Privacy Policy

The MLC Privacy Policy

Last Updated: December 2, 2025

Welcome to The Mechanical Licensing Collective (“The MLC,” “we,” “us,” or “our”), a nonprofit organization designated by the U.S. Copyright Office pursuant to the historic Music Modernization Act of 2018 (the “MMA”), codified in 17 U.S.C. § 115, et seq. This privacy policy (“Policy”) applies to our website, themlc.com (the “Website”). The Website includes:

The MLC Portal: The Portal allows Members of The MLC to register to receive mechanical royalties administered by The MLC as required under the MMA. The Portal Terms of Use are found here.
Public Work Search: As required under the MMA, the Public Work Search allows a user to access a database containing information relating to musical works (and shares of such works) and, to the extent known, the identity and location of the copyright owners of such works (and shares thereof) and the sound recordings in which the musical works are embodied. The MMA and its implementing regulations reference the “musical works database.” The database accessed through the Public Work Search is the same as the “musical works database” described in 17 U.S.C. § 115(d)(3)(E).
Educational and outreach information: The MLC provides extensive information, including links to webinars and other materials, in various locations on the Website.
The MLC DURP: The Distributor Unmatched Recordings Portal (DURP) allows eligible music distributors to view, interact with, and download information about unmatched musical works and sound recordings registered in The MLC Musical Works Database. The DURP Terms of Use are found here.

By using and accessing the features on the Website, you accept and consent to the practices described in this Policy, which may be updated from time to time, the Website Terms of Use, Portal Terms of Use, and the DURP Terms of Use as applicable.

Information We Collect About You and How We Collect It

We collect the following information from you when you access the Website, including information:

By which you or your household may be personally identified, either alone or in combination with other information, such as first and last name, e-mail address, and in some cases, your date of birth, personal address, phone number, and certain financial information required to receive mechanical royalties (“personal data”);
That is about you but individually does not identify you (e.g., geolocation information) but may still constitute personal data pursuant to Data Privacy Laws (defined below); and/or
About your internet connection, the equipment you use to access our Website, and usage details.

We collect this information:

Directly from you when you provide it to us.
Automatically as you navigate through the Website. Information collected automatically may include usage details, IP addresses, and information collected through cookies and other tracking technologies.

Information We Collect Through Automatic Data Collection Technologies

As you navigate through and interact with the Website, we may use automatic data collection technologies to collect certain information about your equipment, browsing actions, and patterns, including:

Details of your visits to the Website, including traffic data, location data, logs, and other communication data and the resources that you access and use on the Website.
Information about your computer and internet connection, including your IP address, operating system, and browser type.

The technologies we use for this automatic data collection may include:

Cookies (or browser cookies). A cookie is a small file placed on the hard drive of your computer. You may refuse to accept browser cookies by activating the appropriate setting on your browser. However, if you select certain settings, you may be unable to access certain parts of the Website. Unless you have adjusted your browser setting so that it will refuse cookies, our system will issue cookies when you direct your browser to the Website. For more details about cookies, please see below.
Web Beacons. The Website may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit us, for example, to count visitors to the Website and for other related statistics (for example, recording the popularity of certain content of the Website and verifying system and server integrity).

Information We Collect Through Public Sources

We may from time to time manually source Personal Information from publicly available sources for the purpose of sharing with third parties, including, but not limited to, within tools and capabilities that enable Collective Management Organizations (CMO) Members to review lists of songwriters from the CMO's territory along with associated contact information. If you do not wish for your Personal Information to be included in these tools and capabilities, you may exercise your data subject rights as outlined in this Privacy Policy, just as you would for data we collect directly from you.

How We Use Your Information

We use information that we collect about you or that you provide to us, including any personal data:

To present the Website and its contents to you.
To identify you and potentially improve and/or customize the Website.
To provide you with information or services, including information you request from us.
To provide you with notices about The MLC.
To notify you about changes to the Website or services we offer or provide though it.
To respond to law enforcement requests.
As required by applicable law, court order, or governmental regulations, specifically including the MMA.
In any other way we may describe when you provide the information.
For any other purpose with your consent.

We will not collect additional categories of personal data or use the personal data we collected for materially different, unrelated, or incompatible purposes without providing you notice.

We do not sell your personal data.

As permitted by law, the MLC may make the Musical Work database available to a person or entity for a fee not in excess of the marginal costs of providing the database to such person or entity. See 17 USC § 115(d)(3)(E)(v)(V). Additional information about the Musical Work Database can be found here and such use is subject to the Musical Works Database Terms of Use.

Disclosure of Your Information

We may disclose personal data that we collect or you provide as described in this Policy:

To contractors, service providers, and other third parties we use to support our business, including the below. All such third parties only receive data pursuant to a contractual relationship where the service provider is required to comply with all applicable privacy laws and to use the personal data only for the purposes for which it is disclosed.
- Google Analytics: We use Google Analytics to evaluate your use of the Website, analyze performance metrics, and compile reports on activity. More information on how Google uses data can be found here.
To fulfill the purpose for which you provide it.
For any other purpose disclosed by us when you provide the information.

With your consent. We may also disclose your personal data:

To comply with any court order, law, or legal process, including to respond to any government or regulatory request. Specifically and for example, we may disclose personal data in the Musical Work established and maintained by The MLC as and to the extent required by the MMA (see 17 USC § 115(d)(3)(E)). The Musical Work Database is required to include information relating to musical works, and to the extent known, the identity and contact information for a copyright owner (e.g., post office or similar designation or address) for musical works and the sound recordings in which the musical works are embodied.
To enforce or apply our Website Terms of Use, Portal Terms of Use, DURP Terms of Use, and other applicable agreements.
To verify your identity when you submit information to become a User (defined in the Portal Terms of Use and DURP Terms of Use).
If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of The MLC or others. This includes exchanging information with other companies and organizations for the purposes of regulatory compliance and fraud protection and detection.

Accessing, Deleting, and Correcting Your Information

As an MLC Member, you will receive communications via email. These communications will consist of updates about your Membership and other notifications as appropriate.

In addition and for example, The MLC may forward a Member newsletter comprising regular communications via email that highlight key events, milestones, and other important information in order to keep you informed about The MLC. If at any time you choose to no longer receive the Member Newsletter, you may opt-out.

If you have an account on The MLC Portal or The MLC DURP, you can review and change your personal data by logging into your account. However, we may not be able to delete your personal data without also deleting your account.

You may send an email to privacypolicy@themlc.com to request access to correct or delete any personal data that you have provided to us. We may not accommodate a request to change information if we believe the change would violate any law or legal requirement or cause the information to be incorrect. This includes requests to revise data contained in the Public Work Search to avoid the public dissemination of personal data or other personal details. Copyright owners may provide anonymous or pseudonymous information as appropriate and may use third-party agents, post office boxes, or designated email accounts. Because of The MLC’s statutory obligation to establish and maintain a Musical Work Database, The MLC cannot and will not delete accurate information contained in the Musical Work Database (accessed through the Public Work Search). Changes made to your account information may be subject to internal review.

Notice To Residents of the European Union, European Economic Area, And United Kingdom

European Economic Area and United Kingdom data protection law requires a “lawful basis” for collecting and retaining personal data from citizens or residents of the European Economic Area and the United Kingdom, respectively. Our lawful bases for collecting such data about you are permitted under Article 6, Section 1 of the EU general data protection regulation 2016/679 (as amended from time to time, and as adopted by the United Kingdom, the “GDPR”) and are summarized below.

Consent: In certain cases, you have affirmatively provided us with your consent to collect your personal data for a specific purpose, such as providing your personal data when you contact us through the Website or enter into a contract (as such term is defined in the GDPR) with us.
Contract: We may need your personal data to comply with our contractual obligation (as such term is defined in the GDPR) to you to deliver the Website, such as fulfilling any future transactional services.
Legal Obligations: Sometimes the law requires us to collect and use your personal data, such as applicable tax laws that may require us to retain records of royalty payments made through the Website, to fulfill statutory obligations under the MMA, or through our contract (as such term is defined in the GDPR) with you.
Legitimate Interests: This is a technical term that means we have a good and fair reason to use your personal data and we do so in ways which do not harm your interests and rights, such as to pursue our legitimate interests in a way that might reasonably be expected as part of running our business and that do not materially impact your rights, freedom, or interests.

In accordance with the GDPR, as a resident of the European Union, European Economic Area, or the United Kingdom, you may have the following rights with respect to your personal data:

If the processing of personal data is based on your consent, the right to withdraw consent at any time for the processing of such personal data. This will not affect the lawfulness of any processing carried out before the consent was withdrawn;
The right to request access to and rectification of your personal data;
The right to object to or request restriction of the processing of your personal data;
The right to request erasure of your personal data; and
The right to receive, in a structured, commonly used and machine-readable format, the personal data you have provided to us based on your consent or a contract (as set forth in the GDPR) and that is processed by automated means, and to have such personal data transmitted to another company where technically feasible (i.e., data portability).

Pursuant to Article 27 of GDPR, the MLC has appointed European Data Protection Office (EDPO) as its GDPR Representative in the European Union. You can contact EDPO regarding matters pertaining to GDPR, including, but not limited to, making a request pursuant to your GDPR rights by:

Using EDPO’s online request form: https://edpo.com/gdpr-data-request/; and/or
Writing to EDPO at Avenue Huart Hamoir 71, 1030 Brussels, Belgium

If you are not satisfied with EDPO’s response to any applicable request made pursuant to your rights under the GDPR, you have the right to lodge a complaint about the processing of your personal data with your local data protection authority. If you are located in the United Kingdom, this is the Information Commissioner’s Office (ICO). If you are located in the European Economic Area, you can contact the Commission Nationale Informatique & Libertés (CNIL).

U.S. Consumer Privacy Rights

Depending on your U.S. state of residence, you may have additional privacy rights with respect to your personal data. These rights may be accorded to you pursuant to, respectively, the California Consumer Privacy Act; the California Privacy Rights Act; the Colorado Privacy Act; the Connecticut Personal Data Privacy and Online Monitoring Act; the Oregon Consumer Privacy Act; the Texas Data Privacy and Security Act; the Utah Consumer Privacy Act; the Virginia Consumer Data Protection Act; the Montana Consumer Data Privacy Act; the Delaware Data Protection Act; the Iowa Data Protection Act; the Nebraska Data Privacy Act; the New Hampshire Privacy Act; the New Jersey Data Privacy Act; the Tennessee Information Protection Act; the Minnesota Consumer Data Privacy Act; the Maryland Online Data Privacy Act; the Indiana Consumer Data Protection Act (effective January 1, 2026); the Kentucky Consumer Data Protection Act (effective January 1, 2026); and the Rhode Island Data Transparency and Privacy Protection Act (effective January 1, 2026) (collectively, as may be amended from time to time, “US Data Privacy Laws,” and together with the GDPR, “Data Privacy Laws”). For the purposes of this section, “personal data” shall have the same meaning as “personal information” as such term is used under US Data Privacy Laws.

Requests to Know: You have the right to request that we disclose:
The categories of personal data we have collected about you;
The categories of sources from which we have collected personal data about you;
Our use of the personal data we have collected about you;
The business or commercial purposes for selling or collecting personal data about you;
The categories of personal data sold, shared, or disclosed about you, as well as the categories – and, if you are a resident of Oregon or Colorado, the names – of third parties to whom the personal data was sold, by category of personal data for each party to whom personal data was sold; and
The specific pieces of personal data collected about you for the twelve (12) months prior to the date of your request.

The delivery of our response to your request to know may take place electronically or by mail. We are not required to respond to requests to know more than twice in a twelve (12)-month period.

Requests to Delete: You have the right to request that we delete any personal data about you that we have collected from you and retained, subject to certain exceptions. We may deny your deletion request if retaining the personal data is necessary for us or our service provider(s) to:
Complete the transaction for which we collected the personal data, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, to fulfill our statutory obligations as under the MMA, or otherwise perform our contract (as such term is defined in the GDPR) with you;
Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities;
Debug products to identify and repair errors that impair existing intended functionality;
Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by applicable law;
Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent;
Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us;
Comply with an obligation under applicable law; and/or
Make other internal and lawful uses of that information that are compatible with the context in which you provided it.
Right to Opt Out of the Sale or Sharing of Personal Data: You have a right to opt out of the sale or sharing (as such terms are defined under US Data Privacy Laws) of personal data we have collected about you to third parties. We will act upon your request as soon as reasonably practicable, but in no event later than fifteen (15) days from the date of our receipt of your request. Any personal data collected in connection with your request will be used only to facilitate that request. You may submit opt out requests by emailing us at privacypolicy@themlc.com. The MLC does not engage in selling or sharing your personal data as described herein.
Requests to Correct Inaccurate Personal Data: You have the right to request that we correct inaccurate personal data that we maintain, or which pertains to you. Upon receipt of a verifiable request from you, we will use commercially reasonable efforts to correct the inaccurate personal data.
Right to Opt Out of Profiling: You have the right to opt out of “profiling.” This opt out applies to the automated processing of personal data that is used to render decisions that could have a legal or similarly-significant effect on a user. Examples of such decisions include those related to credit and access to fundamental goods or services. The MLC does not engage in profiling as described above.
Right to Non-Discrimination: You have the right not to be discriminated against for the exercise of your US Data Privacy Laws rights described above. Unless permitted by US Data Privacy Laws, we will not as a result of such exercise:
Deny you services;
Charge you different prices or rates for services, including through granting discounts or other benefits, or imposing penalties;
Provide you a different level or quality of services; or
To the extent applicable, suggest that you may receive a different price or rate for goods or services or a different level or quality of services.
Authorized Agents: You may designate an authorized agent to make requests on your behalf. You must provide an authorized agent written permission to submit a request on your behalf, and we may require that you verify your identity directly with us. Alternatively, an authorized agent that has been provided power of attorney may submit a request on your behalf.

To make a request pursuant to your US Data Privacy Laws rights, you must contact The MLC’s Privacy Officer either by email at privacypolicy@themlc.com or by mail at The MLC, Attn: Privacy Policy Notes, 333 11th Avenue South, Suite 200, Nashville, TN 37203, United States of America.

The MLC reserves the right to verify all requests made pursuant to US Data Privacy Laws. Upon receipt of such request, we may ask you for additional information to verify your identity. Any additional information you provide will be used only to verify your identity and not for any other purpose. We will acknowledge the receipt of your request within ten (10) days of receipt. Subject to our ability to verify your identity, we will respond to your request within forty-five (45) days of receipt. To protect your privacy and the security of personal data about you, we verify your request by requesting additional identifying information that will only be used to verify your identity and for no other purpose.

If you are a resident of Colorado, Connecticut, Delaware, Iowa, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, or Virginia, you may appeal our denial of your request pursuant to your US Data Privacy Law rights. To do so, you must email us at privacypolicy@themlc.com within forty-five (45) days of your receipt of our denial therefor. We will respond to an appeal within sixty (60) days of receipt for residents of Connecticut, Delaware, Iowa, Maryland, Montana, Nebraska, New Hampshire, Texas, Tennessee, and Virginia, and within forty-five (45) days of receipt for residents of Colorado, Minnesota, and New Jersey, and Oregon.

If your appeal is denied and you are a Connecticut resident, you may contact the Connecticut Attorney General to submit a complaint at: https://portal.ct.gov/AG/Common/Complaint-Form-Landing-page.
If your appeal is denied and you are a Texas resident, you may contact the Texas Attorney General to submit a complaint at: https://www.texasattorneygeneral.gov/consumer-protection/file-consumer-complaint.
If your appeal is denied and you area Maryland resident, you may contact the Maryland Attorney General to submit a complaint at: https://www.marylandattorneygeneral.gov/Pages/CPD/Complaint.aspx.
If your appeal is denied and you are a Montana resident, you may contact the Montana Attorney General to submit a complaint at: https://dojmt.gov/office-of-consumer-protection/consumer-complaints/.

Storage and Transfer of Information

Pursuant to 17 U.S.C. §115(d)(3)(M) and other related MLC policies, The MLC ensures that material records of the operations of The MLC, including those relating to notices of license, the administration of the claims process of The MLC, reports of usage, royalty payments, receipt and maintenance of accrued royalties, royalty distribution processes, and legal matters, are preserved and maintained in a secure and reliable manner. This includes commercially reasonable safeguards to protect against unauthorized access, copying, and disclosure. The MLC’s preservation of material records is subject to confidentiality requirements (set forth in 37 C.F.R. § 210.34) for a period of not less than seven years after the date of creation or receipt, whichever occurs later. In some cases, this information is kept permanently. Any personal data held by us for marketing and service update notifications will be kept by us until such time that you notify us that you no longer wish to receive this information.

The Website is hosted in the United States. Information that we collect from you will be stored in a cloud, used in accordance with applicable law, applicable terms of use, and this Policy, and processed by The MLC in the United States or one of our service providers based in the United States or outside of the United States. By using the Website, you expressly consent to any such transfer and storage of information outside of your country of residence, where data protection laws may be different and/or determined to be less stringent.

Information Relating to Minors

Our Website is not targeted to persons under thirteen years of age. We will never knowingly request or solicit personal data from anyone under the age of thirteen without verifiable parental consent. While individuals under the age of eighteen, but in no event younger than age thirteen, may utilize the Website (including the Portal and the DURP), they must do so only with the consent of their parent or legal guardian, and otherwise subject to this Policy. In the event that we receive actual knowledge that we have collected personal data of anyone under the age of thirteen or under the age of majority in your jurisdiction without the requisite and verifiable parental consent, we will delete that information.

Cookies and Other Tracking Technologies

We may use cookies, for example, to keep track of your preferences and account profile information for the Portal and the DURP, or to engage in certain retargeting activities that may better enhance your user experience of the Website. Cookies are also used to collect general usage and volume statistical information that does not include personal data. We may also use another company or third-party service to place cookies on your computer to collect information to compile aggregated statistics for us about users of the Website.

As mentioned earlier in this Policy, cookies are stored as text files by your Internet browser on your computer’s hard drive. Most Internet browsers are initially set to accept cookies. You can set your browser to refuse cookies from websites or to remove cookies from your hard drive, but if you do so, you may not be able to access or use portions of the Website, or certain offerings on the Website may not function as intended or as well.

A more detailed list of the cookies we currently, or in the future may, use and how we use, or may use, them are as follows:

Security: We secure the Website with cookies that facilitate security features and allow us to detect activity that might violate our rules and Website Terms of Use, the Portal Terms of Use, or the DURP Terms of Use, such as unauthorized access or activity.
Localization: We use some cookies to help us provide localized experiences, such as displaying the Website in the local language.
Website Features and Services: We use certain cookies to provide greater functionality to the Website and help us deliver our services.
Performance: We use performance cookies to help us route traffic between servers and understand how the Website is performing so we can provide users with the best experience possible.
Analytics and Research: We use certain cookies and other technologies also help us to understand, improve, and research features and content on the Website.
Marketing and Online Behavioral Advertising: We may use cookies to help us deliver targeted advertisements through web browsers and on social media platforms based on your activity on the Website and to track the performance of those ads. In some cases, our partners may also use cookies to provide us with information about your interactions with their services, as applicable. Those third-party cookies would be subject to such third-party service’s privacy policies. The Self-Regulatory Program for Online Behavioral Advertising program provides consumers with the ability to opt-out of having their online behavior recorded and used for advertising purposes. Visit this link to opt-out of having your online behavior collected for advertising purposes.

Do Not Track Requests

Please note that your browser setting may allow you to automatically transmit a “Do Not Track” signal to websites and online service you visit. There is no consensus among industry participants as to what “Do Not Track” means in this context. Like many websites and online services, we do not alter our practices when we receive a “Do Not Track” signal from a visitor’s browser. To find out more about “Do Not Track,” please visit http://www.allaboutdnt.com.

Link to Third Party Websites

The Website may include links to other websites, mobile applications, or services (“Third Party Sites”), whose privacy practices may differ from those set forth herein. Such links are not an endorsement by The MLC of those Third Party Sites and/or the products or services they offer. If you visit Third Party Sites or submit Information to any of those Third Party Sites, your visit and information is governed by their privacy policies. We encourage you to carefully read the privacy policies of any Third Party Sites you visit, as it may differ substantially from that of this Policy. The MLC makes no representations or warranties with respect to, nor is The MLC responsible for the privacy policies of any Third Party Sites. If you decide to click on any such links or access any Third Party Sites appearing on the Website, you do so at your own risk.

Data Security

We use reasonable security safeguards that comply with applicable laws to prevent unauthorized access to and otherwise protect your personal data. The Internet is a global network, however, and there are therefore times when your information may not be completely secure. We cannot guarantee or warrant the security of your personal data, or any other information transmitted to or through the Website, and to the fullest extent permissible by law, we disclaim any responsibility for the theft, destruction, or inadvertent and unlawful disclosure of such information. If you provide us with information over the Internet, you do so at your own risk. If you become aware of any unauthorized use of your account or loss of your account credentials, or if you suspect a security breach, please notify us immediately by email at privacypolicy@themlc.com or call The MLC’s support team at (615) 488-3653.

Changes to Our Policy

We may update this Policy to reflect changes to our information and privacy practices from time to time. We will update the “Last Updated” date at the top of this Policy, and we encourage you to periodically review this Policy for the latest information on our information and privacy practices. Once a change becomes effective, your continued use of the Website constitutes your acceptance of such changes.

Contact Information

We welcome your questions, comments, and concerns about this Policy. Please contact us at privacypolicy@themlc.com with any questions or comments you may have regarding the privacy of your information.

The MLC

Attn: Privacy Policy Notices

333 11^th Avenue South

Suite 200

Nashville, TN 37203