User-provided content can be subject to all kinds of legal constraints. It's a big world and hundreds of jurisdictions may feel competent to regulate the content of a web page that can be accessed from that jurisdiction. For example, in country A, it's illegal to claim that the Holocaust didn't take place. In country B, professing belief in a certain religion is considered blasphemy against country B's religion, while country B' considers professing disbelief in said religion to be blasphemy. Meanwhile, in country C, you can be fined for describing how to jailbreak a smartphone.

As an administrator of user-provided content, what do I need to know about laws around the world? Consider that even if I am not subject to a country's laws, I might want to travel there some day and therefore don't want to accrue fines or jail sentences. I can't afford a lawyer, let alone who's knowledgeable in every country's laws.

What precautions do I need to take to have a reasonable chance of remaining unscathed when hosting and moderating user-provided content?


This answer is United States centric. I attempted to dive into this with the intent to hit major pieces of legislation around the world, but quickly got overwhelmed with a single country.

  • The Digital Millennium Copyright Act (DMCA); pass in 1998. As the title of the act states, this law covers the use of copyrighted material, how to have copyrighted material removed, and who is responsible when this material is discovered. This is the law that establishes "safe harbor" for websites even if their users infringe on a copyright, provided you meet certain requirements. Section 512 establishes the criteria for safe harbor. Chilling Effects provides a brief summary

    In addition to informing its customers of its policies (discussed above), a service provider must follow the proper notice and takedown procedures (discussed above) and also meet several other requirements in order to qualify for exemption under the safe harbor provisions.

    In order to facilitate the notification process in cases of infringement, ISPs which allow users to store information on their networks, such as a web hosting service, must designate an agent that will receive the notices from copyright owners that its network contains material which infringes their intellectual property rights. The service provider must then notify the Copyright Office of the agent's name and address and make that information publicly > available on its web site. [512(c)(2)]

    Finally, the service provider must not have knowledge that the material or activity is infringing or of the fact that the infringing material exists on its network. [512(c)(1)(A)], [512(d)(1)(A)]. If it does discover such material before being contacted by the copyright owners, it is instructed to remove, or
    disable access to, the material itself. [512(c)(1)(A)(iii)], [512(d)(1)(C)]. The service provider must not gain any financial benefit that is attributable to the infringing material. [512(c)(1)(B)], [512(d)(2)].

    The downside of the DMCA law is the take down notices. If one is received, in order to qualify for safe harbor protections about, the content must be removed for a specific period of time, regardless of the validity of the claim. The content can be restored if a counter claim is filed. After this, the courts must be involved to determine the validity of the claims.

  • The Electronic Communications Privacy Act of 1986 (ECPA); This extended to prohibition of wiretap laws to computers, protecting against unreasonable searches. On the downside, this was written before there was a public internet and is outdated. For example, ECPA mandates that online communications or files that are one a third-party's servers for more than 180 days is “abandoned.” That means all of your old messages on Gmail, or your files on Dropbox, fall into this category. A simple subpoena (as opposed to a search warrant) is all that is needed for these old messages.

  • Section 230 of the Communications Decency Act (CDA); A mid-ninties law that had many parts struck down by the Supreme Court on First Amendment grounds. One part that did survive though, was Section 230. This portion of the law removes liability of websites for things said by their users. This means that if someone libels you ("Gilles is a car thief"), the web site owner can not be sued, only the person who posted the comment.

As the owner, though, you are likely to receive subpoenas, should such a suit occur. This is especially true if a user can't be uniquely identified by the aggrieved party. The subpoena will ask for identifying information (eg. what you collected at registration, IP addresses, etc) which can then be used to either identify the user or issue more subpoenas (such as to the owner of the IP to find who was assigned the address at the time of the post).

  • The Patriot Act; Passed in October 2001 and is a gigantic piece of legislation. Three important parts of this law for web site owners exist though.

    • National Security Letters
    • Pen Registers
    • Trap and Trace orders

    The NSL is used by the government to gather information about a suspects communications via a third party (ie you, as the web site owner). Often these include a gag order, meaning you can't talk to anyone about receiving such a letter. The pen register and trap and trace orders are used to gather meta data about a suspect's communications. Since the actual contents of the communication aren't gathered a warrant is not required.

Unfortunately, the most recent information I could find about countries around the world, without diving into each country individually is over a decade old. It was compiled by Electronic Frontiers Australia in 2002 and covers internet law and policy for 16 countries (ok, 15 plus the "European Union").

Not the answer you're looking for? Browse other questions tagged or ask your own question.