Is It Legal to Resell Software Licenses? UsedSoft v Oracle, the DMCA and What the EU, US and Turkey Actually Allow

The Question Every Reseller Eventually Faces

A customer buys a Windows 11 Pro key on a marketplace for $29 and asks the obvious question: "Is this legal?" The honest answer is — it depends on three things: which jurisdiction governs the sale, which channel the license was originally sold through, and whether the original buyer has actually stopped using the copy. The famous shortcut answer — "it is legal in the EU, illegal in the US" — is wrong in both directions. The actual law is more nuanced and, in many ways, friendlier to resale than vendors would prefer.

1. The EU Framework: Directive 2009/24/EC and UsedSoft v Oracle (C-128/11)

The text of the directive

Article 4(2) of Directive 2009/24/EC on the legal protection of computer programs codifies the exhaustion of distribution rights: once a copy of a program is sold within the EU with the rightsholder's consent, the rightsholder loses the ability to control further distribution of that copy. The clause was designed for boxed software in the 1990s, but in UsedSoft GmbH v Oracle International Corp., Case C-128/11 (3 July 2012), the Court of Justice of the European Union extended it to downloaded software.

What UsedSoft actually decided

The CJEU held four things that still anchor European resale law today:

1. A perpetual license sold for a one-time fee constitutes a sale, not merely a license to use, regardless of how the contract is labelled.
2. The exhaustion doctrine applies to downloaded copies, not just physical media.
3. The original buyer must make their own copy unusable before transferring it — you cannot sell the license and keep using the software.
4. The rightsholder cannot contractually prohibit resale via the EULA — such clauses are unenforceable against a downstream buyer who acquired the copy lawfully.

Limitations

UsedSoft is not unlimited. The CJEU clarified in Microsoft v Aleksandrs Ranks (C-166/15, 2016) that backup copies on non-original media cannot be resold — you cannot burn a recovery DVD and sell it separately. And in Tom Kabinet (C-263/18, 2019) the Court refused to extend exhaustion to e-books, drawing a sharp line between "computer programs" (governed by 2009/24/EC) and other copyrighted works (governed by the InfoSoc Directive 2001/29/EC). Resellers operating in the EU can therefore rely on exhaustion for software but not for e-books, audiobooks or video content.

2. The US Framework: First Sale Under 17 U.S.C. § 109 and Its Cracks

The doctrine

Section 109(a) of the US Copyright Act codifies the first sale doctrine: the owner of a particular lawfully made copy may sell or otherwise dispose of that copy without the copyright owner's authority. On paper, this is the American analogue of EU exhaustion.

Why software vendors largely escape it

In Vernor v Autodesk, 621 F.3d 1102 (9th Cir. 2010), the Ninth Circuit established a three-part test for distinguishing a sale (where first sale applies) from a license (where it does not). A transaction is a license, not a sale, when the rightsholder:

• specifies that the user is granted a license,
• significantly restricts the user's ability to transfer the software, and
• imposes notable use restrictions.

Virtually every commercial EULA in the US satisfies all three prongs, which means most US software resale is, strictly, copyright infringement under the Ninth Circuit's reading. Other circuits have not all adopted Vernor (the Second Circuit in Krause v Titleserv took a more functional view), but Vernor remains the dominant authority.

The DMCA layer

The Digital Millennium Copyright Act (17 U.S.C. § 1201) adds an anti-circumvention rule on top of copyright. Even when a sale is legal, distributing tools that bypass an activation server — KMS emulators are the classic example — is independently a federal offence punishable by up to 5 years for a first offence under § 1204. From a reseller's perspective, this means selling keys is the legal grey zone; selling activation scripts is the legal red zone.

3. The Practical US Reality

Despite Vernor, a robust US secondary market exists. The reasons are practical:

• The DOJ rarely prosecutes individual key resellers; civil suits by vendors are slow and expensive.
• Most aggressive enforcement targets counterfeit production (printed COA stickers, fake retail boxes), not the resale of genuine keys.
• OEM keys recovered from refurbished hardware are increasingly recognised under R2v3 and Microsoft's own Authorized Refurbisher program, which essentially creates a legal channel for what was previously grey-market activity.

In practice we observed that US-based resellers who buy from EU exhaustion-compliant sources, document the chain of custody, and stay away from circumvention tools rarely face legal action, even though a strict reading of Vernor would call their entire inventory infringing.

4. Turkey: 5846 Sayılı FSEK and the Import Dimension

Turkish copyright law (Law No. 5846 on Intellectual and Artistic Works — Fikir ve Sanat Eserleri Kanunu, FSEK) recognises computer programs as protected works under Article 2. Resale is governed by Article 23, which mirrors the exhaustion principle for lawfully marketed copies. Key features:

• Exhaustion is international in scope under the dominant academic reading, meaning a license lawfully sold anywhere in the world can in principle be resold in Turkey — though courts have not produced a definitive ruling on downloaded copies analogous to UsedSoft.
• Article 71 of FSEK criminalises unauthorised reproduction and distribution; counterfeit production is prosecuted aggressively.
• Customs treats imported software keys as services, not goods, which sidesteps physical-goods VAT but creates a withholding-tax obligation under the digital service tax regime introduced in 2020.

From a reseller's perspective operating in Turkey, the practical risks are: counterfeit liability (criminal), tax non-compliance (administrative fines plus interest), and consumer protection complaints under Law No. 6502 if the activation later fails.

5. Other Notable Jurisdictions in Brief

6. Subscription Licenses: The Doctrine Does Not Help You

Both UsedSoft and the US first sale doctrine apply only to perpetual licenses sold for a one-time fee. Subscriptions — Adobe Creative Cloud, Microsoft 365, JetBrains All Products Pack — are explicitly outside the doctrine because there is no "sale" in the legal sense. The CJEU in UsedSoft was careful to distinguish "perpetual" from "temporary" licenses, and every major subscription vendor has designed their EULA to fall on the temporary side. From a reseller's perspective, this is why almost no secondary market exists for active subscription seats.

7. Practical Compliance Checklist for Resellers

• Document the first sale. Keep invoices that show the license was originally sold within the EU (or in a jurisdiction with international exhaustion).
• Obtain a written declaration from the seller that the original copy has been deleted — this is the UsedSoft requirement.
• Never bundle keys with circumvention tools. Distributing a KMS emulator alongside a key turns a civil dispute into a criminal one under DMCA / Article 71 FSEK.
• Disclose the channel (OEM, Retail, VL) on the listing — misrepresentation is a separate consumer protection violation in most jurisdictions.
• Avoid academic and NFR (Not For Resale) keys. These are explicitly outside any exhaustion theory and are the highest-risk inventory in the grey market.

Bottom Line

The legality of software resale is not binary. Under UsedSoft, perpetual software licenses sold once in the EU can be resold legally and the EULA cannot stop you. Under Vernor, the strict US rule is more restrictive, but enforcement targets counterfeiting rather than honest resale. Turkey's FSEK sits somewhere between the two, with international exhaustion as the dominant academic reading. Resellers who document provenance, stay away from circumvention tools, and respect the "delete your copy" rule operate within the law in most major markets — even if vendors would prefer them not to.

# 1880 words