Pirate music sites, a voice-clone app and the RIAA's 2026 shopping list

What the RIAA reportedly sent to Washington, and what it did not#

The fox learns early that a sign on a gate is not the same as a locked gate. On 15 October 2026 Digital Music News reported that the RIAA had flagged the shadow library in a 15-page submission to the Office of the United States Trade Representative, the body that compiles the annual Notorious Markets list. The submission names Anna's Archive as a new entry, along with ThePirateBay, the stream-ripping site Y2mate, counterfeit vinyl and CD operations in Russia and China, and an AI voice-cloning service called Lalals.

Be precise about what that is. A submission is a request. The trade office publishes its own review later, and the 2026 edition does not exist yet. Digital Music News itself says the earlier names presumably be incorporated into the 2026 edition. The last published review, released in March 2026, identifies 37 online markets and 32 physical markets and focuses on live sports piracy, so music is a small part of a very large list. We could not read the RIAA's filing itself, which is why every claim about its contents in this piece is attributed to the trade report.

The new entry among the pirate music sites that matters most to anyone in marketing is the shadow library. Anna's Archive was ordered to pay more than $322 million in April after labels and Spotify sued over a scrape of Spotify's catalogue. Digital Music News says the operators did not show up in court and remain unidentified, and the RIAA's filing, in the trade site's words, repeated that the library had allegedly downloaded and threatened to release nearly 90 million music files from Spotify.

Collecting is another matter. NME reported that the library has been ordered to pay $322million, but no money will flow while the operators cannot be identified, and Digital Music News notes that the library is still operating via different domains. That gap, between a judgment and an outcome, is the thing to plan around.

Why pirate music sites still matter to a release plan#

It is easy to treat pirate music sites as a legal story and nothing more. For a marketing team, pirate music sites are a timing story. Stream rippers and shadow libraries are where a track goes when it leaves the controlled path, and the controlled path is what a release plan is built on. Embargoes, pre-save campaigns and playlist pitches all assume that the first version people hear is the official one.

Stream ripping is the long-running example among music piracy sites. In October 2025 the IFPI announced that Y2mate.com and eleven related sites, which collectively had in the last 12 months alone received more than 620 million visits globally, had shut after enforcement in Vietnam, and the operator agreed to shut down the sites for good. TorrentFreak, covering the same action, noted that Y2mate had been a familiar name in the RIAA's reports to the US trade office for several years. Now the RIAA has reportedly named it again, which tells you how well a closure holds against pirate music sites that can reappear on a new domain.

The wider piracy picture is moving in the right direction, although the data is thin for music. The analytics firm MUSO reports that overall piracy declined by 14.2% in 2025 across the five sectors it tracks, but it does not break music out on its public page, so treat that as a climate reading and not a music statistic.

What follows for the release plan? Assume that a pre-release file can escape, decide in advance who can authorise a takedown notice, and write the fan message for the day it happens. A one-page leak protocol is dull and it wins weeks. We cover the downstream version of this problem in Sony's 260,000 deepfakes and the takedown queue and in what the DistroKid AI lawsuit means for artist marketing.

The new front: ai voice cloning music and the Lalals listing#

The AI item in the filing is not new in kind. In October 2023 Complete Music Update reported that the RIAA had included voice cloning services in its earlier submission, naming a UK-based tool called Voicify. What is new in 2026 is that the voice-cloning service is a full creative suite. Digital Music News describes Lalals as a UAE-based service that allegedly offers voice changing, voice cloning, text-to-speech, stem splitting, AI song generation, mastering, and AI cover tools.

That list matters because it shows how the line is blurring. Stem splitting and mastering are ordinary studio utilities, and nobody at a label wants them banned. Voice cloning that copies a named artist without permission is the part the industry objects to. The RIAA said as far back as January 2024 that it wanted a close look in the future at emerging piracy challenges presented by AI, and the 2026 filing reads as that look arriving. Note that a listing is an allegation by a trade body, and the service has not been tested in court on these facts.

For artists the practical risk is a convincing imitation of their voice on a platform they do not control. YouTube has expanded its likeness detection, but the coverage says that expansion reaches all users over the age of 18 and concerns faces, with voices not mentioned. So the tooling for protecting a voice is thinner than the tooling for protecting a face. That gap is why contract language on voice and likeness is now part of the marketing brief, not only the legal one.

Deezer's own numbers are the best calibration we have for how big the problem is in listening terms. It reports that AI-detected tracks reached more than 50% of total uploads of new music at the June peak, while fully AI-generated music accounted for between 1 and 3% of total streams. It adds that up to 85% of streams on fully AI-generated tracks were identified as fraudulent in 2025. Those are one platform's figures from its own detection tool, which it says is 99.8% accurate, so read them as Deezer's claim.

Put the two halves together and a sensible reading emerges. The volume of synthetic music is large, the audience for it is small, and much of that audience is fake. The bigger threat to an artist is not that listeners switch to a clone, it is that a clone confuses search results, playlists and royalty pools around the real name.

Five moves for a music marketing team, starting this week#

None of this response to pirate music sites needs a legal department to start. It needs a shared document and a named owner. The moves below are folkfox's recommendation, built on the reporting above, and they are the same whether you run a label, a management company or an independent artist account.

The official hub is the cheapest of the five and the most neglected. When a fake or a leak appears, fans and journalists search for the artist name plus the track title, and a single page that says "these are the real links" gives search engines something authoritative to return. It also helps with the other problem this year, which is how platforms tag synthetic work. We looked at that side in the YouTube Music AI labels story and at the metric fallout in fake streams at Qobuz.

Everything in the table about pirate music sites can change within a month, which is the argument for keeping the register and dating it. If you want the monitoring and the fan communications built together, the music industry marketing page shows how folkfox works, and the contact page is the quickest route in.

Frequently asked questions#