Social media sites are transforming not only the daily lives of consumers, but also how companies interact with consumers. Here at Morrison Foerster, across all of our practice groups, we are seeing complex, cutting-edge legal issues arising out of social media. As with the Internet boom during the mid-to-late 1990s, social media is generating new legal questions at a far faster pace than the law’s ability to provide answers to such questions. In an effort to stay on top of these emerging issues, and to keep our clients and friends informed of new developments, Morrison Foerster publishes this blog devoted to the law and business of social media.<h2>ABOUT MORRISON FOERSTER</h2>Morrison Foerster is a leading global law firm that transforms complexity into advantage for its clients. Our clients include some of the largest financial institutions, banks, consulting and accounting firms, and Fortune 100, technology, and life sciences companies. Highlighting the firm’s commitment to client service, leadership in market-changing deals and impact litigation, and values-based culture, Morrison Foerster has been repeatedly recognized as one of the top 10 firms on The American Lawyer’s A-List. Year after year, the firm receives significant recognition from Chambers and The Legal 500 across their various guides, including Global, USA, Asia‑Pacific, Europe, UK, Latin America, and FinTech Legal. Our lawyers passionately care about delivering legal excellence while living our values. Morrison Foerster has a long-standing commitment to creating a culture that respects and celebrates differences, while providing an inclusive environment. The firm has achieved Mansfield Certification Plus since 2018 as a result of successfully reaching at least 30 percent women, communities of color, and LGBTQ+ lawyer representation in a notable number of current leadership roles and committees. The firm also has a long history of commitment to the community and society through providing pro bono legal services, including litigating for civil rights and civil liberties, improving public education and fostering the wellbeing of children, advocating for veterans, promoting international human rights, enforcing the right to asylum, and safeguarding the environment.

Social

Search

sociallyaware-abajournalweb100-1

Aaron is the chair of the firm’s Technology Transactions Group and co-chair of the Interactive + Digital Media Group. He advises clients on a wide range of complex transactions involving intellectual property and technology, including structuring and negotiating strategic licensing, development, collaboration, procurement, and distribution deals.Aaron’s practice focuses on advising both established and emerging companies in a variety of data- and technology-intensive sectors, including software, SaaS, cloud-based technology, digital media (social media, AR/VR, gaming, streaming media, AdTech), AI, healthcare, consumer electronics, e-commerce, other online business models, and mobile applications. He also maintains an active practice counseling companies on branding and marketing, trademark licensing, and content-related transactions, as well as the intellectual property aspects of mergers, acquisitions, asset spin-offs, and private equity investments.He has represented clients such as Autodesk, Meta, OpenAI, Splunk, Konami, Kaiser Permanente, SoftBank, Visa, and Yahoo, among others.Aaron has been recognized by numerous publications for his work on market-defining technology transactions. He is currently ranked by Chambers USA for “Technology Transactions.”Aaron also serves as co-editor of Socially Aware, the firm’s award-winning newsletter and blog devoted to the law and business of social media, and regularly publishes on various IP and technology-related topics. Aaron is also a sought-after speaker on new and emerging areas of law, and is a frequent presenter and panelist at conferences and legal services programs. In addition to his active practice, Aaron regularly provides pro bono assistance to various nonprofit and charitable organizations such as Common Sense Media and the Starlight Children’s Foundation. He is a member of the board of directors of California Lawyers for the Arts.While in law school at the University of California, Berkeley, Boalt Hall School of Law, Aaron served as executive editor of the California Law Review and was elected to the Order of the Coif. Following law school, Aaron served as law clerk to the Honorable William H. Orrick and the Honorable Martin J. Jenkins, both United States District Judges for the Northern District of California.

rubin_aaron_blog_150x150.png

rubin_aaron_common_640x280.jpg

rubin_aaron_heroretina_2700x1160.jpg

rubin_aaron_mobileretina_750x1040.jpg

rubin_aaron_social_600x600.jpg

Partner

Aaron is the chair of our Technology Transactions Group. He advises clients on a wide range of complex transactions involving intellectual property and technology, including structuring and negotiating strategic licensing, development, collaboration, procurement, and distribution deals. Aaron’s practice focuses on advising both established and emerging companies in a variety of data– and technology–intensive sectors, including software, SaaS, cloud computing, AR/VR, AI, gaming, healthcare, consumer electronics, social media, e–commerce, other online business models, and mobile applications. He also maintains an active practice counseling companies on the intellectual property aspects of mergers, acquisitions, asset spin–offs, and private equity investments.

Aaron P. Rubin

Lawrence Gallick is of counsel in the firm’s Austin office and a member of the Technology Transactions Group.Lawrence focuses his practice on technology transactions and licensing matters. His diverse experience includes advising on SaaS agreements, cross-licensing agreements, research and collaboration agreements, development agreements, and distribution agreements. He counsels a broad range of companies across the software, hardware, life sciences, biotech and FinTech spaces, as well as other entities including universities.He advises clients in connection with general corporate matters including contract negotiations, and leasing and technology placement agreements.Lawrence also serves as co-editor of <a href="https://www.sociallyawareblog.com/" target="_blank">Socially Aware</a>, the firm’s award-winning newsletter and blog devoted to the law and business of social media, and regularly publishes on various IP and technology-related topics.Prior to joining the firm, Lawrence was counsel at another major law firm. Before earning his law degree, Lawrence was a web consultant, project manager, and web developer in Portland, Oregon, where he managed and consulted on projects using industry methodologies and performed custom development and integration of content management systems.Lawrence was named a Super Lawyers “Rising Star” in 2015 and 2018–2022, and is licensed in both California and New York. Lawrence earned his J.D. from the University at Buffalo School of Law, where he was the electronic systems editor for the Buffalo Law Review and awarded the ABA-BNA Award for Excellence in the Study of Intellectual Property Law.

gallick_lawrence_blog_150x150.png

gallick_lawrence_common_640x280.jpg

gallick_lawrence_heroretina_2700x1160.jpg

gallick_lawrence_mobileretina_750x1040.jpg

gallick_lawrence_social_600x600.jpg

Of Counsel

Lawrence Gallick

Anthony Ramirez is a partner in the Technology Transactions Group in the New York office of Morrison Foerster.Anthony advises clients on general commercial and transactional matters. He regularly advises companies on the IP aspects of their M&A transactions. His clients include technology, digital media and content for television and music, financial services, and communications companies with diverse intellectual property assets and issues.His practice focuses on the legal aspects of developing, licensing, and commercializing technology and intellectual property, as well as negotiating general commercial contracts, including outsourcing transactions, as well as content and data licenses. He regularly assists clients with legal issues relating to licensing and commercialization of digital media and content, digital content that is distributed over the Internet or streamed, mobile applications and social media, as well as the licensing of recorded music for distribution via digital platforms. Anthony is also experienced with issues relating to open-source software, software development, artificial intelligence and machine learning, cloud-based technology, and protection of proprietary information.Anthony has extensive experience working on matters involving disruptive technologies, such as blockchain. He has helped fintech clients with general intellectual property issues in connection with terms of service for online financial products and services.Anthony is an integral part of the outside pro bono legal team for nonprofit organizations based in New York, including advising clients on legal issues regarding entertainment, social media, privacy rights, and the negotiation of outsourcing and service agreements. Anthony received his J.D. from the University of Michigan Law School in 2009. He received his B.S. from Cornell University in 2004.

ramirez_anthony_blog_150x150.png

ramirez_anthony_common_640x280.jpg

ramirez_anthony_heroretina_2700x1160.jpg

ramirez_anthony_mobileretina_750x1040.jpg

ramirez_anthony_social_600x600.jpg

Anthony Ramirez is a partner in the Technology Transactions Group in the New York office of Morrison Foerster. He advises clients on general commercial and transactional matters. His clients include technology, media, and communications companies with considerable intellectual property assets. His practice focuses on the legal aspects of licensing and commercializing technology and intellectual property, as well as negotiating general commercial contracts. He also regularly assists clients with legal issues relating to mobile applications and social media.

Anthony M. Ramirez

favicon.ico

favicon-16x16.png

favicon-32x32.png

apple-touch-icon.png

MoFo Favicons

Socially Aware is devoted to the law and business of social media, proactively addressing emerging issues and keeping our clients informed of new developments. We cover fields such as artificial intelligence, privacy and data security, Section 230, intellectual property, and much more.

Welcome to Socially Aware

240920-socially-aware-header.jpg

Welcome to Socially Aware

240920-socially-aware-header

Socially Aware is devoted to the law and business of social media, proactively addressing emerging issues and keeping our clients informed of new developments. We cover fields such as artificial intelligence, privacy and data security, Section 230, intellectual property, and much more.

News and Announcements

Blog - Terms of Use

Blog - Privacy Policy

Blog - Blog Disclaimer

Blog - Attorney Advertising

morrison-foerster-blog-logo.png

Provides a data-driven look at the Federal Circuit.

Federal Circuitry

Brings together legal insights and in-depth analyses on trends and complex issues shaping the global technology industry.

MoFo Tech

Mofo Tech

Equips our clients with the most up-to-date and relevant information on employment and labor law issues.

Employment Law Commentary

In-depth analysis of developments and trends impacting government contracting.

Government Contracts Insight

Government Contracts Insights

Provides insights and reports on the most current class actions lawsuits and product liability issues that affect consumer-facing companies.

Class Dismissed Blog

Class Dismissed

MoFo’s Socially Aware blog provides timely updates and analysis of the many complex and cutting-edge legal and business issues arising out of social media.

Socially Aware

  Linkedin

MoFo LinkedIN

Socially Aware Blog - RSS

Stay Connected

Never miss a post from Socially Aware. Enter your email below to stay up-to-date.

Subscribe

The Law and Business of Social Media

Morrison Foerster - Footer

Blogs -  Home Button

Home

Blog - Topics

Web Scraping

Advertising

Antitrust

Arbitration

Artificial Intelligence

Asia

Autonomous Vehicles

Bankruptcy

Big Data

Blockchain

Class Actions

Cloud Computing

Compliance

Contracts

COPPA

Copyright

Crowdsourcing

Cyberbullying

Cybersecurity

Data Security

Defamation

Digital Content

Disappearing Content

Discovery

DMCA

E-Commerce

E-Discovery

E-Personation

Electronic Contracts

Employment Law

Endorsement Guides

Ephemeral Messaging

Ethics

European Union

Event

Fair Use

FDA Regulations

Financial Institutions

First Amendment

Fraud

Free Speech

GDPR

Hacking

Influencer Marketing

Infographic

Internet of Things

Investment Management Law

JOBS Act

Labor Law

Litigation

Live streaming

Marketing

Mobile

Online Contracts

Online Endorsements

Online Promotions

Online Reviews

Patent

Privacy

Product Liability

Protected Speech

Right of Publicity

Right To Be Forgotten

Section 230 Safe Harbor

Securities Law

Social Media Policy

Statistics

Status Updates

Stored Communications Act

Supreme Court

Terms of Use

Trademark

UK High Court

User-Generated Content

Wearable Computers

Topics

Blog - Editors

Editors

Blog - About

About

Blog - Subscribe

More

Lawrence W. Gallick

Social Links: If the Suit Fits

Social Links: Age Verification, X Appeal, and the Great White North

Social Links: Fake Reviews, Real Rulings, and an Epic Fail

Lawrence W. Gallick on Toth v. Everly Well, Inc.

Social Links: Going Back to Cali

LinkedIN

Cross-device tracking is a hot new issue for regulators. Companies engaged in the practice should take note of two recent developments. On November 16, 2015, the Federal Trade Commission (FTC) hosted a workshop on the issue and, perhaps not coincidentally, on the same day the Digital Advertising Alliance (DAA) addressed the applicability of its interest-based advertising (IBA) self-regulatory regime to the practice.Cross-device tracking enables companies to ascertain—either definitively or with a high degree of probability—that multiple devices are connected to the same person. There are two ways to do this.The first way is through deterministic identifiers, such as login information. For instance, if a user logs into web-based email on two devices (a laptop and mobile phone, for example), the email service can determine that the two devices belong to the same user.The second way is probabilistic identification, which uses information collected from separate devices (such as an IP address, location, and activities on those devices) to infer that the devices are used by the same person.At the FTC workshop, panelists, FTC staff and FTC Chairwoman Edith Ramirez all expressed concern that cross-device tracking is inherently different from tracking users on a single device. In particular, they noted that, while the technology provides benefits to consumers (such as a seamless cross-device experience), it has the potential to be harmful from a privacy perspective because it crosses physical borders that consumers may intentionally establish between their devices. That is, consumers may not want anybody to know that their work devices, their personal laptops, and their tablets all reflect activities by the same person.The FTC seemed to differentiate two aspects of information collection and use related to cross-device tracking: (1) information collected and used for the purposes of tying two or more devices to the same user and (2) information collected and used for IBA purposes, which may include information collected to tie devices together.At its workshop, the FTC appeared to signal that it expects companies to provide a robust notice and choice regime not only with respect to the ways in which data is collected and used to facilitate cross-device tracking (i.e., to simply tie devices together), but also with respect to the use of data collected and collated across devices for IBA purposes. That is, first parties (such as website publishers and apps) should disclose that information may be collected from users for purposes of cross-device tracking, and users should be able to opt out of the collection of information from a device for purposes of linking it to other devices—and not just for purposes of IBA.Furthermore, FTC staff also suggested that a failure to precisely describe the scope of an opt-out (such as by suggesting that opting out of cross-device tracking by a user from one device would propagate to all of the user’s devices) may be considered an unfair or deceptive practice in violation of Section 5 of the FTC Act.The new <a href="http://www.aboutads.info/sites/default/files/DAA_Cross-Device_Guidance-Final.pdf" target="_blank" rel="noopener">DAA cross-device principles</a> do not go as far as the FTC would appear to like, but they do apply the DAA notice and choice regime to cross-device tracking. (For more on this regime, see our June 19, 2015 Privacy Minute on the DAA’s mobile guidance.) As a result, the new guidance require entities that collect data for IBA purposes from one device for use on a different device to provide notice that, among other things, “data collected from a particular browser or device may be used with another computer or device that is linked to the browser or device on which such data was collected.” In other words, users need to be provided with notice if their browsing activity on one device may be used to deliver advertising to them on another device.In addition, the principles affirm that users must be provided with choice regarding the collection and/or use of their information for IBA from a particular device or from sharing with another party. That is, instead of requiring a global opt-out, which is what the FTC seems be advocating, the DAA requires only a device specific opt-out from: (1) collecting data on the device to deliver IBA on another device and (2) delivering IBA on a device based on information collected on another linked device.In light of the DAA’s foray into cross-device tracking, and the FTC’s heightened interest in this space, companies should tread cautiously if they track and/or target users across devices.

oneill_julie_blog_150x150.png

oneill_julie_common_640x280.jpg

oneill_julie_heroretina_2700x1160.jpg

oneill_julie_mobileretina_750x1040.jpg

oneill_julie_social_600x600.jpg

Clients seek out Julie because of her practical advice on cutting-edge issues at the intersection of privacy and consumer protection laws. She provides clients with practical solutions to compliance c

Julie O'Neill

Clients seek out Julie because of her practical advice on cutting-edge issues at the intersection of privacy and consumer protection laws. She provides clients with practical solutions to compliance challenges around a wide variety of both online and offline privacy issues, including tracking, interest-based advertising, geo-targeting and other mobile tracking, personalization, and cross-device tracking. Recognized in The Legal 500 US 2014, 2016, 2019, and 2020 and Chambers USA 2021 for her exceptional legal work, her clients praise her saying, “She is really good at giving practical, targeted advice and taking stock of what the risk profile of the client is, so that the advice is holistic.” (Chambers USA 2021).

jdistock_000066197967_large-1.jpg

Cross-Device Tracking Attracts Interest From Regulators, Prompts Guidance From Industry Group

Cross-Device Tracking Attracts Interest From Regulators, Prompts Guidance From Industry Group

Cross-device tracking is a hot new issue for regulators. Companies engaged in the practice should take note of two recent developments. On November 16, 2015, th

In December 2014, we noted that the Federal Trade Commission’s (FTC) settlement with advertising firm Deutsch LA, Inc. was a clear signal to companies that advertise through social media that they need to comply with the disclosure requirements of Section 5 of the FTC Act. On September 2, 2015, the FTC announced <a href="https://www.ftc.gov/news-events/press-releases/2015/09/xbox-one-promoter-settles-ftc-charges-it-deceived-consumers" target="_blank" rel="noopener">a settlement</a> along the same lines with Machinima, Inc., a company promoting the Xbox One system. This new action indicates that the FTC is serious about enforcing compliance in this space, so companies need to make sure that their advertising and marketing partners understand their obligations under Section 5.A Quick Refresher on Online Advertising Disclosure RequirementsAs we explained in our previous alert, the FTC’s <a href="https://www.ftc.gov/sites/default/files/documents/federal_register_notices/guides-concerning-use-endorsements-and-testimonials-advertising-16-cfr-part-255/091015guidesconcerningtestimonials.pdf" target="_blank" rel="noopener">Endorsement Guides</a> describe how advertisers using endorsements can avoid liability under Section 5 for unfair or deceptive acts or practices. Simply put, a customer endorsement must be from an actual, bona fide user of the product or service and, if there is any material connection between the endorser and the advertiser that consumers would not reasonably expect but that would affect the weight given to the endorsement—such as payment or an employment relationship—then that connection must be clearly and conspicuously disclosed.According to the <a href="https://www.ftc.gov/system/files/documents/cases/150902machinima-cmpt.pdf" target="_blank" rel="noopener">complaint</a> in In re Machinima, Machinima paid video bloggers (“influencers”) to promote Microsoft’s Xbox One system by producing and uploading to YouTube videos of themselves playing Xbox One games. Machinima did not require any disclosure of the compensation the influencers received, and many videos lacked any such disclosure. The FTC alleged that the payments would not be reasonably expected by YouTube viewers, such that the failure to disclose them was deceptive in violation of Section 5. In light of the Deutsch LA case, which dealt with endorsements on Twitter that did not include proper disclosures, In re Machinima seems uncontroversial. But what makes the case interesting is how close Microsoft came to being swept up in it.Microsoft Escapes Liability, NarrowlyThe FTC also issued a <a href="https://www.ftc.gov/system/files/documents/closing_letters/nid/150902machinima_letter.pdf" target="_blank" rel="noopener">closing letter</a> reflecting that it had investigated Microsoft, and Microsoft’s advertising agency Starcom, in relation to influencers’ videos. (Starcom managed the relationship with Machinima.) Even though the FTC did not ultimately take action against Microsoft (or Starcom), the closing letter is significant because it makes clear the FTC’s position that a company whose products are promoted bears responsibility for the actions of its ad agencies—as well as the actions of those engaged by its ad agencies.According to the closing letter, Microsoft avoided an enforcement action because it had a “robust” compliance program in place that included specific guidance relating to the FTC’s Endorsement Guides and because Microsoft made training relating to the Endorsement Guides available to employees, vendors and personnel at Starcom. Furthermore, Microsoft and Starcom adopted additional safeguards regarding sponsored endorsements and took swift action to require Machinima to insert disclosures into the offending videos.Given the increased reliance of advertisers on social media campaigns, the Machinima case provides both a clear warning and clear guidance to companies on how to minimize the risk of a Section 5 enforcement action. Not only must notice be provided of any paid endorsements, regardless of the medium in which they appear, but advertisers should also seriously consider having in place specific policies and procedures to address the FTC’s Endorsement Guides—as well as to ensure that their ad agencies and other involved parties comply with them.

istock_000065443239_600dpi1-300x200-1.jpg

FTC Continues Enforcing Ad Disclosure Obligations in New Media and Issues a Warning to Advertisers

FTC Continues Enforcing Ad Disclosure Obligations in New Media and Issues a Warning to Advertisers

In December 2014, we noted that the Federal Trade Commission’s (FTC) settlement with advertising firm Deutsch LA, Inc. was a clear signal to companies that adve

In law school, everybody learns the adage that hard cases make bad law. When it comes to the Federal Trade Commission, a better aphorism might be, “easy cases make new law.” The FTC’s recent settlement with Nomi Technologies Inc. is, as the FTC’s press release notes, the “FTC’s first against a retail tracking company.” On its face, the case is like many FTC privacy cases: It challenges a statement in the company’s privacy policy for allegedly being inconsistent with the company’s actual practices and thus deceptive. Under the surface, however, the case may open the door for the FTC to create a notice-and-choice regime for the physical tracking of consumers, analogous to its well-established notice-and-choice regime for online tracking.“Retail Tracking” and Nomi’s Allegedly Deceptive PracticesRetail tracking occurs when retailers, or their third-party service providers, capture and track the movements of consumers in and around stores through their mobile devices, such as through the use of Wi-Fi or beacons, in order, for example, to better understand store traffic or serve targeted offers. The FTC’s chief technologist recently published detailed comments on the “privacy trade-offs” of retail tracking and the various technologies that companies are using to engage in it. Given the potential lack of transparency around the practice and the corresponding privacy implications, it is not surprising that the FTC decided to address the practice through its Section 5 authority, even if the FTC did so in an indirect fashion.It is also not surprising that the FTC has moved cautiously into this space. The facts of In re Nomi, as alleged in the complaint, are simple. Nomi provided mobile device tracking technology that enabled its clients, brick-and-mortar retailers, to receive analytics reports about aggregate customer traffic patterns — that is, how long consumers stay in the store and in which sections, how long they wait in line, what percentage of consumers pass by the store altogether, and so on. Nomi represented in the privacy policies posted on its website that it would “[a]lways allow consumers to opt out of Nomi’s service on its website as well as at any retailer using Nomi’s technology.” While Nomi offered an opt-out on its website, it allegedly did not provide an opt-out mechanism at its clients’ retail locations, thus rendering its privacy policy promise deceptive, in violation of Section 5 of the FTC Act.The FTC further alleged that Nomi represented, expressly or by implication, that consumers would be given notice when they were being tracked at a retail location. The statement of Chairwoman Edith Ramirez and Commissioners Julie Brill and Terrell McSweeny in support of the complaint and proposed order explains that “the express promise of an in-store opt out necessarily makes a second, implied promise: that retailers using Nomi’s service would notify consumers that the service was in use. This promise was also false. Nomi did not require its clients to provide such a notice. To our knowledge, no retailer provided such a notice on its own.” By allegedly failing to provide notice when a retail location was utilizing Nomi’s service to track customers, Nomi’s implied promise to provide notice was also deceptive.The FTC Keeps Nomi Narrow, for Now. What Lessons Can Others Learn?The proposed order provides for very narrow injunctive relief: It simply enjoins Nomi from misrepresenting how consumers can control the collection, use, disclosure or sharing of information collected from them or their devices, and from misrepresenting the extent to which consumers will receive notice about such tracking. The majority commissioners, in their statement, were at pains to disclaim any significance of the case with regard to the practice of retail tracking specifically:While the consent order does not require that Nomi provide in-store notice when a store uses its services or offer an in-store opt out, that was not the Commission’s goal in bringing this case. This case is simply about ensuring that when companies promise consumers the ability to make choices, they follow through on those promises.In other words, Nomi is the FTC’s first case involving brick-and-mortar tracking, but the FTC is not yet creating new law: The proposed order does not impose any affirmative notice and choice obligations on industry participants in the retail tracking space. It is not surprising that the commission declined to take such a drastic step with a practice that is still, relatively speaking, in its infancy, and that does not, on its face, involve sensitive personal information (though, while the information collected may be anonymous and analyzed only in aggregate, some retailers may, or at least could, pair tracking information through their apps with other information about identifying a specific consumer).When the FTC does impose specific obligations relating to a particular practice, it typically moves in an incremental fashion. For example, the FTC noted in its 2009 Report on Self-Regulatory Principles for Online Behavioral Advertising and again in its 2012 Privacy Report that the collection of precise geolocation requires affirmative express consent because such information is sensitive. The FTC continued to indicate, in guidance and follow-on staff reports, that a failure to provide notice and obtain affirmative opt-in consent for the collection of precise geolocation information could give rise to a cause of action for deception under Section 5 of the FTC Act.Then, when the FTC settled a case (When the FTC does impose specific obligations relating to a particular practice, it typically moves in an incremental fashion. For example, the FTC noted in its 2009 Report on Self-Regulatory Principles for Online Behavioral Advertising and again in its 2012 Privacy Report that the collection of precise geolocation requires affirmative express consent because such information is sensitive. The FTC continued to indicate, in guidance and follow-on staff reports, that a failure to provide notice and obtain affirmative opt-in consent for the collection of precise geolocation information could give rise to a cause of action for deception under Section 5 of the FTC Act.Then, when the FTC settled a case (Goldenshores), alleging violations of Section 5 relating to an Android app’s collection, use and disclosure of precise geolocation from users’ devices, the order imposed specific parameters on the out-of-policy notice and choice that the app had to provide — effectively creating a new notice and choice regime for the collection, use and disclosure of such information that companies ignore at their peril.By contrast, theThen, when the FTC settled a case (Goldenshores), alleging violations of Section 5 relating to an Android app’s collection, use and disclosure of precise geolocation from users’ devices, the order imposed specific parameters on the out-of-policy notice and choice that the app had to provide — effectively creating a new notice and choice regime for the collection, use and disclosure of such information that companies ignore at their peril.By contrast, theBy contrast, the <a href="https://www.ftc.gov/sites/default/files/documents/reports/federal-trade-commission-staff-report-self-regulatory-principles-online-behavioral-advertising/p085400behavadreport.pdf" target="_blank" rel="noopener">narrow approach the FTC has taken with Nomi</a> raises the question of whether the FTC would ever impose a notice and choice obligation for offline, retail tracking. We have no certainty around the FTC’s view, but it is reasonable to anticipate that the FTC will move in a direction that mirrors its position with respect to online tracking — that is, that at least when information is collected for targeted advertising purposes, a company should provide meaningful disclosures to consumers about the tracking and choice with respect to whether to allow it.[2] The FTC could ultimately deem a failure to provide such notice and/or choice an unfair and/or deceptive practice under Section 5 of the FTC Act.What does this mean for retailers and other places of business? In light of Nomi and our expectations with respect to the direction the FTC is likely to take, companies that engage in in-store tracking should consider how best to provide their customers with notice and choice. Whatever the FTC does, it will probably move conservatively. That means that the FTC is likely to continue to identify practices as violations of Section 5 if they can be remedied without stifling retail tracking technology as it matures.The Nomi complaint presents two interrelated themes that provide a guide to future enforcement. First, choice must be linked to notice, meaning that, as far as the FTC is concerned, consumers do not have meaningful choice unless they also have notice at the point of collection, even if notice is provided only in a privacy policy only. Nomi can thus be read to suggest that, at least in some circumstances, choice with regard to virtual tracking needs to be accompanied by notice in the brick-and-mortar world. Second, the complaint suggests, obliquely, that tracking consumers’ physical activities is “material” — i.e., that it is likely to affect the consumer’s conduct. If that is right, then this type of tracking must be disclosed to consumers because the failure to make such a disclosure would be, axiomatically, a material omission.How should retailers proceed? One option is to track only those customers who have downloaded the retailer’s app and affirmatively agreed to be tracked for identified purposes, such as the delivery of targeted offers. Another option is to use a vendor that subscribes to the Future of Privacy Forum Mobile Location Analytics Code of Conduct, which requires participating mobile location analytics companies to, among other things, provide consumers with appropriate notice and choice. These types of compliance strategies could help protect companies from the next possible phase of FTC enforcement in this space, since they address what appear to be, for now, the most direct ways to avoid conducting retail tracking without providing notice and choice.

istock_000024706403illustra-300x275-1.jpg

The FTC Weighs in on In-Store Tracking. Or Does It?

The FTC Weighs in on In-Store Tracking. Or Does It?

In law school, everybody learns the adage that hard cases make bad law. When it comes to the Federal Trade Commission, a better aphorism might be, “easy cases m

OK, <a href="https://www.sociallyawareblog.com/" target="_blank" rel="noopener">Socially Aware</a> readers, we’ve got a pop-culture quiz for you today. How many of the following names are familiar to you?<ol><li>Smosh</li><li>The Fine Brothers</li><li>PewDiePie</li><li>KSI</li><li>Ryan Higa</li></ol>If any of those monikers rings a bell, we’re guessing you’re a millennial, the parent of a millennial or a marketer who targets millennials. Those of us who don’t fall into any of those categories might be surprised to learn that, <a href="http://variety.com/2014/digital/news/survey-youtube-stars-more-popular-than-mainstream-celebs-among-u-s-teens-1201275245/" target="_blank" rel="noopener">according to a survey conducted for Variety by a celebrity brand strategist</a>, the people on the above list are the five most influential celebrities among U.S. teens aged 13-17. These celebrities are unfamiliar to most of us because they didn’t rise to fame in the mainstream media but on social media—YouTube, specifically.The brand strategist conducting the survey, Jeetendr Sehdev, presented 1,500 teenage respondents with the names of the ten most popular English-language YouTube personalities (based on the number of their subscribers and video views) and the names of the ten mainstream media celebrities with the greatest clout among 13- to17-year-olds (as determined by an accepted set of criteria used to measure consumer appeal).In an effort to compare the 20 celebrities’ influence, Sehdev then asked the respondents to rate these celebrities based on several criteria, such as authenticity and approachability. Based on the teens’ responses, all 20 public figures were ranked. Six of the top ten were social media personalities. The respondents’ comments revealed that, for the teens, the rawness of the YouTube celebrities’ appearances translated into trustworthiness.The lesson for marketers is obvious: When you’re vying for teens’ time, attention and allowance money, your spokesperson shouldn’t be overly polished, and your message shouldn’t be overly produced. Otherwise, your target audience will feel like the endorsement is disingenuous—a quality that’s unlikely to make them ask their parents for the credit card.Of course, advertisers enlisting these or any other YouTube stars to promote products and services need to be aware of the Federal Trade Commission’s (FTC) <a href="https://www.ftc.gov/sites/default/files/attachments/press-releases/ftc-publishes-final-guides-governing-endorsements-testimonials/091005revisedendorsementguides.pdf" target="_blank" rel="noopener">Endorsement Guides</a> and related legal concerns; <a href="https://www.sociallyawareblog.com/2014/12/03/ftc-enforcement-action-confirms-that-ad-disclosure-obligations-extend-to-endorsements-made-in-social-media/" target="_blank" rel="noopener">as we’ve discussed on this blog</a>, the FTC takes the position that, where a social media influencer endorses a company’s products or services in return for consideration from such company, such consideration needs to be clearly disclosed in order to avoid deceiving consumers.By the way, here’s the entire Variety list, complete with the occupations of the listed celebrities (so you can feel like you’re in the know):<ol><li>Smosh (comedy duo)</li><li>The Fine Brothers (producers, writers and directors known for their React video series)</li><li>PewDiePie (Swedish producer of Let’s Play videos)</li><li>KSI (English video game commentator)</li><li>Ryan Higa (YouTube personality and actor)</li><li>Paul Walker (American television and film actor)</li><li>Jennifer Lawrence (American film actor)</li><li>Shane Dawson (American YouTube personality, actor, comedian, and film director)</li><li>Katy Perry (American singer, songwriter and actor)</li><li>Steve Carell (American actor)</li><li>Seth Rogan (American actor)</li><li>Betty White (American actor)</li><li>Vin Diesel (American actor, filmmaker and producer)</li><li>Johnny Depp (American actor)</li><li>Daniel Radcliffe (English actor)</li><li>Jenna Marbles (American entertainer and YouTube personality)</li><li>Michelle Phan (American make-up demonstrator and entrepreneur)</li><li>Ray William Johnson (American video blogger, producer and actor)</li><li>Bethany Mota (American video fashion-blogger)</li><li>Leonardo DiCaprio (American actor)</li></ol>Yes, 93-year-old Betty White is up there, only a couple of rungs beneath the top ten. Feel better now? We sure do.

fan-frenzy-istock_000007106900_illustration_650px-300x232-1.jpg

Are You Socially Aware? Take Our Millennial Influencers Quiz

Are You Socially Aware? Take Our Millennial Influencers Quiz

OK, Socially Aware readers, we’ve got a pop-culture quiz for you today. How many of the following names are familiar to you? Smosh The Fine Brothers PewDiePie K

As consumers increasingly connect to the Internet using multiple devices—such as mobile phones, tablets, computers, TVs and wearable devices—advertising technology companies have rapidly developed capabilities to reach the same consumers across their various devices. Such “cross-device” tracking enables companies to target ads to the same consumer regardless of the platform, device, or application being used. Last week, the Federal Trade Commission (FTC) <a href="https://www.ftc.gov/news-events/press-releases/2015/03/ftc-host-workshop-cross-device-tracking-nov-16?utm_source=govdelivery" target="_blank" rel="noopener">announced</a> that it will host a workshop on November 16, 2015, to explore the privacy issues arising from such practices—signaling that interest based advertising (IBA) is still at the forefront of its agenda.For a long time, advertisers and publishers have tracked consumers’ online activities using HTTP cookies stored in web browsers on desktop and laptop computers. In response to the FTC’s concerns over consumers’ visibility into and control over such tracking for IBA purposes, industry responded with widely adopted ways for publishers and advertisers to provide consumers with enhanced notice and cookie-based choice with respect to such tracking.As consumers’ behavior has shifted, however, traditional cookie-based technologies are becoming less effective. Most consumers now access the Internet through apps on various platforms, in addition to web browsers, and they tend to use different devices throughout the day. This presents challenges for advertisers, publishers and others who want a complete picture of how individual consumers interact with their websites, services, and advertisements over time— as well as for those who want to know where and how they can reach such consumers. In response, companies have developed various solutions for identifying the same consumer across devices. One approach, for example, is to use “deterministic” methods that link the consumer’s devices to a single account as the consumer logs into websites and services on different devices. Another is through “probabilistic” methods that infer links among devices that share similar attributes, such as location derived from IP address. In some cases, companies may combine multiple techniques for greater accuracy.In its announcement, the FTC explained that these new practices may raise privacy issues if consumers are not provided with adequate notice and control—and the workshop will address, among other topics, how companies can make their tracking more transparent and give consumers greater control over it. If history is a guide, the FTC will likely publish a staff report some months after the workshop, to highlight the privacy issues it sees with cross-device tracking and to offer industry guidance on addressing them.The FTC’s announcement is a natural extension of its recent workshops on <a href="https://www.ftc.gov/news-events/events-calendar/2012/05/short-advertising-privacy-disclosures-digital-world" target="_blank" rel="noopener">mobile privacy disclosures</a>, the <a href="https://www.ftc.gov/news-events/events-calendar/2013/11/internet-things-privacy-security-connected-world" target="_blank" rel="noopener">Internet of Things</a>, and <a href="https://www.ftc.gov/news-events/events-calendar/2014/02/spring-privacy-series-mobile-device-tracking" target="_blank" rel="noopener">mobile device tracking</a>. It also follows recent news from the Digital Advertising Alliance (DAA) that it has launched tools to provide in-app notice and choice to consumers about IBA practices and that it expects enforcement of the DAA Self-Regulatory Principles in the mobile environment to begin this summer.

The New Frontier in Interest Based Advertising: FTC Shifts Focus to Cross-Device Tracking

As consumers increasingly connect to the Internet using multiple devices—such as mobile phones, tablets, computers, TVs and wearable devices—advertising technol

The New Frontier in Interest Based Advertising: FTC Shifts Focus to Cross-Device Tracking

Social media is transforming the way companies interact with consumers. Learn how to make the most of these online opportunities while minimizing your company’s risk at Practicing Law Institute’s (PLI) 2015 Social Media conference, chaired by Socially Aware editor John Delaney.This year’s program features speakers from American Express, BuzzFeed, Dell, and Foursquare. There will also be a “Meet the Regulators” panel discussion featuring representatives from FINRA, the FTC, and the New York State Attorney General’s Office. And the conference will conclude with a networking reception.Join us for the conference in New York on February 25th. For more information or to register, please visit PLI’s website <a href="http://www.pli.edu/Content/Social_Media_2015_Addressing_Corporate_Risks/_/N-1z1297bZ4k?ID=225654" target="_blank" rel="noopener">here</a>.

Social Media 2015: Addressing Corporate Risks

Social media is transforming the way companies interact with consumers. Learn how to make the most of these online opportunities while minimizing your company’s

Social Media 2015: Addressing Corporate Risks

The FTC has released its much anticipated <a href="http://www.ftc.gov/system/files/documents/reports/federal-trade-commission-staff-report-november-2013-workshop-entitled-internet-things-privacy/150127iotrpt.pdf">report</a> on the Internet of Things (“IoT”) – a topic that has been top-of-mind for many companies. The FTC’s report, “Internet of Things: Privacy & Security in a Connected World” (the “Report”), discusses the benefits and risks associated with IoT, and addresses the privacy and data security measures the FTC recommends for consumer-facing IoT products and services [The FTC’s discussion of IoT within the report, consistent with the FTC’s jurisdiction, is limited to such devices that are sold to or used by consumers, and not devices sold in a business-to-business context or broader machine-to-machine communications]. While the Report is not legally binding, it provides a strong and valuable indication of the positions that the FTC may take in enforcement actions related to IoT.WHAT IS THE INTERNET OF THINGS?According to the FTC, IoT refers to “‘things’ such as devices or sensors – other than computers, smartphones, or tablets – that connect, communicate or transmit information with or between each other through the Internet.”FTC RECOGNIZES BENEFITS AND RISKS OF IOTThe Report acknowledges that Internet-connected devices offer numerous benefits, many of which remain untapped. In the health arena, connected medical devices allow patients to more efficiently communicate with their physicians to manage their medical conditions. In the home, smart meters enable energy providers to analyze consumer energy use, identify issues with home appliances, and enable consumers to be more energy-conscious. On the road, sensors on a car can notify drivers of dangerous road conditions, and software updates can occur wirelessly. And these applications are just the beginning.On the flip side, however, the FTC cautions that IoT may present a variety of potential security vulnerabilities that could be exploited to harm consumers. First, as with computers, a lack of security could enable unauthorized access and misuse of personal information. This risk is heightened in the IoT world by the plethora of devices to be connected and secured. Second, security vulnerabilities in a particular device may facilitate attacks on the consumer’s network to which it is connected, or enable attacks on other systems. Third, the FTC notes that IoT may present a heightened risk of harm to personal safety. For example, the Report describes an account of how it may be possible to hack remotely into a connected medical device and change its settings, impeding its therapeutic function.According to the FTC, these risks are exacerbated by the fact that companies entering the IoT market may not have experience in dealing with security issues, or may be creating inexpensive devices for which it may be difficult or impossible to apply a patch for a security bug.SECURITYIn light of these increased risks, the FTC asserts that “inadequate security presents the greatest risk of actual consumer harm in the Internet of Things.” As such, it recommends that companies focus on security when developing connected devices. The FTC acknowledged that what constitutes reasonable security for a given device will depend on a number of factors, including the amount and sensitivity of data collected, and the costs of remedying the security vulnerabilities. However, the staff did offer approaches that it encourages companies to adopt when developing their products:<ul><li>Building security into their devices at the outset, by conducting an initial privacy or security risk assessment, considering how to minimize the data collected and retained, and testing security measures before launching the product.</li><li>Training all employees about good security, and ensuring that security issues are addressed at the appropriate level of responsibility within the organization.</li><li>Retaining service providers that are capable of maintaining reasonable security and providing reasonable oversight.</li><li>Implementing a defense-in-depth approach for systems that involve significant risks, considering security measures at several levels.</li><li>Imposing reasonable access control measures to limit the ability of an unauthorized person to access a consumer’s device, data, or network.</li><li>Continuing to monitor products throughout the life cycle and, to the extent possible, patch known vulnerabilities.</li></ul>In sum, devices that collect sensitive information, present physical security or safety risks (such as door locks, ovens, or medical devices), or connect to other devices or networks in a manner that would enable unauthorized access to those devices, may require heightened consideration of security measures.DATA MINIMIZATIONThe Report emphasizes the FTC’s view that companies should reasonably limit their collection and retention of consumer data, including in the IoT context. The FTC believes that these practices, known as data minimization, will help guard against two privacy-related risks: first, larger data stores present a more attractive target for data thieves; and second, if a company collects and retains large amounts of data, there is an increased risk that the data will be used in a way that departs from consumers’ reasonable expectations.At the same time, the Report acknowledges concerns that data minimization requirements may curtail innovative uses of data. Accordingly, the FTC proposes a “flexible” approach to data minimization that gives companies a variety of options: they can decide not to collect data at all, collect only the fields of data necessary to the product or service being offered, collect data that is less sensitive, or de-identify the data they collect. The FTC also suggests that if none of these options work, a company can seek consumers’ consent for collecting additional, unexpected data.NOTICE AND CHOICEThe FTC acknowledges that notifying consumers of privacy principles and offering them a way to meaningfully choose privacy settings may be more difficult in the context of connected devices, which may not have a screen with which to communicate with consumers. However, the report makes clear that the FTC does not believe it will be sufficient for IoT companies to simply have a privacy policy available on their website, and expect consumers to find that policy. Rather, the FTC recommends that a company find ways to present meaningful privacy notices and choices to the consumer, including in the set-up or purchase of the product itself. The Report suggests creative solutions to this issue, including:<ul><li>Offering video tutorials to guide consumers through privacy settings.</li><li>Affixing a QR code that, when scanned, would take the consumer to a website with information about privacy practices.</li><li>Offering a set-up wizard that provides information about privacy practices.</li><li>Allowing users to configure devices, such as home appliances, so that they receive information through emails or texts.</li><li>Creating a user experience “hub” that stores data locally and learns a consumer’s privacy preferences based on prior behavior.</li></ul>Companies may also want to consider using a combination of approaches. Of course, whatever approach a company decides to take, the FTC expects the privacy choices to be clear and prominent, and not buried within lengthy documents.LEGISLATIONLast but not least, the FTC reiterated its recommendation for Congress to enact strong, flexible, and technology-neutral legislation to strengthen the Commission’s existing data security enforcement tools, and require companies to notify consumers when there is a security breach.CONCLUSIONAs the FTC describes, “in the future, the Internet of Things is likely to meld the virtual and physical worlds together in ways that are currently difficult to comprehend.” As a result, companies should consider guidance offered by the FTC and other regulators, and evaluate what steps they can take to mitigate those risks in the privacy and data security context.

x23-bn-300x300-1.jpg

FTC Issues Landmark Report on Internet of Things

FTC Issues Landmark Report on Internet of Things