DMCA Notice Requirements: Why Automated Takedown Requests Fail

What the law actually requires

A takedown notice under United States law is not a letter of complaint. It is a statutory instrument, and section 512(c)(3) of the Copyright Act sets out exactly what it must contain. Six elements, all of them mandatory:

1. A signaturePhysical or electronic, from a person authorised to act on behalf of the owner of the exclusive right that is allegedly infringed.
2. Identification of the copyrighted workThe specific work claimed to have been infringed. If one notice covers several works on one site, a representative list of those works.
3. Identification of the material to be removedInformation reasonably sufficient for the service provider to locate it. A direct URL is the gold standard.
4. Contact detailsAddress, telephone number and, where available, an email address, sufficient for the provider to contact the sender.
5. A good faith belief statementThat the use complained of is not authorised by the copyright owner, its agent, or the law.
6. A statement under penalty of perjuryThat the information is accurate and that the sender is authorised to act on behalf of the owner of the exclusive right.

Now look at that list from the point of view of a machine. Elements one, four, five and six are boilerplate — they can be generated for any notice, about any work, on any site, with no knowledge of the content whatsoever. Element three can be filled in by a crawler that matched something and recorded the URL it was sitting on.

Element two is the only one that requires a human being to know something. It is also the element that automated systems consistently drop.

Five of the six elements can be produced by software that has never seen the file. The sixth is the entire point of the notice.

A worked example

Below is a notice we received recently, anonymised. It is not unusual — we get variants of this text from several agencies, and the structure is close to identical each time.

Read quickly, it looks complete. It uses the statutory language, it swears the oath, it gives a precise target URL. Scored against the six elements, it comes out like this:

Four clean, one incomplete, one absent. And the absent one is fatal.

Why naming a person is not naming a work

Copyright subsists in works. A film, a photograph, a set of images, a piece of music. It does not subsist in a name, a stage persona, a face, or a body. There are laws that protect those things — trade mark, personality and publicity rights, data protection, and the specific statutes covering intimate imagery — but none of them is the DMCA, and a notice filed under section 512 has to be about a work.

So when a notice says the rights holder is Creator_Handle, it has not told us what was infringed. It has told us who is upset. Those are different claims with different legal routes and different evidence.

Profile pages are not works either

• A profile URL points to a changing collection. The account behind it might hold four hundred clips, or forty, or none by the time we look. It does not identify anything specific enough to compare against.
• Several of the sites typically listed as the source are themselves user-upload platforms. Content appearing there proves that someone uploaded it there. It is not evidence of who owns it — the same crawler that found our URL would find those.
• Nothing in the notice connects the accused file to any particular item on any of the listed profiles. We are given seven haystacks and one needle and asked to assume they match.
• The statute does allow a representative list where one notice covers multiple works on one site. That is a list of works, with titles. A list of social accounts is not a representative list of anything.

And the owner is never named

The perjury statement swears that the sender is authorised to act on behalf of the holder of the exclusive rights. It never says who that holder is. Is it the performer personally? A studio she shot for, which may hold the copyright in the footage while she holds none? An agency with a written mandate? Each of those produces a different answer about whether a given upload was authorised, and we cannot check any of them against a blank.

Why this matters more here than elsewhere

On most platforms, a bad notice is an annoyance. On an age-verified adult platform it is a direct risk to the people the notice claims to protect, because of what we hold on file.

Every item published on BentBox carries a record: verified identity of the uploader through ProntoID, a digital model release for each performer depicted, records kept to the standard required under 18 U.S.C. § 2257, a Pronto Tag provenance entry, and a timestamped upload log. That is a deliberately heavy evidentiary trail, and it exists precisely so that ownership questions can be settled with documents rather than assertions.

Give us a work and we can resolve the claim quickly. We compare the accused file against the identified work, pull the release and the upload record for that item, and either remove it or come back to you with what we found. That is usually a matter of hours.

Give us a performer name and we can do none of that. Worse, the most common false positive we see is the creator's own authorised upload. A crawler matches a face or a filename, an agency pipeline fires a notice, and the content it demands we remove is content the performer herself uploaded, under her own release, earning her own revenue. Acting on that notice without verification would mean taking income away from the person the notice was supposedly filed for.

What to send instead

Here is the same claim, rewritten so that it can be processed. It is longer by roughly one paragraph, and that paragraph is the difference between a filed notice and a removed file.

Items two and three are the ones that do the work. Everything else is form. Send it through the notice form rather than to general support: it collects these elements in the order above, so it is logged and clocked correctly from the moment it arrives. The copyright policy sets out what we do with it next.

If you are a BentBox creator chasing your own work on a third-party site, the outbound process — finding that site's designated agent, escalating to the domain registrar, and a downloadable template — is covered in Content Leaks & DMCA Takedown Requests.

What happens after you send it

A notice is not the end of the process, and senders who treat it as a fire-and-forget action tend to be surprised by what follows.

• The uploader can respond. Under section 512(g), the person whose content was removed may file a counter-notification. If they do, we must forward it to you, and unless you file a court action the material goes back up within ten to fourteen business days. A notice you cannot substantiate buys you a fortnight.
• Misrepresentation carries liability. Section 512(f) makes anyone who knowingly materially misrepresents that material is infringing liable for the resulting damages, including costs and legal fees. That applies to the agency and, depending on the mandate, potentially to the client on whose behalf it swore the oath.
• Good faith has to be actual. US case law has held that a sender must form a subjective good faith belief that the use is unauthorised before sending, and must consider whether the use might be lawful. A pipeline that never opens the accused file and never checks the platform's licence records is not forming a belief about anything.
• We keep records too. Every notice is logged with its sender, its content and our decision. Patterns of unsubstantiated notices from a single source are visible to us, and they affect how quickly later notices from that source are handled.

If you are filing from Europe

The DMCA is US law and creates a US safe harbour. BentBox is operated from Europe, which means Article 16 of the Digital Services Act is the operative notice and action regime for us, and a notice that meets its requirements gives us actual knowledge of the content in question.

Article 16 asks for four things: a sufficiently substantiated explanation of why the content is unlawful, a clear indication of its exact electronic location such as the precise URL, the name and email address of the person or entity submitting the notice, and a statement confirming a bona fide belief that the information is accurate and complete.

Different wording, same substance — and the same failure mode. A notice that names a performer and links to profile pages does not substantiate anything, because it never explains which work is unlawfully present or why. We will confirm receipt and we will assess it, but there is nothing in it to act on.

When copyright is the wrong tool entirely

Sometimes the real complaint is not that someone copied a work. It is that intimate content of a person was published without that person's consent. That is a different wrong, and routing it through copyright makes it slower and weaker than it needs to be.

Non-consensual intimate imagery has its own process, with its own deadline. Under the TAKE IT DOWN Act, in force against covered platforms since May 2026, a platform that receives a valid removal request from the depicted individual — or someone authorised to act for them — must remove the material and known identical copies within 48 hours. The request does not ask you to prove you own a copyright. It asks you to identify the depiction, confirm it shows you, and state that it was published without your consent.

If that is the situation, use the non-consensual content route rather than filing for infringement. We will also check the item against the identity verification and model release we hold for that upload, which is often the fastest way to establish what happened.