Last week, German regulators decided to no longer accept the widely used "JusProg" software as a sufficient means for online service providers to comply with statutory youth protection requirements. The decision is effective immediately, although it will most likely be challenged in court. If it prevails, it puts video-sharing platforms, distributors of gaming content, and online media services at risk of being held accountable for not properly protecting minors from potentially harmful content. For the affected providers, this is particularly challenging because it will be hard, if not impossible, to implement alternative youth protection tools that will meet the redefined regulatory standards.
This alert provides the legal background for the decision and discusses its implications in more detail. It is relevant to all online service providers that target German users.
Under German youth protection laws, all online service providers must generally ensure that minors cannot access any content that is deemed harmful for their respective age group. For example, 16+ rated content shall not be available to younger users. "Harmful" content is content that is considered to adversely affect an individual's personal development, such as nudity or violence. It is distinct from "illegal" content (e.g., Nazi propaganda or hate speech), which must not be made available to any audience per se, and which may also be subject to criminal charges.
German law offers online service providers a choice of three possible means to comply with this obligation:
- Use scheduling restrictions to ensure that harmful content is not available during daytime, i.e., when minors would usually be online. For example, 16+ rated content should only be shown between 10:00 p.m. and 6:00 a.m.
- Employ technical measures to ensure that minors are at least significantly impeded (if not fully blocked) from accessing any content that is not suitable for their age group. This will typically require the service provider to issue a PIN to an adult user after conducting an age verification check.
- Tag content with age labeling in a format that officially approved youth protection software can read. In practice, service providers often store an "age-de.xml" file with their offering. This file then designates suitable age groups for the service as a whole or separately for individual parts of the service.
As long as a provider implements at least one of these options, it will comply with German youth protection law.
The third option, age labeling, is obviously the easiest to implement. It shifts responsibility for ensuring an adequate level of youth protection to legal guardians because age labeling will only have an effect when end users run corresponding youth protection software on their own devices. This is why many major domestic and international services have thus far been happy to rely on this option as a relatively smooth way of ensuring compliance with German youth protection laws.
The JusProg Decision
Relying on the third option has always been somewhat risky. It only works as long as there actually is an approved youth protection software available on the market. To date, only one software solution met this criterion, the JusProg product, and following last week's decision, now there is no such solution any more.
JusProg was developed by a German association of online service providers. It received initial regulatory approval in 2012, and since then it has been deemed as a suitable means for online service providers to comply with their youth protection obligations. Since 2016, the regulatory body in charge of the approval process is the German Association for Voluntary Self-Regulation of Digital Media Service Providers (Freiwillige Selbstkontrolle Multimedia or FSM). FSM is a self-regulatory body, and one of the German State Media Authorities must formally confirm its decisions. The State Media Authorities, in turn, have trusted one of their joint bodies with this confirmatory decision, the Commission on Youth Protection in the Media (Kommission für Jugendmedienschutz or KJM).
When FSM first approved JusProg in 2017, it received KJM's blessing. In March 2019, FSM renewed its approval and again asked for KJM confirmation. This time, though, KJM decided to void FSM's approval in a decision made public on May 15, 2019, i.e., it now no longer accepts JusProg. KJM claims that FSM's decision was flawed because it did not properly take into account that an efficient youth protection software had to work across platforms and systems – and JusProg is only available for Windows PCs. FSM disputes this view and will challenge it in court. FSM argues that there is no legal requirement for any such cross-platform functionality, and that approving JusProg was thus lawful.
Impact for Online Service Providers
KJM not only decided to void FSM's JusProg approval, it also ruled that its decision shall be effective immediately. So, therefore, even FSM now appealing KJM's decision in court will not suspend that decision. Rather, FSM will have to take interim action requesting that the court re-establish such suspensive effect, i.e., to stop KJM from enforcing its decision until the court has finally decided on the merits of FSM's complaint. In these interim proceedings, the court will have to consider (i) whether the public interest requires that KJM's decision must indeed apply immediately, or (ii) whether it seems appropriate to put any enforcement on hold until the court has formed a final view on the legality of FSM's approval – which may only happen within the next few years.
In any event, online service providers' preferred option to comply with German youth protection laws is now in jeopardy, since they can no longer rely on JusProg. And as long as the court does not dismiss KJM's view at least on an interim basis, the State Media Authorities will be free to start enforcement action. They could then approach each online service provider that displays potentially harmful content and request that other means be put in place to prevent minors from accessing that content. If a provider fails to comply with that request, it may ultimately be facing monetary fines and/or an order to shut down its service.
This presents the affected providers with a dilemma. Not only is there no alternative software tool available that is FSM/KJM approved. Both other ways of complying with German youth protection laws – scheduling restrictions and technical means such as PIN protection – will not really work for many online services. Both would have a severe impact on the operations and business models of most of these providers. This would specifically apply to providers of services with user-generated content (UGC). Under German law, UGC channels operated by the users of the UGC platform are, in many cases, subject to youth protection regulation themselves – in addition to the UGC platform as such. So far, most of these UGC channels were covered by the JusProg solution that was applied at the platform level and did not require any additional measures. With JusProg no longer being available, regulatory pressure will increase not only on the platform operators, but also on each individual content provider.
Due to these complications, all affected major industry associations in Germany have made statements harshly criticizing the KJM decision. They claim that it undermines all positive efforts made by the industry to ensure a modern and efficient standard for online youth protection.
The German youth protection rules are significantly stricter than what harmonized EU law would require. Specifically, under the current EU Audiovisual Media Services Directive (2010/13/EU, AVMSD), EU Member States must only ensure that minors will normally not perceive harmful content via online services – without further restricting the means by which this goal shall be achieved.
Under these requirements, for example, the UK imposes less restricting youth protection requirements on online services. The UK requirements apply to providers of on-demand video services with material that rated 18+ or with any material that might seriously impair the physical, mental or moral development of minors. Services making such content available in the UK must provide age-verification measures which meet certain minimum standards.
However, the incoming 2018 AVMSD amendment that all Member States must implement by September 2020 will align EU law (and subsequently, Member State law) more closely with the current German standards.
Regardless, in terms of jurisdiction, these German standards do already not only apply to services domiciled in Germany, but in fact to all online services that are available in the German market. Even EU e-commerce law and the AVMSD, which both generally provide for a country of origin principle, include an exception for compliance with local youth protection regimes.
The primary focus will now be on FSM's legal action against the KJM decision. Most importantly, it remains to be seen whether the court will suspend the immediate effect of that decision. If it does, this would not solve the overall uncertainty about JusProg being legitimate, but it would at least buy some time for the industry to come up with alternative solutions.
At the same time, the State Media Authorities have indicated that they are open to discuss alternative compliance measures. Affected providers could also reach out to their industry associations (or to the State Media Authorities directly) to become engaged in this discussion and to ensure that compliance with German youth protection law will remain practicable in the future.
Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.
© Morrison & Foerster LLP. All rights reserved