The RIAA argued that the software circumvented YouTube’s rolling cipher technology. A few weeks later, GitHub reinstated the repository and set up a $1 million defense fund for developers facing similar claims.
The music industry had more success in Germany, where labels won a lawsuit against Uberspace, the hosting provider of youtube-dl’s official website. In November 2024, the Hamburg Court of Appeal rejected the host’s appeal.
While youtube-dl was never formally shut down, active development has been largely taken over by the open source fork yt-dlp. In fact, people who visit the original .org domain of youtube-dl’s former website are redirected to yt-dlp.
The yt-dlp project launched in 2021 and has more than 16,000 forks and more than 190,000 stars on GitHub, making it the 32nd most-starred project on the site.
IFPI Flags yt-dlp as “Major Problem”
The music business is well aware of these developments and continues to see this type of software as a problem. In a new policy submission, music industry group IFPI highlights yt-dlp as a major problem, naming four developers by their online handles.
The callout is part of IFPI’s submission to the consultation for the 2027 EU Counterfeit and Piracy Watch List. Among other things, it asks for yt-dlp to be added to the list of stream ripping services, alongside Savefrom.net and two Y2mate sites.
“YT-DLP is a major problem for the music industry as it provides freely available open-source software that enables users to download and permanently store music and audiovisual content from licensed streaming platforms, including YouTube, without authorisation,” IFPI writes.
IFPI’s overview describes the project’s history, its stream ripping capabilities, and the copyright-critical Unlicense it’s released under. The group also explains why the software is hard to stop.
“Its open-source nature, extensive developer community and its widespread distribution results in the tool being difficult to contain and/or remove, while continuing to facilitate stream ripping at scale and depriving right holders, artists and licensed services from legitimate streaming and downloads.”
Four GitHub Handles
The submission identifies the project’s founder as GitHub user pukkandan, who it says was lead maintainer from 2021 to 2024. It also lists three current core maintainers: coletdjnz, bashonly and Grub4K. These handles are publicly listed on GitHub.
This is the first time we’ve seen yt-dlp, or the original youtube-dl, named as a target in a Watch List or Notorious Markets submission.
Besides the listing, the yt-dlp callout doesn’t ask for anything concrete. There is no takedown request, call for blocking measures, or any action against the developers. The submission also doesn’t mention that the software can be used for lawful purposes.
Circumvention?
The yt-dlp description does not mention the word ‘circumvention’ either, but the general stream-ripper intro does. IFPI argues that YouTube uses technical protection measures to prevent downloads.
“Stream ripping sites are circumventing these measures that enjoy legal protections under the international treaties and EU law,” the submission reads.
The music group also cites the German youtube-dl ruling, where the court held the website’s host liable for aiding and abetting the circumvention of these measures.
However, the submission itself describes the tool as “parsing webpage and player data, and interacting with platform-specific playback endpoints.” How circumvention potentially fits in there is not mentioned.
Officially Hosted in the United States
The European Commission’s Watch List highlights marketplaces and services outside the EU that reportedly engage in or facilitate piracy and counterfeiting. While the location of the developers isn’t discussed, GitHub is called out as the hosting platform.
“Github is YT-DLP’s official source; it serves as the main platform for accessing the scripts latest updates, source code, pre-compiled binaries and installation instructions,” IFPI writes, while adding that forks and copies are also available elsewhere.
GitHub is a Microsoft-owned company, based in the United States, which would make the yt-dlp repository US-hosted.
AI ‘Ripping’ Threats
IFPI’s submission is not limited to traditional threats. It also flags a newer type of ripping tool. AI music apps Rythmix and MusiQ AI allow users to paste a YouTube link and turn the recording into an AI cover song with a cloned artist voice.
Both these tools are available in Apple’s App Store, and Rythmix is also on Google Play, where it was already downloaded more than five million times.
In the months to come, the European Commission will go over all submissions and decide which of the proposed targets make it into the 2027 edition of the list. Whether that includes yt-dlp or the AI apps has yet to be seen.
—
IFPI’s submission to the EU Counterfeit and Piracy Watch List consultation, which includes a variety of additional targets, is available here (pdf).
We reached out to the yt-dlp maintainers and GitHub for a comment on IFPI’s submission, but they did not respond before publication.
