Skip to main content
Encypher Logo

Legal implications of cryptographic watermarking

A signed watermarkWatermark: A mark placed in the content itself, visible or hidden, so it can be found again after the file is copied. carries your rights terms in copies that keep the mark and shows when you signed. With a formal noticeFormal notice: Documentation that tells a user a work is protected and which terms apply, which matters for willfulness., it makes "we did not know it was yours" hard to claim. It is evidence for your counsel, not a verdict.

Start freeTalk to us

This page explains ideas. It is not legal advice. Your counsel decides.

Content marked with rights terms, then a formal notice, then a crawler using the content after notice. Past a dashed line, a small gray gavel labelled For counsel and courts shows that outcomes are for courts, not the mark.
A marked work, a formal notice, then use after notice. What follows is for counsel and courts.

Who it applies to

US, works registered in time
Statutory damagesStatutory damages: Damages set by law per infringed work, under 17 U.S.C. 504(c), with no need to prove actual loss. run from $750 to $30,000 per work. Up to $150,000 if the use was willful. As low as $200 if it was innocent. Generally, register before infringement begins; for infringement beginning after first publication, registration within three months of first publication preserves eligibility. (17 U.S.C. 412.) Counsel assesses statutory exceptions.
US, any work
Terms carried in a work can be copyright management informationCopyright management information: The author, title and terms attached to a work. Knowingly removing it can violate 17 U.S.C. 1202.. Knowingly stripping it can raise a separate claim.
EU, AI model makers
General-purpose model providers must honor rights reservations, including ones machines can read.
Unregistered or outside the US
Statutory damages need registration. Actual damages do not, and EU copyright needs no registration.

Before you rely on it

  1. Register key works
    In the US, statutory damages need registration.
    You and counsel
  2. Sign at publication
    The record dates from the moment you sign, in your CMS or through the APIAPI: Application programming interface: a way for one program to ask another to do a job, such as sign a file..
    Your CMS or the API
  3. Publish your terms
    Set your terms once. Each signed piece links to them.
    You
  4. Send formal notice
    When you find a use, the notice is yours to send.
    You and counsel

What a signed record shows, and what it does not

Four of the five answers a provenance check can give: Verified, Modified after signing, Issuer not recognized, and No provenance found. The fifth is Could not verify.
A check reports who signed and whether the content changed. It never says whether the content is true.
Shows
Who signed, when, which terms came with the work, and whether it changed since.
Does not show
That the signer owns the work, that anyone read the terms, or that a use was unlawful.

Why notice matters

In US law, damages can depend on what the user knew. A court can raise them for willful infringementWillful infringement: Copyright infringement done knowingly. US law allows up to $150,000 in statutory damages per work. and lower them for innocent infringementInnocent infringement: Copyright infringement where the user had no reason to know the work was protected. Damages can drop to $200 per work..

US statutory damages per work, for works registered in time, 17 U.S.C. 504(c) and 412
  • Innocent, lowest$200
  • Ordinary, highest$30,000
  • Willful, highest$150,000

Source: 17 U.S.C. 504(c) and 412. Generally, register before infringement begins; for infringement beginning after first publication, registration within three months of first publication preserves eligibility. Counsel assesses statutory exceptions. The court sets the amount.

A mark puts your terms in copies that keep it. Stripping, retyping and rewriting remove it. A formal notice tells a user that their copies carry it. After that, "we did not know" is a harder claim. Encypher never sends a notice for you.

Machine-readable terms in the EU

Article 53(1)(c) of the EU AI ActEU AI Act: The European Union's law on artificial intelligence, which includes rules for marking AI-made content. tells general-purpose model makers to follow EU copyright law. That includes rights reservations made in a form machines can read. Signed terms in the content are one such form.

How a signature can be challenged

A checker trusts a signature when the signer's certificate was issued by a certificate authority on the C2PA Trust List, and trusts the timestamp when it comes from an authority on the C2PA TSA Trust List. The Conforming Products List shows the signing tool was tested.
Trust is about who signed and when. It does not make the content true.

The other side can attack a digital signatureDigital signature: Math that shows which key signed something and that it has not changed since. Any edit to the signed bytes breaks it. by arguing the key was stolen, the certificate is not trusted, or the timestamp is wrong. Those are narrow, technical claims. E-signature laws such as ESIGN and eIDAS accept signed records in general. How a court weighs one is for the court.

Questions

What is the difference between innocent and willful infringement?
Under 17 U.S.C. 504(c), statutory damages for an eligible work run from $750 to $30,000. Under 17 U.S.C. 412, register before infringement begins; for infringement beginning after first publication, registration within three months of first publication preserves eligibility. A court may raise damages to $150,000 if the infringement was willful. It may lower them to $200 if the infringer did not know and had no reason to know. Counsel decides how this applies.
Does a watermark prove that someone infringed?
No. A signed record shows who signed, when, what terms came with the work, and whether it changed. It does not show ownership, that anyone read the terms, or that a use was unlawful.
Can a cryptographic signature be challenged?
Yes, on narrow grounds: a stolen key, an untrusted certificate or a wrong timestamp. The math itself is hard to attack. Whether a court admits the record, and how much weight it gets, is up to the court.
Does Encypher send notices for me?
No. Sending a formal notice is the rights holder's choice. Encypher gives you the signed record and a public check anyone can repeat.

Sources

  1. 17 U.S.C. 504
  2. 17 U.S.C. 412
  3. 17 U.S.C. 1202
  4. EU AI Act, Article 53
  5. EU Directive 2019/790, Article 4
  6. ESIGN Act
  7. eIDAS

For engineers

Show the technical detail

The signed C2PA manifestC2PA manifest: The signed label itself: a small package inside a file that records who signed it, what they declared and how to check it. records the signer's certificate, a trusted timestamp, a hash of the content and a link to the rights policy. Encypher publishes that policy in W3C ODRL at a stable address per document.

Anyone can repeat the check with open C2PA tools for files, or the public verify endpoint for text, without trusting Encypher's word for the result.

Keep reading

Create. Mark. Endure.

Sign your work free, so the record starts today.

Start freeTalk to us