Would an encryption ban also ban transmitting random noise? Say for the sake of argument that the US government decided to ban all encryption in communications. Since modern encryption makes a message practically indistinguishable from random noise, would sending random noise also be banned? If not, and since there's no practical way to tell them apart, how could this be enforced?
It isn't true that modern encryption necessarily makes messages indistinguishable from random noise. However, let's assume that this is true, for the sake of your question. It depends on how the statute is written, but a reasonable one would not make it a crime to send random noise. It could be enforced by proving that you did the encryption, and then sent what you encrypted across a communication channel. They could have undercover operatives waiting to be sent encrypted material. The encryption system that a user chooses to use might not be as secure as advertised (making it very easy to distinguish from noise if you know its weakness). If all the government had was access to the communication channel and listened there, then you're right, it would be hard to prove and enforce, but they have access to more than that.
As stated in the answer to What is considered &quot;public&quot; in the context of taking videos or audio recordings?; if either of the participants is in Australia than unless all parties have given consent then the recording is illegal. Notwithstanding its legality, property in the recording vests in the person who made it. There is no law against him keeping it. There is no law against him publishing it unless the material contained is offensive, hate speech or defamatory (see Customer feedback gathering in Australia).
It infringes the copyright. It can easily be proved that both XOR1 and XOR2 derive from the source work by XOR-ing the streams with each other. It's just like any encrypted copy: it infringes the copyright, but only those who can decrypt it are in a position to know that it infringes the copyright. The posts on the forum are illegal because they infringe the copyright; it doesn't matter that they are derived works rather than the work itself, just as your drawing of a copyright-protected image infringes copyright because it is a derived work without being the work itself.
You quoted the definition of personal data from Art 4(1) GDPR. This definition of identifiability is further explained in Recital 26: […] To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. […] If the user ID is unique, then the hashed user ID will be unique as well. Thus, the hashed ID will enable “singling out”, and would still count as identifying in the sense of the GDPR. You also claim that there's no way to reverse the hash. This is not quite correct. Assuming that the hash function itself is secure, then the only way to crack the hash is to brute-force the input. The difficulty of brute-forcing depends only on the entropy of the input data, not on the size of the output hash. It is thus comparatively easy to crack hashes of short low-entropy strings like sequential integer user IDs, IPv4 addresses, or weak passwords. In contrast, it would be difficult to crack long random user IDs, such as UUID version 4 identifiers created from a cryptographically secure RNG (CSPRNG). Even if the hashes can't be cracked, they are not anonymous – you can link them to the original user ID, after all. The GDPR only considers data anonymized if there are no “reasonably likely” means to re-identify the data subject. If this de-identification is reversible, it's called pseudonymization instead. If storage allows, a better technique to generate pseudonymous IDs is to create a table that maps the true ID to a CSPRNG-random ID. Unlike a hash, the random ID cannot leak extra information about the original ID. This pseudonymization technique could perhaps also be turned into irreversible anonymization by deleting the ID mapping, assuming that no “singling out” can happen. Pseudonymization is a very good security measure. It is explicitly mandated whenever appropriate in Art 32 GDPR. So you should probably use it. It's just that GDPR continues to fully apply to processing of the pseudonymized data. Since the pseudonymized data is the data subject's personal data, you may be required to delete it when receiving an Art 17 request for erasure. You may also be required to forward the request to others with whom you shared the data. However, the right to erasure has many conditions and exceptions. If you actually need to keep the data for a particular purpose, chances are good that you can keep it.
As far as I can tell, no appeals court has had to decide whether "the Transmission Control Protocol/Internet Protocol, or any predecessor or successor protocols to such protocol" includes UDP for the purposes of 16 CFR §312. I will argue that UDP is included. From King v. Burwell (internal citations removed): when deciding whether the language is plain, we must read the words in their context and with a view to their place in the overall statutory scheme. 16 CFR §312, in conjunction with 15 USC §6501-6505, implements the Children's Online Privacy Protection Act of 1998. The FTC is directed in 15 USC §6502(b) to promulgate regulations that (emphasis mine): require the operator of any website or online service directed to children [...] to provide notice of what information is collected [...] and to obtain verifiable parental consent The FTC drafted 16 CFR §312 to that end. To treat UDP as exempt would mean that the FTC has not fulfilled their duty under 15 USC §6502(b). So, given the context of the overall statutory scheme, it is reasonable to conclude that the FTC intended 16 CFR §312 to include UDP. However, even without the above line of reasoning, if the FTC were to attempt enforcement of 16 CFR §312 as if it included UDP, that interpretation would be controlling. The FTC would be afforded Auer deference by the court. They wrote the regulation; they know what it means. From Auer v. Robbins 519 U.S. 452 (1997): Because the salary basis test is a creature of the Secretary's own regulations, his interpretation of it is, under our jurisprudence, controlling unless plainly erroneous or inconsistent with the regulation. And from Bowles v. Seminole Rock &amp; Sand Co. 325 U.S. 410 (1945): Since this involves an interpretation of an administrative regulation, a court must necessarily look to the administrative construction of the regulation if the meaning of the words used is in doubt. The intention of Congress or the principles of the Constitution in some situations may be relevant in the first instance in choosing between various constructions. But the ultimate criterion is the administrative interpretation, which becomes of controlling weight unless it is plainly erroneous or inconsistent with the regulation. Again, given the context of the overall statutory scheme, such an interpretation of the regulation by the FTC wouldn't be plainly erroneous.
So I can block children under 13, but I can't tell them that? You can tell them after they fail, you cannot tell them on the asking screen. Then what is the correct way to block children under 13 to access my website and still comply with COPPA? I agree with you that it is odd that they recommend using a cookie but they do!* So you have a entry page with a simple question, "Please indicate your age" and then block based on the response. That's it. Note that the rule is neutral. This means that you do not need to disguise your purpose or try to trick people into entering their correct age. *I think that what is happening here is that any parent who wants to complain to their legislator can be met with the response, "If your kid is so sneaky that they are using different computers to lie about their age what do you want us to do about it?" The fact is, this scheme keeps innocent kids from seeing stuff they shouldn't; the sneaky ones are going to find a way.
Seems unlikely that it will "forestall copyright infringement suits". Some jurisdictions, e.g the USA, say that "Works produced by mechanical processes or random selection without any contribution by a human author are not registrable". On the face of it, in such a jurisdiction copyright can't exist in a randomly generated work. Which the TED talk doesn't mention. https://www.youtube.com/watch?v=sJtm0MoOgiU Let's imagine a case in a jurisdiction where copyright can exist in such a work. There is a dispute between two artists or labels. The plaintiff produced a well known tune and accuses the defendant of copying this work. The defendant says the plaintiff didn't have copyright in that work because it wasn't original in the first place, there is a 1200GB TAR file (compressed file) on GitHub that contains all possible single octave, 8-note, 12-beat melody combos, which were produced before the plaintiff's work. The plaintiff says, "like the majority of the population I never heard of GitHub, let alone downloaded, uncompressed a 1200GB file and listened to every melody." That's all aside from plaintiffs or lawyers deciding they have a case or believing the mere threat of civil proceedings will cause the alleged infringer to acquiesce to their demands. I think they are making a point about the law rather than a realistic means of thwarting copyright disputes. It's reasonable of the creators to say there is a finite set of melodies and the likelihood of inadvertently 'creating' the same melody as someone else may be smaller than we think, maybe copyright law has led to some unjust outcomes and led to a chilling effect on music-making.
It might be more helpful to reverse the analogy. Unprotected speech is a box, and everything that doesn't fit inside the box is free speech. The box is small and strangely shaped, and therefore, very few things will fit inside. The government has spent centuries trying to cram things into it, so we have a pretty good idea of what fits and what doesn't: Content-based restrictions on speech have been permitted, as a general matter, only when confined to the few historic and traditional categories of expression long familiar to the bar. Among these categories are: advocacy intended, and likely, to incite imminent lawless action, see Brandenburg v. Ohio, 395 U.S. 444 (1969); obscenity, see, e.g., Miller v. California, 413 U.S. 15 (1973); defamation, see, e.g., New York Times Co. v. Sullivan, 376 U.S. 254 (1964); Gertz v. Robert Welch, Inc., 418 U.S. 323 (1974); speech integral to criminal conduct, see, e.g., Giboney v. Empire Storage &amp; Ice Co., 336 U.S. 490 (1949); so-called “fighting words,” see Chaplinsky v. New Hampshire, 315 U.S. 568 (1942); child pornography, see New York v. Ferber, 458 U.S. 747 (1982); fraud, see Virginia Bd. of Pharmacy v. Virginia Citizens Consumer Council, Inc., 425 U.S. 748 (1976); true threats, see Watts v. United States, 394 U.S. 705 (1969); and speech presenting some grave and imminent threat the government has the power to prevent, see Near v. Minnesota ex rel. Olson, 283 U.S. 697 (1931), although a restriction under the last category is most difficult to sustain, see New York Times Co. v. United States, 403 U.S. 713 (1971). These categories have a historical foundation in the Court's free speech tradition. The vast realm of free speech and thought always protected in our tradition can still thrive, and even be furthered, by adherence to those categories and rules. United States v. Alvarez, 567 U.S. 709, 717–18 (2012). Although I don't know that I've ever seen the Supreme Court acknowledge it explicitly, one of the common threads you'll see in most of these categories is that First Amendment protection begins to weaken when words are spoken with some kind of ill intent and are likely to cause some kind of societal harm. So the Gillars case falls into the &quot;speech integral to criminal conduct&quot; category. She appealed her conviction on First Amendment grounds, but the D.C. Circuit affirmed. Although the First Amendment would protect someone who hated the American government and went on the radio to denounce the American government, it does not protect those who commit the act of treason, even if speech is their weapon: There is no question in our mind that words may be an integral part of the commission of the crime if the elements which constitute treason are present; that is, if there is adherence to and the giving of aid and comfort to the enemy by an overt act proved by two witnesses, with intention to betray, though the overt act be committed through speech. ... While the crime is not committed by mere expressions of opinion or criticism, words spoken as part of a program of propaganda warefare, in the course of employment by the enemy in its conduct of war against the United States, to which the accused owes allegiance, may be an integral part of the crime. There is evidence in this case of a course of conduct on behalf of the enemy in the prosecution of its war against the United States. The use of speech to this end, as the evidence permitted the jury to believe, made acts of words. The First Amendment does not protect one from accountability for words as such. Gillars v. United States, 182 F.2d 962, 971 (D.C. Cir. 1950). This is probably one of the least-developed exceptions to First Amendment protection, and therefore one of the hardest to understand. For a deep dive, I'd recommend Eugene Volokh, The &quot;Speech Integral to Criminal Conduct&quot; Exception, 101 Cornell L. Rev. 981 (2016).