Doe v. GitHub, Microsoft, and OpenAI is a class action lawsuit filed in November 2022 by anonymous software developers against Microsoft, GitHub, and OpenAI. The lawsuit alleges that GitHub's artificial intelligence (AI) coding assistant Copilot was trained on publicly available source code hosted on GitHub, including code released under open source licenses, and that it could reproduce portions of such code without complying with the relevant license terms or keeping the required copyright management information. The plaintiffs allege that this conduct violated the Digital Millennium Copyright Act (DMCA). The original complaint also asserted claims for breach of contract, unfair competition, fraud, unjust enrichment, and violations of the California Consumer Privacy Act (CCPA). The lawsuit has been described by plaintiffs’ lawyers as the first class action to address the training and outputs of AI models.
The defendants argued that the plaintiffs had not established a concrete injury or identified legally cognizable rights that had been violated, that Copilot does not reproduce code verbatim, and that many of the plaintiffs' state law claims were preempted by the Copyright Act.
By June 2024, Judge Jon Tigar dismissed most of the plaintiffs' claims, allowing the breach of contract claims based on the alleged violations of open source license terms to proceed.
Background GitHub, acquired by Microsoft in 2018, is a version-control and code-hosting platform where developers upload and share code. Released on June 29, 2021, GitHub Copilot is an AI tool developed by GitHub and OpenAI designed to assist developers by providing autocompleted suggestions and generating code. The tool was trained on public code hosted on GitHub, including code distributed under open source licenses, which often require attribution or other conditions on the redistribution of derivative works.
Some programmers reported that GitHub Copilot could generate code suggestions that were nearly identical to code hosted on GitHub. GitHub has maintained that the use of copyrighted code to train Copilot is protected under the fair use doctrine, which permits the use of copyrighted works without authorization under certain circumstances.
Case On November 3, 2022, lawyer and open source programmer Matthew Butterick and the Saveri Law Firm filed a class action complaint in the United States District Court for the Northern District of California on behalf of anonymous software developers. The lawsuit concerns GitHub Copilot and OpenAI's Codex, whose technology is used in Copilot. The plaintiffs alleged that GitHub, Microsoft, and OpenAI trained the AI system underlying Copilot on publicly available source code released under open source licenses and that Copilot could reproduce licensed code without complying with the terms of those licenses. Rather than alleging direct copyright infringement under the Copyright Act, which would have required litigating whether the defendants' conduct constituted fair use, the complaint instead alleged violations of the DMCA, stating that Copilot could reproduce licensed code without the required copyright management information and that the defendants knowingly designed the system to disregard open source license requirements. The plaintiffs sought statutory damages of over $9 billion, calculated based on the estimated number of alleged violations.
The plaintiffs also alleged that the defendants engaged in unfair competition, committed fraud by misrepresenting how code hosted on GitHub would be used, breached GitHub's terms of service and privacy policy, and violated the CCPA by using protected personal information as training data, among other claims.
Proceedings In January 2023, lawyers for Microsoft, OpenAI, and GitHub filed a motion to dismiss, arguing that the plaintiffs lacked standing because they had not adequately alleged a concrete injury or identified cognizable rights that had been violated. The defendants also argued that GitHub's terms of service granted broad rights to use code hosted on the platform and challenged the plaintiffs' ability to proceed anonymously.
In May 2023, Judge Tigar allowed the plaintiffs' breach of contract claim and portions of their DMCA claims to proceed, rejecting the defendants' argument that the plaintiffs had failed to identify examples of their code being reproduced and finding that they had plausibly stated their claims at that stage of the litigation. The court dismissed the claims for declaratory relief and civil conspiracy with prejudice, as well as those concerning unfair competition, unjust enrichment, violations of the CCPA, and others, with leave to amend. Judge Tigar also permitted the plaintiffs to continue litigating under pseudonyms.
In June 2023, the plaintiffs filed an amended complaint focusing on Copilot's duplication detection filter, which is designed to filter out suggestions that match public code hosted on GitHub. The plaintiffs alleged that the feature was designed to introduce slight variations in suggested code to avoid reproducing exact copies. It further alleged that disabling the filter could result in Copilot generating identical code. The amended complaint also included examples from one of the anonymous plaintiffs that purportedly showed Copilot reproducing their code.
In November 2023, the defendants argued that the amended complaint failed to establish a basis for damages. Lawyers for GitHub and Microsoft also maintained that Copilot does not reproduce code verbatim and argued that the plaintiffs' state law claims were preempted by the Copyright Act. In response, the plaintiffs argued that their claims arose from violations of open source license terms rather than copyright law and were not preempted. When Judge Tigar asked whether the claims were based on a right to control the distribution of code, the plaintiffs stated that precedent shows that open source licenses can create distinct property rights.
In January 2024, the court held that several of the plaintiffs' state law claims, including negligence, intentional and negligent interference with prospective economic relations, and unjust enrichment, were preempted by the Copyright Act. The court also concluded that the plaintiffs had failed to plausibly allege that Copilot reproduced identical copies of protected code, a requirement for bringing a claim under the DMCA. Finally, the court dismissed the claims for damages brought by two of the plaintiffs for lack of standing, allowing the remaining three plaintiffs' damages claims to proceed.
In June 2024, Judge Tigar dismissed most of the remaining claims in the second amended complaint. The court dismissed the plaintiffs' DMCA claims with prejudice, concluding that the allegedly copied code was not sufficiently identical to the original works to support those claims. The court also dismissed the plaintiffs' requests for unjust enrichment and punitive damages but allowed the breach of contract claims based on alleged violations of open source licenses to proceed.
Reception According to Wired, reactions to GitHub Copilot have been divided, with some developers arguing that it unfairly monetizes open source software and others defending it as a fair use of copyrighted code. In June 2022, the Software Freedom Conservancy announced that it would cease using GitHub and encouraged other free and open source software projects to do the same. The organization cited Copilot as one of the reasons for its decision, claiming that the tool unfairly monetized free and open source software and criticizing Microsoft for declining to explain how license terms were addressed during Copilot's training.
References