Categories of institutional options

1This chapter will focus on the institutional alternatives that can be considered when imposing measures on technical intermediaries.

2There exist four main categories of institutional frameworks for regulating access to internet content.

• General liability or property rules enforced by the courts (court regulation);
• Detailed regulatory rules developed and enforced by an administrative or regulatory body (administrative regulation);
• Self-regulatory regimes, which can involve unilateral regulation by each firm through individual terms of use (unilateral self-regulation), and regulation through collective codes of conduct (multilateral self-regulation);
• Co-regulatory regimes, where the government delegates some regulatory functions to the regulated enterprise, which the regulated enterprise conducts under the government’s supervision.

3These four institutional frameworks often coexist with and complement each other. Indeed the first framework, general liability or property rules enforced by the courts, almost always exists, either by itself or as a backstop for other regulatory measures. In the shadow of liability rules and court enforcement, private actors use unilateral self-regulation, regulation through contract, to govern their relationship with users. The question then is whether supplemental institutional alternatives – administrative regulation, multilateral self-regulation, or co-regulation – are useful.

4This chapter does not have the ambition of trying to identify an optimal institutional framework. Brousseau (2007), Marsden (2011) and Weiser (2009) examine various forms of internet co-regulation, Brousseau focusing in particular on “multi-level” regulation. (I discuss Brousseau’s approach below.) This chapter is less ambitious. It seeks simply to illustrate how the four different institutional frameworks operate (and interoperate) in the internet environment, and identify the principal advantages and disadvantages of each alternative.

General liability or property rules enforced by the courts

5The most basic institutional structure consists of laws that are then enforced by the courts. The vast majority of economic activity is governed by general principles of law that are then applied on a case-by-case basis by the courts. In civil law systems, the general principles of law are defined in a code, such as France’s Civil Code. In common law systems, the general principles are developed through judicial decisions. However, even in common law jurisdictions such as the United States, most legal principles are now reflected in laws enacted by the legislature and organized in codes.

6Sound legal principles are general in nature, and not linked to any economic sector or technology. A good law is one that can survive over time and is flexible enough to adapt to new circumstances and technologies (Conseil d’État, 2016). The court’s job is to apply the general principle to new circumstances.

Advantages and disadvantages of regulation by courts

7The court system is designed to conduct fair adjudication of individual disputes, and performs this function very well. The judges who decide disputes are independent, and the procedures they use are designed to ensure that both sides of the case are given a full opportunity to be heard. The risk of error is reduced by an appeal mechanism. Obviously, not all judges are truly independent, and the procedural safeguards do not always work the way they should. Nevertheless, the court system is designed to come as close as possible to an ideal adjudication system for individual disputes. The judicial system benefits from high legitimacy because it is anchored in the country’s constitution. Both the decision-makers and the decision-making process are respected. Industry capture is less likely to occur than within specialized regulatory agencies where regulators have a close on-going relationship with regulated entities. Decisions that come out of the court system are generally perceived as fair. The court system is a public service – judges and their staff are paid by the state, not by the parties to the dispute. As we will see below, litigation before courts can be expensive, but the cost is not due to the fees of the judges or their staff.

8Courts are flexible: their job is to apply a law to new circumstances, and find an outcome in each case that is fair and promotes the objectives of lawmakers. As noted below, this flexibility can be defeated if the law is poorly drafted.

9In matters involving fundamental rights, courts are considered the most legitimate – and in some cases the only legitimate – decision maker. This is why courts will always be involved in any institutional framework dealing with internet content. Their presence is unavoidable because they guaranty that regulatory authorities (or self-regulatory initiatives) do not violate laws or constitutional rights of individuals. Because courts are unavoidable in any regulatory framework dealing with internet content, the only question is whether courts are sufficient by themselves, or whether additional institutional layers are necessary or useful.

10Courts have several disadvantages. First, courts are designed to adjudicate disputes relating to events that occurred in the past. For example, the court will determine whether an internet platform acted promptly enough in removing illegal content once it received a notice. The court’s focus is on something that happened months, maybe even years, earlier. Courts generally do not conduct forward-looking analysis when adjudicating individual disputes, or ask what the ideal rule would be for development of the internet ecosystem for the future. The courts may conduct this analysis as part of their examination of the case, but it is not their primary focus. Their primary job is to determine who was right or wrong when the event occurred in the past. As we will see below, this is quite different from the role of administrative regulators, whose jobs are to monitor a given sector and adopt decisions that move the sector in the direction desired by lawmakers.

11Second, the primary job of the courts is to render justice between two parties in an individual case. The purpose of court decisions is generally not to design rules that will affect the behavior of an entire sector. Court decisions can of course have this effect indirectly. Economic agents will observe court decisions and adjust their behavior accordingly. But this is not the primary objective of the court. The court’s objective is to render justice between two parties in a given fact situation. The effect of the decision on behavior of other industrial actors is a secondary consideration that courts may in some cases take into account. But it is not the job of courts to make law or regulations, and courts may in some cases be oblivious to the effect of their decision on other economic actors. Moreover, because every individual dispute involves different facts, court decisions can be inconsistent with each other, thereby sending contradictory messages to the market.

12Third, judges depend on the parties to the dispute for access to information. Judges generally cannot undertake independent investigations, and at the beginning of a case they are ignorant about the economic and technological context of the dispute. The result is that judges are dependent on the parties for access to information, and the information provided to them can be limited and biased.

13A point related to judges’ lack of information is the fact that judges are generally not expert in complex technical or economic issues. This can be a disadvantage in some cases, but an advantage in others. A lack of specialization can mean that the judge must devote considerable time to understanding some of the basic technical and economic parameters of a sector. Not possessing expertise, the judge can make mistakes that an expert would not make. On the other hand, a lack of specialization can render the judge free from accepted industry thinking. A non-specialist will more easily be able to think creatively and draw on examples from other sectors. Moreover, not all judges are generalists. In certain larger court systems, judges are assigned to specialized subject matters such as copyright or internet disputes. These judges acquire considerable expertise during their career on subjects such as notice and takedown for internet sites.

14A major disadvantage of the court system is that the adjudication of individual disputes is generally slow. Courts have the ability to act fast in certain circumstances, in particular where there is danger of irreparable harm. However, these urgent proceedings are available only in exceptional circumstances. The normal mode of functioning for a court is to examine the case over a period of several years. This long time period can be attributable to the large backlog and shortage of judges. In other cases, it can be attributable to procedural manoeuvres deployed by one party to delay the lawsuit. The delay inherent in court decisions creates several drawbacks. If the dispute is between a new entrant and a large well-established incumbent, the new entrant may perish while the case is being adjudicated. Even if the new entrant is right, the court decision will come too late to be of any use. The market will have moved on, the new entrant will have gone bankrupt or have had to change its business model.

15To the extent a court decision is intended to send signals to the market, a delay of several years for adjudication is a drawback because it prevents the decision from having an effect on the market when it is most needed. This is especially true in a fast-moving market such as the internet. In addition, a court decision may not be final. As noted above, court decisions can be appealed and may contradict each other, leaving the market uncertain until the matter reaches the country’s highest court. The process may take a decade.

16In the area of notice and takedown, it took ten years for courts to clarify certain issues, such as the kind of internet platform that can benefit from the liability safe harbor. Some questions are still unsettled because of inconsistent court decisions. Internet platforms manage this uncertainty. It is difficult to know whether the slow development of rules on notice and takedown created significant social costs compared to an alternative scenario in which detailed rules would have been developed at the outset through a regulatory authority.

17Last, once a decision is rendered, courts generally do not conduct ongoing supervision over a given actor or situation. The court can only react to specific requests raised by litigants, and cannot itself supervise the application of its decisions over time. As we will see below, regulatory authorities can more easily conduct on-going supervision of market actors.

Advantages and disadvantages of court enforcement

18The main advantages and disadvantages of relying solely on liability or property rules with court enforcement can be summarized as follows:

Advantages

• Judges have a high degree of independence, with a lower risk of conflict of interest or industry capture than other regulatory bodies.
• The court system is procedurally fair: both parties have the right to be heard and a right to appeal.
• Court decisions generally lead to the fairest outcome for the individual dispute.
• Courts are accustomed to applying legal principles to new circumstances.
• Courts are perceived as the most legitimate forum for disputes involving fundamental rights.

Disadvantages

• Courts create rules to apply to events that already happened. The rules are not forward-looking.
• Courts’ first priority is to find the right rule for the individual dispute at hand, and not necessarily the right rule for the industry.
• Because decisions are focused on particular fact situations, court decisions are often inconsistent with each other.
• Court decisions require several years to be issued, even more in case of an appeal.
• Judges depend on the parties for access to information.
• Judges generally lack expertise in specialized technical or economic issues.
• Courts cannot easily conduct on-going supervision of market actors.

Administrative regulation

Division of responsibilities between the lawmaker and the regulator

19The traditional method of regulation of a particular sector (e.g. banking or telecommunications) is for the legislature to enact a law setting out high-level legal principles for the sector and then to entrust the application of those principles to a regulatory authority. The regulatory authority will generally have the ability to adopt recommendations or binding rules that apply the legal principles to actors in the market, and sanction actors that ignore the rules. The regulatory authority may have an adjudication function pursuant to which parties can ask the regulatory authority to resolve disputes. The regulatory authority will generally have investigatory powers allowing it to gather information or even conduct dawn raids. Decisions of the regulatory authority – whether rule-making decisions, sanctioning decisions or dispute resolution decisions – are almost always appealable to courts. The regulatory authority is never a substitute for courts. Courts retain the ultimate power to determine the legality of the regulator’s actions.

General versus detailed legislation

20In the field of measures to limit access to illegal content on the internet, lawmakers have a dilemma. On the one hand, given the sensitivity of the issues and the careful balancing that must accompany any measure, lawmakers will want to draft detailed legislation in order to get the balance right. Detailed legislation will permit lawmakers to do the balancing themselves, contributing to the measure’s legitimacy. The legislature is arguably the best institution to balance sensitive rights and interests, because the legislature is directly accountable to citizens. Also, lawmakers may wish to avoid delegating regulatory authority for something as politically sensitive as measures to limit access to content on the internet. However, a careful balance struck after detailed legislative debate and compromise will result in a text that is perfectly adapted to the technology, business models and social context that existed at the time the debate took place. But when the law is actually applied, the balance struck by the legislature may already be outdated, overtaken by technological change and new social or business trends. The law will be ineffective, derided by critics as creating risks for fundamental rights, costing taxpayer money, without yielding any of the benefits that were supposed to be part of the original equation. A good example if this is the American Home Recording Act (AHRA), in which the United States Congress enacted detailed rules to deal with copyright infringement via digital audiotape recorders.¹ Digital audiotape recorders never became popular, and AHRA was quickly obsolete. Another example is the French HADOPI law. The law and its implementing decrees had peer-to-peer file sharing in mind. But when users turned to streaming and direct download, the HADOPI’s regulatory framework proved ill-adapted to the new technology and usage patterns.

21Another choice for legislatures is to write laws that are so general that they cannot become outdated. This option has advantages. A general law is more likely to stand the test of time, because courts or regulatory authorities can interpret the law in light of new technological developments and fact situations. Section 5 of the Federal Trade Commission Act, which prohibits unfair and deceptive practices, is a good example of a provision that is general enough to be applied to many different circumstances. A regulatory authority such as the FTC can apply the unfair and deceptive standard to almost any situation that might arise on the internet, and the standard will never be outdated. The disadvantage of a general law is that it can create an unpredictable environment for stakeholders, who will have difficulty guessing in advance whether their own conduct falls within the standard or not. To address this shortcoming, the FTC issues guidelines so that market actors understand how the FTC intends to interpret the “unfair and deceptive” standard in various contexts.

22In sum, a law that is too precise will have the advantage of being predictable, but runs the risk of becoming obsolete. A law that is too general will better stand the test of time, but will create uncertainty for stakeholders.

23A third potential route – one used in the European framework for regulation of electronic communications – is for the legislature to adopt a detailed balancing methodology and entrust an independent regulatory authority with its application. This option permits the law to evolve with technological changes, and provides more predictability than the situation in which a bare standard, such as “unfair and deceptive,” is used.

Regulatory authorities have better access to information and expertise

24Regulatory authorities have several advantages over courts. Like courts, regulatory authorities are dependent on regulated entities for access to information. Consequently, the level of information is far from perfect. However, regulatory authorities have more tools at their disposal to gather information than courts do. Regulatory authorities routinely issue public consultations and questionnaires to gather information from market players. Regulatory authorities can use their investigatory powers to gather information. Regulatory authorities also conduct forward-looking economic studies and market analyses, something that courts do not do.

25Regulatory authorities have in most cases a higher level of subject matter expertise than do courts. Regulatory authorities have staffs of economists, engineers and lawyers who are specialized in the relevant industry. Judges do not have access to these resources.

26Regulatory authorities have a forward-looking mission. Their objective is above all to ensure that a given market sector moves in the direction desired by lawmakers. Events of the past are only relevant insofar as they affect future market trends. The regulatory authority may in some cases be called on to sanction past behaviour or adjudicate private disputes. But the main objective of the regulator is elsewhere: to send signals to the market so that economic agents adapt to their behavior in a way that furthers the objectives defined by lawmakers.

27Regulatory authorities are in many cases able to act more quickly than courts. A regulatory authority can adopt industry guidelines in less than 12 months. Some regulatory proceedings take much longer than this, and can even exceed the time needed for court proceedings. However, the time period for regulatory decision-making is supposed to be shorter than in the court system. This permits the regulatory authority to have a quicker effect on the market than would an individual court decision.

28Finally, regulatory authorities are able to adjust their decisions and eliminate rules that are no longer needed. This provides flexibility to adapt rules to changing markets and technology.

Risk of industry capture

29Regulatory authorities are more prone to industry capture than are the courts. Regulatory authorities have an ongoing relationship with players in the regulated industry. Regulators depend on industry players for access to information and for participation in regulatory hearings. Where regulated entities voluntarily comply with regulatory guidelines, the regulator can avoid adopting binding rules or imposing sanctions, which in turn helps the regulator avoid long and potentially damaging² court battles. Regulatory authorities have many incentives to coax market participants into voluntary compliance, instead of trying for force compliance through legal force.

30Most regulatory authorities have rules prohibiting a member of a regulatory authority from working for a regulated entity for a certain time after their employment as a regulator. Nevertheless, many employees of a regulatory authority see employment with a regulated entity as a possible career path for the future. There are many reasons why regulators will want to maintain a good relationship with regulated industry players. Consciously or not, the regulatory authority will not want to take actions that seriously disrupt the players it regulates. The regulator will prefer gradual change over sudden disruptions in regulatory policy. This may lead to a situation where the regulatory authority adopts positions that have the effect of protecting existing market players against disruptive new entrants, technologies or economic models. In this respect, regulators can unconsciously impede innovation and favor the status quo.

31Regulatory capture may be less of an issue for regulators that deal with a broad range of industries. Competition authorities, consumer protection and privacy authorities (such as the FTC in the United States or the CNIL in France) deal with a multitude of industries and players. They do not need the same close relationship with a given industry sector as does a sector-specific regulator such as a regulator of telecommunications or financial services.

Risk of regulatory creep

32Regulatory authorities will have a natural inclination to take actions that increase their own power. When given a choice between a regulatory decision that gives the regulatory authority a greater role in regulating the industry, and a decision that lightens or removes regulation, the regulatory authority will naturally prefer the first option because it will keep the regulatory authority with a job. This phenomenon is referred to as “regulatory creep.” Consciously or not, regulators will be reluctant to withdraw existing regulation because doing so could reduce demand for the regulator’s services. The more natural path for regulators to follow is to increase regulation and their regulatory power. This path will reinforce the perception of the regulator’s importance, potentially giving the regulator access to more budgetary resources from the government. Regulators compete with other branches of government for limited budgetary resources. In the market for access to budgetary resources, each regulator must convince lawmakers that that regulator’s job is more important than that of its peers. A regulator who adopts a deregulatory policy will disadvantage itself in the competition for scarce resources.

Territorial limitations to regulators’ powers

33Regulatory authorities are inherently national in character. They exist because a country’s legislature created them and gave them powers. Consequently a regulator generally has no power outside its own country, and may have difficulty regulating an entity located outside the regulator’s country even if the entity’s actions have effects within the country. This is one of the principal challenges of regulating players in the internet ecosystem. Content and service providers can be located almost anywhere and provide their services worldwide via the internet. The actions of individual regulatory authorities are often ineffective against such entities.

Example of administrative regulation: the FTC’s regulation of privacy

34Section 5 of the Federal Trade Commission Act empowers the Federal Trade Commission to take action against any unfair and deceptive practice in commerce. The FTC has interpreted this provision as giving the FTC broad authority to take action against companies that process personal data of consumers in ways that are misleading or unfair. For certain sectors of industry, the United States has enacted detailed data privacy laws that impose specific requirements on market actors. An example is the United States HIPAA legislation, which closely regulates how hospitals, clinics and insurance companies handle personal health data.³ Detailed rules of this kind also exist for financial services, telecommunications services, cable television, and credit reporting in the United States. By contrast, the United States rules on unfair and deceptive practices are quite general in nature. These terms give the FTC a great deal of flexibility to adopt the guidelines, and bring sanction procedures in a wide variety of contexts. Because a number of industrial sectors in the United States are not covered by sector specific data privacy rules, the FTC has filled the void by applying the unfair and deceptive practice principle to data privacy issues in the United States.

35Because the FTC deals with a broad range of different industries, it is less prone to industry capture than a specialized regulatory authority in the energy sector for example. The FTC has a number of tools at its disposal to do its job as a regulator. The first tool involves conducting individual investigations and entering into settlement agreements with violators. When the FTC investigates a given violation and concludes a settlement, the findings of the FTC will be made public so that other companies can learn from the experience. In this way, the FTC sends a message to all market players as to how the FTC interprets the “unfair and deceptive” standard in given factual circumstances. This function is not unlike that of a court, whose decisions will be scrutinized by all market actors in an effort to understand how the court applied a general legal principle to a specific fact situation.

36Finally, the FTC organizes public hearings, consultations and issues recommendations in an attempt to gather information from the market and adopt guidelines that reflect to the greatest extent possible an industry consensus. This activity is quite different from that of a court, in that the FTC will attempt to develop interpretations of the legal principle after a broad collection of data from the market. As we saw above, a court will typically only be able to collect data from parties to the litigation, and will not be as concerned with making a ruling that reflects industry consensus. The FTC by contrast will prefer industry consensus as it will tend to make regulations more effective and enforceable.

Advantages and disadvantages of administrative regulation

37The main advantages and disadvantages of administrative regulation are as follows:

Advantages

• Regulatory authorities can collect market information from various sources: investigations, consultations, and industry questionnaires.
• Regulatory authorities have subject-matter expertise and can rely on multidisciplinary teams (engineers, computer scientists, economists, lawyers).
• Regulatory authorities try to develop industry consensus and adopt rules reflecting consensus when possible. This in turn helps compliance and enforcement.
• Regulatory authorities have a broad set of tools at their disposal to influence market actors: workshops, guidelines, binding rules, sanction proceedings, settlement agreements.
• Actions by regulatory authorities are in most cases faster than court actions.
• Regulatory authorities follow a road-map defined by lawmakers, thereby giving legitimacy to regulators’ action.

Disadvantages

• Regulatory authorities depend on market players for access to information.
• Regulatory authorities can be subject to industry capture, particularly where the regulatory authority deals with a single sector.
• Regulatory authorities will have a tendency to increase their own powers (regulatory creep).
• A regulator’s authority is limited to a single country.

Self-regulation

Self-regulation and the internet

38Most of the rules surrounding how the internet functions are developed through self-regulation. The technical standards used on the internet as well as the domain name system are developed and enforced principally through self-regulatory mechanisms. During the 1990s some scholars speculated that rules relating to content on the internet might be governed by a form of lex mercatoria, similar to the self-regulatory regime applied by merchants in the Middle Ages (Reidenberg, 1998). Because the internet was developed through private rules and codes of conduct, it seemed reasonable to suppose that issues relating to content on the internet could also be governed by a global body of private rules, similar to the acceptable use policies one sees today in social media platforms. Early internet users, who were almost all academics at the time, observed “netiquette,” a code of conduct that prohibited use of network resources for commercial purposes.

39Let us examine the classic cases where self-regulation works, before examining two forms of self-regulation: unilateral self-regulation (contractual terms of use), and multilateral self-regulation (codes of conduct).

Self-regulation works well in groups with stable membership

40In certain contexts, self-regulatory regimes are extremely effective. In the right circumstances they can achieve high levels of compliance while generating few enforcement costs. In successful self-regulatory regimes, public courts and police are unnecessary. Professional guilds are an example of this kind of self-regulatory situation.

41Bernstein (1992) studied diamond merchants in New York and concluded that the success of the self-regulatory structures among diamond merchants is based on the fact that the membership of the group is relatively stable. Entry and exit from the group is difficult, which means that the cost of violating the group’s internal rules is high. A member of the group who is sanctioned and excluded from the group will not have access to the resources and business opportunities associated with group membership. Because rules are enforced by members of the group, the use of the state’s enforcement power is unnecessary to achieve compliance. The group finances its own enforcement mechanisms, making recourse to courts unnecessary in most cases. While the self-regulatory regime cannot use the power of the state to impose punishment (e.g. imprisonment), the self-regulatory body can order exclusion from the group. Where the costs of exclusion are sufficiently high, self-regulatory bodies can achieve high levels of compliance with internal rules without recourse to state enforcement mechanisms.

42Dixit (2009) underlines the problems of enforcement in multilateral self-regulation environments. Good enforcement generally requires a stable community with many ongoing interactions, and good information flows about members’ behavior. Enforcement by other members of the group may give rise to some private costs. Punishment actions undertaken by certain members therefore become a public good and individuals have the temptation to free ride just as in any other context of private provision of a public good. The communication channels that are needed for members to enforce rules against each other become weaker as the size and scope of the group expand. Successful governance in a large group or one with a large geographic or social spread eventually requires a shift toward more formal methods of governance.

Self-regulation works well where the self-regulatory organization (SRO) controls access to a scarce resource

43Effective enforcement is also possible where the self-regulated group controls a scarce resource. In the case of a bar association or medical board, the scarce resource is the license to practice law or medicine. In the case of the internet domain name system, the scarce resource is domain names.

The difference between unilateral and multilateral self-regulation

44There are two main categories of self-regulation. Self-regulation can take the form of contractual rules imposed by a service provider on its customers. We will call this “unilateral” self-regulation. Unilateral self-regulation is present everywhere: tennis clubs impose rules on their members; internet platforms impose their terms on users of the platform. In unilateral self-regulation, the contract with users is the regulation.

45Self-regulation can also take the form of rules developed by a group of stakeholders in a given industry to govern the conduct of the stakeholders themselves. We will call this “multilateral” self-regulation. Examples of multilateral self-regulation include professional guilds, such as bar associations and medical associations. The self-regulatory bodies created to deal with internet policy are the result of multilateral self-regulation. Multilateral self-regulation can take the form of nonbinding recommendations, or of binding rules. Multilateral self-regulation often requires the creation of a governance body charged with applying the rules.

46We will examine briefly below an example of unilateral self-regulation, and an example of multilateral self-regulation. The example of unilateral self-regulation will be the terms of use of internet platforms. The example of multilateral self-regulation will be the self-regulatory organizations created by stakeholders in the advertising industry.

Unilateral self-regulation by internet platforms

Internet platforms control membership privileges

47Popular internet platforms have the power to exclude users from the platform, and the cost of exclusion is high for users. By entering a social media platform, a user agrees to abide by the terms of use, much like a travelling merchant in the Middle Ages would agree to abide by the rules of a local market place when entering the market. Like a professional guild, a social media platform can enforce its terms of use simply by withdrawing access to the platform. A high degree of enforcement can be achieved with minimal or no action being necessary from the government. In this respect, internet platforms would appear to have the ability to enforce internal rules effectively, with low cost to the state.

48The situation is more complex in reality. Regulation through terms of use raises questions regarding the legitimacy of the underlying rules. Who makes the rules and why? Second, enforcement of the terms of use may not be systematic because of the sheer volume of content uploaded by users. Conscious of the impossibility for platforms to monitor all the content that is uploaded, lawmakers in Europe and United States provided platforms with a liability safe harbor that protects them from liability as long as they promptly remove content once they have received notice of its illegal character. Platforms rely almost exclusively on users to identify and notify the platform of content that is illegal or otherwise violates the platforms’ terms of use.

49When a platform receives a notification from a user, the platform must review the content identified in the notice to determine if it in fact violates the terms of use and should be removed. The vast majority of notifications received by platforms are dealt with unilaterally by the platform, based on the platform’s own determination as to whether the relevant content violates the platform’s terms of use. Few cases go to court. The platform’s job is relatively easy when the content objectively violates one of the platform’s terms of use, such as the prohibition of nude photos. The situation becomes more complex when the illicit character of the content is not obvious. Under United States and European legal principles, an internet platform need not make difficult decisions relating to borderline case. Where there is doubt as to the legality of the content, the platform can either do nothing, and wait for a court order instructing the platform to remove the content, or decide to unilaterally remove the content relying on the platform’s contractual terms of use.⁴

50Complex situations arise when the content is considered illegal or shocking in one region of the world, but not in the country where the platform is based. This situation occurs most frequently in connection with certain kinds of hate speech that are illegal in France and other European countries but permitted in the United States under the First Amendment of the United States Constitution. Other examples involve content that is considered as blasphemous in some countries of the world, but as legitimate political or religious criticism in other countries.

51Jeffrey Rosen’s article entitled “The Delete Squad” illustrates how platforms handle complex questions linked to conflicting international legal norms (Rosen, 2013). Instead of blindly following United States First Amendment principles, global internet platforms are increasingly sensitive to non-US content laws. Other things being equal, the platforms will want to champion First Amendment principles and foster freedom of speech worldwide. However, the platforms make exceptions to the rule, such as where content is manifestly illegal under a local law and was posted by a user located in the country where the content is illegal. In those cases, the platform may decide to make the relevant content inaccessible only in the country where it is illegal. The platforms may also permit certain content to remain on the site in spite of a local law violation if the content is clearly a form of political or religious criticism.

Advantages of unilateral self-regulation

52The contractual rules established by internet platforms do not require a costly institutional framework to administer. Each platform applies its rules to users in accordance with the platform’s own enforcement policy, without any formal procedures or methodology. In creating the rules and enforcing them, internet platforms will take into account their own risk of liability, but also the expectations of platform users. By putting into place a system pursuant to which users can identify unacceptable content by sending notices, platforms delegate to the users part of the job of enforcing the terms of use. The resulting notices will necessarily reflect the expectations and cultural norms of users. The system is a form of bottom up enforcement, which is decentralized and scalable. The platform’s enforcement policies also are not constrained by national boundaries. Because the platform controls the servers on which content is posted, it makes no difference where the user who posted the content is located. He or she may be located in France, Russia or India, and the platform will still be able to exercise jurisdiction over the person based on the platform’s terms of use combined with the platform’s control over infrastructure.

53The ability of platforms to enforce content policies on a global basis puts platforms at an advantage over national regulatory authorities, who typically do not have power outside their own national jurisdiction. This can lead national regulatory authorities to consider platforms as convenient proxies through which authorities can extend their own territorial power. This has occurred in France, for example, where the French data protection authority ordered Google to delist certain search results even for users outside of France. The reasoning of the French regulatory authority is that if a given search result violates the data protection rights of a French individual, those search results should be outlawed even outside France. The counter argument is that if France begins using platforms as a proxy to apply French content rules worldwide, other countries will do the same, resulting in every country in the world regulating what people in other countries see on the internet.

54The point of this illustration is to highlight the tension that can exist between the technical ability of a platform to enforce a content policy worldwide, and the legal jurisdiction of regulatory authorities, which is generally limited to enforcement within a country’s national borders.

55The last advantage of unilateral self-regulation in the internet sector is that the terms of use put in place by each internet platform give the platforms the flexibility to apply ad hoc remedies in complex cases, such as by disabling access to content in certain parts of the world while keeping the content visible in other parts. This flexibility leads to solutions that are pragmatic and that in many cases reflect what a judge would do when confronted with the same complex fact pattern.

Disadvantages of unilateral self-regulation

56Alhert et al. (2004) illustrated the potentially over-zealous application by certain platforms of notice and takedown rules. The authors conducted a “mystery shopper” test among several large internet platforms. The authors posted a text of John Stuart Mill that is in the public domain, and then sent bogus notices to the platforms claiming that the text violated copyright. The platform located in the EU systematically removed the content, while the platform in the United States did not. The authors attribute this difference to variations in how the notice and takedown regime is drafted in the United States and in the EU.

Advantages and disadvantages of unilateral self-regulation

57The main advantages and disadvantages of the unilateral model of self-regulation can be summarized as follows.

Advantages

• Little or no institutional costs, no institutional structure to administer;
• Enforcement is decentralized and scalable via user notice and takedown mechanisms;
• Competitive constraints ensure that enforcement policies are sensitive to user interests;
• Enforcement policies will be pragmatic and flexible;
• Not constrained by national boundaries.

Disadvantages

• Terms of use are drafted unilaterally by the internet platform without any form of stakeholder debate;
• Enforcement of terms of use can lead to inconsistency, with cases of over- or under-enforcement.

Multilateral self-regulation and SROs

58Multilateral self-regulation generally involves some form of governance structure, including the creation of a self-regulatory organization (SRO). Governance procedures and procedural safeguards of the SRO help enhance the credibility and legitimacy of the SRO’s actions. The creation of the substantive rules by the SRO will typically be preceded by a debate among industry stakeholders, giving the normative output of the SRO more legitimacy than policies adopted unilaterally by a single enterprise. SROs can achieve high levels of compliance where their actions are backed by government authorities, and/or where compliance with the SRO code of conduct is a precondition to obtaining access to a scarce resource, such as television advertising inventory. Funded entirely by its members, an SRO will create few administrative costs for the state. SROs will be able to act relatively quickly.

Conflicts of interest in SRO enforcement

59The disadvantages of multilateral self-regulation schemes include their inability or unwillingness to enforce compliance against their members. Because the SRO is entirely funded by its members, the SRO can be crippled by a conflict of interest when it comes to enforcing rules against members. This problem is attenuated when the SRO controls access to a scarce resource. In that case, compliance with the code of conduct is necessary for members to have access to the scarce resource. Compliance is also easier to achieve when the actions of the SRO are supported by government authorities. The threat of government sanctions can therefore motivate SRO members to comply with SRO rules. The SRO and its members will want to effect just enough enforcement to pre-empt government enforcement (DeMarzo et al. 2005).

Self-regulatory rules may not represent the public interest

60Another defect of multilateral self-regulation is that the rules are developed by industry stakeholders, often without the interests of consumers and citizens being represented at the bargaining table. Some SROs include consumer groups and defenders of civil liberties in the governance structure, so as to ensure that the rules adopted by the SRO also take consumer and citizen interests into account. However, this is the exception rather than the rule. Multilateral self-regulatory regimes frequently only involve economic players in a given industry.

Self-regulation and legislative threat

61The state can also encourage the emergence of self-regulatory systems by exercising its power of legislative threat (Halftech, 2008). Governments often use the threat of legislation as a tool to encourage industry stakeholders to develop self-regulatory systems. Typically the government will present a policy problem that requires some form of regulation, and will encourage industry to find stakeholder-led solutions. The OECD (2011a) recommendations on internet policymaking give preference to stakeholder-led regulatory solutions wherever possible. To motivate industry to find a solution quickly, the government will often announce its intention to introduce legislation or detailed regulations if a satisfactory industry-led the solution is not put in place. Like any threat, the legislative threat only works if there is a perceived probability that the threat will be applied. For issues creating political controversy, such as online copyright infringement and data privacy, legislative threat can be ineffective, because industry stakeholders are aware that enacting legislation on such sensitive topics is difficult for any government to achieve.

62Legislative threat, if credible, can force stakeholders to take into account consumer interests. The signals sent by government can also result in a form of implicit co-regulation, where the government’s objectives are implicitly taken into account in self-regulatory policies. I discuss co-regulation in more detail below.

Example of multilateral self-regulation: the advertising industry

Advertising SROs control access to television advertising inventory

63The advertising industry relies extensively on self-regulation. The advertising industry has developed self-regulatory codes in dozens of countries around the world. In addition, the advertising industry has organized self-regulatory organizations (SROs) to enforce the codes of conduct and arbitrate disputes. The SROs in the advertising field are organized in such a way as to give the appearance of independence in their decisions. Typically, bodies that make decisions relating to whether certain advertising content complies with the code or not will include independent members, including representatives of consumer protection bodies.

64Like any self-regulatory organization, the advertising SROs do not have the same powers as a court. SROs cannot impose fines directly enforceable by a court, or impose imprisonment. Nevertheless, the level of compliance with advertising industry codes of conduct is high, particularly for television advertising.

65There are several reasons why compliance in the context of television advertising is high. First, television broadcasters are themselves regulated entities. The media regulator in each country generally has rules on advertising with which television broadcasters must comply. The failure to comply with advertising rules could subject the television broadcaster to fines or even the loss of its broadcasting license. Because of this threat, television broadcasters generally require that all television advertisements first be screened by the advertising industry SRO before the advertising is aired. To have access to advertising time on television, advertisers and advertising agencies must go through the SRO before the advertisement can be broadcast. This gives the SRO control over a scarce resource, i.e. access to television advertising inventory. The SRO’s control of television advertising makes use of the SRO, and compliance with its rules, unavoidable and effective. The second reason why SROs in the advertising industry are relatively effective is that major advertising agencies are a relatively small and stable group of enterprises who will have many repeat transactions in the advertising world. Like diamond traders (Bernstein 1992), or members of the legal profession, advertising agents have an interest in structuring their profession so as to make it difficult for unscrupulous operators to stay in the profession for any length of time. Bad actors threaten the reputation of the profession as a whole.

Advertising SRO enforcement becomes more difficult on the internet

66The internet is bringing about vast changes in the advertising industry. The traditional role of the advertising agency is being challenged by new technical tools that allow advertisers to have direct access to advertising inventory on websites. The characteristics that make self-regulation successful in the advertising industry – television broadcasters’ insistence that advertising be approved by an SRO before being aired, the relatively small and stable number of advertising agencies in the profession – may not apply in internet advertising. Web publishers are not regulated by a media regulatory authority, so there is little pressure on them to have advertising copy vetted in advance by an SRO. An increasing amount of internet advertising occurs in transactions directly between advertisers, internet advertising service providers, and web publishers. Advertising agencies are no longer an obligatory go-between for advertising transactions on the internet. Consequently, the characteristic of a “stable group of industry players with multiple repeat transactions” may not hold true in the field of internet advertising.

Advertising SROs are heavily influenced by state regulation

67One interesting aspect of advertising self-regulation is its relationship with laws and regulations enacted by the state. The codes of conduct developed by the advertising industry are not developed in a vacuum. They reflect legal norms applicable in the relevant country. Those legal norms generally exist in the form of statutes requiring that advertising be truthful, not misleading, and that certain kinds of advertising, such as advertising for cigarettes, shall be prohibited. Laws and regulations in the field of advertising generally remain at a fairly high level of generality. The advertising SROs carry out an essential role of interpreting the general rules in specific circumstances. They go from the general to the specific. Without specific rules, actors in the advertising industry would be left guessing as to whether a particular advertisement complies or not with the general legal principle. The work of the SRO helps eliminate legal uncertainty.

68Unlike other industries, the advertising industry has not seen the emergence of state-created regulatory authorities. Instead, the role of regulatory authority has been assumed by the SROs. The codes of conduct created by the advertising industry, as well as the functioning of the SROs, complement the legal statutes.

69The relationship between advertising SROs and the underlying legal framework is well summarized by the European advertising standards alliance (EASA, 2016):

“Self-regulation is also an alternative to detailed legislation, but not to all legislation. It is now widely accepted that self-regulation works best within a legislative framework. The two complement each other, like the frame and strings of a tennis racquet, to produce a result which neither could achieve on its own. The law lays down broad principles, e.g. that advertising should not be misleading, while self-regulatory codes, because of their greater flexibility and the fact that they are interpreted in spirit as well as the letter, can deal quickly and efficiently with the detail of individual advertisements. Framework legislation therefore creates a legal backstop which self-regulation will need to invoke when dealing with fraudulent and/or illegal practices (like for example pornography) as well as rogue traders – those operators who repeatedly refuse to abide by any laws.”⁵

70The tennis racket “frame and strings” metaphor can apply to each of the institutional frameworks we examine in this chapter: self-regulation, co-regulation and administrative regulation. In each case, law serves as the “frame” for the more detailed and flexible regulatory measures.

71By assuming a regulatory role, the advertising SROs have made it unnecessary for states to create administrative regulatory agencies for advertising. Media regulatory authorities, which have jurisdiction over television and radio broadcasting, could theoretically adopt detailed rules regarding the content of television and radio advertising. In a number of cases, however, media regulatory authorities have unofficially delegated this regulatory function to the SROs. The SROs communicate closely with the media regulatory authority and try to ensure that the SRO code of conduct meets the expectations of the media regulator. To the extent the media regulator influences the creation of the SRO codes of conduct, it would be more appropriate to speak of co-regulation rather than self-regulation.

Advertising SROs and data privacy

72Advertising SROs are attempting to create codes of conduct relating to data privacy, also in the hope of creating a self-regulatory environment that would pre-empt detailed privacy regulations for internet advertising. The SROs’ efforts in this field are for the time being less successful than in the field of television regulation. This is partly because the underlying privacy norms applicable to internet advertising are still open to vigorous debate. Because the underlying normative context is in flux, SRO attempts to create acceptable codes of conduct for internet privacy have not met with general acceptance by the privacy regulators. The SROs’ failure to reach consensus on mechanisms such as “do not track” is not surprising given the vastly different interpretations that national data protection authorities have of the notion of user consent, for example. Another difficulty is that some data protection authorities are already producing detailed guidelines, supplanting the role of SROs. Where state-created rules are detailed, SROs have little room to interpret the rules and create value through voluntary codes of conduct. The regulatory authority has already put strings on the frame of the racket.

73SROs may not be able to thrive where they are in competition with administrative authorities. The role of advertising SROs is openly embraced by media regulatory authorities, who give their implicit approval of the codes of conduct and clearance procedures put in place by the SROs. The implicit support of the government or of a regulatory authority give SROs a state-like legitimacy. To market participants, a code of conduct developed by the advertising SRO will be viewed as the equivalent of a regulation adopted by the government or by a regulatory authority. SROs with state support come very close to co-regulatory systems that we will examine in the next section.

Advantages and disadvantages of multilateral self-regulation

74The main advantages and disadvantages of the multilateral self-regulatory regime are as follows.

Advantages

• SRO governance structures provide higher legitimacy than is the case in unilateral self-regulation regimes;
• Rules are developed by stakeholder debate, leading to more balanced normative output than in the unilateral self-regulation regime;
• The level of compliance can be high where an SRO enjoys government support, and/or controls access to a scarce resource, and/or members of the group are stable;
• SRO rule-making is relatively fast and flexible;
• SROs are not necessarily constrained by territorial boundaries.

Disadvantages

• SROs are subject to an inherent conflict of interest that can hamper the SRO’s willingness to enforce rules against its own members;
• SROs can be ineffective where there are a large number of actors and entry or exit from the group is easy;
• SROs can be ineffective where the underlying normative context is confused or in flux, and/or where the SRO is in competition with state regulatory authorities;
• SRO codes of conduct are generally developed by industry stakeholders only. They do not generally incorporate the views of consumers and citizens. They therefore lack legitimacy compared to co-regulation or administrative regulation;
• SROs can have anti-competitive effects.

Co-regulation

The role of the state in co-regulation

75Co-regulation is a system under which a state-sponsored institution, such as a government agency or independent regulatory authority, creates a framework within which private actors discuss and if possible agree on regulatory measures. Co-regulation is like self-regulation except that in co-regulation the government or regulatory authority has some influence over how the rules are developed and enforced. The involvement of the state is supposed to make the rulemaking process more legitimate and effective compared to purely self-regulatory solutions. It is more legitimate because the process is supervised by officials who are accountable to the democratically-elected legislature. It is more effective because the resources of the state can be used if necessary to enforce the rules.

76The distinction between self-regulation and co-regulation is not always clear. As mentioned above, certain advertising SROs have no official connection with broadcasting regulators, but de facto work very closely with them and receive their implicit and in some cases explicit support.

Co-regulation and accountability

77“Accountability” is a form of co-regulation, because it consists in the development of internal rules by companies that are then verified and/or enforced by government entities. Popular in data privacy regulation, accountability permits private actors to develop their own processes for achieving public policy objectives. Because companies have the best information as to what works within their own organization, they are in a much better position than regulators to design the regulatory compliance processes within their organization. To ensure that the processes are applied, government regulators will have an audit right to evaluate the effectiveness of the procedures. In some cases, the verification process can be delegated to a third party accountability agent. In that case, the government would only become involved if and when a violation occurs, i.e. one of the public interest objectives defined at the outset is violated. Accountability requires strong internal structures within the corporation to create appropriate monitoring and enforcement functions. This may not always be feasible, particularly for smaller organizations (Balleisen and Eisner, 2009).

78Examples of accountability will be presented below, in the section dealing with co-regulation in data privacy.

Preservation of public interest objectives

79The presence of the government in the discussion also ensures that the self-regulatory measures that emerge from the discussions satisfy public interest objectives, objectives that may not be given sufficient weight in self-regulatory regimes. As we have seen, one of the defects of pure self-regulatory approaches is that some stakeholders or interests will be under-represented at the bargaining table. Representatives of consumers and defenders of civil liberties may have fewer resources than industry to make their voices heard at self-regulatory discussions. Oversight of the discussions by a government agency or regulatory authority will help ensure that any bargaining asymmetries among stakeholders are neutralized. In addition, the regulatory authority or agency will ensure that bargained-for solutions stay within limits defined by the legislature.

Enhanced legitimacy of the rules

80Co-regulatory structures tend to yield solutions that are perceived as being more legitimate than self-regulatory structures. Under co-regulation, the solutions that emerge from the discussions of stakeholders are either explicitly or implicitly approved by the regulator or government. This approval helps legitimize the outcome for the reasons mentioned above: the regulatory authority or agency will ensure that consumer and citizen interests are represented, and that the outcome from bargaining is consistent with public interest objectives. The perceived legitimacy of the rule will help compliance and enforcement.

81An agency’s approval of the co-regulatory measure also helps enforcement because third parties will know that if they ignore the rule, the regulatory authority is likely to bring enforcement actions against them. Because the state is involved, co-regulatory solutions can take longer to develop than purely self-regulatory rules. This is particularly true when the co-regulatory rules have a binding nature.

Co-regulation in telecommunications regulation

82Co-regulation has long been used in the telecommunications sector. National regulatory authorities have authority under the European directives on electronic communications to impose on operators that hold significant market power certain obligations relating to access and interconnection. Those obligations include the publication of a reference interconnection offer, and the obligation to enter into interconnection agreements with other operators. The French national regulatory authority for electronic communications, ARCEP, created an interconnection committee within which details of France Telecom’s interconnection products, and its reference interconnection offer, were debated. The interconnection committee involved a representative from the national regulatory authority, a representative from France Telecom, and representatives from France’s main competitive operators. The interconnection committee permitted the national regulatory authority to nudge market players toward consensus on difficult interconnection or access issues linked, for example, to local loop unbundling.

83The information exchange can be a valuable by-product of co-regulatory regimes. As we will see below, one of the main sources of inefficiency for a classic state-run regulatory structure is lack of information by the regulatory authority. The lack of information can lead to poor regulatory decisions. A co-regulatory system should be designed to allow the regulatory authority to gather information from stakeholders.

84In questions relating to interconnection of telecommunications networks, the organisation of a co-regulatory discussion forum did not foster information exchange because participants were concerned about revealing business secrets. But two benefits emerged. First, the discussions held in the interconnection forum permitted competitive operators to have advance information relating to changes to the incumbent operator’s reference interconnection offer, and to discuss and potentially influence the proposed changes. Second, discussions within the forum can help a consensus emerge on contentious issues such as interference levels and technical standards. The compromise solutions are then better accepted by the market, reducing the likelihood of disputes.

Co-regulation in data privacy

85Data protection authorities in Europe are distrustful of purely self-regulatory arrangements, and prefer co-regulatory solutions in which the data protection authority (DPA) is involved in both the formation of rules and their enforcement. DPAs in Europe emphasize binding corporate rules (BCRs), which evidences this co-regulatory preference. Under European legislation, companies are prohibited from sending personal data outside the EEA to countries that have not been recognized by the European Commission as providing an adequate level of data protection. The United States currently is not viewed as providing an adequate level of protection of personal data. One of the ways companies can overcome the prohibition is by adopting BCRs. BCRs are a set of internal procedures that guaranty a high level of protection of personal data throughout the organization, including in parts of the organization located in countries without “adequate” protection. BCRs must be developed in close cooperation with DPAs in Europe. A multinational group can propose BCRs following a template adopted by the Article 29 Working Party, but ultimately the content of the BCRs must be negotiated point by point with one of Europe’s DPAs. Once the BCRs have been approved, they confer rights on third parties who can sue the company for any violation of the BCRs. Likewise any breach of the BCRs can give rise to sanctions by DPAs.

86BCRs constitute an example of co-regulation because they are developed by private stakeholders within a framework established by regulatory authorities, and once they have been adopted, the BCRs can be enforced by regulatory authorities in the same way as classic regulations.

87The Federal Trade Commission’s (FTC) extensive reliance on negotiated settlement agreements can also be seen as a form of co-regulation. The FTC conducts investigations and begins enforcement action against companies that have violated the “unfair and deceptive practices” rule, as well as other privacy violations such as violation of the US-EU Safe Harbor or Privacy Shield framework. One of the procedural options that the FTC can propose is a settlement agreement with the company, which binds the company to put an end to the relevant practices as well as submit itself to on-going accountability obligations similar to those one sees in BCRs.

88The individual settlement agreements provide for procedural and structural safeguards to help prevent violations of data privacy commitments.⁶ Like European BCRs, the negotiated settlement agreements provide for both internal and external audit procedures, training programs and periodic reporting to the FTC. The settlement agreements last for 20 years, giving the FTC the ability to co-regulate major internet companies over a long period of time. The FTC settlement agreements are public, thereby permitting the FTC to use the settlement agreements as a means of sending signals to all companies in the relevant sector. Although the settlement agreements are not binding on companies that are not signatories, the settlement agreements provide guidance to third parties on what the FTC considers to be the state of the art in privacy compliance. The settlement agreements inform third parties on practices that the FTC is likely to view as unacceptable, as well as compliance measures that the FTC is likely to consider as optimal.

89The FTC settlement agreements can have wide ranging effects. First, if the settlement agreement binds a major internet platform such as Facebook, the settlement agreement will have an impact on a large portion of the internet industry simply because the platform serves a large part of internet users. Second, the settlement agreement will have indirect effects on all other players in the internet industry, by showing best practices and FTC expectations. The FTC’s settlement agreements serve a pedagogical function, thereby contributing to overall compliance with regulatory best practices in the industry.

90The United States government is trying to encourage other co-regulatory solutions for data privacy. The United States administration refers to this as the “multi-stakeholder process.” Under the multi-stakeholder process, the National Telecommunications and Information Agency, the NTIA, convenes stakeholders in an effort to develop codes of conduct. The role of the NTIA is to convene multi-stakeholder meetings, facilitate the exchange of information, and apply the threat of mandatory regulatory measures should the stakeholders fail to agree on consensual measures. The NTIA acts as a maieutic regulator (Curien, 2011), helping to nudge stakeholders toward a consensus. The presence of the government in the discussion also ensures that the self-regulatory measures that emerge from the discussions satisfy public interest objectives, and in particular, the protection of privacy rights. The multi-stakeholder process yielded draft recommendations on transparency in mobile applications (NTIA, 2013).

91The convergence of United States and EU co-regulatory philosophies will be tested in connection with efforts to create a compatibility system between European BCRs and Cross Border Privacy Rules (CBPR) developed under the APEC framework (APEC, 2013). Like BCRs, CBPRs represent a set of data protection obligations that companies can subscribe to, and that will be enforced by data protection authorities in participating APEC countries. Application of the rules is verified by an “accountability agent.” The purpose of subscribing to the CBPRs is to demonstrate compliance with the APEC Privacy Framework principles, and thereby facilitate data flows among APEC economies.

Advantages and disadvantages of co-regulation

92The main advantages and disadvantages of a co-regulatory regime are as follows.

Advantages

• The involvement of the government or of a regulatory authority gives co-regulatory solutions added legitimacy;
• Co-regulation leads in theory to solutions in which the interests of all stakeholders, including consumers and citizens, are represented;
• Co-regulation facilitates the exchange of information between industry and regulatory authorities, thereby enhancing the authorities’ ability to avoid mistakes;
• Compliance with co-regulatory solutions is high because industry stakeholders have participated in the development of the relevant solutions. Moreover, the violation of the relevant rules can lead to sanctions from the regulatory authority.

Disadvantages

• Co-regulatory solutions are more time-consuming than self-regulation because the state is involved;
• The involvement of the state will create institutional costs for taxpayers;
• Because state authorities are involved, co-regulation will be closely anchored to national (or regional) laws.

Brousseau’s multilevel approach to governance

93In a 2006 paper, Brousseau (2006) examines the interaction between centralized rules, such as those administered by the state, and decentralized rules, such as those administered by internet intermediaries or by users themselves.

94Citing Lessig (1999), Brousseau notes that digital technologies allow actors to create their own systems of property rights and enforce them through encryption and access control. This is more efficient than a centralized property rights system because the system can be matched to each individual’s needs. Brousseau also points to collective information spaces, such as social media platforms, and the ability of these platforms to efficiently enforce collective rules by excluding users who do not obey them. The technical ability to track individual users, to detect violation of the rules and efficiently exclude them from the platform overcomes some of the traditional limitations to collective self-regulation.

95Examining multilevel governance, Brousseau asks whether it is better for the measurement and enforcement of property rights to be performed by a central authority such as the state, or on a more decentralized level, via self-regulation for example. According to Brousseau, the new institutional economics approach shows that it is inefficient for the establishment and operation of a property rights system to be totally centralized, or totally decentralized. There should be a combination of both.

“Agents build complementary contractual arrangements, self regulations and general institutions to solve the various dimensions of their coordination problems in relation to the optimal centralization/decentralization trade-off for each of these dimensions.” (Brousseau, 2006, p. 628)

96There needs to be a complementarity between the various levels of governance, a system of checks and balances. For example, the central institutional level should ensure that the lower decentralized level is not captured by monopolists. The central level is also necessary to assist in the enforcement of rules created at the decentralized level, since only the government can exercise legitimate force.

97By the same token the decentralized and private governance arrangements allow innovation that would not be possible under the centralized rules, as well as a mechanism to limit the discretionary power of the central institutions. The ability of private actors to “bypass and even overcome the public order constrains public institutions not to be overly inefficient.” (Brousseau, 2006, p. 629)

98Brousseau points out that in any multilevel governance scheme, there must always be a centralized last resort regulating entity that should overhang all the norm setting entities beneath it. The last resort entity is:

“in charge of avoiding incompatibilities among norms and maximizing positive network externalities among them, as well as avoiding the capture of norms by individuals or groups seeking to exercise dominance….It is also responsible for guaranteeing the enforcement of locally set orders as long as they contribute to collective efficiency.” (Brousseau, 2006, p. 629)

99Brousseau refers to a bargain between the centralized norm center and the local norm centers pursuant to which the centralized authority lends assistance to the enforcement of the rules created by the decentralized entities. In exchange the decentralized entities accept the constraints imposed by the last resort regulator in exchange for this support. This allows each level of regulation to reinforce each other.

100Brousseau mentions that states still have a significant regulatory role. The power of private norm centers is limited. Many interactions on digital networks have a material and therefore located dimension. States can therefore easily regulate them. Even for interactions that occur purely on the internet, states can try to apply national legislation through technical intermediaries such as ISPs. Finally, citizens look to national governments to guarantee security and protection of fundamental rights.

101Brousseau indicates that norm centers on the internet, be they governments or private actors, have an incentive to negotiate and cooperate to solve conflicts between norms. For private norm centers this negotiation is important in order to be able to attract users to the norm and for the norm to be a success. As noted above, governments also need to consider private norms when governments evaluate the efficiency of their own centrally created rules. Governments are motivated to do this in order to create optimal conditions for development of the knowledge-based economy. For Brousseau, the problem lies in coordinating between the various international fora involved in standards setting for the internet. Brousseau suggests the creation of a common blackboard, such as those used in many online communities, in order to share experience and best practices.

“It allows those who are in charge of setting collective orders to learn about the inefficiencies of the solution they implement. In addition, the way the conflict is solved can provide the to norm centers with solutions to avoid future conflicts.” (Brousseau, 2006, p. 648)

102Two key lessons emerge from Brousseau’s work that are relevant for this book:

103First, Brousseau’s work highlights the interdependencies between state-imposed norms and self-regulation, particularly for internet-related activities. State-imposed norms constitute the necessary backstop against which private norm-setting and enforcement operate. By the same token, state-imposed norms must take account of self-regulatory norms in order to remain relevant and credible in digital environments.

104Second, the “blackboard” approach recommended by Brousseau shows the importance of exchanging best practices and encouraging review and criticism of regulatory solutions.

105The system for regulatory impact assessments I propose in Chapter 6 attempts to integrate these two key elements, i.e. to take account of self-regulatory measures as a complement to state-imposed norms, and to ensure that impact assessments are shared so that best practices emerge.

Internet requires a “racket and strings” regulatory approach

106Court regulation and unilateral self-regulation are omnipresent. Internet service providers will always have terms of use that govern the rights of the service provider and the user, and that permit the service provider to terminate a user’s account in certain circumstances. Service providers generally apply these terms of use with pragmatism and flexibility, basing their decisions on user complaints and on anticipated court enforcement of liability rules. Currently much of the way internet content is regulated is based on this two-pronged approach: courts enforce liability rules, i.e. the notice and takedown rule combined with the liability safe harbor for internet intermediaries, and platforms develop and enforce their terms of use in the shadow of these court decisions. This reflects Brousseau’s (2006) “multilevel” governance structure, where a centralized organization (generally the state) creates and enforces norms that constitute a backstop for private norms.

107Policymakers debate today whether this two-pronged approach is sufficient to cover all situations. Italy, for example, has entrusted the independent regulator AGCOM with the responsibility for administering the notice and takedown regime. In France one regulatory authority (ARJEL) deals with blocking access to illegal gaming sites, and another (HADOPI) deals with applying the graduated response regime for online copyright infringement. A third authority, the CNIL, deals with “right to be forgotten” claims. An institutional approach that cannot learn from its errors will create costs of its own in the form of regulatory failure.

108A number of institutional options are available in addition to relying solely on court adjudication and unilateral self-regulation. The option being studied now in a number of domains, including data privacy, is co-regulation. Co-regulation attempts to overcome two of the main drawbacks of administrative regulation, i.e. the limited access to information and the lack of flexibility in administrative regulatory solutions. Co-regulation also attempts to correct the main drawback of multilateral self-regulation, which is the absence of legitimacy and public interest objectives in the formation and enforcement of the underlying rules. The involvement of a state regulatory authority or agency will ensure that the underlying rules reflect public interest objectives while permitting flexibility. Many internet regulatory solutions may gravitate toward this co-regulatory approach.

109The purpose of this chapter is not to propose an ideal institutional framework for dealing with access to harmful content on the internet. There are far too many moving parts for there to be a single institutional solution to fit all cases. As pointed out by Brousseau (2006), the ideal solution will generally incorporate some combination of centralized and decentralized rules. The institutional alternatives have to be considered in a broader context, taking into account fundamental rights and “better regulation” analysis, which will, among other things, attempt to measure harm to the internet ecosystem and the effectiveness of the proposed measure. This chapter’s objective was to list the different types of institutional alternatives that currently operate in the internet field, and identify their principal strengths and weaknesses. By understanding the strengths and weaknesses of each institutional solution, it will be easier for policymakers to insert the institutional dimension into a broader methodology and thereby contribute to a more balanced framework for dealing with regulatory solutions.