Got a copyright infringement notice from your ISP? What it means and what to do

The email usually arrives with a subject line like "Notice of claimed infringement" and names a film, show, song or game, a date and time, and your IP address. It can be alarming. In most cases it is the first step in a warning process, not a legal case. This guide is part of our section on copyright notices. It explains why your provider sent the notice, what it can and cannot do, and what to do next.

Notices like this have a long history. From 2013 to 2017, five large US providers forwarded them through a formal program called the Copyright Alert System. That program has ended, but the basic process continues under each provider's own policy.

01Why your provider sent it

Film studios, record labels and game publishers hire monitoring companies to watch peer-to-peer file sharing networks. When those companies see one of their clients' works being shared from an IP address, they send a notice to the internet provider that controls that address. The provider checks its records to see which account had that address at that moment, and forwards the notice to the account holder.

Providers forward these notices partly because of section 512 of the Copyright Act, part of the Digital Millennium Copyright Act of 1998. Section 512(a) shields providers from money damages for infringement that passes through their networks, but section 512(i) makes that protection depend on adopting and reasonably implementing "a policy that provides for the termination in appropriate circumstances of subscribers and account holders" who are repeat infringers. Forwarding notices and tracking how many each account receives is how most providers run that policy.

02What the notice can and cannot do

A forwarded notice is an accusation from a rights holder, passed on by your provider. On its own it:

• is not a lawsuit. The US Copyright Office's section 512 FAQ says plainly that a takedown notice does not mean you are being sued; if you are, you will be served with court papers.
• is not a finding of guilt. No court has looked at the claim.
• does not reveal your name. The rights holder knows an IP address, not who you are.
• does count toward your provider's repeat infringer policy. Further notices can move your account to the next step.

Some providers include the rights holder's original text, which may mention damages of up to $150,000 per work. That figure is the statutory maximum for willful infringement under 17 U.S.C. 504(c), not an amount anyone has been ordered to pay.

03What to do in the first week

1. Read it closely. Note the title, date, time and IP address. Check that the notice came from your actual provider, using your account portal or the phone number on your bill, not a link in the email.
2. Find the source. Check every computer, phone, console and smart TV on your network for torrent or file sharing programs, including ones that start automatically.
3. Stop the sharing. Remove or close programs you do not need. Downloaded files in a sharing folder may keep uploading until you remove them.
4. Secure your Wi-Fi. Set a strong password, use WPA2 or WPA3 encryption, and change the router's default admin password.
5. Keep records. Save the notice and write down what you found and changed.
6. Acknowledge if asked. Some providers require you to log in or call to acknowledge the notice. Doing so is not an admission of liability.
7. Do not pay strangers. Your provider will not ask you to pay a settlement. Treat any payment demand with suspicion until you have confirmed who sent it.

If you think the notice is wrong, for example because the date shows a time when nobody was home, you can contact your provider and ask how to dispute it. Disputes over ISP notices are not formal counter-notices like those used for content taken down from websites, which our guide to DMCA takedowns and counter-notices covers.

04Repeat infringer policies and account suspension

Each provider writes its own repeat infringer policy. Most move accounts through steps: first an email or letter, then notices you must acknowledge, then temporary suspension, and finally termination.

One example: Xfinity's DMCA Repeat Infringer Policy page, updated in August 2026, says accounts move from one step to the next "upon receipt of repeated DMCA notifications in a calendar month." It says termination, if reached, takes effect 14 days after the final notice and typically lasts no less than 180 days. Other providers use different numbers, so read your own provider's policy.

What the Supreme Court said in 2026

On March 25, 2026, the Supreme Court decided Cox Communications v. Sony Music Entertainment. It held that a provider is contributorily liable for its users' infringement only if it induced the infringement or offered a service tailored to it, and that Cox, which simply sold internet access, was neither. The Court noted that Cox had sent warnings, suspended service and terminated accounts in response to notices. It also described the DMCA safe harbor as a defense for providers, not a source of new duties.

The ruling is about the provider's liability, not yours. The person who actually copied or shared a work can still be sued directly.

05Subpoenas and settlement letters

Rights holders sometimes want to go beyond warnings. To find out who is behind an IP address, a rights holder generally has to go to court. Xfinity's policy page, for example, says it does not disclose a customer's identity to content owners under the DMCA "unless there is a valid court order."

The usual path is a lawsuit against an unnamed "John Doe" defendant, followed by a court-approved subpoena to the provider. Providers commonly tell the subscriber before they respond, which gives you time to talk to a lawyer about whether to challenge it.

Settlement letters

Some rights holders and their law firms send letters offering to settle for a set amount. Before you respond:

• check whether a lawsuit has actually been filed, using the case number and the federal court's online records;
• do not ignore real court papers, because deadlines are strict;
• know that smaller disputes can also go to the Copyright Claims Board, a voluntary forum for claims up to $30,000 described on the Copyright Office's section 512 resource page.

This is the point where a lawyer licensed where you live is worth calling.

06Wi-Fi, guests and shared connections

A notice identifies a connection, not a person. On a shared connection, the activity may belong to a roommate, a guest, a child or a neighbor using an open network. That matters if a dispute goes further, because a rights holder must show who actually infringed.

It also means the account holder is the one who hears about it and whose service is at risk. Practical steps help: use a password on your network, set up a separate guest network with its own password, and talk with everyone in the household about file sharing programs. Businesses that offer public Wi-Fi often use terms of use and filtering for the same reason.

07How this compares with six strikes

From February 2013 to January 2017, five large US providers took part in the Copyright Alert System, often called six strikes. Notices moved through up to six alerts with educational and then "mitigation" steps, such as slowed connections, and subscribers could ask for a review for a fee. Our archive explains what a Copyright Alert was and how its six stages worked, and why the Copyright Alert System ended in 2017.

Today there is no shared program. Each provider runs its own policy, with its own steps, and there is no common review process. If you want to avoid notices altogether, our guide to finding movies, TV and music legally explains how to tell licensed services from pirate sites.

If the claim is not about downloading at all but about something AI produced, or a charge that your own work was machine-made, see takedowns and AI-content claims.