For $3.75 a month a reporter put an AI generated track onto the Spotify page of a working Brooklyn punk band, having supplied nothing but the band's name. In the same fortnight Universal told a Delaware court that one distributor delivered nearly twelve million tracks to a single streaming service in six months, ten distribution agreements were read at source and three of them turned out to carry no date whatsoever. An English judge ordered an interim payment of £1.4 million to a British label whose catalogue had stalled because nobody downstream could establish who was entitled to licence it. Europe meanwhile passed eight months without publishing the list of machine readable means by which a rights holder is now obliged to reserve its rights. None of this is fraud and none of it is carelessness. It is an industry writing obligations into fields that nobody checks.
Streaming Platforms
An Artist Profile Turns Out To Be A Free Text Field. Proving It Cost $3.75.
On 17 September Emanuel Maiberg of 404 Media published an account of uploading an AI generated track to the verified Spotify page of Lathe of Heaven, a Brooklyn punk band with no involvement in it of any kind. The track was made with Udio, titled Riding High and delivered through DistroKid. It then propagated to Apple Music, Tidal and Amazon Music. Plagiarism Today's write up four days later records the mechanics that matter: the plan cost $3.75 a month, the band was already recognised in the upload flow so all he had to do was select it, with no IPI number required at any point.
Signal 004 led on the allegation inside Universal's complaint against DistroKid, that a counterfeit recording had been delivered carrying the real ISRC of a legitimate master. This is the same attack surface demonstrated deliberately, by a named journalist, against a named band, which is worse than the complaint describes because no identifier was needed at all. Artist identity in the delivery chain is not a credential and not a verified claim. It is a string that gets matched, so whoever types it first gets attached to the discography.
Nobody stole an identifier. There was nothing to steal, because the field was open.
Scale is what turns a stunt into a structural problem. Universal's stamped complaint, filed in the District of Delaware on 15 September, says that in the past six months DistroKid distributed "nearly twelve million tracks total to that same Digital Service", which it puts at "over half of all tracks delivered to the Service and more than all other distributors combined". The complaint does not name the service. Whatever the litigation eventually decides, the arithmetic is not in dispute and it describes an intake queue no human reviews, running through an onboarding process that took one reporter's card without a question.
The first consequence for an independent label is that the catalogue an artist appears to have is not controlled by whoever owns the recordings in it. A discography page is an assertion by whoever last delivered against that name, which makes profile monitoring a rights administration task rather than a marketing one. If you do not hold the verified profile for your own artists, your only route to object is the same takedown queue as everybody else, queueing behind the person who put the track there.
The second is harder and worth saying plainly, because it cuts against the advice this newsletter usually gives. You cannot fix this with your own metadata discipline. The defect sits in what a distributor accepts at ingest from somebody who is not you, which is precisely the argument behind the IMPALA verification commitments Signal 004 covered and precisely why the absence of the largest artist facing distributors from that list matters. What is left inside your own control is small but worth doing this week: claim and hold the verified profile for every artist you release, put a standing check on each artist's release list rather than on your own delivery log, then keep a dated record of what you actually delivered so that when something appears that you did not send, you can show the difference rather than argue about it.
Sources: 404 Media, 17 September 2026 (partly paywalled) · Engadget · Plagiarism Today, on the upload mechanics · Stamped complaint, UMG Recordings and others v DistroKid and others, D. Del., filed 15 September 2026
Label Operations
Ten Distribution Agreements Read At Source. One Of Them Grants Itself An AI Training Licence And The Opt Out Is A Google Form.
Nobody reports distributor terms of service, because reading a contract page is not an event. So we read ten of them this week, at source, writing down the dates. TuneCore was last revised on 31 July 2026. Too Lost carries an effective date of 10 August 2026, Bandcamp 7 May 2026, UnitedMasters 1 May 2026, Symphonic 15 January 2026, DistroKid "as of September 1, 2024" and ONErpm 22 November 2020. LANDR, RouteNote and Ditto publish no date at all. That spread is the finding on its own: the document governing what you warrant about your own uploads may predate generative music entirely, while at three of the ten you cannot establish from the published page when your obligations last changed.
The document that should stop an independent label in its tracks is UnitedMasters'. Inside terms whose own effective date is 1 May 2026 sits a clause reading "Effective [September 8, 2026], the following applies to User Content and Masters you upload to the platform on or after that date", square brackets included. What follows grants the company rights to "train, develop, test, validate, and improve machine learning and artificial intelligence models", to "deploy, commercialize, license, sublicense, and distribute any models trained" and to "license your User Content, including Masters, to third parties". Output replicating a specific identifiable individual's voice, name or likeness is carved out and needs separate written consent. There is an opt out, which runs through a Google Form, though it does not reach moderation, fraud detection or content identification, which the clause says "are integral to platform operation and legal compliance and are not subject to opt-out".
A prospective clause that bites only on new uploads means the date you delivered a record decides which rights regime it sits under. Most catalogues have no idea what that date was.
The other end of the range is just as instructive. Bandcamp has written the opposite promise into its terms, undertaking that it "will not use, and will not permit others to use, any Artist's Music to train models to generate sound recordings" and related works without the artist's express permission. Too Lost has the most developed protective clause found anywhere, at 7.3(a), barring any unauthorised replica or impersonation of "the voice, name, image, likeness, persona, identity" of a living or deceased person, with 7.3(c) reserving the right to demand "evidence satisfactory to Company of all necessary rights, licenses, consents, permissions, and authorizations" and remedies running to account termination and permanent retention of gross receipts. Symphonic requires, in four words that will cause more arguments than the rest of this paragraph combined, that a label "clearly disclose any AI-generated, AI-assisted, or synthetic media". LANDR runs an opt in programme gated on the contributor owning 100 per cent of all rights, which excludes essentially every label signed master. Its terms then concede the thing every other opt out leaves unsaid: a contribution can only be removed from a model "when that model is next retrained from scratch", with no guarantee that will happen "within any specific timeframe, or at all".
Three things follow. The AI question has moved out of platform policy and into the distribution agreement, where the consequence of getting it wrong is termination and withheld income rather than a metadata flag. The grant now travels in both directions, so a distribution contract is as likely to be the instrument by which a training licence is given as the instrument by which one is refused. And an opt out delivered through a form is an administrative task somebody has to remember to complete, per account, rather than a protection that operates by itself. The job this week is unglamorous and takes an afternoon: open the terms page for whoever distributes you, find the date on it, find the AI clause, then establish whether anything you released after a given day now sits under a grant you did not negotiate.
Sources, all primary and read on 28 September 2026: UnitedMasters · Too Lost · Bandcamp · Symphonic · LANDR · TuneCore · DistroKid · ONErpm · RouteNote · Ditto Music
Metadata & Standards
Europe Requires You To Reserve Your Rights By Machine Readable Means. Eight Months On, Nobody Has Said Which Means Count.
The lever that decides whether a European rights holder can keep its catalogue out of an AI training run is a machine readable reservation. The Commission's consultation on which protocols actually qualify closed on 23 January 2026. Its own page still describes the list of generally agreed machine readable opt out solutions as something it will publish, on a page last updated on 16 December 2025. Eight months and a week after the consultation closed, there is an enforceable obligation, a transparency regime built around it, with no published statement of what a compliant reservation looks like. Every rights holder that has not served a notice is, for the European market, still lawfully trainable.
What compliance looks like in the absence of a standard is visible on SoundCloud's help centre, which tells creators caught by Article 50(4) that they are "encouraged to disclose that their covered content is 'AI-generated or manipulated'" in the track description. A statutory transparency obligation is being met through a free text box. It is not queryable, not validated, does not travel with the recording to any other service and cannot be checked at scale by anyone, SoundCloud included. The page itself carries no date, which is oddly fitting.
A legal obligation with no defined data format is not a standard. It is a hope with a fine attached.
The best explanation of why this keeps happening was published in June and no trade outlet has touched it. The Journal of Intellectual Property Law & Practice devoted an entire issue to music metadata. Etienne Valk's contribution finds that Articles 50 and 53(1)(d) of the AI Act "do not provide sufficient practical, enforceable rules", which is the academic phrasing of the gap above. It names five identifier standards in play and unreconciled: ISWC, ISRC, IPI, ISNI and the newer ISCC. It also records, citing a 2019 UK Intellectual Property Office report, the complaint independents usually make privately, that the market dominance of several DDEX members has been reported as not sufficiently accounting for smaller label and artist interests. The operational sentence in the paper is smaller and sharper than either: when an artist or a small label moves between distributors, the new distributor is often free to decide whether to assign fresh ISRCs. That is the mechanism behind every duplicate identifier a catalogue accumulates across a decade of switching, sitting in plain sight the whole time.
Balázs Bodó's article in the same issue supplies the uncomfortable conclusion. Analysing the December 2025 Anna's Archive scrape, which TechCrunch reported at the time as 86 million music files and roughly 300 terabytes, he establishes that the resulting metadata set, covering 256 million tracks, 58 million albums and 15 million artists, is now substantially larger than any lawful peer produced collection including Discogs at around 151 million tracks. His second finding is the one to act on. Wikidata, MusicBrainz and Discogs, he writes, "do not contain rights-related information, only descriptive data". So there is no authoritative public place where ownership of your catalogue is recorded. There are excellent descriptive databases that do not carry it and one illegitimate corpus that carries a version of it without anybody's consent, so whoever builds the next matching tool will reach for whichever is complete. The only record of what you own that is both authoritative and lawful is the one you keep yourself.
Sources: European Commission consultation on TDM rights reservation protocols · SoundCloud Help Centre, Creators and the EU AI Act · Etienne Valk, Music Metadata Minefield, JIPLP 21(6) 347 · Balázs Bodó, The political economy of the open music metadata ecosystem, JIPLP 21(6) 354 · TechCrunch, on the December 2025 scrape
The Cautionary Tale
A British Label's Catalogue Stopped Earning Because Nobody Downstream Could Work Out Who Was Entitled To Licence It.
NoCopyrightSounds is a UK label and publisher whose catalogue was exploited from 2014 under distribution and sub publishing agreements with AEI Music and Featherstone Music. NCS terminated for material breach in September 2025. The defendants disputed that the termination was effective, relying on heads of agreement signed in July 2017 which they said kept the relationship alive until July 2026. On 15 September 2026 the High Court ordered an interim payment of £1.4 million to NCS in NoCopyrightSounds Ltd v AEI Music Ltd & Anor [2026] EWHC 2360 (Ch). Law360 reports the order as an interim sum made after the defendants had themselves acknowledged owing millions. The underlying dispute continues, so this is money on admitted sums rather than a final reckoning.
The instructive damage is in the earlier judgment. Granting an interim injunction in February, in [2026] EWHC 198 (Ch), His Honour Judge Jarman KC recorded that in May 2025 AEI "confirmed that it owed £4.1 million and couldn't pay more than £250,000 without putting its business at risk". He also recorded two sentences that should be read by anyone who thinks a distribution dispute is a finance problem. "The evidence shows that new or potential licensees have expressed concern about using the rights whilst the dispute between these parties continues." And: "One platform operator has suspended payments because of this dispute."
That is the cost, though it was not inflicted by either party. Licensees who had done nothing wrong simply could not establish who was entitled to grant them anything, so they stopped, which left a perfectly good catalogue earning nothing while the question of whether one agreement had ended stayed open. Three things follow for an independent. A termination clause is worth exactly the evidence that supports it, so a later heads of agreement nobody tidied up is what turns a clean exit into a contested one. Counterparty solvency is a rights question as much as a credit one, because a distributor that cannot pay also cannot be compelled to account. And control that is publicly in doubt is control you have already lost, whatever a court decides eighteen months later.
Sources: Inner Temple Library BAILII digest, for the citation and hand down date · Law360, 15 September 2026 (paywalled) · Full text of [2026] EWHC 198 (Ch), ICLR · Simkins, on the interim injunction
On The Wire
Three shorter things. Two of them nobody reported.
Streaming PlatformsSomebody has finally published the denominator for AI music. It is 0.38 per cent
Every AI volume figure in circulation is an upload figure. Deezer's half of new deliveries, SubmitHub's 38.5 per cent of submissions, all of them describing the queue rather than the market. Qobuz has published the number nobody else would, which is what share of actual listening the material accounts for, which Forbes puts at "just 0.38% of streams". Two further figures are worth having. Sixty per cent of streams on tracks Qobuz identifies as AI are classed as fraudulent. And more than a third of AI identified albums had no listening activity at all, covering four million tracks, which have been pulled from the app's search engine. The quiet part is why the platform needed its own detector: it built one rather than relying on the disclosure metadata arriving from distributors, which is a service saying out loud that it does not trust the delivery to describe what the recording is.
Metadata & StandardsMusicBrainz now stops searching at 500 results. Your reconciliation script will not be told
The MusicBrainz server update of 21 September lists ticket MBS-14455, "Limit the depth of search to 500 results", with the release note adding that "if you need something further down the search, sorry but you probably need a better search". A depth cap does not raise an error, it returns fewer rows, so anyone matching several thousand recordings gets a silently truncated set and no signal that anything was dropped. Page deliberately and assert on counts. The note does not say whether the cap reaches the web service as well as the interface, which is worth establishing before you trust a bulk job. Two other things landed in the same week at the foundation a great deal of catalogue tooling quietly depends on. A separate fix, MBS-14440, closed an issue where "webservice requests can return authenticated data on unauthenticated requests". And on 22 September, the same day Picard 3 reached its fourth release candidate and a text freeze, MetaBrainz announced Silona Bonewald as its new executive director. No trade outlet covered any of it.
Read AcrossAn English court has held that a commissioned photograph with no written assignment buys a right to use, not a right to sue
Shein sued Temu over product photographs, pleading 2,559 listings. By the time the case was heard before Mrs Justice Bacon, a trial sample of 100 works had been narrowed to 20 photographs and then to five images, because each one had to be evidenced individually. On the lead image the freelance photographer had given no written assignment, so what Shein held was a non exclusive licence, which the judgment characterises as a right to use rather than a right to sue. Later assignments were effective but arrived too late to cure the position at the relevant date. Permission to appeal was granted on 21 September. Every independent label commissions exactly this material constantly, in the form of sleeve artwork, press shots, visualisers, live capture and session stems, routinely on a purchase order with no assignment attached. This is now an English authority for what that leaves you holding, which is a picture you may use and cannot defend.
And Finally
Warner Has Officially Released Fourteen Discs Of Bootlegs, Some Of Them Taped By A Bloke In The Crowd
On 25 September a Joy Division live collection called Eternal Live arrived through Warner Music: fourteen CDs and two DVDs covering sixteen performances between 1 March 1979 and 2 May 1980, including two shows never released before and three recordings never heard at all. The set is assembled, as SuperDeluxeEdition's description of it records, from audience recorded cassettes, soundboard tapes and broadcast recordings, all mastered at Abbey Road Studios, with most of the audience recordings sounding "exactly like what they are", taped by a fan in the crowd, from concerts that "have been widely bootlegged". A major label has therefore taken bootlegs, run them through Abbey Road and sold them as the official version.
The rights question underneath is genuinely open rather than merely funny. Copyright in a sound recording belongs to whoever made the recording, which in 1979 was a person standing in a hall in Manchester with a cassette machine and no paperwork. Somebody has either cleared those, acquired them or formed a view that the point will not be pressed. For any label sitting on live archive, the lesson is the one that keeps recurring in this issue: the performance, the composition and the physical recording are three separate rights with three possible owners, while the tape in the box is evidence of none of them.
Elsewhere in the department of documents nobody signed, OutKast's holding company sued the rapper Ovrkast. on 16 September in federal court in Georgia, alleging "intentional, willful, and malicious intent" over a fifteen month dispute that had already been settled by agreeing he would adopt a respelled version of his own name by 15 July. The deadline passed, a breach notice followed on 5 August, a cure date on 11 August, then the complaint. The best evidence in the case is the defendant's own press: the filing cites a 2025 Rolling Stone interview in which he acknowledged that people read his name as OutKast. His answer to all of it, given to Complex on 24 September, is the reason this sits in a rights newsletter rather than a gossip column. "For the record, I NEVER SIGNED any agreement. It was verbal, and I did not ignore their date." Whoever is right, a claim for breaching a settlement needs a settlement, while a dated one page acknowledgement of what was agreed and by when is the cheapest document anybody in this industry will ever produce.
Sources: BroadwayWorld, on the release · SuperDeluxeEdition, on the sourcing of the audio · Consequence, on the complaint · Complex, on the response
Feature Spotlight
Contracts: The Agreement You Cannot Produce Is An Agreement You Do Not Have
Read this issue back and the failure is the same one every time, wearing a different hat. A settlement that may never have been signed. Ten distribution agreements, three of them undated, one quietly taking a training licence from a clause most of its users will never open. A termination whose validity was arguable enough to stop an entire catalogue earning. A commissioned photograph that bought a right to use and not a right to sue. In none of these cases was the underlying deal unreal. What failed was the ability to produce it, on demand, with a date on it.
Contracts inside rightsHUB exists to make that a lookup rather than an excavation. Agreements, amendments, assignments, commissioning terms, side letters and consents sit against the works, recordings and counterparties they actually govern, so the question is answered from the catalogue rather than from a shared drive. Key dates, terms and territories are held as data instead of being buried in a PDF somebody will have to read, which means expiries, renewal windows and reversion dates surface before they matter rather than afterwards. It is the piece of music catalogue management that everybody defers because nothing breaks while you defer it.
What it buys you is unspectacular and worth a great deal on exactly one day. When a buyer's diligence team, a platform, a licensee or a court asks who granted what to whom and when, the answer is a report rather than a fortnight. You can see the rest of the toolkit at rightshub.net/features.
Every story in this issue is a document that existed, or did not, at the moment somebody finally asked for it.