8 ms·

Embedded social media posts might now be illegal

116 points by kixiQu 5y ago

1MachineElf 5y ago
I appreciate the design of this blog.
- dafoex 5y ago
  I do too. I know that's not what this post is about, but its refreshing to see someone not on the minimalist bandwagon.
MattGaiser 5y ago
Would any court let a company deliberately provide something for free and then later let them sue you for using it?
- mdasen 5y ago
  It wouldn't be Instagram suing you. It would be the owner of the photo that uploaded it to Instagram. By uploading it to Instagram, they're granting Instagram a license, but they aren't granting you a license. People can still claim copyright over the images they've uploaded to Instagram. Instagram has the right to sublicense content that has been uploaded, but they've explicitly said that they aren't doing that.
  - Nextgrid 5y ago
    It can be argued that by uploading the photo to a public website they have granted everyone a license to instruct computers to display that photo (that's literally what embeds do)? Also, since Instagram has an embed feature, surely they have something in their ToS that ask the user to grant a license to Instagram to display the content not just on the main website but on any website that embeds the Instagram-hosted content?
- cxr 5y ago
  Your intuition about fairness matches a principle recognized by courts. The term for the applicable legal doctrine here is "estoppel". There's a strong argument to be made that if Instagram didn't make its (fairly unorthodox) position on embeds clear beforehand, then Newsweek's original use was reasonable and non-infringing (but not something that it can rely on indefinitely, esp. after Newsweek was notified that it did not have permission). There's another argument to be made, though, that the absence of an explicit prohibition is not necessary, due to copyright being an automatic negative right—that the burden is on Newsweek to obtain a clear license, not on anyone else to do any work explaining to Newsweek that it can't use it. This is a strong, argument, too, but probably weaker than the argument from estoppel.
nso 5y ago
As long as the internet is global, but laws governing it are made locally, will not this and similar issues get increasingly messy until we are left with a effed if you do effed if you don't? Could these laws that are increasingly unfriendly to the cooperation that the internet enables slow down innovation and make it too risky to invest in many kind of online services? Is it realistic to think that one day in the near future we will get some kind of global law governing these things, and if not what other options are there to resolve these issues?
- lbotos 5y ago
  GDPR sets a reasonable precedent (in the sense of what to expect, and it's a good thing for users, but also in this context, adds complexity for businesses.) "The GDPR applies to companies outside the EU because it is extra-territorial in scope. Specifically, the law is designed not so much to regulate businesses as it is to protect the data subjects’ rights. A “data subject” is any person in the EU, including citizens, residents, and even, perhaps, visitors. What this means in practice is that if you collect any personal data of people in the EU, you are required to comply with the GDPR. The data could be in the form of email addresses in a marketing list or the IP addresses of those who visit your website. (See our article explaining what is considered personal data under the GDPR.) You may be wondering how the European Union will enforce a law in territory it does not control. The fact is, foreign governments help other countries enforce their laws through mutual assistance treaties and other mechanisms all the time. GDPR Article 50 addresses this question directly. So far, the EU’s reach has not been tested, but no doubt data protection authorities are exploring their options on a case-by-case basis." - https://gdpr.eu/compliance-checklist-us-companies/ https://gdpr.eu/compliance-checklist-us-companies/
  - bserge 5y ago
    An email address is PID? My PoV is that an email address + first name in a mailing list should not be covered under GDPR. William (billy69420@cbt.eu) does not identify anyone, does it?
    - gjs278 5y ago
usr1106 5y ago
In Germany it has been illegal for years to embed anything from social media. "Share on..." buttons like tweets or pics. Not because of licensing, but because it will lead to the social media platform tracking the user without consent. Even users that have no account on that social media and never given consent to anything. Compliant sites show some placeholder in gray typically with appropriate warnings. If the reader wants to reveal the element they need to click first. Disclaimer: Not a web developer, not living in Germany, but German as a mother tongue.
- remus 5y ago
  That's interesting...do you know if there's any distinction made between social media embeds and just linking to external resources? I guess you could make a similar tracking argument for images linked from an external site (for example).
  - usr1106 5y ago
    There is no difference between social media or not. You are not allowed to track without explicit consent.
- giansegato 5y ago
  This is not entirely true (disclaimer: living in Germany, with a German-based business). You can embed social media. What you can't do is embed a social media post without disclosing in the cookie notice (that must be approved beforehand) what will happen to the user due to you doing it.
  - the_gipsy 5y ago
    But isn’t the embedded element already setting cookies before the user can reject the cookie notice?
    - lawik 5y ago
      Only if you render the embed before the user accepts which is under the control of the developer/site, even though many don't bother to do that correctly I bet.
foxpurple 5y ago
I feel like the “server test” rule OP talks about doesn’t really matter and shouldn’t. Who cares if the browser downloaded it from Instagram or the site itself. The actual result is the same. It would make sense that embedding is exactly the same as reposting, either allowed or not allowed for both. A similar situation is that I can listen to music on my phone with Spotify legally but if I plug my phone in to a speaker system and play the music for a large group in public, it’s no longer allowed. But the music actually came from Spotify so how is it different? Tech people always feel entitled to loopholes in laws like “this file is just a bunch of bits, how can a number be illegal??” But this thinking is not useful for a functional legal system.
- remus 5y ago
  I think the license to the copyright material is the important part here. In the instagram embedding example, the uploader (i.e. copyright holder) gives IG a broad license to the content that includes giving people the right to embed the IG post on external sites. Spotify's license is obviously not going to include permission from the artist to broadcast the work to large audiences.
- Dylan16807 5y ago
  > Who cares if the browser downloaded it from Instagram or the site itself. Can we apply this logic to downloading copyrighted material? I would love it if I could openly and legally download ROMs of all my games and archives of prime time broadcast television. But since that's not how the legal system works, it's pretty obvious that getting something from the licensed distributor is different from getting a copy made and distributed by someone else, even if it's automated. > But the music actually came from Spotify so how is it different? The downloading is still legal. Spotify is still legal. The only problem is the new part you added. This is not analogous to the download vs. download comparison. > Tech people always feel entitled to loopholes in laws You know the test came from a highly regarded court, right?
- beowulfey 5y ago
  Your spotify comparison does not really match perfectly. Playing for yourself (license permitted) vs playing for the public (license not permitted) is keeping the same content source but changing the end user. With the photo, you are a single user browsing the photo on either website A or website B. Website A “owns” the photo, and website B has embedded it, but in both cases you are getting the photo from website A. Since you are the same user both times, and are getting the photo from the same place both times, at first glance I would regard this as not breaking any license terms since the two parties (image host, end user) are the same, but I can accept that this is a point of contention.
pjc50 5y ago
Please note that this is about the copyright in the embedded post, not the personal data implications, and by "illegal" they mean "infringing", which is usually a civil matter and not a criminal one most of the time.
- kixiQu 5y ago
  https://en.wikipedia.org/wiki/Criminal_copyright_law_in_the_United_States https://en.wikipedia.org/wiki/Criminal_copyright_law_in_the_... If the difference is awareness (demonstrated) and profiting off it, would a banner ad on the page be enough?
qwerty456127 5y ago
> Do you see that fox photo? No, I don't. Probably because I've blocked social widgets capable of tracking me.
netcan 5y ago
Intellectual property is a total mess. IP has tumbled, stumbled and bumbled to its current state by way of haphazard precedents and half assed legislation. To the extent that it's intentionally tweaked (designed is too strong a word), it's adapted to protect high value industry or companies. What we're left with makes no sense. Concepts like freedom of expression, the public domain, rights of artists and such have a part in IP's history, and rhetoric... but I can't think of any legislation, reform or regulatory/enforcement actions that actually set out to defend these. I don't know if there's a one paragraph solution, but IP is central to a lot of centralisation phenomenon one way or another. The economic and legal dynamics of copyright, for example, centralize control over music revenues and often discovery. That's spotify now. It was record companies at one point. The first step in any commercial music endeavor, before a single note is played, is to separate artists from control and ownership of the music. What the hell is the public benefit of giving social media sites these rights over content? If we accept T&C click throughs as valid contracts, the whole concept of determining content usage rights by agreement is absurd in practice.
- A4ET8a8uTh0 5y ago
  I agree. It is a mess. Worse than that. It creates a very avoidable burden and it takes away some interesting products from us. We were going over Zune case in our last MBA class and one of the things that clearly sunk the product ( as opposed to the Ipod ) was the way it attempts to please IP-holders resulting in god awful experience for the user ( https://answers.microsoft.com/en-us/musicandvideo/forum/all/hundreds-of-my-zune-songs-claim-to-have-no-usage/eeb726db-7571-448d-8b27-3ec5b3f1f242 https://answers.microsoft.com/en-us/musicandvideo/forum/all/... ). I am admittedly not an Apple fan, but I personally thought Zune was otherwise quite nifty and would have otherwise seen some adoption. IP craziness crushed it.
- deleted 5y ago
  [deleted]
dxdm 5y ago
I find it strange that merely providing a link to something can be problematic here, when it's the user's browser that follows the link, and Instagram's server that decides what content to serve for it. Can I get into hot water when the content of the link changes after I link to it? But then, the judges might not know the tech well, while I don't know much about law. Maybe the intent of the embedder to have the content displayed by embedding a link to it is all that's needed here? Without their embedding, the viewer would not see the copyrighted content. Interested to hear more knowledgeable perspectives that can elaborate on the legal basis of these decisions.
- marcosdumay 5y ago
  Hum... You are aiding in an illegal act. You know perfectly well what the browser will do when presented to that link, you know the site doesn't follow the law, and you know your user will be harmed on this specific way. I don't see a problem with you being held responsible. (Also, civil laws have a tendency of spreading blame over as many parties as possible when the victim is seen as powerless. That's a very good tradition that the EU started by the way.) If you didn't know that the linked site would misbehave, or what the browser would do, then you shouldn't be blamed. Still, if the victims are seen as very powerless compared to you, it's not rare for laws to still place you as an intermediary and require that you go settle your damages down with the other party. I think the GDPR shouldn't do that, but I don't know if it does.
tomerv 5y ago
Seems like Instagram should be on the hook here. They have a legal team, they have a license for the content, and they provide site owners with an easy way to embed content, but they don't provide the proper licensing for actually using it? Seems like some sort of entrapment - although I'm probably using that word incorrectly in the legal sense. Suppose I put a bowl of cookies on my lawn with a "free cookie" sign. Then I sue anyone who takes a cookie - not for taking the cookie, but for stepping on my lawn. I don't think a court would be willing to accept my stance that I didn't provide a license to enter my property.
b0tzzzzzzman 5y ago
I can only see the fox if I turn off my ad blocker.
JasonFruit 5y ago
> You see, the “server test” comes from the 9th Circuit, and is binding law in California, where most of the tech companies are. This is a misunderstanding that has to stop: judicial opinions are not law! Judicial opinions represent a judge's interpretation of the law, and courts take such precedents into account, but precedent can be and is overturned. There are all manner of precedents that are clearly, absolutely wrong, and which have never happened to be reconsidered by another court in a similar case --- but that's no reason to allow yourself to be bound by them in your life. To change what is or is not legal, legislatures have to change laws. The same, but less so, applies to mandates and orders issued by executive officials or agencies, at whatever level; they may be supported by law, but they are not themselves law, and since often the people making and enforcing those mandates and orders are not elected representatives, they do not have the authority that popular representation gives to actual laws.
- smichel17 5y ago
  Judicial precedent, also known as common law... https://en.m.wikipedia.org/wiki/Common_law https://en.m.wikipedia.org/wiki/Common_law

116 points by kixiQu 5y ago

1MachineElf 5y ago

I appreciate the design of this blog.

dafoex 5y ago
I do too. I know that's not what this post is about, but its refreshing to see someone not on the minimalist bandwagon.

MattGaiser 5y ago

Would any court let a company deliberately provide something for free and then later let them sue you for using it?

mdasen 5y ago
It wouldn't be Instagram suing you. It would be the owner of the photo that uploaded it to Instagram. By uploading it to Instagram, they're granting Instagram a license, but they aren't granting you a license. People can still claim copyright over the images they've uploaded to Instagram. Instagram has the right to sublicense content that has been uploaded, but they've explicitly said that they aren't doing that.
- Nextgrid 5y ago
  It can be argued that by uploading the photo to a public website they have granted everyone a license to instruct computers to display that photo (that's literally what embeds do)? Also, since Instagram has an embed feature, surely they have something in their ToS that ask the user to grant a license to Instagram to display the content not just on the main website but on any website that embeds the Instagram-hosted content?
cxr 5y ago
Your intuition about fairness matches a principle recognized by courts. The term for the applicable legal doctrine here is "estoppel". There's a strong argument to be made that if Instagram didn't make its (fairly unorthodox) position on embeds clear beforehand, then Newsweek's original use was reasonable and non-infringing (but not something that it can rely on indefinitely, esp. after Newsweek was notified that it did not have permission). There's another argument to be made, though, that the absence of an explicit prohibition is not necessary, due to copyright being an automatic negative right—that the burden is on Newsweek to obtain a clear license, not on anyone else to do any work explaining to Newsweek that it can't use it. This is a strong, argument, too, but probably weaker than the argument from estoppel.

nso 5y ago

As long as the internet is global, but laws governing it are made locally, will not this and similar issues get increasingly messy until we are left with a effed if you do effed if you don't? Could these laws that are increasingly unfriendly to the cooperation that the internet enables slow down innovation and make it too risky to invest in many kind of online services? Is it realistic to think that one day in the near future we will get some kind of global law governing these things, and if not what other options are there to resolve these issues?

lbotos 5y ago
GDPR sets a reasonable precedent (in the sense of what to expect, and it's a good thing for users, but also in this context, adds complexity for businesses.) "The GDPR applies to companies outside the EU because it is extra-territorial in scope. Specifically, the law is designed not so much to regulate businesses as it is to protect the data subjects’ rights. A “data subject” is any person in the EU, including citizens, residents, and even, perhaps, visitors. What this means in practice is that if you collect any personal data of people in the EU, you are required to comply with the GDPR. The data could be in the form of email addresses in a marketing list or the IP addresses of those who visit your website. (See our article explaining what is considered personal data under the GDPR.) You may be wondering how the European Union will enforce a law in territory it does not control. The fact is, foreign governments help other countries enforce their laws through mutual assistance treaties and other mechanisms all the time. GDPR Article 50 addresses this question directly. So far, the EU’s reach has not been tested, but no doubt data protection authorities are exploring their options on a case-by-case basis." - https://gdpr.eu/compliance-checklist-us-companies/ https://gdpr.eu/compliance-checklist-us-companies/
- bserge 5y ago
  An email address is PID? My PoV is that an email address + first name in a mailing list should not be covered under GDPR. William (billy69420@cbt.eu) does not identify anyone, does it?
  - gjs278 5y ago

usr1106 5y ago

In Germany it has been illegal for years to embed anything from social media. "Share on..." buttons like tweets or pics. Not because of licensing, but because it will lead to the social media platform tracking the user without consent. Even users that have no account on that social media and never given consent to anything. Compliant sites show some placeholder in gray typically with appropriate warnings. If the reader wants to reveal the element they need to click first. Disclaimer: Not a web developer, not living in Germany, but German as a mother tongue.

remus 5y ago
That's interesting...do you know if there's any distinction made between social media embeds and just linking to external resources? I guess you could make a similar tracking argument for images linked from an external site (for example).
- usr1106 5y ago
  There is no difference between social media or not. You are not allowed to track without explicit consent.
giansegato 5y ago
This is not entirely true (disclaimer: living in Germany, with a German-based business). You can embed social media. What you can't do is embed a social media post without disclosing in the cookie notice (that must be approved beforehand) what will happen to the user due to you doing it.
- the_gipsy 5y ago
  But isn’t the embedded element already setting cookies before the user can reject the cookie notice?
  - lawik 5y ago
    Only if you render the embed before the user accepts which is under the control of the developer/site, even though many don't bother to do that correctly I bet.

foxpurple 5y ago

I feel like the “server test” rule OP talks about doesn’t really matter and shouldn’t. Who cares if the browser downloaded it from Instagram or the site itself. The actual result is the same. It would make sense that embedding is exactly the same as reposting, either allowed or not allowed for both. A similar situation is that I can listen to music on my phone with Spotify legally but if I plug my phone in to a speaker system and play the music for a large group in public, it’s no longer allowed. But the music actually came from Spotify so how is it different? Tech people always feel entitled to loopholes in laws like “this file is just a bunch of bits, how can a number be illegal??” But this thinking is not useful for a functional legal system.

remus 5y ago
I think the license to the copyright material is the important part here. In the instagram embedding example, the uploader (i.e. copyright holder) gives IG a broad license to the content that includes giving people the right to embed the IG post on external sites. Spotify's license is obviously not going to include permission from the artist to broadcast the work to large audiences.
Dylan16807 5y ago
> Who cares if the browser downloaded it from Instagram or the site itself. Can we apply this logic to downloading copyrighted material? I would love it if I could openly and legally download ROMs of all my games and archives of prime time broadcast television. But since that's not how the legal system works, it's pretty obvious that getting something from the licensed distributor is different from getting a copy made and distributed by someone else, even if it's automated. > But the music actually came from Spotify so how is it different? The downloading is still legal. Spotify is still legal. The only problem is the new part you added. This is not analogous to the download vs. download comparison. > Tech people always feel entitled to loopholes in laws You know the test came from a highly regarded court, right?
beowulfey 5y ago
Your spotify comparison does not really match perfectly. Playing for yourself (license permitted) vs playing for the public (license not permitted) is keeping the same content source but changing the end user. With the photo, you are a single user browsing the photo on either website A or website B. Website A “owns” the photo, and website B has embedded it, but in both cases you are getting the photo from website A. Since you are the same user both times, and are getting the photo from the same place both times, at first glance I would regard this as not breaking any license terms since the two parties (image host, end user) are the same, but I can accept that this is a point of contention.

pjc50 5y ago

Please note that this is about the copyright in the embedded post, not the personal data implications, and by "illegal" they mean "infringing", which is usually a civil matter and not a criminal one most of the time.

kixiQu 5y ago
https://en.wikipedia.org/wiki/Criminal_copyright_law_in_the_United_States https://en.wikipedia.org/wiki/Criminal_copyright_law_in_the_... If the difference is awareness (demonstrated) and profiting off it, would a banner ad on the page be enough?

qwerty456127 5y ago

> Do you see that fox photo? No, I don't. Probably because I've blocked social widgets capable of tracking me.

netcan 5y ago

Intellectual property is a total mess. IP has tumbled, stumbled and bumbled to its current state by way of haphazard precedents and half assed legislation. To the extent that it's intentionally tweaked (designed is too strong a word), it's adapted to protect high value industry or companies. What we're left with makes no sense. Concepts like freedom of expression, the public domain, rights of artists and such have a part in IP's history, and rhetoric... but I can't think of any legislation, reform or regulatory/enforcement actions that actually set out to defend these. I don't know if there's a one paragraph solution, but IP is central to a lot of centralisation phenomenon one way or another. The economic and legal dynamics of copyright, for example, centralize control over music revenues and often discovery. That's spotify now. It was record companies at one point. The first step in any commercial music endeavor, before a single note is played, is to separate artists from control and ownership of the music. What the hell is the public benefit of giving social media sites these rights over content? If we accept T&C click throughs as valid contracts, the whole concept of determining content usage rights by agreement is absurd in practice.

A4ET8a8uTh0 5y ago
I agree. It is a mess. Worse than that. It creates a very avoidable burden and it takes away some interesting products from us. We were going over Zune case in our last MBA class and one of the things that clearly sunk the product ( as opposed to the Ipod ) was the way it attempts to please IP-holders resulting in god awful experience for the user ( https://answers.microsoft.com/en-us/musicandvideo/forum/all/hundreds-of-my-zune-songs-claim-to-have-no-usage/eeb726db-7571-448d-8b27-3ec5b3f1f242 https://answers.microsoft.com/en-us/musicandvideo/forum/all/... ). I am admittedly not an Apple fan, but I personally thought Zune was otherwise quite nifty and would have otherwise seen some adoption. IP craziness crushed it.
deleted 5y ago
[deleted]

dxdm 5y ago

I find it strange that merely providing a link to something can be problematic here, when it's the user's browser that follows the link, and Instagram's server that decides what content to serve for it. Can I get into hot water when the content of the link changes after I link to it? But then, the judges might not know the tech well, while I don't know much about law. Maybe the intent of the embedder to have the content displayed by embedding a link to it is all that's needed here? Without their embedding, the viewer would not see the copyrighted content. Interested to hear more knowledgeable perspectives that can elaborate on the legal basis of these decisions.

marcosdumay 5y ago
Hum... You are aiding in an illegal act. You know perfectly well what the browser will do when presented to that link, you know the site doesn't follow the law, and you know your user will be harmed on this specific way. I don't see a problem with you being held responsible. (Also, civil laws have a tendency of spreading blame over as many parties as possible when the victim is seen as powerless. That's a very good tradition that the EU started by the way.) If you didn't know that the linked site would misbehave, or what the browser would do, then you shouldn't be blamed. Still, if the victims are seen as very powerless compared to you, it's not rare for laws to still place you as an intermediary and require that you go settle your damages down with the other party. I think the GDPR shouldn't do that, but I don't know if it does.

tomerv 5y ago

Seems like Instagram should be on the hook here. They have a legal team, they have a license for the content, and they provide site owners with an easy way to embed content, but they don't provide the proper licensing for actually using it? Seems like some sort of entrapment - although I'm probably using that word incorrectly in the legal sense. Suppose I put a bowl of cookies on my lawn with a "free cookie" sign. Then I sue anyone who takes a cookie - not for taking the cookie, but for stepping on my lawn. I don't think a court would be willing to accept my stance that I didn't provide a license to enter my property.

b0tzzzzzzman 5y ago

I can only see the fox if I turn off my ad blocker.

JasonFruit 5y ago

> You see, the “server test” comes from the 9th Circuit, and is binding law in California, where most of the tech companies are. This is a misunderstanding that has to stop: judicial opinions are not law! Judicial opinions represent a judge's interpretation of the law, and courts take such precedents into account, but precedent can be and is overturned. There are all manner of precedents that are clearly, absolutely wrong, and which have never happened to be reconsidered by another court in a similar case --- but that's no reason to allow yourself to be bound by them in your life. To change what is or is not legal, legislatures have to change laws. The same, but less so, applies to mandates and orders issued by executive officials or agencies, at whatever level; they may be supported by law, but they are not themselves law, and since often the people making and enforcing those mandates and orders are not elected representatives, they do not have the authority that popular representation gives to actual laws.

smichel17 5y ago
Judicial precedent, also known as common law... https://en.m.wikipedia.org/wiki/Common_law https://en.m.wikipedia.org/wiki/Common_law