The Law of the Server is the Law of the Site: a Trans-Atlantic Free Speech Defense Doctrine

A note to fellow U.S. legal practitioners on European Union censorship laws.

(Originally published on PrestonByrne.com.)

As some of you may know, I am counsel to the plaintiffs, together with my co-counsel Ron Coleman, in the case 4chan Community Support LLC and Lolcow LLC dba Kiwi Farms vs The UK Office of Communications AKA Ofcom.

That case concerns the question of whether the UK can enforce its domestic censorship laws within the United States. I am quite unable to talk about the legal aspects of the case, and do not do so here. I also do not discuss English law. This blog post is about general principles regarding cross-border enforcement of censorship codes, in particular EU law, as I observe a change of mindset among European lawyers as they start to ask hard questions about the offshore enforceability of their censorship laws.

This post also sets out a new doctrine for transatlantic free speech defense, a doctrine that can be both used to beat inbound censorship and will eventually become more widely recognized in the U.S. and European legal communities, which I can sum up in one line:

“The law of the server is the law of the (web)site.”

Or, for the more classically minded among you: lex loci machinae.

This post is prompted by a knowledge update published yesterday by London law firm Taylor Wessing about the 4chan litigation. TW correctly identifies the general legal point that, if Americans can obtain confirmation from U.S. courts that European notices sent by e-mail are not legally binding, it’s not just the Online Safety Act that will become difficult to enforce - it’s the Digital Services Act and the EU GDPR, too.

This is in contrast to other takes in the London legal market, such as this piece written by the London office of Katten - titled “A (Byrne &) Storm is brewing,” in reference to my law firm - warning Americans to not “ignore the Online Safety Act’s international reach.”

Respectfully, the United States, not Ofcom or the European Commission, sets the rules on what orders Americans may safely ignore in the United States. Although the Europeans may not know this, we Americans already know that e-mailed demands from European speech and data protection regulators are not legally binding in the United States. They’re also almost certainly unenforceable here even if validly served.

Although a new precedent would be nice, as a practical matter, we don’t especially need one - these points are largely settled law in the United States, and indeed there’s a recent example from February of earlier this year that, because it involved a couple of conservative social media websites, went largely unnoticed. Foreign censorship mandates are just something the US judicial system hardly ever sees, because European censorship colonialism was fairly uncommon until this year. More on that below.

But back to the firm’s article, Taylor Wessing writes:

Scope creep: if the challenge is successful, it has potential implications for a range of other extra-territorial effect UK and EU laws subject to the wording of the judgment and the wording of the legislation in question. It may impact both how to enforce (ie whether it can be done by email or whether the Treaty procedure has to be followed), and whether enforcement is even recognised under US law. The Trump administration is already pushing back on what it sees as foreign interference with US companies as a result of recent EU and (to a lesser extent) UK digital legislation, so this challenge, if successful, could impact more than just the OSA.

As a general rule, laws are contained by sovereign boundaries: legal notices issued in or by one country are not legally binding on persons or entities in any other country. This is an ancient principle of international comity, practically as old as the Westphalian system itself.

This can present some coordination problems among countries that share significant links, such as, for example, the United States and the United Kingdom, or the United States and many of the member states of the European Union. For this reason, the United States has executed treaties with these countries, either reciprocal treaties such as Mutual Legal Assistance Treaties (or an MLAT, pronounced “em-lat”) for criminal proceedings or the Hague Service Convention for civil proceedings, to deal with the issue of what happens when a legal process in one country needs to have legal consequences in another.

Taylor Wessing observes that Ofcom, under the OSA, has the power to serve via e-mail. The firm points out:

[in many] European countries... emails are routinely used to exchange official correspondence.

“Official correspondence” here means legal orders. America does not, as a rule, use e-mail to communicate legally binding orders, because the U.S. Constitution imposes due process requirements that require judicial supervision of any process that would deprive an American of their constitutional rights, or compel the disclosure of information or the seizure of property.

Ergo, as I said to the BBC about the 4chan case a month ago, having chosen my words extremely carefully,

Americans do not surrender our constitutional rights just because Ofcom sends us an e-mail.

I’m sure a lot of lawyers in London read that and thought I was firing off a snarky quote as bluster and/or in lieu of a coarser retort to the UK, to which I would remind them that Americans are, despite our reputation, quite capable of subtlety. In fact, I was communicating to European politicians that, to get an American to do something, you cannot simply send them a message. You must send them process, that process must comport with American due process requirements, and in the case of a foreign order, that means utilizing the relevant treaty.

This brings us to the subject of the European Union.

As the EU seeks to export its regulatory schemes to American shores, practitioners would do well to remember that, where U.S. law is concerned, the rule that we will wind up applying here after enough litigation works its way through the courts is simple: the law of server is the law of the site.

The ruling on a motion for a TRO by the plaintiffs in Trump Media and Technology Group v. De Moraes - which held, while denying the TRO, that the service of the Brazilian censorship orders outside of a treaty procedure is of no force and effect in the U.S. - is the first time a component of this principle has won in our courts, and illustrative of the service point. There will be more such wins as the Europeans try to enforce their rules here.

Per the Court’s ruling in Trump Media:

The Court finds that the pronouncements and directives purportedly issued by Defendant Moraes, (Dkts. 16-1, 16-2, 16-3, 16-4, and 16-5), were not served upon Plaintiffs in compliance with the Hague Convention, to which the United States and Brazil are both signatories, nor were they served pursuant to the Mutual Legal Assistance Treaty between the United States and Brazil. The documents were not otherwise properly served on Plaintiffs.

Additionally, the Court is aware of no action taken by Defendant or the Brazilian government to domesticate the “orders” or pronouncements pursuant to established protocols.

For these reasons, under well-established law, Plaintiffs are not obligated to comply with the directives and pronouncements, and no one is authorized or obligated to assist in their enforcement against Plaintiffs or their interests here in the United States. (Emphasis added.)

Finally, it appears no action has been taken to enforce Defendant Moraes’s orders by the Brazilian government, the United States government, or any other relevant actor.

Lex loci machinae holds that an American company engaged in constitutionally protected conduct through the operation of a website must comply with the legal rules where it actually operates, not the legal rules of a much wider world in relation to which it has no connection, save that its American servers may merely be accessed from there remotely via the Internet.

European speech rules don’t govern American metal, American communications, and American conduct on American soil.

The United States has fought multiple wars to settle that issue. The case law is out there, too, if you want to look it up. When speech or the hosting of speech is lawful in the U.S. and the hosting and editorial acts occur here, no foreign regulator may compel acts on U.S. soil or export penalties into the U.S. by e-mail. They must use the treaty and clear U.S. constitutional review.

An American site is only obliged to obey American law, and any purported foreign attempt to the contrary - to be properly served - must also comply with American law, namely the applicable treaty. For that demand to then be enforced, it must comply too with the rest of our laws, including the First, Fourth, and Fifth Amendments.

Sending an e-mail that demands unconstitutional censorship, data disclosure, or self-incrimination - for example - doesn’t comply with any of that. This has not stopped Europe from sending America a great many emails, or from planning to send a great many more. Nor has it stopped Americans, for the most part, from obeying those e-mails, even when they don’t have to.

The failure of lawyers on two continents to notice or do very much to stop Europe’s failure to adhere to our due process requirements has occurred, in my view, for two principal reasons:

• First, because international law firms have, historically, largely refused to represent U.S. companies who were targets of global censorship efforts, and therefore have no experience in this area; and

• Second, because the Big Tech companies those law firms represented have, historically, been willing to comply with European rules as they have domestic European establishments, meaning that it doesn’t make a lot of business sense for them to consider their U.S. constitutional defenses.

To give you some idea of how thin BigLaw’s bench is in this area, until Ofcom tried to extract a fine from 4chan, as far as I am aware, the only time a U.S. company has refused a European censorship fine - ever - was when the most long-standing of the European online censorship laws, the German “Network Enforcement Act,” known also as the “NetzDG,” purported to enforce a fine on U.S. social media company Gab, which operates a strict moderation policy that explicitly follows the U.S. First Amendment. Accordingly, for nearly a decade, Gab has been targeted for destruction by politicians and activist groups alike.

That particular German case was, again to my knowledge, also the only time that a US MLAT procedure has ever been knowingly and intentionally utilized by a foreign government to try to restrain constitutionally protected speech and conduct. (The BfJ also fined Telegram in 2022, but Telegram is a BVI company with operations in the UAE and no operations in the U.S., hence not entitled to American constitutional protection.) This happened under the first Trump Administration and, later, the Biden Administration. I had a word with a couple of Hill staffers about it earlier in the year and the notices from Germany have since ceased, presumably because they are now being blocked by the US Department of State and the Department of Justice.

When contacted by Der Spiegel to explain its refusal, Gab replied plainly that “Germany lost the chance to regulate American free speech in 1945” - μολὼν λαβέ, more or less. Gab was also one of Ofcom’s American social media targets, all four of whom I represent against the agency, and all four of whom, lawfully exercising their constitutional rights, refused Ofcom’s orders. I note for the record that, despite 8 years of attempts, the Germans have not been able to enforce the NetzDG on American soil.

Because they can’t.

It is therefore unsurprising there are few direct precedents in this area. It’s also entirely expected that it never occurred to anyone working at big law firms - with one notable exception, chiefly, counsel for the plaintiffs in Trump Media from Boies Schiller and DLA Piper - that funneling an EU regulatory demand through a treaty, where it would presumably go no further or expose itself to U.S. judicial or Executive Branch scrutiny, was a viable option. This is why law firms, particularly European law firms, are only starting to write public-facing notes about this now, and - judging from the hedging in those notes - still haven’t wrapped their heads around the applicable law.

I would expect that the UK’s blitzkrieg global rollout of the OSA was enough of a shock that larger U.S. companies are starting to review their global compliance posture and are beginning to figure this out for themselves.

Popular U.S.-based image sharing site Imgur certainly appears to have gotten the memo. The company, in response to a threatened UK regulatory fine, pulled out of the UK today, invoked the Constitution and told British regulators to go to hell - a move that is being referred to as the “4chan maneuver” online.

Taylor Wessing’s note correctly identifies that practically all European tech regulation, including the EU DSA and the EU GDPR, is potentially vulnerable if U.S. companies decide to force European speech and data protection regulators to behave like any other European state or non-state actor, and render service through the treaties – service which may not be waved through (in the case of MLAT) or, if it gets through one way or another, becomes vulnerable to constitutional attack the moment it is properly served, if not sooner.

It is difficult to see how the EU’s tech regulations will be effective at carrying out their objectives at all if U.S. lawyers begin to challenge them, through our actions and in our courts.

It would be nice for the U.S. Congress to enact a law like the SPEECH Act that created more robust defenses for American companies and American Internet users. In the meantime, American lawyers have plenty of procedural machinery available to us to bring foreign censorship to a grinding halt at our shores.

Europe will be able to do very little in the face of mass refusal of its orders and daring them to utilize a treaty procedure, and U.S. litigation, to attempt to enforce them in U.S. courts.

I doubt the Europeans have the stomach for that.