Under 17 U.S.C. § 512(i), a repeat infringer policy is a condition of your DMCA safe harbor, not a nice-to-have. The statute requires a policy that terminates repeat infringers in appropriate circumstances, and it requires reasonable implementation of that policy, not just the paper version. The template below covers the whole set: definitions, strike mechanics, termination and appeal language, record-keeping, and where to publish.
Read it with one case in mind. In BMG v. Cox, an ISP whose written thirteen-strike policy existed mostly on paper lost safe harbor entirely and paid $25 million at trial. Courts measure the gap between the document and the practice. This template is built to close that gap. (If the underlying framework is new to you, start with how DMCA safe harbor works.)
What Section 512(i) Actually Requires
Section 512(i)(1)(A) conditions every DMCA safe harbor, conduit under § 512(a), caching under § 512(b), hosting under § 512(c), and search or linking under § 512(d), on the provider having adopted and reasonably implemented a policy that provides for termination of repeat infringers, and on informing subscribers and account holders of that policy. Section 512(i)(1)(B) adds a separate condition: accommodating the standard technical measures copyright owners use to identify infringement.
Two words do the heavy lifting. "Adopted" means the policy exists formally, with a version, an effective date, and an owner. "Reasonably implemented" means staff follow it, and exceptions get documented rather than improvised. The statute sets no strike count, no time window, and no definition of "repeat infringer." You choose all of that. A court later asks a narrower question: does your real process roughly match the policy you published? For a plain-language grounding in what a repeat infringer policy is and how it fits alongside notice-and-takedown, see our explainer.
Defining a Repeat Infringer in Your Policy
Every definition in your policy will eventually be read by opposing counsel, alongside your team's emails and tickets. Write definitions a night-shift abuse reviewer can apply without a lawyer on the line. A workable core set:
>
>
Three design choices sit inside those clauses. First, a strike can rest on a valid notice rather than a court judgment, § 512(i) requires no adjudication, and a policy that waits for judgments will almost never terminate anyone. Second, the count and the window are yours; three strikes in eighteen months is a common, defensible pattern, not a statutory mandate. Third, termination needs teeth. Name what happens to the account, to its content, to paid balances, and to any attempt to return under a new sign-up.
Strike Mechanics: Assigning, Expiring, and Vacating Strikes
Mechanics decide whether the policy can be enforced at scale. Run every incoming notice through an intake check against the § 512(c)(3) elements: identification of the work, identification of the infringing material with enough detail to locate it, complainant contact information, and the good-faith and accuracy statements. A notice that fails intake does not count as a strike. Log it anyway, because a pattern of invalid notices from one sender is worth having on file. De-duplicate as you assign: ten notices about one upload are a single strike; ten separate uploads are ten strikes. Date every strike, attach the notice ID, and give it an expiry.
Then handle challenges. Under § 512(g), a user can send a counter-notice, and if the complainant does not file a court action within the statutory window, the material goes back up. Your policy should say what that does to the strike. The cleanest design suspends the strike during the counter-notice window and vacates it if no suit follows: what happens after a counter-notice is filed walks through that timeline. A sample clause:
For user-facing framing, compare how DMCA strikes work on major platforms, and remember that YouTube's familiar three-strike regime, like every platform's count, is platform policy rather than law.
Termination and Appeals: Language That Holds Up
"Appropriate circumstances" gives you discretion, and discretion is lawful, if it is exercised, recorded, and consistent. A policy that never terminates anyone is worse than a strict one, because it proves the document was never real. Sample language:
>
>
The statute does not require an appeal process. Build one anyway. It catches bad notices before they compound, gives terminations credibility, and serves as evidence that implementation is genuine. Keep appeal windows short and absolute; open-ended review is how strike counts quietly fall to zero. And define the commercial mechanics of termination, refunds, data export, whether linked accounts close with the main one, so support staff are not improvising answers under pressure.
Record-Keeping That Survives BMG v. Cox Scrutiny
BMG Rights Management, through the monitoring firm Rightscorp, sent Cox Communications an enormous volume of notices naming subscribers who were sharing music. Cox's internal program nominally ran thirteen escalating steps toward termination. At trial, the record showed Cox almost never terminated anyone: warnings piled up indefinitely, and internal messages suggested the process was not taken seriously. A Virginia jury returned a $25 million verdict against Cox in December 2015. The Fourth Circuit affirmed the central finding in 2018: the policy was not reasonably implemented, so Cox had no safe harbor at all, not even the § 512(a) conduit protection ISPs depend on. A later suit by Sony's labels ended with a jury award of about $1 billion in 2019. Our BMG v. Cox case breakdown covers the full story; the record-keeping lesson is narrower than the damages.
Keep, per strike:
- the notice as received, with date, sender, works claimed, and URLs;
- your intake assessment against § 512(c)(3), including who performed it;
- the takedown action and its timestamps, plus the notice you sent the user;
- any appeal or counter-notice and its outcome, the strike's status, and its expiry date;
- for terminations, the full strike record and the decision, dated.
Beyond individual strikes, keep an exceptions log, every discretionary non-termination with its reason, plus dated versions of the policy and the internal runbook in force at each point. Federal copyright claims carry a three-year statute of limitations under 17 U.S.C. § 507(b), so three years is the floor; five to seven years is the safer practice, and terminated-account records should outlive the account. Then audit quarterly. High notice volume with near-zero terminations is exactly the pattern a plaintiff's expert will chart in discovery. Write tickets as if a jury will read them, because in this litigation, they did.
Adapting the Template by Platform Type and Jurisdiction
Termination means different things in different businesses. For a conduit, ISP, VPN, carrier, termination is subscriber disconnection, commercially heavy and still legally required; that was Cox's exact position. For a hosting platform, termination is account closure, and your policy should say whether you sweep the account's other uploads too. For a marketplace, put copyright strikes inside your seller account-health system, and decide deliberately whether trademark and counterfeit strikes share the counter or stay separate; conflating them casually creates legal and customer-service problems at once. Reading how marketplace platforms handle infringement claims on a major venue shows how these layers stack when you operate on someone else's rails.
Jurisdiction changes the analysis. The DMCA is United States law; § 512(i) applies to whoever claims its safe harbor for US claims, wherever incorporated. In the EU, the Digital Services Act independently requires platforms to describe their notice handling and moderation decisions in their terms, the DSA's notice-and-action rules sit alongside the Copyright Directive's duties for sharing platforms. In Canada, the notice-and-notice system requires forwarding notices and retaining subscriber information but imposes no termination duty of its own. One global policy with regional addenda is the practical pattern. Assuming any single regime satisfies all of them is the mistake.
Where to Publish Your Repeat Infringer Policy
The same clause of § 512(i)(1)(A) that requires the policy requires you to inform subscribers and account holders of it. Treat that as a floor. Three publication points:
- Terms of Service. Incorporate the policy by reference with its effective date, and keep a dated changelog. If a dispute over this year's conduct surfaces years later, you must be able to prove which version was in force at the time.
- Your copyright page. Post the policy next to your designated agent information and takedown procedure. If you have not completed registering a DMCA agent, that is its own prerequisite for safe harbor eligibility; once filed, verify your listing in the Copyright Office's public agent directory.
- Help center. A plain-language article on strikes, expiry, and appeals reduces disputes and documents the informing the statute asks for.
The published version becomes the measuring stick in litigation. Your internal runbook must match it, because a mismatch between what you tell users and what your staff actually do is precisely the kind of evidence that turned BMG v. Cox into a verdict.
Repeat Infringer Policy FAQ
How many strikes does the DMCA require before termination?
The statute sets no number. Section 512(i) requires termination in "appropriate circumstances" and leaves the count to the provider. Three strikes is a common, defensible choice, and the three-strike regimes users encounter on major platforms are policy decisions, not legal requirements. What courts examine is whether the number you published is the number you enforce.
Does a strike require a court judgment against the user?
No. Most policies count valid takedown notices, and § 512(i) does not require adjudication before a strike accrues. The sound design treats a compliant notice as a strike but lets appeals and counter-notices vacate it, so a defective or abandoned complaint never becomes terminal on its own.
Can users appeal a strike before the account is terminated?
Nothing in the statute mandates appeals, but a short pre-termination review is standard practice and strong evidence of genuine implementation. Set an absolute window, assign a reviewer who did not handle the original notice, and record every outcome. Indefinite review processes quietly reduce terminations to zero, which reads as non-implementation.
How long should we keep strike and termination records?
At minimum three years, matching the statute of limitations for civil copyright claims in 17 U.S.C. § 507(b). Five to seven years is the safer practice. Expired strikes should stay in the record after they stop counting, and terminated-account records should be kept longer than the account itself.
Do non-US platforms need a repeat infringer policy?
Yes, if they want US safe harbor for US copyright claims. Section 512(i) attaches to the protection you claim, not to where you are incorporated. EU and Canadian platforms also answer to their own regimes, so most run one global policy with regional addenda covering the DSA and notice-and-notice.
Next Steps
- Fill in the bracketed choices: strike count, window, expiry, appeal deadlines, and get sign-off from whoever owns trust and safety.
- Map every clause to a system: notice intake, strike ledger, appeal queue, termination workflow, exceptions log.
- Publish in your terms of service, on your copyright page, and in your help center, with dated versions from day one.
- Run a tabletop test: simulate one user who hits the threshold and one who appeals, then confirm the records discovery would demand actually exist.
- Audit quarterly, strikes issued, appeals upheld, terminations, exceptions, and reconcile the runbook against the published policy.
- Check the full compliance picture against our safe harbor requirements checklist, and if you would rather have the policy drafted or audited by people who handle this daily, review our pricing.