Unwanted Exposure: Civil and Criminal Liability for Revenge Porn Hosts and Posters
Hollie Toups, the first named plaintiff in Toups v. GoDaddy, was harassed for weeks after nude pictures of her appeared on the website Texxxan.com alongside her real name and a link to her Facebook profile. When Toups requested that Texxxan.com remove the pictures, she was told by the website that they could help in exchange for her credit card information.[i] Texxxan.com is a “revenge porn” or “involuntary porn” website.[ii] The website and others like it act as repositories for nude photos of individuals submitted by their former boyfriends, embittered friends, or malicious hackers. On January 18, 2013 Toups and 22 other female plaintiffs whose nude photographs appeared on the website filed a lawsuit in the District Court of Orange County, Texas against Texxxan.com, Texxxan.com’s uploaders and subscribers, and the web hosting and the Internet domain registrar giant GoDaddy.com for invasion of privacy and intentional infliction of emotional distress.[iii] They are seeking temporary and permanent injunctions shutting down Texxxan.com, damages,[iv] and class action certification.
Texxxan.com is one of a number of websites that have emerged in recent years seeking to capitalize on the proliferation of amateur porn facilitated by the digital age, and the humiliation it causes. Some, like Texxxan.com, insert pornographic photos into dating-site-style profiles that include screenshots of or links to the person’s social media pages and real name. Others, like IsAnybodyDown?, include more invasive details such as the person’s phone number, address, school, place of work, and children's names. Some allow people who submit content to assign the person to categories based on their age, weight, or alleged STD status, such as Your Mom's Nudes for older women. Underscoring the fact that the postings are malicious and intend to embarrass the victim, websites like You Got Posted feature nude photos in which the person’s face is cropped out or obscured—likely the person taking or sending the image was attempting to preserve some privacy—alongside their name and pictures of their face taken from Facebook, revealing their identity. Websites like MyEx include a space for visitors to anonymously post harassing comments. Because of the breadth of information aggregated on the profiles, revenge porn pages are commonly at the top of Google search results[v] of the person’s name.
Revenge porn has caused the embarrassment, reputation ruination, and even suicide of women featured on these websites. It has contributed to dangers in the physical world such as stalking and harassment when anonymous visitors have used the information found on revenge porn websites to contact the people photographed offline. Women have lost their jobs and received threats of being gang raped because of the posts. When nothing has been effective at getting photos removed from websites, victims have resorted to changing their names and phone numbers.
Alternatives to Host Liability
In addition to filing lawsuits like Toups, victims have tried other tactics to compel revenge porn websites to remove their nude photos. There are several alternative strategies available that are largely unsuccessful. One is for the victim to claim copyright and issue a Digital Millennium Copyright Act (“DMCA”) takedown notice. Consistent with the property-centric ethos of American law, Congress has bestowed intellectual property owners broad and systematic rights. A woman who takes a photo of herself is the rights holder of the photo under 17 USC § 201 of the Copyright Act, and therefore enjoys exclusive rights to distribute and display the photo. The DMCA “safe harbors” protect service providers from liability for the allegedly infringing third party content they host, provided they comply with “notice and takedown” procedures. A DMCA takedown notice alerts a host website to the content and requires the website to expeditiously remove or disable access to it or risk being liable itself. A victim who is also a copyright holder can issue a DMCA takedown notice, and, if a website doesn’t comply, she can sue them for infringement. Protecting privacy rights was not the intent of the legislature when drafting the DMCA, but it has provided some victims with relief; Internet Service Providers (ISPs) generally comply with DMCA notices, whereas they ignore pleas from victims of harassment.[vi] Unfortunately, in response to DMCA notices, revenge porn websites have found strategies to evade law enforcement. Foreign webmasters claim that because their servers are hosted elsewhere, they are beyond U.S. jurisdiction and immune from the law. Revenge porn website IsAnyoneUp? responded to copyright law pressure by hiding its server. To find out what server the company was using and determine where to send a DMCA notice, a victim would have to sue the website and get a subpoena. This option is undesirable given that hiring a lawyer and filing suit is expensive and runs the “Streisand Effect” risk of drawing more attention to the very material a victim is hoping to suppress. It is also only available when the victim took the photo of herself, which is not always the case. A self-help option has emerged to exploit the plight of people tormented by revenge porn and capitalize on their desperation. Like the service offered to Toups through Texxxan.com, some websites offer allegedly blackmailing services that claim to convince websites to remove photos in exchange for money. The more victims there are of revenge porn and the more acutely they suffer, the more prosperous these services become. IsAnybodyDown? features an advertisement for a service called Takedown Hammer, which claims to work on behalf of victims to have the offending content removed for a flat fee. This service is provided by a “friend” of Craig Britton, one owner of IsAnybodyDown?. IsAnybodyDown? admitted to receiving money from Takedown Hammer; however, it denies that the payments were for anything but advertising space. Suspiciously, Takedown Hammer claims to be operated by a New York-based lawyer named David Blade, III, but no such name appears in the New York State Unified Court System’s attorney database. First Amendment attorney Marc Randazza is investigating the possibility that Britton also owns Takedown Hammer. If this is true, Britton may have committed multiple felonies by operating Takedown Hammer, including interstate extortion. Services like Takedown Hammer encourage the socially deleterious viewpoint that privacy is a commodity instead of a right. Women are encouraged to independently bargain for their safety instead of being afforded it by the state. Additionally, self-help remedies, though beneficial to more affluent victims, could hurt victims as a whole by causing momentum for judicial intervention to wane. As is the case with other online reputation management options, courts and legislature may be reluctant to intervene where the market provides a solution to those who can afford it.[vii] Some victims may be able to bring a lawsuit for invasion of privacy against the perpetrator that posted the photos to a revenge porn website. While this may seem ideal, there are numerous downsides. Court documents with the plaintiff’s name would be in the public record and thus widely accessible, increasing the exposure the pictures receive. The non-profit organization Without My Consent advocates for courts to allow more anonymous plaintiff suits to be brought against revenge porn posters and ISPs, to deter people from posting revenge porn without exacerbating the humiliation of victims. However, if the content was posted anonymously, as it often is, the victim would have to bear the time and expense of two suits: one requesting a court order compelling the host website to reveal the poster’s identity and one against the poster. Posters may be judgment proof; meaning attorneys may not be willing to take these cases on a contingent fee basis. Thus, although a victim’s identity would be protected their finances could suffer greatly. What is worse, winning a suit against a specific poster does not necessarily mean that the revenge porn website will remove the offending photos. In Blockowicz v. Williams, the court found that they lacked the power to compel the website Ripoffreport to remove content posted by one of the website’s users, even though the content had been deemed defamatory in a prior lawsuit. A similar outcome in the revenge porn context could leave victims with large legal fees but no change in the visibility of their nude photos.Criminalizing Posters
Once partial solution is to allow criminal proceedings to be brought against the poster, so the government is named and the victim remains anonymous. The government can use fact-finding procedures not available to private parties, and criminal prosecution has a punitive function that could be a powerful deterrent, especially against judgment proof defendants. Two states have already implemented legislation imposing criminal penalties against revenge porn posters. In April of 2013, Florida passed House Bill 787 which will “criminalize the non-consensual transmission or posting of nude adult photographs and videos that include personal information to websites or social networking services. . . without first obtaining the depicted person’s written consent,” making such behavior a felony. The bill also makes the non-consensual use of a person’s personal identification information to harass that person a first-degree misdemeanor. New Jersey’s criminal invasion of privacy statute criminalizes the photographing, filming, and distribution of “the image of another person whose intimate parts are exposed or who is engaged in an act of sexual penetration or sexual contact, without that person’s consent and under circumstances in which a reasonable person would not expect to be observed.” Criminal penalties are appropriate in instances where conduct is considered to be harmful to society as a whole. The revenge porn problem is largely gendered; the subjects are almost exclusively women. In the United States a double standard persists where women are judged more harshly for their sexual behavior than their male counterparts. Individuals, particularly young women, suffer long-term reputational harm stemming from their Internet activity.[viii] A woman’s trust—however naïve—that a boyfriend will respect her privacy should not ruin her chances of professional success indefinitely. The impact that these anti-social websites have on many women—and thus society as a whole—warrants more laws criminalizing revenge porn. The purveyors of revenge porn and some commentators argue that revenge porn websites are ushering in new social norms that reflect the growing ubiquity of sexting and sex tapes, and the heightened transparency of having online identities.[ix] They reason that, eventually, the stigma attached to posing nude will subside without the need for potentially speech-quelling regulation. Some have gone so far as to “blame the victim” for the posts, since the harm could have been avoided by not initially consenting to take the photos. These stances fail to fully appreciate the weight of the consequences for the people featured on the websites. Revenge porn websites do not promote tolerance; instead they promote sexism by objectifying women for male gratification, subjugate women by eliminating their agency to choose to appear on the websites, and preclude them from the rewards that website traffic confers. Even if society were to react with acceptance it would fail to address all of these concerns, and, in the interim, women encounter serious threats to their safety. The welfare of women should not be sacrificed to an illusory ideal of a just society.The Major Hurdle: Section 230 Immunity
For the court in Toups v. GoDaddy to find that Texxxan.com is liable, the plaintiffs will have to overcome the broad immunity of section 230 of the 1996 Communications Decency Act (CDA), which protects ISPs from liability for user generated content they host. The drafters of the CDA aimed to encourage free speech online while concurrently giving website operators an incentive to self-police. They did this by granting them immunity from liability for content posted by non-owner users. Under section 230, ISPs like GoDaddy.com and Texxxan.com enjoy a safe harbor from liability for user-generated content they host, even where the content is defamatory or invades privacy. Section 230 also explicitly protects website users, which includes the defendant-subscribers to Texxxan.com. Under this bleak analysis, the statute appears to preclude victory for the plaintiffs against all defendants; however, there have been several encouraging cases that have broken through the barricade of section 230 when the host website has contributed to the illegal content. One is Sarah Jones v. Dirty World Entertainment Recordings LLC. TheDirty is a website that hosts user-submitted posts. TheDirty's editor selects submissions for publication and adds one or two sentences of snarky commentary to each one. Jones argued that, by adding comments to the posts, the operator of TheDirty became a "creator" of defamatory content posted about her. She further argued that TheDirty was designed to "encourage" users to post defamatory material and that, by claiming ownership of user-submitted material, the website and its operators were "publishers." In denying summary judgment to the website, the court stated that an ISP could be liable for defamation in a case where the ISP “invites the posting of illegal materials or makes actionable postings itself.” The judge based his ruling on Fair Housing Council of San Fernando Valley v. Roommates.com and Federal Trade Commission v. Accusearch, finding they held that if a website is to "specifically encourage development of what is offensive about the content," then section 230 does not afford protection. In Roommates, an en banc Ninth Circuit held that the website Roommates.com could not claim immunity under section 230 when it required users to choose among set answers to questions that violated the Fair Housing Act. The court found that by requiring users to submit answers, the website was affirmatively "inducing third parties to express illegal preferences," making the website a "co-developer" of the content. In Accusearch, the website Accusearch appeared as an intermediary between customers and vendors that sold private records about people. The FTC sued Accusearch for selling confidential information. The court held that Accusearch was not entitled to immunity under section 230 because of the role it played in content creation. The court said that, by soliciting requests for the personal information and purchasing them from third parties, the defendants were at least partially responsible for the content’s creation. Consistent with these decisions, the court in Toups v. GoDaddy should adopt the position that websites like Texxxan.com, which solicit and encourage illegal uses beyond any other legitimate uses, should not be protected by section 230. Revenge porn websites facilitate illegal conduct by encouraging users to post privacy-invading photos. They further encourage illegal uses by providing potentially defamatory categories for the individuals to be grouped into, which could be considered contributing content. Revenge porn websites may not host inherently illegal content like Roommates.com, and they may not select the defamatory words like TheDirty, but their primary purpose is to disseminate content that is privacy invading and illegal. Adopting this position would insulate GoDaddy and other ISPs from liability, but still target the host websites. This logic is analogous to secondary liability theories in copyright law that put websites outside of the DMCA safe harbor. In copyright law a host website is contributory liable for infringement where the defendant had knowledge of the infringement and the defendant materially contributed to the infringement. A host website is liable for vicarious infringement where the defendant had a financial interest in the infringement and the defendant had the legal right and the practical ability to stop the direct infringement but did not do so. A host website is liable for inducement where it “distributes a device with the object of promoting its use to infringe copyright, as shown by clear expression or other affirmative steps taken to foster infringement.”[x] If an analogous standard were applied to revenge porn, the websites would meet every theory of secondary liability; the websites know of the illegal conduct of their users, they materially contribute to the conduct by supplying fields and labels for the privacy invading information, they have a financial interest in promulgating the conduct through membership subscriptions and/or advertising revenue, they have the ability to remove the illegal content, and the websites promote the illegal use by taking affirmative steps to solicit the illegal content. Just as with websites that have been found guilty of copyright infringement, revenge porn websites do not have any other substantial non-illegal use. Websites that meet these criteria should be outside of section 230 protections. However, this approach and any other that finds websites liable for the content they host faces opposition from critics who argue that limiting 230 would chill speech and impinge on First Amendment rights. They fear that more posts would be deleted reflexively by websites at the first sign of a complaint, not because they actually defame or violate privacy, but because the website operator figures it is better to be safe than sorry. In the context of revenge porn, it is hard to imagine that a significant amount of free speech would be censored. First, the First Amendment does not protect certain kinds of speech, such as defamation and threats and should not protect invasions of privacy. Second, the party claiming to have their privacy violated by the posting of a nude photo clearly has the more compelling interest in their personal privacy and safety, as compared to the speech right of a troll to post a particular naked picture. To find otherwise would be to permit purveyors of malicious porn to cower behind a distortion of free speech rights and take advantage of First Amendment absolutism.The Future for Fighting Back
Revenge porn is unequivocally offensive, yet whether the court in Toups will hold Texxxan.com liable for hosting it remains to be seen. The people whose nude pictures and personal information is plastered on these websites need to have a way to get their photos removed, and someone should be held accountable for invading their privacy. Criminal penalties would go far to deter spiteful posters from submitting photos to revenge porn websites, and pressure from activists and women’s groups could be instrumental in more state legislatures passing criminal statutes. Liability for host websites would also be effective at eradicating this despicable conduct. Holding websites liable for promoting illegal uses above all other uses would be a step not only towards correcting the imbalance of rights bestowed on property and those bestowed on privacy but also towards protecting the future of women in the modern age.
[i] Jessica Roy, Victims of Revenge Porn Mount Class Action Suit Against GoDaddy and Texxxan.com, Betabeat (Jun. 7, 2013, 11:29 PM),http://betabeat.com/2013/01/victims-of-revenge-porn-mount-class-action-suit-against-godaddy-and-texxxan-com/
[ii] Texxxan.com is not currently up. The owner claimed that the “lease” on the website expired, but other reports claim GoDaddy shut it down because the owner had registered under a fake name, a violation of the Terms of Service.
[iii] They allege additional torts including intrusion of their right to seclusion, the public disclosure of their private facts, the wrongful appropriation of their names and likenesses, false light invasion of privacy, gross negligence, intentional infliction of emotional distress, and a civil conspiracy through a meeting of the minds to perpetrate these state law torts.
[iv] The filing lists “[a]ctual damages that include their severe mental anguish and emotional distress with physical manifestation that effect their daily lives and routines, humiliation, fear, and other non-economic damages, and also their economic damages” and “punitive or exemplary damages for the extreme and malicious conduct” and “to punish them for their malicious misconduct and deter any such future misconduct”
[v] See Chet Hardin, The Face of Revenge Porn, Colorado Springs Independent (Jun. 7, 2013, 11:29 PM), http://www.csindy.com/
[vi] Ann Bartow, Internet Defamation As Profit Center: The Monetization of Online Harassment, 32 Harv. J. L. & Gender 383, 389 (2009) at 421.
[vii] Id. at 422.
[viii] Mollie Brunworth, How Women Are Ruining Their Reputations Online: Privacy in the Internet Age, 5 Charleston L. Rev. 581, 583 (2011) at 583
[ix] Eric Goldman’s blog claims “we as a society will necessarily have to adjust our social norms about the dissemination of nude or sexual depictions to reflect their ubiquity.”
[x] MGM Studios, Inc. v. Grokster, Ltd., 545 U.S. 913 (2005)