Would I be liable for any illegal traffic that comes through my VPN? Say I hosted a virtual private network somewhere on a cloud hosting provider, say an amazon aws server. If I shared access to that VPN to other people (say for simplicity's sake, 5 friends), someone could potentially use it to access illegal content while trying to remain anonymous. I know I could be subpoenaed or sued for this. Of course, being personally innocent, I would hand over the server logs, or do whatever was required of me. 2 cases: If the logs showed that the illegal traffic was going to another IP address not in my possession, am I still liable for routing that traffic? If the logs for whatever reason couldn't prove that the illegal traffic was going to another specific IP address not in my possession, does liability default to me personally, for having ownership over the VPN server which routed it? I'm trying to ascertain the level of risk associated with hosting my own VPN server, for extra-personal use, but not as a business. No contracts, no fees, just like a club that also accepts donations to keep the service alive.
Generally speaking, in U.S. law, a provider of a service via the Internet, such as a VPN, is immune from liability for user generated content pursuant to Section 230, so long as a copyright take-down notice is in place is complaints are lodged. So, you do not default to liability or have liability merely as a result of running a VPN. But, there is a second problem. If the VPN is very small and you can't be distinguished from other users, you could conceivably face risk not as a VPN operator, but as a user of the VPN who is confused for someone engaging in illegal activity. For example, suppose that there were five users, and that two could be ruled out due to being in places with no Internet access or being sick in the hospital, etc., leaving three possible suspects, and some weak circumstantial evidence pointed to you. You could easily become a prime suspect and maybe even end up on a terrorism watch list, even if it might be difficult or impossible to actually prove any wrongdoing on your part.
A web site that is serious on protecting some content behind a paywall will put the protected content, or a version of the page with both protected and unprotected content, on separate page or pages, so arranged that a user will not be able to follow the link until that user has signed in and been accepted as an authorized user. A site that merely uses CSS to hide "protected" content is not really protecting it. CSS is designed to be modified by the ultimate user -- that is part of its function. If the site chooses to send you content, you are entitled to read it. Even if some of the content has a CSS tag attached which suppresses or obscures the display of that content, they know perfectly well that any user can supersede this with local CSS, and so I don't see how they have any legal claim, nor any way of knowing if you have accessed the "hidden" content or not. If you attempt to bypass or hack a login screen, that might be circumvention under the US DMCA, or "Unauthorized computer access" under any of several laws.
Your VPN scenario is why you have to show the banner to everyone. If you somehow knew beyond any doubt that someone was not in the EU, then you would not have to show a banner, but because you can't verify that, you should always show the banner. Doing so also protects against accidentally violating a similar law in another country; the GDPR is the best-known privacy law, but it is far from the only one. It's good practice to ask for people's permission before collecting their information anyway.
There are a number of existing legal sites that do this, for free or for pay. The main concern for a website operator pertains to the DMCA "safe harbor" provisions, which protect against vicarious liability for infringement. A "report piracy" option is not sufficient; see this answer to a related question.
On the face of the CFAA: How does Aaron Swartz's mass download from JSTOR constitute hacking? He exceeded his authorised access on a protected computer. If this is hacking (the masking of one's IP address) then doesn't that make using VPN hacking? Hacking is not a term used in CFAA. In Aaron's case changing the IP address was a necessity for him to exceed his authorised access; if he stopped when blocked then the unauthorised access would have stopped. If you are authorised to use a VPN for access then you have not exceeded your authorisation, have you?
It's possibe to cover auto-starting apps and cookies under the definition. I'm not convinced and could argue against that but I don't think it matters. The tiny extract you linked isn't a law. It is a definition. It does not say &quot;these things are illegal&quot;. For that, we have to zoom out a little. Section 43 includes the offense in question (emphasis mine): If any person without permission of the owner or any other person who is incharge of a computer, computer system or computer network... introduces or causes to be introduced any computer contaminant or computer virus... So back to the question. Could Steam be considered a virus? Maybe. Is it illegal? No. On the other hand, if I were to gain access to your computer and download Steam, yes that could be an example of breaking that law.
Hypothetically speaking, if a program doesn't come with a EULA, does that mean someone in possession of it (who isn't the owner) would be breaking the law if they used it? If the copy on the stick was lawfully made with permission of the copyright holder, then you can lawfully use the software. Someone who lawfully comes into possession of a lawfully made copy of the software (that was not a backup) has the right to use that software in the ordinary way. For example if someone found a USB stick lying on the ground and it had software on it but no EULA, could they use the software? Maybe, but it would be hard for them to know whether they could or not. It might be a backup. It might be an unlawful copy. There was a case where a person found a CD in the trash that was clearly an original. The package had a shrink wrap agreement, but he found the CD without the package. The court held that he had every right to use the software on the CD (since it was a lawfully-made copy and not a backup) and was not bound by the EULA (since he hadn't opened the package). But he was very fortunate in being able to demonstrate these facts.
It's not clear exactly what you're asking, when you say "the company I work for" – i.e. are you asking "can they fire me?" (almost certainly they can, even if their TOS thinking is legally misguided – unless in your country there are laws that prevent firing employees). To be certain, you need to hire an attorney who is sufficiently savvy about web page technology that they can accurately judge what you are doing, and whether you can fruitfully resist their demands. You seem to be skeptical of their position because you are "not affecting their servers in any way". The TOS is not about affecting their servers, it is about affecting their intellectual property. It appears that your code does a number of the prohibited actions such as and perhaps most importantly "modify". If you have distributed a program that allows users to modify company content on their own computers, then the user might be in violation of the TOS, but not you (since you're not running a server that redistributes). However, I am betting that in order to create and test the program you had to violate the TOS. Additionally, you could be vicariously liable for the infringements of others, especially if this program can only be used to infringe on copyright, and you know this fact. That is pretty much the end of the legal part. As for how you should respond, your attorney, and not Law SE, deals in recommendations.