2

I'm considering a web site on tor network because this way I don't need to publicly disclose anything about me to register a clearnet domain.

Since sites on tor are private (from owner's perspective) I'm wondering why should I bother with legal documents like cookie policy or Terms of Use etc. since nobody could sue because no info about me is anywhere to able to do so.

So the question here is: Is the operator of a website required to have legal documents on hidden service, and under which law(s)?

Maybe I should have posted this question in https://webmasters.stackexchange.com but I believe it's more appropriate here.

edit:

Here is a PDF document I found published by NATO Cooperative cyber defence centre of excellence CCDCOE.

It provides technical and legal details about usage of tor and hidden services, such as various rights, it's a good read however it does not touch legal documents, I guess because they're optional.

Interested folks will surely find it useful, be it for study or to help provide an answer.

Improve this question
3
  • 1
    By "hidden website" do you mean the "dark web"?
    – Barmar
    Commented Sep 20 at 15:04
  • Hidden service (or server) is one which is accessible only over tor network, meaning it's not reachable on clearnet. It doesn't have to be dark web, it may apply to deep web as well or a private web server (ex. authentication required to access it on tor network).
    – metablaster
    Commented Sep 20 at 15:21
  • Isn't this essentially asking: If I set myself up in way that in all likelyhood I won't be caught, do I still need to obey the law?
    – quarague
    Commented Oct 7 at 13:22

2 Answers 2

Reset to default
3

Impressum (contact address)

Anonymitiy does not excuse not complying with § 5 DDG (formerly: TMG)

The DDG - digital services law, formerly known as TMG, TeleMedia Law - prescribes in §5, that as soon as you offer any service in commerce, then you have to always provide an "Impressum", which needs to contain a physical address where lawsuits can be delivered, and the name of who is responsible for the site. This Impressum has to be both easily accessible, and easily recognizable. As such, German domains (or domains of German Companies) usually have a link labeled as Impressum or contact at the bottom or in the menu.

A site being private does not change the fact that it is commercial or not: an access-restricted bar is private in that it is not open to the public, but it is commercial. A playground might be private (=access restricted) or public, and still isn't commercial unless you charge access fees.

The only light at the end of the tunnel here? The DDG applies to digital services of natural or legal persons that have their seat in Germany. The domain ending is irrelevant, the seat of the owner is.

Also, §5 only applies to commercial services. As a simple example, a mere photo album would not be commercial unless you charge for access or offer your services to create or sell the items depicted. However, the line between commercial and not can be complicated: as soon as anything is offered for any sort of compensation, you could be considered commercial. While a discussion forum or blog about how to fix your bike is inherently non-commercial, the presence of advertisements, a Patreon, sponsored content, or sponsored links to products could change that nature to commercial. At which point of ads that would be the case would be determined by the Staatsanwaltschaft (state attorney offices), and is out of scope for here.

Slight side note: you do not need to register your digital service anywhere, or gain a license for it, under §4 DDG.

The DDG calls out 2000/31/EG and 2010/13/EU, as well as 2019/1150, as it establishes its boundaries, applicability and jurisdiction in §1 to §3 DDG. These three matters of European legislation (though of different bodies) all indicate that very similar rules are in place all over the EU and EG. It also points to numerous other European legislations all over, and how it implements those. As a result, you most likely are obligated to have a legal address publicly posted on your website under which you are reachable as soon as you engage in any sort of commerce.

The caveat here is, that you need to be operating out of the EU. Should you operate out of for example , then these laws don't apply, but Sudanese law would. And... according to CIPESA, you don't really want to operate under Sudanese internet law.

Cookie Policy

As long as you don't create cookies, no law obligates you to have a cookie policy.

As soon as you do set cookies, you need a cookie policy under GDPR and e-privacy Directive. For some cookies consent isn't necessary, but you still need a policy explaining them.

Improve this answer
1
  • Thank you, I find it useful because it makes things clear regarding commercial activities.
    – metablaster
    Commented Sep 20 at 12:38
1

Anonymity does not protect you from legal consequences

Bank robbers wear masks; they still get caught and convicted.

Our colleagues on security would tell you that security by obscuration in not security.

Improve this answer
10
  • I understand +1, in an event I'm caught and sued, would legal documents of my website be considered for my defense since it's not clearnet web site? (I don't plan to conduct anything clearly illegal btw.)
    – metablaster
    Commented Sep 20 at 12:21
  • 2
    My question was "Should I have legal documents on hidden service and why?" But your answer does not answer that question. but I appreciate your answer because it's useful otherwise.
    – metablaster
    Commented Sep 20 at 12:31
  • 1
    @metablaster so I fixed the wording up in the OP
    – Trish
    Commented Sep 20 at 12:48
  • 1
    @JBentley Your comment makes sense philosophically, you might want to post an answer explaining why there is no difference and I'll be the first one to upvote it.
    – metablaster
    Commented Sep 20 at 13:47
  • 3
    @metablaster It's difficult to answer the question of "why there is no difference". Using this answer's example, can you explain why there is no difference in the law between a bank robber wearing a mask and a bank robber not wearing a mask? I can't point to a law which says there is no difference; it's just common sense plus the absence of any law which protects robbers with masks. Such questions are better dealt with the other way around: can you explain why there is a difference? Why do you think that a hidden website would not be subject to the usual laws?
    – JBentley
    Commented Sep 20 at 13:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .