An internet jurisdiction retrospective
The problem
Since the dawn of the internet we have wrestled with the
question of how best to reconcile national laws with the inherently
cross-border medium of the internet. We are still at it, with resolution seemingly as far away as ever.
If answers are difficult to come by, the nature of the problem was always obvious. Back in 1999 I described the jurisdictional challenges to national legal systems presented by the internet.
“Time is no longer a barrier: on the Internet content can be delivered instantaneously across geographic and political borders. Distance is irrelevant: not only can messages be transmitted from one part of the globe to another instantaneously, but for the user the location of the content is irrelevant. All that matters is that the content appears on his or her screen. … The Internet also destroys cost barriers.
…
These characteristics give the Internet the potential to erode national legal systems based on geographic and political boundaries. While imposed barriers – customs, immigration, tariff and physical – still remain, the Internet challenges their enforceability. … People responsible for content are vulnerable to enforcement in states in which they live or visit, to which they can be extradited, or in which they have assets. But the information is almost immune. … Once telecommunications links are in place it is extraordinarily difficult for national authorities to prevent information flowing across their borders.” Content on the Internet – Law, Regulation, Convergence and Human Rights (Graham Smith, chapter in ‘International Law and the Hague's 750th Anniversary’, T.M.C. Asser Press, 1999)
That probably overstated the immunity of information to technical border controls, at least in the hands of a sufficiently determined government. Nevertheless, the bits and bytes still tend to fly across borders with a fine disregard for nation state boundaries; and politicians continue to debate the efficacy of geo-blocking and to be exercised by VPNs.
There were some who argued that the internet was nothing new; that we had already had to grapple with cross-border broadcasting. However, a handful of satellite broadcasters bore little resemblance to hundreds of millions of individual online users posting their thoughts direct to a default world-wide audience.
What to do?
How, therefore, can we minimise friction between starkly differing sets
of laws and values when, inevitably, they rub up against each other online? Can we achieve
peaceful co-existence, or are we condemned to a perpetual contest for
superiority between competing national laws? Does that become a race to the
most restrictive common denominator? If
so, does that matter?
If a nation state feels strongly enough about the values
embedded in its own domestic laws, is it entitled to assert those against all visible
online content worldwide? Or should it grit its teeth, exercise jurisdictional
self-restraint and accept that its citizens may legitimately be able to seek
out content created under other legal systems?
What should count as sufficient connection with a country in
order for its authorities to assert jurisdiction over foreign online content? Should
those domestic authorities take into account the fundamental rights of users in
other countries with less restrictive laws? If so, how? Is it legitimate for a
domestic authority to co-opt online intermediaries such as search engines to require them to remove content from their services worldwide?
Is it reasonable to insist that, in order to avoid triggering
other countries’ laws or jurisdiction, online content must be rendered
technically inaccessible by geofencing? What if a geofence can be circumvented?
Those are some of the specific questions that the broad
issue of internet jurisdiction throws up. They have been argued over in the
courts and in academic scholarship for decades, going back to the mid-1990s. That was the era of Johnson and Post’s celebrated 1996 essay Law and Borders –The Rise of Law in Cyberspace, counterweighed ten years later by Goldsmith and
Wu’s Who Controls the Internet?: Illusions of a Borderless World
(OUP, 2006).
In the courts, the mid-1990s saw the CompuServe newsgroup and Radikal magazine cases in Germany. Those were followed in 2000 by the French LICRA/Yahoo! litigation over Nazi memorabilia displayed on Yahoo!’s .com auction site. That was the first case to focus expressly on whether mere accessibility of overseas online content should be sufficient to found jurisdiction, and to examine in detail the technical ability of a foreign website to filter out users from (in this case) France. The litigation carried on, on both sides of the Atlantic, until 2006, attracting world-wide attention as it went. It remains a paradigmatic internet jurisdiction case study.
Uta Kohl’s book Jurisdiction
and the Internet (CUP) was published in 2007. She asked:
“Traditionally transnational
activity has been ‘shared out’ between States with the aid of location-centric
rules and these can be adjusted to suit the Internet. But can these rules be
stretched indefinitely and what are the costs of squeezing global online
activity into nation-state law?”
By 2017 Dan Svantesson was able to introduce his book Solving the Internet Jurisdiction Puzzle (OUP) thus:
“It is fair to say that the topic
of ‘Internet jurisdiction’ is currently gaining an unprecedented level of
attention. Indeed, at the moment, Internet jurisdiction is one of the most important,
and most talked about, topics in Internet law and related fields.”
In March 2021 Julia Hörnle, commenting on her newly
published book Internet Jurisdiction Law and Practice (OUP), observed:
“Essentially, jurisdiction is
about the legal authority of state actors to act and that legal authority is
limited to the population and territory of the state. It ends at the national
border. Since this power of a state agent to act is limited to the territory of
that state, but the internet’s reach is not so limited, jurisdiction is the
fundamental legal concept behind many, if not most, of the troubles of
effectively regulating the global internet. National police forces do not
(normally) cross international borders.
If the legal concept of jurisdiction challenges effective policing of the internet, you may ask, why can’t we simply change this old legal concept to something more suitable? The problem lies not in the law but in the international political system of governance by nation states, a political system closely tied to national identities, culture, and geo-political realities.”
Whether we are seeking to adapt existing jurisdiction rules or to attempt something more radical, the reality is that when national legal rules clash, dispassionate application of formal rules can be hard to disentangle from culturally influenced views about what the law ought - and ought not - to be. That is well illustrated by the comments of the French court in the LICRA/Yahoo! case, suggesting that it would cost Yahoo! very little to extend its prohibitions on various other kinds of content to symbols of Nazism, and that:
"such an initiative would have the merit of satisfying an ethical and moral requirement shared by all democratic societies" (judgment on geo-filtering measures, 20 November 2000)
That implicitly contrasts the moral weight to be attributed to French law with that to be given to the USA's attachment to freedom of expression.
The history of extraterritorial assertion of local laws on the internet is, unsurprisingly, littered with subject-matter about which passions run high: Nazi memorabilia, obscenity, holocaust denial, terrorism and others.
The most recent controversies have been sparked by various
countries’ online safety laws – notably those of the EU and the UK, which (along with some actions of the Brazilian Supreme Court) have attracted the ire of the current US administration.
Online safety is by no means the first, nor will it be the last, subject matter to fuel local enthusiasm to reach out across borders and take aim at non-conforming foreign content. What is perhaps different about online safety is the attempt not just to assert specific content laws against discrete items published online, but to impose entire regulatory regimes on service providers and to penalise non-compliance with administrative regulatory requirements. (In that respect online safety has something in common with EU and UK data protection regimes.)
Whether a foreign service provider has sufficient connection with a state to justify it in asserting a specific content law is a familiar enough question. With a regulatory regime, additional issues arise as to whether a regulatory body such as Ofcom (the UK online safety regulator) is entitled to serve legal notices directly across borders or whether that violates the territorial sovereignty of the state in which the recipient is located. Similar questions have arisen in the context of cross-border evidence requests by law enforcement to online intermediaries.
Lack of consensus
Lack of consensus on jurisdictional self-restraint is perhaps not surprising: cultural and geopolitical sensitivities readily translate into reluctance to cede ground to another country’s less restrictive laws.
“Every so often someone in authority feels the urge to put on blinkers, engage tunnel vision and, casting the internet as chief villain, decide to view the rest of the world as an offshore haven that exists for the sole purpose of subverting his home laws. This even happens at policy level. EU and US authorities have both gained deserved reputations for trying to forcefeed other countries, and each other, with their pet legislative agendas.
In the UK you could argue that we asked for it. Our libel courts willingly adopted the startlingly parochial doctrine, first espoused in the Australian case of Gutnick v Dow Jones, that any website in the world that can be read and comprehended in the UK is published here. Asserting our libel laws against the rest of the world on the basis of minimal UK publication provoked the US to pass the SPEECH Act, preceded by New York’s Libel Terrorism Prevention Act.”
See me, sue me? Cyberleagle, March 2012
Ultimately, what jurisdictional rules are appropriate for the internet? How far should a nation state’s laws be able to reach extraterritorially? What are the consequences of overreach (in international law terminology, exercise of exorbitant jurisdiction)? What are the practical consequences of different jurisdiction rules?
I have been writing about these issues, on and off, for the best part of 30 years. I hope I can be forgiven for illustrating this thematic retrospective with some extracts from my own efforts. Whatever the reader may think of the views expressed, or how far they have stood the test of time, the exercise does illustrate that while the flashpoints may have changed, the underlying issues have not.
An international convention?
At one time there were suggestions of an international convention to govern the internet. Parallels were drawn with the Law of the Sea Convention. However, the maritime analogy does not really hold water. The internet is not an unowned expanse between states, requiring a separate legal regime to be created for activities that take place in the void between national boundaries. People’s online activities may straddle borders, or move across them instantaneously, but the activities do not in substance occur between them. The issue is one of conflicting laws, not one of no law.
In any case a convention harmonising substantive content laws was always likely to be unachievable. For myself, I was doubtful that it was even desirable; first, because there is intrinsic merit in maintaining a rich and changing variety of substantive content laws worldwide; and second, because any uniform worldwide content law that might be achievable would necessarily have to accommodate nation states with scant regard for liberal principles of freedom of expression.
"The risks attached to a universal convention to address those issues are twofold: that the prospect of agreement is very low; but also that if an agreement were reached, that would inevitably involve significant worldwide compromise of values such as freedom of expression. Those who would have to agree to such a convention include the very governments who so enthusiastically seek to apply their often restrictive domestic laws to internet activities emanating from other countries."
Internet Law and Regulation (5th ed, 2019, Sweet & Maxwell) Graham Smith, Chapter 6 Cross-border liability
In principle a jurisdiction convention — a set of rules about whose laws should apply — should aim to be agnostic as to the substantive merits of competing national laws. However, where content is concerned, value neutrality is something of a chimera: the greater the permissible reach of national laws online, the greater the prospect of exposure to the more restrictive law or regulatory regime.
Mere accessibility and most restrictive common denominator
The most expansive basis for asserting jurisdiction is mere accessibility, also known as country of receipt, country of destination or mere visibility. Even if there is no consensus about what internet jurisdiction rules should look like, from the start there was at least a strong body of opinion that mere accessibility is overreaching in principle, and that in practice it would lead to application of the ‘most restrictive common denominator’, a geographically fragmented internet, or both.
“If increased international co-operation were to result in national laws being extra-territorially enforced, … that would effectively amount to a ‘country of receipt’ rather than ‘country of origin’ regime. Under such a regime someone publishing content on the Internet would have to satisfy himself of its lawfulness in all countries of receipt. This is an extremely onerous and effectively impossible task to achieve. If ‘country of receipt’ were to be reinforced, it would result in a ‘most restrictive common denominator approach to Internet content.”
Content on the Internet – Law, Regulation, Convergence and Human Rights (Graham Smith, chapter in International Law and the Hague's 750th Anniversary, T.M.C. Asser Press, 1999).
"Over the years a de facto compromise had been emerging, with the steady expansion of the idea that you engage the laws and jurisdiction of another state only if you take positive steps to target it. Recently, however, some states have become more expansive – not least in their online safety legislation.
…
There has long been a consensus against ‘mere accessibility’ as a test for jurisdiction. It leads either to geo-fencing of websites or to global application of the most restrictive common content denominator. That consensus seems to be in retreat.
Moreover, the more exorbitant the assertion of jurisdiction, the greater the headache of enforcement. Which in turn leads to what we see in the UK Online Safety Bill, namely provisions for disrupting the activities of the non-compliant foreign platform: injunctions against support services such as banking or advertising, and site blocking orders against ISPs.
The concern has to be that in their efforts to assert themselves and their local laws online, nation states are not merely re-erecting national borders with a degree of porosity, but erecting Berlin Walls in cyberspace."
Shifting paradigms in platform regulation Cyberleagle, June 2023
“Today, the Law Commission exhorts Britannia (or England and Wales, to be exact) to rule the internet worldwide:
“In our view, contempt laws should apply to all material that is accessible in England and Wales.” (Part 1 Report on Liability for Contempt of Court, November 2025 [4.173])
... Ultimately, the policy reasons that the Law Commission has finally relied upon are domestically focused. They do not go into the broader cross-border legal and geo-political aspects that a full discussion of international law and comity could have illuminated.
Such an analysis would have involved considering whether it is reasonable, from the perspective of the foreign state and its citizens, to impose ‘mere accessibility’ liability on persons in another country. It would require consideration of the position of a variety of potential actors: mainstream foreign press and media, individual bloggers and posters, and online platforms."
Britannia rule the internet Cyberleagle, May 2026.
“All such Web-based activity, in
this view, must be subject simultaneously to the laws of all territorial
sovereigns.”
Mere accessibility is a species of the ‘effects’ test in international law, a basis on which states may seek to justify extraterritorial assertion of local law. The effects test was described by David Post in 2015 as:
"a wildly inappropriate doctrine for the Internet Age; if you're subject to jurisdiction where the "effects" of your actions or communications are felt, then given that the "effects" of communications over the Internet can plausibly be felt everywhere and anywhere, simultaneously and instantaneously, the [effects test] has the potential to nullify any and all limits on personal jurisdiction and subject everyone to jurisdiction everywhere - not a reasonable outcome."
Mere accessibility and extraterritoriality go hand in hand:“[W]e cannot assume that only the content laws that we like will be asserted extraterritorially. Take any regime whose idea of objectionable activities includes political or religious expression. Extraterritoriality is the first step towards requiring all Internet speech to respect the most restrictive national common denominator.”
Letter to The Times legal section, Graham Smith, 30 January 2001.
“Anyone using the internet must therefore obey the laws in their country. Similarly, they should obey the law in countries where their posts appear. As a practical matter, it is the search engines and service providers which can best prevent breaches of the law outside the country of origin of the original post.”
“So faced with Mr Mosley’s proposed rule, what should I do? Should I try to ascertain the most restrictive country’s content laws and comply with those? With the resources of a multinational publisher that is a challenging exercise. For a lone blogger it is preposterous. Even if it could be done the result is a monstrously chilling effect on freedom of expression, whereby I (and my UK readers) are deterred from enjoying the benefits of the UK’s imperfect but nonetheless relatively liberal content laws.
Should I hope that the worst laws will be unenforceable here, hole up in the UK and never set foot in another country (and if so do we wish to encourage such behaviour)? Or will Mr Mosley’s EU-wide law, then international convention, mean that I can be sued or, worst case, extradited, for breach of any non-UK content law, civil or criminal? (Extradition for internet activities can now no longer be regarded as fanciful, even under current laws.)
So should I try to restrict the blog to a UK audience, or to the UK plus a few selected countries whose laws I might be able to research?”
Leveson Press Inquiry Graham Smith, submission on internet jurisdiction, September 2012
One approach that has held out some promise of evolving into a workable compromise is the targeting test.
"From the earliest days of the web, lawyers have asked whether the worldwide availability of a website should of itself be sufficient to trigger worldwide liability. If not, what is the appropriate rule for the internet? A pure country of origin approach is politically difficult to achieve, whereas a country of destination approach exposes online actors to an unreasonable degree of liability. This article discusses whether a directing and targeting rule promises an acceptable solution, and if so how such a test should be formulated in order to prevent it degenerating into a country of destination rule.
…
In general, if a directing and targeting test is to draw an appropriate balance between country or origin and country of receipt, and discourage the erection of national borders in cyberspace, a finding that a website has targeted a particular country should be founded only on positive acts of the website proprietor, not on omissions to act.
...
To require evidence of positive acts is, in the context of the on-line environment, a close analogue to the original assumption underlying many of the rules written for the off-line world, that a trader did not without taking some positive step engage foreign laws and jurisdictions.”
Directing and Targeting - the Answer to the Internet's Jurisdiction Problems? (Graham Smith, Computer Law Review International 5/2004 129-170 May 2004)
“A properly formulated targeting test would mean that, for instance, the court in the French Yahoo! case could not have found that the mere display of Nazi memorabilia was sufficient to violate French law, without some element of targeting or direction at France. Nor would it have been open to it to find jurisdiction, as it did, on the basis that because Nazi memorabilia were of interest to all, the areas containing those items were directed at all countries simultaneously including France. However, it might still have been possible for a court to find that Yahoo's serving up of French banner advertisements to French IP addresses would satisfy a "directed at" test."
Here, There or Everywhere? Cross-border Liability on the Internet (Graham Smith, 2007 C.T.L.R. 41)
"The targeting approach occupies a middle ground, prescribing legal consequences for localisation but stopping short of incentivising or compelling fragmentation. Targeting holds out some promise of allowing national law to be upheld in circumstances when many would think it reasonable that it should do so, while also reducing incentives to fragment the internet.
However the targeting approach can fulfil this promise only if it is formulated in a way that does not slip towards the country of receipt end of the spectrum. If, for instance, a French blogger writing in English were taken to be targeting all English speaking countries by virtue of using the English language, or the whole world by writing about topics of inter national interest, that would be a targeting approach in name only. A targeting approach still requires an underlying commitment to jurisdictional self-restraint on the part of the legislatures and courts that implement it.
Cyberborders and the right to travel in cyberspace (Graham Smith in The Net and the Nation State (ed Kohl, 2017) Chapter 9).
“Directing and targeting of activities has long been thought to be an appropriate ground on which to assert jurisdiction over internet actors.”
Extraterritoriality and the transatlantic free speech wars Cyberleagle,
Whilst I took issue with Max Moseley’s 2012 visibility test (above), he was not wrong to say that search engines and service providers would be seen as best able to prevent breaches of the law outside the country of origin of the original post.
Co-option of online intermediaries brings into play an important distinction between initial jurisdictional competence and the territorial reach of the measures that a court or regulatory authority may decide to take when exercising that jurisdiction. Court cases seeking to co-opt intermediaries typically boil down to the latter: should a court that has assumed jurisdiction make an order with extraterritorial effect?
The Canadian Google v Equustek and Australian eSafety Commissioner v X cases took different approaches to that question, the latter having more regard to the effect on individual users in other countries. Two CJEU cases have also considered the question: Google v CNIL (C-507/17, 10 January 2019) and Glawischnig-Piesczek v Facebook Ireland Limited (Case C-18/18, 3 October 2019).
"When faced with a bad actor, an ugly set of facts and a demand for an effective remedy it is all the more important that a court should anxiously examine the basis for exercising its power and carefully identify and balance competing factors, even – perhaps especially - where the internet is concerned. …
Where an apparent bad actor thumbs its nose at the court’s authority it is perhaps unsurprising that if a well-resourced global intermediary is haled into court, apparently able to take steps to mitigate damage to the plaintiff at little inconvenience to itself, the tribunal may (if satisfied that it has the power) be inclined to enlist its assistance.
Nevertheless if a future court should contemplate a similar order then a more detailed identification of the rights and interests involved, analysis of any territorial aspects of those rights and consideration of the freedom of speech rights of internet users separate from the sensibilities of states may be key to arriving at an appropriate outcome.”
Worldwide search de-indexing orders: Google v Equustek Cyberleagle, July 2017
“A notable aspect of these passages [in the judgment of Kennett J in eSafety Commissioner v X Corp [2024] FCA 499] is the approach to comity of nations, especially in the balance of convenience section which refers to the effect on millions of people unconnected with the litigation. It stands in significant contrast with the approach of the Canadian Supreme Court in Equustek (a trade mark and confidential information case).”
Internet jurisdiction revisited Cyberleagle, May 2024
"Ideally, in a world of mutually respectful nation states, each country’s legal institutions would behave with modest self-restraint when asserting jurisdiction over cross-border online conduct. They would seek at most to govern activities within the country’s own borders or with an overwhelmingly strong domestic connection. They would refrain from asserting the superiority of their own laws over those of any other country that adhered to core human rights norms. Each country’s institutions would strive to avoid imposing their own country’s laws on activities abroad, either directly or through consequential effects in other countries. Such self-denying behaviour tends to encourage porous or open borders.
At some risk of caricature, in the real online world nation states tend to view the internet as little more than a device designed to undermine the efficacy of their domestic laws. In this view of the world visibility of foreign content is equated to importing the alien laws under which it was made. The parochial temptation to reach out and assert jurisdiction over merely accessible foreign content that contravenes a state’s domestic norms can be all but overwhelming. Laws may be asserted extraterritorially via broad concepts of location of activity and attenuated domestic connecting factors. Self-denying principles, such as that a state should refrain from doing that which it would not have done to it, waver in the face of foreign content that affronts local values. Giving maximum effect to local law may be articulated as a matter of national or regional honour.
...
Targeting rules and country of origin rules both imply recognition that the emancipated internet user’s home state should not seek to impose on its people a total monopoly of local laws in order to insulate them from foreign information– a policy that in the pre-internet physical world was attempted only in the most repressive states. We could go so far as to say that by keeping information out we keep people in: we erect not just a border but a virtual Berlin Wall. There is a risk that states, reacting fearfully and defensively to the inherent global nature of the internet, may adopt a policy of seeking to erect closed borders which are less porous than their pre-internet physical equivalents. By doing so they would deny their people the right to travel in cyberspace.”
Cyberborders and the right to travel in cyberspace (Graham Smith in The Net and the Nation State (ed Kohl, 2017) Chapter 9).
"In one respect we have made progress since 1996. In an increasing number of subject matter areas a targeting test has been held (at least within the EU) to define the territorial scope of a right. Targeting rules hold out the prospect of something approaching a peaceful co-existence regime. Properly formulated and applied, a targeting test (a) lays down that mere accessibility does not trigger the laws or jurisdiction of another country and (b) requires relevant positive conduct, not mere omission, in order to do so.
…
However, the furore that periodically erupts around cross-border internet cases shows that there is still little consensus on these issues. Nuanced approaches may be at greatest risk of being jettisoned when the law in question is said to embody a core value of the state asked to adopt an expansive jurisdictional stance. That is also the time when greatest care should be taken not to let enthusiasm for the perceived merits of domestic law override respect for the different laws of other countries and the principle of peaceful co-existence.”
21 years of cross-border liability on the internet Cyberleagle, August 2017
"Jurisdiction rules are about resolving friction between different legal systems in as agnostic a way as possible, not about ensuring that the best (in someone’s view) law wins.
…
The jurisdictional problems of the internet manifest themselves in both underreach and overreach. There are situations where arrangements between states are no longer providing adequate means to obtain evidence to support criminal investigations. We can no longer assume that the evidence relating to a domestic crime will be held domestically. It could as easily be in a data centre abroad. That would suggest a need to improve procedures for obtaining cross-border evidence.
Conversely, we have situations in which domestic legislatures, agencies and courts are at risk of overreaching in the cause of giving maximum effect to their local laws. That can result in the de facto imposition of those laws in countries with different laws. The concern here is the need for jurisdictional self-restraint.
The challenge is to forge rules that enable cross-border reach when appropriate, yet prevent the exercise of jurisdiction when not appropriate.
…
The premise of jurisdiction rules is that nation states have different laws. The objective where the internet is concerned should be to achieve peaceful co-existence between conflicting national regimes while protecting to the greatest possible extent universal values such as freedom of expression and privacy.
Peaceful co-existence cannot be achieved without compromise. That means taking a broader view than simply a laser-like focus on securing the effectiveness of one country or region’s most cherished laws. It may mean accepting that your country’s citizens can, if they try hard enough, find somewhere on the internet content that complies with another country’s laws and not your own.”
Peaceful coexistence, jurisdiction and the internet Cyberleagle, February 2018
Peaceful co-existence, however, remains far from the norm:
"The transatlantic free speech wars continue to rage.
…
Some, no doubt, will be tempted just to plump for one side or the other, motivated by partisan preference for the EU, UK or US approach to governing speech and online platforms, by broader political affinities, or by views on the propriety or otherwise of deploying visa sanctions for this kind of purpose.
Tempting as that may be, simply to declare 'four legs good, two legs bad' will not do when it comes to considering international law rules and extraterritoriality. Taking sides based purely on a preference for the Digital Services Act or the Online Safety Act over the US First Amendment, or vice versa, does not address the underlying legal issue: how, in the inherently cross-border online world, to go about drawing boundaries - or at least minimise friction - between different national or regional legal systems. A more analytical approach is called for.
…
The more tenuous the connection and the greater the cross-border reach, the more exorbitant the claim to jurisdiction and the less likely that the extraterritoriality can be justified.
That is the theory. In practice, the customary norms of international law tend to be distinctly malleable and, when push comes to shove, to merge into geopolitics.”
Extraterritoriality and the transatlantic free speech wars Cyberleagle,
