Repercussions of defying the Cookie Law I was wondering what case law is out there on the subject, or, if there is not much, what real repercussions can website owners who defy the Cookie Law expect? Say Bob is not only pissed off by the ostensible (as he thinks) necessity to implement the cookie accept buttons, but, instead of doing that, he is ballsy enough to write this sort of fine print on his website: We will set whatever cookies we want and we won't ever ask your permission. We don't care what you think the law about it is. Take it or leave it (or sue us). How soon would events occur which will make Bob change his mind and give in? What sort of events? I would expect that the likely repercussions would pretty much depend on two factors: Jurisdiction (perhaps the most severe ones would occur in the EU) Popularity of the website (perhaps blog / small forum owners don't need to worry as much as big social network owners) As I think case law on the subject would still be rather scarce, I leave this question jurisdiction-open (please tag your answer accordingly).
european-union (germany, spain, uk) The cookie consent law is the ePrivacy directive, which was implemented as national laws by all EU member states (including, at the time, the UK). Later, GDPR changed the applicable definition of consent so that implicit consent is no longer allowed. A notice in fine print as in the given example is not sufficient to meet this definition of consent, so any non-necessary cookies set in that context would be a violation. But it would be the national ePrivacy implementation that would be violated, not the GDPR. Thus, the GDPR's famous 4%/EUR 20M fines are not relevant here. Instead, each country can set its own fines. In Germany, this would probably be up to EUR 50k (§16 TMG) though German law doesn't implement this aspect of ePrivacy correctly. In the UK, PECR penalties are determined by more general data protection penalty legislation. Notable instances of cookie consent enforcement include the Planet 49 (ECJ judgement, German BGH verdict) case which basically affirmed that yes, the GDPR's definition of consent applies. Thus, any case law regarding GDPR consent is also applicable to the issue of cookies. Furthermore, the Spanish AEPD has issued an interesting fine due to insufficient cookie consent, but due to much more subtle violations than the outright disregard in the given example. E.g. in the Vueling action (decision (Spanish, PDF), summary, listing on enforcementtracker), the Vueling airline's website had a consent banner but ultimately told the user to reject cookies via their browser settings. This violates the requirement that consent must be specific/granular, since the browser settings are all-or-nothing if they're available at all. The airline was fined EUR 30k, the maximum possible under applicable Spanish data protection law. But what kind of risks would some blog run into that just sets cookies without appropriate consent? If the service is outside of the EU, enforcement is difficult. I am not aware of cookie consent enforcement against non-EU services. National data protection authorities can investigate the violation and issue fines, subject to their respective national data protection laws. They generally only do this when there are lots of complaints. Some authorities like the UK ICO have indicated that cookie consent enforcement isn't a priority for them. Independently, individuals can generally sue the service for damages. Some lawyers might send out cease and desist letters to non-compliant websites in the hopes of collecting fees. So aside from the last point, the risk is likely somewhat low, especially for a smaller site. At this point, it is worth reminding that ePrivacy/GDPR doesn't require consent for all cookies, and is not just limited to cookies. It is more generally about access to and storage of information on a user's device, unless that access is strictly necessary to provide the service explicitly requested by the user. Thus, functional cookies can be set without consent. However, consent does become necessary when cookies or similar mechanisms are used for analytics, tracking, or ads. Even though GDPR is involved, the cookie consent requirements apply regardless of whether the cookies involve any personal data.
IANAL. (1) GDPR is certainly relevant. (2) This is certainly "personal data" under the definition in GDPR article 4. (3) Maintaining this data is probably lawful under article 6 sections 1(a) (consent) - provided that the Terms and Conditions of the site make clear that the user by signing up is consenting to this information being held (3) There is certainly an obligation under article 14 to disclose that the information exists, and to say how it used. (4) Article 15 says that data subjects are entitled to see the information and know what recipients or categories of recipient have access to the information (I don't know whether it's enough to just say "moderators", or whether the moderators need to be identified). (5) I can't see any reasons why the obligations under articles 16, 17, and 18 regarding rectification, erasure, and restriction of processing aren't relevant. This is exactly the kind of situation that GDPR is designed to address. If you're restricting the service available to particular users based on a record of their behaviour or on judgements made by moderators, then they absolutely have a right to know, and a right of redress.
We cannot and will not try to answer &quot;what should i do?&quot; questions here. Nothing in the linked page makes me think that the views expressed in the previous question here are any less correct. They certainly have not changed the law on copyright. The linked page is an open forum. Many of the posts o9n that thread express ill-informed and incorrect views of how copyright works, and what it protects. Several google searchs find no trace of the suit described in the thread. Note that in US law no copyright claim may be heard in a small claims court, except for the federal copyright office's small claims tribunal. I am not sure if the same is true in Canada, but it might be that the suit was simply dismissed on such a basis. In any case small claims cases do not establish legal precedents in Canada or the US. Of course it is true that anyone can sue over almost anything, even when there is no valid legal basis for the suit. If the suit had been won by the claimant, or even settled that would be larger grounds for worry. A person seriously worried over publishing a book such as that described in the question might do well to consult a lawyer with relevant expertise. A single consultation plus an opinion letter might not cost very much. But 17 USC 102 (b) is very clear that copyright never protects facts, as are the copyright laws of other countries. Note that reports of the events of sports matches are not protected by copyright, although expressive language and analysis may be. 17 USC 102 (b) reads: (b) In no case does copyright protection for an original work of authorship extend to any idea, procedure, process, system, method of operation, concept, principle, or discovery, regardless of the form in which it is described, explained, illustrated, or embodied in such work. Article 2 paragraph (8) of the Berne Copyright Convention provides that: (8) The protection of this Convention shall not apply to news of the day or to miscellaneous facts having the character of mere items of press information. There seems little room for copyright protection of the moves of chess games.
In the US the first amendment protections given to free expression make defamation claims significantly harder to pursue than in some other countries. o-called 'product defamation&quot; claims are generally harder yet. In the case of Dominion Voting Systems some of those sued seem to have made fairly specific allegations, which, if true, would involve probably criminal wrong doing. And please note that none of those suits have yet had a trial on the merits, to the best of my knowledge. We don't know if the statements complained of will be held to be defamatory or protected. Claims that a vaccine is not as safe as it should be, or the regulators were too quick to approve it, are harder to frame as defamatory of the drug companies. Since the government contracted in advance for enough vaccine to give a dose to everyone in the US (as I understand it) damages would be hard to prove. And there would be a risk of a PR backlash. It is not as if any of these companies has tried to file a suit and had it dismissed. They have not chosen to file, for which there could be many reasons.
Is it illegal to ask a company for money in exchange for information on a bug in their software/website? That in itself is legal. Indeed, the company would incur unjust enrichment if it coerced you to disclose your discovery for free. Only if you threatened the company to divulge to others your discovery unless the company pays you, it would be illegal and trigger charges such as extortion (likewise, legislations outlaw the unjustified delivery of programs or instructions for hacking a software/network/etc., although this goes beyond your actual question). Can the company take legal action against me? That seems doubtful, futile, and it could backfire (please note I have not done any research on legal precedents about this). Although the terms and conditions of the website or the End User License Agreement (EULA) of software might prohibit you to reverse engineer (RE)/decompile/etc. the application, anti-RE clauses are unenforceable and the remedies therefor are indeterminate because the sole act of conducting reverse engineering does not subject the company (or third parties) to any losses. The company's decision to take legal action for your discovery could backfire from two standpoints. First, it calls attention to the fact that the software at issue is defective and unsafe. And second, the bug is likely to be detected by someone else anyway, thereby potentially compromising customers' systems.
In the UK, the Disability Discrimination Act 1995 includes provisions which are thought to apply to websites, although as far as I know there is no case law on the matter. If a website's use of JavaScript makes it inaccessible to users with some disability, it may fall foul of the DDA. However, there is no law specifically requiring JavaScript-free versions of web pages.
Yes. Art 13 requires you to provide “the identity and the contact details of the controller”. You are the data controller. Your name and address are necessary to establish your identity. Using AdSense means you're offering an internet society service commercially. In that case, there's also probably some EU fair competition directive that was implemented in your countries national law and will provide equivalent requirements. For example, my country Germany has a far-reaching Impressumspflicht. Not sure if this is the most relevant EU law, but Art 22 of Directive 2006/123 requires that your country passed laws to ensure that you make available “the name of the provider, his legal status and form, the geographic address at which he is established and details enabling him to be contacted rapidly and communicated with directly and, as the case may be, by electronic means”. I think you would be in scope of this directive since you're acting commercially. This legally mandated self-doxxing is unfortunate for private bloggers, but it's also essential for making it possible to enforce data subject rights: if you were to violate someone's privacy rights, how could they sue you if they don't know where to serve you with a lawsuit? However, all things are a balancing act. These requirements are not intended to limit freedom of expression. If you're just trying to communicate something to the public without jeopardizing your anonymity, then paradoxically social media services can be more attractive.
Sure, you can make such a request, but its not likely to help you. Scammers are criminals and don't generally care about GDPR compliance. Scammers are criminals, and won't just publish their real world identity. Serving them with a lawsuit will be difficult, especially if they are from outside the EU. GDPR lets you sue data controllers, but it's not worth it. You can sue for compliance (e.g. to compel fulfillment of your access request), and you can sue for damages stemming from GDPR violations. Compared to the damages you have suffered, a lawsuit is very expensive.