Social media sites are transforming not only the daily lives of consumers, but also how companies interact with consumers. Here at Morrison Foerster, across all of our practice groups, we are seeing complex, cutting-edge legal issues arising out of social media. As with the Internet boom during the mid-to-late 1990s, social media is generating new legal questions at a far faster pace than the law’s ability to provide answers to such questions. In an effort to stay on top of these emerging issues, and to keep our clients and friends informed of new developments, Morrison Foerster publishes this blog devoted to the law and business of social media.<h2>ABOUT MORRISON FOERSTER</h2>Morrison Foerster is a leading global law firm that transforms complexity into advantage for its clients. Our clients include some of the largest financial institutions, banks, consulting and accounting firms, and Fortune 100, technology, and life sciences companies. Highlighting the firm’s commitment to client service, leadership in market-changing deals and impact litigation, and values-based culture, Morrison Foerster has been repeatedly recognized as one of the top 10 firms on The American Lawyer’s A-List. Year after year, the firm receives significant recognition from Chambers and The Legal 500 across their various guides, including Global, USA, Asia‑Pacific, Europe, UK, Latin America, and FinTech Legal. Our lawyers passionately care about delivering legal excellence while living our values. Morrison Foerster has a long-standing commitment to creating a culture that respects and celebrates differences, while providing an inclusive environment. The firm has achieved Mansfield Certification Plus since 2018 as a result of successfully reaching at least 30 percent women, communities of color, and LGBTQ+ lawyer representation in a notable number of current leadership roles and committees. The firm also has a long history of commitment to the community and society through providing pro bono legal services, including litigating for civil rights and civil liberties, improving public education and fostering the wellbeing of children, advocating for veterans, promoting international human rights, enforcing the right to asylum, and safeguarding the environment.

Social

Search

sociallyaware-abajournalweb100-1

Aaron is the chair of the firm’s Technology Transactions Group and co-chair of the Interactive + Digital Media Group. He advises clients on a wide range of complex transactions involving intellectual property and technology, including structuring and negotiating strategic licensing, development, collaboration, procurement, and distribution deals.Aaron’s practice focuses on advising both established and emerging companies in a variety of data- and technology-intensive sectors, including software, SaaS, cloud-based technology, digital media (social media, AR/VR, gaming, streaming media, AdTech), AI, healthcare, consumer electronics, e-commerce, other online business models, and mobile applications. He also maintains an active practice counseling companies on branding and marketing, trademark licensing, and content-related transactions, as well as the intellectual property aspects of mergers, acquisitions, asset spin-offs, and private equity investments.He has represented clients such as Autodesk, Meta, OpenAI, Splunk, Konami, Kaiser Permanente, SoftBank, Visa, and Yahoo, among others.Aaron has been recognized by numerous publications for his work on market-defining technology transactions. He is currently ranked by Chambers USA for “Technology Transactions.”Aaron also serves as co-editor of Socially Aware, the firm’s award-winning newsletter and blog devoted to the law and business of social media, and regularly publishes on various IP and technology-related topics. Aaron is also a sought-after speaker on new and emerging areas of law, and is a frequent presenter and panelist at conferences and legal services programs. In addition to his active practice, Aaron regularly provides pro bono assistance to various nonprofit and charitable organizations such as Common Sense Media and the Starlight Children’s Foundation. He is a member of the board of directors of California Lawyers for the Arts.While in law school at the University of California, Berkeley, Boalt Hall School of Law, Aaron served as executive editor of the California Law Review and was elected to the Order of the Coif. Following law school, Aaron served as law clerk to the Honorable William H. Orrick and the Honorable Martin J. Jenkins, both United States District Judges for the Northern District of California.

rubin_aaron_blog_150x150.png

rubin_aaron_common_640x280.jpg

rubin_aaron_heroretina_2700x1160.jpg

rubin_aaron_mobileretina_750x1040.jpg

rubin_aaron_social_600x600.jpg

Partner

Aaron is the chair of our Technology Transactions Group. He advises clients on a wide range of complex transactions involving intellectual property and technology, including structuring and negotiating strategic licensing, development, collaboration, procurement, and distribution deals. Aaron’s practice focuses on advising both established and emerging companies in a variety of data– and technology–intensive sectors, including software, SaaS, cloud computing, AR/VR, AI, gaming, healthcare, consumer electronics, social media, e–commerce, other online business models, and mobile applications. He also maintains an active practice counseling companies on the intellectual property aspects of mergers, acquisitions, asset spin–offs, and private equity investments.

Aaron P. Rubin

Lawrence Gallick is of counsel in the firm’s Austin office and a member of the Technology Transactions Group.Lawrence focuses his practice on technology transactions and licensing matters. His diverse experience includes advising on SaaS agreements, cross-licensing agreements, research and collaboration agreements, development agreements, and distribution agreements. He counsels a broad range of companies across the software, hardware, life sciences, biotech and FinTech spaces, as well as other entities including universities.He advises clients in connection with general corporate matters including contract negotiations, and leasing and technology placement agreements.Lawrence also serves as co-editor of <a href="https://www.sociallyawareblog.com/" target="_blank">Socially Aware</a>, the firm’s award-winning newsletter and blog devoted to the law and business of social media, and regularly publishes on various IP and technology-related topics.Prior to joining the firm, Lawrence was counsel at another major law firm. Before earning his law degree, Lawrence was a web consultant, project manager, and web developer in Portland, Oregon, where he managed and consulted on projects using industry methodologies and performed custom development and integration of content management systems.Lawrence was named a Super Lawyers “Rising Star” in 2015 and 2018–2022, and is licensed in both California and New York. Lawrence earned his J.D. from the University at Buffalo School of Law, where he was the electronic systems editor for the Buffalo Law Review and awarded the ABA-BNA Award for Excellence in the Study of Intellectual Property Law.

gallick_lawrence_blog_150x150.png

gallick_lawrence_common_640x280.jpg

gallick_lawrence_heroretina_2700x1160.jpg

gallick_lawrence_mobileretina_750x1040.jpg

gallick_lawrence_social_600x600.jpg

Of Counsel

Lawrence Gallick

Anthony Ramirez is a partner in the Technology Transactions Group in the New York office of Morrison Foerster.Anthony advises clients on general commercial and transactional matters. He regularly advises companies on the IP aspects of their M&A transactions. His clients include technology, digital media and content for television and music, financial services, and communications companies with diverse intellectual property assets and issues.His practice focuses on the legal aspects of developing, licensing, and commercializing technology and intellectual property, as well as negotiating general commercial contracts, including outsourcing transactions, as well as content and data licenses. He regularly assists clients with legal issues relating to licensing and commercialization of digital media and content, digital content that is distributed over the Internet or streamed, mobile applications and social media, as well as the licensing of recorded music for distribution via digital platforms. Anthony is also experienced with issues relating to open-source software, software development, artificial intelligence and machine learning, cloud-based technology, and protection of proprietary information.Anthony has extensive experience working on matters involving disruptive technologies, such as blockchain. He has helped fintech clients with general intellectual property issues in connection with terms of service for online financial products and services.Anthony is an integral part of the outside pro bono legal team for nonprofit organizations based in New York, including advising clients on legal issues regarding entertainment, social media, privacy rights, and the negotiation of outsourcing and service agreements. Anthony received his J.D. from the University of Michigan Law School in 2009. He received his B.S. from Cornell University in 2004.

ramirez_anthony_blog_150x150.png

ramirez_anthony_common_640x280.jpg

ramirez_anthony_heroretina_2700x1160.jpg

ramirez_anthony_mobileretina_750x1040.jpg

ramirez_anthony_social_600x600.jpg

Anthony Ramirez is a partner in the Technology Transactions Group in the New York office of Morrison Foerster. He advises clients on general commercial and transactional matters. His clients include technology, media, and communications companies with considerable intellectual property assets. His practice focuses on the legal aspects of licensing and commercializing technology and intellectual property, as well as negotiating general commercial contracts. He also regularly assists clients with legal issues relating to mobile applications and social media.

Anthony M. Ramirez

favicon.ico

favicon-16x16.png

favicon-32x32.png

apple-touch-icon.png

MoFo Favicons

Socially Aware is devoted to the law and business of social media, proactively addressing emerging issues and keeping our clients informed of new developments. We cover fields such as artificial intelligence, privacy and data security, Section 230, intellectual property, and much more.

Welcome to Socially Aware

240920-socially-aware-header.jpg

Welcome to Socially Aware

240920-socially-aware-header

Socially Aware is devoted to the law and business of social media, proactively addressing emerging issues and keeping our clients informed of new developments. We cover fields such as artificial intelligence, privacy and data security, Section 230, intellectual property, and much more.

News and Announcements

Blog - Terms of Use

Blog - Privacy Policy

Blog - Blog Disclaimer

Blog - Attorney Advertising

morrison-foerster-blog-logo.png

Provides a data-driven look at the Federal Circuit.

Federal Circuitry

Brings together legal insights and in-depth analyses on trends and complex issues shaping the global technology industry.

MoFo Tech

Mofo Tech

Equips our clients with the most up-to-date and relevant information on employment and labor law issues.

Employment Law Commentary

In-depth analysis of developments and trends impacting government contracting.

Government Contracts Insight

Government Contracts Insights

Provides insights and reports on the most current class actions lawsuits and product liability issues that affect consumer-facing companies.

Class Dismissed Blog

Class Dismissed

MoFo’s Socially Aware blog provides timely updates and analysis of the many complex and cutting-edge legal and business issues arising out of social media.

Socially Aware

  Linkedin

MoFo LinkedIN

Socially Aware Blog - RSS

Stay Connected

Never miss a post from Socially Aware. Enter your email below to stay up-to-date.

Subscribe

The Law and Business of Social Media

Morrison Foerster - Footer

Blogs -  Home Button

Home

Blog - Topics

Web Scraping

Advertising

Antitrust

Arbitration

Artificial Intelligence

Asia

Autonomous Vehicles

Bankruptcy

Big Data

Blockchain

Class Actions

Cloud Computing

Compliance

Contracts

COPPA

Copyright

Crowdsourcing

Cyberbullying

Cybersecurity

Data Security

Defamation

Digital Content

Disappearing Content

Discovery

DMCA

E-Commerce

E-Discovery

E-Personation

Electronic Contracts

Employment Law

Endorsement Guides

Ephemeral Messaging

Ethics

European Union

Event

Fair Use

FDA Regulations

Financial Institutions

First Amendment

Fraud

Free Speech

GDPR

Hacking

Influencer Marketing

Infographic

Internet of Things

Investment Management Law

JOBS Act

Labor Law

Litigation

Live streaming

Marketing

Mobile

Online Contracts

Online Endorsements

Online Promotions

Online Reviews

Patent

Privacy

Product Liability

Protected Speech

Right of Publicity

Right To Be Forgotten

Section 230 Safe Harbor

Securities Law

Social Media Policy

Statistics

Status Updates

Stored Communications Act

Supreme Court

Terms of Use

Trademark

UK High Court

User-Generated Content

Wearable Computers

Topics

Blog - Editors

Editors

Blog - About

About

Blog - Subscribe

More

Lawrence W. Gallick

Social Links: If the Suit Fits

Social Links: Age Verification, X Appeal, and the Great White North

Social Links: Fake Reviews, Real Rulings, and an Epic Fail

Lawrence W. Gallick on Toth v. Everly Well, Inc.

Social Links: Going Back to Cali

LinkedIN

In our September 2010 issue of Socially Aware, we provided a brief overview of Facebook’s “<a href="http://www.facebook.com/legal/terms">Statement of Rights and Responsibilities</a>,” the social media service’s complex set of terms and conditions that companies frequently “click-accept” with little review (often, in a rush to establish their Facebook presences).  Naturally, this situation is not limited to Facebook— for many if not most social media services— when users first sign up for an account, they are required to agree to the service’s lengthy standard terms and conditions of use.  It’s part of life on the Internet.And Twitter is no exception.  When you sign up for a Twitter account, “By clicking the button, you agree to the terms below.”  And although Twitter’s core <a href="http://twitter.com/tos">Terms of Service</a> are a bit shorter than Facebook’s Statement of Rights and Responsibilities, Twitter’s terms similarly link and branch off to a variety of policies, guidelines, and related documents, all of which govern your use of the service.At the top of Twitter’s hierarchy of terms and conditions are the <a href="http://twitter.com/tos">Twitter Terms of Service</a>.  Those Terms of Service incorporate two documents by reference:  (1) Twitter’s <a href="http://twitter.com/privacy">Privacy Policy</a>, which notes that use of Twitter’s services constitutes consent to the collection, transfer, manipulation, storage, disclosure, and other uses of information described in such policy and (2) the <a href="http://support.twitter.com/articles/18311-the-twitter-rules">Twitter Rules</a>, which describe how end-users should and should not use Twitter, and impose a variety of rules regarding content, spam, and abuse.  But the Terms of Service also link to Twitter’s <a href="https://developer.twitter.com/en/developer-terms/agreement">Developer Rules of the Road</a> (described by Twitter as “an evolving set of rules for how ecosystem partners can interact with your content”), which govern the use of Twitter’s application programming interface (<a href="https://developer.twitter.com/en/docs/api-reference-index">API</a>) and, more generally, Twitter’s philosophy around how information and content shared on Twitter can and cannot be used.Given the complexity of Twitter’s ecosystem, the Developer Rules of the Road branch off to and incorporate a variety of other policies and guidelines, including the service’s Display Guidelines, (which describe how Tweets must be displayed), <a href="http://support.twitter.com/articles/77641">rules on trademark usage</a>, <a href="http://support.twitter.com/articles/76915">automation rules</a>, <a href="http://support.twitter.com/articles/18311#spam">spam rules</a> (which actually loop back to the end-user-focused Twitter Rules), and various other documents.  A complete list of Twitter’s terms, conditions, rules, guidelines, and best practices can be found <a href="http://support.twitter.com/groups/33-report-a-violation">here</a> — there are 36 documents in total.Below, we describe a few key terms from Twitter’s various written policies.  These terms are not necessarily uncommon for Internet-based services — particularly services that are free to use — but they’re worth keeping in mind:Key Term for End-Users — Broad License to User Content.Foremost for many end-users of social media services, is the license being granted to such services in users’ posted content — and end-users grant Twitter a typically broad license.  By posting photos or other content on Twitter, end-users grant Twitter the right to “use, copy, reproduce, process, adapt, modify, publish, transmit, display and distribute” such content in any manner now known or later developed.  The Terms of Service also expressly provide that such license “includes the right for Twitter to make [such content] available to other companies, organizations or individuals who partner with Twitter” for the purpose of distributing such content on other media and services.  True, given that Tweets are publicly available by their nature (assuming a <a href="http://support.twitter.com/articles/14016-about-public-and-protected-accounts">public account</a>), one would expect a broad license grant.  But the grant to Twitter gives Twitter the right to use Tweets for purposes other than simply operating the Twitter service, and the right to distribute those Tweets in ways that may not have even existed when the Tweets were originally posted.  Although the broad license grant does apply to “protected” Tweets (i.e., Tweets that are not publicly viewable) and public Tweets alike, <a href="http://support.twitter.com/articles/14016-about-public-and-protected-accounts">Twitter does state</a>  that protected Tweets will not appear in Twitter or Google searches, meaning that, as a practical matter, a user’s privacy settings should be useful in controlling how widely Twitter may disseminate the user’s Tweets.Key Terms for Developers — API Terms.  Foremost for many developers who leverage social media services, are the services’ rules for accessing their platforms and APIs.  According to Twitter’s Terms of Service, unless otherwise permitted through Twitter’s services or terms, users are required to use the Twitter API in order to “reproduce, modify, create derivative works, distribute, sell, transfer, publicly display, publicly perform, transmit, or otherwise use” Twitter’s content or services.  In light of this, it is important for developers who leverage Twitter in their own apps and services to carefully review the terms and conditions governing Twitter’s API.  Those terms and conditions are sprinkled throughout Twitter’s policies, including the Developer Rules of the Road (changes to which are archived at Twitter’s API Terms of Service Archive) and Twitter’s Rate Limiting page, which addresses the number of “calls” that can be made to various Twitter APIs and services over time.  Of course, all of Twitter’s API restrictions are in addition to, and not in lieu of, those found in the site’s Terms of Service and elsewhere — per the Developer Rules of the Road, use of the API and Twitter content “are subject to certain limitations on access, calls, and use as set forth in the [rules], on dev.twitter.com, or as otherwise provided to you by Twitter.”  Perhaps most importantly, Twitter retains the right to block use of the API and Twitter’s content if Twitter believes that a user has attempted to circumvent or exceed any limitations imposed by Twitter, and Twitter disclaims any liability for resulting costs or damages.Key Terms for Everyone — Modifications to Twitter’s Terms and Services.  Twitter reserves the right to unilaterally modify its Terms of Service and the form and nature of its services at any time.  If Twitter determines in its sole discretion that changes to its Terms of Service are material, Twitter promises to notify users via a Twitter update or by email; nevertheless, as with changes to most websites’ terms of use, a user’s continued use of Twitter following such changes constitutes the user’s agreement to the modified terms.  It is important to keep in mind that changes in a social media site’s services or terms of use — even seemingly tiny changes in the way a social media profile appears to end-users, or in what flavors of activities are or are not permitted on the site — can wreak havoc on a company’s costly social media strategy.  Conveniently, Twitter provides an <a href="http://twitter.com/tos/previous">archive of previous versions</a> of its Terms of Service, which can help users spot changes over time more easily.Our message to end-users and developers alike remains what it was back in 2010:  be sure to carefully review social media services’ terms and conditions so that you know what you’re getting into, particularly when you will be investing money or time in using a service for your business or building an app or site that relies on the service’s content or functionality.

Caveat Emptor, Part II: A Brief Overview of Twitter’s Terms of Service and Related Documents

In our September 2010 issue of Socially Aware, we provided a brief overview of Facebook’s “Statement of Rights and Responsibilities,” the social media service’s

Caveat Emptor, Part II:  A Brief Overview of Twitter’s Terms of Service and Related Documents

On March 26, 2012, the Federal Trade Commission (the “Commission” or “FTC”) released its much-anticipated final privacy report, Protecting Consumer Privacy in an Era of Rapid Change.  The report builds upon the Commission’s December 2010 preliminary report, and provides recommendations for businesses and policymakers with respect to online and offline privacy practices.  The report will be of interest to any company using social media for marketing purposes.  Specifically, the report:<ul><li>Presents a privacy framework that sets forth best practices – not legal requirements – for businesses.  The Commission states that, to the extent that the best practices set forth in the report extend beyond existing legal requirements, such best practices are not intended to serve as a template for law enforcement actions or regulation under laws currently enforced by the Commission.  FTC Chairman Jon Leibowitz reiterated this point to a House Energy and Commerce subcommittee on March 29, 2012, informing legislators that, while companies that follow the report’s best practices would not be in violation of the FTC Act, those that do not follow them would not necessarily be in breach of the law.  In his words, the report “is not a regulatory document or an enforcement document.”  That said, those elements of the report that focus on transparency and consumer choice build on the Commission’s recent law enforcement experience; it is therefore reasonable to assume that the Commission will continue its pattern of focusing on data practices that are not obvious to consumers in context, that are not disclosed adequately, and, in some instances, where consumers do not have meaningful choice.  Of course, the Commission will continue its aggressive enforcement of companies’ privacy and data security promises.</li><li>Recommends baseline privacy legislation.  In the Commission’s view, because self-regulation has not yet gone far enough, flexible and technologically neutral baseline privacy legislation is desirable.  While encouraging industry to continue its self-regulatory efforts, the Commission also intends the privacy framework set forth in the report to assist Congress in crafting legislation.  The Commission also reiterates its call for federal information security and data breach notification legislation and for legislation regulating the practices of data brokers.</li><li>Highlights the Commission’s privacy priorities for the coming year.  The report explains that the Commission will promote implementation of the privacy framework by focusing its efforts on five main areas: (1) cooperation with industry to complete the implementation of an easy-to-use, persistent and effective Do Not Track mechanism (the Commission does not call for Do Not Track legislation in this report); (2) improvement of privacy disclosures and other protections offered by mobile services, including through its May 30, 2012 public workshop on revisions to its Dot Com Disclosures guidance; (3) support for targeted legislation to give consumers access to the information about them held by data brokers and encouragement to data brokers that compile data for marketing purposes to create a centralized website to further increase the transparency of their practices; (4) exploration of the privacy issues associated with the comprehensive tracking of consumers’ online activities by large platform providers, such as ISPs, operating systems, browsers and social media in a workshop later this year; and (5) participation with the Department of Commerce and industry stakeholders to create enforceable self-regulatory codes of conduct.</li></ul>This final priority reflects the Commission’s support for the report issued by the Obama administration on February 23, 2012.  In its report, entitled Consumer Data Privacy in a Networked World: A Framework for Protecting Privacy and Promoting Innovation in the Global Digital Economy, the administration detailed a “Consumer Privacy Bill of Rights” and announced the creation of a multi-stakeholder process to be convened by the Department of Commerce to create voluntary codes of conduct which, if adopted by companies, would be enforceable by the Commission pursuant to its deception authority under Section 5 of the FTC Act.  Importantly, the Commission’s report makes clear that the FTC will participate in the Department of Commerce’s multi-stakeholder process.The Scope of the Privacy FrameworkThe privacy framework applies to all commercial entities that collect or use online and/or offline consumer data that can be reasonably linked to a specific consumer or computer or other device.  There is an exception for entities that collect only non-sensitive data from fewer than 5,000 consumers per year and do not share the data with third parties, so as not to unduly burden small businesses.  The Commission did not, however, exempt from the framework’s intended coverage those companies already covered by sector-specific privacy laws, such as the Gramm-Leach-Bliley Act or the Health Insurance Portability and Accountability Act.  Instead, it emphasizes in the final report that the framework is intended to foster best practices but not impose conflicting legal obligations, and it urges Congress not to pass legislation that creates overlapping or contradictory requirements for entities subject to such laws.The extension of privacy best practices to data linkable to a computer or other device reflects the Commission’s position that the line between “personally identifiable information” (“PII”) and “non-PII” is increasingly blurred.The Commission justified this application on the grounds that, not only is re-identification of supposedly “anonymous” data increasingly possible, but, in the Commission’s view, businesses have strong incentives to re-identify such data.To provide businesses with certainty with respect to what constitutes “reasonably linkable” data, the Commission has taken the position that data is not “reasonably linkable”—and therefore not within the scope of the privacy framework—if the company possessing it implements the following protections: (1) reasonable measures to ensure that the data is de-identified; (2) a public commitment to using the data in a de-identified way; and (3) contractual prohibitions on downstream entities that use the data from de-identifying it, coupled with reasonable measures to ensure compliance with that prohibition.  Even with this attempt at clarity, questions remain, including what it means to “de-identify” data.  For example, does this mean removing PII or does it mean removing any identifier, such as cookie IDs?  Furthermore, what measures are “reasonable” in terms of monitoring downstream entities?The Substance of the Privacy FrameworkThe Commission’s report proposes a privacy framework that calls for companies to incorporate “privacy by design” into their practices, to offer consumers simplified choices about how their data is collected and used, and to provide consumers with greater transparency about their practices.Privacy by DesignAccording to the report, companies should promote consumer privacy throughout their organizations and at every stage of the development and life cycle of their products and services.  As a substantive matter, this means that companies should incorporate the following privacy protections into their practices:<ul><li>Reasonable security for consumer data.  The Commission notes that this obligation is already well settled, as it has a long history of enforcing data security obligations under Section 5 of the FTC Act and other laws.  The Commission commends industry’s efforts to ensure the security of consumers’ data, but, nonetheless, it renews its call for Congress to enact comprehensive data security and breach notification legislation.</li><li>Reasonable limits on data collection.  According to the Commission, reasonable limits are those that are consistent with the context of a particular transaction or the consumer’s relationship with the business (or as required or specifically permitted by law).</li><li>Sound retention and disposal practices.The Commission states that companies should implement reasonable restrictions on the retention of consumer data and should dispose of it once the data has outlived the legitimate purpose for which it was collected.  What is “reasonable” depends on the type of relationship and the nature and use of the data.</li><li>Data accuracy.According to the Commission, companies should maintain the accuracy of the data they hold about consumers.  As with other elements of the framework, the Commission believes that the best approach to achieving accuracy is through a flexible approach, scaled to the intended use and sensitivity of the data at issue.</li></ul>The Commission also urges businesses to maintain comprehensive data management procedures throughout the life cycle of their products and services.  It cites its recent settlement orders with Facebook and Google as providing a roadmap for the types of comprehensive procedural protections it envisions: (1) designation of personnel responsible for the privacy program; (2) a risk assessment that covers, at a minimum, employee training, management and product design and development; (3) implementation of controls designed to mitigate identified risks; (4) appropriate oversight; and (5) evaluation and adjustment of the program in light of regular testing and monitoring.Simplified Consumer ChoiceThe report encourages companies to simplify consumer choice, in part by identifying those practices for which choice is not necessary.  Specifically, the report provides that companies do not need to provide consumers with choice before collecting and using consumer data for practices that are consistent with the context of the transaction or the company’s relationship with the consumer or that are required or specifically authorized by law.While this standard relies to some degree on consumer expectations, it focuses on objective factors related to the consumer’s relationship with the business.  The following commonly accepted practices are provided as examples of the kinds of practices that do not typically require consumer choice: product and service fulfillment, internal operations, fraud prevention, legal compliance and public purpose and first-party marketing.The report goes on to address practices that require choice and states that, when choice is required, it should be offered at a time and in a context in which the consumer is making a decision about his or her data.  (The Commission declines, however, to impose any particular method of providing choice, leaving it to industry to develop the most appropriate choice mechanisms.)  As a general matter, data use and disclosure practices that are inconsistent with the context of the transaction or the company’s relationship with the consumer require consumer choice (unless such practices are required or specifically authorized by law).  Such practices may include, for example, sharing customer data with an affiliate for the affiliate’s own direct marketing use, if the consumer would not have been aware of the affiliate relationship (e.g., because the companies are differently branded).The Commission identifies two practices that it believes require affirmative express consent:  (1) in connection with material retroactive changes to privacy representations (this is not new, as the Commission has expressed it repeatedly for years and has imposed it in settlement orders); and (2) before collecting sensitive data, such as information about children, health and financial information, geolocation data and Social Security numbers. (The Commission also proposes that social networks and others specifically targeting teens should take extra precautions with respect to their submission of personal information.)  The Commission’s identification of specific practices that require affirmative express consent suggests that, where it otherwise calls for choice, clear and conspicuous notice and opt-out would be sufficient.Greater TransparencyThe Commission states that companies should increase the transparency of their data practices, through privacy notices, access to data and consumer education:<ul><li>Privacy notices should be clearer, shorter and more standardized, to enable better comprehension and comparison of privacy practices.  The Commission calls for the simplification of privacy notices, such as through the use of standardized terminology, format and other elements.  In the Commission’s view, members of various industry sectors should work together to create standards relevant to their industry, possibly through the multi-stakeholder process that the Department of Commerce plans to convene.  According to the Commission, the need for simplification and industry involvement is particularly acute in the mobile realm, given the number of entities that want to collect user data and the limited space for disclosures.  As noted above, the Commission plans to address mobile disclosures in a May 30, 2012 public workshop.</li><li>Companies should provide reasonable access to the consumer data they maintain.  The extent of access should be proportionate to the sensitivity of the data and the nature of its use.  For example, the Commission urges businesses that maintain data for marketing purposes to, at a minimum, provide consumers with access to such data and permit them to suppress categories they would not like used for targeting.</li><li>Companies should make efforts to increase the transparency of their data enhancement practices.  The Commission does not suggest that companies obtain consent to such practices; however, it urges industry to rely on the other elements of the privacy framework to address the privacy concerns raised by it.  In the Commission’s view, this means that companies should, for example, explain to consumers how data enhancement works and how they can contact data enhancement sources directly.  They should also encourage their data sources to increase their own transparency.</li><li>The Commission encourages companies to continue to engage in consumer education efforts and invites industry to re-brand and use the Commission’s own materials.</li></ul>ConclusionThe report reflects the Commission’s continued concern that consumers bear too much of a burden for understanding and controlling how their data is collected, used, retained and disclosed.  The report reflects its desire to see this paradigm reversed so that the burden is shouldered by companies instead.  How far this concern is turned into enforceable requirements will depend in large part on the support the Commission receives from Congress, as well as the extent of the development and adoption of self-regulatory codes of conduct.

oneill_julie_blog_150x150.png

oneill_julie_common_640x280.jpg

oneill_julie_heroretina_2700x1160.jpg

oneill_julie_mobileretina_750x1040.jpg

oneill_julie_social_600x600.jpg

Clients seek out Julie because of her practical advice on cutting-edge issues at the intersection of privacy and consumer protection laws. She provides clients with practical solutions to compliance c

Julie O'Neill

Clients seek out Julie because of her practical advice on cutting-edge issues at the intersection of privacy and consumer protection laws. She provides clients with practical solutions to compliance challenges around a wide variety of both online and offline privacy issues, including tracking, interest-based advertising, geo-targeting and other mobile tracking, personalization, and cross-device tracking. Recognized in The Legal 500 US 2014, 2016, 2019, and 2020 and Chambers USA 2021 for her exceptional legal work, her clients praise her saying, “She is really good at giving practical, targeted advice and taking stock of what the risk profile of the client is, so that the advice is holistic.” (Chambers USA 2021).

FTC’s Privacy Report Suggests Tightening of Privacy Regime, Provides Guidance to Business

On March 26, 2012, the Federal Trade Commission (the “Commission” or “FTC”) released its much-anticipated final privacy report, Protecting Consumer Privacy in a

FTC’s Privacy Report Suggests Tightening of Privacy Regime, Provides Guidance to Business

01_17_socialmedialaw_infographic_v1_6_5x44_5in_96dpi1-1.jpg

Key Moments in Social Media Law

Key Moments in Social Media Law

To ring in the New Year, the Socially Aware editors provide their predictions regarding social media law and business developments in the coming year (please keep in mind that, if we were good at this prediction thing, we wouldn’t be practicing law for a living) . . .Watch for an explosion of employment law disputes involving social media in 2012.  It’s coming.  Get ready. You heard it here first.We’re going out on a limb here, but we believe that the Second Circuit may reverse and remand the lower court’s decision in the widely-followed Viacom v. YouTube litigation, potentially creating turbulence for online companies that rely on user-generated content to attract traffic and boost revenues.  Although the case raises some of the most important copyright issues of the digital era, the lower court’s decision, favoring YouTube, did not dig into the details and nuances of the parties’ respective arguments, and our sense is that the Second Circuit may ultimately reverse that decision and send the case back to the lower court for further proceedings.With the rise of social media platforms, we are seeing more and more companies — even Fortune 500 companies — entering into extremely one-sided “clickwrap” agreements with platform providers. Although clickwrap agreements are generally enforceable under U.S. law, we expect to see more challenges on public policy and other grounds to particular provisions in these agreements.Speaking of clickwraps, we often comment on how social media platforms’ terms of service (TOS) are typically long and intricate, branching off into various rules, policies, guidelines and “best practices” that change over time (and not necessarily all at the same time!).  As business users invest more and more time and money in creating and cultivating their social media presences, and as consumers increasingly turn to social media as the way to interact with their favorite brands, we anticipate a resurgence of interest in what these TOS say… not just what they say today, but what they said last week, last month and last year.  We foresee more services adopting Twitter’s practice of maintaining an <a href="http://twitter.com/tos/previous">archive</a> of earlier TOS versions, and perhaps even the institution of a well-stocked third-party clearinghouse, along the lines of <a href="https://tosback.org">TOSback.org</a>, dedicated to tracking social media TOS changes over time.Even with Facebook’s recent settlement with the FTC in connection with Facebook’s data collection practices, we anticipate still further privacy law headaches for social media companies in the coming year.  Global privacy laws get tougher and more burdensome each year, and yet many social media providers, anxious to justify astronomical valuations, are undoubtedly feeling pressure to make more aggressive use of the personal information that they have collected from their customers.  Watch for the first skirmishes in 2012 to be initiated by European regulators.Online behavioral advertising is a subject that attracts strong bipartisan opposition, even in the current bitterly divided Congress.  Watch for 2011’s call for greater regulation of OBA to grow louder over the coming year, resulting in new legislation or regulations.We will see even the largest, most conservative Fortune 500 companies adopting internal, company-wide social media platforms of the type offered by Jive, NewsGator and SocialText.  And, in 2013 and beyond, we’ll be seeing a new generation of privacy, employment, defamation and other legal claims arising out of these enterprise social platforms.We will likely continue to see courts struggle with the limits of the safe harbors provided by Section 230 of the Communications Decency Act.  Ever since the landmark 1997 case Zeran v. America Online, courts have fairly consistently held that Section 230 provides online service providers broad immunity for defamatory or otherwise actionable information posted by users.  But we have also seen courts occasionally impose some limits on the scope of Section 230 — e.g., in the 2008 case Fair Housing Council v. Roommates.com and the more recent Hill v. StubHub case.  And other courts, such as the California Supreme Court in Barrett v. Rosenthal, have expressed discomfort with the broad sweep of Section 230 even while upholding it.  Watch for more Section 230 cases in 2012 as courts continue to explore the outer boundaries of this critically important but controversial statute.You don’t need a crystal ball to see that mobile apps will continue to generate much of the growth in social network use and Internet use in general in 2012.  Perhaps more interesting is the question of what form those apps will take and where users will get them. Various app stores and marketplaces, large and small, will continue to offer consumers many choices to shop for apps for different mobile platforms. And the emergence of HTML5-based apps as an alternative to native apps adds another dimension to the issue.  We will likely see continued volatility in this area in 2012, but, if we were going to make a prediction — and that’s what we’re doing here, right? — our money is on HTML5-based apps to start taking market share from native apps in the coming year.As the major global social media platforms vie for local eyeballs, we foresee more announcements like Twitter’s recently-reported arrangement withMixi,Japan’s long-time favorite social media platform, to collaborate on new products and services. Partnerships like this, coupled with geographic expansion (Twitter opened an office inTokyo in early 2011), could help the leading U.S. social media providers to establish brand recognition and ultimately market share in countries that are still ruled by homegrown incumbents.

Aaron is the chair of the firm’s Technology Transactions Group and co-chair of the Interactive + Digital Media Group. He advises clients on a wide range of complex transactions involving intellectual property and technology, including structuring and negotiating strategic licensing, development, collaboration, procurement, and distribution deals.

Aaron Rubin

Editor’s Predictions for 2012

To ring in the New Year, the Socially Aware editors provide their predictions regarding social media law and business developments in the coming year (please ke

Editor’s Predictions for 2012

On November 29, 2011, the Federal Trade Commission (“FTC”) <a href="http://www.ftc.gov/opa/2011/11/privacysettlement.shtm">announced</a> a proposed order against Facebook that builds upon both the FTC’s recommendations from its 2010 draft privacy report and precedents set in the order that it recently imposed on Google.  Any business that collects personal information from consumers should pay close attention to this action because it makes clear that:<ul><li>The FTC will continue to remain vigilant in holding companies to their privacy-related promises to consumers.  The FTC will pay particular attention when those promises involve consumers’ choices regarding their personal information, and it will continue to look for and prosecute companies who have certified their compliance with the U.S./EU Safe Harbor (allowing personal information collected in the EU to be transferred to the US) yet fail to abide by the principles underlying the Safe Harbor;</li><li>The FTC will continue to require opt-in consent for material changes to a company’s privacy practices.  This is not a new development, but it is worth repeating that the FTC has not backed away from its assertion that, when a company changes its privacy practices in a material way, it must obtain consumers’ opt-in consent to those changes before applying them retroactively (i.e., to information already collected);</li><li>The FTC has a robust new template for privacy orders.  The FTC will continue to impose onerous injunctive relief on companies that do not abide by their own privacy promises, including the obligation — even where there has been no alleged data breach — to obtain an independent privacy audit every other year for 20 years; and</li><li>The FTC will continue to require companies subject to a privacy order to implement and maintain a comprehensive “privacy by design” program and, in fact, may begin to expect this from all companies.  In its 2010 draft privacy report, the FTC proposed that businesses make privacy and data security a routine consideration by adopting a “<a href="http://en.wikipedia.org/wiki/Privacy_by_Design">privacy by design</a>” approach.  The report has not yet been finalized, but that has not stopped the FTC from moving this proposal closer toward becoming a legal requirement by way of its enforcement actions against Google and Facebook (the FTC often expresses its “expectations” of industry through settlement agreements).  We take the inclusion of a “privacy by design” requirement in both orders to mean that the FTC thinks that all businesses should adopt such procedures and that, eventually, the FTC is likely to view a failure to adopt such procedures as deceptive or unfair, in violation of the FTC Act.</li></ul>The proposed order would settle charges that a variety of Facebook’s information practices were deceptive or unfair.  Highlights of the complaint and proposed order are summarized below.  The proposed order was open for public comment until December 30, 2011; that period having closed, the FTC will now determine whether to make its order final or to modify its requirements.The FTC’s Complaint The FTC’s complaint against Facebook contains eight counts, each of which underscores the theme repeated in the FTC’s privacy enforcement actions over the years:  Businesses must comply with the privacy-related promises that they make to their customers.  Here, the FTC alleged that Facebook failed to comply with promises made to its users in a variety of contexts over time.  Specifically:<ul><li>Facebook’s privacy settings: Access to personal information.  Facebook promised its users that, through the choices that they made in their Profile Privacy Pages, they could limit the categories of people who could access their personal information.  According to the FTC, however, users’ choices were meaningless because Facebook permitted third-party applications used by a user’s Facebook friends to access the user’s personal information — including marital status, birthday, town, schools, jobs, photos, and videos — regardless of the privacy settings chosen by the user.  The FTC has therefore alleged that the company’s representations were deceptive.</li><li>Facebook’s privacy settings: Overriding user choice.  Two counts in the FTC’s complaint address privacy policy changes that Facebook made in December 2009 — changes that Facebook claimed would not only give users more control over their personal information but also allow them to keep their existing privacy settings.  According to the FTC, contrary to those promises, some information designated by users as private (such as a friend list) was actually made public under the new policy.  The FTC has charged that this was deceptive because Facebook overrode users’ existing privacy choices without adequate disclosure. The FTC has further charged that the change constituted an unfair practice because Facebook retroactively applied material changes to personal information it had already collected from users without first obtaining their consent.  In the FTC’s view, the practice met the standard for unfairness because it “has caused or has been likely to cause substantial injury to consumers, was not outweighed by countervailing benefits to consumers or to competition, and was not reasonably avoidable by consumers.”</li><li>Scope of applications’ access to user information.  The FTC has alleged that, for more than three years from the debut of applications on the Facebook platform, Facebook deceived its users about the scope of the profile information accessible to apps.  Specifically, Facebook told users that an app would have access to only the information “that it requires to work.”  The FTC has charged that this promise was deceptive because, in many instances, Facebook gave apps unrestricted access to user profile information, including information that such apps often did not need to operate.</li><li>Advertisers’ receipt of user information.  According to the FTC’s complaint, Facebook represented to users numerous times that it would not share their information with advertisers without the users’ consent.  For instance, in its Statement of Rights and Responsibilities, Facebook promised:  “We don’t share your information with advertisers unless you tell us to. . . Any assertion to the contrary is false. Period . . . we never provide the advertiser any names or other information about the people who are shown, or even who click on, the ads.”  The FTC has alleged that this representation and others like it were deceptive because, from at least September 2008 until the end of May 2010, Facebook’s site was designed and operated such that the User ID of a user who clicked on an advertisement was, in many cases, shared with the advertiser.</li><li>Facebook’s “Verified Apps” program.  Facebook promised its users that, under its “Verified App” program, Facebook reviewed apps so as to “offer extra assurances to help users identify applications they can trust — applications that are secure, respectful and transparent, and have demonstrated commitment to compliance with [Facebook] policies.”  According to the FTC, however, because Facebook did not take any steps to verify an app in any of these ways, its promise was deceptive.</li><li>Photo and video deletion.  Facebook told users that, when they deactivated or deleted their accounts, their photos and videos would be inaccessible to others.  The FTC has alleged, however, that Facebook continued to make available the photos and videos of both deactivated and deleted accounts to third parties, and, accordingly, the company’s promises were deceptive.</li><li>Compliance with the U.S.-EU Safe Harbor Framework.  The FTC has alleged that Facebook misrepresented its compliance with its Safe Harbor certification because — as described above — it failed to give its users notice and choice before using their information for a purpose different from that for which it was collected, in violation of the “Notice” and “Choice” principles required of Safe Harbor certified companies.  Because Facebook’s Safe Harbor certification represented to consumers that Facebook was compliant with the principles, the FTC has charged that its failure to comply with them was unfair or deceptive.</li></ul>The Proposed Settlement AgreementNo Privacy or Security Misrepresentations.  Like all FTC orders settling charges of deception, the proposed order would prohibit Facebook from future misrepresentations. Specifically, the order would enjoin Facebook from express and implied misrepresentations about how it maintains the privacy or security of users’ information, including:  (1) the extent to which a user can control the privacy of his or her information; (2) the extent to which Facebook makes user information available to third parties; and (3) the extent to which Facebook makes information accessible to third parties after a user has terminated his or her account.Opt-In Consent for New Disclosures.  The proposed settlement agreement would require Facebook to obtain users’ opt-in consent before sharing their information with a third party in a way that materially exceeds the restrictions imposed by the users’ privacy settings.  This obligation ratifies a requirement that the FTC first imposed against Gateway Learning in 2004 and which it has repeated numerous times since then:  A company that makes a material change to its privacy practice must obtain affected individuals’ opt-in consent to that change before applying it retroactively (i.e., to information already collected).  The proposed order specifies the way in which Facebook must obtain such consent.  It must:  (1) clearly and conspicuously disclose to the user, separate and apart from any privacy policy or similar document, (a) the categories of information that will be disclosed, (b) the identity or categories of the recipients, and (c) the fact that such sharing exceed the restrictions imposed by the user’s privacy settings; and (2) obtain the user’s affirmative express consent to the disclosure.Deletion of “Deleted” Content.  The proposed settlement would require Facebook to implement procedures reasonably designed to ensure that the information of a user who has deleted his or her information or deleted or terminated his or her account is not accessible by any third party.Privacy by Design.  Like the FTC’s order against Google, the proposed Facebook order includes a “privacy by design” provision that would require Facebook to implement and maintain a comprehensive privacy program that (1) addresses the privacy risks related to the development and management of both new and existing products and services and (2) protects the privacy of user information.  Specifically, Facebook would have to:<ul><li>designate one or more responsible employees;</li><li>identify reasonably foreseeable material risks that could result in the unauthorized collection, use or disclosure of user information;</li><li>design and implement reasonable controls and procedures to address identified risks and regularly test them;</li><li>develop and implement reasonable steps to select service providers that will adequately protect user privacy and contractually require them to maintain appropriate protections; and</li><li>evaluate and adjust the privacy program in light of the testing required by it, any material change to Facebook’s operations, or any other circumstances that may have a material impact on the program’s effectiveness.</li></ul>In its 2010 draft privacy report, the FTC proposed that businesses make privacy and data security a routine consideration by adopting a privacy by design approach.  Although it has not yet finalized the report, the FTC has moved this proposal closer to becoming a legal requirement through both its proposed order and its recent order against Google.  The FTC often expresses its expectations of industry through a settlement agreement.  For this reason, we take the inclusion of a privacy by design requirement in both orders to mean that the FTC thinks that all businesses should adopt such procedures and that, eventually, the FTC is likely to view a failure to have them as deceptive and/or unfair, in violation of the FTC Act.Biannual Audits for 20 Years.  The proposed settlement agreement would require Facebook to obtain an independent privacy audit every other year for 20 years.  In light of the fact that this is the second time that the FTC has imposed such relief this year (after the Google matter), we expect that the 20-year audit requirement along with the privacy by design provision, will become a staple of FTC privacy settlements.Safe Harbor Provisions.  The proposed settlement marks the second time that the FTC has held a company accountable for its alleged failure to comply with substantive privacy provisions of the US/EU Safe Harbor framework.  (The first was in the Google action.)  The charges serve as an important reminder that Safe Harbor certification constitutes a representation to consumers that, if false, is actionable.  The proposed order would bar Facebook from misrepresenting its compliance with the Safe Harbor or any other privacy or security compliance program.Key Take Aways The FTC’s complaint and proposed order against Facebook are noteworthy because they reinforce the precedents that the FTC set in its action against Google, thereby sending the following unmistakable signals to the market:<ul><li>The FTC will continue to hold companies to their privacy promises and apply strong injunctive relief where it finds that the promises are false;</li><li>The FTC continues to believe that a company must obtain affected consumers’ affirmative consent to new privacy practices applied retroactively;</li><li>The FTC will continue to look for and prosecute companies’ failures to abide by the principles underlying their US/ EU Safe Harbor certifications;</li><li>The FTC has a new template for privacy settlement agreements — one that requires a privacy by design approach to business, as well as independent biannual audits for 20 years; and</li><li>The FTC is beginning to consider privacy by design as a requirement under Section 5 of the FTC Act, which prohibits unfair and deceptive acts and practices.</li></ul>

Proposed Facebook Settlement Underscores the FTC’s Privacy Priorities

On November 29, 2011, the Federal Trade Commission (“FTC”) announced a proposed order against Facebook that builds upon both the FTC’s recommendations from its 

Proposed Facebook Settlement Underscores the FTC’s Privacy Priorities

Plenty of press attention has been given to social media sites’ views on whether their users can use “handles” or pseudonyms instead of their real names.  But much of the Internet’s social conversation remains dependent upon that dot-com staple, the anonymous message board.  In the recent case of <a href="http://caselaw.findlaw.com/ny-supreme-court/1578640.html">Varrenti v. Gannett Co., Inc.</a>, a New York trial court had an opportunity to opine on the standard for compelling an online service provider (OSP) to disclose the identities of anonymous Internet posters in view of competing <a href="http://www.law.cornell.edu/wex/First_amendment">First Amendment</a> considerations.  However, the court punted on that issue, instead basing its decision on the far narrower question of whether plaintiffs stated a prima facie cause of action against the anonymous defendants — and leaving the standard for discovery of anonymous Internet users’ real identities unsettled in New York, just as it is nationwide.A variety of tests for compelling the disclosure of the identity of an anonymous Internet user have emerged over the past decade.  One approach is the five-factor balancing test established by a New York federal court in <a href="http://scholar.google.com/scholar_case?case=14955773971395308767&q=326+F.Supp.2d+556&hl=en&as_sdt=2002">Sony Music Entertainment Inc. v. Does 1-40</a>.  Under the Sony Music test, a court is required to weigh the following five factors in order to assess the need to disclose an anonymous Internet user’s identity:<ul><li>Is there a concrete showing of a prima facie claim of actionable harm?</li><li>Is the discovery request sufficiently specific to lead to identifying information?</li><li>Is there an absence of alternative means to obtain the subpoenaed information?</li><li>Is there a central need for the subpoenaed information to advance the claim?</li><li>Does the anonymous Internet user have a reasonable expectation of privacy?</li></ul>An OSP’s terms of service agreement can play into the fifth prong of the Sony Music test.  In Sony Music, for example, the OSP’s terms of service specifically reserved the right to disclose any information necessary to satisfy any law.  Because the same terms also expressly prohibited users from transmitting material in violation of copyright law, the court found that the anonymous defendants had little expectation of privacy when using the service to download and distribute over peer-to-peer networks, sound recordings owned by third parties without permission of the copyright holders. Such a limited expectation of privacy, in conjunction with the plaintiff’s strong prima facie claim of copyright infringement and the plaintiff’s demonstrated need for the identifying information to advance its claim, outweighed any limited First Amendment protections that the service users might otherwise have.Another test for whether the disclosure of an anonymous Internet user’s identity can be compelled, is the four-factor test invoked by the Appellate Division of the New Jersey Superior Court in Dendrite International, Inc. v. Doe No. 3.  In the lower court, Dendrite had sought to discover the identity of an anonymous poster on a Yahoo! Internet message board devoted to a discussion of Dendrite’s stock performance.  Dendrite alleged that the poster defamed the company and misappropriated trade secrets by making false statements about Dendrite having changed its revenue recognition policy, Dendrite’s contracts being structured to defer income and Dendrite’s lack of competitiveness, as well as by alleging that Dendrite’s president was secretly and unsuccessfully “shopping” the company.  The lower court judge found that the plaintiff was not entitled to discovery of the anonymous poster’s identity because it had failed to show harm caused by the anonymous postings — a required element for stating a prima facie case of defamation.On review, the Appellate Division adopted, with modifications, a four-factor test that had been applied by the federal district court in the Northern District of California in <a href="https://cyber.harvard.edu/property00/domain/Sees.html">Columbia Insurance Company v. Seescandy.com</a>.  Under this test, a trial court is permitted to order the disclosure of an anonymous Internet user’s identity if:<ul><li>The plaintiff makes efforts to notify the user that he or she is the subject of a subpoena, and affords the user a reasonable opportunity to file and serve opposition;</li><li>The plaintiff identifies and sets forth the exact statements purportedly made by the anonymous user that allegedly constitute actionable speech;</li><li>The plaintiff has asserted a prima facie cause of action against the defendant and produced sufficient evidence to support each element of the action; and</li><li>The strength of the prima facie case presented, and the need for the disclosure of the defendant’s identity, outweigh his or her First Amendment right of anonymous free speech.</li></ul>The fourth prong of this Dendrite test is intended to be a “flexible, non-technical, fact-sensitive mechanism” that gives courts ample discretion to evaluate whether disclosure of the anonymous user’s identity is necessary.  Therefore, even though the lower court judge in Dendrite may have taken a stricter approach than normal to the “harm” element of the test (particularly when applying motion-to-dismiss standards), the Appellate Division determined that the judge’s analysis of the claim was still consistent with that element of the test — and after determining that the record supported the lower court’s finding that there was no nexus between the anonymous postings and fluctuations in Dendrite’s stock prices, it affirmed the finding and refused to permit discovery of the anonymous poster’s identity.At least one court has found that the nature of the speech involved should be the driving force in selecting the test for discovering the identity of an anonymous Internet user.  The <a href="http://www.ca9.uscourts.gov/">Ninth Circuit</a> has held that a stricter test for unmasking “John Doe” Internet publishers is appropriate when the speech at issue is non-commercial.Under this test, originally established by the Delaware Supreme Court in <a href="https://www.eff.org/document/doe-v-cahill-delaware-supreme-court-decision">Doe v. Cahill</a>, a plaintiff may discover an anonymous speaker’s identity by both giving or attempting to give notice to the speaker, and presenting a prima facie case that can survive a hypothetical motion for summary judgment.  As reported in our August 2010 issue, the trial court in <a href="http://www.ca9.uscourts.gov/datastore/opinions/2011/01/07/09-71265.pdf">Quixtar, Inc. v. Signature Management TEAM, LLC</a>, used this test to order the disclosure of the identities of anonymous speakers who had made allegedly false and disparaging statements about the plaintiff company on third-party blogs and in online videos.  On appeal, the Ninth Circuit found that the district court’s application of the Cahill test was not appropriate because the speech involved related to a non-compete provision in a contract, which was not express political speech entitled to greater protection.  However, because the trial court’s decision to apply the Cahill test did not constitute clear error, the Ninth Circuit nonetheless refused to vacate the trial court’s order.  It is unclear whether courts in other jurisdictions have adopted the approach of choosing a test based on whether the speech at issue is commercial or non-commercial.The recent Varrenti decision reminds us that the assertion of a prima facie cause of action remains a key factor in determining whether the identities of anonymous Internet users are discoverable, no matter which test reigns.  In Varrenti, members of the <a href="http://www.brockportpolice.org/">Village of Brockport Police Department</a> brought a defamation action against the <a href="http://www.democratandchronicle.com/">Democrat & Chronicle</a>, a local newspaper publisher in Rochester, New York, and four Internet users who posted anonymous comments on the newspaper’s website about the plaintiffs’ competence, integrity and actions.  The plaintiffs argued that the Sony Music test should apply, while the defendant argued that the Dendrite test should apply.  The New York Supreme Court elected not to address the issue of which test applied, instead focusing on the common factor from both tests — that is, whether the plaintiffs had stated a prima facie cause of action for defamation.  Because the tone and objective of the anonymous statements were critical of the plaintiffs and the comments were published in a web forum that invited newsreaders to share opinions, the court found as a threshold matter that the comments were protected expression that could not form the basis of a defamation claim, and that, therefore, no prima facie case had been stated.In basing its decision solely on the context in which the comments were made, the Varrenti court avoided addressing other test factors, bringing no further clarity on which standard for discovering the identity of anonymous Internet users should apply.  Until the various standards for discovery of anonymous Internet users’ identity converge, then, the question of whether an OSP can be compelled to disclose an Internet user’s identity rests largely on the plaintiff’s ability to state a prima facie claim of actionable harm — worth keeping in mind for companies pursuing a claim against a user of a message board or other social media service.

Standard for Discovery of Anonymous Internet Users’ Identities Remains in Flux

Plenty of press attention has been given to social media sites’ views on whether their users can use “handles” or pseudonyms instead of their real names.  But m

Standard for Discovery of Anonymous Internet Users’ Identities Remains in Flux

Facebook is facing renewed scrutiny following efforts to explain its data collection practices, which include tracking where and when members and nonmembers are browsing after they visit a Facebook page.At the end of 2011, USA Today reported on how Facebook tracks user browsing habits, following in-depth interviews with senior Facebook engineers and spokespersons. According to those interviewed, any Facebook user who visits a Facebook page receives a “browser cookie” with a unique alphanumeric identifier; this cookie is then used by Facebook to track and create a time-stamped record of every visit by that user to any other website that utilizes a Facebook plug-in (such as “like” buttons), even if the user is logged out or not a member of Facebook.  When a user is logged in to Facebook, an additional “session cookie” is activated, allowing Facebook to collect specific profile and system information (such as the user’s email address and list of friends), user preferences and a time-stamped record of websites visited by the user that contain Facebook plugins.  While Facebook only receives a user’s personal information alongside his or her browsing history when the user is logged in to the Facebook service, users frequently remain logged in for long periods of time (merely closing a browser window or tab often is insufficient to end a session—rather, a user must affirmatively select the “log out” option made available by Facebook).According to Facebook, this tracking information is used to boost security and to “enhance user experience” but not to target ads to Facebook users.  Additionally, Facebook claims that it deletes tracking information that is more than 90 days old. However, with Facebook reportedly gearing up for a <a href="http://www.forbes.com/sites/erikamorphy/2011/11/22/about-that-imminent-100b-facebook-ipo/">IPO in 2012</a>, users and critics are concerned that the pressures of the public market will result in more aggressive leveraging of users’ browsing habits and associated data in an effort to maximize profits.Meanwhile, courts have been actively adjudicating claims against online service providers that may be using (or abusing) user information.  In November 2011, a LinkedIn user’s class action lawsuit against LinkedIn for allegedly disclosing the user’s browsing history to third parties was dismissed for lack of constitutional standing to sue.  The plaintiff in the Northern District of California case, Low v. LinkedIn Corp., claimed that he was “embarrassed and humiliated” by LinkedIn’s alleged disclosures of “valuable personal property” (his browsing history and related personal information).  The court found that the plaintiff’s allegations lacked particularity in failing to explain what personal information was disclosed to third parties, how it was disclosed, and to what extent it actually resulted in economic injury.  Failure to allege “injury-in-fact” resulted in a successful motion to dismiss for LinkedIn; however, the court has provided the plaintiff with an opportunity to amend his complaint to allege “particularized” examples of his actual injury.In the past, plaintiffs in the Northern District of California have been able to survive standing challenges when pursuing online service providers for unauthorized disclosure of their personal information.  In April 2011, the plaintiff in Claridge v. RockYou, Inc. survived a motion to dismiss on standing grounds on the theory that personal information is personal property having monetary value.  However, just three days following the successful motion to dismiss in Low, Claridge and RockYou <a href="http://www.scribd.com/doc/72823685/Claridge-v-RockYou-Settlement-Agreement">settled the dispute</a> (subject to court approval), with RockYou consenting to an injunction requiring two privacy/security audits over the next three years.  Moreover, in similar litigation in the Northern District of California, In re Facebook Privacy Litigation, the court was less amenable to treating users’ personal information stored on Facebook as valuable personal property (for an in-depth discussion of these two cases, see our June 2011 issue of Socially Aware).While courts wrestle with users’ attempts to challenge how online service providers use their personal information, both Congress and the World Wide Web Consortium (W3C) are independently moving forward with efforts to create new standards to govern online tracking.  In May 2011, Sen. John D. Rockefeller introduced <a href="http://www.washingtonpost.com/blogs/post-tech/post/sen-rockefeller-introduces-do-not-track-bill-for-internet/2011/05/09/AF0ymjaG_blog.html">the Do-Not-Track Online Act of 2011</a>, a law that, if enacted, would direct the FTC to adopt rules regarding website compliance with Internet users’ activation of a “do not track” preference online.  In November 2011, W3C published <a href="http://www.w3.org/News/2011#entry-9257">two “first drafts”</a> for Web standards relating to “tracking preference expression” and how websites may engage with users who have opted into the newly conceived “do not track” user preference.  The W3C, which develops Web standards and guidelines for the Web, is building these new privacy standards with the expectation that industry stakeholders such as “browser vendors, content providers, advertisers, search engines” among others will adopt the new standards by mid-2012.

istock_000002456857small1-300x300-1.jpg

Tracking the Trackers: Social Media Companies Face Pressure for Tracking Users’ Browsing Habits

Tracking the Trackers: Social Media Companies Face Pressure for Tracking Users’ Browsing Habits

Facebook is facing renewed scrutiny following efforts to explain its data collection practices, which include tracking where and when members and nonmembers are