@maugendre ahh , that all makes sense. I can see that instance admins are controllers, and that consent is probably the only basis for lawful processing. Its all about the #DataProtectionImpactAssessment and the resulting #GDPR #PrivacyNotice. If framed effectively the Privacy Notice and consent should be good protection from liability as long as it acknowledges the reality of lack of control in the #fediverse . But there might be other regulations too!