The music publishers sued Anthropic over its data pipeline, not its model

Key Takeaways

• Sony Music Publishing, Warner Chappell and a group of other publishers filed Case 5:26-cv-09217 in the Northern District of California on August 28, 2026, naming Anthropic plus co founders Dario Amodei and Benjamin Mann personally.

• The headline is the money. The interesting part is Count IV, which claims that running a boilerplate stripper over scraped HTML removes copyright management information under 17 U.S.C. § 1202.

• That theory reaches every retrieval pipeline, not just frontier labs. If you scrape a page and drop the footer before chunking, you have done the thing the complaint describes.

• The complaint's central technical allegation misreads the paper it cites. The Pile's authors say they evaluated DragNet and picked jusText instead.

• Anthropic's own commercial terms indemnify customers for training data claims, then carve out your inputs and anything you combine with the model. Your corpus is not covered.

• Statutory damages on the same work count span roughly $4M to $3.0B depending on one finding: willfulness.

Two music publishers sued Anthropic on Friday. Every outlet covering it led with the damages, which is fair, because the damages are enormous. I read the filing instead, and the paragraph that stopped me had nothing to do with money.

It was paragraph 96. It names a Python library.

The complaint alleges that Anthropic ran text extraction tools over scraped web pages to separate article bodies from footers and copyright notices, and that doing so is a violation of the Digital Millennium Copyright Act. Not the training. Not the output. The cleanup step. I've built ingestion pipelines that do exactly that, and so has every team I know that has shipped retrieval augmented generation to production.

So this is worth reading closely, because AI training data provenance just stopped being a compliance checkbox and became a named cause of action.

Anthropic's public positioning. The complaint spends fourteen pages arguing that the safety framing and the data sourcing do not match.

What did Sony Music and Warner Chappell actually file?

They filed a 48 page complaint in the Northern District of California, San Jose Division, on August 28, 2026, docketed as Case 5:26-cv-09217. The defendants are Anthropic PBC, Dario Amodei and Benjamin Mann. Amodei and Mann are named individually, not just as officers, which is the unusual part.

The opening line sets the register: the publishers say they are bringing the action "to hold accountable the culprits behind one of the largest and most blatant ongoing thefts of intellectual property in history."

An Anthropic spokesperson told TechCrunch: "We disagree with the publishers' claims and we intend to defend ourselves robustly in court."

There are four counts, and they are not variations on a theme. They attack different stages of the pipeline.

Count III enumerates seven separate acts, lettered (a) through (g). Three of them happen before a model exists: scraping lyrics from the websites of authorized licensees, downloading from third party datasets, and "destructively scanning" second hand physical books. The other four are training and generation.

That split matters more than it looks, and I'll come back to it. Counts I, II and IV are AI training data provenance questions. Only part of Count III is about the model.

Why does Count IV matter more than the headline damages?

Because Count IV is the only one that describes something a two person startup does on a Tuesday. Torrenting seven million books from a pirate library is not a thing most engineering teams accidentally do. Stripping a page footer before you embed the text absolutely is.

Here is the allegation, from paragraph 181:

Anthropic intentionally removed and altered CMI in the process of training Anthropic's AI models, including by copying Music Publishers' lyrics from websites containing those lyrics, including the websites of Music Publishers' licensees, and by applying algorithms known to remove copyright notices and other CMI from that copied text.

Sit with that phrase for a second: "applying algorithms known to remove copyright notices and other CMI from that copied text". That is a description of boilerplate removal. It is what trafilatura, readability, jusText and every commercial scraping API exist to do. The whole point of those libraries is to throw away navigation, ads, cookie banners and footers so that what remains is the article.

Page 43 of 48. Count IV is pleaded against Anthropic alone, separately from the three infringement counts.

The publishers also went after the obvious defense in advance. Paragraph 124 says Anthropic added guardrails restricting Claude from reproducing copyrighted text, then argues those guardrails "are easily circumventable by simply 're-prompting' Claude for specific content."

Whether or not that's true, it's the right structural point. An output filter sits at the end of the pipeline. Counts I, II and IV all fire well before the model ever generates a token, and no amount of refusal training reaches backwards to fix how the corpus was assembled. This is the same lesson that showed up in the OpenAI and Hugging Face incident report: controls placed after the fact do not retroactively clean what came before them.

Is stripping boilerplate really "removing copyright management information"?

Legally, it is harder than the complaint makes it sound, and the statute is where you can see why. Section 1202(b)(1) bars anyone from "intentionally remov[ing] or alter[ing] any copyright management information." Section 1202(b)(3) covers distributing works knowing CMI was removed. Both require a second layer of intent on top of that.

The trailing clause is the load bearing one. A defendant must act "knowing, or, with respect to civil remedies under section 1203, having reasonable grounds to know, that it will induce, enable, facilitate, or conceal an infringement of any right under this title."

Section 1202(c)(1) defines CMI to include "the title and other information identifying the work". A song title in a page header qualifies.

So the publishers have to show two things. First, that removal was intentional rather than a side effect of wanting clean text. Second, that Anthropic knew or should have known it would conceal infringement. A defense arguing that footers were stripped because menus and cookie banners poison embeddings attacks the first element directly.

But look at what CMI covers. Subsection (c)(1) includes "the title and other information identifying the work, including the information set forth on a notice of copyright." On a lyrics page, the song title and the writer credit sit in the header. A body text extractor keeps the lyrics and drops the credit line. That is the fact pattern, stated plainly.

I tell clients the uncomfortable version: your extractor was tuned to keep the valuable text and discard the attribution, because attribution is not what you were embedding for.

Does the complaint's technical allegation hold up?

Partly. The complaint cites The Pile paper for the claim that its creators "disclosed their use of extraction tools, like Newspaper and Dragnet," and adds that "Dragnet's algorithms, in particular, separate main website content, such as lyrics, from footers, copyright notices, and other CMI." I pulled the paper it cites, arXiv 2101.00027, and read Appendix C.

The paper says something different about DragNet. In section C.1.2 the authors write that "In addition to jusText, we also considered Trafilatura, Newspaper, Goose3, and DragNet," and that they "chose jusText" for Common Crawl. DragNet appears on a list of extractors they evaluated and passed over. Newspaper was used, but for OpenWebText2, and the paper says the reason was "consistency with OpenWebTextCorpus."

The Pile paper, Appendix C.1. Boilerplate removal is discussed as a text quality problem, with menus and page footers as the named nuisance.

This is not a technicality I'm raising to be pedantic. Count IV's mechanism depends on which tool did what, and the complaint's own exhibit contradicts its characterization of the tool it singles out.

What the paper does support is the broader framing, and support it well. The authors describe Common Crawl's WET files as having "poor quality, often containing large amounts of boilerplate text like menus and page footers," and note that had they used trafilatura, "we would have required an additional intra-page filtering step to remove boilerplate from the page." Boilerplate removal is right there, discussed openly, as an engineering quality decision.

The paper is also candid in a way that will be quoted back at a lot of people. It states that "There are five datasets included in the Pile that were not collected and distributed in a ToS compliant fashion and for which the authors had no ability to consent to their data being used." One of those is a YouTube Subtitles set built from the human generated closed captions of 173,651 videos.

Read that against last month's piece on training data consent and opt out. The disclosure was public in 2020. Nobody had a cause of action attached to it until now.

Where do the two accounts of the Bartz settlement disagree?

TechCrunch and The Verge describe the same $1.5 billion event two different ways, and the difference is not cosmetic. TechCrunch writes that Anthropic "was ordered to pay $1.5 billion in the landmark Bartz case after a judge ruled" on the piracy question. The Verge writes that Anthropic "recently settled a suit brought by the publishing industry for $1.5 billion."

The complaint resolves it, and The Verge is closer. Citing Bartz v. Anthropic PBC, 791 F. Supp. 3d 1038 (N.D. Cal. 2025), the publishers say the court found Anthropic had torrented over seven million books, and that afterwards "Anthropic settled that copyright infringement class action for $1.5 billion." A liability ruling followed by a settlement. Not a damages judgment.

That distinction decides how much this new case is worth. A settlement binds the parties and sets no precedent on the number. The ruling underneath it did establish something, and the complaint quotes it: another court in the district described Anthropic's conduct as "straightforward piracy but at massive scale."

There's a second discrepancy, and this one is a work count. The Verge reports the suit seeks damages for "tens of thousands" of works. The complaint uses two different figures for two different exhibits. Exhibit A, tied to the torrenting counts, covers "hundreds or more" compositions. Exhibit B, tied to the scraping and training count, covers "the tens of thousands." Those attach to different counts against partly different defendants, so collapsing them into one number overstates the exposure on Counts I and II by roughly two orders of magnitude.

What does the damages arithmetic actually look like?

It looks like a range so wide that quoting the top of it tells you almost nothing. The publishers ask for up to $150,000 per work under section 504(c) and up to $25,000 per violation under section 1203(c)(3)(B). Both are ceilings that require findings the defendant will spend years contesting.

Here's the same Exhibit B work count run against every rung of the statute. I've used 20,000 works as a conservative reading of "tens of thousands", and the per work figures come straight from Title 17.

The spread between the willful ceiling and the innocent floor is 750 to 1. Same works, same defendant, same conduct. One word decides it.

Two more things compress that range in Anthropic's favour. Section 504(c)(1) says "all the parts of a compilation or derivative work constitute one work," which is exactly the argument to make about a catalogue. And section 1203(c)(5) lets a court reduce or remit CMI damages where the violator proves it had no reason to believe its acts violated the statute.

Set against that, the CMI claim has something the infringement claim lacks. Its statutory floor is $2,500, not $750, and there is no innocent tier that drops to $200. If Count IV survives, its floor is higher than the other counts' floor by more than three times.

Does your model provider's indemnity cover your pipeline?

Not the part you're worried about. Anthropic's Commercial Terms of Service, effective June 17, 2025, contain a genuinely broad indemnity in section K.1, and it explicitly reaches training data. Then section K.3 carves out the things you build.

K.1 covers "data Anthropic has used to train a model that is part of the Services". The exclusions in K.3 are where your own corpus falls out.

Read K.1 first, because it's better than most people assume. A "Customer Claim" means a third party claim alleging that "Customer's paid use of the Services (which includes data Anthropic has used to train a model that is part of the Services) in accordance with these Terms or Outputs generated through such authorized use violates any third-party intellectual property right." Anthropic's own training data is inside the indemnity. If a publisher ever came after a paying customer over Claude output, that clause is the answer.

Now K.3. Anthropic's obligation does not apply where the claim arises from "the combination of the Services or Outputs with technology or content not provided by Anthropic", from "Inputs or other data provided by Customer", or from use that the customer "knows or reasonably should know violates or infringes the rights of others."

Your retrieval corpus is content not provided by Anthropic. Your scraped context is an Input. Both exclusions land squarely on the architecture almost everyone is shipping.

In my experience this is the single most misread clause in AI procurement. Teams read "indemnified" and file it. The indemnity covers the vendor's data sins, which is the thing you have no visibility into and no ability to fix. It does not cover yours, which is the thing you control completely and mostly have not audited. If you're weighing providers on this, the comparison in OpenAI versus Claude for business agents covers the commercial terms side.

How do you fix AI training data provenance in your own pipeline?

Start by finding out what your extractor throws away, because most teams genuinely do not know. Everything else in AI training data provenance follows from that one audit.

I keep seeing the same five gaps, and none of them are expensive to close.

• Log the acquisition source for every document, not just the URL. Which crawler, which date, under what robots directive, against which terms of service. Counts I through III all turn on how content was obtained, and a pipeline that cannot answer that question cannot mount the defense.

• Preserve copyright notices and bylines into a metadata field instead of dropping them. You still exclude them from the embedding text. You just stop being unable to prove they existed.

• Treat licensed aggregators as off limits. The complaint's sharpest paragraph is about scraping MusixMatch and LyricFind, which are the publishers' own licensees. Scraping a licensee does not inherit the licence, it just adds a terms of service breach on top.

• Keep third party datasets out of anything commercial unless you can name their provenance. The Pile documents its own five non compliant datasets in the paper. That disclosure is now evidence.

• Separate what you can defend from what you cannot. Training on lawfully obtained material survived Bartz. How the material was obtained did not. Those are different questions and your architecture should keep them separate.

One caveat worth stating plainly. A complaint is an argument, not a finding. Every allegation here is contested, Anthropic has said it will defend the case, and paragraph 96 already shows the pleading overreaching on a checkable technical fact.

None of that changes the engineering exposure. The theory is now filed, the plaintiffs' firm has already won at this once, and the discovery requests that follow will ask other companies what their extractors delete. A client of mine spent two weeks last quarter reconstructing where a 40,000 document corpus came from, because nobody had logged it at ingest. That work costs almost nothing when you do it on the way in.

If you want a structured read on where your own data handling sits before someone else asks, the AI readiness assessment walks the same ground. The zero data retention breakdown and the multi agent failure modes piece cover the adjacent controls, and the agents I build ship with provenance logging on by default now, for exactly this reason.

Frequently asked questions

Does this lawsuit affect me if I only call the Claude API?

Directly, no. Anthropic's Commercial Terms section K.1 indemnifies paying customers against third party intellectual property claims arising from authorized use, and the definition explicitly includes data used to train the model. The exposure appears when you add your own retrieval corpus, which K.3 excludes.

Is removing a page footer before chunking actually illegal?

Unsettled, and the complaint is testing it. Section 1202(b) requires intentional removal plus knowledge that removal will induce, enable, facilitate or conceal infringement. A team that strips boilerplate for text quality reasons has a real argument on both elements, but nobody has litigated it to judgment on this fact pattern.

Why are Dario Amodei and Benjamin Mann named personally?

Count II pleads contributory infringement against them individually, alleging that Mann personally used BitTorrent in June 2021 and that Amodei directed and approved it. Personal naming raises settlement pressure and survives corporate restructuring. It is an aggressive move and it is not automatic that it survives a motion to dismiss.

Didn't Bartz already decide that training is fair use?

It decided that using lawfully acquired copyrighted works to train a model can be fair use, and that acquiring them through piracy is not. That's why the new complaint spends most of its length on acquisition and preprocessing rather than on training. The fair use holding does not reach how the corpus was assembled.

How much is this case realistically worth?

Anywhere from single digit millions to several billion, depending almost entirely on a willfulness finding. Running the statutory rungs against 20,000 works gives $4.0M at the innocent floor and $3,000.0M at the willful ceiling. Bartz settled for $1.5 billion after a liability ruling, which is the only real anchor anyone has.

Do output guardrails protect a model provider here?

Not against Counts I, II or IV. Those describe conduct that happens during acquisition and preprocessing, long before generation. The complaint at paragraph 124 argues the guardrails are circumventable anyway, but the structural point stands regardless of whether that specific claim holds up.

What is copyright management information in practice?

Section 1202(c) defines it to include the title and other identifying information about the work, the author's name, the copyright owner's name, and terms of use. On a typical content page that means the byline, the copyright line in the footer, and the title in the header. Those are precisely the elements a body text extractor is built to discard.

Should I stop using Common Crawl or The Pile?

For commercial work, know what you are taking before you take it. The Pile's own paper names five component datasets collected outside terms of service compliance, and that disclosure is now cited in a federal complaint. Using them is not itself unlawful, but you inherit whatever provenance problems they carry and you can no longer claim you did not know.

Sources: Complaint, Sony Music Publishing (US) LLC et al. v. Anthropic PBC, Dario Amodei, and Benjamin Mann, No. 5:26-cv-09217 (N.D. Cal. filed Aug. 28, 2026), 48 pp. Statutory text at 17 U.S.C. §§ 504(c), 1202, 1203 via copyright.gov chapter 5 and copyright.gov chapter 12. Extraction tooling and dataset compliance disclosures from Gao et al., The Pile, arXiv:2101.00027 (Dec. 31, 2020), Appendix C. Indemnification terms from Anthropic Commercial Terms of Service (eff. June 17, 2025), §§ K.1 and K.3. Reporting and Anthropic's statement from TechCrunch (Aug. 29, 2026) and The Verge (Aug. 29, 2026). Damages figures in the table are my own arithmetic on the statutory rates.