Privacy Concerns in Marketing and Commercial Communications

23
Privacy Concerns in Marketing Privacy Concerns in Marketing Privacy Concerns in Marketing Privacy Concerns in Marketing and Commercial Communications and Commercial Communications and Commercial Communications and Commercial Communications Bennet Kelley Liisa M. Thomas June 2, 2009 June 2, 2009 June 2, 2009 June 2, 2009

description

PLI Privacy and Data Security Law Institute (June 2, 2009).

Transcript of Privacy Concerns in Marketing and Commercial Communications

Page 1: Privacy Concerns in Marketing and Commercial Communications

Privacy Concerns in Marketing Privacy Concerns in Marketing Privacy Concerns in Marketing Privacy Concerns in Marketing and Commercial Communicationsand Commercial Communicationsand Commercial Communicationsand Commercial Communications

Bennet Kelley Liisa M. Thomas

June 2, 2009June 2, 2009June 2, 2009June 2, 2009

Page 2: Privacy Concerns in Marketing and Commercial Communications

In the Beginning . . .

Pyramids of Giza, Egypt.© Digital Vision/Getty Images

Page 3: Privacy Concerns in Marketing and Commercial Communications

There was California . . .

“We are saying that unsolicited e-mail cannot be sent and there are no loopholes . . . We don't differentiate and there are no loopholes . . . We don't differentiate between Disney and Viagra.

If you go out and rent a list of e-mail addresses, by definition you are not a legitimate business. You are the person we are trying to stop.”

Former California State Senator Kevin MurrayAuthor of SB 186

Page 4: Privacy Concerns in Marketing and Commercial Communications

84 days later . . .

President George W. Bush signing the CAN-SPAM Act (Dec. 16, 2003).

CCCControlling the ontrolling the ontrolling the ontrolling the AAAAssault of ssault of ssault of ssault of NNNNonononon----SSSSolicited olicited olicited olicited PPPPornography ornography ornography ornography AAAAnd nd nd nd MMMMarketing arketing arketing arketing ActActActAct

Page 5: Privacy Concerns in Marketing and Commercial Communications

CAN-SPAM Act of 2003

CAN-SPAM IS . . .

• An antiAn antiAn antiAn anti----fraud and disclosure fraud and disclosure fraud and disclosure fraud and disclosure statutestatutestatutestatute

• Applies to an email where the Applies to an email where the Applies to an email where the Applies to an email where the “primary purpose” is commercial “primary purpose” is commercial “primary purpose” is commercial “primary purpose” is commercial advertisement or promotion of a advertisement or promotion of a advertisement or promotion of a advertisement or promotion of a product or serviceproduct or serviceproduct or serviceproduct or service

CAN-SPAM DOES NOT . . .

• “Can Spam” “Can Spam” “Can Spam” “Can Spam” –––– except for wireless spamexcept for wireless spamexcept for wireless spamexcept for wireless spam

• Include a “Do Not Email Registry”Include a “Do Not Email Registry”Include a “Do Not Email Registry”Include a “Do Not Email Registry”

• Impose an “ADV” labeling requirementImpose an “ADV” labeling requirementImpose an “ADV” labeling requirementImpose an “ADV” labeling requirement

product or serviceproduct or serviceproduct or serviceproduct or service

• Applicable to bulk and single Applicable to bulk and single Applicable to bulk and single Applicable to bulk and single emailsemailsemailsemails

• Create a general private right of Create a general private right of Create a general private right of Create a general private right of actionactionactionaction

• Generate stimulating cocktail party Generate stimulating cocktail party Generate stimulating cocktail party Generate stimulating cocktail party conversationsconversationsconversationsconversations

Page 6: Privacy Concerns in Marketing and Commercial Communications

Regulatory Timeline

2004: 2004: 2004: 2004: FTC Final Rule on Adult Labeling

FCC CAN-SPAM Rules

2005: 2005: 2005: 2005: FTC (1) Final Rule on Primary Purpose of Email; and

(2) Proposed Discretionary Rules

2006200620062006:

2007:2007:2007:2007:

2008: 2008: 2008: 2008: FTC Final Discretionary Rules

Page 7: Privacy Concerns in Marketing and Commercial Communications

Determining When CAN-SPAM Applies

Page 8: Privacy Concerns in Marketing and Commercial Communications

CANCANCANCAN----SPAMENCLATURESPAMENCLATURESPAMENCLATURESPAMENCLATURESENDERSENDERSENDERSENDER -- means a person who initiates a commercial e-mail and whose product, service, or Internet web site is advertised or promoted by the message.

INITIATE INITIATE INITIATE INITIATE -- means to originate or transmit, or procure the origination or transmission of, such an e-mail message.

PROCUREPROCUREPROCUREPROCURE -------- means intentionally to pay or PROCUREPROCUREPROCUREPROCURE -------- means intentionally to pay or induce another person to initiate the message on one's behalf, while knowingly or consciously avoiding knowing the extent to which that person intends to comply with this Act.

Page 9: Privacy Concerns in Marketing and Commercial Communications

CAN-SPAM Principal Requirements

Page 10: Privacy Concerns in Marketing and Commercial Communications

FTC: must give the recipient enough information to know who is sending the message

From Line

Not deceptive to use multiple domainsKleffman v. Vonage Holding Corp. (C.D. Cal. 2007).

Not misleading to use non-corporate address where domain may be checked using “Who Is” Gordon v. Virtumundo, Inc. (W.D. Wash. 2007)

Fake address can get you in the dog house.

Page 11: Privacy Concerns in Marketing and Commercial Communications

Must Be a Must Be a Must Be a Must Be a Sender Sender Sender Sender Under CANUnder CANUnder CANUnder CAN----SPAMSPAMSPAMSPAM• Name must be in the “From” Line

Designated Sender Rule

Cannot designate Cannot designate Cannot designate Cannot designate NonNonNonNon----SenderSenderSenderSender

• Must be Responsible for CAN-SPAM compliance

• Dropped requirement that Designated Sender be in control of the content or the mailing list used

Page 12: Privacy Concerns in Marketing and Commercial Communications

12

Page 13: Privacy Concerns in Marketing and Commercial Communications

Subject Lines

• Senate Report

– test is whether the person initiating the message knows test is whether the person initiating the message knows test is whether the person initiating the message knows test is whether the person initiating the message knows that the subject heading would be likely to mislead a that the subject heading would be likely to mislead a that the subject heading would be likely to mislead a that the subject heading would be likely to mislead a that the subject heading would be likely to mislead a that the subject heading would be likely to mislead a that the subject heading would be likely to mislead a that the subject heading would be likely to mislead a reasonable recipient about a material fact regarding the reasonable recipient about a material fact regarding the reasonable recipient about a material fact regarding the reasonable recipient about a material fact regarding the content or subject matter of the messagecontent or subject matter of the messagecontent or subject matter of the messagecontent or subject matter of the message

• “New MySpace Phone” subject line misleads consumers by creating false sense of sponsorship by MySpace.

– MySpace, Inc. v. The Globe.com, Inc. MySpace, Inc. v. The Globe.com, Inc. MySpace, Inc. v. The Globe.com, Inc. MySpace, Inc. v. The Globe.com, Inc. ((((C.D. Cal. Feb. 27, 2007)C.D. Cal. Feb. 27, 2007)C.D. Cal. Feb. 27, 2007)C.D. Cal. Feb. 27, 2007)

• “Free Gift” subject lines violate CAN-SPAM– FTC v. FTC v. FTC v. FTC v. AdteractiveAdteractiveAdteractiveAdteractive, , , , Inc. (Inc. (Inc. (Inc. (C.D. Cal. 2007)C.D. Cal. 2007)C.D. Cal. 2007)C.D. Cal. 2007)

Page 14: Privacy Concerns in Marketing and Commercial Communications

Opt-Out Mechanism

• Opt-Out Basics– May offer May offer May offer May offer optionsoptionsoptionsoptions, but total opt, but total opt, but total opt, but total opt----out must be out must be out must be out must be

one of one of one of one of themthemthemthem

– 10 days to remove10 days to remove10 days to remove10 days to remove

– No further use of email address after No further use of email address after No further use of email address after No further use of email address after optoptoptopt----out out out out

– Separate Business Units: Separate Business Units: Separate Business Units: Separate Business Units: OptOptOptOpt----out out out out for Saab not optfor Saab not optfor Saab not optfor Saab not opt----out for all out for all out for all out for all of GMof GMof GMof GM

• Discretionary Regs– Cannot impose any conditions on optCannot impose any conditions on optCannot impose any conditions on optCannot impose any conditions on opt----out out out out

requests (requests (requests (requests (e.ge.ge.ge.g, fee or provide information, fee or provide information, fee or provide information, fee or provide information))))

Page 15: Privacy Concerns in Marketing and Commercial Communications

CAN-SPAM Plaintiffs

No Consumer Private Right of Action

FTC & State AGs

Internet Access Service Provider (IASP) Adversely Effected by Violation Must demonstrate substantial harm

15

Civil Penalties $25 – $250 per email $2 million maximum

Damage Adjustments Treble damages if willful Reduction if violation occurred despite

commercially reasonable efforts to maintain compliance”

Page 16: Privacy Concerns in Marketing and Commercial Communications

Faux ISPs Established to Prosecute

CAN-SPAM Actions

CAN-SPAMIGATORS

Small, free service can qualifyHypertouch v. Kennedy-Western University, 2006 WL 648688 (N.D. Cal. 2006)

But must demonstrate substantial harm - e.g., bandwidth, hardware, connectivity, overhead, staffing or equipment costs Asis Internet Services, v. Optin Global, Inc., 2008 WL 1902217 (N.D. Cal. March 27, 2008 )

Page 17: Privacy Concerns in Marketing and Commercial Communications

Sender Liability

FTC unsuccessful in seeking strict liability

Advertiser liable if “actual knowledge, or by consciously avoiding knowing” about affiliate violationsabout affiliate violations

Strict anti-spam policies and policing of affiliates defeated allegation of intent.Hypertouch v. Kennedy-Western University, 2006 WL 648688 (N.D. Cal. 2006)

– No duty to investigateAsis Internet Services, v. Optin Global, Inc., 2008 WL 1902217 (N.D. Cal. March 27, 2008 )

Page 18: Privacy Concerns in Marketing and Commercial Communications

CAN-SPAM PREEMPTS ALL

STATE REGULATION OF

EMAIL EXCEPT STATE LAWS

• Regulating falsity or deception in email

• Not specific to email, including State trespass, contract, or tort law; or

• Other State laws to the extent that those laws relate to acts of fraud or computer crime

Page 19: Privacy Concerns in Marketing and Commercial Communications

• Misrepresentation must be materialOmega World Travel, Inc. v. Mummagraphics, Inc. (4th Cir. 2006).

• States cannot dictate form of from lineKleffman v. Vonage Holding Corp. (C.D. Cal. 2007); Gordon v. Virtumundo, Inc.(W.D. Wash. 2007).

Rulings On State Spam

Regulation

• Courts split on whether state regulation must be based on traditional notions of fraud

• Yes. ASIS Internet Service v. Optin Global, Inc. (N.D. Cal. 2008); Hypertouch v. ValueClick, (LA Super. Ct. May 4, 2009).

• No. ASIS Internet Service v. Vista Print (N.D.Cal. 2009).

• First Amendment requires that it not impinge non-commercial emailVirginia v. Jaynes (Va. 2008).

Page 20: Privacy Concerns in Marketing and Commercial Communications

Preemption’s Back Door?• Utah/Michigan Utah/Michigan Utah/Michigan Utah/Michigan

Child Registry LawsChild Registry LawsChild Registry LawsChild Registry Laws– Makes sending prohibited email a “computer

crime”– Free Speech Coalition, Inc. v. Shurtleff,

Utah Federal Court refused to enjoin law finding it fell within exception for computer crime fell within exception for computer crime

• DOJ filed brief supporting this position

• New Colorado Spam LawNew Colorado Spam LawNew Colorado Spam LawNew Colorado Spam Law– Makes violation of CAN-SPAM a violation of

state deceptive practices and computer fraud laws– Higher Penalties– Is this a backdoor to creating private right of

action under CAN-SPAM?

Page 21: Privacy Concerns in Marketing and Commercial Communications

Selected Cases: CANSelected Cases: CAN--SPAM ActSPAM ActAdvertiser LiabilityAdvertiser LiabilityAdvertiser LiabilityAdvertiser LiabilityAdvertiser LiabilityAdvertiser LiabilityAdvertiser LiabilityAdvertiser Liability

ASIS Internet Services, v. ASIS Internet Services, v. OptinOptin Global, IncGlobal, Inc., 2008 WL ., 2008 WL 1902217 (N.D. Cal. March 27, 2008 )1902217 (N.D. Cal. March 27, 2008 )

HypertouchHypertouch v. Kennedyv. Kennedy--Western UniversityWestern University, 2006 WL , 2006 WL 648688 (N.D. Cal. 2006)648688 (N.D. Cal. 2006)

US v. US v. CyberheatCyberheat, 2007 U.S. Dist. LEXIS 15448 (N.D. Ariz. , 2007 U.S. Dist. LEXIS 15448 (N.D. Ariz. 2007)2007)

US v. US v. ImplulseImplulse MarketingMarketing, No. CV05, No. CV05--1285RSL (W.D. 1285RSL (W.D. Wash. June 8, 2007)Wash. June 8, 2007)

From and Subject LinesFrom and Subject LinesFrom and Subject LinesFrom and Subject LinesFrom and Subject LinesFrom and Subject LinesFrom and Subject LinesFrom and Subject Lines

FTC v. FTC v. AdteractiveAdteractive, Inc, Inc., No. Case No. CV., No. Case No. CV--0707--5940 SI 5940 SI (C.D. Cal. 2007)(C.D. Cal. 2007)

Gordon v. Gordon v. VirtumundoVirtumundo, Inc, Inc., Case No. 06., Case No. 06--02040204--JCC (W.D. JCC (W.D. Wash. May 15, 2007)Wash. May 15, 2007)

KleffmanKleffman v. Vonage Holding Corpv. Vonage Holding Corp., Case No. CV 07., Case No. CV 07--2406GAFJWJX (C.D. Cal. May 23, 2007)2406GAFJWJX (C.D. Cal. May 23, 2007)

MySpace, Inc. v. The Globe.com, Inc.MySpace, Inc. v. The Globe.com, Inc. No. CV 06No. CV 06--33913391--RGK (RGK (JCxJCx) (C.D. Cal. Feb. 27, 2007)) (C.D. Cal. Feb. 27, 2007)

Page 22: Privacy Concerns in Marketing and Commercial Communications

CANCAN--SPAM Cases Pt 2SPAM Cases Pt 2

PreemptionPreemptionPreemptionPreemption

Asis Internet Services, v. Optin Global, Inc., 2008 WL 1902217 (N.D. Cal. March 27, 2008 )

Asis Internet Services v. VistaPrint USA, Inc., No. C 08-5261-SBA (N.D. Cal. May 5, 2009)

Free Speech Coalition, Inc. v. Shurtleff, No. 2:05CV949DAK, 2007 U.S. Dist LEXIS 21556 (D. Utah Mar. 23, 2007)

Gordon v. Virtumundo, Inc., Case No. 06-0204-JCC (W.D. Wash. May 15, 2007)

Hypertouch, Inc. v. ValueClick, Inc., L.A. Super. Ct. No. C081000 (May 4, 2009).

Kleffman v. Vonage Holding Corp., Case No. CV 07-2406GAFJWJX (C.D. Cal. May 23, 2007)

Omega World Travel, Inc. v. Mummagraphics, Inc., 469 F.3d 348 (4th Cir. 2006)

Virginia v. Jaynes, 666 S.E.2d 303 (Va. 2008).

Page 23: Privacy Concerns in Marketing and Commercial Communications

Bennet Kelley founded the Internet Law Center in 2007 after a decade of activity in many of the hottest internet issues including behavioral targeting, cyber squatting, internet marketing and promotions, net neutrality, privacy, spam and spyware. Prior to launching the Internet Law Center, Bennet worked in-house with companies such as ETM Entertainment Network, SpeedyClick.com, Hi-Speed Media and ValueClick.

Bennet Kelley

Bennet is Co-Vice Chair of the California Bar's Cyberspace Committee and has been a regular contributor to the Journal of Internet Law.

The Internet Law Center’s is based in Santa Monica but also has a presence in Washington, D.C. and Columbia, S.C. The firm’s e-newsletter, Monday Memo, was named one of the top 100 Internet Law resources and has been nominated for the Los Angeles Press Club’s Southern California Journalism Award for best in-house or corporate publication.

[email protected]