Welcome, Fedizens!
This page, prompted by the #TwitterMigration of late 2022-23, is intended to be a rolling, continually updated collection of legal (and law-adjacent) links and resources for those deploying or administering their own Mastodon instances (servers) open to the public as they scale to tens of thousands of users or more. (As Bluesky goes from an initial platform to a federated AT Protocol, these principles may similarly apply.) There are undoubtedly many superior guides out there from a technical or operational perspective; my focus here is on three broad areas:
- Legal: Legal, compliance, regulatory, privacy (“data protection” in EU parlance), intellectual property (especially copyright, e.g. DMCA safe harbor), online liability (e.g. Section 230 in the US), judicial and legislative developments and threats
- Trust and Safety (T&S): Risk, abuse, harassment, spamming, scams, stalking, threats, phishing, doxxing, violent or hateful speech, dangerous dis- or misinformation, platform manipulation, data security breach, surveillance
- Content Moderation: Involving features of both of the above, as problematic content and misconduct in social media poses threats both to site or platform owner/operators (from a legal/liability perspective) and to the communities themselves (degrading or destroying trust, collegiality, community, signal-to-noise (S/N) ratio, overall value and usefulness)
But first, a brief pep talk courtesy of EFF:
“I worry that people will not want to host instances at all, because they go, ‘this is too scary,’ says Corynne McSherry, legal director at the Electronic Frontier Foundation, a nonprofit focused on civil liberties in the digital world. “But it doesn’t have to be scary.”
OK, now on to the good stuff!
Mastodon Legal Mini-FAQ:
1. Why should I care?
Since Elon Musk bought Twitter and unleashed one chaotic decision after another, people have signed up for Mastodon instances in surging waves that have sometimes kicked them briefly offline.
- As owner, operator, or admin (#MastoAdmin) of any user-generated content (UGC) site, such as a Mastodon server, you face responsibilities, risks, and potential liabilities that aren’t necessarily obvious.
- Pragmatically, the risk profile shifts dramatically if your volunteer hobbyist project explodes from a few friends to tens or hundreds of thousands of strangers using a platform open to members of the general public. (Compare to having a few people over to your house vs. running a shopping mall—even though you don’t own any of the stores, and may not even be charging them any money yourself.)
2. Why should I not care?
- If you’re just a normal user of someone else’s Mastodon instance (server), you probably shouldn’t. This is “inside baseball.” That said, if it interests you anyway, read on! These issues and debates are not going away any time soon.
- If you operate entirely outside the United States, I can’t offer many suggestions as to what legal, compliance, or regulatory risks you might face in your country. This may all be irrelevant. That said, similar problems regarding trust and safety, and challenges of content moderation, are similar to some degree worldwide.
3. Why should I listen to you?
- As a lawyer who’s headed or worked on in-house legal teams at social giants dating back to MySpace (2004-06) and eHarmony (2006-09), I’ve built and managed legal teams and compliance processes for #1, served as chief legal counsel to trust and safety teams in #2, and collaborated with community managers, T&S teams and senior executives on #3.
On a personal level, I’m a geek who’s been a prolific user of various flavors of social computing dating back to the mid-1980s, when I was co-sysop of my middle school friend Dave’s BBS in Menlo Park, CA. (I envied his 10MB — yes, megabytes, not GB or TB — hard drive the size of a microwave oven, noisy fan and all, that accompanied his Apple IIe and dial-up modem.) - That said, feel free to ignore or tell me why I’m wrong. With an online industry background at private-sector startups and growth companies, which built platforms ranging from zero to more than a billion page views per day, I’m new to the unique challenges and distinctions of federated content and open protocols at such vast scale.
4. How can I help?
In the spirit of all things Fediverse, any form of collaboration is welcome. Don’t hesitate to suggest additions to any of these links or resources. I am planning to develop more original material and curate good examples to serve as reference for admins (e.g., TOS, privacy or copyright policies).
Mandatory disclaimer
I am an attorney in private practice, licensed in the State of California. That said, everything posted or linked from here should be considered information, not legal advice or opinion, unless we have formally entered into an attorney-client relationship. - Federalism in the US is its own challenging subject. Congress has chosen to regulate many areas at the federal level (patent, trademark, copyright, privacy, online liability, advertising, child protection) which may preempt or work in conjunction with the laws of multiple states. Depending on the subject or state, “your mileage may vary.”
- Things get extra messy on the Internet, where the “location” of activities like publishing or making copies of something (and therefore jurisdiction of states or countries over those actions) can be ambiguous. Never mind the entire field of conflicts-of-law when electrons collide mid-Interwebz.
Mastodon Legal, Compliance, Privacy, Trust and Safety Resources for Admins:
[N.B.: Just getting started here, under construction; consider this version 0.1]
All legal materials refer to United States law unless otherwise noted.
Legal, Compliance, Privacy / Data Protection, IP:
- My own overview of the range of considerations running a UGC site here at Techlexica (badly needs updating, yet covers most essentials):
If you build it, they will abuse it - The first-I’ve-seen guide to potential legal liabilities for US people running a Mastodon instance, posted in November 2022 by Denise Paolucci, drawing on long experience from LiveJournal and Dreamwidth
- Original thread by Denise (@rahaeli on Twitter), on which she based the above (unrolled for easier reading)
- User Generated Content and the Fediverse: A Legal Primer, by EFF counsel Corynne McSherry
- Mastodon Is Hurtling Toward a Tipping Point (Wired, Amanda Hoover)
- The Copyright Challenge With Mastodon (Plagiarism Today, Jonathan Bailey)
- Sample Terms of Service and Copyright Policy (aka DMCA notice-and-takedown procedure) for a US-based UGC site, kindly offered by Denise on a CC-BY-SA basis (see #2 above)
- UK: Notes on operating fediverse services from an English law point of view, by Neil Brown
- EU / EEA: Mastodon data protection guidance including Mastodon Privacy Guide and template privacy notice geared towards EU-based admins, by Carey Lening (@privacat@dataprotection.social)
- Brand protection on Mastodon: what trademark professionals need to know (World Trademark Review; Paywalled)
Trust & Safety, Content Moderation, Community Management:
- The thick skin guide to online community management, by Michael Szell
- How to Make the Fediverse Your Own, a guide from Social.coop to “intentionally setting up democratic governance, democratic economics, and democratic community”
- My own guide If You Build It, They Will Abuse It (#1 above)
- The Santa Clara Principles on Transparency and Accountability in Content Moderation
Lots more to come. Stay tuned and thanks for reading! Don’t hesitate to contact me (@antone@sfba.social) with questions or suggestions.
(Last revised May 15, 2023 by Antone Johnson)
Connect with social media lawyer Antone Johnson on Mastodon or Bluesky Social.
