ISP Liability For Copyright Infringement: Lessons From Cox v. Sony Music

The digital era has revolutionised how content is created, distributed, and consumed, presenting both opportunities and complex legal challenges. Internet Service Providers (ISPs), once seen as neutral conduits of data, now appear to have been saddled with the task of playing a pivotal role in copyright enforcement. With millions of users sharing content daily, ISPs face the question: to what extent should they be held responsible for infringing activities carried out by their subscribers? The answer involves balancing the rights of copyright holders, operational realities, and principles of digital freedom.

A landmark development came with Cox Communications, Inc. v. Sony Music Entertainment. ¹ (“Cox v. Sony”), where the court delineated the boundaries of secondary liability of ISPs under the Digital Millennium Copyright Act (“DMCA”) in the United States of America. The decision highlighted the distinction between knowledge and intent, establishing that an ISP’s liability depends on awareness of infringement and failure to act. It also shows how enforcement mechanisms, internal policies, and monitoring affect liability.

This article explores key takeaways from Cox v. Sony, analyses how intent and knowledge shape ISP liability, reviews Nigerian copyright provisions, and draws lessons from the U.S. experience to guide ISPs, practitioners, and policymakers navigating the intersection of technology and intellectual property law in Nigeria.

BRIEF SUMMARY OF THE COX V. SONY CASE

The legal battle began when Sony and other major record labels sued Cox, a major ISP, in a U.S. Federal District Court. Sony alleged that Cox was both vicariously and contributorily liable for copyright infringement committed by its subscribers using its network. The jury returned a verdict that Cox was liable on both counts, awarding Sony $1 billion in statutory damages. On appeal, the Fourth Circuit reversed the vicarious liability finding. Still, it affirmed the contributory liability verdict, reasoning that providing a service with the knowledge that it will be used for infringement constitutes culpable conduct. Cox petitioned the Supreme Court, which granted certiorari specifically to address the standards for contributory liability.

THE SUPREME COURT OF THE UNITED STATES DECISION

In a landmark ruling on 25th March, 2026, the Supreme Court reversed the Fourth Circuit’s decision. Writing for the majority, Justice Thomas clarified that an ISP cannot be held contributorily liable merely for providing internet access to known infringers. The Court established that liability requires a showing of culpable intent, which can only be proven in two specific ways:

• • Inducement: The ISP must have actively encouraged or promoted the infringement through specific acts.
• • Tailored Service: The service provided must be especially adapted for infringement and lack substantial non-infringing uses.

The Court found that Cox did neither. It merely provided a general-purpose internet connection used for countless legal activities, and it even took steps such as sending warnings and suspending accounts

to discourage piracy. Crucially, the Court rejected the idea that the DMCA safe harbor creates an implied liability for ISPs who fail to terminate repeat infringers; rather, the DMCA only provides additional defences.

SONIA SOTOMAYOR’S CONCURRENCE: CONCERNS OVER NARROW LIABILITY

While Justice Sotomayor concurred in the final judgment, she issued a separate opinion joined by Justice Jackson to express serious concerns about the majority’s inflexible approach.

• • The common-law concern: She argued that the majority unnecessarily limited secondary liability to only two theories (inducement and tailored products), effectively ignoring other common-law doctrines like aiding and abetting.
• • Overly narrow scope: She warned that this rigid focus curtails the ability of courts to hold intermediaries accountable for pervasive and systemic assistance to infringers.
• • Failure to prove Intent: She agreed Cox was not liable in this specific case, but only because Sony failed to prove the specific intent required for aiding and abetting, not because the theory itself was invalid.

INTENT AND KNOWLEDGE IN SHAPING ISP LIABILITY

The Cox v. Sony decision clarifies that mere knowledge of infringement alone does not establish liability. Rather, liability turns on culpable intent, specifically whether the ISP induced the infringement or provided a service tailored to facilitate infringing activity. However, the case also shows that knowledge combined with ineffective internal policies can trigger risk under DMCA safe harbor rules.

The DMCA further delineates the boundaries of liability through provisions on transitory communications and system caching, shielding ISPs in their passive role of transmitting content. These protections do not extend to user-directed content where the ISP is aware of infringing activity. The Act also makes clear that ISPs are not obligated to monitor their networks, reinforcing that liability arises upon awareness of infringement and a failure to respond without undue delay. ²

ISP LIABILITY UNDER THE NIGERIAN COPYRIGHT ACT (NCA)

Under the NCA, Nigeria has codified the liability of intermediaries, including ISPs, in the context of online copyright infringement. The Act sets out specific conditions which provide a conditional immunity framework, similar to safe-harbor provisions in other jurisdictions. A service provider is not liable for storing material at the direction of a user if it does not have actual knowledge of infringing activity or, upon obtaining knowledge, acts promptly to remove or disable access to the material. Section 58 of the NCA also requires that the provider does not directly profit from the infringing activity, exercises control over the content, and complies with procedures for suspending accounts of repeat infringers. ³

The NCA limits immunity to neutral, automated, and passive activities, and mandates the designation of an agent or address to receive infringement notices. Section 54 establishes a notice regime, obliging copyright owners to provide written notice and the provider to respond in a timely manner. Failure to act exposes the ISP to liability equivalent to that of the person placing the infringing content.

Nigeria adopts a broader, principle-based approach to intermediary liability. Unlike the DMCA, which specifies technical categories such as transitory communications, caching, and hosting, the NCA focuses on knowledge, control, financial benefit, and responsiveness to notices. This makes the Nigerian framework less granular but more flexible, allowing for greater judicial interpretation.

Both frameworks emphasise vigilance, structured internal procedures, and timely response over preventive monitoring. By adopting clear policies, maintaining records, and acting swiftly on notices, Nigerian ISPs can reduce liability risk while complying with the evolving statutory landscape.

To view the full article click here.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.