Sony BMG CD Copy-Protection Controversy

Region

United States; United Kingdom

Associated With

Sony BMG Music Entertainment - United States music-CD distributor

Defining Feature

XCP and MediaMax CD copy-protection software

Status

Historical event - regulatory settlements and FTC order

Overview

Sony BMG’s CD copy-protection programme began with a predecessor’s MediaMax discs in 2003 and expanded in 2005.

The earlier discs used MediaMax 3.0. Sony BMG introduced MediaMax 5.0 in January 2005 and XCP that April. These systems controlled computer playback and restricted copying or transfer. They also caused different problems: XCP concealed files on users’ computers, while the FTC alleged that MediaMax 5.0 installed some files even when users declined its licence agreement.

A 2007 FTC order required clearer disclosures, consent safeguards, removal tools, a MediaMax 5.0 patch and remedies for affected consumers.

Why It Mattered

A music CD could bring more than an album onto a computer. Software bundled with the purchase could restrict how buyers used their music, conceal files or leave components installed without agreement. The controversy exposed the consequences of enforcing copy protection on customers’ own machines, making disclosure, meaningful consent and reliable removal central to the story.

Release Chronology and Separate Systems

• The FTC complaint alleged MediaMax 3.0 CD distribution from 2003, MediaMax 5.0 sales from January 2005 and XCP sales from April 2005.
• California’s complaint alleged that MediaMax 5.0 releases began in May 2005; the January and May formulations remain unreconciled.
• A preserved settlement agreement describes MediaMax as SunnComm-designed and XCP as an F4I-designed system, both licensed to Sony BMG.

Computer Playback and Security

• The FTC alleged that some CDs installed additional computer-playback software and imposed copying or transfer limits.
• It separately alleged that XCP cloaked files and that some MediaMax 5.0 files installed even after a user refused the licence agreement.
• CERT documented weaknesses in the XCP removal process and a separate MediaMax privilege-elevation vulnerability.

Regulatory Response

• California announced a settlement with Sony BMG on 19 December 2006, describing restitution, civil penalties and injunctions.
• The FTC issued its Decision and Order on 28 June 2007, requiring specified disclosures, consent safeguards, removal tools and a MediaMax 5.0 patch.
• The order also set notice, exchange and compensation remedies; it imposed obligations rather than deciding every allegation in the FTC complaint.

Gallery