Social media sites are transforming not only the daily lives of consumers, but also how companies interact with consumers. Here at Morrison Foerster, across all of our practice groups, we are seeing complex, cutting-edge legal issues arising out of social media. As with the Internet boom during the mid-to-late 1990s, social media is generating new legal questions at a far faster pace than the law’s ability to provide answers to such questions. In an effort to stay on top of these emerging issues, and to keep our clients and friends informed of new developments, Morrison Foerster publishes this blog devoted to the law and business of social media.<h2>ABOUT MORRISON FOERSTER</h2>Morrison Foerster is a leading global law firm that transforms complexity into advantage for its clients. Our clients include some of the largest financial institutions, banks, consulting and accounting firms, and Fortune 100, technology, and life sciences companies. Highlighting the firm’s commitment to client service, leadership in market-changing deals and impact litigation, and values-based culture, Morrison Foerster has been repeatedly recognized as one of the top 10 firms on The American Lawyer’s A-List. Year after year, the firm receives significant recognition from Chambers and The Legal 500 across their various guides, including Global, USA, Asia‑Pacific, Europe, UK, Latin America, and FinTech Legal. Our lawyers passionately care about delivering legal excellence while living our values. Morrison Foerster has a long-standing commitment to creating a culture that respects and celebrates differences, while providing an inclusive environment. The firm has achieved Mansfield Certification Plus since 2018 as a result of successfully reaching at least 30 percent women, communities of color, and LGBTQ+ lawyer representation in a notable number of current leadership roles and committees. The firm also has a long history of commitment to the community and society through providing pro bono legal services, including litigating for civil rights and civil liberties, improving public education and fostering the wellbeing of children, advocating for veterans, promoting international human rights, enforcing the right to asylum, and safeguarding the environment.

Social

Search

sociallyaware-abajournalweb100-1

Aaron is the chair of the firm’s Technology Transactions Group and co-chair of the Interactive + Digital Media Group. He advises clients on a wide range of complex transactions involving intellectual property and technology, including structuring and negotiating strategic licensing, development, collaboration, procurement, and distribution deals.Aaron’s practice focuses on advising both established and emerging companies in a variety of data- and technology-intensive sectors, including software, SaaS, cloud-based technology, digital media (social media, AR/VR, gaming, streaming media, AdTech), AI, healthcare, consumer electronics, e-commerce, other online business models, and mobile applications. He also maintains an active practice counseling companies on branding and marketing, trademark licensing, and content-related transactions, as well as the intellectual property aspects of mergers, acquisitions, asset spin-offs, and private equity investments.He has represented clients such as Autodesk, Meta, OpenAI, Splunk, Konami, Kaiser Permanente, SoftBank, Visa, and Yahoo, among others.Aaron has been recognized by numerous publications for his work on market-defining technology transactions. He is currently ranked by Chambers USA for “Technology Transactions.”Aaron also serves as co-editor of Socially Aware, the firm’s award-winning newsletter and blog devoted to the law and business of social media, and regularly publishes on various IP and technology-related topics. Aaron is also a sought-after speaker on new and emerging areas of law, and is a frequent presenter and panelist at conferences and legal services programs. In addition to his active practice, Aaron regularly provides pro bono assistance to various nonprofit and charitable organizations such as Common Sense Media and the Starlight Children’s Foundation. He is a member of the board of directors of California Lawyers for the Arts.While in law school at the University of California, Berkeley, Boalt Hall School of Law, Aaron served as executive editor of the California Law Review and was elected to the Order of the Coif. Following law school, Aaron served as law clerk to the Honorable William H. Orrick and the Honorable Martin J. Jenkins, both United States District Judges for the Northern District of California.

rubin_aaron_blog_150x150.png

rubin_aaron_common_640x280.jpg

rubin_aaron_heroretina_2700x1160.jpg

rubin_aaron_mobileretina_750x1040.jpg

rubin_aaron_social_600x600.jpg

Partner

Aaron is the chair of our Technology Transactions Group. He advises clients on a wide range of complex transactions involving intellectual property and technology, including structuring and negotiating strategic licensing, development, collaboration, procurement, and distribution deals. Aaron’s practice focuses on advising both established and emerging companies in a variety of data– and technology–intensive sectors, including software, SaaS, cloud computing, AR/VR, AI, gaming, healthcare, consumer electronics, social media, e–commerce, other online business models, and mobile applications. He also maintains an active practice counseling companies on the intellectual property aspects of mergers, acquisitions, asset spin–offs, and private equity investments.

Aaron P. Rubin

Lawrence Gallick is of counsel in the firm’s Austin office and a member of the Technology Transactions Group.Lawrence focuses his practice on technology transactions and licensing matters. His diverse experience includes advising on SaaS agreements, cross-licensing agreements, research and collaboration agreements, development agreements, and distribution agreements. He counsels a broad range of companies across the software, hardware, life sciences, biotech and FinTech spaces, as well as other entities including universities.He advises clients in connection with general corporate matters including contract negotiations, and leasing and technology placement agreements.Lawrence also serves as co-editor of <a href="https://www.sociallyawareblog.com/" target="_blank">Socially Aware</a>, the firm’s award-winning newsletter and blog devoted to the law and business of social media, and regularly publishes on various IP and technology-related topics.Prior to joining the firm, Lawrence was counsel at another major law firm. Before earning his law degree, Lawrence was a web consultant, project manager, and web developer in Portland, Oregon, where he managed and consulted on projects using industry methodologies and performed custom development and integration of content management systems.Lawrence was named a Super Lawyers “Rising Star” in 2015 and 2018–2022, and is licensed in both California and New York. Lawrence earned his J.D. from the University at Buffalo School of Law, where he was the electronic systems editor for the Buffalo Law Review and awarded the ABA-BNA Award for Excellence in the Study of Intellectual Property Law.

gallick_lawrence_blog_150x150.png

gallick_lawrence_common_640x280.jpg

gallick_lawrence_heroretina_2700x1160.jpg

gallick_lawrence_mobileretina_750x1040.jpg

gallick_lawrence_social_600x600.jpg

Of Counsel

Lawrence Gallick

Anthony Ramirez is a partner in the Technology Transactions Group in the New York office of Morrison Foerster.Anthony advises clients on general commercial and transactional matters. He regularly advises companies on the IP aspects of their M&A transactions. His clients include technology, digital media and content for television and music, financial services, and communications companies with diverse intellectual property assets and issues.His practice focuses on the legal aspects of developing, licensing, and commercializing technology and intellectual property, as well as negotiating general commercial contracts, including outsourcing transactions, as well as content and data licenses. He regularly assists clients with legal issues relating to licensing and commercialization of digital media and content, digital content that is distributed over the Internet or streamed, mobile applications and social media, as well as the licensing of recorded music for distribution via digital platforms. Anthony is also experienced with issues relating to open-source software, software development, artificial intelligence and machine learning, cloud-based technology, and protection of proprietary information.Anthony has extensive experience working on matters involving disruptive technologies, such as blockchain. He has helped fintech clients with general intellectual property issues in connection with terms of service for online financial products and services.Anthony is an integral part of the outside pro bono legal team for nonprofit organizations based in New York, including advising clients on legal issues regarding entertainment, social media, privacy rights, and the negotiation of outsourcing and service agreements. Anthony received his J.D. from the University of Michigan Law School in 2009. He received his B.S. from Cornell University in 2004.

ramirez_anthony_blog_150x150.png

ramirez_anthony_common_640x280.jpg

ramirez_anthony_heroretina_2700x1160.jpg

ramirez_anthony_mobileretina_750x1040.jpg

ramirez_anthony_social_600x600.jpg

Anthony Ramirez is a partner in the Technology Transactions Group in the New York office of Morrison Foerster. He advises clients on general commercial and transactional matters. His clients include technology, media, and communications companies with considerable intellectual property assets. His practice focuses on the legal aspects of licensing and commercializing technology and intellectual property, as well as negotiating general commercial contracts. He also regularly assists clients with legal issues relating to mobile applications and social media.

Anthony M. Ramirez

favicon.ico

favicon-16x16.png

favicon-32x32.png

apple-touch-icon.png

MoFo Favicons

Socially Aware is devoted to the law and business of social media, proactively addressing emerging issues and keeping our clients informed of new developments. We cover fields such as artificial intelligence, privacy and data security, Section 230, intellectual property, and much more.

Welcome to Socially Aware

240920-socially-aware-header.jpg

Welcome to Socially Aware

240920-socially-aware-header

Socially Aware is devoted to the law and business of social media, proactively addressing emerging issues and keeping our clients informed of new developments. We cover fields such as artificial intelligence, privacy and data security, Section 230, intellectual property, and much more.

News and Announcements

Blog - Terms of Use

Blog - Privacy Policy

Blog - Blog Disclaimer

Blog - Attorney Advertising

morrison-foerster-blog-logo.png

Provides a data-driven look at the Federal Circuit.

Federal Circuitry

Brings together legal insights and in-depth analyses on trends and complex issues shaping the global technology industry.

MoFo Tech

Mofo Tech

Equips our clients with the most up-to-date and relevant information on employment and labor law issues.

Employment Law Commentary

In-depth analysis of developments and trends impacting government contracting.

Government Contracts Insight

Government Contracts Insights

Provides insights and reports on the most current class actions lawsuits and product liability issues that affect consumer-facing companies.

Class Dismissed Blog

Class Dismissed

MoFo’s Socially Aware blog provides timely updates and analysis of the many complex and cutting-edge legal and business issues arising out of social media.

Socially Aware

  Linkedin

MoFo LinkedIN

Socially Aware Blog - RSS

Stay Connected

Never miss a post from Socially Aware. Enter your email below to stay up-to-date.

Subscribe

The Law and Business of Social Media

Morrison Foerster - Footer

Blogs -  Home Button

Home

Blog - Topics

Web Scraping

Advertising

Antitrust

Arbitration

Artificial Intelligence

Asia

Autonomous Vehicles

Bankruptcy

Big Data

Blockchain

Class Actions

Cloud Computing

Compliance

Contracts

COPPA

Copyright

Crowdsourcing

Cyberbullying

Cybersecurity

Data Security

Defamation

Digital Content

Disappearing Content

Discovery

DMCA

E-Commerce

E-Discovery

E-Personation

Electronic Contracts

Employment Law

Endorsement Guides

Ephemeral Messaging

Ethics

European Union

Event

Fair Use

FDA Regulations

Financial Institutions

First Amendment

Fraud

Free Speech

GDPR

Hacking

Influencer Marketing

Infographic

Internet of Things

Investment Management Law

JOBS Act

Labor Law

Litigation

Live streaming

Marketing

Mobile

Online Contracts

Online Endorsements

Online Promotions

Online Reviews

Patent

Privacy

Product Liability

Protected Speech

Right of Publicity

Right To Be Forgotten

Section 230 Safe Harbor

Securities Law

Social Media Policy

Statistics

Status Updates

Stored Communications Act

Supreme Court

Terms of Use

Trademark

UK High Court

User-Generated Content

Wearable Computers

Topics

Blog - Editors

Editors

Blog - About

About

Blog - Subscribe

More

Lawrence W. Gallick

Social Links: If the Suit Fits

Social Links: Age Verification, X Appeal, and the Great White North

Social Links: Fake Reviews, Real Rulings, and an Epic Fail

Lawrence W. Gallick on Toth v. Everly Well, Inc.

Social Links: Going Back to Cali

LinkedIN

90807661_internet_of_things_600px-300x300-1.jpg

The Internet of Things: Interoperability, Industry Standards & Related IP Licensing Approaches (Part 2)

The Internet of Things: Interoperability, Industry Standards & Related IP Licensing Approaches (Part 2)

In an article published here in January we addressed some of the more significant Internet of Things (IoT) -specific standards and initiatives and emphasized th

internetofthings-300x300-1.jpg

The Internet of Things: Interoperability, Industry Standards & Related IP Licensing Approaches

The Internet of Things: Interoperability, Industry Standards & Related IP Licensing Approaches

The financial impact of the Internet of Things on the global economy will be significantly affected by interoperability. A 2015 McKinsey Global Institute report

As a technology law blogger and co-editor of <a href="https://www.sociallyawareblog.com/" target="_blank" rel="noopener">Socially Aware</a>, I monitor emerging developments in information technology. What’s hot in IT today? Any shortlist would have to include social media, mobile, wearable technology, the Internet of Things (IoT), cloud computing and big data.That list is all over the map, right? Or is it? On closer inspection, these technologies are far more closely intertwined than they may appear to be at first glance.So what’s the connection between, say, social media and the Internet of Things? Or wearable tech and cloud computing?Here’s my theory: These technologies all reflect the ceaseless drive by businesses to collect, store and exploit ever more data about their customers. In short, these technologies are ultimately about selling more stuff to us.With this “grand unifying theory” in mind, one sees how these seemingly disparate technologies complement one another. And the legal challenges and risks they pose become clear.Collection of DataLet’s start with the collection of consumer data. Of the six key trends identified above, four relate directly to such collection: social media, mobile, wearable technology and IoT.When we use the Internet, marketers are tracking our activities; the data generated by our online behavior is collected and then used to target ads that will be more relevant to us.If we spend time on movie sites, we’re more likely to see ads promoting new film releases. If we visit food blogs, we’re going to be served ads selling cookware.Creepy? It can be. But such tracking and targeting make it possible for many website operators to offer online content and services for free. Indeed, many believe that such tracking and targeting <a href="http://www.wsj.com/articles/SB10001424052748703748904575411530096840958" target="_blank" rel="noopener">are essential to the vibrancy of our Internet ecosystem</a>. (Although Google is reportedly experimenting with an offering <a href="http://www.fool.com/investing/general/2014/11/30/google-wants-to-know-how-much-youll-pay-for-ad-fre.aspx" target="_blank" rel="noopener">where one would pay not to see ads while surfing the Web</a>.)In the past, serious limitations existed on the ability of marketers to track and target us. We might have given our name, email and home address to a website, but not much else; now, with social media, we routinely volunteer loads of personal information—our jobs, hobbies, special skills, taste in music and movies, even our “relationship status.” And not just information about ourselves, but our families, friends and colleagues as well. As a result, social media companies have compiled huge databases about us—in Facebook’s case, nearly 1.4 billion of us.Also, not long ago, we surfed the Web from either home or office—limiting the ability to be tracked and targeted while away from those locations. The rise of Internet-connected mobile devices has changed all that, of course—now we can access the Web from anywhere, and mobile devices can pinpoint our location, even when we’re not browsing. Marketers can track our daily journey to and from home to work and back again, even serving us “just in time” discount offers as we pass a clothing store or restaurant.From a marketer’s perspective, social media and mobile are all about expanding the amount and type of customer data that can be collected. Thanks to mobile devices and apps, tracking and targeting are no longer desk-bound and can occur even if a customer is not connected to the Internet.Wearable tech? Like cell phones, wearables make tracking and targeting possible while one is away from a traditional computer or not actively using the Web. These devices can also collect information that cell phones can’t – our heart rate or body temperature, or the number of hours one slept last week.For marketers, the Internet of Things is especially exciting because it raises the possibility of being able to track and target consumers anywhere in their homes, even while they are away from their desktop computers or mobile devices.Imagine your “smart” refrigerator not only determining when you’re low on milk, but offering a 15 percent discount if you were to buy today a quart of milk at your local market. Or your Internet-connected washing machine recommending a new laundry detergent based on its monitoring of your laundry loads.Another hot technology trend – commercial drones – is relevant here. Although unmanned aerial vehicles (UAVs) have generated attention for their ability to <a href="http://www.amazon.com/b?node=8037720011" target="_blank" rel="noopener">facilitate package delivery</a> and <a href="http://www.independent.co.uk/news/world/americas/widening-the-net-facebook-drones-to-cover-world-in-wifi-9222334.html" target="_blank" rel="noopener">accommodate WiFi access</a>, they can be used to <a href="http://venturebeat.com/2015/02/23/drones-over-head-in-las-valley-are-tracking-mobile-devices-locations/" target="_blank" rel="noopener">collect data on consumers</a> when <a href="http://www.pcworld.com/article/2904692/epic-appeals-to-court-for-faa-drone-privacy-rules.html" target="_blank" rel="noopener">they’re outdoors or near a window</a>, even when they are without cell phones, wearables or other devices used to track their movement and activities.Ingestibles—“smart” pills containing sensors that are swallowed, <a href="http://blogs.gartner.com/michael-shanler/wearable-devices-ha-whats-your-appetite-for-ingestibles/" target="_blank" rel="noopener">allowing the collection of data within one’s body</a>—are a nascent technology that, as they become more widely used, may ultimately fit into this theory.Storage of DataWith social media platforms, mobile, wearable and IoT devices and UAVs collecting information on an unprecedented scale, that data needs to be stored somewhere. Enter the cloud. All of these new technologies depend heavily on the massive storage capacity made possible by cloud systems; it wouldn’t be cost effective otherwise. (Case in point: A 2013 study revealed that<a href="http://www.sciencedaily.com/releases/2013/05/130522085217.htm" target="_blank" rel="noopener"> 90% of all the data in the world had been collected over the prior two years</a>.)Exploitation of DataOnce all this data has been collected and stored in the cloud, what then?That’s where big data enters the picture. Big data is providing companies with the analytic tools for sifting through these inconceivably large databases in order to exploit the bits therein.For example, that photo you uploaded to Instagram can now be analyzed for marketing opportunities. Perhaps you were holding a bag of potato chips; using big data analytics, the chip maker could target you in its next online ad campaign. Or maybe a competing snack company wants to entice you to switch brands. Why stop there? What about the shirt that you were wearing? And that pair of jeans? (I’ve written on the application of big data analytics to the billions of photos hosted on social media sites <a href="https://www.sociallyawareblog.com/2014/08/05/picture-this-online-photos-and-big-data/" target="_blank" rel="noopener">here</a>.)Similarly, information collected from wearables, when processed by big data tools, opens up new opportunities for marketers. Your pulse rate may be of interest to the health care industry. Your jogging workouts may attract attention from retailers of athletic shoes and clothing.But the mother lode just might be all of the marketing insights to be generated by big data analytics stemming from multiple IoT devices in one’s home—the thermostat, stove, refrigerator, coffee machine, toaster, washer/dryer, humidifier, alarm clock and so on: for the first time ever, marketers will have access to real-time information regarding once-private quotidian activities.Legal ConsiderationsSo that’s my theory: The adoption of today’s hottest IT technologies is being driven in large part by the insatiable desire of businesses to collect and store ever-larger amounts of consumer data, and to then use that data to more successfully market to consumers. When these technologies are viewed in light of this theory, some key legal observations emerge.First, because these technologies all involve the collection, storage and exploitation of consumer data, privacy and data security are necessarily raised and indeed are the most important legal considerations. That’s not meant to minimize intellectual property, product liability and other legal concerns associated with these technologies; privacy and data security laws, however, are the ones specifically designed to regulate the collection, use and exploitation of consumer data.Second, these technologies are being developed and implemented far faster than the ability of legislators, regulators and courts to develop rules to govern them. It will be essential for companies embracing these technologies to self-regulate—failure to do so will result in an inevitable backlash, leading to burdensome regulations that will undermine innovation.Third, these technologies will present real challenges to the majority of companies that want to “do the right thing” by their customers. For example, consumers ideally should be provided with notice and an opportunity to consent prior to the collection, storage and exploitation of their personal information, but how can this be done through, say, a smart electric toothbrush? These issues need to be addressed early in the development cycle for next-generation products—it can’t be an afterthought. Moreover, are customers receiving real, tangible value in connection with the data being collected from them?Fourth, as our social-media pages, devices and appliances become more closely tied together, and linked to massive troves of data about us in the cloud, businesses need to be aware that it takes only one weak link to put the entire ecosystem at risk. Hackers will no longer need to bypass your computer or phone’s security to capture personal data; they may be able to access your records through, say, an Internet-enabled toaster that lacks adequate security controls.Finally, companies need to pay attention to whether they need to collect all the data that can be collected through these technologies. Ideally, they should seek to minimize the amounts of personally identifiable information they hold, in order to reduce privacy- and security-related legal risks, and liability.No doubt this last recommendation may be hard for many marketers to embrace; after all, data-gathering is in their DNA. And that same hard-wiring is in all of our DNA—the original source code for data collection, storage and exploitation. We wouldn’t be human without it.(This is an expanded, “director’s cut” version of an op-ed piece that <a href="http://www.marketwatch.com/story/heree-my-grand-unifying-theory-of-todays-tech-trends-2015-05-12?page=2" target="_blank" rel="noopener">originally appeared</a> in <a href="http://www.marketwatch.com/">MarketWatch</a>.)

04_17_big-data-analytics-diagram_v8-276x300-1.jpg

Toward a Grand Unifying Theory of Today’s Tech Trends

Toward a Grand Unifying Theory of Today’s Tech Trends

As a technology law blogger and co-editor of Socially Aware, I monitor emerging developments in information technology. What’s hot in IT today? Any shortlist wo

As consumers increasingly connect to the Internet using multiple devices—such as mobile phones, tablets, computers, TVs and wearable devices—advertising technology companies have rapidly developed capabilities to reach the same consumers across their various devices. Such “cross-device” tracking enables companies to target ads to the same consumer regardless of the platform, device, or application being used. Last week, the Federal Trade Commission (FTC) <a href="https://www.ftc.gov/news-events/press-releases/2015/03/ftc-host-workshop-cross-device-tracking-nov-16?utm_source=govdelivery" target="_blank" rel="noopener">announced</a> that it will host a workshop on November 16, 2015, to explore the privacy issues arising from such practices—signaling that interest based advertising (IBA) is still at the forefront of its agenda.For a long time, advertisers and publishers have tracked consumers’ online activities using HTTP cookies stored in web browsers on desktop and laptop computers. In response to the FTC’s concerns over consumers’ visibility into and control over such tracking for IBA purposes, industry responded with widely adopted ways for publishers and advertisers to provide consumers with enhanced notice and cookie-based choice with respect to such tracking.As consumers’ behavior has shifted, however, traditional cookie-based technologies are becoming less effective. Most consumers now access the Internet through apps on various platforms, in addition to web browsers, and they tend to use different devices throughout the day. This presents challenges for advertisers, publishers and others who want a complete picture of how individual consumers interact with their websites, services, and advertisements over time— as well as for those who want to know where and how they can reach such consumers. In response, companies have developed various solutions for identifying the same consumer across devices. One approach, for example, is to use “deterministic” methods that link the consumer’s devices to a single account as the consumer logs into websites and services on different devices. Another is through “probabilistic” methods that infer links among devices that share similar attributes, such as location derived from IP address. In some cases, companies may combine multiple techniques for greater accuracy.In its announcement, the FTC explained that these new practices may raise privacy issues if consumers are not provided with adequate notice and control—and the workshop will address, among other topics, how companies can make their tracking more transparent and give consumers greater control over it. If history is a guide, the FTC will likely publish a staff report some months after the workshop, to highlight the privacy issues it sees with cross-device tracking and to offer industry guidance on addressing them.The FTC’s announcement is a natural extension of its recent workshops on <a href="https://www.ftc.gov/news-events/events-calendar/2012/05/short-advertising-privacy-disclosures-digital-world" target="_blank" rel="noopener">mobile privacy disclosures</a>, the <a href="https://www.ftc.gov/news-events/events-calendar/2013/11/internet-things-privacy-security-connected-world" target="_blank" rel="noopener">Internet of Things</a>, and <a href="https://www.ftc.gov/news-events/events-calendar/2014/02/spring-privacy-series-mobile-device-tracking" target="_blank" rel="noopener">mobile device tracking</a>. It also follows recent news from the Digital Advertising Alliance (DAA) that it has launched tools to provide in-app notice and choice to consumers about IBA practices and that it expects enforcement of the DAA Self-Regulatory Principles in the mobile environment to begin this summer.

oneill_julie_blog_150x150.png

oneill_julie_common_640x280.jpg

oneill_julie_heroretina_2700x1160.jpg

oneill_julie_mobileretina_750x1040.jpg

oneill_julie_social_600x600.jpg

Clients seek out Julie because of her practical advice on cutting-edge issues at the intersection of privacy and consumer protection laws. She provides clients with practical solutions to compliance c

Julie O'Neill

Clients seek out Julie because of her practical advice on cutting-edge issues at the intersection of privacy and consumer protection laws. She provides clients with practical solutions to compliance challenges around a wide variety of both online and offline privacy issues, including tracking, interest-based advertising, geo-targeting and other mobile tracking, personalization, and cross-device tracking. Recognized in The Legal 500 US 2014, 2016, 2019, and 2020 and Chambers USA 2021 for her exceptional legal work, her clients praise her saying, “She is really good at giving practical, targeted advice and taking stock of what the risk profile of the client is, so that the advice is holistic.” (Chambers USA 2021).

The New Frontier in Interest Based Advertising: FTC Shifts Focus to Cross-Device Tracking

As consumers increasingly connect to the Internet using multiple devices—such as mobile phones, tablets, computers, TVs and wearable devices—advertising technol

The New Frontier in Interest Based Advertising: FTC Shifts Focus to Cross-Device Tracking

The FTC has released its much anticipated <a href="http://www.ftc.gov/system/files/documents/reports/federal-trade-commission-staff-report-november-2013-workshop-entitled-internet-things-privacy/150127iotrpt.pdf">report</a> on the Internet of Things (“IoT”) – a topic that has been top-of-mind for many companies. The FTC’s report, “Internet of Things: Privacy & Security in a Connected World” (the “Report”), discusses the benefits and risks associated with IoT, and addresses the privacy and data security measures the FTC recommends for consumer-facing IoT products and services [The FTC’s discussion of IoT within the report, consistent with the FTC’s jurisdiction, is limited to such devices that are sold to or used by consumers, and not devices sold in a business-to-business context or broader machine-to-machine communications]. While the Report is not legally binding, it provides a strong and valuable indication of the positions that the FTC may take in enforcement actions related to IoT.WHAT IS THE INTERNET OF THINGS?According to the FTC, IoT refers to “‘things’ such as devices or sensors – other than computers, smartphones, or tablets – that connect, communicate or transmit information with or between each other through the Internet.”FTC RECOGNIZES BENEFITS AND RISKS OF IOTThe Report acknowledges that Internet-connected devices offer numerous benefits, many of which remain untapped. In the health arena, connected medical devices allow patients to more efficiently communicate with their physicians to manage their medical conditions. In the home, smart meters enable energy providers to analyze consumer energy use, identify issues with home appliances, and enable consumers to be more energy-conscious. On the road, sensors on a car can notify drivers of dangerous road conditions, and software updates can occur wirelessly. And these applications are just the beginning.On the flip side, however, the FTC cautions that IoT may present a variety of potential security vulnerabilities that could be exploited to harm consumers. First, as with computers, a lack of security could enable unauthorized access and misuse of personal information. This risk is heightened in the IoT world by the plethora of devices to be connected and secured. Second, security vulnerabilities in a particular device may facilitate attacks on the consumer’s network to which it is connected, or enable attacks on other systems. Third, the FTC notes that IoT may present a heightened risk of harm to personal safety. For example, the Report describes an account of how it may be possible to hack remotely into a connected medical device and change its settings, impeding its therapeutic function.According to the FTC, these risks are exacerbated by the fact that companies entering the IoT market may not have experience in dealing with security issues, or may be creating inexpensive devices for which it may be difficult or impossible to apply a patch for a security bug.SECURITYIn light of these increased risks, the FTC asserts that “inadequate security presents the greatest risk of actual consumer harm in the Internet of Things.” As such, it recommends that companies focus on security when developing connected devices. The FTC acknowledged that what constitutes reasonable security for a given device will depend on a number of factors, including the amount and sensitivity of data collected, and the costs of remedying the security vulnerabilities. However, the staff did offer approaches that it encourages companies to adopt when developing their products:<ul><li>Building security into their devices at the outset, by conducting an initial privacy or security risk assessment, considering how to minimize the data collected and retained, and testing security measures before launching the product.</li><li>Training all employees about good security, and ensuring that security issues are addressed at the appropriate level of responsibility within the organization.</li><li>Retaining service providers that are capable of maintaining reasonable security and providing reasonable oversight.</li><li>Implementing a defense-in-depth approach for systems that involve significant risks, considering security measures at several levels.</li><li>Imposing reasonable access control measures to limit the ability of an unauthorized person to access a consumer’s device, data, or network.</li><li>Continuing to monitor products throughout the life cycle and, to the extent possible, patch known vulnerabilities.</li></ul>In sum, devices that collect sensitive information, present physical security or safety risks (such as door locks, ovens, or medical devices), or connect to other devices or networks in a manner that would enable unauthorized access to those devices, may require heightened consideration of security measures.DATA MINIMIZATIONThe Report emphasizes the FTC’s view that companies should reasonably limit their collection and retention of consumer data, including in the IoT context. The FTC believes that these practices, known as data minimization, will help guard against two privacy-related risks: first, larger data stores present a more attractive target for data thieves; and second, if a company collects and retains large amounts of data, there is an increased risk that the data will be used in a way that departs from consumers’ reasonable expectations.At the same time, the Report acknowledges concerns that data minimization requirements may curtail innovative uses of data. Accordingly, the FTC proposes a “flexible” approach to data minimization that gives companies a variety of options: they can decide not to collect data at all, collect only the fields of data necessary to the product or service being offered, collect data that is less sensitive, or de-identify the data they collect. The FTC also suggests that if none of these options work, a company can seek consumers’ consent for collecting additional, unexpected data.NOTICE AND CHOICEThe FTC acknowledges that notifying consumers of privacy principles and offering them a way to meaningfully choose privacy settings may be more difficult in the context of connected devices, which may not have a screen with which to communicate with consumers. However, the report makes clear that the FTC does not believe it will be sufficient for IoT companies to simply have a privacy policy available on their website, and expect consumers to find that policy. Rather, the FTC recommends that a company find ways to present meaningful privacy notices and choices to the consumer, including in the set-up or purchase of the product itself. The Report suggests creative solutions to this issue, including:<ul><li>Offering video tutorials to guide consumers through privacy settings.</li><li>Affixing a QR code that, when scanned, would take the consumer to a website with information about privacy practices.</li><li>Offering a set-up wizard that provides information about privacy practices.</li><li>Allowing users to configure devices, such as home appliances, so that they receive information through emails or texts.</li><li>Creating a user experience “hub” that stores data locally and learns a consumer’s privacy preferences based on prior behavior.</li></ul>Companies may also want to consider using a combination of approaches. Of course, whatever approach a company decides to take, the FTC expects the privacy choices to be clear and prominent, and not buried within lengthy documents.LEGISLATIONLast but not least, the FTC reiterated its recommendation for Congress to enact strong, flexible, and technology-neutral legislation to strengthen the Commission’s existing data security enforcement tools, and require companies to notify consumers when there is a security breach.CONCLUSIONAs the FTC describes, “in the future, the Internet of Things is likely to meld the virtual and physical worlds together in ways that are currently difficult to comprehend.” As a result, companies should consider guidance offered by the FTC and other regulators, and evaluate what steps they can take to mitigate those risks in the privacy and data security context.

x23-bn-300x300-1.jpg

FTC Issues Landmark Report on Internet of Things

“Firsts” for the World of Virtual Currencies

The FTC has released its much anticipated report on the Internet of Things (“IoT”) – a topic that has been top-of-mind for many companies. The FTC’s report, “In

FTC Issues Landmark Report on Internet of Things

Editor’s Note:  At first glance, drones may seem unrelated to the social media and Internet-related issues that we track on Socially Aware. Upon closer examination, however, many social media and Internet companies are exploring the commercial use of drones; for example, Amazon has <a href="http://www.amazon.com/b?node=8037720011" target="_blank" rel="noopener">publicly announced</a> its intentions to incorporate drones into its package delivery system, and both Facebook and Google have expressed their desire <a href="http://www.wired.com/2014/09/facebook-drones-2/" target="_blank" rel="noopener">to use drones to facilitate Internet connectivity</a>. With that in mind, we present the following post regarding the upcoming Notice of Proposed Rulemaking related to commercial drone use in the United States.IntroductionWith drone technology rapidly advancing and the FAA recently starting to open the door to commercial drone use, companies across industries should begin evaluating how drones can add value to their businesses, if they have not already done so.Drones can benefit a wide range of industries and activities, including (to name only a few): industrial-scale agriculture; energy generation, transmission, production, and pipeline facilities; other conveyances and linear projects (such as water and flood control); transportation infrastructure, including railways, roads, ports, and waterways, and the rolling stock, vehicles, and vessels that use them; private and public emergency response (e.g., fire, flooding); insurance and accident inspection; and resource assessment, monitoring, and compliance. But without input from leaders in these industries, their use of drones may not be realized in the foreseeable future. Industry leaders need to demand that the FAA’s much-anticipated Notice of Proposed Rulemaking (NPRM) for small UAS—now expected to be issued in the first half of December—is reasonable and practical for the wide range of industries and activities, and fosters drone use and innovation while responsibly ensuring public safety.Background of the Notice of Proposed Rulemaking for Small UASFAA rulemaking for drones was mandated by Congress as part of the FAA Modernization and Reform Act of 2012. The law requires the FAA to “provide for the safe integration of civil unmanned aircraft systems into the national airspace system as soon as practicable, but not later than September 30, 2015.”The NPRM for small UAS (meaning UAS that weigh less than 55 pounds) was expected sooner—with Congress requiring the FAA to issue a final rule by August 2014. But the agency is notably behind this schedule. According to the latest publicly available information regarding the rulemaking, the NPRM for small UAS will issue in November 2014. We believe, however, that the FAA is more likely to issue the NPRM in mid-December. Moreover, in fall 2013, the DOT declared a deadline of May 2014 for issuing the small UAS NPRM, which it extended. That could happen again. The NPRM will initiate what is expected to be a decade of rulemaking to establish the regulatory regime for drones, large and small.What Will the Proposed Regulations Say?More important than the timing of the NPRM, however, is its expected content. This rulemaking is going to be comprehensive, designed to adopt specific rules for the operation of small UAS in the national airspace. The proposed regulations are likely to address classification of small UAS, certification and training of pilots and visual observers, registration, approval of operations, and operational limitations. Additionally, there will likely be provisions requiring the FAA to collect safety data from the user community.Operational limitations and certification requirements that the FAA may require can be gleaned from the exemption requests that the FAA granted for the commercial use of small UAS in film production late last month. These exemptions—while allowing limited commercial use—remain highly restrictive. They permit the use of specific drone models that must fly at speeds below 50 knots and be equipped with advanced GPS systems. The flights must be conducted below 400 feet and within the visual line of sight of the pilot in command, who must possess at least a private pilot’s certificate. Flight plans of activities are required to be submitted to the local Flight Standards District Offices three days in advance of the operations, and the operators must obtain specific waivers from the relevant air traffic organizations.If the FAA attempts to impose these types of restrictions on small UAS operations across the board, the utility of drone operations for many industries may be severely limited, if not extinguished. For example, using drones to inspect pipelines and power lines over long distances would prove impossible if the FAA imposes a visual line of sight requirement. Similarly, requiring a private pilot’s certificate for all operations may hinder the ability of farmers to use drones for precision agriculture, or realtors to use drones to obtain aerial footage of properties. Simply put, a one-size-fits-all approach will not work for the small UAS regulations. Given the FAA’s historical concerns and agency culture, there is reason for concern.What Can Be Done Now?Companies and trade associations interested in obtaining the benefits of small UAS should start formulating plans now to help shape the NPRM and the regulations that will come out of it. They need not wait for the NPRM to issue.The FAA can be petitioned in advance of the NPRM with broad requests to include or exclude certain provisions. Moreover, comments can be submitted on pending Section 333 exemption requests. These comments can be narrow and limited to why the specific exemption request should or should not be granted; or they can be broad, sweeping commentary on the current status of the FAA’s position on small UAS operations. Several well-known associations have already begun commenting on the exemption requests, including the Aerospace Industries Association, the National Agricultural Aviation Association, the Association for Unmanned Vehicle Systems International, and the Air Line Pilots Association International.Industry leaders should also plan to comment on the NPRM once it is issued. This will require careful consideration of the current operating environment, as well as a keen eye toward potential future uses for UAS. Industry should seek to ensure that small UAS operations are not unduly restricted, while taking into account the risks associated with, and potential unintended consequences of, expanding UAS operations.

dones-300x184-1.jpg

Drones: Why You Should Start Thinking Now About the Anticipated UAS Regulations

Drones: Why You Should Start Thinking Now About the Anticipated UAS Regulations

Editor’s Note:  At first glance, drones may seem unrelated to the social media and Internet-related issues that we track on Socially Aware. Upon closer examinat

Autodesk

HM Revenue and Customs

Alistair Maughan

The Internet of Things Part 2: The Old Problem Squared