Anti-Circumvention Law: Section 1201, Exemptions, and Penalties

Anti-circumvention law in the United States lives in Section 1201 of the Digital Millennium Copyright Act, and it makes two things illegal: breaking a digital lock that protects a copyrighted work, and selling or distributing the tools designed to break those locks. It applies whether or not you ever copy or share the underlying work. Penalties start at $200 per violation in a civil suit and reach $1,000,000 in fines and ten years in prison for repeat criminal offenders. A set of permanent statutory exceptions and a rolling set of three-year exemptions carve out room for repair, accessibility, security research, and other legitimate uses.

What Section 1201 Prohibits

The statute creates three separate bans, and knowing which one applies to your situation matters more than any other detail in this area of law.

Circumventing an access control. You cannot bypass a technological measure that controls access to a copyrighted work, such as decrypting a file you aren’t authorized to view.¹
Trafficking in tools that defeat access controls. You cannot make, sell, import, or distribute technology primarily designed to break those locks.
Trafficking in tools that defeat copy controls. You cannot deal in technology primarily designed to defeat measures that protect a copyright owner’s rights, like the right to reproduce or distribute the work.

Notice what’s missing. There is no ban on the personal act of circumventing a copy control. If you defeat a copy-protection measure on a work you already have legitimate access to, Section 1201 does not reach that act itself. It would still reach whoever sold you the tool.

Access Controls Versus Copy Controls

The distinction between the two types of protection runs through the entire statute. An access control gates whether you can reach the work at all: streaming service encryption, a password wall on a digital library, the authentication check on a game server. A copy control (sometimes called a rights control) kicks in after you have access and protects a specific right of the copyright owner, like the digital rights management that prevents copying an e-book you can already read.¹

Both types of protection are covered by the anti-trafficking rules. Only access controls get the ban on the act of circumvention itself. Congress apparently reasoned that traditional copyright infringement law already covered unauthorized copying once someone had access, so a separate act-of-circumvention ban for copy controls would have been redundant.

When a Circumvention Tool Is Illegal

A tool, product, service, or component triggers the anti-trafficking provisions if it meets any one of three tests:

It is primarily designed or produced to defeat a technological protection measure.
It has only limited commercially significant purpose beyond circumvention.
It is marketed or advertised for use in defeating a protection measure.

One test is enough. A general-purpose program with incidental circumvention capabilities may survive the first two, but if the seller markets it as a way to strip DRM from e-books, the third catches it. A tool with no marketing at all can still fail if its only realistic use is defeating digital locks.

Does Fair Use Protect You?

Not from a Section 1201 claim, and this trips up more people than any other feature of the law. Section 1201(c)(1) preserves fair use and other defenses for copyright infringement claims, but circumvention of an access control is a separate violation from infringement.¹ Break the encryption on a DVD to pull a clip for a documentary, and fair use may defend you against a claim that using the clip infringed the copyright. It will not defend you against a claim that breaking the encryption violated Section 1201. Courts treat those as separate legal questions.

That gap is exactly what the triennial rulemaking process, discussed below, is meant to address.

Permanent Statutory Exemptions

Several exceptions are written directly into the statute and do not depend on any rulemaking. Each has specific conditions, and falling outside those conditions puts you back under the general prohibition.¹

Reverse engineering a lawfully obtained computer program to analyze the parts needed to make an independently created program interoperate with it.
Encryption research done in good faith, with a reasonable effort to get authorization first, that doesn’t facilitate infringement.
Security testing of a computer, system, or network with the authorization of its owner or operator.
Law enforcement, intelligence, and government information-security activities, including work by contractors.
Components that restrict minors’ access to internet material, even if they incidentally restrict access to copyrighted works.
Good-faith previewing by a nonprofit library, archive, or educational institution to decide whether to acquire a copy, provided an identical copy isn’t reasonably available elsewhere.

Triennial Rulemaking Exemptions

Every three years the Librarian of Congress, acting on recommendations from the Copyright Office, grants temporary exemptions to the ban on circumventing access controls. Petitioners have to show that the prohibition is likely to harm noninfringing uses of a specific class of works.² Each exemption lasts three years and has to be renewed each cycle.

The ninth cycle concluded in October 2024, and the current exemptions run through October 2027. They cover:³

Extracting short film clips for criticism, comment, parody, documentaries, noncommercial video, and nonfiction multimedia e-books.
Educational use of film clips by K-12, college, and university educators and students, including accredited nonprofit MOOCs.
Adding captions or audio descriptions to motion pictures for accessibility.
Bypassing e-book protections that interfere with screen readers or other assistive technology.
Diagnosing, repairing, or lawfully modifying software-locked motor vehicles, marine vessels, agricultural equipment, and various consumer devices.
Jailbreaking smartphones, tablets, smart TVs, voice assistant devices, and routers to run lawfully obtained applications.
Unlocking wireless devices to switch telecommunications networks.
Accessing data generated by medical devices or their personal monitoring systems.
Text and data mining of motion pictures and literary works for scholarly research and teaching.
Library, archive, and museum preservation and replacement copying of motion pictures.

An important boundary: these exemptions only protect the act of circumvention. They do not legalize making or selling the tools. You may have a legal right to jailbreak your own phone, while a company selling the jailbreaking tool could still face liability under the anti-trafficking provisions.

Civil Damages

Anyone injured by a Section 1201 violation can sue in federal district court for injunctions, impoundment of the devices involved, and either actual damages or statutory damages.⁴

Statutory damages run from $200 to $2,500 per violation. Each act of circumvention, each device, and each offer or performance of a service counts separately, so a defendant trafficking in thousands of devices can face damages calculated per device. A repeat violation within three years of a prior final judgment can be tripled. Courts can also order destruction or modification of infringing devices and can award attorney’s fees to the prevailing party.

The statute includes a safety valve. A defendant who proves they were not aware and had no reason to believe their conduct was a violation can persuade the court to reduce or eliminate damages.

Criminal Penalties

Criminal prosecution under Section 1204 is reserved for willful violations committed for commercial advantage or private financial gain, and only the Department of Justice can bring these cases. A first offense carries up to $500,000 in fines, up to five years in prison, or both. A subsequent offense doubles the ceiling to $1,000,000 and ten years.⁵

Both the “willful” and the “commercial advantage or private financial gain” elements have to be present. Personal curiosity with no profit motive does not expose you to prison under Section 1204, though a civil lawsuit remains possible.

Extra Protection for Nonprofits and Schools

Nonprofit libraries, archives, educational institutions, and public broadcasting entities get additional protection on top of the general exemptions. The criminal penalties in Section 1204 do not apply to them at all, regardless of the circumstances.⁵

On the civil side, the innocent-violator safety valve becomes mandatory for these organizations. If a qualifying nonprofit proves it was unaware and had no reason to believe its actions violated the law, the court must eliminate damages entirely, not merely consider reducing them.⁴

1
Office of the Law Revision Counsel. 17 USC 1201 – Circumvention of Copyright Protection Systems
2
U.S. Copyright Office. Rulemaking Proceedings Under Section 1201 of Title 17
3
Federal Register. Exemption to Prohibition on Circumvention of Copyright Protection Systems for Access Control Technologies
4
Office of the Law Revision Counsel. 17 USC 1203 – Civil Remedies
5
Office of the Law Revision Counsel. 17 USC 1204 – Criminal Offenses and Penalties