The Connection Is Not the Person
In Cox Communications v. Sony Music, the decisive factual problem was not simply whether Cox knew that infringement occurred. It was what that knowledge identified. This chapter follows the path from an allegedly infringing act to a monitoring notice, an IP address, a subscriber account, and the people who might have used the connection. That path explains why a general-purpose ISP can have substantial information about recurring infringement while still lacking the person-level knowledge needed to infer purposeful assistance.
The distinction matters because legal arguments often compress several different objects into one phrase: “the infringer.” In Cox's records, a notice generally pointed to an IP address associated with a subscriber account. The address was a useful network marker, but it was not necessarily the identity of the person who uploaded or downloaded a work. The Supreme Court treated that gap as part of the legal facts, not as a technical footnote.
From a copyrighted work to a connection-level notice
The first component is the work itself. Sony Music and other major music copyright owners used MarkMonitor to track activity involving copyrighted recordings. MarkMonitor's software detected apparent unauthorized uploads or downloads, traced the activity to an IP address, and identified the Internet service provider associated with that address. During the roughly two-year period at issue, it sent Cox 163,148 notices.
That sequence produces a real evidentiary signal. A notice can tell a provider that an activity associated with one of its connections has been identified as apparently infringing. Repeated notices can make the pattern harder to dismiss as a single mistake. But the notice's content and the conclusion drawn from it are not the same thing. The notice identifies an address; it does not, by itself, identify which person acted, what that person intended, or whether every reported event was ultimately adjudicated as infringement.
The Court's description of Cox's network makes the limitation concrete. Cox served about six million subscribers. Each subscriber account was associated with an IP address, and Cox could generally determine which account corresponded to a particular address. But many users can share one address. A household may have several people using the same connection. A coffee shop or college dormitory may place a much larger group behind one address. The address therefore sits between the provider and the human actor: more specific than general knowledge that infringement exists somewhere on the Internet, but less specific than knowing who performed a particular act.
This is not merely a question of how much data a provider stores. It is a question of what the service relationship allows the provider to know and control. Cox supplied the connection. It did not ordinarily choose which household member, customer, visitor, or downstream user would use it. Nor did it directly control the user's conduct once the connection was provided. The provider could respond to information about an account, but an account-level response is not the same as knowing the identity and purpose of the person who caused the reported activity.
The relationship can be represented as a chain with a missing link. A copyrighted work may appear in detected activity. The activity is traced to an IP address. The address is mapped to a subscriber account or connection. That connection may be used by several possible people. A notice reaches Cox at the provider level, but it does not automatically travel backward through the chain and identify one human principal with certainty.
The diagram does not say that an ISP knows nothing. It shows why the kind of knowledge matters. A provider may know that a particular connection has been associated with repeated reports while not knowing which member of a household, visitor to a coffee shop, or customer of a downstream network performed the acts. That difference becomes especially important when liability requires an intention to help a wrongful act succeed.
Shared connections change the inference
Justice Sotomayor's concurrence made the information gap even more explicit. Although she disagreed with the majority's claim that the two established theories were the only possible forms of contributory liability, she agreed that Cox could not be held liable on this record. In her analysis, an aiding-and-abetting theory would require intent to help a wrongful act succeed, and the notices did not show that Cox knew who the relevant users were.
Consider a single-family home. After several notices, Cox might know that the home's connection is likely to be used again for infringement. But the provider may not know whether the infringer is a parent, child, guest, neighbor with the Wi-Fi password, or another person. A decision to continue serving the connection is therefore a decision about access to the household account, not necessarily a decision to help a known individual's next act.
The problem grows when a connection serves hundreds or thousands of users. The concurrence compared regional ISPs to middlemen: the upstream provider supplies service to an intermediary that passes it to a mixture of lawful and unlawful users. Cox may know that someone using the downstream network infringed in the past and may infringe again, while lacking knowledge of which person is responsible. The concurrence gave similar examples involving university housing, hospitals, and military bases. These examples do not establish that an ISP can never acquire more specific information. They show why the inference cannot be automatic across every connection type.
The scale of the notice record can therefore mislead if it is read without the network model. A high notice count may mean that a provider received a great deal of information about activity associated with its connections. It does not necessarily mean that the provider acquired the same amount of knowledge about individual actors. More notices can strengthen an argument that the provider should take some account-level response, but quantity alone does not answer the separate question of whether the provider intended to facilitate the acts.
The same distinction affects how to interpret a decision to keep an account connected. At the connection layer, Cox can decide whether to warn, suspend, or terminate an account. At the user layer, the provider may not know which person will use that account next. Continuing service can therefore reflect a decision about the consequences imposed on a mixed group of lawful and unlawful users, not an endorsement of a particular user's next upload. That does not make the decision irrelevant. It means its legal meaning depends on the information available and the purpose shown by the surrounding conduct.
For a connection used by one identifiable person, evidence about repeated acts, direct communications, or targeted assistance might support a more specific inference than the record described here. For a regional network serving thousands of people, the same number of notices says less about any one actor and more about the difficulty of assigning responsibility through the upstream provider. The Court did not announce a numerical conversion rate from notices to intent. It required the inference to respect the structure of the service and the quality of the provider's knowledge.
That is also why an account-level policy can be both practically important and legally incomplete. Warnings may deter a subscriber. Suspensions may interrupt activity. Termination may remove access. None of those steps, taken alone, explains whether the provider designed access to help infringement in the first place. Conversely, a provider that adds special assistance for infringing users, promotes a piracy use, or treats infringing traffic differently from ordinary traffic would present a different question. The boundary lies in the relationship between information, service design, and purpose—not in the mere existence of an enforcement ladder.
Ordinary access is a broad service, not a piracy feature
The second component is the service itself. Cox supplied Internet access. The Supreme Court described that access as useful for many purposes other than copyright infringement and said Cox had not tailored it to make infringement easier. That conclusion does not depend on pretending that unlawful copying is rare or harmless. It depends on identifying the service's ordinary function.
A general-purpose connection carries whatever lawful and unlawful traffic users choose to send through it. The provider's service is not, simply by its nature, a catalog of works selected for copying, a set of instructions for evading copyright restrictions, or a system built around distributing unauthorized files. The connection is a means of reaching many destinations and services. Some users can misuse it, just as users can misuse other broadly useful tools, but misuse does not by itself redefine the tool's intended function.
This is where the Betamax analogy becomes useful. The Supreme Court's earlier decision treated a video recorder as capable of substantial noninfringing uses because people could record programs for later personal viewing. The recorder's capacity to make unauthorized copies did not establish that selling it to the public was contributory infringement. In Cox, the Court applied the same basic idea to Internet access: a service with extensive lawful uses is not automatically tailored to infringement because the provider knows some users will use it unlawfully.
The analogy has a limit. Lawful capability is not a universal escape from liability. Grokster involved software that had lawful uses but was promoted and marketed as a tool for infringement. The important question is not whether a service can be used lawfully in the abstract. It is whether the provider's conduct and the service's design show a purpose of encouraging infringement or make the service especially suited to that use without substantial lawful alternatives.
That distinction also explains why the network model should not be exported mechanically to every online platform. A service that stores user content, selects particular works, recommends them, links users to a piracy-focused site, or gives instructions for unauthorized copying may have different functions and different evidence. The Court's conclusion about Cox's ordinary Internet access rests on the service actually supplied, not on a rule that the word “ISP” resolves every question about every intermediary.
What provider responses do—and do not—change
Cox's warnings and interruptions changed the relationship after notices arrived. The company said that a second notice triggered a warning, additional notices could lead to temporary interruption or suspension, and 13 notices could lead to termination. Its subscriber agreement also prohibited posting, copying, transmitting, or disseminating material that infringed copyright. Those measures matter because they show that Cox had a process for responding to reports and contractually prohibited infringement as a use of the connection.
They do not, however, change the underlying identity of the service. Cox remained a provider of general Internet access. A warning does not turn access into a content-selection system. A suspension does not show that the original service was designed for copying. An account termination may show that the provider chose to impose a consequence, but the absence or limited use of termination does not by itself prove that the provider wanted the infringement to occur.
The parties used the same record to tell different stories. Sony emphasized that Cox terminated only 32 subscribers for infringement during the claim period, even though it terminated many more subscribers for nonpayment, and pointed to employee statements that Sony said reflected a preference for subscription revenue. Cox emphasized that its warning and suspension system ended 98 percent of identified infringement. The Court reported both positions. Neither figure is a universal measure of intent, and the 98 percent figure was Cox's litigation position rather than a neutral finding about every act on the network.
The right conclusion is more modest and more useful. The notices and response policy show that Cox was not operating in an information vacuum. They may bear on questions about how a provider implements an anti-infringement policy or whether a statutory safe harbor is available. But under the Supreme Court's contributory-liability analysis, evidence of awareness and imperfect enforcement still needed to connect to active inducement or an infringement-tailored service. The Court found that connection missing.
The connection model thus sets the boundary for the next legal step. The issue is not whether Cox supplied the physical or digital route used by an infringer; it plainly did. The issue is whether that route, considered with the provider's conduct and available information, becomes evidence that Cox meant to help the infringement. The answer requires a rule about purposeful facilitation, not just a count of notices. That is the question the Court's precedents answer next.