How to tell which state governs the &quot;Terms and Conditions&quot; of my website? In the "Terms and Conditions" page of my website, I have this paragraph: These Terms will be governed by and interpreted in accordance with the laws of the State of XXXXX, and you submit to the non-exclusive jurisdiction of the state and federal courts located in XXXXX for the resolution of any disputes. I personally live outside of the United States. If the web-hosting server of my website is located in Texas, and I use a Oregon physical address which I got from a mail-forwarding service (similar to PO box) as my contact information in my email newsletter, should I replace the XXXXX in the aforementioned paragraph with "Texas" or "Oregon"? Or should I replace it with the name of the country where I live instead?
You may want to select a state where you have some sort of presence. According to this article, personal jurisdiction can be waived, but subject matter jurisdiction can not, and "for pragmatic reasons some states deny subject-matter jurisdiction to specific claims, such as those arising in other states". In other words, if nothing about you, the other party, or the case has any relation to the state, the court doesn't necessarily have to listen to the case. And if that happens, the provision about them submitting to the jurisdiction is worthless. Beyond that, are you OK with going to court in the location you select? Do you know whether all your terms and conditions are valid in that location? Do you know whether one place or another has more favorable interpretations of the laws, or more favorable local rules, when it comes to the types of disputes you are likely to have? You probably want a lawyer to help you decide.
A business is free to set its pricing model in whatever way it chooses, unless there is a specific law restring this. As no country or jurisdiction is mentioned in the question, there is no way to judge if some specific law applies. (In the US that would probably be a matter of state law.) A business could set its prices at 10 per user, but with a Minimum charge of 100 if it chose to do it that way. It is up to a potential customer to decide if this is a fair price or not. As long as the price plan was disclosed in advance, the customer has no ground for a legal complaint. The customer could always ask the business to change its policy, but there would be no legal duty to make a change.
Various Privacy Laws may Apply If you live in the EU, the site may be required to delete this information under the GDPR. If you live in the UK, you may have the right to deletion under the UK-GDPR. In each case the procedure for enforcing such a right if the business does not respond depends on the law of your country, and would involve a suit in the courts of that country. Even if a judgement including a court order is obtained, enforcing this on a US firm may not be easy. If you live in California, you may have a right to the deletion of the info under the California Consumer Privacy Act (CCPA) (soon to be replaced by a modified version, the California Privacy Rights Act (CPRA)). If you live in Virginia, you may have rights under the Virginia Consumer Data Protection Act (VCDPA). All these right are subject to various exceptions. Several other states, including Colorado, have passed similar laws, but they have not yet gone into effect. See also &quot;Consumers’ “Right to Delete” under US State Privacy Laws&quot; published by Consumer Privacy World and written by By Glenn A. Brown on March 3, 2021. Since the information was collected (posted) when you were less than 12, your parents may have the right to request deletion under the Federal Children's Online privacy Protection Act (COPPA) The DMCA deals with alleged copyright violations, not with personal privacy issues. CCPA / CPRA The CCPA right to delete applies only to information supplied by the Data Subject (DS). The CCPA right to delete is given by California Civil Code section 1798.105 The Buisness has 10 days to acknowledge a request, and 45 days to respond, which may be extended for an additional 45 days. Note also that the CCPA requires various notices to be delivered to the consumer, and normally requires a privacy policy to be posted. This must include notification of the consumer's rights. Under the CCPA a consumer may not sue a firm directly to enforce the right to delete. Instead a complaint may be made to the California Attorney General, who is empowered to take enforcement action. Only in cases of a data breach ca a consumer sue a firm directly. Note that he CCPA appliws only to firms that: are for-profit businesses that do business in California and Have a gross annual revenue of over $25 million; or Buy, receive, or sell the personal information of 50,000 or more California residents, households, or devices; or Derive 50% or more of their annual revenue from selling California residents’ personal information. See also the official page &quot;California Consumer Privacy Act (CCPA)&quot; VCDPA Section 59.1-573 (A) provides that (A) A consumer may invoke the consumer rights authorized pursuant to this subsection at any time by submitting a request to a controller specifying the consumer rights the consumer wishes to invoke. A known child's parent or legal guardian may invoke such consumer rights on behalf of the child regarding processing personal data belonging to the known child. A controller shall comply with an authenticated consumer request to exercise the right: ... (A) 3. To delete personal data provided by or obtained about the consumer; (A) 4. To obtain a copy of the consumer's personal data that the consumer previously provided to the controller in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another controller without hindrance, where the processing is carried out by automated means; and (A) 5. To opt out of the processing of the personal data for purposes of (i) targeted advertising, (ii) the sale of personal data, or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer. Under subsection B the controller (firm) has 45 days to respond, which may be extended for up to an additional 45 days Under 59.1-574 (A) a controller has verious obligations including to: Limit the collection of personal data to what is adequate, relevant, and reasonably necessary ... and to: Not process sensitive data concerning a consumer without obtaining the consumer's consent, or, in the case of the processing of sensitive data concerning a known child, without processing such data in accordance with the federal Children's Online Privacy Protection Act (15 U.S.C. з 6501 et seq.). Under subsectiuon (B) the rights may not be waived by contract. Under subsection (c) the controller must provide: a reasonably accessible, clear, and meaningful privacy notice and this notice must contain: one or more secure and reliable means for consumers to submit a request to exercise their consumer rights under this chapter. Such means shall take into account the ways in which consumers normally interact with the controller, the need for secure and reliable communication of such requests, and the ability of the controller to authenticate the identity of the consumer making the request. Controllers shall not require a consumer to create a new account in order to exercise consumer rights pursuant to з 59.1-573 but may require a consumer to use an existing account. various exemptions are provided for in the VCDPA. As with the CCPA, the previsions may only be enforced by the state Attorney General, not by private lawsuit. The VCDPA only applies to: persons that conduct business in the Commonwealth or produce products or services that are targeted to residents of the Commonwealth and that (i) during a calendar year, control or process personal data of at least 100,000 consumers or (ii) control or process personal data of at least 25,000 consumers and derive over 50 percent of gross revenue from the sale of personal data. In many ways it is quite similar to the CCPA. COPPA COPPA is a federal law that applies to services, including websites, that collect personal information about children under age 13. It imposes various responsibilities and restrictions on such providers, and give the parents of such children various rights. According to the FTC pagw &quot;Children’s Online Privacy Protection Rule: A Six-Step Compliance Plan for Your Business&quot;&quot; Even if parents have agreed that you may collect information from their kids, parents have ongoing rights — and you have continuing obligations. If a parent asks, you must: give them a way to review the personal information collected from their child; give them a way to revoke their consent and refuse the further use or collection of personal information from their child; and delete their child’s personal information. The FTC's FAQ on COPPA states: The primary goal of COPPA is to place parents in control over what information is collected from their young children online. The Rule was designed to protect children under age 13, while accounting for the dynamic nature of the Internet. The Rule applies to operators of commercial websites and online services (including mobile apps and IoT devices, such as smart toys) directed to children under 13 that collect, use, or disclose personal information from children, or on whose behalf such information is collected or maintained (such as when personal information is collected by an ad network to serve targeted advertising). The Rule also applies to operators of general audience websites or online services with actual knowledge that they are collecting, using, or disclosing personal information from children under 13, and to websites or online services that have actual knowledge that they are collecting personal information directly from users of another website or online service directed to children. Operators covered by the Rule must: ... Provide parents access to their child's personal information to review and/or have the information deleted; ... Maintain the confidentiality, security, and integrity of information they collect from children, including by taking reasonable steps to release such information only to parties capable of maintaining its confidentiality and security; Retain personal information collected online from a child for only as long as is necessary to fulfill the purpose for which it was collected and delete the information using reasonable measures to protect against its unauthorized access or use; The same page says that COPPA: applies to operators of commercial websites and online services (including mobile apps and IoT devices) directed to children under 13 that collect, use, or disclose personal information from children. It also applies to operators of general audience websites or online services with actual knowledge that they are collecting, using, or disclosing personal information from children under 13. The Rule also applies to websites or online services that have actual knowledge that they are collecting personal information directly from users of another website or online service directed to children. The FTC, some other federal agencies, and US states may enforce the COPPA Rule.
You are processing the users IP address in order to carry out the translation to a physical location (see my comment for the technical issues with that) and an IP address is most certainly considered personal information, so yes under the GDPR you are going to need a published policy because you are both data controller and data processor. You need to inform the user of what you are doing, and you need to tell them of the legal basis for the processing (there are several under the GDPR, of which consent is only one - but in your case its going to be the easiest to justify). If you use a third party service for the location translation, you also need to inform the user of that and make available the third party services data processing policy.
It would be terribly risky for you to simply link another company's terms of service. What if they take their server down? What if they change their terms? You would not even know when exactly the changes were made. Copying their terms means you might run into copyright issues on the text. Either pay a lawyer to write your ToS for you, or see if you can find something in the public domain.
No Recognition of territorial claims is the sole province of the diplomatic branches of national government, and of heads of state. In the US it is the State Department, and ultimately the President. The actions of telephone operators and people engaging in other forms of communication cannot and do not bind the decisions of the President, or of other heads of state. Besides, there may be cases in which a telephone country code or a web domain may not match the actual, undisputed legal status of a territory. Accepting a phone call does not affect a country's legal status. For decades the US did not recognize the communist regime in China. Legally, it considered that the Republic of China (aka Taiwan) was the only valid government, and the acceptance of telephone calls did not change that.
Can a city request deletion of all personal data that uses a certain domain for logins? Well, they can, but they have no legal backing to make it happen. Their chances of succeeding are about as good as me requesting a Ferrari, a Yacht and a Mansion. I can make that request. People will laugh. I will not get it. I'm a little worried that I shouldn't allow certain domains to be used as logins in the first place, especially ones that might be school related You have no way to know who owns what email address. And it's none of your business. Your only interest should be in whether the address is owned by the person that is creating the account. You probably already do that by sending a confirmation link to the email address when people sign up. I'd like to have some idea for future reference if there's any case where the GDPR would require me to comply with such a request The only way you have to comply with such a request is if the owner can prove their identity. As far as I understood, the &quot;Finnish city&quot; was three degrees away from that. They could not provide any proof they are who they said they are, they could not provide a finite list of accounts they claimed to own and they could not even provide proof they own those accounts. They literally just wrote an email with zero legal meaning. I want to figure out the right way to reply to emails like this one The correct way to handle this is have a feature on your website where the account owner can delete their own account. GDPR compliant. Then you make a text template explaining how to use that feature and reply with that template to every request, no matter how stupid (like this case) they are. If they cannot identify themselves to you by proving they have access to their &quot;own&quot; email, they have no business wasting your time. Legally, they could provide you with a different method of identification. In case of a Finnish school, that would probably need to be power of attorney from all children's legal guardians and a specific way to identify the accounts that is consistent with the data given (for example if they entered their full name and address on your website). You would probably in your rights to demand a certified translation if it's all in Finnish. Apart from the fact that you as a private US citizen have no real means to check the validity of all that paperwork, personally, if I saw hundreds of pages of certified translated paperwork, I would probably just comply. Not sure it it were actually enough, but it certainly gets an A+ for effort to delete data from a private website. But a real lawyer might give better advice with a real case on their hands. Is deleting the data actually more of a legal liability than not deleting it in some cases? (People shouldn't be able to delete other people's accounts.) Indeed. You should not delete people's data because a random punk on the internet sent you an email. You need to identify who the request is from and if they are allowed to make such a request. Whether you have a legal duty to actually keep data, is up to you or your lawyer to find out. It depends on your data and laws. It is perfectly legal to make a website with a textfield that deletes any data you enter after a second. Destruction of data you own is only a problem if you break other laws with it. For example the IRS might not be amused if you destroyed invoices and other proof of taxable income. &quot;Some dude claimed I must in an email&quot; is not going to fly with them. That said, again, please, identify who you deal with, find out if their claim is valid. Don't do stuff because random internet punks write you an email. Because the next mail you get, will be from a Nigerian Prince. Please wisen up before opening that one. People on the internet, through stupidity or malice, might not have your best interests at heart. Don't believe random emails.
The general answer is "yes." Who ever said that only one set of laws applied? Jurisdiction isn't a matter of "one country's laws matter here, let's find out which one it is." All jurisdiction means is that your laws apply to the conduct, not that no one else's can as well. Broadly, there are a few sources of jurisdiction that are generally considered legitimate (to at least some degree) in international law: Territoriality: You have jurisdiction over actions performed in your territory. You also have jurisdiction over crimes where just one part of the crime happens in your jurisdiction (e.g. standing in country A and shooting someone in country B), or even if it just has a significant effect in your territory. Nationality: You have jurisdiction over crimes committed by your citizens anywhere in the world, regardless of whether or not they were breaking the law of wherever they were. Passive personality: You have jurisdiction over crimes committed against your citizens anywhere in the world. Protective: You have jurisdiction over crimes directly harming core state interests, like counterfeiting your passports or sabotaging your warship. Universal: A handful of crimes (like piracy or genocide) are so serious that every country in the world can exercise jurisdiction. If you catch a pirate, you can punish them. These are accepted to different degrees. Passive personality and protective jurisdiction tend to be iffier; territorial jurisdiction is unquestioned (although if it's just based on effects in your territory, it becomes a bit iffier as well). But any of them can be a basis for jurisdiction. If multiple countries have jurisdiction, whoever actually has the offender decides who will try them (jurisdiction to make an arrest is limited to the country in which the arrest is made). So: If you're located in a country, you have to comply with their laws, and they can regulate just about whatever they want, including what you're doing to foreign computers. The foreign country can also generally regulate what you're doing, because part of what you're doing is happening on their territory. Even if both you and the computer are in a foreign country, you may have to answer to the courts of your country of citizenship. Depending on what exactly you're doing, the protective principle may come into play. For instance, if you hack into a computer on a foreign military base, the foreign country could prosecute you for endangering their security. If you're coordinating a genocide, universality applies and anyone can prosecute you. If you hack the computer of a foreigner, passive personality may apply, although this tends to be controversial.