Esimente del safe harbour ex artt. 14-16 d. lgs. 70-2003 + § 230 CDA + § 512 DMCA

Doveri di data protection del titolare di piattaforma di marketplace on line, doveri che non vengono inibiti dal safe harbour ex dir. 2000/31

Interessanti questioni decise dalla CG 02.12.2025, C-492/23, X c. Russiamedia Digital+1, concernenti il mancato blocco di un annuncio lesivo della privacy comparso sulla piattaforma www.public24.ro della Russmedia Digital.

Le quattro questioni sollevate dal giudice di appello rumeno:

«1) Se gli articoli da 12 a 14 della [direttiva 2000/31] si applichino anche a un prestatore di servizi [della società dell’]informazione del tipo memorizzazione-hosting che mette a disposizione degli utenti un sito in cui possono essere pubblicati annunci gratuiti o a pagamento, il quale sostiene che il suo ruolo nella pubblicazione degli annunci degli utenti è puramente tecnico (messa a disposizione della piattaforma), ma che, attraverso i termini e le condizioni generali di utilizzo del sito, indica di non rivendicare un diritto di proprietà sui contenuti forniti o pubblicati, caricati o trasmessi, conservando però il diritto di utilizzare i contenuti, incluso copiarli, distribuirli, trasmetterli, pubblicarli, riprodurli, modificarli, tradurli, cederli a partner e rimuoverli in qualunque momento, anche senza aver bisogno di un motivo in tal senso.

2) Se, secondo l’interpretazione dell’articolo 2, paragrafo 4, dell’articolo 4, punti 7 e 11, dell’articolo 5, paragrafo 1, lettera f), dell’articolo 6, paragrafo 1, lettera a), degli articoli 7, 24 e 25 del [RGPD] e dell’articolo 15 della direttiva 2000/31, un siffatto prestatore di servizi [della società dell’] informazione del tipo memorizzazione-hosting, che è titolare del trattamento dei dati personali, sia tenuto a verificare prima della pubblicazione di un annuncio se vi sia identità tra la persona che pubblica l’annuncio e il proprietario dei dati personali a cui si riferisce l’annuncio.

3) Se, secondo l’interpretazione dell’articolo 2, paragrafo 4, dell’articolo 4, punti 7 e 11, dell’articolo 5, paragrafo 1, lettera f), dell’articolo 6, paragrafo 1, lettera a), degli articoli 7, 24 e 25 del [RGPD] e dell’articolo 15 della direttiva 2000/31/CE, un siffatto prestatore di servizi [della società dell’]informazione del tipo memorizzazione-hosting, che è titolare del trattamento dei dati personali, sia tenuto a verificare previamente il contenuto degli annunci spediti da utenti, al fine di escludere quelli aventi un possibile carattere illecito o che possono pregiudicare la vita privata e familiare di una persona.

4) Se, secondo l’interpretazione dell’articolo 5, paragrafo 1, lettere b) e f), degli articoli 24 e 25 del [RGPD] e dell’articolo 15 della direttiva 2000/31, un siffatto prestatore di servizi [della società dell’]informazione del tipo memorizzazione-hosting, che è titolare del trattamento dei dati personali, sia tenuto ad applicare misure di salvaguardia tali da impedire o limitare la riproduzione e la ridistribuzione del contenuto degli annunci pubblicati per il suo tramite».

Risposta alla seconda e terza questione :

“L’articolo 5, paragrafo 2, e gli articoli da 24 a 26 del regolamento (UE) 2016/679 del Parlamento europeo e del Consiglio, del 27 aprile 2016, relativo alla protezione delle persone fisiche con riguardo al trattamento dei dati personali, nonché alla libera circolazione di tali dati e che abroga la direttiva 95/46/CE (regolamento generale sulla protezione dei dati),

devono essere interpretati nel senso che:

il gestore di un mercato online, in quanto titolare, ai sensi dell’articolo 4, punto 7, di tale regolamento, del trattamento dei dati personali contenuti in annunci pubblicati nel suo mercato online, è tenuto, prima di pubblicare gli annunci, e mediante misure tecniche e organizzative adeguate,

– ad individuare gli annunci che contengono dati sensibili, a norma dell’articolo 9, paragrafo 1, di detto regolamento;

– a verificare se l’utente inserzionista che si appresta a collocare un annuncio di questo tipo sia la persona i cui dati sensibili figurano in tale annuncio e, in caso contrario,

– a rifiutare la pubblicazione di quest’ultimo, a meno che tale utente inserzionista possa dimostrare che la persona interessata ha prestato il proprio consenso esplicito affinché i dati in questione siano pubblicati in tale mercato online, ai sensi di detto articolo 9, paragrafo 2, lettera a), o che sia soddisfatta una delle altre eccezioni previste da tale articolo 9, paragrafo 2, lettere da b) a j)”.

Risultato quasi scontato, alla luce degli artt 24-26 GDPR.

Riposta alla quarta questione:

“l’articolo 32 del RGPD deve essere interpretato nel senso che il gestore di un mercato online, in quanto titolare, ai sensi dell’articolo 4, punto 7, di tale regolamento, del trattamento dei dati personali contenuti in annunci pubblicati nel suo mercato online, è tenuto a mettere in atto misure di sicurezza tecniche e organizzative adeguate al fine di impedire che annunci ivi pubblicati e contenenti dati sensibili, a norma dell’articolo 9, paragrafo 1, di detto regolamento, siano riprodotti e illecitamente pubblicati su altri siti Internet”.

Idem come sopra.

Risposta alla prima questione:

“l’articolo 1, paragrafo 5, della direttiva 2000/31 e l’articolo 2, paragrafo 4, del RGPD devono essere interpretati nel senso che il gestore di un mercato online, in quanto titolare, ai sensi dell’articolo 4, punto 7, del RGPD, del trattamento dei dati personali contenuti in annunci pubblicati nel suo mercato online, non può invocare – a fronte di una violazione degli obblighi derivanti dall’articolo 5, paragrafo 2, e dagli articoli da 24 a 26 e 32 di tale regolamento – gli articoli da 12 a 15 di detta direttiva relativi alla responsabilità dei prestatori intermediari“.

Era la questione più interessante. Il suo esito però non soprende: il safe harbor UE ex dir. 2000/31 riguarda la responsabilità per fatti altrui (dell’utente), non del provider. Qui invece le censure di negligenza organizzativa riguardano la condotta di quest’ultimo.

Safe harbour a Meta per “difettosità” nella progettazione di Instagram (induzione al suo uso compulsivo) ? Non spetta, dice la Corte Suprema del Massachusetts

Il prof. Eric Goldman ci riferisce della sentenza Massachusetts Supreme Court COMMONWEALTH vs. META PLATFORMS, INC, 10 aprile 2026, SJC-13747, sulla pretese pratiche commerciali sleali di Meta consistenti nella manipolazione psicologica degli utenti IOnstagram

The Commonwealth alleges that Meta
Platforms, Inc., and Instagram, LLC (collectively, Meta),
engaged in unfair business practices by designing the Instagram
platform to induce compulsive use by children, engaged in
deceptive business practices by deliberately misleading the
public about the safety of the platform, and created a public
nuisance by engaging in these unfair and deceptive practices.
Meta moved to dismiss the complaint, arguing, inter alia, that
§ 230 of the Communications Decency Act of 1996 (CDA), 47 U.S.C.
§ 230 (§ 230), barred the claims.

Beh, dice la SC, il safe harbour ex § 230 of the Communications Decency Act of 1996 (CDA), 47 U.S.C. (“(c) (1) Treatment of publisher or speaker – No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider“) non si applica : infatti qui la condotta censurata appartiene solo a Meta, mentre la norma richiede che si tratti di informazione illecita proveniente da terzi, non dall’editore.

In particolare:

c. Unfair business practices (count I). The unfair
business practices claim does not seek to hold Meta liable based
on the content of the information Meta publishes and as such
does not meet the content element. The challenged design
features (e.g., infinite scroll, autoplay, IVR, and ephemeral
content) concern how, whether, and for how long information is
published, but the published information itself is not the
source of the harm alleged. Instead, the claim alleges that the
features themselves induce compulsive use independent of the
content provided by third-party users.
Meta contends that the unfair business practices claim
treats it as a publisher of third-party information because, in
the absence of third-party content, the design features could
not facilitate addiction in young users. But the fact that the
features require some content to function is not controlling;
instead, as discussed supra, to satisfy the content element, we
look to whether the claim seeks to hold Meta liable for harm
stemming from third-party information that it published. Here,
the unfair business practices claim does not; the Commonwealth
alleges that the features themselves prolong users’ time on the
platform, not that any information contained in third-party
posts does so. In this sense, the claim is indifferent as to
the content published.29 Consequently, the unfair business
practices claim in count I does not treat Meta as a publisher of
information, and § 230(c)(1) immunity does not apply. (…)

Contrary to Meta’s argument, the fact that a claim concerns
publishing activities, including the use of algorithms in
connection with publishing activities, is not enough to bring
the claim within the immunity provided by § 230(c)(1).

La risposta è esatta, anche se, tutto sommato, al limite dell’ovvio.

Uguale sarebbe stata, applicando il nostro Digital Services Act reg. UE 2022/2065 (art. 6 Memorizzazione di informazioni – 1. Nella prestazione di un servizio della società dell’informazione consistente nella memorizzazione di informazioni fornite da un destinatario del servizio, il prestatore del servizio non è responsabile delle informazioni memorizzate su richiesta di un destinatario del servizio, a condizione che detto prestatore: (…))

SAfe harbour per una piattaforma di vendita/licenza di fotografie ?

L’appello del 2° circuito 10.02.2026, causa 23-7652, McGuchen v. Shutterstock, affronta il tema dell’applicabilita del porto sicuro ex § 512.(c). US Code title 17 in una lite azionat da un fotografo che vi aveva individuato molte sue fotografie.

I requisiti generali sono ravvisati .

La Corte invece propende per escludere i) quello per cui deve essere un trattamento sotto la direzione dell’utente (ivi, sub (1) IN GENERAL) e, ii) quello simile della assenza di beneficio economico se il “service provider has the right and ability to control such activity” (ivi, sub 1.B);

Sul primo , sub i) :

<<There is evidence in the record that suggests Shutterstock’s review of user images is neither cursory nor automatic. To begin, when a user submits an image to Shutterstock, the image does not immediately appear on the website; rather, the contributor must wait, sometimes for hours, until they receive an email from Shutterstock letting them know which of their images were accepted. See J. App’x at 1293, 1302, 1316. That fact is not dispositive, but it suggests some intervention by Shutterstock between a user upload and the appearance of material on the platform. Moreover, Shutterstock’s website states that it “has high standards and only accepts a portion of the images submitted to be included in [its] collection.” Id. at 1071. Indeed, Shutterstock maintains a page on its website that explains why an image might be rejected and provides advice for successful submissions. Id. at 1071–88. There are “30-odd” reasons that an image might be rejected by a Shutterstock reviewer, id. at 1294–95, which include focus, exposure, lighting, and noise, id. at 1071–75.
The record also contains evidence that Shutterstock’s reviewers exercise some subjective discretion even when applying seemingly rote and straightforward criteria. For instance, when considering an image’s focus, Shutterstock reviewers are “trained to know the difference between something that’s just out of focus and something that’s more intentional.” Id. at 1341–42. And according to Shutterstock, a reviewer may still accept an image that has focus issues if it is “a really unique shot” or a “hard shot to get.” Id. at 1297. That is because, as Shutterstock has explained, “there’s no way to predict what a customer is looking for,” so although “Shutterstock wants to have a high-quality library[,] . . . [t]here’s a lot of value in . . . shots that might not be perfect.” Id. at 1296–97; see also id. at 1366 (Shutterstock employee explaining that reviewers apply “a base guideline . . . but at the same time, it’s not a black-and-white standard”); id. at 1367 (“As our reviewers are humans, they obviously can think for [themselves]. We give them guidelines and we try to give them the best tools possible to review photos and to use their best judgment based on the guidelines we give them.”). In the end, as Shutterstock itself concedes, “photography is an art . . . you can’t just say, ‘This is yes, this is no.’” Id. at 1362. Together, these statements could lead a factfinder to conclude that Shutterstock’s reviewers exercise a considerable degree of case-by-case aesthetic or editorial judgment when determining which images to allow on the platform>>.

Ciò in applicazione del criterio astratto (importante ed espressamente enunciato) per cui <<if a service provider engages in manual, substantive, and discretionary review of user content—if, on a case-by-case basis, it imposes its own aesthetic, editorial, or marketing judgment on the content that appears on its platform—then its storage of infringing material is no longer “at the direction of a user.” In other words, “extensive, manual, and substantive” front-end screening of user content is not “accessibility-enhancing” and is not protected by the § 512(c) safe harbor. Mavrix, 873 F.3d at 1056. That is because, where service providers engage in their own discretionary screening of user content, they can no longer be said to be acting “solely to facilitate access by users.”>>

Sul secondo aspetto, sub ii):

<<There is evidence in the record suggesting “intrusions into user autonomy over their posts” that exceed the bounds set by Congress for the § 512(c) safe harbor. Vimeo II, 125 F.4th at 425. As an initial matter, Shutterstock screens every image before it appears on the platform—this screening determines whether an image ever gets on the platform. By way of contrast, in Vimeo II, “[c]alling attention to selected videos by giving them a sign of approval or displaying them on a Staff Picks channel . . . did not restrict the freedom of users to post whatever videos they wished.” Id. Also in contrast to Vimeo II, there is evidence here that Shutterstock’s image review goes beyond the limited purposes of restricting the site to “selected categories of consumer preferences” and excluding unlawful images. Id. Rather than engaging in categorical content screening—like accepting only holiday-themed images, or images that feature animals—Shutterstock appears to screen user images for their overall aesthetic quality. Curating a “collection,” J. App’x at 1071, of high-quality images is not the same as designing a website “that would be appealing to users with particular interests,” Vimeo II, 125 F.4th at 425.
Further, as McGucken has argued, there is some evidence in the record that Shutterstock extensively advises potential contributors on the types of images it is likely to accept. See J. App’x at 1071–88. That is unlike the service provider in Vimeo II, which “encouraged users to create certain types of content,” but did not condition their ability to post material on whether they created the provider’s preferred types of content. Vimeo II, 125 F.4th at 416. Indeed, in Vimeo II, we cited a website’s practice of giving “its users extensive advice on content” as one fact that can distinguish a service provider that has the right and ability to control infringing activity from one that does not. Id. at 423 (citing Cybernet, 213 F. Supp. 2d at 1173). Accordingly, on the current record, a reasonable factfinder might conclude that the advice and instruction Shutterstock provides its contributors, coupled with its image screening process, are sufficiently coercive to constitute substantial influence.

Finally, for the same reasons articulated above, the duration of Shutterstock’s image review and its 93 percent approval rate are relevant facts, but they are not dispositive. See supra Section II.B.3. Ultimately, it is the factfinder’s role to determine the degree and significance of Shutterstock’s solicitation and screening of user content.>>

Le funzioni di hash-matching dei video, usate da Youtube, producono sempre red flags nel caso di violazioni copyright, tali da far perdere a Youtube il safe harbour ex DMCA § 512(c)?

E’ negativa la risposta dell’ 11° circuito 07 gennaio 2026, caso n. 23-13156, Athos c. Youtube :

<<In sum, as to curation and moderation technologies, the rec-
ord reflects agreement between the parties that YouTube can algo-
rithmically suggest and auto-play videos, can remove users and vid-
eos from the site, and can set its own guidelines for users and up-
loaded content on the site.
With respect to the hashing technologies, the record does
not support Athos’ factual assertions. YouTube does not run Con-
tent ID (or any of its other copyright management tools) automat-
ically or universally for all videos uploaded to the YouTube website.
Athos, moreover, has offered no evidence that any of YouTube’s
video-hash-matching or other tools have any functionality to per-
form a legal analysis of whether an identified video-hash match
constitutes copyright infringement. In fact, YouTube has pre-
sented unrebutted evidence that all of its copyright management
tools were designed with user input and management in mind be-
cause it would be unfeasible for YouTube to operate the tools by
itself without such input. Athos simply has not identified any ma-
terial facts in dispute>>. p. 16.

Poi: <<So the simple accumulation of adequately-addressed DMCA
takedown requests alone cannot amount to red flag knowledge of
other infringing activity which precludes safe-harbor protection.
See id. And “the copyright owner cannot short-circuit the notifica-
tion procedure through a blanket notification;” the DMCA consid-
ers such an attempt a failed notification “and therefore counts it as
of no effect.” Id. at 12B-82–83. Because Athos bases its red flag
knowledge argument on the volume of DMCA takedown requests
it has submitted to YouTube, and on YouTube’s refusal to remove
additional content not noticed in those takedown requests, see Ap-
pellant’s Br. at 19–20, Nimmer’s criticism of Viacom and UMG has
no effect on our resolution of the red flag knowledge issue in this
case>>, p. 23.

Ancora: << The record reflects that the copyright management tools
could not have provided YouTube with actual knowledge because
they were never used in the manner Athos suggests. As discussed
earlier, Athos has not presented evidence that any of the video-
hash-matching tools it argues were designed to provide actual
knowledge are operated automatically or universally by YouTube.
Even if it had made such a showing, the video-hash matches gen-
erated by YouTube’s technologies, as we understand them from
this record, cannot give YouTube actual knowledge of infringing
material because the tools do not perform any analysis to deter-
mine whether the hash matches they generate are legally infringing
or not.
Without any kind of additional analysis being performed by
the copyright management tools or YouTube employees,
YouTube cannot have “actually or ‘subjectively’ [known] of spe-
cific infringement,” because the tools at most produce lists of possible infringement. See Viacom, 676 F.3d at 31. See also BWP Me-
dia USA, Inc. v. Clarity Digit. Grp., LLC, 820 F.3d 1175, 1181 (10th Cir.
2016) (explaining that “if the infringing content has merely gone
through a screening or automated process, the [internet service
provider] will generally benefit from the safe harbor’s protection”).
To require YouTube to not only run its copyright management
tools in the manner Athos suggests, but to then analyze the fruits
of those tools to locate other instances of infringement, would
amount to requiring YouTube to “affirmatively [seek] facts indicat-
ing infringing activity,” in direct contravention of the balance es-
tablished by Congress in the DMCA. See § 512(m)(1). Athos has
not shown that YouTube failed to expeditiously remove any in-
fringing material it had actual knowledge of>>, p. 24/5.

Sub B c’è una breve ma chiara spiegazione tecnica delle funzioni di hash-matching predisposte da Youtube.

La sentenza è utile anche per noi, dato che la disciplina posta (ora) dall’art. 6 del DSA reg. UE 2022/2065 non è così diversa.

Ancora su strumenti anticontraffazione di Youtube e sui suoi algoritmi, in relazione ai “notice and takedown” e al safe harbour ex art. 512(c).1 DMCA statunitense

L’appello dell’ 11° circuito in Athos c. Youtube USCA 7 gennaio 2026, case: 23-13156, decide che ci sono gli estremi per rinoscere a Youtube-Google il safe harbour previsto dal DMCA (vedilo qui).

Il succo sta alle pp 27-29:

“We conclude with the alleged right and ability of YouTube
to control infringing material it purportedly derives a direct finan-
cial benefit from. Agreeing with the Second Circuit’s consideration
of an equivalent issue in Vimeo II, we hold that YouTube’s moder-
ation and content management features do not constitute a right
and ability to control for purposes of the DMCA. We therefore do
not address whether YouTube receives a direct financial benefit
from infringing material.
The right and ability to control “requires ‘something more’
than the mere ability to remove or block access to materials on [the
service provider’s] website.” Vimeo II, 125 F.4th at 423. The service
provider must exert “‘substantial influence’ on user activities” or
otherwise have “induced the infringing activity.” Id. at 423–24.
In Vimeo II, the Second Circuit explained that “[c]alling at-
tention to selected videos by giving them a sign of approval or dis-
playing them on a Staff Picks channel (or the contrary, by demoting
them) did not restrict the freedom of users to post whatever videos
they wished.” Id. at 425. It also concluded that, given the “huge
number of videos posted by users on Vimeo,” the plaintiffs there
had failed to show that Vimeo staff had intervened in more than a
“tiny percentage.” Id. In its view, “denial of eligibility for the safe
harbor based on such noncoercive exercises of control over only a
small percentage of postings would undermine, rather than carry
out, Congress’[ ] purposes in establishing the safe harbor.” Id. at
426.
We agree with the Second Circuit, and conclude that the
same reasoning applies here, where the record reflects only that
YouTube can remove material and users from its website, can pro-
mote and auto-play select videos algorithmically, and can set
policies for content moderation on the site. The record contains
no evidence that YouTube exercises control over any more sub-
stantial a portion of the YouTube website than did Vimeo in Vimeo
II.
None of the identified “noncoercive exercises of control” on
the part of YouTube amount to substantial influence over user ac-
tivity sufficient to establish it had the right and ability to control
any infringing material at issue in this case. See id. “To interpret
this provision as [Athos] argue[s]—to deny [YouTube] access to the
safe harbor merely because of the tiny influences it exercised—
would subject [YouTube] to a huge expense in monitoring millions
of posts to protect itself against the possibility of liability for in-
fringements.” Id. at 426–27. Athos’ approach would have us upset
the balance between copyright owners and service providers struck
by Congress in the DMCA. If that balance is to be recalibrated, it
is a matter for Congress”.

Non troppo diversa da noi la disciplina del nostro DSA europeo , art. 6 (a parte il requisito dell ‘tile economico, da noi assente)-

Ancora sulla responsabilità delle piattaforme per violazione di copyright e sul safe harbour ex § 512 DMCA

Il 9 circuito 13.01.2025, 21-2949(L) Capitol Records v. Vimeo nega la resp. di Vimeo specificando la red flag data dalla competenza di un dipendente.

Ribadisce inoltre che serve la conoscenza della illiceità dei file contestati, non di una generica possibile/probabile illiceità all’interno di tutti i materiali ospitati.

<<However, we also acknowledged in Vimeo I that it is “entirely possible that an employee of the service provider who viewed a video did have expertise or knowledge with respect to the market for music and the laws of copyright.” Id. at 97 (emphasis added). Thus, as an alternative way to establish red flag knowledge, a plaintiff could produce evidence to demonstrate that an employee (1) was not an “ordinary person” unfamiliar with these fields, and (2) was aware of facts that would make infringement objectively obvious to a person possessing such specialized knowledge. See id.
We noted, though, that “[e]ven an employee who was a copyright expert cannot be expected to know when use of a copyrighted song has been licensed,” id., and, as discussed below, even a copyright expert may similarly struggle to identify instances of fair use.
Thus, in order to carry their burden of demonstrating that Vimeo had actual or red flag knowledge of the specific instances of infringement, Plaintiffs needed to show that Vimeo employees were aware of facts making it obvious to (a) a person who has no specialized knowledge or (b) a person that Plaintiffs have demonstrated does possess specialized knowledge that: (1) the videos contained copyrighted music; (2) the use of the music was not licensed; and (3) the use did not constitute fair use>>.

Poi

<<The fact that licensing music, as a general matter, can be challenging or confusing does not make it obvious that music accompanying a particular user-uploaded video was not licensed. Even if a person without specialized knowledge would have intuited a likelihood that many of the posted videos were not authorized, that would not make it obvious that a particular video lacked authorization to use the music.

This is all the more true in view of the uncontested fact that, since 2011, Vimeo had run a store from which users could purchase licenses to use music in videos. Accordingly, Vimeo employees were aware of the existence of simplified opportunities available to purchase licenses. Furthermore, because Plaintiffs have not proved that Vimeo employees had specialized knowledge of the music industry, those employees’ awareness that music found on their videos was under copyright did not show that they knew whether the music they heard on user videos came from EMI or another label. Plaintiffs’ evidence does not support it being apparent to Vimeo employees that the music they heard on any particular video came from a label that did not offer licenses through Vimeo’s store or otherwise.

Plaintiffs also rely on the contention that EMI’s cease-and-desist letter, sent to Vimeo in 2008, put Vimeo employees on notice that any EMI music used on the website was unauthorized. Plaintiffs cite EMI Christian Music Grp., Inc. v. MP3tunes, LLC, 844 F.3d 79, 93 (2d Cir. 2016), where we explained that the defendant’s subjective awareness that there had been no legal online distribution of Beatles songs could support red flag knowledge that any online electronic copies of Beatles songs on defendant’s servers were unlicensed. But the same logic does not necessarily apply here. As the district court pointed out, an awareness that EMI sent a letter in the past demanding removal of its music gave no assurance that EMI did not thereafter make contracts licensing the use of its music, especially in view of evidence that some users who posted the videos containing EMI music asserted that EMI had provided them with authorization to use the music. The DMCA does not require service providers to perform research on mere suspicion of a user’s infringement to determine the identity of the music in the user’s video, identify its source, and determine whether the user acquired a license. See Vimeo I, 826 F.3d at 98-99 (explaining, in the context of a contention of willful blindness, that requiring service providers “constantly to take stock of all information their employees may have acquired that might suggest the presence of infringements in user postings, and to undertake monitoring investigations whenever some level of suspicion was surpassed, . . . would largely undo the value of § 512(m)”).
Even if we concluded that Vimeo had red flag knowledge that EMI’s music in user videos was not authorized or licensed, that would be insufficient to satisfy Plaintiffs’ burden. Plaintiffs needed in addition to show that it would be apparent to a person without specialized knowledge of copyright law, or, alternatively, persons who have been demonstrated to possess specialized knowledge of copyright law, that the particular use of the music in the Videos-in-Suit was not fair use>>.

(segnalazione e link offerti dal blog di Eric Goldman)

Inibitoria contro Cloudfare per coviolazione del diritto di autore

Interessante ordinanza cautelare (contumaciale) di Trib. Roma Sez. spec. in materia di imprese, Ord., 03/06/2024, n. 1569, Rg 14261/2024, RTI (gruppo Mediaset) v. Cloudfare, pubblicata in Altalex da Maurizio De Giorgi , ove link al testo.

Spunti principali:

1) la analitica descrizione del lato tecnico, in particolare del ruolo di Cloudfare, essenzialmente volto a dare l’anonimato ai suoi clienti ma non solo (piattaforma usata anche da Twitter in Brasile nella sua recente lite col governo )

2) l’esame delle questioni di giurisdizione e competenza;

3) il rapporto tra concorso ex art. 2055 cc (affermato) ed esimente ex art. 14, 15, 16 d gls 70/2003 (non affrontata ma -direi- implicitamente negata):

<<Ciò posto, a prescindere dalla qualificazione della resistente come hosting provider e, quindi, dalla questione della responsabilità degli internet service providers anche alla luce della recente giurisprudenza comunitaria, peraltro posta in maniera implicita, l’attività da essa svolta così come prospettata dalla ricorrente appare potersi configurare come un’attività di concorso nella realizzazione degli illeciti compiuti da terzi inquadrabile nell’ambito della fattispecie di cui all’art. 2055 c.c..
In particolare, sussiste, prima facie, nella cognizione tipica della presente fase cautelare, la prova che attraverso i nomi a dominio “G.” in tutte le variate declinazioni sono stati posti a disposizione del pubblico i programmi su cui la R.T.s.p.a. detiene i diritti di sfruttamento economico per l’Italia, senza autorizzazione e, pertanto, in violazione del diritto d’autore della ricorrente.
Dall’analisi espletata dalla S. srl, su incarico della ricorrente, è emerso che il sito noto con il nome di G. ha variato decine di estensioni del nome a dominio e che si serve dei servizi di C..

E’ emerso, altresì, che il sito offre un catalogo indicizzato di prodotti audiovisivi e li rende accessibili e fruibili mediante la pubblicazione di collegamenti ipertestuali (link) a risorse terze (cd. file hosting o cyberlocker) per il download o per lo streaming e che l’aggiornamento dei contenuti viene svolto dalla sola amministrazione del sito mentre l’utente finale può fruire dei contenuti la cui ricerca viene agevolata dalle funzioni del sito stesso.
E’ emerso che C. agisce, quindi, come un intermediario tra il visitatore del sito e il server di origine, migliorando le prestazioni, aumentando la sicurezza e fornendo una serie di servizi aggiuntivi per ottimizzare l’esperienza dell’utente e proteggere il sito dai rischi online. Tutti i domini sfruttati da G. hanno in comune l’uso di tali servizi, ciò è riscontrabile anche dalla consultazione dei registri pubblici ottenute dalle interrogazioni D. di tutti i nomi dominio oggi riferiti a G., il N. risulta essere il comune servizio di Registrar usato per l’acquisto dei nomi di dominio e C. risulta essere l’ intermediario dei servizi internet sfruttato da tutti i domini>>

Motivazione poco lineare: la non invocabilità dell’esimente (questione logicamente antecedente l’invocabilità dell’art. 2055cc) andava argomentata, non ritenuta irrilevante (“a prescidnere”).

L’algoritmo di Tiktok , decidendo il feed degli utenti,. fa si che la piattaforma sia corresponsabile dei loro conteuti

Eric Goldman ci informa sull’appello del 3 circuito n. 22-3061,TAWAINNA ANDERSON, v. TIKTOK, INC.; BYTEDANCE, INC, 27.08.2024. relativo ad uno dei purtroppo frequenti demenziali video di challenge, che spingono giovani e giovanissimi a sfide pericolosissime (asfissia)

Per il collegio, il fatto che il newsfeed sia governato da TikTok fa si che i materiali caricati siano attribuibili non solo all’utente, ma anche a Tik Tok, ai fini del safe harbour ex §230 CDA.

Si tratta quindi non di third-party speech ma di first-party speech.

Tesi che, dice il 3 Circ. , è confermata dalla sentenza della Corte Suprema Moody v. NetChoice, LLC del 2024, per la quale spetta alle piattaforme la tutela del diritto di parola: ne sopportino allora le coerenti conseguenze circa il § 230 CDA.

DA noi l’art. 6 del DSA (reg. UE 2022/2065) ha diversa formulazione: irresponsabilità per “informazioni memorizzate su richiesta di un destinatario”, purchè non sappia o rimuova immediatamente.

Ma il tema si pone lo stesso, alla luce della copiosa giurisprudenza nazionale ed europea sul punto, pur legata alla precedenti disposizioni (d lgs 70 del 2003 e dir. UE 2000/31) (v concetto di hosting provider “attivo”)

Ancora sulla responsabilità degli internet provider per le violazioni copyright dei loro utenti (con un cenno a Twitter v. Taamneh della Corte Suprema USA, 2023)

Approfondita sentenza (segnalata e linkata da Eric Goldman, che va sempre ringraziato) US BANKRUPTCY COURT-SOUTHERN DISTRICT OF NEW YORK, In re: FRONTIER COMMUNICATIONS CORPORATION, et al., Reorganized Debtors, Case No. 20-22476 (MG), del 27 marzo 2024.

Si v. spt. :

-sub III.A, p. 13 ss, “Secondary Liability for Copyright Infringement Is a Well-Established Doctrine”;

– sub III.B “Purpose and Effect of DMCA § 512”, 24 ss.

– sub III.D “Twitter Did Not Silently Rewrite Well-Established Jurisprudence on Secondary Liability for Copyright Infringement” p. 31 ss sul rapporto tra la disciplina delle violazioni copyright e la importante sentenza della Corte Suprema Twitter, Inc. v. Taamneh, 598 U.S. 471 (2023).

Di quest’ultima riporto due passaggi dal Syllabus iniziale:

– la causa petendi degli attori contro Twitter (e Facebook e Google):

<< Plaintiffs allege that defendants aided and abetted ISIS in the
following ways: First, they provided social-media platforms, which are
generally available to the internet-using public; ISIS was able to up-
load content to those platforms and connect with third parties on them.
Second, defendants’ recommendation algorithms matched ISIS-re-
lated content to users most likely to be interested in that content. And,
third, defendants knew that ISIS was uploading this content but took
insufficient steps to ensure that its content was removed. Plaintiffs do
not allege that ISIS or Masharipov used defendants’ platforms to plan
or coordinate the Reina attack. Nor do plaintiffs allege that defend-
ants gave ISIS any special treatment or words of encouragement. Nor
is there reason to think that defendants carefully screened any content
before allowing users to upload it onto their platforms>>

– La risposta della SCOTUS:

<<None of plaintiffs’ allegations suggest that defendants culpably “associate[d themselves] with” the Reina attack, “participate[d] in it as
something that [they] wishe[d] to bring about,” or sought “by [their]
action to make it succeed.” Nye & Nissen, 336 U. S., at 619 (internal
quotation marks omitted). Defendants’ mere creation of their media
platforms is no more culpable than the creation of email, cell phones,
or the internet generally. And defendants’ recommendation algorithms are merely part of the infrastructure through which all the content on their platforms is filtered. Moreover, the algorithms have been presented as agnostic as to the nature of the content. At bottom, the allegations here rest less on affirmative misconduct and more on passive nonfeasance. To impose aiding-and-abetting liability for passive nonfeasance, plaintiffs must make a strong showing of assistance and scienter. Plaintiffs fail to do so.
First, the relationship between defendants and the Reina attack is
highly attenuated. Plaintiffs make no allegations that defendants’ relationship with ISIS was significantly different from their arm’s
length, passive, and largely indifferent relationship with most users.
And their relationship with the Reina attack is even further removed,
given the lack of allegations connecting the Reina attack with ISIS’ use
of these platforms. Second, plaintiffs provide no reason to think that
defendants were consciously trying to help or otherwise participate in
the Reina attack, and they point to no actions that would normally
support an aiding-and-abetting claim.
Plaintiffs’ complaint rests heavily on defendants’ failure to act; yet
plaintiffs identify no duty that would require defendants or other communication-providing services to terminate customers after discovering that the customers were using the service for illicit ends. Even if
such a duty existed in this case, it would not transform defendants’
distant inaction into knowing and substantial assistance that could
establish aiding and abetting the Reina attack. And the expansive
scope of plaintiffs’ claims would necessarily hold defendants liable as
having aided and abetted each and every ISIS terrorist act committed
anywhere in the world. The allegations plaintiffs make here are not
the type of pervasive, systemic, and culpable assistance to a series of
terrorist activities that could be described as aiding and abetting each
terrorist act by ISIS.
In this case, the failure to allege that the platforms here do more
than transmit information by billions of people—most of whom use the
platforms for interactions that once took place via mail, on the phone,
or in public areas—is insufficient to state a claim that defendants
knowingly gave substantial assistance and thereby aided and abetted
ISIS’ acts. A contrary conclusion would effectively hold any sort of
communications provider liable for any sort of wrongdoing merely for
knowing that the wrongdoers were using its services and failing to stop
them. That would run roughshod over the typical limits on tort liability and unmoor aiding and abetting from culpability>>.

La norma asseritamente violata dalle piattaforme era il 18 U.S. Code § 2333 (d) (2), secondo cui : <<2) Liability.— In an action under subsection (a) for an injury arising from an act of international terrorism committed, planned, or authorized by an organization that had been designated as a foreign terrorist organization under section 219 of the Immigration and Nationality Act (8 U.S.C. 1189), as of the date on which such act of international terrorism was committed, planned, or authorized, liability may be asserted as to any person who aids and abets, by knowingly providing substantial assistance, or who conspires with the person who committed such an act of international terrorism>>.

Apple è responsabile per i danni prodotti da una sua “malicious app” oppure è protetta dal safe harbour ex § 230 CDA?

Eric Goldman ci notizia di e ci dà il link alla sentenza di appello del 9 circuito 27.03.2024, No. 22-16514, Hadona Diep v. Apple .

Dismissed le azioni “counts I (violation of the Computer
Fraud and Abuse Act), II (violation of the Electronic Communications Privacy
Act), III (violation of California’s Consumer Privacy Act), VI (violation of
Maryland’s Wiretapping and Electronic Surveillance Act), VII (additional
violation of Maryland’s Wiretapping and Electronic Surveillance Act), VIII
(violation of Maryland’s Personal Information Protection Act), and X (negligence)
of the complaint”.

Invece il § 230 CDA non protegge da azioni basate sulle leggi statali proconsumatori nè da altra come comncorrenza sleale:

<<The claims asserted in counts IV (violation of California’s Unfair
Competition Law (“UCL”)), V (violation of California’s Legal Remedies Act
(“CLRA”)), and IX (liability under Maryland’s Consumer Protection Act
(“MCPA”)) are not barred by the CDA. These state law consumer protection
claims do not arise from Apple’s publication decisions as to whether to authorize
Toast Plus. Rather, these claims seek to hold Apple liable for its own
representations concerning the App Store and Apple’s process for reviewing the
applications available there. Because Apple is the primary “information content
provider” with respect to those statements, section 230(c)(1) does not apply. See
Carafano v. Metrosplash.com, Inc., 339 F.3d 1119, 1124–25 (9th Cir. 2003)
(examining which party “provide[d] the essential published content”)>>.

Nemmeno queste azioni sonio impedite da patti su Limitation of liability (anche se qui di non interesse)