Social media sites are transforming not only the daily lives of consumers, but also how companies interact with consumers. Here at Morrison Foerster, across all of our practice groups, we are seeing complex, cutting-edge legal issues arising out of social media. As with the Internet boom during the mid-to-late 1990s, social media is generating new legal questions at a far faster pace than the law’s ability to provide answers to such questions. In an effort to stay on top of these emerging issues, and to keep our clients and friends informed of new developments, Morrison Foerster publishes this blog devoted to the law and business of social media.<h2>ABOUT MORRISON FOERSTER</h2>Morrison Foerster is a leading global law firm that transforms complexity into advantage for its clients. Our clients include some of the largest financial institutions, banks, consulting and accounting firms, and Fortune 100, technology, and life sciences companies. Highlighting the firm’s commitment to client service, leadership in market-changing deals and impact litigation, and values-based culture, Morrison Foerster has been repeatedly recognized as one of the top 10 firms on The American Lawyer’s A-List. Year after year, the firm receives significant recognition from Chambers and The Legal 500 across their various guides, including Global, USA, Asia‑Pacific, Europe, UK, Latin America, and FinTech Legal. Our lawyers passionately care about delivering legal excellence while living our values. Morrison Foerster has a long-standing commitment to creating a culture that respects and celebrates differences, while providing an inclusive environment. The firm has achieved Mansfield Certification Plus since 2018 as a result of successfully reaching at least 30 percent women, communities of color, and LGBTQ+ lawyer representation in a notable number of current leadership roles and committees. The firm also has a long history of commitment to the community and society through providing pro bono legal services, including litigating for civil rights and civil liberties, improving public education and fostering the wellbeing of children, advocating for veterans, promoting international human rights, enforcing the right to asylum, and safeguarding the environment.

Social

Search

sociallyaware-abajournalweb100-1

Aaron is the chair of the firm’s Technology Transactions Group and co-chair of the Interactive + Digital Media Group. He advises clients on a wide range of complex transactions involving intellectual property and technology, including structuring and negotiating strategic licensing, development, collaboration, procurement, and distribution deals.Aaron’s practice focuses on advising both established and emerging companies in a variety of data- and technology-intensive sectors, including software, SaaS, cloud-based technology, digital media (social media, AR/VR, gaming, streaming media, AdTech), AI, healthcare, consumer electronics, e-commerce, other online business models, and mobile applications. He also maintains an active practice counseling companies on branding and marketing, trademark licensing, and content-related transactions, as well as the intellectual property aspects of mergers, acquisitions, asset spin-offs, and private equity investments.He has represented clients such as Autodesk, Meta, OpenAI, Splunk, Konami, Kaiser Permanente, SoftBank, Visa, and Yahoo, among others.Aaron has been recognized by numerous publications for his work on market-defining technology transactions. He is currently ranked by Chambers USA for “Technology Transactions.”Aaron also serves as co-editor of Socially Aware, the firm’s award-winning newsletter and blog devoted to the law and business of social media, and regularly publishes on various IP and technology-related topics. Aaron is also a sought-after speaker on new and emerging areas of law, and is a frequent presenter and panelist at conferences and legal services programs. In addition to his active practice, Aaron regularly provides pro bono assistance to various nonprofit and charitable organizations such as Common Sense Media and the Starlight Children’s Foundation. He is a member of the board of directors of California Lawyers for the Arts.While in law school at the University of California, Berkeley, Boalt Hall School of Law, Aaron served as executive editor of the California Law Review and was elected to the Order of the Coif. Following law school, Aaron served as law clerk to the Honorable William H. Orrick and the Honorable Martin J. Jenkins, both United States District Judges for the Northern District of California.

rubin_aaron_blog_150x150.png

rubin_aaron_common_640x280.jpg

rubin_aaron_heroretina_2700x1160.jpg

rubin_aaron_mobileretina_750x1040.jpg

rubin_aaron_social_600x600.jpg

Partner

Aaron is the chair of our Technology Transactions Group. He advises clients on a wide range of complex transactions involving intellectual property and technology, including structuring and negotiating strategic licensing, development, collaboration, procurement, and distribution deals. Aaron’s practice focuses on advising both established and emerging companies in a variety of data– and technology–intensive sectors, including software, SaaS, cloud computing, AR/VR, AI, gaming, healthcare, consumer electronics, social media, e–commerce, other online business models, and mobile applications. He also maintains an active practice counseling companies on the intellectual property aspects of mergers, acquisitions, asset spin–offs, and private equity investments.

Aaron P. Rubin

Lawrence Gallick is of counsel in the firm’s Austin office and a member of the Technology Transactions Group.Lawrence focuses his practice on technology transactions and licensing matters. His diverse experience includes advising on SaaS agreements, cross-licensing agreements, research and collaboration agreements, development agreements, and distribution agreements. He counsels a broad range of companies across the software, hardware, life sciences, biotech and FinTech spaces, as well as other entities including universities.He advises clients in connection with general corporate matters including contract negotiations, and leasing and technology placement agreements.Lawrence also serves as co-editor of <a href="https://www.sociallyawareblog.com/" target="_blank">Socially Aware</a>, the firm’s award-winning newsletter and blog devoted to the law and business of social media, and regularly publishes on various IP and technology-related topics.Prior to joining the firm, Lawrence was counsel at another major law firm. Before earning his law degree, Lawrence was a web consultant, project manager, and web developer in Portland, Oregon, where he managed and consulted on projects using industry methodologies and performed custom development and integration of content management systems.Lawrence was named a Super Lawyers “Rising Star” in 2015 and 2018–2022, and is licensed in both California and New York. Lawrence earned his J.D. from the University at Buffalo School of Law, where he was the electronic systems editor for the Buffalo Law Review and awarded the ABA-BNA Award for Excellence in the Study of Intellectual Property Law.

gallick_lawrence_blog_150x150.png

gallick_lawrence_common_640x280.jpg

gallick_lawrence_heroretina_2700x1160.jpg

gallick_lawrence_mobileretina_750x1040.jpg

gallick_lawrence_social_600x600.jpg

Of Counsel

Lawrence Gallick

Anthony Ramirez is a partner in the Technology Transactions Group in the New York office of Morrison Foerster.Anthony advises clients on general commercial and transactional matters. He regularly advises companies on the IP aspects of their M&A transactions. His clients include technology, digital media and content for television and music, financial services, and communications companies with diverse intellectual property assets and issues.His practice focuses on the legal aspects of developing, licensing, and commercializing technology and intellectual property, as well as negotiating general commercial contracts, including outsourcing transactions, as well as content and data licenses. He regularly assists clients with legal issues relating to licensing and commercialization of digital media and content, digital content that is distributed over the Internet or streamed, mobile applications and social media, as well as the licensing of recorded music for distribution via digital platforms. Anthony is also experienced with issues relating to open-source software, software development, artificial intelligence and machine learning, cloud-based technology, and protection of proprietary information.Anthony has extensive experience working on matters involving disruptive technologies, such as blockchain. He has helped fintech clients with general intellectual property issues in connection with terms of service for online financial products and services.Anthony is an integral part of the outside pro bono legal team for nonprofit organizations based in New York, including advising clients on legal issues regarding entertainment, social media, privacy rights, and the negotiation of outsourcing and service agreements. Anthony received his J.D. from the University of Michigan Law School in 2009. He received his B.S. from Cornell University in 2004.

ramirez_anthony_blog_150x150.png

ramirez_anthony_common_640x280.jpg

ramirez_anthony_heroretina_2700x1160.jpg

ramirez_anthony_mobileretina_750x1040.jpg

ramirez_anthony_social_600x600.jpg

Anthony Ramirez is a partner in the Technology Transactions Group in the New York office of Morrison Foerster. He advises clients on general commercial and transactional matters. His clients include technology, media, and communications companies with considerable intellectual property assets. His practice focuses on the legal aspects of licensing and commercializing technology and intellectual property, as well as negotiating general commercial contracts. He also regularly assists clients with legal issues relating to mobile applications and social media.

Anthony M. Ramirez

favicon.ico

favicon-16x16.png

favicon-32x32.png

apple-touch-icon.png

MoFo Favicons

Socially Aware is devoted to the law and business of social media, proactively addressing emerging issues and keeping our clients informed of new developments. We cover fields such as artificial intelligence, privacy and data security, Section 230, intellectual property, and much more.

Welcome to Socially Aware

240920-socially-aware-header.jpg

Welcome to Socially Aware

240920-socially-aware-header

Socially Aware is devoted to the law and business of social media, proactively addressing emerging issues and keeping our clients informed of new developments. We cover fields such as artificial intelligence, privacy and data security, Section 230, intellectual property, and much more.

News and Announcements

Blog - Terms of Use

Blog - Privacy Policy

Blog - Blog Disclaimer

Blog - Attorney Advertising

morrison-foerster-blog-logo.png

Provides a data-driven look at the Federal Circuit.

Federal Circuitry

Brings together legal insights and in-depth analyses on trends and complex issues shaping the global technology industry.

MoFo Tech

Mofo Tech

Equips our clients with the most up-to-date and relevant information on employment and labor law issues.

Employment Law Commentary

In-depth analysis of developments and trends impacting government contracting.

Government Contracts Insight

Government Contracts Insights

Provides insights and reports on the most current class actions lawsuits and product liability issues that affect consumer-facing companies.

Class Dismissed Blog

Class Dismissed

MoFo’s Socially Aware blog provides timely updates and analysis of the many complex and cutting-edge legal and business issues arising out of social media.

Socially Aware

  Linkedin

MoFo LinkedIN

Socially Aware Blog - RSS

Stay Connected

Never miss a post from Socially Aware. Enter your email below to stay up-to-date.

Subscribe

The Law and Business of Social Media

Morrison Foerster - Footer

California Attorney General Kamala Harris released a long-awaited report entitled Making Your Privacy Practices Public (Report) on May 21, 2014. The Report reco

Blogs -  Home Button

Home

Blog - Topics

Web Scraping

Advertising

Antitrust

Arbitration

Artificial Intelligence

Asia

Autonomous Vehicles

Bankruptcy

Big Data

Blockchain

Class Actions

Cloud Computing

Compliance

Contracts

COPPA

Copyright

Crowdsourcing

Cyberbullying

Cybersecurity

Data Security

Defamation

Digital Content

Disappearing Content

Discovery

DMCA

E-Commerce

E-Discovery

E-Personation

Electronic Contracts

Employment Law

Endorsement Guides

Ephemeral Messaging

Ethics

European Union

Event

Fair Use

FDA Regulations

Financial Institutions

First Amendment

Fraud

Free Speech

GDPR

Hacking

Influencer Marketing

Infographic

Internet of Things

Investment Management Law

JOBS Act

Labor Law

Litigation

Live streaming

Marketing

Mobile

Online Contracts

Online Endorsements

Online Promotions

Online Reviews

Patent

Privacy

Product Liability

Protected Speech

Right of Publicity

Right To Be Forgotten

Section 230 Safe Harbor

Securities Law

Social Media Policy

Statistics

Status Updates

Stored Communications Act

Supreme Court

Terms of Use

Trademark

UK High Court

User-Generated Content

Wearable Computers

Topics

Blog - Editors

Editors

Blog - About

About

Blog - Subscribe

California AG Offers Best Practices for Do Not Track Disclosures; Crucial Compliance Questions Left Unanswered

California AG Offers Best Practices for Do Not Track Disclosures; Crucial Compliance Questions Left Unanswered | Socially Aware

Julie O'Neill

California Attorney General Kamala Harris released a long-awaited report entitled <a href="http://oag.ca.gov/sites/all/files/agweb/pdfs/cybersecurity/making_your_privacy_practices_public.pdf">Making Your Privacy Practices Public</a> (Report) on May 21, 2014. The Report recommends “best practices” for compliance with the California Online Privacy Protection Act (CalOPPA). It was originally intended to answer critical questions about exactly what website, online service, and mobile application operators (collectively, “site operators”) must do to comply with CalOPPA’s new do not track (DNT) disclosure obligations, which took effect on January 1, 2014. It does not accomplish that goal. Unfortunately, the Report leaves important questions unanswered and raises new questions.The Report explains that “its recommendations . . . which in some places offer greater privacy protection than required by existing law, are not regulations, mandates or legal opinions.” It fails, however, to clarify what the law actually requires, and we expect that trade associations will continue to seek guidance on important compliance issues. In the meantime, site operators may wish to comply with at least some of the Report’s recommendations to the extent possible because such “recommendations” tend to harden into regulatory “expectations” over time.DISCLOSURE OF CROSS-SITE TRACKING AND RESPONSES TO DNT CHOICE MECHANISMSIn order to assess the Report’s recommendations, it is important to first understand CalOPPA’s DNT disclosure obligations. As amended by AB 370, the law requires a site operator to make disclosures with respect to:<ol><li>Its collection of personally identifiable information (PII) about its users’ activities over time and across third-party sites or online services, if it engages in such cross-site tracking. (We note that the California Attorney General appears to broadly define PII to include not only names, physical addresses, email addresses, phone numbers and social security numbers, but also device identifiers and geo-location data.)</li><li>Any “other party’s” tracking of the site operator’s users over time and across third-party sites or services.</li></ol>The law applies to cross-site tracking for any purpose, including, for example, analytics and advertising.We discuss each of these obligations, as well as questions that the Report raises with respect to them, in turn as follows.A. Disclosures relating to a site operator’s own cross-site tracking.The law requires that a site operator disclose how it responds to browser DNT signals or other tracking choice mechanisms, if it engages in cross-site tracking. As the Report notes, “[t]he new provisions do not . . . depend on a standard for how an operator should respond to a DNT browser signal or to any mechanism that automatically communicates a consumer’s choice not to be tracked.” The law requires only disclosure, not substantive practices, and it can be breached by a failure to disclose, or to disclose accurately, the required information.What does this mean in practice and in light of the Report? And what questions does the Report raise?<ul><li>If a site operator engages in cross-site tracking, it must disclose how it responds to either browser DNT signals or another tracking choice mechanism. <ul><li>If a site operator engages in cross-site tracking and honors DNT signals, it should explain precisely what it does in response to a DNT:1 header. Note that it may be a mistake to represent simply that a site operator “honors” DNT signals, as that representation could be interpreted to mean more than the operator’s actions warrant.For example, there is not yet consensus among stakeholders across the spectrum of industry, academics, and advocates on whether honoring an opt-out means that the site operator ceases the online tracking or merely ceases using the information collected through such tracking.</li><li>If a site operator engages in cross-site tracking and honors some other means for users to express choice with respect to the tracking, it should say so. The law permits a site operator to satisfy the DNT disclosure requirement by “providing a clear and conspicuous hyperlink in the operator’s privacy policy to an online location containing a description, including the effects, of any program or protocol the operator follows that offers the consumer that choice.” The Report makes it clear that a site operator may disclose either how it responds to a browser’s DNT signal or link to another program or protocol that provides choice. The Report notes, however, that “[d]escribing your response in your privacy policy statement is preferable to simply providing a link to a related ‘program or protocol’ . . . because it provides greater transparency to consumers.” It also recommends that site operators “[p]rovide the link in addition to identifying the program with a brief, general description of what it does.” While following these recommendations would promote transparency, both go beyond the law’s requirement of providing a link.</li></ul></li></ul>The Report further recommends that a site operator consider whether “the page to which you link contain[s] a clear statement about the program’s effects on the consumer . . . [and] what a consumer must do to exercise the choice offered by the program.”This begs a couple of questions about linking to third-party choice programs:<ol><li>Must the link bring users directly to the program’s opt-out page, or is a link to the program’s website sufficient? The Report does not make this clear and, again, may go beyond the law, which requires only a link to “an online location containing a description, including the effects, of any program or protocol the operator follows that offers the consumer that choice.”</li><li>The Report is silent as to which, if any, external choice programs are adequate. In our judgment, industry self-regulatory programs such as those run by the Digital Advertising Alliance (DAA) and Network Advertising Initiative (NAI) should meet the law’s requirements. But this is unsettled, and the AG has expressed concerns about whether either program meets the definition. We expect the NAI and DAA will seek further clarification on this point.</li></ol><ul><li>If a site operator engages in cross-site tracking but does not honor browser DNT signals or any other choice mechanism, it should say that it does not honor browser DNT signals. With respect to such site operators, the Report recommends that “[i]f you do continue to collect personally identifiable information about consumers with a DNT signal as they move across other sites or services, describe your uses of the information.” While such a disclosure may be prudent—as a failure to make it could conceivably be deemed a material omission and thus deceptive under Federal Trade Commission law where such use may be unexpected by an ordinary user under the circumstances—the disclosure is not required by CalOPPA.</li></ul><li>If a site operator does not engage in cross-site tracking, no disclosure obligation is triggered. </li>B. Disclosures relating to another party’s cross-site tracking.CalOPPA requires that a site operator disclose “whether other parties may collect personally identifiable information about an individual consumer’s online activities over time and across different Web sites when a consumer uses the operator’s Web site or service.” The law does not require the operator to make any disclosure regarding such “other party’s” response to a DNT mechanism.What does this mean in practice and in light of the Report? And what questions does the Report raise?<ul><li>Is a service provider an “other party”? Because neither the law nor the Report clarify the meaning of the term “other party,” it is not completely clear whether it includes a site operator’s service provider or whether, on the other hand, a service provider stands in the site operator’s shoes for purposes of the law. During a December 10, 2013 call with industry representatives, consumer advocates, and other interested parties, a representative of the AG’s office suggested that a service provider is not the same as a site operator but instead should be treated as an “other party” for purposes of the law. This position is consistent with the law’s definition of an “operator,” which appears to exclude service providers. In our judgment, it follows that a site operator does not have to disclose a DNT response or choice mechanism with respect to the cross-site tracking activities of its service providers, but it does have to disclose whether any service provider or other third party is engaged in the cross-site tracking of the site operator’s users. As a practical matter, this distinction may be of no consequence: a site operator that uses a service provider for cross-site tracking (e.g., for analytics or behavioral advertising services) is typically contractually required by the service provider to both disclose the tracking and tell its users how they can opt out of it, such as through the DAA or NAI.</li><li>The Report recommends that a site operator explain how a third party’s practices may diverge from the site operator’s DNT policy. This recommendation goes beyond the law’s requirements. As discussed above, the law requires only that a site operator disclose whether third parties engage in cross-site tracking. It does not impose any requirement to address the third party’s response to DNT signals or other choice mechanisms. The recommendation, however, raises the question of whether the AG believes there is a duty under the law for a site operator to vet the practices of third-party trackers on its site and to disclose whether such practices diverge from the site operator’s own.</li></ul>OPPORTUNITY TO CURE?The Report acknowledges that CalOPPA includes a 30-day notice and cure period for noncompliance, but it does not squarely address whether that 30-day period applies to companies that have posted a privacy policy that fails to include required DNT disclosures but otherwise complies with the law. In a December 2013 call with interested stakeholders, a representative of the AG’s office stated that the 30-day period does not apply in this situation, and this interpretation seems to be supported in the Report, which notes that “[t]he law provides an operator with a 30-day period to post a policy after being notified of failure to do so. An operator subject to the law is in violation for failing to comply with the legal requirements for the policy or with the provisions of its policy either knowingly and willfully or negligently and materially.” The AG’s apparent interpretation is that the notice and cure provision applies only if there is no policy whatsoever, but that if there is any policy—even one that is almost completely compliant—then no notice and cure period is required. As a matter of public policy, this position makes no sense: the operator who did nothing should not be entitled to greater protection than the operator who tried hard and just missed the mark.ONLINE TRANSPARENCY “BEST PRACTICES”Finally, the Report recommends other “best practices” aimed at ensuring that a site operator’s privacy policy is transparent to its users. While many of these go beyond the law’s requirements, it is worthwhile to consider them, as “best practices” tend over time to harden into regulatory expectations. They include the recommendations to:<ul><li>Prominently label the section of your policy regarding online tracking. For example: “California Do Not Track Disclosures.”</li><li>Disclose whether third parties collect PII from your users.</li><li>Explain your uses of PII beyond what is necessary for fulfilling a customer transaction or for the basic functionality of the website or app.</li><li>Describe what PII you collect from users, how you use it, and how long you retain it.</li><li>Describe the choices a consumer has regarding the collection, use, and sharing of his or her PII.</li><li>Use plain, straightforward language that avoids legal jargon, and use a format—such as a layered approach—that makes the policy readable. Use graphics or icons instead of text.</li></ul>CONCLUSIONWhen it comes to compliance with the new CalOPPA DNT disclosure requirements, the Report raises more questions than it answers. It acknowledges that its recommendations are not necessarily legal requirements, but, in so doing, fails to clarify what the law itself requires. In light of this uncertainty, a site operator may wish to implement the Report’s recommendations to the extent possible.