Reading government regulation for social media apps

"Is this legal?" is almost never one question, and the answer almost never begins with a rule. It begins with five facts about your situation that determine which rules are even in play.

Skip those and you get the characteristic failure of online research on this subject: an authoritative-sounding answer drawn from another country, another kind of organization, or a version of a rule that was replaced. It reads perfectly and it is about someone else.

This is a research method, not a survey of every law governing social media apps. It names useful starting points, but which rules apply depends on place, activity, who you are, and date.

It shows how to work out which rules apply to you and where the current text lives. You either find the answer or learn exactly what to ask a professional.

What to take away

Pin the question down first

Every one of these changes the answer, and a question missing any of them cannot be answered at all.

The actor. Are you asking about an individual, a sole trader, a registered company, a nonprofit, a public body, or an employee acting for one of those? Obligations attach to categories, and moving between them changes what applies.

The activity. Not the product: the specific thing being done. Collecting information, showing advertising, taking payment, employing people, storing something, publishing something, or providing a service to others. Most rules attach to an activity rather than to an industry.

The territory. Where you are established, where the people you deal with are, and sometimes where the infrastructure sits. These are frequently three different places, and it is normal for more than one set of rules to apply at once.

The capacity. The same organization can be regulated differently depending on the role it plays in a given transaction: acting for yourself, acting on someone's behalf, providing tools to someone else, or intermediating between two parties. Capacity is where a great deal of confusion lives, because it is not visible from the outside.

The date. Which rules were in force at the time of the thing you are asking about. For past conduct this is the operative question, and it is not what a search will show you.

Write the five down before you open anything. Half of the disagreements that look like disputes about interpretation are actually two people answering the question with different values in these fields.

How regulation actually reaches you

It arrives through more than one route, and people commonly prepare for the first while being caught by the others.

Direct obligation. A rule applies to you because of what you are or what you do. This is the one people think of, and it is often the least likely to affect a small operator.

Contractual pass-through. Someone who is directly regulated pushes obligations to you through a contract: a customer, a supplier, a payment provider, a marketplace. The rule does not apply to you, but the contract does, and breaching it has the more immediate consequence.

Platform implementation. A service builds a requirement into its own rules and enforces it against everybody, sometimes more broadly than the underlying obligation demands. From your side this looks like a platform policy, and it is treated as one, but the reason it exists is elsewhere. How that side works is set out in platform terms and rules. For instance, Instagram's Community Guidelines are platform rules, not government regulation; meeting them does not answer whether an app operator has separate legal obligations.

Procurement and insurance. Buyers and insurers impose requirements that go beyond the law because it reduces their own risk. These bind in practice long before anything else does.

Most operational compliance work in a small organization comes from the middle two. When something changes, ask which channel it arrives through, because the person you need to talk to is different in each case.

Find the body before you find the rule

Almost every subject has one or more responsible bodies: regulator, agency, department, or supervisory authority. An ombudsman scheme or professional body may be responsible, and identifying it is the highest-value step in the exercise, for three reasons.

Most governments publish directories; one country's is an index of federal agencies, and your own government publishes the equivalent where you are.

The body publishes the current text, which no aggregator reliably does. The body publishes guidance about how it interprets its own rules, which is frequently more useful than the rule. And the body is who you or your adviser would deal with, so knowing its name tells you where a complaint would go and who would ask you questions.

For a US social media app directed to children or knowingly collecting children's personal information, the Children's Online Privacy Protection Act (COPPA) may apply. The Federal Trade Commission (FTC) enforces COPPA; check the FTC's Children's Online Privacy Protection Rule and its guidance for the scope and obligations before drawing a conclusion about a particular app.

For a US employer's social media policy, check the National Labor Relations Act (NLRA) and guidance from the National Labor Relations Board (NLRB). The Act can protect employees who act together to address workplace conditions, including through online discussion; whether a policy crosses a line depends on its wording and on who is covered.

Examples for social media apps

Use these as starting points for research, not as conclusions about whether a particular app is covered:

For example, if a social app hosts user posts for people in the EU, first record the operator, the service's activities, and the relevant territories. Check the DSA definitions and scope, then the European Commission's materials or the relevant national Digital Services Coordinator's materials, depending on the service and issue. Separately assess whether the GDPR applies to the app's personal-data processing and consult the relevant supervisory authority. This research route does not establish that either law applies.

Where more than one body could be responsible, that is itself important information and usually means your activity sits on a boundary. Boundaries are where general advice is least reliable and professional advice is most worth paying for.

Note also that responsibility is often split by level: a national body, a state or regional one, and sometimes a local authority for the same activity. A complete answer at one level can be silent about a requirement at another.

What counts as a primary source

Not everything official-looking is authoritative, and the ranking matters when sources disagree. The official publication systems themselves describe what they hold and how current it is, which is worth reading once: GovInfo's explanation of the Code of Federal Regulations is one example, covering one country's arrangements.

Work down that list, not up it. And whatever you use, record the date you retrieved it. A note that says what a source said, and when you read it, is worth far more later than a conclusion with no provenance.

Passed, in force, enforced

Three states that get treated as one, producing both false alarm and false comfort.

A rule can be adopted and not yet commenced, sometimes with a long gap before anything is required of anyone. A rule can be in force with obligations phased by organization size, activity, or category, so that it binds some parties long before others.

And a rule can be in force while the responsible body has said it will focus initially on guidance and engagement rather than action, which is a statement about approach and not a change to the obligation.

When you find a rule, look for four things in the text or the body's own material. Has it commenced? Is commencement staged? Do transitional provisions apply to arrangements that already existed? And what has the body said about how it intends to start?

Do the same in reverse for anything you were told in the past. Requirements that were described as forthcoming may since have commenced, changed, or been dropped.

Definitions do most of the work

The commonest reason a rule turns out not to mean what a reader assumed is that a defining term in it is narrower or wider than the ordinary word.

Terms that regularly carry a specific technical meaning include the words for the parties, the words for what is being handled, the words for the activity, and the thresholds that determine whether an organization is in scope at all. All of them are usually defined in the instrument itself, and the definition governs.

Read the definitions section before the operative part, then read the operative part again. If a rule applies to a defined category, the only question that matters is whether you fall inside that definition, and that is often harder than it looks.

Where the answer is uncertain, that uncertainty is what to take to an adviser. Framing it precisely will cost you much less of their time.

What a headline does not tell you

Coverage of regulation is compressed by necessity. The four things to check are scope (who and what is covered), commencement (when obligations begin), status (whether a measure is proposed, adopted, in force, or being enforced), and territory (where it applies).

Treat coverage as a signal to go and look rather than as an answer. Take the name of the instrument and the name of the responsible body from it, and get everything else from the body.

Keep a record somebody else could follow

Whatever you conclude, store it so that a colleague, a successor, or an adviser can pick it up without repeating the work.

Record the following:

The last two are what turn research into compliance. A conclusion nobody acted on and nobody will revisit is a document, not a control.

When to stop researching

Reading further has diminishing value and rising risk once you reach any of these points.

At that point the useful output of your research is not an answer. It is a well-framed question, with the five facts, the instrument you think applies, and the specific ambiguity. That is a much cheaper thing to put to a professional than an open question, and it is where amateur research genuinely pays for itself.

Nothing on this page is legal advice, and it is not a substitute for it.

What to hold on to

The research skill here is not reading law. It is narrowing the question until it has one answer, finding the body responsible, taking the text from that body, and recording what you found and when.

Do this and you will either have your answer or know exactly what to ask, the more valuable outcome.

Common questions

How do I find out whether a rule applies to my business?

Pin the five facts, identify the responsible body, and read the scope and definitions in the instrument itself. If you cannot resolve whether you fall inside a defined category, that is the question to take to an adviser rather than a question to answer by reading more summaries.

We operate in several places. Which rules apply?

Potentially all of them, and they are not necessarily consistent. The usual approach is to establish the requirements for each territory separately rather than assuming the strictest one covers everything, because obligations can conflict as well as differ in strictness.

A rule was announced last year. Are we late?

Check its commencement provisions rather than its announcement date. Announced, in force, and applicable to an organization like yours are three different things, and the gaps between them can be long.

Is the platform's approval enough?

No. A service allowing something means only that the service allows it there. It has no bearing on any obligation you have independently, and the reverse is also true.

How often should any of this be revisited?

On a fixed cadence for anything material to your operation. Revisit immediately on any of these triggers: entering a new territory, starting a new activity, crossing a size threshold, a change in the capacity in which you act, or a notice from a body or a contractual counterparty.