CJEU has made it effectively impossible to run a user-generated platform legally
techdirt.com
techdirt.com
Want to deem whether content is allowed or not? Fine, provide an API that allows content to be scanned and return a bool.
Want to age-gate content? Fine, provide an identity service.
While both of these will reduce privacy, they'll achieve one of two objectives: Either those making these policies will realize the law they wrote is impossible to achieve, or it will at least provide an even playing field for startups vs incumbents if they succeed.
This proves that the laws they write are actually quite possible to achieve. It'll happen at the cost of some freedom and many of the nice things about the internet in general, but if you're a businessman looking at business potential and don't care too much about artistic creativity, the impact is actually quite minimal. I'm glad UK and US companies are hiring the most incompetent and useless "verification" companies out there to punish the government through a weird form of malicious compliance, but that won't last.
> Want to deem whether content is allowed or not? Fine, provide an API that allows content to be scanned and return a bool.
https://www.iwf.org.uk/our-technology/image-intercept/ exists for the UK, https://www.web-iq.com/solutions/atlas exists within the EU, https://projectarachnid.ca/en/#shield exists in Canada, https://www.microsoft.com/en-us/photodna exists worldwide, as well as https://developers.cloudflare.com/cache/reference/csam-scann... and https://get.safer.io/csam-detection-tool-for-child-safety. Someone even made an open source, CLIP-based tool that doesn't require hashes and can be tweaked in all kinds of ways: https://github.com/Haidra-Org/horde-safety/blob/main/horde_s...
These mechanisms not only exist, governments try their best to convince people to use them. I don't think you'll get away in court arguing that there is no accessible service for you to use. What happens when you fail after applying one of these services is up for debate, but so far, laws just want you to try your best to prevent abuse, and existing services are enough for that.
> Want to age-gate content? Fine, provide an identity service.
This is a problem now, but privacy-safe age verification is rolling out across the EU in the coming years. This is actually a super easy problem to solve when the government puts in the bare minimum amount of work. A decent argument against the UK/US/etc. but not so much so for an EU member state like in this court case.
Privacy-safe requiring a Google account and a phone logged into it...
In fact, I don't think you technically need to be signed into a Google account for Play Verification to pass, though many phones do make completing the Google sign-in a requirement.
...or the IT-Wallet which is currently deployed, and who's developers stubbornly refuse to remove the requirement.
> In fact, I don't think you technically need to be signed into a Google account for Play Verification to pass
And you're wrong, Play Integrity checks that your phone's account really downloaded the app from the Play Store, and so requires a (signed-in) account.
> many phones do make completing the Google sign-in a requirement
I'm not aware of any such phone, although they sure make it seem like it's a requirement
> Although you could also go with an Apple account
With a cheap, and very open and privacy-respecting, iPhone
The issue with this is internet companies are subject to the laws of all countries, whereas restaurants are subject to the laws they are located in. While someone at the scale of McDonalds may be able to handle laws at a worldwide scale, a small food truck cannot.
Do offline businesses have an API?
There are laws and they have to follow them and can’t just wait until someone complains.
Show me one place like a restaurant or a movie theater where I can put a poster in their shop window without them asking questions about the content of the poster.
Many newspapers still run classified ads (https://en.wikipedia.org/wiki/Classified_advertising).
Many supermarkets still have boards where people can announce that they have something to sell, are looking for a house cleaner, etc.
What about advertisement leaflets and letters to the editor in newspapers?
They just stopped caring when they made the input easier.
Just like websites stopped caring what ads they show.
On nearly every website with ads you can see scam ads
Now things become interesting when a users pays for ranking or 'verification' checkmarks. What makes that content different than a paid advertisment?
Hosts should make sure they know who is posting content on their platforms, so that in the event they are sued, they can countersue the creator of the content.
content for money
and
content not for money
The first should make the hoster liable, they have a contract involving money. The second should not automatically make the host liable.
IIRC the last time my mom came to me with a fake "You Must Upgrade Now" ad on her phone (from an otherwise-legit puzzle game), the ad-network did have a feedback function... but strangely there wasn't any category for fraud.
It might be less of an issue if there were clearer ad-vs-not boundaries, but that starts getting into issues like the browser security line of death [0].
[0] https://textslashplain.com/2017/01/14/the-line-of-death/
But user generated content? LOL, no.
If these companies aren't willing to put basic measures in place to stop even the most obviously illegal ads from airing, I have a lot of trouble having sympathy for them getting their just desserts in court.
[0]: https://www.msn.com/en-us/money/personalfinance/meta-showed-...
They deserve strict regulation because the carrier is actively choosing who sees them, and because there are explicit fiscal incentives in play. The entire point of Section 230 is that carriers can claim to be just the messenger; the only way to make sense of absolving them of responsibility for the content is to make the argument that their conveyance of the content does not constitute expression.
Once you have auctions for ads, and "algorithmic feeds", that becomes a lot harder to accept.
Incorrect, and it's honestly kinda fascinating how this meme shows up so often. What you're describing is "common carrier" status, like an ISP (or Fedex/UPS/post office) would have. The point of Section 230 was specifically to enable not being "just the messenger", it was part of the overall Communications Decency Act intended to aid in stopping bad content. Congress added Section 230 in direct reaction to two court cases (against Prodigy and CompuServe) which made service providers liable for their user's content when they didn't act as pure common carriers but rather tried to moderate it but, obviously and naturally, could not perfectly get everything. The specific fear was that this left only two options: either ban all user content, which would brutalize the Internet even back then, or cease all moderation, turning everything into a total cesspit. Liability protection was precisely one of the rare genuine "think of the children!" wins, by enabling a 3rd path where everyone could do their best to moderate their platforms without becoming the publisher. Not being a common carrier is the whole point!
I know that. I spoke imprecisely; my framing is that this imperfect moderation doesn't take away their immunity — i.e. they are still treated as if they were "just the messenger" (per the previous rules). I didn't use the actual "common carrier" phrasing, for a reason.
It doesn't change the argument. Failing to apply a content policy consistently is not, logically speaking, an act of expression; choosing to show content preferentially is.
... And so is setting a content policy. For example, if a forum explicitly for hateful people set a content policy explicitly banning statements inclusive or supportive of the target group, I don't see why the admin should be held harmless (even if they don't also post). Importantly, though, the setting (and attempt at enforcing) the policy is only expressing the view of the policy, not that of any permitted content; in US law it would be hard to imagine a content policy expressing anything illegal.
But my view is that if they act deliberately to show something, based on knowing and evaluating what it is that they're showing, to someone who hasn't requested it (as a recommendation), then they really should be liable. The point of not punishing platforms for failing at moderation is to let them claim plausible ignorance of what they're showing, because they can't observe and evaluate everything.
Personally, I'm not buying the slippery slope argument. I could be wrong of course but that's the great thing about opinions: you're allowed to be wrong :)
That does not appear to be what the court actually said, however.
And I 100% believe that all advertisements should require review by a documented human before posting, so that someone can be held accountable. In the absence of this it is perfectly acceptable to hold the entire organization liable.
> There’s nothing inherently in the law or the ruling that limits its conclusions to “advertisements.” The same underlying factors would apply to any third party content on any website that is subject to the GDPR.
So site operators probably need to assume it doesn’t just apply to ads if they have legal exposure in the EU.
The court uses the phrase “an online marketplace, as controller” in key places. This suggest to me that there can be online marketplaces that are not data controllers.
The court cites several contributing factors to treat the platform as data controller: they reserved additional rights to upload content, they selected the ads to display. Github only claims limited rights in uploaded content, and I'm not sure if they have any editorialized (“algorithmic”) feeds where Github selects repository content for display. That may make it less likely that they would be considered data controllers. On the other hand, licensing their repository database for LLM training could make them liable if personal data ends up in models. I don't think that's necessarily a bad thing.
I doubt that is enough to trigger this ruling, but algorithmic content is absolutely pervasive these days.
They are but you can keep PII if it is relevant to the purpose of your activity. In this case the author needs you to share his PII, in order to exercise his moral and copyright rights.
I never really understood how that system is supposed to work.
So on the one hand, Section 230 absolves the hoster of liability and tells an affected party to go after the author directly.
But on the other hand, we all rally for the importance of anonymity on the internet, so it's very likely that there will be no way to find the author.
Isn't this a massive vacuum of responsibility?
If someone builds up a reputation anonymously then that reputation itself is something that can be destroyed when a platform destroys their account etc.
> (...) an unidentified third party published on that website an untrue and harmful advertisement presenting her as offering sexual services. That advertisement contained photographs of that applicant, which had been used without her consent, along with her telephone number.(...) The same advertisement nevertheless remains available on other websites which have reproduced it.
Anonymous author, great reach, enough damage for the victim to take a lawsuit all the way to the CJEU.
What exactly provided great reach here? Is it the creator or something else.
> The same advertisement nevertheless remains available on other websites which have reproduced it.
This presumably involved the actions of 3rd parties not just the original content creator.
Irrelevant, in the initial understanding of Section 230 that this thread was advocating for returning to. Only the author is responsible for the content in that framework, not the platforms distributing and/or promoting it.
“letters to the editor” are a very old form of user generated content, but the act of selecting a letter and placing it in a prominent position isn’t a neutral act.
For clarity, they do maintain limited editorial discretion. Section 230(c)(2) states that service providers and users may not be held liable for voluntarily acting in good faith to restrict access to "obscene, lewd, lascivious, filthy, excessively violent, harassing, or otherwise objectionable" material.
Further, Section 230 contains statutory exceptions. This federal immunity generally will not apply to suits brought under federal criminal law, intellectual property law, any state law "consistent" with Section 230, certain privacy laws applicable to electronic communications, or certain federal and state laws relating to sex trafficking.
I love the Internet but it normalizes bad behavior and to the extent the CJEU was tracking toward a new and more stringent standard, well earned by the Internet and its trolls.
>But on the other hand, we all rally for the importance of anonymity on the internet, so it's very likely that there will be no way to find the author.
So:
1) We all rally for the importance of anonymity (wrt general speech) EVERYWHERE, before even (and critical to) the founding of America. Writing like the Federalist Papers were absolutely central to arguments for the US Constitution, and they were anonymous. "The Internet" is not anything special or novel here per se when it comes to the philosophy and politics of anonymous speech. There has always been a tension with anonymous speech risks vs value, and America has come down quite firmly on the value side of that.
2) That said, "anonymous" on the internet very rarely actually is to the level of "no way to find the author with the aid of US court ordered process". Like, I assume that just as my real name is not "xoa" your real name is not "xg15", and to the extent we have made some effort at maintaining our pseudonymity it'd be somewhat difficult for any random member of the general public to connect our HN speech to our meatspace bodies. But the legal process isn't limited to public information. If you have a colorable lawsuit against someone, you can sue their placeholder and then attempt to discover their identity via private data. HN has our IP addresses if nothing else, as does intermediaries between the system we're posting from and HN, as well as possibly a valid email address. Which can potentially by themselves be enough breadcrumbs to follow back to a person and have enough cause to engage in specific discovery against them. And this is without any money getting involved, if there are any payments of any kind that leaves an enormous number of ripples. And that's assuming nobody left any other clues, that you can't make any inferences about who would be doing defamatory speech against you and narrow it down further that.
Yes, it's possible someone at random is using a massive number of proxies from a camera-less logless public access point with virgin monero or whatever and perfect opsec, but that really is not the norm.
3) Hosters not being directly liable doesn't make them immune to court orders. If something is defamatory you can secure an order to have it removed even without finding the person in question. And in practice most hosters are probably going to remove something upon notification as fast as possible, as in this case, and ban the poster in question on top.
So no, I don't think it's a "a massive vacuum of responsibility" anymore than it ever was, and the contrast is that eliminating anonymous speech is a long proven massive risk to basic freedoms.
The Russmedia ruling of the ECJ: Towards a “Cleannet”?
A change in liability privilege for online providers will lead to a “cleaner”, but also more rigid, monitored internet, says Joerg Heidrich.
> There’s nothing inherently in the law or the ruling that limits its conclusions to “advertisements.” The same underlying factors would apply to any third party content on any website that is subject to the GDPR.
False. A European court's conclusions are specifically around the case it is ruling about, so it is inherently limited to the exact circumstances of that case, without the need for it to specify that. They do not set precedent.
Could this lead to censorship as well? For example you could go to a website or community you don’t like, and share information that could be seen as “sensitive personal data” and then file an anonymous complaint so they get into legal trouble or get shut down?
So the community would have to accept community generated ads and not checking them. I'd say it's pretty rare.
And for quick reference, what the judgement actually entails:
On those grounds, the Court (Grand Chamber) hereby rules:
1. Article 5(2) and Articles 24 to 26 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) must be interpreted as meaning that the operator of an online marketplace, as controller, within the meaning of Article 4(7) of that regulation, of the personal data contained in advertisements published on its online marketplace, is required, before the publication of the advertisements and by means of appropriate technical and organisational measures,
– to identify the advertisements that contain sensitive data in terms of Article 9(1) of that regulation,
– to verify whether the user advertiser preparing to place such an advertisement is the person whose sensitive data appear in that advertisement and, if this is not the case,
– to refuse publication of that advertisement, unless that user advertiser can demonstrate that the data subject has given his or her explicit consent to the data in question being published on that online marketplace, within the meaning of Article 9(2)(a), or that one of the other exceptions provided for in Article 9(2)(b) to (j) is satisfied.
2. Article 32 of Regulation 2016/679 must be interpreted as meaning that the operator of an online marketplace, as controller, within the meaning of Article 4(7) of that regulation, of the personal data contained in advertisements published on its online marketplace, is required to implement appropriate technical and organisational security measures in order to prevent advertisements published there and containing sensitive data, in terms of Article 9(1) of that regulation, from being copied and unlawfully published on other websites.
3. Article 1(5)(b) of Directive 2000/31/EC of the European Parliament and of the Council of 8 June 2000 on certain legal aspects of information society services, in particular electronic commerce, in the Internal Market (‘Directive on electronic commerce’) and Article 2(4) of Regulation 2016/679 must be interpreted as meaning that the operator of an online marketplace, as controller, within the meaning of Article 4(7) of Regulation 2016/679, of the personal data contained in advertisements published on its online marketplace, cannot rely, in respect of an infringement of the obligations arising from Article 5(2) and Articles 24 to 26 and 32 of that regulation, on Articles 12 to 15 of that directive, relating to the liability of intermediary providers.
How do they think a hosting provider can check if personal data is accurate? Maybe if privacy didn't exist and everybody could be scrutinized.. but the ruling refers to the GDPR to justify this, and the GDPR is about _protecting_ privacy. So, what is it?
And for everything else.. is the material sensitive or not? How can anyone know, in advance?
I suggest every web site host simply forward all and every input to an EU Court address, and let them handle it. They're the ones suggesting that hosts should make sure that personal data on someone is "accurate", they're the ones demanding that the data should not be "sensitive", so they can as well be responsible for vetting the data.
But they're all crazy anyway, as they demand that a website must block anyone from copying the content.. so how, at the same time, can you even have a website? A website which people can watch?
If the ruling was about collecting data which isn't for displaying, i.e. what a net shop does (address, credit card number), then this would be understandable. But provisions for that already exists, instead they use this (GDPR) as a tool to extend this to user-created content. It's not limited to ads, and ads do need something done. Something totally different from this.
Are you sure? We might have a different reading then, I felt it was obvious it was because it was an ad. And even more, an ad display through an algorithm, I.E it wouldn't apply to Craigslist or platform that display user-generated ads in chronological order.