This week, the New York State Attorney General announced a $4.95 million settlement with Oath Inc., the result of an investigation into violations of the Children’s Online Privacy Protection Act (“COPPA”).

The NYAG found that Oath’s ad exchanges transferred persistent identifiers and geolocation from website users to DSP bidders in its automated auction process.  While that may be fine for websites directed to grown-up audiences, COPPA includes persistent identifiers and geolocation in its definition of “personal information.”  And under the law, companies must obtain verifiable parental consent before collecting or using children’s personal information.

But instead of seeking verifiable parental consent, Oath treated all websites (and therefore all user information) the same, despite knowledge that some website inventory on its exchange was directed to children under 13 and subject to COPPA.  And instead of using available technology to avoid the use of children’s information altogether, Oath’s ad exchanges allowed advertisers to collect information on children and display ads on sites targeting children.  The “flagrant” violations of the law led to the largest-ever penalty under COPPA and a settlement agreement provided some remarkable takeaways:


Continue Reading

For the fourth time, the Federal Trade Commission (FTC) has reached a consent agreement with a company for alleged misrepresentations regarding Privacy Shield certification. A California-based company, ReadyTech Corporation, agreed to a settlement whereby it is “prohibited from misrepresenting its participation in any privacy or security program sponsored by a government or any self-regulatory or standard-setting organization, including but not limited to the EU-U.S. Privacy Shield framework and the Swiss-U.S. Privacy Shield framework.” Privacy Shield is one of a few mechanisms that are available to U.S. companies for the lawful transfer of personal data from the European Union and Switzerland to the United States pursuant to applicable data protection laws including the new General Data Protection Regulation (GDPR). As part of the process, companies must self-certify with the Department of Commerce (DoC) and then annually re-certify that the company is Privacy Shield compliant.

Continue Reading

This month we’re celebrating Privacy Shield’s first birthday (admittedly, a bit belated) with an update on everything Privacy Shield. There have been a number of developments on the Privacy Shield-front that companies certified or seeking self-certification under Privacy Shield need to know. If you are looking for a quick primer on Privacy Shield, please check out our previous post here. Once you’re ready, read on:
Continue Reading

Earlier this month, three class action lawsuits were filed against companies for alleged violations of the Children’s Online Privacy Protection Act (“COPPA”). These lawsuits are raising eyebrows as COPPA does not provide for a private right of action, and a potential class certification could open the floodgates for COPPA-based lawsuits. Given these lawsuits and the recent enforcement actions brought by the FTC and the New York State Attorney General, companies more than ever need to understand their responsibilities and obligations under COPPA and maintain measures for compliance.
Continue Reading

Last week, the Federal Trade Commission (“FTC”) released a new report, Six-Step Compliance Plan for Your Business, to help companies understand their obligations under the Children’s Online Privacy Protection Act (“COPPA”). In addition to reviewing longstanding COPPA requirements, the report provides important new guidance on how COPPA applies to the rapidly evolving world of connected toys, online games and the Internet of Things (“IoT”). Here’s what you need to know.
Continue Reading

In what is being hailed by the Federal Trade Commission as “a record-setting win for American consumers,” and what should be viewed as a cautionary tale for marketers, satellite TV provider Dish Network (“Dish”) was recently found liable for repeated and willful violations of various federal and state telemarketing laws and ordered to pay 280 million dollars in damages in connection with a long-running lawsuit brought by the FTC, Department of Justice, and various state attorneys general.  This decision comes on the heels of last month’s order in a North Carolina class action lawsuit brought against Dish, awarding damages of 61 million to the class action plaintiffs based on many of the same unlawful practices.  The high monetary awards in both cases, and the additional restrictions imposed on Dish in the government’s lawsuit, highlight just how seriously regulators and courts are taking violations of the telemarketing laws.  In addition to the take-aways listed below, the big lesson from the Dish cases is that marketers who rely on a network of third-party vendors to reach out to new customers and turn a blind eye to those vendors’ compliance with the telemarketing laws do so at their peril –  and at the risk of millions in penalties. 
Continue Reading

In the past five months, we’ve seen a significant shift in the direction of privacy regulation at the federal level. As discussed in our previous post, Congress voted (and President Trump signed) a resolution repealing last year’s FCC Order that imposed greater obligations on broadband Internet service providers and other carriers regarding the protection of customer data. The FCC and FTC also announced that they intend to reverse the FCC’s 2015 decision to treat broadband Internet service providers as Title II common carriers, which would effectively return jurisdiction over broadband Internet service providers to the FTC. Then, at the beginning of this month, the Ninth Circuit granted a petition by the FTC to rehear its ruling from last year that the FTC lacked authority under the FTC Act to regulate AT&T as a common carrier.
Continue Reading

On March 1, 2017, the Federal Communications Commission (the “FCC”) voted 2-1 to issue a stay order temporarily halting the implementation of the Protecting the Privacy of Customers of Broadband and Other Telecommunications Services order (the “2016 Privacy Order”). The 2016 Privacy Order was adopted in October 2016 with the intention of imposing greater obligations on broadband Internet service providers and other telecommunications carriers to protect the privacy of their customers. Specifically, the 2016 Privacy Order created three categories for the use and sharing of customer information based on sensitivity: opt-in, opt-out, and exceptions to the consent requirements. In addition, the 2016 Privacy Order imposed new requirements related to notice, customer approval, and breach notification. You can read further about the elements of the 2016 Privacy Order in our previous post. The 2016 Privacy Order faced criticism from broadband industry trade groups, who alleged that it would subject Internet service providers to a different standard than other companies operating in the Internet space. 
Continue Reading

On February 6, 2017, the Federal Trade Commission (“FTC”) in conjunction with the Office of the New Jersey Attorney General announced a settlement with Vizio Inc. (“Vizio”), including payment of $1.5 million to the FTC and $1 million to the New Jersey Division of Consumer Affairs, with $300,000 of that amount suspended, over claims that Vizio’s smart TVs collected information about consumers’ video viewing behavior and shared that data with third parties without sufficient notice or consent. This settlement, along with pending class action litigation against Vizio involving similar allegations, reflects some of the privacy issues faced by developers in the Internet of Things space.
Continue Reading

Shortly after FTC staff published the results of their study on cross-device tracking (described in this prior blog post), the FTC issued its own comprehensive report on the topic.  In addition to highlighting many of the same benefits and privacy concerns raised by cross-device tracking, the FTC report provides an update on industry self-regulatory efforts in this area, along with practical recommendations for those involved in cross-device tracking, based on learnings from past FTC enforcement actions.
Continue Reading