After the IP(s) has/have been notified to the ISP, the ISP will then conduct the warnings (listed below) and notify the offending user that he/she has been conducting this activity. I have provided a step-by-step list of these warnings below.

(Paraphrazing from source: ArsTechnica):

1. First Alert - In response to a notice from a copyright owner, an ISP will send an online alert to a subscriber, such as an email, notifying the subscriber that his/her account may have been misused for content theft, that content theft is illegal and a violation of published policies, and that consequences could result from any such conduct. This first alert will also direct the subscriber to educational resources which will (a) help him/her to check the security of his/her computer and any Wifi network, (b) provide explanatory steps which will help to avoid content theft in the future, and (c) provide information about the abundant sources of lawful music, film, and TV content.


2. Second Alert - If the alleged activity persists, despite the receipt of the first alert, the subscriber may get a second similar alert that will underscore the educational messages, or the ISP may, in its discretion proceed to the next alert.


3. Third Alert - If the subscriber's account again appears to have been used for content theft, he/she will receive another alert, much like the initial alerts. However, this alert will provide a conspicuous mechanism (a click-through pop-up notice, landing page, or similar mechanism) asking the subscriber to acknowledge receipt of this alert. This is designed to ensure that the subscriber is aware of the third copyright alert and reminds the subscriber that content theft conducted through his/her account could lead to consequences under the law and published policies.



4. Fourth Alert - If the subscriber's account again appears to have been used for content theft, the subscriber will receive yet another alert that again requires the subscriber to acknowledge receipt.


5. Fifth Alert - If the subscriber's account again appears to have been used for content theft, the ISP will send yet another alert. At this time, the ISP may take one of several steps, specified in its published policies, reasonably calculated to stop future content theft. These steps, referred to as Mitigation Measures, may include, for example: temporary reductions of Internet speeds, redirection to a landing page until the subscriber contacts the ISP to discuss the matter or reviews and responds to some educational information about copyright, or other measures that the ISP may deem necessary to help resolve the matter. ISPs are not obligated to impose any Mitigation Measure which would disable or be reasonably likely to disable the subscriber's voice telephone service (including the ability to call 911), e-mail account, or any security or health service (such as home security or medical monitoring). The use of the Mitigation Measure is waivable by the ISP at this point.


6. Sixth Alert - Whether or not the ISP has previously waived the Mitigation Measure, if the subscribers account again appears to have been used for content theft, the ISP will send another alert and will implement a Mitigation Measure as described above. Also, as described above, it's likely that very few subscribers who, after having received multiple alerts, will persist (or allow others to persist) in the content theft.