Henderson and Lemley (2024) argue that the terms of use attached to generative AI models - restricting competition, misuse, and guardrail bypass - are of doubtful legal enforceability, and they pose four interrelated open questions: how federal courts will resolve the circuit split over copyright preemption of contract claims; whether courts will recognize human authorship or other copyright interests in AI outputs or model weights; whether the DMCA and CFAA will extend to novel circumvention and misuse specific to generative models; and which statutory or regulatory mechanisms should replace private licensing as a tool against harmful AI use. As of August 2026, the following developments bear on them: the U.S. Copyright Office's Part 2 Copyrightability report and Thaler v. Perlmutter (D.C. Cir. 2025) reinforce the human-authorship requirement while expressly leaving mixed-contribution and model-weights questions open; no decision has touched the preemption split; the 2024 triennial section 1201 rulemaking adopted no AI-research exemption; and the Ninth Circuit's 2026 Amazon v. Perplexity decision cuts against expansive CFAA theories in the AI-agent context. The four questions remain open in the operative sense. They are predictive and normative questions whose ultimate legal resolution awaits concrete litigation and legislation.

Background

Generative artificial intelligence systems present two artifacts that companies try to control through law. The first is the model weights: the billions of numeric parameters, produced by an automated training process over large datasets, that encode the model's behavior. The second is the model outputs: the text, images, or code a model generates in response to user prompts. When a company releases weights publicly (an 'open-weight' model) or offers access through an API or chat interface, it typically attaches terms of use - also called licenses, acceptable-use policies, or responsible-use licenses; a standardized family of such licenses is known as OpenRAIL - prohibiting, among other things, training competing models on the outputs, removing or bypassing safety guardrails (hard-coded limits on generating harmful content), and various harmful or anticompetitive uses.

The traditional legal footing for such terms is copyright: software licenses are enforced as conditions on a copyright grant, so that using the work contrary to the license is copyright infringement. Henderson and Lemley's article argues that this footing largely disappears for generative AI. Under U.S. law, copyright requires a human author: material generated wholly by a machine is not protectable, and - under Copyright Office guidance - prompts alone do not give users sufficient control over the expressive elements of outputs to make them authors. Weights, produced by an automated training process and largely functional, are likewise unlikely to be protectable. If there is no copyright in the licensed artifacts, there may be nothing to license, and contract or tort claims that try to recreate copyright-like control over copying face preemption.

Preemption is the article's second pillar. Section 301 of the Copyright Act preempts state-law rights 'equivalent to' the exclusive federal rights of copyright ('express preemption'), and federal law can also displace state law that conflicts with Congress's purposes ('conflict preemption'). Courts split - a 'circuit split' - on how this applies to contracts. In ProCD, Inc. v. Zeidenberg (U.S. Court of Appeals for the Seventh Circuit, 1996), the court held that breach-of-contract claims based on license terms are generally not preempted, and many circuits follow that approach. The Second Circuit (in ML Genius Holdings LLC v. Google LLC, a 2022 dispute over scraped song-lyric transcriptions, decided in a non-precedential summary order) has instead preempted contract claims coextensive with the rights to reproduce and distribute protected subject matter, and Judge Alsup's 2024 decision in X Corp. v. Bright Data Ltd. (U.S. District Court for the Northern District of California) held, on conflict-preemption grounds, that a platform's adhesion terms of use (standard-form contracts offered on take-it-or-leave-it terms) cannot erect 'a private copyright system' over publicly available data. Which approach prevails when AI terms restrict copying or derivative use of uncopyrightable weights and outputs is unresolved, and commentators describe the split as destined for the Supreme Court.

Third, the article examines two federal statutes as alternative enforcement routes and finds them weak. Section 1201 of the Digital Millennium Copyright Act (DMCA) prohibits circumventing technological measures that control access to, or copying of, copyrighted works; the Copyright Office has taken the position that bypassing model guardrails or fine-tuning around them is not such circumvention. (The statute provides for a triennial rulemaking in which the Librarian of Congress, on the Copyright Office's recommendation, adopts exemptions to this prohibition for lawful uses.) The Computer Fraud and Abuse Act (CFAA) is a computer-trespass statute criminalizing or creating civil liability for intentional unauthorized access to protected computers; the Supreme Court narrowed it in Van Buren v. United States (2021) toward garden-variety hacking, and it is unsettled how it applies when an automated tool or its user exceeds a website's or platform's terms.

The article concludes that many AI terms are likely unenforceable - which it argues is partly good (anticompetitive and research-chilling terms should fail) and partly bad (companies lose a tool against genuinely harmful uses) - and that legislatures, not private license terms, should draw the line between good and bad uses of AI. It explicitly frames the resulting questions as open, outcome-determinative issues awaiting concrete test cases, rulemaking, and legislative choices.

Problem Statement

The problem, as posed by Henderson and Lemley (2024) - and confined, like the article, to United States law - is the set of four interrelated open legal questions that together determine whether and how AI model terms of use can function as a regulatory tool:

  1. Copyright preemption. How will federal courts resolve the existing circuit split - specifically, will the ProCD 'no-preemption-for-contracts' approach or the Second Circuit's express-preemption approach and Judge Alsup's conflict-preemption reasoning prevail when contracts attempt to control copying or derivative uses of uncopyrightable or copyright-eligible material, such as AI model weights and outputs?

  2. Authorship and other bases for copyright. To what extent will courts recognize human authorship or other bases for copyright in AI outputs, or in limited cases of model weights (for example, where weights memorably encode copyrighted material), and how would narrow judicial recognition of such interests alter the enforceability of licenses?

  3. Circumvention and misuse statutes. Will the doctrinal boundaries of the Digital Millennium Copyright Act (DMCA) and the Computer Fraud and Abuse Act (CFAA) evolve, through litigation or rulemaking, to encompass novel forms of circumvention or misuse specific to generative models - such as bypassing brittle guardrails via prompt engineering (crafting inputs to elicit restricted behavior) or fine-tuning (retraining a model on new data) - and if so, what technical and legal standards will define 'circumvention' or 'unauthorized access' in this context?

  4. Policy mechanisms. What statutory, regulatory, or doctrinal mechanisms - for example, legislated safe harbors for security research, standardized responsible-use license frameworks, or limits on the enforceability of anticompetitive terms - should policymakers adopt to balance preventing harmful uses, preserving beneficial research, and avoiding anticompetitive consolidation?

These four questions are interrelated and jointly posed, and the article identifies them as open, outcome-determinative issues.

References

  1. Peter Henderson and Mark A. Lemley, 'The Mirage of Artificial Intelligence Terms of Use Restrictions' (2024), arXiv:2412.07066, DOI 10.48550/arXiv.2412.07066, https://arxiv.org/abs/2412.07066 (later record: DOI 10.2139/ssrn.5049562, https://www.ssrn.com/abstract=5049562, where SSRN lists Lemley first)
  2. ProCD, Inc. v. Zeidenberg, 86 F.3d 1447 (U.S. Court of Appeals for the Seventh Circuit, June 20, 1996), No. 96-1139, https://www.courtlistener.com/opinion/720542/procd-inc-v-zeidenberg/
  3. ML Genius Holdings LLC v. Google LLC, No. 20-3113, 2022 WL 710744 (U.S. Court of Appeals for the Second Circuit, March 10, 2022) (summary order; docket titled 'Genius Media Group Inc. v. Google LLC'), https://www.courtlistener.com/docket/60678163/genius-media-group-inc-v-google-llc/
  4. X Corp. v. Bright Data Ltd., No. 3:23-cv-03698-WHA, 2024 WL 2113859 (U.S. District Court for the Northern District of California, May 9, 2024), https://www.courtlistener.com/docket/67637345/x-corp-v-bright-data-ltd/
  5. U.S. Copyright Office, 'Copyright and Artificial Intelligence, Part 2: Copyrightability' (January 2025), https://www.copyright.gov/ai/Copyright-and-Artificial-Intelligence-Part-2-Copyrightability-Report.pdf (government report; no DOI)
  6. Stephen Thaler v. Shira Perlmutter, 130 F.4th 1039 (U.S. Court of Appeals for the D.C. Circuit, March 18, 2025), No. 23-5233, https://media.cadc.uscourts.gov/opinions/docs/2025/03/23-5233.pdf (also at https://www.courtlistener.com/opinion/10357586/stephen-thaler-v-shira-perlmutter/)
  7. U.S. Copyright Office, 'Copyright and Artificial Intelligence, Part 3: Generative AI Training' (pre-publication version, May 2025), https://www.copyright.gov/ai/Copyright-and-Artificial-Intelligence-Part-3-Generative-AI-Training-Report-Pre-Publication-Version.pdf (government report; no DOI)
  8. Library of Congress, 'Exemption to Prohibition on Circumvention of Copyright Protection Systems for Access Control Technologies' (final rule, 89 Fed. Reg. 85437, October 28, 2024), Federal Register document 2024-24563, https://www.federalregister.gov/documents/2024/10/28/2024-24563/exemption-to-prohibition-on-circumvention-of-copyright-protection-systems-for-access-control
  9. amazon.com Services, LLC v. Perplexity AI, Inc., No. 26-1444 (U.S. Court of Appeals for the Ninth Circuit, August 4, 2026) (published opinion; appeal from No. 3:25-cv-09514-MMC, N.D. Cal.), https://cdn.ca9.uscourts.gov/datastore/opinions/2026/08/04/26-1444.pdf (also at https://www.courtlistener.com/opinion/10939432/amazoncom-services-llc-v-perplexity-ai-inc/)
  10. Enrico Bonadio and Honor Felisberto, 'Copyrightability of AI Outputs: The US Copyright Office's Perspective' (2025), DOI 10.2139/ssrn.5252465, https://doi.org/10.2139/ssrn.5252465
  11. Saleh Al-Sharieh, 'Copyright Denied for Generative AI: Remarks on Thaler v Perlmutter' (2025), 40(1) Utrecht Journal of International and European Law 48-54, DOI 10.5334/ujiel.644, https://doi.org/10.5334/ujiel.644
  12. Andreas Engel, 'Generative AI and Copyright' (2025), in The Oxford Handbook of the Foundations and Regulation of Generative AI, 516-535, DOI 10.1093/oxfordhb/9780198940272.013.0026, https://doi.org/10.1093/oxfordhb/9780198940272.013.0026
  13. Michael Veale and Joao Pedro Quintais, 'The Obligations of Providers of General-Purpose AI Models (Articles 53, 54 and 56)' (2026), in The EU Artificial Intelligence Act (Hart Publishing), 361-402, DOI 10.5040/9781509988570.ch-022, https://doi.org/10.5040/9781509988570.ch-022
  14. Mark Lemley, 'How Generative AI Turns Copyright Law Upside Down' (2024), 25 Columbia Science and Technology Law Review 190, DOI 10.52214/stlr.v25i2.12761, https://doi.org/10.52214/stlr.v25i2.12761 (volume 25, issue 2, first page 190)