| Rule | What it provides | Numeric deadline | Source |
|---|---|---|---|
| US hosting shelter | No liability if, among other conditions, the host acts promptly after a notice: a condition, not a duty. Failing it does not count against the host’s other defences | None: act promptly | 17 U.S.C. § 512(c)(1)(A) to (C) and § 512(l) |
| US notice | 6 mandatory elements; a notice that does not substantially comply is disregarded when assessing what the host knew | None | 17 U.S.C. § 512(c)(3)(A)(i) to (vi) and (c)(3)(B) |
| US subpoena | The recipient of a properly issued subpoena must disclose the information required, whether or not it acted on a notice. Our sources do not show it reaching a host outside the US | None | 17 U.S.C. § 512(h)(1), (5) and (6) |
| False notice | Knowingly and materially misrepresenting that material is infringing makes whoever does so liable for the damages, costs and fees incurred | Not applicable | 17 U.S.C. § 512(f) |
| EU scope | Applies wherever a service is offered to recipients in the Union, whatever the host’s place of establishment; neither displaces § 512 nor makes it applicable | Not applicable | Regulation (EU) 2022/2065, art. 2(1) |
| EU notice and actual knowledge | Hosts operate a notice mechanism; a notice creates actual knowledge only if a diligent host can identify the illegality without a detailed legal examination | None for copyright | Regulation (EU) 2022/2065, art. 16(1) to (6); CJEU, 22 June 2021, joined cases C-682/18 and C-683/18, under Directive 2000/31/EC, art. 14(1) |
| EU terrorist content | Removal following an authority’s removal order | 1 hour | Regulation (EU) 2021/784, art. 3(3) |
| Romania, implementing norms | Inform the authorities after a complaint: a reporting duty, not a removal deadline. The norms refer to articles repealed since 18 April 2024 | 24 hours (reporting) | Norms approved by HG nr. 1308/2002, art. 11 |
| Romania, e-commerce law | Inform the authorities of apparently illegal activity, disclose on request data identifying hosting customers, interrupt service on an authority’s order | None; informing is due without delay | Legea nr. 365/2002, art. 16(1) to (6) |
The DMCA is a liability shelter, not a takedown order
The DMCA is a US federal law of 28 October 1998 (Public Law 105-304). Its title II inserted section 512 into title 17 of the US Code, which limits liability for 4 technical functions, hosting among them. Each limb is built the same way: a provider is not liable if certain conditions are met. Acting promptly after a notice is one of those conditions, and § 512(l) adds that failing them does not count against the provider’s other defences.
Section 512 does impose some things: the recipient of a properly issued subpoena must disclose the information required, whether or not it acted on a notice, and the text provides for injunctions that bind the provider. A US notice has 6 mandatory elements; one that does not substantially comply is disregarded when assessing what the provider knew. Whether a host established outside the US can invoke § 512 is settled by no text we read.
EU law: who it covers and when a notice counts
In the EU the framework is the Digital Services Act, Regulation (EU) 2022/2065. It applies wherever a service is offered to recipients in the Union, whatever the provider’s place of establishment, and neither displaces § 512 nor makes it applicable. A notice gives rise to actual knowledge only where it lets a diligent provider identify the illegality without a detailed legal examination, as the Court of Justice held on 22 June 2021 (joined cases C-682/18 and C-683/18) under the e-commerce directive provision the regulation replaced.
Losing the hosting exemption is not a finding of liability: an inactive host is exposed to the ordinary law, not to an automatic judgment. What the regime does sanction is how notices are handled: the administrative fine is capped at 6% of worldwide annual turnover and depends on no court decision. For copyright, the article 16 notice mechanism sets no numeric deadline.
Romania, Finland, Iceland: what national law adds
Where the servers are determines neither the applicable law nor the competent authority, but national regimes differ. Of the three server countries whose law we read, Romania has the announced regime least favourable to the host: it kept duties the Union regime does not impose, namely informing the authorities without delay of apparently illegal activity, disclosing on request data identifying hosting customers, and interrupting service on an authority’s order. Its implementing norms add informing the authorities within 24 hours of a complaint, but refer to articles repealed since 18 April 2024; no source we consulted shows whether they were adapted.
Finland repealed its national copyright-specific procedure on 17 February 2024: only a requirement to act promptly remains, compelled removals go through the courts, and we verified no published decision applying those orders to a host. Iceland repealed its copyright notice procedure in 2019, and the DSA is not applicable there as our sources stand, for want of an EEA Joint Committee decision; that finding rests on a single source, the Icelandic Ministry for Foreign Affairs’ European affairs database, consulted on 7 September 2026. There, an interim court prohibition, the lögbann, can bar a host from hosting data without it being liable.
Which of the 15 offshore hosts stayed online under real notices
The test ran from March 1, 2026 to September 1, 2026. The testers sent no notices: rights holders and their automated systems sent 80 to 100 per VPS over the full period, fewer to hosts that fell early. Six hosts ended service after a copyright notice: PrivateAlps at notice no. 8, HostSailor at no. 6, FlokiNET at no. 2, AlexHost at no. 2, 1984 Hosting at no. 1 and HostHatch at no. 1. Three stopped for other reasons. According to the testers’ record, 6 were active at the end: TLDBunker, HushVPS, VPSDEN, NimbusVPS, XmrCloud, EchelonVPS (TLDBunker’s commercial opening is unconfirmed).
Where it is established, the server country separated nothing: FlokiNET and 1984 Hosting, both with servers recorded in Iceland, fell at notices no. 2 and no. 1, while PrivateAlps, with a server in Switzerland, lasted until no. 8. The record gives a server country for only four hosts, and our legal analysis does not cover Switzerland yet. What was measured is continuity of service, not notice handling: survival does not prove the notices were legally effective, since automated messages may never have reached the actual-knowledge threshold, and the test cannot tell the two causes apart.
What the hosts publish, and who can learn your identity
Published policies, read on 7 September 2026, describe intent, not behaviour. Of the 6 hosts active at the end, three state a non-action position, each with limits: VPSDEN forwards notices to the customer and acts only on a local court decision, with regional exceptions including a reporting channel for its EU locations; NimbusVPS says 4 of its 8 locations do not act on a US copyright notice, while its 3 EU sites examine notices on the merits; XmrCloud says US-format notices get no action and that it acts only on a competent court’s decision in Iceland or Romania, in a policy marked as a draft. EchelonVPS says the US shelter does not apply to it in law and that it voluntarily applies an equivalent procedure, giving the customer 24 hours to reply.
On identity, AlexHost’s published contract is explicit: article 9.3 provides for giving the subscriber’s name, address and contact details to the complainant, which its reporting page does not say. It is a clause read after the test, not an observed disclosure; AlexHost was cut off at notice no. 2. VPSDEN’s policy describes the opposite flow, redacting the complainant’s details when it forwards a notice. Across the 15 hosts, 5 publish no copyright policy and none publishes how many notices it received over a defined period.
Frequently asked questions
Does the DMCA apply outside the US?
Not as such. The DMCA is a US federal law; used as the name of a universal procedure, it has no legal counterpart outside the United States. For services offered in the EU, notices fall under the Digital Services Act, which neither displaces § 512 nor makes it applicable, and whether a foreign host can invoke § 512 is settled by no text we read.
Does a host have to remove content within 24 or 48 hours?
No text we verified sets a 24- or 48-hour removal deadline. The only numeric removal deadline in EU law is 1 hour, for terrorist content, from an authority’s removal order (Regulation (EU) 2021/784, art. 3(3)). Romania’s 24 hours, in norms referring to articles repealed since 18 April 2024, are for informing the authorities after a complaint, not for removal. The 24 hours EchelonVPS gives a customer to reply come from its published policy, not from the law.
Can a rights holder get my name and address from my host?
Our sources point to three routes: a properly issued US subpoena under § 512(h), which they do not show reaching a host outside the US; for a host under Romanian law, the duty to disclose on request data identifying hosting customers; and contract clauses such as AlexHost’s article 9.3, which provides for giving the subscriber’s name, address and contact details to the complainant. Our test record does not track what hosts did with each notice, so none of these routes was observed.
Does the DSA apply to a host based outside the EU?
Yes, if it offers its service to recipients in the Union: article 2(1) of Regulation (EU) 2022/2065 applies whatever the provider’s place of establishment. Such a provider designates a legal representative in writing in a Member State; without one, every Member State gains supervisory powers. Iceland is a separate case: it applies a Union text only after an EEA Joint Committee decision, and as our sources stand none has been taken for the DSA, a finding resting on a single source.
Which offshore hosts say they ignore DMCA notices?
Of the 6 hosts active at the end of our 6-month test, VPSDEN, NimbusVPS and XmrCloud publish a non-action position; the first two make exceptions by location, including EU sites, and XmrCloud’s policy is marked as a draft. PrivateAlps, whose site read after the test says “Fully DMCA Ignored”, was cut off at notice no. 8: the label is a stated position, not a guarantee.