Consumer Advertising Law Blog

P2P Users - Upgrade Your Software Before Sharing Your Latest Vacation Pics!

For many of us who did not learn to use a computer keyboard and mouse before we could walk, terms like downloading files using BitTorrent or talking to friends on the Gnutella network sounds like having some dental procedure. But others in this generation, and certainly our kids, use those protocols and networks daily to chat and share pictures and videos with their friends though peer to peer or P2P file-sharing networks.

But the same feature of P2P software that underpins its functionality -- its ability to access and share files on your computer across the Internet -- also creates potential security vulnerabilities. The Federal Trade Commission investigated the reportedly largest provider of these P2P services - Limewire. The FTC alleged that older versions of the Limewire software contained security vulnerabilities that put users at risk of inadvertently sharing personal information, including social security numbers, bank account numbers and other matters, stored on their computers.

Limewire upgraded its software, incorporating safeguards into its user interface to help users avoid the inadvertent sharing of sensitive information. The company also said it would tell consumers to upgrade their Limewire software and inform consumers on how to best avoid inadvertent sharing, even though the company could not force users to upgrade (one version is free and the other is a one-time download for $39.99). In large part for those reasons, and the fact that the FTC found that users tended to upgrade voluntarily at a high rate (undoubtedly wanting the fastest service possible to share their latest creations), the FTC closed the investigation without action.

While no computer connected to the Internet is invulnerable, using the most recent version of P2P software may help reduce the vulnerability of your personal information to unintended disclosure.

- Ronald Lee and Beth DeSimone

TILT: FTC Alleges PR Firm Violated Endorsement Guides by Rating Clients’ Gaming Apps

We recently blogged about a column by the New York Times ethicist which addressed the ethics of an employer asking its employees to favorably rate iPhone apps it developed and noted that the practice likely violated the FTC’s revised Endorsement guides. Well, a similar practice has caught the FTC’s eye resulting in a public relations firm settling an FTC charge that it provided misleading online endorsements.

The agency was hired by video game developers, and the FTC alleges that its employees posted game reviews of the video game apps on the iTunes store site without disclosing that they were working for the app developers and, in some cases, received a percentage of sales. As we noted in our prior blog, failing to disclose such material connections runs afoul of the FTC’s guidelines. The proposed settlement has various standard provisions that one might expect but also includes a requirement that the firm remove any previously posted misleading endorsements.

The FTC issued its revised Testimonial and Endorsement Guides in the fall of last year. It is common when the FTC issues new or revised guidance in an area that a flurry of enforcement activity follows the release of the guidance. In this case, there has only been one closing letter associated with an investigation of a retailer, likely because the FTC has spent considerable time on its own PR efforts trying to clarify that it did not intend to go after individual bloggers. This case should provide comfort in that regard. However, is it "Game Over" for companies that do not have policies in place requiring sponsored bloggers to disclose their connection to the company? Stay tuned . . .

- Randy Shaheen

FTC Complaint Includes at Least 3 Life Lessons That Should Make Any Advertiser’s “Best Life” List

Some of us are certain that the cure to all aging, memory loss and weight gain woes can be found in the Brazilian Amazon. According to the Federal Trade Commission, if so, it hasn’t been identified just yet. The FTC recently filed a complaint with the Northern District of Illinois, which granted a temporary restraining order against Central Coast Nutraceuticals and other related parties for false advertising and other deceptive practices related to its AcaiPure and Colopure products.

There are at least 3 life lessons from the complaint:

1) Free Cannot Come with Strings Attached: The FTC asserted the “free” and “risk free” trials were anything but. According to the FTC’s complaint, Central Coast failed to disclose adequately that consumers would automatically be charged for other products unless they opted out and would be enrolled in an automatic monthly membership for the products they ordered. The FTC has long been focused on negative option programs and what constitutes clear and conspicuous notice of material terms, including holding workshops and publishing a lengthy Staff Report last year. Any recurring charges must be expressly authorized and if future charges will vary, advance notice must be provide to customers. The FTC thanked Visa and the Better Business Bureau of Central, Northern & Western Arizona for their assistance in rooting out these practices. And Visa had this to say: "We have tightened enforcement of our rules against banks whose merchants generate excessive levels of cardholder disputes because of deceptive marketing. We also make it a priority to partner with law enforcement and agencies like the Federal Trade Commission and support their investigations such as this case."

2) Use Extra Caution with Health Claims: Central Coast claimed AcaiPure “Was Not Created For Those People Who Only Want to Lose A Few Measly Pounds” and that it would quickly reshape your body. The producer also claimed that its Colopure could eliminate “excess weight and toxic buildup,” thereby helping to prevent colon cancer. The FTC has longstanding guides detailing its views on what substantiation is required for dietary supplement makers and for weight loss products. As we have recently blogged, the FTC has been tightening its requirements for substantiation of health-related claims. Investigating health claims has long been a top enforcement priority for the FTC and we believe will continue to be so.

3) Endorsers Need to Endorse the Product and Do Not (Repeat DO NOT) Mess with Oprah: The FTC has also revised its Testimonial and Endorsement Guides. We have blogged before about what is new and what is old. One thing that is timeless is the requirement to actually have an endorsement from one you claim endorses your product. The FTC asserts Central Coast claimed implied phony endorsements from Oprah Winfrey and Rachael Ray, including posting a picture of Oprah on its website and claiming Rachael called Acai her “number one superfood”. Both (here and here) provided the FTC with declarations used in the TRO proceedings.

- Amy Mudge and Michael Thorpe

Commissioner Rosch on the FTC’s Dual Role as Prosecutor and Judge

At the recent ABA Annual, FTC Commissioner Rosch addressed the FTC’s role as both prosecutor and judge. He focused on three issues: the standard the FTC applies when voting out a complaint, the standard the FTC applies when it reviews decisions of administrative law judges, and whether it is unseemly to have the FTC occupy both these roles. His comments outlined below may help parties arguing matters before him and potentially other like-minded Commissioners.

First, Commissioner Rosch said the FTC applies the “reason to believe” standard when voting out complaints. If there is a “reason to believe” unlawful behavior is occurring, the FTC sues. While his remarks focused on filing antitrust complaints, the same “reason to believe” standard is applicable when the Commission determines whether to challenge an unfair or deceptive business practices under Section 5(b) of the FTC Act. Personally Commissioner Rosch said he first asks whether the Bureau has enough evidence such that he can form a “reason to believe” that further investigation may as a factual and legal matter demonstrate liability. Next, he asks if there is a sound legal basis for the FTC’s theory. Lastly, he asks if pursuing litigation is in the “public interest.” Commissioner Rosch advises parties to put more emphasis on the public interest question because the FTC will not pursue actions where the harm to consumers is minimal, where it would be a poor use of the FTC’s finite resources, or where the FTC will not be establishing an important proposition of law.

As to its appellate review role, Commissioner Rosch explained that the Administrative Procedures Act requires the FTC to conduct a de novo review of an administrative law judge’s (ALJ) findings of law and fact. Commissioner Rosch is less enamored of de novo review when the FTC reviews an ALJ’s finding of fact, particularly when the issue involves . witness credibility since the ALJ sees the witness live and the FTC does not. In addition, Commissioner Rosch believes that reversing an ALJ’s finding of fact only gives more ammunition for appellate courts. Rightly or wrongly, he believes that the appellate courts’ deference to the FTC’s finding of fact is “bound up” with their assessment of whether the FTC correctly analyzed the question of law. When the courts agree with the FTC’s legal analysis, they faithfully apply the substantial evidence standard. When they do not agree, the FTC’s finding of fact get very little deference. Thus, as a strategic matter, Commissioner Rosch does not think it is wise to reject an ALJ’s factual findings.

In discussing whether there may be something untoward about the FTC having both prosecutorial and judicial roles, Commissioner Rosch commented on the history of judicial challenges to the FTC’s authority. From the creation of the FTC in 1914 until the passage of the Administrative Procedures Act in 1946, no one questioned housing both roles within the FTC. The Act created independent administrative law judges and required agency employees conducting investigations to have no part in the ALJ’s decision-making process. Two recent due process challenges in which Commissioner Rosch was asked to serve as the ALJ, both involving FTC challenges to mergers (Whole Foods/Wild Oats and Inova/Prince William) were dropped before a decision on the claims was reached.

After the Act passed, however, parties have also challenged the structure on due process grounds. The Supreme Court has, up until recently, consistently upheld the constitutionality of Congress’s creating of independent agencies under separation-of-powers challenges, so long as the President nominates and the Senate confirms the principal officers, with the caveat that Congress may constitutionally limit the President to a good cause removal power. However, the tide may be turning with the Supreme Court’s recent decision in Free Enterprise Fund v. Public Company Accounting Oversight Board. In that case, the SEC Commissioners, under authority granted to it by the Sarbanes-Oxley Act, appointed members to the Public Company Accounting Oversight Board (PCAOB) who were only removable by the SEC Commissioners, not the President, for good cause. The Supreme Court held that the removal provisions were unconstitutional because it “added a layer of tenure protection” between the President and the PCAOB and the PCAOB was effectively insulated from the President’s authority. Whether the Supreme Court will revisit the independent agency structure is uncertain, but for now, Commissioner Rosch believes that the FTC’s roles as prosecutor and judge not only finds constitutional support, but is the optimal structure in prosecuting antitrust and consumer protection cases and that the FTC receives more than sufficient supervision from all three branches of the government.

- Randy Shaheen and Chester Choi

Violating the FTC’s Endorsement Guides -- Ethicist Says There’s No App for That

I sometimes find myself telling my kids -- “Just because it’s legal doesn’t make it right.” Thankfully, right and legal do sometimes overlap. Over the weekend the New York Times Ethicist opined on a question about a company that creates iPhone apps and asks its employees to download the app and give it a five star rating. The ethicist objected on several grounds, including reviewing an app that you might have never used, conflict of interest and pressuring employees to do something outside the scope of their employment and about which they might have moral objections.

He might have added a fifth objection - violation of the FTC’s endorsement guides. Not only is the endorsement likely false in some instances, it also appears that the employees are not properly disclosing their affiliation with the app developer in their reviews. This does point out an interesting question, though, concerning the FTC’s revised guides. Many customers may only look at how many stars an app or other product receives from users and not necessarily look at all the individual reviews. So, if an employee properly discloses his or her affiliation with the company in the review but goes ahead and gives the product 5 stars, many potential customers may never even realize the extent to which the “star” rating is based on reviews by employees of the manufacturer. Maybe somebody can develop an app to figure all that out.

- Randy Shaheen

FTC Testimony On Efforts To Protect Consumer Privacy

Last week, FTC Chairman Jon Leibowitz testified before the U.S. Senate Committee on Commerce, Science, and Transportation about the FTC’s efforts to protect consumer privacy. The testimony detailed the FTC’s consumer privacy program over the past few decades, focusing on data security enforcement, identity theft, children’s privacy, and protecting consumers from unwarranted intrusions such as spam and spyware.

Liebowitz highlighted the FTC’s recent attempts to re-examine consumer privacy protection in light of rapidly evolving new technologies. Over the past two decades, the Commission has used two main policy approaches towards protecting consumer privacy: (1) promoting the fair information practices of notice, choice, access and security; and (2) protecting consumers from specific and tangible privacy harms. The testimony briefly discussed the limitations of these traditional models of enforcement in adequately protecting privacy in light of rapid developments in technology. The testimony noted that these policy approaches may place too heavy a burden on consumers to read and understand complex privacy policies. Liebowitz also noted that the they may place too strong an emphasis on financial and other tangible harms from exposure of private information.

This past winter, the FTC held a series of roundtables to explore the privacy challenges posed by emerging technology (see here and here).  A number of concerns were raised during the roundtables, notably that most consumers do not understand the extent to which companies are collecting and using their personal information as well as the limitations of the FTC Fair Information Practices model which places a heavy burden on consumers to read and understand lengthy privacy policies.

Moving forward, the FTC indicated that it will be focused on the following areas:

1. integrating privacy into business practices;
2. simplifying consumer choices about commercial data practices; and
3. improving transparency.

The Commission has indicated that they will release a report on this initiative later this year.

The Commission’s testimony coincided with Rite Aid Corporation’s agreement to settle with the FTC over charges that it failed to protect sensitive financial and medical information of its customers and employees.

- Nancy Perkins and Tiana Russell

Competent and Reliable Scientific Evidence Just Isn't What It Used to Be

The FTC has been promising for awhile to tighten the definition of its "competent and reliable scientific evidence" standard.  Last week, the agency made good on that promise in consent orders reached with a Nestle subsidiary and Iovate Health Sciences.

The orders provide that for certain claims "competent and reliable scientific evidence" is defined as

"at least two adequate and well-controlled human clinical studies of the product, or of an essentially equivalent product, conducted by different researchers, independently of each other, that conform to acceptable designs and protocols and whose results, when considered in light of the entire body of relevant and reliable scientific evidence, are sufficient to substantiate that the representation is true."

"Essentially equivalent" is in turn defined as

"a product that contains the identical ingredients, except for inactive ingredients, (e.g., binders, colors, fillers, excipients), in the same form and dosage, and with the same route of administration (e.g., orally, sub lingually), as the covered product; provided that the Covered Product may contain additional ingredients if reliable scientific evidence generally accepted by experts in the field demonstrates that the amount and combination of additional ingredients is unlikely to impede or inhibit the effectiveness of the ingredients in the Essentially Equivalent Product." 

(There are other new provisions not discussed here, including a requirement that certain claims require FDA approval.)

These new definitions apply in the case of Nestle's Health Care Nutrition division to claims that any drink containing probiotics or any nutritionally complete drink, with certain exceptions, reduce the duration of diarrhea in children under the age of thirteen or reduce absences from daycare or school due to illness.  In the case of Iovate, the new definitions apply more broadly to claims that any dietary supplement, food or drug causes weight loss, including rapid weight loss.

We think the key points from these new definitions is that the FTC has now predetermined that certain claims must be substantiated by:

1. two human clinical studies;
2. that should be evaluated in light of the entire body of scientific evidence; and
3. are conducted on a product with identical active ingredients to the advertised product and in the same form, dosage and route of administration, unless there is sufficient reason to believe that the differences are unlikely to affect the efficacy of the advertised product.

Of course, the FTC has in the past required two clinical trials to substantiate certain claims so the requirement itself is not new.  What is new is determining that up front in a consent order.  Essentially, the FTC has taken the guesswork out of its definition of "clear and competent scientific evidence" and presumably minimized the risk of embarrassing court losses like Lane Labs.

However, for advertisers, the FTC's new definition has potentially significant ramifications.  Several questions, though, remain unanswered.  First, how broadly does the FTC intend to apply its new 2 clinical trial requirement?  Our guess is that the Commission may try to insert the language (or the FDA approval requirement if the claim is a disease claim) in many orders covering health related claims.  Second,the requirement that any supporting tests be conducted on an essentially equivalent product could have a significant impact on advertisers, depending upon how broadly or narrowly the FTC interprets the exception for differences that are unlikely to make a difference.  Advertisers that comes out with a low fat version of a product or makes some other relatively minor product change may now struggle with whether the relevant health claims for the modified product have to be resubstantiated.  Other companies that found it prohibitively expensive to conduct their own research for their product, but instead relied upon clinical studies of the principal ingredient may similarly face some difficult decisions. 

Our two cents worth is that determining in advance the necessary quantity and quality of substantiation for claims ahead of time is an exercise in trying to balance risk: setting too strict a standard that discourages innovation and consumer communications versus allowing advertisements prone to misleading claims because the substantiation bar is set too low (or that courts will interpret general substantiation requirements in a way to harm consumers). Perhaps the benefits outweigh the harm when the product and claims at issue are ones that are unlikely to be truthful in any circumstance (e.g. "lose weight while you watch TV").  In that situation, there is little risk of inadvertently suppressing innovation or consumer communication and significant risk that misleading claims might otherwise be made.  However, when the product and claims are ones that could in some circumstances be substantiated the risk/benefit analysis seems reversed.  In this scenario, product innovation and communication of truthful information to consumers might be overly discouraged while the heightened standard does little to further prevent the communication of misleading information.  In either event, if you know anyone pondering a career path, going into clinical research might not be such a bad idea. 

- Randy Shaheen and Diem-Mi Lu  

FTC: Consumer Debt Dispute Resolution System Broken

As we’ve noted previously on the blog, both the FTC and state attorneys general are stepping up their scrutiny of debt collection firms in this slow economy. Continuing that trend, the FTC recently released a report on the nation’s system for resolving consumer debt disputes, which concludes that the existing mechanisms for adjudicating and arbitrating debt claims are badly in need of reform.

Reflecting concerns expressed during a series of public roundtable discussions with industry, consumer groups, and other stakeholders, the report highlights two primary problems identified by the FTC: (1) the high percentage of default judgments in consumer debt cases (according to the report, between 60 and 95%, depending on the jurisdiction) and (2) the fairness and transparency of arbitration proceedings. The report contains a number of recommendations for debt collectors, arbitration forums, states, and Congress. The report also indicates that the FTC will focus enforcement efforts on debt collectors who attempt to recover time-barred debt without disclosing to the consumer that the statute of limitations has run. Debt collectors also may not accept partial payment on time-barred debt without informing the consumer that this may toll the statute of limitations on the whole debt owed. The report makes clear that both of these practices run afoul of the federal Fair Debt Collection Practices Act.

The report also noted that the National Arbitration Forum (NAF), the leading arbitration forum for consumer debt disputes, recently settled a suit filed by the Minnesota Attorney General. The complaint had accused the NAF of holding itself out as a neutral forum when in fact it had financial ties to the debt collection industry. In the settlement, the NAF agreed to stop conducting consumer debt arbitrations. After the settlement, the American Arbitration Forum also ceased such arbitrations, and a number of large banks removed mandatory pre-dispute arbitration clauses from their credit card contracts. This chain of events led Commissioner Julie Brill to issue a concurring statement urging Congress to ban mandatory arbitration of consumer debt disputes “until the arbitration process can be shown to be fair, transparent, and as affordable as traditional litigation, and until consumers have a meaningful opportunity to opt out of pre-dispute arbitration without losing access to the credit services they seek.”

Some of the reforms advocated by the FTC and Commissioner Brill are actually already in the pipeline. The newly enacted financial regulatory reform legislation empowers the SEC and the new Consumer Financial Protection Bureau to limit mandatory arbitration provisions (see sections 921 and 1028), and several states have recently passed their own reforms. The report states that the FTC will continue to closely monitor consumer debt collection, but the choice of whether and how to implement the report’s recommendations is almost entirely out of the FTC’s hands. Those decisions rest largely with other federal agencies, Congress, state legislatures, arbitration forums, and industry, and only time will tell how these groups will respond. Hopefully whatever reforms are ultimately put in place will not raise the costs of legitimate debt collection practices, preventing collection and settlement firms from lowering interest rates and benefiting businesses and consumers. 

- Nancy Perkins and William Perdue

WEBINAR: Implications of the Consumer Financial Protection Bureau for Retailers and Other Nonbank Financial Services Providers

Does your company provide loans or some type of other financial service to the public? Have you been concerned that your products may be covered by the new Consumer Financial Protection Bureau (CFPB) contemplated by the financial reform legislation that is about to be passed by the Congress?

If so, you might want to tune into the event that our firm, Arnold & Porter LLP, is sponsoring on July 29, 2010, entitled, "Is This a Brave New World? Implications of the CFPB and the FTC for Nonbank Financial Services Providers".

This webinar will go over the proposed jurisdiction of the new CFPB, which is contemplated to be an independent bureau within the Federal Reserve. Importantly, the CFPB would be responsible for consumer protection over financial products and services offered by anyone (both banks and nonbanks) who offers to finance retail goods or services. While banks have been subject to comprehensive supervision for consumer compliance by their primary bank regulators for some time, nonbank entities have not. Thus, for those entities, the legislation will usher in a new supervisory regime that most likely will be different than that of the Federal Trade Commission (FTC), which now has jurisdiction over these entities

This event will highlight the FTC’s historical role over nonbank financial services providers, the expected changes for those entities that will be covered by the CFPB’s jurisdiction, and the anticipated cooperation between the FTC and the CFPB.

We are pleased to have at this event Joel Winston, the Associate Director of the Division of Financial Practices at the FTC’s Bureau of Consumer Protection. Also speaking are Beth DeSimone, Nancy Perkins, and Robert Clark, Arnold & Porter LLP attorneys who work in the consumer credit area.

The event will take place from 12:30 PM to 2:00 PM EDT on July 29, 2010. The event is being offered both in person at Arnold & Porter LLP's Washington DC office as well as via webinar. Lunch will be provided for those who come in person.

For a written analysis of this aspect of the legislation, click here.

UPDATE (8/3/2010): Click here for a link to audio and video recordings of the event.

NAD Process Too Brittle for Wedding Band Wars?

What’s the right metal for your wedding ring? In recent years some jewelers have been encouraging couples saying their “I-dos” to forgo traditional options like gold or platinum in favor of tungsten carbide. Also used in industrial machining and armor-piercing ammunition, this metal is especially popular with grooms--according to a consumer survey by The Knot, almost one in five men’s wedding rings sold in 2009 was made with tungsten carbide. Jeweler Scott Kay, however, recently challenged tungsten carbide’s suitability for use in wedding bands. After refusing to participate in an NAD proceeding brought by Frederick Goldman, Inc., Kay’s claims about tungsten carbide rings may now be under review by the FTC.

It all began last October when Scott Kay held a press conference for the jewelry industry trade press to contest some of the claims being made about tungsten carbide wedding bands. In order to show that these rings are not “hard" and “indestructible”, which he said some unnamed internet retailers have claimed, Kay literally bashed tungsten carbide, shattering a number of tungsten carbide rings by throwing them onto a piece of marble tile and hitting them with a pair of pliers. He later posted a video of his demonstration which declares, “It is the opinion of Scott Kay that carbide is not a practical metal for the use of bridal jewelry.” Kay’s website also depicts magnified images showing that tungsten carbide is porous, which he maintains puts it “at risk of cracking, chipping, or shattering.” Reasoning that a material subject to breaking is not appropriate to symbolize matrimonial commitment, Kay also advertised that “Brittle is NOT for Bridal Jewelry.” The ads urge knot-tiers to choose Kay’s own new line of cobalt alloy rings instead. (Apparently neither Kay nor its competitors think that couples should consider contemporary divorce rates when choosing a wedding band.)

Frederick Goldman, the leading manufacturer of tungsten carbide bands, was none too pleased with Kay’s public metallurgy seminar, and challenged Kay’s claims about the alleged weakness of tungsten carbide and the superiority of cobalt before the NAD. Characterizing Kay’s demonstrations as contrived parlor tricks, Frederick Goldman argued that both Kay’ express claims about tungsten carbide’s brittleness and his implied claim that tungsten carbide bands are not durable enough to withstand a lifetime of normal consumer use were false. Frederick Goldman also challenged Kay’s claims that cobalt rings are produced through a green process and that they can be easily and safely removed in an emergency.

Kay decided against participation in the NAD process, which, of course, is entirely voluntary. Kay maintained that the NAD was not the appropriate forum for this dispute because Kay’s claims “merely respond to” advertising by Frederick Goldman and other tungsten carbide manufacturers, and NAD procedures do not allow for counterclaims. Accordingly, Kay expressed its willingness to defend its advertising in a judicial forum, “where Goldman’s own advertising may be examined in the same light and simultaneously as Scott Kay’s.”

Under the NAD’s procedures, however, “[i]f the advertiser fails to file a substantive written response . . . [NAD] may refer the file to the appropriate government agency . . . .” Faced with Kay’s non-participation, the NAD did just that, sending the matter over to the FTC for further review. Most companies, even if they are confident their comparative claims are substantiated, do not want their file to land on the FTC’s desk. For this reason, among others, voluntary compliance with a NAD investigation is high -- over 90% of companies agree to participate in the process and most of those voluntarily comply with the NAD’s recommendations. The FTC is a public supporter of the NAD and self-regulation generally, and takes NAD referrals seriously. The FTC, however, also recognizes the value of truthful, nondisparaging comparative advertising. Other companies prefer to participate in the NAD process to avoid the more costly airing of the grievance in federal court in a Lanham Act false advertising case (including full blown discovery and in many cases the need to retain survey experts), something Kay apparently welcomes so the fact finder can consider simultaneously both sides of the story. It raises an interesting question of whether the NAD process would be improved or unduly hampered by allowing simultaneous counter challenges.

- Amy Mudge and William Perdue

Groups To FTC: Changes In Technology Warrant Changes To COPPA

The Children’s Online Privacy Protection Act (COPPA) governs online sharing by, and collection of information from, children under age 13. COPPA was initially scheduled for review in 2015, but this past spring the FTC announced that it would accelerate the review “in light of rapidly evolving technology and changes in the way children use and access the Internet.” The FTC invited comments on its review and the comment period closed today.

In response to the FTC’s request, a broad coalition of child advocacy, health, consumer, and privacy groups, the American Academy of Pediatrics, the Center for Digital Democracy, Consumer Federation of America, Consumers Union, the Privacy rights Clearinghouse, and the World Privacy Forum, is urging changes to COPPA designed to address the growth of mobile phones, interactive games, and more sophisticated tracking and targeting technologies.

In their formal comments, the groups asked the FTC to:

1. Extend COPPA’s privacy protections to mobile phones, online gaming consoles, interactive television, and other new digital platforms;
2. Update the definition of “personal information” to include information that permits targeting an individual without necessarily knowing the individual’s identity;
3. Use the criteria developed for the 2008 report to Congress on food marketing to clarify the definition of websites and online services “directed at children”;
4. Close loopholes on when and how a website can contact children multiple times without obtaining parental consent;
5. Require major websites, ad networks, social networks and other online service operators to periodically inform the FTC about their data collection practices; and
6. Investigate the efficacy of Safe Harbor programs and require operators to reapply for continued authorization.

The groups also strongly urged the FTC to develop a separate set of privacy protections for children over the age of 13. The formal comments are available here.

The ball is now in the FTC’s court. We expect to see at least some changes to COPPA as a result of the current review.

- Randy Shaheen and Tiana Russell

Made in the USA (We can’t say this in California)

Fireworks to the tune of “Stars and Stripes Forever,” American flags everywhere—the Fourth always generates a swell of patriotism. Patriotism, for some, extends to supporting US manufacturing operations. Indeed, companies often sacrifice cost savings from sourcing materials overseas (or moving manufacturing operations overseas) so that they can continue to market their products as “Made in USA."

We have previously blogged about both the FTC standard for a “Made in USA” label and the stricter California standard. Both require that final processing or assembly occur in the United States. But while the FTC requires that “all or virtually all” of the costs associated with a product be attributable to domestic parts and processing, California prohibits a “Made in USA” label if the product, “or any article, unit, or part thereof,” is “entirely or substantially” made overseas. California courts have interpreted this strictly, to prohibit the label if any part of a product—perhaps even a single screw—is “substantially” made abroad. (For more information on the two standards, see this article.)

However, the California law is so strict that it may well be self-defeating. Some companies, no matter how well-intentioned, may not be able to meet the California standard because, for example, a minor component is only available overseas. Failure to meet the standard means manufacturers must create special packaging for California—not always feasible—or drop the “Made in USA” label entirely. And once forced to drop the label, companies lose a big incentive to continue domestic sourcing and production, and US jobs may be lost, not gained.

A recent MSNBC.com article highlights this issue. Mag Instruments’ flashlights are almost entirely domestically sourced, satisfying the FTC standard. But two small components — a light bulb and an O-ring “not produced by anyone in the United States” — are imported, and so the Company believes it cannot satisfy the California standard. As a result, the company has had to drop the label entirely. Maglite has recently lost market share to cheaper foreign-sourced and imported products. It has now lost the “Made in USA” label that constituted “[o]ne of [its] advantages . . . in the U.S. market.” Founder Anthony Maglica, an ardent supporter of American-made products, refuses to shift Mag Instruments’ production overseas. But he laments the effects of the California law on US businesses, noting that just like “if you have a little dog, and you want him to do the tricks, you give him a bone,” businesses “need incentive too.”

Of course, one solution is to qualify the claim, for example, “Made in USA of US and foreign components”. Mag Instruments has done just that for its Maglite flashlights. However, this doesn’t solve the problem of many companies being unable to make a “Made in USA” claim under standards adopted by the FTC because of a stricter California law. But for now, as Mag has concluded, it may be better than nothing.

In case the Terminator is reading this, maybe it’s time for California to fall in line behind the FTC.

- Randy Shaheen, Amy Mudge, James Speyer, and Karen Otto

FTC’s Revised Endorsement Guides: No Plans to Monitor Bloggers, But Will Focus on Advertisers

The FTC recently issued “FTC Facts for Business,” answering frequently asked questions about the FTC’s revised endorsement guides, which we have previously blogged about here and here. The FTC Staff took considerable heat for its revised Guides, including critiques that it was targeting bloggers and misunderstood social media, and the FAQs try to eliminate some common misunderstandings -- including the fear that the FTC will be knocking on the doors of teen and mom bloggers and issuing fines.

The Q&As begin by summarizing three truth-in-advertising principles: (1) endorsements must be truthful and not misleading; (2) If the advertiser does not have proof that the endorser’s testimonial represents the typical experience, the ad must clearly and conspicuously disclose generally expected results; and (3) If there is a connection between the endorser and the marketer of the product that would affect how people view the endorsement, then that connection should be disclosed. The FAQ then addressed the following subjects:

About the Endorsement Guides: They are not new, but they are revised. They were revised because they were written in 1980, and needed to be updated to apply in today’s marketing world, which includes blogs and social networking sites. Disclosures are important because an act or practice is deceptive if it misleads “a significant minority.” Contrary to some press releases, there is no fine for not complying with the FTC guide. The FTC has no plans to monitor bloggers, but will continue to focus on advertisers. The guides do not hold online reviewers to a higher standard than reviewers for paper-and-ink publications. Finally, if you are acting on behalf of an advertiser, that is commercial speech which can be regulated under the FTC Act if it is deceptive.

When do the Guides apply to endorsements? They cover endorsements that are made on behalf of a sponsoring advertiser, e.g., where an advertiser pays a blogger or gives him or her something of value to discuss a product. Continuously getting free stuff from an advertiser creates an expectation of future benefits from positive reviews. The guide applies to videos just the same way it applies to websites or blogs. If readers understand that a person is being paid to endorse a product, then a disclosure is not necessary.

How should I make the disclosure? There is no special language, the point is simply to give readers the information. The following types of disclosures are typically not sufficient: a single disclosure on a home page, or a button that says “disclosure, legal.” On the other hand, a disclosure can be sufficient in as many as 8 characters in a tweet: “#paid ad”!

How do the Guides apply to affiliate or network marketing? Small network marketing businesses should tell participants that if they get products through the program, they should be clear they got them for free. With respect to affiliate marketers with links to online retailers who pay commissions, such relationships should be disclosed. Social media marketing networks should set up reasonable monitoring programs and should check up on questionable practices.

What do I need to know about the Guides? You can’t talk about your experience if you haven’t tried it. If you were paid to try something, and you thought it was terrible, you can’t say it was great. You can’t make statements about a product that would require proof you don’t actually have. With respect to testimonials, statements like “results not typical,” will not suffice. You must either have the proof to show the results are typical, or clearly and conspicuously disclose the generally expected performance.

- Amy Mudge and Marianne El Sonbaty

Insecurity is No Tweet

Many people use Twitter to share their deepest feelings to the cyberworld (in 140 characters or less) about topics ranging from their dismay about the current unemployment rate to the joy of Landon Donovan’s dramatic goal in the World Cup. But sometimes Twitter users just want to send private messages to their friends and colleagues and of course, no one wants their private information to be shared with the public or to be misrepresented through phony tweets in such a public forum. However, according to the FTC, Twitter users’ private information may have been at more risk than they were led to believe through Twitter’s privacy disclosures.

Last week, the FTC voted 5-0 to settle charges against Twitter that it deceived consumers by failing to provide the necessary safeguards to protect their personal information. The FTC alleged that “serious lapses” in data security allowed hackers to obtain unauthorized administrative control of Twitter, including access to non-public user information, tweets that consumers designated as private, and the ability to send phony tweets from any user. This was the first case of this kind brought by the FTC against a social networking service.

In its complaint, the FTC alleged that Twitter made several misleading statements on its webpage about the protection of their users’ private information and the ability to make private, direct Twitter messages and to create private Twitter accounts. For example, the Twitter webpage states that users can “send followers private tweets, called direct messages” and that “only author and recipient can view direct messages.” With regard to protected accounts, the webpage states that users “have the option of … protecting the account to keep [their] updates private” and “only approved followers are able to see [their] profile page.”

Vladeck Discusses Policy and Enforcement Issues on Consumer Privacy

On June 3, 2010, FTC BCP Director David Vladeck spoke at the Privacy Law Scholars Conference in Washington, DC. His remarks focused on the issue of privacy and technology. In the 1890’s, Vladeck noted, Louis Brandeis and Samuel Warren wrote about their concerns with the invasiveness of a new technology, the camera. Since that time, we have grappled with the impacts of more and more invasive technology on privacy. Vladeck discussed new technological information practices and the privacy risks they pose. The FTC, he noted, is trying to “address these risks [through policy development and enforcement.] without stifling the dramatic benefits of technological innovation.”

With respect to policy development, Vladeck offered several key messages from roundtables and public discussions: (1) given the volume of information maintained about consumers, it “no longer makes sense to talk about ‘personal information’ and ‘non-personal information’”; (2) because it is now more expensive to destroy than to keep data, data will likely “hang around long enough that it is re-examined and re-purposed for uses that may not have been contemplated at the point of collection”; (3) consumers are still getting up to speed about how information is handled and with whom it is shared; (4) privacy policies, while useful to promote business accountability, are not useful to consumers because they are not located where “consumers need them and they’re too complicated, too vague, and too long.” Vladeck discussed the effort led by a non-profit think tank, the Future of Privacy Forum, along with marketing company WPP, to develop an icon to notify consumers how to make choices about use of their information in behavioral targeting.

With respect to enforcement, Vladeck indicated that a number of non-public investigations are ongoing, including efforts by the FTC to investigate companies in order to determine whether actions are necessary in new technology areas, such as P2P file sharing software. Finally, he discussed the contribution of academic research. As an example, he discussed the assistance academics from the University of Texas made to an investigation FTC conducted of Netflix’s release of “anonymized” movie queue information. The professors made the FTC aware that it was possible to re-identify individuals using the data set. As a result, Netflix agreed to modify its practice.

In the same vein, an FTC representative spoke at a Calgary, Alberta event put on by Canada’s privacy commissioner. The representative’s remarks, reflected frustration with current U.S. privacy laws, including an indictment that they “[aren’t] working,” in particular because “’[w]e’ve put too much burden on the consumers to understand [privacy] policies.’” No one should be surprised to see more FTC enforcement and regulation efforts in this area.

- Nancy Perkins and Marianne El Sonbaty

Establishing the Legal Position of Geographic Location Applications

With the ever-increasing availability and utilization of smartphones and GPS technology, location has become a vehicle through which marketing and social information can be transmitted. "Geo-location" technology has been in existence since 1999 and is well known from applications ("apps") like Google Maps, which enable a user to search for physical places (i.e. hotels, restaurants, stores, tourist attractions) relative to a computer or phone's location. These apps are now becoming more advanced and creative which has led both Congress and the FTC to examine how businesses and the government (should) regulate location-based information.

Geo-location apps, such as Foursquare and Loopt, allow friends to share their location and post comments about places they frequent or visit. The more places one visits and shares with friends, the more points and "badges" that person receives which can be redeemed for discounts and rewards. For example, on May 22nd, Pepsi released "Pepsi Loot" for the iPhone and iPad. This location-based app directs users to restaurants serving Pepsi products, known as "Pop Spots." As visits to these establishments accumulate, a user can obtain rewards, such as free downloads of exclusive music or free Pepsi with an entree purchase.

From a legal standpoint, the use of location-based information produces privacy and data security concerns. The FTC, after holding a town hall on the mobile marketplace in 2008, issued recommendations ("Self Regulatory Principles for Online Behavioral Advertising") for companies seeking to advertise based on a consumer's online activity over time. The FTC recommended that industry self-regulation consist of a requirement of "affirmative express consent" for "material retroactive changes to privacy promises" and for use of "sensitive" data, which should include "precise geographic location information." Companies need to be certain any notice they provide for location-based apps is consistent with their privacy policy; otherwise, they may be subject to privacy violations for "deceptive" notice under Section 5 of the FTC Act.

Location-based apps may trigger a string of laws concerned with protecting personal information, such as:

• the Children's Online Privacy Protection Rule (for online services aimed at children under 13),
• HIPAA and the FTC Health Breach Rule (for covered entities under HIPAA or their "business associates"), 
• FACTA and the FTC Red Flag Rules (for financial institutions with data subject to identity theft),and
• Section 222 of the Federal Communications Act (for telecom providers with customer proprietary network information), and various state data security laws.

In Congress, meanwhile, Representative Rick Boucher (D-Va) and Representative Cliff Stearns (R-Fla) have sponsored an online consumer privacy protection bill, released May 4th, which would require that consumers opt-in before companies collect, use, or disclose "sensitive" data, such as "precise geographical location." More generally, Apple is looking to control third-party targeted advertising, as the most recent iPhone Developer Agreement mandates that third parties get Apple's permission before collecting user data, which would include location-based data, to advertise. The FTC, however, is reported to be investigating potential antitrust issues with this policy.

The bottom line is this: regulators seem to be in agreement that companies should obtain affirmative consent from online consumers before collecting, using, and disclosing their precise geographic location data. How mandatory any requirements might be, how extensive their reach, and where they might come from is still uncertain. Anyone involved in this growing market should watch to see if the legal parameters are clarified in the near future.

Tilting at Windmills: Is the “Unfair and Deceptive” Standard in the FTC Act Really “Unfair”?

On Wednesday, Senator Orrin Hatch (R-Utah)--the ranking minority member on the Senate’s antitrust subcommittee--voiced concern that the standard in Section 5 of the Federal Trade Commission Act for identifying “unfair or deceptive practices” is too vague. Senator Hatch voiced these concerns during a congressional hearing on antitrust enforcement where FTC Chairman Jon Leibowitz testified, detailing the agency’s recent work to promote competition and benefit consumers, such as ending “pay-for-delay” pharmaceutical agreements, preventing anticompetitive mergers, revising the guidelines that the FTC and the Justice Department use to assess horizontal mergers, and using its authority under Section 5 of the FTC Act to combat unfair methods of competition and protect consumers.

Senator Hatch may be tilting at windmills in his quest for a more definitive “unfair and deceptive practices” standard. While the area has been cited as a broad and relatively untested province of antitrust law according to The National Law Journal’s January report, the FTC has long used the authority to rein in unfair trade practices, particularly those that affect consumers. Indeed, the FTC recently exercised its Section 5 authority in challenges involving the likes of Intel Inc., Voice Touch Inc., Ticketmaster Entertainment Inc., and U-Haul International Inc. The FTC has also used this authority recently to rein in pay day loan practices, debt rehabilitation and mortgage foreclosure prevention programs and other practices in the consumer financial area. (For those Supreme Court history buffs we note that way back in 1935 the Supreme Court struck down an attempt by Congress to set up “fair” codes for business competition as unconstitutional because the term was too undefined. It noted with approval, however, the use of the term “unfair” in the FTC Act.)

Furthermore, the FTC has issued policy statements on what is deemed to constitute unfairness and deception, yet Chairman Leibowitz correctly acknowledged that the courts ultimately say what the law is. Chairman Leibowitz attempted to further allay Senator Hatch’s concerns by insisting that he “ha[d] yet to meet a company that has been surprised” by FTC action against conduct it deemed in violation of the FTC Act. Despite the lack of a clear standard, he seemed to suggest, companies were effectively on notice

We note that these standards also are expected to be employed by the proposed Bureau of Consumer Financial Protection under the pending financial reform bill. The bill, as currently written, authorizes the new Bureau to not only prevent a provider from committing or engaging in an “unfair or deceptive act or practice” in connection with any transaction with a consumer for a financial product or service, but also abusive acts or practices. The bill also sets forth what appears to be the current standard used by the FTC for finding an act unfair or deceptive, namely, that (A) the act or practices causes or is likely to cause substantial injury to consumers which is not reasonably avoidable by consumers; and (B) such substantial injury is not outweighed by countervailing benefits to consumers or to competition.

The bill also articulates a standard for what constitutes “abusive” practices: in order to declare an act or practice abusive, the Bureau must find either that it “materially interferes with the ability of a consumer to understand” terms or conditions, or that it “takes unreasonable advantage” of consumers in specified ways.

Thus, it appear that despite Senator Hatch’s views, use of the “unfair and deceptive” standards to rein in what is perceived as egregious practices against consumers is here to stay.

- Beth DeSimone & Caroline DeCell

FTC Revisits COPPA: Time for A Change?

The FTC hosted a workshop last Wednesday aimed at determining whether the Child Online Privacy Protection Act of 1998 (COPPA) continues to remain effective in the ever-changing world of online privacy. COPPA generally prohibits the online collection of personal information from children under the age of thirteen--without notice and parental consent--where a website or online service is directed to children or the operator has actual knowledge of the collection of personal information from children. The FTC has frequently targeted companies for failing to develop or abide by privacy policies that adhere to COPPA guidelines.

Three out of the five panels in the FTC’s program poked and prodded the statutory text, testing its durability and flexibility in different contexts. The first panel examined the definitions of “internet,” “website,” and “online service,” finding that all three terms continue to adequately describe the kinds of media, changed though they may be, that COPPA intended to regulate. The panelists determined that the definition of “internet,” for example, not only continues to be technically accurate, but also encompasses such new developments as mobile browsing. “Online service” remains a capacious term, as Congress intended, that extends beyond the internet, having possible implications for text messaging and other emerging means of communication. (See a previous blog post on this topic here). Because many new services, such as interactive television, carry on the trend toward increased connectivity via the internet, COPPA continues to be widely applicable in new contexts. However, COPPA is still limited by an important caveat: where a website or online service is not operated for commercial purposes, COPPA doesn’t apply.

The second panel investigated the “actual knowledge” standard for operators of websites not otherwise directed to children. Described as an industry victory, Congress’s adoption of this standard in lieu of a more expansive “constructive knowledge” or “knowing” standard provided operators a greater degree of protection, requiring direct and clear knowledge of the collection of personal information from a child in order to trigger COPPA applicability. Panelists contested the adequacy of this standard in light of advertising developments such as behavioral targeting. Some panelists suggested that the term “actual knowledge” could stretch to cover effective knowledge of the age of targeted viewers from behavioral monitoring, potentially blurring the industry-protective line between actual and constructive knowledge embedded in the statute.

In a similar vein, the third panel addressed the question of whether “personal information” includes facts that separately fail to identify an individual (such as an IP address), but, when aggregated, may point to a specific person. The panelists arrived at no clear conclusions.

Whether any changes result from this discussion remains unclear. What does seem clear is that the FTC will continue its vigorous enforcement in this area.

- Randy Shaheen & Danielle Sims

Second Time’s The Charm? Kellogg Agrees to Stronger Consent Order as a Result of FTC Investigation

On June 3, 2010, the Federal Trade Commission (FTC) announced the modification of a 2009 Consent Order entered into with the Kellogg Company related to health benefit claims for its food products. The original 2009 Consent Order related to Kellogg’s® Frosted Mini-Wheats® and the company’s claims that the bite size cereal improved children’s attentiveness. The 2009 Order barred Kellogg from “mak[ing] any representation, in any manner, expressly or by implication. . . about the benefits, performance, or efficacy of [Kellogg’s® Frosted Mini-Wheats® cereal or any other morning food or snack food] for cognitive function, cognitive process, or cognitive health, unless the representation is true, non-misleading, and, at the time made, [Kellogg] possesses and relies upon competent and reliable scientific evidence that substantiates the representation.”

This time, Rice Krispies® cereal brought the parties back to the table. In July of 2009, Kellogg unveiled a new advertising campaign for Rice Krispies® cereal claiming that the product boosts children’s immunity. The timing of the Rice Krispies® campaign and its planning was not lost on the Commission. In a Concurring Statement, Commissioner Julie Brill and Chairman Jon Leibowitz noted, “[w]hat is particularly disconcerting to us is that at the same time that Kellogg was making promises to the Commission regarding Frosted Mini-Wheats, the company was preparing to make problematic claims about Rice Krispies.”

The FTC was not the only one that had a problem with Kellogg’s immunity boosting claims. San Francisco city attorney Dennis Herrera demanded Kellogg remove the immunity claims from the Rice Krispies box, which the company agreed to do in November of 2009. In December of 2009, Kellogg settled with the Oregon Department of Justice and Attorney General John Kroger, destroying two million units of packaging and donating hundreds of thousands of boxes of cereal to Oregon Food Bank and Feeding America.

The new FTC Order entered by the parties expands Kellogg’s agreement to “all foods” and unveils some, but not all, of the new, more specific definitions of “competent and reliable scientific evidence” that the Bureau has been talking about. Specifically, the order requires that evidence relied upon, “is sufficient in quality and quantity based on standards generally accepted in the relevant scientific field when considered in light of the entire body of relevant and reliable scientific evidence, to substantiate that the representation is true.”

For comparison, the FTC’s traditional definition of “competent and reliable scientific evidence” is:

...tests, analyses, research, studies, or other evidence based on the expertise of professionals in the relevant area, that has been conducted and evaluated in an objective manner by persons qualified to do so, using procedures generally accepted in the profession to yield accurate and reliable results.

Probably the most notable difference between the two definitions is the express requirement that the “entire body” of relevant evidence be considered. 

- Randy Shaheen and Jessica Halbert

Leibowitz Addresses FTC Efforts to Protect Consumer Privacy

FTC Chairman Jon Leibowitz spoke earlier this month at the National Cable & Telecommunications Association’s Cable Show 2010. He also recently testified before the U.S. Senate Subcommittee on Financial Services and General Government of the Committee on Appropriations concerning the FTC’s FY 2011 budget request. Both his remarks and testimony reflected the FTC’s commitment to protecting consumer privacy while promoting competition. At the Cable Show, Leibowitz discussed behavioral advertising as it intersects with “consumer choice” and “consumer control” -- the choice consumers have to allow advertisers to chart their personal information, and the control they have to say how or where it is stored. In the cyberspace context, Leibowitz commented, “ ‘notice and consent’ rarely reflect[] a consumers’ conscious informed choice.” So what is being done to address this situation?

First, as Leibowitz discussed, a coalition including the Direct Marketing Association, the Interactive Advertising Bureau, and the Better Business Bureau have proposed behavioral advertising guidelines, encouraging companies to explain their information collection practices for advertising outside their privacy policies.

Second, Congress may end up regulating online data collection, as is reflected by Representative Boucher’s draft legislation, released earlier this month. And, last year the FTC issued a revised set of behavioral advertising self-regulatory principles, including the following: (1) websites need to give consumers the choice as to whether they want their personal information gathered for behavioral advertising, and, as Leibowitz warned, the disclosure should not be a “3-point font, ten-page document written by corporate lawyers and buried deep within the site;” (2) consumer data should be stored securely and only as long as necessary to fulfill a business need; (3) where a company changes its privacy policy, consumers should be informed and allowed to choose whether to continue allowing their data to be collected under the new terms; and (4) companies that use sensitive data in advertising should collect it only after receiving express affirmative consent.

Leibowitz’ testimony before the Senate Subcommittee concerning the FY 2011 budget also described the agency’s efforts and successes in protecting consumer privacy, including pursuing 29 actions against companies that failed to protect consumers’ personal information, obtaining $11 million as part of a settlement preventing false identity theft prevention claims, shutting down a rogue ISP that helped deliver child pornography among other illegal spam, and settling a lawsuit against Sears for not fully disclosing the scope of personal information collected. Efforts to protect consumer privacy are also being made in the areas of social networking, cloud computing, online behavioral advertising, and mobile marketing.

Outside the privacy area, Leibowitz also described the FTC’s continuing efforts to (1) protect financially-strapped consumers; (2) continue enforcement of the Do Not Call Registry; (3) protect children through litigation under the Children’s Privacy Protect Act; (4) promote competition by challenging anti-competitive health care mergers and stopping pay-for-delay drug patent settlements; and (5) protect competition in the technology, energy, and consumer goods services. The FTC requested $314 million to support 1,207 full time employees, up $22.3 million and 40 full time employees from last year.

- Amy Mudge and Marianne El Sonbaty