Social Media Law 101: Dealing with Legal and Risk Issues Arising from User-Generated Content
Written by: Antone F. Johnson
Work with the right lawyer who knows his or her way around these issues.
There is no substitute for professional advice. An hour or two initial orientation on the full range of potential issues from someone who's "been there, done that" will easily pay for itself, and with respect to any discrete issue, a five-minute call or email exchange can save you endless headaches.
Again, no substitute for having a good Internet lawyer draft/review those, tailored to the specifics of your site. Often you want Community Guidelines as well that dovetail with the TOU, written in plain English, posted somewhere users might actually read them (as opposed to the TOU and PP, which go largely unread on most sites). For a good example, see eHarmony Advice at http://advice.eharmony.com/community_guidelines.html
Broadly speaking, there are two main areas of risk on social sites: Inappropriate content and inappropriate conduct.
For either, the single most powerful point of leverage you have is prevention by self-policing -- including a "Report as Inappropriate" link for every post, encouraging users to serve as your eyes and ears, and appointing the most active and responsible users of the site as moderators, admins or "super-admins" who may have the ability to delete posts or even suspend users, depending on how much you trust them. The benefit of this approach is that it's preventive, scalable, and nearly costless.
Inappropriate content: Spamming, phishing, porn, hate speech, commercial self-promotion, trolling, flame wars and personal attacks
The right TOU and Guidelines give you the legal right to delete posts and terminate user accounts at any time for behaving badly in any of these ways. Nevertheless, it's usually impossible to prevent a determined jackass from coming back again and again, using new accounts and proxy servers as necessary to get around IP address blocks. In that situation, if the jackass is unpopular, your best defense is to appeal to users to immediately flag every one of his/her posts for deletion, and have your community manager prioritize responding accordingly. (You could moderate every post, but that's impractical for successful sites with thousands of posts per day or more.)
Copyright infringement is its own peculiar form of inappropriate content.
Users find endless ways to infringe the IP rights of third parties on your site, by posting photos, articles, audio or video clips, etc. Fortunately, you as site operator are generally shielded from any liability provided that you correctly implement a notice-and-takedown policy under Section 512 of the DMCA. There are many resources around the Web explaining how to do that (I like http://www.chillingeffects.org/dmca512c/faq.cgi), but as usual, it's best to work with a qualified lawyer to ensure you're covered. Correctly implemented, the DMCA "safe harbor" gives the site operator complete immunity against suits by content owners. (The Viacom v. YouTube lawsuit was a high-profile challenge to this safe harbor, and Viacom lost.) Two traps for the unwary: Be certain to file the form with the U.S. Copyright Office designating a Copyright Agent to receive DMCA takedown notices (http://www.copyright.gov/onlinesp), and include a street address (not just an email) to receive notices.
More on copyright and user-generated content
I could write a whole article on copyright issues, but the bottom line is that you don't have an obligation to independently review every piece of content -- but you do have a duty to respond to DMCA take-down requests, if properly made, within a "reasonable time" (usually thought to be about a week). The Fair Use doctrine allows much copyrighted work to be used on your site with impunity, but practically speaking, you don't want to have to be the judge of that -- so when a content owner sends a proper DMCA take-down notice, I wouldn't mess around: Just take the content down.
Trademark infringement is theoretically an issue, but in practice it rarely comes up.
Trademarks are brand names, slogans, taglines or logos. The Web makes it easier than ever to cut and paste them just about anywhere. (Picture something like the Nike swoosh.) In practice, most brand owners don't go around threatening to sue UGC sites over TM issues because it's generally either a non-commercial use (e.g., a fan expressing enthusiasm), a parody (fair use), a comparison against other products (nominative use) -- or even if technically infringing, it serves to give the brand more visibility, so it would do more harm than good for the brand owner to send a nasty cease-and-desist letter. However, if you do find yourself on the receiving end of one of those letters, the low-risk approach is to go ahead and remove the content (without admitting liability). If it's a hugely popular item on your site, it's worth consulting a lawyer to see if you want to push back and make fair use arguments, etc., but keep in mind that defending even a meritless suit can be expensive.
Photos and videos pose their own unique set of problems.
The main issue there, of course, is nudity or pornography. Every site can set its own standards regarding nudity; whatever lines you draw will be tested and violated. If you decide to allow nudity, make a serious effort to keep users under 18 off the site. Local laws vary and you don't want to have to defend against some conservative state AG charging you with distributing porn to minors. Ideally it's best to have someone review and moderate every photo, but in practice, given scalability issues, you may need to rely on a user reporting system for objectionable photos. A special case is child pornography; unlike almost every other US law in existence, businesses have a legal obligation to report a crime to NCMEC if any content that appears to be child porn is discovered. See http://www.missingkids.com/missingkids/servlet/PageServlet?LanguageCountry=en_US&PageId=2450 for more information.
Porn isn't the only reason to pick a minimum age for access to your site and enforce it.
Porn isn't the only reason to pick a minimum age for access to your site and enforce it. In particular, in the US, COPPA (the Children's Online Privacy Protection Act) prohibits the collection of any personal information from children under age 13 without their parents' consent. This includes things as simple as email addresses. If your non-child-targeted site is of a nature that you know it will appeal to kids, your TOU should forbid users under age 13 from accessing the site; the registration process should ask for age or date of birth somewhere to confirm you aren't registering people under 13; and there needs to be a mechanism to cookie the user's browser so a 12-year-old can't just hit the back button and enter a new, higher age. (Xanga got in trouble for this and was fined $1 million by the FTC.)
You are generally not liable for any other unlawful content posted by users on the site, thanks to a wonderful law called Section 230
...of the Communications Decency Act. (See http://www.citmedialaw.org/legal-guide/immunity-online-publishers-under-communications-decency-act for a good summary.) This would cover things like defamation, hate speech, stating discriminatory preferences in hiring or housing, etc. Of course you can and should delete posts and kick people off the site for posting such content (in accordance with those Community Guidelines and TOU), but that should be the end of it. Exercising judgment in deciding which posts to remove does not make the site responsible in any way for the ones that remain.
Defamation tends to be the most common type of claim that falls within the Section 230 safe harbor, particularly on rating/review sites like Yelp.
If someone threatens to sue your site based on allegedly false negative statements posted by a user, it may be necessary to have your lawyer send a nasty letter basically saying "Go to hell, you don't have a case against the site, here's why, and if you sue us, we'll countersue to make you pay our own expensive lawyers' fees." I call this the "smackdown letter" and have always found it to be effective when representing site operators. Taking the high road, if the complainant is being reasonable, I always encourage them to post a thoughtful rebuttal to criticism, and/or ask their other, more satisfied customers to post on the site to dilute the impact of the negative review.
Unlawful conduct (as opposed to content) is usually less of a problem for the simple reason that most of it happens offline or away from your site.
Online it generally takes the form of stalking, harassment, etc., or conspiring to commit illegal acts like drug dealing, counterfeiting, or financial crimes. In general, as site owner you don't have any legal obligation to report suspected crimes (other than child porn), but it doesn't hurt to cultivate a good relationship with law enforcement like IC3 (http://www.ic3.gov) as the site scales. Again, it's your playground and you set the rules, balancing free speech against standards of conduct that reflect on public perceptions of your site.
Expect lawsuit threats and subpoenas as the site scales.
The most likely legal issues that will arise around user conduct are either (A) that someone will threaten to sue your site based on criminal or tortious behavior of someone they met through it (e.g., "You should pay me back the $1,500 I sent to a Nigerian scammer I met on your site"), or (B) you will be contacted by lawyers or investigators with a subpoena or other records request related to the commission of a crime or legal dispute. For (A), the best defense is a well-crafted TOU that makes it clear in no uncertain terms that the site bears no responsibility for interactions among individual users. (See eHarmony's TOU at http://www.eharmony.com/about/terms for a good example of this.) (B) is a subject for another whole article, but it's important to respond and comply promptly with requests from law enforcement investigators in particular to freeze accounts or preserve records, and consult a qualified lawyer with any questions. It's equally important to respect federal privacy law
For additional information, see the "News and Resources" section on my firm website (listed below) and answers to related questions on Founders' Space and Quora.