Social media sites are transforming not only the daily lives of consumers, but also how companies interact with consumers. Here at Morrison Foerster, across all of our practice groups, we are seeing complex, cutting-edge legal issues arising out of social media. As with the Internet boom during the mid-to-late 1990s, social media is generating new legal questions at a far faster pace than the law’s ability to provide answers to such questions. In an effort to stay on top of these emerging issues, and to keep our clients and friends informed of new developments, Morrison Foerster publishes this blog devoted to the law and business of social media.<h2>ABOUT MORRISON FOERSTER</h2>Morrison Foerster is a leading global law firm that transforms complexity into advantage for its clients. Our clients include some of the largest financial institutions, banks, consulting and accounting firms, and Fortune 100, technology, and life sciences companies. Highlighting the firm’s commitment to client service, leadership in market-changing deals and impact litigation, and values-based culture, Morrison Foerster has been repeatedly recognized as one of the top 10 firms on The American Lawyer’s A-List. Year after year, the firm receives significant recognition from Chambers and The Legal 500 across their various guides, including Global, USA, Asia‑Pacific, Europe, UK, Latin America, and FinTech Legal. Our lawyers passionately care about delivering legal excellence while living our values. Morrison Foerster has a long-standing commitment to creating a culture that respects and celebrates differences, while providing an inclusive environment. The firm has achieved Mansfield Certification Plus since 2018 as a result of successfully reaching at least 30 percent women, communities of color, and LGBTQ+ lawyer representation in a notable number of current leadership roles and committees. The firm also has a long history of commitment to the community and society through providing pro bono legal services, including litigating for civil rights and civil liberties, improving public education and fostering the wellbeing of children, advocating for veterans, promoting international human rights, enforcing the right to asylum, and safeguarding the environment.

Social

Search

sociallyaware-abajournalweb100-1

Aaron is the chair of the firm’s Technology Transactions Group and co-chair of the Interactive + Digital Media Group. He advises clients on a wide range of complex transactions involving intellectual property and technology, including structuring and negotiating strategic licensing, development, collaboration, procurement, and distribution deals.Aaron’s practice focuses on advising both established and emerging companies in a variety of data- and technology-intensive sectors, including software, SaaS, cloud-based technology, digital media (social media, AR/VR, gaming, streaming media, AdTech), AI, healthcare, consumer electronics, e-commerce, other online business models, and mobile applications. He also maintains an active practice counseling companies on branding and marketing, trademark licensing, and content-related transactions, as well as the intellectual property aspects of mergers, acquisitions, asset spin-offs, and private equity investments.He has represented clients such as Autodesk, Meta, OpenAI, Splunk, Konami, Kaiser Permanente, SoftBank, Visa, and Yahoo, among others.Aaron has been recognized by numerous publications for his work on market-defining technology transactions. He is currently ranked by Chambers USA for “Technology Transactions.”Aaron also serves as co-editor of Socially Aware, the firm’s award-winning newsletter and blog devoted to the law and business of social media, and regularly publishes on various IP and technology-related topics. Aaron is also a sought-after speaker on new and emerging areas of law, and is a frequent presenter and panelist at conferences and legal services programs. In addition to his active practice, Aaron regularly provides pro bono assistance to various nonprofit and charitable organizations such as Common Sense Media and the Starlight Children’s Foundation. He is a member of the board of directors of California Lawyers for the Arts.While in law school at the University of California, Berkeley, Boalt Hall School of Law, Aaron served as executive editor of the California Law Review and was elected to the Order of the Coif. Following law school, Aaron served as law clerk to the Honorable William H. Orrick and the Honorable Martin J. Jenkins, both United States District Judges for the Northern District of California.

rubin_aaron_blog_150x150.png

rubin_aaron_common_640x280.jpg

rubin_aaron_heroretina_2700x1160.jpg

rubin_aaron_mobileretina_750x1040.jpg

rubin_aaron_social_600x600.jpg

Partner

Aaron is the chair of our Technology Transactions Group. He advises clients on a wide range of complex transactions involving intellectual property and technology, including structuring and negotiating strategic licensing, development, collaboration, procurement, and distribution deals. Aaron’s practice focuses on advising both established and emerging companies in a variety of data– and technology–intensive sectors, including software, SaaS, cloud computing, AR/VR, AI, gaming, healthcare, consumer electronics, social media, e–commerce, other online business models, and mobile applications. He also maintains an active practice counseling companies on the intellectual property aspects of mergers, acquisitions, asset spin–offs, and private equity investments.

Aaron P. Rubin

Lawrence Gallick is of counsel in the firm’s Austin office and a member of the Technology Transactions Group.Lawrence focuses his practice on technology transactions and licensing matters. His diverse experience includes advising on SaaS agreements, cross-licensing agreements, research and collaboration agreements, development agreements, and distribution agreements. He counsels a broad range of companies across the software, hardware, life sciences, biotech and FinTech spaces, as well as other entities including universities.He advises clients in connection with general corporate matters including contract negotiations, and leasing and technology placement agreements.Lawrence also serves as co-editor of <a href="https://www.sociallyawareblog.com/" target="_blank">Socially Aware</a>, the firm’s award-winning newsletter and blog devoted to the law and business of social media, and regularly publishes on various IP and technology-related topics.Prior to joining the firm, Lawrence was counsel at another major law firm. Before earning his law degree, Lawrence was a web consultant, project manager, and web developer in Portland, Oregon, where he managed and consulted on projects using industry methodologies and performed custom development and integration of content management systems.Lawrence was named a Super Lawyers “Rising Star” in 2015 and 2018–2022, and is licensed in both California and New York. Lawrence earned his J.D. from the University at Buffalo School of Law, where he was the electronic systems editor for the Buffalo Law Review and awarded the ABA-BNA Award for Excellence in the Study of Intellectual Property Law.

gallick_lawrence_blog_150x150.png

gallick_lawrence_common_640x280.jpg

gallick_lawrence_heroretina_2700x1160.jpg

gallick_lawrence_mobileretina_750x1040.jpg

gallick_lawrence_social_600x600.jpg

Of Counsel

Lawrence Gallick

Anthony Ramirez is a partner in the Technology Transactions Group in the New York office of Morrison Foerster.Anthony advises clients on general commercial and transactional matters. He regularly advises companies on the IP aspects of their M&A transactions. His clients include technology, digital media and content for television and music, financial services, and communications companies with diverse intellectual property assets and issues.His practice focuses on the legal aspects of developing, licensing, and commercializing technology and intellectual property, as well as negotiating general commercial contracts, including outsourcing transactions, as well as content and data licenses. He regularly assists clients with legal issues relating to licensing and commercialization of digital media and content, digital content that is distributed over the Internet or streamed, mobile applications and social media, as well as the licensing of recorded music for distribution via digital platforms. Anthony is also experienced with issues relating to open-source software, software development, artificial intelligence and machine learning, cloud-based technology, and protection of proprietary information.Anthony has extensive experience working on matters involving disruptive technologies, such as blockchain. He has helped fintech clients with general intellectual property issues in connection with terms of service for online financial products and services.Anthony is an integral part of the outside pro bono legal team for nonprofit organizations based in New York, including advising clients on legal issues regarding entertainment, social media, privacy rights, and the negotiation of outsourcing and service agreements. Anthony received his J.D. from the University of Michigan Law School in 2009. He received his B.S. from Cornell University in 2004.

ramirez_anthony_blog_150x150.png

ramirez_anthony_common_640x280.jpg

ramirez_anthony_heroretina_2700x1160.jpg

ramirez_anthony_mobileretina_750x1040.jpg

ramirez_anthony_social_600x600.jpg

Anthony Ramirez is a partner in the Technology Transactions Group in the New York office of Morrison Foerster. He advises clients on general commercial and transactional matters. His clients include technology, media, and communications companies with considerable intellectual property assets. His practice focuses on the legal aspects of licensing and commercializing technology and intellectual property, as well as negotiating general commercial contracts. He also regularly assists clients with legal issues relating to mobile applications and social media.

Anthony M. Ramirez

favicon.ico

favicon-16x16.png

favicon-32x32.png

apple-touch-icon.png

MoFo Favicons

Socially Aware is devoted to the law and business of social media, proactively addressing emerging issues and keeping our clients informed of new developments. We cover fields such as artificial intelligence, privacy and data security, Section 230, intellectual property, and much more.

Welcome to Socially Aware

240920-socially-aware-header.jpg

Welcome to Socially Aware

240920-socially-aware-header

Socially Aware is devoted to the law and business of social media, proactively addressing emerging issues and keeping our clients informed of new developments. We cover fields such as artificial intelligence, privacy and data security, Section 230, intellectual property, and much more.

News and Announcements

Blog - Terms of Use

Blog - Privacy Policy

Blog - Blog Disclaimer

Blog - Attorney Advertising

morrison-foerster-blog-logo.png

Provides a data-driven look at the Federal Circuit.

Federal Circuitry

Brings together legal insights and in-depth analyses on trends and complex issues shaping the global technology industry.

MoFo Tech

Mofo Tech

Equips our clients with the most up-to-date and relevant information on employment and labor law issues.

Employment Law Commentary

In-depth analysis of developments and trends impacting government contracting.

Government Contracts Insight

Government Contracts Insights

Provides insights and reports on the most current class actions lawsuits and product liability issues that affect consumer-facing companies.

Class Dismissed Blog

Class Dismissed

MoFo’s Socially Aware blog provides timely updates and analysis of the many complex and cutting-edge legal and business issues arising out of social media.

Socially Aware

  Linkedin

MoFo LinkedIN

Socially Aware Blog - RSS

Stay Connected

Never miss a post from Socially Aware. Enter your email below to stay up-to-date.

Subscribe

The Law and Business of Social Media

Morrison Foerster - Footer

On March 26, 2012, the Federal Trade Commission (the “Commission” or “FTC”) released its much-anticipated final privacy report, Protecting Consumer Privacy in a

Blogs -  Home Button

Home

Blog - Topics

Web Scraping

Advertising

Antitrust

Arbitration

Artificial Intelligence

Asia

Autonomous Vehicles

Bankruptcy

Big Data

Blockchain

Class Actions

Cloud Computing

Compliance

Contracts

COPPA

Copyright

Crowdsourcing

Cyberbullying

Cybersecurity

Data Security

Defamation

Digital Content

Disappearing Content

Discovery

DMCA

E-Commerce

E-Discovery

E-Personation

Electronic Contracts

Employment Law

Endorsement Guides

Ephemeral Messaging

Ethics

European Union

Event

Fair Use

FDA Regulations

Financial Institutions

First Amendment

Fraud

Free Speech

GDPR

Hacking

Influencer Marketing

Infographic

Internet of Things

Investment Management Law

JOBS Act

Labor Law

Litigation

Live streaming

Marketing

Mobile

Online Contracts

Online Endorsements

Online Promotions

Online Reviews

Patent

Privacy

Product Liability

Protected Speech

Right of Publicity

Right To Be Forgotten

Section 230 Safe Harbor

Securities Law

Social Media Policy

Statistics

Status Updates

Stored Communications Act

Supreme Court

Terms of Use

Trademark

UK High Court

User-Generated Content

Wearable Computers

Topics

Blog - Editors

Editors

Blog - About

About

Blog - Subscribe

FTC’s Privacy Report Suggests Tightening of Privacy Regime, Provides Guidance to Business

FTC’s Privacy Report Suggests Tightening of Privacy Regime, Provides Guidance to Business | Socially Aware

Julie O'Neill

On March 26, 2012, the Federal Trade Commission (the “Commission” or “FTC”) released its much-anticipated final privacy report, Protecting Consumer Privacy in an Era of Rapid Change.  The report builds upon the Commission’s December 2010 preliminary report, and provides recommendations for businesses and policymakers with respect to online and offline privacy practices.  The report will be of interest to any company using social media for marketing purposes.  Specifically, the report:<ul><li>Presents a privacy framework that sets forth best practices – not legal requirements – for businesses.  The Commission states that, to the extent that the best practices set forth in the report extend beyond existing legal requirements, such best practices are not intended to serve as a template for law enforcement actions or regulation under laws currently enforced by the Commission.  FTC Chairman Jon Leibowitz reiterated this point to a House Energy and Commerce subcommittee on March 29, 2012, informing legislators that, while companies that follow the report’s best practices would not be in violation of the FTC Act, those that do not follow them would not necessarily be in breach of the law.  In his words, the report “is not a regulatory document or an enforcement document.”  That said, those elements of the report that focus on transparency and consumer choice build on the Commission’s recent law enforcement experience; it is therefore reasonable to assume that the Commission will continue its pattern of focusing on data practices that are not obvious to consumers in context, that are not disclosed adequately, and, in some instances, where consumers do not have meaningful choice.  Of course, the Commission will continue its aggressive enforcement of companies’ privacy and data security promises.</li><li>Recommends baseline privacy legislation.  In the Commission’s view, because self-regulation has not yet gone far enough, flexible and technologically neutral baseline privacy legislation is desirable.  While encouraging industry to continue its self-regulatory efforts, the Commission also intends the privacy framework set forth in the report to assist Congress in crafting legislation.  The Commission also reiterates its call for federal information security and data breach notification legislation and for legislation regulating the practices of data brokers.</li><li>Highlights the Commission’s privacy priorities for the coming year.  The report explains that the Commission will promote implementation of the privacy framework by focusing its efforts on five main areas: (1) cooperation with industry to complete the implementation of an easy-to-use, persistent and effective Do Not Track mechanism (the Commission does not call for Do Not Track legislation in this report); (2) improvement of privacy disclosures and other protections offered by mobile services, including through its May 30, 2012 public workshop on revisions to its Dot Com Disclosures guidance; (3) support for targeted legislation to give consumers access to the information about them held by data brokers and encouragement to data brokers that compile data for marketing purposes to create a centralized website to further increase the transparency of their practices; (4) exploration of the privacy issues associated with the comprehensive tracking of consumers’ online activities by large platform providers, such as ISPs, operating systems, browsers and social media in a workshop later this year; and (5) participation with the Department of Commerce and industry stakeholders to create enforceable self-regulatory codes of conduct.</li></ul>This final priority reflects the Commission’s support for the report issued by the Obama administration on February 23, 2012.  In its report, entitled Consumer Data Privacy in a Networked World: A Framework for Protecting Privacy and Promoting Innovation in the Global Digital Economy, the administration detailed a “Consumer Privacy Bill of Rights” and announced the creation of a multi-stakeholder process to be convened by the Department of Commerce to create voluntary codes of conduct which, if adopted by companies, would be enforceable by the Commission pursuant to its deception authority under Section 5 of the FTC Act.  Importantly, the Commission’s report makes clear that the FTC will participate in the Department of Commerce’s multi-stakeholder process.The Scope of the Privacy FrameworkThe privacy framework applies to all commercial entities that collect or use online and/or offline consumer data that can be reasonably linked to a specific consumer or computer or other device.  There is an exception for entities that collect only non-sensitive data from fewer than 5,000 consumers per year and do not share the data with third parties, so as not to unduly burden small businesses.  The Commission did not, however, exempt from the framework’s intended coverage those companies already covered by sector-specific privacy laws, such as the Gramm-Leach-Bliley Act or the Health Insurance Portability and Accountability Act.  Instead, it emphasizes in the final report that the framework is intended to foster best practices but not impose conflicting legal obligations, and it urges Congress not to pass legislation that creates overlapping or contradictory requirements for entities subject to such laws.The extension of privacy best practices to data linkable to a computer or other device reflects the Commission’s position that the line between “personally identifiable information” (“PII”) and “non-PII” is increasingly blurred.The Commission justified this application on the grounds that, not only is re-identification of supposedly “anonymous” data increasingly possible, but, in the Commission’s view, businesses have strong incentives to re-identify such data.To provide businesses with certainty with respect to what constitutes “reasonably linkable” data, the Commission has taken the position that data is not “reasonably linkable”—and therefore not within the scope of the privacy framework—if the company possessing it implements the following protections: (1) reasonable measures to ensure that the data is de-identified; (2) a public commitment to using the data in a de-identified way; and (3) contractual prohibitions on downstream entities that use the data from de-identifying it, coupled with reasonable measures to ensure compliance with that prohibition.  Even with this attempt at clarity, questions remain, including what it means to “de-identify” data.  For example, does this mean removing PII or does it mean removing any identifier, such as cookie IDs?  Furthermore, what measures are “reasonable” in terms of monitoring downstream entities?The Substance of the Privacy FrameworkThe Commission’s report proposes a privacy framework that calls for companies to incorporate “privacy by design” into their practices, to offer consumers simplified choices about how their data is collected and used, and to provide consumers with greater transparency about their practices.Privacy by DesignAccording to the report, companies should promote consumer privacy throughout their organizations and at every stage of the development and life cycle of their products and services.  As a substantive matter, this means that companies should incorporate the following privacy protections into their practices:<ul><li>Reasonable security for consumer data.  The Commission notes that this obligation is already well settled, as it has a long history of enforcing data security obligations under Section 5 of the FTC Act and other laws.  The Commission commends industry’s efforts to ensure the security of consumers’ data, but, nonetheless, it renews its call for Congress to enact comprehensive data security and breach notification legislation.</li><li>Reasonable limits on data collection.  According to the Commission, reasonable limits are those that are consistent with the context of a particular transaction or the consumer’s relationship with the business (or as required or specifically permitted by law).</li><li>Sound retention and disposal practices.The Commission states that companies should implement reasonable restrictions on the retention of consumer data and should dispose of it once the data has outlived the legitimate purpose for which it was collected.  What is “reasonable” depends on the type of relationship and the nature and use of the data.</li><li>Data accuracy.According to the Commission, companies should maintain the accuracy of the data they hold about consumers.  As with other elements of the framework, the Commission believes that the best approach to achieving accuracy is through a flexible approach, scaled to the intended use and sensitivity of the data at issue.</li></ul>The Commission also urges businesses to maintain comprehensive data management procedures throughout the life cycle of their products and services.  It cites its recent settlement orders with Facebook and Google as providing a roadmap for the types of comprehensive procedural protections it envisions: (1) designation of personnel responsible for the privacy program; (2) a risk assessment that covers, at a minimum, employee training, management and product design and development; (3) implementation of controls designed to mitigate identified risks; (4) appropriate oversight; and (5) evaluation and adjustment of the program in light of regular testing and monitoring.Simplified Consumer ChoiceThe report encourages companies to simplify consumer choice, in part by identifying those practices for which choice is not necessary.  Specifically, the report provides that companies do not need to provide consumers with choice before collecting and using consumer data for practices that are consistent with the context of the transaction or the company’s relationship with the consumer or that are required or specifically authorized by law.While this standard relies to some degree on consumer expectations, it focuses on objective factors related to the consumer’s relationship with the business.  The following commonly accepted practices are provided as examples of the kinds of practices that do not typically require consumer choice: product and service fulfillment, internal operations, fraud prevention, legal compliance and public purpose and first-party marketing.The report goes on to address practices that require choice and states that, when choice is required, it should be offered at a time and in a context in which the consumer is making a decision about his or her data.  (The Commission declines, however, to impose any particular method of providing choice, leaving it to industry to develop the most appropriate choice mechanisms.)  As a general matter, data use and disclosure practices that are inconsistent with the context of the transaction or the company’s relationship with the consumer require consumer choice (unless such practices are required or specifically authorized by law).  Such practices may include, for example, sharing customer data with an affiliate for the affiliate’s own direct marketing use, if the consumer would not have been aware of the affiliate relationship (e.g., because the companies are differently branded).The Commission identifies two practices that it believes require affirmative express consent:  (1) in connection with material retroactive changes to privacy representations (this is not new, as the Commission has expressed it repeatedly for years and has imposed it in settlement orders); and (2) before collecting sensitive data, such as information about children, health and financial information, geolocation data and Social Security numbers. (The Commission also proposes that social networks and others specifically targeting teens should take extra precautions with respect to their submission of personal information.)  The Commission’s identification of specific practices that require affirmative express consent suggests that, where it otherwise calls for choice, clear and conspicuous notice and opt-out would be sufficient.Greater TransparencyThe Commission states that companies should increase the transparency of their data practices, through privacy notices, access to data and consumer education:<ul><li>Privacy notices should be clearer, shorter and more standardized, to enable better comprehension and comparison of privacy practices.  The Commission calls for the simplification of privacy notices, such as through the use of standardized terminology, format and other elements.  In the Commission’s view, members of various industry sectors should work together to create standards relevant to their industry, possibly through the multi-stakeholder process that the Department of Commerce plans to convene.  According to the Commission, the need for simplification and industry involvement is particularly acute in the mobile realm, given the number of entities that want to collect user data and the limited space for disclosures.  As noted above, the Commission plans to address mobile disclosures in a May 30, 2012 public workshop.</li><li>Companies should provide reasonable access to the consumer data they maintain.  The extent of access should be proportionate to the sensitivity of the data and the nature of its use.  For example, the Commission urges businesses that maintain data for marketing purposes to, at a minimum, provide consumers with access to such data and permit them to suppress categories they would not like used for targeting.</li><li>Companies should make efforts to increase the transparency of their data enhancement practices.  The Commission does not suggest that companies obtain consent to such practices; however, it urges industry to rely on the other elements of the privacy framework to address the privacy concerns raised by it.  In the Commission’s view, this means that companies should, for example, explain to consumers how data enhancement works and how they can contact data enhancement sources directly.  They should also encourage their data sources to increase their own transparency.</li><li>The Commission encourages companies to continue to engage in consumer education efforts and invites industry to re-brand and use the Commission’s own materials.</li></ul>ConclusionThe report reflects the Commission’s continued concern that consumers bear too much of a burden for understanding and controlling how their data is collected, used, retained and disclosed.  The report reflects its desire to see this paradigm reversed so that the burden is shouldered by companies instead.  How far this concern is turned into enforceable requirements will depend in large part on the support the Commission receives from Congress, as well as the extent of the development and adoption of self-regulatory codes of conduct.