Does &quot;personal, noncommercial use&quot; preclude use of Pokemon GO &quot;Lure Modules&quot; to attract players to non-commercial events? I represent a local denomination that is actively trying to get people to learn about our church by attending a church service. To help accomplish this, I would like to place a "Lure Module" near my church building. (A "Lure Module" attracts uncaught Pokemon and, in turn, players) However, the app's Terms of Service state: Niantic grants you a limited nonexclusive, nontransferable, non-sublicensable license to download and install a copy of the App on a mobile device and to run such copy of the App solely for your own **personal**, noncommercial purposes. Likewise, another section says: Subject to your compliance with these Terms, Niantic grants you a personal, noncommercial, nonexclusive, nontransferable, non-sublicensable, revocable license to download, view, display, and use the Content solely in connection with your permitted use of the Services. My own quick research into the subject suggests that "personal use" simply means "not for business use" and thus all other uses are permitted. However, since the ToS explicitly say personal AND non-commercial use, I'm not 100% sure my use of a Lure Module for the purpose stated above would qualify as acceptable.
There is ample reason to conclude that "non-commercial" would include a church, as well as advocating a political cause or candidate. The hard part of "personal". In the context of (Canadian) bankruptcy law, it can mean "non-business use"; in the context of "personal use property", it can be "A type of property that an individual does not use for business purposes or hold as an investment. In other words, property that an individual owns for personal enjoyment". US tax law takes "personal purposes" to refer to non-business purposes. But in the context of copyright (especially music downloading / copying), it is taken to refer to the use of or by an individual. Distributing free copies of a protected work does not get legally sanctioned due to the copying being non-commercial. The alternative term "private" is much clearer, in identifying "just you", but is probably avoided in this kind of context so as to avoid the wrong inference that you can only play Pokemon in the privacy of your own home. So the slightly less clear term "personal" is used instead of "private" especially in copyright-related contexts. "Personal" and "private" are not exactly the same, but when it's about use, I don't see any difference, and I think there is no question that use to attract to a church or political candidate is not "private", it is public. Since the license does not define "your own personal purposes" and there is not an existing crystal-clear definition of "personal purposes", the phrase could be given its "ordinary (plain) meaning". Of course, plain meaning has to give way to contractual intent, so we have to figure out what the parties intended. Except, you don't have a contract with Niantic, but still, plain meaning surely has some place in the law of licenses. At this point, in a lawsuit, both sides would hire an expert witness like a linguist or English teacher to make the case that a church or other non-commercial non-private use is / is not included in the meaning of "personal purpose". A silly argument could be made to the effect that if you personally have an interest in doing something then it is a personal purpose (if specifically commercial, it would be precluded by the term "noncommercial"). What makes this silly is that everybody does things for personal purposes (even acting in a way that benefits others, since you do so for the personal reason that you should do so), and thus "personal" would not mean anything. That is, "personal purposes" does not mean "whatever motivation or interest you personally have". You can also gain a certain understanding of what "personal purposes" means by looking at similar licenses. In the context of academic publishing, authors are typically granted license to copy "for personal, professional, or teaching purposes". Professional purposes and teaching purposes are things that the person has an interest in, so by mentioning these things separately, we must conclude that "teaching" is not a "personal purpose". And so: I would conclude that a court could find that using a product to support a political campaign, philosophy, or religion, is a "public" purpose, not a "personal" purpose. At the same time, at least as I understand it, a lure module is a thing that others besides yourself personally can see (I admit, I don't go), which implies that the purpose of the thing is not entirely private. In addition, there is a fair amount of buzz out there about how a lure could be good for business, which is (1) clearly in contradiction of the license terms and (2) clearly a golden opportunity for Niantic, perhaps in a few weeks after everybody gets hooked and then they will offer non-personal licenses. Their license terms also say that you will not "use the Services or Content, or any portion thereof, for any commercial purpose or for the benefit of any third party or in a manner not permitted by these Terms". I would say that that definitively says "No don't do it", and it also means that you can't be nice to a neighbor. So what they literally say and what they really intend are probably completely different things.
No These are derivative works and making them is copyright breach. Doing this as a hobby or even for the entertainment of friends in private is likely fair use. Distribution or performance in public (monitored or not) is likely not fair use and you would need a licence. Here is a summary of the relevant law in australia.
It is not possible to say that this is generally fair use, although sometimes it would be. A copy for personal use is still a copyright right violation on its face, and fair use does not categorically exclude non-commercial or personal use of copyrighted works. It is a highly fact specific inquiry. The likelihood of anyone discovering that you have done so and deciding to sue over it is slight, but that doesn't mean that there isn't potential copyright infringement liability. Compare this to speeding. People do it all the time, and even driving one mile per hour above the speed limit is still a traffic violation. But it is rare for less serious violations to be ticketed.
A fundamental requirement of criminal culpability is intent. Based on the description this whole process is happening after a user has already had their phone seized. If a person was not aware of Signal's hidden files to damage the police's data forensics software, they will not have met the criminal intent requirement, either maliciously or under a criminal negligence theory. None of the prongs of CFAA are strict liability statutes (18 U.S. Code § 1030 &quot;Whoever having knowingly accessed a computer...&quot;), so that would not apply here. If we imagine a person that is aware of all the information from Signal about their app intentionally abusing Cellebrite's package and with intention to cause damage downloads Signal's malicious files to their phone, I think it's an open question whether or not they would be liable under the CFAA. Specifically, 18 U.S. Code § 1030(a)(5)(A) (emphasis mine) Whoever knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer; An argument on this could go both ways. On the one hand, the owner of the phone could be found to not have substantially caused the information to be transmitted to a protected computer, as the police were the integral cause for that in executing their warrant. On the other hand, this sort of file could be considered a digital &quot;booby trap,&quot; and booby traps are illegal for essentially this reason, that they have a foreseeable effect of causing harm to people who are lawfully inside a building without the owner's permission. In this case, the owner's trap was sprung by law enforcement but still placed by the owner in order to damage them.
By itself, a chess position is not personal data. Personal data is “any information relating to an … identifiable natural person”. Since the file in question includes the name of the opponent, it is clearly personal data about the opponent. If the files are used for “purely personal or household purposes”, the GDPR won't apply per Art 2(2)(c). If the files are shared more widely – especially if the files are published – then GDPR becomes relevant. The person/entity who is data controller has to consider GDPR compliance. Data controller is whoever determines the purposes and means of processing of personal data (the “why” and “how”). The first question would be under which legal basis this personal data about another person can be shared. The GDPR offers multiple legal basis, notably “legitimate interests” and “consent”. Consent is always an option, but must be freely given (entirely voluntary). Legitimate interests can serve as a legal basis after a balancing test between your interests and the data subject's rights and interests. This balancing test also depends on the reasonable expectations of the data subject, which in turn depends on the more general context. For example, in a chess community where such sharing is completely normal there would likely be a legitimate interest for you to share games as well, if the games occurred in the context of this community. But if you play a game with a friend who is not part of this community, the friend cannot reasonably expect that their name and associated personal data would be shared. The second question would be how you would satisfy further GDPR compliance obligation, in particular the Art 13/Art 14 right to information. When collecting personal data, it is necessary to provide certain information such as your identity, what processing is being carried out, and how the data subject can invoke their GDPR rights (a privacy notice or privacy policy). This might be difficult or awkward to do. Practical solutions to these problems: If you want to share a game but aren't sure that the opponent is OK with this, remove identifying aspects such as names. For example, you could crop a screenshot, or describe the game in textual notation without listing the opponent's name. Play the game via a chess website that publishes the game. This way, the website is the data controller, and you and the opponent are the data subjects. This avoids having to act as the data controller yourself. This might work for private interactions, but not e.g. if you run a chess club and require members to play via that website – you might still be in a data controller role then and have full compliance obligations.
No, it's not illegal... Ads are shown as a contract between the site that hosts it and the advertising company. The contract does not stipulate that customers need to buy something, in fact, the contract can't force the customer to buy anything! At best, the contract can pay the hosting site based on the ad being shown, clicked, or any sale made after it. ...but you will do exactly the opposite Advertizement is made to put your own brand into the head of people. In fact, most ads don't have any effect on people. As I am writing this, ads for a kid TV, travels to Turkey and the primetime films for the weekend on the TV-station I have on are shown. I have no intention of consuming any of these advertised products. Impact of a campaign is measured by two metrics: people reached, and people responding. People reached is measured in clicks. People responding is measured in changes in earnings or sales. Clicking the ad increases the reached rating. If the rating is bad, the ad campaign is just ineffective... which leads to the most paradoxical thing: Bad advertisement and good advertisement both lead to more advertisement - bad to level out the missing response, good to maximize the response. By clicking on the ad you just funnel more money to the ad industry. When does it get illegal? [DDOS] The only way it would become illegal is if John Doe sets up a computer - or rather a botnet - and has that network click the ads thousands of times per second. Google can handle easily 83,000 searches per second, twitter gets more than 9000 tweets that are distributed to millions of people, Tumbler and Instagram handle together about 2500 posts per second. In fact, every second, more than 100000 Gigabytes of traffic run through the net. To have an impact on one site, you need to be truly a large number of calls... and then it is called a DDOS. DDOS is illegal under the CFAA, in this case 18 UC 1030: (a)Whoever— (5) (A)knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer; (b)Whoever conspires to commit or attempts to commit an offense under subsection (a) of this section shall be punished as provided in subsection (c) of this section. In the UK, you'd break the Computer Misuse Act of 1990 section 3, because denying someone else service via DDOS is unauthorized, clearly unauthorized, and prevents access to any data (the website) on any computer (the server): (1)A person is guilty of an offence if— (a)he does any unauthorised act in relation to a computer; (b)at the time when he does the act he knows that it is unauthorised; and (c)either subsection (2) or subsection (3) below applies. (2)This subsection applies if the person intends by doing the act— (b)to prevent or hinder access to any program or data held in any computer But can a DDOS be protest? [NO!] Anonymous attempted to petition to make DDOS a legal form of protest in 2013. The petition got 6,048 of the 25000 signatures needed to warrant an answer by the white house - unlike people in 2016 asking for a Death Star. At least it prompted Joshua I. James to write a research paper about the proposal in March. He too points to the CFAA and Section 5A, especially the sentence I quoted above. Among a lot of stipulations, he points out that internet protest in the shape of a DDOS would need to follow the same rules as a legal protest on the streets - which for example demands that entrance to businesses can't be blocked, and one is not allowed to harass employees and customers. According to the general rules for legal protest as given, there are still a number of challenges. First and foremost, entrances to businesses should not be blocked. In terms of DDoS, if sustained denial of service takes place, then access (entrance) to the server (business)is eﬀectively blocked. This means that, at a minimum, sustained denial of service should be considered as a non-legal approach to protesting. Thus, he concludes sustained DDOS is per se can't be a legal protest, and even a non-sustained DDOS would impact people using the site in a way they will deem harassing - which means that even a non-permanent DDOS can't be a legal protest. And then comes the final blow: DDOS, unlike a real protest on the streets, can't, by its very nature, inform people of why there is protest, even if it were a form of protest! This means that nobody knows it is meant to be a protest and not a normal DDOS, and as it can't convey what the action is about, it can't be a proper protest.
There are a number of misconceptions here. GDPR does not generally impose blanket bans, but things get dicey if you're using data in a way that is not strictly necessary. Consent (freely given opt-in) is a way to continue nevertheless. A website without ads, tracking, or potentially tracking embedded content can probably work without having to ask for consent. Under the GDPR, every processing of personal data needs a purpose. This purpose must be covered by a legal basis. Some processing might be legally mandated or required by a contract with the data subject. It's also possible to base processing on a legitimate interest, but this requires a balancing test that also considers the data subject's rights and interests. As a last resort, consent can be an appropriate legal basis, but this comes with additional restrictions. Once you have a clear purpose that is covered by a legal basis, you can process the minimum data necessary to achieve the purpose. Sometimes, laws prescribe a particular legal basis. This is the case for cookies. You can use cookies (and similar technologies that access information on the end user's device) as strictly necessary to provide a service explicitly requested by the user. If you go beyond that, the ePrivacy Directive says you must obtain consent first. So for example, session cookies, shopping carts, or cookies that remember a “dark mode” preference are all perfectly fine because they are strictly necessary for something the user is trying to do. Also, you can use cookies to remember if the user gave or declined consent. On the other hand, analytics or tracking cookies are not necessary and require consent. If a website embeds third party content, this discloses personal data such as IP addresses to the third party. This disclosure requires a legal basis, most likely consent. There is case law about this regarding Facebook Like buttons on a page (→ Fashion ID case) but the same principle can be generalized to embedded Tweets or Youtube videos, images, or JavaScript files. A common way to handle this is to replace the embedded content with a placeholder, and to only load the embed once the user gives consent. But not all other domains or services are “third party” in the sense of the GDPR. When you engage a company to act as a data processor on your behalf, they are contractually bound to only use the data as instructed by you, and not for their own purposes. The GDPR allows you to outsource processing activities such as serving web content, as long as you have a suitable contract in place. Such “data processing agreements” are common for hosting providers or CDNs. When consent is to be used as a legal basis, it's important to consider the various conditions that the GDPR imposes (see Art 7 GDPR). The core principle is that consent must be freely given. You cannot make access to a site conditional on consent, so a naïve cookie wall or captive portal will be non-compliant. It's fine to force a choice, but “no” MUST be valid and possible. That consent is freely given also means that you must provide enough context for the user to make an informed decision, that the user must give consent through an unambiguous, affirmative action (consent is never the default), and that consent must be specific for a particular purpose (you can't bundle unrelated purposes). That is why modern consent management tools have multiple layers of information and allow the user to give consent for individual purposes (e.g. yes to analytics but no to ad personalization). In your particular context, you could proceed as follows: Figure out what kind of external content you're currently including. Can you enter into a data processing agreement with the external providers? If so, sign that. Can you host the content locally? This can be an easy solution except for video streams. Careful: copyright concerns might make this impossible. Can you replace the content with placeholders that only load if and when the user gives consent? That way, the rest of your site remains accessible without annoying consent walls. If the third party content is an unavoidable and essential part of your page, use an interstitial to inform the user of the risks before they proceed.
Your friend's relationship with the game company is one of contract. You don't say what the contract terms are, so it's impossible to say whether they were breached by your friend or the company. In any case, it is likely that the only remedy your friend could seek is damages, probably limited to whatever outstanding portion of the subscription they have not had the benefit of. It seems unlikely that it will be a large enough amount to be worth pursuing. As a private company the game provider can choose to contract with who they wish, or not as the case may be (unless they can be shown to be discriminating against protected characteristics).