Texas SCOPE act takes effect Sunday. How does Lemmy comply? - eviltoast
What is the SCOPE Act? New law expected to take effect Sunday aims to add extra layer of protection to kids online
www.click2houston.com
The new SCOPE Act takes effect this Sunday, adding protections for kids online through age verification and stricter marketplace regulations but one non-profit is challenging it. Will a judge block it? #OnlineSafety #ConsumerProtection #SCOPEAct

“The SCOPE Act takes effect this Sunday, Sept. 1, and will require everyone to verify their age for social media.”

So how does this work with Lemmy? Is anyone in Texas just banned, is there some sort of third party ID service lined up…for every instance, lol.

But seriously, how does Lemmy (or the fediverse as a whole) comply? Is there some way it just doesn’t need to?

  • General_Effort@lemmy.world
    1·
    4 months ago

    (and keeping in mind the nature of federation meaning the only stuff my instance sends out is the stuff that I write)

    The stuff you write is personal data as long as it can be connected to your identity and so protected under the GDPR. But that’s a problem for other people.

    Your problem is the personal data of other people that come under your control. For starters, you need to answer this question: What legal basis do you have for processing that data?

    For those of us who love federation and privacy and want to federate while complying with the GDPR - what must be done?

    They need legal experts on the team. As GDPR-fans will tell you, data protection is a fundamental human right. We don’t let just anyone perform surgery, so don’t expect that just anyone should be able to run a social media site.

    Complying with the GDPR is challenging at the best of times. When you handle personal data, some of it sensitive, at the scale of a fediverse instance, it becomes extremely hard.

    Strictly speaking, it’s impossible. EG you need to provide information about what you do with the data in simple language. The information also needs to be complete. If the explanation is too long and people just click accept without reading, that’s not proper consent. You need to square that circle in a way that any judge will accept. That’s impossible for now. Maybe in a few years, when there’s more case law, there’ll be a solid consensus.

    Complying as well as possible will require the input of legal experts, specialized in the law of social media sites. The GDPR is not the only relevant law. There’s also the DSA, quite possibly other stuff I am not aware of, and local laws.

    Definite problems, I can see:

    1. Under german law, an instance owner has to provide an address, that may be served legal papers.
    2. It’s possible to embed images, but under the GDPR, there must not be connections to 3rd party servers without consent. In fact, all out-going links are a problem.
    3. Federation itself. You can’t federate with instance, if you haven’t made sure that they comply with GDPR.