DMCA safe harbor for a classifieds site: what the six-dollar filing actually buys you
The photo that isn't yours to lose
An advertiser uploads a photo lifted from someone else's profile, a professional photographer's portfolio, or a stock library that never licensed it for this use. Weeks later, an email arrives, not addressed to the advertiser, but to the site: a copyright holder, or a lawyer representing one, says the photo is theirs and threatens suit against the platform hosting it. This is the moment an operator learns that "a user posted it, not us" is not itself a legal defense; under US copyright law, a service that stores and displays what a user uploads can be found liable too, alongside the person who uploaded it.
The way out exists, and it is not automatic. It is a specific immunity, the DMCA safe harbor at 17 U.S.C. §512(c), built for exactly this situation: a platform that hosts user-supplied material and does not itself decide what gets posted. But it is opt-in. It only protects a platform that has already done a short, specific list of things, and one of them, registering an agent with a federal office, is the kind of paperwork task that gets pushed to "later" indefinitely, because nothing forces it until the day something does.
This is a different problem from the one FOSTA-SESTA carves out of platform immunity, which is about sex trafficking content specifically and changes what a different law, Section 230, covers. A copyright claim over a photo has nothing to do with what the listing is advertising; the same claim would land the same way on a furniture marketplace or a used-car site. It is a picture-ownership problem, not a content-legality problem, and it needs its own, separate answer.
What makes this worth an operator's attention now, rather than after the first notice, is that the safe harbor's conditions are forward-looking in a specific way: the protection covers what the site does once it is set up correctly, and a site that only starts the paperwork after a claim lands is trying to close a door that is already open. The fix costs six dollars and takes fifteen minutes. Not doing it costs the ability to say, credibly, that the claim should have been directed at the advertiser instead of the business.
An immunity you have to apply for
Section 512(c) sets out conditions, not a general promise. To qualify, a service provider must not have actual knowledge that specific material is infringing, must not be aware of facts that would make infringement obvious, must not receive a direct financial benefit tied to specific infringing material it has the right and ability to control, and, once it learns of a specific infringing item, must act quickly to remove or block access to it. None of that happens automatically just because the platform is a marketplace for user listings rather than a publisher of its own content.
The condition that trips up small operators is a separate one: a service provider has to designate an agent to receive copyright complaints, and since the U.S. Copyright Office moved to an all-electronic system, that agent has to be registered in the Office's own online directory. An email address posted in a site's footer, on its own, is not what the law looks for anymore. The old approach, filing a paper form or simply publishing contact details, stopped counting once the paper-based registrations lost their validity at the end of 2017; only the electronic directory entry does the job today.
The registration itself is a short form: legal business name, the site's domain or domains, and the name and contact details of whoever should receive a notice. The Copyright Office charges six dollars for the initial filing, an amendment, or a resubmission, with no separate fee just to open the account that files it. For a business already paying far more for a payment processor's underwriting file or a lawyer's hourly rate, this is one of the cheapest pieces of legal protection it will ever buy, and one of the easiest to forget it bought.
The registration is not permanent. It expires three years after it is filed unless the provider renews it, either by amending the entry or resubmitting it unchanged, and either action starts a fresh three-year clock. A lapsed registration does not send a warning to the business; it simply stops being valid, silently, and the gap is usually discovered by whoever is trying to rely on it, only after a claim has already arrived. Whoever manages compliance for the site should own a calendar reminder for this the same way they own one for a domain renewal, because the two failures look identical from the outside and cost about the same to prevent.
What arrives is a countdown, not a courtesy
A validly formatted takedown notice does not ask the operator to investigate or judge whether the claim is true. It asks for one thing: that the material be removed or disabled quickly. The law does not set a fixed number of hours or days for "expeditiously"; what counts as fast enough is judged against what a provider of that size and with those resources could reasonably manage, which for a small classifieds site means having an actual, working process, not a promise that someone will get to it.
In practice that process is simple to build and easy to skip: a monitored inbox or form that reaches a person with the authority to pull a listing or a specific photo, a record of when the notice arrived and when it was acted on, and a habit of treating every notice that carries the required elements (identification of the work, identification of the material, contact details, a good-faith statement, a signature) as one that starts the clock, whether or not the claim looks solid on a first read.
That last point matters because the reverse mistake, a false or exaggerated copyright claim used to knock a competitor's listing offline, is a real risk in a business where operators already compete hard for the same search traffic. The safe harbor's answer to this is not for the platform to play judge. It is the counter-notice: an advertiser who believes a takedown was wrong can file one, and once a valid counter-notice is in, the provider is protected if it restores the material after waiting no less than ten and no more than fourteen business days, unless the original claimant files suit in that window.
This sequence matters for an operator specifically because it removes the need to personally adjudicate who owns a photo. The process, not the operator's judgment, decides the outcome: pull it fast on a valid notice, put it back on a valid counter-notice once the waiting period has passed without a lawsuit, and document both steps. An operator who improvises this the first time it happens, instead of having it written down in advance, is the one who ends up either leaving a legitimate advertiser's listing down for weeks or missing the window that would have protected the removal decision.
The policy that has to work, not just exist on paper
One more condition sits underneath the notice-and-takedown mechanics, and it is the one that has actually cost a large provider its safe harbor in court: under §512(i), the provider must adopt, and reasonably implement, a policy for terminating the accounts of repeat infringers in appropriate circumstances. Adopting a policy means writing one down. Implementing it reasonably means the policy has to actually produce terminations when its own conditions are met, not just exist as a page linked from the footer.
That distinction is exactly what went wrong for the internet provider Cox Communications in BMG Rights Management v. Cox Communications. Cox had a written policy that, on paper, escalated through thirteen warnings before termination, but the Fourth Circuit found that Cox's own internal practice almost never resulted in an account actually being cut off, no matter how many valid notices piled up against it. The appeals court agreed that a policy which does not lead to real terminations is functionally no policy at all, and on that basis Cox lost its safe harbor entirely, not just for the specific files at issue. A jury's initial damages verdict against Cox was later vacated on appeal over an unrelated instruction error, and the two companies settled the case confidentially before a second trial took place, but the loss of the safe harbor itself stood.
The lesson does not require running an ISP's scale of infrastructure to apply. A small classifieds site needs a plain, written threshold, for example, an advertiser account that accumulates a set number of valid, unresolved copyright notices within a defined period gets suspended, and it needs to actually suspend that account when the threshold is met, every time, not only when it is convenient. It also needs the standard courts look for when they later ask whether the policy was reasonable: a real, credible basis for treating an account as a repeat infringer, which does not require a court to have ruled on the underlying claim first, but does require more than a single unverified accusation sitting alone.
What makes this defensible later is the paper trail, not the exact number chosen for the threshold: which notices came in, when, against which account, and what happened as a result. A three-line spreadsheet updated every time a notice is actioned is worth more, if the policy is ever tested, than a beautifully worded policy page that nobody has checked against what the site actually did the last time it mattered.
What this doesn't cover, and what to do this week
The DMCA safe harbor is a copyright mechanism and nothing else. It has no bearing on a trademark complaint, a defamation claim, or the separate carve-out FOSTA-SESTA created in Section 230 for content tied to sex trafficking, which runs on its own legal test entirely apart from anything discussed here. An operator who has registered a DMCA agent and built a working repeat-infringer policy has solved the photo-ownership problem specifically, and only that one.
It is also a purely domestic mechanism. A platform reaching users in the European Union carries a separate, parallel obligation, the notice-and-action duty the EU's Digital Services Act imposes regardless of where the company is based, which runs on its own required elements and its own timeline. Neither process substitutes for the other; an operator serving both audiences needs both running side by side, with someone who actually knows which notice triggers which clock.
What changes this week, concretely: check whether the site has a current agent registration in the Copyright Office's online directory, and if it has never been filed, or was filed under the old paper system before the 2017 cutover, file it now for six dollars. Write down, even briefly, the repeat-infringer threshold the site will actually enforce and who is responsible for enforcing it. Set up the monitored inbox or form, and the simple log, before the first real notice tests whether either one exists.
Run the counter-notice process once, on a test basis, so whoever handles it knows the ten-to-fourteen-business-day window before a real advertiser is waiting on it. None of this prevents a copyright claim from arriving. It decides, in advance, whether that claim lands on the advertiser who posted a photo that was never theirs, or on the business that gave them a place to post it.
