In general, a federal law called "Section 230" (47 U.S.C. § 230 which is part of the Communications Decency Act) makes a provider of a potentially legitimate Internet service immune from civil or criminal liability in the United States for user generated content, so long as the provider does not participate in generating the content along with the user.
Your mileage in jurisdictions outside the United States may vary. Most other countries are not as solicitous of the rights of Internet service providers as the United States.
So, generally, there would be not liability for this service in the United States.
This is true even when the provider has good reason to believe that the provider's service is being used to perpetrate crimes and receives payment for use of the service by users, as in the case of "BackPage" a classified ad site used on a paid basis to advertise prostitutes including human traffickers (as found in a recent criminal case launched by a California prosecutor).
On the other hand, if the provider actively marketed the site as a means by which someone could commit crimes, that might very well cross the line. Also, the site would probably have to cooperate with law enforcement subpoenas to investigate the site's customer/users, even if this harmed their business.
Appendix: The Full Text of Section 230
(a) FindingsThe Congress finds the following:
(1) The rapidly developing array of Internet and other interactive
computer services available to individual Americans represent an
extraordinary advance in the availability of educational and
informational resources to our citizens.
(2) These services offer users a great degree of control over the
information that they receive, as well as the potential for even
greater control in the future as technology develops.
(3) The Internet and other interactive computer services offer a forum
for a true diversity of political discourse, unique opportunities for
cultural development, and myriad avenues for intellectual activity.
(4) The Internet and other interactive computer services have
flourished, to the benefit of all Americans, with a minimum of
government regulation.
(5) Increasingly Americans are relying on interactive media for a
variety of political, educational, cultural, and entertainment
services.
(b) Policy
It is the policy of the United States—
(1) to promote the continued development of the Internet and other
interactive computer services and other interactive media;
(2) to preserve the vibrant and competitive free market that presently
exists for the Internet and other interactive computer services,
unfettered by Federal or State regulation;
(3) to encourage the development of technologies which maximize user
control over what information is received by individuals, families,
and schools who use the Internet and other interactive computer
services;
(4) to remove disincentives for the development and utilization of
blocking and filtering technologies that empower parents to restrict
their children’s access to objectionable or inappropriate online
material; and
(5) to ensure vigorous enforcement of Federal criminal laws to deter
and punish trafficking in obscenity, stalking, and harassment by means
of computer.
(c) Protection for “Good Samaritan” blocking and screening of
offensive material
(1) Treatment of publisher or speaker
No provider or user of an interactive computer service shall be
treated as the publisher or speaker of any information provided by
another information content provider.
(2) Civil liability
No provider or user of an interactive computer service shall be held
liable on account of—
(A) any action voluntarily taken in good faith to restrict access to
or availability of material that the provider or user considers to be
obscene, lewd, lascivious, filthy, excessively violent, harassing, or
otherwise objectionable, whether or not such material is
constitutionally protected; or
(B) any action taken to enable or make available to information
content providers or others the technical means to restrict access to
material described in paragraph (1).
(d) Obligations of interactive computer service
A provider of interactive computer service shall, at the time of
entering an agreement with a customer for the provision of interactive
computer service and in a manner deemed appropriate by the provider,
notify such customer that parental control protections (such as
computer hardware, software, or filtering services) are commercially
available that may assist the customer in limiting access to material
that is harmful to minors. Such notice shall identify, or provide the
customer with access to information identifying, current providers of
such protections.
(e) Effect on other laws
(1) No effect on criminal law
Nothing in this section shall be construed to impair the enforcement
of section 223 or 231 of this title, chapter 71 (relating to
obscenity) or 110 (relating to sexual exploitation of children) of
title 18, or any other Federal criminal statute.
(2) No effect on intellectual property law
Nothing in this section shall be construed to limit or expand any law
pertaining to intellectual property.
(3) State law
Nothing in this section shall be construed to prevent any State from
enforcing any State law that is consistent with this section. No cause
of action may be brought and no liability may be imposed under any
State or local law that is inconsistent with this section.
(4) No effect on communications privacy law
Nothing in this section shall be construed to limit the application of
the Electronic Communications Privacy Act of 1986 or any of the
amendments made by such Act, or any similar State law.
(f) Definitions
As used in this section:
(1) Internet
The term “Internet” means the international computer network of both
Federal and non-Federal interoperable packet switched data networks.
(2) Interactive computer service
The term “interactive computer service” means any information service,
system, or access software provider that provides or enables computer
access by multiple users to a computer server, including specifically
a service or system that provides access to the Internet and such
systems operated or services offered by libraries or educational
institutions.
(3) Information content provider
The term “information content provider” means any person or entity
that is responsible, in whole or in part, for the creation or
development of information provided through the Internet or any other
interactive computer service.
(4) Access software provider
The term “access software provider” means a provider of software
(including client or server software), or enabling tools that do any
one or more of the following:
(A) filter, screen, allow, or disallow content;
(B) pick, choose, analyze, or digest content; or
(C) transmit, receive, display, forward, cache, search, subset,
organize, reorganize, or translate content.
UPDATE: While I don't have full access to the relevant legal sources, I can point you in the right direction and the news isn't great. The regulatory scheme in India has been described as "Onerous Yet Inadequate".
ISPs have been specifically categorized as internet intermediaries
under the Information Technology Act, 2000(amended in 2008 and
hereinafter referred to as the Act). Section 79 of the Act provides
immunity to the ISPs in certain cases of internet wrongs even if
committed through their networks provided they follow the due
diligence guidelines, prescribed in detail in the Information
Technology (Intermediaries guidelines) Rules, 2011 and expediently
remove/disable access in case of any actual knowledge of unlawful act
or on receipt of government notification to that effect. This immunity
from liability, however, does not apply when the unlawful act concerns
copyright or patent infringement, both of which have been specifically
excluded by way of proviso to section 81 of the Act.
In view of internet being one of the prime mediums for accessing,
distributing and most importantly infringing copyrighted content,
liability of ISPs in case of copyright infringement is fixed by the
Copyright Act, 1957 mostly under Section 51(a) (ii) of the Act which,
inter alia, holds, any person providing "any place" for communication
of infringing work, for profit, to the public, liable of infringement
unless she can prove that she was not aware or she had no reasonable
grounds for believing such communication to be infringing.
Section 79 of the Information Technology Act, 2000 as amended and as clarified by regulation and case law, is India's equivalent to Section 230. This states (verbatim):
CHAPTER XII: NETWORK SERVICE PROVIDERS NOT TO BE LIABLE IN CERTAIN
CASES
- For the removal of doubts, it is hereby declared that no person providing any service as a network service provider shall be liable
under this Act, rules or regulations made thereunder for any third
party information or data made available by him if he proves that the
offence or contravention was committed without his knowledge or that
he had exercised all due diligence to prevent the commission of such
offence or contravention.
Explanation.—For the purposes of this section,—
(a) "network service provider" means an intermediary;
(b) "third party information" means any information dealt with by a
network service provider in his capacity as an intermediary;
Thus, unlike Section 230, which automatically provides immunity for third-party content violations generally even if the provider suspects that the service is being misused, Section 79 provides immunity only if the Internet company proves the affirmative defense of lack of knowledge or exercise of due diligence.
The 2011 regulations do clarify what constitutes due diligence somewhat. But, the regulations turn out to be rather onerous indeed. One of the first requirements is to have a Terms of Service Agreement with many terms required by regulation that must be enforced. The regulations state (definitions omitted) that:
- Due diligence to he observed by intermediary — The intermediary shall observe following due diligence while discharging his duties,
namely : —
(1) The intermediary shall publish the rules and regulations, privacy
policy and user agreement for access-or usage of the intermediary's
computer resource by any person.
(2) Such rules and regulations, terms and conditions or user agreement
shall inform the users of computer resource not to host, display,
upload, modify, publish, transmit, update or share any information
that —
a) belongs to another person and to which the user does not have any
right to;
b) is grossly harmful, harassing, blasphemous defamatory, obscene,
pornographic, paedophilic, libellous, invasive of another's privacy,
hateful, or racially, ethnically objectionable, disparaging, relating
or encouraging money laundering or gambling, or otherwise unlawful in
any manner whatever;
c) harm minors in any way;
d) infringes any patent, trademark, copyright or other proprietary
rights; violates any law for the time being in force;
e) deceives or misleads the addressee about the origin of such
messages or communicates any information which is grossly offensive or
menacing in nature;
f) impersonate another person;
h) contains software viruses or any other computer code, files or
programs designed to interrupt, destroy or limit the functionality of
any computer resource;
i) threatens the unity, integrity, defence, security or sovereignty of
India, friendly relations with foreign states, or public order or
causes incitement to the commission of any cognisable offence or
prevents investigation of any offence or is insulting any other nation
(3) The intermediary shall not knowingly host or publish any
information or shall not initiate the transmission, select the
receiver of transmission, and select or modify the information
contained in the transmission as specified in sub-rule (2): provided
that the following actions by an intermediary shall not amount to
hosing, publishing, editing or storing of any such information as
specified in sub-rule: (2) —
(a) temporary or transient or intermediate storage of information
automatically within the computer resource as an intrinsic feature of
such computer resource, involving no exercise of any human editorial
control, for onward transmission or communication to another computer
resource;
(b) removal of access to any information, data or communication link
by an intermediary after such information, data or communication link
comes to the actual knowledge of a person authorised by the
intermediary pursuant to any order or direction as per the provisions
of the Act;
(4) The intermediary, on whose computer system the information is
stored or hosted or published, upon obtaining knowledge by itself or
been brought to actual knowledge by an affected person in writing or
through email signed with electronic signature about any such
information as mentioned in sub-rule (2) above, shall act within
thirty six hours and where applicable, work with user or owner of such
information to disable such information that is in contravention of
sub-rule (2). Further the intermediary shall preserve such information
and associated records for at least ninety days for investigation
purposes,
(5) The Intermediary shall inform its users that in case of
non-compliance with rules and regulations, user agreement and privacy
policy for access or usage of intermediary computer resource, the
Intermediary has the right to immediately terminate the access or
usage lights of the users to the computer resource of Intermediary and
remove noncompliant information.
(6) The intermediary shall strictly follow the provisions of the Act
or any other laws for the time being in force.
(7) When required by lawful order, the intermediary shall provide
information or any such assistance to Government Agencies who are
lawfully authorised for investigative, protective, cyber security
activity. The information or any such assistance shall be provided for
the purpose of verification of identity, or for prevention, detection,
investigation, prosecution, cyber security incidents and punishment of
offences under any law for the time being in force, on a request in
writing staling clearly the purpose of seeking such information or any
such assistance.
(8) The intermediary shall take all reasonable measures to secure its
computer resource and information contained therein following the
reasonable security practices and procedures as prescribed in the
Information Technology (Reasonable security practices and procedures
and sensitive personal Information) Rules, 2011.
(9) The intermediary shall report cyber security incidents and also
share cyber security incidents related information with the Indian
Computer Emergency Response Team.
(10) The intermediary shall not knowingly deploy or install or modify
the technical configuration of computer resource or become party to
any such act which may change or has the potential to change the
normal course of operation of the computer resource than what it is
supposed to "perform thereby circumventing any law for the time being
in force: provided that the intermediary may develop, produce,
distribute or employ technological means for the sole purpose of
performing the acts of securing the computer resource and information
contained therein.
(11) The intermediary shall publish on its website the name of the
Grievance Officer and his contact details as well as mechanism by
which users or any victim who suffers as a result of access or usage
of computer resource by any person in violation of rule 3 can notify
their complaints against such access or usage of computer resource of
the intermediary or other matters pertaining to the computer resources
made available by it. The Grievance Officer shall redress the
complaints within one month from the date of receipt of complaint.
One could quibble over whether the service you describe is really an "Intermediary" but this appears to be the most sensible reading of the statute and the regulations as the instructions in those authorities can be applied in a way that makes sense to your proposed venture.
