Stage 8: User content

The short answer

If people can post, upload or share anything in your app, you host user content, and a few rules decide whether you are liable for it. In the US, register a DMCA agent with the Copyright Office for $6, renew it every three years, and act fast on copyright notices. If users can post images or video, run a process that removes non-consensual intimate images within 48 hours of a valid request. If you have EU users, give them a contact point, clear rules and a way to report illegal content.

Why this matters

This stage only applies if users can put content into your app that other people see, or that you store for them. If that is you, these are the numbers.

• Copyright damages are counted per work. Under US copyright law, a court can award statutory damages, which are set amounts that do not need proof of actual loss. They run from $750 to $30,000 per work, up to $150,000 per work if the infringement was willful, and as low as $200 per work if the infringer proves it was innocent (17 U.S.C. 504). A user who uploads 20 photos they do not own is 20 works.
• The shield costs $6 and lapses after three years. The DMCA safe harbor protects a host from those damages for user uploads, but only if the host has a designated agent on file with the Copyright Office. The fee is $6 (Copyright Office fees). The designation expires three years after you register it unless you renew it, and the Copyright Office warns that providers "risk losing the safe harbor protections of section 512" (Copyright Office FAQ, 37 CFR 201.38).
• Section 230 does not cover copyright. The law most people think protects platforms has an exception for intellectual property law (47 U.S.C. 230). For copyright, the DMCA process is your protection.
• A 48-hour removal duty is now enforced. The TAKE IT DOWN Act was signed on 2025-05-19. Platforms had one year to set up a removal process, so the duty applies from 2026-05-19. On a valid request, a covered platform must remove a non-consensual intimate image "as soon as possible, but not later than 48 hours" (Public Law 119-12). The FTC enforces it and has opened a complaint site (TakeItDown.ftc.gov).
• The EU rules for hosts have applied since 2024. The EU Digital Services Act applies from 2024-02-17 and gives every host basic duties, whatever its size (DSA Article 93, unofficial mirror).

Core concepts

Do you host user content?

User-generated content (UGC) is anything your users create and put into your app: posts, comments, reviews, profile photos, uploaded files, shared links, chat messages others can see. You host it when it sits on your servers or storage and your app shows it or keeps it for them.

Worked example. Here is a case from my own app. When I checked Ducktate, I found no public sharing and no hosting of user content for other people to see, and the terms have no DMCA clause. So this stage does not apply to Ducktate today. I wrote it down as a watch item: if I add a hosted vault or a web app that shows content, I come back here before that ships. Do the same: write down your answer, and the feature that would change it.

The DMCA safe harbor and your designated agent

The DMCA is the Digital Millennium Copyright Act. Its section 512 gives hosts a safe harbor: protection from copyright damages for content users store on your service, if you meet its conditions (17 U.S.C. 512). The main conditions for user uploads, in plain words:

1. You have a designated agent, a named person or role that receives copyright complaints. The agent's details are on your website and on file with the Copyright Office.
2. You do not know the content infringes, and it is not obvious from the facts. If you find out, you act fast to remove it.
3. You do not get a financial benefit directly from the infringing activity when you have the right and ability to control it.
4. When you get a proper notice, you remove or block the content quickly.
5. You adopt a policy to end the accounts of repeat infringers, tell users about it, and actually carry it out.

How to register. Go to the Copyright Office's DMCA Designated Agent Directory. Registration is online only. You pay $6 for a new designation, and $6 again to amend or resubmit it. There is no separate renewal fee: an amendment or resubmission renews it and starts a new three-year period (Copyright Office fees, 37 CFR 201.3). Then put the same agent contact details on your website, usually on a "Copyright" or "DMCA" page linked from your terms.

Worked example. You launch a photo-sharing app on 2026-11-01 and register your agent the same day. Put two dates in your calendar: one in September 2029, to amend or resubmit, and the expiry date on 2029-11-01. If you forget, the designation lapses and you risk losing the safe harbor. Now say a user uploads 10 photos from a professional photographer without permission, and you have no current agent. If a court finds you liable, the usual statutory minimum is 10 x $750 = $7,500 (it can fall to $200 a work if the infringer proves it was innocent), and the willful maximum is 10 x $150,000 = $1,500,000. A $6 form is cheap next to that.

A takedown procedure is the steps you follow when a notice arrives: confirm receipt, remove or block the content, tell the user who posted it, and log what you did. Write it down before launch, so you do not invent it under pressure.

Section 230 and what it does not cover

Section 230 is a US law, 47 U.S.C. 230. Its core sentence says that no provider or user of an interactive computer service is treated as the publisher or speaker of content provided by someone else. A second part protects good-faith moderation: you are not liable for voluntarily removing objectionable material (47 U.S.C. 230).

In plain words: if a user posts a false claim about someone, Section 230 generally means the user is the speaker, not you. And when you remove objectionable posts in good faith, that removal does not make you liable.

The exceptions matter as much as the rule. Section 230 does not apply to:

I did not research court cases on Section 230, or the reform bills of 2025 and 2026, so this is the text of the law, not how courts apply it in every case.

The TAKE IT DOWN Act: the 48-hour clock

The TAKE IT DOWN Act is a 2025 US federal law (Public Law 119-12) about non-consensual intimate images: intimate photos or videos of a person shared without their consent. It also makes publishing them a federal crime, including AI-made fakes, which the law calls "digital forgeries" (Public Law 119-12).

It applies to a covered platform: a public website, online service or app that primarily provides a forum for user-generated content, or that regularly publishes or hosts non-consensual intimate images. A covered platform must:

1. Have a notice-and-removal process. The deadline to set it up was 2026-05-19.
2. Post a clear, plain-language notice on the platform that explains how to use it.
3. On a valid request, remove the image as soon as possible and no later than 48 hours, and make reasonable efforts to remove known identical copies.

A valid request has a signature, information to find the image, a good-faith statement that it was shared without consent, and contact details. Removals made in good faith carry liability protection.

The FTC enforces the Act. Failing to reasonably comply is treated as a violation of an FTC rule, which can bring civil penalties. The FTC's business guidance from May 2026 recommends a request path that people without an account can use, tracking numbers for each request, and hash matching, which means comparing a digital fingerprint of the image against lists from services such as NCMEC's Take It Down and StopNCII.org (FTC business guidance). That guidance also gives a penalty amount per violation; I read that figure through a summary tool, not on the page, so check it there.

Worked example. A request arrives on Friday at 6 pm through your web form. Your process sends you an alert, gives the request a tracking number, and replies to confirm receipt. You check it has the four parts of a valid request. It does, so you remove the image and search for identical copies by hash. You are done by Saturday noon, well inside 48 hours. If your only plan was "check the support inbox on Monday", you would have missed the deadline. Solo founders need an alert that reaches a phone.

The EU Digital Services Act for small hosts

The Digital Services Act (DSA) is the EU law for online intermediaries, including hosts. It has applied since 2024-02-17. I read it on an unofficial mirror site, because the official EU site did not load for my research. The European Commission says "Micro and small companies have lighter requirements based on their size" (European Commission). Lighter does not mean none. Every host has these duties:

The Article 16 form must let people give reasons, the exact location such as a URL, a good-faith statement, and their name and email. You confirm receipt, then tell the person your decision and how to challenge it. A proper notice counts as actual knowledge of the content, so after it arrives you cannot say you did not know.

Micro and small companies are exempt from the yearly transparency report in Article 15(1), and from the extra rules for online platforms in Article 19, but not from the duties in the table (Article 15, Article 19). I did not confirm the size limits for micro and small companies, or the DSA fine amounts, so I do not give them here.

Worked example. One report form can serve three laws. Build a single "Report content" form that asks for the URL, the reason (copyright, intimate image shared without consent, other illegal content), a good-faith statement, a name and an email, and that works without an account. Route intimate-image reports to your phone alert. Confirm every report by email with a tracking number.

Key terms

The checklist

• Write down whether your app hosts user content, and which future feature would change that answer.Must doSource: 17 U.S.C. 512, TAKE IT DOWN Act text
• If users can upload or post, register a DMCA designated agent online with the Copyright Office for $6.If it appliesSource: DMCA Designated Agent Directory, Copyright Office fees
• Put the same agent contact details on a copyright page on your website, linked from your terms.If it appliesSource: 17 U.S.C. 512, Copyright Office FAQ
• Add calendar reminders to renew the agent designation before it expires three years after you register it.If it appliesSource: 37 CFR 201.38, Copyright Office FAQ
• Write a takedown procedure and a repeat infringer policy, tell users about the policy in your terms, and follow both.If it appliesSource: 17 U.S.C. 512
• Do not rely on Section 230 for copyright claims; use the DMCA process for those.If it appliesSource: 47 U.S.C. 230
• If users can post images or video others see, build a removal process for non-consensual intimate images that meets the 48-hour limit.If it appliesSource: TAKE IT DOWN Act text, FTC business guidance
• Post a plain-language notice that explains how to request removal, and make the request form work for people without an account.If it appliesSource: TAKE IT DOWN Act text, FTC business guidance
• Give every removal request a tracking number and an alert that reaches you on weekends.If it appliesSource: FTC business guidance, TakeItDown.ftc.gov
• If you have EU users, publish one electronic point of contact and terms that explain your content rules and moderation.If it appliesSource: DSA Article 12 (mirror), DSA Article 14 (mirror)
• If you host content for EU users, add an electronic notice-and-action form that confirms receipt and tells the reporter your decision.If it appliesSource: DSA Article 16 (mirror)
• If you have no EU base but offer your service in the EU, appoint a legal representative in an EU country.If it appliesSource: DSA Article 13 (mirror), European Commission DSA page

The prompt for your agent

Copy this into Claude Code, Codex or Cursor from the root of your project. The first check decides whether the rest apply.

Audit this project for Stage 8 of a launch checklist: user-generated content.
Do not change any code, terms, or pages until I approve a plan.

For each item below, report PASS, FAIL, UNKNOWN, or NOT APPLICABLE, with the file
and line that proves it. If you cannot prove an item from the code, report
UNKNOWN. Never report PASS without evidence.

1. List every way a user can put content into the app: posts, comments, reviews,
   profile photos, file uploads, shared links, public pages, messages that others
   see. For each, say where it is stored and who can see it. If there are none,
   say so with evidence and mark items 2 to 9 NOT APPLICABLE.
2. Is there a copyright or DMCA page with a designated agent's name and contact
   details, linked from the terms?
3. Do the terms describe a repeat infringer policy? Is there code or an admin
   tool that can suspend or end an account?
4. Is there an admin path to remove or hide one piece of content quickly, and is
   each removal logged with a date and reason?
5. Can users upload images or video that others can see? If yes, is there a
   report path for intimate images shared without consent, and does it work
   without signing in?
6. Does each removal request get a tracking number, a receipt to the requester,
   and an alert to the owner that would reach them within hours?
7. Is there a plain-language notice in the app or site that explains how to
   request removal?
8. Is there a "report content" form that asks for the URL, the reason, a
   good-faith statement, a name, and an email, and that confirms receipt?
9. Do the terms explain content rules and moderation, and name one contact point
   for users?

End with a table: item, status, evidence (file and line), and the smallest fix you
suggest. Then stop and wait for my approval.

The agent cannot check the Copyright Office directory for you. Search it yourself for your company name and check the expiry date.

Common mistakes

• Skipping the DMCA agent because "Section 230 protects me". Section 230 does not cover copyright claims.
• Registering the agent once and forgetting it. The designation lapses after three years unless you renew it.
• Listing an agent with the Copyright Office but not on your own site. The law asks for both.
• Routing intimate-image reports to a shared inbox that nobody checks on weekends, against a 48-hour limit.
• Requiring an account to report abuse. The person in the image is often not your user.
• Assuming the EU rules do not reach a tiny US app. Small hosts get lighter duties, not zero duties.

Check yourself

Resources

• Copyright Office: DMCA Designated Agent DirectoryToolPaid

  Where you register, renew and search agents; each filing costs $6.

• Copyright Office: online service provider FAQGuidanceFree

  Plain answers on registration, expiry and renewal.

• 17 U.S.C. 512LawFree

  The safe harbor conditions, including the repeat infringer policy.

• 17 U.S.C. 504LawFree

  Statutory damages for copyright infringement.

• 37 CFR 201.38LawFree

  The rule that a designation expires after three years.

• 47 U.S.C. 230LawFree

  The platform shield and its exceptions, in the law's own words.

• TAKE IT DOWN Act, Public Law 119-12LawFree

  The 48-hour removal duty and what a valid request contains.

• FTC: TAKE IT DOWN Act business guidanceGuidanceFree

  How the FTC expects platforms to run requests, with hash-matching tips.

• European Commission: the Digital Services ActGuidanceFree

  The official overview, including lighter rules for small companies.

• DSA Article 16 (unofficial mirror)LawFree

  What the EU notice-and-action form must do.

Next stage

Your users' content now has a process. Stage 9 moves to money: how a subscription must be shown before the charge, how easy cancelling has to be, and where the federal click-to-cancel rule stands after a court threw it out.