Social media sites are transforming not only the daily lives of consumers, but also how companies interact with consumers. Here at Morrison Foerster, across all of our practice groups, we are seeing complex, cutting-edge legal issues arising out of social media. As with the Internet boom during the mid-to-late 1990s, social media is generating new legal questions at a far faster pace than the law’s ability to provide answers to such questions. In an effort to stay on top of these emerging issues, and to keep our clients and friends informed of new developments, Morrison Foerster publishes this blog devoted to the law and business of social media.<h2>ABOUT MORRISON FOERSTER</h2>Morrison Foerster is a leading global law firm that transforms complexity into advantage for its clients. Our clients include some of the largest financial institutions, banks, consulting and accounting firms, and Fortune 100, technology, and life sciences companies. Highlighting the firm’s commitment to client service, leadership in market-changing deals and impact litigation, and values-based culture, Morrison Foerster has been repeatedly recognized as one of the top 10 firms on The American Lawyer’s A-List. Year after year, the firm receives significant recognition from Chambers and The Legal 500 across their various guides, including Global, USA, Asia‑Pacific, Europe, UK, Latin America, and FinTech Legal. Our lawyers passionately care about delivering legal excellence while living our values. Morrison Foerster has a long-standing commitment to creating a culture that respects and celebrates differences, while providing an inclusive environment. The firm has achieved Mansfield Certification Plus since 2018 as a result of successfully reaching at least 30 percent women, communities of color, and LGBTQ+ lawyer representation in a notable number of current leadership roles and committees. The firm also has a long history of commitment to the community and society through providing pro bono legal services, including litigating for civil rights and civil liberties, improving public education and fostering the wellbeing of children, advocating for veterans, promoting international human rights, enforcing the right to asylum, and safeguarding the environment.

Social

Search

sociallyaware-abajournalweb100-1

Aaron is the chair of the firm’s Technology Transactions Group and co-chair of the Interactive + Digital Media Group. He advises clients on a wide range of complex transactions involving intellectual property and technology, including structuring and negotiating strategic licensing, development, collaboration, procurement, and distribution deals.Aaron’s practice focuses on advising both established and emerging companies in a variety of data- and technology-intensive sectors, including software, SaaS, cloud-based technology, digital media (social media, AR/VR, gaming, streaming media, AdTech), AI, healthcare, consumer electronics, e-commerce, other online business models, and mobile applications. He also maintains an active practice counseling companies on branding and marketing, trademark licensing, and content-related transactions, as well as the intellectual property aspects of mergers, acquisitions, asset spin-offs, and private equity investments.He has represented clients such as Autodesk, Meta, OpenAI, Splunk, Konami, Kaiser Permanente, SoftBank, Visa, and Yahoo, among others.Aaron has been recognized by numerous publications for his work on market-defining technology transactions. He is currently ranked by Chambers USA for “Technology Transactions.”Aaron also serves as co-editor of Socially Aware, the firm’s award-winning newsletter and blog devoted to the law and business of social media, and regularly publishes on various IP and technology-related topics. Aaron is also a sought-after speaker on new and emerging areas of law, and is a frequent presenter and panelist at conferences and legal services programs. In addition to his active practice, Aaron regularly provides pro bono assistance to various nonprofit and charitable organizations such as Common Sense Media and the Starlight Children’s Foundation. He is a member of the board of directors of California Lawyers for the Arts.While in law school at the University of California, Berkeley, Boalt Hall School of Law, Aaron served as executive editor of the California Law Review and was elected to the Order of the Coif. Following law school, Aaron served as law clerk to the Honorable William H. Orrick and the Honorable Martin J. Jenkins, both United States District Judges for the Northern District of California.

rubin_aaron_blog_150x150.png

rubin_aaron_common_640x280.jpg

rubin_aaron_heroretina_2700x1160.jpg

rubin_aaron_mobileretina_750x1040.jpg

rubin_aaron_social_600x600.jpg

Partner

Aaron is the chair of our Technology Transactions Group. He advises clients on a wide range of complex transactions involving intellectual property and technology, including structuring and negotiating strategic licensing, development, collaboration, procurement, and distribution deals. Aaron’s practice focuses on advising both established and emerging companies in a variety of data– and technology–intensive sectors, including software, SaaS, cloud computing, AR/VR, AI, gaming, healthcare, consumer electronics, social media, e–commerce, other online business models, and mobile applications. He also maintains an active practice counseling companies on the intellectual property aspects of mergers, acquisitions, asset spin–offs, and private equity investments.

Aaron P. Rubin

Lawrence Gallick is of counsel in the firm’s Austin office and a member of the Technology Transactions Group.Lawrence focuses his practice on technology transactions and licensing matters. His diverse experience includes advising on SaaS agreements, cross-licensing agreements, research and collaboration agreements, development agreements, and distribution agreements. He counsels a broad range of companies across the software, hardware, life sciences, biotech and FinTech spaces, as well as other entities including universities.He advises clients in connection with general corporate matters including contract negotiations, and leasing and technology placement agreements.Lawrence also serves as co-editor of <a href="https://www.sociallyawareblog.com/" target="_blank">Socially Aware</a>, the firm’s award-winning newsletter and blog devoted to the law and business of social media, and regularly publishes on various IP and technology-related topics.Prior to joining the firm, Lawrence was counsel at another major law firm. Before earning his law degree, Lawrence was a web consultant, project manager, and web developer in Portland, Oregon, where he managed and consulted on projects using industry methodologies and performed custom development and integration of content management systems.Lawrence was named a Super Lawyers “Rising Star” in 2015 and 2018–2022, and is licensed in both California and New York. Lawrence earned his J.D. from the University at Buffalo School of Law, where he was the electronic systems editor for the Buffalo Law Review and awarded the ABA-BNA Award for Excellence in the Study of Intellectual Property Law.

gallick_lawrence_blog_150x150.png

gallick_lawrence_common_640x280.jpg

gallick_lawrence_heroretina_2700x1160.jpg

gallick_lawrence_mobileretina_750x1040.jpg

gallick_lawrence_social_600x600.jpg

Of Counsel

Lawrence Gallick

Anthony Ramirez is a partner in the Technology Transactions Group in the New York office of Morrison Foerster.Anthony advises clients on general commercial and transactional matters. He regularly advises companies on the IP aspects of their M&A transactions. His clients include technology, digital media and content for television and music, financial services, and communications companies with diverse intellectual property assets and issues.His practice focuses on the legal aspects of developing, licensing, and commercializing technology and intellectual property, as well as negotiating general commercial contracts, including outsourcing transactions, as well as content and data licenses. He regularly assists clients with legal issues relating to licensing and commercialization of digital media and content, digital content that is distributed over the Internet or streamed, mobile applications and social media, as well as the licensing of recorded music for distribution via digital platforms. Anthony is also experienced with issues relating to open-source software, software development, artificial intelligence and machine learning, cloud-based technology, and protection of proprietary information.Anthony has extensive experience working on matters involving disruptive technologies, such as blockchain. He has helped fintech clients with general intellectual property issues in connection with terms of service for online financial products and services.Anthony is an integral part of the outside pro bono legal team for nonprofit organizations based in New York, including advising clients on legal issues regarding entertainment, social media, privacy rights, and the negotiation of outsourcing and service agreements. Anthony received his J.D. from the University of Michigan Law School in 2009. He received his B.S. from Cornell University in 2004.

ramirez_anthony_blog_150x150.png

ramirez_anthony_common_640x280.jpg

ramirez_anthony_heroretina_2700x1160.jpg

ramirez_anthony_mobileretina_750x1040.jpg

ramirez_anthony_social_600x600.jpg

Anthony Ramirez is a partner in the Technology Transactions Group in the New York office of Morrison Foerster. He advises clients on general commercial and transactional matters. His clients include technology, media, and communications companies with considerable intellectual property assets. His practice focuses on the legal aspects of licensing and commercializing technology and intellectual property, as well as negotiating general commercial contracts. He also regularly assists clients with legal issues relating to mobile applications and social media.

Anthony M. Ramirez

favicon.ico

favicon-16x16.png

favicon-32x32.png

apple-touch-icon.png

MoFo Favicons

Socially Aware is devoted to the law and business of social media, proactively addressing emerging issues and keeping our clients informed of new developments. We cover fields such as artificial intelligence, privacy and data security, Section 230, intellectual property, and much more.

Welcome to Socially Aware

240920-socially-aware-header.jpg

Welcome to Socially Aware

240920-socially-aware-header

Socially Aware is devoted to the law and business of social media, proactively addressing emerging issues and keeping our clients informed of new developments. We cover fields such as artificial intelligence, privacy and data security, Section 230, intellectual property, and much more.

News and Announcements

Blog - Terms of Use

Blog - Privacy Policy

Blog - Blog Disclaimer

Blog - Attorney Advertising

morrison-foerster-blog-logo.png

Provides a data-driven look at the Federal Circuit.

Federal Circuitry

Brings together legal insights and in-depth analyses on trends and complex issues shaping the global technology industry.

MoFo Tech

Mofo Tech

Equips our clients with the most up-to-date and relevant information on employment and labor law issues.

Employment Law Commentary

In-depth analysis of developments and trends impacting government contracting.

Government Contracts Insight

Government Contracts Insights

Provides insights and reports on the most current class actions lawsuits and product liability issues that affect consumer-facing companies.

Class Dismissed Blog

Class Dismissed

MoFo’s Socially Aware blog provides timely updates and analysis of the many complex and cutting-edge legal and business issues arising out of social media.

Socially Aware

  Linkedin

MoFo LinkedIN

Socially Aware Blog - RSS

Stay Connected

Never miss a post from Socially Aware. Enter your email below to stay up-to-date.

Subscribe

The Law and Business of Social Media

Morrison Foerster - Footer

Blogs -  Home Button

Home

Blog - Topics

Web Scraping

Advertising

Antitrust

Arbitration

Artificial Intelligence

Asia

Autonomous Vehicles

Bankruptcy

Big Data

Blockchain

Class Actions

Cloud Computing

Compliance

Contracts

COPPA

Copyright

Crowdsourcing

Cyberbullying

Cybersecurity

Data Security

Defamation

Digital Content

Disappearing Content

Discovery

DMCA

E-Commerce

E-Discovery

E-Personation

Electronic Contracts

Employment Law

Endorsement Guides

Ephemeral Messaging

Ethics

European Union

Event

Fair Use

FDA Regulations

Financial Institutions

First Amendment

Fraud

Free Speech

GDPR

Hacking

Influencer Marketing

Infographic

Internet of Things

Investment Management Law

JOBS Act

Labor Law

Litigation

Live streaming

Marketing

Mobile

Online Contracts

Online Endorsements

Online Promotions

Online Reviews

Patent

Privacy

Product Liability

Protected Speech

Right of Publicity

Right To Be Forgotten

Section 230 Safe Harbor

Securities Law

Social Media Policy

Statistics

Status Updates

Stored Communications Act

Supreme Court

Terms of Use

Trademark

UK High Court

User-Generated Content

Wearable Computers

Topics

Blog - Editors

Editors

Blog - About

About

Blog - Subscribe

More

Lawrence W. Gallick

Social Links: If the Suit Fits

Social Links: Age Verification, X Appeal, and the Great White North

Social Links: Fake Reviews, Real Rulings, and an Epic Fail

Lawrence W. Gallick on Toth v. Everly Well, Inc.

Social Links: Going Back to Cali

LinkedIN

The cost for violating the Children’s Online Privacy Protection Act (COPPA) has been steadily rising, and companies subject to the law should take heed. Last week, the Federal Trade Commission (FTC) announced a record-setting $5.7 million settlement with the mobile app company Musical.ly for a myriad of COPPA violations, exceeding even the December 2018 $4.95 million COPPA settlement by the New York Attorney General. Notably, two Commissioners issued a statement accompanying the settlement, arguing that the FTC should prioritize holding executives personally responsible for their roles in deliberate violations of the law in the future.COPPA is intended to ensure parents are informed about, and can control, the online collection of personal information (PI) from their children under age thirteen. Musical.ly (now operating as “TikTok”) is a popular social media application that allows users to create and share lip-sync videos to popular songs. The FTC cited the Shanghai-based company for numerous violations of COPPA, including failure to obtain parental consent and failure to properly delete children’s PI upon a parent’s request.COPPA Clearly Applied to the Musical.ly AppCOPPA applies to an operator of a website, mobile application, or other online service that either (1) is directed to children under thirteen, or (2) has actual knowledge that it collects PI from children under thirteen. According to the <a href="https://www.ftc.gov/system/files/documents/cases/musical.ly_complaint_ecf_2-27-19.pdf" target="_blank" rel="noopener">FTC complaint</a>, Musical.ly satisfied both prongs. First, citing the factors set forth in the FTC’s COPPA Rule for determining whether an online service is directed to children, the FTC charged that the Musical.ly app was “directed to children” because it targeted children “as one audience.”  Specifically, a large portion of users were underage, the app had song categories like “Disney” and “School,” and the app was used by celebrities who are popular with tweens. The FTC further stated that the “core activity of the app” – creating lip-sync videos – is a “child-oriented activity.”That final point may arguably be a stretch. (Who doesn’t love karaoke?) But the FTC also accused Musical.ly of having actual knowledge of its users’ ages. The company received thousands of complaints from parents whose children used the app without their consent, and merely perusing the user profile pages and photos (many of which featured a user’s self-reported age, birthdate, or school) would reveal that many users were underage.  Finally, in 2016, the company was made aware that many of its most “followed” users were under thirteen.What Not to Do When You’re Subject to COPPAThe FTC complaint details the myriad ways in which Musical.ly allegedly failed to comply with COPPA, and companies should take care not to mirror any of its mistakes.The company allegedly failed to both obtain parental consent before collecting PI from children and post appropriate notices of its practices with respect to its collection of PI from children. Thousands of parents complained to the company that they were never asked for consent before their children signed up. From the app’s launch in 2014 until July 2017, Musical.ly did not request the age of its users, but it did require users to enter a short bio and submit their email, phone number, first and last names, and a photo.  After July 2017, the company screened new users for age, but it did not confirm the age of existing users, nor did it seek parental consent for profiles clearly belonging to children under thirteen.As reflected in complaints received by the company, the lack of parental notice and consent appalled many parents, particularly given how the application permitted the disclosure of PI.  In addition to enabling children to publicly share videos of themselves, all user profiles were by default set to “public,” while “private” profiles hid only a user’s uploaded videos (that is, the “private” user’s profile and contact information were still viewable). By default, any user could directly message any other user, leading to reports of adults contacting minors. Moreover, up until 2016, the app collected geolocation, which it used to display a list of other users within a 50-mile radius of the user (with whom the user could then interact).The company also allegedly violated COPPA’s data deletion and retention obligations: if a parent contacted Musical.ly to close his or her child’s account, Musical.ly would close the account but not delete the child’s videos or profile information from its servers. As the <a href="https://classdismissed.mofo.com/ftc/dont-forget-to-hit-delete-ftc-blog-post-clarifies-coppa-information-deletion-requirement/" target="_blank" rel="noopener">FTC recently reminded businesses</a>, COPPA requires deletion of children’s PI if the information no longer serves the purpose for which it was collected.A Record-Setting Settlement Means “Think Twice About COPPA”Given the number of missteps by Musical.ly, it may not be surprising that the company ultimately agreed to a record-setting $5.7 million <a href="https://www.ftc.gov/system/files/documents/cases/musical.ly_proposed_order_ecf_2-27-19.pdf" target="_blank" rel="noopener">settlement with the FTC</a>. The company agreed to delete the PI of children under thirteen lacking the required parental consent, and it is now subject to a multi-year consent order that imposes a variety of compliance, reporting, and recordkeeping obligations on it.In the FTC’s own <a href="https://www.ftc.gov/news-events/blogs/business-blog/2019/02/largest-ftc-coppa-settlement-requires-musically-change-its?utm_source=govdelivery" target="_blank" rel="noopener">blog post describing the settlement</a>, companies were warned to “think twice before concluding ‘We’re not covered by COPPA.’” Indeed, the Musical.ly case highlights the many ways in which a consumer-facing service might be subject to the law. The settlement also closely follows on a $4.95 million COPPA settlement from the New York Attorney General, potentially signaling an upwards trend in COPPA settlement appetite by regulators. Even the $5.7 million settlement with Musical.ly likely represents a mere fraction of the company’s total potential liability under COPPA: the FTC is authorized to seek up to approximately $40,000 per violation (i.e., per child) in civil penalties (in addition to injunctive relief) for violations of COPPA.The two Democrat Commissioners also <a href="https://www.ftc.gov/enforcement/cases-proceedings/172-3004/musically-inc" target="_blank" rel="noopener">issued a public statement </a>suggesting that the Musical.ly settlement should have gone even further. Commissioners Slaughter and Chopra argue that the FTC should move away from the status quo, where individuals at companies largely avoid personal liability for grievous violations of the law, and hold individuals personally liable if they “made or ratified decisions to knowingly violate the law.” The statement was not specifically limited to COPPA.  While such an expansion of enforcement may be unlikely to occur during the administration of the current Republican-led FTC, the Commissioners’ statement serves as a useful reminder to all companies: effective privacy compliance starts at the top of any organization.

oneill_julie_blog_150x150.png

oneill_julie_common_640x280.jpg

oneill_julie_heroretina_2700x1160.jpg

oneill_julie_mobileretina_750x1040.jpg

oneill_julie_social_600x600.jpg

Clients seek out Julie because of her practical advice on cutting-edge issues at the intersection of privacy and consumer protection laws. She provides clients with practical solutions to compliance c

Julie O'Neill

Clients seek out Julie because of her practical advice on cutting-edge issues at the intersection of privacy and consumer protection laws. She provides clients with practical solutions to compliance challenges around a wide variety of both online and offline privacy issues, including tracking, interest-based advertising, geo-targeting and other mobile tracking, personalization, and cross-device tracking. Recognized in The Legal 500 US 2014, 2016, 2019, and 2020 and Chambers USA 2021 for her exceptional legal work, her clients praise her saying, “She is really good at giving practical, targeted advice and taking stock of what the risk profile of the client is, so that the advice is holistic.” (Chambers USA 2021).

gettyimages-165628069_small-1-300x300.jpg

Thank You, Next Enforcement: Music Video App Violates COPPA, Will Pay $5.7 Million

Thank You, Next Enforcement: Music Video App Violates COPPA, Will Pay $5.7 Million

The cost for violating the Children’s Online Privacy Protection Act (COPPA) has been steadily rising, and companies subject to the law should take heed. Last we

Most companies are familiar with the Children’s Online Privacy Protection Act (COPPA) and its requirement to obtain parental consent before collecting personal information online from children under 13.  Yet COPPA also includes an information deletion requirement of which companies may be unaware.  On May 31, 2018, the Federal Trade Commission (FTC) published a <a href="https://www.ftc.gov/news-events/blogs/business-blog/2018/05/under-coppa-data-deletion-isnt-just-good-idea-its-law?utm_source=govdelivery" target="_blank" rel="noopener">blog post</a> addressing this requirement, clarifying (i) when children’s personal information must be deleted and (ii) how the requirement applies, as well as (iii) recommending that covered companies review their information retention policies to ensure they are in compliance.(i) COPPA’s information deletion requirement.  The FTC clarifies that, under Section 312.10 of COPPA, companies may retain children’s personal information “for only as long as is reasonably necessary to fulfill the purpose for which the information was collected.”  After that, a company must use reasonable measures to ensure such personal information is securely destroyed.(ii) Application of the deletion requirement to children’s outdated subscription information.  In its post, the FTC applies the deletion requirement to the example of a subscription-based app directed to children under 13.  If the subscription period ends, and a parent decides not to renew the service, can the company keep the child’s personal information?  The answer, the FTC confirms, is “no”:  the information is no longer “reasonably necessary” to provide the app’s services, so it must be deleted.  This is true regardless of whether a parent affirmatively requests deletion.(ii) Recommendation to review information retention policies in light of the deletion requirement.  The FTC recommends that companies review their information retention policies with COPPA’s deletion requirement in mind.  It lists questions to help guide companies as they navigate this requirement:<ul><li>What types of personal information are you collecting from children?</li><li>What is your stated purpose for collecting the information?</li><li>How long do you need to hold onto the information to fulfill the purpose for which it was initially collected? For example, do you still need information you collected a year ago?</li><li>Does the purpose for using the information end with an account deletion, subscription cancellation, or account inactivity?</li><li>When it’s time to delete information, are you doing it securely?</li></ul>Key takeaway.  If a company possesses personal information collected online from a child under 13, and the information no longer serves the purpose for which it was collected, the company must delete it.  Companies should review their information retention policies to ensure compliance with this COPPA requirement.*       *       *For more on the Children’s Online Privacy Protection Act, please read the following Socially Aware posts: <a href="https://www.sociallyawareblog.com/2013/01/10/ftc-issues-substantially-revised-coppa-rule-effective-july-1-2013-review-of-changes-and-compliance-tips/" target="_blank" rel="noopener">FTC Issues Substantially Revised COPPA Rule</a>: and <a href="https://www.sociallyawareblog.com/2015/07/20/mobile-app-legal-terms-conditions-six-key-considerations/">Review of Changes and Compliance Tips; and Mobile App Legal Terms & Conditions: Six Key Considerations</a>.

ftcbuilding-gettyimages-530746609-600px-300x199-1-300x199.jpg

Don’t Forget to Hit “Delete”: FTC Blog Post Clarifies COPPA Information Deletion Requirement

Don’t Forget to Hit “Delete”: FTC Blog Post Clarifies COPPA Information Deletion Requirement

Most companies are familiar with the Children’s Online Privacy Protection Act (COPPA) and its requirement to obtain parental consent before collecting personal 

In the last few years, as advertising has followed consumers from legacy media such as television to online video and social media platforms, the <a href="https://www.law360.com/agencies/federal-trade-commission" target="_blank" rel="noopener">Federal Trade Commission</a> has been attempting to ensure that participants in this new advertising ecosystem understand the importance of complying with the FTC’s “<a href="https://www.ftc.gov/sites/default/files/attachments/press-releases/ftc-publishes-final-guides-governing-endorsements-testimonials/091005revisedendorsementguides.pdf" target="_blank" rel="noopener">Guides Concerning the Use of Endorsements and Testimonials in Advertising</a>,” or the endorsement guides. The endorsement guides require advertisers and endorsers (also referred to as influencers) to, among other things, clearly and conspicuously disclose when the advertiser has provided an endorser with any type of compensation in exchange for an endorsement.A failure to make appropriate disclosures may be a violation of <a href="https://www.federalreserve.gov/boarddocs/supmanual/cch/ftca.pdf" target="_blank" rel="noopener">Section 5 of the Federal Trade Commission Act</a>, which prohibits unfair or deceptive acts or practices. In recent enforcement actions, press releases, guidance, closing letters and letters sent directly to endorsers (including prominent public figures), the FTC has made clear its belief that: (1) appropriate disclosures by influencers are essential to protecting consumers; and (2) in too many instances, such disclosures are absent from celebrity or other influencer endorsements.Given the repetition of this message, it is apparent that the FTC believes it is still not being heard. With influencer marketing campaigns showing no signs of losing popularity, it would not be surprising if the next step the FTC takes is to bring an enforcement action against a major celebrity, as well as the brand or brands with which the celebrity is associated. So, with the FTC on the prowl, brands, advertisers and marketing companies should all be making sure they have a compliance program in place to increase the likelihood that the FTC makes its splash elsewhere. In this post, we recount how the FTC has gotten to where it is today and, thus, why it might be heading for a celebrity enforcement action next.In the BeginningThe FTC’s activity in the endorsement and influencer space is grounded in its endorsement guides, which outline how the FTC believes a business may lawfully use consumer and other endorsements in its advertising. The endorsement guides provide, in relevant part, that any “material connection” between an endorser and an advertiser—in other words, a connection that might affect the weight or credibility that consumers give the endorsement—must be clearly and conspicuously disclosed. The FTC’s thinking is typified by this example from its endorsement guide FAQs:Say you’re planning a vacation. You do some research and find a glowing review on someone’s blog that a particular resort is the most luxurious place he has ever stayed. If you knew the hotel had paid the blogger hundreds of dollars to say great things about it or that the blogger had stayed there for several days for free, it could affect how much weight you’d give the blogger’s endorsement. The blogger should, therefore, let his readers know about that relationship.The scope of a material connection, as stated in the endorsement guides and as interpreted by the FTC, including in the FAQs, is quite broad. It includes, for example, a business relationship, a payment, a gift or a sweepstakes entry. The scope of actors subject to the rules is also quite broad: it includes advertising and marketing companies that facilitate campaigns on behalf of advertisers (i.e., brands), those advertisers/brands themselves, and the endorsers or influencers acting on behalf of the marketing companies or brands. As discussed below, the FTC’s enforcement actions have involved each of these types of participants in influencer marketing activities.First, the Marketing FirmsThe FTC’s efforts to regulate this ecosystem began in late 2014 when the FTC brought its first enforcement action specifically related to social media activity (though this case also included straightforward allegations of deceptively made statements). The FTC alleged that the advertising firm Deutsch LA Inc. engaged in deceptive activities relating to the promotion, through <a href="https://www.law360.com/companies/twitter-inc" target="_blank" rel="noopener">Twitter</a>, on behalf of its client Sony, of the PlayStation Vita handheld gaming console.In a story that would become familiar over the next few years, the <a href="https://www.ftc.gov/system/files/documents/cases/1503deutschcmpt.pdf" target="_blank" rel="noopener">FTC’s complaint</a> alleged that company employees responded to a request from an assistant account executive at the company to use their personal Twitter accounts to post positive comments about the Sony console, each using the “#gamechanger” hashtag. The complaint includes examples of the employees’ tweets, such as, “One thing can be said about PlayStation Vita…it’s a #gamechanger.” The FTC alleged that the employees’ tweets were deceptive because they falsely purported to be endorsements from actual users of the Sony gaming console. Moreover, the fact that the tweets were written by employees of Sony’s ad agency would have been material to consumers in making decisions about whether to purchase the console. For this reason, the tweeters’ failure to disclose their connection to Deutsch LA (and, in turn, to Sony) was allegedly deceptive.In September 2015, the FTC brought a very similar case against Machinima Inc., an online entertainment network. Machinima allegedly paid video bloggers to promote the <a href="https://www.law360.com/companies/microsoft-corporation" target="_blank" rel="noopener">Microsoft Xbox One</a> system by producing and uploading to <a href="https://www.law360.com/companies/youtube-inc">YouTube</a> videos of themselves playing Xbox One games. The FTC alleged that Machinima did not require any disclosure of the compensation the influencers received and that many videos lacked any such disclosure. Because the payments would not be reasonably expected by YouTube viewers, the failure to disclose them was deceptive in violation of Section 5.Then, the BrandsIn connection with the Machinima matter, the <a href="https://www.ftc.gov/system/files/documents/closing_letters/nid/150902machinima_letter.pdf" target="_blank" rel="noopener">FTC also issued a closing letter</a> reflecting that it had also investigated Microsoft and its advertising agency Starcom in relation to the influencers’ videos. (Starcom managed the relationship with Machinima.) Even though the FTC did not ultimately take action against Microsoft (or Starcom), the closing letter made clear the FTC’s position that a company whose products are promoted bears responsibility for the actions of its ad agencies — as well as the actions of those engaged by its ad agencies. In particular, Microsoft avoided an enforcement action because it had a “robust” compliance program in place that included specific guidance relating to the FTC’s endorsement guides and because Microsoft made training relating to the endorsement guides available to employees, vendors and personnel at Starcom. (The FTC also subsequently updated its endorsement guides FAQs to formalize the expectations that were foreshadowed in the closing letter, including the statement that “[a]dvertisers need to have reasonable programs in place to train and monitor members of their network.”)Consistent with its incremental approach, the FTC followed these actions with its first complaint against a brand for its use of social media influencers. In early 2016, the FTC alleged that <a href="https://www.law360.com/companies/lord-taylor-llc" target="_blank" rel="noopener">Lord & Taylor</a> gifted a dress to 50 “fashion influencers” and paid them to post photos of themselves wearing the dress on their <a href="https://www.law360.com/companies/instagram-inc" target="_blank" rel="noopener">Instagram</a> accounts. According to the FTC, Lord & Taylor’s role in the promotional effort was not appropriately disclosed. The FTC thus alleged that the company violated Section 5’s prohibition on deceptive practices by, among other things, failing to disclose that the influencers’ Instagram posts did not reflect their independent and impartial statements, but rather were specifically created as part of an advertising campaign in which they were paid to participate.The FTC followed the Lord & Taylor action with <a href="https://www.ftc.gov/news-events/press-releases/2016/07/warner-bros-settles-ftc-charges-it-failed-adequately-disclose-it" target="_blank" rel="noopener">a similar settlement</a> relating to a company’s alleged failure to disclose that it had paid online influencers to post positive reviews in YouTube videos and on social media. Here, while the company allegedly instructed influencers to provide a written disclosure that videos were sponsored, they did not “require that the YouTube influencers be instructed to place a sponsorship disclosure clearly and conspicuously in the video itself.”Taken together, these actions show how the FTC has moved incrementally, starting with matters involving standard-fare alleged deceptive practices by marketing companies that also involved social media endorsements, and then escalating to enforcement actions against brands based on specific failures to include disclosures in a specific manner.To Individual Endorsers (Sort Of)Having covered two of the major parts of the social media advertising ecosystem, the logical next step for the FTC is individuals who are paid to make endorsements. Here, as with previous actions, the FTC has started (relatively) conservatively with an enforcement action announced in September 2017 against a company—and two of its officers—in connection with endorsements made by the officers in YouTube videos and social media. The company, CSGO Lotto Inc., runs an online virtual currency gambling website. The <a href="https://www.ftc.gov/system/files/documents/cases/1623184_csgolotto_complaint.pdf">FTC alleged</a> that the company provided two individuals (who were also owners and officers of the company) with free virtual currency to gamble on the site and that the two did not disclose their material connections to the company when they promoted it online. For example, both of the individuals created YouTube videos promoting CSGO Lotto and disseminated tweets linking to their videos and directly promoting the site (e.g., “Bruh … I’ve won like $8,000 worth of CS:GO Skins today on @CSGOLotto I cannot even believe it!”).The FTC’s allegations in this case are similar to those of the previous influencer cases, such as that the company failed to include appropriate disclosures of sponsorship in YouTube videos. But, the FTC also alleged that the officers of the company—who were named individually in the complaint — engaged in violation of Section 5 as influencers by, among other things, failing to disclose that they were owners/officers of the company, which “would be material to consumers in their decisions regarding using CSGO Lotto.”What’s Next?The CSGO Lotto case sets the stage for an enforcement action against an influencer alone. Perhaps to drive home the point, the FTC accompanied its announcement of its settlement of that case with<a href="https://www.ftc.gov/news-events/blogs/business-blog/2017/09/three-ftc-actions-interest-influencers" target="_blank" rel="noopener"> the disclosure that it had sent follow-up letters to 21 influencers</a> who, in April 2017, had received letters from the FTC regarding brand endorsements. The FTC noted that it asked the recipients to tell the FTC whether “they have material connections to the brands” in social media posts the FTC flagged and, if so, “to spell out the steps they will be taking to make sure they clearly disclose their material connections to brands and businesses.”Given the FTC’s activity in this space, the parameters for running an influencer campaign that complies with Section 5 are becoming well established. To help mitigate the risk of being the FTC’s next example, some practical considerations include:<ul><li>Implementation of a process for obtaining signed and dated acknowledgements of disclosure and related obligations from each influencer with a material connection (which may include, for example, a paid relationship, a professional relationship, or free goods or services);</li><li>An explicit requirement that the endorser make clear and prominent disclosures of the material connections between the endorser and the advertiser;</li><li>A process for monitoring and reviewing social media influencers for compliance; and</li><li>Maintaining the right to immediately terminate the arrangement in light of noncompliance.</li></ul>Influencers should also understand that they must clearly and conspicuously disclose their affiliations with the brands that they promote, above the jump in the post or video. And all companies that use social media influencers should consider the policies and procedures they have in place or need to develop to ensure that they, their influencers and any other parties they work with in this space are meeting the FTC’s expectations. If they don’t, they risk falling victim to the FTC’s next efforts to promote itself as the top cop on the endorsement beat.*    *    *Editor’s note: This piece originally appeared in <a href="https://www.law360.com/articles/1014039/the-ftc-s-quest-for-better-influencer-disclosures">Law360</a>.

gettyimages-689976460-600px-300x212.jpg

The FTC’s Quest for Better Influencer Disclosures

The FTC’s Quest for Better Influencer Disclosures

In the last few years, as advertising has followed consumers from legacy media such as television to online video and social media platforms, the Federal Trade 

In 2016, brands spent $570 million on social influencer endorsements on Instagram alone. This recode article takes a looks at how much influencers with certain followings can command, and whether they’re worth the investment.And don’t overlook the legal issues associated with the use of social media influencers; the FTC just settled its first complaint against social media influencers individually. The case involved two online gamers who posted videos of themselves promoting a gaming site that they failed to disclose they jointly owned.In a precedent setting opinion, the European Court of Human Rights held that the right to privacy of a Romanian man, Bogdan Bărbulescu, was violated when Bărbulescu’s employer, without explicitly notifying Bărbulescu, read personal messages that Bărbulescu sent from an online account that Bărbulescu had been asked to set up for work purposes.In other European news, the attorney general for England and Wales, Jeremy Wright, MP, has begun an inquiry into whether that jurisdiction needs to impose restrictions on social media in order to help ensure criminal defendants there get a fair trial.More than half of Americans 50 or older now get their news from social media sites, Pew Research Center’s 2017 social media survey shows.Celebrities who promote initial coin offerings (ICOs) on social media risk violating laws that apply to the public promotion of securities.Facebook developed an artificial intelligence robot that can express emotion by making realistic facial expressions at appropriate times.A college student has sued Snapchat and the Daily Mail for alleged defamation and invasion of privacy arising from the use of the student’s name and image on Discover, Snapchat’s social news feature, under the headline, “Sex, Drugs and Spring Break—College Students Descent on Miami to Party in Oceans of Booze and Haze of Pot Smoke.”Is the threat of artificial intelligence disrupting a slew of industries less imminent than we thought?Google created a website that uses fun illustrations to show which “how to” queries its users entered into the search engine most.The popularity of online videos that viewers can appreciate with the sound turned off has led to striking similarities between early silent film and modern social video.

Aaron is the chair of the firm’s Technology Transactions Group and co-chair of the Interactive + Digital Media Group. He advises clients on a wide range of complex transactions involving intellectual property and technology, including structuring and negotiating strategic licensing, development, collaboration, procurement, and distribution deals.

Aaron Rubin

Social Links: Social media influencers earn big bucks for endorsements, while the FTC settles a suit against influencers; European court sides with employee axed over emails reviewed by employer

In 2016, brands spent $570 million on social influencer endorsements on Instagram alone. This recode article takes a looks at how much influencers with certain 

Social Links: Social media influencers earn big bucks for endorsements, while the FTC settles a suit against influencers; European court sides with employee axed over emails reviewed by employer

Recent challenges to the Federal Trade Commission’s (FTC) authority to police data security practices have criticized the agency’s failure to provide adequate guidance to companies.In other words, the criticism goes, businesses do not know what they need to do to avoid a charge that their data security programs fall short of the law’s requirements.A series of blog posts that the FTC began on July 21, 2017, titled “<a href="https://www.ftc.gov/news-events/press-releases/2017/07/stick-security-ftc-provide-additional-insights-reasonable-data">Stick with Security</a>,” follows <a href="https://www.ftc.gov/news-events/press-releases/2017/03/ftc-testifies-house-committee-about-data-security-small">promises</a> from acting Chair Maureen Ohlhausen to provide more transparency about practices that contribute to reasonable data security. Some of the posts provide insight into specific data security practices that businesses should take, while others merely suggest what, in general, the FTC sees as essential to a comprehensive data security program.Building on the data security principles drawn from FTC enforcement actions and articulated more than two years ago in <a href="https://www.ftc.gov/tips-advice/business-center/guidance/start-security-guide-business">Start with Security: A Guide For Business</a>, the <a href="https://www.ftc.gov/news-events/blogs/business-blog/2017/07/stick-security-insights-ftc-investigations?utm_source=govdelivery">inaugural post</a> addresses the question of whether there any recurring themes of data security investigations closed by the FTC. The answer is general, stating that the practices that led the staff to close investigations largely aligned with the practices recommended in Start with Security: “For example, the companies typically had effective procedures in place to train their staff, keep sensitive information secure, address vulnerabilities and respond quickly to new threats.”These general conclusions from the FTC do not suggest actual practices that businesses can operationalize. It may be more helpful for the FTC to specify precisely what those companies did to avoid prosecution. The blog post does note that the FTC may close an investigation where the risk of harm in the event of a data breach is low because the data was properly encrypted.It appears that the Stick with Security series will generally affirm the types of “reasonable” security practices that are by now becoming standard best practices. Indeed, the <a href="https://www.ftc.gov/news-events/blogs/business-blog/2017/07/start-security-stick-it">second post</a> refreshes the baseline “start with security” principle from the FTC’s Start with Security guidance. Companies are reminded (with updated examples): to not collect personal information they don’t need, to hold onto information only as long as there is a legitimate business need, to not use personal information when it is not necessary, to regularly train and remind staff on security standards and practices, and, when feasible, to offer consumers more secure choices.The <a href="https://www.ftc.gov/news-events/blogs/business-blog/2017/08/stick-security-control-access-data-sensibly">third post</a> discusses access controls, recommending specific measures such as implementing a “clean desk” policy for employees and limiting administrator-level IT privileges, and the <a href="https://www.ftc.gov/news-events/blogs/business-blog/2017/08/stick-security-require-secure-passwords-authentication">fourth post</a>, covering passwords and authentication processes, provides a few helpful pointers. For example, the FTC recommends that systems be designed to automatically reject passwords that are too obvious or simple and to suspend accounts whenever multiple incorrect logins have been attempted. It also recommends that companies protect sensitive databases with multifactor authentication, such as a password in combination with a verification code sent to a user’s phone. Like most of the preceding posts, however, the most recent installment, which recommends that companies segment and monitor access to their networks, does not go very far beyond approvingly citing general examples of implementing segmentation and network monitoring.The FTC promises a new post every Friday over the coming months. The next post is expected to discuss how companies should secure remote access to their networks. While it is encouraging that the FTC is attempting to increase its guidance to businesses, it remains to be seen what new insights a business will actually be able to glean from these efforts.*     *     *For more on federal and state regulation of computer security matters, please see the following Socially Aware articles: <a href="http://www.sociallyawareblog.com/2017/04/10/new-yorks-new-cybersecurity-regulations/">N.Y.’s New Cybersecurity Regulations: What Financial Services Companies Need to Know</a>; <a href="http://www.sociallyawareblog.com/2017/02/14/rules-for-cross-device-tracking/">FTC Report Reinforces the Rules for Cross-Device Tracking</a>; and <a href="http://www.sociallyawareblog.com/2015/02/02/ftc-issues-landmark-report-on-internet-of-things/">FTC Issues Landmark Report on Internet of Things</a>.

ftcbuilding-gettyimages-530746609-600px-300x199-1.jpg

More Insight From the FTC on Data Security—or More of the Same?

More Insight From the FTC on Data Security—or More of the Same?

Recent challenges to the Federal Trade Commission’s (FTC) authority to police data security practices have criticized the agency’s failure to provide adequate g

Searching “millennials killed…” on the Internet returns over 1.5 million results in .65 seconds. Commentators have blamed the generation raised by tablets, smartphones, and apps for killing everything from <a href="http://www.marketwatch.com/story/here-are-all-of-the-things-millennials-have-been-accused-of-killing-2017-05-22" target="_blank" rel="noopener noreferrer">marriage</a> to <a href="http://nypost.com/2017/03/23/millennials-have-officially-ruined-brunch/" target="_blank" rel="noopener noreferrer">brunch</a>, often deriding today’s youth for being too opinionated and too obnoxious. It is a bit ironic, then, that the right to complain was almost a casualty of the technology generation.Today, ecommerce and social media are ubiquitous and intertwined. For example, any ecommerce site worth its salt will include interactive user comments that enable purchasers to praise or critique products. Moreover, the power of online review sites, such as Yelp and Rotten Tomatoes, to set consumer tastes is only increasing. For example, a <a href="http://www.hbs.edu/faculty/Pages/item.aspx?num=41233" target="_blank" rel="noopener noreferrer">study</a> conducted at Harvard Business School concluded that a one-star improvement on Yelp would lead to a roughly 9% increase in revenue for restaurants. Considering how thin profit margins are in the restaurant sector, 9% could make or break a small business.In response to the growing significance of user reviews, some companies sought to protect their revenue streams by including non-disparagement clauses in form contracts, such as terms of service and other click-through agreements. Retailers, studios, restaurants and even <a href="http://www.cnn.com/travel/article/bad-hotel-review-fine-backlash/index.html" target="_blank" rel="noopener noreferrer">hotels</a> used these gag clauses to suppress bad reviews by levying fines and imposing other penalties on consumers.In some cases, these practices were abusive. For example, one small town Utah couple told their <a href="https://www.commerce.senate.gov/public/_cache/files/2966d0eb-8812-4035-ae59-4b75979864e4/93F3E6B5DE58928F85DF4367AEC0373A.jen-palmer-testimony.pdf" target="_blank" rel="noopener noreferrer">story</a> to the U.S. Senate Committee on Commerce, Science & Transportation. Jen Palmer left a negative review about a company after a twenty dollar Christmas purchase her husband made never arrived. Three years later, the company sent Ms. Palmer a demand for $3,500 claiming that her review violated the company’s terms of sale and use. When the Palmers were unable to pay, the company flagged them to credit agencies, creating a multi-year ordeal for their household. There have also been <a href="https://arstechnica.com/tech-policy/2011/05/all-your-reviews-are-belong-to-us-medical-justice-vs-patient-free-speech/" target="_blank" rel="noopener noreferrer">reports</a> of doctors and dentists requiring their patients to agree to gag clauses in order to receive medical treatment.Some time ago, <a href="http://www.sociallyawareblog.com/2015/06/29/the-right-to-give-one-star-reviews/" target="_blank" rel="noopener noreferrer">we discussed</a> in Socially Aware the possibility of the federal government taking action against such practices and, on December 14, 2016, President Obama signed into law the Consumer Review Fairness Act (CRFA). Now, as of March 14, 2017, the CRFA’s provisions prohibiting gag clauses in the context of customer reviews have become effective.<h4>What Activities Are Banned?</h4>The <a href="https://www.congress.gov/bill/114th-congress/house-bill/5111/text" target="_blank" rel="noopener noreferrer">CRFA</a> cracks down on three main activities. Specifically, companies are prohibited from using form contracts to restrict a consumer’s ability to leave reviews about goods or services they received, imposing penalties for leaving negative reviews, and requiring assignment by the consumer of intellectual property rights in reviews. Further, the CRFA is not limited to written reviews or the typical five-star rating system employed by many review sites. Even pictures and videos created by consumers fall under the protection of the CRFA.The fact that the CRFA applies to pictures and videos, combined with the provision prohibiting compulsory assignment of intellectual property rights in reviews, effectively stops companies from using a particularly creative method of censoring reviewers. In <a href="https://www.eff.org/files/2016/02/02/eff-comment-on-md-hb-131.pdf" target="_blank" rel="noopener noreferrer">written testimony</a> to the state of Maryland, the Electronic Frontier Foundation (EFF) described a method whereby companies would require consumers to agree to assign to the company the copyright in any reviews created by the consumers. Then, if the consumers posted a video of themselves demonstrating or discussing a product to a website (such as YouTube), companies would send a takedown notice under the Digital Millennium Copyright Act (DMCA) to assert ownership of the video and demand that the website remove the video. The EFF called this practice a “disturbing trend” among companies and made reference to one <a href="https://www.eff.org/deeplinks/2011/05/medical-justice-stifling-speech-patients-touch" target="_blank" rel="noopener noreferrer">medical organization</a> actually instructing doctors to use the DMCA to restrict negative reviews.<h4>Effectiveness of the CRFA</h4>As noted above, the CRFA’s provisions prohibiting gag clauses became effective on March 14, 2017. These provisions apply to consumer contracts in effect on or after that date, meaning that companies are prohibited from enforcing gag clauses in such contracts even if the contracts were entered into previously (though companies are not subject to penalties for having entered into such contracts prior to March 14, 2017). The state attorneys general and the Federal Trade Commission (FTC) have authority to enforce the CRFA, but such enforcement will not begin until December 14, 2017 and will apply only to contracts in effect on or after that date.<h4>Exceptions and Limits</h4>As noted above, the CRFA only applies to form contracts containing boiler plate provisions that consumers are unable to negotiate. This means contracts that are meaningfully negotiated are not covered by the protections of the CRFA. Additionally, the CRFA does not protect would-be reviewers from civil actions where their content includes confidential, sensitive or private information, or constitutes defamation, libel or slander. Nor does the CRFA stop companies from removing posts on their own sites that are defamatory, obscene, explicit, harassing, false, unrelated to the business or misleading. The FTC has <a href="https://www.ftc.gov/tips-advice/business-center/guidance/consumer-review-fairness-act-what-businesses-need-know" target="_blank" rel="noopener noreferrer">cautioned companies</a> that a consumer’s pure opinion is not likely to meet the “clearly false or misleading standard.” Finally the statute does not apply to employment contracts or agreements between companies and independent contractors.<h4>Penalties</h4>The CRFA does not offer a private cause of action for consumers. As mentioned above, enforcement will not begin for a few more months, but once it does the state attorneys general and the FTC will be charged with enforcing the law. The CRFA states that companies may be subject to investigations, fines and lawsuits but does not identify specific penalties. Rather, it grants the FTC and the states the power to bring civil actions directly against companies that violate the CRFA. Additionally, the FTC is authorized to treat any violation of the CRFA as an unfair or deceptive business practice, as defined in the <a href="https://www.house.gov/content/vendors/leases/tort.php" target="_blank" rel="noopener noreferrer">Federal Tort Claims Act</a>. It should also be noted that the CRFA does not preempt state laws regarding consumer reviews, and such laws may provide consumers with additional remedies. For example, California’s “<a href="http://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=201320140AB2365" target="_blank" rel="noopener noreferrer">Yelp law</a>” also banned gag clauses in consumer contracts and dates back to January 2015.<h4>Conclusion</h4>In short, while the CRFA does not spell the end of gag-clauses in all circumstances, the statute protects the rights of millennials to cry over spilled mimosa, empowers disgruntled holiday shoppers who didn’t get their “Tickle-Me-Sebastian” dolls in time to blast retailers and provides a safe harbor for anyone else who was done wrong by a company or business to “get their gripe on” in a public forum.

customerfeedback-gettyimages-516289772-600px-300x300-1.jpg

Get Your Gripe On: The Consumer Review Fairness Act Is Live

Get Your Gripe On: The Consumer Review Fairness Act Is Live