Embedded social media posts might now be illegal

https://maya.land/monologues/2021/09/21/illegal-fox-picture.html

by kixiQu • 5 years ago

116 55 5 years ago

maya.land

1MachineElf• 5 years ago

I appreciate the design of this blog.

dafoex2• 5 years ago

I do too. I know that's not what this post is about, but its refreshing to see someone not on the minimalist bandwagon.

MattGaiser• 5 years ago

Would any court let a company deliberately provide something for free and then later let them sue you for using it?

mdasen• 5 years ago

It wouldn't be Instagram suing you. It would be the owner of the photo that uploaded it to Instagram. By uploading it to Instagram, they're granting Instagram a license, but they aren't granting you a license. People can still claim copyright over the images they've uploaded to Instagram. Instagram has the right to sublicense content that has been uploaded, but they've explicitly said that they aren't doing that.

Nextgrid4• 5 years ago

It can be argued that by uploading the photo to a public website they have granted everyone a license to instruct computers to display that photo (that's literally what embeds do)?

Also, since Instagram has an embed feature, surely they have something in their ToS that ask the user to grant a license to Instagram to display the content not just on the main website but on any website that embeds the Instagram-hosted content?

cxr• 5 years ago

Your intuition about fairness matches a principle recognized by courts. The term for the applicable legal doctrine here is "estoppel". There's a strong argument to be made that if Instagram didn't make its (fairly unorthodox) position on embeds clear beforehand, then Newsweek's original use was reasonable and non-infringing (but not something that it can rely on indefinitely, esp. after Newsweek was notified that it did not have permission). There's another argument to be made, though, that the absence of an explicit prohibition is not necessary, due to copyright being an automatic negative right—that the burden is on Newsweek to obtain a clear license, not on anyone else to do any work explaining to Newsweek that it can't use it. This is a strong, argument, too, but probably weaker than the argument from estoppel.

nso• 5 years ago

As long as the internet is global, but laws governing it are made locally, will not this and similar issues get increasingly messy until we are left with a effed if you do effed if you don't?

Could these laws that are increasingly unfriendly to the cooperation that the internet enables slow down innovation and make it too risky to invest in many kind of online services?

Is it realistic to think that one day in the near future we will get some kind of global law governing these things, and if not what other options are there to resolve these issues?

lbotos• 5 years ago

GDPR sets a reasonable precedent (in the sense of what to expect, and it's a good thing for users, but also in this context, adds complexity for businesses.)

"The GDPR applies to companies outside the EU because it is extra-territorial in scope. Specifically, the law is designed not so much to regulate businesses as it is to protect the data subjects’ rights. A “data subject” is any person in the EU, including citizens, residents, and even, perhaps, visitors.

What this means in practice is that if you collect any personal data of people in the EU, you are required to comply with the GDPR. The data could be in the form of email addresses in a marketing list or the IP addresses of those who visit your website. (See our article explaining what is considered personal data under the GDPR.)

You may be wondering how the European Union will enforce a law in territory it does not control. The fact is, foreign governments help other countries enforce their laws through mutual assistance treaties and other mechanisms all the time. GDPR Article 50 addresses this question directly. So far, the EU’s reach has not been tested, but no doubt data protection authorities are exploring their options on a case-by-case basis." - https://gdpr.eu/compliance-checklist-us-companies/

bserge2• 5 years ago

An email address is PID?

My PoV is that an email address + first name in a mailing list should not be covered under GDPR.

William (billy69420@cbt.eu) does not identify anyone, does it?

rkagerer2• 5 years ago

Article 50 is not very specific.

For enforcement to have teeth outside their jurisdiction don't they either need assets or revenue streams in the EU which can be confiscated/leveraged, or else good old fashioned extradition treaties? And don't the latter typically require said crime to be illegal in both jurisdictions?

orangeoxidation• 5 years ago

What this means in practice is that if you collect any personal data of people in the EU, you are required to comply with the GDPR.

In practice almost everyone in and out of the EU violates the GDPR because it is simply not enforced.

Not because it's impossible to hold foreign companies responsible, but because the authorities aren't even trying (except the very occasional headline grabber).

pjc502• 5 years ago

I first got interested in this subject back in 2001 at the time of https://en.wikipedia.org/wiki/United_States_v._Elcom_Ltd. , where a Russian developer who'd made an ebook cracking tool was arrested as soon as he stepped off a plane in the US.

Since then there have been various problematic claims at universal jurisdiction, especially relating to money and gambling (poker sites serving the US, crypto regulation in general).

The situation remains .. stable, but fragmented around the edges. There's going to be a slow tick over of cases like this. I don't think it will affect investment, the "break the law and hope you become big enough to make a political win later" approach of Uber and AirBnB has become popular.

Global law is unlikely unless it's set by the US, and the US terms on privacy (very loose except for finances which are subject to total surveillance) is not in sync with the rest of the world.

usr11063• 5 years ago

In Germany it has been illegal for years to embed anything from social media. "Share on..." buttons like tweets or pics. Not because of licensing, but because it will lead to the social media platform tracking the user without consent. Even users that have no account on that social media and never given consent to anything.

Compliant sites show some placeholder in gray typically with appropriate warnings. If the reader wants to reveal the element they need to click first.

Disclaimer: Not a web developer, not living in Germany, but German as a mother tongue.

remus5• 5 years ago

That's interesting...do you know if there's any distinction made between social media embeds and just linking to external resources? I guess you could make a similar tracking argument for images linked from an external site (for example).

usr11063• 5 years ago

There is no difference between social media or not. You are not allowed to track without explicit consent.

giansegato• 5 years ago

This is not entirely true (disclaimer: living in Germany, with a German-based business).

You can embed social media.

What you can't do is embed a social media post without disclosing in the cookie notice (that must be approved beforehand) what will happen to the user due to you doing it.

the_gipsy4• 5 years ago

But isn’t the embedded element already setting cookies before the user can reject the cookie notice?

foxpurple• 5 years ago

I feel like the “server test” rule OP talks about doesn’t really matter and shouldn’t. Who cares if the browser downloaded it from Instagram or the site itself. The actual result is the same. It would make sense that embedding is exactly the same as reposting, either allowed or not allowed for both.

A similar situation is that I can listen to music on my phone with Spotify legally but if I plug my phone in to a speaker system and play the music for a large group in public, it’s no longer allowed. But the music actually came from Spotify so how is it different?

Tech people always feel entitled to loopholes in laws like “this file is just a bunch of bits, how can a number be illegal??” But this thinking is not useful for a functional legal system.

remus5• 5 years ago

I think the license to the copyright material is the important part here. In the instagram embedding example, the uploader (i.e. copyright holder) gives IG a broad license to the content that includes giving people the right to embed the IG post on external sites.

Spotify's license is obviously not going to include permission from the artist to broadcast the work to large audiences.

Dylan16807• 5 years ago

Who cares if the browser downloaded it from Instagram or the site itself.

Can we apply this logic to downloading copyrighted material? I would love it if I could openly and legally download ROMs of all my games and archives of prime time broadcast television.

But since that's not how the legal system works, it's pretty obvious that getting something from the licensed distributor is different from getting a copy made and distributed by someone else, even if it's automated.

But the music actually came from Spotify so how is it different?

The downloading is still legal. Spotify is still legal. The only problem is the new part you added. This is not analogous to the download vs. download comparison.

Tech people always feel entitled to loopholes in laws

You know the test came from a highly regarded court, right?

beowulfey• 5 years ago

Your spotify comparison does not really match perfectly. Playing for yourself (license permitted) vs playing for the public (license not permitted) is keeping the same content source but changing the end user.

With the photo, you are a single user browsing the photo on either website A or website B. Website A “owns” the photo, and website B has embedded it, but in both cases you are getting the photo from website A.

Since you are the same user both times, and are getting the photo from the same place both times, at first glance I would regard this as not breaking any license terms since the two parties (image host, end user) are the same, but I can accept that this is a point of contention.

pjc502• 5 years ago

Please note that this is about the copyright in the embedded post, not the personal data implications, and by "illegal" they mean "infringing", which is usually a civil matter and not a criminal one most of the time.

kixiQu• 5 years ago

https://en.wikipedia.org/wiki/Criminal_copyright_law_in_the_...

If the difference is awareness (demonstrated) and profiting off it, would a banner ad on the page be enough?

qwerty456127• 5 years ago

Do you see that fox photo?

No, I don't. Probably because I've blocked social widgets capable of tracking me.

netcan• 5 years ago

Intellectual property is a total mess.

IP has tumbled, stumbled and bumbled to its current state by way of haphazard precedents and half assed legislation. To the extent that it's intentionally tweaked (designed is too strong a word), it's adapted to protect high value industry or companies. What we're left with makes no sense.

Concepts like freedom of expression, the public domain, rights of artists and such have a part in IP's history, and rhetoric... but I can't think of any legislation, reform or regulatory/enforcement actions that actually set out to defend these.

I don't know if there's a one paragraph solution, but IP is central to a lot of centralisation phenomenon one way or another. The economic and legal dynamics of copyright, for example, centralize control over music revenues and often discovery. That's spotify now. It was record companies at one point. The first step in any commercial music endeavor, before a single note is played, is to separate artists from control and ownership of the music.

What the hell is the public benefit of giving social media sites these rights over content? If we accept T&C click throughs as valid contracts, the whole concept of determining content usage rights by agreement is absurd in practice.

A4ET8a8uTh0• 5 years ago

I agree. It is a mess. Worse than that. It creates a very avoidable burden and it takes away some interesting products from us. We were going over Zune case in our last MBA class and one of the things that clearly sunk the product ( as opposed to the Ipod ) was the way it attempts to please IP-holders resulting in god awful experience for the user ( https://answers.microsoft.com/en-us/musicandvideo/forum/all/... ). I am admittedly not an Apple fan, but I personally thought Zune was otherwise quite nifty and would have otherwise seen some adoption. IP craziness crushed it.

dxdm• 5 years ago

I find it strange that merely providing a link to something can be problematic here, when it's the user's browser that follows the link, and Instagram's server that decides what content to serve for it.

Can I get into hot water when the content of the link changes after I link to it?

But then, the judges might not know the tech well, while I don't know much about law. Maybe the intent of the embedder to have the content displayed by embedding a link to it is all that's needed here? Without their embedding, the viewer would not see the copyrighted content.

Interested to hear more knowledgeable perspectives that can elaborate on the legal basis of these decisions.

marcosdumay• 5 years ago

Hum... You are aiding in an illegal act.

You know perfectly well what the browser will do when presented to that link, you know the site doesn't follow the law, and you know your user will be harmed on this specific way. I don't see a problem with you being held responsible. (Also, civil laws have a tendency of spreading blame over as many parties as possible when the victim is seen as powerless. That's a very good tradition that the EU started by the way.)

If you didn't know that the linked site would misbehave, or what the browser would do, then you shouldn't be blamed. Still, if the victims are seen as very powerless compared to you, it's not rare for laws to still place you as an intermediary and require that you go settle your damages down with the other party. I think the GDPR shouldn't do that, but I don't know if it does.

tomerv• 5 years ago

Seems like Instagram should be on the hook here. They have a legal team, they have a license for the content, and they provide site owners with an easy way to embed content, but they don't provide the proper licensing for actually using it? Seems like some sort of entrapment - although I'm probably using that word incorrectly in the legal sense.

Suppose I put a bowl of cookies on my lawn with a "free cookie" sign. Then I sue anyone who takes a cookie - not for taking the cookie, but for stepping on my lawn. I don't think a court would be willing to accept my stance that I didn't provide a license to enter my property.

JasonFruit• 5 years ago

You see, the “server test” comes from the 9th Circuit, and is binding law in California, where most of the tech companies are.

This is a misunderstanding that has to stop: judicial opinions are not law! Judicial opinions represent a judge's interpretation of the law, and courts take such precedents into account, but precedent can be and is overturned. There are all manner of precedents that are clearly, absolutely wrong, and which have never happened to be reconsidered by another court in a similar case --- but that's no reason to allow yourself to be bound by them in your life. To change what is or is not legal, legislatures have to change laws.

The same, but less so, applies to mandates and orders issued by executive officials or agencies, at whatever level; they may be supported by law, but they are not themselves law, and since often the people making and enforcing those mandates and orders are not elected representatives, they do not have the authority that popular representation gives to actual laws.

smichel17• 5 years ago

Judicial precedent, also known as common law... https://en.m.wikipedia.org/wiki/Common_law

Embedded social media posts might now be illegal

Related Stories