united-states contract-law software privacy european-union
Are there any laws around viewing the messages of the members of a site you own?
<p>If I build a website that has a messaging feature between users, what laws are there governing my behavior as the owner of the website?</p>
<p>That is to say, I am the sole moderator and database administrator. By default I can see everyone's messages to each other and am automatically privy to every private conversation.</p>
<p>This is a new position for me to be in. Are there any laws around this in the US or EU? I mean, it is my website, and I never promised that messages were encrypted or anything. I'm really unsure.</p>
<p>To an extent I feel this is important for me to be able to do, to prevent or mitigate harassment. But at the same time, idk.</p>

<p>If you haven't disclosed to your users that you are willing and able to arbitrarily read any &quot;private conversation,&quot; as you put it, I think it would be fair to say that the users haven't consented to that kind of access to their messages.</p>
<p>If that's the case, I think you'd want to look at <a href="https://www.law.cornell.edu/uscode/text/18/2511" rel="nofollow noreferrer">18 U.S. Code § 2511</a>, which imposes criminal sanctions on anyone who &quot;intentionally intercepts ... any wire, oral, or electronic communication.&quot;</p>
<p>As for the E.U., my guess is that the <a href="https://en.wikipedia.org/wiki/General_Data_Protection_Regulation" rel="nofollow noreferrer">GDPR</a> would have a lot to say about this, but I'm not familiar enough with it to say how it handles this kind of situation.</p>

<p>Under the GDPR, you are required to take &quot;technical and organizational measures&quot; to safeguard the privacy of your users.</p>
<ul>
<li>You are allowed to have admins who <em>can</em> read the messages.</li>
<li>You cannot allow them to <em>do</em> it on a whim, or to satisfy their curiosity.</li>
<li>You can allow them to do it to resolve technical issues.</li>
<li>I don't know what you can allow your moderators.</li>
</ul>
<p>The fact that you are owner, admin and moderator in one person means that you &quot;wear different hats&quot; at different times. Things you can do as admin to safeguard the system integrity may be different from things you can do as a moderator to uphold community standards.</p>
