Gonzalo Mon writes in Mashable that “Although various bills pending in Congress would require companies to get consent before collecting certain types of information, outside of COPPA, getting consent is not a uniformly applicable legal requirement yet. Nevertheless, there are some types of information (such as location-based data) for which getting consent may be a good idea.  Moreover, it may be advisable to get consent at the point of collection when sensitive personal data is in play.”

First, what current requirements – laws, agency regulations and quasi-laws – require obtaining consent, even if not “uniformly applicable”?

1. Government Enforcement.  The Federal Trade Commission’s November 2011 consent decree with Facebook user express consent to sharing of nonpublic user information that “materially exceeds” user’s privacy settings.  The FTC was acting under its authority under Section 5 of the FTC Act against an “unfair and deceptive trade practice”, an authority the FTC has liberally used in enforcement actions involving not just claimed breaches of privacy policies but also data security cases involving managing of personal data without providing adequate security.

2. User Expectations Established by Actual Practice.  The mobile space offers some of the most progressive (and aggressive) examples of privacy rights seemingly established by practice rather than stated policy.  For example, on the PrivacyChoice blog, the CEO of PlaceIQ explained that “Apple and Android have already established user expectations about [obtaining] consent.  Location-based services in the operating system provide very precise location information, but only through a user-consent framework built-in to the OS.  This creates a baseline user expectation about consent for precise location targeting.”  (emphasis added) Continue reading

For businesses, is there an obligation in the United States to do anything more than simply have a privacy policy?  The answer is not much of an obligation at all.

Put another way, is it simply a question of disclosure – so long as a business tells users what it intends to do with their personal information, can the business pretty much do anything it wants with personal information?  This would be the privacy law equivalent of the “as long as I signal, I am allowed to cut anyone off” theory of driving.

Much high-profile enforcement (via the Federal Trade Commission and State Attorneys General) has definitely focused on breaches by businesses of their own privacy statements.  Plus, state laws in California and elsewhere either require that companies have privacy policies or require what types of disclosures must be in those policies, but again focus on disclosure rather than mandating specific substantive actions that businesses must or must not take when using personal information.

As The Economist recently noted in its Schumpeter blog, “Europeans have long relied on governments to set policies to protect their privacy on the internet.  America has taken a different tack, shunning detailed prescriptions for how companies should handle people’s data online and letting industries regulate themselves.”   This structural (or lack of structural) approach to privacy regulation in the United States can also been seen – vividly – in legal and business commentary that met Google’s recent privacy overhaul.  Despite howls of displeasure and the concerted voices of dozens of State Attorneys General, none of the complaints relied on any particular violations of law.  Rather, arguments (by the AGs) are made about consumer expectations in advance of consumer advocacy, as in “[C]onsumers may be comfortable with Google knowing their search queries but not with it knowing their whereabouts, yet the new privacy policy appears to give them no choice in the matter, further invading their privacy.”

Again, there’s little reliance on codified law because, for better or worse, there is no relevant codified law to rely upon.  Google, Twitter and Facebook have been famously the subjects of enforcement actions by the states and the Federal Trade Commission, and accordingly Google has been careful in its privacy rollout to provide extensive advance disclosures of its intentions.

As The Economist also reported, industry trade groups have stepped in with self-regulatory “best practices” for online advertising, search and data collection, as well as “do not track” initiatives including browser tools, while the Obama Administration last month announced a privacy “bill of rights” that it hopes to move in the current or, more realistically, a future Congress.

This also should not ignore common law rights of privacy invasion, such as the type of criminal charges successfully brought in New Jersey against the Rutgers student spying on his roommate.   These rights are not new and for the time being remain the main source of consumer recourse for privacy violations in the absence of meaningful contract remedies (for breaches of privacy policies) and legislative remedies targeted to online transactions.

More to come on this topic shortly.

“With regulators considering easing fund-raising rules for start-ups …” a recent Wall Street Journal story began, “social-networking sites that link entrepreneurs to large pools of donors are gearing up for a boom.”

First, the background.  Federal and state securities laws govern the sales – including the solicitation of sales – of securities, affecting all efforts to raise capital for startups.  This includes any public efforts to raise money, and includes raising small or large amounts of money.  Generally, sales and solicitations of sales of stock require compliance with SEC and various state securities law, and more particularly the registration requirements of those laws. Continue reading

A privacy policy?  Who needs a privacy policy?  Privacy is a mess.  You’re building an online business, and you figure you have to have a privacy policy.  But why?  Is “because everyone else has one” a good enough reason?  Ever wonder what you really need to know about privacy law?  I mean … what you have to comply with as a business operating in an online environment?

Here, then, the first of several Frequently Asked Questions about privacy policies.  Or to be more precise, here now some practical answers on privacy practices:

FAQ #1: Can I simply post a privacy policy and forget about it?  Short Answer: No.  Longer Answer: No, because as between posted statements and actual compliance, actual compliance is what’s required.   Continue reading

Podcast #2: January 6, 2011

Audio clip: Adobe Flash Player (version 9 or above) is required to play this audio clip. Download the latest version here. You also need to have JavaScript enabled in your browser.

In today’s podcast, we cover trademark cases from both U.S. and European Union courts involving major search engines such as Google and Yahoo.  In particular, we look at whether and how search engines can be held responsible for trademark infringement when advertisers buy search result advertisements using the trademarked names of their competitors.

My guest is Howard Hogan, a partner in Gibson, Dunn, & Crutcher’s Washington, DC office.  Howard’s practice focuses on intellectual property litigation and counseling, including trademark, copyright, patent, false advertising, licensing, media and entertainment, and trade secret matters.

The trademark issue arises because in many countries, including the US, the search engines allow companies to advertise next to search results using their competitors’ trademarks.  We have seen a major shift in the last year.  Before 2010, it was clear that at least in France and Germany, it was not appropriate for search engines to sell marks, and Google’s policy reflected that.  In the US, there was a divide between the district courts of the Second Circuit and the rest of the country as to whether buying and selling trademarks for search engine advertising constituted a “use in commerce,” but there was very little law on whether that use was likely to cause confusion.

Now, in Europe, the law seems to have shifted against holding search engines liable, but leaving open the potential for trademark holders to go after the advertisers.  In the U.S. the “use in commerce” question has been resolved decisively against the search engines, and the debate has shifted to the “likelihood of confusion” question.  On one hand, we are starting to see more decisions finding that their sale of the marks are not confusing (Rosetta Stone, Boston Duck Tours, College Network) at the same time as other courts are finding that the use of marks by an advertiser are likely to cause confusion (Storus, Skydive Arizona).

Please press play on the audio player to hear the podcast.

Audio clip: Adobe Flash Player (version 9 or above) is required to play this audio clip. Download the latest version here. You also need to have JavaScript enabled in your browser.

A little-appreciated requirement for trademark owners is a duty to monitor and police their trademarks.  This duty applies to owners of unregistered trademarks as much as federal registered marks, since registration is not necessary to claim many trademark rights.

What types of activities must be monitored and policed?  Infringement and dilution.  Or in other words, any third party uses of the same trademark or confusingly similar versions that might cause confusion in the marketplace about the source of the goods or services represented by the trademark.

Trademark Duty to Monitor and Police

2 basic reasons to monitor and police: First, the government won’t do it for you.  The Trademark Office is actually quite explicit about stating this, see here.  Second and more to the point, unchallenged third party uses of a trademark could legally – and actually – weaken the strength of the trademark as an identifier of the owner’s goods or services, which in turn weakens the owner’s ability to later enforce the trademark and devalues the worth of the mark. Continue reading

FTC enforcement of its new blogger guidelines has involved typically high-profile actions against Anne Taylor LOFT (FTC ultimately taking no action) and Reverb Communications (for allegedly deceptive postings of positive reviews on iTunes for games produced by Reverb clients).

While premature to draw any broad conclusions on the enforcement environment for the new rules, a philosophical problem with the FTC’s new blogger framework is its willful ignorance of the advertising underpinnings of traditional media.

So, for example, while established newspapers like the New York Times and Washington Post depend for their credibility on perceived soundness of the journalistic “church-state” divide, readers are almost never proactively alerted to major advertising support from common story subjects in business and politics.  Disclosure more typically comes from investment or ownership relationships, in the form of “full disclosure” statements like that from Ezra Klein when reporting about Facebook (“Disclosure: Washington Post Co. Chairman Donald E. Graham is on Facebook’s board, and The Post markets itself on Facebook.”).  Not, though, from advertising relationships, even major advertisers.

At least not with newspapers.  PBS’ Newshour, NPR and other public news broadcasts commonly disclose underwriting relationships involving story subjects.  However, the same cannot be said of commercial television news broadcasts unless they involve investment or ownership relationships.

Since the underwriting structure of public broadcasting is substantively no different than the advertising relationships of newspapers, commercial television and most media websites, editorial disclosure of the financial support – of any kind – of such media outlets seems equally appropriate.

Citizen Media Law Project, in its coverage of Anne Taylor action, notes that the FTC guidelines limit disclosure to cases where the sponsorship relationship is not “reasonably expected by the audience”.

Put in the context of audience reasonable expectation, this seems rather generously written for the benefit of old-line media, which has relied for generations on the presumption of credibility by its readership much more so than disclosure.

Why then, shouldn’t bloggers be afforded the same benefit of the doubt that newspaper publishers have been given for generations?  Yes, there will always be egregious cases of paid-for “earned media” such as the Reverb case with iTunes.  But it used to be that time and dedicated readership was the ultimate arbiter of media influence.

This all begs the question of why the expectation of the relationship – rather than actual influence – is the measuring stick.

[Thomas Yarnell contributed to research and drafting on this post.]

Google’s popular and dominant advertising service, AdWords, allows companies to place auction-style bids on search keywords.  If a company bids the highest amount on a keyword, that company’s ad comes up first when someone searches the keyword.  The company then pays Google on a pay-per-click basis.  In many countries, including the United States, Google lets companies advertise next to search results from use of their competitors’ trademarks.

Let’s say you want to buy a Louis Vuitton bag.  You know it’s expensive, so you might not want to buy it directly from the company’s website.  Instead, you might search “Louis Vuitton bags” on Google and assess other options.  As you can see in a search of “Louis Vuitton bags”, you may find some “Sponsored links” to the right of your search.  Sponsored links such as the “Louis V. Bags Handbags” come from the AdWords service. Continue reading

I will be moderating 2 separate panels on Monday and Tuesday at the 2010 Politics Online conference spectacular here in Washington.

The first will be Monday April 19th at 2pm, and called “Is this Barack Obama’s Real Facebook Page? Domains, Twitter Handles, Online Presence – real or fake? Intellectual Property, Cyber Identity, and More!”.  I will be joined on the panel by Jason Torchinsky of Holtzman-Vogel, Matt Sanderson of Caplin & Drysdale and Neal Seth of Baker Hostetler.

The second will be Tuesday April 20th at 10:30am, and called “Laws Affecting Digital Communications – Copyright, Privacy, Elections/FEC, Advertising, Libel, Contract Law, etc.  Rules, Regs, Fines and Community “Standards” Applicable to Communicating in Digital Media.”  On this panel, I will be joined by Jason Torchinsky of Holtzman-Vogel and John Stewart of Crowell & Moring.

Details at polc2010.com/.

Publishers are worried about cookies, specifically talk of regulatory action on the privacy front.  What’s the story here?

A Privacy Policy might typically say something like this:

“A ‘cookie’ is a small text file on your computer’s hard drive that our Web site uses to collect information about how you use our site.  The cookie transmits this information back to our Web site each time you visit a page on our site, thus allowing us to identify our most popular pages, features and data.”

To someone not working for an ad agency or at a publisher or for, say, Google, reading these terms, what they might read could be summarized like this: “Software … embedded in my computer … I have no choice … it stays there forever and ever … it will watch my every move and report back to its masters and possibly the government … my wife might find out.”

Continue reading