Social media sites are transforming not only the daily lives of consumers, but also how companies interact with consumers. Here at Morrison Foerster, across all of our practice groups, we are seeing complex, cutting-edge legal issues arising out of social media. As with the Internet boom during the mid-to-late 1990s, social media is generating new legal questions at a far faster pace than the law’s ability to provide answers to such questions. In an effort to stay on top of these emerging issues, and to keep our clients and friends informed of new developments, Morrison Foerster publishes this blog devoted to the law and business of social media.<h2>ABOUT MORRISON FOERSTER</h2>Morrison Foerster is a leading global law firm that transforms complexity into advantage for its clients. Our clients include some of the largest financial institutions, banks, consulting and accounting firms, and Fortune 100, technology, and life sciences companies. Highlighting the firm’s commitment to client service, leadership in market-changing deals and impact litigation, and values-based culture, Morrison Foerster has been repeatedly recognized as one of the top 10 firms on The American Lawyer’s A-List. Year after year, the firm receives significant recognition from Chambers and The Legal 500 across their various guides, including Global, USA, Asia‑Pacific, Europe, UK, Latin America, and FinTech Legal. Our lawyers passionately care about delivering legal excellence while living our values. Morrison Foerster has a long-standing commitment to creating a culture that respects and celebrates differences, while providing an inclusive environment. The firm has achieved Mansfield Certification Plus since 2018 as a result of successfully reaching at least 30 percent women, communities of color, and LGBTQ+ lawyer representation in a notable number of current leadership roles and committees. The firm also has a long history of commitment to the community and society through providing pro bono legal services, including litigating for civil rights and civil liberties, improving public education and fostering the wellbeing of children, advocating for veterans, promoting international human rights, enforcing the right to asylum, and safeguarding the environment.

Social

Search

sociallyaware-abajournalweb100-1

Aaron is the chair of the firm’s Technology Transactions Group and co-chair of the Interactive + Digital Media Group. He advises clients on a wide range of complex transactions involving intellectual property and technology, including structuring and negotiating strategic licensing, development, collaboration, procurement, and distribution deals.Aaron’s practice focuses on advising both established and emerging companies in a variety of data- and technology-intensive sectors, including software, SaaS, cloud-based technology, digital media (social media, AR/VR, gaming, streaming media, AdTech), AI, healthcare, consumer electronics, e-commerce, other online business models, and mobile applications. He also maintains an active practice counseling companies on branding and marketing, trademark licensing, and content-related transactions, as well as the intellectual property aspects of mergers, acquisitions, asset spin-offs, and private equity investments.He has represented clients such as Autodesk, Meta, OpenAI, Splunk, Konami, Kaiser Permanente, SoftBank, Visa, and Yahoo, among others.Aaron has been recognized by numerous publications for his work on market-defining technology transactions. He is currently ranked by Chambers USA for “Technology Transactions.”Aaron also serves as co-editor of Socially Aware, the firm’s award-winning newsletter and blog devoted to the law and business of social media, and regularly publishes on various IP and technology-related topics. Aaron is also a sought-after speaker on new and emerging areas of law, and is a frequent presenter and panelist at conferences and legal services programs. In addition to his active practice, Aaron regularly provides pro bono assistance to various nonprofit and charitable organizations such as Common Sense Media and the Starlight Children’s Foundation. He is a member of the board of directors of California Lawyers for the Arts.While in law school at the University of California, Berkeley, Boalt Hall School of Law, Aaron served as executive editor of the California Law Review and was elected to the Order of the Coif. Following law school, Aaron served as law clerk to the Honorable William H. Orrick and the Honorable Martin J. Jenkins, both United States District Judges for the Northern District of California.

rubin_aaron_blog_150x150.png

rubin_aaron_common_640x280.jpg

rubin_aaron_heroretina_2700x1160.jpg

rubin_aaron_mobileretina_750x1040.jpg

rubin_aaron_social_600x600.jpg

Partner

Aaron is the chair of our Technology Transactions Group. He advises clients on a wide range of complex transactions involving intellectual property and technology, including structuring and negotiating strategic licensing, development, collaboration, procurement, and distribution deals. Aaron’s practice focuses on advising both established and emerging companies in a variety of data– and technology–intensive sectors, including software, SaaS, cloud computing, AR/VR, AI, gaming, healthcare, consumer electronics, social media, e–commerce, other online business models, and mobile applications. He also maintains an active practice counseling companies on the intellectual property aspects of mergers, acquisitions, asset spin–offs, and private equity investments.

Aaron P. Rubin

Lawrence Gallick is of counsel in the firm’s Austin office and a member of the Technology Transactions Group.Lawrence focuses his practice on technology transactions and licensing matters. His diverse experience includes advising on SaaS agreements, cross-licensing agreements, research and collaboration agreements, development agreements, and distribution agreements. He counsels a broad range of companies across the software, hardware, life sciences, biotech and FinTech spaces, as well as other entities including universities.He advises clients in connection with general corporate matters including contract negotiations, and leasing and technology placement agreements.Lawrence also serves as co-editor of <a href="https://www.sociallyawareblog.com/" target="_blank">Socially Aware</a>, the firm’s award-winning newsletter and blog devoted to the law and business of social media, and regularly publishes on various IP and technology-related topics.Prior to joining the firm, Lawrence was counsel at another major law firm. Before earning his law degree, Lawrence was a web consultant, project manager, and web developer in Portland, Oregon, where he managed and consulted on projects using industry methodologies and performed custom development and integration of content management systems.Lawrence was named a Super Lawyers “Rising Star” in 2015 and 2018–2022, and is licensed in both California and New York. Lawrence earned his J.D. from the University at Buffalo School of Law, where he was the electronic systems editor for the Buffalo Law Review and awarded the ABA-BNA Award for Excellence in the Study of Intellectual Property Law.

gallick_lawrence_blog_150x150.png

gallick_lawrence_common_640x280.jpg

gallick_lawrence_heroretina_2700x1160.jpg

gallick_lawrence_mobileretina_750x1040.jpg

gallick_lawrence_social_600x600.jpg

Of Counsel

Lawrence Gallick

Anthony Ramirez is a partner in the Technology Transactions Group in the New York office of Morrison Foerster.Anthony advises clients on general commercial and transactional matters. He regularly advises companies on the IP aspects of their M&A transactions. His clients include technology, digital media and content for television and music, financial services, and communications companies with diverse intellectual property assets and issues.His practice focuses on the legal aspects of developing, licensing, and commercializing technology and intellectual property, as well as negotiating general commercial contracts, including outsourcing transactions, as well as content and data licenses. He regularly assists clients with legal issues relating to licensing and commercialization of digital media and content, digital content that is distributed over the Internet or streamed, mobile applications and social media, as well as the licensing of recorded music for distribution via digital platforms. Anthony is also experienced with issues relating to open-source software, software development, artificial intelligence and machine learning, cloud-based technology, and protection of proprietary information.Anthony has extensive experience working on matters involving disruptive technologies, such as blockchain. He has helped fintech clients with general intellectual property issues in connection with terms of service for online financial products and services.Anthony is an integral part of the outside pro bono legal team for nonprofit organizations based in New York, including advising clients on legal issues regarding entertainment, social media, privacy rights, and the negotiation of outsourcing and service agreements. Anthony received his J.D. from the University of Michigan Law School in 2009. He received his B.S. from Cornell University in 2004.

ramirez_anthony_blog_150x150.png

ramirez_anthony_common_640x280.jpg

ramirez_anthony_heroretina_2700x1160.jpg

ramirez_anthony_mobileretina_750x1040.jpg

ramirez_anthony_social_600x600.jpg

Anthony Ramirez is a partner in the Technology Transactions Group in the New York office of Morrison Foerster. He advises clients on general commercial and transactional matters. His clients include technology, media, and communications companies with considerable intellectual property assets. His practice focuses on the legal aspects of licensing and commercializing technology and intellectual property, as well as negotiating general commercial contracts. He also regularly assists clients with legal issues relating to mobile applications and social media.

Anthony M. Ramirez

favicon.ico

favicon-16x16.png

favicon-32x32.png

apple-touch-icon.png

MoFo Favicons

Socially Aware is devoted to the law and business of social media, proactively addressing emerging issues and keeping our clients informed of new developments. We cover fields such as artificial intelligence, privacy and data security, Section 230, intellectual property, and much more.

Welcome to Socially Aware

240920-socially-aware-header.jpg

Welcome to Socially Aware

240920-socially-aware-header

Socially Aware is devoted to the law and business of social media, proactively addressing emerging issues and keeping our clients informed of new developments. We cover fields such as artificial intelligence, privacy and data security, Section 230, intellectual property, and much more.

News and Announcements

Blog - Terms of Use

Blog - Privacy Policy

Blog - Blog Disclaimer

Blog - Attorney Advertising

morrison-foerster-blog-logo.png

Provides a data-driven look at the Federal Circuit.

Federal Circuitry

Brings together legal insights and in-depth analyses on trends and complex issues shaping the global technology industry.

MoFo Tech

Mofo Tech

Equips our clients with the most up-to-date and relevant information on employment and labor law issues.

Employment Law Commentary

In-depth analysis of developments and trends impacting government contracting.

Government Contracts Insight

Government Contracts Insights

Provides insights and reports on the most current class actions lawsuits and product liability issues that affect consumer-facing companies.

Class Dismissed Blog

Class Dismissed

MoFo’s Socially Aware blog provides timely updates and analysis of the many complex and cutting-edge legal and business issues arising out of social media.

Socially Aware

  Linkedin

MoFo LinkedIN

Socially Aware Blog - RSS

Stay Connected

Never miss a post from Socially Aware. Enter your email below to stay up-to-date.

Subscribe

The Law and Business of Social Media

Morrison Foerster - Footer

Blogs -  Home Button

Home

Blog - Topics

Web Scraping

Advertising

Antitrust

Arbitration

Artificial Intelligence

Asia

Autonomous Vehicles

Bankruptcy

Big Data

Blockchain

Class Actions

Cloud Computing

Compliance

Contracts

COPPA

Copyright

Crowdsourcing

Cyberbullying

Cybersecurity

Data Security

Defamation

Digital Content

Disappearing Content

Discovery

DMCA

E-Commerce

E-Discovery

E-Personation

Electronic Contracts

Employment Law

Endorsement Guides

Ephemeral Messaging

Ethics

European Union

Event

Fair Use

FDA Regulations

Financial Institutions

First Amendment

Fraud

Free Speech

GDPR

Hacking

Influencer Marketing

Infographic

Internet of Things

Investment Management Law

JOBS Act

Labor Law

Litigation

Live streaming

Marketing

Mobile

Online Contracts

Online Endorsements

Online Promotions

Online Reviews

Patent

Privacy

Product Liability

Protected Speech

Right of Publicity

Right To Be Forgotten

Section 230 Safe Harbor

Securities Law

Social Media Policy

Statistics

Status Updates

Stored Communications Act

Supreme Court

Terms of Use

Trademark

UK High Court

User-Generated Content

Wearable Computers

Topics

Blog - Editors

Editors

Blog - About

About

Blog - Subscribe

More

Lawrence W. Gallick

2024 Recap: Ten Lords A-Leaping!

Social Links: If the Suit Fits

Social Links: Age Verification, X Appeal, and the Great White North

Social Links: Fake Reviews, Real Rulings, and an Epic Fail

Lawrence W. Gallick on Toth v. Everly Well, Inc.

We’ve reported before on <a href="http://www.law.cornell.edu/uscode/text/47/230">Section 230</a> of the Communications Decency Act (CDA), the 1996 statute that states, “[n]o provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider.”  Courts have interpreted Section 230 to immunize social media and other websites from liability for publishing content created by their users, provided the site owners are not “responsible in whole or in part, for the creation or development of” the offending content.Two recent federal cases involving the website TheDirty.com show that, 15 years after the landmark <a href="http://en.wikipedia.org/wiki/Zeran_v._America_Online,_Inc.">Zeran v. AOL </a>case interpreting Section 230 immunity broadly, courts still grapple with the statute and, arguably, get cases wrong, particularly when faced with unsavory content.TheDirty.com is an ad-supported website that features gossip, salacious content, news and sports stories.  The site, run by owner/editor Hooman Karamian, a/k/a Nik Richie, prompts users to “submit dirt” via a basic text form requesting “what’s happening” and “who, what, when, where, why,” and allows users to upload files. In response, users, referred to on the site as the “Dirty Army,” submit stories and photographs along with gossip about the people pictured. Richie then posts the pictures and information, often accompanied by his own comments. Two such racy posts, one detailing the sex habits of a Cincinnati Bengals cheerleader and the other about the supposed exploits of a “Church Girl,” led their subjects to bring defamation claims in federal court. Third-party users, not TheDirty.com, generated the content. Cases dismissed on Section 230 grounds, right?  Not quite.In <a href="http://www.citmedialaw.org/sites/citmedialaw.org/files/2012-01-10-SummaryJudgmentDenied.pdf">Jones v. Dirty World Entertainment Recordings</a>, a case in the U.S. District Court for the Eastern District of Kentucky, plaintiff Sarah Jones, a cheerleader for the Cincinnati Bengals football team and also a high school teacher, sued TheDirty.com based on two user-submitted posts that included her picture and statements regarding her sex partners, as well as allegations that she had sexually transmitted diseases. Richie added a one-line comment— “why are all high school teachers freaks in the sack?”—and published the post. Jones requested that the posts be removed, but TheDirty.com refused. Richie also commented on the site directly addressing Jones, saying her concern about the post was misguided and that she was “d[igging] her own grave” by calling attention to it. Jones sought damages for defamation and invasion of privacy under state tort law, and TheDirty.com moved for judgment as a matter of law on CDA immunity grounds.The court held that TheDirty.com did not qualify for CDA immunity because it “specifically encouraged the development of what is offensive about the content” (citing the Tenth Circuit’s opinion in <a href="http://itlaw.wikia.com/wiki/FTC_v._Accusearch">Federal Trade Comm’n v. Accusearch</a>).  The court found that the TheDirty.com encouraged the development of, and therefore was responsible for, the offensive content based on the site’s name, the fact that the site encouraged the posting of “dirt,” Richie’s personal comments added to users’ posts, and his direct reference to the plaintiff’s request that the post be taken down. The court focused on Richie’s comments, including his statement “I love how the Dirty Army has war mentality. Why go after one ugly cheerleader when you can go after all the brown baggers.”The Jones court’s analysis diverges from prevailing CDA case law in a few respects. For example, regarding the issue of responding to a subject’s request that an allegedly defamatory post be taken down, the Ninth Circuit has held that deciding what to post and what to remove are “<a href="http://en.wikipedia.org/wiki/Barnes_v._Yahoo!,%20Inc.">traditional duties of a publisher</a>” for which the CDA provides immunity to website operators.  More critically, in adopting the “specifically encouraged the development of what is offensive” standard coined in Accusearch, the court in Jones reasoned that by requesting “dirt,” the site “encourage[d] material which is potentially defamatory or an invasion of the subject’s privacy,” and therefore lost CDA immunity.  That reasoning, though, could extend to any website functionality, such as free-form text boxes, that permits users to input potentially defamatory material. To hold that a website operator loses immunity based on the mere potential that users will post defamatory content effectively vitiates CDA immunity and parts ways with cases like the Ninth Circuit’s <a href="http://www.ca9.uscourts.gov/datastore/opinions/2008/04/02/0456916.pdf">Roommates.com</a> case, which held that a website’s provision of “neutral tools” cannot constitute development of content for purposes of the exception to CDA immunity. For these and other reasons, one leading Internet law <a href="http://blog.ericgoldman.org/archives/2012/01/thedirty_denied.htm">commentator</a> calls the case a “terrible ruling that needs to be fixed on appeal.” TheDirty.com’s appeal to the Sixth Circuit is pending.In a more recent case, S.C. v. Dirty World, LLC, the U.S. District Court for Western District of Missouri held that Richie and TheDirty.com did qualify for CDA Section 230 immunity on facts similar to those in Jones. The plaintiff in S.C. brought suit based on a user-generated post on TheDirty.com that showed her picture along with a description alleging that she had relations with the user’s boyfriend and attempted to do so with the user’s son. Richie published the post, adding a comment about the plaintiff’s appearance. The court explained that, because a third party authored the allegedly defamatory content, CDA immunity turned on whether TheDirty “developed” the content by having “materially contribute[d] to [its] alleged illegality.”  The court held that the defendants did not materially contribute to the post’s alleged illegality because the defendants never instructed or requested the third party to submit the post at issue, “did nothing to specifically induce it,” and did not add to or substantively alter the post before publishing it on the site.After having noted these facts, and how they differed from the facts in Jones, which the S.C. plaintiff had cited, the court explicitly “distanced itself from certain legal implications set forth in Jones.”  The S.C. court pointed out that a “broad” interpretation of CDA immunity is the accepted view.  It explained that CDA immunity does not, and should not, turn on the “name of the site in and of itself,” but instead focuses on the content that is actually defamatory or otherwise gives rise to legal liability.  The court noted, for example, that the site itself has a variety of content, much of it not defamatory or capable of being defamatory (e.g., sports stories and other news).Given that some may consider TheDirty.com’s gossip content and mission extreme, cases like S.C. likely provide peace of mind to operators of more conventional social media sites.  Still, should Jones survive appeal, it could lead to forum shopping in cases where plaintiffs expect to face CDA immunity defenses, because the “specifically encouraged” standard could, as in Jones, lead to a loss of immunity. We’ll keep you posted on the appeal.

A Dirty Job: TheDirty.com Cases Show the Limits of CDA Section 230

We’ve reported before on Section 230 of the Communications Decency Act (CDA), the 1996 statute that states, “[n]o provider or user of an interactive computer se

A Dirty Job: TheDirty.com Cases Show the Limits of CDA Section 230

In our September 2010 issue of Socially Aware, we provided a brief overview of Facebook’s “<a href="http://www.facebook.com/legal/terms">Statement of Rights and Responsibilities</a>,” the social media service’s complex set of terms and conditions that companies frequently “click-accept” with little review (often, in a rush to establish their Facebook presences).  Naturally, this situation is not limited to Facebook— for many if not most social media services— when users first sign up for an account, they are required to agree to the service’s lengthy standard terms and conditions of use.  It’s part of life on the Internet.And Twitter is no exception.  When you sign up for a Twitter account, “By clicking the button, you agree to the terms below.”  And although Twitter’s core <a href="http://twitter.com/tos">Terms of Service</a> are a bit shorter than Facebook’s Statement of Rights and Responsibilities, Twitter’s terms similarly link and branch off to a variety of policies, guidelines, and related documents, all of which govern your use of the service.At the top of Twitter’s hierarchy of terms and conditions are the <a href="http://twitter.com/tos">Twitter Terms of Service</a>.  Those Terms of Service incorporate two documents by reference:  (1) Twitter’s <a href="http://twitter.com/privacy">Privacy Policy</a>, which notes that use of Twitter’s services constitutes consent to the collection, transfer, manipulation, storage, disclosure, and other uses of information described in such policy and (2) the <a href="http://support.twitter.com/articles/18311-the-twitter-rules">Twitter Rules</a>, which describe how end-users should and should not use Twitter, and impose a variety of rules regarding content, spam, and abuse.  But the Terms of Service also link to Twitter’s <a href="https://developer.twitter.com/en/developer-terms/agreement">Developer Rules of the Road</a> (described by Twitter as “an evolving set of rules for how ecosystem partners can interact with your content”), which govern the use of Twitter’s application programming interface (<a href="https://developer.twitter.com/en/docs/api-reference-index">API</a>) and, more generally, Twitter’s philosophy around how information and content shared on Twitter can and cannot be used.Given the complexity of Twitter’s ecosystem, the Developer Rules of the Road branch off to and incorporate a variety of other policies and guidelines, including the service’s Display Guidelines, (which describe how Tweets must be displayed), <a href="http://support.twitter.com/articles/77641">rules on trademark usage</a>, <a href="http://support.twitter.com/articles/76915">automation rules</a>, <a href="http://support.twitter.com/articles/18311#spam">spam rules</a> (which actually loop back to the end-user-focused Twitter Rules), and various other documents.  A complete list of Twitter’s terms, conditions, rules, guidelines, and best practices can be found <a href="http://support.twitter.com/groups/33-report-a-violation">here</a> — there are 36 documents in total.Below, we describe a few key terms from Twitter’s various written policies.  These terms are not necessarily uncommon for Internet-based services — particularly services that are free to use — but they’re worth keeping in mind:Key Term for End-Users — Broad License to User Content.Foremost for many end-users of social media services, is the license being granted to such services in users’ posted content — and end-users grant Twitter a typically broad license.  By posting photos or other content on Twitter, end-users grant Twitter the right to “use, copy, reproduce, process, adapt, modify, publish, transmit, display and distribute” such content in any manner now known or later developed.  The Terms of Service also expressly provide that such license “includes the right for Twitter to make [such content] available to other companies, organizations or individuals who partner with Twitter” for the purpose of distributing such content on other media and services.  True, given that Tweets are publicly available by their nature (assuming a <a href="http://support.twitter.com/articles/14016-about-public-and-protected-accounts">public account</a>), one would expect a broad license grant.  But the grant to Twitter gives Twitter the right to use Tweets for purposes other than simply operating the Twitter service, and the right to distribute those Tweets in ways that may not have even existed when the Tweets were originally posted.  Although the broad license grant does apply to “protected” Tweets (i.e., Tweets that are not publicly viewable) and public Tweets alike, <a href="http://support.twitter.com/articles/14016-about-public-and-protected-accounts">Twitter does state</a>  that protected Tweets will not appear in Twitter or Google searches, meaning that, as a practical matter, a user’s privacy settings should be useful in controlling how widely Twitter may disseminate the user’s Tweets.Key Terms for Developers — API Terms.  Foremost for many developers who leverage social media services, are the services’ rules for accessing their platforms and APIs.  According to Twitter’s Terms of Service, unless otherwise permitted through Twitter’s services or terms, users are required to use the Twitter API in order to “reproduce, modify, create derivative works, distribute, sell, transfer, publicly display, publicly perform, transmit, or otherwise use” Twitter’s content or services.  In light of this, it is important for developers who leverage Twitter in their own apps and services to carefully review the terms and conditions governing Twitter’s API.  Those terms and conditions are sprinkled throughout Twitter’s policies, including the Developer Rules of the Road (changes to which are archived at Twitter’s API Terms of Service Archive) and Twitter’s Rate Limiting page, which addresses the number of “calls” that can be made to various Twitter APIs and services over time.  Of course, all of Twitter’s API restrictions are in addition to, and not in lieu of, those found in the site’s Terms of Service and elsewhere — per the Developer Rules of the Road, use of the API and Twitter content “are subject to certain limitations on access, calls, and use as set forth in the [rules], on dev.twitter.com, or as otherwise provided to you by Twitter.”  Perhaps most importantly, Twitter retains the right to block use of the API and Twitter’s content if Twitter believes that a user has attempted to circumvent or exceed any limitations imposed by Twitter, and Twitter disclaims any liability for resulting costs or damages.Key Terms for Everyone — Modifications to Twitter’s Terms and Services.  Twitter reserves the right to unilaterally modify its Terms of Service and the form and nature of its services at any time.  If Twitter determines in its sole discretion that changes to its Terms of Service are material, Twitter promises to notify users via a Twitter update or by email; nevertheless, as with changes to most websites’ terms of use, a user’s continued use of Twitter following such changes constitutes the user’s agreement to the modified terms.  It is important to keep in mind that changes in a social media site’s services or terms of use — even seemingly tiny changes in the way a social media profile appears to end-users, or in what flavors of activities are or are not permitted on the site — can wreak havoc on a company’s costly social media strategy.  Conveniently, Twitter provides an <a href="http://twitter.com/tos/previous">archive of previous versions</a> of its Terms of Service, which can help users spot changes over time more easily.Our message to end-users and developers alike remains what it was back in 2010:  be sure to carefully review social media services’ terms and conditions so that you know what you’re getting into, particularly when you will be investing money or time in using a service for your business or building an app or site that relies on the service’s content or functionality.

Caveat Emptor, Part II: A Brief Overview of Twitter’s Terms of Service and Related Documents

In our September 2010 issue of Socially Aware, we provided a brief overview of Facebook’s “Statement of Rights and Responsibilities,” the social media service’s

Caveat Emptor, Part II:  A Brief Overview of Twitter’s Terms of Service and Related Documents

While Facebook, Twitter, LinkedIn and other social media platforms have become an increasingly important tool for businesses across industries to meet their customers’ needs and expectations, financial institutions have been slow to embrace social media.  This is likely attributable to the highly regulated environment in which financial institutions operate, the unique risks associated with operating within it, and the lack of available guidance on how to navigate and mitigate such risks.In an effort to address industry concerns, the California Department of Financial Institutions (“DFI”) – the licensing and regulatory agency that oversees California’s state-chartered financial institutions – recently conducted a survey of more than 340 financial institutions’ use of social media policies.  The survey revealed that 72 percent of the financial institutions surveyed did not have a social media plan, and 59 percent did not have a social media policy.  These findings suggest that either a significant number of financial institutions are not utilizing social media or they are doing so without the important framework needed to help ensure that they do not run afoul of their many regulatory requirements.To that end, the DFI has published guidance on the development of social media policies.  It first addresses how a financial institution should go about developing a social media plan – specifically, by asking itself a variety of questions that form the basis for plan development, including:<ul><li>What does your financial institution expect to gain from using social media?</li><li>Who are the target viewers?</li><li>What types of bank activities and postings are planned?</li><li>What types of social media do you plan to use and how do you plan to use them?</li><li>How will the activities be managed and by whom?</li></ul>The DFI’s guidance also identifies the elements necessary for a financial institution’s creation of appropriate social media policies.  These include:<ul><li>A description of approved social media activities;</li><li>Guidelines for personal use, if allowed;</li><li>Definition of permitted content;</li><li>Inclusion of applicable consumer protection laws and regulations requirements, if the institution’s products and services will be advertised;</li><li>Employee training; and</li><li>Identification of oversight responsibility.</li></ul>The DFI’s three-part series was published in its December, February and March Monthly Bulletin.  The DFI plans to continue to cover these issues in subsequent bulletins.The DFI is not the only regulatory body that is taking action in this area.  The <a href="http://www.ffiec.gov/">Federal Financial Institutions Examination Council</a> (“FFIEC”) – the interagency body tasked with prescribing uniform principles, standards, and report forms for the federal examination of financial institutions – has charged a task force with developing guidance on financial institutions’ use of social media.  In addition, the <a href="http://www.finra.org/">Financial Industry Regulatory Association</a> (“FINRA”) – an independent regulator of securities firms – has published basic guidance in the form of two Regulatory Notices, one in <a href="http://www.finra.org/web/groups/industry/@ip/@reg/@notice/documents/notices/p120779.pdf">January 2010</a> and the other in <a href="http://www.finra.org/web/groups/industry/@ip/@reg/@notice/documents/notices/p124186.pdf">August 2011</a>.While greater input may be required from financial industry regulators as corporate usage of social media continues to evolve, the DFI frameworks and the guidance provided by FINRA are the pragmatic first steps needed by an industry that seems to have partly steered clear of this potentially large, growing, and indispensable channel for reaching its consumers.  Financial institutions should seriously consider reviewing these materials when creating their own plans and policies.

oneill_julie_blog_150x150.png

oneill_julie_common_640x280.jpg

oneill_julie_heroretina_2700x1160.jpg

oneill_julie_mobileretina_750x1040.jpg

oneill_julie_social_600x600.jpg

Clients seek out Julie because of her practical advice on cutting-edge issues at the intersection of privacy and consumer protection laws. She provides clients with practical solutions to compliance c

Julie O'Neill

Clients seek out Julie because of her practical advice on cutting-edge issues at the intersection of privacy and consumer protection laws. She provides clients with practical solutions to compliance challenges around a wide variety of both online and offline privacy issues, including tracking, interest-based advertising, geo-targeting and other mobile tracking, personalization, and cross-device tracking. Recognized in The Legal 500 US 2014, 2016, 2019, and 2020 and Chambers USA 2021 for her exceptional legal work, her clients praise her saying, “She is really good at giving practical, targeted advice and taking stock of what the risk profile of the client is, so that the advice is holistic.” (Chambers USA 2021).

California Provides Social Media Guidance for Financial Institutions

While Facebook, Twitter, LinkedIn and other social media platforms have become an increasingly important tool for businesses across industries to meet their cus

California Provides Social Media Guidance for Financial Institutions

On March 26, 2012, the Federal Trade Commission (the “Commission” or “FTC”) released its much-anticipated final privacy report, Protecting Consumer Privacy in an Era of Rapid Change.  The report builds upon the Commission’s December 2010 preliminary report, and provides recommendations for businesses and policymakers with respect to online and offline privacy practices.  The report will be of interest to any company using social media for marketing purposes.  Specifically, the report:<ul><li>Presents a privacy framework that sets forth best practices – not legal requirements – for businesses.  The Commission states that, to the extent that the best practices set forth in the report extend beyond existing legal requirements, such best practices are not intended to serve as a template for law enforcement actions or regulation under laws currently enforced by the Commission.  FTC Chairman Jon Leibowitz reiterated this point to a House Energy and Commerce subcommittee on March 29, 2012, informing legislators that, while companies that follow the report’s best practices would not be in violation of the FTC Act, those that do not follow them would not necessarily be in breach of the law.  In his words, the report “is not a regulatory document or an enforcement document.”  That said, those elements of the report that focus on transparency and consumer choice build on the Commission’s recent law enforcement experience; it is therefore reasonable to assume that the Commission will continue its pattern of focusing on data practices that are not obvious to consumers in context, that are not disclosed adequately, and, in some instances, where consumers do not have meaningful choice.  Of course, the Commission will continue its aggressive enforcement of companies’ privacy and data security promises.</li><li>Recommends baseline privacy legislation.  In the Commission’s view, because self-regulation has not yet gone far enough, flexible and technologically neutral baseline privacy legislation is desirable.  While encouraging industry to continue its self-regulatory efforts, the Commission also intends the privacy framework set forth in the report to assist Congress in crafting legislation.  The Commission also reiterates its call for federal information security and data breach notification legislation and for legislation regulating the practices of data brokers.</li><li>Highlights the Commission’s privacy priorities for the coming year.  The report explains that the Commission will promote implementation of the privacy framework by focusing its efforts on five main areas: (1) cooperation with industry to complete the implementation of an easy-to-use, persistent and effective Do Not Track mechanism (the Commission does not call for Do Not Track legislation in this report); (2) improvement of privacy disclosures and other protections offered by mobile services, including through its May 30, 2012 public workshop on revisions to its Dot Com Disclosures guidance; (3) support for targeted legislation to give consumers access to the information about them held by data brokers and encouragement to data brokers that compile data for marketing purposes to create a centralized website to further increase the transparency of their practices; (4) exploration of the privacy issues associated with the comprehensive tracking of consumers’ online activities by large platform providers, such as ISPs, operating systems, browsers and social media in a workshop later this year; and (5) participation with the Department of Commerce and industry stakeholders to create enforceable self-regulatory codes of conduct.</li></ul>This final priority reflects the Commission’s support for the report issued by the Obama administration on February 23, 2012.  In its report, entitled Consumer Data Privacy in a Networked World: A Framework for Protecting Privacy and Promoting Innovation in the Global Digital Economy, the administration detailed a “Consumer Privacy Bill of Rights” and announced the creation of a multi-stakeholder process to be convened by the Department of Commerce to create voluntary codes of conduct which, if adopted by companies, would be enforceable by the Commission pursuant to its deception authority under Section 5 of the FTC Act.  Importantly, the Commission’s report makes clear that the FTC will participate in the Department of Commerce’s multi-stakeholder process.The Scope of the Privacy FrameworkThe privacy framework applies to all commercial entities that collect or use online and/or offline consumer data that can be reasonably linked to a specific consumer or computer or other device.  There is an exception for entities that collect only non-sensitive data from fewer than 5,000 consumers per year and do not share the data with third parties, so as not to unduly burden small businesses.  The Commission did not, however, exempt from the framework’s intended coverage those companies already covered by sector-specific privacy laws, such as the Gramm-Leach-Bliley Act or the Health Insurance Portability and Accountability Act.  Instead, it emphasizes in the final report that the framework is intended to foster best practices but not impose conflicting legal obligations, and it urges Congress not to pass legislation that creates overlapping or contradictory requirements for entities subject to such laws.The extension of privacy best practices to data linkable to a computer or other device reflects the Commission’s position that the line between “personally identifiable information” (“PII”) and “non-PII” is increasingly blurred.The Commission justified this application on the grounds that, not only is re-identification of supposedly “anonymous” data increasingly possible, but, in the Commission’s view, businesses have strong incentives to re-identify such data.To provide businesses with certainty with respect to what constitutes “reasonably linkable” data, the Commission has taken the position that data is not “reasonably linkable”—and therefore not within the scope of the privacy framework—if the company possessing it implements the following protections: (1) reasonable measures to ensure that the data is de-identified; (2) a public commitment to using the data in a de-identified way; and (3) contractual prohibitions on downstream entities that use the data from de-identifying it, coupled with reasonable measures to ensure compliance with that prohibition.  Even with this attempt at clarity, questions remain, including what it means to “de-identify” data.  For example, does this mean removing PII or does it mean removing any identifier, such as cookie IDs?  Furthermore, what measures are “reasonable” in terms of monitoring downstream entities?The Substance of the Privacy FrameworkThe Commission’s report proposes a privacy framework that calls for companies to incorporate “privacy by design” into their practices, to offer consumers simplified choices about how their data is collected and used, and to provide consumers with greater transparency about their practices.Privacy by DesignAccording to the report, companies should promote consumer privacy throughout their organizations and at every stage of the development and life cycle of their products and services.  As a substantive matter, this means that companies should incorporate the following privacy protections into their practices:<ul><li>Reasonable security for consumer data.  The Commission notes that this obligation is already well settled, as it has a long history of enforcing data security obligations under Section 5 of the FTC Act and other laws.  The Commission commends industry’s efforts to ensure the security of consumers’ data, but, nonetheless, it renews its call for Congress to enact comprehensive data security and breach notification legislation.</li><li>Reasonable limits on data collection.  According to the Commission, reasonable limits are those that are consistent with the context of a particular transaction or the consumer’s relationship with the business (or as required or specifically permitted by law).</li><li>Sound retention and disposal practices.The Commission states that companies should implement reasonable restrictions on the retention of consumer data and should dispose of it once the data has outlived the legitimate purpose for which it was collected.  What is “reasonable” depends on the type of relationship and the nature and use of the data.</li><li>Data accuracy.According to the Commission, companies should maintain the accuracy of the data they hold about consumers.  As with other elements of the framework, the Commission believes that the best approach to achieving accuracy is through a flexible approach, scaled to the intended use and sensitivity of the data at issue.</li></ul>The Commission also urges businesses to maintain comprehensive data management procedures throughout the life cycle of their products and services.  It cites its recent settlement orders with Facebook and Google as providing a roadmap for the types of comprehensive procedural protections it envisions: (1) designation of personnel responsible for the privacy program; (2) a risk assessment that covers, at a minimum, employee training, management and product design and development; (3) implementation of controls designed to mitigate identified risks; (4) appropriate oversight; and (5) evaluation and adjustment of the program in light of regular testing and monitoring.Simplified Consumer ChoiceThe report encourages companies to simplify consumer choice, in part by identifying those practices for which choice is not necessary.  Specifically, the report provides that companies do not need to provide consumers with choice before collecting and using consumer data for practices that are consistent with the context of the transaction or the company’s relationship with the consumer or that are required or specifically authorized by law.While this standard relies to some degree on consumer expectations, it focuses on objective factors related to the consumer’s relationship with the business.  The following commonly accepted practices are provided as examples of the kinds of practices that do not typically require consumer choice: product and service fulfillment, internal operations, fraud prevention, legal compliance and public purpose and first-party marketing.The report goes on to address practices that require choice and states that, when choice is required, it should be offered at a time and in a context in which the consumer is making a decision about his or her data.  (The Commission declines, however, to impose any particular method of providing choice, leaving it to industry to develop the most appropriate choice mechanisms.)  As a general matter, data use and disclosure practices that are inconsistent with the context of the transaction or the company’s relationship with the consumer require consumer choice (unless such practices are required or specifically authorized by law).  Such practices may include, for example, sharing customer data with an affiliate for the affiliate’s own direct marketing use, if the consumer would not have been aware of the affiliate relationship (e.g., because the companies are differently branded).The Commission identifies two practices that it believes require affirmative express consent:  (1) in connection with material retroactive changes to privacy representations (this is not new, as the Commission has expressed it repeatedly for years and has imposed it in settlement orders); and (2) before collecting sensitive data, such as information about children, health and financial information, geolocation data and Social Security numbers. (The Commission also proposes that social networks and others specifically targeting teens should take extra precautions with respect to their submission of personal information.)  The Commission’s identification of specific practices that require affirmative express consent suggests that, where it otherwise calls for choice, clear and conspicuous notice and opt-out would be sufficient.Greater TransparencyThe Commission states that companies should increase the transparency of their data practices, through privacy notices, access to data and consumer education:<ul><li>Privacy notices should be clearer, shorter and more standardized, to enable better comprehension and comparison of privacy practices.  The Commission calls for the simplification of privacy notices, such as through the use of standardized terminology, format and other elements.  In the Commission’s view, members of various industry sectors should work together to create standards relevant to their industry, possibly through the multi-stakeholder process that the Department of Commerce plans to convene.  According to the Commission, the need for simplification and industry involvement is particularly acute in the mobile realm, given the number of entities that want to collect user data and the limited space for disclosures.  As noted above, the Commission plans to address mobile disclosures in a May 30, 2012 public workshop.</li><li>Companies should provide reasonable access to the consumer data they maintain.  The extent of access should be proportionate to the sensitivity of the data and the nature of its use.  For example, the Commission urges businesses that maintain data for marketing purposes to, at a minimum, provide consumers with access to such data and permit them to suppress categories they would not like used for targeting.</li><li>Companies should make efforts to increase the transparency of their data enhancement practices.  The Commission does not suggest that companies obtain consent to such practices; however, it urges industry to rely on the other elements of the privacy framework to address the privacy concerns raised by it.  In the Commission’s view, this means that companies should, for example, explain to consumers how data enhancement works and how they can contact data enhancement sources directly.  They should also encourage their data sources to increase their own transparency.</li><li>The Commission encourages companies to continue to engage in consumer education efforts and invites industry to re-brand and use the Commission’s own materials.</li></ul>ConclusionThe report reflects the Commission’s continued concern that consumers bear too much of a burden for understanding and controlling how their data is collected, used, retained and disclosed.  The report reflects its desire to see this paradigm reversed so that the burden is shouldered by companies instead.  How far this concern is turned into enforceable requirements will depend in large part on the support the Commission receives from Congress, as well as the extent of the development and adoption of self-regulatory codes of conduct.

FTC’s Privacy Report Suggests Tightening of Privacy Regime, Provides Guidance to Business

On March 26, 2012, the Federal Trade Commission (the “Commission” or “FTC”) released its much-anticipated final privacy report, Protecting Consumer Privacy in a

FTC’s Privacy Report Suggests Tightening of Privacy Regime, Provides Guidance to Business

For several months, various legislative proposals that would ease regulatory and financing burdens on smaller companies have been discussed by legislators, business leaders and commentators. These proposals were brought together under the <a href="http://www.gpo.gov/fdsys/pkg/BILLS-112hr3606pcs/pdf/BILLS-112hr3606pcs.pdf">Jumpstart Our Business Startups (JOBS) Act (H.R. 3606)</a>. The JOBS Act was passed by Congress on March 27, 2012 and signed into law by President Obama on April 5, 2012. For a comprehensive overview of the JOBS Act, see our Client Alert.The JOBS Act tackles various issues relating to financing businesses, however, within the realm of social media, “crowdfunding” is a key topic which Congress has chosen to regulate. In this article, we take a close look at the crowdfunding component of the new law.Background on Crowdfunding “Crowdfunding” or “crowdsourced funding” is a new outgrowth of social media that provides an emerging source of funding for ventures. Crowdfunding works based on the ability to pool money from individuals who have a common interest and are willing to provide small contributions toward the venture. Crowdfunding can be used to accomplish a variety of goals (e.g., raising money for a charity or other causes of interest to the participants), but when the goal is commercial in nature and there is an opportunity for crowdfunding participants to share in the venture’s profits, federal and state securities laws will likely apply. Absent an exemption from SEC registration (or actually registering the offering with the SEC), crowdfunding efforts that involve sales of securities are in all likelihood illegal. In addition to SEC requirements, those seeking capital through crowdfunding have had to be cognizant of state securities laws, which include varying requirements and exemptions. By crowdfunding through the Internet, a person or venture can be exposed to potential liability at the federal level, in all 50 states, and potentially in foreign jurisdictions. Existing exemptions present some problems for persons seeking to raise capital through crowdfunding. For example, Regulation A requires a filing with the SEC and disclosure in the form of an offering circular, which would make conducting a crowdfunding offering difficult. The Regulation D exemptions generally would prove too cumbersome, and a private offering approach or the intrastate offering exemption is inconsistent with widespread use of the Internet. Section 25102(n) of the California Corporations Code might provide a possible exemption for some California issuers, given that it permits general announcement of an offering without qualification in California (with a corresponding exemption from registration at the federal level provided by SEC Rule 1001, the California limited general solicitation exemption). Crowdfunding advocates have called on the SEC to consider implementing a new exemption from registration under the federal securities laws for crowdfunding. For more on crowdfunding, see also our prior Client Alert here.When H.R. 3606 was adopted in the House of Representatives, the bill included Title III, titled “Entrepreneur Access to Capital.” This Title provided an exemption from registration under the Securities Act for offerings of up to $1 million, or $2 million in certain cases when investors were provided with audited financial statements, provided that individual investments were limited to $10,000 or 10 percent of the investor’s annual income. The exemption was conditioned on issuers and intermediaries meeting a number of specific requirements, including notice to the SEC about the offering and the parties involved with the offering, which would be shared with state regulatory authorities. The measure would have permitted an unlimited number of investors in the crowdfunding offering, and would have preempted state securities regulation of these types of offerings (except that states would be permitted to address fraudulent offerings through their existing enforcement mechanisms).The House measure also contemplated that the issuer must state a target offering amount and a third-party custodian would withhold the proceeds of the offering until the issuer has raised 60 percent of the target offering amount. The provision also contemplated certain disclosures and questions for investors, and provided for an exemption from broker-dealer registration for intermediaries involved in an exempt crowdfunding offering.After it was adopted, the House crowdfunding measure drew a significant amount of criticism, with much of that criticism focused on a perceived lack of investor protections. In a letter to the Senate leadership, SEC Chairman Mary Schapiro noted that “an important safeguard that could be considered to better protect investors in crowdfunding offerings would be to provide for oversight of industry professionals that intermediate and facilitate these offerings,” and also noted that additional information about companies seeking to raise capital through crowdfunding offerings would benefit investors.In the Senate, an amendment to H.R. 3606 submitted by Senator Merkley and incorporated in the final JOBS Act provides additional investor protections in crowdfunding offerings. Title III, titled “Crowdfunding,” amends Section 4 of the Securities Act to add a new paragraph (6) that provides a crowdfunding exemption from registration under the Securities Act. The conditions of the exemption are that:<ul><li>The aggregate amount sold to all investors by the issuer, including any amount sold in reliance on the crowdfunding exemption during the 12-month period preceding the date of the transaction, is not more than $1,000,000;</li><li>The aggregate amount sold to any investor by the issuer, including any amount sold in reliance on the crowdfunding exemption during the 12-month period preceding the date of the transaction, does not exceed: <ul><li>the greater of $2,000 or 5 percent of the annual income or net worth of the investor, as applicable, if either the annual income or the net worth of the investor is less than $100,000; or</li><li>10 percent of the annual income or net worth of an investor, as applicable, not to exceed a maximum aggregate amount sold of $100,000, if either the annual income or net worth of the investor is equal to or more than $100,000;</li></ul></li><li>The transaction is conducted through a broker or funding portal that complies with the requirements of the exemption; and</li><li>The issuer complies with the requirements of the exemption.</li></ul>Among the requirements for exempt crowdfunding offerings would be that an intermediary:<ul><li>Registers with the SEC as a broker or a “funding portal,” as such term is defined in the amendment;</li><li>Registers with any applicable self-regulatory authority;</li><li>Provides disclosures to investors, as well as questionnaires, regarding the level of risk involved with the offerings;</li><li>Takes measures, including obtaining background checks and other actions that the SEC can specify, of officers, directors, and significant shareholders;</li><li>Ensures that all offering proceeds are only provided to issuers when the amount equals or exceeds the target offering amount, and allows for cancellation of commitments to purchase in the offering;</li><li>Ensures that no investor in a 12-month period has invested in excess of the limit described above in all issuers conducting exempt crowdfunding offerings;</li><li>Takes steps to protect privacy of information;</li><li>Does not compensate promoters, finders, or lead generators for providing personal identifying information of personal investors;</li><li>Prohibits insiders from having any financial interest in an issuer using that intermediary’s services; and</li><li>Meets any other requirements that the SEC may prescribe.</li></ul>Issuers also must meet specific conditions in order to rely on the exemption, including that an issuer file with the SEC and provide to investors and intermediaries information about the issuer (including financial statements, which would be reviewed or audited depending on the size of the target offering amount), its officers, directors, and greater than 20 percent shareholders, and risks relating to the issuer and the offering, as well specific offering information such as the use of proceeds for the offering, the target amount for the offering, the deadline to reach the target offering amount, and regular updates regarding progress in reaching the target.The provision would prohibit issuers from advertising the terms of the exempt offering, other than to provide notices directing investors to the funding portal or broker, and would require disclosure of amounts paid to compensate solicitors promoting the offering through the channels of the broker or funding portal.Issuers relying on the exemption would need to file with the SEC and provide to investors, no less than annually, reports of the results of operations and financial statements of the issuers as the SEC may determine is appropriate. The SEC may also impose any other requirements that it determines appropriate.A purchaser in a crowdfunding offering could bring an action against an issuer for rescission in accordance with Section 12(b) and Section 13 of the Securities Act, as if liability were created under Section 12(a)(2) of the Securities Act, in the event that there are material misstatements or omissions in connection with the offering.Securities sold on an exempt basis under this provision would not be transferrable by the purchaser for a one-year period beginning on the date of purchase, except in certain limited circumstances. The crowdfunding exemption would only be available for domestic issuers that are not reporting companies under the Exchange Act and that are not investment companies, or as the SEC otherwise determines is appropriate. Bad actor disqualification provisions similar to those required under Regulation A would also be required for exempt crowdfunding offerings.Funding portals would not be subject to registration as a broker-dealer, but would be subject to an alternative regulatory regime, subject to SEC and SRO authority, to be determined by rulemaking. A funding portal is defined as an intermediary for exempt crowdfunding offerings that does not: (1) offer investment advice or recommendations; (2) solicit purchases, sales, or offers to buy securities offered or displayed on its website or portal; (3) compensate employees, agents, or other persons for such solicitation or based on the sale securities displayed or referenced on its website or portal; (4) hold, manage, possess, or otherwise handle investor funds or securities; or (5) engage in other activities as the SEC may determine by rulemaking.The provision would preempt state securities laws by making exempt crowdfunding securities “covered securities,” however, some state enforcement authority and notice filing requirements would be retained. State regulation of funding portals would also be preempted, subject to limited enforcement and examination authority.The SEC must issue rules to carry out these measures not later than 270 days following enactment. The dollar thresholds applicable under the exemption are subject to adjustment by the SEC at least once every five years.The provisions of this title of the JOBS Act are not self-effectuating, as indicated above.Practical Considerations Issuers: For those issuers who are seeking to raise small amounts of capital from a broad group of investors, the crowdfunding exemption may ultimately provide a viable alternative to current offering exemptions, given the potential that raising capital through crowdfunding over the Internet may be less costly and may provide more sources of funding. At the same time, issuers will need to weigh the ongoing costs that will arise with crowdfunding offerings, in particular the annual reporting requirement that is contemplated by the legislation. Moreover, it is not yet known how much intermediaries such as brokers and funding portals will charge issuers once SEC and SRO regulations apply to their ongoing crowdfunding operations.Intermediaries: Brokers and potential funding portals will need to consider how their processes can be revamped to comply with regulations applicable to exempt crowdfunding offerings, in particular given the level of information that will need to be provided in connection with crowdfunding offerings and the critical role that intermediaries will play in terms of “self-regulating” these offerings.

The JOBS Act Opens Door for Crowdfunding Offerings

For several months, various legislative proposals that would ease regulatory and financing burdens on smaller companies have been discussed by legislators, busi

The JOBS Act Opens Door for Crowdfunding Offerings

In the recent online contracting case of <a href="https://scholar.google.com/scholar_case?case=12279872483928107605" target="_blank" rel="noopener">Fteja v. Facebook, Inc.</a>, a New York federal court held that a forum selection clause contained in Facebook’s <a href="http://www.facebook.com/legal/terms">Statement of Rights and Responsibilities</a> (the “Terms”) was enforceable because the plaintiff assented to the Terms when registering to use Facebook.  The court’s analysis and holding followed the recent trend of de-emphasizing the distinction between “clickwrap” and “browsewrap” agreements and instead focusing on whether the user was provided  with actual or constructive notice of the agreement’s terms and conditions.  In this case, the result turned on whether Facebook’s Terms were reasonably communicated to the plaintiff prior to his use of the Facebook.com site.The plaintiff, an active Facebook user, brought the action against Facebook in New York state court asserting that Facebook disabled his Facebook.com account without justification and for discriminatory reasons.  He claimed that the disabling of his account hurt his feelings, inflicted emotional distress and assaulted his good reputation among his friends and family.Facebook removed the lawsuit to New York federal court on the basis of diversity of citizenship, and then moved to transfer the action to federal court in Northern California, citing the forum selection clause in the Terms.  Facebook argued that because the plaintiff clicked through Facebook’s registration page and expressly acknowledged that he read and agreed to the Terms (including the forum selection clause), the Terms were valid and enforceable.  The plaintiff responded that there was no proof that he agreed to the forum selection clause and that he did not remember agreeing to the Terms.The court reviewed Facebook’s registration process, noting that after a new user provides his or her personal information and clicks an initial “Sign Up” button, he or she is directed to a security page that requires the new user to input a series of letters and numbers.  Below the box where the new user enters the letter/number combination, the page displays a second “Sign Up” button that is immediately followed by the phrase: “By clicking Sign Up, you are indicating that you have read and agree to the Terms of Service.”  The phrase “Terms of Service” is underlined, indicating that it is hyperlinked to the Terms.After this review of Facebook’s registration process, the court then described the historical development of online contracting law, referencing the <a href="https://law.justia.com/cases/federal/appellate-courts/F3/356/393/539823/">Register.com, Inc. v. Verio, Inc.</a>, <a href="http://cyber.law.harvard.edu/stjohns/Specht_v_Netscape.pdf">Specht v. Netscape Communications Corp.</a>, and <a href="http://ocoee.files.wordpress.com/2009/11/hines-v-overstock.pdf">Hines v. Overstock.com, Inc.</a> decisions, and the importance of establishing mutual manifestation of assent.  Following this discussion, the court pointed out that Facebook’s Terms are “somewhat like a browsewrap agreement in that the terms are only visible via a hyperlink, but also somewhat like a clickwrap agreement in that the user must do something else – click ‘Sign Up’ – to assent to the hyperlinked terms,” and that, unlike some clickwrap agreements, a new Facebook user can click to assent whether or not he or she has been presented with the Terms.  Finally, the court looked at the plaintiff’s level of sophistication and stated that an Internet user whose social networking was so prolific that losing Facebook would cause him mental anguish should understand that the hyperlinked phrase “Terms of Service” really means “Click Here for Terms of Service,” thereby establishing constructive knowledge of the Terms.The court concluded that the plaintiff’s registration for Facebook by clicking the “I accept” button constituted his assent to the Terms (including the forum selection clause) even though he may not have actually reviewed the hyperlinked Terms.  The court then, after considering the public policy ramifications of the transfer decision, held that the forum selection clause was enforceable and directed the action to be transferred to federal court in Northern California.Key Take Aways.  While the Fteja v. Facebook, Inc. case illustrates that U.S. courts may enforce a hybrid browsewrap/clickwrap agreement even where the user does not have actual knowledge of the terms and conditions, the safest approach for a website operator is to structure its online terms of service as a traditional clickwrap agreement that requires users to scroll through the terms and conditions and then click an “I accept” button.  In situations where this structure is not commercially reasonable, the following tips can be used to help establish user assent under U.S. law through constructive knowledge of the terms and conditions of an online agreement:<ul><li>Prominent Notice:  Include a prominent notice that cannot be skipped by users; such notice ideally should state that the use of service is subject to the hyperlinked terms of service.  Such notice should be provided in reasonably large font and contrasting colors that do not blend into the website’s background.  If possible, include an “I accept” button next to the notice.</li><li>Easy Access/Full Disclosure:  Provide easy access to the full text of the terms of service via a clearly identifiable hyperlink that links to a downloadable and printable version of the terms of service.  The hyperlink should be provided next to the notice and an “I accept” button (if any).</li><li>Readability:  Structure and phrase the terms of service so that they can be reasonably understood by users based on their anticipated level of sophistication.</li><li>Highlight Important Terms:  Make sure that any particularly important terms are clearly identifiable and not hidden.  If the website operator is especially concerned about an issue (e.g., enforceability of the limitation of liability provision of the terms of service), consider expressly referencing the concern as part of the general notice (e.g., “By clicking Sign Up, you are indicating that you have read and agree to the Terms of Service, including the limitations on vendor’s liability described therein”).</li></ul>

Facebooks’s Online Terms of Service Held to Be Enforceable

In the recent online contracting case of Fteja v. Facebook, Inc., a New York federal court held that a forum selection clause contained in Facebook’s Statement 

Facebooks’s Online Terms of Service Held to Be Enforceable

Late last year, Superior Court Judge David Ironson in Morristown, New Jersey, declined to dismiss an indictment of identity theft against Dana Thornton, who allegedly created a false Facebook page that portrayed her ex-boyfriend, narcotics detective Michael Lasalandra, in a highly unfavorable light.  According to the prosecution, Thornton used the page to impersonate her ex-boyfriend, publishing posts through which the false “Lasalandra” admitted to using drugs, hiring prostitutes and contracting a sexually transmitted disease.Thornton’s defense attorney Richard Roberts did not deny that Thornton created the bogus Facebook page, but argued that the indictment against Thornton failed to “quantify or qualify” the injuries Lasalandra suffered because of the impersonation.  Roberts also argued that New Jersey’s impersonation and identity theft statute does not include “electronic communications” as a means of unlawful impersonation and that Thornton’s actions thus did not fall within the scope of activity that the statute proscribes.Judge Ironson disagreed, holding that Thornton’s postings, by their nature, could harm Lasalandra’s “professional reputation” as a police officer.  He further held that New Jersey’s law is “clear and unambiguous” in forbidding impersonation activities that cause injury, and does not need to specify the means by which the injury occurs.  New Jersey’s impersonation and identity theft statute provides that a person is guilty if he or she “[i]mpersonates another or assumes a false identity and does an act in such assumed character or false identity for the purpose of obtaining a benefit for himself or another or to injure or defraud another.”  Judge Ironson construed this law broadly to include Thornton’s actions.As social media ambles from infancy into toddlerhood, the avenues for abuse available to users continue to increase.  Establishing a false Facebook page for the purpose of defaming another is part of a growing form of destructive impersonation through electronic means, sometimes referred to as “e-personation.”  E-personation requires far less information than many other forms of identity theft require.  In order to create a false Facebook page, a would-be e-personator does not need any of the victim’s personally identifiable information other than his or her name.  The power of the Internet to disseminate information, and the popularity of Facebook and other social media sites, make e-personation particularly harmful by enabling perpetrators to spread injurious statements much more quickly and effectively than would be possible using conventional, non-electronic means.To combat this phenomenon, some states have begun to enact legislation that explicitly criminalizes e-personation.  New York’s <a href="http://law.onecle.com/new-york/penal/PEN0190.25_190.25.html">criminal impersonation statute</a> makes it illegal to impersonate somebody “by communication by internet website or electronic means.”  In January 2011, California added an entire e-personation statute to its penal code, which includes opening a “profile on a social networking Internet Web site in another person’s name” in the definition of “e-personation.”  The Texas penal code includes a narrower “online harassment” statute that is limited to barring impersonation on “commercial social networking sites.”  And most recently, Washington state enacted an e-personation statute.New Jersey does not currently include any express e-personation provisions in its penal code, but an amendment that would specifically criminalize e-personation has passed the state Assembly and is currently being considered by the state Senate.  In Thornton’s hearing before Judge Ironson, Roberts attempted to use this fact to argue that Thornton’s alleged e-personation was outside of the scope of the current New Jersey statute.  Judge Ironson, however, agreed with prosecutor Robert Schwartz that the proposed amendment is only a clarification of the current law, under which e-personation already constitutes a form of injury-inducing impersonation.  As Schwartz stated, “In no way [is the current law] saying that electronic communication has been excluded.  No way did the Legislature ever intend for Ms. Thornton to get away with this kind of conduct.”As noted, a small handful of states currently have e-personation statutes, but Judge Ironson’s ruling in New Jersey demonstrates that even traditional identity theft and impersonation statutes can be applied by courts to prohibit e-personation.  This raises the issue of whether e-personation is an issue best dealt with through new legislation or under existing identity theft and impersonation laws, a question that has divided the Internet legal community.  Some <a href="http://verdict.justia.com/2011/11/22/dealing-with-e-personation">legal scholars</a> oppose express e-personation statutes, noting that laws attempting to respond to rapidly changing technology often become outdated quickly, may result in narrowing the scope of sufficient laws already in place, and can raise First Amendment issues.  <a href="http://sspblue.com/tag/e-impersonation/">Others </a>call for e-personation statutes in all states in order to increase protection for victims of acts similar toThornton’s.In the coming months, there will likely be further developments in Thornton’s case.  Although Thornton and the prosecution did make some attempts at a plea bargain, the prosecution has now stated that it intends to take the case to trial, and will prosecute Thornton for fourth-degree identity theft, which carries a maximum sentence of 18 months in prison.  Last December, Roberts filed a motion to be removed as Thornton’s lawyer, so the trial has been delayed.  In any event, as Thornton’s case plays out, it will be interesting to see how different states react to its outcome in their approaches to e-personation, an ever-growing and evolving negative side effect of the social media revolution.

kaufman_jessica_blog_150x150.png

kaufman_jessica_common_640x280.jpg

kaufman_jessica_heroretina_2700x1160.jpg

kaufman_jessica_mobileretina_750x1040.jpg

kaufman_jessica_social_600x600.jpg

Jessica’s practice focuses on complex civil litigation, with an emphasis on class action, financial services litigation and enforcement, and commercial disputes. Recent representative matters include the defense of a leading marketplace lender in a putative nationwide class action under state usury laws; a major consumer products company in multidistrict antitrust litigation; a

Jessica Kaufman

Vindictive Ex-girlfriend Could Face 18 Months in Prison for Facebook “E-Personation”