COMING INTO FORCE, NOT COMING INTO EFFECT? THE IMPACT OF THE GERMAN IMPLEMENTATION OF ART. 17 CDSM DIRECTIVE ON SELECTED ONLINE PLATFORMS CREATe Working Paper 2022/1

Germany transposed Art. 17 of Directive 2019/790 on copyright and related rights in the Digital Single Market (CDSMD) through a new Act on the Copyright Liability of Online Content Sharing Service Providers (OCSSP Act), which entered into force on 1 August 2021. After a brief summary of the state of the debate on the EU level regarding Art. 17 CDSMD and of the German OCSSP Act, this paper examines whether the terms and conditions and other publicly accessible copyright policies of eight services, namely YouTube, Rumble, TikTok, Twitter, Facebook, Instagram, SoundCloud and Pinterest, changed upon the entry into force of the German OCSSP Act. For this purpose, we reviewed and analysed the relevant German-language websites four times between July 2021 and November 2021. Our data collection reveals only few changes in the terms and conditions of platforms over time, but significant differences between the services in relation to their use of content recognition technology. The concluding section discusses the implications of these findings for the future of copyright policy in the EU.

2 the European Union (CJEU) at the time of conducting this study. 4 A comparison between the Commission Guidance on Art. 17 and the Opinion of Advocate General Saugmandsgaard Øe in the annulment action 5 reveals, however, that a mainstream view on how to accommodate the protection of copyright with freedom of expression under conditions of algorithmic content moderation appears to emerge. As regards the legal-technological starting points, there is now widespread agreement that: • Art. 17(4)(b) and (c) CDSMD effectively forces OCSSPs, in many cases, to put in place automatic content recognition and moderation tools to prevent the communication to the public of content for which rightholders have provided "relevant and necessary" information (indexed content); 6 • that no currently available technology can assess to the standard required by law as to whether user-generated content (UGC) is infringing or lawful; 7 • and that also for this reason there is a real risk of false positives, also known as overblocking. 8 Under these conditions, Art. 17(7) CDSMD and an interpretation of Art. 17 as a whole in light of freedom of expression suggest, according to both the Commission and AG Saugmandsgaard Øe, that: • an ex post complaint and redress mechanism (Art. 17(9) CDSMD) that restores blocked but legitimate content is insufficient; 9 • upload filtering must be limited to "manifestly" infringing UGC, whereas "ambiguous" content must not be the subject to preventive blocking measures; 10 4 Case C-401/19. 5 Opinion of Advocate General Saugmandsgaard Øe, 15 July 2021, Case C-401/19, ECLI:EU:C:2021:613. 6 Commission Guidance (n 3), p. 11-13; AG Saugmandsgaard Øe (n 5), paras. 57-69. 7 Commission Guidance (n 3), p. 20; AG Saugmandsgaard Øe (n 5), para. 67. 8 Commission Guidance (n 3), p. 13; AG Saugmandsgaard Øe (n 5), paras. 142-148. 9 Commission Guidance (n 3), p. 19; AG Saugmandsgaard Øe (n 5), paras. 180 et seq. 10 Commission Guidance (n 3), p. 21; AG Saugmandsgaard Øe (n 5), paras. 198 et seq., [205][206]. The distinction between likely (later "manifestly") infringing and likely legitimate uploads was mentioned first in a consultation paper published by the Commission in July 2020; see European Commission, Targeted consultation addressed to the participants to the stakeholder dialogue on Article 17 of the Directive on Copyright in the Digital Single Market, 27 July 2020, available at https://digitalstrategy.ec.europa.eu/en/news/directive-copyright-digital-single-market-commission-seeks-viewsparticipants-stakeholder-dialogue.
• criteria to distinguish between manifest infringements and ambiguous cases include the length/size of the UGC, the proportion of the content identified as matching indexed files in relation to the entire upload and the level of modification of the work. 11 The Commission and the Advocate General mention several concrete tools to put the abovementioned basic approaches into concrete action. Whereas users should be able to pre-flag content in order to trigger a manual check, 12 according to the Commission, rightholders should be empowered to block "earmarked content" which is particularly time-sensitive. 13 Finally, mechanisms to mitigate the risks of misuse of such procedures should be put in place. 14 the Act introduces a new category of "uses presumably authorised by law" -i.e. any statutory limitation to copyright that an OCSSP must in principle communicate to the public (Sec. 9(1)).

II. The German OCSSP Act
According to Sec. 9(2), this rebuttable presumption of lawfulness concerns UGC that: (1) contains less than half of one or several other works or entire images, (2) combines this third-party content with other content, and (3) uses the works of third parties only to a minor extent (Sec. 10) or, in the alternative, is flagged by the user as legally authorised (Sec. 11).
11 Commission Guidance (n 3), p. 21; AG Saugmandsgaard Øe (n 5), para. 202-203. 12 Cf. Commission Guidance (n 3), p. 21 (feedback from users) with AG Saugmandsgaard Øe (n 5), para. 211 with further references. 13 Cf. Commission Guidance (n 3), p. 14, 21 (e.g. pre-released music or films or highlights of recent broadcasts of sports events); critical AG Saugmandsgaard Øe (n 5), para 223 (a simple assertion of a risk of significant economic harm by rightholders does not justify preventive blocking unless the content is manifestly infringing). 14 Commission Guidance (n 3), p. Minor uses are defined in Sec. 10 as uses that do not serve commercial purposes or only serve to generate insignificant income and concern up to 15 seconds of a cinematographic work or moving picture, up to 15 seconds of an audio track, up to 160 characters of a text, and up to 125 kilobytes of a photographic work, photograph or graphic (e.g. memes). The flagging option comes into play where UGC exceeds these limits but still possibly qualifies for a limitation or exception because it combines images or less than half of indexed content with other non-indexed content into e.g. a remix or mashup (Sec. 9(2) Nos. 1 and 2). The flagging option must be implemented by OCSSPs during the upload of new content by the user. If the upload matches an indexed reference file submitted by a rightholder and would thus be blocked from being communicated to the public, OCSSPs must inform the user respectively and enable her to flag the use as authorised by law under any statutory limitation. Both minor and pre-flagged UGC trumps upload filters and thus will go online.
At the same time, the act obliges OCSSPs to inform a rightholder about the availability on their sites of minor or pre-flagged UGC containing parts of their indexed works (Sec. 9(3)). A rightholder may then initiate the regular internal complaints procedure, which might lead within one week to an ex post takedown and the future blocking of the upload in dispute (Sec. 14(1)- (3)). In addition, OCSSPs must provide "trustworthy" rightholders with a "red button" procedure aimed at premium content, e.g. live sports events or movie blockbusters. If, following a review by a natural person, such rightholder declares that a certain minor or pre-flagged use substantially impairs the economic exploitation of her work, the OCSSP is obliged to immediately block the uploaded content until the conclusion of the complaints procedure (Sec. 14(4)). 18 In sum, the German OCSSP Act establishes a complex legal framework which aims to translate the traditional legal structure of exclusive rights, limitations and exceptions and remedies into a digital realm where most decisions are taken and enforced automatically by content recognition technology that produces, however, false negatives and false positives. To balance exclusivity and access under these rough algorithmic conditions, the act distinguishes between the following situations: • Presumably illegal UGC that must be blocked: Uploads containing only indexed content or, if indexed content is combined with non-indexed content, the match ratio equals or exceeds 50%. 19 5 • Presumably legal UGC that must go online: Uploads combining minor parts of indexed works with non-indexed content.
• UGC in a grey area that combines non-indexed content with up to 50% of indexed content will be blocked unless the user flags it as lawful (green flag).
• Minor or pre-flagged combinations of indexed content with non-indexed content are to be blocked immediately if a trustworthy rightholders presses the "red button".
In this concept, most decisions will be taken seamlessly by machines (only indexed or combined content y/n; minor use y/n; </> 50 % match). In individual cases, humans may correct the algorithmic outcome by a pre-flagging or a "red button" declaration. OCSSPs must sanction misuses of these options by excluding the users or rightholders from the respective procedures for an appropriate period of time (Sec. 18 (1)(3) and (5)).

III. Effects of the German OCSSP Act: Research Question, Data and Methodology
In light of this emerging EU consensus on how to embed the checks and balances of copyright into OCSSPs algorithms, we wanted to find out whether the publicly accessible copyright policies on the German language websites 20 of eight services changed upon the coming into force of the German OCSSP Act on 1 August 2021. These services included: YouTube, Rumble (a smaller platform with similar functionality), TikTok, Twitter, Facebook, Instagram, SoundCloud and Pinterest. The selection of these eight services is based on the premise that all are arguably covered by the German Act because they store and give the public access to a large amount of copyright-protected content uploaded by their users, which they organise and promote for profit-making purposes. 21 At the same time, they differ in size, content focus (video, audio, picture, text) and also general functionality. 22 We copied and saved, in total, 514 documents containing terms and conditions, general community and copyright guidelines, complaint forms, FAQs and other relevant copyright help pages. 23 Furthermore, the process of uploading content was documented through screenshots 20 The only exception is Rumble, which does not provide a German-language website but is accessible for German users nonetheless. 21 Art. 2(6) CDMSD; Secs. 2 and 3 OCSSP Act. 22 Regarding the size of the platforms, the range varies between services with higher and smaller user numbers. E.g., in the impact assessment of the CDSMD, the EU For each service and each point in time, the source-data were analysed as to whether they implement the following six mandatory duties of OCSSPs under the German Act: (1) Ensure "qualified blocking" (upload filters), Sec. 7(1). 24 (2) Inform users about all statutory limitations and exceptions under German law, Sec. 5 (1) and (3). 25 (3) Enable pre-flagging of lawful content, Sec 11(1) No.3. 26 (4) Make an internal complaints procedure available, Sec. 14(1)-(3), (5). 27 (5) Implement a "red button" solution for trustworthy rightholders, Sec. 14(4). 28 2000/31/EC, COM/2020/825 final ("'terms and conditions' means all terms and conditions or specifications, irrespective of their name or form, which govern the contractual relationship between the provider of intermediary services and the recipients of the services."). 24 The provision reads: "Service providers are obliged, in accordance with section 1(2), to ensure, as far as possible, by blocking or removal (blocking) that a work is not communicated to the public and will in future not be available for this purpose, as soon as the rightholder so requests and provides the information required for such purpose." 25 The provision reads: "(1) The communication to the public of copyright-protected works and parts of works by the user of a service provider is authorised for the following purposes: 1. quotations in accordance with section 51 of the Copyright Act, 2. caricatures, parodies and pastiches in accordance with section 51a of the Copyright Act, and 3. other cases of communication to the public authorised by law and the reproduction required for such purpose in accordance with Part 1 section 6 of the Copyright Act.
(3) Service providers must, in their general terms and conditions, draw the user's attention to the uses authorised by law referred to in subsection (1)." 26 The provision reads: "(1) If user-generated content is to be blocked automatically when being uploaded and does not constitute minor use as per section 10, service providers are obliged […] 3. to enable the user to flag the use as authorised by law pursuant to section 5." 27 The provision reads: "(1) Service providers must make available to users and rightholders an effective, free and expeditious complaints procedure in respect of the blocking and the communication to the public of protected works.
(3) Service providers are obliged to immediately 1. notify the complaint to all the parties involved, 2. give all the parties involved the opportunity to comment, and 3. decide on the complaint, at the latest within one week after its submission.
[…] (5) Decisions on complaints must be made by impartial natural persons." 28 The provision reads: "If, following a review by a natural person, a trustworthy rightholder declares that the presumption under section 9(2) is to be rebutted and that the continued communication to the public substantially impairs the economic exploitation of the work, the service provider is, in derogation of section 9(1), obliged to immediately block the work up until the conclusion of the complaints procedure." 7 (6) Exclude rightholders from the automated blocking and red button procedures and users from the pre-flagging option in cases of misuse, Sec. 18(1), 18 (3) No. 1 and (5). 29 This overall scope of the study allows to identify the practical effect of the German OCSSP Act (1) over time on individual services, and (2) across the eight services covered. Did the terms and conditions change, and if so, on which platforms? With these research questions, this paper forms part of a growing body of research that empirically studies the effects of public and private online platform rules. 30

IV. Findings
Our data collection revealed only few changes in the terms and conditions of platforms over time but significant differences between the services.
Most changes concerned the most contentious and also possibly the most important feature of Art. 17 CDSMD and the German OCSSP Act, namely the duty of OCSSPs to implement preventive upload filters "as soon as the rightholder so requests and provides the information required for such purpose" ("qualified blocking", duty No. (1)). Except for Twitter, all platforms mentioned the option to submit copyrighted materials for subsequent automated copyright content moderation even before 1 August 2021. TikTok appeared to be in the process of establishing upload filters during the time of study. TikTok's website mentioned such an option and offered a link to a corresponding form, which was, however, not accessible; at best, an error message appeared when we tried to access the form on 19 August. The form was accessible on 21 November 2021. According to the website, TikTok enables the rightholder to request that works protected by copyright are not available on TikTok in the EU in accordance with Art. 17 CDSMD.
During the final round of data collection in November, we also observed changes on the copyright help pages of YouTube, Facebook and Instagram. YouTube announced the 'Copyright Match Tool', which had been available already in July 2021, to be now available for every user of the platform.
In contrast, 'Content ID' has been and remains restricted to rightholders submitting numerous takedown notices. With the expansion of the 'Copyright Match Tool', YouTube increased its compliance with the requirements of Sec. 7(1) German OCSSP Act. Facebook and Instagram 29 The provision reads: "(1) If an alleged rightholder repeatedly requests that the service provider block a work belonging to a third party as the rightholder's own work or a work in the public domain, the service provider must exclude the alleged rightholder from the procedures under sections 7 and 8 for an appropriate period of time. Internal complaints procedures (4) were available on all services before the OCSSP Act came into force. The only changes in this context were observed between the third and fourth round of data collection and concerned Twitter's 'Copyright Policy' and the move from submitting a counternotification via a form rather than a separate email, and the establishment of a Facebook 'Transparency Center'. However, these observations are subject to the caveat that we did not run test uploads and therefore were unable to evaluate how effectively and expeditiously the procedures are carried out.
No public statements explaining the "red button" option for trustworthy rightholders were It is questionable whether this suffices to comply with the mandatory misuse sanctions under the OCSSP Act. Instagram merely announced that misleading or fraudulent reporting of copyright or trademark infringement could lead to action on the part of the platform. We did not observe any rules concerning the exclusion of users who misuse the pre-flagging option. This result is in line with our finding that no such pre-flagging option existed in the first place.
Overall, the only relevant changes in the four rounds of data collection concerned the availability of preventive, automated copyright moderation tools on YouTube, TikTok, Facebook and Instagram ("qualified blocking" also known as "upload filters" according to Sec. 7(1) German OCSSP Act) and minor adjustments to the already existing complaints procedures on Twitter and Facebook. In addition, and beyond the scope of our study, we noticed that Facebook and Instagram changed their terms of service by 1 August 2021 to the effect that a person authorised to receive service in Germany for the purposes of the OCSSP Act (Sec. 20) was announced. 31 This is the only context in which the German OCSSP Act was explicitly referenced on any of the websites studied.
The following table summarises the levels of compliance and relevant changes observed.
The green, yellow and red dots represent full, partial or no compliance, respectively. With regard to the duty of "qualified blocking" in accordance with Sec. 7(1) German OCSSP Act, the table visualises the implementation or expansion of the already existing automatic filter systems (yellow -a respective system is in place; green -the system was implemented/expanded). 31 https://www.facebook.com/terms?ref=pf and https://help.instagram.com/ 581066165581870.

V. Summary and Discussion
Our study of public statements on the websites of eight service providers that arguably are subject to the German OCSSP Act provides answers to both research questions, i.e. the evolution of terms and conditions (1) over time and (2) as compared between different services.
First, the entry into force of the Act on 1 August 2021 did not immediately result in any changes or additions to the terms and conditions. Insofar as we were able to observe compliance, it was established already before 1 August 2021 and thus possibly anticipated by service providers. 32 Only during the last round of data collection in mid-November 2021 did we observe relevant changes. These concerned preventive, automated copyright moderation tools (YouTube, TikTok, Facebook, Instagram) and the complaint mechanism (Twitter, Facebook). However, until 22 November, no service had fully complied with the six statutory obligations studied.  95, 21.4.1993, p. 29. 35 Cf. Art. 17(6) CDSMD and Sec. 2(2)-(4) with Sec. 7(4) and (5) OCSSP Act. All services are, however, available in the EU for more than three years and probably have an EU turnover of more than 1 million euros. 36 Sec. 2(1) No. 4 OCSSP Act. 37 AG Saugmandsgaard Øe (n 5), paras. 149 et seq., 210. 38 Supra n 2. 39 Cf. Commission Guidance (n 3), p. 1 ("The guidance may need to be reviewed following that judgment.").
until a solid, EU-wide consensus on how to put Art. 17 into platform practice has emerged. Rather than splitting up their services into 27 versions compliant with national OCSSP Acts, they take the risk of running afoul of, say, German law.
In that risk assessment, the sanctions for a failure to comply are key. On this enforcement level, another weakness or imbalance of both Art. 17 CDSMD and the German OCSSP Act comes to light.
The failure to implement sufficient copyright moderation practices results in full civil liabilityincluding the duty to pay damages. This may explain the observed changes towards preventive copyright moderation tools for all rightholders on TikTok, YouTube, Facebook and Instagram. In contrast, failure to protect legitimate user interests incurs very limited legal consequences.
Art. 17 CDSMD is silent on this latter issue, and the German OCSSP Act only entitles "user associations" to claim injunctive relief against a service provider who repeatedly and wrongly blocks authorised uses. 40 The whole regime regarding "uses presumably authorised by law", i.e.
minor or pre-flagged uses, is not coupled with a specific enforcement regime at all, and it is very doubtful whether general tort law can fill the void. 41 Thus, the much-praised German OCSSP Act might turn out to be a toothless tiger with respect to users' interests. Legal provisions to their benefit have not yet left a mark on the terms and conditions of the services studied. The lesson taught by the preliminary failure of the German OCSSP Act is that effective enforcement of user interests, including through public law sanctions, 42 is crucial to achieve a meaningful and balanced result. 40 Sec. 18(6) OCSSP Act. 41 Sec. 823(2) German Civil Code (breach of a statute that is intended to protect another person). 42 Cf. 38 et seq. DSA proposal (n 23).