Bypassing website&#39;s paywall by modifying HTTP request headers Recently I see some debates about bypassing paywalls by modifying browser's HTTP request as stated on ghack. Most paywalled websites allow users to read a certain number of free articles before blocking them outside of the paywall. They do it by saving a record in browser's cookies or by checking the request referrer to identify whether the user exceeds his / hers daily reading limit. There's some browser extensions that clears the browser cookies and modify the request referrer before user send out a HTTP request. By this way they can gain access to unlimited articles since it's harder for websites to identify them. Are making or spreading these kind of extensions illegal? How about the users that use the extension?
This is relatively uncharted legal territory, so until multiple cases establish some sort of precedent, we can only guess. I know of no legal requirement that a Browser or User has to submit cookies or referrer data or other meta-information accurately. In that regard, a user is unlikely to be prosecuted just for submitting HTTP headers. It is likely closely related to Free Speech issues. The DMCA spells out that it is illegal to circumvent copyright protection measures. While this law is typically used to make it illegal to copy DVDs, video-games or streaming movies, it is possible that the "3-free articles" policy could be interpreted as a copyright protection mechanism, and defeating it by changing HTTP headers is a circumvention. A good summary is here. A specific site's TOS (Terms of Service) probably contains language that spells out it is a violation to use the site in a manner other than as it is intended. This is a typical anti-hacking, anti-screen-scraping provision. Altering a browser session to circumvent their services is probably a violation of the license to access the site, and may open a user to a civil lawsuit for damages or even criminal hacking charges (the details of which are different state-to-state)
This would probably fall under the "legitimate interest" basis. However the service provider would need to show that the processing they did was aimed at this objective and in accordance with the data protection principles, particularly of data minimisation and storage. They should consider what data they want to extract from the detailed logs, whether the logs can be anonymised, how long they need to keep them, and whether they can achieve their objectives by storing aggregate data (e.g. percentage of people who clicked this link when viewing this page) rather than individual clicks and key presses. They should also consider whether the logs might reveal special category data (e.g. health, sexuality, religion, politics). This can happen if, for instance, the site contains information about a particular disease; people who read it are likely to have that disease or know someone who does.
I'm only going to consider US perspectives, which may or may not answer your question entirely. Also, I'm not going to address the guesses in other answers because, and except to say, they don't appear to be based in law, but rather (mis)understandings of law. 17 U.S. Code § 512 provides protections for service providers when providing content, online. This expressly includes caching. In Viacom Int'l, Inc. v. YouTube, Inc., 676 F.3d 19 (2d Cir. N.Y. 2012) at 39, the Court held that to exclude these functions from the safe harbor would remove protections for service providers under subsection (c). The answer, however, lies in Perfect 10 v. Google, Inc., 416 F. Supp. 2d 828 (C.D. Cal. 2006), in footnote 17, at 852: Local caching by the browsers of individual users is noncommercial, transformative, and no more than necessary to achieve the objectives of decreasing network latency and minimizing unnecessary bandwidth usage (essential to the internet). It has a minimal impact on the potential market for the original work, especially given that most users would not be able to find their own local browser cache, let alone locate a specific cached copy of a particular image. That local browser caching is fair use is supported by a recent decision holding that Google's Click for Enhanced Coverage Linking Searches own cache constitutes fair use. The case referred to is Field v. Google, Inc, 412 F.Supp. 2d 1106 (D. Nev. 2006). Although the Perfect 10 v. Google, Inc. was overturned on appeal - Google was permitted to utilise thumbnails in their search pages - and the above is merely obiter, it is the closest to a ruling on browser caching I have been able to find. In short: Google's caching has been found to be fair use. It is unlikely that your local cache would not, as it is generally done automatically.
I'm not sure it makes sense to talk about having "jurisdiction" over an IP address, for the purposes you're discussing. If you wanted to sue the IP address itself--something that is possible under limited circumstances--then you might need to locate it for jurisdictional purposes. But I don't think that's what you're talking about. You're talking about taking civil or criminal action against the people who are using the IP address to commit crimes. What matters, in that case, is not a theoretical legal question about the location of an IP address. It's questions like: where do these people live? Where do the people downloading the illegal content live? Where are the physical servers located? ("In the cloud" is not an answer--there are physical servers somewhere making up that cloud). For jurisdictional purposes, the chair they're sitting in when they upload the illegal data, and the location of the AC power outlet the physical server is plugged into, are as important as, if not more important than, the metaphysical "location" of the IP address of the server.
According to the current version of the TOS: You own the rights to the content you create and post on Medium. By posting content to Medium, you give us a nonexclusive license to publish it on Medium Services, including anything reasonably related to publishing it (like storing, displaying, reformatting, and distributing it). In consideration for Medium granting you access to and use of the Services, you agree that Medium may enable advertising on the Services, including in connection with the display of your content or other information. We may also use your content to promote Medium, including its products and content. We will never sell your content to third parties without your explicit permission. This explicitly says you own your content, although Medium has some rights to do some things. And they won't sell it without permission, so unless Medium itself is publishing this book, it would seem to be copyright infringement. (Of course, I don't know what the TOS said when you originally wrote the article.) If what was copied was not copyrightable (like a quote from the Constitution, or a simple uncreative graph of something obvious) then it wouldn't be infringement. But your article was probably more than that.
Content posted to the web is usually openly accessible to all (unless protected by a password, paywall, or similar restriction). But that does not mean it is freely copyable by all. Such content is protected by copyright in just the same way as if it had been published in a book of essays by various contributors. Unless the copyright holders (who are likely to be the original authors, but might not be) give permission, or an exception to copyright applies, copying such content would be clear and obvious copyright infringement, and any copyright holder could sue for damages. Permission could be given by publishing the content under a permissive license, such as a CC-BY-SA license, or any of many other available permissive licenses. Or a would-be reuser could find the copyright holders and ask for permission. If the holder cannot be found or identified, or does not respond, then no permission has been granted. In the US the main exception to copyright is fair use. See this answer and other threads with the fair-use tag here for more on fair use. Since the question seems to contemplate using the whole of the posted content, since it might well damage any potential market for that content, and since the use does not seem to be &quot;transformative&quot;, nor used for criticism or comment, a finding of fair use for this situation seems unlikely. But Fair use findings are very much fact-driven, and the exact facts do matter. Thus I cannot be at all sure whether a court would find this toi be fair use or not. In other countries there are a variety of exceptions to copyright, and I have not come close to reviewing them all. But none of the ones I know of seem to apply to the situation described in the question. Many are narrower than the US concept of fair use. I fear that without permission, copying this content would be infringement. However, it would not be infringement to create a site that includes a link to the existing content, and a summary or description of that content, along with new content, including comments on the old, with brief quotes to indicate what is being commented on.
It is legal, and good policy, because the later explanation could create conflicting policies and notions as to what the &quot;agreement&quot; is. The TOS is probably created by a lawyer who interviewed the website owner to figure out what they wanted, then wrote legal language to do that. If you ask tech support how to interpret the TOS, you probably are not getting a legally-correct statement (assuming that the tech support guy isn't also a lawyer). Rather than take a risk that a customer would defend their action in court by arguing &quot;they said I could!&quot;, the website may elect to not make promises that they don't want to keep. Instead, if you want to understand the agreement, you hire your own lawyer, then propose a hypothetical action, to see how the law interprets the language of the agreement. For example &quot;can I rent out my Netflix password so that other people can use it?&quot;. The lawyer would then read the TOS and relevant cases law, and would advise you whether this is allowed under the TOS (it is not). Alternatively, you could read up on relevant aspects of the law and figure it out yourself. Website TOS is basically driven by copyright law, the technical necessity of some kind of automatic copying in order to use a web page, and the legal requirement that you can't copy without permission of the copyright holder. The TOS is the set of conditions that you must satisfy in order to be permitted to use the site. So many questions reduce to issues of copyright law and permission to copy *can you legally &quot;permit&quot; the copying of materials you upload?).
Criminal liability is triggered by guilty knowledge. The people who run OnlyFans may know in general terms that it is probable that some illegal images exist on their servers, but so does everyone who allows the public to upload stuff. If that was illegal then the senior management of Google and Facebook would be liable to arrest on the same grounds and the Internet as we know it could not exist. Once the company becomes aware of a specific file that contains such material they need to remove it. If they fail to do so then they become liable. OnlyFans has been doing this: [OnlyFans] provides templates for each successive warning - explaining why material has been removed, and that failure to comply with terms of service may result in the closure of the account. [emphasis added] The site operators also become liable if they have a general policy of tolerating illegal material. This is a grey area; a prosecution would have to prove that the toleration was an active policy rather than merely ineffective moderation. There doesn't seem to be any evidence to support such a claim. Permitting an account to continue after deleting an offending file is not toleration of the offending file. The BBC report does not allege that the OnlyFans policy of multiple warnings has been applied to cases of underage content; rather it talks about cases of incest, bestiality and exploitation of vulnerable adults (such as homeless people), and only where the accounts were particularly popular. The linked articles do report cases where accounts have been set up advertising content by minors, but they were shut down as soon as the company was notified of them. The second article also quotes its source as saying that lots of such accounts get closed down all the time; there doesn't seem to be any evidence of toleration of that material specifically. So in conclusion it seems from the available evidence that OnlyFans have been complying with the law. It is telling that the BBC article specifically does not say that they have done anything illegal. If the BBC had found unambiguous evidence of illegal conduct by OnlyFans management then they would certainly have highlighted this.