@egonw With the users as the cat? I'd say they have somewhat more responsibility if they knowingly committed to it. But proving such knowledge could get difficult, whereas the company 100% knew.