Privacy and Data Security
Florida has become the latest state – approximately ten – to enact a comprehensive privacy law. On June 6, 2023, Governor DeSantis recently signed SB 262 which includes some new privacy provisions. Florida also recently passed a child privacy law that is notably similar to California’s Age Appropriation Act that becomes effective July 1, 2024.
The Florida Digital Bill of Rights Law
Covered entities (“controllers”) include those that earn $1 billion in global gross annual revenues and either (i) receive 50% of gross annual revenue from online ad sales; (ii) operate a consumer smart speaker and voice command service with an integrated virtual assistant through a cloud-connected service and hands-free verbal activation; or (iii) operate an app store or digital distribution platform that has at least 250,000 apps available for download.
Note, however, that non-covered entities that serve as data processors for covered entities may potentially be impacted. More specifically, such processors are required to support a covered entities’ compliance efforts and to maintain responsible contracts that include provisions governing data processing. In fact, the new law sets forth specific requirements that must be included in such data processing agreements.
Not unlike other states, the Florida Digital Bill of Rights Law has numerous exemptions and applies to consumer information. Exemptions include entities covered by HIPAA (and business associates), financial institutions and affiliates (subject to GLBA), non-profits, certain government entities, and higher education institutions. There are also specific data exemptions.
On May 23, 2023, the Federal Trade Commission hosted a national workshop designed to consider the current state of recycling practices and recycling-related advertising.
This follows an FTC announcement in December 2022 that the agency was seeking public comment on potential updates and changes to its ‘Green Guides’ for the use of environment marketing claims. The Green Guides help marketers avoid making environmental marketing claims that are unfair or deceptive under Section 5 of the FTC Act.
Updates to ‘Green Guides’
In December 2022, the FTC announced that it would seek public comment on potential updates to its “Green Guides” for the use of environmental marketing claims. FTC attorneys seek to update the Green Guides based on increasing consumer interest in buying environmentally friendly products. The comment period was extended through April 24, 2023.
“Consumers are increasingly conscious of how the products they buy affect the environment, and depend on marketers’ environmental claims to be truthful,” said FTC lawyer and Bureau of Consumer Protection Director Samuel Levine. “We look forward to this review process, and will make any updates necessary to ensure the Green Guides provide current, accurate information about consumer perception of environmental benefit claims. This will both help marketers make truthful claims and consumers find the products they seek.”
The Green Guides were first issued in 1992 and were revised in 1996, 1998, and 2012. They provide guidance on environmental marketing claims, including how consumers are likely to interpret particular claims and how marketers can substantiate these environmental claims to avoid deceiving consumers.
The Florida Telephone Solicitation Act (“FTSA”) has long been criticized for numerous reasons, including an overly broad and vague autodialer definition. Florida’s Governor recently signed HB 761, which makes significant, telemarketer friendly changes, to the FTSA (Fla. Stat. § 501.059).
Fewer Types of Telemarketing Equipment Covered
The amendments narrow the types of telemarketing equipment covered by the statute.
For example, prior the the amendments, autodialing restrictions applied to “automated system[s] for the selection or dialing of telephone numbers.” Now, the amended autodialing restrictions apply only to “automated system[s] for the selection and dialing of telephone numbers.” The foregoing effectively eliminates the legal argument that a dialing or texting platform falls under the statute even if the calling party manually selects or dials a telephone number to be called or texted.
Caveat, the amended version of the statutes continues to restrict “the playing of a recorded message when a connection is completed to a number called, or the transmission of a prerecorded voicemail.”
Text Message Notice and Cure Period
The revised statute provides for a fifteen (15) day notice and cure period before a plaintiff is permitted to initiate formal legal action. For example, by responding “STOP” to message.
Expanded Definition of “Signature”
The modified statute has a broadened definition of “signature” and includes “checking a box” and “responding affirmatively to receiving text messages.” Digital signatures may be acceptable to obtain prior express written consent provided that “such form of signature is recognized as a valid signature under applicable federal law or state contract law.”
Retroactive Application
Florida Telephone Solicitation Act class action cases that are not certified prior to the effective date of the statutory amendments are subject to the retroactive application of the new legislation.
FTC issues policy statement addressing emerging technologies that might harm consumers and violate the FTC Act.
On May 18, 2023, the Federal Trade Commission issued a warning that the increasing use of consumers’ biometric information and related technologies, including those powered by machine learning, raises significant consumer privacy and data security concerns and the potential for bias and discrimination.
Biometric information refers to data that depict or describe physical, biological, or behavioral traits, characteristics, or measurements of or relating to an identified or identifiable person’s body.
“In recent years, biometric surveillance has grown more sophisticated and pervasive, posing new threats to privacy and civil rights,” said FTC lawyer Samuel Levine, Director of the FTC’s Bureau of Consumer Protection. “Today’s policy statement makes clear that companies must comply with the law regardless of the technology they are using.”
In a policy statement, the Commission said the agency is committed to combatting unfair or deceptive acts and practices related to the collection and use of consumers’ biometric information and the marketing and use of biometric information technologies.
Recent years have seen a proliferation of biometric information technologies. For instance, facial, iris, or fingerprint recognition technologies collect and process biometric information to identify individuals. Other biometric information technologies use or claim to use biometric information in order to determine characteristics of individuals, ranging from the individuals’ age, gender, or race to the individuals’ personality traits, aptitudes, or demeanor.
As previously blogged about here, the FCC recently proposed a rule that would turn the lead generation on its head. The proposed new rule goes quite a bit further than simply requiring wireless carriers to block texts from illegitimate numbers.
In addition to carrier investigation and blocking obligations, as well as an extension of DNC protections to text messages, the FCC proposes:
“…to ban the practice of obtaining a single consumer consent as grounds for delivering calls and text messages from multiple marketers on subjects beyond the scope of the original consent.”
In an illustration of the issue, Company A describes a website that purports to enable consumers to comparison shop for insurance. The website sought consumer consent for calls and texts from insurance companies and other various entities, including Company A’s ‘partner companies.’ The ‘partner companies’ were listed in a hyperlink on the web page (i.e., they were not displayed on the website without clicking on the link) and the list of ‘partner companies’ included both insurance companies and other entities that did not appear to be related to insurance.”
Public Knowledge, an influential non-profit Washington, D.C.-based public interest group argues that lead generators and data brokers use hyperlinked lists to harvest consumer telephone numbers and consent agreements on a website and pass that information to telemarketers and scam callers. Commentors have argued that the telemarketer that obtains the consumer’s contact information from the lead generator may believe that it has the consumer’s prior express consent,
On May 3, 2023, the FTC announced that it is proposing a blanket prohibition preventing Facebook from monetizing youth data. The Commission alleges that the company violated the 2020 privacy order and now proposes new protections for children and teens.
The Federal Trade Commission proposed changes to the agency’s 2020 privacy order with Facebook after alleging that the company has failed to fully comply with the order, misled parents about their ability to control with whom their children communicated through its Messenger Kids app, and misrepresented the access it provided some app developers to private user data.
“Facebook has repeatedly violated its privacy promises,” said FTC lawyer Samuel Levine, Director of the FTC’s Bureau of Consumer Protection. “The company’s recklessness has put young users at risk, and Facebook needs to answer for its failures.”
As part of the proposed changes, Meta, which changed its name from Facebook in October 2021, would be prohibited from profiting from data it collects, including through its virtual reality products, from users under the age of 18.
The company would also be subject to other expanded limitations, including in its use of facial recognition technology, and required to provide additional protections for users.
This marks the third time the agency has taken action against Facebook for allegedly failing to protect users’ privacy.
The Commission first filed a complaint against Facebook in 2011, and secured an order in 2012 barring the company from misrepresenting its privacy practices.
Lead generators beware. The FTC has issued a Notice of Proposed Rulemaking that would turn the lead generation industry on its head.
Amongst numerous items currently on the FCC’s agenda, there is discussion on closing the “lead generator” loophole.
The FCC Chairwoman has proposed a new rule that would block unlawful robotexts. Read more, here.
The FCC first issued a Report and Order requiring mobile wireless providers to block text messages from numbers on a reasonable Do Not Originate list, which includes numbers that purport to be from invalid, unallocated or unused North American Numbering Plan numbers, and numbers for which the subscriber to the number has requested that texts purporting to originate from that number be blocked. The FCC already requires similar blocking of voice calls by gateway providers.
The Report and Order would also ensure that any erroneous text blocking can be reported to the provider doing the blocking by requiring mobile wireless providers to maintain a single point of contact for texters to report erroneously blocked texts. This single point of contact is already required for voice call blocking.
Even more significant for lead generators is that the FCC has issued a NPRM that would require carriers to “investigate and potentially block texts from a sender after they are on notice from the Commission that the sender is transmitting suspected illegal texts…”
Additionally, the FCC has proposed an extension of DNC protections to text messages.
February 2023 has been a busy couple of months at the Federal Trade Commission. High-profile consumer protection actions and announcements span a broad spectrum of digital advertising and marketing. From “review hijacking, health product-related claim substantiation issues and lead generation, to the first Health Breach Notification Rule case and a reminder that willful blindness is not a defense for service providers that turn a blind-eye to third-party conduct. The FTC also announced a new office to keep pace with digital marketplace developments, and issues a Criminal Liaison Unit Report.
First Law Enforcement Action “Review Hijacking”
According to the Commission, a marketer of vitamins and other supplements, called The Bountiful Company, abused a feature of Amazon.com to mislead consumers into thinking that its newly introduced supplements had more product ratings and reviews, higher average ratings, and “#1 Best Seller” and “Amazon’s Choice” badges. The agency alleges that Bountiful carried out this tactic by merging its new products on Amazon with different well-established products that had more ratings, reviews, and badges.
“Boosting your products by hijacking another product’s ratings or reviews is a relatively new tactic, but is still plain old false advertising,” said Samuel Levine, Director of the FTC’s Bureau of Consumer Protection. “The Bountiful Company is paying back $600,000 for manipulating product pages and deceiving consumers.”
Bountiful, based in Bohemia, New York, manufactures vitamin, mineral, and other nutritional supplements. Its brands include Nature’s Bounty and Sundown. As alleged by the FTC, Bountiful sells its supplements to Amazon,
On December 6, 2022, New York Governor Kathy Hochul signed legislation intended to crack down on unwanted telemarketing calls.
Legislation (S.8450-B/A.8319-C) requires telemarketers to give customers the option to automatically be added to the company’s do-not-call list at the beginning of certain telemarketing calls, right after the telemarketer’s name and solicitor’s name are provided, and before addressing the purpose of the call, etc.
Caveat, telemarketers that utilize pre-recorded messages must ensure that an automated means exists for consumers to have their telephone numbers suppressed. Consult with a state attorney general (AG) defense lawyer about the applicability of the new legislation, adjustment of scripts, and the implementation of appropriate disclosures and suppression protocols.
We are dialing up our efforts to give New Yorkers a break from unsolicited telemarketing calls,” Governor Hochul said. “For too long, New Yorkers have dealt with these nuisance calls, not knowing they can avoid these interactions by being added to a telemarketer’s do-not-call list. This new legislation will protect New Yorkers from receiving frustrating, unwanted calls by better providing information on do-not-call lists.”
Under existing law (Section 399-Z), telemarketers are required to inform individuals that they may request to be added to their company’s do-not-call list. However, not at the beginning. According to the NY Attornehy General’s office, consumers usually hang up before a telemarketer or recording has mentioned the do-not-call list, allowing telemarketers to continue calling them again and again.
According to the Telephone Consumer Protection Act, only “residential telephone subscribers” possess a right of action for violations of the Do-Not-Call registry.
Specifically, 47 U.S.C. § 227(c)(1) directs the FCC to promulgate DNC regulations to “protect residential telephone subscribers’ privacy rights to avoid receiving telephone solicitations to which they object.” 47 C.F.R. § 64.1200(c)(2) prohibits telephone solicitation calls to “[a] residential telephone subscriber who has registered his or her telephone number on the national do-not-call registry.”
But what about numbers that are used for both residential and business purposes?
In Chennette v. Porch.com, Inc. (50 F.4th 1217 (9th Cir. 2022)), the Ninth Circuit recently held that a fact-specific inquiry into each separate telephone number is required in order to determine whether a mixed-use telephone line is “residential.”
Here, the plaintiffs were home improvement contractors that allegedly received unsolicited text messages from Porch.com and its subsidiary, GoSmith that offered leads. Numerous plaintiffs purportedly registered their telephone numbers on the national DNC registry but allegedly received over 2,000 text messages. As a result, the plaintiffs filed suit in federal court alleging violations of the TCPA based upon use of an automated telephone dialing system to send automated text messages and violations of the DNC registry prohibitions.
The defendants filed a motion dismiss. They argued that the plaintiffs lacked standing to sue under the TCPA because their telephone numbers are used for personal and business purposes.
The Ninth Circuit reversed the lower federal court ruling.
In doing so,
Topics
Archives
About This Blog and Hinch Newman’s Advertising + Marketing Practice
Hinch Newman LLP’s advertising and marketing practice includes two decades successfully resolving some of the highest-profile Federal Trade Commission (FTC) and state attorneys general digital advertising and telemarketing investigations and enforcement actions. As FTC attorneys, the firm possesses superior compliance knowledge and deep legal advocacy experience in the areas of advertising, marketing, lead generation, promotions, e-commerce, privacy and intellectual property law. It has also been selected to author the Consumer Protection Section of the prestigious American Lawyer Media International Federal Trade Commission: Law, Practice and Procedure Treatise, a comprehensive resource for developments of concern to advertisers, marketers and legal professionals that practice before the Commission. Through these advertising and marketing law updates, Hinch Newman LLP provides commentary, news and analysis on issues and trends concerning developments of interest to digital marketers, including FTC and state attorneys general advertising compliance, civil investigative demands (CIDs), and administrative/ judicial process.