How to send a DMCA takedown notice for a leaked PDF

What a DMCA notice must include under 17 U.S.C. § 512(c)(3), where to send it, a copy-paste template, and the EU alternative under the Digital Services Act.

Published 10 min read

On this page

This isn't legal advice. It summarizes the law and how takedown notices usually work, for creators dealing with a leaked file. If your case is unusual, or the other side pushes back, talk to a lawyer.

A DMCA takedown notice is a written request asking a website or hosting service to remove material that infringes your copyright. It comes from section 512 of the US Copyright Act, which the Digital Millennium Copyright Act added in 1998. A service that stores material for its users is shielded from liability for that material if, among other conditions, it removes it "expeditiously" once it receives a valid notice. That protection, known as the safe harbor, gives hosts and platforms a strong reason to act on notices.

You don't need a lawyer or a copyright registration to send a notice. Copyright generally arises when an original work is fixed in a tangible form. Registration is generally required before bringing an infringement lawsuit over a US work.

Check three things before you send it

A DMCA notice contains statements you sign, so make sure of these first.

  1. You own the copyright, or you're authorized to act for the owner. If you made the PDF, you're usually the owner. If a publisher, a client or a co-author holds the rights, they may need to send the notice, or authorize you to.
  2. The use isn't authorized by you or allowed by law. Consider fair use and other applicable exceptions before sending a notice. Reviews and teaching uses may qualify, but neither the purpose nor the amount copied settles the question on its own. The Copyright Office's fair use guidance explains the factors to consider.
  3. You know exactly where the copies are. You need the full address of each page or download link, not just the site's homepage.

Be accurate. Under section 512(f), anyone who knowingly and materially misrepresents that material is infringing can be liable for the damages that result, including costs and attorneys' fees.

What a DMCA notice must include

Section 512(c)(3)(A) says a notice must be a written communication to the service provider's designated agent that includes "substantially the following":

  1. A signature, physical or electronic, of a person authorized to act for the copyright owner. A typed full name is the usual electronic signature.
  2. Identification of the copyrighted work. Give the PDF's title and enough detail to identify it; a link to your product page can help. If several of your works are on the same site, the law allows a representative list.
  3. Identification of the infringing material, with information "reasonably sufficient" for the provider to find it. In practice, the exact web addresses.
  4. Your contact information, "such as an address, telephone number, and, if available, an electronic mail address".
  5. A statement of good faith belief that the use "is not authorized by the copyright owner, its agent, or the law".
  6. A statement that the information in the notice is accurate, and, under penalty of perjury, that you're authorized to act on behalf of the copyright owner.

A notice that doesn't substantially comply generally doesn't count as notice under section 512(c)(3)(B), so include all six.

Where to send it

Start with the site itself and work outward.

Look in the site's footer, terms of service or help pages for "DMCA", "Copyright" or "Report". Large platforms and file hosts usually have a web form that asks for each of the six elements in its own field. When there's a form, use it.

To keep the safe harbor, a US service provider has to name an agent to receive notices, publish the agent's details on its service, and register them with the US Copyright Office. The Office keeps a public directory you can search at dmca.copyright.gov/osp. Search for the company that runs the site, which may have a different name from the site itself.

A designation expires three years after it's registered unless the provider renews it, so check the date on the entry. According to the Copyright Office, a provider without a designated agent risks losing the safe harbor.

3. The hosting provider

If the site ignores you, or is clearly run by the people sharing your files, go to the company that hosts it.

  • Find the host. An IP lookup or WHOIS tool shows which network the site's IP address belongs to, and hosting companies usually publish an abuse or copyright contact. ICANN Lookup shows a domain's registrar and name servers.
  • If Cloudflare proxies the site, an IP lookup may show Cloudflare rather than the host. Cloudflare name servers alone don't tell you where the content is hosted. Report the site at abuse.cloudflare.com. For content it proxies but doesn't host, Cloudflare says it forwards copyright complaints to the operator and host and provides the host's contact details to the rightsholder.

4. Search engines

If the file stays up, you can at least make it harder to find. For a search engine, the notice identifies the link in its results rather than the file itself (section 512(d)).

  • Google: start from Report content for legal reasons, choose Google Search, then copyright. Google asks for the exact URLs, not the homepage. It may send a copy of your notice to Lumen, a public database of takedown requests, though it says it doesn't share your personal contact information with Lumen.
  • Bing: use the Notices of Infringement form, which covers Bing's web, image and video results.

Removing a search result doesn't delete the file, but people searching for your product on that search engine won't be sent to it.

DMCA takedown notice template

Replace everything in square brackets, and send one notice per site. Paste it into the site's form field by field, or email it to the designated agent.

Subject: DMCA notice of copyright infringement

To the designated agent of [service provider name]:

I am writing to notify you, under 17 U.S.C. § 512(c)(3), of material on your service that infringes my copyright.

1. The copyrighted work
[Title of your PDF], a [type of work, for example "digital sewing pattern"] created by [your name or business name]. The original is sold at [URL of your product page].

2. The infringing material
Unauthorized copies of this work are available at these locations on your service:
[URL 1]
[URL 2]

Please remove this material or disable access to it.

3. Contact information
Name: [Your full name]
Copyright owner: [Your name or business name]
Address: [Postal address]
Phone: [Phone number]
Email: [Email address]

4. Statements
I have a good faith belief that use of the material in the manner complained of is not authorized by the copyright owner, its agent, or the law.

The information in this notification is accurate, and under penalty of perjury, I am the owner, or am authorized to act on behalf of the owner, of an exclusive right that is allegedly infringed.

Signature: [Your full name]
Date: [Date]

A few things to get right:

  • Leave your customer out of it. The site only needs to know where the copies are. Don't include the buyer's name, order number or copy codes. Keep that evidence for yourself.
  • Use contact details you're comfortable sharing. The site may pass your notice on to the person who uploaded the file, so a business address and email are better than your home address, if you have them.
  • Keep a record of what you sent, where you sent it and when, along with any reply.

What happens after you send it

  • The provider decides. The law asks providers to act "expeditiously" but doesn't set a deadline. If you hear nothing after a week or so, follow up, then go to the host or the search engines.
  • The uploader can send a counter notice. They state under penalty of perjury that removal resulted from a mistake or misidentification. Under the DMCA counter-notice process, the provider forwards it to you and restores access 10 to 14 business days after receiving it, unless its agent first receives notice that you've filed a court action seeking to restrain the infringement. A counter notice includes the uploader's name, address, phone number and consent to the relevant US federal court's jurisdiction.
  • Repeat uploaders can lose their accounts. To keep the safe harbor, a provider must have a policy of terminating repeat infringers "in appropriate circumstances" (section 512(i)), so it's worth reporting each new upload.

In the EU: a Digital Services Act notice

The Digital Services Act, Regulation (EU) 2022/2065, has applied since 17 February 2024. Article 16 requires every hosting service to offer an easy-to-use, electronic way to report illegal content, and copyright infringement counts: the regulation defines illegal content as information that doesn't comply with EU law or the law of a member state. The rules cover services offered to users in the EU, wherever the provider is based.

Use a DSA notice for hosts that offer their service in the EU, especially file hosts and platforms that have no DMCA process. Look for a link labeled "Report illegal content" or "DSA".

What a DSA notice must include

Article 16(2) lists four elements:

  1. A sufficiently substantiated explanation of why you consider the content illegal. For a leaked PDF: you own the copyright, the file is a complete copy of your paid work, and it was shared without your permission.
  2. A clear indication of the exact electronic location, "such as the exact URL or URLs".
  3. Your name and email address.
  4. A statement confirming your bona fide belief that the information and allegations in the notice are accurate and complete.

Article 16 doesn't ask for a signature, a postal address or a statement under penalty of perjury, though a platform's own form may ask for more.

What the host has to do

  • Confirm receipt "without undue delay", if you gave an email address (Article 16(4)).
  • Tell you its decision without undue delay, with information on how to challenge it (Article 16(5)).
  • Handle the notice "in a timely, diligent, non-arbitrary and objective manner" (Article 16(6)).

If the notice makes the illegality apparent without detailed legal analysis, Article 16(3) treats the provider as having knowledge of that content. Article 6 then requires prompt removal or disabled access to retain its liability exemption, subject to that article's other conditions.

Platforms covered by Article 20 must offer a free internal complaint process for at least six months after the decision. Article 19 generally exempts micro and small platform providers from this requirement, unless designated as very large online platforms.

For platforms covered by Article 23, repeated manifestly unfounded notices can lead to a temporary suspension of notice processing after a warning. Check your facts before sending a notice.

DSA notice template

Subject: Notice of illegal content (copyright infringement) under Article 16 of the Digital Services Act

To [service provider name]:

I am notifying you of illegal content on your service under Article 16 of Regulation (EU) 2022/2065 (Digital Services Act).

1. Why the content is illegal
I am the copyright owner of [title of your PDF], a [type of work] that I sell at [URL of your product page]. The files at the locations below are complete, unauthorized copies of this work. I have not licensed or permitted their distribution. Making them available to the public infringes my exclusive right to authorize or prohibit the making available of my work, under Article 3(1) of Directive 2001/29/EC as implemented in national law.

2. Exact location of the content
[URL 1]
[URL 2]

3. Contact details
Name: [Your full name]
Email: [Email address]

4. Statement
I confirm my bona fide belief that the information and allegations contained in this notice are accurate and complete.

[Your full name]
[Date]

DMCA or DSA?

  • DMCA: sites and hosts based in the United States, and platforms that name a DMCA agent, as most large ones do.
  • DSA: hosting services that offer their service in the EU, especially when they have no DMCA process.

When a platform offers both, use the copyright form it points you to. You don't need to send the same notice twice.

How Imprint helps

On the Premium plan, once leak tracing has matched a leaked file to an order, Draft a takedown notice opens a form with the title of your work filled in. Choose United States: DMCA or European Union: Digital Services Act, add the addresses of the copies (up to 50) and your details, and Imprint drafts the notice for you to copy or download as a text file. You then send it yourself.

The notice never includes your customer's name or email, the order number or the copy codes. Imprint doesn't store what you enter, and the notice is always written in English. The takedown notices docs explain every field.

To investigate the copy's source, read How to find out who leaked your PDF. Tracing the buyer isn't required to send a takedown notice. For protecting future downloads, see How to sell PDFs on Shopify and limit sharing.

Sources

Checked on October 29, 2026. Laws and platform processes change, so check the current versions before you rely on them.

More guides