Automated Takedowns, Manual Headaches: When DMCA Bots Go Bad

Lately we've been receiving a number of warnings from Google about sites we operate:

Google has been notified that your site allegedly infringes upon the copyrights of others, and violates applicable copyright laws in your region.

It is Google's policy to remove copyrighted content when the copyright holder or their authorized representative alleges that a use is infringing. Therefore we are in the process of removing the reported content from Google Search results for users globally.

Not ideal. The complaint includes a list of image URLs and the complainant’s details. Since getting delisted from Google can hurt traffic, we have to treat these seriously, and investigate them quickly.

At Square1 we run a platform for publishers, and as part of this service we run an image hosting service. It happens from time to time that a journalist in one of the publishers accidentally publishes a photo they don't have copyright on, and should not have released, leading to a complaint from the rights holder.

The usual process is to check out the images, notify the publisher, and they either buy a licence or remove the content asap. The complaints take some time to look into, but copyright law is an important part of the commercial model of the web, so it's important to investigate, even aside from the Google de-listing problem.

What has changed in recent weeks is the volume of these complaints, and the type of images copyright is asserted over. In the past week alone, we've been told that stock photos of road signs, Dublin breweries, and concert press shots were stolen images republished without permission. Specifically, stolen from behind the paywall of creators on platforms like OnlyFans, Fansly, and Patreon. In full disclosure, I haven't subscribed to the OnlyFans accounts in question to verify it definitively (I don't fancy explaining that line on the company card expense report...), but I feel that it's a safe bet that nobody paying a subscription to these services is doing so to see pictures of road signs or Elon Musk testifying before Congress.

 

Each of the complaints contains a list of the offending images, a list of links to the rights holder's accounts on OnlyFans, Instagram, and any other platforms they use to build an audience. In the recent spike of cases, it's the same company complaining each time - a service called Takedowns[dot]ai. They market themselves as a service to help content creators deal with unauthorised leaks of paywalled content, with plans ranging from $199 - $499 a month.

What's a DMCA Takedown Notice?

Google offers a copyright removal tool under the DMCA (Digital Millennium Copyright Act). If you’re a creator and someone republishes your content without permission, you can file a notice asking for it to be taken down from search results. It’s an essential safety net, for both highlighting inadvertent violation, as well as dealing with more serious cases.

But the entire system assumes a degree of honesty. You’re meant to file in good faith, and with a legitimate claim to ownership of the original content. That's where these complaints start to fall apart. Companies like Takedowns ai and the like are using automated scanners, and filing based on these results, with seemingly no human review at any point in the submission. How can I tell? As well as flagging press photos, and street scenes, they've at least once flagged their own admin panel. That's the kind of thing you'd expect a person would spot!

And to be clear, the creators are right to be frustrated. Their work gets stolen. They don’t have time to trawl the internet looking for pirated copies. Outsourcing the dirty work makes sense. But unfortunately the automation of these complaints is causing a lot of time and effort to be wasted on nonsense complaints.

The Problem

In theory, automating takedown requests is a fine idea. As the number of sites online continues to grow rapidly, so does the number of potential copyright thefts. It's difficult to keep up with it all purely on a manual basis.

However, the problem is that these tools don't seem to work well in their current form. They're presumably scanning the paywalled content, then looking for approximate image matches. And sometimes there is a face match where you might squint, tilt your head a bit, and think "ok, maybe, I can just about see how they got that match."

But the majority of these requests are nonsensical. So much so, that trying to reverse-engineer what the image model saw would stretch the imagination of even the most porn-addled teenager on the planet.

Dispute process

Challenging these reports is time consuming. Google provides a form where we can file an appeal, and insist that the complainant doesn't have the rights which they claim.

This appeal goes into a queue somewhere in Google, and within a few days there is usually a short reply acknowledging that our delisted content has been restored.

But this is manual time and effort being spent by us, and Google, which neither of us should be wasting here. And we're not alone - other publishers are getting hit by the same spammy takedowns.

Bad Faith

To submit a DMCA takedown, you are supposed to sign a binding form confirming that you own the material in question (or are acting on behalf of those who do). The idea is that this should stop nuisance claims being made. But with the increased automation afforded by AI, the scale of these complaints being filed has ramped up, with no apparent consequences for the repeated erroneous filings. It's the same problem we've seen with email spam - a near-zero cost to the sender, and real time taken by the recipient to have to deal with it.

Takedowns.ai claims a 99.8% successful takedown rate on their site. I may be just extremely unlucky - every single interaction I have had has been one of these false matches, so perhaps I am the 0.2%. But given the type of images being flagged, I'd be hugely sceptical of those claims of effectiveness.

The takedown requests are shared by Google on the Lumen database. A quick search here will show how many of these notices are being filed. While a number of these complaints will highlight obviously-stolen images (sites like explicit-leaked-onlyfans-nudes dot biz and the like don't have a great defence here...), there are a significant number of mis-fires.

What Could Be Done?

If Google wanted to curb the nonsense without hurting legitimate creators, there are a few things they can try.

• A friction point: Rate limits on complaints. When you're found to have filed multiple bad requests, your ability to file new ones gets throttled - either a flat rate limit, or something like an exponential back-off. One false complaint? You can't file again for an hour. Two? Two hour delay. Three? Four hour delay, then 8, 16, and so on, before ultimately a hard block.

• Reputation tracking: If the same entity files hundreds of false claims, maybe they shouldn't be trusted at face value?

• The option to flag bad actors: Like you would for phishing or malware. If Google can deindex spammy results, surely it can deindex spammy claimants.

Any one of these steps would make a significant difference in the time and effort being wasted on these misfiring takedowns. Until then, we’ll keep spending time manually reviewing automated nonsense.