Who is legally responsible for malware delivered through an ad on a website, the website or the ad network? Forbes recently started to block people who use an adblocker from accessing their website. The irony is that only a couple of days later, the ad network they use started spreading malware, ransomware to be exact, through the ads. Suppose a Forbes user gets ransomware because of malicious ads on the Forbes website and loses important data (or at least valuable time while restoring the backup). Who is responsible for the malware infection? Forbes, because they're the website the user visited? The ad network that provided a vector for infection and didn't properly check their content? Or the makers of the ad, because they made the ad with malicious intent? Can the user sue the responsible party for damages? Does it make a difference whether the user has taken due diligence with software updates and patches? The main jurisdictions I wonder about are Belgium and the USA.
There is no real answer to that question at this point. If on filed such a suit, it would probably be under a negligence theory. You would sue: Forbes, because they're the website the user visited? The ad network that provided a vector for infection and didn't properly check their content? The makers of the ad, because they made the ad with malicious intent? and anyone else who might have been negligent. You then have to prove they were negligent. Can the user sue the responsible party for damages? You can sue anyone for anything. The problem is winning. Does it make a difference whether the user has taken due diligence with software updates and patches? It might. Contributory negligence would be an obvious defense to such a suit.
The U.S. FTC gave extensive guidance on this subject in March 2013. (You may have noticed shortly thereafter that conspicuous disclosures of free samples and compensation started popping up in reviews and posts around the web.) The FTC's FAQ covers this question in such detail I would just encourage people to visit it directly. However, as is the custom on Stack Exchange, I will reproduce the most salient content here: If an endorser is acting on behalf of an advertiser, what she or he is saying is usually going to be commercial speech – and commercial speech violates the FTC Act if it’s deceptive. The FTC (ironically?) refers to 16 CFR §255 as "the Guides." The Guides, at their core, reflect the basic truth-in-advertising principle that endorsements must be honest and not misleading. An endorsement must reflect the honest opinion of the endorser and can’t be used to make a claim that the product’s marketer couldn’t legally make. In addition, the Guides say if there’s a connection between an endorser and the marketer that consumers would not expect and it would affect how consumers evaluate the endorsement, that connection should be disclosed. For example, if an ad features an endorser who’s a relative or employee of the marketer, the ad is misleading unless the connection is made clear. The same is usually true if the endorser has been paid or given something of value to tout the product. The reason is obvious: Knowing about the connection is important information for anyone evaluating the endorsement.
Like many other jurisdictions, in the UK sites like the Daily Mail are liable for the content they host. In other words, the legal issue here is they either do not have the staff available to (or simply do not want to) spend the time moderating the comment sections in order to remove potentially defamatory or otherwise illegal content. As Lag added in a comment below: another legal reason may be liability for publishing something that creates a substantial risk of seriously impeding or prejudicing the course of justice in some ongoing legal proceeding. Far easier to prevent it beforehand than moderate it (and risk missing it) later. Content on Twitter (for example, replies to their own tweets), on the other hand, is not the Daily Mail's problem to moderate.
Congrats, you've done well to minimize your processing of personal data. But I think you're still processing personal data, and are subject to the GDPR. Serving a website necessarily involves processing an IP address. This IP address will typically be personal data. While you are not storing the IP address, the GDPR's definition of “processing” extends beyond storage and pretty much covers doing anything with that IP address. As far as I know this is not an entirely settled matter, but it's better to err on the side of caution and to assume that you are in fact performing a processing activity. Even a static web page can easily lead to additional relevant processing of personal data, for example if the HTML embeds resources from third party domains. Since your website is clearly targeted at the public, it does not fall under the GDPR's exception for “purely personal or household” purposes. So I think you do need a (minimal) privacy notice that contains at least the items mentioned in Art 13 GDPR. The main reason why some people try to avoid posting a privacy notice is because it must disclose your identity and contact details. But in Germany, that information has to be provided anyway due to the Impressumspflicht. As part of your GDPR compliance obligations, you must protect how data is processed by others on your behalf. A hosting provider will typically act as your data processor. For this to be legal, you need a contract / data processing agreement that fulfills the conditions in Art 28 GDPR. This contract binds the data processor to only use the data as instructed by you, and not for their own purposes. European hosting providers sometimes include the necessary terms in their terms of service / AGB, but you should check to make sure. Netcup expects you to accept their data processing amendment in your account settings. In the hypothetical case that you were not processing any personal data at all, the GDPR would not apply and it wouldn't require you to post a privacy notice. Other laws might still have information obligations, notably the German TMG and TTDSG.
That depends on several things: Do the authorities have solid evidence of what happened? Authorities in which country? A screenshot is not evidence, that would be easily faked. It takes access to the metadata. Does the country where the perpetrator lives consider it a serious crime? Note that when two people exchange such messages, who is the criminal and who is the victim can depend on the ages of both, and the exact rules of who is guilty of what may differ from country to country. There are countries which prosecute child abuse by their citizens or residents abroad once they come back. So it may be that nothing happens, or it may be prosecuted.
Yes One could certainly put up a site whose only content was a link to another domain. And I can't find any law which this would violate. If the link is a &quot;deep link&quot;, and if it bypasses a log-in page, while the other site is so designed that all access is intended to go through the login, I believe (but cannot at the moment verify) that the owner of the other site could claim that this violates their copyright. In any case it is not a good idea.But a link to an appropriate page should have no problem, nor should pointing your domain at an appropriate entry page. Therefor, since simply re-pointing a domain should have the same effect as simply linking, in those cases where it works at all, it should be legal. Doing it with an iframe, which would truly open another site within your site, may not be if the other site forbids such use, as in the ToS. The case law on that is not settled, but many sites object to it, as the answer by @BlueDogRanch points out. I don't see a good reason why one would want to do this, but that isn't the question. Copying the HTML of another site and modifying the URLs while keeping the content the same would pretty clearly be a copyright infringement, besides being a lot of work to little obvious point. It also isn't what the question asked about. Building a one-page site that has only a simple link or a redirect would clearly be legal, and would serve the purpose of causing your domain to lead a user to another site, but it isn't, strictly speaking, what was asked about either.
Not on its own, no Overview A ToS can be of some value, but will not fully protect the site operator (host). For one thing, a ToS is probably not binding on the user based on a contract of adhesion such as &quot;by using this site you agree to...&quot;. A specific act, such as clicking a checkbox that defaults to clicked or activating an &quot;I accept the terms&quot; button is probably required to make a ToS binding on the user. But a host must do more that obtain an agreement to its ToS. Once it has actual knowledge of illegal content, a host must take action to remove or disable it, or else it may be liable as if it had posted the content itself. It also depends what kind of &quot;something illegal&quot; is involved. The most common form is perhaps content that allegedly infringes copyright. Safe Harbor In the EU Article 14 of the EU Directive on electronic commerce (Directive 2000/31/EC) will apply (note that being a directive, rather than a regulation, 2000/31/EC) depends on implementation in national law, which may vary from one country to another. Article 14 reads: Hosting Where an information society service is provided that consists of the storage of information provided by a recipient of the service, Member States shall ensure that the service provider is not liable for the information stored at the request of a recipient of the service, on condition that: (a) the provider does not have actual knowledge of illegal activity or information and, as regards claims for damages, is not aware of facts or circumstances from which the illegal activity or information is apparent; or (b) the provider, upon obtaining such knowledge or awareness, acts expeditiously to remove or to disable access to the information. Paragraph 1 shall not apply when the recipient of the service is acting under the authority or the control of the provider. This Article shall not affect the possibility for a court or administrative authority, in accordance with Member States' legal systems, of requiring the service provider to terminate or prevent an infringement, nor does it affect the possibility for Member States of establishing procedures governing the removal or disabling of access to information. Article 14 means that when a host obtains actual knowledge of infringing or otherwise illegal content, the host must promptly delete that content or disable access to it. Such knowledge could come via a takedown notice. According to the page &quot;Copyright infringement and remedies in Germany&quot;: One of the main situations refers to platform operators. Once they have been informed about a specific infringement on their platform, they are required to remove the specific infringing content and to implement measures in order to prevent future violations. See also the Wikipedia article &quot;Notice and Take down&quot; which discusses Article 14, and points out that it does not define a specific notice and take down procedure, unlike the US provisions of 17 USC 512 (which includes the DMCA notice and take down procedure, and the related Safe Harbor provisions). Since Article 14 clearly envisages some sort of notice procedure, but not specific procedure has been defined in the laws of most EU member states, including Germany, some people use the US DMCA notice format, as describesd in this article. Such a notice may serve to give a German host &quot;actual knowledge&quot; and impose liability if the host fails to respond promptly. There have been recent legal cases which affect the procedures in such cases, as reported in &quot;Copyright 'safe harbours' for service providers need to be consistent&quot; from Pinsent Masons and &quot;Germany: Time To Hit Pause: Copyright Infringement On User Generated Platforms – When Is The Platform Provider Liable For Damages?&quot; from Morrison &amp; Foerster LLP. The Morrison &amp; Foerster article reads: Previous rulings by the CJEU have addressed both the application of the safe harbor principle set out in the EU E-Commerce Directive1 that shields hosting providers from liability for hosted unlawful third-party content of which they have no actual knowledge and, separately, the extent of infringement of copyright by hosting of, or linking to, copyright infringing third-party content under the EU Copyright Directive. But it is still unclear under which conditions the providers of the various online platforms that store and make available user-generated content, can rely on the safe harbor privilege applying to hosting providers to avoid liability, or whether they must not only take down the infringing content when they obtain knowledge of such content but also compensate the rightsholders of such content for damages for copyright infringement. The Pinsent Masons article reads: [A] ruling last year by a German court has highlighted an anomaly in the way 'safe harbour' protections ISPs enjoy under EU law apply in the case of copyright enforcement. It has confirmed that applications for blocking orders and injunctive relief are treated differently, despite the economic effect of those measures being the same. The safe harbour protections stem from the EU's E-Commerce Directive. That legislation prohibits service providers from being put under any general obligation to monitor for illegal activity by users of their service. In addition, where the service providers are mere conduits to infringing activity by others, they cannot be held liable for that activity unless and until they obtain 'actual knowledge' of the activity. At that stage, a service provider must act expeditiously to remove or to disable access to the information if they are not to be held liable themselves for infringement. However, EU copyright law cuts into these 'safe harbour' protections. It makes clear that rights holders can apply for an injunction against intermediaries whose services are used by a third party to infringe copyright. In Germany, however, changes made to the Telemedia Act in October 2017 have spurred debate over the admissibility and the requirements of blocking injunctions. Other unlawful content Other sorts of illegal content are possible, such as neo-Nazi propaganda and Child Pornography, which are criminal under German law. In theory Article 14 applies to such content as well as to alleged copyright infringements. But since these are serious crimes, the degree of promptness expected from a host will probably be greater. Conclusion A hosting provider will need, at the least, to respond to notices alleging copyright infringement or other illegal content, and provide an address to which such notices can be sent. A host might do well to implement the full DMCA takedown procedure. ToS provisions will not provide a shield against liability after a notice is sent to the host. A host may be required to block future access by those whose previous uploads have been found to be unlawful. This may require soem sort of log-in procedure. Thus a simple ToS provision, as described in the question, particularly in the absence of any log-in mechanism, and of any enforcement of the ToS provisions, will not be enough to shield the host from liability for unlawful content posted by users.
At what point is unsolicited explicit material considered harassment? How do the advertisers have the right to broadcast something that I would definitely bring up to HR if I heard a coworker say? The contexts are too different. One cannot expect much similarity on how the unsolicited explicit communications are addressed. On platforms such as Youtube the unsolicited explicit material is not sent specifically to you, but to a set of users who at best have some characteristics in common. By contrast, akin communications in a work environment are much likelier to constitute harassment insofar as they usually are intended for a specific person. Your own use of the term &quot;broadcast&quot; reflects your acknowledgment of that difference. Another difference relates to the recipient's dependency on the environment where the unpleasant communications occur. Implicit in the anti-harassment protections in a work environment is the acknowledgment that the recipient's livelihood depends on that person's continued employment. That dependency renders such communications a form of coercion. By contrast, dependency is much lower or non-existent when it comes to entertainment platforms: the recipient can leave the platform without any consequences that might threaten that person's livelihood. Have I entered into an agreement with the service provider than I consent to receiving these advertisements by using their services? That is hard to tell. You will need to read the terms of service of these platforms and post another question if some clause(s) is(are) unclear.