Copyright and the DMCA

We are seeing continued exploitation of the DMCA notice-and-takedown system by third-party monitoring services—in some instances, through the use of AI-generated mass reporting methods. While DMCA abuse by third-party reporters may not be a new trend, it is notable that reporters are leveraging AI to submit reports en masse, almost certainly to maximize revenue. We support strong copyright protection for our users, in keeping with our principles to empower users and uphold their rights. We believe, however, that it is important to call out such abusive behaviour, especially since it consumes valuable Trust & Safety resources that would be better directed toward processing legitimate DMCA notices or other legitimate reports.

One such company, Enforcity, has submitted large volumes of AI‑generated DMCA notices targeting non-existent content on WordPress.com and WordPress VIP. In this reporting period, Trust & Safety processed a total of 838 inactionable reports from Enforcity alone. Enforcity and a handful of other third‑party reporters continue to file abusive notices despite repeated clarification that we do not host the material in question. We suspect this behaviour is largely driven by payment structures that reward the submission of reports regardless of their legitimacy.

EU Regulation and Defamation Claims

Our Trust & Safety team regularly receives notices from complainants citing the DSA and the GDPR that request the removal of content from our platforms. Notably, during this reporting period, both of these pieces of European legislation have been cited—by attorneys and private individuals—as a removal tool for content that is alleged to be defamatory. Online defamation is complex, often blurring the lines between a user’s opinion and factual information. We routinely push back against demands that undermine protections of free expression and, unless legally prohibited, notify users of complaints made against them. Regulatory tools like the DSA and GDPR can be used to pressure platforms to remove the highly contextual content that is often the subject of defamation claims. These laws have equipped users with greater rights to protect themselves, but they have also, albeit unintentionally, provided a means for certain individuals to attempt to curb free expression online.

Phishing Scam Alert

While we don’t typically include spam‑related data in our Transparency Report updates, transparency and user safety are key pillars of Trust & Safety’s work. We therefore want to draw attention to a significant rise in phishing scams—particularly email and subscriber‑based attempts to obtain the private information of our users by impersonating WordPress.com, through means such as fake email messages. In an unfortunate twist, advancements in AI mean that these attacks are becoming more sophisticated and harder to spot, including by our teams. Protecting users’ private information is a key pillar of Automattic’s Trust & Safety team, and so it is important that we remain vigilant to user reports and the increasingly novel scams carried out by bad actors.

We welcome you to take a look through the data. As always, let us know if you have comments, suggestions, or requests.

The full transparency report is available here.

Today, we updated Tumblr’s self-harm policy in the User Guidelines, specifically to revise the language used around suicide. In a sentence in our self-harm policy, we replaced the term “commit” with “attempt,” which follows the guidance from mental health experts and organizations regarding how we talk about suicide. While this may seem like a small change, the power of language and its potential for harm cannot be understated. As noted by the Suicide Prevention Alliance, “to commit” an act may imply that a crime has taken place, and while the act of suicide may have been considered as a criminal offense in the past, this is no longer generally the case.

We recognize that referring to suicide in this way is not only outdated, it can be harmful and stigmatizing particularly for survivors and/or family members who may have lost a loved one to suicide. We believe it’s important to show compassion and sensitivity to others, including those in the Tumblr community who have been impacted by suicide in some way. The World Health Organization (WHO) has stated that confronting and breaking down stigmas or taboos related to self-harm can play an important role in aiding suicide prevention worldwide—by raising awareness; facilitating open and healthy conversations; and helping to remove feelings of guilt or shame. This update is a small step, but one that we believe to be in the right direction toward positive change and growth. 

Our revised self-harm policy now reads as follows:

Promotion or Glorification of Self-Harm. Don’t post content that actively promotes or glorifies self-harm. This includes content that urges or encourages others to: cut or injure themselves; embrace anorexia, bulimia, or other eating disorders; or attempt suicide rather than, e.g., seeking counseling or treatment, or joining together in supportive conversation with those suffering or recovering from depression or other conditions. Dialogue about these behaviors is incredibly important and online communities can be extraordinarily helpful to people struggling with these difficult conditions. We aim for Tumblr to be a place that facilitates awareness, support and recovery, and we will remove only those posts or blogs that cross the line into active promotion or glorification of self-harm.

If you or someone you know is struggling with mental health, or if you just need someone to talk to, please consider reaching out to family and friends, and/or a counselor at one of the services listed on our Counseling and Prevention Resources page.

In our transparency report, we look through the lens of two pillars in particular: user rights and safety by design. 

User Rights: Supporting users’ control over their own data

Over the past year, we’ve seen more people exercising their right to access and delete their personal data; we view this as a win for user rights—specifically their ability to control their data. We believe in keeping these options accessible to users rather than hidden away. 

On the Tumblr side, we received 3,868 deletion requests and 7,699 access requests, up from 2,820 and 6,504 respectively during the last reporting period. Even with higher volumes, we’ve reduced the average response time for both types of requests, going from nearly 11 hours to under 6 hours, almost doubling our speed.

Meanwhile on the WordPress.com side, those same deletion and access requests remain comparatively few. We received only six access requests this period (up from three last period). Nonetheless, our response times here improved here as well. We went from 24 days to 19 days, on average. 

We’re well under the 30-day response time for GDPR requests, and we’re working on decreasing our response times even further. We don’t just look at these as compliance obligations; they offer autonomy to users. Whether a user wants to review the information we hold or remove it entirely, Automattic believes the process should be straightforward, timely, and predictable. As the number of requests increases, we’ve demonstrated that we can move faster without sacrificing care or accuracy for our users. 

Safety by Design: Giving users easier pathways to flag harmful content.

We’ve seen a significant increase in Digital Services Act-related reports, specifically on Illegal Content, both on Tumblr and WordPress.com. While WordPress.com shows only 88 reports, this is up from 71 during the last reporting period with Defamation and Intellectual Property reports making up the bulk, at 22 and 16 reports respectively.

But it is on the Tumblr side we see the most interesting numbers, where users have flagged 17% more reports than last period. Granted, these are not large absolute numbers—we had 105 reports in total—but we’ve found that our users are getting better at reporting content accurately. This period, the content they reported on Tumblr as Illegal Content was in violation in some way 76% of the time, up from 56%.

Hate Speech reports more than doubled—from 17 to 40 reports this period. Of these, 75% of reports were actionable as hate speech, 5% more were actionable under other violations, and an additional 5% were actionable via geoblocks (that is, not in violation globally). 

Users reported more Terrorism content, and while reports nearly doubled (from 9 reports last period to 16 reports this period), the instances of actual terrorism content was rare. Of these reports, 75% were suspended for other reasons (usually violent content); 25% were not actionable.

Our take is that our users are eager to report violations to us, but we need to do a better job of helping them understand what constitutes different types of violations. Clearly, more education is in order—and empowering users is another one of our five pillars. Stay tuned.

We welcome you to take a look through the data. As always, let us know if you have comments, suggestions, or requests.

The full transparency report is available here.

Automattic’s 23rd biannual transparency report is now available, covering the period from July through December 2024. This report dives into the intersection of tech and intellectual property, user privacy, government takedowns, content moderation, and much more.

The Challenge of Mass Takedown Spam: Balancing Protection & Open Platforms

At Automattic, we believe that the internet thrives when creators, businesses, and bloggers can share their work freely without fear of unnecessary content removals. One of the biggest challenges creators face online is the misuse of intellectual property claims. Overly aggressive and automated takedown notices disproportionately affect independent creators, bloggers, and small businesses—those who lack the resources to fight back. For this reason, Automattic isn’t just processing trademark takedown notices mechanically. We manually review each case to ensure we are actively defending fair use and preventing abuse of copyright mechanisms. Safeguarding free expression while protecting trademark holders is a difficult but important challenge—one that has become even more complex in recent months. 

During this reporting period, there has been a sharp rise in the use of trademark reports being used to report gambling spam sites. These reports are sent in large volumes with duplicate notices, often targeting the same material across many sites. We received 13,554 total trademark notices about gambling spam across 14,327 unique sites. When gambling spam numbers were excluded, the trademark reports totaled a mere 129 trademark notices. 

This volume places undue strain on platforms like Automattic, as these types of complainants flood our trademark queues with spammy or bad-faith claims. On top of this, within this reporting period, a total of 7,426 trademark notices were determined to be non-actionable. These figures highlight the sheer volume of non-actionable claims, and reinforce the importance of human review to identify these and push back where appropriate. We strive to balance the ability for content creators to create, while still responding swiftly to legitimate claims of trademark infringement. 

Evolving Challenges in Content Moderation

As trademark takedowns increase, we’re also noticing evolving trends in privacy-related requests. In the most recent period, data deletion requests increased by 21%, while data access requests decreased by 37%. We take these seriously, and have made improvements to our internal workflows, resulting in these requests being processed 61% faster than in the previous period. At the same time, user appeals have almost tripled, and copyright takedown reports increased by 193%, averaging 1,916 reports per month. These rising volumes place increasing pressure on platforms like ours, where human review remains essential for assessing reports and preventing abuse. As trends shift, we are committed to refining our processes to ensure that genuine user concerns receive the attention they deserve.

The internet is often legislated for big players, creating compliance challenges that disproportionately impact smaller companies. When bad actors flood reporting systems with spam or duplicate claims, it further strains resources, making fair and equitable enforcement even more difficult. As we navigate these challenges, it’s important for us to advocate for public policies that are fair, proportional, and transparent. We are a user-first platform, and will always fight to protect your rights against abusive claims.

__________________________________________________

We welcome you to take a look through the data. As always, let us know if you have comments, suggestions, or requests.

The full transparency report is available here.

We presented on the importance of earning and maintaining user trust through a value-based Trust & Safety framework. Automattic’s mission is to make the web a better place, and we believe that it is important to clearly identify and articulate your key principles, build processes and policies around those, and be prepared to stand up for them; all while being as transparent as possible. At Automattic these are more than just platitudes, and we have repeatedly demonstrated our willingness to fight back on behalf of our users and freedom of expression online.

Contributing to discussions and conferences like the Trust & Safety Summit UK and RightsCon, which we attended in February, is an important part in how we listen to and engage with different perspectives on the future of the internet.  In the coming months we will also be taking part in both TrustCon, which is being held in San Francisco in July, and the TSPA EMEA Summit, which is being held in Dublin in May. If you are attending and interested in democratizing publishing, please come and speak to us.

Photo courtesy of the Trust & Safety UK Summit.

This year, we gave a talk about our victory in the Turkish Constitutional Court, sharing the story of the pressures governments around the world place on platforms like ours to remove content, and what it looks like in practice to fight back. In that case, we fought back against a takedown order that attempted to censor criticism of the Turkish government, until the Turkish Constitutional Court unanimously concluded eight years later that both the user’s freedom of expression (as provided for under Article 26 of the Turkish Constitution) and their right to an effective remedy (as provided for under Article 40) had been violated.

As well as presenting, we listened and learned from other RightsCon participants. We attended many talks and workshops, and had meaningful discussions with other attendees from a wide range of backgrounds. From discussing emerging opportunities and challenges, such as those presented by the proliferation of AI technologies and increasing global regulation, we are proud to continue to stand up for the open web and represent Automattic at RightsCon.

The DSA at Automattic

The Digital Services Act (DSA) is a piece of European Union legislation that came into effect for smaller platforms in February 2024. The DSA emphasizes transparency, and seeks to inform users about how online platforms make content-related decisions. The DSA also regulates how platforms balance freedom of expression with the removal of harmful content. Its underlying principle of prioritizing transparency naturally aligns with our philosophy at Automattic, where we believe that accountability is key to democratizing publishing.

Given their distinct functions and separate user bases, our platforms—WordPress.com and Tumblr—are categorized differently under the DSA, and so have different responsibilities under this regulation. Along with the new reporting areas detailed below, our Trust and Safety teams now offer more comprehensive explanations to users whose sites or content have been removed. Both platforms are also required to track additional statistics on government takedown orders from EU member states. Additionally, Tumblr is now mandated to accept user appeals regarding the moderation decisions made by our Trust & Safety team.

New Reporting Areas

Some of the requirements legislated by the DSA were already being met (or exceeded) as a matter of policy here at Automattic. For instance, while the DSA requires an annual transparency report, we have issued ours twice yearly for more than a decade. Similarly, we have always published how many takedown orders and information requests are received from EU member state governments, statistics the DSA now mandates.

That said, there are some notable changes to highlight. Most significantly, we’re including two new categories: Illegal Content Notices (for both WordPress.com and Tumblr), and Appeals (for Tumblr only). In addition to those major additions, we’ve expanded a number of our existing categories. Takedown orders received from EU member state countries now include additional details, including the originating country and what type of content was at issue. You’ll also see reporting on median response times across several existing categories.

Challenges with New Types of Reports

These new pages are our first iteration of collecting this data. Please note that because the DSA came into effect on February 17, the information we are presenting was collected from February 17 onward. The period of January 1–February 16 is not reported in these new pages.

In collecting this new data, we realized that our on-site reporting flows needed improvements. The reporting forms on both platforms caused confusion for users, resulting in many invalid reports. For instance, of the 362 Illegal Content notices we received for Tumblr, only four were sufficiently precise, adequately substantiated, and reported content that we wouldn’t have removed due to a violation of our User Guidelines. Notably, 206 of these notices—more than half—were not from the EU, or were not reporting a law being broken. On WordPress.com, none of the reported sites were removed solely based on the Illegal Content reports.

To address these issues, we’ve made some changes on our reporting forms to help reporters submit complete and actionable notices. Tumblr’s Illegal Content Notice form now features a dropdown menu of violation reasons. This feature was not implemented during the current reporting period, and we are continuing to refine the list of violation reasons. However, because the dropdown has already proven helpful on Tumblr, we plan to add this to WordPress.com’s reporting form as well. 

Overall, we will continue iterating on this process while experimenting with what works best. We’re learning from our experiences and adapting our processes as we receive additional guidance from the EU regarding DSA requirements.

We welcome you to take a look through the data. And as always, let us know if you have comments, suggestions, or requests.

The full transparency report is available here.

For almost a decade now, we have received regular takedown demands from Turkey (officially known as the Republic of Türkiye). Often, the reported sites contain political speech that are critical of the Turkish government or other public figures.

In 2015 we received one such order, relating to a site that contained allegations of corruption leveled at President Erdoğan. The judgment was based on a supposed violation of the president’s personal rights under Article 9 of Turkish Law No. 5651 (a provision that has since been found to be unconstitutional). As a result, we had no choice but to block the site in the region, or risk all visitors from Turkey being prevented from accessing WordPress.com—and the hundreds of millions of sites that we host.

With the support of the blogger, we swiftly appealed the First Instance Court’s decision on the basis that such a restriction was an undue interference in freedom of expression. Unfortunately (but not surprisingly), this argument was rejected.

At Automattic, we firmly believe in the importance of freedom of expression—and we weren’t about to let this clear attempt at political censorship go by without a fight. Given the nature of the allegations involved, we decided to strike back, and petitioned the Turkish Constitutional Court. While the prospects of success seemed low, we were fully prepared to take the case all the way to the European Court of Human Rights in Strasbourg if necessary.

Eight years after we submitted our original appeal, we finally received word that the Constitutional Court had accepted our arguments, and unanimously concluded that both the user’s freedom of expression (as provided for under Article 26 of the Turkish Constitution) and their right to an effective remedy (as provided for under Article 40) had been violated. 

Do not underestimate the significance of this outcome. Victories of this kind in Turkey are rare, and prior to this case, we had spent almost $100,000 USD appealing 14 different takedown orders, without any success. Don’t just take our word for it, though. Here’s what Nik Williams—a policy and campaigns officer from Index on Censorship, a nonprofit that campaigns for and defends free expression—has to say about this case:

Free expression victories in Turkey are few and far between so this decision by the Constitutional Court should be celebrated. It offers a clear and robust refutation of Erdoğan’s erosion of free expression. International human rights standards are unequivocal—speaking out and challenging power is a central tenet of democracy. We hope it gives the Turkish authorities a chance to reevaluate their approach to free expression, both online and off, while also sending a powerful signal to everyone in Turkey who seeks to speak out in the public interest.

In the past, we’ve worked with the Electronic Frontier Foundation on our approach to combating censorship in the region. Jillian York, EFF’s director for international freedom of expression, also shares thoughts about this important case:

EFF is thrilled to hear that Automattic went up against the Turkish government on a takedown demand and won. It is vital that companies continue to challenge wrongful takedown orders such as the one cited in ‘Abdullah Kaya and Others with application number 2016/1430.’ We encourage platforms to implement the guidelines laid out in the Santa Clara Principles on Transparency and Accountability in Content Moderation.

While this case demonstrates that victories are possible, the length of the proceedings means that justice was not properly served, and we still face a long battle ahead for freedom of expression online—both in Turkey and beyond. Increasingly, we see the fragmentation of access to information as the result of national legislation and legal judgments concerning speech. At Automattic, our mission is to democratize publishing. We have always pushed back against government overreach and will continue to stand up for the fundamental rights of users. We call upon other platforms to do the same.

Since 2013, we have published bi-annual Transparency Reports providing the public with robust insights into the types of complaints, takedown demands, and information requests that Automattic receives across our products and services. Transparency is an essential pillar in our fight for a democratic internet, and we believe that this type of information belongs to the public. 

Each period, our team works to find new ways to define transparency through the data points we include and highlight in our report. We do this based on a handful of factors, including your feedback, different industry trends, or government regulations. 

Government Information Requests

This period, we noticed a decrease in government information requests for all of our services. On WordPress.com, we received 2 court orders—compared to last period’s 14—and 25 subpoenas, almost half the amount as last period. Our compliance with these requests also dropped considerably, from 90% to 72%. 

Last reporting period, Tumblr experienced an uncanny increase in legal requests for user information, doubling those of the July 1, 2022 – December 31, 2022 period. We learned that this wasn’t a trend, and from July 1, 2023 – December 31, 2023 our numbers reverted to a more expected amount of 97 information requests. Our team complied with 83% of these, a statistic which remained consistent from the previous period. 

Intellectual Property 

There was a significant increase in trademark infringement complaints in this reporting period compared to the last. The team evaluated over 1,400 reports across our platforms, up from 872 cases during the previous period. Most of these complaints were sent to us by third-party companies hired by trademark holders to monitor their registered marks and go after potential infringement. Despite this considerable increase, only 5% of reports resulted in the removal of content due to receipt of a valid complaint. This staggeringly low metric showcases the poor quality and high volume of frivolous infringement complaints submitted by monitoring companies, only detected through our consequential practice of manually reviewing every takedown notice.

Similarly, we also experienced an influx of abusive copyright infringement complaints by third-party reporters. Just one complainant, OpSec Online LLC, made up 10% of all WordPress.com’s 2,984 DMCA (Digital Millennium Copyright Act) takedown notices received during this period. OpSec Online, a copyright monitoring service similar to one we recently featured in our Hall of Shame, filed almost 300 complaints—with only half of them targeting content that was actually hosted on WordPress.com. 

A growing number of third-party monitoring services inundate hosting providers with incomplete notices aimed at non-violative content, or content not even hosted on that platform. We’ve written about the harm caused by automated monitoring services in the past. It’s disappointing to see, as our reported metrics routinely demonstrate, that these abuses of the DMCA and Trademark Law have only escalated in recent years, proving to be increasingly challenging to evaluate.

As always, our transparency reporting is for you. If you have any comments or suggestions on making it more informative, please contact us and let us know.

Our latest entry into Automattic’s Hall of Shame tells the story of a Star Trek starship, an overambitious copyright monitoring company, one off-base DMCA (Digital Millennium Copyright Act) takedown notice, and an adult content creator whose pseudonym is an extraordinary double entendre.

Tumblr is a haven for fandoms, pop culture communities, artists, and enthusiasts—we are fiercely committed to protecting our users’ rights to free expression and organization. While we pride ourselves on being the home for a diverse group of fandoms, there’s a special place in our hearts for Star Trek and the fans it attracts. Whether you’re a Trekkie or occasionally throw up a Vulcan salute, Tumblr welcomes you home with every log in. 

One user in particular, mappinglasirena.tumblr.com, uses their blog to research and understand the lore of the La Sirena starship. Mapping La Sirena embarks on deep dives into the schematics, floor plans, canons, and nuances of the ship, exploring how La Sirena acts almost like a character in Picard. Their blog contains fan art, short essays, scene clips, and more. 

Since January, Tumblr has received DMCA takedown notices from DMCA Piracy Prevention Inc, a third-party copyright monitoring service used frequently by content creators to prevent infringement of their original work. While most of the over 300 complaints we received from DMCA Piracy Prevention Inc are technically complete, they rarely accurately target content created by the company’s clients. And although the complaints may report posts loosely related to the complainant, the content was irrelevant and did not infringe on any copyrights—including the La Sirena fandom. 

La Sirena just so happens to also be the name of one of DMCA Piracy Prevention Inc’s clients—La Sirena 69, an adult content creator notably not involved in the Star Trek fandom.

In one recent copyright claim, the monitoring service targeted over 90 Tumblr posts that matched a keyword search of “la sirena.” But instead of alerting our team to La Sirena 69’s allegedly infringed content, the company reported a wide array of mappinglasirena.tumblr.com’s original posts—like a short essay about a new La Sirena booklet, an article analysis of the starship’s design, and even the blog owner’s thoughts on the fourth trailer for Picard season two.

None of these reported links from mappinglasirena.tumblr.com contained infringing content from La Sirena 69—instead, they focus on La Sirena, the starship. As you probably expect, we rejected this complaint. 

While it may be amusing to think of innocuous Star Trek fandom musings getting confused with an adult industry creator’s paywalled content, this case earns itself into the Hall of Shame for several reasons. 

The Trust and Safety team here at Automattic is small but mighty, and it takes significant time to manually review copyright infringement complaints. We are steadfast champions of user rights and consider the analysis of each DMCA takedown notice with the utmost importance—even if, in this author’s humble opinion, the original Enterprise is cooler than La Sirena. Protecting the intellectual property of content creators, regardless of industry, is a crucial mission that some copyright monitoring services are working to achieve valiantly and respectfully. But others certainly get this wrong, as we’ve written about in the past. 

Copyright monitoring services should not flippantly report content entirely irrelevant to their clients’ content; that is an abuse of the DMCA. These companies have a responsibility to verify that the content targeted in their takedown notices is actually owned by their client. La Sirena 69 is not La Sirena, and the onus to distinguish between the two falls on Piracy Prevention LLC’s shoulders. Whether it’s an improved algorithm or more human eyes on every notice that they’re submitting, guardrails must be implemented to prevent DMCA abuse—otherwise, these monitoring services risk unnecessarily burdening innocent content creators, or removing innocuous content. 

Tumblr is a special place—not only for Trekkies, but for anyone who writes prose, creates artwork, constructs moodboards, or expresses themselves in their own unique way. This mission is why we do what we do, and we will never stop fighting for users to champion this right in our little pocket of cyberspace.

Artwork by Gemma Evans