I want to host a small website on my server where friends (and friends of friends) can upload files to get a link so that other can download those files again. Exactly like a filehosting service.

No account is needed on my site and I thought that I need some kind of user agrement that saves me a little bit from files that could be illegal on my server.

Is it possible to add a "by uploading you accept our user agrement" to my site where rules are written like

  • I am not responsible for uploaded files
  • I do not scan or look at files so I don't know what is uploaded
  • etc

Would a text like that secure me for legal actions against me if someone uploads something illegal?

  • There's a long list of "basic file share" companies that have been sued and shut down despite well done ToS, you need a lawyer.
    – Ron Beyer
    Oct 11, 2021 at 16:01

1 Answer 1


Not on its own, no


A ToS can be of some value, but will not fully protect the site operator (host). For one thing, a ToS is probably not binding on the user based on a contract of adhesion such as "by using this site you agree to...". A specific act, such as clicking a checkbox that defaults to clicked or activating an "I accept the terms" button is probably required to make a ToS binding on the user.

But a host must do more that obtain an agreement to its ToS. Once it has actual knowledge of illegal content, a host must take action to remove or disable it, or else it may be liable as if it had posted the content itself.

It also depends what kind of "something illegal" is involved. The most common form is perhaps content that allegedly infringes copyright.

Safe Harbor

In the EU Article 14 of the EU Directive on electronic commerce (Directive 2000/31/EC) will apply (note that being a directive, rather than a regulation, 2000/31/EC) depends on implementation in national law, which may vary from one country to another.

Article 14 reads:


  1. Where an information society service is provided that consists of the storage of information provided by a recipient of the service, Member States shall ensure that the service provider is not liable for the information stored at the request of a recipient of the service, on condition that:

(a) the provider does not have actual knowledge of illegal activity or information and, as regards claims for damages, is not aware of facts or circumstances from which the illegal activity or information is apparent; or

(b) the provider, upon obtaining such knowledge or awareness, acts expeditiously to remove or to disable access to the information.

  1. Paragraph 1 shall not apply when the recipient of the service is acting under the authority or the control of the provider.

  2. This Article shall not affect the possibility for a court or administrative authority, in accordance with Member States' legal systems, of requiring the service provider to terminate or prevent an infringement, nor does it affect the possibility for Member States of establishing procedures governing the removal or disabling of access to information.

Article 14 means that when a host obtains actual knowledge of infringing or otherwise illegal content, the host must promptly delete that content or disable access to it. Such knowledge could come via a takedown notice.

According to the page "Copyright infringement and remedies in Germany":

One of the main situations refers to platform operators. Once they have been informed about a specific infringement on their platform, they are required to remove the specific infringing content and to implement measures in order to prevent future violations.

See also the Wikipedia article "Notice and Take down" which discusses Article 14, and points out that it does not define a specific notice and take down procedure, unlike the US provisions of 17 USC 512 (which includes the DMCA notice and take down procedure, and the related Safe Harbor provisions). Since Article 14 clearly envisages some sort of notice procedure, but not specific procedure has been defined in the laws of most EU member states, including Germany, some people use the US DMCA notice format, as describesd in this article. Such a notice may serve to give a German host "actual knowledge" and impose liability if the host fails to respond promptly.

There have been recent legal cases which affect the procedures in such cases, as reported in "Copyright 'safe harbours' for service providers need to be consistent" from Pinsent Masons and "Germany: Time To Hit Pause: Copyright Infringement On User Generated Platforms – When Is The Platform Provider Liable For Damages?" from Morrison & Foerster LLP.

The Morrison & Foerster article reads:

Previous rulings by the CJEU have addressed both the application of the safe harbor principle set out in the EU E-Commerce Directive1 that shields hosting providers from liability for hosted unlawful third-party content of which they have no actual knowledge and, separately, the extent of infringement of copyright by hosting of, or linking to, copyright infringing third-party content under the EU Copyright Directive. But it is still unclear under which conditions the providers of the various online platforms that store and make available user-generated content, can rely on the safe harbor privilege applying to hosting providers to avoid liability, or whether they must not only take down the infringing content when they obtain knowledge of such content but also compensate the rightsholders of such content for damages for copyright infringement.

The Pinsent Masons article reads:

[A] ruling last year by a German court has highlighted an anomaly in the way 'safe harbour' protections ISPs enjoy under EU law apply in the case of copyright enforcement. It has confirmed that applications for blocking orders and injunctive relief are treated differently, despite the economic effect of those measures being the same.

The safe harbour protections stem from the EU's E-Commerce Directive. That legislation prohibits service providers from being put under any general obligation to monitor for illegal activity by users of their service.

In addition, where the service providers are mere conduits to infringing activity by others, they cannot be held liable for that activity unless and until they obtain 'actual knowledge' of the activity. At that stage, a service provider must act expeditiously to remove or to disable access to the information if they are not to be held liable themselves for infringement.

However, EU copyright law cuts into these 'safe harbour' protections. It makes clear that rights holders can apply for an injunction against intermediaries whose services are used by a third party to infringe copyright.

In Germany, however, changes made to the Telemedia Act in October 2017 have spurred debate over the admissibility and the requirements of blocking injunctions.

Other unlawful content

Other sorts of illegal content are possible, such as neo-Nazi propaganda and Child Pornography, which are criminal under German law. In theory Article 14 applies to such content as well as to alleged copyright infringements. But since these are serious crimes, the degree of promptness expected from a host will probably be greater.


A hosting provider will need, at the least, to respond to notices alleging copyright infringement or other illegal content, and provide an address to which such notices can be sent. A host might do well to implement the full DMCA takedown procedure. ToS provisions will not provide a shield against liability after a notice is sent to the host.

A host may be required to block future access by those whose previous uploads have been found to be unlawful. This may require soem sort of log-in procedure.

Thus a simple ToS provision, as described in the question, particularly in the absence of any log-in mechanism, and of any enforcement of the ToS provisions, will not be enough to shield the host from liability for unlawful content posted by users.

  • So I need to implement a checkbox to agree the ToS that needs to be actively checked by the user before upload, provide an email address for notices, need to repond to those notices and delete the content. Would that be enough to shield me against such things? (I do not want to implement a login system to keep it simple. Does it help that my site doesn't store files indefinitly but only for max 30 days?) Oct 12, 2021 at 6:28

Not the answer you're looking for? Browse other questions tagged or ask your own question.