File hosting user agrement I want to host a small website on my server where friends (and friends of friends) can upload files to get a link so that other can download those files again. Exactly like a filehosting service. No account is needed on my site and I thought that I need some kind of user agrement that saves me a little bit from files that could be illegal on my server. Is it possible to add a &quot;by uploading you accept our user agrement&quot; to my site where rules are written like I am not responsible for uploaded files I do not scan or look at files so I don't know what is uploaded etc Would a text like that secure me for legal actions against me if someone uploads something illegal?
Not on its own, no Overview A ToS can be of some value, but will not fully protect the site operator (host). For one thing, a ToS is probably not binding on the user based on a contract of adhesion such as &quot;by using this site you agree to...&quot;. A specific act, such as clicking a checkbox that defaults to clicked or activating an &quot;I accept the terms&quot; button is probably required to make a ToS binding on the user. But a host must do more that obtain an agreement to its ToS. Once it has actual knowledge of illegal content, a host must take action to remove or disable it, or else it may be liable as if it had posted the content itself. It also depends what kind of &quot;something illegal&quot; is involved. The most common form is perhaps content that allegedly infringes copyright. Safe Harbor In the EU Article 14 of the EU Directive on electronic commerce (Directive 2000/31/EC) will apply (note that being a directive, rather than a regulation, 2000/31/EC) depends on implementation in national law, which may vary from one country to another. Article 14 reads: Hosting Where an information society service is provided that consists of the storage of information provided by a recipient of the service, Member States shall ensure that the service provider is not liable for the information stored at the request of a recipient of the service, on condition that: (a) the provider does not have actual knowledge of illegal activity or information and, as regards claims for damages, is not aware of facts or circumstances from which the illegal activity or information is apparent; or (b) the provider, upon obtaining such knowledge or awareness, acts expeditiously to remove or to disable access to the information. Paragraph 1 shall not apply when the recipient of the service is acting under the authority or the control of the provider. This Article shall not affect the possibility for a court or administrative authority, in accordance with Member States' legal systems, of requiring the service provider to terminate or prevent an infringement, nor does it affect the possibility for Member States of establishing procedures governing the removal or disabling of access to information. Article 14 means that when a host obtains actual knowledge of infringing or otherwise illegal content, the host must promptly delete that content or disable access to it. Such knowledge could come via a takedown notice. According to the page &quot;Copyright infringement and remedies in Germany&quot;: One of the main situations refers to platform operators. Once they have been informed about a specific infringement on their platform, they are required to remove the specific infringing content and to implement measures in order to prevent future violations. See also the Wikipedia article &quot;Notice and Take down&quot; which discusses Article 14, and points out that it does not define a specific notice and take down procedure, unlike the US provisions of 17 USC 512 (which includes the DMCA notice and take down procedure, and the related Safe Harbor provisions). Since Article 14 clearly envisages some sort of notice procedure, but not specific procedure has been defined in the laws of most EU member states, including Germany, some people use the US DMCA notice format, as describesd in this article. Such a notice may serve to give a German host &quot;actual knowledge&quot; and impose liability if the host fails to respond promptly. There have been recent legal cases which affect the procedures in such cases, as reported in &quot;Copyright 'safe harbours' for service providers need to be consistent&quot; from Pinsent Masons and &quot;Germany: Time To Hit Pause: Copyright Infringement On User Generated Platforms – When Is The Platform Provider Liable For Damages?&quot; from Morrison &amp; Foerster LLP. The Morrison &amp; Foerster article reads: Previous rulings by the CJEU have addressed both the application of the safe harbor principle set out in the EU E-Commerce Directive1 that shields hosting providers from liability for hosted unlawful third-party content of which they have no actual knowledge and, separately, the extent of infringement of copyright by hosting of, or linking to, copyright infringing third-party content under the EU Copyright Directive. But it is still unclear under which conditions the providers of the various online platforms that store and make available user-generated content, can rely on the safe harbor privilege applying to hosting providers to avoid liability, or whether they must not only take down the infringing content when they obtain knowledge of such content but also compensate the rightsholders of such content for damages for copyright infringement. The Pinsent Masons article reads: [A] ruling last year by a German court has highlighted an anomaly in the way 'safe harbour' protections ISPs enjoy under EU law apply in the case of copyright enforcement. It has confirmed that applications for blocking orders and injunctive relief are treated differently, despite the economic effect of those measures being the same. The safe harbour protections stem from the EU's E-Commerce Directive. That legislation prohibits service providers from being put under any general obligation to monitor for illegal activity by users of their service. In addition, where the service providers are mere conduits to infringing activity by others, they cannot be held liable for that activity unless and until they obtain 'actual knowledge' of the activity. At that stage, a service provider must act expeditiously to remove or to disable access to the information if they are not to be held liable themselves for infringement. However, EU copyright law cuts into these 'safe harbour' protections. It makes clear that rights holders can apply for an injunction against intermediaries whose services are used by a third party to infringe copyright. In Germany, however, changes made to the Telemedia Act in October 2017 have spurred debate over the admissibility and the requirements of blocking injunctions. Other unlawful content Other sorts of illegal content are possible, such as neo-Nazi propaganda and Child Pornography, which are criminal under German law. In theory Article 14 applies to such content as well as to alleged copyright infringements. But since these are serious crimes, the degree of promptness expected from a host will probably be greater. Conclusion A hosting provider will need, at the least, to respond to notices alleging copyright infringement or other illegal content, and provide an address to which such notices can be sent. A host might do well to implement the full DMCA takedown procedure. ToS provisions will not provide a shield against liability after a notice is sent to the host. A host may be required to block future access by those whose previous uploads have been found to be unlawful. This may require soem sort of log-in procedure. Thus a simple ToS provision, as described in the question, particularly in the absence of any log-in mechanism, and of any enforcement of the ToS provisions, will not be enough to shield the host from liability for unlawful content posted by users.
Generally speaking, you are only linking to other resources on the web, and generally that's not illegal. But that could be different depending on the country that hosts the site and the country of the user's access. This site seems to have no problem: http://thehiddenwiki.org/hidden-wiki/ Read their TOS, too: http://thehiddenwiki.org/2013/06/26/terms-of-service-and-privacy-policy/ That site is hosted in Romania (the domain is privately registered in Malaysia), but Germany and Romania are both EU. Now, what users may use those links for may be illegal. And that's still in legal flux in some jurisdictions, i.e. the hosting of a site of BitTorrent links that allow downloading of copyrighted material while the link itself does not contain the material themselves. See https://en.wikipedia.org/wiki/Legal_issues_with_BitTorrent Besides, a list of .onion links on the regular web is useless unless you know how to use the links; you're linking to resources on the &quot;dark&quot; that are not even directly accessible from those links on the &quot;bright&quot; web. Someone who wants to go to an .onion link needs to install Tor https://www.torproject.org/ to enable the DNS changes to access the .onion TLD (Top Level Domain). .onion is not even in the Internet's Root Domain; it's a special case TLD. https://en.wikipedia.org/wiki/.onion Installing and using TOR is one more step that someone has to take to make use of a link in the &quot;bright&quot; web to reach a link in the &quot;dark&quot; web. So your links are &quot;isolated&quot; in one more sense from usefullness, and that could be a legal defense, if it even comes down to it. Like anything, do your own research and draft a good TOS for your site. And, at the same time, using TOR is not illegal itself (but could be in some countries), but can result in illegal activity: https://en.wikipedia.org/wiki/Silk_Road_(marketplace) Read TOR's own legal FAQ: https://www.torproject.org/eff/tor-legal-faq.html.en
You are asking the wrong question. It should be: When you have downloaded the content and metadata, what are you allowed to do with it and what is forbidden? Somebody owns the copyright to the text and images in the thumbnail. This could be the operator of the third party website, or that site has licensed the content from yet another party. You haven't licensed it from anybody. So you can watch the content in accordance with the TOS, and your computer can evaluate the metadata to do it, but you cannot display it on your own site. Details will differ between jurisdictions, of course. You might also be held responsible for illegal content in the thumb you generate. Follow-up: There seems to be some question of what 'thumbnail' and 'card' mean in this context. This answer assumes a somewhat scaled-down representation of the content of the entire page, not just a collection of actual metadata like content length and expiry.
Yes, there would still be an obligation to comply with erasure requests – if the data subject can be identified, and if the GDPR applies. This is a case for Art 11 GDPR: processing which does not require identification. The pastebin site is not required to collect identifying info just in order to facilitate later deletion. If the site is unable to identify the data subjects, then the data subject rights (like access, rectification, erasure, restriction, or data portability) do not apply. Other rights like the right to be informed and the right to object do remain, though. But if the data subject provides sufficient additional information that makes it possible to identify their records, then the data subject rights apply again. In practice, this is likely going to mean that anyone with access to a paste will be able to request deletion, since the site would have no ability to verify the identity of the data subject beyond the information in the paste. None of this absolves the site from implementing appropriate technical and organizational measures to ensure the security of this data. Even though the pastes might not be directly identifying, they are personal data and are far from anonymous. Common practices like numbering pastes with a sequential ID or showing recent pastes on a homepage have to be viewed critically. My go-to recommendation is to assign a cryptographically random UUIDv4 ID to the post, so that it is practically impossible for anyone to find the paste unless they were given a link by the uploader. Your idea to delete pastes after a fairly short retention period is also good. This helps with security, and it is in line with the GDPR's data minimization and storage limitation principles: data may only be kept as long as necessary for its purpose. On the other hand, quick deletion might not be in line with the purpose of these pastes – it all depends on context. You mention that this is an US-based site. If so, there's a question whether GDPR would even apply. GDPR will apply per Art 3(2) if the data controller is offering its services to people who are in Europe. Here, “offering” does not mean mere availability of the website, but that the data controller intends the service to be used by such people, in particular if the service is somehow targeted or marketed to such people.
We cannot dispense personalized legal advice: that is what your attorney is for. However, I agree with your analysis that this is most likely covered by fair use, and indeed it is not obvious that you have taken anything that is protected. There is no creativity behind a number such as entries in the &quot;I did N pushups&quot; column. The arrangement of data into a web page passes the smidgen of creativity test, but &quot;210&quot; is not a creative number. The terms of service of a website cannot negate your right to use the website however you want in a non-infringing way. If your use is &quot;fair use&quot;, then they can't tell you that you can't use it. In case it turns out that &quot;fair use&quot; fails, the matter would hinge on what exactly the TOS says. They may have granted you permission to make use of their &quot;information&quot;. So there are three positive avenues for you to consider: not protected, fair use, and permitted. A practical difficulty is that a university lawyer is only interested in the interests of the university, and they are as likely to say &quot;don't do that&quot; or &quot;get permission&quot; as they are to say &quot;that is fair use&quot;. You can hire a lawyer who is paid to care about your interest, though there is never a guarantee that the lawyer's advice is correct. I think it is likely that the lawyer will tell you to not say anything until legally forced to, given the apparent rebuff of your request for special permission.
Yes, it's illegal. 18 USC 1030 (a) (5) (A) [Whoever] knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer [shall be punished as provided in subsection (c) of this section]. &quot;Damage&quot; is defined at (e)(8) to mean &quot;any impairment to the integrity or availability of data, a program, a system, or information&quot;. Your proposed attack would certainly cause impairment to the availability of the Stack Exchange system and the data and information which it hosts. Whatever else you may think about the Stack Exchange terms of service, they certainly do not authorize any user or moderator to &quot;destroy the site&quot; in any sense such as you describe. It's not necessary for the TOS to explicitly say &quot;you may not do X&quot;; it's enough that they don't say that you may do it. To use a firewall analogy, it's &quot;default deny&quot;. &quot;Protected computer&quot; is defined in (e)(2) to mean, essentially, any computer that is used in or affects interstate commerce. Which means practically every computer that has ever accessed the Internet, and certainly includes Stack Exchange servers. So your proposed attack would include all the elements of a violation of this section. Such a violation is punishable by up to five years' imprisonment if it causes a loss of more than $5000 (see (4)(A)(i)(I)), which if such an attack were successful, it certainly would. Greater penalties are possible in certain circumstances. Even if the loss does not exceed $5000, or if the attack is merely attempted but without success, it is still punishable by one year imprisonment or a fine ((4)(G)(i)). There is nothing in the terms of service saying you will go to federal jail for destroying stack exchange. Irrelevant. It is not up to Stack Exchange Inc. or its TOS to determine who does or doesn't go to federal prison. Rather, it is up to Congress to determine what conduct deserves such punishment (as they did in 1984 by enacting this law), up to federal law enforcement and prosecutors to investigate and make a case against an alleged violator, and up to the federal courts to determine if the accused is guilty and how they should be punished.
Is it possible to forbid linking to a site? No. It would be quite childish and out of touch to aspire to that level of control. Publishing a website/page for permanent, wide open access is inconsistent with prohibiting accessing it from certain venues, such as hypertext links. The prohibition of linking to a site is an attempt to enforce a certain degree of selective privacy. As such, it would not be enforced by U.S. courts, and it would be laughable if other jurisdictions proceeded differently. In United States v. Forrester, 512 F.3d 500, 510 (9th Cir. 2008), the court wrote that e-mail and Internet users have no expectation of privacy in the to/from addresses of their messages or the IP addresses of the websites they visit because they should know that this information is provided to and used by Internet service providers for the specific purpose of directing the routing of information. That rationale is equally --or perhaps even more-- applicable to a publisher, since in this case browsers and/or the publisher himself post(s) his URL (the equivalent of a "from" address of emails) "for the specific purpose of directing the routing of information". A hyperlink is an address, so it would be similar, I believe, to disallowing someone to list an address (on a map for instance). That analogy is inadequate because it overlooks essential differences between a web address and a physical (be it home, office, etc.) address. A web address is used for obtaining information which the initial publisher deliberately makes available to the public. By contrast, the act of having one's physical address registered somewhere else serves no such purpose whatsoever. Another important difference between a hyperlink and a physical address is that "consuming" a hyperlink simply cannot annoy or harm the initial publisher (except in the extreme scenario of Denial-of-Service attacks), whereas a common knowledge of a person's address may make that person vulnerable to harassment, trespassing, larceny, and other unlawful acts. A better analogy with hypertext links would be bibliographical references, since both are types of text strings for directing the consumer to a (or "the") source of information. Neither text string causes detriment to the author/source of that information. Can you imagine if bibliographical references were forbidden by statute or by the author of that information? The mere difference that a bibliographical reference needs to be copied/pasted, whereas it suffices to click on a hypertext link, cannot permit treating the permissibility of hypertext links any differently than the permissibility of bibliographical references.
Criminal liability is triggered by guilty knowledge. The people who run OnlyFans may know in general terms that it is probable that some illegal images exist on their servers, but so does everyone who allows the public to upload stuff. If that was illegal then the senior management of Google and Facebook would be liable to arrest on the same grounds and the Internet as we know it could not exist. Once the company becomes aware of a specific file that contains such material they need to remove it. If they fail to do so then they become liable. OnlyFans has been doing this: [OnlyFans] provides templates for each successive warning - explaining why material has been removed, and that failure to comply with terms of service may result in the closure of the account. [emphasis added] The site operators also become liable if they have a general policy of tolerating illegal material. This is a grey area; a prosecution would have to prove that the toleration was an active policy rather than merely ineffective moderation. There doesn't seem to be any evidence to support such a claim. Permitting an account to continue after deleting an offending file is not toleration of the offending file. The BBC report does not allege that the OnlyFans policy of multiple warnings has been applied to cases of underage content; rather it talks about cases of incest, bestiality and exploitation of vulnerable adults (such as homeless people), and only where the accounts were particularly popular. The linked articles do report cases where accounts have been set up advertising content by minors, but they were shut down as soon as the company was notified of them. The second article also quotes its source as saying that lots of such accounts get closed down all the time; there doesn't seem to be any evidence of toleration of that material specifically. So in conclusion it seems from the available evidence that OnlyFans have been complying with the law. It is telling that the BBC article specifically does not say that they have done anything illegal. If the BBC had found unambiguous evidence of illegal conduct by OnlyFans management then they would certainly have highlighted this.