Internet Service Providers Win at the US Supreme Court in the Landmark Case of Cox v. Sony Music Setting the Limits of Secondary Copyright Liability, A Ugandan Legal Perspective.

Introduction

In the modern digital economy, access to the internet has become as fundamental as access to electricity or running water. The entities that make this access possible are known as Internet Service Providers, or ISPs which are companies that supply individuals, households, businesses, and institutions with connectivity to the global internet.

ISPs such as Cox Communications, one of the largest in the United States with approximately six million subscribers, function essentially as infrastructure providers, they assign each subscriber account a unique Internet Protocol (IP) address and facilitate the flow of data across their networks, but they do not, and largely cannot, monitor or control what their subscribers do online.

This reality is as true in Uganda as it is in the United States. Ugandan subscribers access the internet daily through ISPs such as Canal Box, Zuku Fibre, and various telecom networks including MTN and Airtel. These providers supply the connection, nothing more and nothing less. What a subscriber chooses to do with that connection, whether streaming lawfully licensed content, conducting business, or downloading copyrighted music without permission, remains largely beyond the provider's sight and control. The ISP is, in the most practical sense, the road, not the driver.

This technical and operational reality places ISPs in a structurally awkward position when their networks are used for unlawful purposes. Among the most widespread of such purposes is online copyright infringement. Copyright law, codified in the United States under Title 17 of the United States Code, grants creators and rights holders the exclusive right to reproduce, distribute, and digitally transmit their protected works.

When a subscriber uses an ISP's internet connection to upload or download copyrighted material, a song, a film, a software programme, without the rights holder's authorisation, that subscriber commits a direct act of copyright infringement. The ISP, however, is rarely the one doing the uploading or downloading. It is simply the conduit.

The mechanism by which such infringement typically occurs is basically, a subscriber installs peer-to-peer file-sharing software and uses it to distribute or obtain copyrighted content without permission. Rights holders, unable to monitor the entire internet themselves, engage specialist third-party services to do so on their behalf.

One such service, MarkMonitor, was retained by Sony Music Entertainment to scan peer-to-peer networks for unauthorised sharing of its musical catalogue. MarkMonitor's software detects infringing activity, traces it to a specific IP address, identifies the ISP to which that address belongs, and transmits a formal infringement notice to that ISP. In the two-year period relevant to the present case, MarkMonitor sent Cox Communications no fewer than 163,148 such notices, a figure that underscores both the scale of online piracy and the frequency with which ISP networks are implicated in it.

The legal question that flows from this scenario is that when an ISP receives repeated notices that specific subscriber accounts are being used to infringe copyrights, and continues nonetheless to provide those accounts with internet access, does the ISP become legally responsible for that infringement?

This is the question addressed by the United States Supreme Court in Cox Communications, Inc. v. Sony Music Entertainment, decided on March 25, 2026. Sony Music, rather than pursuing the individual subscribers responsible for the direct infringement, chose to hold Cox itself accountable, arguing that Cox's continued provision of internet service to known infringers made it a secondary infringer liable for the harm caused. A jury agreed, returning a verdict of $1 billion in statutory damages against Cox. The Supreme Court ultimately reversed that verdict, articulating important boundaries around the doctrine of contributory copyright liability and, in doing so, reshaping the legal landscape for ISPs across the United States.

download the full case below

24-171_bq7d.pdf

Download PDF • 202KB

Background

The dispute between Cox Communications and Sony Music arose from the well-documented problem of large-scale online copyright piracy. Sony Music, as the owner of an extensive catalogue of copyrighted musical works, engaged a third-party service to monitor peer-to-peer file-sharing networks for unauthorised copying of its recordings. That service identified numerous Cox subscribers who were allegedly downloading or distributing Sony's copyrighted songs without authorisation and transmitted infringement notices to Cox accordingly.

Cox responded in part, closing certain subscriber accounts, but continued to provide internet access to other accounts despite having received notices of alleged infringement. Sony Music contended that Cox's failure to terminate all identified accounts rendered it secondarily liable for the direct copyright infringement committed by those subscribers.

Questions Presented

After the Supreme Court granted certiorari on 30 June 2025, the case came before the Court on two questions of considerable practical significance for the internet industry

1. Whether the Fourth Circuit erred in holding that a service provider can be held liable for "materially contributing" to copyright infringement merely because it knew that people were using certain accounts to infringe and did not terminate access, without proof that the service provider affirmatively fostered infringement or otherwise intended to promote it.

2. Whether the Fourth Circuit erred in holding that mere knowledge of another's direct infringement suffices to find wilfulness under 17 U.S.C. § 504(c) for the purpose of statutory damages.

   
   

Procedural History

At trial, Sony prevailed comprehensively. The jury returned a verdict against Cox on two distinct theories of secondary copyright infringement, contributory infringement and vicarious infringement, and awarded statutory damages of $1 billion, one of the largest copyright verdicts in history.

On appeal, the United States Court of Appeals for the Fourth Circuit partially upheld that verdict. The Fourth Circuit affirmed the jury's finding of contributory copyright infringement, rejecting Cox's arguments that its general-purpose internet service was also heavily used for lawful activity and that its contribution to infringement must rise to the level of aiding and abetting.

However, the Fourth Circuit reversed the verdict on vicarious liability, finding that Cox had not directly profited from its subscribers' infringing acts, an essential element of that form of secondary liability. The Supreme Court then granted certiorari to address the scope of contributory infringement liability for internet access providers.

The Supreme Court's Holding

Writing for the Court, Justice Thomas reversed the Fourth Circuit and held that Cox was not liable for contributory copyright infringement. The Court articulated a two-part framework and concluded that Cox satisfied neither condition for liability.

The Legal Framework

• Specific intent required

  The Court held that contributory infringement by a service provider requires a showing of specific intent to facilitate infringement. That intent is established in one of two ways: either the service provider induced infringement, or the service itself was tailored for infringement.

  
  

• Inducement

  A service provider induces infringement where it actively encourages infringement through specific acts, such as express promotion, marketing, or other conduct demonstrating an intent to promote infringing use. Knowledge of infringement alone is insufficient; there must be affirmative conduct directed at facilitating it.

  
  

• Tailoring

  A service is "tailored to infringement" where it lacks substantial non-infringing and commercially significant uses. Where a service has meaningful lawful applications, it cannot be said to have been designed to facilitate infringement.

Application to Cox

The Court found that Cox fell outside the scope of contributory liability on both grounds. On inducement, the Court observed that Sony had adduced no evidence of express promotion, marketing, or intent to promote infringement. On the contrary, the Court noted that Cox had repeatedly discouraged copyright infringement, issuing warnings, suspending services, and terminating accounts, conduct fundamentally incompatible with any intent to foster piracy.

Cox neither induced its users’ infringement nor provided a service tailored to infringement. Cox simply provided Internet access, which is used for many purposes other than copyright infringement. Thomas, J. Cox v. Sony Music (2026)

On the question of tailoring, the Court held that Cox's internet service was plainly capable of substantial, commercially significant non-infringing uses. Citing Justice Ginsburg's concurring opinion in the proceedings below, the Court emphasised that Cox had not engineered its service to make copyright infringement easier, it had merely provided general internet access, a utility deployed daily for an enormous range of legitimate purposes entirely unrelated to piracy.

The DMCA Safe Harbour

The Court also addressed an important ancillary argument advanced by Sony regarding the Digital Millennium Copyright Act. Sony had contended that Cox's failure to comply with the DMCA's safe-harbour conditions, which include maintaining and enforcing a repeat-infringer termination policy, should be treated as evidence of, or as the basis for, liability under the general copyright statute.

The Court squarely rejected this argument, holding that Sony had overread the DMCA. The statute does not expressly impose liability on internet service providers who continue to serve known infringers. Rather, the DMCA merely creates additional defences from liability that providers may elect to rely upon where they satisfy the prescribed conditions.

The Court held that the DMCA itself made clear that an ISP's failure to qualify for safe-harbour protection shall not bear adversely on any separate defence that the ISP's conduct was itself non-infringing. Compliance with safe-harbour conditions is thus elective, not a threshold requirement for asserting other copyright defences.

Significance and Commentary

◆

A major victory for ISPs.

The decision establishes that general internet access providers are not required to police their networks for infringement on pain of secondary liability. An ISP that responds to notices, warns subscribers, and does not affirmatively promote piracy will not be held contributorily liable under federal copyright law.

The decision draws a principled line between platform operators who affirmatively design for infringement, such as the peer-to-peer networks condemned in earlier secondary liability cases, and neutral infrastructure providers whose services happen to be misused by some subscribers. By requiring specific intent, whether through inducement or tailoring, the Court ensures that the contributory infringement doctrine does not sweep in providers of general-purpose communications infrastructure.

The Court's treatment of the DMCA is equally significant. The holding forecloses a litigation strategy under which rights-holders might leverage the safe-harbour framework offensively, arguing that an ISP which fails to satisfy safe-harbour conditions is thereby exposed to heightened liability under the main copyright statute. The safe harbour is an elective shield, not a mandatory compliance regime whose breach creates new heads of liability.

The case is likely to carry significant implications for the many ongoing disputes between major record labels and ISPs across the United States, several of which involve analogous contributory infringement theories predicated on the receipt of DMCA notices and a failure to terminate subscriber accounts. Whether the decision will also reshape the wilfulness inquiry under 17 U.S.C. § 504(c), and by extension the scale of statutory damages available in future cases, remains to be seen as lower courts apply the Supreme Court's framework on remand.

Conclusion

The Supreme Court’s decision in Cox Communications, Inc. v. Sony Music Entertainment is, at its core, a ruling about the boundaries of responsibility in a fast-paced digital world. Sometimes the law catches up with technological innovation; at other times, it slows it down. This decision, however, addresses a question that lies at the heart beat of technology, commerce, and law and how far does liability travel down the chain from the person who commits a wrong to the infrastructure that made it possible?

The Court's answer was that liability does not follow mere knowledge, and an ISP that provides a general-purpose service without inducing or designing for infringement is not the copyright police. That responsibility, the Court made clear, belongs elsewhere.

For the United States, the immediate consequences are significant. ISPs are relieved of the threat of billion-dollar verdicts premised solely on their failure to terminate subscriber accounts. Rights holders must now direct their enforcement energies more precisely, toward those who actually commit infringement, or toward platforms that affirmatively design for or promote it. The DMCA safe harbour, meanwhile, is restored to its proper function as a voluntary shield rather than a sword that rights holders may wield against non-compliant providers.

For Uganda, the lessons are prospective but no less important. The country's copyright framework is still taking shape. The ongoing development of the Copyright Bill presents a rare and valuable opportunity, the opportunity to legislate with the benefit of watching other jurisdictions navigate these questions first, often at enormous cost. Uganda need not wait for a billion-dollar lawsuit to clarify where an ISP's responsibility begins and ends. It can draw on the reasoning of Cox v. Sony Music to inform how secondary liability is defined, how ISP obligations are framed, and how the competing interests of rights holders, service providers, and the general public are balanced in statute.

At the same time, Uganda must be honest about the foundational gaps that remain. A copyright framework is only as strong as the public's understanding of it. When basic concepts such as neighbouring rights are still subjects of confusion rather than common knowledge, the more sophisticated questions of contributory liability and ISP accountability risk becoming the preserve of a small legal elite, disconnected from the artists, creators, and entrepreneurs whose livelihoods the law is designed to protect.

Closing that gap, through legal education, public awareness, and accessible drafting, is as urgent a task as any legislative reform.

The internet does not respect borders because the same peer-to-peer networks that flooded Cox's servers with infringement notices operate just as freely through Canal Box and Zuku Fibre. The same musicians whose recordings were pirated across American broadband connections are the spiritual counterparts of Ugandan artists whose music circulates online without attribution, licence, or remuneration.

The legal tools available to address this problem will, in time, be tested in Ugandan courts as they have been tested in American ones. When that moment arrives, it will matter enormously whether Uganda has built a framework clear-eyed enough to distinguish the road from the driver, and wise enough to hold the right one accountable.