There are obviously certain elements of the iAd environment that are unique to Apple.  Apple sold the hardware the ads are displayed on (iPhones, iPod Touches and iPads), distributed and/or sold the App the ad appears in (through the App Store) and is creating many of the ads itself.  Thus, in many ways, Apple will set the “default” for flow of information among the various stakeholders– user to Apple (via Apple’s Privacy Policy and the App Store Terms and Conditions), Apple to App developer and Apple to advertisers.  Through these last two, Apple could presumably establish requirements for the use and disclosure of user information by App developers and advertisers.

But the question remains:  are the interests of all of these stakeholders aligned?  Or does the mobile ad environment lend itself to certain inherent tensions when it comes to the use and exploitation of personal information?

For example, Apple’s Privacy Policy and App Store Terms and Conditions state that information is collected and used by Apple only in aggregated form (that is, individualized information is not collected).  Location data is separately called out, with the policies providing that location data may be collected if a user “uses any service that relies on location information.”  Such location information appears to have primary value only if used on an individualized basis, for example, to serve an ad to a user based on his or her location at any given time.

But as noted above, Apple isn’t the only entity involved.  Data can be collected in an App itself, as well as through an iAd placed in an App.  And while Apple can claim that it is solely responsible for, and has sole entitlement to, data it collects through the sale of its hardware and Apps through the App Store, that is not necessarily the case for data that may be harvested through an App and/or an iAd contained in an App.

The most valuable asset in the mobile ad environment is the granularity of data that can be collected, mined and then exploited in the future, through highly targeted ads that fetch higher and higher rates because they generate more and more revenue for the advertisers.  One example that is receiving a lot of publicity is the Shopkick app, which will be available both on the iPhone and Android phones.  Shopkick can track a user through participating malls and retail stores and enable the user to accumulate points, redeemable for gift cards, as they move through the store.  App developers, publishers, advertisers, marketers and ad networks (such as Apple) all have a strong interest in user data, which effectively puts such data into play when framing the various agreements that are the foundation to the mobile ad environment.  Thus, in entering a contract for the development of an in-App ad, the developer/publisher of the App and the advertiser/marketers placing the ad can reach agreement on what user data will be collected, by whom and how it will be maintained, used and exploited.  While some of these provisions regarding use may need to comply with requirements dictated by the operator of the App store (such as Apple or Google or RIM/Blackberry) or of the ad network, it is clear that there will likely be different standards, conditions and restrictions amongst the various stakeholders.

In addition, and of importance to consumers, privacy advocates and, perhaps, regulators, is the question of responsibility and disclosure.  More likely than not, in this new mobile ad environment, consumers are not going to draw distinctions between all of the different stakeholders (e.g. the operator of the App store, developer/publisher of the App, advertiser/marketer placing the ad, and operator of the ad network).  They just want to know how to find out how their information is being collected and used.

From a functionality and user-experience perspective, there may be resistance to placing notices, privacy policies or terms and conditions at every user entryway in a mobile ad environment–which would include both App and ad.  However any entity collecting user information is going to have an obligation to disclose its collection and use policies to consumers.  And it will be up to the consumers to sort out what rights they may have with respect to the various stakeholders and how they may vary depending on where in the mobile ad landscape that information is collected.

Obviously this is a brave new world, with the rules, protocols, rights, responsibilities and risks being established and allocated in a very fluid fashion.  And these issues are particularly timely for the DigitalHHR team.  On September 21, we will be presenting a CLE-accredited webinar entitled,  “Whose Data Is it Anyway? Privacy and Data Security in a De-Centralized Digital World”.  We will be exploring the legal and business issues raised by the need to protect personally identifiable information of end users in a digital environment, including the special issues that are present in the mobile ad space.  Information on registering can be found here.

*  George Tsiatis, a summer associate with the firm, assisted in the preparation of this article.

It is not yet clear what the rationale is behind Apple’s new policy, how Apple plans to implement the policy and what it means for consumers and other players in the mobile advertising space.  Whether the policy will act as a blanket prohibition on development of geo-spam apps used primarily as tools for serving ads (i.e., ad-serving engines) remains to be seen.  In light of Apple’s acquisition of Quattro, some have surmised that Apple could be trying to curtail competition with its own products as its integrated advertising strategy evolves.  On the other hand, perhaps Apple’s intention is simply to protect its customers from apps designed solely to deliver possibly unwanted ads. 

The updated terms of Apple’s iPhone Developer Program License Agreement give Apple the right to “revoke the digital certificate of any of Your Applications at any time” meaning it can essentially kill an app.  This is not uncommon for end-user license agreements but could have widely felt ramifications for the more than 100,000 developers of iPhone apps.  Steve Jobs confirmed in 2008 that there is an iPhone ‘kill switch’ which allows Apple to remotely disable apps already installed on a device.  The terms of this latest developer agreement seems to allow that.  So while the language of the Apple Store Tip leaves open some ambiguity about how Apple will apply its policy regarding mobile apps, it now appears that the agreement every developer of apps must sign gives Apple the right to reject any app, including location based apps if it “has reason to believe that such action is prudent or necessary.”

Although this sector of mobile-advertising is still currently a nascent business, it is quickly growing as the use of GPS-enabled smartphones and other similarly equipped mobile devices become increasingly popular.  Companies, particularly smaller, local businesses, could increase their ability to reach potential in-market consumers and consumers may be better served by an improved user-experience.  Mobile advertising spending was estimated at just $416 million in 2009, compared with $24 billion spent overall on online adverting, but is expected to reach $1.56 billion by 2013and possibly more with the synergies of smartphones and mobile advertising companies. 

Excitement in the mobile ad space is tempered by the scrutiny of the Federal Trade Commission (“FTC”) and various consumer protection groups trying to balance privacy challenges and protection of consumers against the beneficial uses of new technologies such as geo-targeted ads.  A complaint filed last year with the FTC by the Center for Digital Democracy and the U.S. Public Interest Research Group asks for an immediate investigation into mobile advertising and certain practices in particular, which include location-based targeting. 

Currently, behavioral advertising in the mobile space, including location-based advertising, is subject to self-regulation.  But the FTC is continuing to look into whether, how, and to what extent more formal regulations may be needed to regulate emerging technologies.  To that end, it has scheduled a series of public roundtables to discuss proposals for regulations, including for mobile marketing. 

The FTC has long been interested in trying to regulate consumer privacy in the online behavioral advertising space by establishing guidelines.  The 2009 FTC Staff Report, titled “Self-Regulatory Principles for Online Behavioral Advertising” (which was the subject of a previous post in connection with online behavioral tracking technology), updates the FTC’s 2007 guidelines and emphasizes principles of “transparency and consumer control”; “reasonable security, and limited data retention for consumer data”; “affirmative express consent for material changes to existing privacy promises” and “affirmative express consent to (or prohibition against) using sensitive data for behavioral advertising”.  The FTC has said that the first principle of transparency and user control, which requires companies to notify consumers and give them the opportunity to opt-out of data collection practices, also applies to mobile technologies.  In addition the FTC’s efforts in the mobile advertising space, industry groups like the Mobile Marketing Association have established policies and guidelines and consumer best practices guidelines in connection with mobile advertising as well.

As the FTC continues to grapple with defining the parameters of mobile marketing guidelines and turning them into industry standards, key market players like Apple and Google will likely shape the mobile ad experience for service providers, advertisers and consumers alike.  At stake in this growing mobile-advertising sector is the potential for big money for service providers and advertisers and improved user experience for consumers weighed against possible privacy concerns.  We will continue to follow the legal and economic developments in this mobile-ad space and its implications for our clients.

• E-commerce sites, especially Amazon, the biggest of them all, got some bad news as the New York Supreme Court upheld the validity of a law requiring e-tailers to collect state sales tax. Amazon and Overstock.com sued based on a 1992 Supreme Court ruling that a company had to have a physical presence in the state to collect taxes.  Appeals are likely but for now, it looks likely that sales tax on e-commerce is inevitable.  More information is here.
• A task force has been formed by four Madison Avenue trade groups, with the support of the Council of Better Business Bureaus, to develop industry guidelines for new forms of online behavioral advertising and to lobby the government regulators and policymakers on the benefits to consumers.  The initiative is in response to potential government regulations that would limit new forms of online user targeting.  More details here.
• Reports out of Washington say that Julius Genachowski is being considered to take the chair of the Federal Communications Commission.  Although he was a former general counsel at the FCC and knows the agency well, he is better known as a digital media veteran, a longtime executive at InterActiveCorp and founder of a D.C.-based VC firm which has invested in numerous Web companies.  Here’s a piece from all things digital.com discussing the proposed appointment and industry reaction.
• Two consumer groups are set to appear before the FCC to seek an investigation into mobile ads.  The Center for Digital Democracy and US Public Interest Research Group claim that mobile ad firms don’t fully disclose the extent of the information they collect from consumers.  Here’s an article from the San Francisco Chronicle detailing the debate.