As we’ve discussed in a previous post, the United States lacks a comprehensive federal privacy law regulating the collection, storage, use and disclosure of personal information in the online context and lawmakers have introduced several new initiatives in an attempt to address the issue.  However, under COPPA, one of the few existing federal laws that deals with online privacy, the FTC has been flexing its muscles by regulating online (i.e., website-based), and with this case, mobile (i.e., app-based), privacy.

According to the FTC, several of W3’s apps are directed at children under the age of 13, including the popular “Emily’s Girl World”, “Emily’s Dress Up”, “Emily’s Dress UP & Shop” and “Emily’s Runway High Fashion”.  These apps encourage, but do not require, users to post comments (which could include personal information) to the Emily’s Girl World blog and to directly email their comments to “Emily”.  The FTC’s complaint states that, “in addition to the collection and maintenance of over 30,000 emails, containing email addresses, [the company has] collected, maintained, and/or disclosed personal information from over 300 Emily’s Girl World app users and 290 Emily’s Dress Up app users who have registered to submit comments.” Specifically, the FTC alleges that W3 failed to: (a) maintain or link to an online notice of its information collection, use and disclosure practices; (b) provide direct notice to parents of their practices regarding the collection, use, and/or disclosure of children’s personal information; and (c) obtain verifiable consent from parents prior to collecting, using or disclosing such information, all in violation of COPPA.

In response to the FTC action, W3 stated that its “sole purpose in collecting email data was to improve the user experience with [its] apps; we never used any email address for marketing purposes or sold it to other firms”.  The company appears to have taken immediate corrective action after receiving notice from the FTC and implemented “a strict email policy that removes any possibility of collecting and retaining email addresses, even unintentionally, from users under the age of 13”.  As part of the settlement, W3 has also agreed to delete all the personal information previously collected from children and to refrain from future violations of COPPA.

This is the second federal enforcement action made public this year over a COPPA violation which suggests that the FTC may continue to aggressively pursue privacy violations involving children.  Playdom, a Disney Enterprises subsidiary, is the first website/app developer to settle with the FTC this year over COPPA violations.  The company operates virtual world websites where users, many of whom are Children, are required to provide ages and email addresses in order to register to play online games.  They are also allowed to post their full names, email addresses, instant messenger IDs, and location data to personal profile pages and online community forums .  In May, Playdom agreed to pay $3 million in a costly settlement over FTC charges, similar to those set forth in the W3 complaint, that it collected information from children without notifying parents and obtaining prior parental consent in violation of COPPA.

Most notably for app developers and distributors, FTC Chairman Jon Leibowitz emphasized the importance of obtaining parental consent, and made clear that the app space is no different from traditional website platforms.  “The FTC’s COPPA Rule requires parental notice and consent before collecting children’s personal information online, whether through a website or a mobile app,” said Chairman Jon Leibowitz in a statement given in response to the settlement. According to Senator Amy Klouchar, who has been working to prevent deceptive in-app purchase practices on mobile devices, “Mobile apps can be great tools for kids to learn and have fun, but parents should never have to worry that their child’s personal information is being collected or violated.”

In light of the current evolving enforcement climate, developers, distributors and operators of apps and websites targeted at children that collect personal information, should, among other things, ensure that they adhere to the requirements of COPPA, including  the basic guidelines described below. Specifically, prior to collecting, using or disclosing personal information received from children under 13, developers, distributors and operators must obtain verifiable parental consent for any such collection, use or disclosure.  They should also provide notice on their apps, websites and other applicable platforms regarding the kind of information that is collected from children, how such information is used and their disclosure practices related thereto. Further, if and whenever requested by a parent (or guardian), such developers, distributors and operators must provide (a) a description of the specific types of personal information collected from that child; (b) the opportunity at any time to refuse to permit further use or maintenance in retrievable form, or future online collection, of personal information from that child; and (c) reasonable means for the parent to obtain any personal information collected from that child. In addition, COPPA rules proscribe conditioning a child’s participation in a game, the offering of a prize, or another activity on the child disclosing more personal information than is reasonably necessary to participate in such activity.

As apps continue their meteoric rise in popularity, and become, in many instances, the preferred method of digital content distribution and consumption, we will continue to monitor the FTC’s actions in both the online and mobile spaces, the new privacy initiatives making their way through Congress and what these events may ultimately mean for the current stakeholders.

The explosive popularity of tablets, smartphones and other Internet-connected consumer devices has ushered in a new technology ecosystem driven by Apps. These self-contained software programs have not only provided the stakeholders involved with a compelling way to exploit everything from movies and games to magazines and newspapers, but have created a thriving new marketplace poised for ongoing, accelerated growth. While the stakeholders are many, the myriad of complex business and legal issues facing them are no less staggering in number. For publishers, content creators, App developers, content distributors, aggregators, storefront operators and service providers, the successful navigation of a rapidly evolving landscape of shifting terms and conditions, privacy regulations, content restrictions and corresponding business considerations across multiple devices and platforms has proven a daunting but essential exercise for leveraging the economic opportunities available.

In this CLE-accredited webinar, the DigitalHHR team will explore the critical business and legal challenges associated with the development, publication, distribution, sale and use of Apps. We will discuss the contours of in-App purchases, subscription-based offerings, and “freemium” models, as well as in-App advertising and App-based ad networks. We will analyze the evolving privacy terms and conditions associated with the use of Apps, and the corresponding laws, regulations and case law impacting end user data collection, disclosure and ownership. We will also address the terms and requirements promulgated by the various platform operators, including Apple, RIM (Blackberry) and Google (Android), and how they impact stakeholders’ participation across the different App environments.

The webinar will be held on Thursday, April 7, 2011 from 12:30 p.m. to 1:30 p.m. EDT.

To register, please click here.

The Facebook disclosures were the result of a common Web standard called a referer.  As web users navigate from site to site, the referer tells the new site which page the user is coming from.  Most of the time, this is an innocuous tool used to help websites track the source of their traffic flow and customize user experience.  However, when user IDs are included in web addresses, as is the case with Facebook and other social networking sites, this practice could potentially expose the browser’s identity.  The user IDs can be used to look up public information on the user’s Facebook profile, which, depending on the selected privacy settings, could include anything from the user’s name to his age, hometown, or even photos.

Sharing any user information with advertising and data companies is a violation of Facebook’s privacy policy.  However Facebook has stated that it does not consider the sharing of IDs with application developers to be a privacy breach and that the disclosures by the applications to advertising companies were, for the most part, inadvertent and a “byproduct of how internet browsers work”.  Facebook has announced a proposed solution that would encrypt user IDs in referer headers to prevent inadvertent disclosure to third parties.  The encryption will be mandatory starting January 1, 2011.  However, the encryption only prevents accidental transmission.  Describing it as a “Web-wide problem”, Facebook states that they are looking forward to working with the Web standards community and browser developers in the future to develop a more complete fix.  

Facebook has had trouble with the disclosure of user IDs before.  In May, Facebook revealed that IDs were being sent to advertisers when users clicked on certain ads on Facebook pages.  In some cases, advertisers received the ID of the user who clicked on the advertisement, as well as the ID of the person whose page the user was viewing at the time. 

The disclosure of user IDs, which has always been a sensitive issue for companies doing business on the web, is becoming more of a hot-button issue as public awareness of the issue increases.  It has already attracted the attention of lawmakers who have asked Facebook to outline the steps it is taking to protect consumer information.  While there is no foolproof method to prevent widespread disclosures of personal information, a two-pronged approach, using both technological solutions and a careful framing of contractual protections may help mitigate the problem and avoid the possibility of increased legislative oversight or intervention.

One technological solution would be the increased use of encryption in connection with coding, storing and transmitting user IDs and other personal information.  However, while encryption could prevent unauthorized disclosures, such technological solutions must be coupled with clear contractual obligations on the part of the various stakeholders to ensure their proper use and implementation.  For example, publishers, ad service providers, search providers, developers and others who rely on the use, analysis and disclosure of user data could include in their various agreements provisions requiring that encryption and/or other data security technologies be implemented in connection with the transfer of data between the parties. 

The agreements could also include provisions that spell out how the parties may use personal data (for example, only for internal use in connection with fulfilling obligations under the underlying agreement), and more critically, include specific restrictions and prohibitions on use (for example, prohibiting the sharing of such information with third parties).  Additionally, the inclusion of provisions requiring the maintenance of records of data practices which would be available for audit might also lead to increased vigilence.  Although these measures place increased burdens on the various stakeholders, absent further technological developments, they may be the best way to convince regulators (and the public) that the industry is serious about protecting consumers’ privacy.

Websites can also take steps on their own to beef up their security policies.  In recent months, Facebook has been working to increase their protection of user data.  Following an investigation by the Canadian Privacy Commissioner, Facebook limited the access that applications have to private information.  Unless the user grants additional permission, the application can only view information in the user’s public profile.  (For our previous article on the Canadian Privacy Commissioner’s investigation, see here.)  In early October, Facebook implemented a new tool to help users control what information applications can access, in response to criticisms that its privacy settings were too complicated.  And, after these latest disclosures, Facebook announced a “clarified” privacy policy stating that user IDs cannot leave an application.  In the event that a developer needs to share information with an advertiser or content provider, they must use an anonymous identifier. 

Whether or not these revised policies actually provide more protection to users’ privacy is yet to be seen.  However, it is probably not a stretch to say that the coming months will bring similar revelations and changes across the Web.  We will continue to monitor this and other developments in the ongoing debate over privacy on the internet. 

**Kate O’Donnell, who recently joined the Firm, assisted in the preparation of this article.

• The Electronic Frontier Foundation released a “terms of service” tracker earlier this week. The tracker chronicles older and new terms of service agreements, side by side, and highlights changed provisions. The TOSBack.org site was created in part from an outgrowth of Facebook’s change in its service agreement in February that, under a broad interpretation, provided that Facebook with a license to its members’ uploaded content even after termination of membership. Following criticism in the media and by its members, Facebook backed down and provided for a termination of the license. But the episode revealed the difficulty end users have in evaluating how revised terms of service provisions can have real impact. The “terms of service” tracker currently tracks 44 sites, including Facebook, Google, WordPress, Data.gov, YouTube, GoDaddy, and eBay.
• For years, content providers have provided information to viewers for free by depending on advertising sales to support its websites. With the decline of the advertising market, advertisers have cut back on spending, forcing content providers to rethink their business model. Many websites are returning to previously used revenue models, including charging for premium services and selling real or virtual goods on its sites. GigaOM, a network of tech-oriented blogs, is one of the latest examples of this trend. GigaOM is charging for a premium subscription research service, which includes more content and analysis, while continuing to provide its basic content for free. We expect to see more business changes of this type in the future
• The increase in digital media possibilities has led traditional storefront retailers to make efforts to capitalize on digital space. Last September, Best Buy bought Napster for $121 million. Now, Best Buy is supplying capital for a new digital media investment fund managed by Fuse Capital. By doing so, Best Buy will be able to hedge its profit opportunities in this fast-changing economy with both its core retail business and its investments in digital media.
• Internet advertisers have been using trackers to follow around users. But now federal regulators are tracking the online advertisers around to ensure that they are being fair to consumers. According to Jessica Rich, the Assistant Director of the Federal Trade Commission’s Privacy & Identity Protection (USPIRG) arm, “[t]he FTC is concerned that data collection is disproportionate to the benefits that are achieved.” In December, the FTC released a draft of behavioral guidelines, calling for more transparency and user control, and allowing opt-ins for sensitive data. Few people actually opt out, however, even when given the opportunity. Yahoo told Congress last year that only 75,000 users a month even visited its privacy page to opt out of targeted ads. Microsoft’s Mike Hintze says that it is unrealistic and that if users are not going to bother to opt out, they are unlikely to opt in. He suggests that more consumer education is necessary, but most consumers just do not care.
• A recent study confirms DRM technology sometimes it makes pirates of even those who are attempting to make legal uses of content. DRM does not discriminate between preventing illegal versus legal uses. As a result, even users who want to use the content for legal purposes must violate anticircumvention laws and in essence become pirates to accomplish their goals. Advocates of the DRM technology assert that despite the inability to accommodate legal uses, there is not an anti-piracy solution that would be able to accommodate all possible legal exceptions. Unfortunately, this has left even legal content users forced to find other means, including piracy, to get around the DRM protection.

The tremendous effectiveness of video game product placement and in-game sponsorship is no surprise, with gamers maintaining high and sustained exposure to advertisements. A recent study revealed that gaming audiences are more inclined to remember and positively perceive brands featured inside video games than other advertisements and that this form of advertising is even beginning to trump the effectiveness of television advertisements. Another similar study found that, unlike advertising messages in other media, advertising in video games is seen by gamers as making the games feel more authentic and 65% of players agreed that in-game advertisements made the gaming experience feel more realistic and 55% said the advertisements “look cool”.

In this climate, your decision to dress your main video game character in, for example, a pair of Vans (or even kicks resembling Vans) could earn you a thank you note or possibly a temporary restraining order from Vans which may have an exclusive in-game licensing arrangement with Activision Blizzard, the publishers of the Tony Hawk series of skateboarding games. Make no mistake, the major video game developers and publishers are engaged in a well-funded war for market share, and licensing agreements with real-world content owners have become the norm. Whether you’re creating a sports game, a music title or a first person shooter, there is both tremendous promotional value and legitimacy that accompanies the in-game inclusion of popular names, products and places, and the respective owners now want their say as to the games in which they appear and how and under what conditions their content is featured.

Now that content owners have skin in the game (no pun intended, of course), licensing arrangements are being struck left and right–some exclusive, some non-exclusive, some royalty bearing, some royalty free. From guitar makers to gun manufactures, content owners know that placing, for example, a “Smith & Wesson” gun in the main character’s hands, as opposed to an “ACME” rifle, has the potential to sway consumers inundated with options, especially in the already crowded first person shooter genre, from one title to another. With  in-game asset licensing arrangements becoming more and more common, the traditional test for assessing trademark infringement as it relates to video games—the likelihood of confusion among consumers as to whether the assets being depicted in the video game are endorsed or associated with the title—has and will continue to be an easier hurdle for trademark owners to clear as the amount of licensing agreements pertaining to inclusion of trademarked or copyrighted works in video games increases. In other words, circumventing the licensing process in favor of a “fair use” or First Amendment defense will no longer be a viable position from a risk assessment perspective, as plaintiffs will now have an easier time demonstrating and establishing that in-game licensing arrangements have become industry standard and convey substantial commercial value.

This will be the first of many posts to come on the subject of video game licensing and clearances, as well as the legal principles and case law underlying the topic, including fair use and infringement (both for copyright and trademark) and the building blocks of the licensing agreements required to navigate the interactive gaming space.

• As online, targeted advertising becomes more and more common, the question of balancing privacy concerns and commercial demands is becoming increasingly more complex.  While website privacy policies can disclose how information provided to the site’s publisher may be used, they can’t explain how and why you are being shown a specific advertisement when you visit the site.  Joseph Turow, a marketing professor at the Annenberg School for Communication at the University of Pennsylvania, has developed an approach to provide consumers with more information and control over how they view ads.  Mr. Turow’s plan:  place an icon on each ad that signifies that the ad collects or uses information about users.  Clicking on the icon will bring you to what Mr. Turow calls a “privacy dashboard” that will show you exactly what information was used to choose that ad for you and provide an opportunity to edit the information or opt out of ad targeting. 
• A broad array of ad organizations is asking the Federal Trade Commission to delay implementing new guidelines on testimonials.  One of the proposed changes under consideration would require bloggers, online commentators and others to disclose connection they have to marketers.  In the joint letter to the FTC, the ad organizations, including the American Association of Advertising Agencies, American Advertising Federation and others, say the proposed regulations would result in uncertainty and increased costs for marketers.  Some on Madison Avenue are also concerned they might be held liable for bloggers’ failure to disclose ties to marketers. 
• While it may not be surprising to hear that purchases of CDs dwindling rapidly – 17 million fewer in 2008 compared to 2007 according to NDP – and that the number of purchase music downloads increased by 29 percent last year, it may be to learn that the number of people buying music is falling at a considerable pace.  According to research from the NPD group, the number of total music buyers fell by 13 million in the US last year. 
• Did you ever wonder what happens to your data after it has been stolen?  A U.K. Web security firm found information about several hundred thousand individuals on a botnet server in the Ukraine.  It has since been shut down and the authorities notified, but it goes to show how data from several sources can be fused together indiscriminately and used for criminal intent. 

• According to a new research study by Nielson Online, social sites like Facebook have surpassed e-mail as the number one online activity, with two-thirds of the world’s population visiting social networking or blogging sites.  What’s more, the “stickiness” of these sites is expanding, with one of every 11 minutes spent online being devoted to social networking activities.  And, in a finding to confirm the frustration and consternation of many teenagers, the fastest growing audience on Facebook is the 35-49 age group.  Which may explain such Facebook groups as “Cool Parents Who Have Facebooks”, although we at digitalhhr can proudly say we have avoided joining that one.)
• In perhaps one more sign of the ubiquity of social networking sites, Citigroup is rolling out a MySpace-branded Visa credit card.  Its marketing pitch is geared to fiscal responsibility-a bit of an ironic twist considering Citibank’s own (mis)adventures in that area.  But Citibank is also trying to preach to its intended audience, providing bonus points to be used for concerts, movie premieres and music downloads, as well as the ability to earn points for donations and charitable deeds.  Citi has also adopted a “manifesto” including such planks as “The environment, the economy, our very security …They’re the consequences of people not thinking about consequences.” 
• In the coming weeks, members of the Online Publishers Association (OPA) such as ESPN, Forbes.com and iVillage plan to roll out new, flashier, in-your-face, ad display units aimed at grabbing visitor attention better than the average banner ad.  While enabling advertisers to get more creative with their online ads, the new formats will hopefully help publishers make more money from fewer ads, since an abundance of ad inventory has been depressing revenue. 
• Continuing the social networking news, Hulu quietly added a new social networking feature that allows users to add friends, recommend videos or shows to one another and leave messages for one another, a la Facebook.  The site, which just celebrated its 1st birthday has even more reason to celebrate.  In just one year, it has become the number two site among the top online video properties, with 9.5 million unique viewers in February viewing 308 million video streams. 
• Google introduced its Google Voice integrated phone service, which was built on top of technology developed by GrandCentral, a company acquired by Google in 2007.  With its host of features, Google seems to be aiming less at replacing any one telephone service-such as VoIP or voicemail transcription or conference calling-and more at insinuating itself in as many aspects of telecommunications services as possible. 

The report, entitled “Self-Regulatory Principles For Online Behavioral Advertising:  Tracking, Targeting, and Technology”, is actually the result of a process begun in late 2007.  At that time, the FTC sought public comment on its preliminary set of principles for self-regulation of online behavioral advertising.  The latest report summarizes the comments received by industry insiders, responds to the main issues raised in those comments and establishes revised principles intended to guide the industry.  Such principles include the encouragement of transparency and consumer control, with the expectation that website operators provide clear and prominent notice regarding behavioral advertising and effective disclosure mechanisms that are separate from their privacy policies so that Internet users understand what information is being collected, how and for what purposes.

However, some say its just a matter of getting Internet users to feel comfortable with what behavioral targeting does and how its used, in an attempt to dispel the widespread notion that its just “creepy” and, ultimately, an invasion of our privacy.  It is certainly a daunting task, especially because much of the technology used to track Internet use is done on the back-end, which is not seen by users.  While this provides efficiency for advertisers and website operators, it makes it more difficult to let users known when they are being tracked. The key issues have been, and will continue to be, notice and choice of consumers.

Although these will continue to be difficult waters to navigate for the foreseeable future, particularly in the mobile space, the advertising community is definitely taking notice that an informed and concerned consumer base needs to be convinced of the benefits of behavioral targeting in practice, as opposed to in theory.  This issue also presents a conundrum for website operators and content owners that are, at all times, attempting to reconcile maximization of user experience with the perception that their users’ privacy is being compromised by technology and the monetization of advertising.  There will undoubtedly be more to discuss on this issue soon. Stay tuned.

• E-commerce sites, especially Amazon, the biggest of them all, got some bad news as the New York Supreme Court upheld the validity of a law requiring e-tailers to collect state sales tax. Amazon and Overstock.com sued based on a 1992 Supreme Court ruling that a company had to have a physical presence in the state to collect taxes.  Appeals are likely but for now, it looks likely that sales tax on e-commerce is inevitable.  More information is here.
• A task force has been formed by four Madison Avenue trade groups, with the support of the Council of Better Business Bureaus, to develop industry guidelines for new forms of online behavioral advertising and to lobby the government regulators and policymakers on the benefits to consumers.  The initiative is in response to potential government regulations that would limit new forms of online user targeting.  More details here.
• Reports out of Washington say that Julius Genachowski is being considered to take the chair of the Federal Communications Commission.  Although he was a former general counsel at the FCC and knows the agency well, he is better known as a digital media veteran, a longtime executive at InterActiveCorp and founder of a D.C.-based VC firm which has invested in numerous Web companies.  Here’s a piece from all things digital.com discussing the proposed appointment and industry reaction.
• Two consumer groups are set to appear before the FCC to seek an investigation into mobile ads.  The Center for Digital Democracy and US Public Interest Research Group claim that mobile ad firms don’t fully disclose the extent of the information they collect from consumers.  Here’s an article from the San Francisco Chronicle detailing the debate.

• One report says that ad spending on social networking sites will be lower than expected this year and will remain relatively flat in 2009.  Details from the WSJ are here. 
• The House Committee on Energy and Commerce has released a report entitled “Deception and Distrust:  The Federal Commmunications Commission under Chairman Kevin J. Martin.”  Some of the highlights of the criticism: lax oversight of telecommunciations companies and pushing for revisions to agency reports in a less-than-open fashion.  One caveat:  the report was prepared and released by the majority staff and is not necessarily a consensus view.  Here’s a link.
• Google has reached agreement to bring the magazine archive and current issues online as part of Google Book Search.  Titles involved in the project are a diverse bunch and include New York Magazine, Popular  Mechanics and Ebony.  The announcement was made via this post on Google’s official blog.
• The New York Times takes a look at licensing and other revenue opportunities that are being exploited in virtual worlds.  We’ll be looking at the legal impact that emerging technologies in the virtual space might have on licensing arrangements in the coming weeks.  Check back for the full post.