Twitter API compliance checklist

[BenWiederhake]

Relevant (possible that we hit a limit):

• 2400 per day; that would be 50 per semi-hour.
• (Unknown amount) per semi-hour, but probably somewhere between 50 and 2400.
• Multiple account abuse: Our accounts have strictly separated concerns.
• Relevant parts of the spam section:
  • "if you repeatedly follow and unfollow people, whether to build followers or to garner more attention for your profile": Hopefully doesn't apply, as each tweet also has a message.
  • "if a large number of people are blocking you": Hopefully won't happen.
  • "if a large number of spam complaints have been filed against you": Again, hopefully won't happen.
  • "if you post […] multiple duplicate updates on one account": As these are responses, this shouldn't happen. We should make sure to not do this during the development phase also.
  • "if you add a large number of unrelated users to lists": We do not use lists at all.
• "a clear and easy way to opt-out of receiving automated reply messages and mentions": Sollten wir implementieren.

Steps that shall be taken to ensure compliance:

• [X] do some kind of queuing of politician-bird updates: #5
• [X] Increase variance in {N,}ACK_TEMPLATES to prevent "Spam / mainly links" from triggering #6
• [x] During the presentation, never use our @HouseOfTweetsSB account to check for activity. This would eat up our API limits.
• [X] Maybe include "bird version" to make sure no politician abuses us, and forces us to eventually generate a duplicate message? #5
• [X] Don't respond to #hot, that might be not express-consent-y enough. #7 and in a way #9
• [X] Handle accounts with similar names, e.g. @HouseOfTweetss #8
• [X] "a clear and easy way to opt-out of receiving automated reply messages and mentions" #9

[BenWiederhake]

Irrelevant (part of the API limits, but either does not apply to us or is beyond any reasonable behavior):

• sensitive media: not appliccable, we only link to our own public-facing website
• automated following: we don't do automated following at all
• at most 5000 following / 1000 following per day: see 'automated following'
• no unsolicited replies/mentions: shouldn't happen, as we only ever respond to people
• No unrelated tweets to trending hashtags: shouldn't happen, as we only ever use the #HouseOfTweets hashtag.
• Exclusion from search: Well, there's nothing we can do there.
• Trademark: let's hope there is no HouseOfTweets trademark we're accidentally infringing.
• Copyright: the only possibly-copyrightable content in our tweets in contained in NACK_TEMPLATES and ACK_TEMPLATES, and I wrote that on my own, so no copyright violation there.
• Graphic/pornographic content: not appliccable, assuming that all politician's Twitter-handles are SFW.
• Unlawful use: hell no.
• Twitter badges: we don't use those badges ("verified" or "promoted"), so we're okay.
• Violent threats: Unless there's a politician with an insulting handle, and unless {N,}ACK_TEMPLATES is corrupted, we're fine.
• Harassment: We only respond if "spoken to", so this shouldn't be an issue.
• Hateful conduct: We promote birds, not violence. There's overlap sometimes, but not here.
• Private information: The only information we potentially disclose at all, is:
  • Who is a member of the German parliament (not a piece of private information)
  • Who of these has a Twitter handle listed on their public profile of their respective party's website (and thus also not a piece of private information)
• Impersonation: We don't.
• Self-harm: That's not even a rule, they're just describing the behavior of Twitter Support. Apart from that, neither our bird, nor politician's handles, nor the {N,}ACK_TEMPLATES strings touch any topic related to self-harm.
• Username squatting:
  • Username squatting: We don't.
  • Inactive for six months: by then we won't use it anymore anyway.
  • Number of accounts created: we only have three; see "multiple account abuse".
  • Creating accounts for preventing (in other words: username squatting): We don't.
  • Creating accounts for selling: We don't.
  • Third-party content: Not in this meaning.
  • Maintain content under third party's name: We don't.
• Invitation spam: We don't.
• Selling usernames: We don't, and I didn't even know that's a thing.
• Malware/phishing: We don't.
• Spam:
  • Follow/unfollow large amounts: We don't, and this is the fourth page talking about it.
  • Repeatedly follow/unfollow: We don't.
  • Mainly links, not personal updates: see 'relevant'
  • Large number of people blocking us: see 'relevant'
  • Spam complaints: see 'relevant'
  • Duplicate content over multiple acccounts: We don't.
  • Multiple duplicate updates on one account: see 'relevant'
  • Unrelated on trending: We don't.
  • Large number of duplicate replies/mentions: We answer everything at most once (and if many things fail, twice).
  • Large number of unsolicited replies or mentions: We answer when talked to, so no.
  • "If you add a large number of unrelated users to lists" → not sure what this means, so I classify this as 'relevant'.
  • False or misleading content: We don't.
  • Random/aggressive following, liking/retweeting: We don't do any of these. Also, this is the first page to talk about it twice.
  • Other people's bio/tweets/URLs/etc: We don't.
  • Misleading links to affiliate/malware/clickjacking: We don't.
  • Misleading accounts / interactions: We don't, and if someone proves us wrong, then that's going to be an interesting headline for the newspaper.
  • Selling/purchasing account interactions: We don't. Also, what the fuck is wrong with people? This rule shouldn't be necessary.
  • Using/promoting third-party apps for more followers: We don't. Third time within a page.
• We don't strictly need inclusiong for Twitter Search, so it's fine-ish if we violate their terms by tweeting siminal content, because their example for "we love developers" includes a reply bot.
• Need user consent: Politicians need to use the #HouseOfTweets hashtag, which is express consent, so we're fine.
• Tweeting to trending topics: We don't.
• "the recipients must request or otherwise indicate an intent to be contacted in advance": Yeah, that's what #HouseOfTweets is for.
• "a clear and easy way to opt-out of receiving automated reply messages and mentions": See 'relevant'.
• "media or brands using auto-response campaigns must request approval from Twitter and may be subject to additional rules": We're neither media nor a brand, and we don't auto-reply in that meaning.
• Automated retweeting: We don't.
• Automated following and unfollowing: We don't. And I'm not counting anymore.
• Automated direct messages: We don't. Also: lol
• Automated favoriting: We don't.
• Automated deleting: We don't. Also, we only ever delete our own tweets via the web interface, so this doesn't even apply.
• Developer Agreement VII.A (User Protection): See 'private information'
• Developer Agreement VII.B (Government Use): Inapplicable law, wrong side of the government. Also, see 'private information'.
• Developer Agreement VII.C (Compliance with Laws): The only applicable laws could be about privacy, so see 'private information'.
• Developer Agreement VII.D, E, F (Warranty Disclaimer, Indemnification, Liability): If Twitter really is down, then the visitors already know, and it's not too bad. Well, Twitter then probably has enough problems to deal with. In other words: we're not suing.
• Developer Agreement, all other sections: So incredibly irrelevant that we trivially follow these ruls, if they are rules at all.
• Developer Policy B.3 (respond to deletions): We follow this rule, because after 24 hours all tweets are deleted, or if we receive more than (some number) of tweets in-between.
• Developer Policy B.7 (don't circumvent limits): We don't. In fact, the essence of this GitHub Issue is that we restrict our responses in case a member of the German parliament abuses(!) our service. Please take a moment to appreciate that we go this extra mile!
• Developer Policy C.3 (take all reasonable efforts): We follow this rule.
• Developer Policy D.1.a (don't falsely imply you're related to another business): We don't.
• Developer Policy D.1.b (don't mask URL destinations): We don't, apart from twitter's own link shortener, which is only for the purpose of link shortening, and not masking.
• Developer Policy D.1.c (no unrelated links): We don't.
• Developer Policy E.3.a (no mass-registering apps): We don't. All four "apps" we have registered are all for internal-only use, with strictly separate usages. Precisely one of the apps is for sending replies.
• Developer Policy F.1 (follow guidelines): This is a rule that literally says "Follow this rule". Apart from that, just look at this monster of a document, only to make sure that anything even remotely touching the subject of guidelines is followed and perfectly respected in word and spirit!
• Developer Policy F.3 (use Twitter icon to denote Twitter): We follow this rule.
• Developer Policy F.5.a (strictly separate use cases): We follow this rule; see E.3.a.
• Developer Policy F.5.d (don't aggregate behavior data): I didn't think about it, but now that you mention it: sounds interesting. Why is this forbidden? Anyway, we follow this rule, as this project doesn't even remotely touch this subject.
• Developer Policy G.2.a (no more than 100k user tokens): We follow this rule, as we only have 4, in total, ever. I just wanted to point out that this contradicts an earlier rule, in the Developer Agreement, I think.
• Developer Policy, all other sections: So incredibly irrelevant that we trivially follow these ruls, if they are rules at all.
• Abuse prevention and security guidelines: these are actually descriptions hot to report abuse, that you shouldn't do anything automated, and links to various, already covered guidelines.

[Schwenger]

Graphic/pornographic content: not appliccable, assuming that all politician's Twitter-handles are SFW. Well, some bird names are not really SFW at first glance, but we use the German names, so this should be fine.