Disclaimer: IANAL.

The legal reasoning here is shaky. Notice that they cite a German court and assert that the law there is materially the same as that in the US.

I did some research on this specific issue at one point, and I'm skeptical that Youtube's controls qualify under the law in question.

RIAA cites two sections of the law:
>the provision or trafficking of the source code violates 17 USC §§1201(a)(2) and 1201(b)(1).

It almost certainly doesn't violate 1201(a)(2), which is for access controls. This is intended to be used by someone who already has access to Youtube, so no access controls are bypassed.

R. CHRISTOPHER GOODWIN & ASSOCIATES, INC. v. SEARCH, INC., Dist. Court, ED Louisiana 2019:

>While the user id/password combination required for access was surely a "technological measure" that controlled access to the works at issue, Pevny did not circumvent that measure. She validly accessed the system using her id/password combination while she was still an employee with Plaintiff. Even if the use that she made of that access is not something that Plaintiff would have authorized her to do, i.e., copy the materials at issue, it remains that Pevny's alleged abuse of her logon privileges does not rise to the level of descrambling, decrypting, or otherwise to avoiding, bypassing, removing, deactivating, or impairing anything. As the district court observed in Digital Drilling Data Systems, LLC v. Petrolink Services, Inc., No. 4:15-CV-02172, 2018 WL 2267139, at *14 (S.D. Tex. May 16, 2018), many different district courts have held that using the correct username and password to access a copyrighted work, even without authorization to do so, does not constitute circumvention under § 1201(a) of the DMCA.

Youtube-dl either involves access to files that don't require a login, or it uses your password / cookies to access the file, so it doesn't bypass access controls.

The claim under 1201(b)(1), which is for copy controls, has more potential.

There are the subsections:

>(A)is primarily designed or produced for the purpose of circumventing protection afforded by a technological measure that effectively protects a right of a copyright owner under this title in a work or a portion thereof;
>(B)has only limited commercially significant purpose or use other than to circumvent protection afforded by a technological measure that effectively protects a right of a copyright owner under this title in a work or a portion thereof; or
>(C)is marketed by that person or another acting in concert with that person with that person’s knowledge for use in circumventing protection afforded by a technological measure that effectively protects a right of a copyright owner under this title in a work or a portion thereof.

A and B clearly don't apply. The primary purpose of youtube-dl isn't to download copyrighted content, but simply to download Youtube videos, whether they're copyrighted or not. There's clearly more than limited legitimate uses (such as downloaded public domain videos.) The question here is about C - there's an arguable case that the examples in the repo that this letter cites are "marketing" usage for infringing purposes. I'm somewhat skeptical that counts as "marketing", however, and it could be easily remedied by removing those examples or replacing with public domain examples.