Comment by Lentor | Hacker News Reader

Comment by Lentor | Hacker News Reader

We've been affected by these fake DMCA for one months now and there is ZERO support from Shopify.

(thanks to the OP for shedding light on this situation)

Running a business through Shopify has become very risky these days.

We are now working on transferring our online stores to Woocommerce where it is far more difficult to get your content removed with bogus DMCA.

Picture the situation to understand the Nightmare:

1) You are driving paid traffic to a product page with good ROAS because your ads are optimized after months.

2) Then the competitor submits a fake DMCA

3) Your page is content is removed automatically by Shopify (no check on their end)

4) Your optimized ads are now directing customers to an empty page

5) Then you risk having your ads accounts flagged

You might think you could just redirect the url to a duplicate? That would be a great solution indeed. BUT

6) The competitor is monitoring your product page and immediately submits another fake DMCA

7) You redirect again

8) Then another fake DMCA

Now WAIT for the cherry on the Cake.

9) After 4 or 5 fake DMCA, you Shopify account admin is locked

10) You may even get suspended automatically by shopify

11) Then you can no longer fulfill your orders from customers

12) Then your customers start making chargebacks

13) Then the payments processors on which you've built a reputation over the years can suspend you

14) Shopify (zero)support asks you to reply to the DMCA with a counter notice and WAIT for the Trust & Safety Team to get back to you

15) Then you receive an auto reply from them telling you that the other party has been informed and that you may repost your content in 2 weeks unless the scammer has filed a court action.

16) Then after 2 weeks, you repost your content

17) Then the same or the next day, the same scammer (watching you like a hawk) issues another fake DMCA for the same product page through the same fake account.

ISN'T IT BEAUTIFUL?

** Shopify could literrally STOP 80% of these false DMCA by just adding a field on their rudimentory form: asking to verify a phone number or upload an ID but NO, that seems to be a task too Challenging for a billion dollar company like Shopify

This could easily be fixed by having a consequence to fake DMCA reports. A fine or something. Something messed up that Youtube does is when someone files a copyright claim they get to take the money from your video. I have had times when I was sent a copyright strike for videos I have made and when I check my video is usually much older than the music that I am being accused of stealing.

I always win these disputes for obvious reasons but Youtube has never offered to make things right.

Basically the accused is guilty until proven innocent which is not how it should be.

Somehow this issue always seems to arise when forming agreements with large platforms.

Wait, is youtube still doing that? I thought they moved to putting the money in escrow until the dispute was settled, which cut down on the majority of the false claims?

It’s been a couple years since my last attempted strike but it’s good to hear that they are trying solutions. Maybe that’s why I haven’t gotten one in a while.

Part of the problem is many of these companies have a faux DCMA process.

Rather than use the “official” DCMA process, they build a reporting mechanism in front of it. People can abuse it without facing federal repercussions.

Isn't a fake DMCA report "lying for profit" AKA fraud? And it's done on a computer making wire fraud, a federal crime. AFAIK this is already against the law and can be prosecuted, no need to add a new law for fines.

DMCA claims are made under penalty of perjury. Perjury is usually a felony.

This is not good enough. I wonder if they'll backflip on "Shopify is replacing customer service with AI chatbots"[1].

[1] https://www.reddit.com/r/stocks/comments/153z5r7/shopify_is_...

> asking to verify a phone number or upload an ID

I’m pretty sure they’re not legally allowed to add extra requirements like this. If they were, sites could make it almost impossible to take things down by adding a lot of requirements

As I learned from this comment [0], that kind of is a requirement. Section 512 requires a notice contain:

> Information reasonably sufficient to permit the service provider to contact the complaining party, such as an address, telephone number and email address

I think another poster hit the nail on the head, when they said (and I'm paraphrasing), these aren't real DMCA takedowns. They're a different system these hosters bend to that acts outside of it. By being more liberal in what gets shut down, they comply with DMCA which is much more onerous on what is required to shut things down.

In fact, if this was really the DMCA process, people would have legal standing to go after the accusers via Section 512.

Further, I'm also pretty sure you don't have to take things down right away. You do have time to investigate the alleged violation and decide whether you are in the right.

Basically, all these players are hiding behind systems they put in place so they wouldn't come close to DMCA issues or have to pay anyone to investigate notices.

[0]: https://news.ycombinator.com/item?id=37986095

Has anyone managed to prove that an email address is not "reasonably sufficient to permit the service provider to contact the complaining party"?

I doubt it. I expect that Shopify doubts it, too.

The law itself is explicit, no one needs to prove what the word "and" means.

> such as an address, telephone number and email address

In this context, I think "and" could be reasonably argued to mean either "and" or "or". And given that the purpose of the contact information is "Information reasonably sufficient to permit the service provider to contact the complaining party" and not for identity verification, I'd guess that no company is willing to go to court to test this.

And means and. Arguing that and means or is an interesting strategy I suppose but and means and.

But is "and" being used to form a set of acceptable forms of identification (any of which would be sufficient), or is it joining the forms of identification together as all being required?

It's joining them all together, but the whole thing is presented as an example. Any avenue that provides the ability to contact presumably meets that standard.

If Shopify were to alter their contact info requirement, it would clearly be with a different goal in mind than the one laid out in that sentence. That's assuming of course, that the current requirements have actually led to communication.

Coming back to add, I think the following sentences have identical meanings:

"Acceptable forms of identification include driver's license, passport, and birth certificate."

"Acceptable forms of identification include driver's license, passport, or birth certificate."

This is currently being debated in the highest court of the USA, right now as we speak. It’s pretty dumb and absurd to us techies but apparently it’s not a settled matter in law.

https://www.inquirer.com/opinion/supreme-court-first-step-ac...

> Information reasonably sufficient to permit the service provider to contact the complaining party, such as an address, telephone number and email address

The words "information reasonably sufficient" set the bar of compliance. The list is an example, not an explicit requirement; hence the words "such as".

To blindly listen to anonymous reports on the internet is not good faith. Shopify has a duty to handle these in good faith and it’s infinitely foreseeable that this bad faith conduct could result in serious damage to their customers (as you explain).

That does sound unbearable. May I ask what market segment you operate in? Do you make your own products or are you rebranding some kind of generics?

These companies need to be dismantled. Every small shop this happens to should focus on documentation and suing for damages. This is negligence.

Reply on news.ycombinator.com