User-Generated Content Clause in Privacy Policy and Terms and Conditions Agreement

If you host user-generated content on your site, you need to consider the legal implications for the relationships between you, the user and third parties.

At the bare minimum, you need a clause covering this relationship and how any disputes will be settled. In many cases, the points may make more sense as several connected clauses located within your Privacy Policy and Terms and Conditions agreement.

This article will show you what needs to go into this important clause so you can draft your own.

What is User-Generated Content?

'Content' is a wide-ranging term so you need to cover all possibilities. In short, your user-generated content clause needs to cover anything that appears on your site but which you do not create yourself.

This could cover website features such as:

• Social media posts
• Message boards and discussion forums
• User reviews
• "For sale," "help wanted" and similar features

Remember that the legal implications are usually the same regardless of whether the user-generated content is the sole or primary purpose of your site or simply an additional feature.

The legal implications can cover all forms of content, not just writing. Examples include images, video and audio.

Remember also that the legal implications apply (sometimes more so) where the user is posting content they have not created themselves. It's the fact they are posting it to your site that makes it user-generated.

The legal implications may vary depending on whether you:

• Let users post directly to the site and only moderate it later on
• Let users post directly to the site but with an automated content check
• Manually review user-generated content before it goes up on the site

Where a User-Generated Content Clause Appears

The various elements of a user-generated content clause could be appropriate for several documents or sections on your website. These include:

• Your Privacy Policy
• Your Terms and Conditions agreement

In some cases, you may repeat clauses or points across documents.

You could:

• Display the clauses when somebody creates a user account or uses a posting facility
• Post the documents on your site and include a link at the point somebody creates an account or posts content

The key is to make sure that:

• Users are aware of the rules before they post any content
• Third parties such as rights holders can easily find your policies and how to make a complaint or take action over any alleged violations

Points to Cover in User-Generated Content Clauses

What Content is Acceptable and Not Acceptable to Post

You can cover these points in several ways:

• As a dedicated document
• As a dedicated clause in a Terms and Conditions or Privacy Policy

The key is to make clear what content it is acceptable to post, though usually businesses do this by listing the types of material users are not allowed to post.

Examples could include:

• Content that violates third-party intellectual property rights
• Content that is offensive, obscene or discriminatory
• Content that could cause harm (including damaging computers)
• Content that enables or encourages people to break the law
• Repeatedly reposting the same content
• Reposting content that has already been removed
• Content that includes somebody's personal details or private information, particularly that of third parties
• Content that contains advertising or promotional material
• Posting material under a new account after being suspended or banned from using the site

Slack explicitly sets out banned actions for users:

Removal of Content and Other Consequences

You need to make clear if, when and how you will remove content that violates your Acceptable Use Policy.

Points to cover include:

• Whether you give the user an opportunity to modify content before you remove it (for example, to make it compliant with your Acceptable Use Policy)
• Whether you will keep a copy of the content, for example to restore it if the user shows you were wrong to remove it
• Whether you will block the user from posting content in the future. You may have rules on which type of violating content leads to a ban, and whether you ban them immediately or operate a multiple strikes policy.
• Whether you will end a user's paid account if they breach the Acceptable User Policy. If so, say whether they will get any refund
• Whether users can download copies of their content after you ban them

OLIO details a wide range of possible consequences:

The User's Intellectual Property

The user will often hold some intellectual property rights over the material they generate and post to your site. Most commonly, this will be copyright, which automatically applies to any original material including their writing, images, audio and video. (Registering copyright is usually not necessary to enjoy the legal rights, but in some jurisdictions registration can make it easier to exercise the rights or get additional damages for a violation.)

You will need to explain how your site publishing the user-generated content affects the user's copyright. One option is to require the user to surrender their copyright as part of posting it.

Another is to require them to give you a license to use the material: this means you have their permission but they still retain ownership of the copyright. You should address what happens if another organization buys out your site or business. Ideally, you would be able to transfer the license to use the user-generated material.

You could make clear that the license does not require you to pay any money to the user, including in cases where you derive revenue from the content. For example, the user would not have the right to a share of any money from advertising that appeared beside their content.

Apple details the license that users grant when posting material:

Limiting Your Liability

When somebody posts user-generated content on your site, there's a risk the material could cause harm or financial damage to a third party. You will usually want to limit or disclaim liability for this damage, meaning the user is solely or mainly responsible and the third party cannot seek or gain compensation from you.

Such harm could include breaching the third party's intellectual property. This most commonly involves copyright (an original expression of ideas in forms such as writing, images, sound and video) but could involve trademarks or patents. The harm could also involve defamation (libel) or a breach of the third party's privacy.

Exactly how far you can go in disclaiming liability will vary depending on your jurisdiction. It could also vary depending on whether or not you let users post directly to the site or if you moderate content before it becomes publicly available.

For this reason, disclaimers often include wording such as "to the fullest extent allowable by law." This wording usually aims to find a middle ground between disclaiming any liability (which may not be legally valid) and accepting all liability.

The most extreme measure you can take is to require users to indemnify you against liability. This means that they will have to repay your costs if you have to pay damages to a third party because of material the user posted.

Twitter explicitly disclaims liability for content posted by users:

Digital Millennium Copyright Act

This United States federal law sets out specific rules for handling allegations of copyright violations. It can apply both to website owners and to their hosting companies or other service providers.

In short, the process is as follows:

• The copyright holder (or person claiming to be the copyright holder) files a "Takedown Notice" with the site owner or hosting company. The notice should include the URL where the infringing content appeals, the URL (or other location) of the original content, and the details of the copyright ownership.
• The site or service provider decides whether to take the content offline. If they do so, they benefit from a "safe harbor" protection that means they can't be sued over the alleged infringement.
• The person who posted the content (the user in the case of user-generated content) can file a counter-notice to say (under penalty of perjury) that the allegation of infringement is incorrect. The website or host can put the content back online after 10 days unless the copyright claimant has begun legal action against the alleged infringer. The website or host must put the content back online after 14 days if the copyright claimant has not begun legal action against the alleged infringer.

Your user-generated content clause should address how you handle the DMCA takedown process.

This should include:

• A statement that you respond to takedown notices and counter-notices, removing and reposting material in line with the law
• Contact details for filing takedown notices and counter-notices
• The information you require people to include in the notices and counter-notices

NAMM covers all of these points:

Privacy Issues

User-generated content could include personal information that is protected under data protection and privacy laws. You may also collect and process associated personal information such as the email address, name and date of birth a user provides when signing up for an account allowing them to post material.

Which laws apply will depend on your location, that of the user, and the physical location of any data processing (for example in a data center in another country.) Many laws offer some exemptions for personal information the user has made public, for example by posting it in their content, but you shouldn't treat this as a blanket exemption.

Normally, you will cover privacy issues in a standalone Privacy Policy. Your user-generated content clause should make clear that any information the user provides or posts on your site will be covered by this policy.

Your Privacy Policy may have to include specific details for particular laws, but generally you should address:

• What information (or types of information) you collect
• How and why you use it
• How long you keep it
• Whether you share it with anyone else (including selling it)
• How the user can find out what information you hold about them
• Whether and how the user can ask or tell you to correct or delete information or get a copy to take to another organization
• How the user can complain or ask you to review a decision
• Whether you use the information for automated decision making (profiling)
• How you protect the information from unauthorized access, alteration or deletion

The New York Times addresses user-generated content in its Privacy Policy:

Summary

Let's recap what you need to know about user-generated content clauses:

• User-generated content is anything users post to your site. It may be their own creation or somebody else's material.
• A user-generated content clause helps clarify the relationship between you, the user and any third parties.
• A user-generated content clause needs specific information. This information could work best as a standalone document or a clause (or clauses) in your Privacy Policy and/or your general site Terms and Conditions.
• Spell out what types of content users can and can't post, along with the consequences of breaking the rules.
• Address the user's intellectual property rights over their content. Most commonly, you will require them to grant you a licence to use it without any money changing hands.
• Disclaim or limit liability for any harm the user-generated content causes to third parties, though be aware that laws in your jurisdiction could restrict these limitations.
• Detail how people can file a DMCA takedown and how you will respond.
• Remember that user-generated content could have privacy implications and make sure users are aware of your Privacy Policy.