Is it legal in the USA to pay someone for their work if you don&#39;t know who they are? Let's say you go on a freelancing platform and hire a designer to make a website for you. They never reveal their real name, photo or location and payment is requested via Bitcoin. The job completes successfully and far as you've concerned you've just transferred $1,000 to a completely anonymous person who may be located at any corner of the planet. You also have no way of ever contacting them again, as their email address was single-use just for this job and they'll never access it again. Would this violate any laws? Does it matter if you pay them as an individual or as a business entity? For the sake of this question assume that the person/entity paying is located in the US.
You cannot do this legally General rules Under US law you are required to file a Form 1099 with the IRS for this payment if it was for a trade or business purpose. ( $1,000.00 is above the current reporting limit of $600.) This you cannot do without the recipient's name (personal or business) and address. You will also need their SSN or TIN. Failure to file the 1099 may be a violation of law. Private people, as well as businesses, get 1099s which are also filed with the IRS. I myself have received 1099s as a private individual for freelance work. (Corporations mostly do not get 1099s.) Private individuals as well as businesses report payments on 1099s. Such a person might be involved in unlawful tax evasion, and the demand for payment in bitcoin might support a reasonable suspicion of this. If so, you might be accused of being an accessory. If the person is foreign (non-US) and the work was not done in the US it may not need to be reported, but if you do not know the person's location you cannot safely assert that it is outside the US. If you intend to deduct the payment on your own taxes as a business expense, you may also need to have a receipt showing the recipient of the money. It would seem that if the payor/client is in the US and the work was done for a trade or business (which includes a non-profit, but not a hobby or personal site) and the amount is $600 or more, there is no safe and legal way to hire a person or firm without knowing the name, address, and (in most cases) TIN (taxpayer identification number) of the contractor, or at least using ones &quot;best efforts&quot; to obtain the TIN. See the various IRS instructions below for details. IRS Instructions According to the Form 1099-Misc/1099-NEC insatructions Report on Form 1099-MISC [or 1099-NEC] only when payments are made in the course of your trade or business. Personal payments are not reportable. You are engaged in a trade or business if you operate for gain or profit. However, nonprofit organizations are considered to be engaged in a trade or business and are subject to these reporting requirements. Generally, payments to a corporation (including a limited liability company (LLC) that is treated as a C or S corporation) [are not reportable]. If you are required to file Form 1099-MISC, you must furnish a statement to the recipient. Enter [in Box 3] other income of $600 or more required to be reported on Form 1099-MISC that is not reportable in one of the other boxes on the form. File Form 1099-NEC, Nonemployee Compensation (NEC), for each person in the course of your business to whom you have paid the following during the year: At least $600 in ... Services performed by someone who is not your employee (including parts and materials) (box 1); Generally, you must report payments to independent contractors on Form 1099-NEC in box 1. If the following four conditions are met, you must generally report a payment as NEC. You made the payment to someone who is not your employee. You made the payment for services in the course of your trade or business (including government agencies and nonprofit organizations). You made the payment to an individual, partnership, estate, or, in some cases, a corporation; You made payments to the payee of at least $600 during the year. Instructions for Form 1042-S specify that one must report for foreign payees: Compensation for independent personal services performed in the United States. General Instructions for Certain Information Returns says: Recipient names. Show the full name and address in the section provided on the information return. If payments have been made to more than one recipient or the account is in more than one name, show on the first name line the name of the recipient whose TIN is first shown on the return. ... TINs. TINs are used to associate and verify amounts you report to the IRS with corresponding amounts on tax returns. Therefore, it is important that you report correct names, social security numbers (SSNs), individual taxpayer identification numbers (ITINs), employer identification numbers (EINs), or adoption taxpayer identification numbers (ATINs) for recipients on the forms sent to the IRS.
Yes, this violates the GDPR if the user is in Europe. Data which is tied to a personal device can be tied to the person who owns it. From "What Is Personal Data" by the UK Information Commissioner's Office (ICO) (emphasis added): Personal data is information that relates to an identified or identifiable individual. What identifies an individual could be as simple as a name or a number or could include other identifiers such as an IP address or a cookie identifier, or other factors. If it is possible to identify an individual directly from the information you are processing, then that information may be personal data. If you cannot directly identify an individual from that information, then you need to consider whether the individual is still identifiable. You should take into account the information you are processing together with all the means reasonably likely to be used by either you or any other person to identify that individual. The bit about "all means reasonably likely" in the last bullet includes the kind of de-anonymisation tactics described in the NYT article. There are 6 lawful bases for data processing in the GDPR, and all processing must fall under at least one of them. (a) Consent: the individual has given clear consent for you to process their personal data for a specific purpose. (b) Contract: the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract. (c) Legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations). (d) Vital interests: the processing is necessary to protect someone’s life. (e) Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law. (f) Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks.) Selling data isn't covered by any of the others, so consent must be obtained. Permission must be clear and positive, and you cannot predicate delivery of a service on the processing of data that isn't necessary for that service. So for instance you cannot say "You can use this service as long as we are allowed to collect and sell your data" because selling the data isn't necessary to the provision of the service. From "Consent" by the ICO: Consent requires a positive opt-in. Don’t use pre-ticked boxes or any other method of default consent. Explicit consent requires a very clear and specific statement of consent. Keep your consent requests separate from other terms and conditions. Be specific and ‘granular’ so that you get separate consent for separate things. Vague or blanket consent is not enough. [...] Avoid making consent to processing a precondition of a service. This applies to any processing of data about individuals within the EU, so just being an American company doesn't get you a free pass to ignore the GDPR if your app gets used by Europeans. The "Legitimate interests" basis is more problematic, in that the company collecting the data has to conduct a vague "balancing test" to determine if this basis applies. For direct marketing the ICO has written this, which says that direct marketing may be a legitimate interest, especially if you can show that the user has expressed interest in such adverts. For instance a location service which promises to tell you about nearby special offers would fall into this category. Against this, the impact on the user's privacy has to be considered, and location data is "special category data" because it can reveal medical information (e.g. hospital attendance) or religious affiliation (e.g. which church you go to). So unless the relationship between the recorded location data and the service is very direct its not going to pass the balancing test. The company would also need to distinguish between knowing the current location and keeping a record of historical locations; the two need separate justification. And of course nothing about this covers the sale of the data; this is considering a company which sells advertising space in it's app, not one that sells the data itself.
The Apache 2.0 license purports to be irrevocable, but it also presupposes that the supposed licensor has the right to grant permission to copy. In this case, that is untrue, so there never was a proper license and nothing to revoke (the copyright owner grants permission in the form of "a license" which is a legal abstraction, that normally is specified in the license document). An end-user snared by this illegal license might attempt to sue the author because of the legal screw-up but paragraph 9 says that the supposed licensor cannot be held liable. In this case, though, "licensor" is defined not as the person who hands you the license document, but as the copyright owner. So it's the employer who would be not liable under the terms of the document (but since the employer had nothing to do with the license, it's as though the license never existed). The end-user is a secondary infringer (the employee is the primary infringer, in illegally distributing the material). Under US law, that doesn't matter, the user is still liable. Under UK law, secondary infringement includes the element that you have to have reason to know that the copy is infringing, which in the scenario that you describe is not the case.
Possibly The game company has almost certainly excluded liability under the contract you entered. There may be some consumer protection that you have that they cannot exclude - I don’t know enough about German law to meaningfully comment. Notwithstanding, if you were to initiate legal action against the, as yet, unknown wrongdoer, you could subpoena the relevant records from the game company with a court order. No matter what privacy or other protections the other person has, the game company must obey the order or be in contempt. Without such an order the game company is right that they can’t disclose details of other users. As a practical matter, it will cost several hundred € to initiate legal action and several thousand to pursue it to the end. And you might lose. A better response is to treat the lost €80 as a relatively cheap life lesson - many people lose a lot more learning to recognise scams.
There are a number of existing legal sites that do this, for free or for pay. The main concern for a website operator pertains to the DMCA "safe harbor" provisions, which protect against vicarious liability for infringement. A "report piracy" option is not sufficient; see this answer to a related question.
It is legal for a company to ask for any information they want as a condition of doing business with you, so long as their request isn't proscribed by law. I don't know of any jurisdiction where a request for banking or credit information is illegal. (In this case, however, it does seem like you are being phished. You could report the matter to your country's consumer protection agency.)
Yes, they are. A business can decide not to do business with someone for pretty much any reason. The obvious prohibited reason is due to your race. But I don't see how eBay would even know your race. Some State laws might protect you, but I don't think there's any that applies in this case. For example, California might give you a means of appeal if someone stole your identity and they performed those transactions, not you. But I don't know of any Federal or State law that would change the very, very basic principle of law that a property owner gets to decide who can and cannot access their property. eBay owns eBay. One key benefit of ownership is precisely that you can make decisions that other people consider to be unfair, discriminatory (other than the specifically prohibited categories) and draconian. Other people don't have to agree with your decisions for them to be lawful.
You are free to sell or not to sell to whoever you like (unless it is illegal discrimination, like not selling to white Christians), but it doesn't make a difference, because anyone who buys the software from you can legally sell it on to anyone they want. So you cannot control who ends up owning the software. If I want the software and you don't sell it to me, and I still want it, I'll just ask a friend to buy it and give them the money. Other people would just get a pirated copy if you refuse to sell to them (and would have very little bad conscience since they offered you cash and you refused to take it). You can put terms into a license, and in the USA this is binding. The customer may not agree with the license, and in that case they have the right to get a refund for the software. In the EU, I don't think a license is binding, so you'd have to sign a legally binding contract with the buyer. Apart from all that, you have very little chance to find out if the software is used against your wishes and to do anything about it.