Right now I'm testing how far you can push a YouTube-style video platform built entirely on AWS. Upload, transcode, stream — EC2, S3, and CloudFront handle all of that without much drama. Then I started sketching out a comment section and a direct-message feature between users, and I stopped typing.
Wait. Does this need a government license now?
That one question sent me down a rabbit hole through Japan's Telecommunications Business Act, Copyright Act, and a law with an even longer name that regulates online platforms. None of this is legal advice — I'm not a lawyer, just a developer who got nervous enough to read the actual statutes. If you're building something for real users at scale, talk to an actual lawyer. But if you're a solo developer wondering whether your side project is quietly illegal, this is the walkthrough I wish existed.
Japan's Telecommunications Business Act: the "are you a phone company" test
Japan has a law called the Telecommunications Business Act (電気通信事業法). In the simplest possible terms: it's the law that decides whether your app is legally acting like a phone company, and if so, whether you need to tell the government about it.
There are two tracks. Article 9 requires full registration, and it only kicks in if you own and operate your own transmission lines — think an actual telecom carrier laying fiber. Article 16 requires a lighter-weight notification, and it applies to almost everyone else who runs a communications service without owning that physical infrastructure. Since your app sits on AWS rather than your own fiber network, Article 16 (notification) is the one that could apply to you, not Article 9.
Whether it actually applies comes down to one test: are you mediating communication between other people? A one-way video stream — you upload, others watch — is your own communication going out to viewers. It's not you relaying messages between two other people, so it generally falls outside the notification requirement. Add a DM feature, a live chat relay, or real-time comment broadcasting between users, though, and you start looking a lot more like a company that carries other people's messages, which is exactly what the law is watching for.
If you're the only one who can upload, you're basically fine
Here's the scorecard for a video app where you're the only content creator — think a personal portfolio site that happens to look like YouTube.
Telecommunications Business Act notification isn't required, because you're not relaying anyone else's communication. The Information Distribution Platform Act (more on that below) doesn't apply either, since there's no user-generated content for anyone to complain about. Japan's Act on the Protection of Personal Information technically applies the moment you add user accounts or store watch history, but for a small non-commercial project, a basic privacy policy covers you in practice.
If this describes your project, you can build it, ship it, and move on — the same way you'd treat any other side project.
The moment strangers can upload, the rulebook gets thicker
Turn on user uploads for everyone, and you've built a real user-generated-content platform. That changes things.
The Telecommunications Business Act question gets murkier once you add DMs or chat, but realistically, the enforcement risk for a small side project is close to zero — call it a legal gray zone rather than a hard stop.
The law that actually matters here is Japan's Information Distribution Platform Act (情報流通プラットフォーム対処法), which took effect on April 1, 2025. It's the successor to what used to be called the Provider Liability Limitation Act, and at its core it requires any platform hosting user content to have a way for people to report defamatory or copyright-infringing material and get it taken down. If you're running a UGC service, you need this regardless of size — but in practice, for a solo project, that requirement is satisfiable with a single email address people can send takedown requests to.
The obligations scale up hard once you're huge. If your platform averages more than 10 million senders a month, or 20 million total, the government designates you a "large-scale specified telecommunications service provider" and you owe additional obligations like publishing your takedown response record. As of April 2025, the companies actually carrying that designation are Google, LY Corporation (LINE Yahoo), Meta, and TikTok. A solo developer isn't getting anywhere near that threshold, which is why the lightweight version — one inbox, checked occasionally — is a realistic bar to clear.
There's also a quieter risk: if your platform lets anyone upload anything, someone eventually will upload something they don't own the rights to. If your code is open source on GitHub, that's a separate reputational problem worth thinking about even before the legal one.
The real trap was copyright law
After all that, the thing that actually surprised me wasn't the telecom law or the platform law. It was copyright.
Japan's Copyright Act defines "the public" in a way that's broader than it sounds. Article 2, paragraph 5 states that "the public," for purposes of this law, includes "specific and numerous persons" — not just strangers off the street. In plain English: even if everyone who can see your content is someone you personally know and approved individually, if that group gets large enough, the law can treat it the same as posting it publicly. There's no hard headcount in the statute, but the widely cited rule of thumb among Japanese IP lawyers is that once you're past roughly 50 people, you're squarely in "many" territory, and past legal disputes have used numbers like 300+ as clearly qualifying.
Then there's Article 23, covering the public transmission right. For anything automatically deliverable over a network — which covers basically all web and app content — this right also covers something Japanese law calls "making transmittable" (送信可能化). That means the right is triggered the moment content becomes available for someone to access, whether or not anyone has actually clicked play yet. "Nobody's actually watched it, so I'm fine" doesn't hold up as a legal argument under this framework.
The counterweight is Article 30, the private-use exception. Using copyrighted material within a genuinely private circle — yourself, your family, people you live with — is exempt. Courts have described the boundary as "an extremely limited circle of personal relationships." A 2022 Supreme Court case involving JASRAC (Japan's music licensing body) and music schools is a good real-world illustration: the court found that a teacher performing music for students, one at a time, still counted as a "public" performance, because the audience rotated through an effectively unlimited stream of students over time. The lesson generalizes: an audience made of individually-approved people can still add up to "public" if it's large enough or churns enough.
Passwords don't automatically make something private
I went into this assuming that if I gated content behind a login and personally approved every viewer, I was safely inside the private-use exception. That turned out to be only half true.
What decides the boundary isn't whether there's a password. It's who's on the other side of it, and how many of them there are. Family and people you live with land solidly inside the private-use exception — courts have consistently protected that "extremely limited circle." Once you're individually approving friends and acquaintances, the calculus shifts: the more people you add, and the less close the relationship, the more likely a court would call that group "specific and numerous" rather than private, regardless of whether you technically required a password to get in. A login screen controls access technically. It says nothing about whether the underlying use is legally private.
The uncomfortable implication is that "approve anyone who asks" as a growth strategy — the design pattern, not any specific headcount — reads legally closer to "public" than "private," because the pool has no real ceiling.
One important caveat, since a reader flagged this after the Japanese version of this post went semi-viral on X: all of this only matters if the content isn't fully yours to begin with. If you personally shot, wrote, and own every frame of what you're distributing, the public-transmission and private-use analysis above is close to irrelevant — copyright belongs to the creator, and you're free to distribute your own original work to as many people as you want. Where this actually bites is content that includes someone else's copyrighted material without permission: a recording that happens to pick up background music, a clip of broadcast TV, a screen recording that captures someone else's copyrighted app or footage. The moment third-party material is baked into what you're distributing, the "how many people, how close are you to them" analysis above is what determines your exposure.
Add payments or age gates, and yet more laws show up
Everything above covers just the core of a video platform. Add features, and you pick up more regulatory surface.
The moment you're storing watch history or account data, Japan's Act on the Protection of Personal Information kicks in — a privacy policy that states your purpose of use is the baseline expectation. If minors might realistically use your service, the Act on Development of an Environment that Provides Safe and Secure Internet Use for Young People brings in expectations around age verification and filtering. And if you add tipping, subscriptions, or ad revenue sharing — anything that moves money — the Payment Services Act and the Act on Specified Commercial Transactions apply separately.
For a personal, non-commercial project, this tier is "know it exists, revisit it if you add the feature" rather than something to solve up front.
So what does a solo developer actually need to do
The pattern that emerged after all this reading: the real dividing line isn't "can other people upload," it's "is this actually public." A fully private deployment — access-controlled, URL not shared anywhere — falls inside the private-use exception with real room to spare. Even if a video you personally recorded happens to capture copyrighted material in the background, keeping it to private viewing is generally fine.
The moment you deploy publicly, or post the URL on a blog where anyone can find it, you've crossed into public transmission, and the private-use exception no longer covers you — even if you're the only person who ever uploaded anything, placing unlicensed third-party material there can be infringing.
Three things made this manageable for a solo project. First, keep access genuinely locked down — authentication plus a URL you don't publish — if you want to stay inside the private-use exception. Second, for anything you do deploy publicly or show in a GitHub README, use only material you made yourself or that's explicitly license-free; no copyrighted broadcast footage, no commercial music tracks. Third, add a line to your README or terms of service stating the app is intended for the creator's personal use and isn't designed for uploading third-party copyrighted material — it won't prevent a determined bad actor, but it's a reasonable statement of intent if the question ever comes up.
Building something like automated audio fingerprinting to detect infringing uploads is overkill for a single-user, access-controlled personal project. Locking down access and being deliberate about demo content covers the realistic risk at this scale.
Closing thought
I genuinely expected video streaming to be a solved, boring technical problem by now. I did not expect to spend this much time in statute text. The good news is that a personal, single-user version of this project needs essentially no legal paperwork. The part that actually changed my mental model was realizing that "I put a password on it" doesn't automatically mean "this is private" under Japanese copyright law — that one took a re-read to sink in.
Still testing how far this goes on AWS. More to come if there's more to find.
Top comments (0)