Legal Challenges for OWI and Search Engine Use

LEGAL CHALLENGES FOR OWI AND SEARCH ENGINE USE* P. C. Johannes†, H. Koulani‡, ITeG, University of Kassel, Germany L. Beer§, Open Search Foundation e.V., Munich, Germany Abstract Opening up the current search engine market, would create diversity and freedom of choice when searching the internet, thus strengthening overall informational selfdetermination. The European Open Web Index (OWI) aims to serve as an alternative to the closed, non-transparent systems of large platforms and search engines. It would provide a basis for the services of a large number of (new) search engines and other application developers. This article focuses on the applicable European legal framework. After a short introduction of the OWI and it’s business uses, it concentrates on the use case “vertical search engines”. Addressed are the most important legal challenges to this use case from the perspective of the OWI as well as the vertical search engine developers. Based upon this, the article investigates the user perspective, i.e. what is required for an OWI to be trusted and used. It concludes with an overall assessment and future outlook. OWI BUSINESS MODELS The business models of search engines are based on the targeted marketing of user data, for example for personalised online advertising. The collection and analysis of user data makes people very predictable for advertisers. This makes the users of search engines vulnerable to manipulation, for example by online advertising that is specifically tailored to the individual surfing behaviour, interests and circumstances of the internet users. The search engine market is currently dominated worldwide by only four providers who have their own so-called web indexes. An OWI as an alternative to the closed, non-transparent systems of the large platforms will provide a basis for the services of a large number of (new) search engines. It can also be used for research and innovation, for example in the field of artificial intelligence (see [1] for more details). The OWI is intended to strengthen the EU's digital sovereignty by reducing dependence on the search engine monopolists through a sustainable, freely accessible web index [2]. Similar to other indexes, the OWI is being created by systematically crawling the web, analysing the crawled content and storing it with metadata in a database [3]. In order for this emerging open search infrastructure to be fully effective, it must be designed in a way that is compatible with fundamental rights and can be operated within the current European legal framework[4]. For example questions arise in the context of the ‘right to deindexing’ and the effects and application of the European legal framework on data, digital services and online platforms. The aim is to align the design of an open search infrastructure with the fundamental rights and principles that the European Commission has also declared as the benchmark for the ‘Digital Decade’ [5]. The PriDI project [6] is researching how an OWI can be designed in a way that is compliant with fundamental rights of users and operators and is protective of privacy. To achieve this, possible use cases of an OWI were developed and examined. This allowed to analyse legal challenges from the perspective of the users of an OWI. Use cases were initially based on the study by Nowakowski/Zimmermann [7]. That study groups possible use cases into the categories web search, enterprise search, information portals, value-adding services, content management and e-commerce. Web search and value-adding services are by far the largest categories. The study contains a list of possible applications, although it should be noted that this is not comprehensive. These applications are mostly only tagged and briefly described in the study, but not defined in detail. The PriDI study builds upon those and thus closes the gap for certain use cases and lays the foundation for further legal evaluation [8]. The detailed use cases always consist of the goal of the use case and the relevant actors within the specific use case. In this context, a distinction is also made between a user and an actor. When assessing the OWI from a legal and user acceptance perspective, a distinction must be made between different stakeholders. A wide range of people and entities can be considered as actors. In the case of the OWI, this might be an organisation that acts as a data retriever/consumer or the institutions that develop the OWI as index developers. For the purposes of this study the following roles were defined: First of all, there are the data subjects. This role describes persons or companies whose personal data and intellectual property (IP) are stored in the OWI and are used or can be found by tools or search engines based on the OWI. ___________________________________________ * Based on research of “Privacy-enhancing digital infrastructures” (PriDI), funded by the German Federal Ministry of Education and Research (BMBF). The responsibility for the content of this publication lies with the authors. This papers contains parts that have already been submitted for publication to CPDP.AI 2025. † paul.johannes@uni -kassel.de ‡ koulani@uni -kassel.de § [email protected] https://doi.org/10.5281/zenodo.17229609 The index itself is developed and maintained by the OWI developer. The OWI developers have by nature of collaboration alone formed an operator consortium. For the purposes of this study it is assumed they have formed a legal entity of some kind. The data retrievers or data consumers of the information contained in the OWI are referred to as application developers. They are persons or organisations that request the retrieval of web data from the index in order to create and develop various tools and models based on the retrieved data for their own applications and services, e.g. for a search engine. Lastly, end users also come into contact with the index and the applications built on it’s use. These are the natural or legal persons who use the tools and systems developed by the application developers. USE CASE “VERTICAL SEARCH ENGINE” The OWI can serve as a basis for the development of new (vertical) search engines. For example, search engines could be created for specific user groups, geographical areas or topics. The OWI creates the basis for this by providing a comprehensive database. Developers of specialised search engines can access the index and filter out exactly the data that is relevant for the respective purpose. This means that smaller organisations and companies can also develop search engines and thereby increase diversity in the search engine market. Organisations and companies do not have to devote enormous resources to crawling and indexing the entire or a part of the web, but can deliver precise and relevant results for specific topics based on the OWI. As the source code of the OWI is publicly available, developers can understand the underlying algorithms and adapt them to their specific needs. For example, the OWI can be used to create news search engines that provide individuals with news about both current and past events. In addition, press reviews on various topics, events or even companies could be compiled. For the purpose of this study, the following assumptions for the use case were made: The primary objective of this use case is to develop a news search engine tailored for individuals and businesses by retrieving web data on current news. This initiative involves several key actors: application developers, data subjects (such as article authors, newspapers, and individuals mentioned in news articles), OWI developers, and end users. It is also assumed that the application developers are a sole proprietorship whose clients include companies and authorities seeking to monitor media coverage of individuals and businesses. Additionally, nongovernmental organizations (NGOs) interested in specific political topics, such as legislation, climate protection, and study results, also utilize their services. The interaction process begins with the application developer engaging with the OWI system to request access to a pre-built news index. The developer specifies that the data will be used for developing a news web search engine . Upon receiving the request, the system processes it and, if technically feasible, notifies the data subjects about the intended use of their data. Once processed, the application developer receives the requested data, concluding the interaction. End users interact with the news search engine by submitting queries related to events, persons, or companies. The system displays relevant results along with their respective sources. Users may also be informed that the search engine relies on OWI data and the time period from which the data is sourced, ensuring transparency in the data usage process. This interaction concludes once the user has reviewed the search results. LEGAL CHALLENGES The complexity of the OWI and it’s use by prospective vertical search engine application developers raises many questions as to how it falls under the law of the European Union and the laws of it’s member states. European law on data and online services has undergone major changes in recent years. The General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) lays down detailed rules on the handling of personal data. Now a regulatory network of more or less specialized, directly applicable legal acts for data and digital services has emerged. Among others the Digital Services Act (DSA, Regulation (EU) 2022/2065), the Data Governance Act (DGA, Regulation (EU) 2022/868), the Data Act (DA, Regulation (EU) 2022/868), the Digital Markets Act (DMA, Regulation (EU) 2022/1925) and the AI Act (AIA, Regulation (EU) 2024/1689) form a legal framework for digital services and on data (see more detailed [9]). Regulations are directly and uniformly applicable in all member states. Complexity is added by the various laws of member states, establishing national frameworks for implementing these regulations, e.g. in Germany the Digitale Dienste Gesetz (DDG) for the DSA and the Bundesdatenschutzgesetz (BDSG) for the GDPR. Others questions arise from the legal framework for copyright. In the EU this is primarily governed by a combination of EU Directives, international treaties, and national laws of member states (also see [1]). This article focuses on legal challenges faced by the OWI developer and the vertical search engine application developers across the regulatory domains of data protection and digital services. The initial assessment of the use case highlights the complexities and the need for ongoing studies. In the case that the OWI serves as a basis for the development of new (vertical) search engines the OWI developer provides a comprehensive database to the application developer of this new search engine. The ensuing relationship as well as the operation of the new service, have to be scrutinized in light of the aforementioned regulations. This article focuses on the GDPR and the DSA. https://doi.org/10.5281/zenodo.17229609 RULES ON DATA PROTECTION The OWI will, intentionally or unintentionally, contain personal data of natural persons (data subjects) within the meaning of Article 4 No. 1 GDPR [10][11]. This data will be contained in the crawled data. It may even be special category data within the meaning of Article 9 para. 1 GDPR. Personal data could also be part of the metadata collected and enriched by the OWI (e.g. owners of websites, contact details). The protection of personal data is a fundamental right (see Article 8 Charter of Fundamental Rights of the EU (CFR)) and is governed by the GDPR. The entity operating the OWI is a controller with all responsibilities under the GDPR in relation to the personal data it processes. LAWFUL PROCESSING The processing of personal data is only lawful if it can be justified on a legal basis within the meaning of Article 6 GDPR. The creation and operation of an independent, freely accessible web index is in the public interest, if only to reduce the dependence of Internet users on foreign search engines. For the lawfulness of processing in the public interest pursuant to Article 6 para. 1 subpara. 1 lit. e GDPR requires a legal basis in Union law or in the law of the Member States in accordance with para. 3. Such a basis is not yet apparent, so that a public body or public bodies processing the OWI would have to fall back on a general purpose authorisation in law of the member states. For example: A data centre, organized as a public body in Bavaria in Germany is likely to process personal data for an OWI, e.g. crawling, enriching and sorting websites and indexing them, on the basis of its own purpose (i.e. statutes and/or establishment act) in conjunction with Article 4 Bavarian Data Protection Act (BayDSG) on the basis of and in conjunction with Article 6 para. 1 subpara. 1. lit. e and para. 2 and 3 GDPR. For private entities, the creation and operation of the OWI can only be based on the protection of legitimate interests of the controller or a third party in accordance with Article 6 para. 1 subpara. 1 lit. f GDPR. This requires a balancing of the interests, fundamental rights and freedoms of the data subject. The legitimate interest of the OWI operator as the controller is to create and maintain an OWI. The legitimate interest of the general public as a third party is to have access to an independent, freely accessible web index. The interest of the data subjects in not being included in a web index and thus protecting their informational self-determination does not outweigh these legitimate interests. The OWI only crawls data that is freely accessible to everyone and has already been crawled many times by search engine operators such as Google, Bing, Yandex or Baidu. It is also common knowledge that this happens technically, so that data subjects can protect themselves against it by taking appropriate measures against those who publish their data. Therefore, the interests of the data subjects do not outweigh the legitimate interests of the OWI developer and the general public in the creation of an OWI. This is also true for the application developers using the OWI’s data. The news search engine developers as defined in the use case can rely their processing of personal data (OWI data as well as the queries of it’s end users) on lit. f as well. The constellation in which an OWI crawls special categories of personal data that are publicly accessible but have not been made publicly accessible by the data subject itself remains problematic and has not yet been fully clarified. This also applies to application developers who use this data. According to Article 9 para. 1 GDPR, the processing of special categories of personal data like health data or data regarding sexual orientation, is prohibited unless there is an exception according to Article 9 para. 2 GDPR, especially making that data available to the public by the data subject itself (lit. e). If a third party has made this data accessible on the internet instead of the data subject itself, there might be no legal basis for the OWI to crawl this data and the search engine developers to use this data. It is doubtful that the OWI provider and search engine developer could face requests for deletion in accordance with Article 17 GDPR. Theoretically, fines could be imposed in accordance with Article 83 GDPR, whereby many factors would play a role in the assessment of a possible fine, in particular whether the controller is responsible for disclosing the specific data in question. However, in light of the fact that major search engines have been exposed to this risk for many years and infringements have not yet been prosecuted, a fine is rather unlikely. Still, a risk remains. To address this, it could be argued that the OWI and the search engines operate under the assumption, that information contained in crawled webdata is not processed within the meaning of Article 9 para. 1 GDPR, since it does no take action to identify this information as such. It can also be argued, that the OWI and the search engine can assume that, since all data crawled is publicly available, it was made publicly available by the data subject itself within the meaning of Article 9 para. 2 lit. e GDPR. Further processing to identify or ascertain this are not necessary because of Article 11 GDPR, which states that the controller shall not be obliged to maintain, acquire or process additional information in order to identify the data subject for the sole purpose of complying with the GDPR. Furthermore, in the case that the controller of the OWI is a public body, it is very likely that it is allowed to process special categories of personal data in accordance with member state law on the basis of a general purpose authorisation statute in conjunction with its own governing statues on the basis of Article 9 para. 2 GDPR. OBLIGATIONS Both the OWI developer and application developers like search engine providers would have to comply with GDPR principles (Article 5 GDPR) when processing personal data included in the in the database of the OWI. As controllers they must fulfil a number of technical and organizational obligations in accordance with the GDPR in order to mitigate the risks for data subjects and their rights and fundamental freedoms (e.g. Chapter IV https://doi.org/10.5281/zenodo.17229609 GDPR). On the technical and operational level these include, but are not limited to the creation and maintenance of records of processing activities (Article 30 GDPR), the obligation to implement appropriate technical and organisational measures to ensure security of processing (Article 32 GDPR) and the implementation of appropriate technical and organisational measures to ensure data protection by design and by default (Article 25 GDPR). Other obligations of OWI and search engine providers are the need to undertake a Data Protection Impact Assessment (DPIA, see Article 35 GDPR) and to designate a Data Protection Officer (see Article 37 GDPR). The OWI developer as well as the application developers should also create information policies: The OWI developer as well as the search engine developer are not obliged to inform the data subjects about the data collection or processing proactively. According to Article 14 para. 5 lit. b sentence 2 GDPR, however, the controller must take appropriate measures to protect the fundamental rights and freedoms as well as the legitimate interests of data subjects. Sentence 2 mentions the provision of information to the public as an example. The OWI developer as well as the search engine developer should therefore provide transparent, clear and comprehensible information on their website about the manner in which (personal) data is collected and the rights of the data subjects as well as the reasons why they respectively, as the controllers, are relying on Article 14 para. 5 lit. b GDPR. They should therefore draft and make publicly available a privacy policy or data privacy statement. Furthermore, the GDPR contains a number of data subject rights about which the controller must provide full information and which it must comply with at the request of the data subject. These include the right to access under Article 15 GDPR, the right to rectification under Article 16 GDPR, the right to erasure under Article 17 GDPR, the right to restriction of processing under Article 18 GDPR and the right to object under Article 21 GDPR. In addition, every data subject has the right to lodge a complaint with a supervisory authority in accordance with Article 77 GDPR. The OWI developer as well as the search engine developer should as organisational measures implement each concepts to receive and act upon queries of a data subject pertaining to their rights. The OWI developer shares data with the application developers e.g. the search engine provider. If there are several controllers who jointly determine the purposes and means of processing, they are jointly responsible. This applies if several organizations operate the OWI together. As such, they are joint controllers and obliged to define in an agreement in accordance with Article 26 GDPR how the obligations under the GDPR are to be implemented in detail. The joint controller agreement shall be made available to the data subjects. If infringements occur during the processing of personal data, both joint controllers can be held liable. That the OWI developer and search engine developer would also be joint controllers within the meaning of Article 26 GDPR is unlikely. They might be for certain aspects of their relationship and data processing operations, like the sharing of the index data or of parts of the crawled data. RULES ON DIGITAL SERVICES In its current form, the OWI as well as the (news) search engine will each fall under the regulation of digital services, in particular the DSA. The DSA regulates the liability and scope of due diligence obligations for providers of digital intermediary services. The aim of the regulation is to provide an appropriate framework for the digital space, to create a safe, predictable and trustworthy online environment and to protect fundamental rights, see Article 1 para. 1 DSA. According to Recital 29 DSA intermediary services “cover a wide range of economic activities that take place online and are continuously evolving to enable the fast, safe and secure transmission of information and to provide convenient solutions for all stakeholders in the online ecosystem”. INTERMEDIARY SERVICES The classification of the OWI as an intermediary service under the individual characteristics of the DSA is difficult, especially when it comes to the qualification as a hosting service, online platform or search engine. The OWI can only be classified as an intermediary service within the meaning of Article 3 lit. g No. iii DSA and as an online search engine within the meaning of Article 3 lit. j DSA with some assumptions or leaps of thought [12]. It is obvious that the legislator had use cases such as social media and market portals in mind when designing the DSA, while higher-level applications such as a web directory or index were not even considered. Also, the rules on online search engines were not thought through to the end. Nevertheless, the functions and possibilities of the OWI are often comparable with typical use cases covered by the DSA, so that according to the purpose of the DSA, the OWI should fall under it and thus a legalteleological argumentation (purpose of the law) can be made in this direction. The OWI developer would not itself fall under the rules of the DSA concerning search engines, since it does not provide a search interface. The developer of the news search engine on the other hand would. The search engine operator would likely be considered an intermediary and could benefit from limited liability for content hosted by third parties, provided they comply with their obligations under the DSA (e.g. content moderation, transparency reports). In terms of both, the purpose of the DSA and general considerations, it would make sense to allow the OWI developer to benefit from the exemption from liability of the DSA or comparable privileges. At the same time, however, the OWI developer should also be subject to corresponding duties of care, which are considerable. These obligations are even greater when the OWI would be categorized as a very large online search engine. The legislator should clarify this accordingly and include both online search engines and indexing services https://doi.org/10.5281/zenodo.17229609 in the definition of Article 3 lit. g DSA and name them accordingly in the obligations and exemptions from liability. In lieu of such clear-cut rules as of now, an OWI operator should assume the OWI is as search engine and hosting service within the meaning of the DSA and regulate its operation accordingly. LIABILITY UNDER DSA As providers of hosting services, the OWI developer as well as the search engine developer would be exempt from liability in accordance with Article 6 para. 1 lit. a and b DSA, provided that they have no knowledge of illegal content in the index data and take immediate action to block access to this content as soon as they become aware of it. According to Recital 22 DSA, knowledge cannot be assumed solely from the general awareness that the service can be used to store illegal content. Recital 22 DSA also emphasizes that automatic indexing of illegal content is not sufficient to establish specific knowledge. According to Article 7 DSA, the exemption of liability also applies if the provider, on its own initiative, carries out voluntary investigations in good faith and diligently or undertakes other measures to detect, identify and remove illegal content or to block access to illegal content or takes the necessary measures to comply with legal requirements. A general obligation of the OWI developer or search engine developer to monitor and actively investigate the index data for illegal content does not exist in accordance with Article 8 DSA. However, pursuant to Article 6 para. 4 DSA, at the request of a judicial or administrative authority, they would have to comply with an order pursuant to Article 9 para. 1 DSA to take action against illegal content and must, pursuant to Article 10 DSA, inform the issuing authority immediately of the receipt and implementation of the order. GENERAL PROVISIONS UNDER DSA According to Article 11 DSA, the OWI operator is obliged to designate an easily accessible central point of contact for the authorities of the Member States, the Commission and the panel within the meaning of Article 61 DSA. The point of contact should enable smooth electronic communication. In addition, a central point of contact for users of the service must be designated in accordance with Article 12 DSA, which enables users to communicate directly, quickly and effectively. In accordance with Article 14 DSA, both the OWI developer and the search engine developer are obliged to provide clear and comprehensible information in its General Terms and Conditions (GTC) about restrictions on the information provided and the use of the services. According to Article 3 lit. u DSA, the GTC are all clauses that govern the contractual relationship between the developer and the users or end users of the respective services. According to Article 14 para. 1 sentence 2 DSA, the information obligation covers all guidelines, procedures, measures and tools used to moderate the content. The OWI developer provides services to the application developers. It should therefore provide the necessary information at least to the search engine developer. The search engine developer renders it’s service to end users and should address them. Furthermore, as discussed before it is conceivably to consider all natural persons whose data are indexed as users of the index within the meaning of the DSA. Therefore, the OWI developer should provide the information publicly towards all, data subjects and end users, not only in the interest of transparency but also to ensure compliance with the DSA. The information should explicitly mention algorithmic decision-making, human review and the procedural rules of the internal complaints management system pursuant to Article 20 para. 1 DSA. Therefore, the OWI developer in particularly is obliged to explain transparently and in detail whether and how user content is crawled and indexed and how it is used in the index and made accessible to third parties. In order to comply with this obligation, the OWI developer could disclose the crawling methods and technologies used, as well as provide a list of the excluded index terms and domains. In addition, in accordance with Article 14 para. 1 DSA, the procedural rules of the complaints management system and measures against abusive use of the system must be specified. Furthermore, in the case of very large online platforms, the GTC must be supplemented with content on available legal remedies in accordance with Article 14 para. 5 and 6 DSA and must be available in the official languages of all Member States in which the service is offered. Article 15 DSA specifies special transparency obligations: according to this, the OWI developer must make a report on the content moderation carried out publicly available at least once a year. This would also apply to the search engine developer. Content moderation is defined in Art. 3 lit. t DSA as the activities of intermediary service providers aimed at identifying and combating illegal content provided by users that is incompatible with the provider's GTC, including measures relating to the accessibility of illegal content or information. Article 15 para. 1 lit. a to e DSA lists various aspects that need to be addressed. ADDITIONAL PROVISIONS FOR HOSTING SERVICES According to Article 16 para. 1 DSA, the OWI developer and search engine developers would be obliged to introduce an easily accessible and digital reporting procedure so that persons or entities can report illegal content. In order to facilitate a sufficiently accurate and reasoned report, Article 16 para. 2 sentence 2 lit. a to d DSA state that reports should contain (1) a sufficiently reasoned explanation as to why the person concerned considers the information to be illegal content, (2) a clear indication of the exact electronic location of this information, such as the URL address or, if necessary, the name of the website where the information is stored, (3) the name and email address of the reporting party, unless the information relates to a criminal offense, and (4) a https://doi.org/10.5281/zenodo.17229609 statement that the reporting party has a good faith belief that the report is accurate and complete. Such reports must be processed promptly, carefully, free of arbitrariness and objectively and inform the reporting party of the use of automated means for decision-making within the meaning of Article 16 para. 6 DSA; in addition, in accordance with Article 16 para. 3 and 5 DSA, an acknowledgement of receipt and the decision must be issued to the reporting party without delay and the possible legal remedy must be explained. In addition, the OWI developer and search engine developers need to inform the law enforcement authorities of the respective Member State according to Article 18 para. 1 DSA or, in accordance with Article 18 para. 2 DSA, a representative or Europol immediately as soon as they become aware of information that gives rise to suspicion of a committed or possible criminal offence that poses a threat to the life or safety of a person. USER ACCEPTANCE AND TRUST Although legally compliant design and considerations like data protection and privacy hold great importance in Europe, user behaviour suggests that these factors are often secondary when selecting digital services. In practice, other aspects tend to influence decisions more strongly. Consequently, integrating essential elements of user acceptance into the development of OWI and related tools is crucial. User perception and their intention to use new technological solutions are essential concepts researched over the last decades. Many theories and models were introduced providing insights into factors that affect user acceptance of technology, such as TAM [13], UTAUT [14] and their extended versions [15, 16, 17]. Furthermore, trust in IT-artifacts has become an important construct to be considered while designing new technologies [18]. For the practical application of user acceptance and trust considerations for OWI, a combination of two theoretical theories is drawn upon, Trust-TAM [ 19] and UTAUT2 [17]. The latter introduces seven factors, such as performance and effort expectancy, social influence and facilitating conditions. Our study aims at adapting each factor to the OWI context and introducing suitable user acceptance considerations under each factor. In particular, the factor performance expectancy could be expanded to include two considerations, reliability and speed. These concepts encourage developers of OWI tools to leverage the database of OWI to implement search engines and services since reliability and speed of OWI responses matter to the tools’ results. Considering the end users as actors in these use cases, promoting reliability and speed in the functionality and structure of OWI indirectly affects the perception of end users since these aspects would be mirrored in the developed search engines and local services for the end usage. For a European web index to be competitive on a global scale—or at least to challenge international rivals within Europe—it must balance European principles of privacy and data security with key user preferences, ensuring that design choices and requirements are well aligned. CONCLUSIONS AND OUTLOOK This analysis demonstrates that the development and implementation of an OWI and applications based on it, such as search engines, presents a unique set of challenges and opportunities for the protection of fundamental rights. While the OWI holds the potential to enhance access to information (Article 11 CFR), foster competition in the digital market, and promote innovation, it also raises concerns regarding data protection (Article 8 CFR), the freedom to conduct a business (Article 16 CFR), and the protection of intellectual property (Article 17 CFR). The current legal framework of GDPR and DSA guides and restricts the development of an OWI and it’s application such as search engines in many ways. The requirements of both legal acts must be observed. However, it should also be emphasized that neither the GDPR nor the DSA fundamentally prevent or ban the business model presented. Further studies and assessments of the OWI, it’s use cases and their relationships with each other are ongoing and necessary. The comprehensive legal framework of the EU addresses some of the underlying concerns for rights and freedoms. Ongoing monitoring of the legal framework, coupled with adaptation, is crucial to ensure that the OWI contributes to a more open, inclusive, and rights and freedoms respecting European digital ecosystem. REFERENCES [1] L. Beer, P. C. Johannes and H. Koulani, “Legal aspects of AI training and retrieval augmented generation”, presented at OSSYM 2025 - 7th International Open Search Symposium, Helsinki, Finland, Oct. 2025, paper #####, this conference – submitted. [2] L. Beer et. al., “An Open Web Index - opportunities and risks for fun-damental rights and freedoms”, presented at CPDP.ai 2025, Brussels, Belgium, May 2025 – submitted. [3] G. Hendriksen et al., “The Open Web Index. Crawling and Indexing the Web for Public Use.” in Advances in Information Retrieval: 46th European Conference on Information Retrieval. ECIR 2024, Glasgow. UK. Mar. 2024. pp. 130-143 [4] L. Beer et. al., “Ein offener Webindex: Chancen und Risiken für Grundrechte und Grundfreiheiten”, in Tagungsband Plattform Privatheit 2024, Berlin, Germany, Oct. 2024 – forthcoming. [5] European Commission, COMMUNICATION FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT, THE COUNCIL, THE EUROPEAN ECONOMIC AND SOCIAL COMMITTEE AND THE COMMITTEE OF THE REGIONS State of the Digital Decade 2024, COM(2024) 260 final. [6] PriDI, https://pridi-projekt.de/. [7] D. Nowakowski, N. Zimmermann, “Market potential assessment of OpenWebSearch.eu - Exploring the economic and societal impact of an Open Web Index”, Mücke/Roth, Germany, 2024. https://doi.org/10.5281/zenodo.17229609 [8] H. Koulani, L. Beer, P. C. Johannes, C. Geminn, M. Söllner and S. Voigt, “Anwendungsfälle eines offenen Webindex”, PriDI, Mar. 2025, published as white paper on https://pridiprojekt.de/. [9] C. Geminn and P. C. Johannes (Eds.), Handbuch Europäisches Datenrecht, Baden-Baden, Germany: Nomos, 2025, to be published. [10] C. Geminn, K. Erenli and L. Pfeiffer, “Legal Challenges of an Open Web Index”, International Cybersecurity Law Review, vol. 2, no. 2, pp. 183-94, 2021. https://doi.org/10.1365/s43439-021-00017-8. [11] C. Geminn, “Rechtsfragen eines offenen Web-Index - Infrastrukturen für die digitale Gesellschaft”, Multimedia und Recht, no. 12, pp. 16-19, 202 [12] M. Nebel and P. C. Johannes, “Open Web Index im Lichte des Digital Services Act – Voraussetzungen – Grenzen – Rechtsfolge”, Multimedia und Recht, no. 12, pp. 10101016, 2024. [13] F. D. Davis, “User acceptance of information technology: system characteristics, user perceptions and behavioral impacts,” International Journal of Man-Machine Studies, vol. 38, no. 3, pp. 475–487, Mar. 1993, doi: 10.1006/imms.1993.102 [14] V. Venkatesh, M. Morris, G. Davis, and F. D. Davis, “User acceptance of information Technology: toward a unified view,” MIS Quarterly, vol. 27, no. 3, p. 425, Jan. 2003, doi: 10.2307/30036540. [15] V. Venkatesh and F. D. Davis, “A theoretical extension of the technology acceptance model: four longitudinal field studies,” Management Science, vol. 46, no. 2, pp. 186–204, 2000, [Online]. Available: https://www.jstor.org/stable/263475 [16] V. Venkatesh, J. Thong, and X. Xu, “Consumer Acceptance and use of Information technology: Extending the unified theory of acceptance and use of technology,” MIS Quarterly, vol. 36, no. 1, p. 157, Jan. 2012, doi: 10.2307/41410412. [17] M. Söllner, A. Hoffmann, and J. M. Leimeister, “Why different trust relationships matter for information systems users,” European Journal of Information Systems, vol. 25, no. 3, pp. 274–287, Dec. 2015, doi: 10.1057/ejis.2015.17. [18] M. Söllner, A. Hoffmann, and J. M. Leimeister, “Why different trust relationships matter for information systems users,” European Journal of Information Systems, vol. 25, no. 3, pp. 274–287, Dec. 2015, doi: 10.1057/ejis.2015.17. [19] D. Gefen, E. Karahanna, and D. Straub, “Trust and TAM in online shopping: an integrated model,” MIS Quarterly, vol. 27, no. 1, p. 51, Jan. 2003, doi: 10.2307/30036519. 1L. Beer, P. C. Johannes and H. Koulani, “Legal aspects of AI training and retrieval augmented generation”, presented at OSSYM 2025 - 7th International Open Search Symposium, Helsinki, Finland, Oct. 2025, paper #####, this conference – submitted. 2L. Beer et. al., “An Open Web Index - opportunities and risks for fun-damental rights and freedoms”, presented at CPDP.ai 2025, Brussels, Belgium, May 2025 – submitted. 3G. Hendriksen et al., “The Open Web Index. Crawling and Indexing the Web for Public Use.” in Advances in Information Retrieval: 46th European Conference on Information Retrieval. ECIR 2024, Glasgow. UK. Mar. 2024. pp. 130-143. 4L. Beer et. al., “Ein offener Webindex: Chancen und Risiken für Grundrechte und Grundfreiheiten”, in Tagungsband Plattform Privatheit 2024, Berlin, Germany, Oct. 2024 – forthcoming. 5European Commission, COMMUNICATION FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT, THE COUNCIL, THE EUROPEAN ECONOMIC AND SOCIAL COMMITTEE AND THE COMMITTEE OF THE REGIONS State of the Digital Decade 2024, COM(2024) 260 final. 6 PriDI, https://pridi-projekt.de/. 7D. Nowakowski, N. Zimmermann, “Market potential assessment of OpenWebSearch.eu - Exploring the economic and societal impact of an Open Web Index”, Mücke/Roth, Germany, 2024. 8H. Koulani, L. Beer, P. C. Johannes, C. Geminn, M. Söllner and S. Voigt, “Anwendungsfälle eines offenen Webindex”, PriDI, Mar. 2025, published as white paper on https://pridi-projekt.de/. 9C. Geminn and P. C. Johannes (Eds.), Handbuch Europäisches Datenrecht, Baden-Baden, Germany: Nomos, 2025, to be published. 10C. Geminn, K. Erenli and L. Pfeiffer, “Legal Challenges of an Open Web Index”, International Cybersecurity Law Review, vol. 2, no. 2, pp. 183-94, 2021. https://doi.org/10.1365/s43439-021-00017-8. 11C. Geminn, “Rechtsfragen eines offenen Web-Index - Infrastrukturen für die digitale Gesellschaft”, Multimedia und Recht, no. 12, pp. 16-19, 2021. 12M. Nebel and P. C. Johannes, “Open Web Index im Lichte des Digital Services Act – Voraussetzungen – Grenzen – Rechtsfolge”, Multimedia und Recht, no. 12, pp. 1010-1016, 2024. 13 F. D. Davis, “User acceptance of information technology: system characteristics, user perceptions and behavioral impacts,” International Journal of Man-Machine Studies, vol. 38, no. 3, pp. 475–487, Mar. 1993, doi: 10.1006/imms.1993.1022. 14 V. Venkatesh, M. Morris, G. Davis, and F. D. Davis, “User acceptance of information Technology: toward a unified view,” MIS Quarterly, vol. 27, no. 3, p. 425, Jan. 2003, doi: 10.2307/30036540. 15 V. Venkatesh and F. D. Davis, “A theoretical extension of the technology acceptance model: four longitudinal field studies,” Management Science, vol. 46, no. 2, pp. 186–204, 2000, [Online]. Available: https://www.jstor.org/stable/2634758 16 V. Venkatesh and H. Bala, “Technology Acceptance Model 3 and a research Agenda on interventions,” Decision Sciences, vol. 39, no. 2, pp. 273–315, May 2008, doi: 10.1111/j.1540-5915.2008.00192.x. https://doi.org/10.5281/zenodo.17229609 17 V. Venkatesh, J. Thong, and X. Xu, “Consumer Acceptance and use of Information technology: Extending the unified theory of acceptance and use of technology,” MIS Quarterly, vol. 36, no. 1, p. 157, Jan. 2012, doi: 10.2307/41410412. 18 M. Söllner, A. Hoffmann, and J. M. Leimeister, “Why different trust relationships matter for information systems users,” European Journal of Information Systems, vol. 25, no. 3, pp. 274–287, Dec. 2015, doi: 10.1057/ejis.2015.17. 19 D. Gefen, E. Karahanna, and D. Straub, “Trust and TAM in online shopping: an integrated model,” MIS Quarterly, vol. 27, no. 1, p. 51, Jan. 2003, doi: 10.2307/30036519. https://doi.org/10.5281/zenodo.17229609