If you've ever accepted a Copilot suggestion at 2 AM and quietly wondered "wait, whose code is this?", Wednesday brought the biggest answer yet in the Copilot lawsuit saga. A US federal appeals court ruled in favour of OpenAI and Microsoft, holding that their AI coding tools did not violate the Digital Millennium Copyright Act (DMCA) when they reproduced open-source code without the original author's credit. For India's developer community — one of the largest GitHub populations on the planet — this ruling deserves your attention, whether you're shipping code for a Bengaluru startup or contributing to open source from a Tier-2 college hostel room.
01.What the Copilot lawsuit was actually about
Back in 2021, a group of anonymous open-source programmers sued GitHub (owned by Microsoft), OpenAI and others, calling Copilot "software piracy on an unprecedented scale". Their complaint: Copilot is trained on millions of public GitHub repositories, and when it suggests code, it sometimes reproduces those snippets verbatim — without the attribution, copyright notices or licence terms that open-source licenses require. They wanted penalties north of $9 billion. It was the first copyright-related lawsuit against OpenAI over its generative AI products, so the whole industry has been watching it like a slow-motion cricket final.
02.What the court decided
The Ninth Circuit Court of Appeals in San Francisco broke the programmers' argument into an "input" theory (CMI stripped during training) and an "output" theory (code returned to users without attribution). On the output theory, the unanimous three-judge panel agreed with a lower court: Copilot and Codex don't "remove or alter" copyright management information from a copy of an existing work — they create new works that never contained that information in the first place. Judge Eric Miller, writing for the panel, put it bluntly: "We decline plaintiffs' invitation to transform run-of-the-mill copyright infringement claims into DMCA claims."
Why did this matter so much? Money. The DMCA's enhanced statutory damages run up to $25,000 per violation, versus roughly $30,000 per work under ordinary copyright law. When you're talking about millions of code suggestions, that difference is the difference between a fine and a funeral. The court also found the programmers did have legal standing to sue — they just couldn't use this particular law to do it.
03.Why the EFF is actually celebrating
Here's the twist nobody expected: the Electronic Frontier Foundation, which normally fights for users against big tech, called the ruling a victory — for programmers. Their argument is that stretching the DMCA this way would have created a brand-new source of liability for ordinary, lawful activity: remixers, teachers, reverse engineers, even independent developers. Meanwhile, the developers' regular copyright infringement claims and two breach-of-contract claims are still alive before the trial judge. So the war isn't over; one very expensive weapon was just taken off the table.
04.The bigger picture for AI training data
This decision lands in the middle of a crowded courtroom. Courts and lawmakers worldwide are still fighting over whether training AI on copyrighted material is fair use, and this ruling nudges the needle toward AI companies — at least on the narrow DMCA question. It doesn't settle whether AI training itself is legal, and it explicitly leaves the door open for traditional infringement claims when a model genuinely reproduces someone's code — a fight already playing out in the open, as the unsealed files in the NYT v OpenAI case show. If you've been following how AI tools are reshaping the daily work of developers — we recently covered how AI agents are starting to replace pull requests entirely — this is the legal plumbing underneath all of that change.
05.My honest take
Honestly, what surprised me most is how narrow and sensible the ruling is. The court didn't say "AI companies can do whatever they want" — it said "use the right law for the right complaint". If a model regurgitates your code, you can still sue for copyright infringement; you just can't demand the DMCA's scary multiplier. For open-source maintainers in India who give away brilliant work for free, though, the sting is real: attribution is about credit and community, not just cash, and no court ruling fixes an AI tool that forgets to say "this came from your repo".
Key Takeaways
- The Ninth Circuit upheld the dismissal of DMCA claims against OpenAI and Microsoft over GitHub Copilot
- The court held AI output is a new work, not an existing work with copyright info stripped
- Plaintiffs had standing to sue, but chose the wrong legal theory — ordinary infringement and contract claims survive
- The $9 billion enhanced-damages exposure under the DMCA is off the table
- The EFF backed the outcome, warning an expanded DMCA would hurt small creators most
Frequently Asked Questions
What did the US appeals court rule in the Copilot lawsuit?
The court ruled that GitHub Copilot and Codex did not violate the DMCA by outputting open-source code without attribution, holding that AI-generated code is a “new work” — not a copy with copyright info stripped off.
Are all the programmers' claims dead?
The programmers' $9 billion penalties claim is dead for now, though breach-of-contract claims continue. Normal copyright infringement claims are still open — this ruling only killed the DMCA theory.
What This Means for You
If you're an Indian developer using Copilot, Cursor or Codex daily, two practical takeaways. One: your licence obligations didn't disappear — if you paste AI output into a product, you're still the one responsible for compliance, so review anything that looks suspiciously complete. Two: if you publish open-source code, assume AI models have learned from it; add clear licence files and enforcement now depends on traditional copyright, which still works. And if you're building products on top of these models, understanding what they can and can't legally reproduce is becoming a core skill — the GPT-6 Astra — Zero to Hero Guide covers AI agents, prompting and safe deployment practices in plain language, so legal surprises don't ambush your project. One more thing worth knowing: OpenAI just disclosed six incidents of its models misbehaving, so keep an eye on what your tools do with your credentials, not just your code.