-1

I have an img on my website which is used as the profile picture of the user. It is embedded as <img src="${Hotlink}". The user can specify an URL and that is used as his profile picture.

What are the legal implications of this, does this under any Copyright or similiar issues?

Where do I look the legal paragraphs up myself?

Improve this question
1
  • 4
    Apart from legal things... you realize it is trivial to have a URL give you a picture of a funny clown if you are in Germany and a picture of male genitalia to anyone else, right? Or serve a swastika to Germans and a pizza to everyone else. Well, content from random internet trolls, that you would need specially trained moderators to even moderate properly. Even if legally valid, it simply is a bad, bad idea to embed dynamically changing user content. Unless you want to end up as a troll playground.
    – nvoigt
    Commented Jun 26 at 12:21

2 Answers 2

Reset to default
3

It's illegal to embed media from other sites without consent

Landgericht München I published a verdict on 10.01.2007 (AZ: 21 O 20028/05) that explicitly dealt with hotlinking a photo to embed it into a webpage. It was held, that this violates copyrights, if you present the work to a previously not impacted part of the public.

This sentiment was mirrored by the highest European court, the EuGH in the verdict of 09.03.2021 (Az. C 392/19) after the BGH asked about a very similar situation with videos. You can not legally embed or frame someone elses media (videos, images etc) on your page if the owning party has made even the tiniest (even ineffective!) protections. If such protections do not exist, then framing and hotlinking can be allowable.

Improve this answer
9
  • Are there any websites that allow embedding their images without consent?
    – Honigeintopf
    Commented Jun 26 at 8:19
  • 2
    @Honigeintopf That's a non-sequitur: If they allow it, then you have consent. If they don't allow it, you have no consent. Consent is allowance.
    – Trish
    Commented Jun 26 at 8:34
  • 1
    @Honigeintopf That is not how the courts interpreted it. If you usually have to log in to see an image or get the url, it's protected.
    – Trish
    Commented Jun 26 at 8:43
  • 1
    @User65535 it can - If I "deeplink" an image in the file directory of a server that shows that image only to logged in users normally, it circumvents the login. Or the image is normally shown with a watermark in it, but the file server also contains a version without but with a hidden modifier to the file name (e.g. "_orig") - linking to the normally not shown unwatermarked version is bypassing something.
    – Trish
    Commented Jun 26 at 9:02
  • 1
    Copyright infringement has no mens rea requirement.
    – Trish
    Commented Jun 26 at 9:05
1

What are the legal implications of this, does this under any Copyright or similiar issues?

So lets say I browse your site and then the code on your site makes a GET request to a third party site for an image, leaking my IP address to a third party.

Welcome to your very own DSGVO (=GDPR) violation. You would basically need to have me sign a consent form to leak my private data to random strangers all over the internet. Not going to happen.

You can either download the picture to your backend server and then serve me this picture from your server, or you can ask for my consent before you send my browser to download this picture from a third party source. That is how many sites link facebook posts and twitter posts nowadays with all their connected "like" buttons.

If you allow your code to automatically give my private information to a third party, you will be liable. Not for anything the third party could do wrong with it, just for the simple fact that you did.

Feel free to read through LG München I, Endurteil vom 20.01.2022 - 3 O 17493/20.

Partial Quote from the written judgement linked above:

The dynamic IP address constitutes personal data for a website operator because the website operator has abstract legal means that could reasonably be used to have the person concerned identified with the help of third parties, namely the competent authority and the internet access provider, on the basis of the stored IP addresses (BGH, judgment of 16.05.2017 - VI ZR 135/13). It is sufficient for the defendant to have the abstract possibility of identifying the persons behind the IP address. It does not matter whether the defendant or Google has the concrete possibility of linking the IP address to the plaintiff.

the defendant violated the plaintiff's right to informational self-determination by forwarding the dynamic IP address to Google when the plaintiff accessed the defendant's website.

Improve this answer
6
  • If this is true then any site that allows user generated hotlinks, which includes this one, facebook and twitter is susceptible to such a GDPR violation. I do not think any do the sort of caching you suggest.
    – User65535
    Commented Jun 26 at 12:35
  • @User65535 Can you show me a link on this site (or anywhere on the SE network) that would do the kind of hotlinking described?
    – nvoigt
    Commented Jun 26 at 12:38
  • 1
    @User65535 Wow, that seems indeed problematic. I don't know exactly what I as a registered user agreed to, but that is weird to allow for unregistered users. What happened to imgur? Well, anyway, you don't have to take my word for it, I linked the court decision, it doesn't get any more legally official than a judge saying so in their written judgement.
    – nvoigt
    Commented Jun 26 at 13:01
  • 1
    "What happened to imgur?" You get an imgur link if you use the hyperlink button, but if you just include the image with the markup ![alt text](link) you can use anything. I fear I cannot read German, if you had an English link I would read it.
    – User65535
    Commented Jun 26 at 13:03
  • 1
    I'm afraid there are no English versions, written judgement in Germany are in German. But you can throw it into a free online tranlator like deepl to read it in English. I added a small part of it that is the core of the issue in my point of view. The case is that someone linked to Google fonts dynamically, instead of loading them from their own webserver. And someone else sued, since that meant their IP address was made available to Google when the browser downloaded the font.
    – nvoigt
    Commented Jun 26 at 13:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .