8 ms·

CJEU has made it effectively impossible to run a user-generated platform legally

122 points by alsetmusic 11mo ago

free_bip 11mo ago
Seems like a pretty big overreaction IMO. Advertisements deserve more strict regulation than general user-generated content because they tend to reach far more people. The fact that they aren't has resulted in something like 10% of all ads shown being outright scams or fraud[0]. And they should never have allowed the ad to air in the first place - it was patently and obviously illegal even without considering the GDPR. If these companies aren't willing to put basic measures in place to stop even the most obviously illegal ads from airing, I have a lot of trouble having sympathy for them getting their just desserts in court. [0]: https://www.msn.com/en-us/money/personalfinance/meta-showed-users-15-billion-scam-ads-a-day-in-2024-and-earned-16-billion-from-them-are-you-just-a-click-away-from-the-next-impulse-buy-trap/ar-AA1RI1C7 https://www.msn.com/en-us/money/personalfinance/meta-showed-...
- zahlman 11mo ago
  > Advertisements deserve more strict regulation than general user-generated content because they tend to reach far more people. They deserve strict regulation because the carrier is actively choosing who sees them, and because there are explicit fiscal incentives in play. The entire point of Section 230 is that carriers can claim to be just the messenger; the only way to make sense of absolving them of responsibility for the content is to make the argument that their conveyance of the content does not constitute expression. Once you have auctions for ads, and "algorithmic feeds", that becomes a lot harder to accept.
  - xoa 11mo ago
    >The entire point of Section 230 is that carriers can claim to be just the messenger Incorrect, and it's honestly kinda fascinating how this meme shows up so often. What you're describing is "common carrier" status, like an ISP (or Fedex/UPS/post office) would have. The point of Section 230 was specifically to enable not being "just the messenger", it was part of the overall Communications Decency Act intended to aid in stopping bad content. Congress added Section 230 in direct reaction to two court cases (against Prodigy and CompuServe) which made service providers liable for their user's content when they didn't act as pure common carriers but rather tried to moderate it but, obviously and naturally, could not perfectly get everything. The specific fear was that this left only two options: either ban all user content, which would brutalize the Internet even back then, or cease all moderation, turning everything into a total cesspit. Liability protection was precisely one of the rare genuine "think of the children!" wins, by enabling a 3rd path where everyone could do their best to moderate their platforms without becoming the publisher. Not being a common carrier is the whole point!
    - zahlman 11mo ago
      > Congress added Section 230 in direct reaction to two court cases (against Prodigy and CompuServe) which made service providers liable for their user's content when they didn't act as pure common carriers but rather tried to moderate it but, obviously and naturally, could not perfectly get everything. I know that. I spoke imprecisely; my framing is that this imperfect moderation doesn't take away their immunity — i.e. they are still treated as if they were "just the messenger" (per the previous rules). I didn't use the actual "common carrier" phrasing, for a reason. It doesn't change the argument. Failing to apply a content policy consistently is not, logically speaking, an act of expression; choosing to show content preferentially is. ... And so is setting a content policy. For example, if a forum explicitly for hateful people set a content policy explicitly banning statements inclusive or supportive of the target group, I don't see why the admin should be held harmless (even if they don't also post). Importantly, though, the setting (and attempt at enforcing) the policy is only expressing the view of the policy, not that of any permitted content; in US law it would be hard to imagine a content policy expressing anything illegal. But my view is that if they act deliberately to show something, based on knowing and evaluating what it is that they're showing, to someone who hasn't requested it (as a recommendation), then they really should be liable. The point of not punishing platforms for failing at moderation is to let them claim plausible ignorance of what they're showing, because they can't observe and evaluate everything.
- tensor 11mo ago
  Except this isn't limited to ads is it? From the post it sounds like the ruling covers any user content. If someone uploads personal data to Github now Github is liable. In fact, why wouldn't author names on open source licenses count as PII?
  - free_bip 11mo ago
    You could always sue GitHub to find out. Personally, I'm not buying the slippery slope argument. I could be wrong of course but that's the great thing about opinions: you're allowed to be wrong :)
  - o11c 11mo ago
    The author of the article is claiming it extends beyond ads. That does not appear to be what the court actually said, however. And I 100% believe that all advertisements should require review by a documented human before posting, so that someone can be held accountable. In the absence of this it is perfectly acceptable to hold the entire organization liable.
    - iamnothere 11mo ago
      The ruling is about an advertisement, but: > There’s nothing inherently in the law or the ruling that limits its conclusions to “advertisements.” The same underlying factors would apply to any third party content on any website that is subject to the GDPR. So site operators probably need to assume it doesn’t just apply to ads if they have legal exposure in the EU.
  - fweimer 11mo ago
    The judgement is a bit more nuanced than that: https://curia.europa.eu/juris/document/document_print.jsf?mode=req&pageIndex=0&docid=306764&part=1&doclang=EN&text=&dir=&occ=first&cid=14888943 https://curia.europa.eu/juris/document/document_print.jsf?mo... The court uses the phrase “an online marketplace, as controller” in key places. This suggest to me that there can be online marketplaces that are not data controllers. The court cites several contributing factors to treat the platform as data controller: they reserved additional rights to upload content, they selected the ads to display. Github only claims limited rights in uploaded content, and I'm not sure if they have any editorialized (“algorithmic”) feeds where Github selects repository content for display. That may make it less likely that they would be considered data controllers. On the other hand, licensing their repository database for LLM training could make them liable if personal data ends up in models. I don't think that's necessarily a bad thing.
SilverElfin 11mo ago
> Under this ruling, it appears that any website that hosts any user-generated content can be strictly liable if any of that content contains “sensitive personal data” about any person. Could this lead to censorship as well? For example you could go to a website or community you don’t like, and share information that could be seen as “sensitive personal data” and then file an anonymous complaint so they get into legal trouble or get shut down?
- orwin 11mo ago
  It seems to only applies to user-generated ads you run on your platform, not generic content. So the community would have to accept community generated ads and not checking them. I'd say it's pretty rare.
xg15 11mo ago
> I am an unabashed supporter of the US’s approach with Section 230, as it was initially interpreted, which said that any liability should land on the party who contributed the actual violative behavior—in nearly all cases the speaker, not the host of the content. I never really understood how that system is supposed to work. So on the one hand, Section 230 absolves the hoster of liability and tells an affected party to go after the author directly. But on the other hand, we all rally for the importance of anonymity on the internet, so it's very likely that there will be no way to find the author. Isn't this a massive vacuum of responsibility?
- Retric 11mo ago
  Anonymous authors have very little reach without external promotion or a long lasting reputation. If someone builds up a reputation anonymously then that reputation itself is something that can be destroyed when a platform destroys their account etc.
  - probably_wrong 11mo ago
    Your premise goes precisely against the base of the lawsuit itself: > (...) an unidentified third party published on that website an untrue and harmful advertisement presenting her as offering sexual services. That advertisement contained photographs of that applicant, which had been used without her consent, along with her telephone number.(...) The same advertisement nevertheless remains available on other websites which have reproduced it. Anonymous author, great reach, enough damage for the victim to take a lawsuit all the way to the CJEU.
    - Retric 11mo ago
      > great reach What exactly provided great reach here? Is it the creator or something else. > The same advertisement nevertheless remains available on other websites which have reproduced it. This presumably involved the actions of 3rd parties not just the original content creator.
      - 11mo ago
smartbit 11mo ago
Another analysis, by Heise Verlag, publisher of C’t Europe's largest IT and tech magazine https://heise.de/-11102550 https://heise.de/-11102550 The Russmedia ruling of the ECJ: Towards a “Cleannet”? A change in liability privilege for online providers will lead to a “cleaner”, but also more rigid, monitored internet, says Joerg Heidrich.
234958720934 11mo ago
[flagged]
hexo 11mo ago
Websites have to be held responsible for ADs they serve. Otherwise they tend to make unfounded excuses we cant care less about. Like scam ADs on youtube. But user generated content? LOL, no.
- RunSet 11mo ago
  What a relief this does not apply to https://uk.LokiList.com https://uk.LokiList.com
- jeroenhd 11mo ago
  Ads on Youtube are user-generated. If I were to upload a picture of you with your phone number as a youtube ad, offering sexual services, Youtube will likely be accountable in the same way.
- orwin 11mo ago
  Doesn't the site make user pay to show their ads? I thought it was the deal, you pay the platform to host your advertising, and that was one of the justification for the CJEU.
Tor3 11mo ago
Sigh. "..that personal data processed must be accurate and, where necessary, kept up to date. " How do they think a hosting provider can check if personal data is accurate? Maybe if privacy didn't exist and everybody could be scrutinized.. but the ruling refers to the GDPR to justify this, and the GDPR is about _protecting_ privacy. So, what is it? And for everything else.. is the material sensitive or not? How can anyone know, in advance? I suggest every web site host simply forward all and every input to an EU Court address, and let them handle it. They're the ones suggesting that hosts should make sure that personal data on someone is "accurate", they're the ones demanding that the data should not be "sensitive", so they can as well be responsible for vetting the data. But they're all crazy anyway, as they demand that a website must block anyone from copying the content.. so how, at the same time, can you even have a website? A website which people can watch? If the ruling was about collecting data which isn't for displaying, i.e. what a net shop does (address, credit card number), then this would be understandable. But provisions for that already exists, instead they use this (GDPR) as a tool to extend this to user-created content. It's not limited to ads, and ads do need something done. Something totally different from this.
- orwin 11mo ago
  > It's not limited to ads Are you sure? We might have a different reading then, I felt it was obvious it was because it was an ad. And even more, an ad display through an algorithm, I.E it wouldn't apply to Craigslist or platform that display user-generated ads in chronological order.
  - Tor3 11mo ago
    The _source_ of it was an ad. The _fix_ is not limited to ads.
nomercy400 11mo ago
The party which decides to show the advertisment in exchange for payment, should be more responsible for what they are showing than a free user posting content. Now things become interesting when a users pays for ranking or 'verification' checkmarks. What makes that content different than a paid advertisment?
- jay_kyburz 11mo ago
  I came to the comments to express the same sentiment, expecting to be an unpopular opinion. Pleasantly surprised to find your comment at the top. Hosts should make sure they know who is posting content on their platforms, so that in the event they are sued, they can countersue the creator of the content.
  - g-b-r 11mo ago
    So anonymity should be impossible?
    - nomercy400 11mo ago
      Anonymity should not be possible if you pay/receive money for it. Anonymity should be possible if it doesn't involve money / contracts with money. See my sibling post on my view.
  - nomercy400 11mo ago
    The important part is that there is a difference between content for money and content not for money The first should make the hoster liable, they have a contract involving money. The second should not automatically make the host liable.
- Terr_ 11mo ago
  Speaking of responsibility: I want ad networks (a scourge on modern society) to be very liable when their systems are spreading malware and scams. IIRC the last time my mom came to me with a fake "You Must Upgrade Now" ad on her phone (from an otherwise-legit puzzle game), the ad-network did have a feedback function... but strangely there wasn't any category for fraud. It might be less of an issue if there were clearer ad-vs-not boundaries, but that starts getting into issues like the browser security line of death [0]. [0] https://textslashplain.com/2017/01/14/the-line-of-death/ https://textslashplain.com/2017/01/14/the-line-of-death/
jjcm 11mo ago
I've long held a belief that if countries want to mandate compliance, they should be required to provide the mechanism for compliance. Want to deem whether content is allowed or not? Fine, provide an API that allows content to be scanned and return a bool. Want to age-gate content? Fine, provide an identity service. While both of these will reduce privacy, they'll achieve one of two objectives: Either those making these policies will realize the law they wrote is impossible to achieve, or it will at least provide an even playing field for startups vs incumbents if they succeed.
- snapplebobapple 11mo ago
  [flagged]
  - tomhow 11mo ago
    Please don't comment like this on HN. The guidelines make it clear we're aiming for something better here. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- o11c 11mo ago
  [flagged]
  - bpodgursky 11mo ago
    [flagged]
    - tomhow 11mo ago
      Please don't comment like this on HN. It's fair enough to express disagreement with the parent comment, and I've replied to them asking them to avoid fulminating and making shallow dismissals. But this kind of reply is also in breach of the guidelines. Replying to a bad comment with an even worse one is how death-spirals happen, and that's exactly what we're trying to avoid on HN. We've had to ask you several times before to follow the guidelines. We have to ban accounts that keep ignoring our requests. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
dmitrygr 11mo ago
[flagged]
- orwin 11mo ago
  It only targets user-generated advertising. If a platform chooses to display an add that contains PII, they have to make sure the person whose PII are displayed has agreed.
  - iamnothere 11mo ago
    This particular ruling is about advertising, however: > There’s nothing inherently in the law or the ruling that limits its conclusions to “advertisements.” The same underlying factors would apply to any third party content on any website that is subject to the GDPR. If you have legal exposure in the EU, you should ask counsel about it ASAP. Especially if your site may be in the crosshairs for whatever reason.
jeroenhd 11mo ago
Long, but quite readable English judgement: https://curia.europa.eu/juris/document/document_print.jsf?mode=req&pageIndex=0&docid=306764&part=1&doclang=EN&text=&dir=&occ=first&cid=14888943 https://curia.europa.eu/juris/document/document_print.jsf?mo... And for quick reference, what the judgement actually entails: On those grounds, the Court (Grand Chamber) hereby rules: 1. Article 5(2) and Articles 24 to 26 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) must be interpreted as meaning that the operator of an online marketplace, as controller, within the meaning of Article 4(7) of that regulation, of the personal data contained in advertisements published on its online marketplace, is required, before the publication of the advertisements and by means of appropriate technical and organisational measures, – to identify the advertisements that contain sensitive data in terms of Article 9(1) of that regulation, – to verify whether the user advertiser preparing to place such an advertisement is the person whose sensitive data appear in that advertisement and, if this is not the case, – to refuse publication of that advertisement, unless that user advertiser can demonstrate that the data subject has given his or her explicit consent to the data in question being published on that online marketplace, within the meaning of Article 9(2)(a), or that one of the other exceptions provided for in Article 9(2)(b) to (j) is satisfied. 2. Article 32 of Regulation 2016/679 must be interpreted as meaning that the operator of an online marketplace, as controller, within the meaning of Article 4(7) of that regulation, of the personal data contained in advertisements published on its online marketplace, is required to implement appropriate technical and organisational security measures in order to prevent advertisements published there and containing sensitive data, in terms of Article 9(1) of that regulation, from being copied and unlawfully published on other websites. 3. Article 1(5)(b) of Directive 2000/31/EC of the European Parliament and of the Council of 8 June 2000 on certain legal aspects of information society services, in particular electronic commerce, in the Internal Market (‘Directive on electronic commerce’) and Article 2(4) of Regulation 2016/679 must be interpreted as meaning that the operator of an online marketplace, as controller, within the meaning of Article 4(7) of Regulation 2016/679, of the personal data contained in advertisements published on its online marketplace, cannot rely, in respect of an infringement of the obligations arising from Article 5(2) and Articles 24 to 26 and 32 of that regulation, on Articles 12 to 15 of that directive, relating to the liability of intermediary providers. This mostly seems to be about advertisers distributing content, not so much making it "effectively impossible to run a user-generated platform legally". Unless you think basic KYC for paying customers is "effectively impossible", perhaps.
deleted 11mo ago
[deleted]
mannyv 11mo ago
The case is about advertising, but the ruling is not limited to advertising. That's the problem.
rendx 11mo ago
I think the author, an American, is confusing common law and civil law. The ruling's language may be overly broad but in civil law countries like all of Europe, while it may be cited in other legal cases _as a supporting argument by one side or the other_, it will not fundamentally change law and it's not the catastrophy the post author makes it sound like. > There’s nothing inherently in the law or the ruling that limits its conclusions to “advertisements.” The same underlying factors would apply to any third party content on any website that is subject to the GDPR. False. A European court's conclusions are specifically around the case it is ruling about, so it is inherently limited to the exact circumstances of that case, without the need for it to specify that. They do not set precedent.

122 points by alsetmusic 11mo ago

Seems like a pretty big overreaction IMO. Advertisements deserve more strict regulation than general user-generated content because they tend to reach far more people. The fact that they aren't has resulted in something like 10% of all ads shown being outright scams or fraud[0]. And they should never have allowed the ad to air in the first place - it was patently and obviously illegal even without considering the GDPR. If these companies aren't willing to put basic measures in place to stop even the most obviously illegal ads from airing, I have a lot of trouble having sympathy for them getting their just desserts in court. [0]: https://www.msn.com/en-us/money/personalfinance/meta-showed-users-15-billion-scam-ads-a-day-in-2024-and-earned-16-billion-from-them-are-you-just-a-click-away-from-the-next-impulse-buy-trap/ar-AA1RI1C7 https://www.msn.com/en-us/money/personalfinance/meta-showed-...

zahlman 11mo ago
> Advertisements deserve more strict regulation than general user-generated content because they tend to reach far more people. They deserve strict regulation because the carrier is actively choosing who sees them, and because there are explicit fiscal incentives in play. The entire point of Section 230 is that carriers can claim to be just the messenger; the only way to make sense of absolving them of responsibility for the content is to make the argument that their conveyance of the content does not constitute expression. Once you have auctions for ads, and "algorithmic feeds", that becomes a lot harder to accept.
- xoa 11mo ago
  >The entire point of Section 230 is that carriers can claim to be just the messenger Incorrect, and it's honestly kinda fascinating how this meme shows up so often. What you're describing is "common carrier" status, like an ISP (or Fedex/UPS/post office) would have. The point of Section 230 was specifically to enable not being "just the messenger", it was part of the overall Communications Decency Act intended to aid in stopping bad content. Congress added Section 230 in direct reaction to two court cases (against Prodigy and CompuServe) which made service providers liable for their user's content when they didn't act as pure common carriers but rather tried to moderate it but, obviously and naturally, could not perfectly get everything. The specific fear was that this left only two options: either ban all user content, which would brutalize the Internet even back then, or cease all moderation, turning everything into a total cesspit. Liability protection was precisely one of the rare genuine "think of the children!" wins, by enabling a 3rd path where everyone could do their best to moderate their platforms without becoming the publisher. Not being a common carrier is the whole point!
  - zahlman 11mo ago
    > Congress added Section 230 in direct reaction to two court cases (against Prodigy and CompuServe) which made service providers liable for their user's content when they didn't act as pure common carriers but rather tried to moderate it but, obviously and naturally, could not perfectly get everything. I know that. I spoke imprecisely; my framing is that this imperfect moderation doesn't take away their immunity — i.e. they are still treated as if they were "just the messenger" (per the previous rules). I didn't use the actual "common carrier" phrasing, for a reason. It doesn't change the argument. Failing to apply a content policy consistently is not, logically speaking, an act of expression; choosing to show content preferentially is. ... And so is setting a content policy. For example, if a forum explicitly for hateful people set a content policy explicitly banning statements inclusive or supportive of the target group, I don't see why the admin should be held harmless (even if they don't also post). Importantly, though, the setting (and attempt at enforcing) the policy is only expressing the view of the policy, not that of any permitted content; in US law it would be hard to imagine a content policy expressing anything illegal. But my view is that if they act deliberately to show something, based on knowing and evaluating what it is that they're showing, to someone who hasn't requested it (as a recommendation), then they really should be liable. The point of not punishing platforms for failing at moderation is to let them claim plausible ignorance of what they're showing, because they can't observe and evaluate everything.
tensor 11mo ago
Except this isn't limited to ads is it? From the post it sounds like the ruling covers any user content. If someone uploads personal data to Github now Github is liable. In fact, why wouldn't author names on open source licenses count as PII?
- free_bip 11mo ago
  You could always sue GitHub to find out. Personally, I'm not buying the slippery slope argument. I could be wrong of course but that's the great thing about opinions: you're allowed to be wrong :)
- o11c 11mo ago
  The author of the article is claiming it extends beyond ads. That does not appear to be what the court actually said, however. And I 100% believe that all advertisements should require review by a documented human before posting, so that someone can be held accountable. In the absence of this it is perfectly acceptable to hold the entire organization liable.
  - iamnothere 11mo ago
    The ruling is about an advertisement, but: > There’s nothing inherently in the law or the ruling that limits its conclusions to “advertisements.” The same underlying factors would apply to any third party content on any website that is subject to the GDPR. So site operators probably need to assume it doesn’t just apply to ads if they have legal exposure in the EU.
- fweimer 11mo ago
  The judgement is a bit more nuanced than that: https://curia.europa.eu/juris/document/document_print.jsf?mode=req&pageIndex=0&docid=306764&part=1&doclang=EN&text=&dir=&occ=first&cid=14888943 https://curia.europa.eu/juris/document/document_print.jsf?mo... The court uses the phrase “an online marketplace, as controller” in key places. This suggest to me that there can be online marketplaces that are not data controllers. The court cites several contributing factors to treat the platform as data controller: they reserved additional rights to upload content, they selected the ads to display. Github only claims limited rights in uploaded content, and I'm not sure if they have any editorialized (“algorithmic”) feeds where Github selects repository content for display. That may make it less likely that they would be considered data controllers. On the other hand, licensing their repository database for LLM training could make them liable if personal data ends up in models. I don't think that's necessarily a bad thing.

SilverElfin 11mo ago

> Under this ruling, it appears that any website that hosts any user-generated content can be strictly liable if any of that content contains “sensitive personal data” about any person. Could this lead to censorship as well? For example you could go to a website or community you don’t like, and share information that could be seen as “sensitive personal data” and then file an anonymous complaint so they get into legal trouble or get shut down?

orwin 11mo ago
It seems to only applies to user-generated ads you run on your platform, not generic content. So the community would have to accept community generated ads and not checking them. I'd say it's pretty rare.

xg15 11mo ago

> I am an unabashed supporter of the US’s approach with Section 230, as it was initially interpreted, which said that any liability should land on the party who contributed the actual violative behavior—in nearly all cases the speaker, not the host of the content. I never really understood how that system is supposed to work. So on the one hand, Section 230 absolves the hoster of liability and tells an affected party to go after the author directly. But on the other hand, we all rally for the importance of anonymity on the internet, so it's very likely that there will be no way to find the author. Isn't this a massive vacuum of responsibility?

Retric 11mo ago
Anonymous authors have very little reach without external promotion or a long lasting reputation. If someone builds up a reputation anonymously then that reputation itself is something that can be destroyed when a platform destroys their account etc.
- probably_wrong 11mo ago
  Your premise goes precisely against the base of the lawsuit itself: > (...) an unidentified third party published on that website an untrue and harmful advertisement presenting her as offering sexual services. That advertisement contained photographs of that applicant, which had been used without her consent, along with her telephone number.(...) The same advertisement nevertheless remains available on other websites which have reproduced it. Anonymous author, great reach, enough damage for the victim to take a lawsuit all the way to the CJEU.
  - Retric 11mo ago
    > great reach What exactly provided great reach here? Is it the creator or something else. > The same advertisement nevertheless remains available on other websites which have reproduced it. This presumably involved the actions of 3rd parties not just the original content creator.
    - 11mo ago

smartbit 11mo ago

Another analysis, by Heise Verlag, publisher of C’t Europe's largest IT and tech magazine https://heise.de/-11102550 https://heise.de/-11102550 The Russmedia ruling of the ECJ: Towards a “Cleannet”? A change in liability privilege for online providers will lead to a “cleaner”, but also more rigid, monitored internet, says Joerg Heidrich.

234958720934 11mo ago

[flagged]

hexo 11mo ago

Websites have to be held responsible for ADs they serve. Otherwise they tend to make unfounded excuses we cant care less about. Like scam ADs on youtube. But user generated content? LOL, no.

RunSet 11mo ago
What a relief this does not apply to https://uk.LokiList.com https://uk.LokiList.com
jeroenhd 11mo ago
Ads on Youtube are user-generated. If I were to upload a picture of you with your phone number as a youtube ad, offering sexual services, Youtube will likely be accountable in the same way.
orwin 11mo ago
Doesn't the site make user pay to show their ads? I thought it was the deal, you pay the platform to host your advertising, and that was one of the justification for the CJEU.

Tor3 11mo ago

Sigh. "..that personal data processed must be accurate and, where necessary, kept up to date. " How do they think a hosting provider can check if personal data is accurate? Maybe if privacy didn't exist and everybody could be scrutinized.. but the ruling refers to the GDPR to justify this, and the GDPR is about _protecting_ privacy. So, what is it? And for everything else.. is the material sensitive or not? How can anyone know, in advance? I suggest every web site host simply forward all and every input to an EU Court address, and let them handle it. They're the ones suggesting that hosts should make sure that personal data on someone is "accurate", they're the ones demanding that the data should not be "sensitive", so they can as well be responsible for vetting the data. But they're all crazy anyway, as they demand that a website must block anyone from copying the content.. so how, at the same time, can you even have a website? A website which people can watch? If the ruling was about collecting data which isn't for displaying, i.e. what a net shop does (address, credit card number), then this would be understandable. But provisions for that already exists, instead they use this (GDPR) as a tool to extend this to user-created content. It's not limited to ads, and ads do need something done. Something totally different from this.

orwin 11mo ago
> It's not limited to ads Are you sure? We might have a different reading then, I felt it was obvious it was because it was an ad. And even more, an ad display through an algorithm, I.E it wouldn't apply to Craigslist or platform that display user-generated ads in chronological order.
- Tor3 11mo ago
  The _source_ of it was an ad. The _fix_ is not limited to ads.

nomercy400 11mo ago

The party which decides to show the advertisment in exchange for payment, should be more responsible for what they are showing than a free user posting content. Now things become interesting when a users pays for ranking or 'verification' checkmarks. What makes that content different than a paid advertisment?

jay_kyburz 11mo ago
I came to the comments to express the same sentiment, expecting to be an unpopular opinion. Pleasantly surprised to find your comment at the top. Hosts should make sure they know who is posting content on their platforms, so that in the event they are sued, they can countersue the creator of the content.
- g-b-r 11mo ago
  So anonymity should be impossible?
  - nomercy400 11mo ago
    Anonymity should not be possible if you pay/receive money for it. Anonymity should be possible if it doesn't involve money / contracts with money. See my sibling post on my view.
- nomercy400 11mo ago
  The important part is that there is a difference between content for money and content not for money The first should make the hoster liable, they have a contract involving money. The second should not automatically make the host liable.
Terr_ 11mo ago
Speaking of responsibility: I want ad networks (a scourge on modern society) to be very liable when their systems are spreading malware and scams. IIRC the last time my mom came to me with a fake "You Must Upgrade Now" ad on her phone (from an otherwise-legit puzzle game), the ad-network did have a feedback function... but strangely there wasn't any category for fraud. It might be less of an issue if there were clearer ad-vs-not boundaries, but that starts getting into issues like the browser security line of death [0]. [0] https://textslashplain.com/2017/01/14/the-line-of-death/ https://textslashplain.com/2017/01/14/the-line-of-death/

jjcm 11mo ago

I've long held a belief that if countries want to mandate compliance, they should be required to provide the mechanism for compliance. Want to deem whether content is allowed or not? Fine, provide an API that allows content to be scanned and return a bool. Want to age-gate content? Fine, provide an identity service. While both of these will reduce privacy, they'll achieve one of two objectives: Either those making these policies will realize the law they wrote is impossible to achieve, or it will at least provide an even playing field for startups vs incumbents if they succeed.

snapplebobapple 11mo ago
[flagged]
- tomhow 11mo ago
  Please don't comment like this on HN. The guidelines make it clear we're aiming for something better here. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
o11c 11mo ago
[flagged]
- bpodgursky 11mo ago
  [flagged]
  - tomhow 11mo ago
    Please don't comment like this on HN. It's fair enough to express disagreement with the parent comment, and I've replied to them asking them to avoid fulminating and making shallow dismissals. But this kind of reply is also in breach of the guidelines. Replying to a bad comment with an even worse one is how death-spirals happen, and that's exactly what we're trying to avoid on HN. We've had to ask you several times before to follow the guidelines. We have to ban accounts that keep ignoring our requests. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

dmitrygr 11mo ago

[flagged]

orwin 11mo ago
It only targets user-generated advertising. If a platform chooses to display an add that contains PII, they have to make sure the person whose PII are displayed has agreed.
- iamnothere 11mo ago
  This particular ruling is about advertising, however: > There’s nothing inherently in the law or the ruling that limits its conclusions to “advertisements.” The same underlying factors would apply to any third party content on any website that is subject to the GDPR. If you have legal exposure in the EU, you should ask counsel about it ASAP. Especially if your site may be in the crosshairs for whatever reason.

jeroenhd 11mo ago

Long, but quite readable English judgement: https://curia.europa.eu/juris/document/document_print.jsf?mode=req&pageIndex=0&docid=306764&part=1&doclang=EN&text=&dir=&occ=first&cid=14888943 https://curia.europa.eu/juris/document/document_print.jsf?mo... And for quick reference, what the judgement actually entails: On those grounds, the Court (Grand Chamber) hereby rules: 1. Article 5(2) and Articles 24 to 26 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) must be interpreted as meaning that the operator of an online marketplace, as controller, within the meaning of Article 4(7) of that regulation, of the personal data contained in advertisements published on its online marketplace, is required, before the publication of the advertisements and by means of appropriate technical and organisational measures, – to identify the advertisements that contain sensitive data in terms of Article 9(1) of that regulation, – to verify whether the user advertiser preparing to place such an advertisement is the person whose sensitive data appear in that advertisement and, if this is not the case, – to refuse publication of that advertisement, unless that user advertiser can demonstrate that the data subject has given his or her explicit consent to the data in question being published on that online marketplace, within the meaning of Article 9(2)(a), or that one of the other exceptions provided for in Article 9(2)(b) to (j) is satisfied. 2. Article 32 of Regulation 2016/679 must be interpreted as meaning that the operator of an online marketplace, as controller, within the meaning of Article 4(7) of that regulation, of the personal data contained in advertisements published on its online marketplace, is required to implement appropriate technical and organisational security measures in order to prevent advertisements published there and containing sensitive data, in terms of Article 9(1) of that regulation, from being copied and unlawfully published on other websites. 3. Article 1(5)(b) of Directive 2000/31/EC of the European Parliament and of the Council of 8 June 2000 on certain legal aspects of information society services, in particular electronic commerce, in the Internal Market (‘Directive on electronic commerce’) and Article 2(4) of Regulation 2016/679 must be interpreted as meaning that the operator of an online marketplace, as controller, within the meaning of Article 4(7) of Regulation 2016/679, of the personal data contained in advertisements published on its online marketplace, cannot rely, in respect of an infringement of the obligations arising from Article 5(2) and Articles 24 to 26 and 32 of that regulation, on Articles 12 to 15 of that directive, relating to the liability of intermediary providers. This mostly seems to be about advertisers distributing content, not so much making it "effectively impossible to run a user-generated platform legally". Unless you think basic KYC for paying customers is "effectively impossible", perhaps.

deleted 11mo ago

[deleted]

mannyv 11mo ago

The case is about advertising, but the ruling is not limited to advertising. That's the problem.

rendx 11mo ago

I think the author, an American, is confusing common law and civil law. The ruling's language may be overly broad but in civil law countries like all of Europe, while it may be cited in other legal cases _as a supporting argument by one side or the other_, it will not fundamentally change law and it's not the catastrophy the post author makes it sound like. > There’s nothing inherently in the law or the ruling that limits its conclusions to “advertisements.” The same underlying factors would apply to any third party content on any website that is subject to the GDPR. False. A European court's conclusions are specifically around the case it is ruling about, so it is inherently limited to the exact circumstances of that case, without the need for it to specify that. They do not set precedent.