Operates a social platform, in Italy

Legge 22 aprile 1941, n. 633, artt. 102-sexies to 102-decies · Read the law's page

• These rules reach an information society service provider whose main purpose, or one of whose main purposes, is to store and give the public access to large amounts of protected works that its users upload and that it organizes and promotes to make a profit, directly or indirectly. They do not reach non-profit online encyclopedias, non-profit educational or scientific repositories, platforms for developing and sharing open-source software, electronic communications service providers, online marketplaces, business-to-business cloud services or cloud services that let users upload content for personal use, unless the marketplace or cloud service lets users share protected works among several users.
• Obtain authorization from the rightholders, including by a license agreement, for the protected works your users upload and to which you give the public access. The authorization also covers uploads by users who do not act for commercial purposes or whose activity does not generate significant revenue.
• If you have no authorization, you are liable for unauthorized communication to the public unless you show that you made your best efforts, to high industry standards of professional diligence, to obtain authorization and to keep unavailable the specific works for which rightholders gave you relevant and necessary information, and that after a sufficiently reasoned notice you promptly disabled access to or removed the notified works and made your best efforts to prevent their upload in future. You are never exempt if you practice or facilitate copyright piracy.
• On a rightholder's request, promptly give complete and adequate information on how you implement these measures and, where license agreements exist, on the use of the content they cover.
• Tell your users in your terms and conditions that they may use works under the exceptions for quotation, criticism and review and for caricature, parody and pastiche, and do not let your cooperation with rightholders prevent the availability of user uploads that respect copyright.
• When you act on a rightholder's request to disable access to or remove a specific work, submit the decision to human review and tell the users concerned immediately of the disabling or removal.
• Set up and make available to users quick and effective complaint mechanisms against a decision to disable access to or remove their uploads. Keep the contested content disabled while the complaint is decided. Your decision on a complaint can be contested by an appeal to AGCOM, without prejudice to the courts.
• If you have operated in the Union market for less than three years and have annual turnover below EUR 10 million, you are liable unless you show your best efforts to obtain authorization and prompt disabling or removal after a sufficiently detailed notice. If your average monthly unique visitors in the previous calendar year exceed 5 million, you must also show your best efforts to prevent future uploads of the notified works.

D.Lgs. 208/2021, Art. 42, Video-Sharing Platform Protection Measures · Read the law's page

• Applies to video-sharing platform providers subject to Italian jurisdiction, and, so far as compatible, to platforms for audio-only content or user-generated audio (Article 42(1) and (11)).
• Take appropriate measures to protect minors from programmes, user-generated videos and audiovisual commercial communications that may impair their physical, mental or moral development (Article 42(1)(a)).
• Set up systems to verify the age of platform users, in compliance with personal data protection law, for content that may harm the physical, mental or moral development of minors (Article 42(7)(f)).
• Have parental control systems under the supervision of the end user for that content (Article 42(7)(h)).
• Subject the most harmful content to the strictest access-control measures (Article 42(6)).
• Do not process the personal data of minors collected or generated for age verification or parental control for commercial purposes (Article 42(8)).

Legge 14 luglio 2023, n. 93, artt. 2 and 5 · Read the law's page

• If you provide network access, run a search engine, or provide an information society service involved in any way in making the website or illegal service accessible, execute AGCOM's disabling order without delay and in any case within 30 minutes of its notification, by disabling DNS resolution of the listed domain names and routing of traffic to the listed IP addresses or by other technological and organizational measures that make the content unusable by end users.
• If you provide a VPN service or a publicly available DNS service, wherever you reside or are located, execute AGCOM's disabling orders in the same way.
• If you run a search engine or provide an information society service that is not involved in the accessibility of the site, still take, within the same 30 minutes of notification, all useful technical measures to hinder the visibility of the illegal content, including de-indexing the blocked domain names from search engines.
• If you assign IP addresses, run the registry of the .it country-code domain or register domain names, periodically restore the resolution and routing blocked under Article 2, after at least six months, for those not used for unlawful purposes.
• At AGCOM's request, inform the Rome public prosecutor's office without delay of all the activities you carried out to comply with an order and supply any data you hold that could identify the providers of the unlawfully distributed content.

Decreto legislativo 24 luglio 2023, n. 107, artt. 3-7 · Read the law's page

• Remove terrorist content, or disable access to it, within one hour of receiving a removal order from the public prosecutor's office. Where the content is user-generated and hosted on a platform attributable to a third party, the order covers only the specific unlawful content.
• Inform the authority that issued the removal order, promptly and on the form in Annex II to the Regulation, that you have executed it, stating the date and time.
• Designate or establish a point of contact to receive removal orders electronically and execute them immediately, and make the information on the point of contact available to the public.
• If your main establishment is not in the Union, designate in writing a natural or legal person as your legal representative in the Union, who resides or is established in a Member State where you offer your services and who has the powers and resources to comply with removal orders and cooperate with the authorities. Inform the Interior Ministry body and the competent directorate of the Ministry of Enterprises and Made in Italy of the designation and make the representative's details public.
• Meet the other duties of the Regulation that Article 6(1) backs with an administrative fine: report the execution of a removal order on the Annex II form, take the measures the Regulation requires to restore content or access that you removed or disabled, preserve removed content and related data as the Regulation requires, meet its transparency obligations, set up and operate the complaint mechanism, and give content providers the information the Regulation requires.
• If you are exposed to terrorist content, include in your terms and conditions, and apply, provisions against misuse of your services for spreading terrorist content, adopt specific measures to protect your services, and report them to the Interior Ministry body within three months of a decision of that body and at each annual interval.

Decreto-legge 15 settembre 2023, n. 123, art. 15 · Read the law's page

• Comply with the obligations in Articles 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 20, 21, 22, 23, 24, 26, 27, 28 and 30 of the Digital Services Act, and Article 45, which Article 1(32-bis) of Law 249/1997 lists: AGCOM applies administrative fines for a violation of them.
• Reply to AGCOM's requests for information with accurate, complete and non-misleading information, rectify information that proves wrong, and submit to its inspections.
• If you are a provider of intermediary services established in Italy, pay AGCOM the contribution of 0.135 per mille of the turnover shown in your last approved financial statements; AGCOM may vary the rate for later years by reasoned decision, up to 0.5 per mille.

D.Lgs. 4 settembre 2024, n. 138, Art. 25 · Read the law's page

• This binds an essential or important entity under Article 3; Article 7(5) names the cloud computing, online marketplace, online search engine and social-network platform providers among the entities it reaches, and the wider sector classes are reached as on this jurisdiction's companion risk-management row. An entity of sectors 3 and 4 of Annex I that Regulation (EU) 2022/2554 governs reports under that Regulation instead, because Article 3, paragraph 14 sets Chapters IV and V of this decree aside for it.
• Notify CSIRT Italia without unjustified delay, and in any event within 24 hours of becoming aware of a significant incident, with a pre-notification stating, where possible, whether the incident appears unlawful or malicious and whether it may have a cross-border impact.
• Follow with a full notification within 72 hours of becoming aware, updating the pre-notification and giving an initial assessment of the incident's severity and impact and, where available, indicators of compromise.
• Submit an intermediate report on CSIRT Italia's request, and a final report within one month of the notification (or, for an incident still ongoing at that point, a monthly progress report and a final report within one month of the incident's resolution).
• Where you are a trust-service provider, notify within 24 hours rather than 72 for an incident affecting the trust services you supply.

D.Lgs. 4 settembre 2024, n. 138, Artt. 23 e 24 · Read the law's page

• Adopt technical, operational and organisational measures adequate and proportionate to the risks facing the network and information systems you use in your activities or in providing your services, and to prevent or minimise the impact of an incident on the recipients of your services and on other services.
• Cover at least: risk-analysis and information-system security policies; incident handling, including the procedures and tools to carry out the Article 25 and 26 notifications; business continuity, including backup management, disaster recovery and crisis management; and supply-chain security.
• Have your management and governing bodies approve how these measures are implemented and oversee their implementation, see that they attend cybersecurity training, and promote similar training for your employees.
• This binds an essential or important entity under Article 3; Article 7(5) names the cloud computing, online marketplace, online search engine and social-network platform providers among the entities it reaches, and the wider sector classes it also reaches (energy, transport, banking, health, water, digital infrastructure and public administration) are reached too, by declaring that you are an essential or important entity. An entity of sectors 3 and 4 of Annex I that Regulation (EU) 2022/2554 governs answers under that Regulation instead, because Article 3, paragraph 14 sets Chapters IV and V of this decree aside for it.

D.Lgs. 9 settembre 2026, n. 160, art. 14, amending D.Lgs. 28 luglio 1989, n. 271, art. 104, comma 1, lett. e-bis · Read the law's page

• If you provide hosting services, an online platform, a search engine or another intermediary service of the information society, remove the content and the data, or disable access to the profile, when a preventive-seizure order covers online content generated also with AI systems, while ensuring where technically possible access to content unrelated to the unlawful conduct (art. 14, amending art. 104, comma 1, lettera e-bis of the implementing norms of the Codice di Procedura Penale).

Disegno di legge S. 1136 (XIX Legislatura), Disposizioni per la tutela dei minori nella dimensione digitale · Read the law's page

• A provider of an online social network or a video-sharing platform must allow a minor to activate an account only after the minor has completed 15 years of age.
• Pending uniform European technical measures, verify users' age through the national mini-wallet that implements the European Union age-verification solution, taking account of the arrangements set by the communications authority.
• A contract for an account already created and held by a minor aged 15 or under remains valid only if the minor has completed 15 years of age when the law enters into force; any other such contract is void and cannot be the legal basis for processing the minor's personal data under Article 6(1)(b) of Regulation (EU) 2016/679.

Schema di decreto legislativo recante attuazione della direttiva (UE) 2024/2853, Atto del Governo n. 434 · Read the law's page

• The draft treats software as a product, except free and open-source software that you develop or supply outside a commercial activity (Art. 115(2)(d) as proposed).
• If you develop, produce or make a product, software included, or have it designed or made, or present yourself as its manufacturer by putting your name, trade mark or another distinguishing feature on it, you answer as its manufacturer for the damage a defect in it causes (Arts. 115(3)(i) and 116(1)(a) as proposed).
• Keep supplying the software updates and upgrades needed to maintain safety while the product is under your control: a defect due to software, a related service or a missing safety update is not excused because it arose after you placed the product on the market (Art. 118(2) as proposed).
• Meet the product safety requirements that apply to your product, cybersecurity requirements relevant to safety included: they count in deciding whether it is defective (Art. 117(2)(f) as proposed), and failing a mandatory safety requirement meant to protect against the damage suffered presumes it defective (Art. 120(2)(b) as proposed).
• Account for what your product learns or acquires after release: the effect of its ability to keep learning or to acquire new functions is weighed in deciding whether it is defective (Art. 117(2)(c) as proposed).
• Be ready to produce the relevant evidence you hold when a court orders it on a plausible claim: failing to do so presumes the product defective (Arts. 119(1) and 120(2)(a) as proposed).
• If you manufacture outside the Union, the importer, your authorized representative or, failing both, the logistics service provider answers for the product alongside you (Art. 116(1)(c) as proposed).
• If you substantially modify a product outside its original manufacturer's control and then make it available on the market or put it into service, you are treated as its manufacturer (Art. 116(2) as proposed).
• If you distribute a product, or provide an online platform that lets consumers conclude distance contracts with traders, identify the economic operator or your own supplier within one month of the injured person's written request, or you answer for the defective product (Art. 116(3) to (5) as proposed).
• Be able to show that you did not place the product on the market or put it into service, or that it is probable the defect did not exist then (Art. 118(1)(a) and (c) as proposed).