AI Policy

Sony Fingerprinted What Was Inside The Model

Sony Music filed a second suit against Udio on 20 July 2026 asserting 30,117 recordings it identified inside the training data by audio fingerprinting. The method matters more than the damages.

AI PolicyBy Servola Tech Desk2026-07-215 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

Sony Fingerprinted What Was Inside The Model

Key takeaways

Sony Music filed a second copyright suit against Udio in the Southern District of New York on 20 July 2026 asserting 30,117 sound recordings, taking the recordings at issue from 333 to more than 30,000 and the statutory exposure from around 50 million dollars to roughly 4.5 billion.
Sony did not estimate what was in the training set. It inspected it in discovery and matched hundreds of thousands of its own recordings by audio fingerprinting, so a training corpus is now demonstrably enumerable by an outside party.
One of the three claims is circumvention of technological protection measures under the DMCA, which attacks how the data was obtained rather than what the model did with it, and survives independently of any fair-use or mining defence.
The European analogue is the text-and-data-mining exception in the 2019 copyright directive, which only applies where access was lawful and the rightsholder had not reserved its rights, so acquisition-stage lawfulness is the exposure on this side of the Atlantic too.
Before your next model or fine-tuning contract, require a written provenance warranty naming the datasets and the reservation checks performed, and keep a manifest of your own fine-tuning corpus, because inability to reconstruct it is no longer a defence.

A filing that should not have been necessary

On 29 June 2026 a judge in the Southern District of New York told Sony Music it could not add more than 30,000 sound recordings to the case it was already running against Udio. Three weeks later Sony filed them anyway, as a separate lawsuit. The complaint landed on 20 July and asserts 30,117 recordings.

Procedurally this is unremarkable. A court declining to expand an existing case does not extinguish the claims; it just makes the plaintiff open a second front. What makes it worth an operator's attention is the arithmetic that follows. The original action put 333 recordings in dispute. Statutory damages in that case topped out around 50 million dollars, roughly 46 million euros. At 30,117 recordings the theoretical ceiling moves to about 4.5 billion dollars, around 4.2 billion euros.

Sony is also now the odd one out. Universal and Warner both reached licensing arrangements with Udio. Sony did not, and the absence of a settlement is what keeps the discovery record in play rather than sealed behind a deal.

How 333 became 30,117

The interesting part is not the number. It is where the number came from. Sony did not sample the internet and infer what a music model must have been trained on. Through discovery in the first case it obtained access to Udio's training data, then ran audio fingerprinting against it and identified hundreds of thousands of its own recordings. The 30,117 asserted in the new complaint are a subset of what the matching turned up.

A training corpus, it turns out, is an inventory. That sentence would have been contested two years ago. Model builders routinely described their datasets as too large, too transformed and too intermingled to be enumerated, and the argument had some force while nobody had looked. Somebody has now looked, with a commodity technology that the music industry has used for content identification for two decades, and produced a list with five significant figures.

Nothing about this is specific to music. Fingerprinting works on audio because audio has robust perceptual hashes, but the general capability, matching a known catalogue against a corpus you have been ordered to hand over, transfers to images, video, text and code with different tooling and the same legal effect.

The claim that is not about copyright

The complaint brings three claims. Two are conventional infringement: post-1972 recordings, and pre-1972 recordings protected under the Music Modernization Act. The third is different in kind. It alleges circumvention of technological protection measures under the Digital Millennium Copyright Act.

Circumvention is an acquisition claim. It does not ask whether training on a work is transformative, or whether the output competes with the original, or whether any of the fair-use factors point one way. It asks how the defendant got past the lock. That distinction is doing quiet structural work in this case, because a defendant can win the argument about what training is and still lose on how the material was collected.

European readers should not file this as an American curiosity. The mining exception in the 2019 copyright directive, the provision most EU firms rely on when they scrape, is conditioned on lawful access and on the rightsholder not having reserved its rights in a machine-readable way. Both conditions attach to acquisition. The doctrinal vocabulary differs on either side of the Atlantic and the pressure point is identical: how you obtained the data is a separate question from what you did with it, and it is answered first.

Why not knowing what you trained on stopped being safe

For three years the practical answer to a provenance question from a customer or a regulator has been a shrug dressed up as engineering. The corpus is enormous, the pipeline ran years ago, the intermediate artefacts were not retained. That answer used to function as a defence because the counterparty had no way to check.

The Udio discovery record ends that. Once a rightsholder can obtain the corpus and match it, the party who cannot describe its own training data is not protected by the gap, it is simply the party with less information about its own exposure. Uncertainty stopped being a shield and became an unpriced liability, and it is now sitting on the balance sheet of every firm that fine-tuned on material it did not document.

The regulatory direction reinforces the same point rather than causing it. The European AI Act requires providers of general-purpose models to publish a sufficiently detailed summary of the content used for training, and the Commission's enforcement powers over those obligations become exercisable on 2 August 2026. A firm that cannot produce that summary internally will not be able to produce it for a supervisor either. The litigation and the regulation are asking the same question from opposite directions.

Put provenance in the contract, not in the assumptions

Three concrete changes, none of which require a legal opinion to start. First, in your next model or fine-tuning agreement, ask for a written provenance warranty that names the principal datasets and states what rights-reservation checks were performed, with indemnity attached. A vendor that will describe its data verbally and not contractually has told you something useful.

Second, keep a manifest of anything you fine-tune on yourself: source, date acquired, licence or exception relied on, and whether a machine-readable reservation was present at the time of collection. That last field is the one nobody records and the one the mining exception turns on. Reconstructing it later is materially harder than logging it now.

Third, separate the two questions in your own risk register. Acquisition lawfulness and training lawfulness fail independently, and a model can be clean on the second and exposed on the first. Most internal AI risk assessments written before this month treat them as one line item. They are two, and the first one is the one a plaintiff reaches with a fingerprint.

Frequently asked questions

Does this ruling mean training AI on copyrighted work is now illegal?

No. Nothing has been decided on the merits. Sony filed a complaint containing allegations, and the June ruling it follows was procedural, about whether recordings could be added to an existing case, not about whether training infringes. What has changed is evidentiary rather than doctrinal: discovery showed that a training corpus can be inspected and matched against a known catalogue.

Why does the DMCA circumvention claim matter more than the infringement claims?

Because it targets acquisition rather than use. Infringement claims invite arguments about transformation, market harm and fair use. A circumvention claim asks only whether a technical protection measure was bypassed to obtain the material, so it can succeed even where a defendant prevails on what training is. The European mining exception has the same structure, conditioned on lawful access and on rights not having been reserved.

What should a European company using a third-party model actually do?

Ask for a contractual provenance warranty naming the principal training datasets and the rights-reservation checks performed, with indemnity, and treat a refusal to put it in writing as a finding. Separately, maintain a manifest for any corpus you fine-tune on yourself, recording source, acquisition date, the licence or exception relied on, and whether a machine-readable reservation was present when you collected it.

The damages figure will carry the coverage and it is the least durable part of this story. Settlements shrink numbers; the parties may yet do a deal, as two of the three majors already have. What will not be undone is the demonstration. A rightsholder obtained a training corpus, matched it against its own catalogue, and turned an unknowable into a list. Every firm that has been treating the contents of its models as unrecoverable should assume someone else can recover them.

UdioSony MusicTraining dataDMCAText and data miningAI liability

A Court Just Priced a Pirated Book at 3,000 Dollars

On 20 July 2026 a federal judge gave final approval to Anthropic's 1.5 billion dollar copyright settlement: 3,000 dollars per work across roughly 500,000 works. Training data provenance now has a published price.

3 min read

AI Policy

Twenty-Seven Ministers Named, No Tech Secretary

Twenty-seven ministerial appointments were approved on 20 July 2026 and not one of them runs a technology department. DSIT is gone, and the AI Security Institute, the Sovereign AI Fund, UKRI and the Government Digital Service now sit inside a business department.

5 min read

Law & Regulation

The EA Buyout Now Hinges on Brussels

The largest take-private in history has cleared EA shareholders and US antitrust. The last real gate is the EU - and not classic merger review, but the Foreign Subsidies Regulation, facing its first blockbuster test.