All About Advertising Law - Venable LLP

Upcoming Panel: "Countdown to the New COPPA"

The Clock Is Ticking – Is COPPA Compliance a “Mission Impossible”?

On July 1, 2013, sweeping new regulations for marketing to children take effect. In updating the Children's Online Privacy Protection Act (COPPA) Rule, the Federal Trade Commission (FTC) has extended its reach to new businesses and new information.

In this upcoming session presented by the Direct Marketing Association, panelists including Venable's Stu Ingis and Julia Kernochan Tama will walk through the COPPA Rule changes, take a deep dive into the FTC's "Complying with COPPA" FAQs, and answer your questions about how to stay on the right side of the regulators. DMA's Jerry Cerasale, Senior Vice President for Government Affairs will also present.

May 30, 2013
2:00 PM – 3:00 PM ET
Click here to register.

California's Song-Beverly Credit Card Act Does Not Apply to Online Downloadable Purchases

For now, online retailers can rest assured that they are not liable under California’s Song-Beverly Credit Card Act if they require customers to enter their addresses or phone numbers in order to complete downloadable online purchases.  On February 4, 2013, the California Supreme Court held in Apple Inc. v. Superior Court (Krescent) that the Credit Card Act’s prohibition against recording customers’ personal identification information as a condition of credit card purchases under those circumstances. This provide significant relief to online retailers, who otherwise could have been exposed to up to $1,000 in statutory penalties each time a customer had to enter personal identification information in connection with an online downloadable credit card purchase.

David Krescent brought a putative class action against Apple in June 2011, claiming that Apple violated the Credit Card Act when it required him to provide his telephone number and address in order to purchase online media downloads. 

The California Supreme Court had to determine whether the Credit Card Act, which was “enacted in 1990 . . . almost a decade before online commercial transactions became widespread,” was intended to apply to online transactions or only to brick-and-mortar retail transactions.

Since it was not clear whether the Legislature intended for the Credit Card Act to cover online transactions, the Court considered its legislative history and purpose, finding that the enactment of the Credit Card Act balanced consumer privacy protection with retailers’ concerns about the risk of fraud.  In 1991, the Credit Card Act  was amended to clarify that retailers could require customers to provide photo identification and could record a customer’s driver’s license number if the customer did not make the credit card itself available for verification.  This “key antifraud mechanism,” however, is not applicable to an online retailer who cannot visually inspect a credit card, signature, or photo. 

Based on the Legislature’s concern that an antifraud mechanism be available and the fact that the mechanism provided in the statute is not available to online retailers, the Court concluded that the Legislature could not have intended the Credit Card Act to apply to online transactions for downloadable purchases.

While the Court’s holding is a win for retailers with an online presence, the Court invited the Legislature “to revisit the issue of consumer privacy and fraud prevention in online credit card transactions,” so the victory could be short-lived.  Meanwhile other questions, such as the application of the Credit Card Act to online transactions not involving downloadable products, still remain open.  Finally, the Court’s decision will have little, if any, immediate impact on the dozens of ongoing class action lawsuits in which plaintiffs allege that retailers’ in-person collection of their ZIP codes violates the Credit Card Act.

Melissa McLaughlin, Doug Emhoff, Stu Ingis and Milo Cividanes

Upcoming Panel: "COPPA: The Final Word"

On July 1, 2013, sweeping new regulations for marketing to children take effect.  (See details here).  In updating the Children’s Online Privacy Protection Act (COPPA) Rule, the Federal Trade Commission has extended its reach to new businesses and new information.  Even if you were safe in the past, you may not be in this brave new regulatory world.  Learn from the experts and avoid the pitfalls of COPPA compliance in the Digital Age… 

COPPA: The Final Word
Monday, January 14 at 2:00 p.m. ET
Venable LLP, 575 7th Street NW, Washington, DC
(Dial-in Available for Remote Attendees)
RSVP to Attend

Panelists include:

• Mamie Kresses, Senior Attorney, Bureau of Consumer Protection, Federal Trade Commission
• Stu Ingis, Partner, Venable LLP
• Jerry Cerasale, Senior Vice President, Government Affairs, Direct Marketing Association

Hosted by

• Direct Marketing Association
• Venable LLP

In partnership with

• Association of National Advertisers
• Interactive Advertising Bureau
• American Association of Advertising Agencies
• Entertainment Software Association

Share

It's Beginning to Look a Lot Like… COPPA

Just in time for Christmas, the Federal Trade Commission (“FTC”) has unveiled its long-anticipated update to the Children’s Online Privacy Protection Rule (“COPPA Rule”).  The COPPA Rule, which has been in place since 1999, imposes a variety of privacy requirements on “operators” of websites and online services that are “directed to children” under 13 or have actual knowledge that they are collecting “personal information” from children.  Among other requirements, such operators must provide notice of their practices and obtain verifiable parental consent before collecting, using, or disclosing personal information from children. 

Beginning on July 1, 2013, the COPPA Rule will impose new duties on operators that already fall under COPPA, while also extending the scope of the Rule to reach additional operators that previously fell outside the Rule.  Sites and services that may be affected by these changes will want to reassess their practices in light of this significant rulemaking. 

Among other notable changes, the revised COPPA Rule will have the following effects:

• The COPPA Rule will apply to additional categories of “personal information” such as certain geolocation information; photo, audio, and video files with a child’s image or voice; screen or user names; and persistent identifiers (such as cookies and IP addresses) that can be used to recognize a user over time and across different sites or services. 
• However, under an exception, operators may continue to collect and use persistent identifiers without parental notice and consent for certain internal support purposes.  Although contextual advertising is considered internal support, online behavioral advertising is not. 
• The COPPA Rule will hold first-party sites and services strictly liable for the activities of third parties – such as ad networks and social plug-ins – that collect personal information from their users, if the collection benefits the site or service.
• In addition, such third-party services will be directly subject to COPPA if they have actual knowledge that they are collecting personal information from a child-directed site or service.
• Sites and services that are “directed to children” under the COPPA Rule, but do not target children as their primary audience, will have the option of age-screening all users and then obtaining parental notice and consent with respect to those users that identify themselves as being under 13.  In contrast, sites and services that target children as their primary audience must continue to treat all users as children.
• Operators will be required to comply with new data retention and deletion guidelines, but there is no specific time limit for retention.  In addition, operators that release personal information to third parties will need to take reasonable steps to select third parties capable of providing data security and obtain assurances that they will do so.
• Operators that choose to participate in FTC-approved safe harbor programs will be subject to annual assessments by the safe harbors, and the safe harbors will report annually to the FTC on aggregate assessment results and any disciplinary actions.

Milo Cividanes, Stu Ingis and Julia Kernochan Tama

Share

Ensuring Privacy and Compliance in the World of Children's Apps: A Brief Guide to the FTC's Second Report on Mobile Apps for Kids

The children were nestled all snug in their beds, while visions of Angry Birds® danc’d in their heads,

And Mama with her iPad®, and I with my Nook®, just stared at the screens, all chatting forsook…

No one can deny the prominent role electronic devices play in our daily lives, and children, unsurprisingly, have jumped on the technology bandwagon with enthusiasm. A Nielsen Company survey reveals that 48% of surveyed children ages 6-12 want an iPad above all else this year for the holidays. Savvy mobile app developers would be wise to take advantage of this ever-growing market, but they should do so while being cognizant of and compliant with applicable federal laws and regulations regarding the collection of information from kids.

On December 12, 2012, the Federal Trade Commission (“FTC”) released a report entitled “Mobile Apps for Kids: Disclosures Still Not Making the Grade.”  This report is the second FTC report on children’s privacy issues surrounding mobile apps this year. In this second report, the FTC reveals the results from a survey it conducted in which it compared the actual practices of children’s apps to their accompanying disclosures. After analyzing the survey results, the FTC expressed disappointment that many children’s apps collect and transmit children’s information from mobile devices (unique identifiers, phone numbers, and geolocation data), provide links to social networking services, and allow for in-app purchases without disclosing any of these practices to parents prior to app download.

If a mobile app developer wants to develop an app for kids, they should be sure to:

1. Incorporate privacy protections into the design of the app (“privacy by design”). This means considering privacy as you design the app by making the default information sharing practices and sharing settings consistent with users expectations, providing easy to locate privacy controls, and getting express consent from users for data collection or sharing that is inconsistent with what users expect.
2. Provide parents with clear and understandable choices about the data collection and sharing allowed by the kids’ app in the disclosures. Privacy policies should appear in the app store and other easy-to-find locations prior to download.
3. Include details in the disclosures of how data is collected, transmitted, and shared through the children’s app. Make sure what you say about your app’s practices is clear, consistent, and truthful, and fully discloses the app’s data collection and sharing practices.

Importantly, the report also reveals the FTC’s plan to launch multiple nonpublic investigations of mobile app developers. These investigations will seek to determine whether the targeted mobile app developers are in compliance with the Children’s Online Privacy Protection Act (“COPPA”) and whether they are engaged in any unfair or deceptive trade practices in violation of the FTC Act. Moreover, the FTC indicates in the report that it plans to conduct a third survey of kids’ apps and to develop and issue consumer education targeted at parents. The FTC hopes consumer education will help parents navigate the mobile app marketplace and avoid those children’s apps that fail to provide sufficient disclosures.

In light of this most recent report, the settlement of the FTC’s first enforcement action against a mobile app developer for potential COPPA violations, and revisions to COPPA that came out this week, the FTC has demonstrated a strong interest in children’s privacy issues. Developers of mobile apps would be well advised to review their disclosures and practices used for kids’ mobile apps to ensure that they comply with relevant federal laws and regulations.

Kelly DeMarchis and Kristen Brown

Share

Federal Trade Commission Looks at "The Big Picture"

Carrying out a plan announced earlier this year, the Federal Trade Commission (“FTC”) convened a day-long public workshop on “The Big Picture: Comprehensive Online Data Collection” on December 6, 2012.  The workshop was intended to examine the practices and privacy implications of “comprehensive” data collection about consumers’ online activities.  Data collection capabilities of entities like Internet service providers and operating systems were discussed, but many speakers also focused heavily on data collection for advertising purposes using technologies such as cookies and web beacons.

FTC Commissioner Julie Brill, who opened the conference, voiced concern that online data could be used to harm consumers at work or in the financial arena.  She expressed interest in considering how the FTC’s existing recommendations for commercial data practices should apply to comprehensive online data collection.  FTC Commissioner Ohlhausen, speaking later in the day, stated that an eventual privacy framework should meet certain principles including technology neutrality, focus on consumer harm, and promotion of market approaches.

The workshop included panels on the risks and benefits of online data collection, consumer attitudes and choices, and the future of such collection. Several themes emerged from these discussions.  Some speakers, generally consumer advocates and academics, argued that online data collection presents risks of harm to consumers.  They contended that consumers cannot respond to these risks in the market because they are unaware of commercial data practices.  Other speakers from industry and academia highlighted the benefits of data collection, arguing that any regulation should not restrict collection but rather should address any data uses that cause concrete consumer harm in a technology neutral fashion.  Many speakers agreed that comprehensive data collection does not typically occur because consumers divide their time among many devices, browsers, and networks.

Milo Cividanes, Stu Ingis and Julia Kernochan Tama

FTC to Apps: "We've Got a Guide for That"

Mobile apps are off the hook! For those of us a bit older, the world clearly is “Going Mobile.” 
Just this week, the White House launched its new mobile app, the Pew Research center released a study on Americans’ privacy concerns with apps, Angry Birds marked Freddie Mercury's birthday by giving him a cameo appearance and most importantly to all of you the FTC published its new guide for app developers on how to market their products legally.  The FTC’s guide gives mobile app developers a primer on observing the agency’s advertising and privacy principles, noting that an app’s compliance program should be designed from the product’s launch.  The guide emphasizes that even the smallest app distributer is considered an advertiser, so the FTC will not entertain any excuses for non-compliance – not even from the little guys.
 
The FTC’s guiding principles for apps are very similar to other truth-in-advertising standards in traditional marketing formats.  For example, app developers must be honest about what the app can do.  Like the substantiation standards in other contexts, if objective claims are made about the app, "competent and reliable" evidence is required.  If health or performance claims are advertised in the app, "competent and reliable scientific evidence" is the standard. 

Key information about an app must also be disclosed clearly and conspicuously; app disclosures cannot be buried in long licensing agreements or only found by following vague hyperlinks.  The mobile app guide does not help developers figure out to make these clear and conspicuous disclosures on the limited real estate of mobile devices.  Perhaps the FTC’s updated “Dot Com Disclosures” guidance promised for this Fall will help on that front.   

The FTC’s guide also encourages app developers to build privacy protections into the technology from the get-go and to limit the amount of information collected to what is necessary.  The FTC advises that apps offer choices to users, like opt-outs and privacy settings, that are easy to find and easy to use.

App developers should also be transparent about their data practices.  If the fact that an app collects information about the user is unclear to the user, the developer should be sure to get a user’s express consent before the data is collected.  Sensitive information (for example, a person’s medical, financial, or precise geolocation data) should never be collected without the express agreement of the consumer.  The FTC’s guide warns that it’s a mistake for an app developer to simply assume a user won’t mind if an app collects their personal data.

Apps designed for children, of course, raise special concerns.  If an app developer knows that it’s collecting personal information from kids, it must be sure the program is in compliance with the additional requirements of the Children’s Online Privacy Protection Act. 

Finally, the FTC notes that any app collecting user data must have a system in place to ensure that the data is securely kept.  App developers are required to honor any representation they make to users about their data privacy practices.  After all, the FTC expects app developers – just like all other marketers—to keep the promises they make.

Len Gordon and Maura Marcheski

Share

FTC Modifies COPPA Rule Proposal

The Federal Trade Commission (“FTC”) has released a new set of proposed amendments in its ongoing review of its Children’s Online Privacy Protection Act (“COPPA”) regulations. These amendments would alter key definitions in the COPPA regulations, modifying the FTC’s original proposal from September 2011. If finalized, the FTC’s proposals to date will significantly change who and what COPPA covers and when COPPA applies. Comments are due by September 10, 2012.

WHO is responsible for COPPA compliance: The FTC has clarified its proposals for how COPPA compliance responsibility would be assigned in situations when third parties collect data through websites or online services (“sites” or “services”) operated by other entities. There are two sides to this equation:

     • First, the FTC intends to add a proviso that will make sites and services responsible, in many cases, for executing COPPA requirements for third parties on their online properties. Examples of third parties are ad networks and social plug-ins. Sites and services would be “operators” if a third party collects “personal information” in the interest of, as a representative of, or for the benefit of the site or service where the data is collected. This broad proviso would encompass, for example, any data collection that benefits a site or service by supplying ad revenue, content, or functionality.

      • At the same time, the FTC would limit which third-party data collectors would be directly responsible for COPPA compliance. By statute, COPPA applies to operators of sites or services that are directed to children or have actual knowledge that they are collecting personal information from children. Recognizing that third parties face challenges in controlling or monitoring how their services are deployed, the FTC would provide that third-party operators would be “directed to children” only if they know, or have reason to know, that they are collecting “personal information” through another site or service that is directed to children.

WHEN a site or service is “directed to children”:

    • In addition to addressing third-party data collectors, the FTC would redefine when first-party sites and services are “directed to children.” Currently, numerous factors determine whether a site or service is “targeted to” children. While these factors would be retained, the new “directed to children” definition would include sites and services that either “knowingly target” or are “likely to attract” children as a primary audience.

      • The FTC also proposes a new approach for sites and services with mixed audiences of children along with teenagers or adults. Any site with a “disproportionately large” percentage of children in its audience would now be “directed to children,” but would have more flexibility in complying with the law. Such mixed-audience sites could either fulfill COPPA requirements for all users, or could age-screen all users and then fulfill COPPA requirements only for children. Coupled with the FTC’s proposed new definition of “personal information,” this provision could significantly expand the reach of COPPA.

WHAT “personal information” COPPA covers:

    • The FTC is attempting to clarify when “persistent identifiers” count as “personal information.” Currently, persistent identifiers are “personal information” only when combined with certain other types of data. Under the FTC’s new proposal, “personal information” would include persistent identifiers that can be used to recognize users over time or across different sites or services, unless such identifiers are used only to support internal operations. The FTC would define a list of acceptable “support” activities; using identifiers for any purpose that is not listed would trigger COPPA.

    • Last year, the FTC proposed to add any “screen or user names” to the list of “personal information” under COPPA. The FTC now states that screen or user names should be “personal information” only when they function as online contact information.

     • The FTC has not retreated from its 2011 proposals to expand “personal information” to include, for example, audio and video files, photographs, certain geolocation information, and other “online contact information” such as VOIP and video chat identifiers. Taken together, these proposals would apply COPPA, for the first time, to many data elements that sites and services previously collected in order to avoid requesting more identifiable details from children.

Julia Tama, Milo Cividanes and Stu Ingis

A Short History Of The FTC’s “In Short: Advertising and Privacy Disclosures in a Digital World” Workshop

Yesterday, the FTC convened a day-long public workshop to discuss updating its “Dot Com Disclosures” guidance on presenting online advertising disclosures. The FTC is considering whether it should overhaul this guidance, which dates to 2000, to address current trends such as social media and mobile advertising. The workshop also included a panel devoted to mobile privacy disclosures. Newly confirmed Commissioner Maureen Ohlhausen kicked off the event by explaining that the FTC does not intend to expand its Section 5 authority, but wants to shed light on how existing legal principles should apply to new technologies. Mary Engle, the head of the FTC’s Advertising Practices Division, told participants that new technology platforms should adapt to existing legal principles, not the other way around. But discussion at the workshop highlighted the challenges of reaching this goal in a way that is technically feasible and does not detract from users’ experience. One obvious challenge is the space limitations of mobile devices and certain social media platforms, which give advertisers less room to provide disclosures. Numerous panelists opined that, despite these limitations, disclosures should still be placed near advertising claims. A few panelists suggested that ad campaigns that require extensive disclosures should not use platforms where such disclosures are not feasible. To cope with space limits, some panelists endorsed the concept of standardized icons, labels, and other shorthand signals that give consumers access to disclosures. The mobile privacy disclosures panel featured several presentations by programs that are developing such offerings. Other panelists, however, expressed concern that these signals may not be understood by consumers, or saw a need for more consumer education to promote understanding. Numerous panelists also advocated for the FTC to retain flexibility for companies and for social media users. Another challenge is the fact that digital content can easily be relocated in cyberspace, potentially losing or altering disclosures in the process. For example, the panel on social media disclosures discussed the challenge of ensuring that disclosures travel with promotional messages when blog content is repurposed or syndicated. Disclosures presented in a sidebar will be lost if the blog is viewed in an RSS feed. Translating webpages from desktop to mobile environment can also affect how consumers see disclosures. The FTC now faces the task of distilling these and other workshop discussions, as well as comments solicited last year, into concrete guidance for the business community. Ms. Engle, the Advertising Practices chief, pledged that the FTC will seek to turn these “shades of gray” into “as many … blacks and whites as we can.” To that end, the FTC will be accepting comments until July 11 and expects to issue its new guidance as early as the fall.

Stu Ingis, Milo Cividanes, Julia Kernochan Tama,  and Michael Signorelli

Do Not Text: Payless Enters Into NonCash Class Action Settlement

Underage sexting and texting while driving aren’t the only text-related legal battles that are being fought out there. Text messaging by advertisers to consumers is also highly regulated. Companies should only send text messages to those consumers who have given their prior express consent to such text messages (pursuant to a recent FCC order such consent must be in writing beginning next February.)  You should also check to make sure that consumers' telephone numbers aren’t registered on any Do Not Call lists.

Late last month, the team here at Venable obtained final approval of a non-cash settlement of a class action suit relating to texting that had been brought against Payless ShoeSource, Inc.  Plaintiffs alleged that Payless had violated the Telephone Consumer Protection Act by sending promotional text messages without their prior express consent. The parties reached a settlement agreement, under which each class member will receive a $25 merchandise certificate redeemable at any Payless retail store in the United States. If less than $5 million of the value of the merchandise certificates end up getting redeemed, then Payless will make cy pres contributions to charities in the form of $15 merchandise certificates redeemable at any U.S. Payless store. Payless is responsible for ensuring that at least 85% of the value of the cy pres contribution is realized through redemption of these cy pres merchandise certificates.

Not only does the case demonstrate that non-cash settlements are still possible in the post-Class Action Fairness Act era, but it serves as a reminder that you can never be too careful when conducting a text message marketing campaign. Payless implemented a "double opt-in” texting program in October 2010, under which no person would receive promotional text messages unless they actively opted into the program, and then reconfirmed their decision, and it has proved very successful.  Now, if only there were a way for some of us over the age of 40 to understand what these texts mean.  B4N BBIAW with MTF.

Annie H. Lee