Internet Law

Pre-Checked Boxes Do Not Constitute Valid Consent Under GDPR

October 4, 2019 by David Klein

October 4, 2019

On October 1, 2019, the Court of Justice for the European Union (“CJEU”) issued an important opinion regarding the scope of consent in the context of the General Data Protection Regulation (“GDPR”). Specifically, the Court determined that a company cannot validly obtain a user’s consent to install cookies on his/her computer device through means of pre-checked boxes. Instead, the Court ruled that for a user’s consent to be valid under the GDPR, consent must be both active and unambiguous.

Why don’t pre-checked boxes constitute valid GDPR consent? [Read More]

FTC Calls for Public Comment on Negative Option Marketing

September 30, 2019 by David Klein

September 30, 2019

negative-option-marketing — Negative Option Marketing and the FTC

On September 25, 2019, the Federal Trade Commission (“FTC” or “Commission”) published an Advance Notice of Proposed Rulemaking calling for public comment on the need to amend the current “Rule Concerning the Use of Prenotification Negative Option Plans” (the “Negative Option Rule” or “Rule”). Negative option marketing, where a consumer’s silence constitutes consent to an offer, can come in several different forms. According to the FTC, the current Rule fails to address: 1) all forms of negative option marketing; 2) across all types of media.

How Would the FTC Amend the Current Rule?[Read More]

CCPA Amended to Require California Data Broker Registration

September 23, 2019 by David Klein

September 23, 2019

On September 13, 2019, the California State Legislature passed Assembly Bill No. 1202 (the “Bill”), amending the California Consumer Privacy Act (“CCPA”) to require certain businesses to register as data brokers with the State Attorney General’s Office. The Legislature believes that a California data broker registry will provide greater transparency on the issue of third parties that may have access to their personal information (companies that they do not have a first party relationship with the consumer) and allow consumers to prospectively opt out of the “sale” of this personal information. The CCPA defines “sale” in a very broad fashion, such that it includes the “selling, renting, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to another business or third party for monetary or other valuable consideration.” In practice, this means that a disclosure of almost any kind (other than to pure service providers) falls within the definition. We can, therefore, assume that in the context of the CCPA, selling really means sharing and should be treated as such. The Bill has moved to Governor Gavin Newsom’s desk, who now has until October 13, 2019 to act on the legislation.

What is required of California Data Brokers?

California Data Broker Definition

The Bill defines a California data broker as “a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship.” Exempt from the definition are: 1) consumer reporting agencies that are covered by the federal Fair Credit Reporting Act; 2) financial institutions covered by the Gramm-Leach-Bliley Act; and 3) entities covered by the Insurance Information and Privacy Protection Act. A “direct relationship” is not defined in the Bill, but the Legislature has stated that direct relationships can form for various reasons, “such as by visiting a business’ premises or [I]nternet website, or by affirmatively and intentionally interacting with a business’ online advertisements.”

Registering as a California Data Broker

Businesses that meet the definition of California data broker must register annually with the Attorney General on or before January 31. Registration will require California data brokers to: 1) pay a fee that will be determined by the Attorney General; 2) provide their primary physical, email, and Internet website addresses; and 3) include any additional information that they choose to include with respect to their data collection practices. Failing to register as a California data broker may result in a civil penalty of $100 for each day that the California data broker fails to register its business, payment of the registration fee, and any expenses incurred by the Attorney General’s Office to investigate and prosecute any associated regulatory action.

As early as 2012, the Federal Trade Commission (“FTC”) had suggested that legislation should be initiated at the federal and state level to regulate the data broker industry. Currently, Vermont is the only other state of the Union that requires data broker registration. As more states look to follow the lead of California and Vermont in requiring consumer data broker registration, businesses should seek the advice of qualified legal counsel to help navigate the existing and emerging issues presented by applicable state laws.

If you are interested in learning more about this topic or ensuring that your business is compliant with state and federal data collection, storage and usage laws, please e-mail us at info@kleinmoynihan.com or call us at (212) 246-0900.

The material contained herein is provided for information purposes only and is not legal advice, nor is it a substitute for obtaining legal advice from an attorney. Each situation is unique, and you should not act or rely on any information contained herein without seeking the advice of an experienced attorney.

Attorney Advertising

New Jersey Fantasy Sports Operator Settles with State

September 13, 2019 by David Klein

September 13, 2019

New-Jersey-fantasy-sports — New Jersey Fantasy Sports

On August 16, 2019, fantasy sports operator SportsHub Games Network, Inc. (“SportsHub”) and the New Jersey Attorney General entered into a Consent Order in which SportsHub agreed to pay a $30,000 penalty for operating a fantasy sports website in New Jersey without a permit. Pursuant to the terms of the New Jersey fantasy sports Consent Order, SportsHub took steps to obtain the necessary permits to operate in the State and agreed to amend its business practices so that its Website Privacy Policy and Terms and Conditions complied with the State’s consumer protection laws.

What were the terms of the Consent Order?

[Read More]

Free Trial Law and the FTC

September 10, 2019 by David Klein

September 10, 2019

On July 12, 2019, the Federal Trade Commission (“FTC”) filed a complaint against AH Media Group, LLC, and its owners, Henry Block and Alan Schill (collectively, “Defendants”), for allegedly violating certain free trial laws as codified in Section 5(a) of the FTC Act, Section 4 of the Restore Online Shoppers’ Confidence Act (“ROSCA”), Section 907(a) of the Electronic Funds Transfer Act (“EFTA”), and Section 1005.10(b) of Regulation E, respectively. The Defendants have agreed to a preliminary injunction, barring them from continuing to run negative option plans tied to “free” trial offers.

How did the Defendants’ “free” trial offers allegedly violate free trial law?

[Read More]

Reminder: Nevada Opt-Out Requirements Take Effect October 1

August 22, 2019 by David Klein

August 22, 2019

We have previously blogged about Nevada Senate Bill 220 and how it amended Nevada’s data privacy law to provide consumers with the ability to opt-out of the sale of their personally identifiable information to certain businesses. Given that the Nevada opt-out requirements go into effect on October 1, 2019, we wanted to remind our readers of the measures that need to be addressed in order to be ready as of the effective date.

What are the Nevada opt-out requirements?

[Read More]

Nevada Privacy Law Amended to Include Opt-Out Rights

June 7, 2019 by David Klein

June 7, 2019

On May 29, 2019, Senate Bill 220 (the “Law”) was signed into law by Nevada Governor Steve Sisolak. The Law amends Nevada’s privacy law to grant consumers the right to prevent certain businesses from selling their personally identifiable information. Businesses that were already preparing for California’s Consumer Privacy Act (“CCPA”) (which takes effect on January 1, 2020), must accelerate compliance measures for the Nevada Privacy Law effective October 1, 2019.

What are the changes to Nevada’s existing privacy law?

[Read More]

FTC Acts to Enforce Non-Disparagement Provision Ban

May 10, 2019 by David Klein

May 10, 2019

The Federal Trade Commission (“FTC”) has settled its first Consumer Review Fairness Act (“CRFA”) violation investigations. Enacted in December of 2016, the CRFA prohibits businesses from offering provisions in form contracts that prevent customers from publicly expressing honest reviews about products or services, or penalizing those customers who have publicized such reviews. Complaints were filed against: 1) A Waldron HVAC, LLC and its owner; 2) National Floors Direct, Inc.; and 3) LVTR LLC and its owner (collectively, “Respondents”). In the complaints, the FTC alleged that Respondents violated Section 2(c) of the CRFA, by offering customers form contracts that contained non-disparagement provisions. In each case, the Respondents have accepted proposed consent agreements, and are awaiting public comment before a final order is entered.

Why were the non-disparagement provisions deemed invalid?

[Read More]