Consumer Privacy and Cookies: What the FTC's $22.5 Million Settlement With Google Means For Your Company

Author: Paul C. Van Slyke

Recently the Federal Trade Commission reached a record $22.5 million settlement with Google for consumer privacy violations of an earlier order involving what is called “online behavioral advertising” or OBA.  The Google case is a roadmap for avoiding serious legal missteps for tracking of consumer interests in violation of a company’s own policies and claims that are commonly made and often overlooked.  In the Google settlement, the FTC sent a loud and clear message that it will not tolerate promises and claims made in fine print to protect the privacy of consumers and breaking those promises by use of cookies and user tracking tools in day-to-day operations long after the promises in fine print are forgotten. 

Overlooked Privacy Claims in the Google Case

Most companies have gotten the message that what they say in their privacy policies has to line up with their day-to-day operations. The problem is that many companies are conveying claims not just in a formal privacy policy in the fine print on the website, blog or social media brand page, but also where the company states choice mechanisms, opt-outs, and other ways consumers can customize their experience.  The FTC’s complaint against Google highlights alleged misrepresentations on the company’s Advertising Cookie Opt-Out Plug-in page that were overlooked for compliance.  Cookies are the unique file codes placed on a consumer’s computer when a website is opened and consumer choices are made on the website.

Google claimed in its fine print that for users of the Safari browser that it would not place tracking cookies on the users’ computers or serve them targeted advertisements.  The  FTC alleged that Google used codes to disguise its cookies to work around Safari’s opt-out default setting. 

Overlooked Claims of  Self-Regulatory Compliance

Many companies promote on their website their affiliation with self-regulatory programs.  For example, to join the Network Advertising Initiative (NAI), a voluntary self-regulatory group for the online advertising industry, company members agree to disclose to users their data collection and use practices.  Although Google touted its NAI membership on its website, the FTC says the company did not truthfully disclose what it was doing with Safari users’ data. 

Key Points

• The CEO and top executives of your company must often repeat that they are committed to compliance with consumer privacy and advertising laws and they will hold the IT director and Chief Marketing Officer accountable.

• Your information technology staff needs to take the lead in compliance before your marketing managers and legal advisors get involved.

• It helps for a company to adopt an internal consumer privacy policy that places primary responsibility on the IT Department and secondary responsibility on the marketing staff for compliance with laws and regulations on the use of cookies and user tracking tools.

•  The internal policy should require that IT department make and update a list of all the places on your company websites, social media promotions and sponsored blogs where  privacy representations and claims are made,  maintain an inventory of the cookies they use, and not launch new ones without both marketing and legal review.

• The internal policy should also require that the marketing staff make and update a separate list of all the user tracking tools being used on your company websites, social media promotions and sponsored blogs and maintain an inventory of the categories of data being collected from users, and not launch new tracking tools or categories of data being collected without both IT and legal review.

•  Sidestepping users’ preferences can lead to costly legal missteps.

New California Law More Restrictive Than FTC Guides on Environmental Claims for Food, Beverages and Plastic Bags

Environmental packaging claims that pass muster under Federal Trade Commission (FTC) law and guides may now be unlawful under a new, more restrictive California law.

California Environmental Package Claims Unlawful

Recently, the California Attorney General sued two makers of bottled water and their plastic bottle supplier for marketing and labeling the bottles as “100 percent biodegradable and recyclable” in violation of California law. The Complaint alleges that such claims are inherently misleading to consumers.

In 2008, California banned the use of words like “biodegradable” “degradable,” or “decomposable” in the labeling of plastic food or beverage containers. It also prohibited calling containers “compostable” or “marine degradable” unless specific American Society for Testing and Materials (ASTM) standards were met.

A few months ago, California began requiring “compostable plastic bags” to contain visual cues for consumers, like dying the bag green, or labeling both sides as “COMPOSTABLE” in big letters next to a big green stripe—in compliance with the FTC Guides for Use of Environmental Marketing Claims (a/k/a the “Green Guides”). These bags also can’t be labeled “recyclable” for fear that added microbes they will “contaminate” the recycling stream.

 The California law provides for civil fines up to $2,000 per violation for repeat offenders, plus court costs if the state sues and wins. Class action lawsuits under California’s Unfair Competition Law or False Advertising Law are also possible.  In 2013, the California law will expand to  all plastic products beginning in 2013.

Companies Claim Plastic Bottles Decompose in 5 Years

The two companies, Balance and Aquamantra, claim that their bottles will decompose in less than five years in a landfill or compost area because of a microbial additive. The California Attorney General disagrees, contending that decomposition frequently does not take place for several reasons, such as improperly recycled bottles that sit in a landfill, which is not conducive to decomposition, as well as that the added microbes are ineffective.

FTC Green Guides Have Different Standard

Proposed changes to the FTC Green Guides would require only that biodegradability claims be substantiated by competent and reliable scientific evidence that the entire product or package will completely break down and return to nature( i.e., it decomposes into elements found in nature within a reasonably short period of time after customary disposal).

Thus, while the FTC permits  biodegradable claims if it occurs “within a reasonably short period after customary disposal,”  California law appears to create an irrefutable presumption that a biodegradable claim is inherently deceptive to consumers, regardless of substantiation proof.

Implications

Compliance with the FTC Green Guides will not be a safe harbor against violation of the California law. National marketing of plastic bottles and plastic bags (and as soon as 2013 all forms of plastic) making  claims such as biodegradable and compostable may therefore be practically impossible given California’s position. Alternatively, national marketers can try to craft a cost-effective way to market different bottle labels in California.

Authors:  Paul Van Slyke

Brandon Witkow

Gaston Kroub

Congressmen Ask FTC to Investigate Secret Use of Supercookies For Behavioral Advertising

Two Congressmen recently wrote the Federal Trade Commission (FTC) asking the FTC to investigate the privacy implications of the installation of files called Flash cookies or Supercookies on consumers’ computers.  These Supercookies allow companies such as Hulu.com to gain personal information from consumers without their knowledge for behavioral advertising targeting. The two Congressmen, Joe Barton (R-TX) and Ed Markey (D-MA), are Co-Chairman of the Congressional Bi-Partisan Privacy Caucus.

Supercookies are Hidden

The Congressmen’s letter is based on an August Wall Street Journal article discussing the use of Supercookies.  Supercookies differ from regular “cookies” because Supercookies are hidden from view and cannot be deleted.  Consumers are unaware these files are placed on their computer.  They remain on a computer even when the consumer clears the browsing history and cache.  And they record information even when the consumer is browsing in “private browsing” mode.

Supercookies Common on Many Top Websites

A recent study found 100 Supercookies placed on users’ computers by 37 of the top 100 websites.  Some Supercookies can even “respawn” traditional cookies after a consumer deletes them. Amazingly, the study also suggests that owners of the top website surveyed have little or even no knowledge that their websites are being used by third party tracking companies to place Supercookies on consumers’ computers.

Class Action Suits Filed on Secret Use of Supercookies

Earlier this year, a California class action lawsuit against Web measurement company Quantcast and widget maker Clearspring based on surreptitious placement of Supercookies settled for $2.5 Million. Another class action lawsuit in California against Kissmetrics and Hulu.com alleging that surreptitious placement of cookies and similar tracking files violates the Computer Fraud and Abuse, Electronic Communications, and Video Privacy Protection Acts, as well as several similar state laws, is still pending.  Most recently, on Nov. 23, 2011 web video company Metacafe settled a similar suit by the agreeing to stop use of Supercookies to recreate users’ regular cookies. 

FTC Action/Settlement

The FTC itself on Nov. 8, 2011 both filed a complaint and announced a settlement agreement containing a consent injunction against ad network ScanScout (which was acquired last year by Tremor Media).  The agreement requires ScanScout and Tremor to give prominent notice on its website that it is collecting information to send the consumer targeted ads, unless the consumer opts out by clicking on a hyperlink declining to receive targeted ads. The agreement also requires that the hyperlink take consumers to a mechanism that allows them to block the company from collecting information that can identify them or their computer, from redirecting their browser to third parties that collect date with their approval; and from associating any previously collected personal data with them.  The consumer’s choice must last for at least five years, unless the consumer changes it. The agreement will be subject to public comment for 30 days, continuing through December 8, 2011, after which the Commission will decide whether to make it final.

Implications of Secret Use of Supercookies

The FTC investigation requested by Congressmen Barton and Markey, the pending class action lawsuits, and actions by the FTC are likely to lead to additional regulations and limits on behavioral advertising through the use of Supercookies.  The FTC is likely to rule that obtaining personal data using Supercookies without notice and an opportunity for consumers to opt out violates current laws and FTC privacy guides.  It is unclear whether companies will be liable for engaging in behavioral advertising by acquiring and using personal data obtained by third parties with the use of Supercookies, but we expect further limits on such use.

Authors: Paul Van Slyke

Gregory Casamento

Patrick Hatfield

Think Your Ad or Package Claims Have Adequate Substantiation? The Reebok Case Has Some Lessons

    

            Recently the FTC announced a high-profile agreement to settle its lawsuit against  athletic shoe maker Reebok The agreement requires Reebok to pay  $25 Million for refunds to people who bought Reebok EasyTone or RunTone shoes or apparel. Reebok also agreed to an onerous injunction against making claims that the shoes were effective in strengthening muscles or that wearing the shoes will result in quantified percentage or amounts or muscle toning or strengthening.

            The FTC press release seemed to imply that Reebok had taken almost no steps to substantiate its claims.  According to the FTC complaint, Reebok made unsupported claims in advertisements that walking in its EasyTone shoes and running in its RunTone running shoes strengthen and tone key leg and buttock (gluteus maximus) muscles more than regular shoes.  The ads claimed, for example: “Get a Better Butt.  Get Better Legs.  Get EasyTone.  EasyTone sole technology gives you up to 28% more toning in your calves, hamstrings , and, oh yes, your butt.”

            Here is one of Reebok’s EasyTone advertisements:

            A close examination of an earlier proceeding  of the National Advertising Division (NAD) of the Better Business Bureau suggests that Reebok had undertaken scientific testing to support its claims, but that its testing was inadequate to serve as “reliable and competent substantiation for the claims” required by Sec. 5 of the FTC Act.

Actual Testing by Reebok

            The NAD examined some of the same products and claims as in the FTC action  While the NAD found that Reebok had conducted an independent lab study by a qualified expert, it. concluded that the study was too small and did not necessarily reflect real world conditions of women using the shoes.  In other words, Reebok lacked adequate substantiation for the claims made in its advertisements .

Definition of Adequate Substantiation

            The Reebok case demonstrates that good faith substantiation efforts do not necessarily immunize a company from charges of failure to meet the FTC standard of reliable and competent evidence. The agreed injunction gives some guidance on the type of scientific testing the FTC deems adequate substantiation: “For purposes of this Section, competent and reliable scientific evidence shall consist of at least one

·         clinical study . . . of at least six weeks duration;

·         [that] uses an appropriate measurement tool or tools (e.g., a dynamometer if measuring strength);

·         . . . is conducted by persons qualified by training and experience to conduct and measure compliance with such a study;

·          conforms to acceptable designs and protocols, and

·         the result of which, when considered in light of the entire body of relevant and reliable scientific evidence, is sufficient to substantiate that the representation is true.”

[bullet points and indenting added for clarity]           

            In light of the guidance provided by this high-profile settlement, the key question companies should ask themselves is, do the company’s advertising claims (or that of its competitors) meet these elements of competent and reliable substantiation?

     Authors:       Paul Van Slyke               Greg Casamento                 Tom Casagrande



FTC proposes to extend Mail or Telephone Rule to e-commerce

By:  Paul Van Slyke

The FTC recently announced it proposes to extend its Mail or Telephone Order Merchandise Rule (the “Rule”) to orders placed online. If ultimately adopted, the proposed changes will affect advertising agencies and marketers of consumer goods doing business over the Internet.

The FTC is accepting public comments on the proposed extension of the Rule through December 14, 2011.  Comments can be filed online.

Proposed Changes to the Rule

In addition to extending the Rule to online commerce, the FTC is also proposing to make certain other changes.   Some examples of what is  in the proposal are:

·         an amendment to allow sellers to provide refunds and refund notices to buyers by any means at least as fast and reliable as first-class mail;

·         a clarification on sellers' obligations when buyers use payment methods not spelled out in the Rule — debit cards or prepaid gift cards, for example; and

·         a requirement that companies make refunds within seven working days for purchases using third-party credit, like Visa or MasterCard.  (For credit sales where the seller is the creditor — for example, when merchants have their own store charge cards — the refund deadline would remain one billing cycle.)

Other FTC Rules and Guides for Online Advertising

The Rule proposed to be added to online advertising is an addition to several existing statutes and FTC rules and guides bearing on the subject of online advertising and commerce.  For example:

·          the FTC has issued  the Advertising and Marketing on the Internet: Rules of the Road as an overview of all the FTC rules and guides that apply;

·         The FTC Staff paper Dot com Disclosures: Information About Online Advertising offers practical tips on how to make effective disclosures online;

·         In 2000, the FTC issued a report Privacy Online: Fair Information Practices in the Electronic Marketplace with guidelines for websites that collect personal information from consumers; and

·         In 1998, Congress passed the Children's Online Privacy Protection Act ("COPPA"), which governs collection of personal information from children under the age of 13.  The FTC guides Children's Online Privacy Protection Rule and How to Comply with the Children's Online Privacy Protection Rule give additional guidance and practical suggestions on compliance with COPPA.

Locke Lord has an Advertising & Marketing team experienced in compliance with FTC rules and submitting comments on proposed rules.