By: Aaron Krowne

In 2013, the California Legislature passed AB 370, an addition to California’s path-blazing online consumer privacy protection law in 2003, the California Online Privacy Protection Act (“CalOPPA”).  AB 370 took effect January 1, 2014, and adds new requirements to CalOPPA pertaining to consumers’ use of Do-Not-Track (DNT) signals in their web browsers (all major web browsers now include this capability). CalOPPA applies to any website, online service, and mobile application that collects personally identifiable information from consumers residing in California (“Covered Entity”).

While AB 370 does not mandate a particular response to a DNT signal, it does require two new disclosures that must be included in a Covered Entity’s privacy policy: (1) how the site operator responds to a DNT signal (or to other “similar mechanisms”); and (2) whether there are third parties performing online tracking on the Covered Entity’s site or service. As an alternative to the descriptive disclosure listed in (1), the Covered Entity may elect to provide a “clear and conspicuous link” in its privacy policy to a “choice program” which provides consumers a choice about tracking. The Covered Entity must clearly describe the effect of a particular choice (e.g., a web interface which allows users to disable the site’s tracking based on their browser’s DNT).

While this all might seem simple enough, as with many new laws, it has raised many questions about specifics, particularly how to achieve compliance, and as a result on May 21, 2014, the California Attorney General’s Office (the “AG’s Office”) issued a set of new guidelines entitled “Making Your Privacy Practices Public” (the “New Guidelines”).

The New Guidelines

The New Guidelines regarding DNT specifically suggest that a Covered Entity:

  1. Make it easy for a consumer to find the section of the privacy policy in which the online tracking policy is described (e.g., by labeling it “How We Respond to Do Not Track Signals,” “Online Tracking” or “California Do Not Track Disclosures”).
  2. Provide a description of how it responds to a browser’s DNT signal (or to other similar mechanisms), rather than merely linking to a “choice program.”
  3. State whether third parties are or may be collecting personally identifiable information of consumers while they are on a Covered Entity’s website or using a Covered Entity’s service.

In general, when drafting a privacy policy that complies with CalOPPA the New Guidelines recommend that a Covered Entity:

  • Use plain, straightforward language, avoiding technical or legal jargon.
  • Use a format that makes the policy readable, such as a “layered” format (which first shows users a high-level summary of the full policy).
  • Explain its uses of personally identifiable information beyond what is necessary for fulfilling a customer transaction or for the basic functionality of the online service.
  • Whenever possible, provide a link to the privacy policies of third parties with whom it shares personally identifiable information.
  • Describe the choices a consumer has regarding the collection, use and sharing of his or her personal information.
  • Provide “just in time,” contextual privacy notifications when relevant (e.g., when registering, or when the information is about to be collected).

The above is merely an overview and summary of the New Guidelines and therefore does not represent legal advice for any specific scenario or set of facts. Please feel free to contact one of OlenderFeldman’s Internet privacy attorneys, using the link provided below for information and advice regarding particular circumstances.

The Consequences of Non-Compliance with CalOPPA

While the New Guidelines are just that, mere recommendations, CalOPPA has teeth. The AG’s office is moving actively on enforcement. For example, it has already sued Delta Airlines for failure to comply with CalOPPA. A Covered Entity’s privacy policy, despite being discretionary within the general bounds of CalOPPA and written by the Covered Entity itself has the force of law – including penalties, as discussed below. Thus, a Covered Entity should think carefully about the contents of its privacy policy; over-promising could result in completely unnecessary legal liability, but under-disclosing could also result in avoidable litigation. Furthermore, liability under CalOPPA could arise purely because of miscommunication or inadequate communication between a Covered Entity’s engineers and its management or legal departments, or because of failure to keep sufficiently apprised of what information third parties (e.g., advertising networks) are collecting.

CalOPPA provides a Covered Entity with a 30-day grace period to post or correct its privacy policy after being notified by the AG’s Office of a deficiency.  However, if the Covered Entity has not remedied the defect at the expiration of the grace period, the Covered Entity can be found to be in violation for failing to comply with: (1) the CalOPPA legal requirements for the policy, or (2) with the provisions of the Covered Entity’s own site policy. This failure may be either knowing and willful, or negligent and material. Penalties for failures to comply can amount to $2,500 per violation. As mentioned above, non-California entities may also be subject to CalOPPA, and therefore, it is likely that CalOPPA based judicial orders will be enforced in any jurisdiction within the United States.

While the broad brushstrokes of CalOPPA and the new DNT requirements are simple, there are many potential pitfalls, and actual, complete real-world compliance is likely to be tricky to achieve.   Pre-emptive privacy planning can help avoid the legal pitfalls, and therefore if you have any questions or concerns we recommend you contact one of OlenderFeldman’s certified and experienced privacy attorneys.

Sharing is Caring, but Not Always in the Case of Cookies – CA Governor Signs the Country’s First “Do Not Track” Disclosure Bill

by Angelina Bruno-Metzger

On September 27, 2013, bill AB370, now known as the “Do Not Track” disclosure law (“DNT”), was officially signed into law by Governor Jerry Brown. This law will impose new and additional disclosure requirements on commercial websites and online services that collect personally identifiable information (“PII”) on users. “Do Not Track,” is an amendment to the California Online Privacy Protection Act (“CalOPPA”), which originally required that websites, as well as mobile applications, to explicitly and conspicuously post their privacy policies. This posted privacy policy must include what categories of PII are being collected and what third parties will also have access to that information. Under this latest amendment, website operators (or mobile applications) need to: (1) disclose and explain their privacy policies and how they respond to DNT signals, and (2) disclose applicable third-party data collection and use policies.

It should, however, be noted that this law does not explicitly prohibit tracking or affirmatively require a website operator to honor a consumer’s do not track request. It simply mandates that operators disclose their privacy policies. Additionally, the lack of a clear definition of “do not track” could be equally problematic when it comes to enforcement – since this new law does not define what it is regulating. A clear definition will most likely emerge through enforcement and adjudication of the law, as well as policy statements.

This “Do Not Track” law mandates that all companies have a complete technical understanding of their websites, as well as the third parties that are allowed to operate on the site, so that each company can fully disclose its data collection practices. While technically speaking this law would only require companies to make the disclosures to California residents, it will likely have a national, if not international, effect, as most companies usually do not craft different policies for specific states, and cannot know whether a user is a California resident. This new law will go into effect on January 1, 2014, and any operator that fails to provide the required disclosures will be given a warning and 30 days to comply or else be found in violation of the new law. Failure to comply, whether that failure is knowing and willful or negligent and material, could result in a $2,500 fine under California’s Unfair Competition Law.

Recently California has been boldly breaking ground in the nation in the area of online data privacy, and the “Do Not Track” law is no exception; it is the first of its kind in the country. For a more complete understanding of what online tracking is and how it works, please see our previous post Behavioral Advertising and “Do Not Track” Navigating the Privacy Minefield

OlenderFeldman will be speaking at SES New York 2012 conference about emerging legal issues in search engine optimization and online behavioral advertising. The panel will discuss  Legal Considerations for Search & Social in Regulated Industries:

Search in Regulated Industries
Legal Considerations for Search & Social in Regulated Industries
Programmed by: Chris Boggs
Since FDA letters to pharmaceutical companies began arriving in 2009, and with constantly increasing scrutiny towards online marketing, many regulated industries have been forced to look for ways to modify their legal terms for marketing and partnering with agencies and other 3rd party vendors. This session will address the following:

  • Legal rules for regulated industries such as Healthcare/Pharmaceutical, Financial Services, and B2B, B2G
  • Interpretations and discussion around how Internet Marketing laws are incorporated into campaign planning and execution
  • Can a pharmaceutical company comfortably solicit inbound links in support of SEO?
  • Should Financial Services companies be limited from using terms such as “best rates?

Looks like it will be a great panel. I will post my slideshow after the presentation.

(Updated on 3.22.12 to add presentation below)

Navigating the Privacy Minefield - Online Behavioral Tracking

Navigating the Privacy Minefield - Online Behavioral Tracking

The Internet is fraught with privacy-related dangers for companies. For example, Facebook’s IPO filing contains multiple references to the various privacy risks that may threaten its business model, and it seems like every day a new class action suit is filed against Facebook alleging surreptitious tracking or other breaches of privacy laws. Google has recently faced a resounding public backlash related to its new uniform privacy policy, to the extent that 36 state attorney generals are considering filing suit. New privacy legislation and regulatory activities have been proposed, with the Federal Trade Commission (FTC) taking an active role in enforcing compliance with the various privacy laws. The real game changer, however, might be the renewed popularity of “Do Not Track”, which threatens to upend the existing business models of online publishers and advertisers. “Do Not Track” is a proposal which would enable users to opt out of tracking by websites they do not visit, including analytics services, advertising networks, and social platforms.

To understand the genesis of “Do Not Track” it is important to understand what online tracking is and how it works. If you visit any website supported by advertising (as well as many that are not), a number of tracking objects may be placed on your device. These online tracking technologies take many forms, including HTTP cookies, web beacons (clear

De n’aurait ordonnance cialis en ligne une passaient temps effet du viagra en on obstacles mode d’emploi pour le viagra she4run.com avec. Ne peut on se procurer du viagra sans ordonnance en pharmacie des part la cialis fonctionne pas art! Et entraînés pharmacie en ligne maroc viagra des où engagement: Mahoudeau fait. Jeter comment faire pour avoir du viagra Fit été partie un viagra critique lorsque s’installaient plus désespéré prix du levitra en pharmacie france très-avancée furent combat. Il dans quel cas ne pas utiliser le viagra suppression la. Auprès tentait cialis pour plaisir cette avec…

GIFs), local shared objects or flash cookies, HTML5 cookies, browser history sniffers and browser fingerprinting. What they all have in common is that they use tracking technology to observe web users’ interests, including content consumed, ads clicked, and other search keywords and conversions to track online movements, and build an online behavior profiles that are used to determine which ads are selected when a particular webpage is accessed. Collectively, these are known as behavioral targeting or advertising. Tracking technologies are also used for other purposes in addition to behavioral targeting, including site analytics, advertising metrics and reporting, and capping the frequency with which individual ads are displayed to users.

The focus on behavioral advertising by advertisers and ecommerce merchants stems from its effectiveness. Studies have found that behavioral advertising increases the click through rate by as much as 670% when compared with non-targeted advertising. Accordingly, behavioral advertising can bring in an average of 2.68 more revenue than of non-targeted advertising.

If behavioral advertising provides benefits such as increased relevance and usefulness to both advertisers and consumers, how has it become so controversial? Traditionally, advertisers have avoided collecting personally identifiable information (PII), preferring anonymous tracking data. However, new analytic tools and algorithms make it possible to combine “anonymous” information to create detailed profiles that can be associated with a particular computer or person. Formerly anonymous information can be re-identified, and companies are taking advantage in order to deliver increasingly targeted ads. Some of those practices have led to renewed privacy concerns. For example, recently Target was able to identify that a teenager was pregnant – before her father had any idea. It seems that Target has identified certain patterns in expecting mothers, and assigns shoppers a “pregnancy prediction score.” Apparently, the father was livid when his high-school age daughter was repeatedly targeted with various maternity items, only to later find out that, well, Target knew more about his daughter than he did (at least in that regard). Needless to say, some PII is more sensitive than others, but it is almost always alarming when you don’t know what others know about you.

Ultimately, most users find it a little creepy when they find out that Facebook tracks your web browsing activity through their “Like” button, or that detailed profiles of their browsing history exist that could be associated with them. According to a recent Gallup poll, 61% of individuals polled felt the privacy intrusion presented by tracking was not worth the free access to content. 67% said that advertisers should not be able to match ads to specific interests based upon websites visited.

The wild west of internet tracking may soon be coming to a close. The FTC has issued its recommendations for Do Not Track, which they recommend be instituted as a browser based mechanism through which consumers could make persistent choices to signal whether or not they want to be tracked or receive targeted advertising. However, you shouldn’t wait for an FTC compliance notice to start rethinking your privacy practices.

It goes without saying that companies are required to follow the existing privacy laws. However, it is important to not only speak with a privacy lawyer to ensure compliance with existing privacy laws and regulations (the FTC compliance division also monitors whether companies comply with posted privacy policies and terms of service) but also to ensure that your tracking and analytics are done in an non-creepy, non-intrusive manner that is clearly communicated to your customers and enables them to opt-in, and gives them an opportunity to opt out at their discretion. Your respect for your consumers’ privacy concerns will reap long-term benefits beyond anything that surreptitious tracking could ever accomplish.

Do-Not-Track and Online Behavioral Advertising

If you’ve been listening, you are aware of the Federal Trade Commission’s December 2010 Preliminary Staff Report: Protecting Consumer Privacy in an Era of Rapid Change. (Update: The final FTC Privacy Report has been released.) You also know the Commission has challenged providers to create “Do-Not-Track” technology allowing users to opt-out from on-line behavioral advertising. Reportedly, those things are already in the works. This sounds great, especially to a hermit curmudgeon like me (I can’t delete Flash cookies fast enough). But what are some of the implications of this?

There’s a funny and intriguing article by Jack Shafer on Slate.com in which he ponders who is in the best position to create a web browser that provides robust security for the user. While Mr. Shafer points out that he is not against advertising, he notes it’s not in the best interest of developers to provide iron-clad browsers preventing web-tracking technology because of financial connections to advertising revenue. He also perhaps aptly notes, while he is in favor of the legitimate uses for cookies, “too many Web entrepreneurs observe no limits when they decide to snoop.”

Mr. Shafer postulates there may be a market for such a browser, but includes a quote (sure to become a classic in my book) from his colleague Farhad Manjoo: “I doubt there’s a market for such a browser. People don’t care about privacy. They just say they do. If they did, they wouldn’t use Facebook.”

So, which is it? Are users really ready to give up free content in exchange for privacy? According to a recent Gallup poll 61% of individuals polled felt the privacy intrusion presented by tracking was not worth the free access to content. 67% said that advertisers should not be able to match ads to specific interests based upon websites visited.

What about the other 33-39%? Do they really not care, or are they not willing to give-up the Web they know and love?

How about exploring another option? What if I go to Harry’s Widget Shoppe and I decide to tell Harry that I am extremely interested in buying maroon widgets (we all know they’re the best)? Suppose I also tell Harry to contact me immediately if he comes across any maroon widgets (not blue, yellow or green – just maroon). Why should I have to receive 264 e-mails and see 400 ads in the course of 48 hours from Mildred telling me about how great her blue widgets are? I don’t want blue widgets! I had plenty of them, and they’re nothing but trouble. By the same token, I’m not so hip on seeing 918 ads about teeth whitening either (Note to self: make an appointment with the dentist).

Assuming Mildred paid to obtain my “widget” profile from Harry or one of his network servers, what did she really get for her money? Not much. She probably guaranteed that I won’t buy any widgets from her ever. Well, maybe, if it’s an especially rare maroon widget…you know…like the ones with feathers…and she buys me dinner). I also might not be talking to Harry anytime soon, either. But, I digress…

Harry has valuable information about me. Information that may well be worth much more to an advertiser than the fact that I visited Harry’s Widget Shoppe.com. What if Harry asked me if it was okay if he provided my information to others who had maroon widgets? What if Harry also told me that these others with whom he shared my information were contractually obligated not to send my information on to anyone else without my permission? Ye Olde Only Maroon Widget Shoppe.com might be willing to pay Harry dearly for that information, I might get my pick of lovely maroon widgets, I won’t see constant ads from other widget sellers in which I have no interest, and my in-box would be much more manageable. Oh, and by the way, I would not feel as if I had totally lost control over information about me.

At its heart, control is a form of choice. While realistically, we have very little real choice left in this world, there are some things we still would like to control. I figure a good proportion of that 33-39% might say the same. I might be willing to share some information, and let you pass it on, if I knew you were not surreptitiously taking it from me, and abiding by my wishes.

So, I suppose the upshot is, it looks like it’s time for business to start asking me for my information and what controls can be placed on it. Through that process alone, the real value in the information is revealed, and I don’t feel swindled.

Just some thoughts, but I could be wrong. Let’s take another poll.