With the digital media landscape quickly shifting, it can be difficult to keep track of our digital rights and what we can legally do.
Wayne Unger is an associate professor of law at Quinnipiac University School of Law, where he teaches Constitutional Law, Criminal Law, First Amendment, and Data Privacy & Security Law. Unger said there are a lot of misconceptions about individuals’ rights online.
“So, when it comes to, for example, your speech on a private platform, such as any social media platform, well, there your First Amendment rights, for example, do not carry over, so Facebook has no obligation to follow free speech principles in the First Amendment, because they are a private actor and the Constitution only applies to public actors,” Unger said.
Although there are protections such as the First Amendment, Unger emphasized that constitutional rights apply only to the government and public actors. Many social media companies like Meta, which owns Facebook and Instagram, are considered private platforms.
Under Section 230 of the Communications Decency Act, social media platforms are granted broad immunity from civil liability for user-generated content. Unger said that means that many lawsuits against large social media platforms are dismissed. The law was enacted by Congress in 1996, long before social media companies existed on the internet.
“The rationale from Congress in Section 230 was that if we don't provide this level of legal immunity, then we may stifle innovation. As far as users are concerned, there are various ways in which you may be able to hold a social media platform accountable, and at least at the federal level, the biggest roadblock would be Section 230,” Unger said.
However, Unger said there is hope for users to hold platforms legally accountable through contract law. That is the agreement that companies have with users, often outlined in the terms of service agreements that show up in every account. Unger said the agreements are often written in favor of the platform, but there are some protections for users.
“Those are the advantages of having some legal rights; that is, you may not even know of the legal right, but the platform is required to do something to protect you, but you need to exercise that,” Unger said.
An agreement that many users consent to across platforms is data sharing. Sometimes it's required for the function of a certain app function and sometimes that data is shared with third parties. Another misconception users might have surrounds copyright laws and ownership of their personal data. Unger said it's essential that users understand the difference before agreeing to certain terms.
“The terms of service, for example, could also have guidelines on who owns that data, whether you actually own your data, that say you post a picture on Facebook, whether you actually own that picture, or whether Facebook, when you post that picture, now becomes the lawful owner,” Unger said.
In that case, users can upload images and videos of themselves and might not have the legal ownership rights to their own image. When a certain platform has ownership of data, it then has the legal authority to use the data as they see fit. If a user is not comfortable with the platform's terms of service, Unger advises using a different platform.
Unger said users should take the time to look through all of their accounts’ privacy settings to ensure the strongest level of protections. Users should look into features like data privacy sharing restrictions and data deletion. These are legal protections that platforms are required to give and users should exercise those legal rights.
In 2025, the company 23andMe filed for bankruptcy. Unger explained that the data the company collected for years can legally be sold as an asset to pay creditors. The genetic data could be sold to others as a way for the company to liquidate assets. Despite this, Unger said users have the legal right to request that the company delete the data before it gets sold.
Other legal cases surrounding personal data aren't always so black and white. Unger said there is a legal grey area when it comes to AI platforms using data without clear copyright protections. Companies will scrape the internet for publicly available information to feed into AI algorithms to train models. In recent years, lawsuits have emerged, making their way through state and federal courts.
“The unanswered question from a legal perspective in today's world is, what legal rights does somebody who perhaps owns the copyright for that information, what do they have with respect to these AI platforms using their information to train their platforms? And we don't know the answer, because this is so new,” Unger said.
More info:
Featured Guest: Wayne Unger is an associate professor of law at Quinnipiac University School of Law, where he teaches Constitutional Law, Criminal Law, First Amendment, and Data Privacy & Security Law. Unger's research focuses on the intersection of constitutional law, emerging technologies, and data privacy and security.
Roman: What are some misconceptions that some people might have about what they're legally allowed to do and what protections they have online?
Unger: Sure, so there, that is a, there's a lot to that answer. Many of the rights that you have in the United States apply online, but the one big caveat is that the Constitution, as an example, only applies to public actors or government actors. So, when it comes to, for example, your speech on a private platform, such as any social media platform, well, there your First Amendment rights, for example, do not carry over, so Facebook has no obligation to follow free speech principles in the First Amendment, because they are a private actor and the Constitution only applies to public actors. That's one of the largest misconceptions.
Roman: And speaking of those companies, you know there are quite a few laws related to the companies and what legal rights they have with regard to content moderation and how they run their platforms. So, can you break down what rights corporations have versus what rights users have?
Unger: Well, so there are lots of laws at play that all touch on this digital space, and first we have the Constitution, second we have federal statutes, and then third we have state statutes. So we are a country in which we have kind of multiple, multiple levels of government, and those multiple levels of government all have essentially jurisdiction to a certain extent to regulate these online platforms at the federal level, so as I mentioned, the Constitution only provides protections against public actors, so Congress, for example, cannot pass a law that unconstitutionally infringes upon your free speech at the federal level, when it comes to statutes, there we have laws that primarily protect the platform, and a key example, one that's kind of been in the news a lot recently, is Section 230 of the Communications Decency Act, and Section 230 of the Communications Decency Act actually provides broad immunity to the social media platforms from any civil liability, so if a user, as an example, tries to bring a lawsuit against one of the social media platforms arguing that because of their negligence I was injured this way, or because of the product design I was injured this way. Well, more often than not, probably 99% of the time, those social media platforms, their defense in court is going to be I have federal civil immunity under section 230 of the Communications Decency Act, and so most cases get dismissed before they go pretty much anywhere, and that is because, again, Congress, when it passed this Communications Decency Act, one I should note that the Communications Decency Act was enacted by Congress way before the internet became what we know it to be today, way before any social media company, dating back to Friendster and Myspace, and then Facebook, and then certainly, of course, today companies like TikTok, X or Twitter way before any of those platforms existed, and the rationale from Congress in Section 230 was that if we don't provide this level of legal immunity, then we may stifle innovation. As far as users are concerned, there are various ways to hold a social media platform accountable, and, at least at the federal level, the biggest roadblock would be Section 230.
Roman: Do you see that there is hope for stronger protections for the users themselves in the future?
Unger: Yes, so from the user's perspective, what we're running into here is the users claiming some level of rights and perhaps filing lawsuits, which again are running up against the Section 230 roadblock. Meanwhile, you have the platforms claiming Section 230 immunity and First Amendment protection. So, what will happen over the next couple of years is hopefully we get more clarity as far as well, what is the extent of the section 230 immunity, because if we pull it back from how courts have read it over the last two decades, users might be able to have a legal right to sue them and not face that roadblock anymore, or at least face a diminished roadblock. We have to keep in mind that there is. The First Amendment provides some shield to those platforms essentially from that government regulation, and said users can get protections put in place through government regulation. It's just that government regulation has to pass constitutional muster, which is generally a higher bar.
Roman: Social media platforms often will require users to agree to set terms of service, and there are certain conditions we've all encountered that pop-up screen that comes up and it says, I have agreed to terms, and you know, you check that little box, but sometimes people don't go through the whole agreement. So, what are some common things that people typically consent to that they should be aware of that they might not have read?
Unger: Yes, so a whole other level of legal protection may exist in the form of contract law, and contract law, of course, being separate from any regulatory law or legislative actions that a state legislature or Congress can take. Some of those, for example, may be obligations that the platforms set for themselves via their terms of service, but generally speaking, the terms of service and privacy policies and other types of disclaimers and disclosures like that are very one-sided, right? They're very pro-platform and very, very counter to or contrary to the user's interest, so some of the common provisions that users often consent to that we see across terms and service agreements across all of the platforms are for example data sharing, so your user data could be shared for these purposes as they disclose them in their privacy policy or even in the terms of service, the terms of service, for example, could also have guidelines on who owns that data, whether you actually own your data, that say you post a picture on Facebook, whether you actually own that picture, or whether Facebook, when you post that picture, now becomes the lawful owner of that copyright clarifications as another example, where again, if you post something, whether that platform then has the legal authority to use whatever you've posted as they see fit.
Roman: For those listening, those that say, you know, I'm not a, I'm not a lawyer, I'm not an attorney, I don't understand the legal jargon. How do they go about better understanding what they're agreeing to? And then also, what if they don't agree?
Unger: Yes, so there's actually a great movement as we speak, where we have regulations and legislation being enacted across the country that actually require these type of disclosures, whether they're terms in service or privacy policies, to be written in such a way that an ordinary person could understand them, so they're essentially plain language requirements placed on the platforms, and those have generally been upheld in the courts when they've been challenged, because the goal there is, of course, to provide that notice and provide that level of understanding with all the users to understand, for example, what data is being collected, how is it being shared, where is it being shared, and to whom is it being shared. So we see a movement; it's only going to pick up more and more steam, so I would expect that if you come across as a user, if you come across some privacy policy, some terms of service that are difficult to understand. Well, number one, what I would always do, and I know I'm an attorney and a law professor, but even as an ordinary user, if I'm confused about something, is I just begin a Google search, you know, see what else, because if you're experiencing the issue right, if you're experiencing the confusion, chances are somebody else in the world has experienced the same confusion, and maybe they've discussed it right, maybe they've discussed it on, say, Reddit, as an example. Now, if you do that, my cautionary tale, of course, is take whatever you see online, any interpretation of something that perhaps is on a thread in Reddit, and take it with a grain of salt, because, of course, ordinary users are not necessarily the experts. Now, if you're super concerned about it, and you take a look at it, you try to read it from top to bottom, and you're still confused, because it's written in such a way that what we say in law school and in the legal profession is legalese, right? If there's a bunch of legalese, legal terms, legal jargon in there that is difficult to understand at the end of the day, if you are super concerned. Learned about it, perhaps talk to an attorney who can interpret it, but I know that's not always an option for most individuals. So, with that said, I say perhaps a good first start is to see what's already out there. What we do have, and this is to be clear, oftentimes you have law firms, and this is a good resource for everyone to be aware of. Oftentimes you have law firms who are kind of in these spaces, so perhaps they do digital rights, perhaps they do internet law, technology law, contract law, and what these law firms tend to do mostly as a marketing purpose, but also a great public service. Is they post blogs that may describe what you're concerned about. What are my rights with respect to the photos that I upload on this platform? It is very possible for you to do a Google search, search around, find a law firm's blog, and then read that law firm's blog on what's going on. What I always caution, though, is keep in mind the law always changes, right? The Supreme Court could decide something, a lower court could decide something, a state could pass a new law, so always pay attention to the date of that blog post, and of course you want to rely on more recent posts than, say, if you're reading something from 2013 that is obsolete by this point.
Roman: Often, we'll see that online users can't access the platform unless they agree to these terms; is it a matter of just accepting them? What if we're not comfortable with it? Should we just look for alternative platforms?
Unger: Yeah, so that's the best answer right there, which is, if you're not comfortable with the terms and service of platform A, then you have to go to platform B. So, these platforms are so large that you can't enter into a negotiation with them as an individual user, right? You can't email the CEO of the platform and say, 'Hey, I don't agree with this term, so can you strike it? Because they're just going to say, 'Absolutely not, like, go away if they even respond to you. So, with that said, a user doesn't have much right to negotiate the terms of service if they're even interested in doing so. You just have to find a platform that perhaps respects what you're looking for them to respect.
Roman: Some people understand that if, as you mentioned, a photo is uploaded online, they might not have the right to that photo or that content, but what do you say about the emergence of creative content being used or mined to improve things like AI tools?
Unger: Yes, that is the legal question of today. So we may have, for example, as a creative, or even not as a creative, and you post information online, perhaps you're posting your resume, even right. And we have AI platforms who are out there scraping information that is generally publicly available, but not necessarily always, and they're scraping the information to feed into their AI algorithms to train those models. So, for AI to function, it requires a lot of input data to train it to learn whatever the output is going to be whatever the designer is trying to output, and the unanswered question from a legal perspective in today's world is, what legal rights does somebody who perhaps owns the copyright for that information, what do they have with respect to these AI platforms using their information to train their platforms, and we don't know the answer, because this is so new. What we do know is that there are several lawsuits working their way through state and federal courts, mostly federal, where you have users arguing for copyright protections or arguing for their copyrights, and what tends to be the most common defense right now behind whoever the creator of that AI algorithm and that platform is, the most common defense seems to be a fair use defense, which is that we can use your information because of this carve out in the United States Code that says there are some lawful uses of copyrighted material, so for example in say the broadcast space we can use a clip of a speech. If we're going to report on that speech or comment on that speech, that is a fair use, generally speaking, and that is what these AI platforms are arguing. We don't know, because these lawsuits are new and they haven't been sorted out, and we're probably not going to know for another year or five as far as where the law begins to land on this question.
Roman: What advice would you give someone who doesn't know anything about how to navigate the digital world? What is one thing that they can do to better protect themselves online?
Unger: My recommendation is to always start with whatever the settings are with whatever platform we're talking about, and look through those settings and enable the settings that provide you the strongest level of protections, so that could be, for example, data privacy sharing restrictions, that could be data deletion after a certain timeframe, versus having them keep your data forever, and do that on all of your devices, all of the platforms, any online account that you have, because number one, you might, because number one, you might have legal protections that require the platform to give that to you, so you should exercise those legal rights, and number two, it's also again in your best interest, and because this is somewhat timely, I'll mention one thing here. Recently, 23andMe filed for bankruptcy. Now, the data that they have, that they've collected for years, that genetic data is an asset that will be sold in bankruptcy, because the reason why you file bankruptcy is because your creditors, right, you can't pay your creditors. So, in order to pay off their creditors in the bankruptcy proceedings, they're going to sell their assets to liquidate, really, the company and what they have to pay back their creditors, that said, if you have used, for example, 23andMe, and you have data on andme, this is one of those, will you actually have a legal right to ask for the deletion of that data, and I strongly recommend that users do, because number one, genetic data is extremely valuable, and many buyers will be lining up at the table to buy that data from the bankruptcy of 23andMe, and because it's an asset, it's going to be sold. All of that is to say, exercise the settings that you have on whatever platform, on whatever device, on whatever system that you are dealing with; exercise all of the settings that you possibly can to protect yourself.
Roman: So, main point being, go through all of your accounts, all of your apps…
Unger: Yes. The beauty here is, yes, it's tedious in the beginning, but it protects you in the long run, and you don't necessarily have to do it all at once. Perhaps you set a plan where you do one platform a day, or one account a day, and you do it for a month just to try to do it. Perhaps you start by writing a list down of all the various accounts that you can think of, and just do it as a checklist. Those are the advantages of having some legal rights. You may not even know of the legal right, but the platform is required to do something to protect you, and you need to exercise that.
