Advertising & Marketing Archives - OF DIGITAL INTEREST

Advertising & Marketing

In with the New: 2014 Privacy, Advertising and Digital Media Predictions

by McDermott Will & Emery | Jan 24, 2014 | Advertising & Marketing, Cloud, Consumer Protection, Cybersecurity, Data Transfers/Safe Harbor/Privacy Shield, Mobile Apps

Data privacy and security made the headlines practically daily in 2013. Our second annual Privacy and Data Protection 2013 Year in Review topped 65 pages!

What privacy, advertising and digital media trends will make headlines in 2014? Here are predictions from Of Digital Interest’s U.S. editorial team:

User Tracking Law Enforcement in California: “Amendments to the California Online Privacy Protection Act (CalOPPA) took effect on January 1, 2014 that require every website that is available to California residents to disclose how it responds to Do Not Track signals from web browsers and what third party data collection is occurring on the website. I predict that we will see enforcement activity from the California Attorney General about whether website owners/operators have made disclosures to consumers that not only meet the new CalOPPA requirements but also accurately reflect tracking activities by the website and by third parties.” – Heather Egan Sussman, Partner

No Kid-ding: “January 1 marked the six-month anniversary of the effective date of the amended “COPPA Rule,” which requires businesses to have parental consent before personal information is collected from kids under age 13. Having just approved a parental consent method (in December), I predict that the Federal Trade Commission (FTC) will initiate COPPA enforcement actions related to social media (now that photos and videos are personal information under COPPA) and in mobile apps (now that COPPA covers geo-location data). Perhaps the FTC will start by investigating the app developers to which the FTC sent letters explaining their new COPPA compliance responsibilities last May.” – Julia Jacobson, Partner

Safe Harbor Will Stay Safe: “Last year’s government surveillance accusations made the U.S. Safe Harbor Program a flash point for debate between EU and U.S. data protection regulators. Nevertheless, very few on either side of the Atlantic believe that companies properly certified under the Safe Harbor Program should disrupt data transfers necessary to meet credible business objectives. I predict that the rhetoric will continue, but so will the U.S. Safe Harbor Program, albeit perhaps tweaked in response to the European Commission’s recently-issued recommendations to improve the Progam’s effectiveness. More debate to come in 2014, but, meanwhile, many U.S. companies will continue to view Safe Harbor certification as their preferred approach to E.U. data protection compliance and will continue to implement data protection policies and programs intended to comply with the Safe Harbor Principles.” – Ann Killilea, Counsel

Cloudy Forecast: “The year of 2014 is quickly becoming the year of the mega-sized data breach, with the Target and Neiman Marcus incidents leading the way. Corporate customers have long been aware that cloud offerings present data security concerns, but may not have been as laser-focused on the data breach aspects as they should. I predict that in 2014, as the cloud service market becomes a commercial fact of life, data breach concerns will dominate how customers select and contract with their cloud service providers, and how they implement their incident response plans by including cloud service providers in their preparations.” – [...]

Continue Reading

Guidance on Personal Data Used in Advertising in Germany

by Paul Melot de Beauregard | Jan 22, 2014 | Advertising & Marketing, Data Privacy

German data protection authorities published new guidelines in December 2013 about the collection and processing of personal data for advertising purposes. The 2013 advertising guidelines (available here in German) supplement another set of advertising guidelines published in October 2012 (available here in German). Together, the 2012 and 2013 guidelines help to clarify how German data protection law relates to advertising activities.

The 2013 guidelines cover the following three main topics:

The “list-privilege” exception. The Bundesdatenschutzgesetz (Germany’s Data Protection Act) provides an exception to the rule that consent is required before personal data is processed for advertising. Certain personal data, such as name, address and year of birth, may be used for an organisation’s own marketing purposes without prior consent as long as the data is aggregated. The 2013 guidelines provide useful information on this exception by, for example, clearly stating that e-mail addresses and telephone numbers do not qualify for this exemption, and by providing commentary on how long the information qualifies for this exception after the last time it is used to contact the person to whom the data relates (generally two years, but the 2013 guidelines state that the time period can vary based on the facts).
Consent. The 2013 guidelines confirm that leaving business cards at a trade show for the express purpose of receiving information from business contacts constitutes consent to contact the person named on the business card for advertising purposes. For the digital world, the 2013 guidelines advise a double opt-in for consent provided electronically (e.g., via e-mail or SMS). Under the 2013 guidelines, double opt-in consent means that the person providing personal data about himself or herself must: (i) affirmatively consent (e.g., by clicking a button or checking an unchecked box on a website) at the time of data collection; and (ii) confirm his/her consent after receiving a written request for confirmation of consent (e.g., a detailed e-mail requiring confirmation by clicking a link) that includes enough information to enable the person to provide informed consent.
Right to object to use of personal data for advertising purposes. The 2013 guidelines state that when a person indicates (whether in writing or otherwise) that he/she no longer wishes to be contacted for advertising purposes, the organisation holding the data should take action in accordance with such a request without “undue delay.” (The 2013 guidelines don’t specify what time period is acceptable for undue delay.) The 2013 guidelines do, however, recognise that stopping all communications immediately may not be feasible, and advises organisations to inform individuals of any time lag to avoid complaints. The 2013 guidelines also remind organisations that a statement publicising an individual’s right to object should be included on every marketing communication, not just in (often lengthy) website terms and conditions.

Privacy and Data Protection: 2013 Year in Review

by Daniel F. Gottlieb | Dec 10, 2013 | Advertising & Marketing, Big Data, Cloud, Consumer Protection, Cybersecurity, Data Privacy, Data Transfers/Safe Harbor/Privacy Shield, Ecommerce, Email/Spam, General Interest, Mobile Apps, Social Media, Text Messaging

Privacy and data protection continue to be an exploding area of focus for regulators in the United States and beyond. This report gives in-house counsel and others responsible for privacy and data protection an overview of some of the major developments in this area in 2013 around the globe, as well as a prediction of what is to come in 2014.

Read the full report here.

Are Your Robocalls Legal? Following Federal Law May Not Be Enough

by McDermott Will & Emery | Dec 5, 2013 | Advertising & Marketing, Consumer Protection, Data Privacy

Last week’s Seventh Circuit ruling in Patriotic Veterans v. State of Indiana confirms that businesses should check both federal and state laws before using automatic dialing systems (ATDS) to deliver prerecorded or synthetic voice messages known as “robocalls”.

The Telephone Consumer Protection Act (TCPA) is a federal law that generally prohibits robocalls to residential telephone lines without the prior express consent of the party receiving the call. However, calls that are not made for a commercial purpose, including calls made for political purposes, are exempt from the TCPA.

The TCPA contains a preemption clause that states “nothing in this section . . . shall preempt any State law that imposes more restrictive intrastate requirements or regulations on, or which prohibits:

the use of automatic telephone dialing systems;
the of artificial or prerecorded or prerecorded voice messages;” (emphasis added)

Notably, the State of Indiana’s Automated Dialing Machine Statute imposes “more restrictive” requirements, because while it does have some limited exemptions, it does not contain the TCPA’s exemption for political calls.

In Patriotic Veterans, an Illinois based non-profit sought to make robocalls for political purposes across state lines to Indiana residents. Not wanting to pay for the live callers that would be required under the Indiana law, Patriotic Veterans filed a complaint in federal court against the State of Indiana and the Indiana Attorney General, seeking a declaration that the Indiana law was, among other things, pre-empted by the TCPA.

The District Court agreed with Patriotic Veterans, holding that the TCPA preempted the Indiana statute and granting Patriotic Veteran’s request for an injunction against enforcement of Indiana’s law with respect to political messages, but stayed the injunction pending the appeal.

The Seventh Circuit Court of Appeals reversed. The Court concluded that there was no express preemption in the statutory language because “the TCPA says nothing about preempting laws that regulate the interstate use of automatic dialing systems. Therefore, we must conclude that they are not preempted. The plain language of the text reinforced by the presumption against preemption prevents this court from looking any further[.]” The Court further concluded that there was no implied preemption for two reasons: (1) the federal regulatory scheme is not so pervasive or dominant as to make clear that Congress intended to occupy the entire legislative field, and (2) it is possible to comply with both laws (even if inconvenient or expensive for Patriotic Veterans).

What Does This Mean for Businesses?

The ruling in Patriotic Veterans further confirms that mere compliance with the TCPA is not enough. Courts are unlikely to strike down state laws that are more restrictive than the TCPA, so it is important for businesses that are developing a robocalling strategy to check the laws of the states where they plan to contact residents. Any such strategy should include a plan to comply with both the TCPA and the applicable state law requirements.

Consumer Data Privacy Update for Marketers, Part 2: New Telemarketing/Text Message Marketing Rules Effective October 16, 2013

by McDermott Will & Emery | Nov 21, 2013 | Advertising & Marketing, Consumer Protection, Data Privacy, Ecommerce, Mobile Apps, Promotions, Sweepstakes & Contests, Text Messaging

The Federal Communications Commission (FCC)’s Report and Order 12-21 (Order 12-21), issued in February 2012, describes revised telemarketing rules that became effective during the past 12 months.

The FCC’s telemarketing rules are issued under the Telephone Consumer Protection Act (TCPA) and apply to a telephone call to a residential landline or wireless number or a text message that is initiated for advertising or telemarketing purposes and uses an “automatic telephone dialer system” (ATDS) or an “artificial or prerecorded” voice message.

The three major changes implemented during the past year are:

(i) Abandoned calls rule effective November 16, 2012: Telemarketers must ensure that no more than three percent of calls answered by a person are “abandoned” (i.e., not answered by the telemarketer within two (2) seconds after the called person answers) during a 30-day calling campaign period;

(ii) Opt-out mechanism effective January 14, 2013: Artificial or prerecorded telemarketing messages must include an automated, interactive mechanism that enables the called person to opt out of receiving future prerecorded messages; and

(iii) Prior express written consent rule effective October 16, 2013: “Prior express written consent” (as described below) of the called person is required[i] for:

telemarketing calls to a wireless telephone number when an artificial or prerecorded message or ATDS is used;
telemarketing text messages sent using an ATDS; or
telemarketing calls to a residential landline telephone number using an artificial or prerecorded message.

“Prior express written consent” means a written agreement signed by the called person that clearly authorizes delivery of advertising or telemarketing messages using an ATDS or an artificial or prerecorded voice message and clearly states that agreeing is not a condition of buying any product or service. A written agreement may be “signed” electronically using any method recognized under the federal Electronic Signatures in Global and National Commerce Act (E-SIGN Act) or applicable state contract law. The E-SIGN Act recognizes a signature as an “electronic sound, symbol or process” that is “attached or logically associated with” an agreement and “adopted by a person with the intent to sign.”

Although industry standards have required express opt-in consent for recurring text messaging programs prior to implementation of the FCC’s prior express written consent rule, consent obtained under the old regulatory framework is not sufficient under the new FCC consent rule because (among other requirements) the “agreement” to which the consumer consents (i) must include reference to use of automated technology and (ii) “must be obtained without requiring, directly or indirectly, that the agreement be executed as a condition of purchasing any good or service.”

Action Step for Marketers: Obtain New Opt-in Consent for Telemarketing and Mobile Marketing

Obtaining new opt-in consent consistent with the requirements of the new FCC consent rule is best practice because the sender bears the burden of proving that it has obtained prior express written consent that meets the FCC standards. Relatedly, implementation of a record-keeping system through which evidence of compliant consent is retained for at least three years (i.e., the statute [...]

Continue Reading

Welcome to McDermott’s Of Digital Interest Blog

by McDermott Will & Emery | Nov 19, 2013 | Advertising & Marketing, Big Data, Consumer Protection, Data Privacy, Social Media

Welcome to McDermott’s Of Digital Interest blog!

The global digital economy continues to rapidly expand and we can only imagine where technological innovation will take us next. Every day companies are developing new and exciting ways to leverage the Internet and digital connectivity to make businesses more efficient, improve individual outcomes, facilitate customer engagement and maximize the power and value of data.

At the same time, privacy, data security, digital advertising and online consumer protection continue to be among the fastest growing areas of the law around the globe. In the digital realm, jurisdictional lines can be crossed in nanoseconds, and this compounds compliance challenges. With more than 50 attorneys in our group around the world, McDermott’s international, multi-disciplinary team of lawyers work hard to keep abreast of important developments and trends so we can help our clients meet those challenges.

This blog is the natural extension of those efforts and it is designed to provide legal professionals and risk managers with practical insights into regulatory developments, industry trends and current issues impacting the digital environment. From major developments in privacy and data security, to new strategies for legitimizing cross-border data transfers, to coverage of hot topics like user tracking and geolocation, and the latest trends in the specialized field of online advertising, internet promotions and beyond, we expect that this blog will serve as a trusted resource for professionals who are responsible for managing data and compliance in the digital age.

We hope you find Of Digital Interest to be both interesting and helpful and we welcome your feedback. If you have questions or topic suggestions, please let us know via the “Contact Us” form or feel free to reach out to one of the editors directly.

Heather Egan Sussman and Rohan Massey
Co-chairs, McDermott’s Privacy and Data Protection Practice

Consumer Data Privacy Update for Marketers, Part 1: Children’s Online Privacy Protection Act Amendments

by McDermott Will & Emery | Nov 19, 2013 | Advertising & Marketing, Big Data, Consumer Protection, Data Privacy, Email/Spam, Mobile Apps, Social Media

New technologies enable marketers to collect and analyze more — and more specific— data than ever before. Marketers can track consumers across the internet and mobile applications, and can deliver advertising based on consumers’ interests inferred from the collected data. In theory, consumer tracking enables marketers to present advertising to consumers who are predisposed to a specific product or service, producing a higher purchase rate and transaction price, and a greater return on investment in marketing activities.

While these new technologies make advertising and marketing more targeted and efficient, they also present new challenges for marketers. Although a majority of consumers understand the “pay with data” model through which websites, mobile applications and other digital services are made available at no cost, they do not want advertisers to track them or to aggregate the tracking data into so-called “big data” databases. Consequently, consumer digital privacy has been the subject of many recent news articles – from lawsuits filed by consumers against email service providers and social media platforms for undisclosed data mining to senatorial requests to data brokers for transparency.

In this four-part series, we will highlight of some recent developments in consumer data privacy law and suggested steps for marketers on how to address them.

Children’s Online Privacy Protection Act Amendments

The Children’s Online Privacy Protection Act (COPPA) is a federal statute enacted in 1998 that requires operators of commercial digital services to provide parental notification and obtain verifiable parental consent prior to collecting personal information from children under 13. To implement COPPA, the Federal Trade Commission (FTC) issued a set of regulations known as the Children’s Online Privacy Protection Rule (COPPA Rule). On December 19, 2012, the FTC released amendments to the COPPA Rule which became effective July 1, 2013.

The amended COPPA Rule enhances online privacy protection for children and makes digital services’ operators more accountable for data collection activities involving children under age 13. Notable for marketers is a new liability standard for third-party service providers. Specifically, effective July 1, 2013:

The operator of “children-directed” (i.e., intended for children under age 13) online or mobile websites and services is strictly liable for actions of independent third parties – including social media plug-ins – on/through its website and mobile services if the third party is acting as its agent or service provider or if the operator benefits by allowing the third party information collection; and
A software plug-in, ad network or similar party that collects information on or through a third-party’s online or mobile website or service now is liable under COPPA if that party has actual knowledge it is collecting personal information on a children-directed platform.

The amended COPPA Rule makes several other key changes to the original COPPA Rule, including:

An expanded definition of personal information to include geo-location information, a child’s photo or audio or video file, screen or user names, and persistent identifiers, such as information held in a cookie, an IP address, a mobile device [...]

Continue Reading

To Track or Not to Track

by McDermott Will & Emery | Nov 13, 2013 | Advertising & Marketing, Consumer Protection, Data Privacy, Mobile Apps, Social Media

October 21, 2013 Digital advertising based on tracking users’ interests and related privacy concerns have been the subject of many recent news articles. What does this mean for businesses? Evolving industry practices and new legislation relating to online privacy and user tracking likely require changes to online privacy practices and policies.

To read the full article, click here.