Consumer Advertising Law Blog

UK Power to Regulate Online Advertising Going Viral?

As a result of a “landmark” decision by the Committee of Advertising Practice (the UK body responsible for writing the advertising codes) the scope of the UK Advertising Standards Authority’s (the body responsible for regulating advertising in the UK) digital remit to regulate online advertising has been significantly extended.

The ASA’s current digital remit only applies to advertisements in e-mails and advertisements in paid-for space online (including, for example, banner and pop-up advertisement) and sales promotions in paid-for space and non-paid-for space online. However, as from 1 March 2011, the ASA will also regulate advertisers’ own marketing communications on their own websites and for other non-paid-for space online under their control (such as social networking sites used to target marketing communications at UK consumers).

The move is being justified on the basis of extending the ASA’s established principles of effective consumer protection and fair competition to the online world. According to ASA Chairman Lord Chris Smith “We have received over 4,500 complaints since 2008 about marketing communications on websites that we couldn’t deal with, but from 1 March anyone who has a concern about a marketing communication online will be able to turn to the ASA”.

Sanctions for breach of the new extended code will include the removal of paid-for search advertising and advertising paid for by the ASA to highlight an advertiser’s continued non-compliance. To fund the new remit, the industry has agreed to apply a 0.1% levy on paid-for advertising appearing on internet search engines through media and search agencies.

See here for full details of the decision. For the current versions of the UK broadcast and non-broadcast advertising codes.

- Richard Dickinson and Jake Marshall

No Cash? No Problem. Grab Your Phone and Charge It! Consumer Protections Included

Leave your ATM cards at home; forget the drive thru at the bank; heck, leave your whole wallet on the kitchen counter -- mobile banking is here and becoming all the rage. Well, maybe not all the rage just yet (like it is in Japan, but certainly, it is becoming easier, with the popularity of the I-Phone and similar devices with interactive capability.

For example, the office supply store, Staples, Inc. reported this month that more than one-fourth of small business owners report having a phone device capable of making mobile payments. About 24% use these devices to make purchases and 3% always do so. Those that do so shop on line frequently. In response to this trend, Staples has enhanced its mobile website.

Other press reports have noted that mobile banking is particularly popular with the young and the underbanked. Indeed, the market research firm Celent reported this month that the attraction of mobile banking lies in ease of access and portability. A lot of the underbanked may not have online access but do have a cell phone. As a result, prepaid card issuers, such as Green Dot are offering mobile account access and intend to upgrade their mobile device offerings.

Banks also are getting in the act, testing new technologies that will allow bank customers to access their accounts and make purchases through their smart phones.

In adopting new banking applications, however, it would be advisable for companies to understand consumers’ rights and the risks. Mobile payment applications are subject to the same banking rules as their technologically older counterparts. Thus, if a user links her phone to a credit card, the consumer protections afforded by federal law to credit cards would apply. These protections limit a consumer’s liability to $50 for unauthorized use (although many credit card issuers have a zero liability policy).

If a user links her phone to a debit card, the consumer protections afforded by federal law to debit cards would apply. These protections also limit a consumer liability for unauthorized use to $50 if the consumer notifies its institution of the unauthorized use within two business days. Otherwise, the liability can go as high as $500.

The protection afforded prepaid cards may differ, depending on the type of card. Payroll cards are given the same protection as debit cards, while other prepaid cards may not provide any protection against unauthorized use at all - they are the equivalent of cash and thus, if there is unauthorized use of the card, it is like your cash has been stolen.

A more insidious risk, however, is the risk that someone not just uses the phone for an unauthorized transaction, but actually hacks into the mobile applications or the merchant’s site, and access consumer account information - taking not just someone’s funds but also potentially their identity.

Consumers Union highlighted some of the these risks in a report issued on Tuesday. While the Consumers Union report focused on consumer risk, and called for possible changes in law, it would be wise for stores or other companies contemplating offering apps for mobile payments to consider data security and other risks, and plan accordingly. Users of mobile payments may want to carefully review the disclosures for the payment mechanism being linked to the phone to know what consumer protections apply to them.

- Beth DeSimone

P2P Users - Upgrade Your Software Before Sharing Your Latest Vacation Pics!

For many of us who did not learn to use a computer keyboard and mouse before we could walk, terms like downloading files using BitTorrent or talking to friends on the Gnutella network sounds like having some dental procedure. But others in this generation, and certainly our kids, use those protocols and networks daily to chat and share pictures and videos with their friends though peer to peer or P2P file-sharing networks.

But the same feature of P2P software that underpins its functionality -- its ability to access and share files on your computer across the Internet -- also creates potential security vulnerabilities. The Federal Trade Commission investigated the reportedly largest provider of these P2P services - Limewire. The FTC alleged that older versions of the Limewire software contained security vulnerabilities that put users at risk of inadvertently sharing personal information, including social security numbers, bank account numbers and other matters, stored on their computers.

Limewire upgraded its software, incorporating safeguards into its user interface to help users avoid the inadvertent sharing of sensitive information. The company also said it would tell consumers to upgrade their Limewire software and inform consumers on how to best avoid inadvertent sharing, even though the company could not force users to upgrade (one version is free and the other is a one-time download for $39.99). In large part for those reasons, and the fact that the FTC found that users tended to upgrade voluntarily at a high rate (undoubtedly wanting the fastest service possible to share their latest creations), the FTC closed the investigation without action.

While no computer connected to the Internet is invulnerable, using the most recent version of P2P software may help reduce the vulnerability of your personal information to unintended disclosure.

- Ronald Lee and Beth DeSimone

TILT: FTC Alleges PR Firm Violated Endorsement Guides by Rating Clients’ Gaming Apps

We recently blogged about a column by the New York Times ethicist which addressed the ethics of an employer asking its employees to favorably rate iPhone apps it developed and noted that the practice likely violated the FTC’s revised Endorsement guides. Well, a similar practice has caught the FTC’s eye resulting in a public relations firm settling an FTC charge that it provided misleading online endorsements.

The agency was hired by video game developers, and the FTC alleges that its employees posted game reviews of the video game apps on the iTunes store site without disclosing that they were working for the app developers and, in some cases, received a percentage of sales. As we noted in our prior blog, failing to disclose such material connections runs afoul of the FTC’s guidelines. The proposed settlement has various standard provisions that one might expect but also includes a requirement that the firm remove any previously posted misleading endorsements.

The FTC issued its revised Testimonial and Endorsement Guides in the fall of last year. It is common when the FTC issues new or revised guidance in an area that a flurry of enforcement activity follows the release of the guidance. In this case, there has only been one closing letter associated with an investigation of a retailer, likely because the FTC has spent considerable time on its own PR efforts trying to clarify that it did not intend to go after individual bloggers. This case should provide comfort in that regard. However, is it "Game Over" for companies that do not have policies in place requiring sponsored bloggers to disclose their connection to the company? Stay tuned . . .

- Randy Shaheen

Redondo Beach Does Not Want to Be Friends

Citing a briar patch of potential legal issues, the City of Redondo Beach, California has for the moment called it quits on Facebook. As reported in the local paper, The Daily Breeze, City Attorney Mike Webb recommended deactivating the city’s Facebook page out of concerns arising from, inter alia:

• The City’s obligation to retain user comments under the California Public Records Act, Cal. Gov. Code § 6250-6270
• First Amendment protections afforded user comments and the potential liability of the City if it blocked or removed offensive comments
• Whether postings by three or more elected officials on a single topic would violate California’s Open Meetings Law, a.k.a. The Brown Act, Cal. Gov. Code § 54950-54963

A video of the city council’s August 17 meeting at which the decision was made, as well as a Power Point presentation outlining the city attorney’s legal analysis of the city’s use of social media, can be seen here starting at 2:26:12. Redondo Beach’s farewell Facebook post can be seen here.

Public and private sector entities face numerous legal pitfalls as they attempt to embrace new technologies, like social networking sites, that offer unprecedented access to constituents or consumers. The instantaneous and extraordinarily public nature of interactions on sites like Facebook requires companies and agencies with legal duties to the public to think twice about how they will manage those interactions. In the case of Redondo Beach, the city chose to take the cautious route and defer the use of Facebook until a day when the courts have provided more definitive answers and guidance regarding the above issues (or until Facebook changes its functionality such that the above issues become moot.) Notably, Redondo Beach continues to maintain a presence on Twitter, Youtube, and Nixle, a public safety social networking platform, because those platforms can be managed to limit the user comments. As noted in The Daily Breeze article, another California city has addressed these issues by providing a Social Media Policy, available to users through the city’s Facebook page, which addresses some of the issues that concerned Redondo Beach.

- Suzanne Wilson and Emilia Morris

Offensive Forum Postings Raise Questions about User Anonymity

While there aren’t necessarily significant legal issues associated with this topic, we thought it worthy of comment given the interesting policy and business issues raised as companies continue to look for the most effective way to utilize social media. It is often difficult to find a comfortable balance between encouraging candor in online postings versus requiring users to take responsibility for their comments. Allow anonymous postings, and risk creating a climate for offensive and hateful comments. Require users to register with their real names, however, and risk discouraging posting altogether. As posts become more and more prolific, however, many websites have increasingly opted for the latter tradeoff, with mixed results.

For example, the Buffalo News recently implemented a policy requiring commenters to provide their real names and hometowns, in order to combat racist responses to news stories. This move follows that of the Attleboro, Massachusetts, Sun Chronicle, which requires commenters to register with names, addresses, phone numbers, and credit cards, and to pay a one-time fee of ninety-nine cents.

Blizzard Entertainment, the producer of the popular online games World of Warcraft and Starcraft II, has also struggled with policing its forums. Although originally scheduled to introduce on July 27 a “RealID” framework that would require forum posters to display their real names, Blizzard dropped the proposal when gamers revolted at the idea of foregoing anonymity. (A World of Warcraft forum thread discussing the change spanned over 2,000 pages with over 40,000 replies).

Well-advised online forum providers will search for a solution in between total anonymity and full disclosure of personal information. Too harsh a policy may totally hinder the online discussion: in the weeks following the Sun Chronicle’s move to its registration system, only twenty-two people have registered to comment. One promising, less extreme technique is to allow the forum to police itself, which may include promoting and demoting comments based on user voting. However, such a system risks demoting comments which are not offensive bur rather simply unpopular. Also, systems for ranking commenters can help create incentives for reputation-building. Some sites also reserve the right to block offensive postings. Ultimately, devising an effective comment-filtering mechanism is crucial to fostering a productive online community.

- Randy Shaheen and Andrew Macurdy

Random and Nonsensical Domain Names Misrepresented Me! Not So, Says CA Supreme Court

While it often seems like there are very few things in life on which everyone can agree, there’s at least one sentiment that unites us - spam e-mail is annoying. It clutters up our inboxes and distracts us from identifying important messages. Many of us accept spam e-mail as a fact of life, but one plaintiff, George F. Kleffman, decided that he had received one too many spam emails from Vonage, a local and long distance phone service provider, and decided to try his luck in court.

In March 2007, Kleffman filed a class action alleging that Vonage violated California Business and Professions Code Section 17529.5(a)(2), which makes it unlawful to send commercial e-mail advertisements if the advertisement “contains or is accompanied by falsified, misrepresented, or forged header information.” Vonage had sent Kleffman 11 spam e-mail advertisements using 11 different domain names that did not include the word “Vonage” in the header. Kleffman did not allege that that there was any “falsified” or “forged” content in the header of any of the e-mails and acknowledged that all of the e-mails were fully traceable to Vonage’s marketing agent. The main thrust of Kleffman’s argument was that Vonage’s use of multiple “random” and “nonsensical” domain names -- some examples include “fromycompanysite.com” and “urgrtquirkz.com” -- was a deliberate strategy to conceal the single source of the spam e-mails in order to bypass spam filters. Thus, Kleffman argued that Vonage’s multiple domain strategy amounted to a “misrepresentation” under section 17529.5(a)(2) because the statute permits spam emails sent from multiple domain names only if “they are not deceptive by virtue of their utterly random and nonsensical nature.”

After the federal district court granted Vonage’s motion to dismiss, Kleffman appealed to the Ninth Circuit, which certified to the California Supreme Court the issue of whether Vonage’s sending spam e-mails using multiple domain names for the purpose of bypassing spam filters constitutes “misrepresented” header information under Section 175529.5(a)(2).

In unanimously affirming the district court decision to grant the motion to dismiss, the California Supreme Court concluded that an e-mail with an accurate and traceable domain name, even if it is “random” or “nonsensical,” does not “misrepresent” header information under section 17529.5(a)(2) because it makes no false representation of fact. The Court reasoned that, as a matter of law, “the use of an accurate and traceable domain name in an e-mail could not be reasonably understood to be an implied assertion that the source of that e-mail is different from the source of another e-mail containing a different domain name.” Therefore, there was no misrepresentation as defined by the statute in this case. The court also rejected Kleffman's attempt to expand the definition of “misrepresented” header information to include “deceptive” or “misleading” header information (by analogizing to California B&P Code Section 17200) because the legislative history did not support Kleffman's expansive statutory interpretation.

At bottom, the California Supreme Court conducted a detailed analysis of the specific word of the statute, and refused to go beyond their meaning -- even if it means more spam for our already cluttered inboxes.

- Sean Morris and Chester Choi

Groups To FTC: Changes In Technology Warrant Changes To COPPA

The Children’s Online Privacy Protection Act (COPPA) governs online sharing by, and collection of information from, children under age 13. COPPA was initially scheduled for review in 2015, but this past spring the FTC announced that it would accelerate the review “in light of rapidly evolving technology and changes in the way children use and access the Internet.” The FTC invited comments on its review and the comment period closed today.

In response to the FTC’s request, a broad coalition of child advocacy, health, consumer, and privacy groups, the American Academy of Pediatrics, the Center for Digital Democracy, Consumer Federation of America, Consumers Union, the Privacy rights Clearinghouse, and the World Privacy Forum, is urging changes to COPPA designed to address the growth of mobile phones, interactive games, and more sophisticated tracking and targeting technologies.

In their formal comments, the groups asked the FTC to:

1. Extend COPPA’s privacy protections to mobile phones, online gaming consoles, interactive television, and other new digital platforms;
2. Update the definition of “personal information” to include information that permits targeting an individual without necessarily knowing the individual’s identity;
3. Use the criteria developed for the 2008 report to Congress on food marketing to clarify the definition of websites and online services “directed at children”;
4. Close loopholes on when and how a website can contact children multiple times without obtaining parental consent;
5. Require major websites, ad networks, social networks and other online service operators to periodically inform the FTC about their data collection practices; and
6. Investigate the efficacy of Safe Harbor programs and require operators to reapply for continued authorization.

The groups also strongly urged the FTC to develop a separate set of privacy protections for children over the age of 13. The formal comments are available here.

The ball is now in the FTC’s court. We expect to see at least some changes to COPPA as a result of the current review.

- Randy Shaheen and Tiana Russell

FTC’s Revised Endorsement Guides: No Plans to Monitor Bloggers, But Will Focus on Advertisers

The FTC recently issued “FTC Facts for Business,” answering frequently asked questions about the FTC’s revised endorsement guides, which we have previously blogged about here and here. The FTC Staff took considerable heat for its revised Guides, including critiques that it was targeting bloggers and misunderstood social media, and the FAQs try to eliminate some common misunderstandings -- including the fear that the FTC will be knocking on the doors of teen and mom bloggers and issuing fines.

The Q&As begin by summarizing three truth-in-advertising principles: (1) endorsements must be truthful and not misleading; (2) If the advertiser does not have proof that the endorser’s testimonial represents the typical experience, the ad must clearly and conspicuously disclose generally expected results; and (3) If there is a connection between the endorser and the marketer of the product that would affect how people view the endorsement, then that connection should be disclosed. The FAQ then addressed the following subjects:

About the Endorsement Guides: They are not new, but they are revised. They were revised because they were written in 1980, and needed to be updated to apply in today’s marketing world, which includes blogs and social networking sites. Disclosures are important because an act or practice is deceptive if it misleads “a significant minority.” Contrary to some press releases, there is no fine for not complying with the FTC guide. The FTC has no plans to monitor bloggers, but will continue to focus on advertisers. The guides do not hold online reviewers to a higher standard than reviewers for paper-and-ink publications. Finally, if you are acting on behalf of an advertiser, that is commercial speech which can be regulated under the FTC Act if it is deceptive.

When do the Guides apply to endorsements? They cover endorsements that are made on behalf of a sponsoring advertiser, e.g., where an advertiser pays a blogger or gives him or her something of value to discuss a product. Continuously getting free stuff from an advertiser creates an expectation of future benefits from positive reviews. The guide applies to videos just the same way it applies to websites or blogs. If readers understand that a person is being paid to endorse a product, then a disclosure is not necessary.

How should I make the disclosure? There is no special language, the point is simply to give readers the information. The following types of disclosures are typically not sufficient: a single disclosure on a home page, or a button that says “disclosure, legal.” On the other hand, a disclosure can be sufficient in as many as 8 characters in a tweet: “#paid ad”!

How do the Guides apply to affiliate or network marketing? Small network marketing businesses should tell participants that if they get products through the program, they should be clear they got them for free. With respect to affiliate marketers with links to online retailers who pay commissions, such relationships should be disclosed. Social media marketing networks should set up reasonable monitoring programs and should check up on questionable practices.

What do I need to know about the Guides? You can’t talk about your experience if you haven’t tried it. If you were paid to try something, and you thought it was terrible, you can’t say it was great. You can’t make statements about a product that would require proof you don’t actually have. With respect to testimonials, statements like “results not typical,” will not suffice. You must either have the proof to show the results are typical, or clearly and conspicuously disclose the generally expected performance.

- Amy Mudge and Marianne El Sonbaty

Insecurity is No Tweet

Many people use Twitter to share their deepest feelings to the cyberworld (in 140 characters or less) about topics ranging from their dismay about the current unemployment rate to the joy of Landon Donovan’s dramatic goal in the World Cup. But sometimes Twitter users just want to send private messages to their friends and colleagues and of course, no one wants their private information to be shared with the public or to be misrepresented through phony tweets in such a public forum. However, according to the FTC, Twitter users’ private information may have been at more risk than they were led to believe through Twitter’s privacy disclosures.

Last week, the FTC voted 5-0 to settle charges against Twitter that it deceived consumers by failing to provide the necessary safeguards to protect their personal information. The FTC alleged that “serious lapses” in data security allowed hackers to obtain unauthorized administrative control of Twitter, including access to non-public user information, tweets that consumers designated as private, and the ability to send phony tweets from any user. This was the first case of this kind brought by the FTC against a social networking service.

In its complaint, the FTC alleged that Twitter made several misleading statements on its webpage about the protection of their users’ private information and the ability to make private, direct Twitter messages and to create private Twitter accounts. For example, the Twitter webpage states that users can “send followers private tweets, called direct messages” and that “only author and recipient can view direct messages.” With regard to protected accounts, the webpage states that users “have the option of … protecting the account to keep [their] updates private” and “only approved followers are able to see [their] profile page.”

Vladeck Discusses Policy and Enforcement Issues on Consumer Privacy

On June 3, 2010, FTC BCP Director David Vladeck spoke at the Privacy Law Scholars Conference in Washington, DC. His remarks focused on the issue of privacy and technology. In the 1890’s, Vladeck noted, Louis Brandeis and Samuel Warren wrote about their concerns with the invasiveness of a new technology, the camera. Since that time, we have grappled with the impacts of more and more invasive technology on privacy. Vladeck discussed new technological information practices and the privacy risks they pose. The FTC, he noted, is trying to “address these risks [through policy development and enforcement.] without stifling the dramatic benefits of technological innovation.”

With respect to policy development, Vladeck offered several key messages from roundtables and public discussions: (1) given the volume of information maintained about consumers, it “no longer makes sense to talk about ‘personal information’ and ‘non-personal information’”; (2) because it is now more expensive to destroy than to keep data, data will likely “hang around long enough that it is re-examined and re-purposed for uses that may not have been contemplated at the point of collection”; (3) consumers are still getting up to speed about how information is handled and with whom it is shared; (4) privacy policies, while useful to promote business accountability, are not useful to consumers because they are not located where “consumers need them and they’re too complicated, too vague, and too long.” Vladeck discussed the effort led by a non-profit think tank, the Future of Privacy Forum, along with marketing company WPP, to develop an icon to notify consumers how to make choices about use of their information in behavioral targeting.

With respect to enforcement, Vladeck indicated that a number of non-public investigations are ongoing, including efforts by the FTC to investigate companies in order to determine whether actions are necessary in new technology areas, such as P2P file sharing software. Finally, he discussed the contribution of academic research. As an example, he discussed the assistance academics from the University of Texas made to an investigation FTC conducted of Netflix’s release of “anonymized” movie queue information. The professors made the FTC aware that it was possible to re-identify individuals using the data set. As a result, Netflix agreed to modify its practice.

In the same vein, an FTC representative spoke at a Calgary, Alberta event put on by Canada’s privacy commissioner. The representative’s remarks, reflected frustration with current U.S. privacy laws, including an indictment that they “[aren’t] working,” in particular because “’[w]e’ve put too much burden on the consumers to understand [privacy] policies.’” No one should be surprised to see more FTC enforcement and regulation efforts in this area.

- Nancy Perkins and Marianne El Sonbaty

Establishing the Legal Position of Geographic Location Applications

With the ever-increasing availability and utilization of smartphones and GPS technology, location has become a vehicle through which marketing and social information can be transmitted. "Geo-location" technology has been in existence since 1999 and is well known from applications ("apps") like Google Maps, which enable a user to search for physical places (i.e. hotels, restaurants, stores, tourist attractions) relative to a computer or phone's location. These apps are now becoming more advanced and creative which has led both Congress and the FTC to examine how businesses and the government (should) regulate location-based information.

Geo-location apps, such as Foursquare and Loopt, allow friends to share their location and post comments about places they frequent or visit. The more places one visits and shares with friends, the more points and "badges" that person receives which can be redeemed for discounts and rewards. For example, on May 22nd, Pepsi released "Pepsi Loot" for the iPhone and iPad. This location-based app directs users to restaurants serving Pepsi products, known as "Pop Spots." As visits to these establishments accumulate, a user can obtain rewards, such as free downloads of exclusive music or free Pepsi with an entree purchase.

From a legal standpoint, the use of location-based information produces privacy and data security concerns. The FTC, after holding a town hall on the mobile marketplace in 2008, issued recommendations ("Self Regulatory Principles for Online Behavioral Advertising") for companies seeking to advertise based on a consumer's online activity over time. The FTC recommended that industry self-regulation consist of a requirement of "affirmative express consent" for "material retroactive changes to privacy promises" and for use of "sensitive" data, which should include "precise geographic location information." Companies need to be certain any notice they provide for location-based apps is consistent with their privacy policy; otherwise, they may be subject to privacy violations for "deceptive" notice under Section 5 of the FTC Act.

Location-based apps may trigger a string of laws concerned with protecting personal information, such as:

• the Children's Online Privacy Protection Rule (for online services aimed at children under 13),
• HIPAA and the FTC Health Breach Rule (for covered entities under HIPAA or their "business associates"), 
• FACTA and the FTC Red Flag Rules (for financial institutions with data subject to identity theft),and
• Section 222 of the Federal Communications Act (for telecom providers with customer proprietary network information), and various state data security laws.

In Congress, meanwhile, Representative Rick Boucher (D-Va) and Representative Cliff Stearns (R-Fla) have sponsored an online consumer privacy protection bill, released May 4th, which would require that consumers opt-in before companies collect, use, or disclose "sensitive" data, such as "precise geographical location." More generally, Apple is looking to control third-party targeted advertising, as the most recent iPhone Developer Agreement mandates that third parties get Apple's permission before collecting user data, which would include location-based data, to advertise. The FTC, however, is reported to be investigating potential antitrust issues with this policy.

The bottom line is this: regulators seem to be in agreement that companies should obtain affirmative consent from online consumers before collecting, using, and disclosing their precise geographic location data. How mandatory any requirements might be, how extensive their reach, and where they might come from is still uncertain. Anyone involved in this growing market should watch to see if the legal parameters are clarified in the near future.

FTC Revisits COPPA: Time for A Change?

The FTC hosted a workshop last Wednesday aimed at determining whether the Child Online Privacy Protection Act of 1998 (COPPA) continues to remain effective in the ever-changing world of online privacy. COPPA generally prohibits the online collection of personal information from children under the age of thirteen--without notice and parental consent--where a website or online service is directed to children or the operator has actual knowledge of the collection of personal information from children. The FTC has frequently targeted companies for failing to develop or abide by privacy policies that adhere to COPPA guidelines.

Three out of the five panels in the FTC’s program poked and prodded the statutory text, testing its durability and flexibility in different contexts. The first panel examined the definitions of “internet,” “website,” and “online service,” finding that all three terms continue to adequately describe the kinds of media, changed though they may be, that COPPA intended to regulate. The panelists determined that the definition of “internet,” for example, not only continues to be technically accurate, but also encompasses such new developments as mobile browsing. “Online service” remains a capacious term, as Congress intended, that extends beyond the internet, having possible implications for text messaging and other emerging means of communication. (See a previous blog post on this topic here). Because many new services, such as interactive television, carry on the trend toward increased connectivity via the internet, COPPA continues to be widely applicable in new contexts. However, COPPA is still limited by an important caveat: where a website or online service is not operated for commercial purposes, COPPA doesn’t apply.

The second panel investigated the “actual knowledge” standard for operators of websites not otherwise directed to children. Described as an industry victory, Congress’s adoption of this standard in lieu of a more expansive “constructive knowledge” or “knowing” standard provided operators a greater degree of protection, requiring direct and clear knowledge of the collection of personal information from a child in order to trigger COPPA applicability. Panelists contested the adequacy of this standard in light of advertising developments such as behavioral targeting. Some panelists suggested that the term “actual knowledge” could stretch to cover effective knowledge of the age of targeted viewers from behavioral monitoring, potentially blurring the industry-protective line between actual and constructive knowledge embedded in the statute.

In a similar vein, the third panel addressed the question of whether “personal information” includes facts that separately fail to identify an individual (such as an IP address), but, when aggregated, may point to a specific person. The panelists arrived at no clear conclusions.

Whether any changes result from this discussion remains unclear. What does seem clear is that the FTC will continue its vigorous enforcement in this area.

- Randy Shaheen & Danielle Sims

Leibowitz Addresses FTC Efforts to Protect Consumer Privacy

FTC Chairman Jon Leibowitz spoke earlier this month at the National Cable & Telecommunications Association’s Cable Show 2010. He also recently testified before the U.S. Senate Subcommittee on Financial Services and General Government of the Committee on Appropriations concerning the FTC’s FY 2011 budget request. Both his remarks and testimony reflected the FTC’s commitment to protecting consumer privacy while promoting competition. At the Cable Show, Leibowitz discussed behavioral advertising as it intersects with “consumer choice” and “consumer control” -- the choice consumers have to allow advertisers to chart their personal information, and the control they have to say how or where it is stored. In the cyberspace context, Leibowitz commented, “ ‘notice and consent’ rarely reflect[] a consumers’ conscious informed choice.” So what is being done to address this situation?

First, as Leibowitz discussed, a coalition including the Direct Marketing Association, the Interactive Advertising Bureau, and the Better Business Bureau have proposed behavioral advertising guidelines, encouraging companies to explain their information collection practices for advertising outside their privacy policies.

Second, Congress may end up regulating online data collection, as is reflected by Representative Boucher’s draft legislation, released earlier this month. And, last year the FTC issued a revised set of behavioral advertising self-regulatory principles, including the following: (1) websites need to give consumers the choice as to whether they want their personal information gathered for behavioral advertising, and, as Leibowitz warned, the disclosure should not be a “3-point font, ten-page document written by corporate lawyers and buried deep within the site;” (2) consumer data should be stored securely and only as long as necessary to fulfill a business need; (3) where a company changes its privacy policy, consumers should be informed and allowed to choose whether to continue allowing their data to be collected under the new terms; and (4) companies that use sensitive data in advertising should collect it only after receiving express affirmative consent.

Leibowitz’ testimony before the Senate Subcommittee concerning the FY 2011 budget also described the agency’s efforts and successes in protecting consumer privacy, including pursuing 29 actions against companies that failed to protect consumers’ personal information, obtaining $11 million as part of a settlement preventing false identity theft prevention claims, shutting down a rogue ISP that helped deliver child pornography among other illegal spam, and settling a lawsuit against Sears for not fully disclosing the scope of personal information collected. Efforts to protect consumer privacy are also being made in the areas of social networking, cloud computing, online behavioral advertising, and mobile marketing.

Outside the privacy area, Leibowitz also described the FTC’s continuing efforts to (1) protect financially-strapped consumers; (2) continue enforcement of the Do Not Call Registry; (3) protect children through litigation under the Children’s Privacy Protect Act; (4) promote competition by challenging anti-competitive health care mergers and stopping pay-for-delay drug patent settlements; and (5) protect competition in the technology, energy, and consumer goods services. The FTC requested $314 million to support 1,207 full time employees, up $22.3 million and 40 full time employees from last year.

- Amy Mudge and Marianne El Sonbaty

Digital Marketing of Alcohol Products Placed Under Microscope

Gone are the days when alcohol marketing consisted only of catchy slogans, like "Guinness is Good for You" and "This Bud's for You." Today, alcohol advertising often comes in the form of online games, quizzes, videos, screensavers, discussion boards, customized music - even "interactive residences." This content advertising is found not only on a supplier's website, but also on social networking sites, such as Facebook. Concern over how much youth are exposed to these marketing items, and their subsequent effects, is what sparked a recent report by the Center for Digital Democracy ("Alcohol Marketing in the Digital Age") calling for investigative action by the FTC and state attorneys general into the adequacy of self-regulatory measures taken by alcohol companies in online advertising.

Alcohol companies are utilizing social networks to market their brands in various methods. On Facebook, for example, a company can sponsor social games, blogs, groups, fan pages, videos, widgets (applications), events, and polls (see the report for numerous specific examples). The marketing then typically goes "viral," as users pass along the video, information, or applications to others.

The report raises at least two interesting questions.  First, what constitutes a sufficient age verification mechanism. Initially recommended by the FTC in a 1999 report, age verification mechanisms are now found on most alcohol company web sites and typically require entry of a user's birthdate.  To combat fraud, the FTC has urged companies to utilize "tools to prevent minors from back-clicking to change their birth date" (2008 report) and ensure their "web site content is not likely to appeal to minors" (2003 report).

Age verification is also an issue for alcohol related pages on social networking sites, since such sites are very popular with the teenage demographic (a third of Facebook users are twenty years old or younger). In a 2008 report, the FTC did not need to address the issue (except in a footnote), since Facebook did not yet accept advertising from alcohol companies. Facebook now permits alcohol advertising if it meets its prescribed guidelines, requiring that ads be "targeted to people 21 years or older" (in the US) and that "Facebook Pages" possess "viewer restrictions" set at 21 years of age. (it appears that Facebook provides access depending upon the age profile of the user) 

However, the CDD report suggests that content from age restricted sites is "rebroadcast" by visitors to these sites in a manner that results in little if any age restrictions.  (We note that the Bud Light Facebook page asks visitors to only share the content "with friends 21 and older.)  A 2009 study by the Marin Institute tested this issue.  Its authors created two Facebook user profiles, one under-21 and one over-21. To attract alcohol advertising, they placed terms like "drinking," "partying," and "bars" in the "Interests" and Activities" sections of their profiles. They found that the number of paid alcohol ads is minor "compared to the tens of thousands of alcohol-related Pages, Applications, Events, and Groups" subject to few guidelines. Much of that content is "accessible to users of every age."  Of course, the fact that such "rebroadcasting" occurs does not necessarily mean that the advertiser is legally responsible for any dissemination of its advertising materials other than its own. 

So what actions is the CDD calling for?  It is recommending that the industry set stronger self-regulatory codes and that the FTC investigate the effectiveness of age-verification systems, among other things. The Center thinks Congress and the FTC's relatively recent foray into interactive consumer advertising has been mostly focused on "the impact on personal privacy of commercial data collection policies"; therefore, the time may be ripe for the FTC to address alcohol marketing on social networking sites (the issue has even spread beyond the U.S.). Stay tuned to see if the FTC decides to address these issues, which have potential ramifications that reach beyond simply alcohol marketing. 

Randy Shaheen and John Eason

FDA’s New Internet Research: Connecting “Unbranded” Websites to Drug Manufacturers and Faulting Manufacturers for the Content

FDA has again made clear its interest in ensuring that “less traditional” forms of marketing of FDA-regulated products do not mislead consumers or otherwise pose a potential risk to public health. Back in November 2009, FDA held a public hearing and opened a docket on promotion of medical products using the Internet and social media tools, such as Google searches, Twitter, Facebook, and Wikipedia. This hearing alerted companies to increased FDA scrutiny of, among other things, company-sponsored websites and third-party websites that may be receiving manufacturer grants or other funding.

On April 21, 2010, FDA’s Division of Drug marketing, Advertising, and Communications (DDMAC) issued a Warning Letter to Novartis Pharmaceuticals Corporation concerning two disease awareness sites sponsored by Novartis, www.gistalliance.com and www.cmlalliance.com -- even though these websites nowhere mentioned the Novartis cancer drug by name, Gleevec®. FDA nonetheless considered these websites to be “branded promotional materials for Gleevec” that promoted the drug for an unapproved use, failed to disclose risk information, and made unsubstantiated dosing claims that could “put patients at higher risk of experiencing serious adverse events.”

FDA did some detective work in linking the two disease awareness sites to Gleevec. Among other alleged connections, FDA found that the two websites were:

• “perceptually similar” to the Novartis Gleevec product site” in that both included a “distinct orange” color scheme and similar design layouts, for example;
• registered to Novartis;
• contained numerous specific references to a set of clinical guidelines that recommend Gleevec exclusively for first-line treatment of the two cancers discussed in the websites, chronic myeloid leukemia (CML) and gastrointestinal stromal tumors (GIST);
• discussed the use of a certain class of anti-cancer drugs for first-line treatment of CML and GIST, often in conjunction with the Novartis name -- yet Gleevec is the only product in this drug class indicated for these uses and the only one made by Novartis for these uses, details that are “well known in the oncology community”; and
• presented data and corresponding literature references with titles that included the established name of the drug (imatinib), and at least one of these literature references described the pivotal clinical study submitted to FDA in support of the Gleevec approval.

These and other factors made FDA consider the websites “Gleevec-specific promotions” and thus subject to FDA regulation. FDA identified in these promotional sites a number of alleged violations, including promotion of an unapproved use for Gleevec and omission or minimization of risks associated with the drug.

FDA did further detective work in tracing back to Novartis a third website, www.bloodleveltesting.com, which was prominently displayed on the two main “Gleevec-branded” websites above and which included allegedly unsubstantiated dosing claims for Gleevec. A pop-up disclaimer for this third website -- you are “moving to an external website independently operated and not managed by the Novartis Pharmaceuticals Corporation” -- did nothing to dispel FDA’s belief that Novartis was responsible for its content. Among other links to Novartis, FDA found that the website was registered to Novartis, included repeated references to Novartis and hyperlinks to the two “Gleevec-branded” websites above, and identified no other pharmaceutical manufacturers or drugs in Gleevec’s drug class except Novartis and imatinib (Gleevec’s established drug name), respectively. That Novartis offered a Blood Level Testing Program at no cost to healthcare providers further suggested a link between the company and the site www.bloodleveltesting.com. Finding Novartis “at least partly responsible for the content of this website,” FDA faulted Novartis for the website’s unsubstantiated dosing claims, which FDA found “deeply troubl[ing]” from a public health perspective.

This Warning Letter confirms what the November 2009 public hearing, and an earlier batch of Untitled Letters concerning “sponsored-links” (issued on March 26, 2009 and posted in April 2009 here), already indicated: websites, even apparently “unbranded” websites, are under increasing FDA scrutiny. Companies should be careful about how connected they are to disease awareness and other informational sites. Too many connections -- even despite pop-up disclaimers and the like -- may cause FDA to consider the websites promotional materials and fault the company for any information therein that may be misleading or otherwise in violation of the Federal Food, Drug, and Cosmetic Act.

- Margaret Renner and Daniel Kracov

Retailer’s Close Encounter With New FTC Endorsement Guides

We have previously blogged here about the FTC’s revised guidelines governing endorsements and testimonials. Among other things the guidelines state that bloggers who receive cash or in-kind payment to review a product may be considered an endorser of that product. As a result, any material connections between the company and the blogger must be disclosed and companies could be held liable for any claims the bloggers may make about their products.

The new guidelines caused quite a stir in the blogosphere, along with apocalyptical predictions, but in one of its first investigations under the new guidelines the FTC decided to be merciful. On April 20, 2010, the FTC notified Ann Taylor through a letter that it was closing its investigation of content posted by bloggers who attended a January 2010 preview of Ann Taylor LOFT’s Summer 2010 collection. LOFT invited bloggers to attend the preview, offering a “special gift,” and promising those that wrote about the event that they would be entered into a “mystery gift-card drawing” worth $50 to $500. Ann Taylor posted a sign at the preview that told bloggers that they should disclose the gifts they received in their coverage of the event, but according to the FTC it was not clear how many bloggers actually saw the sign.

The FTC decided not to recommend an enforcement action against LOFT based on three factors. First, the January 26, 2010 preview was the first and only event LOFT had held up to the date of the closing letter. Second, only a small number of bloggers actually posted content about the preview, and several of the bloggers disclosed that the company had provided them gifts at the preview. Third, LOFT adopted a written policy in February 2010 stating that it would not issue any gift to any blogger without first telling the blogger that the blogger must disclose the gift in their blog. The FTC did state that it expects LOFT to honor its written policy and that LOFT must take reasonable steps to monitor bloggers’ compliance with the obligation to disclose gifts they receive from LOFT.

- Randy Shaheen and Chester Choi

Long-Awaited Consumer Privacy Bill Announced by House Committee

Today, the House Energy and Commerce Committee released a bipartisan, draft proposal of new legislation to protect consumer privacy both on and off the Internet. The proposed legislation would require entities that collect “covered information” from at least 5,000 individuals in any 12-month period to give individual notice of the entity’s privacy policy and request consent before collecting, using, or disclosing their “covered information.” 

The bill defines “covered information” broadly to include personal data such as a consumer’s name, address, social security number, medical records, and financial information. However, the bill’s restrictions and requirements are principally focused on the use and disclosure of such information for advertising or marketing purposes, and generally would not apply to uses and disclosures of information collected for conducting a “transaction” or “operation” at the request of or under an agreement with the individual.

Before collecting any of the covered personal information other than for “transaction” or “operations” purposes, companies would generally be required under the bill to provide notice of the company’s privacy policy and the intended uses of the data. If the information is being collected over the internet, the notice must be posted conspicuously on the web site. Otherwise, the company must provide the consumer with a written copy of the notice. The notice must, among a number of requirements, describe who the company is that is collecting the information, how they will collect it, what it will be used for, how long the company will keep it, and under what circumstances the company will disclose it to others.

Although the bill requires the consumer’s consent before a company can collect, use, or disclose the consumer’s information, it generally assumes consent unless the consumer opts out. This means that if the individual consumer either affirmatively agrees to the use of their information or does not respond either way, then the company may use their information. Companies will only be prevented from using an individual consumer’s information if the consumer actively denies consent. This “opt out” consent does not apply in three situations. First, a company must get affirmative consent before collecting or disclosing sensitive information about the consumer. Sensitive information includes a consumer’s medical records, financial information, location, race, religion, or sexual orientation. Second, a company may not release any of the consumer’s data to another company without express consent. Third, and finally, a company cannot collect or disclose all or substantially all of a consumer’s online activity without express consent.

Under the proposed legislation, the Federal Trade Commission (FTC) would be responsible for enforcing the bill. The FTC would have the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. § 41 et seq.) were incorporated into the bill. The FTC would also be able to make rules as needed to carry out the bill. State attorneys general would also be able to enforce the bill through civil actions in federal court, subject to the intervention of the FTC. However, there would be no private right of action to enforce the bill.

- Nancy Perkins and Peter Roman

Social Networking Site Gets Tagged . . . Again

Earlier this week, the San Francisco District Attorney announced that the city had reached a $650,000 settlement with Tagged.com over allegations of unfair business practices. We previously blogged here about the settlements totaling $750,000 that Tagged reached in November 2009 with the states of New York and Texas over similar allegations.

The San Francisco settlement is especially noteworthy because it marks an expansion of the company’s legal obligations pursuant to the injunctions entered in New York and Texas. Under the San Francisco settlement, in addition to providing clear and conspicuous disclosures prior to accessing a customer’s email contacts, Tagged must also implement new procedures allowing customers to read and approve any message sent under that customer’s name to the people in the customer’s email contacts list.

As we previously noted, social networking sites and web-based member communities must remain abreast of the data security and privacy laws of the jurisdictions (local, state, and national) in which they and their members reside (Tagged.com is based in San Francisco). Failure to do so could lead to similar consequences, including interruptions in regular business operations and multiple sources of potential liability.

- Taja-Nia Y. Henderson

No Decision on Legality of Search Engine’s Sale of Keywords

Last month, Google Inc. and Rescuecom Corp. settled their long fight over Google’s sale of the RESCUECOM mark as a search engine keyword, which permitted Rescuecom’s competitors to display “sponsored listings” when Internet users searched for Rescuecom. The dismissal settles Rescuecom’s trademark infringement and dilution claims, and comes after the parties took their dispute up to the Second Circuit, which found in favor of Rescuecom and remanded the case for further proceedings. The dismissal itself contains no clues as to why the parties finally decided to end their six-year dispute.

The Rescuecom case is just one of many trademark infringement and dilution cases filed in the US and in Europe against Google’s sale of third party trademarks as keywords in its AdWords program. For years, Google has defended these sales, and its “suggestion” tool that prompts customers to purchase the trademarks of others, by claiming that these sales do not fall within the definition of “use in commerce” under the Lanham Act’s trademark provisions. This has been a thorny issue for trademark owners, particularly in the Second Circuit, which includes New York. Last year, the Second Circuit’s decision in favor of Rescuecom cleared the way for trademark plaintiffs who sought to proceed past the complaint stage in lawsuits against search engines to be able to prove the substance of their trademark claims. Rescuecom Corp. v. Google, Inc.¸ 562 F.3d 123 (2d Cir. 2009). After last year’s appellate decision revived Rescuecom’s trademark infringement lawsuit against Google, many trademark owners were waiting to see how Rescuecom’s claims would proceed on their merits at the trial court.

Though the dismissal itself contains no settlement terms, news reports state that Rescuecom was ready to settle because it learned recently that Google had removed the RESCUECOM mark form its suggestion tool five years ago, which, when combined with Google’s stated policy of not allowing trademarks in ad text, would diminish the use and visibility of the RESCUECOM mark in competitors’ sponsored listings. Rescuecom is claiming victory in this settlement, trumpeting the dismissal as “A Case of David versus Googleiath” in a recent press release (available here). According to the press release, Rescuecom achieved two of its three objectives (i.e., removal of its mark from the suggestion tool and from the text of advertisements), though Rescuecom admits that it did not obtain relief on its third goal of preventing use of its mark as a keyword “trigger” for advertisements.

Google is still involved in other trademark keyword disputes but, with the settlement of Rescuecom, has avoided a trial on the merits of such a case for now. Meanwhile, Rescuecom is embroiled in another lawsuit, a declaratory judgment lawsuit it filed against Best Buy, which, ironically, seeks to prove that Rescuecom’s purchase of the GEEK SQUAD mark as a keyword is a fair use, among other things. See Rescuecom Corp. v. BBY Solutions, Inc. (NDNY filed Oct. 14, 2009).

- Suzanne Wilson and Catie Rowland