What are the consequences for intentionally providing false information to an online site? Suppose you provide a false name and birthdate to a site like Facebook or some other online site that requires accurate information. You do not make any financial transactions or impersonate anyone (you use the name John Doe for example), and you are old enough to use the site in real life. Aside from permanently banning you from using their services (for violation of Terms of Service), can they legally do anything else? Are they likely to legally do anything else? What if you were not old enough to use the site originally, but are now (say, you created an account at age 12, which is generally not old enough to use websites, but are now eligible)? What if your use of false information allows you to create multiple accounts in violation of the Terms of Service, but this does not lead to any damages? For example, suppose a social media site wants to prevent duplicate accounts, so it searches for users with the same name, birthdate, and IP address, but since you used your real name and birthdate on one and false information on the other, the social media site assumes these are different users. Assume that this process never required making a fake ID.
There are three main aspects to this: Its their website, and their terms of service. They can enforce those terms, or change them (in some appropriate manner). You have no recourse if they remove you, block you, or delete your account, for example. That's the measure that you would probably have, virtually every time. To claim damages, or litigate beyond just website access control, requires a legal claim. But there's a catch there. To claim damages, they need to show actual damage, which they wish to be compensated for. If you misused their website but no actual harm can be shown, the total damage claimable is zero, whether or not you followed their rules. Merely entering dishonest information isn't by itself harm. So they would have to show they suffered damage/harm because of that, which is directly attributable to your behaviour, was foreseeably harmful etc, or similar. They also need to consider legal costs, and ability to enforce, especially if you are in a different country. If for some reason the computer use was also illegal, then a criminal act could be committed and they could notify law enforcement. For example suppose you did this in the little known country of Honestania, where the law says that to prevent trolling and online abuse, anything posted on social media under any but your own legal name is a crime. Or suppose you'd been banned from the system and ignoring/evading such a ban was criminal computer use or criminal trespass due to the forbidden/unauthorised access (which can happen in several places). But this is purely for completeness; I guess you'd know if you were taking it further, into criminal computer use.
There are various tangential ways in which this could be illegal, for example if your subjects are celebrities, you take a picture of them and commercially exploit it without permission in a product endorsement. Leaving aside such fringe cases, in the US, the legal right to privacy comes about, at the first cut, by premise trespass law. If the proprietor tells you to go away, you have to go away; if the proprietor tells you that you cannot take pictures, you cannot take pictures (your right to enter is conditional). Neither of those circumstances holds in your case. There are other tort-law bases for a right to privacy: numerous privacy laws regarding privacy and financial transactions (not relevant here), the aforementioned right of publicity (commercial exploitation of likeness), false light (like defamation, about creating a false impression – I don't see what false information is conveyed by a photo). There is also public disclosure of private fact, but that cat is out of the bag because the subject has self-disclosed the supposedly offensive fact revealed by the picture by eating in public. Intrusion of solitude and seclusion does not exist in the circumstance, since the subject is eating in public where everybody can see: there is no reasonable expectation of privacy. This page sums us Virginia law. The main take-away from that is that there is no common law action for privacy in Virginia, and only an action for unauthorized used of likeness or name.
In the abstract, two businesses that cooperate in violating a third party's copyright could both face liability. Applying that information to the facts you gave would amount to legal counsel. If you don't want to tell the client 'no,' you should speak to a lawyer about your potential liability. Beyond the legalities, do you really want your portfolio to advertise that you design sites by ripping other sites off?
Earlier this year, the Internet lawyer Arnoud Engelfriet wrote a blog post about exactly this topic. As it is written in Dutch, I will summarize it here: As you also said, deleting posts breaks the flow of the archived conversation and it makes your archive incomplete. This is a problem for the freedom of expression and information. But Art. 17(3) GDPR includes an exception to the right of erasure for this situation. So posts do not need to be deleted. However, profiles are not included in this exception. So they must be removed, but they can be pseudonymized. For example replace the username with user89432, and remove all details from the profile. If other posts contain the nick of the author of an anonymized post, that is considered an journalistic, academic artistic or literary expression, so Art. 85 GDPR would apply, so the right of erasure does not apply to that. Bottom line: you only have to pseudonymize the account, if that person wants to be removed from the forum.
There are no direct penalties per GDPR. The data controller must make sure that the person making the request is the data subject, or at least authorized by the data subject. If the controller has reasonable doubts about the identity, they should request additional information for identification purposes. The controller must find a middle ground between violating the GDPR by rejecting a potentially valid request and violating the GDPR by disclosing data to potentially unauthorized recipients. Having reasonable technical and organization measures that prevent unauthorized disclosure is part of the controller's responsibilities per Art 24. What the data controller can do is to block future requests from the alleged stalker. When a request is “manifestly unfounded or excessive, in particular because of their repetitive character”, then the controller can charge a reasonable fee or refuse to act on the request (Art 12(5) GDPR). But it's up to the controller to prove that the requests are unfounded or excessive, it is not possible to reject potentially valid requests on sight. Depending on what the alleged stalker does with the obtained data, they would fall within the scope of the GDPR themselves and would probably be violating it because there is no sufficient legal basis. Also, the alleged stalker, as a data controller, would be required to inform the data subject about subsequent processing of the data per Art 14 GDPR. Attempting to obtain another person's personal data through an access request would have to be punishable by other laws. For starters, such attempts would likely involve identity theft, and successfully obtaining the data would probably be a kind of fraud.
There are a number of misconceptions here. GDPR does not generally impose blanket bans, but things get dicey if you're using data in a way that is not strictly necessary. Consent (freely given opt-in) is a way to continue nevertheless. A website without ads, tracking, or potentially tracking embedded content can probably work without having to ask for consent. Under the GDPR, every processing of personal data needs a purpose. This purpose must be covered by a legal basis. Some processing might be legally mandated or required by a contract with the data subject. It's also possible to base processing on a legitimate interest, but this requires a balancing test that also considers the data subject's rights and interests. As a last resort, consent can be an appropriate legal basis, but this comes with additional restrictions. Once you have a clear purpose that is covered by a legal basis, you can process the minimum data necessary to achieve the purpose. Sometimes, laws prescribe a particular legal basis. This is the case for cookies. You can use cookies (and similar technologies that access information on the end user's device) as strictly necessary to provide a service explicitly requested by the user. If you go beyond that, the ePrivacy Directive says you must obtain consent first. So for example, session cookies, shopping carts, or cookies that remember a “dark mode” preference are all perfectly fine because they are strictly necessary for something the user is trying to do. Also, you can use cookies to remember if the user gave or declined consent. On the other hand, analytics or tracking cookies are not necessary and require consent. If a website embeds third party content, this discloses personal data such as IP addresses to the third party. This disclosure requires a legal basis, most likely consent. There is case law about this regarding Facebook Like buttons on a page (→ Fashion ID case) but the same principle can be generalized to embedded Tweets or Youtube videos, images, or JavaScript files. A common way to handle this is to replace the embedded content with a placeholder, and to only load the embed once the user gives consent. But not all other domains or services are “third party” in the sense of the GDPR. When you engage a company to act as a data processor on your behalf, they are contractually bound to only use the data as instructed by you, and not for their own purposes. The GDPR allows you to outsource processing activities such as serving web content, as long as you have a suitable contract in place. Such “data processing agreements” are common for hosting providers or CDNs. When consent is to be used as a legal basis, it's important to consider the various conditions that the GDPR imposes (see Art 7 GDPR). The core principle is that consent must be freely given. You cannot make access to a site conditional on consent, so a naïve cookie wall or captive portal will be non-compliant. It's fine to force a choice, but “no” MUST be valid and possible. That consent is freely given also means that you must provide enough context for the user to make an informed decision, that the user must give consent through an unambiguous, affirmative action (consent is never the default), and that consent must be specific for a particular purpose (you can't bundle unrelated purposes). That is why modern consent management tools have multiple layers of information and allow the user to give consent for individual purposes (e.g. yes to analytics but no to ad personalization). In your particular context, you could proceed as follows: Figure out what kind of external content you're currently including. Can you enter into a data processing agreement with the external providers? If so, sign that. Can you host the content locally? This can be an easy solution except for video streams. Careful: copyright concerns might make this impossible. Can you replace the content with placeholders that only load if and when the user gives consent? That way, the rest of your site remains accessible without annoying consent walls. If the third party content is an unavoidable and essential part of your page, use an interstitial to inform the user of the risks before they proceed.
You Have No Recourse You have no recourse, at least to the extent that the people communicating to your employer point out the particular Facebook posts that were made or accurately summarize or paraphrase them (if the content of the Facebook posts was misrepresented to the employer that would be a different story). A factually truthful statement (e.g., "McGovern made a Facebook post at this link which you ought to look at") is absolutely privileged from legal liability under the 1st Amendment to the U.S. Constitution (assuming that you are talking about a U.S. case). The only exceptions would be when (1) the information provided is false and the person providing the tip has the appropriately standard of intent1 in providing the false statement (which can be actionable as defamation or intentional interference with contract as the DJ suing Taylor Swifts alleges in the Mueller v. Taylor Swift trial pending right now), or (2) the person providing the tip was someone who owed you a duty of confidentiality (e.g. your lawyer or psychiatrist), but that duty applies only to confidential communications between you and that person in most cases, and hence not to Facebook posts. Also, whether your own statements on Facebook were true, false or neither (e.g. statements of opinion) is irrelevant to the culpability or liability of the people providing the tip to your employer, so long as their description of your posts made to the employer were substantially accurate or to the extent that they were inaccurate were accompanied by a means by which the employer could determine what you actually said without relying on their second hand account. 1 To the extent that you are not a public figure and this is not a matter of public concern, even a negligent misrepresentation about what you actually wrote on Facebook, that is not a statement of opinion and is not accompanied by a reference allowing someone to confirm the accuracy of the statement at the source, could give rise to legal liability on the part of the person giving the tip. The standard of intent is the higher "actual malice" threshold for statements on matters of public concern, statements by media defendants and statements about public figures. But, there is nothing in the question to suggest that the tip given was in any way inaccurate. This Does Not Legally Constitute Harassment This is not harassment in a legal sense, even if it may have been an unkind thing to do on the part of the person doing it done with a specific and malicious desire on the person providing the tip to harm you. This is a natural consequence of you saying something on the Internet, which is forever. If your employer doesn't like true things that you say whether or not they relate to your job, if you are an employee at will you can be fired for it. It isn't absolutely impossible for factually true statements to constitute harassment, in a legal sense, but in those cases, it is the frequency and character of the communications, rather than their content or intended recipient, that make them harassing. For example, if the person providing the tip sent an email about that tip every five minutes for several days to every email address at your employer, causing your employer to find that it was just too disruptive to the employer's business to keep you on the payroll, that might be harassment, but that would have nothing to do with the content of the message provided in that case. Similarly, if someone screamed and yelled their statement over a loudspeaker every time you tried to tutor someone, that might be harassment, again, without regard to the content of what they were saying. In those cases, the "time, place and manner" exception to laws limiting the freedom of speech would apply. Could An Employer Take Employment Action Based On These Posts? There are a couple of states (Wyoming and Colorado, at least) which prohibit employers for taking employment actions against employees for lawful off the job conduct, despite the fact that otherwise, the default rule of law is that an employer can normally treat an employee at will (which the vast majority of employees are) as the employer deems fit. But, even then, liability is limited to the employer and not the person providing the tip. And, even in those states, off duty conduct can sometimes be considered by employers when it reflects directly on your fitness and ability to do your job when you are on the job, which a post about mathematics made by a math tutor very well might. Some high level employees with written contracts, career government employees with civil service protections, and almost all unionized employees can only be fired or disciplined on the job when the higher standard of "for cause" employment action is met, which posting something true on Facebook would not normally be. But, in the "at will" employment world, anything you say can and will be held against you even if it is entirely true. But, again, even if the employer misuses the information that the employer receives, that doesn't mean that someone who provided truthful information to your employer has any legal responsibility whatsoever to you or that the person providing the tip has done anything legally wrong in any way. For the most part, even if every word of your Facebook post was 100% true and accurate, outside the couple of states mentioned, you can be fired for posting it anyway if you are an employee at will. For example, suppose that your employer thinks that the Kumon method of teaching mathematics is a horrible method of instruction, and you post Kumon method exercises or explanations on your Facebook page (assume to avoid going on tangents that you had express permission from the copyright holder to do so). You could still be fired by your employer for posting that on Facebook in the vast majority of states. A Footnote on Internet Age Defamation Jurisdiction The usual rule is that a U.S. Defendant can be sued for defamation or similar torts where a statement is intentionally published to by the person being sued. In the case of a media defendant, or someone suing over a post made on Facebook, that could be any place in the world in many cases. But, while the geographic location of your Facebook post may be unclear, the geographic location of your employer to whom the statement you are concerned about being communicated was made, is not. Any harm done to you was done by communications to a single "legal" person who is legally located at a particular place in a single state, so the law of the state in which your employer is located (Washington State, U.S.A.) would govern, although there would also be an argument to looking to the law of the place where the person making the statement was located when they made the statement (which, it appears, would also be Washington State in your fact pattern). When someone in the U.S. communicates something to someone outside the U.S. that does not have the same level of protections for free speech that the U.S. does, there are federal statutes that provide that a judgment obtained there is not enforceable in the United States.
It is a false statement to claim to live in one county when you actually live in a different one. It becomes perjury (a crime) when you falsely swear to that statement on your status report, and you are required to report changes in &quot;household situation&quot; within 10 days. There isn't an exception allowing you to give a false address &quot;in case it costs more to report truthfully&quot;. The only legal solutions are to report truthfully and pay more, or move again, report truthfully, and not pay more.