Blog

CBD Cosmetics Advertising Guidelines

March 5, 2020 by David Klein

When the Agriculture Improvement Act of 2018 (the “Farm Bill”) was signed into law in December 2018, it gave the Cannabidiol (“CBD”) industry hope that this would be a boon for business. With the passage of the Farm Bill, companies thought that they would now be able to legally sell all things CBD infused, including CBD cosmetics, foods, drinks, animal treats, etc. However, the Farm Bill explicitly preserved the Food and Drug Administration’s (“FDA”) authority to regulate products containing cannabis or cannabis-derived compounds under the Federal Food, Drug and Cosmetic Act (the “FD&C Act”) and Section 351 of the Public Health Services Act (the “PHS Act”). The Farm Bill also gave states the power to establish their own regulations applicable to the production, sale and distribution of CBD products. As a result, companies that sell cosmetics containing CBD ingredients must be aware of both federal and state regulations concerning the lawful labeling and advertising of CBD cosmetics.

What must CBD businesses know about the advertising of CBD cosmetics?

[Read More]

CCPA Forms: The Right to Opt-Out, Request to Know and Request to Delete

February 28, 2020 by David Klein

Readers of this blog have been following our coverage of the California Consumer Privacy Act (“CCPA”) and related regulatory developments. In today’s blog, we detail some of the compliance measures that should be taken with respect to consumer data election rights and the associated CCPA forms through which consumers can make these elections. Among other measures, the CCPA has codified California consumers’ rights to: 1) opt-out of the sale of their personal information to third parties; 2) request to know what personal information businesses have collected about them and how businesses have sold or disclosed that information to third parties; and 3) request that businesses delete personal information that has been collected from/about them. With limited exceptions, businesses should provide consumers with CCPA forms to make elections by and through their websites.

What are CCPA forms and when should they be processed?

CCPA Forms

In order to comply with the CCPA, each business is required to “provide two or more methods for submitting requests to opt-out, including, an interactive form accessible via a clear and conspicuous link titled ‘Do Not Sell My Personal Information,’ or ‘Do Not Sell My Info,’ on the business’ website or mobile application.” Businesses do not need to provide an opt-out form if they do not sell personal information and explain this fact in their privacy policies. Opt-out forms should: 1) include a description of consumers’ rights to opt-out of the sale of their personal information; 2) use plain, straightforward language and avoid technical or legal jargon; 3) provide instructions on any other method by which consumers may submit their requests to opt-out; and 4) be reasonably accessible to consumers with disabilities. The modified CCPA regulations have removed the requirements that opt-out forms include proof when consumers are using authorized agents to exercise their rights to opt-out and that opt-out forms provide links to the URLs of businesses’ privacy policies.

The most recent proposed CCPA regulation revisions have eliminated the requirement that businesses operating exclusively online that have a direct relationship with their consumers provide a web-based CCPA form to submit right to know requests. These businesses are now only required to provide an email address. All other businesses must provide two (2) methods for submitting requests to know including, but not limited to, a toll-free telephone number and, a designated email address or a form that can be submitted by U.S. Mail. When supplying consumers with the ability to delete their personal information, businesses must provide two (2) or more methods for submitting these requests. Methods include, but are not limited to, a toll-free number, a link or form available online through a business’s website, or a designated email address. If businesses create CCPA forms to satisfy right to know and deletion election requirements, they too should use plain, straight forward language, which must be reasonably accessible to consumers with disabilities. Please note that the modified CCPA regulations no longer require a two-step process to effectuate online requests to delete.

Processing CCPA Forms

Businesses must comply with requests to opt-out no later than fifteen (15) business days from the date the requests are received. If a business sells a consumer’s personal information after the request to opt-out has been received, but before that business has complied with the request, it must notify third parties that have received consumer personal information from the company in this interim period that the consumer has elected to opt-out and that these third parties may no longer sell that consumer’s personal information. Businesses must confirm receipt of right to know and deletion requests within ten (10) business days of receiving such requests and respond to these requests within forty-five (45) calendar days from the date that the subject requests were received. If necessary, businesses that are unable to respond to requests within the forty-five (45) calendar day period may take an additional forty-five (45) calendar days to respond, provided that they provide consumers with notice and explanation that an extension is required.

CCPA forms are just one regulatory implementation measure that should be taken on the path to CCPA compliance. If you are interested in learning more about this topic or require assistance with consumer data privacy compliance for your business, please email us at info@kleinmoynihan.com, or call us at (646) 713-1684.

The material contained herein is provided for informational purposes only and is not legal advice, nor is it a substitute for obtaining legal advice from an attorney. Each situation is unique, and you should not act or rely on any information contained herein without seeking the advice of an experienced attorney.

Attorney Advertising

Related Blog Posts

CCPA Law: The Private Right of Action

CCPA Service Provider Requirements Clarified by California AG

CCPA Amended to Require California Data Broker Registration

Consumer Privacy Compliance Primer

February 27, 2020 by David Klein

As readers of this blog know, businesses face significant liability if they fail to take their consumer privacy obligations seriously. These obligations can vary widely based on the kind of information a business collects and where a consumer is located. Privacy compliance is an essential consideration for many businesses, and properly obtaining consumer consent to collect, use and/or share consumer data is critical.

How Should Businesses Obtain Consumer Consent?

Existing Privacy Frameworks

The global trend toward increased consumer privacy protections continues, and jurisdictions across the world are developing new laws and updating existing frameworks to regulate the collection, use and sharing of consumer data. California and the European Union (“EU”) are unquestionably leading the pack on this front. On May 25, 2018, the General Data Protection Regulation (“GDPR”) went into effect in the EU. To date, the United States has not passed comprehensive federal privacy regulations, but privacy legislation has been proposed or enacted in several states. Most notably, on January 1, 2020, the California Consumer Privacy Act (“CCPA”) went into effect. Both the GDPR and CCPA significantly changed businesses’ obligations regarding consumer data.

When it comes to consumer consent, the GDPR can generally be described as an opt-in regime. The GDPR requires that consent be “freely given, specific, informed and unambiguous.” For US-based businesses, the GDPR may be of limited application, as it generally only applies to businesses that collect, retain or use the personal data of EU residents. By contrast, virtually all US-based businesses must carefully analyze (and most likely, implement) the CCPA’s various requirements. The CCPA imposes an opt-out regime on businesses that collect, use or share the data of California residents. Under the CCPA, businesses must allow California consumers to opt-out of the sale of their personal information. Businesses must post “clear and conspicuous” opt-out language on their websites, allowing consumers to exercise their rights under the CCPA.

Within the United States, the CCPA is seen as the standard of privacy legislation. In large part, this is due simply to California’s size. The CCPA sets out specific requirements for how a company must honor consumers’ right to know, deletion and opt-out elections; and a number of other states are following suit. For example, in 2019, the New York Privacy Act was introduced by the State Legislature. The bill, in many respects, mirrored the GDPR’s opt-in consent requirements. However, the New York measure went further, requiring businesses to act as “data fiduciaries” for consumers. Under this proposal, businesses would have been required to place the best interests of consumers before any duties owed to its owners or shareholders. Although the bill did not gain sufficient traction during a recent legislative session and ultimately failed to become law, new data privacy compliance legislation is likely to pass in New York in the near future.

Consent and Privacy Compliance

Many of the most significant privacy laws are relatively new, and the exact requirements are still evolving. Moreover, new legislation is proposed all the time. It is impossible to predict exactly what the privacy landscape of the future will look like. However, there are steps that businesses can take today to ensure that they are flexible and able to adapt.

Only collect, use or share whatever consumer data is necessary to operate your business. Other than data obtained with the consumer’s consent, the GDPR sets forth five acceptable bases to collect, use or share consumer data. All of these bases have one thing in common: collect only what is necessary. This limits potential liability and will help streamline data management.
Use clear language. All privacy legislation seeks to increase transparency and empower consumers. Businesses should, therefore, ensure that their privacy policies are clear and unambiguous. In addition, privacy-related information should not be hidden within websites, but should be prominently featured and built into the consent portion of the online registration/purchasing process.
Create and maintain systems for consumers to revoke and limit their consent. The concept of “Privacy by Design” has spread beyond the EU, and there is every reason to expect that legislation in other jurisdictions will require businesses to afford consumers far greater data privacy rights than exist today.

Businesses’ privacy compliance obligations are always changing. To that end, it is important to work with counsel experienced in this space. If you need to review your privacy policies or need assistance understanding the changing laws affecting consumer privacy compliance, please e-mail us at info@kleinmoynihan.com, or call us at (646) 350-1736.

Attorney Advertising

Responding to Trademark Office Actions

February 24, 2020 by David Klein

Approximately three (3) months after submitting a trademark application to the United States Patent and Trademark Office (“USPTO”), the application will be assigned to an Examining Attorney. The Examining Attorney will review the application for any administrative or substantive issues and deliver an “office action” if there are any such issues. If no issues with the application are identified, the mark will be submitted for publication. If no oppositions are filed during the publication period, the mark will proceed to registration in less than three (3) months.

What is an office action and how do you respond to it?

[Read More]

Fantasy Sports Law Today

February 20, 2020 by David Klein

Daily fantasy sports exploded onto the landscape approximately five (5) years ago. Since then, the industry has been shaped by substantial fantasy sports law developments that have required deft navigation by operators that offer fantasy sports contests to consumers. The flurry of legal changes has given rise to nuanced regulatory differences across various jurisdictions. This has made it easy to lose sight of some of the requirements that are common to all jurisdictions.

What are some of the common fantasy requirements across jurisdictions?

[Read More]

HBO’s McMillion$: A Reminder to Comply with Sweepstakes Law

February 14, 2020 by David Klein

If you want to enter the sweepstakes business, familiarize yourself with the law and consult legal counsel to ensure compliance.

February 14, 2020

HBO’s new docuseries, McMillion$, is the fascinating story of how the sponsors of the McDonald’s Monopoly sweepstakes were scammed out of $24 million dollars in the 1990s. Despite the scam, the McDonald’s Monopoly sweepstakes was an otherwise successful partnership between two iconic brands (the fast-food chain and the board game), a promotion that was often used by McDonald’s over the years to increase foot traffic when sales were low. Any business owner who has watched episode 1 of the series may be prompted to introduce a sweepstakes to generate excitement among her/his customers. Before doing so, however, it is wise to speak with a promotions attorney who is familiar with the nuances of sweepstakes law.

What are the basics of sweepstakes law?

[Read More]

Daily Fantasy Ruling Could Spur Change To NY Gambling Ban

February 13, 2020 by David Klein

A New York State appellate court has issued a ruling on daily fantasy sports that could change the State’s constitutional ban on gambling.

By Zachary Zagger

Law360 (February 11, 2020, 10:21 PM EST) — A New York state appellate court has thrown daily fantasy sports into hot water by finding that contests like those offered by DraftKings and FanDuel are illegal. But the ruling could actually push lawmakers to change the state’s constitutional prohibition on gambling expansion, potentially clearing the way for mobile and online sports betting at the same time.

The New York Appellate Division, Third Department, found Thursday that daily fantasy sports, or DFS, contests are gambling under the state penal code. The court struck down a 2016 law passed at the eleventh hour to legalize DFS amid enforcement actions by the state attorney general against DraftKings and FanDuel, finding the law violated the state constitution’s prohibition on gambling expansion.

But the new ruling comes after DFS has already gained a foothold in New York and amid a growing push to legalize online and mobile sports betting now that the U.S. Supreme Court has allowed it. Such sports betting has proven to be a strong source of tax revenue for neighboring New Jersey, but could be limited in New York by the same constitutional prohibition at the center of the DFS ruling.

Attorneys say that while the DFS ruling is sure to be appealed, lawmakers would be smart to start the long process of amending the state constitution to allow state lawmakers to keep DFS and permit mobile sports betting so as not to get left behind neighboring states.

“Does it call for a constitutional amendment? Absolutely, and I think it is likely that it will happen,” said gambling industry attorney David O. Klein, the managing partner at Klein Moynihan Turco LLP. “They’ll kill two birds with one stone so to speak and [propose] a constitutional amendment to change the law such that both fantasy sports and sports gambling will be legalized.”

Notably, the appellate court rejected the legislature’s determination that DFS — in which contestants compete for cash prizes by selecting an imaginary roster of athletes with points awarded on the real- life performance of those athletes over a short period of time — contests are games of skill, and therefore not gambling.

Lawmakers had relied in part on evidence presented by fantasy sports operators that showed DFS contests are games of skill since those with better research and statistical analysis skills perform much better in the contests. The evidence showed that a small percentage of DFS contestants win a large percentage of the overall prize money.

But the appellate court said that the legislature just cannot simply call DFS a skill-based game to avoid the constitutional prohibition because that would render the constitutional prohibition meaningless.

To make matters worse for DFS operators and proponents, the court went on to find DFS met the state’s definition of gambling. No matter how much preparation and skill is used in setting a DFS lineup, the actual performance of the real-life players is dependent on factors outside the DFS contestants’ control, the court said.

“I think this hammers home why the state of New York should have addressed this some time ago, not only for fantasy sports but also for mobile and online sports betting,” said C.J. Fisher, a gambling and sports industry attorney at Fox Rothschild LLP. “I would anticipate that even if there is a bill passed to expressly allow internet and mobile sports betting outside the commercial casino facilities, that that bill would also similarly be challenged in the state.”

New York’s constitutional amendment process is long and complicated, requiring legislative approval in two separate sessions and a statewide voter referendum. But attorneys point to some key differences between now and 2016, when the DFS law was passed, that might make a constitutional amendment more possible.

When then-Attorney General Eric Schneiderman was pursuing illegal gambling enforcement actions against DraftKings and FanDuel in 2015, several other state regulators followed suit.

But now many of those states have joined New York in legalizing DFS or their authorities are not actively pursuing DFS operators. In the Empire State, DFS companies have even formed partnerships with professional sports teams. Madison Square Garden, for instance, has opened several areas branded as “DraftKings Daily Fantasy Sports Lounges.”

There is also a strong push for mobile and online sports betting in New York now that the U.S. Supreme Court has opened the door for states to legalize sports betting. While New York has legalized in-person sports betting at upstate casinos that have popped up since a 2013 constitutional amendment, neighboring states New Jersey and Pennsylvania brought in more than $30 million each in taxes from sports betting that mostly occurred online or through mobile phone apps.

“New York is almost an island in and of itself. Is it going to be stuck far behind and are we going to be stuck based on this Third Department [ruling]? Or are we going to make the decision to move forward and get behind daily fantasy sports?” said Buffalo-based sports and entertainment attorney Anthony Kroese of Goldberg Segalla. “If they don’t make a change now, we are going to be way behind.”

Still, attorneys say an appeal is almost certain to occur, meaning New York’s highest court, the Court of Appeals, will have its say. The state has yet to confirm it plans to appeal the ruling, but New York does provide for an appeal to the Court of Appeals for cases involving substantial constitutional issues.

The Appellate Division panel analyzed DFS contests under New York’s definition of gambling, which follows a minority of states in defining gambling as wagering something of value on a game where chance is a “material” factor in the outcome. More states look at whether chance is the dominant factor, lowering the bar for the amount of skill necessary.

“This is an industry that is still subject to varied state laws and this decision highlights how those distinctions in the gambling laws that were drafted years ago could impact decisions in various states,” said BakerHostetler advertising attorney Linda Goldstein, who has represented fantasy sports and other gaming companies.

Goldstein said the New York appellate court ruling’s lone dissent by Justice Stan L. Pritzker, which said the court should not second-guess the legislature when there is a rational basis for its interpretation of the law, could give the Court of Appeals an alternative argument to latch onto to keep the DFS legalization law intact.

Either way, the ruling shows that the constitutional question will continue to be an impediment for state lawmakers to open the door to new forms of sports-related games and wagering.

“I really always thought that was the best way to deal with this issue once and for all, … just go through the constitutional process,” said attorney Irwin Kishner, co-chair of the sports law group at Herrick Feinstein LLP. “It has been done before. It takes time, but that is the way to go.”

–Editing by Emily Kokoll and Michael Watanabe.

CA Attorney General Releases New CCPA Law Modifications

February 12, 2020 by David Klein

February 12, 2020

Recently, the California Consumer Privacy Act (“CCPA”) regulations were modified by the California Attorney General.

The latest CCPA modifications were released on February 7, 2020, in an attempt to address issues that were raised during the public hearing and comment period that followed the release of the proposed regulations on October 11, 2019. The California Attorney General has announced a deadline of February 24, 2020, at 5:00 p.m. (PST) to submit written comments, in yet another attempt to clarify CCPA law.

How have the proposed regulations changed?

[Read More]