Is it legal for a business to deny me access to their store on the basis of how I look? Is it legal for a business to use discriminatory (and notoriously false-positive) fingerprinting algorithms that prevent me from loading their website purely on the basis of how I look (as opposed to how I act)? Some time ago I opened an account on a website. For security reasons, I used Tor Browser. I loaded money onto my account and purchased their services. I used their services several times without issue. Recently I tried to log-into my account, but I got stuck in an infinite loop on CloudFlare, so I could never access their website. It should go without saying that I'm not doing anything malicious, but I'll say it: this is reproducible when launching a fresh version of TAILS, opening the browser, typing the naked domain into the address bar and pressing &lt;enter&gt;. I'm never allowed into the store. So it appears to me that this website is denying me access to their business services, my account, and the funds on my account for one reason: because they don't like the way I look. Is this legal for them to do to their customers? I'm also curious if the same thing would be legal in the IRL analog, for example: Would it be legal for a brick-and-mortar store to deny me from entering their shop purely on the basis of the way that I look? Would it be legal for a bank (with whom I already have an open account in good-standing) to prevent me from accessing my safety deposit box because they don't like the way that I look? Or, perhaps for a closer analogy: Would it be legal for a brick-and-mortar store to deny me from entering their shop because their SaaS CCTV facial recognition software (falsely) said that I &quot;look&quot; like a shoplifter? Would it be legal for a bank (with whom I already have an open account in good-standing) to prevent me from accessing my safety deposit box because I'm wearing the same T-Shirt from JC Penny that someone else wore who robbed their bank yesterday (and they do not permit me to attempt to prove my identity)? I'm primarily interested in US and EU law, but I would be interested in any countries with strong consumer and data protection laws that would provide consumer protection from discrimination on the basis of &quot;looks&quot; on the Internet.
You are mistaken: they deny you on your act When you use Tor, your browser is not sending a lot of information. That makes Tor browsers hilariously easy to detect: nobody knows where the real browser is, but it is hilariously easy to block all Tor users for using Tor, or at least those that the server knows are Tor IPs. Using Tor is an action, not how you look. The closest Brick and mortar equivalent would be &quot;Show me your ID please&quot; and you show them a paper cutout of something that has Sample stamped over it. &quot;No shirt, no shoes, no service&quot; in the united-states Yes, most places can deny service based on how you dress or your state of hygine. These two would in most cases not extend to the protections under the Civil Rights Act, which protects some characteristics like race and sex, but not visual factors like &quot;being dressed&quot; or &quot;smelling of cow&quot;. There can be a fine line where religious dress code is concerned, but in general and broad strokes, the restaurant can deny you for wearing the wrong clothes. Actually, the slogan is much broader than it appears: as long as an establishment's dress code is not violating discrimination law (like the CRA), they can enforce it under their freedom to contract.
Your lawyers should understand that you're dealing with a private company that can make and enforce its own policies when it comes to allowing access to the their store. If Google's policy is to require you to do research and diligence on a possible trademark infringement of your App, that's legal, as long as Google's requirements don't not violate local or national laws of the variant of their store. The idea that another company or individual can allege infringement, yet not communicate sufficiently with you or Google, may not seem fair, but as a response to that, Google can play it safe and not open themselves up to liability by removing your App or making you resubmit under a new name. That is outlined in Google's TOS, which you agreed to. Your only recourse is to keep talking to Google and keep trying to contact the complainant.
You tag the question with "criminal law", suggesting that by "illegal" you mean "is it a crime" -- that would depend on jurisdiction, but in the US or my state, it is not a crime. There are crimes that you could commit with such an account, but violating the TOS is not itself a crime. However, it is illegal, a breach of contract, as you can see from the TOS "You will not provide any false personal information on Facebook, or create an account for anyone other than yourself without permission".
A business owner can normally refuse service for any reason unless anti-discrimination law, or some other specific law, applies. &quot;Critic of the business&quot; is not a protected class. Whether a business would act in such a way I cannot say if it would risk significant negative publicity. But I see no legal reason why they could not.
Given a large database of email addresses that you can't prove have given consent to receive email, the only legal thing to do with it, is to (securely) delete it. (I am going to switch your question about a larger company to a bank: in the UK, big pharma is forbidden from advertising to individuals.) In principle the rules are the same for a huge bank and everything down to a self-employed plumber. In practice the plumber will be told "don't do that again" rather than fined. This case was treated under the Data Protection Act, which has a maximum fine of £500,000&nbsp;&ndash; so a big bank would probably have been fined more, but not necessarily much more. Under GDPR, fines are related to turnover, so the fine would be a lot bigger for a large bank. The incident is a year old now. Details here.
FDIC Regulation 500 prohibits discrimination in making loans on the basis of "National origin" but not on the basis of immigration status. This story from The Nation says that Bank of America is denying accounts to non-citizens, and arguing that it is legal because of increased risks, although there are current court challenges to this. Perez v. Wells Fargo Bank, N.A is a case now pending challenging loan denials based on immigration status. This has particularly come up in regard to DACA recipients, rather than people with LPR status. The US "public accommodation" laws probably do not apply, as a bank is not usually considered a place of public accommodation. Any specific state laws prohibiting discrimination on the basis of immigration status might apply. In short, this is an issue still not clearly settled. There seems to be no law or regulation requiring banks to ask for citizenship information, much less to deny accounts based on it, and it would be well to seek a bank with a different policy if possible. The above is very US-specific. Many countries do limit banking access based on citizenship, i understand. I am not a lawyer, and this is not legal advice. Before challenging any bank action, you may well wish to seek advice from a lawyer.
I'm not aware of any cases on point, but as a rule legal fig-leaves don't play well in court. If the webmaster simply puts up a banner saying that EU residents are not permitted but takes no other action to exclude them, then that is going to be considered irrelevant. The webmaster is still very likely required to comply with the GDPR. On the other hand if the webmaster takes other steps to exclude EU residents, such as using a geolocation service to block connections known to be in the EU, validating email addresses and blocking those from EU domains, and ejecting anyone who mentions that their residence is in the EU, then that is more likely to be seen as a good-faith attempt to avoid being subject to the GDPR. It will also have the practical effect of greatly reducing the number of actual EU residents. All these controls can be evaded, but it would be much harder for any data subjects to claim that they acted in good faith or that the webmaster acted in bad faith. Note that validating an email address or logging an IP is itself processing of personal data, so anyone implementing such a system still can't ignore the GDPR completely, but it would greatly limit the scope and make it easy to delete any such data after a short time. (Note: the term &quot;EU resident&quot; above is an approximation of the territorial scope).
This would not be "legal jeopardy" per-se, really the only remedy that Stack Exchange would have in a case like this would be to ban both accounts. It would be different if you caused SE some kind of monetary/reputation damages to the site itself. From SE's Acceptable Use Policy: Identity Theft and Privacy. Users that misleadingly appropriate the identity of another person are not permitted. It seems your described scheme would violate that term. But this isn't a legal problem, just an operational one. You aren't violating any law (unless there are local laws against this) by paying somebody to "be you" on SE. The most that this would earn you and your cohort would be a ban and probably removal of the contributions.