What is the SCOPE Act? New law expected to take effect Sunday aims to add extra layer of protection to kids online
www.click2houston.com
The new SCOPE Act takes effect this Sunday, adding protections for kids online through age verification and stricter marketplace regulations but one non-profit is challenging it. Will a judge block it? #OnlineSafety #ConsumerProtection #SCOPEAct

“The SCOPE Act takes effect this Sunday, Sept. 1, and will require everyone to verify their age for social media.”

So how does this work with Lemmy? Is anyone in Texas just banned, is there some sort of third party ID service lined up…for every instance, lol.

But seriously, how does Lemmy (or the fediverse as a whole) comply? Is there some way it just doesn’t need to?

    • abff08f4813c@j4vcdedmiokf56h3ho4t62mlku.srv.us
      41·
      4 months ago

      At times like this I wish we had /c/LegalAdvice - would love for someone who says “IAAL” to chime in.

      Some of the biggest lemmy instances - lemmy.world, feddit.de - are based in the EU. I don’t understand how EU based instances like these would be able to get away with not following GDPR.

      Though, it may be more that GDPR doesn’t apply, as per https://decoded.legal/blog/2022/11/notes-on-operating-fediverse-services-mastodon-pleroma-etc-from-an-english-law-point-of-view/

      [The UK GDPR] does not apply to … the processing of personal data by an individual in the course of a purely personal or household activity
      But for those spinning up an instance of a fediverse service for them and their friends, for a hobby, I think there’s far more scope for argument.

      In any case it seems like asking a fediverse instance to be compliant with the GDPR is possible, see for an example at https://sciences.re/ropa/ and https://mastodon.social/@robin/109331826373808946 for a discussion.

      • General_Effort@lemmy.world
        2·
        4 months ago

        a purely personal or household activity

        No chance. This is what makes it legal to share data within a family and, to a degree, among friends. Running an open social media platform is neither a personal nor a household activity.

        The UK is not part of the EU. They kept the GDPR when they left, but it should not be assumed that the UK interpretation is always the same.

        The GDPR is not very thoroughly enforced; much to the chagrin of some people. This may or may not change in the future. It would be politically quite unpopular, a bit like thoroughly enforcing no-parking zones.

        • abff08f4813c@j4vcdedmiokf56h3ho4t62mlku.srv.us
          1·
          4 months ago

          a purely personal or household activity
          No chance. This is what makes it legal to share data within a family and, to a degree, among friends. Running an open social media platform is neither a personal nor a household activity.

          Hmm.

          So running a single user instance for my own personal use (and keeping in mind the nature of federation meaning the only stuff my instance sends out is the stuff that I write) is absolutely not covered by the above?

          The UK is not part of the EU. They kept the GDPR when they left, but it should not be assumed that the UK interpretation is always the same.

          That is a very good point indeed.

          The GDPR is not very thoroughly enforced; much to the chagrin of some people. This may or may not change in the future. It would be politically quite unpopular, a bit like thoroughly enforcing no-parking zones.

          Seems risky to rely on low enforcement though. For those of us who love federation and privacy and want to federate while complying with the GDPR - what must be done?

          • General_Effort@lemmy.world
            1·
            4 months ago

            (and keeping in mind the nature of federation meaning the only stuff my instance sends out is the stuff that I write)

            The stuff you write is personal data as long as it can be connected to your identity and so protected under the GDPR. But that’s a problem for other people.

            Your problem is the personal data of other people that come under your control. For starters, you need to answer this question: What legal basis do you have for processing that data?

            For those of us who love federation and privacy and want to federate while complying with the GDPR - what must be done?

            They need legal experts on the team. As GDPR-fans will tell you, data protection is a fundamental human right. We don’t let just anyone perform surgery, so don’t expect that just anyone should be able to run a social media site.

            Complying with the GDPR is challenging at the best of times. When you handle personal data, some of it sensitive, at the scale of a fediverse instance, it becomes extremely hard.

            Strictly speaking, it’s impossible. EG you need to provide information about what you do with the data in simple language. The information also needs to be complete. If the explanation is too long and people just click accept without reading, that’s not proper consent. You need to square that circle in a way that any judge will accept. That’s impossible for now. Maybe in a few years, when there’s more case law, there’ll be a solid consensus.

            Complying as well as possible will require the input of legal experts, specialized in the law of social media sites. The GDPR is not the only relevant law. There’s also the DSA, quite possibly other stuff I am not aware of, and local laws.

            Definite problems, I can see:

            1. Under german law, an instance owner has to provide an address, that may be served legal papers.
            2. It’s possible to embed images, but under the GDPR, there must not be connections to 3rd party servers without consent. In fact, all out-going links are a problem.
            3. Federation itself. You can’t federate with instance, if you haven’t made sure that they comply with GDPR.
    • General_Effort@lemmy.world
      1·
      4 months ago

      It is a problem. If anyone complains or sues about GDPR compliance, they will get fined and/or have to pay damages.

      There’s also other regulations, like the DSA. I’m fairly sure the GDPR isn’t the only legal problem.

    • Kaboom@reddthat.com
      24·
      4 months ago

      It’s going to be a big problem when the EU catches wind. Gpdr is a nasty law, hard to comply with properly, and has harsh fines. And no, “we tried to comply” will not fly

      • Don_alForno@feddit.orgDeutsch
        31·
        4 months ago

        hard to comply with properly

        Not at all. Don’t collect personal data that’s not technically necessary for the service to work. Tell users what data is collected and for what purposes. Done.