Who regulates wireless radio communication in North America and Europe? Wireless technologies, such as Wi-Fi, cellular 4G networks and satellite communication are all radio-based under the hood. Meaning that they all send and receive radio signals, inside of regulated frequency ranges, as their underlying form of communication. For instance, to be &quot;Wi-Fi&quot;, the device must send-and-receive radio signals around the 2.4GHz frequency range. For satellite, the signals must be inside the 136-138 MHz frequency range, etc. I'm wondering what internationally-recognized agencies/bodies regulate these radio-based wireless technologies, both in North America as well as in Europe. In the United States, I would imagine it would be either the FCC, the FAA, or both, but I can't tell where there regulatory boundaries are. So I ask: what official bodies regulate radio-based communications in these jurisdictions? I'm mostly interested in US, Canada and UK, but would love to be informed about other European (even Asian) countries as well. Update: Here's a quick useful link for any future-comers that have a similar question: https://en.wikipedia.org/wiki/List_of_telecommunications_regulatory_bodies update 2022-05-24: The wiki page seems to be missing some countries and links need to be updated. We just curated this list fully: https://www.mcxess.com/telecom-authority/ Hope this helps.
In the US, radio communication proper is regulated by the FCC and the NTIA. The FAA has nothing to do with it; they regulate things as they affect airplanes, but the actual radio rules are set by the FCC, and since frequency allocation is a purely radio thing the FAA has nothing official to do with it. The breakdown between FCC and NTIA is that the FCC deals with non-federal communications, while the NTIA deals with federal communications; they split the spectrum. Now, with things like Wi-Fi, many of the rules are set by non-governmental standards organizations. Wi-Fi is not regulated by the FCC; it falls within the frequencies and transmission powers that the FCC has deemed to be not regulated. So, the FCC never set aside 2.4 GHz for wireless Internet; they set it aside for any low-powered transmissions anyone wants to make (subject to interference rules). With LTE and satellite communications, there's more regulatory control; they are high-powered communications, and are licensed to individual operators for a specific frequency range. As Flup said, there is international coordination for obvious reasons (the ITU actually predates the UN by almost a century). The ITU helps coordinate spectrum usage, and also assigns satellite orbital slots in geostationary orbit (where most communication satellites are).
Contract law involves a number of parts, the most relevant here being the formation of a contract, and the enforcement of its terms. There are various rules about formation, such as that you cannot hold a gun to a person’s head to force them to say yes (the courts would then say there was no contract), and then under other conditions a term in a contract might be illegal, for instance the courts will not order a person to commit a crime as one of the conditions of a contract. In the scenario that you propose, no term of the contract involves an illegal action, the only presumed illegality is in the circumstances surrounding formation of the contract. Duress is illegal, because there is no voluntary mutual assent. That’s not the case here. So there is no established legal impediment to finding that a contract was formed. There are ample opportunities to test the theory that an element of illegality in the formation of a contract makes the contract void, for example if a physical instrument used in creating or transmitting the contract was used illegally (the paper was stolen, the paper was used without permission of the owner); the assent was made while trespassing; the contract language infringes copyright. Given the court’s very strong commitment to recognizing and enforcing contracts, it is highly unlikely that the courts would reject a contract over a technicality of this type §97.113 of the FCC rules states the prohibited transmissions, the two relevant clauses being that the prohibited list includes (2) Communications for hire or for material compensation, direct or indirect, paid or promised, except as otherwise provided in these rules; (3) Communications in which the station licensee or control operator has a pecuniary interest, including communications on behalf of an employer, with the following exceptions… (2) is not clearly applicable, since the communication is not for material compensation (e.g. A is not paying B to make a transmission). (3) is more likely applicable, since the parties each have a pecuniary interest in the communication. The exceptions involve being compensated for making a communication, or one can on an irregular basis offer amateur radio apparatus for sale or trade. Since the FCC regulations only provide bare languages and no explanatory texts, and they decline to provide any examples (this seems to be a policy thing), and there is substantial unclarity as to what the restrictions mean, see this analysis. A finding of letter-of-the-law violation in this case cannot be made by the court in which breech of contract would be litigated. Instead, the FCC would have to first make a finding of law-breaking, then a party would have to prove in a separate cause of action that because of illegality in the circumstances surrounding formation of the contract, there never was an agreement.
The US has jurisdiction because the systems that the accused allegedly attacked are in the US. To use an example with older technology, you can't escape criminal liability for defrauding someone in one country simply because you did so through the mail or by telephone from another country. The UK and the US have an extradition treaty. The UK might refuse to extradite the accused; in that case the US would most likely complain loudly. If too many extradition requests are refused on one side, the other side might start limiting cooperation in any of several areas.
In the UK and USA (and I imagine other jurisdictions) there have been laws that explicitly provide for orders obliging entities to (A) provide access or information and (B) keep the order secret. For example, in the USA the Stored Communications Act, Fair Credit Reporting Act and Right to Financial Privacy Act authorise the FBI to issue National Security Letters (Wikipedia, EFF, EPIC, Lawfare). These are an administrative subpoena, without prior approval from a judge, for meta-information (e.g. phone numbers dialed or email recipients addressed but not the content) of communications relevant to national security investigations. They typically contain a non-disclosure requirement prohibiting the recipient of the NSL from disclosing its existence or the FBI's demands. There have been challenges on First Amendment grounds to the non-disclosure aspect but, so far as I'm aware, they have all ultimately failed. Some of their non-disclosure requirements may eventually expire under other laws. In response, so-called 'warrant canaries' (Wikipedia) have been developed (and gone a bit further than the original idea) - these are intended to allow entities to relatively passively warn of such an order having been received if not the detail of the order. However, they can be legally risky in that they might be seen by a court as trying to circumvent the non-disclosure requirement and therefore breaking it.
(EU) 2016/679 (GDPR) is available in 24 languages. It wouldn't be practical for everyone communicating with EU citizens to be obliged to translate to all of them. Article 12 in Chapter 3 section 1 specifies : The controller shall take appropriate measures to provide any information referred to in Articles 13 and 14 and any communication under Articles 15 to 22 and 34 relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language If your application is available only in Ukranian and only people who understand Ukranian will be able to use it, your policies and responses to customer enquiries should also be in Ukrainian - but in a form that's "concise, transparent and easily accessible".
The territorial scope of the GDPR is defined in Article 3. It covers "personal data of data subjects who are in the Union", whether they are EU citizens or not. So to answer your questions: 1) are EU users, but moved to USA a few years ago, and signed-up on my website? They are not in the EU, so are not covered. You don't need to know if someone is an EU citizen, just if they are currently in the EU. 2) went for holidays in USA, signed-up on my website, and then came back to EU? (note - potentially skipped any Consent questions at sign-up, because IP was from USA) If someone moves into the EU while using your service then they fall under the GDPR for the time they are in the EU. If their home address is in the EU then that is covered, and monitoring of their behaviour while in the EU is also covered. Your other two questions are about VPNs. If a VPN is used to evade IP address geolocation and you have no other clue about where someone is then you can't be blamed for not knowing where they are (although I'm not aware of any actual case law on this topic). But if someone with a USA IP address gives a home address in the EU then you should probably treat them as being in the EU to be on the safe side. Basically, if you don’t know if they are in the EU or not, you should treat them as if they were.
The GDPR roughly applies in the following scenarios: Art 3(1): you have an establishment in Europe Art 3(2): you do not have an european establishment, but Art 3(2)(a): offer goods or services to persons in Europe Art 3(2)(b): monitor the behaviour of people who are in Europe (where Europe means EU/EEA/UK as appropriate). Art 3(1) does not seem to apply for you. Art 3(2)(a) does not apply, since you're not actively targeting people in Europe. At the point in time where you are offering the app to users, those users are in the US. Art 3(2)(b) could apply if you collect some kind of tracking data, in particular (but not limited to) location data. But if you temporarily shut down collection of new data for personalisation while the user is in Europe, that's probably going to be reasonably safe. It might not be necessary to disable ad personalisation if that personalisation is based on data collected outside of Europe. In practice, unless your app is specifically targeted at travellers, no one will care about what your app does outside of the US. For detailed guidelines on the territorial scope of the GDPR, consider reading EDPB guidelines 3/2018 (PDF). The document contains some relevant examples, but since it's official guidance they won't explicitly say that GDPR won't apply in a scenario like yours. The closest is Example 8: An Australian company offers a mobile news and video content service, based on users’ preferences and interest. Users can receive daily or weekly updates. The service is offered exclusively to users located in Australia, who must provide an Australian phone number when subscribing. An Australian subscriber of the service travels to Germany on holiday and continues using the service. Although the Australian subscriber will be using the service while in the EU, the service is not ‘targeting’ individuals in the Union, but targets only individuals in Australia, and so the processing of personal data by the Australian company does not fall within the scope of the GDPR. Also relevant is Example 10, which says that app downloads in the EU might not be subject to GDPR: A U.S. citizen is travelling through Europe during his holidays. While in Europe, he downloads and uses a news app that is offered by a U.S. company. The app is exclusively directed at the U.S. market, evident by the app terms of use and the indication of US Dollar as the sole currency available for payment. The collection of the U.S. tourist's personal data via the app by the U.S. company is not subject to the GDPR.
I think it really is a state-by-state answer. From a web site for doctors getting involved in Telemedicine. Some medical boards such as Alabama, Montana and Oregon offer a special purpose telemedicine license. Other states that regulate telepractice in medicine include Texas, Florida, California and Colorado. The levels of regulation vary greatly by state. For example, California and Florida, similar to New York, require full licensure to perform any function relating to patient care, with some exceptions for consultation in some instances. Other states are exploring the issue of telepractice and in general, how to regulate it. That site has a state-by-state break out of the rules. I see other things about reciprocity among some nearby states. Three states (MD, NY, VA) and Washington DC provide reciprocity to bordering states. Alabama and Pennsylvania have agreements with other states to grant licenses to out-of-state physicians who have licenses in states that reciprocally accept their home state licenses. In Connecticut, an out-of-state physician can obtain an in-state license based on his or her home state standards.