7 ms·

Legal compliance is probably the worst part of building a side project. For example for basic levels of protection, you at least want a terms of service and pr

by zawerf 8y ago

Legal compliance is probably the worst part of building a side project. For example for basic levels of protection, you at least want a terms of service and privacy policy on your site. You'd think it's just copying and pasting some boilerplate. But say you want to allow user uploads, then you also need to not get screwed if someone uploads a picture owned by some copyright troll. So then you have to figure out how to get DMCA safe harbor status so you're not responsible for user content. And that requires: registering at a copyright office, monitoring email for timely takedowns, and communicating counter notices, etc. All of this work and we haven't gotten to GDPR compliance yet! At one point you just go fuck it, it's a side project. Just wrap it in a LLC so it can't bankrupt you even if you do get sued. But now you have to deal with company formation laws which is yet another can of worms.

dudul 8y ago
I've never had a serious side-project, but what you describe in your comment has always been my main concern. I remember asking a while ago on HN if it was a good idea to incorporate asap when building a side project to make sure you are protected, and most answers were "nah f-it, just build your thing and don't worry about it". Wasn't convinced.
Tomte 8y ago
The legal stuff is the difference between playing around and being serious. Unfortunately, the Internet has made it easy to harm and fuck over people far outside your circle of friends and acquaintances, so playing around isn't a viable option anymore.
skummetmaelk 8y ago
This is a consequence of enforcing the letter of the law rather than the spirit of the law. Bad actors keep finding loopholes to exploit and politicians fix them with patchwork resulting in overly complex monstrosities of legalese with a million little exceptions. Of course this just adds to the loophole problem. The only way to reliably fix this is to institute some form of judgment of whether or not an actor was following the spirit of the law. If they weren't they should have any advantages gained by skirting the law removed by force. Of course this leads to a different set of problems with the potential for overreaching state actors. One way to combat this could be making the judicial branch much more independent than it usually is in most countries.
- sandworm101 8y ago
  "Spirit of the law" is a myth. It is something invented by non-lawyers when they want to gloss over something, normally when they dislike how a law is written. Calling for people to comply with "spirit" is simply a call for some arbitor to enforce thier interpretation, thier opinion on spirit. We have judges for that already. Spirit is a dogwhistle for non-lawyers to be involved ... but we have that too. Non-lawyers, elected officials, write and pass the laws. Blame them.
  - Bjartr 8y ago
    IIRC, in Europe it's harder for companies to exploit letter-of-the-law loopholes than in the US. So I think you do have a point, but there's more nuance in practice.
    - sandworm101 8y ago
      The US obsession with loopholes and "letter of the law" is a historical religious thing. US is protestant, where the language of the bible is made availible to all. Everyone is free to read and invent an interpretation, to find thier own loopholes. Europe follows a more catholic tradition, where biblical language is interpreted through priests. Hence, european judges (legal priests) are given more authority to interpret language and smooth out rough edges. It is centuries-old culture.
      - twic 8y ago
        Ah yes, Martin Luther, that famous American. Who can forget when he inspired President Henry VIII to break with the Catholic church!
      - ben_w 8y ago
        The distinction I’ve heard is called Roman law (continental) versus common law (UK, its colonies and empire).
        deleted 8y ago
buu700 8y ago
At one point you just go fuck it, it's a side project. Just wrap it in a LLC so it can't bankrupt you even if you do get sued. From experience: this is dangerous and completely wrong advice. The corporate veil can be pierced if the LLC is determined to be an "alter ego" of the individual, which isn't a difficult argument for a one-person side project.
- pc86 8y ago
  That's the point they're making. "Fuck it, it's a side project" acknowledges that it's not the right move, but that it's too onerous to do things the way they should be done. So you risk it and hope you have the time and money to fix it later before it becomes an issue.
  - buu700 8y ago
    I get the point, but I wouldn't want anyone reading that and taking the conclusion seriously. Forming an LLC in that case is pretty much a waste of time and money that offers a false sense of security.
    - mbesto 8y ago
      > Forming an LLC in that case is pretty much a waste of time and money that offers a false sense of security. Pro tip to people reading this, don't take generic advice about something that might have financial/legal implications...consult a lawyer/accountant.
      - buu700 8y ago
        Definitely retain counsel no matter what for anything important. I'm just saying I'd be surprised if there were a situation in which a lawyer would advise that registering an LLC is reasonable protection from all legal repercussions of your solo side project.
        mcbits 8y ago
ovi256 8y ago
There is no GDPR compliance requirement for personal, non-commercial, side-projects. You can gather PPI on all the people in the world and use it on your own for non-commercial purposes and GDPR has nothing to say about that.
- WA 8y ago
  I think this is completely false. Do you have a source for that?
  - ovi256 8y ago
    https://gdpr-info.eu/recitals/no-18/ https://gdpr-info.eu/recitals/no-18/
    - deleted 8y ago
      [deleted]
    - pbhjpbhj 8y ago
      That doesn't say what you claimed at all, not by the longest stretch of the imagination.
    - fierarul 8y ago
      I think a side-project would classify as 'in connection with a professional activity'. This recital basically covers your personal rolodex.
- pc86 8y ago
  But if you're creating a personal side-project for commercial ends you still need GDPR compliance, right?
  - ska 8y ago
    Yes, and "commercial" is a pretty low bar here.
- groestl 8y ago
WA 8y ago
On the other hand: the tech industry is/was mostly entirely unregulated so far. For a long time, you could do whatever you wanted. Which other industry is as unregulated as software? For example, you could make an app that collects arbitrary amounts of personal data. You could "promise" your users whatever you wanted, especially in the health and fitness space.
dvfjsdhgfv 8y ago
> Just wrap it in a LLC so it can't bankrupt you There are many ways it can.
makewavesnotwar 8y ago
I think a big issue you're nodding to is localized definitions. For instance, why must you legally have a privacy policy? Because of a law in California. What does that privacy policy entail? ¯\_(ツ)_/¯ You can write a privacy policy that say you are going to go out of your way to make any private information given to you as public as you can or sell it all to the king of Saudi-Arabia and if nobody reads that privacy policy then it's kind of meaningless. And very few people read the privacy policy. People seem to think, well this is popular... so they can't be doing anything bad or someone would stop them. And with internet properties, that's simply not the case. There's no implicit privacy or federal/global definition of what privacy rights people should have, if anything the rights are diminished the higher up the ladder you get. So people have to navigate a sea of differing definitions in massive legal documents which they aren't properly trained to do unless they already hold a law degree.

by zawerf 8y ago

dudul 8y ago

I've never had a serious side-project, but what you describe in your comment has always been my main concern. I remember asking a while ago on HN if it was a good idea to incorporate asap when building a side project to make sure you are protected, and most answers were "nah f-it, just build your thing and don't worry about it". Wasn't convinced.

Tomte 8y ago

The legal stuff is the difference between playing around and being serious. Unfortunately, the Internet has made it easy to harm and fuck over people far outside your circle of friends and acquaintances, so playing around isn't a viable option anymore.

skummetmaelk 8y ago

This is a consequence of enforcing the letter of the law rather than the spirit of the law. Bad actors keep finding loopholes to exploit and politicians fix them with patchwork resulting in overly complex monstrosities of legalese with a million little exceptions. Of course this just adds to the loophole problem. The only way to reliably fix this is to institute some form of judgment of whether or not an actor was following the spirit of the law. If they weren't they should have any advantages gained by skirting the law removed by force. Of course this leads to a different set of problems with the potential for overreaching state actors. One way to combat this could be making the judicial branch much more independent than it usually is in most countries.

sandworm101 8y ago
"Spirit of the law" is a myth. It is something invented by non-lawyers when they want to gloss over something, normally when they dislike how a law is written. Calling for people to comply with "spirit" is simply a call for some arbitor to enforce thier interpretation, thier opinion on spirit. We have judges for that already. Spirit is a dogwhistle for non-lawyers to be involved ... but we have that too. Non-lawyers, elected officials, write and pass the laws. Blame them.
- Bjartr 8y ago
  IIRC, in Europe it's harder for companies to exploit letter-of-the-law loopholes than in the US. So I think you do have a point, but there's more nuance in practice.
  - sandworm101 8y ago
    The US obsession with loopholes and "letter of the law" is a historical religious thing. US is protestant, where the language of the bible is made availible to all. Everyone is free to read and invent an interpretation, to find thier own loopholes. Europe follows a more catholic tradition, where biblical language is interpreted through priests. Hence, european judges (legal priests) are given more authority to interpret language and smooth out rough edges. It is centuries-old culture.
    - twic 8y ago
      Ah yes, Martin Luther, that famous American. Who can forget when he inspired President Henry VIII to break with the Catholic church!
    - ben_w 8y ago
      The distinction I’ve heard is called Roman law (continental) versus common law (UK, its colonies and empire).
      - deleted 8y ago

buu700 8y ago

At one point you just go fuck it, it's a side project. Just wrap it in a LLC so it can't bankrupt you even if you do get sued. From experience: this is dangerous and completely wrong advice. The corporate veil can be pierced if the LLC is determined to be an "alter ego" of the individual, which isn't a difficult argument for a one-person side project.

pc86 8y ago
That's the point they're making. "Fuck it, it's a side project" acknowledges that it's not the right move, but that it's too onerous to do things the way they should be done. So you risk it and hope you have the time and money to fix it later before it becomes an issue.
- buu700 8y ago
  I get the point, but I wouldn't want anyone reading that and taking the conclusion seriously. Forming an LLC in that case is pretty much a waste of time and money that offers a false sense of security.
  - mbesto 8y ago
    > Forming an LLC in that case is pretty much a waste of time and money that offers a false sense of security. Pro tip to people reading this, don't take generic advice about something that might have financial/legal implications...consult a lawyer/accountant.
    - buu700 8y ago
      Definitely retain counsel no matter what for anything important. I'm just saying I'd be surprised if there were a situation in which a lawyer would advise that registering an LLC is reasonable protection from all legal repercussions of your solo side project.
      - mcbits 8y ago

ovi256 8y ago

There is no GDPR compliance requirement for personal, non-commercial, side-projects. You can gather PPI on all the people in the world and use it on your own for non-commercial purposes and GDPR has nothing to say about that.

WA 8y ago
I think this is completely false. Do you have a source for that?
- ovi256 8y ago
  https://gdpr-info.eu/recitals/no-18/ https://gdpr-info.eu/recitals/no-18/
  - deleted 8y ago
    [deleted]
  - pbhjpbhj 8y ago
    That doesn't say what you claimed at all, not by the longest stretch of the imagination.
  - fierarul 8y ago
    I think a side-project would classify as 'in connection with a professional activity'. This recital basically covers your personal rolodex.
pc86 8y ago
But if you're creating a personal side-project for commercial ends you still need GDPR compliance, right?
- ska 8y ago
  Yes, and "commercial" is a pretty low bar here.
groestl 8y ago

WA 8y ago

On the other hand: the tech industry is/was mostly entirely unregulated so far. For a long time, you could do whatever you wanted. Which other industry is as unregulated as software? For example, you could make an app that collects arbitrary amounts of personal data. You could "promise" your users whatever you wanted, especially in the health and fitness space.

dvfjsdhgfv 8y ago

> Just wrap it in a LLC so it can't bankrupt you There are many ways it can.

makewavesnotwar 8y ago

I think a big issue you're nodding to is localized definitions. For instance, why must you legally have a privacy policy? Because of a law in California. What does that privacy policy entail? ¯\_(ツ)_/¯ You can write a privacy policy that say you are going to go out of your way to make any private information given to you as public as you can or sell it all to the king of Saudi-Arabia and if nobody reads that privacy policy then it's kind of meaningless. And very few people read the privacy policy. People seem to think, well this is popular... so they can't be doing anything bad or someone would stop them. And with internet properties, that's simply not the case. There's no implicit privacy or federal/global definition of what privacy rights people should have, if anything the rights are diminished the higher up the ladder you get. So people have to navigate a sea of differing definitions in massive legal documents which they aren't properly trained to do unless they already hold a law degree.