Has The 9th Circuit Raised The Bar For Text-Message Affiliate Marketing?

Did text-message advertising get more difficult after last week’s decision by the U.S. Court of Appeals for the Ninth Circuit in Satterfield v. Simon & Schuster, Inc.? Perhaps so, but not principally for reasons cited by many accounts and commentators reporting on the case.

Satterfield, the recipient of a text-message advertising a Stephen King novel sent by its publisher as part of an outsourced promo campaign, sued Simon & Schuster (and outsourcer ipsh!) under the Telephone Consumer Protection Act (“TCPA”), which prohibits (among other things) “calls” to numbers assigned to cellular and similar services sent by automatic telephone dialing system (or “ATDS”). Simon & Schuster defended on grounds the ad was not delivered by an ATDS as defined by statute, and that text messages are not “calls” as the TCPA requires. It also claimed the text fell under the law’s consent exception insofar as Satterfield received it after registering at Nextones.com (to allow her minor son to receive a free ringtone), where she agreed to terms and conditions (“T&Cs”) that included accepting on the registered cell phone promotions from the website’s affiliates and brands. Initially, Satterfield was turned aside on summary judgment when the trial court held the text was not sent by an ATDS and that Satterfield consented to its receipt (and thus did not reach arguments that text messages are not “calls” under the TCPA).

Last week, the Ninth Circuit reversed. It found, given dueling expert testimony, a material fact question that needed to be tried, as to whether the equipment that sent the text was an ATDS. It also held, based on Federal Communications Commission (“FCC”) pronouncements, and on the law’s legislative history and intent, that text messages are “calls” under the TCPA. This part of the decision became the headline in much reporting and commentary on the case, not to mention speculation about what it means to marketers. But classifying text messages to phone numbers as ATDS transmissions is hardly news – the FCC said they were over five years ago, and reiterated as much in adopting rules under the CAN-SPAM Act (which govern mobile service commercial messages to email addresses, which differ from text messages to phone numbers), so that question was never in serious doubt. Rather, the more intriguing aspect of the Ninth Circuit’s decision (in my view), which received less attention, comes in its last few pages.

There, the court rejected claims that the text-message was allowed based on consent Satterfield gave at the Nextones’ website to receiving promotions from its affiliates and brands. Rather than viewing who could be an “affiliate” of Nextones in more colloquial terms – which is the tone for which many online T&Cs and privacy policies strive to make them more consumer-friendly – the Ninth Circuit construed “affiliate” as having “independent legal significance” so as to require a corporate relationship between the entities “by shareholdings or other means of control.” Since Nextones and Simon & Schuster are not commonly controlled, the court reasoned, the publisher could not be an “affiliate” of Nextones from whom Satterfield consented to receive texted ads. The court took a similarly narrow view of “brands,” holding they are “commonly defined” as “goods identified as being … of a single firm,” so since the text message advertised a product of Simon & Schuster, not Nextones, consent did not exist on this basis, either.

The decision thus begs the question how a company’s website (and other peripheral materials) must identify third-parties who may market to the company’s consumers, in order for consent, such as that contemplated by the TCPA, to encompass third parties. If describing them as “affiliates” will not suffice – and, one would think, the prospect exists of courts like the Ninth Circuit imposing legally-specific definitions on, or finding equally insufficient otherwise, other commonly used colloquialisms such as “partners,” “clients” or “co-marketers” – how are companies to describe such third-party marketers in a way that is both understandable and succinct, while still being meaningful to consumers? That, I believe, is among the principal challenges facing marketers in the wake of the Ninth Circuit’s Satterfield decision.
 

We're Baaaaaaack.

Those of you who were once frequent visitors to this blog may, by now, be asking one or more of the following questions:

(a) Why haven’t you guys posted anything for so many months?
(b) Why does the site look different?
(c) Who’s going to win the NBA playoffs?
(d) Why did they cancel My Name is Earl?

Well, the first two at least. The truth is that this blog was started in August 2005, and ran steadily (sometimes more steadily than others) for about three years. As blogs go, that’s a fairly distinguished record – there are more abandoned blogs lining the sides of the Information Superhighway than there are hubcaps along the Cross Bronx. Wait, did we actually just use the phrase “Information Superhighway”? Because that is so 2005. As is that phrase we just used.

So anyway, when our firm decided to revamp its website, we took this as an opportunity to think seriously (read: discuss over drinks) what we wanted to accomplish with this blog, and what we needed to do to keep it fresh and relevant. The process has taken a bit longer than we expected, but here’s where we are:

Rather than a long list of bloggers, you will be getting regular updates from just five of us – and henceforth there will be no more posts in this annoying third-person, royal we, voice. We may have some guest bloggers on occasion, but for the most part you can level any criticisms at the following:

Bruce Johnson, our Burgermeister-Meisterburger, who will be blogging on the topic of Personal Communications (blogging, employee/employer relations, etc.)

Randy Gainer, who will be captivating you with stories about the Government Surveillance (ECPA/CFAA, CALEA, REAL ID/travel issues, etc.)

Charlene Brownlee, who is by far the most stylish among us (and who will be blogging on the subject of Data Breaches and identity-theft laws)

Ronald London, who will endeavor to keep an eye on Congress and will be blogging about telemarketing, junk fax, CAN-SPAM, behavioral/advanced advertising, and CPNI (which we’ll call Marketing and Consumer Privacy)

Lance Koonce, who will try not to mangle any stories about Online Threats such as hacking, phishing, pharming, pretexting, malware/spyware, and offline versions such as dumpster diving and the theft/loss of data-containing devices.

We do not purport to be a source for all news that touches on privacy and security – the field has exploded and aggregating such information would be a full-time career. Rather, we hope to tease out interesting aspects of specific issues within our areas of coverage. We hope you’ll take a look, and keep coming back if what you see intrigues you.

Thanks,

The PrivSecBlog Team


And by the way:

The Lakers.
Ratings. And possibly bad karma.
 

FTC "Reminder" About ID Theft Red Flag Compliance

Our recent Advisory Bulletin recounts how the FTC recently issued issued a gentle reminder that companies should be well along in getting their Identity Theft Red Flag programs in place in anticipation of the November  2008 compliance deadline.  The FTC's notice announced that it also has launched an outreach effort to explain the rules, which included publication of a very general alert on what the rules require and what types of businesses must comply.

Continue Reading...

Malware Cited as the Cause of Massive Supermarket Data Breach

By Hozaifa Cassubhai

A massive data breach at an East coast supermarket chain compromised up to 4.2 million credit and debit cards earlier in March, leading to 1,800 cases of fraud arising as far away as Mexico, Italy and Bulgaria.  Recently, the Hannaford Bros. grocery chain announced the cause of that breach:  unauthorized software secretly installed on servers that intercepted data from customers as they paid with plastic at checkout counters.

Continue Reading...

Some State Data Encryption Requirements More Effective than Others

Posted by Randy Gainer

State and federal laws encourage businesses to encrypt consumers’ computerized personal information. Most state data breach notice laws do not require businesses to notify their customers when customers’ digital personal information has been stolen or lost if the information was encrypted. The Federal Trade Commission encourages but does not mandate that consumers’ personal data be encrypted. See Protecting Personal Information, A Guide for Businesses

Nevada enacted a statute that goes further and affirmatively requires businesses to encrypt certain consumer data. Washington and Michigan are currently considering legislation that would also require consumer data to be encrypted. The Nevada statute and the pending Washington and Michigan bills contain different encryption requirements. Of the various measures, the proposed Michigan bill and the Washington Senate bill would most effectively protect consumer data if they are enacted.

Continue Reading...

Privacy Coalition Requests FTC to Probe Ask.com; In Response, Ask.com and its Allies Cry Foul

Posted by Hozaifa Cassubhai

The election season may be in full swing, and the buzz about the recent Superbowl at full throttle, but heated debates and bravado are not just limited these days to politicians and athletes.  Recently, search engine vendor Ask.com and its supporters have come out swinging against several privacy groups over a complaint they recently filed that requested the Feds to forcibly pull the plug on a new feature called AskEraser. As Nicholas Graham, a spokesman for Ask.com stated: [The complaint] merits a 15-yard penalty for unsportsmanlike conduct.

Continue Reading...

FTC Data Security Consent Decree Suggests Minimum Steps Companies Must Take

Posted by Ronald London

The FTC recently announced a consent decree with online retailer Life is good (www.lifeisgood.com) that offers insight into what that agency may believe are the bare minimum steps companies must take when making the kind of generic we-protect-the-information-you-give-us statements found in most privacy policies. The FTC claimed Life is good offered such reassurances but failed to have in place sufficient measures (from the FTC's view) to back them up, based on the ability of a hacker to use SQL injection attacks on Life is good’s website to access consumers' credit card numbers, expiration dates, and security codes. To resolve allegations in a draft complaint the FTC had prepared alleging unfair trade practices, Life is good settled the claims by entering a consent decree requiring it to adopt a comprehensive information-security program and obtain biennial audits by an independent third-party security professional … for the next 20 years.

Continue Reading...

California Breach Disclosure Law Now Covers Medical Records

By Charlene Brownlee

California extended its data breach notification law to include incidents involving electronic medical and health insurance information. California's data breach law, SB 1386, had previously covered only financial records. The new law, AB 1298 took effect January 8, 2008. The law adds medical and health-related information to the existing breach notification law definition of "personal information" and expands the application of the Confidentiality of Medical Information Act (CMIA) to include any business organized for the purpose of maintaining medical information.

Continue Reading...

Record Number of Data Breaches Reported in 2007, But Optimism Reigns

Posted by Hozaifa Cassubhai

The number of publicly reported data breaches in the United States rose by more than 40 percent in 2007, according to the Identity Theft Resource Center (ITRC), and it appears Microsoft, among others, is taking steps in response.

Continue Reading...

Report on the FTC's Conference on "Ehavioral Advertising"

Posted by K.C. Halm, Ronald London, Razeeb Hossain, and Anne Shelby

In early November the FTC held a series of roundtables and panels to discuss emerging issues in behavioral advertising. The FTC has posted transcripts, videos, the workshop agenda and a list of all participants on its website, found here.

Common discussion themes throughout the two-day workshop included the contradiction between consumers' failure to protect their personal information despite their stated concern with privacy; the perceived need for greater transparency in privacy policies, especially with respect to providing more detailed descriptions of data use; the disagreement between the infor-mation industry and consumer groups as to the efficacy of private sector self-regulation; debate over the best methods to inform consumers of their privacy choices; and concern over the coming use of developing technologies for data collection, use and disclosure.

A detailed discussion of the sessions follows below. 

Continue Reading...