Extraterritorial Application of the Digital Millennium Copyright Act

 

Image by ChatGPT

Congress passed the Digital Millennium Copyright Act (DMCA) in 1998 to criminalize the circumvention of access controls to copyrighted works. Section 1201 provides: “No person shall circumvent a technological measure that effectively controls access to a work protected under this title.” Section 1203 allows a person injured by a violation of that provision to sue for damages.

The question in Cadence Design Systems, Inc. v. Yunjing Intelligent Innovation (Shenzhen) Co. was whether the DMCA applied to Chinese companies that allegedly obtained unauthorized, or “cracked,” copies of plaintiff’s software from third-party websites on foreign servers. The defendants argued that they engaged in no conduct in the United States. But in a March 17, 2026, decision, Judge Araceli Martínez-Olguín (Northern District of California) held that, because a license file used to protect the software was located in California, circumvention of the access controls occurred in the United States. She also rejected defendants’ arguments that the court lacked personal jurisdiction.

Cracked Software

Cadence Design Systems develops and sells electronic design automation software that manufacturers can use to optimize printed circuit boards and semiconductors. Cadence owns a registered U.S. copyright for the software. Customers must obtain a license and pay ongoing license fees.

To prevent unauthorized use, customers must install the Cadence License Manager (CLM) on their servers. The CLM limits the number of users to the number of licenses purchased by the customer. When a customer purchases a license, Cadence generates a license file that the customer enters in the CLM to access the software. To install the CLM on its servers, a customer must accept the terms of Cadence’s Software License and Maintenance Agreement (SLMA).

Yunjing Intelligent Innovation (Shenzhen) Co. and its subsidiaries are Chinese companies that manufacture robotic vacuums under the name “Narwhal.” These companies allegedly used cracked versions of Cadence’s software, downloaded from a website outside the United States. Through a “phone home” feature of its software, Cadence detected more than 200,000 unauthorized uses by defendants. Cadence sued for violations of the DMCA and breach of the SLMA. Defendants moved to dismiss for lack of personal jurisdiction, forum non conveniens, and failure to state a claim, arguing that the DMCA does not apply extraterritorially.

Extraterritoriality

The U.S. Supreme Court applies a presumption against extraterritoriality to determine the geographic scope of federal statutes. In its current incarnation, the presumption has two steps: (1) look for a clear indication that a statutory provision applies extraterritorially; and (2) in the absence of such an indication, determine whether applying the provision can be considered “domestic” because conduct relevant to its focus occurred in the United States. Relying on a pre-DMCA case, Judge Martínez-Olguín reasoned that U.S. copyright laws do not apply extraterritorially, and so she turned to step two.

Based on the statutory language, Judge Martínez-Olguín concluded that the conduct § 1201 seeks to regulate is the circumvention of copyright protection systems. The question then became whether that conduct occurred domestically. The parties disagreed about which “technological measure” controlled access to the software, with the defendants arguing that it was the CLM installed on their servers in China and Cadence arguing it was the license file maintained on its servers in California. The judge found that the circumvented technological measure consisted of both the CLM and the license file together. “Since Cadence alleges it generates and maintains the license file in this district,” she reasoned, “the circumvention constitutes a domestic application of the DMCA.”

This seems like the right result to me, but its implications are sweeping. So long as part of the access control to a copyrighted work has to run through a U.S. server, any circumvention of that access control necessarily involves domestic conduct. This is true even if, as in this case, the defendants are foreign companies that downloaded the cracked software from foreign servers. The practical result is that U.S. copyright holders should be able to claim DMCA protection worldwide.

Personal Jurisdiction and Forum Non Conveniens

Of course, a potential obstacle to claiming DMCA protection worldwide is the need to obtain personal jurisdiction over the defendants. Here too, Judge Martínez-Olguín interpreted the law in a way that favors U.S. copyright holders, finding personal jurisdiction based on effects in California and the forum selection clause in the SLMA.

The Supreme Court held in Calder v. Jones (1984) that personal jurisdiction can be based on injuries that the defendants knew would occur in the forum state. As in Calder, the court reasoned, “Defendants knew of Cadence and its location in the United Stated and allegedly knew their circumvention of Cadence’s security measures to gain unauthorized access to the software would impact Cadence there.” (The court did not mention Walden v. Fiore (2014). But in this case, unlike Walden, the plaintiff not only resided in California but was also injured there.)

The court also found that Cadence’s claims arise out of or relate to the defendants’ forum-related conduct. The Ninth Circuit has recently held that this requirement does not require a causal relationship. Using “counterfeit [license] files that avoid a domestic cybersecurity measure are the kinds of contacts that would tend to cause a Section 1201 violation and a claim for breach of a licensing agreement,” Judge Martínez-Olguín noted. Indeed, “even applying a causal requirement between Defendants’ contacts and the claims at issue, it is clear that but for Defendants’ alleged circumvention of security measures partially created and maintained in California, there would be no claim under 17 U.S.C. § 1201.”

Alternatively, Judge Martínez-Olguín held that the forum selection clause in the SLMA expressed consent to jurisdiction in California courts. Cadence’s regular customers have to click “I agree” to install the CLM on their servers. Defendants argued that they never did this and so never assented to the SLMA and its forum selection clause. “Jurisdictional discovery shows Defendants downloaded the ‘cracked’ software from a third-party website, which employed a ‘one-click’ installation that automated the process of clicking through the SLMA,” the court noted. This automated process was sufficient to manifest assent, Judge Martínez-Olguín concluded.

The forum selection clause also doomed defendants’ forum non conveniens argument. Under Atlantic Marine Construction Company v. U.S. District Court for the Western District of Texas (2013), the existence of a valid forum selection clause tips all the private interest factors in favor of the selected forum, leaving only the public interest factors, which rarely require dismissal.

Like the court’s holding on extraterritoriality, its holdings on personal jurisdiction seem correct but also sweeping. Personal jurisdiction in DMCA cases may be based on the effects of circumventing access control measures so long as the defendants knew whose copyrighted works they were accessing and where they were located in the United States. Or personal jurisdiction may be based on consent if the access controls required clicking through an agreement with a forum selection clause even if, as in this case, the click-through was automated.

Conclusion

Judge Martínez-Olguín’s decision in Cadence Design Systems gives broad protection under the DMCA to U.S. copyright holders against foreign parties who circumvent their access controls. So long the access controls run in part through a U.S. server, applying the DMCA will be considered domestic. The domestic circumvention may also be used to establish personal jurisdiction on an effects theory. Or, alternatively, consent may be a basis for personal jurisdiction if the access controls are structured to require assent to a forum selection clause.

Under this decision, circumventing access controls that are properly structured can give rise to DMCA claims in U.S. courts against foreign defendants who have no other U.S. contacts.