Can action be taken against a Discord server for someone admitting in chat they&#39;re under 13 then changing their age to over 13 thereafter? Suppose you have a Discord server with a member who voluntarily tells people in chat that they are 12 years old. For purposes of this example, the user says I am 12 years old. Then after making that claim, they tell the moderators they are instead 18 years old in a private DM. For purposes of this example, the user says I am actually 18 years old. My questions are Whether or not the Discord server is legally required to ban this user after voluntarily saying they are 12 years old, even if they then say it was fabricated, either in the public chat or via private DM. Outside of banning the user, is there any other action the server administrators are required to take? Hypothetically speaking, could the server owner/server be held liable if god forbid something happened to or on behalf of that individual? Useful Information Discord TOS says: By using or accessing the Discord application (the “App”) or the website located at https://discord.com (the &quot;Site&quot;), which are collectively referred to as the “Service,” you agree (i) that you are 13 years of age and the minimum age of digital consent in your country, (ii) if you are the age of majority in your jurisdiction or over, that you have read, understood, and accept to be bound by the Terms, and (iii) if you are between 13 (or the minimum age of digital consent, as applicable) and the age of majority in your jurisdiction, that your legal guardian has reviewed and agrees to these Terms. A recent Tweet from Discord: Anyone under the age of 13 cannot use Discord per our Terms of Service. If a server owner is aware and ignores it, we will take action on the server and/or owner.
Yes (probably), under COPPA The FTC has stated that YouTube content creators could be held liable under the Children's Online Privacy Protection Act (COPPA), a United States law that &quot;imposes certain requirements on operators of websites or online services directed to children under 13 years of age, and on operators of other websites or online services that have actual knowledge that they are collecting personal information online from a child under 13 years of age.&quot; (source) The FTC's FAQ on complying with COPPA notes that &quot;operators will be held to have acquired actual knowledge of having collected personal information from a child where, for example, they later learn of a child’s age or grade from a concerned parent who has learned that his child is participating on the site or service.&quot; It also has the following question/answer (emphasis added): I operate a general audience video game service and do not ask visitors to reveal their ages. I do permit users to submit feedback, comments, or questions by email. What are my responsibilities if I receive a request for an email response from a player who indicates that he is under age 13? Under the Rule’s one-time response exception (16 C.F.R. § 312.5(c)(3)) you are permitted to send a response to the child, via the child’s online contact information, without sending notice to the parent or obtaining parental consent. However, you must delete the child’s online contact information from your records promptly after you send your response. Assuming the FTC is correct that content creators (not just the service itself) are responsible for COPPA compliance, a Discord server administrator would likely be required to ban/delete the account of a user upon discovering (acquiring actual knowledge) that the user is under 13. It may be a defense that they believed the user's retraction and claim that it was a lie, but I wouldn't want to be stuck arguing that in court (an underage user who doesn't want to be banned certainly would have a good reason to lie about their age upon finding out that they would be banned for having admitted their actual age).
The basic requirements for the effectiveness of valid legal consent are defined in Article 7 of the GDPR and specified further in Recital 32. There is no form requirement for the consent, so using a button is not a problem. However, I do not think the MailChimp-button you reproduce as an example is good enough. It asks for a blanket consent to stuff that is buried in MailChimp's “Anti-spam Policy &amp; Terms of Use”. But according to the GDPR, what the data subject consent to can’t be buried in the ToU – it must spelled out in clear, plain language. Requests must be granular, asking for separate consent for separate types of processing. “When the processing has multiple purposes, consent should be given for all of them” (Recital 32). Blanket consent, as used by MailChimp, is not allowed. The other clear requirement from the GDPR is that opt-in is mandatory. Pre-ticked and opt-out buttons are explicitly banned: “Silence, pre-ticked boxes or inactivity should not therefore constitute consent” (Recital 32). ‘No’ must become your data default, but if the user chooses to opt-in by clicking a button, this is valid consent. The MailChimp-button complies witrh this. The GDPR also requires you to keep a records of the consents given (so make that part of the user profile), and to withdraw consent at any time &ndash; so you make make provisions for that as well in your implementation of consent.
The GDPR's right to erasure just applies in some specific situations. While messages you wrote on Slack are personal data, they are generally also part of a larger discussion with others. If your messages are removed, the discussion becomes incomplete, so that will violate the freedom of expression of those others. Art. 17(3) GDPR provides an exception for the right of erasure in such cases. So basically, whoever is the controller, you probably don't have the right to have your messages to be deleted. However, you would have the right to have your account pseudonymized like Slack replied in the Reddit post you linked to. See also my answer in "Does a user have the right to request their forum posts deleted?". Basically, it is correct that Slack can be just the processor. Even if the controller cannot get access to more than 10000 messages unless they pay. However, Slack is not allowed to do anything with those messages, except when the controller says so. In its Privacy Policy, Slack distinguishes between customer data and other data. It states to be the processor for the customer data, but controller for the other data. Because those are tied together, I am not sure this distinction can be made. If not, Slack and the customer will be joint controllers, but it requires probably a court case to decide on that. For example, the Court of Justice of the European Union has ruled (in the Fashion ID case) that putting a Facebook "like" button on your website, makes you a joint controller together with Facebook. And (in the Wirtschaftsakademie case) that also creating a Facebook "fan" page makes you a joint controller. But neither of those are very similar to the situation with Slack.
Most place it isn't illegal, but unless the company has some good reason for asking (such as the ones that Nij outlines) then it might open them up to accusations of ageism. In other words, if they have no good reason for asking they would have difficulty explaining to a court why they wanted that information if it wasn't to facilitate age discrimination.
Probably not An employee is someone that the employer "suffers or permits to work" - moderators would appear to be caught by this. There are specific exemptions carved out in the public and not-for-profit sectors where they "a) work toward public service, religious or humanitarian objectives; b) not expect or receive compensation for services; and c) not displace any genuine employees." However, they very specifically say “Under the FLSA, employees may not volunteer services to for-profit private sector employers.” So on the face of it, a moderator is an employee and is entitled to minimum wages and conditions for the hours they work. AOL settled a lawsuit in 2009 with their moderators who were suing for wages for an undisclosed sum and so the case did not set a precedent. This article suggests that "for-profit companies don’t have volunteers; they have lawsuits waiting to happen" and uses examines the situation at Reddit (which could equally apply here). Facebook employs moderators so the precedent exists that this is work that employees do. When the lawsuit happens, we'll find out. It will turn on the particular facts - some types of mods for some companies may be employees while others may not.
I'm not aware of any cases on point, but as a rule legal fig-leaves don't play well in court. If the webmaster simply puts up a banner saying that EU residents are not permitted but takes no other action to exclude them, then that is going to be considered irrelevant. The webmaster is still very likely required to comply with the GDPR. On the other hand if the webmaster takes other steps to exclude EU residents, such as using a geolocation service to block connections known to be in the EU, validating email addresses and blocking those from EU domains, and ejecting anyone who mentions that their residence is in the EU, then that is more likely to be seen as a good-faith attempt to avoid being subject to the GDPR. It will also have the practical effect of greatly reducing the number of actual EU residents. All these controls can be evaded, but it would be much harder for any data subjects to claim that they acted in good faith or that the webmaster acted in bad faith. Note that validating an email address or logging an IP is itself processing of personal data, so anyone implementing such a system still can't ignore the GDPR completely, but it would greatly limit the scope and make it easy to delete any such data after a short time. (Note: the term &quot;EU resident&quot; above is an approximation of the territorial scope).
In Illinois, there were previously no restrictions for those 13 and older. However: NOTE: Beginning on January 1, 2016, no person born on or after January 1, 1998, unless exempted by subsection (i), shall operate a motorboat with over 10 horse power unless that person has a valid Boating Safety Certificate issued by the Department of Natural Resources or an entity or organization recognized and approved by the Department. Please check back at a later date for more details. Persons at least 12 years of age and less than 18 years of age may only operate a motorboat if: They have in possession a valid Boating Education Certificate of Competency issued by the Illinois Department of Natural Resources, Safety Education Division, or They are accompanied on the motorboat and under direct control of a parent of guardian, or a person at least 18 years of age designated by a parent or guardian. Emphasis in original. Source: https://www.dnr.illinois.gov/safety/Pages/BoatingSafety.aspx In Wisconsin, Who May Operate/Age Restrictions It is illegal for a parent or guardian to allow a child to operate a vessel in violation of the requirements below. Motorboats (Other Than a Personal Watercraft) A person under the age of 10 may not operate a motorboat. A person 10 or 11 years old may operate a motorboat only if accompanied by a parent, a guardian, or a person at least 18 years old who is designated by the parent or guardian. A person 12-15 years old may operate a motorboat only if: He or she is accompanied by a parent, a guardian, or a person at least 18 years old who is designated by the parent or guardian or … He or she has completed a boating safety course that is accepted by the Wisconsin DNR. A person at least 16 years old may operate a motorboat only if he or she has completed a boating safety course that is accepted by the Wisconsin DNR. A person born before January 1, 1989, is exempt from the safety course requirement. Personal Watercraft (PWC) A person under the age of 12 may not operate a PWC. A person 12-15 years old may operate a PWC only if he or she has completed a boating safety course that is accepted by the Wisconsin DNR. (Parental supervision is not a substitute for a boating safety course certificate as with other motorboats.) A person at least 16 years old may operate a PWC only if he or she has completed a boating safety course that is accepted by the Wisconsin DNR. A person born before January 1, 1989, is exempt from the safety course requirement. A person under the age of 16 may not rent or lease a PWC. Emphasis removed. Source: https://www.boat-ed.com/wisconsin/handbook/page/6/Who-May-Operate%7CAge-Restrictions/
In general, a ToS document for a web site or online service is simply a contract or agreement. Normally violations of such an agreement are possible grounds for a civil suit, but are not crimes. Moreover, some terms that some TOS documents claim are not legally enforceable. For example some insist that a user waive a right that the law says cannot be waived. The kind of terms mentioned ion the question are probably enforceable in most jurisdictions. If a person intentionally supplies false information to a site operator or service provider, with the intention of gaining some financial benefit that would not be available without the false statements, under circumstances where it would be reasonable for the site operator to rely on the statements, that would be fraud in many jurisdictions. Fraud is often a matter for a civil suit, but in some cases it can be a crime also. Those cases vary in different jurisdictions, and the question does not specify any particular jurisdiction. Criminal fraud is the only case where I can think of where a ToS violation would be a crime. Some TOS documents prohibit things which are already crimes. For example a communication site might include in its ToS that users are not to use it to assist in committing a crime, or to unlawfully harass someone. If a user violated those provisions, they would also be committing a crime, but only because those actions would be crimes even if the TOS had never mentioned them. It is a crime to plan a murder via a chat site, whether the TOS says so or not. But that is because it is a crime to plan a murder in general, with nor without the chat site. There are some specifically online crimes. For example, posting so-called &quot;revenge porn&quot; is a crime in many jurisdictions. But that is a crime because of a law against it, not because of a TOS that prohibits it. In all usual cases, a ToS violation will be dealt with via a civil suit, or by limiting or canceling the user's access, if it is dealt with at all. CFAA In the united-states the Computer fraud and Abuse Act (CFAA), specifically 18 U. S. C. §1030(a)(2), makes it a crime for anyone who ... intentionally accesses a computer without authorization or exceeds authorized access ... The recent case of Van Buren v. United States, 593 U.S. ___ (2021) dealt with the &quot;exceeds authorized access&quot; language. (See the Wikipedia article) In that case, Van Buren, a police officer, accessed official databases to determine id the holder of a given license plate was in fact an undercover police officer. Van Buren thought that this information was being provided to a criminal, and was paid $6,000 for it. Van Buren knew that the access policy prohibited access for &quot;personal use&quot; or any &quot;non-official purpose&quot;. He was charged with a felony violation of the CFAA on the ground that he accessed information with an &quot;improper purpose&quot;, although he would have been authorized to access that same information with a proper purpose. After a long discussion of the meanign of the words &quot;so&quot; and &quot;entitled&quot; in the stsatute, the court opnion says: If the “exceeds authorized access” clause criminalizes every violation of a computer-use policy, then millions of otherwise law-abiding citizens are criminals. Take the workplace. Employers commonly state that computers and electronic devices can be used only for business purposes. So on the Government’s reading of the statute, an employee who sends a personal e-mail or reads the news using her work computer has violated the CFAA. Or consider the Internet. Many websites, services, and databases—which provide “information” from “protected computer[s],” §1030(a)(2)(C)—authorize a user’s access only upon his agreement to follow specified terms of service. If the “exceeds authorized access” clause encompasses violations of circumstance-based access restrictions on employers’ computers, it is difficult to see why it would not also encompass violations of such restrictions on website providers’ computers. And indeed, numerous amici explain why the Government’s reading of subsection (a)(2) would do just that—criminalize everything from embellishing an online-dating profile to using a pseudonym on Facebook. ... ... For example, one police department might prohibit using a confidential database for a non-law-enforcement purpose (an access restriction), while another might prohibit using information from the database for a non-law-enforcement purpose (a use restriction). Conduct like Van Buren’s can be characterized either way, and an employer might not see much difference between the two. On the Government’s reading, however, the conduct would violate the CFAA only if the employer phrased the policy as an access restriction. An interpretation that stakes so much on a fine distinction controlled by the drafting practices of private parties is hard to sell as the most plausible. In sum, an individual “exceeds authorized access” when he accesses a computer with authorization but then obtains information located in particular areas of the computer—such as files, folders, or databases—that are off limits to him. This case clearly says that a person who has authorization to access a computer, but does so for a purpose prohibited by system policy, perhaps as expressed n a TOS contract, is not subject to criminal prosecution under the CFAA. It does not directly deal with the case where, as a condition of access, a person must furnish truthful ID information, or comply with some other condition, and whether violating such a condition would constitute a crime under the CFAA. But it casts significant doubt on any interpretation of the CFAA which would treat that as a crime