Whose rules apply to the Web?

Sites go to extraordinary lengths to stay legal in a world where taboos vary.

The idea seemed like an obvious next step for profiting from online social networks: advertisements displayed on the side of individual Facebook home pages using pictures and names of friends to promote products.

For example, an ad for Blockbuster would hype that your friend "Meghan Marks gave a four-star rating to the movie 'Top Gun.'" Haven't seen it? Well, if Meghan likes it, perhaps you should rent it tonight.

But Facebook's new ad scheme has hit a snag – it might be illegal.

A century-old New York privacy law bans advertisers from using anyone's name or picture without written consent. Running such an ad in the Empire State is a criminal misdemeanor, says William McGeveran, a law professor at the University of Minnesota in Minneapolis.

The situation points to a larger question many dotcoms are now facing: Since websites can be displayed on screens anywhere in the world, does that mean they are beholden to the laws in every state and every country?

"When you put anything up online, you're not just sending it to New Jersey or to Australia. You're sending it everywhere," says Professor McGeveran. "It can be seen in countries with different ideas about speech and privacy – countries that don't have the First Amendment."

Applying existing laws to the Internet is a murky business. For years, courts and lawyers have questioned whether copyright laws written for the physical world should carry the same weight in the digital world, where duplicating products takes only the click of a mouse.

But sorting out which laws govern online activities could prove even more difficult, Internet experts say. After all, how do you draw jurisdictions for something called the "World Wide Web"? Facebook.com is based in California, and the data for those social ads can fly through wires in a dozen states before they reach your computer in New York. So which states' laws apply?

Facebook argues that it's none of the above. Because its content crosses many state borders, the site is protected from local rules by the US Constitution's Commerce Clause, says Chris Kelly, Facebook's chief privacy officer. "State laws aren't supposed to interfere with interstate commerce," he says. That's the domain of federal law.

Mr. Kelly assures that Facebook will address New York's concerns by making it clear to users that certain online actions they take would allow the site to use their faces in advertisements.

But whose rules govern US websites in other countries? There's no international equivalent to the Commerce Clause, so foreign judges apply local law.

Such a ruling caused a YouTube blackout in many parts of Brazil earlier this year. Supermodel Daniela Cicarelli sued the American video-sharing site in a Brazilian court, claiming that a steamy clip of her and banker Renato Malzoni that had popped up on the user-driven site violated her privacy. A court ordered YouTube to prevent the popular video from reaching computers in Brazil and demanded that some Internet providers block access to the entire website until YouTube could put an effective filter in place for that one video.

"There is no way to stop a similar lawsuit in the future," says Mia Garlick, product counsel for YouTube. "Different countries have different standards for privacy.... And it's obvious that you can't be on top of all the laws."

In June, YouTube took a step toward mediating the problem by rolling out localized versions of the site. There are now 18 different YouTubes, including one for Mexico, several in Europe, and a Brazilian edition. Each is translated into the local language and tailored to reflect the countries' attitudes on privacy, copyright, and decency, Ms. Garlick says.

For example, the Taiwanese YouTube, which opened last month, has a broader definition of what's racy or violent and locks such videos behind an age-restricted part of the website, she says.

"Anytime a company has a major presence in another country, they should open a local site," says Ian Ballon, an Internet law expert who works with companies to develop international strategies. But taking that step can be a hard sell for small Internet start-ups, and for some large companies as well, he says.

"In 1999, I walked through these ideas with the general counsel of a substantial software company," Mr. Ballon says. "He looked at me and said, 'That's ridiculous.' Now, a number of lawsuits means that that attitude has subsided a bit, but there is still that cowboy mentality."

Even localized sites aren't perfect. They can't protect companies from lawsuits, because foreign users can still enter the US version. For example: In France, where it is illegal to sell Nazi memorabilia, Yahoo's French marketplace blocked them. But French users could simply buy them on the American site instead. After a lawsuit in 2000, a French judge ordered that Yahoo prevent all access to race-hate memorabilia in France – regardless of where it appeared.

"Geofilters" on some Web pages, particularly shopping sites, try to block foreign users, but the filters are easy to fool.

In 2004, Dow Jones settled a $400,000 defamation case by Australian businessman Joseph Gutnick, who sued after a 2000 Barron's Online article linked him to a convicted money launderer. Since the New Jersey-based website broadcast the offending article around the world, Australia's High Court unanimously agreed that Mr. Gutnick could sue under Australia's more stringent libel laws.

More notoriously, when Google launched its Chinese-specific search engine, it agreed to censor certain terms in order to appease Beijing. When users of google.cn look up "Falun Gong" or "Tiananmen Square," they find very carefully worded websites. The company argues that it's better to offer a partial portal than none at all.

Perhaps the biggest challenge for Internet companies today is how to manage their sites in China. Government servers block unauthorized Web pages, and companies wishing to start a localized Chinese version often must make concessions. On Nov. 13, Yahoo settled a lawsuit brought by the families of two journalists who were jailed in China. The case accused Yahoo of illegally aiding the Chinese government in arresting the reporters by handing over information that led to their arrest – and alleged torture.

But what happens the next time a foreign government demands data from a website? Should the company break local laws to protect their users and morals?

"That's a question business schools aren't asking enough," says Peter Navarro, a business professor at the University of California, Irvine, and author of "The Coming China Wars." "Executives, now more than ever, need to answer a range of tough ethical questions, and more universities need to help students think through the problems – to understand where lines should be drawn."