A Guide For Application Builders And Developers
Prepared by Shubhank Suman, AI, Privacy and IP Counsel
This note explains the Delhi High Court’s decision in ANI Media v. OpenAI for the people who build software.
1. What The Court Actually Decided
ANI is a news agency. It gathers and writes news, and sells it to subscriber news organizations. OpenAI runs ChatGPT. ANI’s complaint was that OpenAI used its news articles, without permission, in two different ways. The first was copying and storing the articles to train the models behind ChatGPT. The second was reproducing ANI’s articles inside the answers ChatGPT gives to users. ANI asked the Court, at an early stage, for a temporary order stopping OpenAI and directing it to delete ANI’s stored works, while the full case is fought out later.
On that first impression, the Court reached three conclusions. Storing ANI’s articles to train the models was not infringement, because it fell inside a user’s right in the Copyright Act called fair dealing. The answers ChatGPT produced did not copy ANI’s articles closely enough to infringe. And ANI could not show that the model had memorized its articles and was repeating them back. On that basis the Court refused the injunction. The lawsuit itself continues to trial.
Several important questions were deliberately left for that trial: who owns each individual article, whether answers built through live retrieval infringe, whether the internal steps of turning text into numbers count as copying, None of these is settled by this judgment. As per the current ruling:
What a builder may do | What a builder may not do |
|---|---|
|
|
What a builder may do | What a builder may not do |
|---|---|
| e.g. crawling from India, then storing in the US, still brings the Indian Act into play.
|
2. Where You Build Does Not Decide Which Law Applies
OpenAI argued that its servers, its training data and the entire training process sit outside India, and that the training claim should be severed and dismissed. The Court declined. Storage abroad, it held, is only the terminal step in a chain that begins with access to the works from India and their transmission from India, and the Act does not require the chain to be cut so that only the last link is examined. It added that a copyright owner may sue under Section 62(2) where it carries on business, that an interactive site collecting subscription fees from Indian users attracts Section 20 CPC, and that a forum selection clause in terms of use cannot waive a statutory remedy.
The assumption that hosting in a United States region, renting GPUs overseas, or routing inference through a foreign API insulates a product from Indian copyright law does not survive this reasoning. For most Indian teams the chain looks exactly as the Court described it: the crawler runs from, or is triggered from, an Indian machine, and the corpus is then pushed abroad. The reasoning also works in reverse, and helps a developer whose own content is taken.
3. Every Copy In The Pipeline Is A Reproduction
Section 14(a)(i), as amended in 1994, covers reproduction in any material form “including the storing of it in any medium by electronic means”. The Court held that the scope of this right is very wide, that the section draws no distinction between temporary and permanent storage, and that the purpose behind the storage is irrelevant at the stage of deciding whether Section 51 is engaged. Storing in order to train is still storing, and deleting the material after training does not undo the act.
Applied to an ordinary build, the crawl cache, the raw HTML in object storage, the cleaned text in a warehouse, the chunked passages in a database, the document store behind a vector index, and any copy kept for evaluation are each prima facie a reproduction. There is no useful argument that no copy was made, and no de minimis defence for an intermediate file. The whole of the defence therefore sits in Section 52(1)(a), and a pipeline should be designed so that the conditions of that provision are met.
4. The Conditions On Which Section 52(1)(a) Was Satisfied
The doctrinal findings are favourable. Section 52 is not a proviso or an exception to Section 51 but a user’s right that independently defines what a user may do, and it must receive a broad and liberal construction. Commercial motive does not defeat it: the legislature required non-commercial use expressly in Sections 52(1)(ad), (k)(ii), (l), (n) and (o), and that requirement is conspicuously absent from Section 52(1)(a). The word “private” extends beyond individuals to private entities, including companies. And through the doctrine of updating construction the Court held that “research” now reaches machine learning, because training involves screening and organising works, extracting from them, converting them into machine readable inputs, and iterating until the most probable statistical output is reached.
The holding nevertheless rests on one factual condition, and this is the sentence a builder should read most carefully. The Court found that the stored works sit in a closed space, accessible only to the models themselves, and never available to any human being for access or download, neither in natural language nor in tokenised form. That is precisely what distinguished the authorities ANI relied on. In Jiwan Publishing House and in TIPS Industries v. Wynk Music the defendant supplied the works onward to third parties, and the defence failed.
The operative line, in engineering terms, is human accessibility: the protection weakens or disappears wherever a person can reach the ingested material. In practice this happens through:
- an internal dataset browser, notebook or admin console over the scraped corpus;
- a support or engineering team able to query the raw text store for debugging;
- publishing or sharing the corpus, or circulating exports, backups or evaluation sets outside the closed system;
- a retrieval feature that returns the stored passage verbatim rather than a generated answer;
- a “view cached source” or offline reader that serves your copy instead of the publisher’s live page; Access control over the corpus is therefore not only an information security matter. It is the fact on which the copyright defence stood.
5. The Fairness Test, And Why A Narrow Product Is More Exposed Than A General One
Finding no uniform Indian test, and recording a broad consensus that the American four factor test does not apply here, the Court framed three factors for this case: whether the use is limited to training; whether it results in economic competition and prejudices the owner’s legitimate interests; and whether the functions performed serve the overall public interest.
Limited to training. This was satisfied because OpenAI placed documents showing that the models are not trained to reproduce or communicate the material, and because no instance of any other use was shown. A builder should be able to establish the same: what the corpus is, where it sits, how long it is kept, who can reach it, and what it is used for. Data lineage records are evidence, and their absence at an interim hearing is costly.
Economic competition. This is where most applications will be decided, and it should worry the current generation of quickly assembled products more than anything else in the judgment. The finding that ChatGPT is not a market substitute for ANI turned on an asymmetry: ANI runs a single line of business, news gathering and syndication, while ChatGPT performs many functions across content creation, research, translation, learning and summarising. The Court carried that asymmetry through the substantial reproduction analysis, the fairness test and the balance of convenience alike.
Reverse the asymmetry and the reasoning reverses with it. A product built on one publisher’s feed, or on a narrow class of sources, and doing broadly what those sources do, is a substitute in the way ChatGPT was found not to be. A summariser that delivers the day’s stories from a single agency, a research assistant built on one journal, a tool that reads subscription material on the user’s behalf, or a vertical assistant that reproduces the function of its source, sits on the wrong side of this factor even though the training conduct is identical. The general purpose defence is not portable to a vertical wrapper.
Two evidentiary points cut the same way. ANI led nothing beyond bare averments of lost subscribers or reduced revenue, and its own offer of a licence at USD 7.5 million showed the claim was quantifiable in money. A claimant who leads revenue evidence, and who has never priced a licence, presents a materially stronger case.
Public interest. The Court drew on the NITI Aayog paper of October 2025 and on domestic model development to hold that an injunction would harm the growth of AI and millions of Indian users. That factor is systemic rather than product specific, and a small application should not assume it carries the same weight for it.
7. Outputs: What Saved The Defendant, And What Will Not Save You
The memorisation case failed principally on the calendar. Training closed in April 2022 for GPT- 4 and April 2024 for GPT-4o, and every pleaded article was published between 9 August and 30 September 2024. A work absent from the corpus cannot have been memorised from it. That is a fact specific escape and it is not available to a builder whose corpus does contain the works in issue.
On the material actually examined, the Court found no substantial similarity. Applying R.G. Anand it compared the works as a whole rather than fragments, noted that ChatGPT supplied its own context and commentary, that even the titles differed materially, and that responses carried a reference to the source. It also characterised the second prompt, which used the word “exactly”, as adversarial and deliberately framed to manufacture reproduction.
Three things follow. Output side controls are legal controls, not product polish: deduplication of the corpus, limits on the length of any quoted passage, suppression of verbatim continuation, and periodic testing for regurgitation. Attribution and linking helped, and were treated as conveying unprotectable facts without appropriating protected expression; reproducing headlines and opening paragraphs is a different exercise, and the Court compared titles expressly. And GEMA v. OpenAI, where the Munich court enjoined verbatim reproduction of memorised lyrics on non-adversarial prompts, was distinguished on its facts, not rejected in principle. Where the source is dense, distinctive expression rather than reported fact, such as lyrics, poetry, literary text or copyrightable code, the memorisation risk is real and the higher threshold applied to news is not available. Prompt logs cut both ways: if a claimant needs a chain of engineered prompts to extract anything, the logs prove it.
8. Retrieval Augmented Generation Has Not Been Cleared
The observation that retrieval outputs did not infringe was made on a narrow ground, that they were not substantially similar, and it was made about a theory that had never been pleaded and was raised only in oral argument. Whether such outputs infringe was expressly reserved for trial, as was the question whether tokenisation and vectorisation amount to reproduction, adaptation or translation.
For anyone building retrieval today that is the live exposure. A retrieval pipeline holds an identifiable, addressable copy of the source text rather than a set of statistical weights, and it produces answers that sit much closer to the source than a trained model’s output does. Nothing here protects a retrieval product that returns long verbatim extracts, that indexes material obtained in breach of access controls, or that lets a user read the source through the application instead of at the source. The Court’s own description of acceptable behaviour, a system acting like an AI enabled search engine supplying summaries from multiple sources with references, is the shape such a product should take.
9. What You Can Safely Do, And Why
9.1 Crawl what is open to everyone The articles ANI complained about were sitting on its own public website, free to read, with nothing blocking access. The Court treated that as significant. Copyright still exists in a free public article -putting something online at no charge is not the same as handing everyone a licence to copy it, but the way the material is taken matters a great deal. OpenAI took the articles the way any ordinary visitor could: without logging in, without defeating a paywall, and without ignoring a “do not crawl” instruction. The Court also pointed out that ANI could have blocked OpenAI’s crawler and simply chose not to.
Illustration. A public recipe blog with no paywall, whose robots.txt permits crawling, is the safe case: fetching its pages the way a reader’s browser would is fine. If the same blog moves its recipes behind a “subscribers only” login and you script your way past it, you have left the safe zone, even though the words on the page are identical.
9.2 Keep internal copies, if no human can reach them This is the most important and least intuitive point in the whole judgment. Under the Copyright Act, making a copy, even a temporary one, even one you delete afterwards, is in principle a “reproduction”, and reproduction is one of the exclusive rights that belong to the owner. So every stage of an ordinary pipeline is, strictly speaking, a copy: the raw pages you cache, the cleaned-up text, the chunks, the vectors in your database. The Court accepted all of that. What saved OpenAI was the next step. Those copies lived inside a closed system that no person could open. They were used only by the machine, and were never shown to, or downloadable by, any human. That confinement is what brought the storage inside the fair-dealing right.
Illustration. A vector database that only your model queries at inference time is inside the safe zone. The moment you add an internal admin page where a support engineer can search and read the original scraped articles, you have opened the box, and the very feature that protected the storage is gone. The protection lived in the fact that no human could reach the text, not in the storage itself.
9.3 Build a paid product on it ANI argued that a defence meant for private use should not shelter a business making money at scale. The Court disagreed, and the reasoning is simple. Where the Copyright Act wants to limit a right to non-commercial use, it says so in plain words, and it does say so, in several other clauses. The clause OpenAI relied on contains no such limit. Because the legislature knew how to write “non-commercial” and chose not to here, a court will not read that limit in. Charging for the product does not, by itself, defeat the defence.
Illustration. A paid subscription assistant, or a metered developer API, is not disqualified simply because money changes hands, in the same way that a book reviewer paid for the review is still doing “criticism or review”, and a salaried journalist is still “reporting current events”. The commercial wrapper does not change the underlying purpose.
9.4 Rely on the research purpose as a company The defence covers “private or personal use, including research”. Two plain-language points unlock it for a builder. First, “private” is not limited to individuals; the Court held it reaches private entities, including companies. Second, “research” is not defined in the Act, and the Court applied a settled principle that old statutes are read to keep pace with new technology , known as updating construction , to hold that training a model is a form of research. Training studies the material, screens and organises it, and repeats the process until it produces something new; that, the Court said, is research in substance, even though it is done by a machine.
Illustration. A startup, not just a hobbyist, can rely on the research purpose. Training that reads, organises and learns from the material to build a new capability is treated like the research that precedes a paper, a product or a judgment, an internal step on the way to something new, rather than like simply republishing the source.
9.5 Summarise in your own words, with credit Copyright protects the particular words and arrangement an author chooses - the expression, not the facts or ideas underneath. An answer that conveys what happened, in the model’s own phrasing, with a pointer to the source, therefore takes the unprotected facts without taking the protected expression. When ANI put news questions to ChatGPT, the Court found the answers used their own wording and added their own context, rather than reproducing ANI’s sentences. It compared the two as whole pieces of text and found them materially different, even down to the headlines.
Illustration. “According to ANI, the Union Cabinet approved two new metro corridors,” followed by a link, is fine , it borrows the fact and credits the source. Pasting ANI’s exact headline and opening paragraph is not, that borrows the expression. The first is a summary; the second is a copy.
9.6 Reuse the underlying facts No one owns a fact. The first person to report that an event happened has discovered it, not created it, and cannot stop others from stating the same fact. The law goes one step further: where a fact can realistically be expressed in only one or two ways, even that limited expression is treated as unprotectable, because protecting it would hand someone a monopoly over the fact itself. For news, this makes the protected layer thin. What is capable of protection is the reporter’s particular composition, not the event being reported.
Illustration. That a cricketer’s mother praised a rival athlete is a fact anyone may repeat. The only thing capable of protection is the distinctive way ANI happened to write it -and only if it is genuinely distinctive rather than the obvious way to state the fact. Build on the facts freely; do not lift the sentences.
10. What You Cannot Do, Or Do Only At Real Risk
10.1 Break past any access barrier Everything in the previous section assumed the material was taken cleanly. If instead you get in by defeating a barrier -a login, a paywall, a rate limit, an anti-bot wall, or a robots.txt “do not crawl” instruction -two further bodies of law switch on that fair dealing does not answer. Getting around a technical lock can itself be an offence under the anti-circumvention sections of the Copyright Act (Sections 65A and 65B), and gaining unauthorised access to a computer resource engages the Information Technology Act (Sections 43 and 66). Section 52 is a defence to a copyright claim only; it says nothing about either of these.
Illustration. A United States court in the Anthropic case drew this exact line: scanning books the company had lawfully bought was acceptable, but taking the same books from pirated “shadow libraries” was not. Same text, different route in, opposite result. How you obtained the copy can matter as much as what you did with it.
10.2 Let a human reach the stored copy This is the mirror image of point 3.2, and the single sentence most worth remembering. The storage defence held only because no person could reach the corpus. The Indian cases ANI relied on, where the defence failed, were all cases where the defendant passed the material on to other people -a photocopy shop supplying copies, a music service streaming songs to listeners. The moment a human can open your store, the feature that protected it is gone.
Illustration. Publishing your training set to a public model hub, exporting it to a labelling vendor, letting staff browse the raw scraped text to debug an issue, or adding a “view cached original” button to your product are all ways of putting the material in front of a person. Each one quietly converts a protected internal process into something that looks like distribution, and takes the defence with it.
10.3 Build something that stands in for the source A central reason OpenAI won on the news articles is that ChatGPT is not a substitute for ANI. ANI does one thing, gather and syndicate news. ChatGPT does many things across writing, research, translation and more, and on news it gives a short, credited summary rather than the article itself. Because the two do not compete head-on, the use did not take ANI’s market. That single finding ran through the whole judgment. Now reverse it: a product built on a narrow set of sources, doing the same job those sources do, is a substitute in exactly the way ChatGPT was found not to be, and the reasoning that protected OpenAI turns against you.
Illustration. A general assistant that occasionally summarises a news item with a link sits where ChatGPT sat. An app whose whole purpose is to serve one agency’s daily headlines, so that users never open that agency’s website, competes with it directly. The “no market harm” point that protected OpenAI would then point the other way. The broad, general-purpose defence does not carry over to a narrow wrapper around a single source.
10.4 Give the source’s own words back to users Two distinct risks live here. The first is substantial reproduction: an output that reproduces the source’s actual wording, a headline, an opening paragraph, a long extract, can infringe even if the surrounding text is original. The second is memorisation: if a model has absorbed a work so completely that it can recite it, and does so on an ordinary prompt, that is reproduction too. ANI lost on both, but only on its particular facts , the articles were published after training had closed, so they were never in the model to begin with. A German court, in the GEMA case, did grant an injunction where song lyrics had genuinely been memorised and repeated word for word. The lesson is that dense, distinctive material, lyrics, poetry, literary prose, source code -carries a real memorisation risk, and the “news is mostly facts” cushion that helped OpenAI is not available there.
Illustration. An answer that restates a story in fresh words is safe; one that returns ANI’s exact headline is not. A model that, asked an innocent question, reproduces a copyrighted poem in full has reproduced it, however the words were “learned”. Output-side controls — removing duplicate copies from the training set, capping how much of any source can be quoted, blocking verbatim continuation, and testing for regurgitation — are legal safeguards, not merely product polish.
10.5 Treat retrieval and storage mechanics as settled law Some of the points that went OpenAI’s way did so only because they were not properly before the Court, which expressly left them for trial. Retrieval-augmented generation — where the application fetches live text from a source at the moment of the question and answers from it — was never formally pleaded, so its lawfulness is undecided. So is the separate question of whether turning text into tokens and vectors is itself a form of copying, adaptation or translation. A retrieval system is inherently riskier than a trained model, because it keeps an actual, addressable copy of the source, and its answers sit much closer to that source than a trained model’s do.
Illustration. A retrieval assistant that pulls a paragraph from a publisher’s live page and returns most of it, lightly reworded, is precisely the untested case. Nothing in this judgment clears it, and a future court could readily see it as ordinary copying. Design a retrieval product to summarise and link, in the shape of a search engine, rather than to relay the source’s text.
10.6 Treat foreign servers as a shield from Indian law OpenAI argued that because its servers, its data and its entire training process sit abroad, the Indian Copyright Act should not reach the training at all. The Court refused. It looked at the whole chain of events -the articles are accessed from India, transmitted from India, and only then stored abroad -and held that the last, offshore step does not put the conduct beyond Indian law. It also confirmed that India was the right place to sue: a copyright owner can sue where it carries on business, an interactive website that takes money from Indian users is enough of a connection, and a clause in the terms of use sending all disputes to San Francisco cannot remove a statutory right to sue in India.
Illustration. If your crawler runs from, or is triggered from, an Indian machine and the dataset is then pushed to a cloud bucket in the United States, the fact that the bucket sits in Oregon does not move the case out of India. The same reasoning helps you in reverse: if someone abroad scrapes your Indian website, you can sue them at home rather than having to chase them overseas.
10.7 Borrow United States “fair use” reasoning Much of the American writing on AI and copyright is framed around “fair use” and a four-factor test drawn from Section 107 of the US statute. India does not have fair use. It has fair dealing, a narrower, list-based right in Section 52 of its own Act, which applies only to specific listed purposes. An Indian court has held that decisions applying the US four-factor test carry no persuasive value here. American cases can be cited for colour or for a factual analogy, but the operative test is always the Indian one.
Illustration. A due-diligence memo that concludes “this is fair use, see the US cases” is answering the wrong question. The question in India is whether the use fits one of the specific purposes in Section 52(1)(a) -here, research -and whether it is fair. That is the analysis this judgment actually carried out, and it is the analysis a builder’s own assessment should follow.
10.8 Overlook the contract and data-protection layers Winning on copyright does not clear the other layers of exposure, and this is the most common blind spot in quickly assembled products. Three separate layers sit alongside copyright and are untouched by this judgment. The first is contract: a website’s terms of use, an API’s terms, and a model provider’s terms all bind you regardless of copyright, and scraping in breach of stated terms, or using a hosted model against its terms, remains actionable. Section 52 is a defence to copyright infringement, not to breaking a contract. The second is data protection: news is full of personal data, and the Digital Personal Data Protection Act, 2023 has no “legitimate interest” basis and only a narrow carve-out for personal data that the individual themselves made public -which does not obviously cover a person’s details published by a news agency. Large-scale scraping for training is a separate, unresolved privacy exposure. The third is false attribution:
presenting invented or altered text as coming from a publisher can be passing off, so any citation feature must reflect what the source actually said.
Illustration. You may hold a strong copyright position and still be sued on any of three other grounds: for breaching a site’s terms of service, for processing personal data without a lawful basis under the DPDP Act, or for a citation feature that puts words in a publisher’s mouth. These are three different doors into the same building, and this judgment locks only the copyright door.
11. What The Judgment Leaves Open
Because this was an early, first-impression decision, a great deal remains genuinely undecided and will be resolved only at trial on evidence: who owns each individual article; whether answers built through live retrieval infringe; whether tokenisation and vectorisation amount to copying, adaptation or translation; whether the models keep the full original text; and any properly proven instance of memorisation. The safest way to use the judgment is therefore as a design standard -a description of what a court found acceptable on one clean set of facts , rather than as a clearance certificate. A product that matches those facts stands where OpenAI stood; a product that departs from them does not carry the protection with it.
One further limit deserves emphasis. The comfort in this judgment rested heavily on the fact that news is largely fact, and facts are not owned. That cushion does not exist for other kinds of material. Images, music, video and software carry a much thicker layer of protectable expression, so the same training and output conduct that passed here could be judged quite differently when the source is a photograph, a song, a film or a codebase.
12. The Record Worth Keeping Before A Dispute
This case was decided on what was actually on the file. ANI lost partly because the evidence it needed -proof that OpenAI’s activity had cost it subscribers or revenue -was never placed on record, while OpenAI filed documents explaining how its models are trained and handed over an unrebutted note on each example. The practical lesson is that the following should exist before a notice ever arrives, not be assembled afterwards:
1. A source register: every domain crawled, the dates, the volume taken, the robots.txt position at the time, and where each third-party dataset came from.
2. Crawl Logs Showing That Robots.Txt Was Fetched And Honoured And That No Login, Paywall Or Anti-Bot Measure Was Bypassed.
3. A Short Written Statement Of What The Corpus Is For, And Evidence That It Has Been Used Only For That Purpose.
4. Access Controls And An Access Log For The Corpus, Capable Of Showing That No Human Can Retrieve Or Download The Stored Text.
5. A Retention And Deletion Schedule, And Evidence That It Is Actually Applied.
6. Output-side controls under version control: duplicate removal, quoted-length limits, verbatim suppression, and regurgitation test results.