Skip to content
Blog

What a DMCA notice actually does — and what it does not

A notice is not a court order and the DMCA is not a global law. What "DMCA ignored" actually means, and what it does not excuse.

NimbusVPS engineering··9 min read·#legal#dmca#jurisdiction

Somewhere between a third and a half of the abuse mail we receive is a copyright notice sent to a server in a country where the sender's statute has no effect. Most of these are automated. A meaningful share are simply wrong — the wrong IP, the wrong customer, or a work the sender does not own.

None of that makes the senders villains. It makes the process worth understanding, because a great deal of confusion in the hosting market flows from three misconceptions.

Misconception one: a DMCA notice is a legal order

It is not. Section 512(c)(3) of the US Copyright Act specifies what a notice must contain, and the sender swears under penalty of perjury that they are authorised to act on behalf of the rights holder. They do not swear that the material is actually infringing, and no judge reviews the claim before it is sent.

A notice is therefore an assertion by an interested party. It carries a specific legal consequence for a US provider — act on it and you keep your safe harbour — but it is not an adjudication of anything.

The practical consequence: an ordinary US host receiving a notice about your content will remove it, immediately, without evaluating whether the claim is correct. That is not cowardice; it is exactly what the statute incentivises.

Misconception two: the DMCA is international

The Digital Millennium Copyright Act is a United States federal statute. It binds providers subject to US jurisdiction. It does not bind a company in Bucharest, and there is no international treaty that makes a US notice enforceable abroad on its own terms.

This is the whole substance of "DMCA ignored". It is not defiance. The notice itself simply compels nothing outside the United States — which is a narrower statement than it sounds, and the next section is about the part it leaves out.

One caveat before you file that away, and it is the reason our own DMCA-ignored list is 4 locations rather than 7. The Netherlands, Romania and Bulgaria are EU Member States, and since February 2024 the Digital Services Act has required every hosting provider in the Union to accept a complaint about a customer's server and deal with what it says: a properly substantiated one leaves the provider knowing it, and the liability shield goes with it. So "no mechanism at all" is true of a US notice as such, and not true of a site inside the Union — which is why we classify those 3 as reviewed rather than ignored, and why you should be suspicious of any provider that classifies an EU site the other way.

What does exist internationally is copyright law itself. Iceland, Moldova, Panama and Seychelles all have it, as does every other country we operate in. A rights holder who wants content removed there can go to court and obtain an order, and that order is honoured. The difference is that they have to actually litigate rather than send an email.

Misconception three: "DMCA ignored" means no rules

Every provider that has survived more than a couple of years in this market enforces an acceptable use policy, for a reason that has nothing to do with principle: transit providers disconnect networks that host criminal infrastructure. A host that tolerates malware command-and-control loses its upstreams, and every customer on that network — including the ones doing nothing wrong — loses their servers.

So when we say we do not act on copyright notices in 4 locations, and in the same breath say that CSAM, phishing, malware and denial-of-service attacks are removed on verification everywhere, those are not in tension. One is a statement about which legal instruments have force in which country. The other is a statement about what we are willing to have on our network.

What we actually do with a notice

In our DMCA-ignored locations: we log it, we forward it to the customer, and we take no action. The customer knows a claim was made and can respond if they want to. Nothing is removed and nothing is suspended.

In our 3 EU locations (the Netherlands, Romania and Bulgaria), where the Digital Services Act obliges us to take a complaint and deal with it: we weigh a substantiated one on its merits and give the customer a reasonable opportunity to respond before we do anything. We do not suspend on receipt, because receipt is not evidence.

In our United States location: full statutory procedure, including takedown and counter-notice. We say this plainly on the location page before anyone orders, because a customer who buys "offshore hosting" and lands in Kansas City has been sold the opposite of what they asked for.

The uncomfortable part

Some of the notices we decline to act on are almost certainly correct. Someone somewhere is hosting a film they do not own, and the studio's notice is accurate, and we forward it and do nothing.

We think that is the right outcome anyway, for a reason that has nothing to do with that particular file: a system where any party can cause content to disappear by asserting a claim, with no adjudication and no cost for being wrong, is a system that will be abused — and empirically is abused, at scale, against journalism, criticism and competitors.

Requiring a court is not a loophole. It is what due process looks like when it is inconvenient.

What this means for you

If you are choosing a jurisdiction, the practical question is not "will they ignore DMCA" but "what does it take to compel action here". In Iceland, Moldova, Panama and Seychelles the answer is a local court order. In the Netherlands, Romania and Bulgaria it is a complaint substantiated well enough that EU law stops letting us sit on it, after you have had a chance to respond. In the United States it is an email.

All three are legitimate answers. Only one of them is what most people mean when they say offshore. Details on the DMCA policy page.

Disagree with something here?

Email [email protected]. When we correct a published article, the correction is noted on the article itself rather than quietly edited in.

Or just deploy a server

Deploy in the next five minutes.

Pick a location, size the box, pay in crypto. No account signup wall, no ID, no waiting on a human.

7-day money-back guarantee · No KYC · Cancel any time from the panel