“The SCOPE Act takes effect this Sunday, Sept. 1, and will require everyone to verify their age for social media.”
So how does this work with Lemmy? Is anyone in Texas just banned, is there some sort of third party ID service lined up…for every instance, lol.
But seriously, how does Lemmy (or the fediverse as a whole) comply? Is there some way it just doesn’t need to?
Why should it affect LW or any other (non-Texan) instance? Any rogue country with populists at the head can implement any arbitrary legislation. That does not affect Lemmy instances hosted in countries with reasonable governments. If Texas wants to enforce their rules (or punish for non-compliance), it is on them to approach instance admins or block the site in their corner of the global internet.
This is a fair view. I’m not sure anyone has gotten that far, especially outside the country.
Heres an article about a similar bill in Utah, that hasn’t gone into effect yet.
What’s not clear from the Utah bill and others is how the states plan to enforce the new regulations.
I mean if the general consensus is that it doesn’t apply, then, cool.
I live in Texas, and can confidently tell you the people writing these laws have no fundamental concept of what the internet is or how to implement or enforce such a law for consistent adherence.
I can also tell you with confidence this law will be wielded with impunity against specific companies/sites our corrupt, petulant AG decides to go after. Fuck Ken Paxton.
As far as users in Texas, this is nothing a VPN can’t fix.
Is there a way to put a VPN on the router, so that all devices are covered?
I can absolutely see Texas looking at it the other way. “Your website can be accessed by our citizens? On you to comply with our laws.” They then spit out a bunch of criminal charges that make things rather inconvenient for some instance hosts. The US reach into international banking systems is uncomfortably long.
The real problem question is about federation. You can post to an instance from any federated instance. If an account is created in one instance and the user posts to a federated instance are both liable? You have to be able to create accounts AND post to be subject to the law. Can one instance not allow posts but host accounts for participation in other instances to skirt around the law?
That would require jurisdiction to charge them anyways. They do not have such power.
jurisdiction and extradition. theyre too busy suppressing voting and melting their elderly.
isn’t this exactly what happened with porn sites?
Interstate commerce is not under the jurisdiction of any state, it’s under the jurisdiction of the federal government. They’d need a federal bill passed.
Look where it’s hosted? Sorry, but this approach has been outdated for decades. Laws apply when you address the users inside that legislation. No matter where you are, where your server is, etc.
Do you have examples of that? From what I’ve seen the laws only apply if a business has a physical presence in that state or country.
Everywhere…
Today here: https://sh.itjust.works/post/24478719
And like the top level comment stated, it’s on Brazil to block Twitter in their corner of the internet. That’s why their 20,000 ISPs are scrambling to block it - not Twitter
Is there any Lemmy hosted in the US? Texas can put on a stunt against any US instance, but don’t see them even trying for anything from the rest of the world. Too much work/money with too little chance of success.
And the state I’m in would tell them to fuck right off and would probably allow me to counter sue Texas into the ground for harassment. I don’t think Texas wants to mess with states that have massive GDPs and contribute lots of money to the federal government.
The answer? Block Texas
Not joking. If suddenly hundreds or thousands of sites would become unavailable. It wouldn’t last a week
That didn’t work with porn, so it’s not a good idea for less popular websites.
Who cares about porn
doesnt that happen every time it rains in texas?
The same way lemmy works with GPDR. Lemmy completely ignores it.
That’s the vibe I’m getting. No problem.
It’s going to be a big problem when the EU catches wind. Gpdr is a nasty law, hard to comply with properly, and has harsh fines. And no, “we tried to comply” will not fly
hard to comply with properly
Not at all. Don’t collect personal data that’s not technically necessary for the service to work. Tell users what data is collected and for what purposes. Done.
That’s not true. Out of curiosity, where did you learn that?
It is a problem. If anyone complains or sues about GDPR compliance, they will get fined and/or have to pay damages.
There’s also other regulations, like the DSA. I’m fairly sure the GDPR isn’t the only legal problem.
It doesn’t exactly ignore it, but in a sense GDPR doesn’t apply to Lemmy.
Long story short, GDPR is made to protect private information, and EVERYTHING in Lemmy is public so there is no private information to protect. It’s similar to things like pastebin or even public feed in Facebook, companies cannot be penalized for people willingly exposing their information publicly, but private information that is made public is a problem.
That is entirely incorrect. It is general data protection regulation, not privacy regulation.
You are given certain rights over data relating to you. For example: you may have it deleted. Have you googled the name of a person? At the bottom, you will find a notice that “some results may have been removed”. Under the GDPR, you can make search engines delete links relating to you; for example, links to unflattering news stories (once you are out of the public eye).
Sorry, forgot about answering here. Although the name is General data it is about personal data. I was going to reply with point by point why it either doesn’t apply to Lemmy or it follows GDPR, but I think it might be easier to answer directly your point about right to be forgotten.
First of all Lemmy allows you to delete your posts and user so it complies with it, but even if it didn’t GEPR has this to say:
Paragraphs 1 and 2 shall not apply to the extent that processing is necessary:
Paragraphs 1 and 2 are the right to be forgotten
for exercising the right of freedom of expression and information;
Which one could argue is public forum primary use
for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing;
Which again one could argue is part of the purpose of Lemmy as well.
I was going to reply with point by point why it either doesn’t apply to Lemmy or it follows GDPR
It does apply to lemmy and lemmy is not compliant. That is simply a fact as far as the courts have ruled so far.
Which one could argue is public forum primary use
One can argue a lot. But if such hand-wavy arguments work, then why do you think anyone ever has to pay fines or damages?
For this argument to work, you have to argue that erasing the precise personal data in question would infringe on someone else’s right to freedom of expression and information.
The original “right to be forgotten” was about links to media reports. The media reports themselves did not have to be deleted because of freedom of information, but google had to delete the links to them to make them harder to find. This is a narrow exception. Under EU law, data protection and these freedoms are both fundamental rights. They must be balanced. The GDPR dictates how. These exceptions will only apply where these freedoms are infringed in a big way.
At least, you have to do like reddit and anonymize the comments and posts. It could be argued that you actually may not even do more. Removing comments that someone else has replied to arguably makes their personal data incomplete. Reddit’s approach meets a lot of outspoken criticism on lemmy.
The problem is that the data is duplicated all over the federated instances. So, someone on your instance deletes their data, Other instances also delete their copies. What do you do if someone in the US refuses to delete and maybe gives you that argument about freedom of expression? That’s right. You pay damages to your user because you screwed it up.
Still, the archival nature of decentralized communities is one of the primary objectives of the technology. It’s arguably the defining feature of any decentralized thing that no one controls everything so things are meant to stay “forever”. Otherwise Bitcoin would be completely ilegal since there’s no way to delete information there.
What do you do if someone in the US refuses to delete and maybe gives you that argument about freedom of expression? That’s right. You pay damages to your user because you screwed it up.
Not really, again, the text of the law states that if the information has been made public the company must inform whoever they made the data public to:
Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.
AFAIK Lemmy federated deletions, whether an instance acts on it or not is another matter.
But GDPR doesn’t work like you think, let me give you an example, say you sent an email from provider A to someone on provider B, then you decide to delete that email account, the email you sent will still be in provider B, even if company A deletes all of your information that email is still there and won’t get deleted. This is fine with GDPR, otherwise no email provider could operate here. Same goes for other federated or decentralized technologies.
Still, the archival nature of decentralized communities is one of the primary objectives of the technology. It’s arguably the defining feature of any decentralized thing that no one controls everything so things are meant to stay “forever”. Otherwise Bitcoin would be completely ilegal since there’s no way to delete information there.
Any number of people here will happily tell you where to shove your illegal technology. In truth, the GDPR is explicitly meant to limit what may be done with existing technology.
With crypto, one can make use of some existing exceptions and perhaps create compliant apps. I’m not familiar with those. Much that stuff is not compliant. There isn’t a lot of enforcement.
So that’s my bad. I pointed out the issue with the right to erasure to highlight the problem, In truth, the probable violation happens when the data is shared. With e-mail, the user sends their own data, just like while clicking links. The transfer of data for lemmy federation is under the control of the instances involved. It might still be okay, like serving the data over the web. But that requires the user to know what’s going on.
If you could hand-wave these problems away so easily, Meta would not be paying those huge fines. What do you actually think that’s about?
Data in Bitcoin is undeletable, it’s impossible for any law to force anything from being deleted on Bitcoin. Then the same exceptions that apply there would apply to Lemmy since the technology is similar in the relevant aspects (besides deletion being theoretically possible on Lemmy).
As for Meta, the problem is that the data they’re sharing is not public. Meta is not getting fined for sharing things you posted on your publicly, since they share those regardless by virtue of them existing and being publicly available, they’re fined for sharing things you put privately or data derived from non publicly available sources such as how you interact with Meta.
Any information that a user willingly makes public can be processed in any way, even if it includes identifiable medical information (which is the biggest no-no of GDPR). It even has a specific point about it in 9.2.e
processing relates to personal data which are manifestly made public by the data subject;
Essentially saying you can process anything that was made public by the person. GDPR is to protect people from companies doing shady things, not to prevent people from themselves. Because EVERYTHING is public in Lemmy, all data in it has been manifestly made public by the person who created it.
I’m so glad I don’t live in that shithole state.
They can SCOPE deez nuts.
That’s right, get noSCOPEd
It’s called the “Fuck Texas” response to such a garbage law. And good luck enforcing it especially with federated sites.
I’m tired of Texas trying to expand their sphere of influence beyond their borders with shitty laws and shitty judges.
Set up a redirect for all Texas IP addresses. Point to Fuck Texas.
So much freedom that it hurts.
I’m fine with Texas disappearing from the internet. Literally every site with a comment section now has to comply or just block Texas. One of those seems more feasible.
Texas is slowly turning into Afghanistan
Not so slowly. 20 years ago it was a battleground state.
Texas: “I’m gonna let you finish but I’m just going to keep regressing right now.”
Enjoying freedumb in Texas, I bet. One of the least-free states in the country.
Its getting more dystopian by the week. I would say day, but a lot of brains don’t move that fast here.
Comply?
“Is there some way it just doesn’t need to” = “Is there some scenario in which Texas laws don’t apply worldwide?”
Yes. There is.
To expand on this- In general you must comply with the laws of any jurisdiction where you have a business presence. This for example Meta is a USA company, but they have offices in the EU and they sell advertising in the EU from EU offices so they have to comply with EU laws for EU users. They can’t just wave off and say ‘we are a USA company, EU regs don’t apply to us’.
Lemmy is not a corporation. There is no business presence in Texas, unless an instance admin lives there or hosts the server there. So Lemmy, both as a whole and as individual instances, can simply give Texas the middle finger and say ‘we aren’t subject to your laws as we have no presence or business in your state. We are in the state of California (or whatever) and are subject to the laws of our home state. It is not our job to enforce Texas laws in California on servers hosted in Virginia.’
Thus Texas trying to enforce their laws on a Cali company is like Hollywood studios sending DMCA notices to Finland.
Thus Texas trying to enforce their laws on a Cali company is like Hollywood studios sending DMCA notices to Finland.
My point exactly.
I expect the usage of VPNs in Texas to skyrocket exponentially in the next couple of months.
Don’t think so
I’m petty sure everyone already started using VPNs when Pornhub was banned
