Advising e-Commerce Business Startups: A Crib Sheet

Editor's Note: This month, in the first of a two-part article, our expert author examines some issues that e-commerce counsel should pay particular attention to when advising e-commerce startups, particularly small, single-entrepreneur or small-group driven Internet-based storefronts. See the April edition of e-Commerce Law & Strategy for Part Two.

The legal risks associated with operating an online business are largely hidden to many people who are lured by the dream of making their fortunes with the apparent ease of opening a virtual storefront.

But the risks of setting up a virtual storefront ' an e-commerce venture ' can exceed those of operating a real-world, bricks-and-mortar business operation, where relationships with consumers are often based on tangible items.

In the virtual world, a business owner may face a number of additional problems, including:

• Copyright infringement;
• Trademark infringement;
• Intellectual property ownership;
• Libel and slander;
• Identity theft;
• Jurisdictional issues
• Invasion of privacy; and
• Breach of confidentiality.

And those are just a few of the problems from a litany of possible pitfalls the e-commerce entrepreneur faces.

Counsel advising clients on e-commerce startup should, then, be cognizant not only of general business concerns, but also of the regulatory framework that has shaped much of online activity in the last 10 years or so.

Internet Jurisdiction

Owners of most new businesses ' whether bricks-and-mortar or virtual ' will want to limit their liability by choosing a business entity that fits their legal and tax needs. To do so, they face a cornucopia of choices, including limited-liability companies and corporations. Although the business entity may be formed in a single state, the external activities of the entity could face liability in numerous jurisdictions well beyond the scope originally intended by the business owner. Indeed, when operating online, the number of jurisdictions a business can be hauled into increases exponentially. (For more on limited-liability companies and limited partnerships as components of an e-commerce business-development plan, see, 'Some Old Lessons for New Enterprises: Or, What Living Fossils and Old Coaches Can Teach e-Commerce Firms,' in the July 2006 edition of e-Commerce Law & Strategy.)

Under long-arm jurisdiction principles, a non-resident defendant is subject to a forum state's jurisdiction where:

• The defendant has sufficient 'minimum contacts' with the forum state;
• The claim asserted against the defendant arises out of those contacts; and
• The exercise of jurisdiction is reasonable (International Shoe Co. v. Washington, 326 U.S. 310 (1945)).

For an online business, this standard is not too difficult to satisfy. Courts have applied a 'sliding scale' of jurisdiction in situations in which the likelihood of jurisdiction is contingent on the interactive nature of the Web site. A court could examine any number of factors, including the number of subscribers within the forum state or the presence of agreements with Internet-access providers to permit access within the state (see, Zippo Manufacturing Co. v. Zippo Dot Com, 952 F.Supp. 1119 (W.D. Pa. 1997)).

In other words, don't do business in a state you wouldn't like to be sued in. This is all the more applicable in the international context. If you do some business in Australia, even if it is 1% of your overall business revenue, then Australian courts are certainly not above hauling you in on, say, a defamation case. (See, Dow Jones v. Gutnick, [2002] HCA 56, 2002 AUST HIGHCT LEXIS 61.) Similarly, if you are an advocate of free speech and feel comfortable with selling anti-Semitic paraphernalia online, don't be surprised if German or French courts come knocking at your door. (See, L.I.C.R.A. v. Yahoo! Inc., Interim Court Order, the County Court of Paris 6, May 22, 2000.) (See also, 'International Internet Law,' in this edition of e-Commerce Law & Strategy.)

So how does a business control who visits its Web page if it wants to exclude certain jurisdictions? A number of geographical-identification technologies ('geo-ID'), such as NetGeo and Quova, are available on the market and will assist a business owner in controlling the 'location' of customers. These geo-ID services are more than 99% accurate in determining from which state or country a computer user is seeking to access a particular page. Another way of putting it: This technology can help an online business avoid jurisdictional entanglements. If these services are not within the budget of a nascent venture, then at the very least there should be a 'choose a country' option to peruse the site or, taking a more aggressive tack, a method of cross-referencing location with a credit card or driver's license. These are all options that are driven by the market and services or goods ' or a combination of services and goods ' offered to the consumer: Pornography or gambling sites, for instance, may be more sensitive to users' age and location, whereas a site selling lavender soap may not.

(For an in-depth look at online expression cases involving foreign jurisdictions that addressed e-commerce activities, see, 'Overseas Court Decisions Limit U.S. Internet Speech: Foreign Courts' Decisions to Exercise Jurisdiction over Internet Libel Claims Presents a Free Expression, and e-Commerce, Challenge,' in the August 2006 edition of e-Commerce Law & Strategy.)

Terms of Service and Privacy Agreements

Perhaps two of the most important elements of an online business are the terms of service ('TOS') and privacy agreements. A TOS agreement sets the boundaries of how users can visit and use a business' Web site, and how commercial transactions will take place on the site. A privacy agreement explains to a site's users what kind of information will be collected from them and what the company will do with it.

Where an online business tenders a sale of some kind, whether in goods or services, the sale is governed by traditional principles of contract law. The sale should mirror a traditional sale in a non-virtual context. In other words, the TOS should outline fundamental concerns such as:

• Purchase-related policies;
• Warranties;
• Limitation of liability provisions; and
• Jurisdictional principles, such as governing law language and forum-selection clause favorable to the business.

Similarly, with privacy agreements, a business should audit its business practices so that its principals and counsel, when necessary, can easily understand what exactly it is doing with information collected from customers. This practice covers everything from credit card information to shopping habits. Long-term planning is also advised; for example, a business should plan for the contingency that this information may eventually be sold in a merger or acquisition by disclosing to users the potential of such a sale.

But let's ask: Is it really sufficient to have such important terms hidden away in those tiny links at the bottom of the screen? Maybe not. In 2002, the Second Circuit held, in Specht v. Netscape Communications Corp., 306 F.3d 17 (2^nd Cir.), that terms accessible through a link located at the bottom of the screen, down below the fold, are not binding on a user. The court reasoned that a reasonably prudent person would not necessarily think to scroll down to access these terms, because essential information was contained on the front page without scrolling.

In other words, 'click-wrap' agreements are preferable to 'browse-wrap' agreements (click-wrap agreements require active consent from a user, whereas browse-wrap agreements don't). Although the better practice is to require some form of active consent, click-wrap agreements may not be necessary in all circumstances. The more interactive the site, however, the higher the likelihood that some form of active consent from the user will be required.

Copyright Issues: Tricky for the Unwary

Copyright Ownership Of the Web Site

In most cases, business owners will want to copyright their Web sites. The first question should, of course, be: Who owns the material? If a business hired an outside party to design the site and never signed an agreement with that party, then the outside party will probably own all the online material. Similarly, if the business owner signed an agreement, but merely holds a license to use the work, then copyright ownership remains with the outside party.

Under copyright law, unless you are an employee of the person commissioning your work, or provide an outright transfer of your rights to the work to another, you are the owner of the copyrighted work. In terms of Web site ownership from a business owner's perspective, all site design and programming work should be labeled a 'work for hire' and transferred to the business owner (see, www.copyright.gov/circs/circ9.html).

In registering the site with the U.S. Copyright Office, due care should be taken to describe the subject of copyright ownership accurately. Although copyright law protects anything that is 'fixed' in a tangible means of expression, whether it be a book, painting, record or sculpture, it does not protect the 'look and feel' of an item. Indeed, in describing a site, it may not be acceptable to describe original authorship being registered as 'user interface,' 'format,' 'layout' or 'design.' A better approach is to clearly describe what is sought to be protected with terms such as 'text,' 'music,' or 'artwork.' In some instances, even alluding to the 'look and feel' with terms such as 'visual material' may result in a rejection of the application. The moral of the illustration: Be clear in your description and your registration should go through without a hitch.

The Digital Millennium Copyright Act

If a Web site is interactive in that it allows users to upload or download (or both) text, materials, pictures, graphics or other content, then chances are that the Digital Millennium Copyright Act ('DMCA') is applicable. The DMCA is broad legislation that is meant to bring the United States into compliance with international treaty obligations and address digital-piracy issues.

Section 512(c) of the DMCA addresses hosted content such as Web sites, bulletin boards and forums. If it were not for the DMCA's safe-harbor provisions, every owner of an interactive Web site could be liable for the copyright infringements of its users. In order to benefit from the protection of 512(c), a site must provide a method through which a person alleging copyright infringement can contact the site and ask it to take down the allegedly infringing material. Once the site receives the notice, it must:

• Act expeditiously to remove, or disable access to, the allegedly infringing materials;
• Notify the alleged infringer that the material has been removed;
• Forward any counter-notices from the alleged infringer to the complainant; and
• Replace the allegedly infringing material if the complainant has not filed a lawsuit within 10-14 days after the site has received the counter-notice (see, 17 U.S.C. 512(c)).

Because a complainant's notice must follow a certain format, the better practice is to outline the requirements of the DMCA within a site's TOS, or on a dedicated Web page, so that all relevant information required to locate the allegedly infringing material is included. A site should also dedicate a copyright agent to receive these notices and provide an electronic-mailing address, as well as a physical address, so that notices can be directly routed to the agent. The contact information for the agent should also be registered with the Copyright Office along with a $30 fee; if any information changes, an amended designation should be filed. Although the safe-harbor provisions are fairly broad, they are not available to a site whose operators have actual knowledge about the infringing activity and do nothing about it, or to a site whose operators can control infringing activity and receive a financial benefit from it.

Domain Name Disputes

Domain-name disputes arise when a trademark owner believes that a registered domain name infringes on his or her trademark. Every business owner wants to register a catchy domain name that highlights the business, but the real question isn't necessarily whether the domain name is available ' it's whether it will infringe on someone else's trademark rights.

The Internet Corporation for Assigned Names and Numbers ('ICANN'), a federally mandated body that oversees domain names worldwide, adopted in 1999 the Uniform Domain Name Dispute Resolution Policy to address disputes between trademark and domain-name owners quickly and cost-effectively. Rather than resorting to costly and protracted litigation proceedings, a trademark holder can use the policy to gain control of a domain name that has been registered in bad faith with the intent to profit commercially from that trademark. Disputes are handled entirely on paper or on the Internet, without the need for personal appearance or travel.

The first step in the process is to file a complaint with a recognized arbitration association that handles disputes under the policy. These include the:

• World Intellectual Property Organization ('WIPO');
• National Arbitration Forum; and
• Center for Dispute Resolution.

After paying a one-time fee (about $2000 for three or fewer domain names under dispute), the complainant and supporting materials are submitted to an arbitration panel for review.

Complaints must demonstrate that:

• The domain name in dispute is identical or confusingly similar to a trademark or service mark in which the complainant has rights;
• The domain-name registrant has no rights or legitimate interests in the disputed domain name; and
• The disputed domain name has been registered and is being used in bad faith.

The winner can get the infringing domain name cancelled or transferred by the offending domain name's registrar, which must comply with a decision under the dispute-resolution policy.

In cases where a respondent has legitimate competing rights or interests in a domain name, the resolution policy is unlikely to provide relief, because bad faith will likely not be found. Also, if a business owner seeks damages for misuse of a domain name, legal action in the courts will be necessary. Decisions under the resolution policy may be appealed in court within 10 days after a final decision has been handed down. In the event that an appeal is taken, cancellation or transfer of the disputed domain name is postponed until that court renders a decision.

Conclusion

The last 10 years have witnessed a phenomenal growth in new laws addressing online activities. From copyright to domain-name disputes, the Internet has perhaps unnecessarily complicated the legal framework for business owners. As technologies evolve, perhaps some of this framework will no longer be relevant. Until then, it remains incumbent on us to understand how to navigate the virtual and non-virtual legal landscape governing online activity.

Next month: The second part of this article will address ramping up an e-commerce business and other important topics, such as the Child Online Protection Act, spam, international privacy issues and the Communications Decency Act.

Editor's Note: This month, in the first of a two-part article, our expert author examines some issues that e-commerce counsel should pay particular attention to when advising e-commerce startups, particularly small, single-entrepreneur or small-group driven Internet-based storefronts. See the April edition of e-Commerce Law & Strategy for Part Two.

The legal risks associated with operating an online business are largely hidden to many people who are lured by the dream of making their fortunes with the apparent ease of opening a virtual storefront.

But the risks of setting up a virtual storefront ' an e-commerce venture ' can exceed those of operating a real-world, bricks-and-mortar business operation, where relationships with consumers are often based on tangible items.

In the virtual world, a business owner may face a number of additional problems, including:

• Copyright infringement;
• Trademark infringement;
• Intellectual property ownership;
• Libel and slander;
• Identity theft;
• Jurisdictional issues
• Invasion of privacy; and
• Breach of confidentiality.

And those are just a few of the problems from a litany of possible pitfalls the e-commerce entrepreneur faces.

Counsel advising clients on e-commerce startup should, then, be cognizant not only of general business concerns, but also of the regulatory framework that has shaped much of online activity in the last 10 years or so.

Internet Jurisdiction

Owners of most new businesses ' whether bricks-and-mortar or virtual ' will want to limit their liability by choosing a business entity that fits their legal and tax needs. To do so, they face a cornucopia of choices, including limited-liability companies and corporations. Although the business entity may be formed in a single state, the external activities of the entity could face liability in numerous jurisdictions well beyond the scope originally intended by the business owner. Indeed, when operating online, the number of jurisdictions a business can be hauled into increases exponentially. (For more on limited-liability companies and limited partnerships as components of an e-commerce business-development plan, see, 'Some Old Lessons for New Enterprises: Or, What Living Fossils and Old Coaches Can Teach e-Commerce Firms,' in the July 2006 edition of e-Commerce Law & Strategy.)

Under long-arm jurisdiction principles, a non-resident defendant is subject to a forum state's jurisdiction where:

• The defendant has sufficient 'minimum contacts' with the forum state;
• The claim asserted against the defendant arises out of those contacts; and
• The exercise of jurisdiction is reasonable ( International Shoe Co. v. Washington , 326 U.S. 310 (1945)).

For an online business, this standard is not too difficult to satisfy. Courts have applied a 'sliding scale' of jurisdiction in situations in which the likelihood of jurisdiction is contingent on the interactive nature of the Web site. A court could examine any number of factors, including the number of subscribers within the forum state or the presence of agreements with Internet-access providers to permit access within the state ( see, Zippo Manufacturing Co. v. Zippo Dot Com , 952 F.Supp. 1119 (W.D. Pa. 1997)).

In other words, don't do business in a state you wouldn't like to be sued in. This is all the more applicable in the international context. If you do some business in Australia, even if it is 1% of your overall business revenue, then Australian courts are certainly not above hauling you in on, say, a defamation case. (See, Dow Jones v. Gutnick, [2002] HCA 56, 2002 AUST HIGHCT LEXIS 61.) Similarly, if you are an advocate of free speech and feel comfortable with selling anti-Semitic paraphernalia online, don't be surprised if German or French courts come knocking at your door. (See, L.I.C.R.A. v. Yahoo! Inc. , Interim Court Order, the County Court of Paris 6, May 22, 2000.) ( See also , 'International Internet Law,' in this edition of e-Commerce Law & Strategy .)

So how does a business control who visits its Web page if it wants to exclude certain jurisdictions? A number of geographical-identification technologies ('geo-ID'), such as NetGeo and Quova, are available on the market and will assist a business owner in controlling the 'location' of customers. These geo-ID services are more than 99% accurate in determining from which state or country a computer user is seeking to access a particular page. Another way of putting it: This technology can help an online business avoid jurisdictional entanglements. If these services are not within the budget of a nascent venture, then at the very least there should be a 'choose a country' option to peruse the site or, taking a more aggressive tack, a method of cross-referencing location with a credit card or driver's license. These are all options that are driven by the market and services or goods ' or a combination of services and goods ' offered to the consumer: Pornography or gambling sites, for instance, may be more sensitive to users' age and location, whereas a site selling lavender soap may not.

(For an in-depth look at online expression cases involving foreign jurisdictions that addressed e-commerce activities, see, 'Overseas Court Decisions Limit U.S. Internet Speech: Foreign Courts' Decisions to Exercise Jurisdiction over Internet Libel Claims Presents a Free Expression, and e-Commerce, Challenge,' in the August 2006 edition of e-Commerce Law & Strategy.)

Terms of Service and Privacy Agreements

Perhaps two of the most important elements of an online business are the terms of service ('TOS') and privacy agreements. A TOS agreement sets the boundaries of how users can visit and use a business' Web site, and how commercial transactions will take place on the site. A privacy agreement explains to a site's users what kind of information will be collected from them and what the company will do with it.

Where an online business tenders a sale of some kind, whether in goods or services, the sale is governed by traditional principles of contract law. The sale should mirror a traditional sale in a non-virtual context. In other words, the TOS should outline fundamental concerns such as:

• Purchase-related policies;
• Warranties;
• Limitation of liability provisions; and
• Jurisdictional principles, such as governing law language and forum-selection clause favorable to the business.

Similarly, with privacy agreements, a business should audit its business practices so that its principals and counsel, when necessary, can easily understand what exactly it is doing with information collected from customers. This practice covers everything from credit card information to shopping habits. Long-term planning is also advised; for example, a business should plan for the contingency that this information may eventually be sold in a merger or acquisition by disclosing to users the potential of such a sale.

But let's ask: Is it really sufficient to have such important terms hidden away in those tiny links at the bottom of the screen? Maybe not. In 2002, the Second Circuit held, in Specht v. Netscape Communications Corp ., 306 F.3d 17 (2 nd Cir.), that terms accessible through a link located at the bottom of the screen, down below the fold, are not binding on a user. The court reasoned that a reasonably prudent person would not necessarily think to scroll down to access these terms, because essential information was contained on the front page without scrolling.

In other words, 'click-wrap' agreements are preferable to 'browse-wrap' agreements (click-wrap agreements require active consent from a user, whereas browse-wrap agreements don't). Although the better practice is to require some form of active consent, click-wrap agreements may not be necessary in all circumstances. The more interactive the site, however, the higher the likelihood that some form of active consent from the user will be required.

Copyright Issues: Tricky for the Unwary

Copyright Ownership Of the Web Site

In most cases, business owners will want to copyright their Web sites. The first question should, of course, be: Who owns the material? If a business hired an outside party to design the site and never signed an agreement with that party, then the outside party will probably own all the online material. Similarly, if the business owner signed an agreement, but merely holds a license to use the work, then copyright ownership remains with the outside party.

Under copyright law, unless you are an employee of the person commissioning your work, or provide an outright transfer of your rights to the work to another, you are the owner of the copyrighted work. In terms of Web site ownership from a business owner's perspective, all site design and programming work should be labeled a 'work for hire' and transferred to the business owner (see, www.copyright.gov/circs/circ9.html).

In registering the site with the U.S. Copyright Office, due care should be taken to describe the subject of copyright ownership accurately. Although copyright law protects anything that is 'fixed' in a tangible means of expression, whether it be a book, painting, record or sculpture, it does not protect the 'look and feel' of an item. Indeed, in describing a site, it may not be acceptable to describe original authorship being registered as 'user interface,' 'format,' 'layout' or 'design.' A better approach is to clearly describe what is sought to be protected with terms such as 'text,' 'music,' or 'artwork.' In some instances, even alluding to the 'look and feel' with terms such as 'visual material' may result in a rejection of the application. The moral of the illustration: Be clear in your description and your registration should go through without a hitch.

The Digital Millennium Copyright Act

If a Web site is interactive in that it allows users to upload or download (or both) text, materials, pictures, graphics or other content, then chances are that the Digital Millennium Copyright Act ('DMCA') is applicable. The DMCA is broad legislation that is meant to bring the United States into compliance with international treaty obligations and address digital-piracy issues.

Section 512(c) of the DMCA addresses hosted content such as Web sites, bulletin boards and forums. If it were not for the DMCA's safe-harbor provisions, every owner of an interactive Web site could be liable for the copyright infringements of its users. In order to benefit from the protection of 512(c), a site must provide a method through which a person alleging copyright infringement can contact the site and ask it to take down the allegedly infringing material. Once the site receives the notice, it must:

• Act expeditiously to remove, or disable access to, the allegedly infringing materials;
• Notify the alleged infringer that the material has been removed;
• Forward any counter-notices from the alleged infringer to the complainant; and
• Replace the allegedly infringing material if the complainant has not filed a lawsuit within 10-14 days after the site has received the counter-notice (see, 17 U.S.C. 512(c)).

Because a complainant's notice must follow a certain format, the better practice is to outline the requirements of the DMCA within a site's TOS, or on a dedicated Web page, so that all relevant information required to locate the allegedly infringing material is included. A site should also dedicate a copyright agent to receive these notices and provide an electronic-mailing address, as well as a physical address, so that notices can be directly routed to the agent. The contact information for the agent should also be registered with the Copyright Office along with a $30 fee; if any information changes, an amended designation should be filed. Although the safe-harbor provisions are fairly broad, they are not available to a site whose operators have actual knowledge about the infringing activity and do nothing about it, or to a site whose operators can control infringing activity and receive a financial benefit from it.

Domain Name Disputes

Domain-name disputes arise when a trademark owner believes that a registered domain name infringes on his or her trademark. Every business owner wants to register a catchy domain name that highlights the business, but the real question isn't necessarily whether the domain name is available ' it's whether it will infringe on someone else's trademark rights.

The Internet Corporation for Assigned Names and Numbers ('ICANN'), a federally mandated body that oversees domain names worldwide, adopted in 1999 the Uniform Domain Name Dispute Resolution Policy to address disputes between trademark and domain-name owners quickly and cost-effectively. Rather than resorting to costly and protracted litigation proceedings, a trademark holder can use the policy to gain control of a domain name that has been registered in bad faith with the intent to profit commercially from that trademark. Disputes are handled entirely on paper or on the Internet, without the need for personal appearance or travel.

The first step in the process is to file a complaint with a recognized arbitration association that handles disputes under the policy. These include the:

• World Intellectual Property Organization ('WIPO');
• National Arbitration Forum; and
• Center for Dispute Resolution.

After paying a one-time fee (about $2000 for three or fewer domain names under dispute), the complainant and supporting materials are submitted to an arbitration panel for review.

Complaints must demonstrate that:

• The domain name in dispute is identical or confusingly similar to a trademark or service mark in which the complainant has rights;
• The domain-name registrant has no rights or legitimate interests in the disputed domain name; and
• The disputed domain name has been registered and is being used in bad faith.

The winner can get the infringing domain name cancelled or transferred by the offending domain name's registrar, which must comply with a decision under the dispute-resolution policy.

In cases where a respondent has legitimate competing rights or interests in a domain name, the resolution policy is unlikely to provide relief, because bad faith will likely not be found. Also, if a business owner seeks damages for misuse of a domain name, legal action in the courts will be necessary. Decisions under the resolution policy may be appealed in court within 10 days after a final decision has been handed down. In the event that an appeal is taken, cancellation or transfer of the disputed domain name is postponed until that court renders a decision.

Conclusion

The last 10 years have witnessed a phenomenal growth in new laws addressing online activities. From copyright to domain-name disputes, the Internet has perhaps unnecessarily complicated the legal framework for business owners. As technologies evolve, perhaps some of this framework will no longer be relevant. Until then, it remains incumbent on us to understand how to navigate the virtual and non-virtual legal landscape governing online activity.

Next month: The second part of this article will address ramping up an e-commerce business and other important topics, such as the Child Online Protection Act, spam, international privacy issues and the Communications Decency Act.