TDM registry: effective optout through content-based fingerprinting technologies

Any suggestion that copyright might be linked in any way to a registry is enough to raise concerns amongst legal scholars and rightsholders. Yet, notwithstanding the questionable choice of term - one could just as readily call it a 'directory' - a digital ledger that uses modern, content-based fingerprinting technologies appears to offer undeniable advantages in the era of global-scale processing for AI, compared with traditional metadata-based signals.

The European Commission has just published the results of a year-long feasibility study on a registry for optouts from text and data mining (TDM). The study examines whether - and under what conditions - such a registry could make the expression and detection of rights reservations under Article 4(3) DSM Directive more effective and unambiguous. The registry would be introduced as a complementary means to express the optout alongside existing methods, ultimately leaving to rightsholders the choice of the most appropriate means for their specific case.

Broadly speaking, the study addresses two main questions: can a registry-based system help resolve some of the challenges rights holders face in expressing the TDM opt-out, and what technical characteristics should such a system have?

In this text, I will focus on content-based fingerprinting technologies and their - so I argue - unmatched potential to enhance the effectiveness of optout under Article 4(3) DSM. The Commission study of course ranges well beyond this specific topic, also addressing technical architectures, governance options, redress and dispute‑resolution workflows, and indicative cost scenarios. For those broader questions—and the study’s full reasoning and underlying assumptions—I invite readers to consult the report itself.

The study reflects the European Union's effort in keeping a balanced approach to promoting digital innovation while safeguarding copyright, grounded primarily in the TDM exception introduced by the 2019 DSM Directive. The exception is accompanied by a rights-reservation mechanism (the 'optout') which allows rightsholders to exclude their works from the exception by signalling their reservation in an appropriate manner. Leaving broader policy considerations beyond the scope of this text, it is worth noting that the European legislator has taken the view that Article 4 of the Directive and its optout mechanism are relevant to artificial intelligence (AI), as confirmed by the explicit reference to this provision in the AI Act. Indeed, the development of general-purpose AI models requires processing vast amounts of text, images, videos and other data - much of which is protected by copyright.

From the outset, the decision to introduce an optout from a copyright exception raised concerns about its practical implementation. Rightsholders pointed in particular to the lack of readily available machine-readable means to express their optout and - crucially, in my view - to the difficulty of attaching relevant metadata to content that has already been distributed and is no longer materially within their control. Although new protocols and attachment mechanisms are being developed (and will continue to be), this loss of control remains hard to tackle via traditional metadata embedding. Rightsholders therefore face what appears to be an intractable predicament: digital content can replicate at will, stripped of metadata, and resurface anywhere else across the web's high seas. AI developers, on the other hand, lament the legal uncertainty created by multiple non-standardised (and possibly conflicting) signals.

That said, this is precisely where content-based digital fingerprinting technologies offer a distinct advantage. By identifying works through intrinsic features of the content—rather than relying on embedded metadata that can be stripped or lost—these technologies can help rightsholders signal reservations more robustly and AI developers detect them more reliably at scale.

Think of it as a DNA sequence for digital files: content-based fingerprints typically use deterministic algorithms to compute a unique "signature" from a file's actual content. Because the signature is computed from the file, rather than being attached to it, the fingerprint cannot be removed, changed or otherwise altered during copying, reformatting, or redistribution (a common issue at web scale). For what matters here, these fingerprints provide a stable content-derived “handle” that can be queried against a registry (aha!) to re-associate metadata information even when other signals are missing. In effect, this is a persistent link between content and its metadata.

One may argue that the study’s interest in a registry lies less in the registry concept as such than in the role that a registry naturally plays in supporting the underlying fingerprinting technology, its core feature and identified in the study in the International Standard Content Code (ISCC).

The ISCC (an ISO standard since 2024) is an open-source technology that "enables the identification, attribution, and management of digital content across various platforms and industries". Characteristic of the ISCC is that it generates a composite fingerprint with multiple layers stacked together, including a meta-code capturing descriptive metadata where available, a content-code which is the content-based fingerprint itself, a data-code representing a hash of the raw file bytes, a semantic-code for semantic similarity and an instance-code for data integrity.

A free toolkit built on top of the raw iscc-core algorithms is available via the official Git repository. The toolkit is batteries included and provides high-level ISCC functionality for processing different media types and implementing ISCC-based workflows in Python applications. For the non-Pythonistas, the ISCC Foundation has also released a high-performance Rust implementation, with bindings for multiple programming languages, available on this website. The WebAssembly build, in particular, enables ISCC handling in the browser - thus for example, enabling ISCC codes to be generated locally without the need to upload files on third-party back-end servers.

In my view, the main selling point of these fingerprinting technologies is their ability to link optout information to digital content which rightsholders no longer control, for example because it has already been distributed to third parties. This is where these fingerprints shine: they allow rightsholders to propagate instantaneously any information declared centrally via the registry to every instance of the same file, regardless of where it is or who holds it. Moreover, optout signals expressed this way are dynamic, which means rightsholders could even change their optout preferences over time simply by updating the registry - something that becomes excessively challenging when the optout is instead embedded in a file that has already been distributed.

Besides persistence and reach, another key advantage of layered fingerprints like ISCC is their robustness to transformation. They can detect the same work despite format changes, compression, cropping, and minor edits.

Of course, many sectors of the creative industries have long adopted their own unique assigned identifiers such as ISBNfor books or ISRC in the music sector. In this regard, the study clarifies that those assigned identifiers remain authoritative for identification and metadata interoperability within the pipelines of the creative industries and co-exist in the registry alongside the ISCC. In fact, besides ISCC signatures and optout information, the data model of the registry could extend to any relevant metadata, including sector identifiers. However, ISCC will fill the gap where those identifiers are not available, whatever the reason may be. This way, for example, opting out via the registry remains available to all rightsholders, from individual creators to large organisations. Moreover, the availability of rich metadata records could in the future support a wider digital copyright infrastructure enabling services beyond the mere rights reservations, for example those needed to set up a licensing marketplace.

Optouts via the registry involve two separate processes: an expression workflow and a detection workflow. Each consists of three basic steps, all of which can be carried out as part of a fully automated process:

• Expression: compute the ISCC signature, create a registry record, express the optout

• Detection: obtain content, compute the ISCC signature, check against the registry

Records are created in the registry via onboarding workflows. These could be organised with varying degrees of automation and integration, for example on account of relevant databases and existing management structures in use by the creative industries. In general, however, the study is clear in establishing that onboarding should be available to any rightsholder regardless of whether metadata is imported in bulk through dedicated API or instead added manually using front-end forms.

As to the detection workflows, these should primarily operate via APIs, considering the needs reported by AI developers in the study for scalability, automation and the need to integrate checks into large-scale technical systems without creating latency or excessive costs. It could help to conceptualise the detection workflow as a digital sieve that - given a basket of content identifiers - filters out those on which an optout has been declared. This binary (true/false) behaviour is of course a gross oversimplification, as detection pipelines are likely to require more elaborate responses from the registry APIs.

For the sake of completion, the study also describes a second detection workflow linked to source-level exclusions, which would operate a pre‑retrieval filtering to exclude web sources that have declared opt‑outs before they are crawled. This optout implementation does not rely on ISCC and would be akin to source-based signals performed via the Robots Exclusion Protocol (robot.txt) or other emerging dedicated reservation protocols such as TDMRep.

None of this is to suggest that a registry-based opt-out is a silver bullet, and indeed that was never the objective of the study. Rightsholders may continue to rely on embedded signals, or source-level exclusions, and in some contexts those tools will remain the most practical and proportionate choice. But as the study makes clear, a registry paired with content-based fingerprinting can play a valuable complementary role where opt-out information (and any other metadata, really) is hard to make stick: at web scale, across copies that have travelled beyond a rightsholder’s control, and for works that are frequently reformatted, reposted, or stripped of metadata.

The feasibility study now gives the Commission a concrete technical and governance picture, and it is for the Commission—on the basis of that evidence—to decide whether, and how, to take the next step.

Disclaimer

The information and views set out in this article are those of the author and do not necessarily reflect the official opinion of the European Commission.