Consumer Advertising Law Blog

Europe Announces Plans To Reform Outdated Data Protection Rules

The European Commission has announced plans to reform comprehensively the existing EU data protection regime. The proposals, in the form of a new Regulation and Directive, aim to modernise, strengthen and future-proof the principles set out in the 1995 Directive, which was designed to safeguard a pre-internet society. The new Regulation will sweep away the current patchwork of national laws in favour of a single EU law, valid across all 27 Member States. This will, it is hoped, end some of the legal uncertainty and fragmentation that companies of all sizes face when doing business in Europe.

The proposals include some significant amendments to the existing rules including:

• the strengthening of individuals’ rights to include easier access to personal data, a right to request that all personal data be deleted if no longer necessary, and new rules on obtaining explicit consent;
• increased obligations for data controllers, such as the mandatory requirement to notify security breaches and the obligation for large organisations to appoint a data protection officer;
• the extension of EU rules to companies located outside the EU but which are active in the EU market and offer goods and services to consumers in the EU;
• the reduction of red tape for businesses by removing the requirement to notify all data protection activities to data protection supervisors; and
• the strengthening of national data protection authorities’ powers, such as the ability to impose fines for serious breaches up to €1 million or up to 2% of a company’s annual worldwide turnover.

The proposals will now be passed to the European Parliament and the EU Member States for consultation. If agreed, the new Regulation will take effect two years from the date of adoption and will apply to all Member States automatically.

The proposed Regulation can be found here.

UPDATE: A more detailed discussion of this development can be found here.

- Richard Dickinson and Gemma Davies

Keeping an Eye on the Folks Marketing Your Brand -- Google Gets Tripped Up in Blogger Controversy

The FTC’s revised endorsement guides have raised the stakes for companies using social media to promote their brands or services.  This is particularly the case with respect to the relatively new disclosure requirements surrounding paid blogger endorsements. We previously discussed paid blogger endorsements in light of the FTC’s Revised Endorsement and Testimonial Guides here, here, and here.

Google has become the second company in recent months to allege that an agency hired to promote its services had gone “rogue” and used paid blogger endorsements without the company’s knowledge or consent. Which raises the question of whether advertisers should spend more time minding the store and whether agencies should spend more time educating their staff on the finer points of the FTC’s endorsement guides.

As the FTC made clear in the Hyundai case, it does not view ignorance as an excuse when it comes to compliance with its endorsement guidelines, though Hyundai did get a pass, in part because it had a policy against the use of paid endorsements without disclosures and quickly dealt with the issue once it learned of it. 

In Google’s case, they got lucky because the blogs, which attested to Google Chrome’s benefits and posted a promotional video bore the legend “This post is sponsored by Google.”  (though some allege that the blogs misinformed consumers about Chrome’s benefits to small businesses, which, if true, could also potentially be a possible violation of the guides.) 

Ultimately for Google, it ended up being more of a public relations embarrassment as Google has historically opposed paid endorsements. And Google quickly took down the blogs.

There is an old Russian proverb, at least according to Ensign Chekov of the Starship Enterprise, “Fool me once, shame on you; fool me twice shame on me.”  Will the FTC at some point insist that companies keep a sharper eye on the agencies they hire for social media promotions?

- Randy Shaheen and Anita Kalra

 

 

 

But, Upromised to Keep My Data Secure ….

In a significant action signaling the high risks involved in collecting personal information online, the FTC recently settled charges against the online membership program Upromise Inc. Upromise offers its members the opportunity to purchase products from certain partner merchants, receive cash rebates in return, then place those rebates into college savings accounts.  In order to use the program, consumers download a toolbar onto their computers that highlights partner merchants in consumers’ search results so they may easily find companies that are part of the Upromise program.

In addition to the standard toolbar, Upromise offered its members option of activating a “personalized offers” feature that collected and transmitted information through a member’s browser (this is referred to by the FTC as the “Targeting Tool”).  The information collected was subsequently used to provide targeted advertising to the member.

The FTC took issue with Upromise’s Targeting Tool, which it alleged collected scores of highly sensitive personal information from its members, including the websites they visited; their usernames and passwords; and, in some instances, information entered into forms on secure web pages such as credit card and account numbers, security codes and social security numbers.  The FTC alleged that this information was collected, and in some instances, transmitted to a third party, without proper protections and safeguards. 

Upromise’s privacy statement noted that the Toolbar might “infrequently” collect some personal information, but that any identifiable information would be removed.  The FTC alleged that the filter Upromise purportedly used to avoid collecting certain sensitive data was too narrow and improperly structured, and that data collected as part of the Targeting Tool and then transmitted to a third party provider for analysis was sent over the internet in clear text, rather than encrypted text.  Data transmitted in clear text is highly vulnerable to interception, particularly over unsecured networks such as those in coffee shops and other public spaces.  The FTC also alleged that Upromise failed to test its security measures to ensure they functioned properly and provided adequate protections.

In its recent settlement with the FTC, Upromise  agreed to take a variety of ongoing measures to ensure proper security of personal information and disclosures to consumers consistent with the level of security actually provided.

The FTC’s complaint and the Consent Order agreed to by Upromise highlight key lessons for companies that collect and utilize data entered by consumers over the Internet.  Sensitive personal information should always be encrypted before transmitted via the Internet.  Technology related to data collection and security should be tested and checked regularly and on an ongoing basis using a reliable, certified set of tools and measures.  Privacy and security policies should be displayed to consumers in a clear and prominent way, and inform consumers of the risks involved with the provision of personal information either actively or passively by use of an Internet tool.  And users should always be given an opportunity, clearly and affirmatively, to opt-out of the collection of their personal information or its transmission to  third parties.  The more sophisticated Internet technology becomes, the more important these lessons are.

- Danielle Garten and Nancy Perkins

New Domain Names: From “Dot.com” to “Not Com” [Part 3 of 3]

In this third and final segment of our series, we suggest strategies that trademark owners may want to adopt and report on a recent development in the new top level domain scheme.

The launch of new top level domain names is right around the corner, on January 12, 2012. Trademark owners, particularly those that have developed significant goodwill in their brands, will be faced with several decisions. This blog briefly surveys those decision points. It also reports on an important letter published by the Department of Commerce (DOC) that may mirror some trademark owners’ concerns.    

Do You Want to Register a New Top Level Domain in the System? 

These are some of the factors that a company otherwise in a position to register a new gTLD (i.e., because it has the financial resources to do so) might consider:

• Is the company’s brand name strong, and arbitrary or fanciful? If the company has a brand that it can protect under the trademark laws, it might simply object to any third party attempt to register its mark as a new gTLD, with some assurance that its objection will succeed.

• Is the company’s name merely descriptive, or at most suggestive, so that the company should register the name as a new gTLD to keep others from doing so, if it wants to use the name in this capacity?

• Does the company want to use the use its mark as a new gTLD for marketing purposes?  Canon, for example, has announced its intent to register .canon and to issue second level domains to Canon customers who purchase cameras with unique chips so photos could be automatically uploaded to personal websites at [customer’s name].canon.

Apart from these issues, DOC’s letter raises a concern that may become widespread as the Internet opens up to new top level domains: Many trademark owners may feel compelled to file defensively at the top level, even if they are not going to use their top level domains, to prevent others from doing so. Of course, they will have an opportunity to object to third party attempts to register the same or confusingly similar letter strings as gTLDs. This, however, requires a trademark owner to be alert to the period for filing an objection, i.e., the period beginning approximately two weeks after the close of the application window on April 12, when ICANN posts the public portions of all applications that have been received on its website, and lasting for approximately seven months.   

Should You Register Any Marks or Names as Second Level Domains? 

Deciding whether you should register any marks or names as second level domains requires an in-depth familiarity with your organization’s portfolio. Some companies have dozens or even hundreds of trademarks, and will not wish to register all of them for cost and organizational reasons. A company may want to select (1) those marks that are its most valuable, and that it plans to continue using into the indefinite future or (2) any marks that it believes third parties will try to misappropriate.  

Trademark owners must then submit evidence of their rights, of the sort we described in the second blog in this series, to the Trademark Clearinghouse. In addition, a rightful trademark owner may reserve its marks as second level domains with the new gTLD during the Sunrise Period, which will open at least 30 days before the launch of a new gTLD, ahead of others who might try to reserve the same names.

- Roberta Horton

2011: Consumer Protection and Advertising Year-in-Review

From celebrity misappropriation suits to blockbuster class action rulings in the Supreme Court, 2011 was another exciting year in consumer advertising law. As we look forward to 2012, here’s a look at eleven of the top stories from the year that was. If you have your own nominees for 2011’s top eleven, send an email (randal.shaheen@aporter.com) and we’ll try to post our readers' list later this month. 

11. Maybe It’s Maybelline … or Maybe It’s Airbrushed

Beauty enhancements should come from products, not post-production! So said the UK’s Advertising Standard Authority in 2011, when it banned advertisements [Aug. 2, 2011] depicting Julia Roberts and Christy Turlington on the basis that the images had been digitally altered.

10. 2011.xxx

Many a legitimate enterprise found itself registering a .xxx domain name in 2011, as a new top level domain was launched for adult content on the Internet. These companies blushingly took advantage of the Sunrise B [Oct. 11, 2011] time period during which non-adult-industry trademark owners could defensively register their marks, thereby eliminating them from the pool of available .xxx domains.

9. There’s No Such Thing as a Free Lunch

It seems like the battle against the bulge is never-ending and so is the FTC’s battle against companies advertising misleading weight loss remedies. In 2011 the FTC reached a $25 million settlement [Oct. 4, 2011] with Reebok over ads for toning shoes that promised “a better butt and better legs with every step.”

8. She Looks Like Kim Kardashian

It’s well known that misappropriation suits are de rigueur for any self-respecting celebrity du jour.  See e.g., Paris Hilton’s 2009 suit against Hallmark (for use of the phrase “that’s hot”); Lindsay Lohan’s 2010 suit against E*Trade (for portraying a baby named Lindsay as a “milkaholic”). 2011 was no exception, as Kim Kardashian sued Old Navy [Aug. 4, 2011] for allegedly using a model resembling her in a TV advertisement.   

7. Made in Havana, Puerto Rico

The rule that literally true statements can be challenged as impliedly false took a hit this year [Oct. 10, 2011] when the Third Circuit held that survey evidence showing that the name “Havana Rum” gave the impression the rum was made in Cuba could be excluded because the statement on the bottle that the rum was “made in Puerto Rico” was objectively verifiable.

6. The Meaning of “Natural” 

The trickle of cases alleging deceptive use of the term “natural” on labeling or in advertisements became a torrent in 2011, with new suits [Oct. 3, 2011] against Conagra, Kellogg, and Skinny Girl, to name just a few.

5.Protecting Children in the US -- Standards for Food Advertising

We have been following FTC efforts to establish principles for marketing food to children for some time. In 2011, these efforts culminated in initial recommendations [May 16, 2011] published by the Interagency Working Group on Food Marketed to Children. These recommendations met with heavy resistance in the form of an industry coalition, [Aug. 9, 2011] which is seeking legislative action on the basis that the proposed standards are overbroad and anti-business.     

4. Protecting Children in the UK -- Standards for Decency 

The UK advertising regulator, the Advertising Standards Authority, was also active in protecting children in 2011, finding ad campaigns directed at children [Oct. 24, 2011] or portraying children (here and here) [Aug. 18 and Dec. 19, 2011] to violate UK standards for responsible advertising.

3.COPPA 

The FTC proposed changes [Sept. 23, 2011] to rules implementing the Children’s Online Privacy Protection Act (COPPA), which provides parents control over what personal information web sites may collect from children under 13 years old. These proposals are significant, particularly because FTC enforcement has made COPPA compliance a serious consideration [Nov. 23, 2011] for all web site operators.

2. Concepcion

In AT&T Mobility LLC v. Concepcion [May 4, 2011], the Supreme Court held that arbitration provisions prohibiting class-wide arbitrations can be enforced, and that the California Supreme Court’s decision in Discover Bank finding such provisions unenforceable is preempted by the Federal Arbitration Act. The full ramifications of Concepcion have yet to play out, but at least one court has found that such clauses can still be unconscionable. [Nov. 14, 2011]

1. Wal-Mart v. Dukes

The top spot on our list goes to the Supreme Court’s watershed decision [June 28, 2011] on class certification, the first of its kind in many years. Wal-Mart embraces a rigorous analysis of the elements of class certification, and substantially raises the bar for showing that the commonality element of Rule 23 has been met. Commentators were quick to predict that Wal-Mart would shape class action law for years to come, and early indications [Aug. 24, 2011] suggest that might be an understatement. [Nov. 15, 2011]

- George Langendorf, Randy Shaheen, and Amy Mudge

New Domain Names: From “dot.com” to “not com” [Part 2 of 3]

In this second segment of our series, we discuss options for trademark owners on how to act defensively if they do not become registries under the new top level domain system.

The first blog in this series explained how the opening up of the Internet to new registries -- and the potential explosion of new top level domains -- could change the Internet. Yet many, if not most, trademark owners will not become a registry with their own top level domains, for financial, technical or other reasons. These trademark owners, however, should know how to protect their trademark rights from the new form of cyberpirates that is likely to emerge. This blog briefly describes the more important mechanisms that ICANN plans to offer savvy trademark owners to protect their rights.     

Objecting to a Third Party’s New gTLD Application

Only four grounds may form the basis for a trademark owner’s objection to a new gTLD application: 

• String Confusion Objection: The applicant’s proposed gTLD “string” of letters, is confusingly similar to a pre-existing gTLD or another applied-for gTLD string in the same round of applications. 
• Legal Rights Objection: The applicant’s gTLD string infringes the legal rights of the objector, such as the objector’s trademark rights. Factors in deciding a legal rights objection are similar to those in the Uniform Domain-Name Dispute Resolution Policy under current practice.
• Limited Public Interest Objection: The applicant’s gTLD contravenes generally accepted standards of morality and public order under international law.
• Community Objection: A significant part of the community, such as a geographic community, objects to the gTLD application, e.g., New York City residents might object to a Miami company’s submission for a .nyc registry. 

To initiate a proceeding, the objector must file its complaint by a posted deadline with an appropriate Dispute Resolution Service Provider (DRSP), along with a specified fee. For many companies, the most relevant DRSPs are the World Intellectual Property Organization (for legal rights objections) and the International Centre for Dispute Resolution (for string confusion objections). 

Protecting Against Infringing Second Level Domains in the New Domain Name Space

ICANN’s  program contemplates important measures to protect trademark owners from the registration of second level domains, combined with the new gTLDs, by trademark infringers. Thus, a company owning the ABC^® mark could invoke the procedures described below to prevent a third party from registering “ABC.new TLD” or to learn of such registrations.

The Trademark Clearinghous. ICANN plans to create a Trademark Clearinghouse, i.e., a central database for information about trademark rights. Trademark owners who want to register their second level domains with the new registry ahead of the general public, and trademark owners who want to be notified if a would-be infringer registers their trademarks as second level domains, must submit evidence of their trademark rights to the Trademark Clearinghouse. This evidence may consist of: a trademark registration; a judicial decision recognizing the trademark; or other evidence showing that the mark “constitute[s] intellectual property”. This Clearinghouse will authenticate information about the trademarks it receives and store that information in its database. It will provide information about the authenticity of the trademarks in its database, as needed, to new gTLD registries for use in the Sunrise Service and Trademark Claims Services described below.

Sunrise Service. New gTLD registries must provide a Sunrise Service that protects trademark owners from a “race to registration” against domain name registrants who might infringe the trademark owners’ rights. The anticipated sunrise period will be at least 30 days before the launch of a new gTLD, during which time a rightful trademark owner may reserve its mark as a second level domain with the new gTLD, ahead of others who might try to reserve the same name. For example, if a major car manufacturer could register its MERCEDES^® mark as “mercedes.car” before Company S permits the public to register domain names in the .car gTLD.  

Trademark Claims Service. In addition, all new gTLD registries must provide a Trademark Claims Service for the first 60 days after the public launch of their new gTLDs, i.e., after the general public can begin registering domain names in the gTLDs. This service provides a warning notice, called the Trademarks Claim Notice, to prospective registrants of a pre-existing trademark owner’s rights when the domain name applicant attempts to register a domain name that is an “identical match” to the trademark that the trademark owner has listed with the Trademark Clearinghouse. This notice, however, is of limited utility, because it is only triggered when a third party tries to register a second level domain identical to a trademark that resides in the Trademark Clearinghouse. If the domain name registrant proceeds with the registration application, the trademark owner will receive a notice informing it that a domain name that is an identical match to the trademark owner’s mark has been registered.

Objections to Registrations. The Uniform Dispute Resolution Procedure that currently applies to disputes involving registration of second level domains with .com, .net, .org and certain other top level domains will apply to registration of second level domains with the new gTLDs. An entity that wants to challenge registration of a second level domain with a new gTLD may, assuming jurisdiction and venue lie, also file a lawsuit in the United States alleging infringement, cybersquatting and related causes of action.

- Roberta Horton

 

New Domain Names: From “Dot.Com” to “Not Com” [Part 1 of 3]

This is the first in a series of three blogs on the new gTLDs

Most of you are probably familiar with the common Internet domain name endings such as “.com”, “.net”, or “.org”, which, when combined with an organization’s or individual’s name, serve as addresses for websites in cyberspace (e.g., “microsoft.com”). The portion to the right of the dot is the Top-Level domain (“TLD”). One type of TLD is a “generic” TLD (gTLD), such as .com; another is a “cc TLD” or country code, such as “.jp.” . The portion to the left of the dot is called a “second-level domain name” and is the name of the organization or individual. To date, only 22 gTLDs exist. Beginning on January 12, 2012, however, the Internet will open up to a potentially infinite number of new top level domains or “gTLDs”. This Blog briefly explores how the launch of these new top level domains could change the Internet -- and affect your organization -- dramatically.  

What will the changes look like? The launch of new gTLDs means that anyone with the means can become a “registry” that creates and manages a database of domains ending with a particular top level domain that it selects. That new gTLD can be a generic term (e.g., “.bank”, “.wine”) or a brand name (e.g., “.canon”, “.nokia”). The registry should have a say in setting the rules for entities eligible to register under that gTLD. For example, if the gTLD is a generic term such as “.bank”, the registry may require that registrants actually offer banking services. If the registry is a car manufacturer using its brand name as the gTLD (e.g., “.mercedes”), it may require that only authorized dealers can register in its gTLD space (e.g., “manhattandealer.mercedes”). Still other registries might use the new gTLDs for creative promotional purposes. The camera company Canon was the first to express an interest in setting up a new registry, under .canon. The company may use “.canon” for marketing purposes, issuing second level domain names to Canon camera owners and embedding a unique chip in the buyers’ cameras so that they could upload photos onto [buyer’s name].canon.

The registry will set the rules for bodies called “registrars”, which are accredited by the Internet Corporation for Assigned Names and Numbers, the global body that governs the Internet. The registrars will, in turn, sell to individual registrants the right to combine their second level names with the top level domain for a limited period of time. 

How does one become a Registry?  The requirements are rigorous, and include a significant financial payment ($185,000), a demonstration of financial stability, and sophisticated technical support on a 24/7 basis. If a Registry elects to outsource its technical work, its financial commitment could run $1 million or more. Applicants must complete a 40+ page application and 10 detailed specifications demonstrating their financial and technical capability. ICANN is not planning to post the actual new GTLD application.  This link, here, will allow an Internet visitor to navigate through the application process. ICANN will evaluate the applications. Among other things, it will guard against the granting of multiple new gTLDs that are confusingly similar to a previous gTLD. The application window lasts for only four months, from January 12, 2012 to April 12, 2012.

What to watch out for if you are not a Registry: Becoming a Registry is not for everyone. Some organizations do not have the expertise or the financial wherewithal, or want to make the commitment required. Still others, such as non-commercial entities that do not sell products or services, might not stand to gain by carving out a space they can control to some degree on the Internet. 

If you are not in the “Registry Game”, you should be prepared to act defensively to: 

1. Object to a third party’s proposed gTLD that incorporates your trademark; or
2. Object to a third party’s  attempt to register second level domains incorporating your name or trademark within the new gTLD space. 

The next blog post in this series will describe these defensive mechanisms and explains how they work.  The third and final post will sum up the new gTLD process and suggests strategies for an organization to  adopt as the launch date approaches.   

- Roberta Horton

 

 

We Thought People Just Liked to Talk About Superbowl Ads - FTC Closes Investigation of Alleged Payment to Bloggers for Mentioning Ads

When the FTC issued its revised Endorsement Guides, there was much anguish in the blogosphere about the newfound guidance on blogging and the FTC’s enforcement intentions in this regard. The Agency, however, was quick to offer some reassurance that it was not going to throw stay at home blogging mom’s or blogging teenage gamers in jail (see one of our previous postings here). A recent closing letter sent to Hyundai serves as both a reminder that the worst fears in the blogospheres have not come to pass and what steps a company can proactively take to stay out of trouble with the Agency if, despite all precautions, there is a potential Section 5 problem.

The FTC’s inquiry focused on whether bloggers had been given gift certificates as an inducement to include links to Hyundai videos or comment on upcoming Super Bowl ads and were specifically told not to disclose this information (in violation of the Endorsement Guides).

The FTC decided not to recommend an enforcement action. Their decision was influenced in part by steps Hyundai had taken that others might be wise to take as well. 

• First, the incentives were provided by a rogue individual working for a media firm hired to conduct the campaign. Although Hyundai could have been held responsible for the actions of those working for them, Hyundai had an established social media policy that called for bloggers to disclose the receipt of any compensation. (The media firm had one as well.) 

• Second, when the media firm learned of the misconduct, it took prompt action to address it.  We don’t know whether that was before or after the FTC initiated its investigation, but, based upon our prior experience, the FTC likely gave them credit for taking remedial action before the Commission came calling.

So, as this case demonstrates, a few simple steps can sometimes save you from a much bigger problem. 

And just to clear up any confusion, Hyundai did not offer us gift certificates, free cars or super bowl tickets (or anything else) to blog about their case.  

- Randy Shaheen

COPPA Compliance is No Day at the Beach

Skid-e-kids, a social networking site which advertises itself as the “Facebook and Myspace for kids,” recently entered into a consent decree with the Federal Trade Commission (FTC) regarding alleged violations of the Children’s Online Privacy Protection Act (COPPA). This latest social networking should send a strong warning to all website operators regarding the potential pitfalls of collecting site visitors’ information without strict screening.  In addition, because COPPA applies not just to website operators, but also to operators of mobile applications, many applications operators should be on notice of the implications of the Skid-e-kids Consent Decree.

COPPA requires that website operators notify parents and obtain their consent before collecting personal information from children under age 13. This is required not only for ostensibly “children’s sites”, but also for any website whose operators have actual knowledge the site is collecting information from children under age 13. A website operator may have actual knowledge of a user’s age, for example, if it asks for, and receives, information from which age can be determined, such as by asking “What grade are you in?”

Skid-e-kids allegedly violated COPPA by allowing children to register on its site without first obtaining parental permission. Such collection allegedly occurred despite the statement in the site’s privacy policy that it was mandatory for “child users to provide a parent’s valid email address in order to register on the website.” In practice, there apparently was no such requirement, as Skid-e-kids allegedly obtained information from approximately 5,600 children without parental consent.

Pursuant to the Consent Decree, Skid-e-kids must (i) delete all of the personal information it obtained from children without parental consent, (ii) provide a link to online privacy educational material and (iii) retain a privacy professional to oversee compliance for a period of time. Further, the Consent Decree imposes a $100,000 civil penalty on Skid-e-kids – although payment of all but $1,000 of that penalty will be suspended provided Skid-e-kids complies with the Consent Order’s oversight provisions and its operator provided truthful financial information.

The FTC is currently accepting comments on proposed changes to the COPPA rule. Among the potential changes are expanding the definition of “personal information;” allowing children to participate in some interactive communities without parental consent so long as certain conditions apply; developing new parental consent mechanisms; and strengthening the oversight of the “safe-harbor programs.” Written comments on the proposed revisions are due to the FTC by November 28, 2011.

 - Nancy Perkins and McCormick Conforti

Watching the Sun Rise: Protecting Your Brand in the New .XXX Domain Name Space Before It’s Too Late

The new .XXX top level domain was recently launched as the space for adult content on the Internet (e.g., PLAYBOY.XXX). But this is also an invitation for third party cybersquatters to register in the .XXX space. To guard against this danger, the registry managing the launch is allowing legitimate brand owners a limited window for “reserving” their brand names together with .XXX before these names become generally available. The reservation process, as described below, is quick and relatively easy, but trademark owners should capitalize on it soon to avoid an association between their brands and the adult entertainment industry.

The .XXX launch, which is managed by ICM Registry, LLC (“ICM”), includes three phases:  Sunrise, Land Rush, and General Availability. Sunrise, which began on September 7, 2011, is a limited period during which members of the adult entertainment industry may register .XXX domain names corresponding to their registered trademarks (Sunrise A), and non-industry trademark owners may defensively register their marks (Sunrise B), eliminating them from the pool of available .XXX domains.  The Sunrise period ends October 28, 2011, and when Land Rush begins on November 9, 2011, members of the adult entertainment industry may reserve .XXX domain names regardless of trademark ownership. 

To obtain a Sunrise B defensive registration, trademark owners must apply to ICM through an Accredited Registrar.  Each Registrar sets its own one-time fee for Sunrise B applications, with most charging between $200-$300. Importantly, only a registered trade or service mark of national effect may be the basis for Sunrise B defensive registration; Sunrise B is not available for unregistered marks, or those that are merely state registered. Further, only registrations issued before September 1, 2011 qualify for Sunrise B.

FTC Apps-olutely Reviewing Claims Made by Apps Marketers for Potential Enforcement

The FTC has been making novel headlines in going after affiliate marketers and use of endorsements on blogs and yesterday adds a new first -- announcing consents involving allegedly deceptive health claims by mobile app marketers.  The AcneApp available at iTunes for $1.99 and Acne Pwner available at the Android Marketplace for $.99 claimed to treat acne. The buyer was to hold her smartphone screen to the affected area and blue or red light would eliminate certain acne causing bacteria and reduce blemishes. Ads for the Apps relied on satisfied customer testimonials.  Some AcneApp ads cited a study in the British Journal of Dermatology supporting it claims. The study did not test the efficacy of the mobil app. Readers of this blog know, the FTC has increasingly been requiring product testing to support health claims and not reliance on general studies for substantiation. Further, use of customer testimonials, even if truthful, do not provide the needed support that the product works. Such anecdotes must be supported by science showing typical results.  

In one of his customary cheeky comments, Chairman Leibowitz said in announcing the settlements, "unfortunately when it comes to curing acne, there's no app for that."

The consents [available here and here] include injunctive relief as well as consumer redress.  Before making any claims that apps or other devices cure acne, the respondents must have competent and reliable scientific evidence, defined to mean at least two adequate and controlled independent studies.  While the redress amounts are modest, as a percentage of total sales they are significant (e.g., $1,700 in the case of Acne Pwner, but total downloads at $0.99 only totaled 3,300). 

Why go after such small potatoes?  These cases are a reminder that health claims are a continued priority for the BCP. They should also stand as a warning to Apps makers to make sure the claims made for apps, even if not as life changing as a cure for acne, are substantiated. The disclaimer from AcneApp that "this app is for entertainment purposes only" did not deter the FTC from enforcement, presumably because a marketer can generally only use a disclaimer to add important clarifying information and not take away from the promises it makes it its ads. The FTC is clearly monitoring claims in the app space and we expect this will not be the last of such enforcement efforts.

- Amy Mudge

Self Regulation By Online Advertisers Yields Mixed Privacy Results

A recent study by Stanford University’s Center for Internet and Society has found that only a handful internet advertising companies participating in the self-regulatory Network Advertising Initiative (NAI) actually cease tracking user browsing habits after users request to opt-out of a member company’s targeted advertising. The researchers found that not only did half of the 64 companies they studied keep tracking software in place after users opted out, but eight NAI members even did so after expressly promising not to.

NAI touts itself as a voluntary and effective alternative to governmental regulation of online advertisers that use behavioral technology to “target” consumers with ads based on their browsing patterns. The NAI website offers its own “opt out” tool that allows users to detect and eliminate tracking software on their computers. However, NAI executive director Chuck Curran has criticized the Stanford study as failing to distinguish between a policy of not tracking any online browsing, something the Stanford researchers advocate, and NAI’s voluntary “self regulatory commitments to limit ad targeting based on user interests.” In other words, NAI distinguishes between, on the one hand, collecting data on browsing patterns, and, on the other hand, acting on that data by targeting ads at individual users tailored to their interests. The NAI website also reminds readers that “most content on the Internet” is free because of effective online advertising.

However, web tracking is receiving increased attention from more than the industry itself. The FTC has signaled that it will regulate tracking behavior it finds deceptive or egregious, such as a 2009 action in which the agency censured a retailer for paying users of its website $10 in exchange for installing software on their systems that the retailer did not disclose would track virtually everything the users did on their computers.

Online advertisers are also facing threats from their client websites. The Wall Street Journal recently reported that a company called Ensighten is promising website owners software that will allow them to dictate what information online advertisers can track about browsers of their websites. This software purports to allow website owners to limit tracking by those online advertising companies that “don’t have a strong privacy policy or follow industry standards.”

But, as the Stanford study indicates, even those online advertising companies with “strong” privacy policies do not necessarily limit their tracking of user data the way users likely think they do. So, much uncertainty remains about what “industry standards” for online advertisers actually are, and the success of self-regulation like NAI remains unclear.

- Ronald Lee and Tom McSorley

Maureen Ohlhausen Is Nominee for FTC Commissioner, Says Obama Administration

Maureen Ohlhausen Is Nominee for FTC Commissioner, Says Obama Administration The Obama administration announced its intention today to nominate Maureen Ohlhausen as the next FTC Commissioner. Ohlhausen, currently a partner with Wilkinson Barker Knauer, LLP, would replace outgoing Commissioner Bill Kovacic, who finishes his term in September of this year. Ohlhausen is no stranger at 600 Pennsylvania Avenue; her prior tour of duty included serving as Director of the Office of Policy Planning (OPP) and as attorney advisor to former Commissioner Swindle. Her prior personal experience with how business is done at the commissioner and the staff level should be an asset. Also for those who track such things this would mark the first female majority at the Commission level since 1997.

While Kovacic is a strong antitrust academic, Ohlhausen is a practicing lawyer experienced in issues of privacy and consumer protection. During her tenure, the OPP repeatedly encouraged informative labeling  and advertising meant to better inform consumers, as well as clearer disclosure by mortgage lenders and pharmaceuticals. This reflects the growing focus by the FTC on consumer protection issues. With the Consumer Financial Protection Bureau launching as another agency watchdog on the consumer financial landscape, the consumer protection side of the Commission will clearly not be taking a vacation; instead, it is gearing up with a commissioner likely more interested in taking an active role in directing staff priorities rather than sitting back to see what staff puts on her desk.

Should she be appointed, Ohlhausen’s presence would also beef up the FTC’s growing technology focus. Through the FTC’s Internet Access Task Force, Ohlhausen was responsible for reports on competition in broadband connectivity, which touched on the issue of net neutrality, and on municipal provision of wireless Internet. Meanwhile, under her leadership the OPP weighed in on issues of technology ranging from protecting children from online advertising to auctioning wireless licenses. We would not be surprised given her background and interest in technology if Ohlhausen takes a leadership role in the recently announced antitrust investigation into Google’s search practices.

Ms. Ohlhausen previously served as a clerk to Judge David Sentelle (D. C. Cir.) and to Judge Robert Yock (Fed. Cl.). She received a B.A. from the University of Virginia and a J.D. from George Mason University School of Law, and has since taught Unfair Trade Practices as an adjunct professor at her alma mater.  Ms. Ohlhausen has also contributed academically to the analyses of the relationship between advertising and childhood obesity.

As this blog has discussed previously, the FTC is an independent agency led by five commissioners who each serve staggered seven-year terms. Although nominated by President Obama, Ohlhausen would fill one of the slots reserved for a Republican or independent-- no more than three sitting commissioners may belong to the same political party --as the FTC currently has three Democratic members in the form of Commissioners Julie Brill, Edith Ramirez, and Jon Leibowitz. J. Thomas Rosch rounds out the current roster of Commissioners.

- Amy Mudge and Will Thomas

Make New Friends But Keep the Old - Suit Against Facebook Fails to Strike Gold

Late last month, Judge Seeborg dismissed Cohen v. Facebook, Inc., a class action suit brought in the Northern District of California. Cohen involved one of Facebook’s newest services, Friend Finder, which provides suggested new “friends” to current Facebook users. Friend Finder searches users’ email databases for new contacts and common contacts among users. Friend Finder then solicits new users and suggests new friends to current users, increasing the Facebook network. Facebook promotes the service by displaying the names and photos of users who have purportedly found new friends via Friend Finder on its website. The Cohen decision will allow Facebook to continue promoting its Friend Finder service for the foreseeable future, but leaves open the door for future claims of misappropriation and perhaps false endorsement and unfair competition.

Plaintiffs in Cohen alleged that Facebook used their names and likenesses without consent or knowledge to advertise Friend Finder, thus increasing the Facebook network and boosting commercial advertisement sales. Plaintiffs brought suit alleging misappropriation in violation of the common law right to privacy and Cal. Civ. Code § 3344 , as well as false endorsement in violation of section 1125(a)(1) of the Lanham Act and unfair competition under Cal. Bus. Code. § 17200 .

In its motion to dismiss, Facebook argued that plaintiffs consented to the use of their names and likenesses as part of Facebook’s terms and conditions. Although the court ultimately dismissed all four counts with leave to amend, it refused to accept that plaintiffs had consented to the use of their names and likenesses for an endorsement of a Facebook service. Rather, the court relied on plaintiffs failure to allege any injury, noting that had they at least pled mental anguish the misappropriation claims might have gone forward. The Cohen court also dismissed the claims of false endorsement and unfair competition due to the plaintiffs lack of “commercial interest” in their names and likenesses, noting that it was “not clear how this defect could be cured” for future claims (absent adding Brad Pitt or Angelina Jolie as plaintiffs.) Thus, future plaintiffs may have viable claims against Facebook for its promotion of Friend Finder under a misappropriation theory, but claims of false endorsement and unfair competition appear to be limited to celebrities.

- Randy Shaheen and Jocelyn Wiesner

Google Street View Case Rolls Along After Recent Ruling

A federal judge in Northern California denied Google’s motion to dismiss allegations that its street-mapping project, which collected information from unprotected, private wireless (WiFi) networks, violated the federal Wiretap Act.  Since 2007, a worldwide fleet of camera-laden vans and bicycles has collected images of city streets that are used to augment the online service Google Maps.  In 2010, German regulators discovered that those vans and bicycles were also “archiving the location of wireless networks.” While early reports suggested Google was merely recording the name (SSID) and unique address (MAC) of private networks, later Google announced that its fleet also  collected “payload data,”  — data packets containing usernames, passwords, and private emails.  The revelation of captured payload data gave rise to the extant suit, as several private individuals sued Google under the Wiretap Act, as well as under similar state statutes, on the basis that surreptitious collection of information from private networks violated the Act, and entitled them to civil damages.  Similar claims were brought under a equivalent state statutes.

Central to the motion to dismiss was whether data packets on private, unsecured networks constitute “radio communication.”  The Wiretap Act creates a private right of action against interceptors of “electronic communication” except where the communication was “readily accessible to the general public.” However, Congress defined “readily accessible to the general public” not in the context of all electronic communication, but instead only with respect to “radio communication.”  In Google’s view, radio communication applies to all communication relying on the medium of radio waves.  Plaintiffs argued a decidedly narrower view, suggesting instead the term covered only the method of using radio for traditional services.  Finding the expression ambiguous, and deriving only indirect assistance from similar provisions (the Wiretap Act at various points identifies “oral communication” and “wire communication”), the court ultimately turned to legislative history to resolve this method-or-medium disagreement.  The Court held that Congress intended the expression “radio communication” be construed narrowly; the wiretapping exception was created to protect radio hobbyists, and noticeably declined to extend that protection to wireless telephony. (Yes: cell phones existed in 1986.)  Finding that wireless networks more closely resembled cellular networks than amateur radio, the Court held that the Wiretap Act’s carveout for the interception of communications “readily accessible to the general public” does not extend to WiFi networks.

The decision is the first domestic decision addressing the applicability of certain Wiretap Act exceptions to WiFi networks.  The court also dismissed a host of state claims against Google, and has yet to decide whether to certify a class of plaintiffs complaining Google breached their privacy.  One thing is clear: WiFi network security requires more than passing attention.

UPDATE (7/22/2011): Tapping the breaks? The district court has granted parties leave to appeal its recent decision not to grant Google’s motion to dismiss. That decision gives the Ninth Circuit an opportunity to decide the proper scope of exceptions to The Wiretap Act before litigation continues.

- Nancy Perkins, Ronald Lee, and Will Thomas

Questions Remain on the Future of Personal Jurisdiction in a Global, Digital Age

In a duo of decisions handed down last Monday, the Supreme Court held that US state courts lacked personal jurisdiction over foreign corporations that were sued for personal injuries allegedly caused by the companies’ products.  The cases presented an opportunity for the Court to clarify the muddy waters of personal jurisdiction and to give multinational companies operating in the modern, global economy clearer guidance on when they can be hailed into US courts.  But, no clear majority emerged on the ground rules for assessing personal jurisdiction in future cases, so the opinions leave companies largely in the dark about when personal jurisdiction will exist in any particular case.  Even so, the results of the two cases -- declining to find jurisdiction -- are in line with the pro-business trend this past term and they will be useful precedent for defending products liability suits, false advertising claims and other consumer class actions involving foreign companies. 

Facebook’s Putting Names to Faces - A New Violation of Privacy Rights?

The Electronic Privacy Information Center (EPIC) along with the Center for Digital Democracy, Consumer Watchdog, and the Privacy Rights Clearinghouse, filed a complaint with the FTC claiming that Facebook’s use of facial recognition technology constitutes unfair and deceptive trade practices, in violation of Section 5 the FTC Act.

According to the complaint, the technology being challenged concerns the “covert” collection of “biometric data” by Facebook. Specifically, Facebook’s “Tag Suggestions” technology “converts photos uploaded by Facebook users into an image identification system under the sole control of Facebook,” which allegedly “has occurred without the knowledge or consent of Facebook users and without adequate consideration of the risks to Facebook users.” In other words, when User A uploads a photograph of Friend B, Facebook’s face recognition technology suggests a name label, or “tags” the photo of Friend B with a name based on other photos of Friend B that Facebook has in its database -- which it allegedly collected without notifying Facebook users. This is in contrast to User C’s ability to upload a picture of Friend D and manually tag that photo of Friend D, a practice most Facebook users enjoy without concern. According to the EPIC, Facebook now possesses approximately 60 billion photographs, and its actions impact 500 million users, 150 million of whom fall within the jurisdiction of the FTC.

EPIC alleges that Facebook’s practices injure users by invading their privacy in several ways:

• by “allowing for disclosure and use of information in ways and for purposes other than those consented to or relied upon by such users”;
• by “causing them to believe falsely that they have full control over the use of their information”; and
• by “undermining the ability of users to avail themselves of the privacy protections promised by the company.”

The Complaint requests several forms of relief. It asks that the Commission:

1. Require Facebook to suspend any form of Facebook-initiated tagging based on Facebook’s database of images;
2. Require that Facebook not misrepresent the extent to which it protects the security and privacy of user information;
3. Require Facebook, prior to sharing user information with a third party, to make appropriate disclosures;
4. Require Facebook to maintain a comprehensive privacy policy;
5. Permit Facebook to reintroduce auto tagging only after it has established appropriate security safeguards, revised its privacy policy to limit disclosure of user information, and obtain informed user consent that allows individuals to opt-on of the auto tagging features.
6. Finally, EPIC requests the appropriate injunctive and compensatory relief.

It remains to be seen whether the FTC will take up this investigation. In the meantime, a European Union privacy watchdog, Article 29 Data Protection Working Party, is investigating Facebook’s facial recognition software to see if it violates EU privacy regulations. The feature has been active in most European countries for the last few months. Facebook has since apologized for rolling out the feature the way it did, namely without notifying users more aggressively. Of course, unless this new technology informs Facebook users of information that they did not already know - it is hard to see how any privacy issues are raised.

- Marianne El Sonbaty, Ronald Lee, and Alex Watt

Privacy Concerns in a Mobile World

On May 19, David Vladeck, director of the FTC’s Bureau of Consumer Protection, testified on behalf of the Commission before the Senate Committee on Commerce, Science and Transportation about the growing consumer privacy challenges presented by mobile technology.

While the increasing range of new mobile services available to consumers offers tremendous benefits, it also raises privacy challenges as it has facilitated unprecedented levels of data collection from consumers. The testimony came at the same time as lawmakers grilled technology executives about their privacy policies with respect to mobile technology and how they share consumer information with other companies. The hearing was prompted by concerns over revelations that Apple iOS devices were in some cases storing up to a year’s worth of location data in an insecure manner both on the iOS device itself and on computers with which the iOS devices were synced.

The FTC testimony highlighted the privacy concerns that expanding mobile technology presents for U.S. consumers and discussed the agencies’ attempts to deal with these growing concerns. The Commission noted that mobile devices are almost always carried by the user and switched-on, thus potentially allowing companies to collect data over time and “reveal[] the habits and patterns that mark the distinction between a day in the life and a way of life.” United States v. Maynard. To deal with these issues, the FTC made three main recommendations for mobile technology: transparency, streamlined privacy choices and “privacy by design.” Additionally, as Congress continues to examine a Do Not Track mechanism, the FTC urged that any Do Not Track mechanism should be universal, easy to find, enforceable, ensure that consumer choices are persistent, and allow consumers to opt out of both targeted advertising and collection of behavioral data for all purposes not commonly accepted.

Both the FTC and members of the Senate Commerce Committee were interested in how location services may impact younger users given the rising use of mobile devices by children and teens. The number of 12 to 17 year olds who use a cell phone has increased rapidly over the past few years, and was as high as 75% by 2009. Tracking of younger users raises issues under the Children’s Online Privacy Protection (COPPA) rule, which regulates companies’ collection of information from the online activity of children ages 13 and younger. At the hearing, the FTC said it is currently handling several COPPA investigations involving the use of mobile phones. The FTC has already brought sixteen complaints against companies for violating COPPA, and this past month announced its largest civil penalty in a COPPA action, a $3 million settlement with Playdom, Inc.

Director Vladeck’s testimony reminds companies, if any such reminder were needed, that their privacy policies, practices, and compliance processes all need to devote substantial attention to mobile technologies, applications, and users. When it comes to privacy enforcement, the FTC is on the move.

- Ron Lee and Tiana Russell

FTC’s Web Disclosures Guidance Scheduled for 2.0 Upgrade

In the world of internet advertising, 11 years is a lifetime. The past decade has seen the popularization of pop-up blockers, social networking, and smartphone apps, yet the Federal Trade Commission’s guidance document advising businesses of their legal obligations related to internet advertising and sales has not been updated since 2000.

That’s about to change. The Commission has announced an upcoming revision of the guidance document, entitled “Dot Com Disclosures: Information About Online Advertising,” and is seeking public comment.

The 2000 publication emphasized that online advertisements are subject to the same consumer protection laws that apply to ads in other media. The publication advised online advertisers on how to ensure that all required disclosures are presented clearly and conspicuously. For instance, advertisers must consider such factors as the prominence of the disclosure, its proximity to the relevant claim, whether other elements in the ad draw attention from the disclosures, whether audio disclosures are audible, and whether visual disclosure are visible for enough time, among other considerations.

With smaller screen sizes on mobile devices -- and a host of other changes in technology and internet activities -- it is possible that guidance concerning what is considered “clear and conspicuous” has changed in the past 11 years. As the Commission considers updating “Dot Com Disclosures,” it is particularly interested in comments concerning:

• What issues have been raised by internet features and new technologies that have emerged since 2000?
• What issues have been raised by new laws and regulations enacted since 2000?
• How will technologies on the horizon affect internet advertising?
• Which areas of the 2000 guidelines have become outdated?

Written comments should be mailed to: Federal Trade Commission, Office of the Secretary, Room H-113 (Annex I), 600 Pennsylvania Avenue, N.W., Washington, DC 20580. Naturally, written comments also can be submitted electronically. The public comment period ends on July 11, so -- to borrow a ubiquitous phrase from the world of advertising -- act now!

- Amy Mudge, Randy Shaheen, and Brian Feinstein

Would You Like A Cookie With Your EU Browsing?

A new European Directive coming into effect tomorrow has caused much hand-wringing in the online advertising industry. Directive 2009/136/EC has been dubbed the “Cookie Directive” because of its most high profile change – it requires that cookies and any similar technology can only be placed on machines where the user has given their positive consent, or to actively ‘opt in’. The new requirement could be a blow to online advertisers operating in the UK (and elsewhere in the European Union), and in particular to behaviour-targeted ads, which tend to generate more clicks and more income than non-targeted online displays.

(As you may know, Cookies are small text files that are installed on a user’s computer to store certain information which the originating website can access next time the user logs on to it. This allows websites to be personalised, and often make browsing easier for the user by storing things such as log-in details or preferences. Some cookies play a key practical role in the functionality of websites, for instance allowing an online retailer’s website to remember what items the customer has added to the ‘shopping cart’ as the customer moves from page to page. However, some cookies are unsettling to many internet users, most notably stalker-like website tracking cookies which follow users around other websites and relay their browsing history back to the originating server. Such tracking cookies are at the heart of targeted online advertising, where online banners and other displays are tailored to what a user is most likely to be interested in given his or her browsing habits.)

The UK government has said that the new rules will be implemented gradually; in the early phases all that is expected of businesses is that they get to work on addressing their uses of cookies. The UK government is hoping to work with browser manufacturers to develop a way to meet the requirements of the Directive via enhancements to browser settings. However, the UK regulator for information and data protection, the Information Commissioner’s Office (ICO), published guidance on 9 May 2011 clarifying that, at least for the time being, consent via browser settings will not be an option; websites will have to gain consent some other way. This is because most browser settings are not sophisticated enough for users to be presumed to have consented to cookies; indeed, as pointed out by privacy watchdogs, most browsers accept cookies by default.

The ICO’s advice is that businesses using cookies should check what type of cookies they use and how they are used, and ‘clean up’ any cookies they don’t need. They should then consider how intrusive the identified cookies are, and prioritise changing how the most intrusive cookies are used in order to comply with the new rules. One possible outcome of this process may be that some of the most intrusive cookies will stop being used altogether because businesses are unable to obtain proper consent from users; this may well be a not-so-secret policy intention behind the Directive.

Perhaps understandably, some in the online advertising industry are complaining that their businesses will suffer as the Directive’s new provisions are implemented and enforced. Though the UK Government has assured the public that the transposition of the Directive is proportionate and does not place unnecessary burdens on the industry, it is clear that online privacy is being taken seriously in Europe and in the UK. Indeed, there are early signs that the UK Government may come under fire from the European Union, who appears unimpressed with the UK’s “light touch, business friendly” approach to the new framework. It seems likely that there is no going back to the way things were.

- Richard Dickinson