Shopify files lawsuit over DMCA abuse
torrentfreak.com
torrentfreak.com
Check how basic their form is >> https://help.shopify.com/en/legal/dmca#/form
We've been harassed by the same scammer that placed 7 fake DMCA over the past 2 weeks and Shopify automatically removes you content with zero check. That dude just mentioned the product pages he wanted and used totally irrelevant links as a source for what he claims was the original content even a .xyz domain.
Shopify support does absolutely nothing even if you send them 20 emails.
Hundreds of legit businesses are affected by this loophole exploited by scammers.
See https://twitter.com/hashtag/FixShopifyDMCA?src=hashtag_click
Since the products are identical the only way of succeeding is being the store that the customer sees first. Some invest heavily into SEO/Paid Ads. Others try and harm competition like the DCMA requests and leaving negative reviews.
But one thing I've seen first hand is that the competition is brutal. Everyone just steals website content, images, marketing material etc from the competitors. Whatever they can do to get ahead.
Starting the "back in my day rant": In the past, you would actually negotiate with your manufacturers about how many items you would purchase over the year, and that would determine the discount you got on their SRP. You could then mark it up, but for the most part you didn't, and your profit was your discount.
Now days, though, everyone is just plugging directly into AliExpress/Temu/Wish, and marking it up. They are just a lazy low/no-value middle-person between me and cheap knockoffs from China. The "clever" ones are worse, because you might not even realize you are buying a knockoff. The packaging, images, titles, and descriptions will be 1:1 with the real product.
We are also better equipped to guarantee supply chain integrity and have much better customer service. Getting a warranty on a part can be difficult, but we have dedicated people who work with vendors every day. All the customer has to do is stick a shipping label on box.
Or for that matter, car-dealerships operate on the same model.
1. Platforms could detect they're sellng the same piece of good and automatically sort by price
2. There's no material difference between vendors other than pricing and offering, e.g. in customer service
3. vicious anti-competitive behaviour like those illustrated here are heavily regulated
When all these are true the vendors that survive would be ones that offer the best price among those who offer goods of the same level of crappiness.
No matter where you go and buy a fungible consumer product (SKU), the retailer was regulated by law to give you the best price available anywhere in the world at that exact microsecond.
2. Copy everything they do. Steal their photos, descriptions. Everything, really. Launch a bunch of stores that sell the exact same thing, with exact same listings, etc.
3. Attack the store with bogus DMCA takedowns, deluge them with fake reviews.
4. Boost your own store(s) with fake positive reviews.
5. Replace the stores you are competing against.
If you're located in China and can do that with impunity, what are the owners going to do? Amazon seems to be happy for any business.
So much for " The e-commerce platform typically receives thousands of takedown notices per month from rightsholders, which are in part processed automatically. That works well in most instances, but not always."
As a person who's built at least half their career on Rails, I want Shopify to succeed in a big way, but every "platform" acts the same way. What's worse is that I've read other stories from Shopify creators who are having their stuff directly ripped off, and their complaints have no effect.
Why do the people running platforms all wink and nod, and agree to enshittify the service for the creators in the same way, leaving them nowhere else to go? Seems like there's an opportunity to make more money by breaking the mold, and being a platform that favors creators over complaints.
Ahhh, don't worry; I'm sure AI will sort all of this out shortly. <eyeroll> Anything to avoid hiring actual people with brains to sort these kinds of things out.
If these automated systems are so great, you'd think there'd be relatively little gray area for human beings to sort out, but no one seems to actually do that, until a stink is made on some social media that the company can't avoid.
1. Forcing a seasoning period on new accounts before they create DMCA requests
2. Ranking the # of DMCA requests by account and increasing scrutiny of top complainers
Could someone in the know explain how Shopify can continue to avoid the problem despite obvious solutions?
https://en.m.wikipedia.org/wiki/Notice_and_take_down
> Provided the notification complies with the requirements of Section 512, the online service provider must expeditiously remove or disable access to the allegedly infringing material, otherwise the provider loses its safe harbour and is exposed to possible liability.
Which include :
> Information reasonably sufficient to permit the service provider to contact the complaining party, such as an address, telephone number and email address
>> Shopify says that it’s not feasible for the company to investigate the validity of all takedown notices in detail. As such, these false claims resulted in actual removals and the affected stores also received strikes on their accounts.
It isn't a good system but Youtube in particular was loaded with pirated content in the early days before Google invented automated copyright moderation so they most likely needed to do something drastic to delete pirate accounts to avoid legal trouble with the copyright lobby and everybody else just copied the idea as a "best practice".
In other words, they don't want to spend the money to fulfill their responsibilities.
That's the context I was referring to. If Shopify requires an address and phone number from DMCA claimants, then won't the DMCA claimants simply sue Shopify for making the process too restrictive?
It looks like Shopify has decided not to play that specific game.
>Information reasonably sufficient to permit the service provider to contact the complaining party //
The complaining party is a party with a [genuine] complaint of copyright infringement. A specious claimant is not really a complaining party. Whilst an email address may allow you to contact a party, it's not really sufficient to contact a [genuine] complaining party; the email address will put you in touch with lots of correspondents who are not complaining parties but instead are vexacious complainants.
Requirement for a notarized affidavit delivered by registered mail would seem like it would be no bar for genuine complainants who were subject to a loss that the court, or public process, should care about.
That might be too onerous? Maybe parties should prove they have registered the copyright in their works at the USPTO, as they would in an infringement proceeding?
This situation seems like what happens when you let corporate interests write the laws and you just sign them in.
That does not answer whether Shopify is free to use more information to filter out fraudulent claims; though my understanding is that Shopify is not really allowed to filter out fraudulent claims at all, so that point is moot.
Where the DMCA went wrong in my opinion is it should have been upon notice you have one business day to notify whoever posted the content, and they get one business day to respond. If they take down the offending content, then all is well (the amount you could gain from two days of something being up isn't worth your court costs) If there is no response at all, only then is content taken down automatically. If there is a response that the content doesn't infringe then content stays up, but the response must contain full legal contact information: the accuser is required to go to court to get the content taken down. Note that court mean the count of law in the country the accused lives in.
The above is how normal cases should work. There are some tricky things that need to work different. If the accused is in a country that doesn't recognize copyright, if the legal contact information is invalid, if the accuser is submitting many false claims, or the middle party doesn't do their part there are problems. I'll post my ideas, but there is room for better ones and a lot of details need to be worked out.
If accused party is in a country that doesn't recognize international copyright (China being the big example), then take downs need to happen immediately - we cannot trust your courts to protect our people so you in turn are assumed wrong, take it up with your government. (I can't think of anything better here - I'm open to better ideas)
If the legal contact information given in the response is invalid, then the entire account should be terminated and all content deleted.
Many false claims needs to be legally defined. I'm going with the copyright owner and (not or!) their authorized agents send more than 100 take downs that after 1 year are still up and no court case has been filed.
If the middle party (youtube) doesn't react to court orders to take things down, or to the poster asking to take infringing content down then they are in trouble. Otherwise they are only a middleman.
The writers definitely intended towards that spectrum's latter.
As a piece of enforceable legislation, it is heavily-flawed.
As an example, send a DMCA/C&D to shopify.com - do they have to take down their homepage? Of course not. Did they set up a robot to take down their homepage when it receives a request? Of course not.
> DMCA has no concept of fraud prevention
Yes it does. The safe harbor requirements require that material removed expeditously upon proper notice. A bogus notice is not proper notice. Acting on a bogus notice is against shopify's own notice and takedown procedure. They are creating more harm for themselves by doing this.
What they are not prepared to defend is their users' content.
Then build something reasonable to replace it.
To the implementation established through corporate lobbying of media corporation over the last century; yes, I'd very much agree.
The core is, people who create useful works deserve to make a living and not simply have the financial benefit of those works go to others who are rich enough to exploit them.
I'd be interested if you don't agree with that core, if you could explain why?
Monopoly is not the route we should be taking to achieve that. Copyright only manages to support a select few artists. It does so by making it more difficult to create art in the first place!
The overwhelming majority of copyright benefit (in dollars) goes to "others who are rich enough to exploit" the system itself, not to the artists who are in need of "a living". Those absurdly wealthy groups make it more difficult and more expensive for artists to compete with them. The tool they use for anti-competitive behavior is copyright. Copyright is only useful for anti-competitive behavior, because copyright is literally defined as monopoly.
---
If we did not have copyright, people would still be free to financially support artists. There would only be two major differences:
1. Artists would not be able to compel people to financially support them.
2. Giant corporations would not be able to compel artists to give them monopoly over their art. Artists would be entirely free to create new art, and to seek direct financial benefit from that art.
I argue that the second effect is by far the greater of the two, particularly in respect to artists who need a living wage.
Yes, in the copyright system we _have_ in USA/Europe (probably globally). But fundamentally copyright was birthed out of protecting creators of works (authors of books in the case of Queen Anne's Statute). Capitalism is fundamentally corrupting of every system, but that doesn't mean the "core" of the underlying system was bad -- that is all I argue for here, that a just copyright system that actually encourages sharing of works could exist, modelled on the fundamental core of copyright which is protecting authors/creators from predatory industries and maintaining things such as right of authorship (being acknowledged as author).
To be clear, you should not be able to profit from claiming original authorship of those works: that would be fraud.
The problem with the DMCA is that in practice it's ridiculously lopsided. It's *supposed to be* under penalty of perjury but no harm comes to those who make false claims.
Have any companies been successfully sued for attempting to police DMCA fraud on their platform? Be interesting to know how courts treat good-faith efforts and if there have been instances where a company just phoned it in and got in trouble for half-measures.
However, companies often have policies that are more restrictive than DMCA (YouTube, for example, will remove things that the DMCA would not require).
Because if Shopify gets the take-down request and ignores it, they are now potentially liable for the infringing content remaining available after the complaint has been made. Reviewing each complaint requires billable hours for someone, and just blanket accepting every one and removing the content is easily automated and incredibly cheap. And because they're so big and handle so many websites, even if every complaint is invalid and bullshit, the stores that get nuked in the process won't hurt their bottom line as much as a potential IP lawsuit would.
If sending fraudulent claims like this resulted in the sender going to jail this wouldn’t be much of a problem at all. But it doesn’t.
Prison is a massive cost to society, we should avoid it except where it's entirely necessary.
The rationale is that the DMCA gives complainants the ability to restrict others' speech, and so the law wants to strongly disincentivize abuse of that power.
In any case, I didn't express it well. What I intended was that, in my personal opinion, these matters should be treated as a civil matter in view of copyright essentially being a tort.
USA Americans seem to contort the notion of speech beyond recognition. Being prevented from publishing a video someone else created, say, doesn't inhibit your right to express any opinion (aka freedom of speech). But of course, disincentivising abuses of power is always good.
Yes. DMCA claims are made under penalty of perjury.
> Being prevented from publishing a video someone else created, say, doesn't inhibit your right to express any opinion (aka freedom of speech).
Indeed, the inhibition of free speech is when you are prevented from publishing a video you created, because someone else falsely claims that they created it. Hence the felony.
The reason for frivolous lawsuits, DMCA takedowns, rape accusations, fake news and internet misinformation is that people feel no practical consequences for false reporting.
If you are caught with a blatantly false report you should be faced with a stiff penalty.
The penalty should be just enough so that normal people feel twice before false reporting. This should discourage 99.9% people from false reporting and then allow authorities to assign adequate resources to deal with the rest 0.1%.
I personally think that DMCA was terribly designed - but a replacement would need careful consideration from all sides.
As to chilling effect on reporters, I disagree.
We have laws to protect people from libel, and yet it does not have chilling effect on reporters. And yet it is essentially exactly the same thing I am thinking about.
The damage from libel is to an individual. The damage from misinformation is to entire society.
The reason libel laws work is that the number of cases isn't overwhelming the court system.
But if you rewind time 20 years and you suspended libel law for a moment, if everybody could publish in a newspaper or TV whatever they want about whoever they want. What do you think would happen? A deluge of false information about everybody.
What would people say about somebody wanting to introduce a libel law? That "it would have a chilling effect on journalism".
If you're an asshole there are many methods online to really screw with your competitors :(
It’s not a problem Etsy or others take seriously, even when the attack hits stores with multi-million dollars per year in sales.
It’s yet another case of a tech company refusing to staff enough workers to manually review and verify things that computers shouldn’t be doing by themselves.
Needless to say, this is difficult to scale. It's fine for our app; which Serves a fairly small demographic, and does not make money, but it would be a big problem for major-league outfits.
I have a feeling that one of the first commercial applications of AI, will be moderation and response to customer complaints.
We'll have to see how well that works.
> We'll have to see how well that works.
Worth noting that almost all of YouTube's front facing customer service is heavily, heavily automated, which is a source of constant hostility and aggrivation for YouTubers, in that they must interact with these ML agents, get a stupid, nonsensical answer, then reply again to get a human reviewer who (usually) resolves the situation that would've been faster resolved by a human in the first place and let to less frustration for all involved.
I think it's a fantastic idea to not automate the process of signups for a service, and yes, it will substantially slow down the process. But I think everyone has just about had their fill of all these services that produce bad outcomes extremely quickly when a trivial amount of human involvement would've handled whatever issue better, in a perfectly acceptable time frame.
If you don't want to have a customer service department that is well staffed and well paid to handle customer complaints/problems/issues/what have you, then my suggestion is do not involve yourself with or build a company that will need one. Simple as.
Edit: And like, I think it's fair to extend this to all these sectors of a normal, functioning business that silicon valley companies are happy to "automate" to cut their costs:
- If you don't want to provide the resources for human approval for your platform, then don't start a platform.
- If you don't want a provide the humans to moderate content, do not host content.
- If you don't want to handle verifying ID's and driver's licenses, running background checks, and all the rest that is Bog Fucking Standard for a cab company, then don't start a cab company.
It just blows my mind how many of these business have gone into the field of X or Y and just... not done or half-assed huge aspects of those fields, and then shrug their shoulders when people get pissed that they can't get help. Do you think all these dinosaur businesses you're trying to disrupt went out of their way to find an excuse to hire on customer service agents for the hell of it? No! They needed people to solve problems for customers with the product they sell!
Maybe instead of moderation and response, it would function better as a blackbox middleware to the customer support onboarding process. So instead of tackling the problem at the customer level, you use AI/ML to enable your existing support staff to scale their workload.
The picture I have in my mind is a pre-processor for new tickets that would add a series of tags to a support request. That would allow your support staff to be assigned to tags where they specialize. This simplistic implementation would probably integrate into existing service management platforms without having to stand up Yet Another B2B.
Not only is this a lie you've been willingly sold, it appears you've bought it and taken it home.
This said I don't think you should feel too bad, we the consumer buy these same lies all over the place "If we have to follow these regulations then it's going to be a big problem for the industry".
At the end of the day some of the problems do not scale easily and cheaply. In these cases business have the choice of willingly being good societal actors and taking a loss of profit in order to prevent issues, or by means of regulation be forced to behave in a fitting manner.
That was unkind. I didn't think we behaved that way, here, but I'm often wrong...
It certainly can be done, but that usually means the shareholders need to hold off on that second lambo. That doesn't often play well, in the boardroom.
The law is designed specifically to enable this, because the recording industry bought a bunch of politicians, and said "hey we need to have a zero cost zero risk mechanism for us to remove content we believe to be pirated, without having any penalties for being wrong, but there must be penalties for the host services if they try to stop us".
This is how the DMCA should have been designed in the first place.
Doesn't the law require this?
> Shopify automatically removes you content with zero check
Doesn't the law also require this?
AFAIK, the only thing the DMCA allows is for them to put the content back after you swear to them that it's not copyright infringement. But it's not very clear how much evidence they should request.
Should they? I thought the whole point of DMCA Safe Harbor is that third parties (such as providers and hosting services) don't have to figure out what's infringing and what's not but merely accept statements from all the involved parties.
If removal on notice is one-click process, restoring on counter-notice could (should!) also be an one-click process.
And if DMCA doesn't prohibit proactive counter-notices, marketplaces that care about their sellers should let them preemptively swear that all their products are not infringing on anything, and save the counter-notice, so takedown requests would be immediately served with "we took the content down for a femtosecond (as legally required), but we got this counter-notice, so we restored the content - now you can go to a court". Not sure how legal this could be, but giants like Etsy's or Amazon's legal teams surely can test those waters if they would want to stop the DMCA abuse.
Because if everyone did this, the scammers would eventually not bother.
If everyone retaliated to fake takedown notices by spamming every single page and/or item listed by that account, they'd have no choice but to stop.
They do what they do because it makes them money! If they want to sell, they need an account which doesn't have every single item DMCA'ed.
Quoting the parent, emphasis mine:
> The problem with Shopify is that literally anyone can *open a fake account* and submit a DMCA to take down any competitor.
(thanks to the OP for shedding light on this situation)
Running a business through Shopify has become very risky these days.
We are now working on transferring our online stores to Woocommerce where it is far more difficult to get your content removed with bogus DMCA.
Picture the situation to understand the Nightmare:
1) You are driving paid traffic to a product page with good ROAS because your ads are optimized after months.
2) Then the competitor submits a fake DMCA
3) Your page is content is removed automatically by Shopify (no check on their end)
4) Your optimized ads are now directing customers to an empty page
5) Then you risk having your ads accounts flagged
You might think you could just redirect the url to a duplicate? That would be a great solution indeed. BUT
6) The competitor is monitoring your product page and immediately submits another fake DMCA
7) You redirect again
8) Then another fake DMCA
Now WAIT for the cherry on the Cake.
9) After 4 or 5 fake DMCA, you Shopify account admin is locked
10) You may even get suspended automatically by shopify
11) Then you can no longer fulfill your orders from customers
12) Then your customers start making chargebacks
13) Then the payments processors on which you've built a reputation over the years can suspend you
14) Shopify (zero)support asks you to reply to the DMCA with a counter notice and WAIT for the Trust & Safety Team to get back to you
15) Then you receive an auto reply from them telling you that the other party has been informed and that you may repost your content in 2 weeks unless the scammer has filed a court action.
16) Then after 2 weeks, you repost your content
17) Then the same or the next day, the same scammer (watching you like a hawk) issues another fake DMCA for the same product page through the same fake account.
ISN'T IT BEAUTIFUL?
** Shopify could literrally STOP 80% of these false DMCA by just adding a field on their rudimentory form: asking to verify a phone number or upload an ID but NO, that seems to be a task too Challenging for a billion dollar company like Shopify
[1] https://www.reddit.com/r/stocks/comments/153z5r7/shopify_is_...
I always win these disputes for obvious reasons but Youtube has never offered to make things right.
Basically the accused is guilty until proven innocent which is not how it should be.
Rather than use the “official” DCMA process, they build a reporting mechanism in front of it. People can abuse it without facing federal repercussions.
I’m pretty sure they’re not legally allowed to add extra requirements like this. If they were, sites could make it almost impossible to take things down by adding a lot of requirements
> Information reasonably sufficient to permit the service provider to contact the complaining party, such as an address, telephone number and email address
I think another poster hit the nail on the head, when they said (and I'm paraphrasing), these aren't real DMCA takedowns. They're a different system these hosters bend to that acts outside of it. By being more liberal in what gets shut down, they comply with DMCA which is much more onerous on what is required to shut things down.
In fact, if this was really the DMCA process, people would have legal standing to go after the accusers via Section 512.
Further, I'm also pretty sure you don't have to take things down right away. You do have time to investigate the alleged violation and decide whether you are in the right.
Basically, all these players are hiding behind systems they put in place so they wouldn't come close to DMCA issues or have to pay anyone to investigate notices.
I doubt it. I expect that Shopify doubts it, too.
> such as an address, telephone number and email address
If Shopify were to alter their contact info requirement, it would clearly be with a different goal in mind than the one laid out in that sentence. That's assuming of course, that the current requirements have actually led to communication.
"Acceptable forms of identification include driver's license, passport, and birth certificate."
"Acceptable forms of identification include driver's license, passport, or birth certificate."
https://www.inquirer.com/opinion/supreme-court-first-step-ac...
The words "information reasonably sufficient" set the bar of compliance. The list is an example, not an explicit requirement; hence the words "such as".
Adding liability in the case that the work is found not to be infringing, including substantial punitive damages paid to the accused (covering their time, emotional distress of being targeted by a lawsuit, attorney fees, and some amount extra) and the hosting provider (for wasting their time), would be a good reform.
The problem with substantial punitive damages however is that you will have people who do legit requests that are determined to be false per haps by algorithms. (Or that are in some gray area.)
>damages paid to the accused (covering their time, emotional distress of being targeted by a lawsuit, attorney fees, and some amount extra)
Now you're talking fining people thousands of dollars even though they may have been in the right.
So, if you are the victim of a fake takedown request, either you are not going to find them because they don't exist, or if they do exist, they are beyond your reach.
There is no means to enforce this penalty unless your opponent decides to by the rules. (Spoiler: they won't.)
This is by design. Every single person involved was well informed about the consequences of the law when the US Congress was discussing it.
YouTube has an additional layer on top (Content ID), through agreements with music, tv, and movie industry, to automatically flag supposedly offending material so it can be 'acted on' without anyone needing to file a DMCA notice (or Youtube get sued even more).
I wish the free speech caucus realized how it can be weaponized to suppress speech. Sometimes I wish someone would DMCA a bunch of congressional campaign ads, because if pols realized how one-sided and ripe for abuse the system is they might actually fix it.
Of course, they could be right or wrong, but you’re allowed to sue them in order for a court to decide that question if they decline to take it down. The takedown procedure is not legally mandatory, although the DMCA safe harbor limiting service provider liability does not apply without it.
I’m not a lawyer and am just discussing here for general information purposes rather than legal advice, so double check this with your own lawyer before filing any such lawsuit. But I am far more familiar with this area of law than most non-lawyers, for various reasons.
By giving themselves an exemption, like the anti-telemarketer laws.
Get rid of the nonsense that "stop copying me!" should be raised to a cause of action, and we're good.
The world can survive if the top few percent of musicians, writers, and actors make a little less money, that they were receiving based on that fictitious tort.
If non-Western actors targeted the top 1,000 Shopify stores with an automated system --> I imagine it would get fixed sooner.
Strikes are not part of the DMCA but something Shopify has chosen to add themselves. The DMCA does not require any account termination at all. Perhaps they should focus on fixing that first in order to protect innocent merchants.
Source: 17 USC 512(i)(1)(A)
https://www.law.cornell.edu/uscode/text/17/512
Of course, these policies are not required by the law to count fake infringement claims toward the evaluation of whether a user is a repeat infringer, even though many do. So Shopify could add a “was this legit?” element to their repeat infringer policy in order to mostly or entirely negate the impact of fake claims, possibly with human review before termination. That’s more work than most companies at their scale want to put into making sure their strike system is equitable.
In practice, there isn’t much incentive for the big providers to doubt the takedown notices as applied to most customers. After all, the pushback against them for being too quick to terminate will generally be comparable or milder than that for them being too slow to terminate, given who has the money and influence, plus it takes more work from the provider to be protective of legal reuse than to assume all notices are legitimate.
Some cases of reuse-protective approaches by service providers do exist, of course. I suspect this happens when the provider is small enough to either have a reuse-protective ideology or simply to take a personalized rather than automated approach, and also when a big provider views a customer as lucrative or influential enough that they don’t want to punish them incorrectly.
Here's an outline of what the service provider has to do when they receive a notice from a complainer about alleged infringing material posted by a user of the service, if the provider wants to take advantage of the DMCA safe harbor.
1. Do a simple check of the complaint to see if it contains the required information (contact information of the complainer, asserting that the complainer is authorized to act on behalf of the copyright owner, description of what specifically is allegedly infringing, etc).
2. If it passes the check remove the alleged infringing material.
3. If the alleged infringer tells service provider that the material is not infringing, the service provider must restore the alleged infringing material, and provide the complainer with contact information of the alleged infringer.
After that if the complainer wants to force the removal of the material they have to bring an infringement lawsuit against the alleged infringer.
If the complainer does so and wins then the person who was an alleged infringer becomes simply an infringer.
The complainer can again ask the provider to take down the material, but this time instead of making a DMCA request they can provide a copy of the judgement from that lawsuit. That makes the provider aware that the material is actually infringing, not just allegedly infringing, and the DMCA safe harbor is not available. The provider must take down the material or the provider itself might be liable for infringement.
Excuse my language but that is 100% bullshit. If it's not feasible for you to investigate these claims before kicking your own customers out then it's not feasible for your business to exist. Investigating these claims before acting on them should be considered a cost of doing business.
I can't blame businesses for not having sufficient staff to investigate takedown fraud when any business that did would probably be uncompetitive given how easy it is to send fraudulent takedowns and how much time and money it costs to investigate them. Most customers would almost certainly rather accept the risk of being the victim of a fraudulent DMCA takedown than pay extra to avoid it, in part because most people probably don't understand how easy it is to abuse the DMCA.
Would you make the same defense if the company that makes M&M candies said that since they have hundreds of factories they would have to hire 10,000 janitors a day to keep cockroaches out of candy bags? After all, it’s very complicated to collect and manage so many people and schedules.
They are under a strict legal obligation to follow the DMCA.
They are under a far less strict to nearly non-existent legal obligation not to fuck their customers completely over.
The first issue is an "IS" problem. The second issue is an "OUGHT" problem. If you want to solve the Is-Ought problem you have to change both sides of the equation to an is, or to an ought via law.
• An account with unverified credentials was allowed to make a substantial number of DCMA takedown requests without any kinds of checks or limits
• Shopify had DMCA automation that either assumed guilt for each accusation or applied woefully inadequate heuristics in apllying them
• The accused have access to appeal process that leaves them suspended and thus unable to operate their businesses in the Shopify market for two weeks
• Shopify took legal action, not to protect their customers, but because reputational loss from the uproar their handling of this situation caused
From my perspective, there are two parties at fault here:
• The user that made this false takedown requests
• Shopify for:
• not doing due-dilgience on the user making them,
• for automating the process with poorly tested and/or inadequate algorithms/heuristics,
• for not promptly following up on appeals, leaving businesses unable to trade for an unreasonably long period of time
If not, you definitely can't require companies pay you to be able to make DMCA takedown notices.
Oops, went and looked - it's not free. So that's why.
Obviously a bug in the system there needs to be another tier for companies to make DMCA takedowns somehow, I bet someone there is working on that now. Bet it's not easy though.
on edit: what I don't understand though, do other companies pay for shopify just to make takedown notices? Their pricing model and the wording of the article implies they do - that's weird. If I was a lawyer doing shopify takedown notices for my clients I'd get pissed.
That behavior is strongly incentivized by US law (the DMCA), which holds Shopify liable for any copyright infringement by the shops on its site unless it performs takedowns in exactly this fashion.
To be sure, the law does require the person or entity filing the complaint to attest "under penalty of perjury" that the accusation of copyright infringement is true. But I am not aware of any cases ever where someone was prosecuted for filing false DMCA claims.
If this Shopify lawsuit were to hold the person submitting false claims liable for Shopify's expenses in handling the false claims, that might set a useful president.
It doesn't. It requires them to attest under penalty of perjury that they are authorised to act on behalf the copyright holder, but not to the accuracy of the take-down claim.
Yet another case where powerful legal actions are taken onlime with a single mouse click. Some (FEW) things really would benefit from a physical world friction, like notarization.
A business being taken offline for two weeks without notice or recourse is unacceptable in my opinion. How many small businesses have the reserves to weather that? And even if they did, the stress of it happening again a week later, or the week after that?
The penalty for the platform is that they lose their safe harbor; if a takedown has merit and they restore it before 10 days they could be sued too. I do wish platforms would go to bat for their users when a takedown was obviously fraudulent and restore the content immediately, but getting it wrong would be expensive.
[1] https://www.aclu.org/documents/text-digital-millennium-copyr...
Except youtube has not taken legal action on behalf of their users.
https://torrentfreak.com/bungie-files-lawsuit-to-punish-send...
https://torrentfreak.com/bungie-vs-fake-dmca-notices-google-...
https://torrentfreak.com/digital-trails-how-bungie-identifie...
https://torrentfreak.com/bungies-7-7m-lawsuit-vs-dmca-frauds...
Rights holder claims IP violation -> content uploader challenges the claim -> IP owner challenges the counter-challenge -> governmental agency steps in -> elevated number of unfavorable judgements result in legal action.
The current process places very little disincentive to place bogus claims, because very few content uploaders gain enough from content distribution to challenge the claim in a court of law and put possible perjury to the test, especially in non-obvious situations.
The modified process still places incentives to file claims out of judicial system, however it places disincentive on submitting bogus claims. Claims can still be submitted by automated systems, but presence of counter-claim incentivizes detection quality as drop in automated detection quality is automatically balanced by increased manual review cost, which is in turn balanced by risk of losing access to the quick process itself. Such system still incentivizes finding mutual agreement out of judicial system while protecting those willing to challenge on both ends.
But a question:
> The strikes will be removed if the merchant files a successful counternotice, but those can take up to two weeks to process.
Is there any legal reason acting on the counternotice can't be as quick and automatic as acting on the initial DMCA claim? It seems like this is something Shoppify could do to help, that is completely under their control. Why should processing the counternotice take two weeks?
Or is this a legal issue in the DMCA process, that a lag is required here?
But it never works out this way because this system wasn't intended to protect individuals, but rather large media groups. Record labels and movie studios didn't want their stuff easily copied. Hosting companies don't fear the wrath of an individual, but they do fear a multi billion dollar corporation. So they respond instantly and automatically to takedown notices, but are hesitant to put back anything based on a counter notice, lest the claimant - likely a large corporation or their agent - decides to take them to court for continuing to make it available.
Etsy takes this one step further and straight up doesn't implement the DMCA. Instead, they take copyright infringement notices and make that an automatic take down and strike. There is no counter notice option at all. As the defendant, you are told to contact the claimant and convince them to reverse the claim. Which of course they will never do no matter how good of a case you can make for it. In the mean time, your store gets shut down and any money still in your account is frozen. Ask Etsy what to do and you'll get one automatic reply followed by radio silence forever. I lost two years of work building up my first store and had to start another from the ground up.
Elsewhere in this thread people are posting that they are leaving shoppify because fake DMCA takedowns are such a problem. So this is clearly self-interested on Shoppify's part. The lawsuit against the John Doe is a good thing, but it's more just an announcement of intent, they haven't even found the guy yet!
Making the counternotices instantaneous, as the notices are, would remove a huge chunk of the harm here to shoppify's customers, no?
> but are hesitant to put back anything based on a counter notice, lest the claimant - likely a large corporation or their agent - decides to take them to court for continuing to make it available.
This is weird, as they scrupulously followed the DCMA, and should be immune from such suits, right? Of course, anyone can sue for anything, but if they put it back up only after a counter-notice, a judge should throw out a suit pretty quick, no? The whole point of the DMCA is that hosts are not liable if they have adhered to it, and putting something back up after a proper counternotice is adhering to it.
This is the way, Shoppify.
"promptly provides the person who provided the notification under subsection (c)(1)(C) with a copy of the counter notification, and informs that person that it will replace the removed material or cease disabling access to it in 10 business days; and"
"(C) replaces the removed material and ceases disabling access to it not less than 10, nor more than 14, business days following receipt of the counter notice, unless its designated agent first receives notice from the person who submitted the notification under subsection (c)(1)(C) that such person has filed an action seeking a court order to restrain the subscriber from engaging in infringing activity relating to the material on the service provider’s system or network."
1: https://www.aclu.org/documents/text-digital-millennium-copyr...
10 business days may have sounded like a shorter amount of time 20 years ago, for the use cases anticipated then. With what's actually occuring, and the widespread use of unjustified takedown requests, it is much harser than I think was planned.
Unfortuantely, if there were any ammendments to happen to DMCA now, I think they'd be in the wrong direction.
> Shopify launched an investigation and the company ultimately restored all items and removed all strikes, but that came at significant cost. “Those efforts cost Shopify tens of thousands of dollars in personnel time and resources.
“Dozens” is legalese for [x>12; x<151], so Shopify is suggesting a cost of moderation per single DMCA of “tens of thousands” / “a hundred or so” = “tens of tens or so”, which is “hundreds of dollars per request” in plain language.
So, if Shopify is placing the cost of actually considering a DMCA notice — as opposed to just machine-processing it like any other bigcorp — then that explains a lot about modern bigcorp account closures. They would rather lose your business to a false positive, than risk owing a process that costs $X00 per “please reconsider, here is my evidence” request from a customer.
This also makes it possible to estimate the potential cost in “risk of exposure” SEC filing terms for any proposed law that compels providers to 1) explain algorithmic decisions, 2) process appeals with human beings.
COICA, PROTECT IP, E-PARACITE, SOPA ... these evil ideas are just waiting to fill the void should anyone reopen the DMCA. And they will probably add language to make all online open for "inspection" by copyright holders, yet another attempt to outlaw proper encryption.
It would also probably be mail fraud to submit a bogus claim.
Though there is a balance here that needs to be found.
I still find it a little wierd that those takedowns are sent to shops. What copyright are the shops violating?
I sent a certified letter a few weeks ago and was not required to show ID.
Sending certified mail in the United States absolutely does not require showing any identification at all. You can even do it all online.
This sounds quite bizzare. Is this a DMCA feature or just Shopify's sloppiness ? How did they act upon DMCA notices without even knowing the identity of the claimant ?
paragraph 3A(vi) requires:
A statement that the information in the notification is accurate, and under penalty of perjury, that the complaining party is authorized to act on behalf of the owner of an exclusive right that is allegedly in-fringed.
> Information reasonably sufficient to permit the service provider to contact the complaining party, such as an address, telephone number, and, if available, an electronic mail address at which the complaining party may be contacted.
so if they can't get a hold of John Doe, these notices would seem to be invalidt to me.
But unless that penalty is actually imposed the law isn’t worth the paper it’s printed on.
So it is a vicious circle all over the net.
If it were Shopify's tail on the line, they would build automated tools to do things like compare all images posted on their site to those found online - there are search engines to do this. Then they would consider those results when looking into a DMCA notice.
2. Good for Shopify for suing these fraudsters.
I wish we had been successful in going after fraudster and US Senator Kay Bailey Hutchison who shut down everyone who ran against her with phony DMCA notices.
The subject of the DMCA takedown can appeal and then the original filer has a time period where they can escalate to a court case or drop it.
There is no reason for the anonymity of a takedown.