Esimente del safe harbour ex artt. 14-16 d. lgs. 70-2003 + § 230 CDA + § 512 DMCA

SAfe harbour per una piattaforma di vendita/licenza di fotografie ?

L’appello del 2° circuito 10.02.2026, causa 23-7652, McGuchen v. Shutterstock, affronta il tema dell’applicabilita del porto sicuro ex § 512.(c). US Code title 17 in una lite azionat da un fotografo che vi aveva individuato molte sue fotografie.

I requisiti generali sono ravvisati .

La Corte invece propende per escludere i) quello per cui deve essere un trattamento sotto la direzione dell’utente (ivi, sub (1) IN GENERAL) e, ii) quello simile della assenza di beneficio economico se il “service provider has the right and ability to control such activity” (ivi, sub 1.B);

Sul primo , sub i) :

<<There is evidence in the record that suggests Shutterstock’s review of user images is neither cursory nor automatic. To begin, when a user submits an image to Shutterstock, the image does not immediately appear on the website; rather, the contributor must wait, sometimes for hours, until they receive an email from Shutterstock letting them know which of their images were accepted. See J. App’x at 1293, 1302, 1316. That fact is not dispositive, but it suggests some intervention by Shutterstock between a user upload and the appearance of material on the platform. Moreover, Shutterstock’s website states that it “has high standards and only accepts a portion of the images submitted to be included in [its] collection.” Id. at 1071. Indeed, Shutterstock maintains a page on its website that explains why an image might be rejected and provides advice for successful submissions. Id. at 1071–88. There are “30-odd” reasons that an image might be rejected by a Shutterstock reviewer, id. at 1294–95, which include focus, exposure, lighting, and noise, id. at 1071–75.
The record also contains evidence that Shutterstock’s reviewers exercise some subjective discretion even when applying seemingly rote and straightforward criteria. For instance, when considering an image’s focus, Shutterstock reviewers are “trained to know the difference between something that’s just out of focus and something that’s more intentional.” Id. at 1341–42. And according to Shutterstock, a reviewer may still accept an image that has focus issues if it is “a really unique shot” or a “hard shot to get.” Id. at 1297. That is because, as Shutterstock has explained, “there’s no way to predict what a customer is looking for,” so although “Shutterstock wants to have a high-quality library[,] . . . [t]here’s a lot of value in . . . shots that might not be perfect.” Id. at 1296–97; see also id. at 1366 (Shutterstock employee explaining that reviewers apply “a base guideline . . . but at the same time, it’s not a black-and-white standard”); id. at 1367 (“As our reviewers are humans, they obviously can think for [themselves]. We give them guidelines and we try to give them the best tools possible to review photos and to use their best judgment based on the guidelines we give them.”). In the end, as Shutterstock itself concedes, “photography is an art . . . you can’t just say, ‘This is yes, this is no.’” Id. at 1362. Together, these statements could lead a factfinder to conclude that Shutterstock’s reviewers exercise a considerable degree of case-by-case aesthetic or editorial judgment when determining which images to allow on the platform>>.

Ciò in applicazione del criterio astratto (importante ed espressamente enunciato) per cui <<if a service provider engages in manual, substantive, and discretionary review of user content—if, on a case-by-case basis, it imposes its own aesthetic, editorial, or marketing judgment on the content that appears on its platform—then its storage of infringing material is no longer “at the direction of a user.” In other words, “extensive, manual, and substantive” front-end screening of user content is not “accessibility-enhancing” and is not protected by the § 512(c) safe harbor. Mavrix, 873 F.3d at 1056. That is because, where service providers engage in their own discretionary screening of user content, they can no longer be said to be acting “solely to facilitate access by users.”>>

Sul secondo aspetto, sub ii):

<<There is evidence in the record suggesting “intrusions into user autonomy over their posts” that exceed the bounds set by Congress for the § 512(c) safe harbor. Vimeo II, 125 F.4th at 425. As an initial matter, Shutterstock screens every image before it appears on the platform—this screening determines whether an image ever gets on the platform. By way of contrast, in Vimeo II, “[c]alling attention to selected videos by giving them a sign of approval or displaying them on a Staff Picks channel . . . did not restrict the freedom of users to post whatever videos they wished.” Id. Also in contrast to Vimeo II, there is evidence here that Shutterstock’s image review goes beyond the limited purposes of restricting the site to “selected categories of consumer preferences” and excluding unlawful images. Id. Rather than engaging in categorical content screening—like accepting only holiday-themed images, or images that feature animals—Shutterstock appears to screen user images for their overall aesthetic quality. Curating a “collection,” J. App’x at 1071, of high-quality images is not the same as designing a website “that would be appealing to users with particular interests,” Vimeo II, 125 F.4th at 425.
Further, as McGucken has argued, there is some evidence in the record that Shutterstock extensively advises potential contributors on the types of images it is likely to accept. See J. App’x at 1071–88. That is unlike the service provider in Vimeo II, which “encouraged users to create certain types of content,” but did not condition their ability to post material on whether they created the provider’s preferred types of content. Vimeo II, 125 F.4th at 416. Indeed, in Vimeo II, we cited a website’s practice of giving “its users extensive advice on content” as one fact that can distinguish a service provider that has the right and ability to control infringing activity from one that does not. Id. at 423 (citing Cybernet, 213 F. Supp. 2d at 1173). Accordingly, on the current record, a reasonable factfinder might conclude that the advice and instruction Shutterstock provides its contributors, coupled with its image screening process, are sufficiently coercive to constitute substantial influence.

Finally, for the same reasons articulated above, the duration of Shutterstock’s image review and its 93 percent approval rate are relevant facts, but they are not dispositive. See supra Section II.B.3. Ultimately, it is the factfinder’s role to determine the degree and significance of Shutterstock’s solicitation and screening of user content.>>

Le funzioni di hash-matching dei video, usate da Youtube, producono sempre red flags nel caso di violazioni copyright, tali da far perdere a Youtube il safe harbour ex DMCA § 512(c)?

E’ negativa la risposta dell’ 11° circuito 07 gennaio 2026, caso n. 23-13156, Athos c. Youtube :

<<In sum, as to curation and moderation technologies, the rec-
ord reflects agreement between the parties that YouTube can algo-
rithmically suggest and auto-play videos, can remove users and vid-
eos from the site, and can set its own guidelines for users and up-
loaded content on the site.
With respect to the hashing technologies, the record does
not support Athos’ factual assertions. YouTube does not run Con-
tent ID (or any of its other copyright management tools) automat-
ically or universally for all videos uploaded to the YouTube website.
Athos, moreover, has offered no evidence that any of YouTube’s
video-hash-matching or other tools have any functionality to per-
form a legal analysis of whether an identified video-hash match
constitutes copyright infringement. In fact, YouTube has pre-
sented unrebutted evidence that all of its copyright management
tools were designed with user input and management in mind be-
cause it would be unfeasible for YouTube to operate the tools by
itself without such input. Athos simply has not identified any ma-
terial facts in dispute>>. p. 16.

Poi: <<So the simple accumulation of adequately-addressed DMCA
takedown requests alone cannot amount to red flag knowledge of
other infringing activity which precludes safe-harbor protection.
See id. And “the copyright owner cannot short-circuit the notifica-
tion procedure through a blanket notification;” the DMCA consid-
ers such an attempt a failed notification “and therefore counts it as
of no effect.” Id. at 12B-82–83. Because Athos bases its red flag
knowledge argument on the volume of DMCA takedown requests
it has submitted to YouTube, and on YouTube’s refusal to remove
additional content not noticed in those takedown requests, see Ap-
pellant’s Br. at 19–20, Nimmer’s criticism of Viacom and UMG has
no effect on our resolution of the red flag knowledge issue in this
case>>, p. 23.

Ancora: << The record reflects that the copyright management tools
could not have provided YouTube with actual knowledge because
they were never used in the manner Athos suggests. As discussed
earlier, Athos has not presented evidence that any of the video-
hash-matching tools it argues were designed to provide actual
knowledge are operated automatically or universally by YouTube.
Even if it had made such a showing, the video-hash matches gen-
erated by YouTube’s technologies, as we understand them from
this record, cannot give YouTube actual knowledge of infringing
material because the tools do not perform any analysis to deter-
mine whether the hash matches they generate are legally infringing
or not.
Without any kind of additional analysis being performed by
the copyright management tools or YouTube employees,
YouTube cannot have “actually or ‘subjectively’ [known] of spe-
cific infringement,” because the tools at most produce lists of possible infringement. See Viacom, 676 F.3d at 31. See also BWP Me-
dia USA, Inc. v. Clarity Digit. Grp., LLC, 820 F.3d 1175, 1181 (10th Cir.
2016) (explaining that “if the infringing content has merely gone
through a screening or automated process, the [internet service
provider] will generally benefit from the safe harbor’s protection”).
To require YouTube to not only run its copyright management
tools in the manner Athos suggests, but to then analyze the fruits
of those tools to locate other instances of infringement, would
amount to requiring YouTube to “affirmatively [seek] facts indicat-
ing infringing activity,” in direct contravention of the balance es-
tablished by Congress in the DMCA. See § 512(m)(1). Athos has
not shown that YouTube failed to expeditiously remove any in-
fringing material it had actual knowledge of>>, p. 24/5.

Sub B c’è una breve ma chiara spiegazione tecnica delle funzioni di hash-matching predisposte da Youtube.

La sentenza è utile anche per noi, dato che la disciplina posta (ora) dall’art. 6 del DSA reg. UE 2022/2065 non è così diversa.

Ancora su strumenti anticontraffazione di Youtube e sui suoi algoritmi, in relazione ai “notice and takedown” e al safe harbour ex art. 512(c).1 DMCA statunitense

L’appello dell’ 11° circuito in Athos c. Youtube USCA 7 gennaio 2026, case: 23-13156, decide che ci sono gli estremi per rinoscere a Youtube-Google il safe harbour previsto dal DMCA (vedilo qui).

Il succo sta alle pp 27-29:

“We conclude with the alleged right and ability of YouTube
to control infringing material it purportedly derives a direct finan-
cial benefit from. Agreeing with the Second Circuit’s consideration
of an equivalent issue in Vimeo II, we hold that YouTube’s moder-
ation and content management features do not constitute a right
and ability to control for purposes of the DMCA. We therefore do
not address whether YouTube receives a direct financial benefit
from infringing material.
The right and ability to control “requires ‘something more’
than the mere ability to remove or block access to materials on [the
service provider’s] website.” Vimeo II, 125 F.4th at 423. The service
provider must exert “‘substantial influence’ on user activities” or
otherwise have “induced the infringing activity.” Id. at 423–24.
In Vimeo II, the Second Circuit explained that “[c]alling at-
tention to selected videos by giving them a sign of approval or dis-
playing them on a Staff Picks channel (or the contrary, by demoting
them) did not restrict the freedom of users to post whatever videos
they wished.” Id. at 425. It also concluded that, given the “huge
number of videos posted by users on Vimeo,” the plaintiffs there
had failed to show that Vimeo staff had intervened in more than a
“tiny percentage.” Id. In its view, “denial of eligibility for the safe
harbor based on such noncoercive exercises of control over only a
small percentage of postings would undermine, rather than carry
out, Congress’[ ] purposes in establishing the safe harbor.” Id. at
426.
We agree with the Second Circuit, and conclude that the
same reasoning applies here, where the record reflects only that
YouTube can remove material and users from its website, can pro-
mote and auto-play select videos algorithmically, and can set
policies for content moderation on the site. The record contains
no evidence that YouTube exercises control over any more sub-
stantial a portion of the YouTube website than did Vimeo in Vimeo
II.
None of the identified “noncoercive exercises of control” on
the part of YouTube amount to substantial influence over user ac-
tivity sufficient to establish it had the right and ability to control
any infringing material at issue in this case. See id. “To interpret
this provision as [Athos] argue[s]—to deny [YouTube] access to the
safe harbor merely because of the tiny influences it exercised—
would subject [YouTube] to a huge expense in monitoring millions
of posts to protect itself against the possibility of liability for in-
fringements.” Id. at 426–27. Athos’ approach would have us upset
the balance between copyright owners and service providers struck
by Congress in the DMCA. If that balance is to be recalibrated, it
is a matter for Congress”.

Non troppo diversa da noi la disciplina del nostro DSA europeo , art. 6 (a parte il requisito dell ‘tile economico, da noi assente)-

Ancora sulla responsabilità delle piattaforme per violazione di copyright e sul safe harbour ex § 512 DMCA

Il 9 circuito 13.01.2025, 21-2949(L) Capitol Records v. Vimeo nega la resp. di Vimeo specificando la red flag data dalla competenza di un dipendente.

Ribadisce inoltre che serve la conoscenza della illiceità dei file contestati, non di una generica possibile/probabile illiceità all’interno di tutti i materiali ospitati.

<<However, we also acknowledged in Vimeo I that it is “entirely possible that an employee of the service provider who viewed a video did have expertise or knowledge with respect to the market for music and the laws of copyright.” Id. at 97 (emphasis added). Thus, as an alternative way to establish red flag knowledge, a plaintiff could produce evidence to demonstrate that an employee (1) was not an “ordinary person” unfamiliar with these fields, and (2) was aware of facts that would make infringement objectively obvious to a person possessing such specialized knowledge. See id.
We noted, though, that “[e]ven an employee who was a copyright expert cannot be expected to know when use of a copyrighted song has been licensed,” id., and, as discussed below, even a copyright expert may similarly struggle to identify instances of fair use.
Thus, in order to carry their burden of demonstrating that Vimeo had actual or red flag knowledge of the specific instances of infringement, Plaintiffs needed to show that Vimeo employees were aware of facts making it obvious to (a) a person who has no specialized knowledge or (b) a person that Plaintiffs have demonstrated does possess specialized knowledge that: (1) the videos contained copyrighted music; (2) the use of the music was not licensed; and (3) the use did not constitute fair use>>.

Poi

<<The fact that licensing music, as a general matter, can be challenging or confusing does not make it obvious that music accompanying a particular user-uploaded video was not licensed. Even if a person without specialized knowledge would have intuited a likelihood that many of the posted videos were not authorized, that would not make it obvious that a particular video lacked authorization to use the music.

This is all the more true in view of the uncontested fact that, since 2011, Vimeo had run a store from which users could purchase licenses to use music in videos. Accordingly, Vimeo employees were aware of the existence of simplified opportunities available to purchase licenses. Furthermore, because Plaintiffs have not proved that Vimeo employees had specialized knowledge of the music industry, those employees’ awareness that music found on their videos was under copyright did not show that they knew whether the music they heard on user videos came from EMI or another label. Plaintiffs’ evidence does not support it being apparent to Vimeo employees that the music they heard on any particular video came from a label that did not offer licenses through Vimeo’s store or otherwise.

Plaintiffs also rely on the contention that EMI’s cease-and-desist letter, sent to Vimeo in 2008, put Vimeo employees on notice that any EMI music used on the website was unauthorized. Plaintiffs cite EMI Christian Music Grp., Inc. v. MP3tunes, LLC, 844 F.3d 79, 93 (2d Cir. 2016), where we explained that the defendant’s subjective awareness that there had been no legal online distribution of Beatles songs could support red flag knowledge that any online electronic copies of Beatles songs on defendant’s servers were unlicensed. But the same logic does not necessarily apply here. As the district court pointed out, an awareness that EMI sent a letter in the past demanding removal of its music gave no assurance that EMI did not thereafter make contracts licensing the use of its music, especially in view of evidence that some users who posted the videos containing EMI music asserted that EMI had provided them with authorization to use the music. The DMCA does not require service providers to perform research on mere suspicion of a user’s infringement to determine the identity of the music in the user’s video, identify its source, and determine whether the user acquired a license. See Vimeo I, 826 F.3d at 98-99 (explaining, in the context of a contention of willful blindness, that requiring service providers “constantly to take stock of all information their employees may have acquired that might suggest the presence of infringements in user postings, and to undertake monitoring investigations whenever some level of suspicion was surpassed, . . . would largely undo the value of § 512(m)”).
Even if we concluded that Vimeo had red flag knowledge that EMI’s music in user videos was not authorized or licensed, that would be insufficient to satisfy Plaintiffs’ burden. Plaintiffs needed in addition to show that it would be apparent to a person without specialized knowledge of copyright law, or, alternatively, persons who have been demonstrated to possess specialized knowledge of copyright law, that the particular use of the music in the Videos-in-Suit was not fair use>>.

(segnalazione e link offerti dal blog di Eric Goldman)

Inibitoria contro Cloudfare per coviolazione del diritto di autore

Interessante ordinanza cautelare (contumaciale) di Trib. Roma Sez. spec. in materia di imprese, Ord., 03/06/2024, n. 1569, Rg 14261/2024, RTI (gruppo Mediaset) v. Cloudfare, pubblicata in Altalex da Maurizio De Giorgi , ove link al testo.

Spunti principali:

1) la analitica descrizione del lato tecnico, in particolare del ruolo di Cloudfare, essenzialmente volto a dare l’anonimato ai suoi clienti ma non solo (piattaforma usata anche da Twitter in Brasile nella sua recente lite col governo )

2) l’esame delle questioni di giurisdizione e competenza;

3) il rapporto tra concorso ex art. 2055 cc (affermato) ed esimente ex art. 14, 15, 16 d gls 70/2003 (non affrontata ma -direi- implicitamente negata):

<<Ciò posto, a prescindere dalla qualificazione della resistente come hosting provider e, quindi, dalla questione della responsabilità degli internet service providers anche alla luce della recente giurisprudenza comunitaria, peraltro posta in maniera implicita, l’attività da essa svolta così come prospettata dalla ricorrente appare potersi configurare come un’attività di concorso nella realizzazione degli illeciti compiuti da terzi inquadrabile nell’ambito della fattispecie di cui all’art. 2055 c.c..
In particolare, sussiste, prima facie, nella cognizione tipica della presente fase cautelare, la prova che attraverso i nomi a dominio “G.” in tutte le variate declinazioni sono stati posti a disposizione del pubblico i programmi su cui la R.T.s.p.a. detiene i diritti di sfruttamento economico per l’Italia, senza autorizzazione e, pertanto, in violazione del diritto d’autore della ricorrente.
Dall’analisi espletata dalla S. srl, su incarico della ricorrente, è emerso che il sito noto con il nome di G. ha variato decine di estensioni del nome a dominio e che si serve dei servizi di C..

E’ emerso, altresì, che il sito offre un catalogo indicizzato di prodotti audiovisivi e li rende accessibili e fruibili mediante la pubblicazione di collegamenti ipertestuali (link) a risorse terze (cd. file hosting o cyberlocker) per il download o per lo streaming e che l’aggiornamento dei contenuti viene svolto dalla sola amministrazione del sito mentre l’utente finale può fruire dei contenuti la cui ricerca viene agevolata dalle funzioni del sito stesso.
E’ emerso che C. agisce, quindi, come un intermediario tra il visitatore del sito e il server di origine, migliorando le prestazioni, aumentando la sicurezza e fornendo una serie di servizi aggiuntivi per ottimizzare l’esperienza dell’utente e proteggere il sito dai rischi online. Tutti i domini sfruttati da G. hanno in comune l’uso di tali servizi, ciò è riscontrabile anche dalla consultazione dei registri pubblici ottenute dalle interrogazioni D. di tutti i nomi dominio oggi riferiti a G., il N. risulta essere il comune servizio di Registrar usato per l’acquisto dei nomi di dominio e C. risulta essere l’ intermediario dei servizi internet sfruttato da tutti i domini>>

Motivazione poco lineare: la non invocabilità dell’esimente (questione logicamente antecedente l’invocabilità dell’art. 2055cc) andava argomentata, non ritenuta irrilevante (“a prescidnere”).

L’algoritmo di Tiktok , decidendo il feed degli utenti,. fa si che la piattaforma sia corresponsabile dei loro conteuti

Eric Goldman ci informa sull’appello del 3 circuito n. 22-3061,TAWAINNA ANDERSON, v. TIKTOK, INC.; BYTEDANCE, INC, 27.08.2024. relativo ad uno dei purtroppo frequenti demenziali video di challenge, che spingono giovani e giovanissimi a sfide pericolosissime (asfissia)

Per il collegio, il fatto che il newsfeed sia governato da TikTok fa si che i materiali caricati siano attribuibili non solo all’utente, ma anche a Tik Tok, ai fini del safe harbour ex §230 CDA.

Si tratta quindi non di third-party speech ma di first-party speech.

Tesi che, dice il 3 Circ. , è confermata dalla sentenza della Corte Suprema Moody v. NetChoice, LLC del 2024, per la quale spetta alle piattaforme la tutela del diritto di parola: ne sopportino allora le coerenti conseguenze circa il § 230 CDA.

DA noi l’art. 6 del DSA (reg. UE 2022/2065) ha diversa formulazione: irresponsabilità per “informazioni memorizzate su richiesta di un destinatario”, purchè non sappia o rimuova immediatamente.

Ma il tema si pone lo stesso, alla luce della copiosa giurisprudenza nazionale ed europea sul punto, pur legata alla precedenti disposizioni (d lgs 70 del 2003 e dir. UE 2000/31) (v concetto di hosting provider “attivo”)

Ancora sulla responsabilità degli internet provider per le violazioni copyright dei loro utenti (con un cenno a Twitter v. Taamneh della Corte Suprema USA, 2023)

Approfondita sentenza (segnalata e linkata da Eric Goldman, che va sempre ringraziato) US BANKRUPTCY COURT-SOUTHERN DISTRICT OF NEW YORK, In re: FRONTIER COMMUNICATIONS CORPORATION, et al., Reorganized Debtors, Case No. 20-22476 (MG), del 27 marzo 2024.

Si v. spt. :

-sub III.A, p. 13 ss, “Secondary Liability for Copyright Infringement Is a Well-Established Doctrine”;

– sub III.B “Purpose and Effect of DMCA § 512”, 24 ss.

– sub III.D “Twitter Did Not Silently Rewrite Well-Established Jurisprudence on Secondary Liability for Copyright Infringement” p. 31 ss sul rapporto tra la disciplina delle violazioni copyright e la importante sentenza della Corte Suprema Twitter, Inc. v. Taamneh, 598 U.S. 471 (2023).

Di quest’ultima riporto due passaggi dal Syllabus iniziale:

– la causa petendi degli attori contro Twitter (e Facebook e Google):

<< Plaintiffs allege that defendants aided and abetted ISIS in the
following ways: First, they provided social-media platforms, which are
generally available to the internet-using public; ISIS was able to up-
load content to those platforms and connect with third parties on them.
Second, defendants’ recommendation algorithms matched ISIS-re-
lated content to users most likely to be interested in that content. And,
third, defendants knew that ISIS was uploading this content but took
insufficient steps to ensure that its content was removed. Plaintiffs do
not allege that ISIS or Masharipov used defendants’ platforms to plan
or coordinate the Reina attack. Nor do plaintiffs allege that defend-
ants gave ISIS any special treatment or words of encouragement. Nor
is there reason to think that defendants carefully screened any content
before allowing users to upload it onto their platforms>>

– La risposta della SCOTUS:

<<None of plaintiffs’ allegations suggest that defendants culpably “associate[d themselves] with” the Reina attack, “participate[d] in it as
something that [they] wishe[d] to bring about,” or sought “by [their]
action to make it succeed.” Nye & Nissen, 336 U. S., at 619 (internal
quotation marks omitted). Defendants’ mere creation of their media
platforms is no more culpable than the creation of email, cell phones,
or the internet generally. And defendants’ recommendation algorithms are merely part of the infrastructure through which all the content on their platforms is filtered. Moreover, the algorithms have been presented as agnostic as to the nature of the content. At bottom, the allegations here rest less on affirmative misconduct and more on passive nonfeasance. To impose aiding-and-abetting liability for passive nonfeasance, plaintiffs must make a strong showing of assistance and scienter. Plaintiffs fail to do so.
First, the relationship between defendants and the Reina attack is
highly attenuated. Plaintiffs make no allegations that defendants’ relationship with ISIS was significantly different from their arm’s
length, passive, and largely indifferent relationship with most users.
And their relationship with the Reina attack is even further removed,
given the lack of allegations connecting the Reina attack with ISIS’ use
of these platforms. Second, plaintiffs provide no reason to think that
defendants were consciously trying to help or otherwise participate in
the Reina attack, and they point to no actions that would normally
support an aiding-and-abetting claim.
Plaintiffs’ complaint rests heavily on defendants’ failure to act; yet
plaintiffs identify no duty that would require defendants or other communication-providing services to terminate customers after discovering that the customers were using the service for illicit ends. Even if
such a duty existed in this case, it would not transform defendants’
distant inaction into knowing and substantial assistance that could
establish aiding and abetting the Reina attack. And the expansive
scope of plaintiffs’ claims would necessarily hold defendants liable as
having aided and abetted each and every ISIS terrorist act committed
anywhere in the world. The allegations plaintiffs make here are not
the type of pervasive, systemic, and culpable assistance to a series of
terrorist activities that could be described as aiding and abetting each
terrorist act by ISIS.
In this case, the failure to allege that the platforms here do more
than transmit information by billions of people—most of whom use the
platforms for interactions that once took place via mail, on the phone,
or in public areas—is insufficient to state a claim that defendants
knowingly gave substantial assistance and thereby aided and abetted
ISIS’ acts. A contrary conclusion would effectively hold any sort of
communications provider liable for any sort of wrongdoing merely for
knowing that the wrongdoers were using its services and failing to stop
them. That would run roughshod over the typical limits on tort liability and unmoor aiding and abetting from culpability>>.

La norma asseritamente violata dalle piattaforme era il 18 U.S. Code § 2333 (d) (2), secondo cui : <<2) Liability.— In an action under subsection (a) for an injury arising from an act of international terrorism committed, planned, or authorized by an organization that had been designated as a foreign terrorist organization under section 219 of the Immigration and Nationality Act (8 U.S.C. 1189), as of the date on which such act of international terrorism was committed, planned, or authorized, liability may be asserted as to any person who aids and abets, by knowingly providing substantial assistance, or who conspires with the person who committed such an act of international terrorism>>.

Apple è responsabile per i danni prodotti da una sua “malicious app” oppure è protetta dal safe harbour ex § 230 CDA?

Eric Goldman ci notizia di e ci dà il link alla sentenza di appello del 9 circuito 27.03.2024, No. 22-16514, Hadona Diep v. Apple .

Dismissed le azioni “counts I (violation of the Computer
Fraud and Abuse Act), II (violation of the Electronic Communications Privacy
Act), III (violation of California’s Consumer Privacy Act), VI (violation of
Maryland’s Wiretapping and Electronic Surveillance Act), VII (additional
violation of Maryland’s Wiretapping and Electronic Surveillance Act), VIII
(violation of Maryland’s Personal Information Protection Act), and X (negligence)
of the complaint”.

Invece il § 230 CDA non protegge da azioni basate sulle leggi statali proconsumatori nè da altra come comncorrenza sleale:

<<The claims asserted in counts IV (violation of California’s Unfair
Competition Law (“UCL”)), V (violation of California’s Legal Remedies Act
(“CLRA”)), and IX (liability under Maryland’s Consumer Protection Act
(“MCPA”)) are not barred by the CDA. These state law consumer protection
claims do not arise from Apple’s publication decisions as to whether to authorize
Toast Plus. Rather, these claims seek to hold Apple liable for its own
representations concerning the App Store and Apple’s process for reviewing the
applications available there. Because Apple is the primary “information content
provider” with respect to those statements, section 230(c)(1) does not apply. See
Carafano v. Metrosplash.com, Inc., 339 F.3d 1119, 1124–25 (9th Cir. 2003)
(examining which party “provide[d] the essential published content”)>>.

Nemmeno queste azioni sonio impedite da patti su Limitation of liability (anche se qui di non interesse)

Il safe harbor ex § 230 CDA per Youtube in caso di accessi abusivi frodatori ad account altrui

Interessante lite sull’applicabilità del § 230 CDA statunitense a Youtube per allegate violazioni informatiche a fini di frode in account altrui (tra cui quello di Steve Wozniak) .

E’ ora giunta la decisione del 6° appellate district 15 marzo 2024, H050042
(Santa Clara County Super. Ct. No. 20CV370338), Wozniak e altri c. Youtube), che sostanzialmente conferma il rigetto del primo grado (lasciando aperta agli attori solo una piccola finestra).

La fattispecie è interessante per l’operatore. Gli attori avevano diligentemente cercato di aggirare il safe harbour, argomentando in vario modo che gli addebiti a Y. erano di fatti propri (cioè di Y.), anzichè di mera condotta editoriale di informazioni altrui (per cui opera il safe harbor). Ragioni che la corte (anzi gli attori) avevano raggruppato in sei categorie:

a. Negligent security claim

b. Negligent design claim

c. Negligent failure to warn claim

d. Claims based on knowingly selling and delivering scam ads and
scam video recommendations to vulnerable users

e. Claims based on wrongful disclosure and misuse of plaintiffs’
personal information

f. Claims based on defendants’ creation or development of
information materially contributing to scam ads and videos

Ma per la corte non si può arrivare a qualificarle come condotte proprie di Y. ai sensi del § 230 CDA , ma solo dei terzi frodatori (sub ii Material contributions, 34 ss).

Concede però parziale Leave to amend, p. 36.

I profili allegati dagli attorei sono utili pure da noi, perchè il problema è sostanzialmente simile: quello del capire se le notizie lesive pubblicate possono dirsi solo del terzo oppure anche della piattaforma (art. 6 reg. UE DSA 2022/2065)

(notizia della e link alla sentenza dal blog di Eric Goldman)

Trib. Roma sulla responsabilità del provider per materuiali caricati dagli utenti

Eleonora Rosati su IPKat ci notizia di (e ci linka a) due sentenza 2023 di Trib. Roma sez. spec. impr. sull’oggetto, entrambe tra RTI (attore) e una piattaforma di hosting files (Vimeo e V Kontacte).

Le domande sono respinte, alla luce del precedente della Corte di Giustizia Cyando del 2021.

Si tratta di :

– Trib. Roma 07.04.2023 n. 5700/2023, RG 59780/2017, Giudice rel. Picaro, RTI c. Vimeo;

– Trib. Roma 12.10.2023 n. 14531/2023, RG 4341/2027, giud. rel.: Cavaliere, RTI v. V Kontakte;

Per Rosati la lettura del pcedente europeo è errata.

Qui io solo evidenzio che i) civilisticamente non ha dignità giuridica da noi la distinzine tra responsabilità primaria e secondaria/indiretta nel caso di materiali illeciti caricati dagli utenti e ii) il safe harbour copre ogni responsabilità da esso conseguente.

Il punto più importante è che, per perdere il safe harbour, bisogna che il provider avesse contezza dell’esistenza degli specifici illeciti azionati, non di una loro generica possibilità.

Altra questione poi è quella del livello di dettaglio della denuncia al provider da parte del titolare dei diritti. Per il Trib. deve essere elevato: ed è esatto, stante il principio per cui onus probandi incumbit ei qui dicit , regola processuale che va applicata anche alla denuncia de qua (nè c’è ragione per caricare il provider di attività faticose e incerte, a meno che tali non siano più per ragioni ad es. di avanzamento tecnologico).