Photo of Lauren Myers

Email
(202) 342-8473
Bio

California Attorney General Xavier Becerra announced yesterday that the California Department of Justice will hold a series of six public forums on the California Consumer Privacy Act (CCPA).  The hearings will take place during January and February of this year and will give the public an initial opportunity to comment on the requirements set forth by the CCPA and the regulations the Attorney General must adopt on or before July 1, 2020.

The CCPA was passed in June of this year, and gives California residents specific privacy rights related to their online activities. Starting January 1, 2020, businesses will be required to comply with a number of provisions including requirements to disclose data collection and sharing practices to consumers, grant consumers a right to request deletion of their data, grant consumers a right to opt out of the sale of their personal information, and a prohibition on selling personal information of consumers under the age of 16 without explicit consent.

The CCPA requires the Attorney General to “solicit broad public participation” and adopt regulations regarding issues such as the definition of personal information, considering changes in technology and data collection practices, procedures for how a consumer can submit a request to opt out of the sale of his or her personal information, and procedures for businesses to determine whether a consumer’s request for information is verifiable.

The Attorney General’s announcement is particularly important because CCPA enforcement will not begin until six months after the promulgation of these regulations, or July 1, 2020, whichever is sooner.  These public forums indicate that Attorney General Becerra’s office is taking steps to adopt these rules, meaning CCPA enforcement may come sooner rather than later.

These hearings will serve as the first public forum in which businesses and members of the public can voice their thoughts or concerns about the required regulations. Members of the public who would like to speak at the forums can, but are not required to, register online. Comments may also be submitted via mail or email. A full schedule of the forums can be found here.

Kelley Drye is happy to assist if your business is considering whether to submit comments concerning the CCPA regulations or enforcement.  These forums present a critical opportunity for any stakeholder interested in California privacy law and enforcement to have their voices heard.  For more information on the CCPA and how it may affect your business, please visit our past blog posts here and here.

About a year ago, the SEC issued a warning to celebrities and social influencers who promoted Initial Coin Offerings (ICOs) on social media, noting that such promoters are subject to federal securities laws. Apparently, at least two celebrities weren’t paying attention because they recently settled the SEC’s first cases regarding promoting ICOs without proper disclosures.

Khaled Khaled, better known as music producer DJ Khaled, and professional boxer Floyd Mayweather Jr. both allegedly promoted investments in ICOs for Centra Tech Inc. in 2017 without disclosing the compensation they received in exchange for their endorsements ($50,000 for Khaled and $100,000 for Mayweather). This triggered a violation of the anti-touting provision of the federal securities laws.

A few examples of these endorsements include Khaled referring to Centra’s ICO as a “Game changer” on various social media accounts, and Mayweather tweeting that Centra’s ICO “starts in a few hours. Get yours before they sell out, I got mine…”

Mayweather also allegedly failed to disclose his relationship with two other ICOs that paid him $200,000 for posts such as, “You can call me Floyd Crypto Mayweather from now on.”

In settling the charges, Khaled agreed to pay $152,725 in disgorgement, penalty, and prejudgment interest, while Mayweather agreed to pay $614,775 for the same. Mayweather and Khaled also agreed not to promote any securities, digital or otherwise, for three and two years, respectively.

Although proper disclosures in social media endorsements have been an area of concern for the FTC for years, this settlement indicates that the SEC is just as interested in making sure consumers understand when they’re seeing sponsored content in the marketing of financial products.

For more information on this topic, check out our earlier post on SEC activity and our webinar, “Advertising Under the Influence.”

In June of this year, California passed the California Consumer Privacy Act (CCPA) giving California residents specific rights related to their online privacy, similar to those proscribed by GDPR. The law was passed hastily to avoid a stricter ballot measure on the subject, but Governor Brown recently signed a bill amending the law.

Many of the amendments clarify some of the CCPA’s “technical” errors, such as solidifying that the Act should not be enforced to contradict the California Constitution. The most significant change, however, deals with the enforcement of the Act. Although Section 1798.198 makes the Act operative on January 1, 2020, the newly-added Section 1798.185(7)(c) prevents the Attorney General from bringing an enforcement action under the Act until July 1, 2020, or six months after the final regulations made pursuant to the Act are published, whichever is sooner. Thus, although the effective date is January of 2020, the California Attorney General may not be able to bring enforcement actions until up to six months after the enactment date, depending on when the office promulgates regulations. The amendments also extend the date by which the Attorney General must promulgate regulations from January 1, 2020 to July 1, 2020.

Another point worth noting is that the amendments remove the requirement for a private plaintiff to inform the Attorney General of a claim he or she has brought to enforce his or her private cause of action under the Act. This eliminates the ability of the Attorney General to bring its own action in lieu of a private one.

Additional changes include specifying additional laws to which the Act does not apply, including: (1) the Confidentiality of Medication Information Act or regulations promulgated in response to HIPAA, or the Health Information Technology for Economic and Clinical Health Act; (2) the Federal Policy for Protection of Human Subjects; and (3) the California Financial Information Privacy Act. The amendments also limit the civil penalty to $2,500 per violation, or $7,500 for each intentional violation.

Although this bill has clarified some issues with the original law, this will likely not be the last set of amendments to the CCPA before it goes into effect. We will keep you posted.

 

The Northern District of California recently ruled on DIRECTV’s motion for judgment on partial findings in a case where the FTC is seeking $3.95 billion in damages. The FTC’s case alleges that DIRECTV engaged in misleading advertising over a span of more than a decade and across a variety of media channels ranging from television to the company’s website, violating Section 5 of the FTC Act and the Restore Online Shopper’s Confidence Act (ROSCA).

Specifically, the FTC alleges that the company failed to prominently display certain key provisions, such as the 24-month contract requirement and that advertised prices would increase after 12 months, on over 40,000 advertisements. The agency did not allege that the advertising in question was false, but that the details were not displayed sufficiently.

In partially granting DIRECTV’s motion, the court found that the FTC failed to prove a Section 5 violation as to the company’s banner, print, or TV ads because the agency did not establish that there was a misleading net impression among consumers, and because the Commission did not sufficiently identify the alleged net impression. The proffered evidence did not establish that the advertisements were likely to mislead a reasonable consumer.

The FTC provided evidence for less than 1,000 of the challenged 40,000 advertisements at issue in the case. The court determined that this, along with the additional evidence that the FTC did provide, such as expert testimony regarding three specific ads, were not enough for the agency to meet its burden. The court noted that the agency was not required to introduce all 40,000 ads into evidence, but it did need to explain why the conclusions made about a few ads could be generalized among a large number of others that varied in format, content, and emphasis. The court also highlighted that DIRECTV’s print ads displayed the necessary disclosures in text that was in all caps, bolded, and in a dark font against a light background, which the court determined was likely sufficiently prominent and in compliance with the FTC’s .com Disclosure guidance.

Notably, the court declined to make a similar conclusion about DIRECTV’s website advertisements. The court found that the FTC’s evidence, although “far from overwhelming” was enough to defer a determination about the Section 5 and ROSCA claims associated with the website advertising at issue. Specifically, the court focused on the fact that the challenged advertising required consumers to hover over or click on a link or icon to learn about the pertinent terms of the offer. In theory, therefore, a consumer could have flowed through the entirety of the online order process without confronting important details about the offer.

The court also discussed the FTC’s nearly $4 billion potential remedy, suggesting that the agency would be unlikely to meet its burden to prove an adequate basis for relief due to the court’s partially granting DIRECTV’s motion. The court had issues with the FTC expert’s calculation of unjust gains because he presumed that all of the defendant’s subscribers for the time period at issue were misled in the same way, without a sufficient basis for that presumption other than the FTC’s instruction. This presumption was especially problematic because there were so many iterations of the advertisements. However, the court deferred the issue to see if the FTC would be able to prove liability with the remaining claims.

In a case that is historic for the breadth of advertising at issue and the amount of damages the FTC seeks, the court’s order creates significant challenges for the agency as to the remaining claims in the case. We will continue to monitor this case for any updates as it proceeds.

In the meantime, the case continues to be notable in highlighting the scrutiny that a company may face when failing to sufficiently disclose post-introductory prices and term commitments for subscription type plans. Following best practices and regulatory guidance on disclosing material terms are helpful steps to avoid such scrutiny in the first instance.

The FTC recently finalized updates to its Guides for the Jewelry, Precious Metals, and Pewter Industries, which provide the FTC’s interpretation of the jewelry marketing rules found in 16 C.F.R. §23.  The FTC hosted a roundtable in 2013, which we wrote about here, and considered stakeholder comments prior to finalizing the new Guides.  The updated Guides address a number of topics, including the surface application of precious metals, below-threshold previous metal alloys, gemstone products, and “cultured” diamonds.

What’s Changed

Some highlights of the changes include advising that jewelry marketers may:

  • Qualify if a coated product only has a service layer of a precious metal;
  • Advertise a product’s precious metal coating to assure reasonable durability;
  • Disclose the purity of coatings made with precious metal alloys;
  • Qualify a product’s gold karat fineness or a parts per thousand (PPT) designation for silver products that have less than 925 PPT;
  • Use alternative words and phrases for man-made stones (where it shares the same properties as the named stone) if they clearly and conspicuously convey that the product is not a mined stone.

Continue Reading All That Glitters Is Not Gold: FTC Updates Jewelry Guides

Last week, the House Committee on Energy and Commerce held a Committee Hearing on the Oversight of the Federal Trade Commission. All five Commissioners attended and their message was largely the same: the FTC needs additional rulemaking and civil penalty authority to better protect consumers, especially as it applies to privacy and data security enforcement.

Privacy and data security were a focus of the Chairman’s opening statements, during which he noted that both were a top priority for the agency. Chairman Simons also discussed the need for the FTC to have jurisdiction over nonprofits and common carriers, imploring Congress to pass legislation giving the agency such authority, along with comprehensive data security legislation. Simons noted that the FTC was watching and assessing the EU’s implementation of its comprehensive privacy law, the General Privacy Data Protection Regulation (GDPR), to see how it may apply to the U.S. and he reaffirmed enforcement of the EU-U.S. Privacy Shield, which the FTC has enforced in the past.

Chairman Simons also referenced the hearings that the Commission will be holding in the fall, emphasizing that he anticipated the agency would benefit from participant input on a number of topics—from merger guidelines to privacy and data security. Simons, a former student of Chairman Pitofsky, noted that the agency held similar hearings during the Pitofsky era that resulted in agency action, such as amendments to the merger guidelines. The Chairman noted that he wanted this year’s hearings to be similarly effective in setting the agency’s future agenda. Continue Reading Big Government? FTC Advocates for More Authority in Congressional Hearing

California recently passed the California Consumer Privacy Act (CCPA), providing new rights for California consumers (broadly defined as California residents) regarding their personal data. The CCPA is modeled after the EU’s General Data Protection Regulation (GDPR), which provides EU citizens with a number of rights related to data processing and imposes specific requirements on companies that process EU citizen data. The new California law provides similar requirements for businesses that collect data from California consumers. The following are some key points of comparison. Continue Reading GDPR Sidebar: Comparing the California Consumer Privacy Act to the GDPR

The Advertising Standards Authority of Ireland – similar to the NAD in the US – recently issued a decision regarding a social media influencer that companies on this side of the Atlantic should note.

The case involves social media posts by Rosie Connolly, a fashion, beauty, and lifestyle blogger. Connolly posted pictures with flawless makeup, and mentioned RosieConnollyPostthat she was wearing Rimmel Foundation. The trouble is, Connolly’s face had been filtered and photo-shopped. A consumer complained to the ASA that people “may purchase the Rimmel Foundation thinking they would achieve the same results if they used the product,” when those results may not be likely.

Connolly said that Rimmel had approved the images and, therefore, that the complaint should be addressed to them. Rimmel, in turn, acknowledged that the image had been filtered using a built-in camera feature. The image was not intended to mislead people, but the company removed it because it did not reflect their values as a brand. Moreover, Rimmel said it had taken various steps to avoid future issues with heavily filtered images. For example, the company updated its policy to more explicitly require flagging an influencer’s use of filters/photo-shopping, and promised to monitor posts more strictly.

The ASA “considered that the use of post-production techniques which exaggerated the effects of an advertised product could mislead and they welcomed the steps the advertisers had taken in removing the posts.”

Although cases involving influencers in the US have focused mostly on whether the influencers have property disclosed their relationship to the brands whose products they touted, the FTC has made clear that both influencers and brands can be held liable for any misleading content in influencer posts. Moreover, outside of the influencer context, there are plenty of cases here regarding the use of mockups or enhancements. Accordingly, companies should take steps to ensure that influencer posts are not misleading, not only in their descriptions, but in the photos themselves.

On June 28, 2018, Governor Brown signed into law the “California Consumer Privacy Act of 2018.” The legislation was a compromise to avoid a ballot initiative that was more closely modeled after the European Union’s General Data Protection Regulation (GDPR). This Act is scheduled to go into effect on January 1, 2020.

The Act enumerates a number of rights for consumers regarding the privacy of their personal information. Some rights, such as the right to be forgotten or the right to request information disclosure, are reminiscent of those seen in the GDPR, while others, such as the right to opt out of the sale of a consumer’s personal information, are specific to the new law.

Along with identifying consumer rights, the law also imposes requirements on businesses, including those that collect or have collected consumers’ personal information, to make specific disclosures about their personal information practices and to respond to consumer requests. Importantly, the definition of “personal information” is broadly defined to include common information, such as a name or email address, as well as more specific information, such as biometric information and geolocation data, although publicly available information is not included. Continue Reading California Enacts Sweeping Privacy Law; Will Other States Follow?

Under the GDPR, processors must have a lawful basis for processing any data of an EU data subject. Consent is one of six lawful bases[1] under the GDPR, and in this installment of GDPR SIDEBAR, we’ll cover best practices that can help achieve an acceptable level of compliance with GDPR consent requirements.

Valid consent under the GDPR must be: (1) freely given; (2) specific; and (3) informed. And a consumer must make a clear, affirmative action to consent. This means pre-populated check boxes aren’t going to count as valid consent for GDPR purposes. Here are a few tips for meeting GDPR’s consent requirements:

  • Make sure consent is specific. Identify what type of processing the data subject is consenting to, so that the data subject understands exactly what data is collected and how it is used. Example 1 provides a consent mechanism for each specific type of communication (text message, email, etc.). This makes it clear to the data subject what she is signing up for when she consents to processing.

  • Make sure consent is unbundled. Provide a separate consent mechanism for each type of processing the data is expected to be used for. Do not bury consent in an agreement for terms and conditions or a general privacy policy. Example 2 offers unbundled options for separately consenting to marketing messages and the website’s terms and conditions.

Continue Reading GDPR SIDEBAR: Best Practices for Complying with GDPR Consent Requirements