On July 20, the U.S. District Court for the Northern District of California granted final approval to the USD 1.5 billion (approximately RMB 10 billion) settlement between Anthropic and the class of authors, and issued its judgment at the same time. Once the appeal period expires, payments will begin to be distributed to the rights holders of more than 400,000 works. The judge who issued the approval order was Araceli Martínez-Olguín; William Alsup, who first heard the case, retired at the end of last year.
In China, this news is easily read as two sentences: Americans really dare to impose penalties, and fortunately we are not there. But if you are building models, doing fine-tuning, building vertical applications, or simply selling corpora, the lessons bought with this USD 1.5 billion are likely useful to you.
What it bought are three lessons: which act is being compensated for, how the money is calculated, and how much peace of mind this sum actually purchases. Brought back to China, these three lessons will land in a different place; taken to Europe and the United States, they require yet another calculation. Below, I break them down one by one, and finally turn to the few things you should change before going live.
Lesson one: what is compensated is the act of bringing the books home, not using books for training
First, let us get the accounts of this case straight.
On June 23, 2025, in the substantive judgment in this case, Judge Alsup divided Anthropic's conduct into two segments. The first segment is training: using copyright-protected book text to train a large language model, with a purpose and character that are typically transformative, constitutes fair use and is not infringement. The second segment is acquisition: downloading millions of books from the two pirate book repositories LibGen and PiLiMi and permanently retaining them in a central database; this act itself independently constitutes infringement, and buying an authorized copy afterward does not eliminate it.
The USD 1.5 billion compensates for the second segment.
This point was stated even more firmly in the final approval order of July 20. In addressing objections, the court recorded that Anthropic stated that the LibGen or PiLiMi datasets, or any part thereof, did not enter the training corpus of any of its commercially released large language models. This money has nothing to do with whether Claude works well, how much money was made, or how much these books contributed to the model. What it compensates is the act of bringing the books home.
Lesson two: the money is calculated per work, and has nothing to do with how much you earn
The compensation amount also does not depend on how much you earned. The court's verified list of works is 482,460 works, averaging approximately USD 3,000 per work; the court noted in the approval order that this figure is four times the ordinary statutory minimum damages for infringement of USD 750; the class notice stated a statutory damages range of USD 200 to USD 150,000 per work. As of April 16, 91.3% of the works had been claimed by rights holders, and only 350 members opted out. Class counsel initially sought 20%, i.e., USD 300 million, in attorney fees; the court ultimately approved only approximately USD 101 million, or 6.8% of the fund.
Number of works multiplied by unit price: that is the entire algorithm. Whether your model is commercial, and how much weight a single work carries among billions of tokens, has no place in this formula. In China, people building models are accustomed to estimating infringement damages by "scope of impact"; the Guangzhou Ultraman case awarded RMB 10,000, the Hangzhou Ultraman case RMB 30,000, and the Medusa case RMB 50,000, all at this order of magnitude. Once the class action algorithm is set in motion, the exposure for the same batch of data differs by several orders of magnitude.
Damages calculation
The third lesson: the closure this money bought is much narrower than it appears.
The approval order confirms that the class members released only claims concerning past input-side conduct, namely past pirated downloading and reproduction, up to any AI output. They did not release claims concerning past AI outputs, nor did they release claims concerning any future conduct after August 25, 2025. The objectors sought to have the licensing mechanism, output provenance labeling, and model deletion written into the settlement; the court held that these exceeded the scope of relief obtainable in this case and rejected them in their entirety. As non-monetary relief, Anthropic must also destroy pirated copies belonging to class members.
The class scope is also strictly limited to that list of works. For works not on the list, the right holders' claims remain entirely intact, and some authors have already bypassed this settlement and filed separate suits.
More accurately, Anthropic used USD 1.5 billion to settle old accounts involving a specific period, specific sources, and specific conduct; what it bought was closure for that segment, not a pass exempting it from being sued. Here, the settlement is more like paying a parking ticket; it does not mean one may park anywhere in the future.
Bringing the three lessons back to China: the gate needs to be moved.
The three lessons above were learned under U.S. law, and transplanting them directly to China would cause a mismatch. The latest answer to the same question under Chinese law came on April 29 of this year.
The Shanghai Intellectual Property Court issued its second-instance judgment in Case No. (2025) Hu 73 Min Zhong 1189, upholding the original judgment. The facts were that a user captured more than twenty images of the Medusa character from the animated series Battle Through the Heavens, used the platform's LoRA training function to generate two models, publicly released them and sold them externally, and other users could use these models to generate images substantially similar to the character. The first instance was decided by the Shanghai Jinshan District People's Court on November 3 last year: the user was ordered to pay RMB 50,000, and the platform was not held liable; the plaintiff had sought RMB 2 million from the platform when filing suit.
What Chinese AI practitioners should really copy down is the second-instance court's clarification of the right of reproduction:
The right of reproduction entitles the right holder to prohibit others from carrying out, for profit-making purposes, acts of fixing a work by various means, and such fixing should form a new copy that can directly or indirectly reproduce the work. Therefore, the right of reproduction is in essence a "right of re-presentation."
Li's act of inputting images of the Medusa character from Company Y's Battle Through the Heavens animated series into the LoRA model for model training infringed the right of reproduction only when the LoRA model, under the user's instructions, again generated works substantially similar to the input copyrighted works. The reason is that only when the output reproduces the work can others access the work, and only then is the reproduction of the work completed.
Translated: in China, the act of feeding a work into a model is not itself reproduction; reproduction is completed, and infringement established, only when what the model generates is similar enough to the original and has been seen by others.
This is exactly the reverse of the Anthropic case. The United States installs the gate at the intake: where you obtain the material and whether your hands are clean when obtaining it is the life-or-death line. China currently installs the gate at the output: what matters is whether the generated output is similar. To transpose the first lesson to China, one word must be changed: in the United States, what is fatal is "taking"; in China, what is fatal is "similarity."
Two gates
Two cases in the same direction corroborate each other. In the Hangzhou Ultraman case, the court of first instance expressly stated that the use of others' works at the data-training stage is in principle for the purpose of learning from and analyzing prior works, not for the purpose of reproducing original expression, and may be regarded as fair use absent contrary evidence; it further suggested that relatively lenient and accommodating standards should be adopted for data input and data training, while stricter standards should be applied to the output and use of generated content. In the Guangzhou Ultraman case ((2024) Yue 0192 Min Chu No. 113), the platform was ordered to pay RMB 10,000, but the plaintiff's claim for deletion of the Ultraman material from the training set was not upheld, on the ground that the court could not ascertain that the defendant had actually used those works for training.
This brings out the most practical layer in China: a right holder seeking to win a claim against you at the training stage must first overcome the evidentiary hurdle. Model weights cannot be reverse-engineered, and if the dataset is not retained after training, even you may not be able to say clearly what was originally fed in. iQIYI filed suit against MiniMax in January 2025 in the Shanghai Xuhui District People's Court, claiming approximately RMB 100,000 and alleging precisely the unauthorized use of its copyrighted material for training; more than a year later, the matter remains in judicial proceedings. To date, China has no effective judgment finding that a large-model developer infringed copyright in its training corpus.
On the input side, the bill in China is collected through another channel
Anyone who reads this far and concludes that inputs in China can be taken freely is heading for trouble. The first lesson has not lost force in China; it is simply that a different party now comes to hold you to account.
The input side in China is not without rules; it is just that these rules are not triggered by right holders' lawsuits but are enforced by regulators. Article 7 of the Interim Measures for the Administration of Generative Artificial Intelligence Services makes lawful sourcing a statutory obligation of service providers:
Article 7 Generative artificial intelligence service providers (hereinafter referred to as providers) shall lawfully carry out training data processing activities such as pre-training and optimization training, and shall comply with the following provisions:
(1) use data and foundation models from lawful sources;
(2) where intellectual property is involved, not infringe the intellectual property rights lawfully enjoyed by others;
(3) where personal information is involved, obtain the individual's consent or satisfy other circumstances prescribed by laws and administrative regulations;
(4) take effective measures to improve the quality of training data and enhance the authenticity, accuracy, objectivity and diversity of training data;
(5) other relevant provisions of laws and administrative regulations such as the Cybersecurity Law of the People's Republic of China, the Data Security Law of the People's Republic of China and the Personal Information Protection Law of the People's Republic of China, and the relevant regulatory requirements of the competent authorities.
Article 19, paragraph 1, of the same regulation specifies what you must produce when you are inspected:
Article 19: Where the competent authorities conduct supervisory inspections of generative artificial intelligence services in accordance with their duties, providers shall cooperate in accordance with the law, explain as required the sources, scale, types, labeling rules, and algorithmic mechanisms of the training data, and provide necessary technical, data, and other support and assistance.
Taken together, the two articles mean something straightforward: where the source of the corpus is unlawful, in China this typically does not first result in a lawsuit brought by the rights holder; rather, it is first stopped at the checkpoint of filing, security assessment, and supervisory inspection, along the path of an order to correct, a warning and public notice, or an order to suspend services. National standards have already turned this into item-by-item verifiable indicators: GB/T 45654-2025 requires that open-source data follow the open-source license or be supported by authorization documents; self-collected data must have collection records and must not collect data that others have expressly prohibited from being collected; commercial data must be supported by a legally effective transaction contract, and data for which the counterparty cannot produce source-provenance materials should not be used.
As to whether fair use can save you: fair use in China is a closed enumeration. Article 24 of the Copyright Law lists twelve circumstances plus a catch-all for other circumstances provided by laws and administrative regulations. None of them mentions data mining or model training, and the general limitation also requires that the normal use of the work not be affected and that the lawful rights and interests of the copyright owner not be unreasonably harmed. It is a defense after being sued, not a pass before ingestion, and you certainly cannot use the permissive reasoning of Chinese courts to explain your downloading acts outside China.
Once the same batch of corpus leaves the country, the three jurisdictions stop you at different points
In the United States, the problem is money, and that is where the three lessons above originate. Pirated book repositories, cracked academic databases, and film and television resource sites are red-line sources, and the Anthropic case has already put an explicit price on such sources. Beyond that, there are two technical red lines independent of copyright: Section 1201 of the U.S. Digital Millennium Copyright Act prohibits circumventing technological measures that control access, so the act of a crawler bypassing a login or defeating verification may itself be a violation, regardless of whether the subsequent use is reasonable; Section 1202 prohibits intentionally removing copyright management information, so wiping out fields such as author and source during data cleaning may also give rise to a separate claim. Liability is also extending upstream: in November 2025, authors sued Together AI in the U.S. District Court for the Northern District of California, alleging that it copied the Books3 pirated book repository into the RedPajama open-source dataset and facilitated more than 190,000 third-party downloads. A party that passes something on cannot escape by saying "I was merely moving it."
In the European Union, the problem is disclosure. Article 53(1)(d) of the EU Artificial Intelligence Act requires providers of general-purpose AI models to publish, in accordance with the public summary template of the European AI Office, a sufficiently detailed summary of the training content, and use of the template is mandatory. On August 2, that is, next Sunday, the European AI Office's enforcement powers over this obligation formally commence, with penalties of up to 3% of global turnover for the preceding financial year or EUR 15 million, whichever is higher. The summary is required to list the top 10% most relevant domains in web-crawled data by data volume and to state whether an opt-out mechanism has been established. Looked at another way, this summary is effectively a rights-enforcement map that you hand to rights holders worldwide. The EU also recognizes prior reservations by rights holders: on November 11, 2025, the Regional Court of Munich I held in GEMA v. OpenAI that lyrics entering training data constituted reproduction and making available to the public, and that the text and data mining exception could not be invoked.
The same batch of corpus is an administrative issue in China, a money issue in the United States, and a disclosure issue in the European Union. If you must pass all three, prepare your records according to the strictest of the three.
Three jurisdictions
With the three lessons in hand, these are the things you should change
For model companies doing in-house pre-training, first compile a source list organized by batch, where each batch can answer where it came from, on what basis it can be used, who approved it, and when it was deleted. Red-line sources should be isolated where isolation is warranted, and records should be kept of both the isolation and deletion processes. When procuring corpus externally, contracts must include copyright warranties and full indemnification clauses, so that suppliers stand behind the lawfulness of the source. For those doing business in the EU market, preparation of the training-content summary should begin now; that document cannot be written the night before publication.
Companies engaged in fine-tuning and application-layer development, where the risks mainly lie at the output end and in user-uploaded materials. The reason the platform in the Medusa case was able to emerge unscathed was that it simultaneously did five things: its user agreement provided adequate notice; it conducted manual review before model release; it set up a reporting channel on every model page; it promptly deleted, blocked and disabled links after receiving notice; and it forwarded infringement notices to affiliated platforms with which data had been shared. This last item is the most easily overlooked: if you synchronize user-generated models or images to overseas sites or affiliated products, forwarding notices is your statutory ancillary obligation. Miss any one of these five, and you may slide from the Medusa side to the Hangzhou Ultraman side—in that case, the platform was found to have contributed to infringement and paid RMB 30,000 in damages.
Companies that sell corpora and provide data services, the Together case shows that upstream parties will be held liable separately. Your core asset is not the volume of data, but the authorization chain that can be produced behind each batch of data.
Client enterprises procuring models, lock down three things in the service agreement: the supplier's representations and warranties regarding the lawfulness of the sources of training data; the defense and indemnification arrangements in the event of infringement claims; and whether the data you input is used for training and how to turn that off. The national standard requires that the last item be reachable in no more than four clicks from the main service interface to the opt-out option, which can be directly verified at acceptance.
Conclusion
On May 23 of this year in Shenzhen, the first batch of 22 publishing, media, copyright and technology entities signed the Convention on the Construction of High-Quality Artificial Intelligence Corpora, establishing the principle of authorization before use, requiring that all text, charts, images, audio and video used for AI training obtain lawful copyright authorization in advance, and intending to introduce blockchain for full-process traceability. It is an industry self-regulation document, not law; you do not violate the law by not joining.
But it changed one thing: compliant corpora have begun to be available for purchase on the market. When lawful procurement channels objectively exist, the weight in court of the statement "we could not obtain authorization, so we could only crawl" will grow lighter year by year.
Back to the question at the beginning. The lesson Anthropic bought with USD 1.5 billion can, in the final analysis, be summed up in one sentence: that training itself is lawful does not mean the acquisition process was lawful; and the traces left by the act of acquisition are far clearer than the model weights, and are preserved for far longer. Your model is a black box; your download logs, procurement contracts and crawler configurations are not.
Sooner or later a meter must be installed at this intake of corpora. Installing it yourself in advance is a cost; retrofitting it after an investigation is a price. Anthropic has already paid this price list once on behalf of the entire industry.
If you are training your own model, doing vertical fine-tuning, or have on hand a batch of corpora whose sources are not entirely clear, and you are unsure where things will get stuck in the domestic market and in overseas markets respectively, you are welcome to talk with me. Clarifying the source ledger and the allocation of liability in contracts before launch will always be cheaper than patching things up after receiving a lawyer's letter.
