § 512(f). Claim exactly what you hold and nothing else. The step-by-step filing guide and the annotated DMCA notice template cover the mechanics, and both are packaged in the free DIY toolkit so you fill in blanks instead of drafting from zero.
Platforms first: the fast removals
YouTube is the fastest lever in music. The copyright removal request lives in YouTube Studio under the Copyright section, and a granted request takes the video down and issues a copyright strike against the uploader's account, YouTube's strike system ends channels that accumulate three. The full YouTube takedown walkthrough covers every screen, including the search-and-remove tool that sweeps the platform for copies of your content. These move in days, not weeks.
SoundCloud takes copyright reports through its help-center form and acts on a similar clock. TikTok and Instagram run their own copyright forms for videos using your track, and the Instagram and TikTok guide covers the specifics. Leaks surface on social platforms before anywhere else, so those forms matter most in the run-up to a release.
Spotify, Apple Music, and the other streamers route differently. You generally go through your distributor, DistroKid, TuneCore, CD Baby and their peers run infringement and abuse channels: or through the service's designated legal contact when someone has uploaded your music under their own artist name. The fake-artist upload, where your song earns someone else's royalties, is the standard form of streaming theft, and distributors deal with it constantly.
Download blogs and MP3 mirrors: the host is the lever
"Free MP3" blogs and pirate mirrors don't answer email. Their hosts do, because safe harbor under 17 U.S.C. § 512(c) protects a provider only if it removes infringing material expeditiously after a proper notice. The site can ignore you. The host can't afford to.
Finding that host is its own skill. Most pirate domains hide behind CDN and edge providers, and the abuse desk at that layer will forward your notice or name the origin host. The process for finding a site's real host covers the tracing steps, including the lookups that cut through the CDN front. Hosts registered under the DMCA keep a designated agent on file with the US Copyright Office under 17 U.S.C. § 512(c)(2); the DMCA agent directory gives you the current contact, and the notice goes there rather than to a generic inbox.
Then delist. Pirate sites live on search traffic, and a Google legal removal request strips the page from results even when an offshore host never replies. Host takedown plus same-day search delisting is the standard combination, the delisting strangles the page's traffic while the host process runs its course.
Two wrinkles. Direct-download mirrors often place the file on a different host than the page linking to it, so trace and notice each host separately. And when a host ignores a valid notice, pressure migrates up the chain: the upstream provider, the domain registrar, and the ad networks keeping the site alive each have their own abuse routes.
The automatic layer: fingerprinting and monitoring
Manual filing doesn't scale past a handful of copies, and fingerprinting does. YouTube's Content ID matches every new upload against your reference files and lets you decide, per match, whether to block, track, or monetize. Eligibility requires evidence of exclusive rights and a history of valid claims, which is why most independent artists reach it through a distributor or label partner. How Content ID works is worth understanding before you depend on it, and keep the systems straight: a Content ID claim is an automated policy action you control from your dashboard, while a copyright removal request is the legal notice under § 512. You will use both.
Meta runs similar matching through its Rights Manager, and the streaming stores run duplicate and reference checks at ingest, which is why fake uploads carrying your ISRC surface fast. What fingerprinting covers poorly is the open web, download blogs, mirror sites, lookalike pages, and that is where music protection monitoring earns its keep: detection across platforms and hosts, then removal, without you filing each notice by hand.
If your release calendar is public, monitoring should be live before launch day. Leaks follow release schedules, and early detections are the cheap ones.
When they push back: counter-notices, proof, and escalation
Some uploaders fight. A counter-notice claims you misidentified the material, and under 17 U.S.C. § 512(g) the platform restores it after roughly 10 to 14 business days unless you file a court action. Read the counter-notice process before you respond, and only sue if you mean it, the window passes and the copy stays up. Most counter-notices are bluffs that fold when documentation appears.
Documentation is where musicians quietly win. DAW project files, stems, session logs with dates, export metadata, release metadata, distributor records, PRO registrations: assemble the pack once and keep it organized. Proving content ownership with dated session files and other timestamp evidence is close to unbeatable. When the copy returns under a new account, your notices are building the record that repeat-infringer policies, required of platforms under 17 U.S.C. § 512(i), use to terminate accounts.
When removal alone isn't enough and money is on the table, know your two escalation rights: timely registration makes statutory damages and attorney's fees available, and the small-claims route at the Copyright Claims Board offers a forum without the cost of federal litigation.
Frequently asked questions
Do I need to register my song before sending a takedown notice?
No. Copyright exists from the moment the song and recording are fixed, and the DMCA process has no registration step, platforms and hosts act on unregistered works every day. Registration matters later: you need it to bring an infringement suit in US court, and timely registration makes statutory damages and attorney's fees available. The difference between copyright and the DMCA is why, the DMCA is an enforcement shortcut, not the right itself.
What happens if the uploader files a counter-notice?
The platform notifies you and restores the material after about 10 to 14 business days unless you file a court action seeking to restrain the use. Don't threaten litigation you won't pursue; the window closes and the copy stays. What happens after a counter-notice covers the timeline and the realistic options at each stage.
Does a DMCA notice work on pirate sites hosted outside the US?
Not directly. Section 512 binds US-based services and hosts; a pirate site on an offshore server answers to its own jurisdiction, the EU's notice-and-action regime, UK takedown procedures, Canada's notice-and-notice system. Offshore hosts often respond anyway, and search delisting works regardless of where the site sits. Whether the DMCA works internationally maps the options region by region.
They credited me as the artist, is that still infringement?
Credit is not a license. An unauthorized copy infringes whether your name is attached or not, and attribution cures nothing. The one pause before filing: uses involving commentary, criticism, or transformation may be fair use, and notices against protected uses carry misrepresentation risk. When not to file a DMCA notice walks those cases so you don't step on one.
How long do music takedowns usually take?
Platform forms typically remove copies within days. The law requires hosts to act expeditiously on proper notices, and most do; offshore pirate sites take longer or never fold, which is why search delisting runs in parallel. Typical takedown timelines break the pattern down by platform and host type.
Do this today
If you would rather hand the work off, our takedown team runs this whole ladder. Otherwise, work top to bottom:
- Archive the evidence: screenshot each copy, save the URLs and the dates you found them.
- Build the notice once, with your ISRC, release date, and ownership statements.
- File the platform forms for copies on YouTube, SoundCloud, TikTok, and Instagram.
- Trace the hosts behind every download blog and mirror, notice them, and submit the Google delisting the same day.
- Turn on Content ID or distributor fingerprinting, and monitoring across the open web, before your next release, plans start free.
- Keep the evidence pack current; dated project files settle disputes before they begin.