Ask HN: How do I prevent my users from uploading copyrighted material? | Hacker News Reader

Ask HN: How do I prevent my users from uploading copyrighted material?

4 pointsboeing7679 comments

I'm building a Gumroad-like platform for creators to sell their ebooks, and I've heard horror stories about how entire platforms get torpedoed because 1 bad actor user uploaded illegal/copyrighted material, so Stripe pulls the plug on them and fined them to the heavens.

I've been thinking about how to combat this, and I've come up with 2 solutions:

1. Let users bring their own API keys (meaning I use Stripe Connect and use the "direct charge" model), so I don't get held liable to refunds, chargebacks, etc. My own Stripe is literally for subscription fees, that's it.

2. I haven't looked into it, but maybe there's an API out there, or even some AI bot, that I can use to screen uploaded material to see if they're illegal or copyrighted?

Is there any other solution that I'm missing?

View on HN

Your project is doomed to failure unless you actually take the time to understand copyright. You have clearly already skipped that step, so you should go back to it before you do anything else.

For one thing, everything is copyrighted automatically. A creator uploading a work that they just created is uploading a copyrighted work. What you need to do is to ensure, somehow, that only the owner (or a licensee) of that copyright uploads the work.

And no, there is no service or API or ai bot that can help you. If I write a story tonight, I automatically own the copyright on that story and there is no way for that hypothetical ai bot or API to know about it.

Lawyers learn about this stuff in law school. At minimum, you need to find one of their textbooks and read it. Then you need to hire a lawyer of your own to advise you.

I think it's clear the poster means "material the users do not own the rights to" by "copyright material".

That said, you can legally post material that you don't own the rights to as long as you have licence, or a licence to do so (ie. Public Domain, CC-* material) as long as you abide by that licence.

Yeah, and I need a way to screen for people who upload stuff that isn't theirs and selling it.

I think that's a huge legal liability.

Maybe for this business I finally need to set up an LLC.

I heard Gumroad has tons of outsourced workers in India literally manually going through uploads to check for this.

I'm not sure what I have to do, but I hope it won't come down to that.

Option 0: get a lawyer who knows about this stuff.

IANAL, but refunds & chargebacks are not your biggest concerns:

* providing a download service for copyrighted files you don't have a license for

* showing names & descriptions of trademarked products without the permission of the trademark holder

* even HAVING the really illegal stuff on your servers

Yeah, you're absolutely right.

Even merely listing them on my site is a huge liability.

And I'd be in deep trouble if someone uploaded child porn or something.

Your best bet is #1 along with clear Terms of Service. #2 is not happening. The value of Gumroad is not in the software (you clearly can build it yourself for the most part). The value is in the ecosystem and the tools/resources they have to validate uploads (most likely manual but they can afford to do that).

The value of Gumroad is certainly the software for the end-users.

End-users don't care about validating uploads.

But validating uploads is a necessary evil in order to sustain the business.

All user input is evil, but especially so when they have a free-for-all "upload" field.

Just hire hundreds of people to manually check the uploads. Easy. Sometimes, some things cannot be automated.

IANAL, and as a consumer I hate DMCA but as a platform, it is your friend.

Built a system so that copyright-holders can notify you of copyrighted material.

Built a system so that you can immediately stop serving any material in question and provide a way for uploader to appeal. Next step is either manually verify the material in question or use some sort of AI/hash matching/something.

And finally don't use Stripe. Get a real merchant account where you can talk to someone in person.

Reply on news.ycombinator.com