This Week in the “DMCA Eating Copyright Law”: Cordova v. Huneault (Guest Blog Post)
by guest blogger Kieran McCarthy
The court let a DMCA section 1201(a) claim survive a motion to dismiss based on allegations that YouTube uses technical measures, including rolling cipher mechanisms, to prevent unauthorized downloading. The court then said the fact that the videos are broadly accessible by the public does not matter. If there are technical measures aimed at stopping downloading, that can be enough to plead an access-control theory.
On the surface, this feels like a modest pleading-stage ruling. Courts often say, sure, the plaintiff alleged a thing, let’s get to discovery. But small decisions like this one are how bad legal interpretations get normalized. This one matters because of what it treats as obvious, and what it does not even try to engage.
Publicly viewable, but with access locked?
Cordova alleged that defendants copied his publicly viewable YouTube videos and reposted them. The complaint described rolling-cipher technology, which encrypts and dynamically alters the video stream’s URL signatures, and asserted that ripping tools and browser extensions can “retrieve and decrypt the obfuscated streaming URLs” to make local copies.
Here is the crux of the issue: The work is publicly accessible for viewing, but the platform uses technical controls that allegedly limit access to a particular version of it, the downloadable file, or a preferred pathway to the content. The opinion treats that distinction as sufficient. Viewing is public. Downloading is gated. Therefore, access is controlled.
That framing is doing a ton of work. It is also a convenient way to turn product design and platform preferences into federal anti-circumvention liability.
In the modern web, nearly everything is delivered through some combination of signed URLs, token rotation, encryption, bot gating, and rate limits. They are default architecture. If courts treat that architecture as an access control for section 1201(a), then a lot of ordinary data collection and analysis starts to look like circumvention by definition.
That is how content protection shifts from the domain of copyright law into a federally enforceable platform-control law without anyone ever announcing the shift.
The opinion’s biggest problem is what it does not say
Section 1201 has been controversial for decades for a simple reason. It can be used to punish bypassing a restriction even when the underlying use would not be infringing or fair use, or even when the underlying issue is not copyright at all.
Some courts have confronted that risk head on. Two of the most important opinions are Chamberlain v. Skylink and Storage Technology v. Custom Hardware. They wrestle with the idea that 1201 should not create a new property right where copyright does not already grant one. They also worry about a world where rights holders can wrap non-copyright interests in a thin technical wrapper and then claim the DMCA as a super-powered enforcement mechanism.
While there is a circuit split on this issue, the courts on the other side of it should still appreciate the importance of finding a limiting principle here. They should get their spidey-sense up when section 1201 is being used as a substitute for proving copyright infringement, or as a circumvention mechanism itself to avoid fair use, interoperability, competition, and the basic underlying tenets of the Copyright Act.
The court in Cordova is uninterested in that conversation. It does not ask what prevents a plaintiff from turning any technology speed bump into a federal access-control claim. It does not grapple with the downstream impact on public-facing platforms and automated access. It does not ask whether calling publicly viewable content an access-controlled work just because the platform prefers one mode of access is consistent with what Congress really had in mind back when Clinton was the president.
Why this matters for scraping and the open web
I’ve been over this before, but if 1201 liability attaches whenever a platform can point to a rotating token or interface speed bump to public content and call it a TPM, then this law can lead to cascading consequences pretty quickly.
Cordova is a pleading-stage decision. It may narrow later. But if courts keep treating copyright and fair use considerations as “immaterial” to public-facing section 1201(a) cases, the momentum around this is going to build soon. It will allow platforms to set preferences as enforceable laws, and that will have major downstream market effects throughout the tech industry.