Section 1 – GDPR Violations by the IA
1. Unlawful Processing Without a Legal Basis (Article 6)
Per Article 6(1), processing of personal data is lawful only if one of the legal bases applies,
including the data subject's explicit consent (Article 4(11)) or contractual necessity. The IA
collects and archives personal data (Article 4(1)) from third-party websites without consent or
notice, in violation of Article 6(1)(a) and (f). The activities of web crawling, duplicating, storing,
and making available personal data clearly fall under the definition of “processing” under Article
4(2). The IA's default position of scraping all content regardless of public interest does not
qualify as a legitimate interest, nor has a balancing test under Article 6(1)(f) been demonstrated.
2. Misapplication of Public Interest (Articles 5, 89, Recitals 157, 158)
The IA routinely invokes Article 89(1) (processing for archival purposes in the public interest)
without satisfying the substantive criteria. For this exemption to apply, the processing must:
serve a genuine and substantial public interest (e.g., educational, historical, scientific, or
journalistic purposes) (Recitals 157, 158), be subject to appropriate safeguards, and respect
data minimization and necessity principles (Article 5(1)(c), 5(1)(e)). The indiscriminate scraping
and retention of non-public, personal, and semi-private content such as personal blogs, social

profiles, or deleted/modified web pages clearly exceeds what is necessary for a legitimate public
interest archive. As such, the IA’s reliance on Article 89 is legally unfounded.
3. Failure to Inform Data Subjects (Article 5, 13, 14)
Where personal data is not collected directly from the data subject, Article 13 and Article 14(1)
obliges the controller (Article 4(7)) to provide information including: the identity and contact
details of the controller, the purposes and legal basis for processing, the categories of data
involved, retention periods, and the rights of the data subject. The IA does not notify affected
individuals when it collects and archives their data, nor does it offer any public mechanism for
identifying or objecting to such processing. This violates the transparency principle under Article
5(1)(a).
4. Excessive Retention (Article 5)
The IA stores personal data indefinitely, including in backup systems, without a defined retention
schedule or regular erasure mechanism. This is incompatible with the storage limitation principle
under Article 5(1)(e), which mandates data be kept only for as long as necessary for the
purposes originally collected. Archiving “everything forever,” including obsolete, harmful, or
contested data, clearly exceeds what is proportionate or necessary under GDPR standards.
5. Failure to Respond to Erasure Requests (Articles 12, 17)
Under Article 17(1) (Right to Erasure) and Article 12(3), a controller must respond to valid data
deletion requests within one month. In multiple documented cases including mine, the IA has:
not responded within the deadline, failed to confirm any deletion or legal basis for refusal, or
offered vague responses about “exclusion” without any erasure. This constitutes a direct
violation of Articles 12 and 17 and demonstrates systemic failure to uphold data subject rights.
6. Incomplete Erasure (Recital 66)
Instead of fully deleting personal data upon request, the IA often merely “excludes” it from public
view while retaining the data internally. Per Recital 66, controllers must take reasonable steps to
erase all replications, including: backups, indexed copies, and any further dissemination. This
form of concealment is not equivalent to erasure. As long as the data remains stored or
accessible internally, it is still being “processed” (Article 4(2)) and therefore remains under the
controller’s obligations.
7. Processing Special and Potentially Sensitive Categories of Data (Article 9)
The IA may be processing special categories of personal data (e.g., political views, health
information, personal identifiers tied to minors, usernames linked to behavior, etc.) without
satisfying the exceptions in Article 9(2). In many cases, the archived data also includes: phone
numbers, emails, real names, photos, personal identifiers (such as age, location, etc.), data

from minors (violation of COPPA), and entire web pages. This heightens the severity of the data
protection violations and suggests lack of adequate internal data classification and safeguards.
8. No Designated Data Protection Officer (Articles 37, 38, 39)
Under Article 37(1)(b), a Data Protection Officer (DPO) is required when processing operations:
involve regular and systematic monitoring of data subjects on a large scale, or involve special
categories of data (Article 9). Despite operating a platform that systematically collects and
reproduces personal data from across the globe, the IA provides no accessible DPO contact
and appears not to have designated a qualified DPO according to their Bios. This is a
governance failure under Articles 37–39.
9. Inadequate Technical and Organizational Measures (Articles 5, 32)
Article 32 requires data controllers to implement measures ensuring a level of security
appropriate to the risk. Given the scale of IA’s duplication and distribution systems, and the lack
of deletion pathways, it is unlikely that they: apply proper access controls, enforce deletion from
backups, or prevent unauthorized internal access. The lack of any external audit or compliance
transparency also raises concerns about data integrity and confidentiality (Article 5(1)(f)).
10. General Evasion of Data Subject Rights (Articles 12, 13, 14, 15, 17, 21)
The IA creates systemic obstacles to users exercising their rights under GDPR by: obscuring
their internal policies, failing to provide a working request form, ignoring or delaying responses,
and denying access to meaningful erasure options. This constitutes a violation of: Article 12
(Transparent communication), Articles 13–15 (Right to information and access), Article 17
(Erasure), Article 21 (Right to object), and probably more.
Section 2 – CCPA Violations by the IA
1. Collection Without Notice (§1798.100)
The IA archives and processes personal information (names, usernames, emails, etc.) without
informing users at or before the point of collection. There’s no notice or “right to know”
disclosure, especially when content is scraped.
2. Failure to Honor Deletion Requests (§1798.105)
If a user makes a verified request to delete personal data, the service must: respond within
specific deadlines, erase the data from systems (including backups), and confirm the request is
completed. As mentioned above, the IA has a history of “excluding” content (hiding it) instead of
erasing it, which does not fulfill the deletion requirement.
3. No Access or Disclosure Rights Fulfilled (§1798.100, 1798.110, 1798.115)

Consumers have the right to request: what personal data is collected, how it’s used and with
whom it’s shared, and where it came from. The IA provides no clear mechanism or response
process for such access requests.
4. Retention Policy Not Transparent (§1798.100, 1798.130)
CCPA requires a description of how long data is retained or the criteria used to determine
retention. The IA keeps data indefinitely without disclosing any justification or retention
schedule.
5. No Easily Accessible Privacy Policy (§1798.130)
The IA’s privacy policy (if it exists) is not clearly accessible from all pages, nor does it outline
consumer rights as required under California law.
Section 3 – COPPA Violations by the IA
1. Collecting Personal Info from Children Without Verifiable Parental Consent (§312.5)
The IA archives: profiles, posts, comments, and entire web pages which often contain names,
usernames, photos, voice, IPs, and identifiers of children under 13. There is no consent
mechanism, nor do they even attempt to verify age.
2. No Direct Notice to Parents (§312.4)
COPPA requires direct notice to parents before any collection of personal data from children.
The IA does not notify parents when a child’s webpage or content is archived.
3. Failure to Honor Erasure Requests for Children (§312.6)
If a parent or guardian requests deletion of a child’s data, it must be fully removed including from
backups. The IA’s “exclude” system is not compliant under COPPA as the data still exists
internally.
4. No Privacy Policy for Children (§312.3, 312.4)
Any service likely to process children’s data must have a clear, child-friendly privacy policy as
well as state what data is collected, how it’s used, and how to request deletion. The IA does not
have a specific COPPA-compliant privacy policy or a special section addressing children’s data.
5. Passive Collection from Third-Party Sites Visited by Children

Even if the IA does not directly target children, archiving children’s websites, gaming forums, or
educational tools that have a strong likelihood of being used by minors still falls under COPPA if
the audience includes under-13s, and no consent was obtained from guardians.