Big Tech Companies’ Obligations under International Human Rights Law

Abstract

This article critically evaluates three attempts to overcome the problem of fit between international human rights law (IHRL) and the digital ecosystem, through an expansion of the existing IHRL framework to big tech companies. The attempted expansions considered here include standard-setting initiatives involving the imposition on states and companies – large technology companies and other business enterprises – of certain duties to apply IHRL in connection with potentially rights-infringing business practices. As I discuss below, most of the duties identified and/or developed in this regard within the context of the United Nations Human Rights Council’s Business and Human Rights (BHR) agenda constitute soft law for the time being. Negotiations for a Legally Binding Instrument (LBI) designed to strengthen the applicable legal framework are ongoing, but their prospects of success remain unclear. Another attempted expansion involves self-regulation by big tech companies through corporate policies aimed at incorporating certain IHRL norms into their business practices. The efforts of Meta to incorporate IHRL into its corporate policies and to offer an IHRL grievance mechanism through the operation of the Meta Oversight Body (focusing mainly on protecting freedom of expression, as articulated in the International Covenant on Civil and Political Rights) represent a key case study in this regard. A third attempt to address the aforementioned problem of fit that I consider below involves efforts by special procedures of the Human Rights Council to exercise its standard-setting and monitoring functions in connection with the practices of large technology companies. The work of the Special Rapporteur for Freedom of Opinion and Expression in this area is particularly noteworthy. These three examples of expansion attempts provide useful insights into the potential of IHRL to serve as a legal framework to govern the operations of large technology companies, as well as about the limits of its potential.

The article starts by discussing recent developments in the BHR agenda, including efforts to conclude an LBI. The extent to which this agenda represents a promising avenue for holding large technology companies accountable to IHRL norms is then considered in the second and third parts of the article, which discuss two normative initiatives that derive largely from the BHR agenda: this section specifically examines Meta’s espousal of IHRL as part of its corporate BHR policy, and considers attempts by Human Rights Council special procedures to apply IHRL to technology companies.

1. Introduction

Modern international human rights law (IHRL) developed after 1945 as an international legal framework designed to limit state power and prevent abuse of governmental authority.¹ It was created as part of a new world order heralded by the United Nations organisation against the backdrop of the atrocities of the Second World War and the extreme forms of persecution and oppression introduced by totalitarian regimes in the inter-war period. Extensive evidence for the state-centric configuration of IHRL is found in the numerous treaties that constitute this normative regime by placing legal obligations on states,² in the consignment of human rights to the state-centric normative and institutional framework of public international law,³ and in the historical linkage between IHRL and domestic human rights norms and institutions, which introduced from the eighteenth century onwards political and legal constraints on governmental power.⁴

Indeed, state-centrism runs deep and wide inside and throughout IHRL. The enforcement machinery developed under global and regional human rights treaties focuses on the legal responsibility of states for human rights violations. States are expected to report periodically to a variety of IHRL monitoring bodies, to reply to individual petitions brought against them by human rights victims or other complainants, and to strive to give effect to country-specific recommendations relating to their human rights records. Even when acknowledging the potential involvement of private and other non-state actors in violations of IHRL norms (such violations are typically referred to, when perpetrated by non-state actors, as ‘abuses’),⁵ IHRL focuses on the obligations of states to prevent such violations/abuses, including on their duty to facilitate and promote the enjoyment of human rights by rights holders through regulating, when necessary, the operations of private and other non-state actors.⁶

As a result of this structural state-centrist configuration, questions arise concerning the fit between IHRL and the vast and diverse array of interactions and applications involving a host of private actors using digital technology and impacted thereby (i.e., the digital ecosystem).⁷ Arguably, the ability to enjoy digital human rights – that is, the human rights that are due to individuals in connection with their use of digital technology or the effects of such technology on them⁸ – depends more on the power relations holding between individual digital technology users or ‘data subjects’ and large technology companies that provide digital services and products, than on the relationship between such individuals and the states in which they live or work. While questions of the fit of IHRL norms and institutions arise in many situations where private companies, through their activities, have an impact on the enjoyment of human rights by individuals, it looks as if big tech companies – i.e., the technology companies that occupy the largest market share or the largest stream of revenues in the technology sector – raise a unique institutional challenge for IHRL. This is because the relationship between large technology companies and their users differs in some important respects from that existing between individuals and other private companies, such as private security companies, banks or industrial factories.

First, large technology companies present a unique regulatory challenge. They operate across a wide variety of national jurisdictions, and their products and services typically involve an internationally diverse supply chain and/or value chain. Such transnational features are facilitated and exacerbated by the highly mobile nature of digital technology, and the global nature of the internet and other online platforms for the dissemination of digital goods and services. The international reach, as well as the sheer economic size of leading technology companies – such as Google, Apple, Meta, Amazon, Microsoft, X (Twitter) and Open AI – might render them both too global and too large to be regulated by most states, as traditional IHRL doctrines on positive state obligations envision.⁹ In addition, the quick and dynamic nature of the development of digital technology itself – including its fast evolution from foundational models to applied products – creates serious challenges in timing any regulatory intervention by any specific states with regard to such moving technological targets, and in enabling states and other actors to evaluate the actual human rights impacts of new and emerging technology.¹⁰

Second, the interface between the operations of large technology companies and individual users is exceptionally broad in terms of the numbers of individuals affected by digital products and services. The interaction between big tech companies and individual users is also exceptionally consequential for individuals and for societies as a whole, in view of the fundamental nature of the individual and group rights implicated thereby. In fact, certain technology companies have positioned themselves as key ‘gatekeepers’ in establishing or constraining the enjoyment, on a global scale, of fundamental human rights such as freedom of expression, the right to privacy and the right to equality.¹¹

Third, the seller–buyer or service provider–customer relationship, which exists between large technology companies and individual users, and the nature of the products and services the former provide, puts big tech companies in a unique position to ensure, on an ongoing basis, the enjoyment of rights by individual users or data subjects.¹² In fact, with regard to several digital human rights – such as those involving the exercise of control by data subjects over personal data (e.g., the right to data portability¹³ or the right to be forgotten¹⁴ ) and algorithmic decision making (e.g., the right to a human decision maker¹⁵) – large technology companies might be expected to uphold rights in ways that have no immediate offline equivalent, and which most states were never in a position to uphold.¹⁶ The lack of offline IHRL experience from which to draw might mean that both states and companies would face numerous difficulties in implementing new digital human rights.

This article critically evaluates three prominent attempts to overcome the problem of fit between IHRL and the digital ecosystem, by way of an expansion of the existing IHRL framework to big tech companies. Through a discussion of these three attempts, I will identify some structural constraints that hamper the application of IHRL to big tech companies: for example, excessive reliance on voluntary commitments, the foregrounding of some digital rights and the backgrounding of others, limited access to effective remedies, and the inadequacy of international enforcement mechanisms to address the violation of digital human rights.

The expansions considered herein include standard-setting initiatives involving the imposition on states and companies – large technology companies and other business enterprises – of certain duties to apply IHRL in connection with rights-infringing business practices. As I discuss below, most of the duties identified and/or developed in this regard within the context of the Business and Human Rights (BHR) agenda of the UN Human Rights Council (HRC) constitute soft law for the time being. Negotiations for a Legally Binding Instrument (LBI) designed to strengthen the applicable legal framework are ongoing, but their prospects of success remain unclear. Another attempted expansion involves BHR-inspired self-regulation by big tech companies through corporate policies aimed at incorporating certain IHRL norms into their business practices. The efforts of Meta to incorporate IHRL into its corporate policies and to offer an IHRL grievance mechanism through the operation of the Meta Oversight Body (MOB) (which focuses mostly on protecting freedom of expression, as articulated in the International Covenant on Civil and Political Rights (ICCPR))¹⁷ represent a key case study in this regard. A third attempt to address the aforementioned problem of fit that I consider below involves efforts by special procedures of the HRC to exercise their standard-setting and monitoring functions in connection with the practices of large technology companies. The work of the Special Rapporteur for Freedom of Opinion and Expression is particularly noteworthy in this area. These three examples provide useful insights into the potential of IHRL to serve as a legal framework to govern the operations of large technology companies, as well as the structural limits of this potential.

Section 2 of the article discusses recent developments in the BHR agenda, including efforts to conclude a LBI. The extent to which this agenda represents a promising avenue for holding large technology companies accountable to IHRL norms is considered mostly in Sections 3 and 4, which discuss two normative initiatives that largely derive from the BHR agenda: Section 3 considers specifically Meta’s espousal of IHRL as part of its corporate BHR policy, and Section 4 considers attempts by HRC special procedures to apply IHRL to technology companies. Section 5 concludes.

2. The Business and Human Rights agenda and the draft Legally Binding Instrument

The 2011 UN Guiding Principles on Business and Human Rights (UNGP)¹⁸ constitute an important milestone in ongoing international efforts to hold international businesses accountable under international human rights standards. They were adopted on the basis of the 2008 Protect, Respect, Remedy Framework – a set of principles introduced by John Ruggie, the UN Secretary-General’s Special Representative on Human Rights and Transnational Corporations and Other Business Enterprises,¹⁹ which were partially built, in turn, on lessons learnt from a previous attempt to promulgate norms of business and human rights.²⁰ The Sub-Commission on the Promotion and Protection of Human Rights adopted in 2003 the said norms, but the Commission on Human Rights rejected them shortly thereafter.

Despite their significance as a conceptual framework for articulating desirable standards of conduct, the UNGP do not impose concrete legal obligations on business entities. Rather they call on states to undertake a variety of regulatory and policy functions vis-à-vis business enterprises. The first pillar of the UNGP contains demands from states to afford protection for individuals located within their territory or under their jurisdiction against human rights abuses committed by business enterprises. It also recommends that states set out normative expectations for business enterprises domiciled in their territory or subject to their jurisdiction, take additional steps to control the operations of business enterprises with which they have a special nexus and of business enterprises involved in conflict situations, and extend their legal obligations in the field of BHR also to multilateral settings. States should also take appropriate steps, pursuant to the third pillar of the UNGP, to ensure that those affected by abuses within their territory or jurisdiction have access to an effective remedy. Parts of the UNGP reiterate existing legal obligations that states incur under IHRL, whereas other parts elaborate new soft law standards that should govern the relations between states and business enterprises. Still, in both normative configurations – i.e., when providing greater specificity to lex lata and complementing existing law with additional norms that can be regarded as lex ferenda – the UNGP arguably follow the traditional state-centric logic of IHRL.

The second pillar of the UNGP, which covers corporate responsibility to respect human rights, represents a minor deviation from the dominant state-centric IHRL framework. It calls on business enterprises directly to respect human rights, and proposes in this respect a number of soft law standards of conduct (such as to avoid and address adverse human rights impacts, have in place human rights policies and processes, apply human rights due diligence, and report on how human rights concerns are addressed). In the same vein, the third pillar calls on business enterprises to develop and participate in effective grievance mechanisms.

Particularly significant, for our purposes, is the statement found in the commentary to Principle 11 of the UNGP,²¹ according to which:

The responsibility to respect human rights is a global standard of expected conduct for all business enterprises wherever they operate. It exists independently of States’ abilities and/or willingness to fulfil their own human rights obligations, and does not diminish those obligations. And it exists over and above compliance with national laws and regulations protecting human rights.

The UNGP framework does not identify explicitly the normative source of this independent standard of expected conduct, although Ruggie suggested that it stems from the ‘basic expectations of society’.²² Another significant normative statement is found in Principle 12 of the UNGP, which provides:

The responsibility of business enterprises to respect human rights refers to internationally recognized human rights – understood, at a minimum, as those expressed in the International Bill of Human Rights and the principles concerning fundamental rights set out in the International Labour Organization’s Declaration on Fundamental Principles and Rights at Work.

The combined effect of these two statements is that the drafters of the UNGP appear to have considered the responsibility of business enterprises to respect IHRL to derive from the normative justifications or social expectations which underlie basic IHRL norms. Furthermore, the drafters appear to have presumed that IHRL serves as a suitable normative framework to govern broad categories of interaction between business enterprises and individuals impacted by their activities, notwithstanding the fact that these IHRL standards were originally developed for application by states and despite the great diversity of business enterprises and interactions covered by the UNGP. In any event, the responsibility of business enterprises to respect IHRL pursuant to the UNGP does not depend formally on the question of whether or not the states in which they operate or to which they are tied have adopted specific treaties comprising the International Bill of Rights, such as the ICCPR or ICESCR. It is a direct, not derivative, form of responsibility.

Another notable aspect of the UNGP is that the second pillar focuses on the responsibility of business enterprises to respect IHRL (partly corresponding to negative obligations of states to uphold IHRL), and does not introduce a responsibility to protect or fulfil IHRL (which would have partly corresponded to positive obligations of states to uphold IHRL).²³ In fact, the Commentary to Principle 11 provides explicitly that ‘business enterprises may undertake other commitments or activities to support and promote human rights, which may contribute to the enjoyment of rights. But this does not offset a failure to respect human rights throughout their operations’. This language suggests that the responsibility to respect is qualitatively different from and normatively superior to any other IHRL responsibility that may be actually assumed by business enterprises.

The UNGP have been criticised for their over-reliance on voluntarism, given the lack of an identifiable legal source for the soft ‘responsibilities’ they introduce, the limited effectiveness of the soft enforcement methods for inducing compliance by business enterprises with IHRL standards,²⁴ and the analytical unclarity of the distinctions offered between duties of states and business enterprises and between the responsibility to respect IHRL and other potential responsibilities (e.g., to protect and fulfil).²⁵ The measures taken by certain domestic legal systems to impose legally binding reporting and due diligence obligations on transnational corporations in connection with certain IHRL norms,²⁶ and the willingness of some national courts to impose legal liability on corporations which have failed in doing so,²⁷ have further nurtured perceptions about the relative weakness of the UNGP framework.²⁸ Such criticisms and perceptions have led the HRC and other international actors to undertake efforts to upgrade the UNGP through the adoption of a LBI on BHR.²⁹

The LBI drafting process has generated over the years a number of drafts. The updated third draft from July 2023 contains in Article 2(b) the following statement of aim for the LBI: ‘To clarify and ensure respect and fulfilment of the human rights responsibilities of business enterprises’.In the same vein, Article 2(c) provides as an aim: ‘To prevent the occurrence of human rights abuses in the context of business activities by effective mechanisms for monitoring, enforceability and accountability’. In order to implement these aims, the draft LBI strengthens the first and third pillar of the UNGP. It requires states to ‘adopt appropriate legislative, regulatory, and other measures’ in order to ‘prevent the involvement of business enterprises in human rights abuse’, ‘ensure respect by business enterprises for internationally recognized human rights and fundamental freedoms’ and ‘ensure the practice of human rights due diligence by business enterprises’.³⁰ It also provides victims of human rights abuses with the right to bring claims before the domestic courts and ‘non-judicial grievance mechanisms’,³¹ and imposes on states:³²

[a duty to] adopt such measures as may be necessary to establish a comprehensive and adequate system of legal liability of legal and natural persons conducting business activities, within their territory, jurisdiction, or otherwise under their control, for human rights abuses that may arise from their business activities or relationships, including those of transnational character.

In this last connection, states must ensure that ‘the liability of a legal person is not contingent upon the establishment of liability of a natural person’.³³ Significantly, the updated third draft also requires states:³⁴

[to] take necessary measures to ensure that business enterprises take appropriate steps to prevent human rights abuse by third parties where the enterprise controls, manages or supervises the third party, including through the imposition of a legal duty to prevent such abuse in appropriate cases.

If adopted, the LBI would create extensive and legally binding obligations for states to regulate and control the operations of business entities that have an impact on the enjoyment of IHRL by individuals. While such legal obligations expand upon the first and third pillars of the UNGP, they remain based largely on existing IHRL standards (providing them, however, with more specific and concrete meaning).³⁵ Still, they will be monitored by a dedicated treaty body structured in accordance with the model available under other global IHRL treaties.³⁶

The LBI will also strengthen indirectly the second and third pillars of the UNGP as applicable to business enterprises. By requiring states to ensure that liability for IHRL abuses is imposed on business enterprises under domestic law and that effective remedies are available to victims, the LBI contributes to the blurring of boundaries between social responsibilities and legal obligations. Still, this does not amount to direct application of IHRL to business entities, or to the provision of a direct right of access by victims of IHRL abuses to international enforcement mechanisms in order to bring legal proceedings against rights-infringing private corporations.

In other words, despite growing acceptance of the premise that business enterprises should comply with IHRL standards, the LBI retains a state-centric approach (in fact, the updated third draft explicitly reaffirms that states have the ‘primary obligation to respect, protect, fulfill and promote human rights and fundamental freedoms’).³⁷ The main difference between the UNGP and the LBI appears to be the latter’s introduction of stronger state obligations relating to the manner in which its domestic laws, regulations, policies, remedies and monitoring mechanisms apply to business enterprises.

One interesting normative development in the LBI, which might suggest a gradual transformation in the nature of corporate responsibility existing under the UNGP, is the aforementioned allusion in Article 6.5 to the duty of states to ensure that business enterprises undertake positive measures to prevent abuses by third parties they control, manage or supervise.³⁸ Such a development of positive responsibilities by business enterprises mirrors earlier developments in IHRL relating to positive state obligations intended to protect human rights victims from violations by private actors.³⁹ Given the dominant role of supply and value chains in the digital economy, such a development could have significant repercussions for the IHRL duties of large technology companies.

3. The Meta experience

Meta’s engagement with IHRL standards represents a unique case study for the application of the UNGP – that is, a high-profile attempt by a major technology company to voluntarily implement the BHR framework, through the direct application of certain IHRL standards to some of its operations, and the availability of an institutionalised and highly accessible grievance mechanism potentially providing remedies to millions of victims of IHRL abuses. The combined effect of direct application and enforcement of IHRL and the significant transnational governance functions actually exercised by Meta offers a potential model for regarding certain business enterprises as IHRL duty holders in a new way, which puts them in a status comparable with that held by states.

Like other online platforms, Meta’s Facebook, Instagram and Threads social media platforms self-regulate their customers’ interaction on the platform and with the platform through a series of legal documents, such as terms of service,⁴⁰ privacy policy⁴¹ and community standards.⁴² The latter refer to Meta’s ‘commitment to voice’ and expression, but note that they can be limited at the service of company values – authenticity, safety, privacy and dignity. The Facebook community standards also affirm that when making decisions about content removal, ‘[w]e look to international human rights standards to make these judgments’. Specific policies have been published by Meta over the years with regard to violence and criminal behaviour, safety, objectionable content, integrity and authenticity, intellectual property, content-related requests and decisions, and other policy areas.⁴³

In view of concerns raised about the adequacy of Facebook’s content moderation policies and about their manner of implementation, the company’s CEO – Mark Zuckerberg – announced in 2018 his decision to establish an independent body to review some of the company’s content moderation decisions.⁴⁴ The MOB began its operations in May 2020, with its functions and competencies spelt out in a number of documents, including a Charter⁴⁵ and Bylaws.⁴⁶ A number of provisions in these instruments allude to human rights standards: Article 2.2 of the Charter provides that ‘[w]hen reviewing decisions, the board will pay particular attention to the impact of removing content in light of human rights norms protecting free expression’; Article 1.4.1 of the Bylaws requires the MOB to include in its annual reports ‘[a]n analysis of how the board’s decisions have considered or tracked the international human rights implicated by a case’; and Article 2.2.3.2 of the Bylaws requires Facebook to notify posting and reporting users about MOB decisions in a manner ‘guided by relevant human rights principles’.

In parallel with these developments, Meta published, in March 2021, its Corporate Human Rights Policy.⁴⁷ The first segment, dealing with ‘our commitments’, provides the following language, in part lifted directly from the UNGP:

We are committed to respecting human rights as set out in the United Nations Guiding Principles on Business and Human Rights (UNGPs).This commitment encompasses internationally recognized human rights as defined by the International Bill of Human Rights — which consists of the Universal Declaration of Human Rights; the International Covenant on Civil and Political Rights; and the International Covenant on Economic, Social and Cultural Rights — as well as the International Labour Organization Declaration on Fundamental Principles and Rights at Work. Depending on circumstances, we also utilize other widely accepted international human rights instruments, including the International Convention on the Elimination of All Forms of Racial Discrimination; the Convention on the Elimination of All Forms of Discrimination Against Women; the Convention on the Rights of the Child; the Convention on the Rights of Persons with Disabilities; the Charter of Fundamental Rights of the European Union; and the American Convention on Human Rights … We recognize the diversity of laws in the locations where we operate, and where people use our products. We strive to respect domestic laws. When faced with conflicts between such laws and our human rights commitments, we seek to honor the principles of internationally recognized human rights to the greatest extent possible. In these circumstances we seek to promote international human rights standards by engaging with governments, and by collaborating with other stakeholders and companies.

Other sections of the Policy cover implementation (including internalising human rights into relevant policy instruments), governance, oversight and accountability processes, conducting human rights due diligence, providing access to remedies and protecting human rights defenders.

The upshot of these normative developments has been the emergence within one large technology company – Meta – of a thick net of IHRL standards that purport to shape its approach to content moderation, corporate governance, oversight and accountability, and set normative expectations for Meta clients. These standards consist of major IHRL treaties, which Meta has undertaken to respect. Significantly, Meta has accepted, in line with the UNGP,⁴⁸ to follow IHRL standards, to the greatest extent possible, even in the face of incompatible domestic legal standards that govern its operations in different jurisdictions. This suggests that IHRL occupies a uniquely high status in the normative hierarchy of sources to which the company strives to adhere. Unlike many corporate commitments and human rights policies the legal status of which is less than clear – they are general representations about standards applicable to business operations and not contractual arrangements – it is noteworthy that Meta’s community standards, which are forms of contractual arrangements,⁴⁹ reflect in part IHRL standards, and stipulate that they should be construed in accordance with IHRL.

A review of the practice of the MOB in applying these normative standards confirms that IHRL holds pride of place in the process of the quasi-judicial review that it exercises over Meta content moderation decisions. Almost all MOB decisions are structured in a way that alludes to IHRL as relevant standards, alongside Meta’s Community Standards and Values, and the analysis of compliance with Meta’s IHRL responsibilities occupies a significant part of the decision. Such analysis follows, as a rule, a typical human rights analysis methodology: identification of the right allegedly infringed (most cases implicate freedom of expression issues), and consideration of whether the limitation of rights was permissible on the basis of its legality (including clarity and accessibility of the applicable Meta instruments), legitimate aim, necessity and proportionality. The decisions often cite normative outputs of IHRL bodies, such as Human Rights Committee general comments⁵⁰ and views in individual communications,⁵¹ UN Human Rights Council resolutions⁵² and UN Special Rapporteur reports.⁵³ The decisions also cross-cite one another, contributing thereby to the creation of a significant body of MOB jurisprudence on IHRL.

The experience of Meta offers a possible model for the application of IHRL beyond the state. Parts of the normative framework it applies remain state-centric – the domestic laws of the different states in which it operates, and regional and international standards that such states created. Still, significant parts of its transnational governance structures are independent of states, and directly apply autopoietic norms (community standards, company values, MOB case law), which mirror IHRL. With regard to IHRL, it appears as if the MOB treats Meta’s exercise of governance power over speech as analogous to state government power. In fact, the Board sometimes notes weaknesses in the application of IHRL by a relevant state as a reason for affording users a higher level of protection by Meta. In the Öcalan Isolation case, for example, the MOB wrote: ‘The Board is particularly concerned about Facebook removing content on matters in the public interest in countries where national, legal and institutional protections for human rights, in particular freedom of expression, are weak’.⁵⁴ This suggests a reversal of roles. Whereas the UNGP envisioned states as the primary IHRL duty holders, which ought to develop and put in place safeguards against IHRL abuses by business enterprises, the Meta experience proposes that there could be situations where the business enterprise might be expected to serve as a corrective device for IHRL violations committed by states.⁵⁵ Furthermore, given the almost global reach of companies like Meta, their impact on the global interpretation and application of IHRL, and especially on the application of freedom of expression, exceeds that of most states.

While the Meta model is interesting and promising (albeit not free from criticism),⁵⁶ it is important to acknowledge that it remains voluntary in nature, with the scope of decisions and policies reviewed determined unilaterally by Meta. The voluntariness of the model also implies that Meta may decide in the future to stop replenishing the trust fund that facilitates the long-term operations of the MOB,⁵⁷ or stop providing it with the necessary staffing or logistical support.⁵⁸ In addition, Meta retains broad discretion over whether or not to adopt certain general policy recommendations made by the Board.⁵⁹

Furthermore, it remains to be seen how much the model will be replicated by other large technology companies. So far, no other major big tech company has set up an MOB-like structure, and no company has followed up on Meta’s suggestion that they consider joining the MOB itself.⁶⁰ To be sure, many other technology companies have also introduced codes of conduct or community guidelines that internalise IHRL standards, such as freedom of expression and the prohibition of hate speech,⁶¹ right to privacy,⁶² non-discrimination,⁶³ protection of personal security,⁶⁴ child safety⁶⁵ and intellectual property rights.⁶⁶ Some of these companies also regularly publish detailed human rights policy statements.⁶⁷ While the scope, extent, independence and permanence of the different internal oversight mechanisms resorted to by other technology companies varies,⁶⁸ they do not offer an IHLR-applying grievance mechanism that resembles the MOB; nor do they allow for ongoing normative engagement with IHRL in the same way that the MOB facilitates.

The diversity in the IHRL practices of big tech companies underscores the continued voluntariness of much of the BHR framework that governs their engagement with IHRL – effectively allowing them to select the level of desirable engagement with IHRL – and the absence of strong and effective mechanisms that operate across the board for applying IHRL norms and for providing remedies to victims. So, while human rights due diligence procedures⁶⁹ and compliance or transparency reporting on certain IHRL-related practices⁷⁰ are gaining traction across large technology companies, and although some companies do involve third parties in addressing complaints concerning ethical and compliance issues,⁷¹ the creation of a fully fledged independent IHRL-applying complaint mechanism – àla the MOB – has not yet attained a ‘gold standard’ status.

4. The special procedures mechanisms

Another development that throws more light on the fit between IHRL and the responsibilities of large technology companies is increased attempts by special mandate holders or special procedures operating alongside the HRC to extend their standard-setting and compliance monitoring mechanisms to such companies. The special procedures of the HRC consist of some 60 working groups and special rapporteurs entrusted with reviewing thematic IHRL issues and specific country situations. In their official capacity, they produce annual reports, conduct country visits and respond to individual complaints (or communications), as well as produce other public statements and documents, including comments on pending legislation and policy measures. As ‘Charter Bodies’ – drawing their legal authority ultimately from the UN Charter – they can apply specific treaties binding on the states subject to their review, or other universal IHRL standards.⁷²

There are four principal ways in which special mandate holders can extend their procedures to large technology companies through issuing recommendations to them or to relevant states: (i) the elaboration in thematic reports of IHRL standards relevant to the technology sector, (ii) the inclusion of the private technology sector in country visits, (iii) the issuance of comments to big tech companies on specific measures that were undertaken or should be undertaken by the latter, and (iv) the processing of individual communications against specific technology companies. The mandate of the Special Rapporteur on Freedom of Opinion and Expression stands out as a particularly interesting example of an attempt to extend its normative and institutional purview to the technology sector. As a result, the focus of this section is on the activities of this mandate in that regard.

4.1. Thematic reports

The work of special procedures in elaborating IHRL standards applicable to big tech corporations appears to be an extension of the work of the HRC and other international and multi-stakeholders in the BHR field. For example, in his 2015 report on encryption and anonymity in digital communications, the Special Rapporteur on Freedom of Opinion and Expression, David Kaye, discussed the role of corporations and recommended that companies should implement BHR due diligence and transparency practices, embrace certain technological solutions and conduct themselves, in certain aspects, in the same ways in which states are expected to behave:⁷³

[C]orporate actors should review the adequacy of their practices with regard to human right norms … Companies, like States, should refrain from blocking or limiting the transmission of encrypted communications and permit anonymous communication… Corporate actors that supply technology to undermine encryption and anonymity should be especially transparent as to their products and customers.

In a subsequent report on freedom of expression in the digital age, from 2016, the Special Rapporteur stated his intention to use the mandate to monitor the implementation of IHRL policies by technology companies, using procedures originally developed for monitoring IHRL compliance by states:⁷⁴

Beyond adoption of policies, private entities should also integrate commitments to freedom of expression into internal policymaking, product engineering, business development, staff training and other relevant internal processes. The Special Rapporteur will aim to explore policies and the full range of implementation steps in a number of ways, including through company visits.

In a 2017 report on internet and telecommunication access,⁷⁵ the Special Rapporteur elaborated the positive duties of technology companies, moving beyond the focus on responsibility to respect found in the UNGP – underscoring thereby the interconnectedness of negative and positive duties – and portraying companies as counterweights to states, especially when the latter engage in potential IHRL violations:

In this spirit, in addition to high-level policy commitments to human rights, the industry should allocate appropriate resources towards the fulfilment of these commitments, including due diligence, rights-oriented design and engineering choices, stakeholder engagement, strategies to prevent or mitigate human rights risks, transparency and effective remedies. … [W]hen States request corporate involvement in censorship or surveillance, companies should seek to prevent or mitigate the adverse human rights impacts of their involvement to the maximum extent allowed by law. In any event, companies should take all necessary and lawful measures to ensure that they do not cause, contribute or become complicit in human rights abuses.

The 2018 Special Rapporteur’s report on content moderation further called on information and communication technology (ICT) companies to rely on IHRL in their policies and processes so as to ‘respect democratic norms and counter authoritarian demands’.⁷⁶ As part of their transparency requirements, he called on them to develop a ‘case law’ that will frame the interpretation of their content moderation standards and implementation practices,⁷⁷ foreshadowing thereby the work of the MOB (which started its operations two years later). A later report on online hate speech explicitly mentions the IHRL standards that companies are expected to apply in their relevant content moderation policies.⁷⁸

In the 2019 report on surveillance and human rights, Special Rapporteur Kaye called for a multi-stakeholder approach to develop rights-based regulatory standards and implementation initiatives.⁷⁹ He also called on private surveillance companies to introduce robust safeguards against IHRL violations, including suitable contractual clauses, technological features against misuse, and effective grievances and remedial mechanisms.⁸⁰ In the same vein, the next Special Rapporteur, Irene Khan, in 2021 called on ICT companies to ‘establish internal appeals mechanisms for a broader range of content moderation decisions and types of content, such as coordinated inauthentic behaviour’ and to ‘explore the creation of external oversight mechanisms such as social media councils’.⁸¹ In the same report she criticised technology companies for failing ‘to apply their policies consistently across all geographical areas or to uphold human rights in all jurisdictions to the same extent’.⁸²

The upshot of these thematic reports is that the Special Rapporteur on Freedom of Opinion and Expression has made extensive use of his/her mandate to define and develop the IHRL obligations of technology companies, to identify shortcomings in their policies and actual practices and to recommend improvements in policy design, implementation measures, and accountability and transparency mechanisms. The harnessing of IHRL mandates for advancing standard setting for, and review of practices of technology companies can be found, albeit to a lesser extent, in the work of the certain other special mandate holders as well.⁸³

4.2. Country visits

As indicated above, the Special Rapporteur on Freedom of Opinion and Expression, expressed in 2016 an interest in holding a company visit – presumably along lines similar to that used in country visits – that is, visits dedicated to investigating human rights conditions in specific countries. The Rapporteur, David Kaye, did visit Silicon Valley, albeit not in the form of a ‘country visit’ but as part of research he conducted in connection with a 2018 report on content regulation.⁸⁴ This followed an earlier visit to San Francisco by the Working Group on Business and Human Rights, which took place as part of its US country visit, and was dedicated to reviewing the ICT sector’s engagement with IHRL in managing supply chains and in addressing issues relating to the right to privacy and freedom of expression.⁸⁵ At least one other mandate holder expressed an interest in conducting a separate ‘country visit’ to Silicon Valley with a view to assessing the IHRL practices of technology companies based there.⁸⁶

4.3. Comments on policies and measures

Until now, the Special Rapporteur on Freedom of Opinion and Expression has sent at least seven letters to large technology companies, alerting them to IHRL concerns about recent policies or measures that they have allegedly undertaken or considered undertaking. These include letters concerning Apple’s removal of VPN applications in China,⁸⁷ Meta’s need to ensure the independence of the MOB and its ability to rely on IHRL,⁸⁸ a comment on the MOB Al Jazeera decision relating to arbitrary/biased content moderation in the Israeli–Palestinian context,⁸⁹ a letter on Meta’s policy relating to cases involving online gender violence,⁹⁰ a joint letter with the Special Rapporteur on Freedom of Assembly and of Association to ICANN concerning the transfer of the Public Interest Registry to a private equity firm, letters to the NSO Group concerning potential abuse of their spyware products and their new whistleblower policy,⁹¹ and a letter written together with the Working Group on Human Rights and Business to TikTok concerning the need to integrate IHRL in their new content moderation policy.⁹² Whereas most of the letters remain unanswered, in a few cases the companies responded and provided more information, suggesting some interest in engaging with the Special Rapporteur around the concerns raised.⁹³

4.4. Communications

A similar letter-writing procedure – which partly overlaps with the policies and measures comments procedure – exists in connection with communications submitted to special procedures by individual complainants. They too have resulted on occasion in the writing of letters by the Special Rapporteur on Freedom of Opinion and Expression to large technology companies (almost always jointly with other special procedures), expressing concern about the practices in question and/or asking for clarification. In 2023, for example, the Special Rapporteur was involved in writing letters to Google in relation to cyber attacks against a human rights defender,⁹⁴ TikTok and Omegle relating to the streaming of online sexual activity,⁹⁵ Telegram in relation to the dissemination of hate speech in Myanmar⁹⁶ and the NSO Group with regard to the application of spyware against human rights defenders.⁹⁷ By 2023, at least 14 letters had been sent by the Special Rapporteur on Freedom of Opinion and Expression (the first letter on the Special Rapporteur’s website dates from 2018).⁹⁸ Replies by technology companies to special procedures communication letters, however, have been sporadic.⁹⁹

The experience of the Special Rapporteur on Freedom of Opinion and Expression and other special procedures involved in elaborating standards and monitoring the IHRL practices of large technology companies suggests that there are now enough legal sources and conceptual building blocks to provide meaningful normative guidance to such companies with regard to certain areas of IHRL, and that special procedures have some capacity to monitor their activities. Going forward, the UN Working Group on Business and Human Rights could serve as a focal point within the UN for corporate accountability for human rights abuses, including in the digital sector.

Still, the looseness of the BHR legal framework, the paucity of tailormade IHRL norms addressing the rights of users of digital technology, and the overall weakness of the special procedures as enforcement mechanisms raise the concern that this procedural avenue offers a rather limited basis for controlling the IHRL practices of large technology companies. One may recall in this regard that, for states, the special procedures are one among numerous legal controls, alongside treaty bodies, regional human rights systems, domestic constitutional law etc. Most of these legal controls are unavailable or only partly available for large technology companies: treaty bodies and regional courts remain focused on state responsibility for IHRL violations, and domestic law treats the legal responsibility of technology companies primarily through private law, not public law lenses.

5. Conclusions

The question of fit between IHRL and the operations of large technology companies that affect the enjoyment of rights by users of digital technology remains a vexing problem in law and in practice. Driven by an ethos of effective protection of IHRL, international actors have been able to develop in the twenty-first century a BHR framework that gives concrete contents to the positive obligations of states to ensure the enjoyment of IHRL by individual rights holders, to provide access to effective remedies, and to supplement existing IHRL with certain soft law norms that apply both to states and to business enterprises. This framework, codified in the UNGP and expected to be upgraded some day by the LBI, however, remains state-centric in its orientation. Still, it applies some, albeit indirect, pressure on companies, including big tech companies, to conform their activities to IHRL standards, and to undertake substantive and procedural measures to give effect to the normative justifications and social expectations that undergird the UNGP. The rise of IHRL due diligence obligations has been particularly noteworthy in this regard.

Despite representing a significant normative and conceptual development, the BHR framework suffers from a number of weaknesses. It is voluntary in nature, allowing companies, in practice, to select the level of engagement with IHRL they wish to assume. It also lacks, for the time being, effective oversight mechanisms. Such lack of ‘teeth’ is particularly problematic when one confronts the need to control the operations of large technology companies that conduct business on the global level, far beyond the regulatory reach and capacity of most states. Still, recent advances in the regulation of technology by the European Union (EU) – including, the Digital Services Act,¹⁰⁰ the Digital Markets Act¹⁰¹ and the AI Act¹⁰² (and before that, the General Data Protection Regulation¹⁰³ )– suggest that the regulation of large companies, including very large online platforms and search engines,¹⁰⁴ is feasible, provided that states muster the required political will to cooperate in creating effective regulatory structures. Although such EU regulatory instruments do not focus on the IHRL responsibilities of big tech companies, some of their contents – in areas such as privacy protection, curbing hate speech and disinformation, and ensuring child safety – have clear IHRL dimensions.

The case of Meta, discussed in Section 3, illustrates that the BHR framework does have some potential for guiding the effective integration of IHRL into self-regulation instruments and grievance mechanisms operated by big tech companies. This experience is built, however, around the voluntary assumption of IHRL commitments by Meta, coupled with the voluntary subjection of its content moderation decisions to monitoring by an independent review body – the MOB. The relative success of the MOB in developing a considerable body of IHRL jurisprudence is impressive. However, it is ultimately linked to the voluntary nature of the entire enterprise, which to date remains limited in scope and unique in the big tech sector. It is also worth noting that, with respect to freedom of expression, the analogy between Meta’s content moderation decisions and state regulation of speech is rather straightforward. It remains to be seen how more complex configurations of power holding between large technology companies and individuals that have no immediate parallel in state–individual relations – such as different forms of AI-based decision making or the administration of clouding or blockchain services – can be addressed by the existing IHRL framework and/or an MOB-like process, which would mirror judicial or quasi-judicial review available at the national, regional or international level.

Indeed, one key problem of the BHR framework is that it addresses only to a limited degree the conceptual and practical adaptations required to facilitate the application to private companies of IHRL obligations, which were created with states as prototypical duty holders in mind. The focus of the UNGP under the second pillar on the responsibility of business enterprises to respect IHRL is too crude a measure of adaptation given the interdependence between negative and positive IHRL obligations, and indeed the LBI appears to be moving away from such sharp distinctions. More fine tuning of IHRL obligations will need to be introduced in the future by law-interpreting and law-applying bodies, probably on a sector-by-sector basis, taking into account any governance or quasi-governance functions fulfilled by private sector entities, including big tech companies. In any event, the BHR framework does not appear to provide a clear theoretical basis for direct application of IHRL to business enterprises.

The last part of this article (Section 4) discussed the potential of special procedures of the UN Human Rights Council to provide normative guidance and compliance monitoring to technology companies. Such a review is couched primarily in the BHR framework, but can provide an institutional context for identifying new sector-specific IHRL obligations, as well as help to shape voluntary commitments and grievance mechanisms developed and operated by large technology companies. Still, like other parts of the BHR framework, the special procedures have no binding authority over technology companies, and seem to generate only limited compliance pull through the non-judicial monitoring measures they pursue. The special procedures also have not articulated to date a theoretical foundation for the direct application of IHRL to private companies, nor have they promulgated clear guidelines for the process of adaptation of IHRL from states to business enterprises, and from offline to online environments.

The upshot of this analysis is that much normative and institutional work remains to be done in this area of IHRL in order to effectively utilise IHRL norms and institutions to address any right-infringing practices of large technology companies. As it currently stands, IHRL, when applied to big tech companies, suffers from a series of structural constraints that hamper its ability to afford effective protection to digital users. These include excessive reliance on voluntary commitments by companies under the BHR framework, the foregrounding of some digital rights (such as freedom of expression), and the backgrounding of others (such as limits on automated decision making and control over personal data), limited access to remedies (the MOB being a glaring exception to the general practice of not establishing strong complaint mechanisms), and the inadequacy of international enforcement machinery, which includes the Human Rights Council special procedures, for effective monitoring and curbing abuses by big tech companies.

In order to address these difficult constraints and challenges, we need to do more thinking outside the box, including engaging in a frank discussion about the adequacy of the box itself – IHRL – to the contents inside it – the operations of big tech companies. Such a discussion may lead to different approaches to business regulation – direct regulation, indirect regulation or self-regulation – which could perhaps protect more effectively the basic rights and interests of digital users than the current BHR-driven agenda.