Legality of creating bot accounts in Facebook/Twitter/Instagram I am a programmer and have a job offer to create a script that will automate the creation of a Bot Farm. So my boss wants me to develop a program to mass-create Facebook/Twitter/Instagram accounts. The accounts have to pull the images to use as profiles. I guess those images belong to real people and will be used without their agreement. I wonder if it is legal to create such bot accounts in Facebook/Twitter/Instagram? Is it possible that I could face legal repercussions as a developer of this program? Or is I merely write the program but don't run it can I be held responsible for its misuse?
You have several issues. Breach of Contract When you sign up with each of those services you are entering a legally binding contract and must comply with the terms of that contract. For example, this is taken from Facebook's terms: Here are some commitments you make to us relating to registering and maintaining the security of your account: You will not provide any false personal information on Facebook, or create an account for anyone other than yourself without permission. You will not create more than one personal account. I haven't checked but its a fair bet that the other services have similar terms. Unless you have permission, what you are doing breaches these terms of service. If what you do causes damage to Facebook et al then they can sue you and your employer for damages. Even if it doesn't they can probably bar you from having an account for as long as they like. Improper use of images This is jurisdictional but it is generally required to have the permission of the subject of a photograph where that photograph is used for commercial gain. There are exceptions where the person is not the primary subject (e.g. crowd shots, or images primarily of something else where the person happens to be in the shot) but the type of photos you would use for these services are not going to be exempt. The sanctions for breaching this will be dependent on jurisdiction. Breach of Copyright Somebody owns the copyright in those photographs. If you do not have a licence to use them in the way you propose then you are breaching their copyright. The copyright holder can sue for damages (if any) and any profits you make. Vicarious Liability An employer is strictly liable for the actions of their employees, jointly and severally with the employee. That means a plaintiff can go after either the employer, the employee or both. An employee may have some statutory or contractual indemnity but this is by no means common.
TL;DR In theory there's nothing wrong with your method, it's just a way to authenticate the user, and without authentication a user has no right to request anything anyway. But in practice it looks like your method doesn't have a way to deal with situations where users lose or forget their authentication data and want to be able to recover their account. Failing to deal with that in a modern system might be considered an unacceptable bad practice and so be against the GDPR principles of security and privacy by design. EXTENDED VERSION I might be wrong or not understand the question correctly, but I don't see how this is different from many other common cases where encryption is not involved. Think about it, you aren't able to give the user their own personal data unless they provide the ID and encryption keys. How is this significantly different from the fact you aren't able to (or rather you should not) show a user their own data unless they provide their own username and password, or they convincingly authenticate themselves in any way? Just like you can't ask Facebook to show you all the data collected about Donald Trump only by claiming you are Donald Trump, you can't be required to give a user their own data unless they provide the encryption key. It can be seen as your way to authenticate users (among other things). Edited: multiple IDs/keys I didn't understand your method involved multiple IDs and keys. In theory, the situation is still the same, only with multiple pieces of data for authentication, like the user had to remember multiple usernames and passwords. Failing to provide all IDs and all keys will result in a partial authentication. But with such an approach a potential problem becomes more evident: your authentication scheme might be against the GDPR principles of "security and privacy by design and by default". Basically, your methods might be considered bad practice because they fail to deal with the common issue of lost or forgotten passwords. If a user tells you they have lost a USB drive containing all their IDs and keys and they don't have them anymore, what do you do? You can't delete their data because you aren't able to know what their data is, without another way of authenticating. And their data is now at risk, because somebody else might have their IDs and keys. If you had an email address associated with all the user's IDs and data, then you might be able to confirm their identity (for example sending an email with a link) and delete all their data. As you see, things can get pretty complicated, it all depends on the details of your implementation, and just adding or removing one detail might change the whole scenario.
The existence of a robots.txt file and the directory and file inclusions/exclusions in a robots.txt file do not constitute a legally binding contract for the use of the website by the visitor; if it exists, the Terms of Service would usually establish the contract for use of the site. Many TOSs prohibit bots, crawlers and any automated means from crawling or scraping a site, and you are contractually obligated to honor those stipulations simply by visiting the site. Violating a TOS is typically a civil matter, depending on jurisdiction. Simply crawling a site to &quot;map&quot; it, and crawling a site to &quot;scrape&quot; it and copy all content are two different things. Crawling could violate the TOS. Scraping content can violate the TOS and also be copyright infringement, depending on jurisdiction. See https://law.stackexchange.com/search?q=scraping I suppose a TOS could state that users are legally bound to the restrictions in a robots.txt, but I've never seen that in a TOS.
Whether this is considered a trade secret (at least in the US) depends partly on whether you've taken reasonable action to keep it secret. If an employee thought it was OK to publish the algorithm, that's evidence that you didn't try very hard to keep it from getting out. Even if nobody's noticed it yet, getting the blog post taken down in't going to get it off the internet. You may as well try to do it anyway. If nobody has noticed the algorithm by now, you want to make it harder for them to find. You need an IP lawyer pronto. Depending on where you are, you might be able to get a patent on the algorithm still, but patents are hard to enforce, and it appears to be getting harder in the US to patent algorithms. (There's a Stack Exchange site so people can look at patent applications and see if they can invalidate the application with prior art.) You can't license out the algorithm without having some legal way of stopping other places from just using it. If you have more proprietary algorithms or things that aren't generally known that give you a competitive advantage, it would be a good idea to inform employees that they aren't supposed to reveal them. Check with your IP lawyer to see what you should do.
When the question is "Can I be sued for..." there can't ever be a really useful answer, because anyone can be sued for just about anything. The suit may be tossed as pointless early in the process, but it can be filed. That said, could there be a valid ground of suit against a developer for creating a scraper? Possibly. Scraping a site could be against the site's TOS. It could be largely a way of committing copyright infringement. It could be unlawful in some other way. For most sites, scraping is not unlawful. Google does it all the time. If there is no legitimate use for the scraper, or very nearly none, so that any user is likely to be acting maliciously and unlawfully, and if the developer knows this, or any reasonable developer should know this, then the developer could possibly be found liable for the illegitimate actions of those who use the scarper. If there is a legit use for the scraper, or the developer would plausibly think that there is, then such development is not illegal, and a successful suit against the developer is unlikely.
Yes (probably), under COPPA The FTC has stated that YouTube content creators could be held liable under the Children's Online Privacy Protection Act (COPPA), a United States law that &quot;imposes certain requirements on operators of websites or online services directed to children under 13 years of age, and on operators of other websites or online services that have actual knowledge that they are collecting personal information online from a child under 13 years of age.&quot; (source) The FTC's FAQ on complying with COPPA notes that &quot;operators will be held to have acquired actual knowledge of having collected personal information from a child where, for example, they later learn of a child’s age or grade from a concerned parent who has learned that his child is participating on the site or service.&quot; It also has the following question/answer (emphasis added): I operate a general audience video game service and do not ask visitors to reveal their ages. I do permit users to submit feedback, comments, or questions by email. What are my responsibilities if I receive a request for an email response from a player who indicates that he is under age 13? Under the Rule’s one-time response exception (16 C.F.R. § 312.5(c)(3)) you are permitted to send a response to the child, via the child’s online contact information, without sending notice to the parent or obtaining parental consent. However, you must delete the child’s online contact information from your records promptly after you send your response. Assuming the FTC is correct that content creators (not just the service itself) are responsible for COPPA compliance, a Discord server administrator would likely be required to ban/delete the account of a user upon discovering (acquiring actual knowledge) that the user is under 13. It may be a defense that they believed the user's retraction and claim that it was a lie, but I wouldn't want to be stuck arguing that in court (an underage user who doesn't want to be banned certainly would have a good reason to lie about their age upon finding out that they would be banned for having admitted their actual age).
This seems to be a mix of question about law and a meta-question about this site, but I'll treat it as an on-topic question about law. The author of a question, or answer, owns the copyright to their contributions, and they can re-publish to their heart's content. Any user who posts here grants a license to SE and other users to use content posted here, so I don't have to ask you permission to quote you. As part of the permission granted by SE to use this website, you have agreed to &quot;follow the rules&quot; set by SE. There are many rules, some spelled out more clearly that others. For example, if you post a question, you indirectly agreed that your content can be upvoted or down-voted. Certain content can be &quot;closed&quot; and deleted, when the content is deemed to violate the rules in particular ways (is spam, porn, abuse, or judged to be poor-quality). Judgment (on different matters) can be rendered by community managers, moderators, or other users. The agreement is here, see especially here. If we take the post that you linked to, it is quite possible that it was deleted because it is not a general legal question, in violation of the acceptable use policy. If you want a historical analysis of your particular case, it should be asked on Law Meta.
If you do, you will probably be faced with a lawsuit. If the program did something that they don't do, it might be okay (but hire a lawyer to be sure). Perhaps a plumbing app would be safe. They (Meta) do state that Meta is one of their trademarks, and you can verify that here. That means that they have the exclusive right to use the mark &quot;Meta&quot; in the particular spheres where they operate, namely G &amp; S: Identification verification services; Online social networking services; Personal concierge services for others comprising making requested personal arrangements and reservations and providing customer-specific information to meet individual needs; Providing access to computer databases and online searchable databases in the fields of social networking; Social introduction and networking services; Social networking services related to sports, fitness, and coaching activities provided through a community website online and other computer and electronic communication networks; User verification services; Social introduction, networking and dating services as well as Computer hardware; Application programming interface (API) for software which facilitates online services for data retrieval, upload, download, access and management; Computer peripheral devices; Virtual, augmented, and mixed reality software for use in enabling computers, mobile devices, to provide virtual reality experiences; Software for integrating electronic data with real world environments for the purposes of entertainment, education, communicating; Virtual reality computer hardware; Virtual reality software for use in enabling computers, mobile devices, to provide virtual reality experiences; Motion tracking sensors for virtual reality technology; Motion tracking sensors for augmented reality technology; Digital media streaming devices; Wearable computing devices comprised primarily of software and display screens for connection to computers, mobile devices, and in order to enable virtual reality and augmented reality world experiences; Software for tracking motion in, visualizing, manipulating, viewing, and displaying augmented and virtual reality experiences; Software, firmware and hardware for use in visual, voice, audio, motion, eye and gesture tracking and recognition; Hardware and software for operating sensor devices; Electronic sensor devices, cameras, projectors, and microphones for gesture, facial, and voice detection, capture and recognition; Hardware and software for detecting objects, user gestures and commands; Wireless computer peripherals; Computer software for modifying photographs, images and audio, video, and audio-visual content with photographic filters and augmented reality (AR) effects, namely, graphics, animations, text, drawings, geotags, metadata tags, hyperlinks; Computer software, downloadable computer software and mobile application software for facilitating interaction and communication between humans and AI (artificial intelligence) platforms, namely, bots, virtual agents and virtual assistants; Application programming interface (API) software for allowing data retrieval, upload, access and management; Software for organizing images, video, and audio-visual content using metadata tags; Application programming interface (API) for use in developing AI (artificial intelligence) platforms, namely, bots, virtual agents and virtual assistants; Computer software for sending and receiving electronic messages, graphics, images, audio and audio visual content via the internet and communication networks; Downloadable software, namely, instant messaging software, file sharing software, communications software for electronically exchanging data, audio, video images and graphics via computer, mobile, wireless, and communication networks; Computer software for personal information management, and data synchronization software; Computer software for use in facilitating voice over internet protocol (VOIP) calls, phone calls, video calls, text messages, instant message; Communication software and communication computer hardware for providing access to the Internet; Electronic display screens; Computer peripherals for remotely accessing and transmitting data; Computer hardware for displaying data and video; Computer peripherals for displaying data and video; Software to view virtual images in creating augmented reality; Computer software for setting up, configuring, operating and controlling wearable devices, computers, and computer peripherals; Computer software for accessing, monitoring, searching, displaying, reading, recommending, sharing, organizing, and annotating news, sports, weather, commentary, and other information, content from periodicals, blogs, and websites, and other text, data, graphics, images, audio, video, and multimedia content; Computer software for accessing, browsing and searching online databases; Computer software for accessing, monitoring, searching, displaying, reading, recommending, sharing, organizing, and annotating news, sports, weather, commentary, and other information, content from periodicals, blogs, and websites, and other text, data, graphics, images, audio, video, and multimedia content; Computer software for controlling the operation of audio and video devices; Computer software for creating, editing, uploading, downloading, accessing, viewing, posting, displaying, tagging, blogging, streaming, linking, annotating, indicating sentiment about, commenting on, embedding, transmitting, and sharing or otherwise providing electronic media or information via computer the internet and communication networks; Computer software for integrating electronic data with real world environments for the purposes of entertainment, communicating, and social networking; Computer software for modifying and enabling transmission of images, audio, audio visual and video content and data; Computer software for modifying photographs, images and audio, video, and audio-visual content with photographic filters and virtual reality, mixed reality and augmented reality effects, namely, graphics, animations, text, drawings, geotags, metadata tags, hyperlinks; Computer software for processing images, graphics, audio, video, and text; Computer software for sending and receiving electronic messages, graphics, images, audio and audio visual content via computer the internet and communication networks; Computer software for sending and receiving electronic messages, alerts, notifications and reminders; Computer software for social networking and interacting with online communities; Computer software for the collection, managing, editing, organizing, modifying, transmission, sharing, and storage of data and information; Computer software for the redirection of messages, Internet e-mail, and/or other data to one or more electronic wearable wireless communication devices from a data store on or associated with a personal computer or a server; Computer software for wireless content, data and information delivery; Computer software to enable accessing, displaying, editing, linking, sharing and otherwise providing electronic media and information via the internet and communications networks; Computer software to enable development, assessment, testing, and maintenance of mobile software applications for portable electronic communication devices, namely, mobile phones, smartphones, handheld computers and computer tablets; Computer software to enhance the audio-visual capabilities of multimedia applications, namely, for the three-dimensional rendering of graphics, still images and moving pictures provided as updates for or in combination with head-mounted display screen devices; Computer software, downloadable computer software and mobile application software for creating, managing and accessing groups within virtual communities; Computer software, namely, an application providing social networking functionalities; Computer software, namely, an interpretive interface for facilitating interaction between humans and machines; Downloadable computer software for finding content and content publishers, and for subscribing to content; Downloadable computer software for viewing and interacting with a feed of images, audio, audio-visual and video content and associated text and data; Gesture recognition software; Software for detecting objects, user gestures and commands; Software for operating sensor devices; Software to view virtual images in creating virtual, augmented and mixed reality; Interactive entertainment software; Location-aware computer software, downloadable computer software and mobile application software for searching, determining and sharing locations; Messaging software; Mixed reality software; Mixed reality software for interactive entertainment; Mixed reality software for navigating a mixed reality environment; Mixed reality software for object tracking, motion control and content visualization; Social assistant software; Software and firmware for enabling electronic devices to share data and communicate with each other; Software development tools; Software driver programs for electronic devices for enabling computer hardware and electronic devices to communicate with each other; Software for advertisers to communicate and interact with online communities; Software for alerts, messages, emails, and reminders, and for recording, organizing, transmitting, manipulating, reviewing, and receiving text, data, audio, image and digital files and display screens; Software for creating and managing social media profiles and user accounts; Software for creating, editing, uploading, downloading, accessing, viewing, posting, displaying, tagging, blogging, streaming, linking, annotating, indicating sentiment about, commenting on, embedding, transmitting, and sharing or otherwise providing electronic media or information via computer and communication networks; Software for creating, managing and accessing groups within virtual communities; Software for creating, managing, and interacting with an online community; Software for integrating electronic data with real world environments for the purposes of entertainment, education, communicating, and social networking; Software for modifying and enabling transmission of images, audio, audio visual and video content and data; Software for processing images, graphics, audio, video, and text; Software for social networking; Software for streaming multimedia entertainment content; Software and firmware for use in visual, voice, audio, motion, eye and gesture tracking and recognition; Software, namely, an interpretive interface for facilitating interaction between humans and machines; Video display software; Computer software, firmware and hardware for use in visual, voice, audio, motion, eye and gesture tracking and recognition; Computer hardware and software for operating sensor devices; Computer hardware and software for detecting objects, user gestures and commands; Computer software driver programs for electronic devices for enabling computer hardware and electronic devices to communicate with each other; Cameras; Wireless computer peripherals; Video receivers; Sensors for monitoring physical movements and dozens of other also-registered areas.