The 'New and Improved' FTC?

A broad survey of Federal Trade Commission (“FTC”) actions and appointments throughout 2009 reveals priorities in enforcement efforts.

For instance, the FTC initiated what some observers characterize as fundamental changes to its previous modus operandi ' changes that mark a more proactive approach on several fronts.

Indeed, the Obama Administration and the FTC have lobbied Congress to amend the FTC Act to enhance the FTC's conventional enforcement authority.

The House of Representatives voted 223 to 202 on Dec. 11 to approve The Wall Street Reform and Consumer Protection Act of 2009 (“H.R. 4173″) which primarily establishes a Consumer Financial Protection Agency and sets rules governing how some sophisticated financial instruments that fueled the current financial crisis are traded, and enhances the FTC's authority. The bill's ultimate fate remains uncertain because the Administration wants certain revisions and the Senate must still take up its version.

The version of the bill the House voted to approve amends the FTC Act by removing administrative obstacles to rulemaking by permitting the FTC to pursue civil actions without prior Department of Justice review and allowing the FTC to target advertising agencies, media, marketing companies and others that aid unfair commerce practices.

The bill says any person who furnishes “substantial assistance” in committing an unfair or deceptive act or practice can be punished as a primary perpetrator, even if the person didn't know about the violation.

Privacy

The FTC set a series of roundtables on privacy in new technologies and business practices, the first of which was held Dec. 7. These FTC roundtables examine:

• Cloud-computing;
• Mobile marketing; and
• Online behavioral advertising, social networking, and information-collection practices of retailers, data brokers and third-party applications.

About three dozen industry executives, consumer-privacy advocates, academics, technology experts and government employees debated issues of privacy and data collection over the Internet, including online behavioral targeting, whether privacy standards should differ for “sensitive” information, how to notify consumers about ad-targeting and whether online privacy should be regulated.

Another roundtable is scheduled for March 17. (For instructions on how to comment and/or participate, go to www.ftc.gov/bcp/workshops/privacyroundtables/index.shtml. A specific agenda will be posted there as well, but was not yet available at press time.)

Areas of Government Scrutiny

With Congress showing more interest in regulating these issues, lawmakers are looking beyond the Internet to:

• Interactive television commercials;
• Mobile phones; and
• Advertisements received by consumers via mail and telephone-sales promotions.

Rep. Rick Boucher (D-VA), Ghairman of the House Energy and Commerce Subcommittee on Communications, Technology and the Internet, is overseeing draft privacy legislation that would impose broad new privacy rules on advertisers. A draft of the bill may be unveiled this year.

This proposed measure could launch a new era in privacy law as the first major effort to regulate behavioral targeting, which epitomizes the future of advertising.

Privacy and Online Behavioral Advertising

In February 2009, the FTC issued Self-Regulatory Principles for Online Behavioral Advertising (Behavioral Advertising: Tracking, Targeting & Technology) (www.ftc.gov/opa/2009/02/behavad.shtm). The report focuses on how advertisers can best protect consumers' privacy while companies continue engaging in behavioral targeting to track and collect information on consumers' online and new-media activities.

Indeed, throughout 2009, new-media companies struggled with how best to protect consumer privacy, while the FTC pursued companies for violating privacy policies and failing to protect consumers' information.

Sears Holdings Management Corp.

One important 2009 case involved Sears Holdings Management Corp. (“Sears Holdings”), which handles marketing operations for Sears Roebuck and Kmart retail stores and operates the sears.com and kmart.com online retail sites. The FTC approved a final consent decree on Aug. 31, following a public comment period. According to the original FTC complaint, Sears Holdings created and made available to users of its Web sites a downloadable software application. The software was supposed to be used as part of a “My SHC Community” voluntary market research program. In re Sears Holdings Management Corp., FTC Docket No. C-4264.

Sears Holdings marketed this software via a pop-up box delivered to 15% of visitors to the sears.com and kmart.com Web sites. The box touted the market-research program as a method for customers to “talk directly” to a retailer and to obtain more relevant offerings in the future. In exchange for downloading the “research software” and retaining it for a month, each participant would be paid $10. Interested users were directed first to a landing page and then to a registration page where they were asked to enter their name, postal address, age and e-mail address. A scroll box located underneath the My SHC Community registration fields presented a Privacy Statement and User License Agreement ' 10 lines at a time ' notifying consumers that the downloadable software application installed on their computers would track their “online browsing.”

But the FTC said users were not notified until late in the registration process, beginning around line 75, that the software would monitor not just online browsing but “nearly all of the Internet behavior that occurs on the computer” on which the software was installed. The FTC charged that the software actually monitored each user's online secure sessions ' including sessions on third parties' Web sites ' and collected each user's personal information transmitted in those sessions, such as:

• Online bank statements;
• Prescription drug records;
• Shopping-cart contents;
• Library browsing histories;
• Video-rental records; and
• The sender, recipient, subject and size of Web-based e-mails.

According to the original FTC complaint, Sears Holdings “failed to disclose adequately” the full scope and extent of the software's data collection and that Sears Holdings buried its data-collection policy deep in the registration process, a deceptive practice in violation of '5 of the FTC Act.

Under the consent decree settling the charges, Sears Holdings agreed to destroy any information previously collected by the “My SHC Community” software. Sears Holdings also agreed that if it ever again decides to advertise or disseminate any tracking software, it must clearly and prominently disclose the types of data the software will monitor, record or transmit. This disclosure must be made prior to the user's installation of any tracking software and be separate from any user license agreement.

At the first FTC privacy roundtable in December, Chairman Leibowitz specifically referred to the Sears Holdings case: “Nobody argues that the folks at Sears are bad people who wanted to do bad things with the information. To the contrary, they probably didn't know exactly what they expected to learn from this data. That just demonstrates, however, that all of us are still feeling our way around what respecting privacy really means.”

The Iconix Case

In October, the FTC filed a complaint in Federal District Court in New York alleging that since 2006, Iconix Brand Group Inc. (“Iconix”) ' the owner, licensee or marketer of popular youngsters' apparel brands such as Mudd, Candie's, Bongo and OP ' knowingly collected and stored personal information obtained from 1,000 children without first notifying their parents or obtaining required parental consent, which is a violation of the FTC Act and the Children's Online Privacy Protection Act (“COPPA”). The complaint also alleged that Iconix enabled children to publicly share photos and stories online.

Section 5 of the FTC Act prohibits “unfair or deceptive trade acts or practices.” The FTC has used '5 to pursue companies that engage in “deceptive trade acts or practices” by failing to follow their own stated privacy practices, as well as companies that engage in “unfair” acts by inadequately securing consumers' personally identifiable information.

Under the FTC's Children's Online Privacy Protection Rule (16 C.F.R. '312) (the “Rule”), “personal information” includes “a photograph of the individual, when associated with other information collected online that would enable the physical or online contacting of the individual.” 16 C.F.R. '312.2.

Instead of contesting the FTC's charges, Iconix agreed to pay a $250,000 civil penalty and enter a consent order prohibiting COPPA violations in the future and requiring deletion of all personal information Iconix collected and maintained in violation of COPPA.

Also last year, the FTC released a report titled Beyond Voice: Mapping the Mobile Marketplace that addresses the challenges and concerns that “smartphones” and other mobile devices with which people can access the Internet present to protecting children's privacy (see, www.ftc.gov/opa/2009/04/mobilerpt.shtm). The United States currently has no laws relating specifically to mobile marketing campaigns aimed at children, although an industry self-regulatory body, the Mobile Marketing Association, has established voluntary guidelines. (See, “Recommendation Marketing Through Evolving Social Media Channels” in the October 2009 issue of e-Commerce Law & Strategy, at www.ljnonline.com/issues/ljn_ecommerce/26_6/news/152810-1.html.) As a result, the FTC staff agreed to expedite review of the COPPA rule to determine if affirmative express consent from parents should be required when advertisers collect information used to send individualized ads to children as part of a behavioral advertising campaign in mobile marketing. The expedited review is scheduled for this year.

Marketing Inappropriate Content to Children

On Dec. 3, the FTC released Marketing Violent Entertainment to Children: A Sixth Follow-Up Review of Industry Practices in the Motion Picture, Music Recording & Electronic Game Industries (www.ftc.gov/opa/2009/12/violentent.shtm). The report criticizes widespread cross-promotion of violent PG-13 movies to young children.

The FTC report found that PG-13 movies were regularly advertised on children's television networks such as Nickelodeon and the Cartoon Network, even though children aged two to 11 years old compose 50% of these networks' viewers any time of day. The FTC's review of movie studio marketing plans demonstrated that studios “intentionally market” violent PG-13 films to children under the age of 13 through advertising and promotional tie-ins with food, toys and other licensed products.

The FTC also found that studios continued to place a significant number of ads for violent R-rated movies during television programs and on Internet sites highly popular with children under 17.

This is the FTC's seventh such report to Congress since 2000. Although this latest report found that the movie and game industries made progress in restricting marketing of products, the report concluded that the music industry “had not significantly changed its marketing practices since the commission's initial report.”

The report suggested that the movie and music industries create explicit, objective criteria to restrict marketing of violent content to children, specifically marketing PG-13 movies to children directly, and through online and viral marketing and tie-ins with food, toys and other licensed products. The report also recommends that the movie, music and video-game industries increase enforcement against online posting of “red tag” trailers without adequate age-based access restrictions and that all three industries improve display of rating information in advertising and on packaging.

The FTC's latest report concerning marketing of violent media to children seems to support private organizations' assessments that more stringent and express restrictions must be established and effectively implemented to reduce the potential number of young children exposed to inappropriate entertainment-media marketing.

The FTC report specifically notes that the Motion Picture Association of America ' which has worked with other non-government bodies to rate and review ads and marketing of motion pictures to children ' “has not adopted any new rules prohibiting inappropriate targeting of R-rated and PG-13 rated films to teens and younger children.”

The report concludes that entertainment-industry “standards against targeting teens and younger children in the marketing of violent entertainment products have not sufficiently curbed marketing that reaches a large youth audience, particularly in online media. These standards need to be tightened and more strictly enforced.”

Endorsement and Testimonial
Guidelines in Advertising

In October, the FTC published its revised Guides Concerning the Use of Endorsements and Testimonials in Advertising (the “FTC Guides”) (See, 16 C.F.R. Part 255). These went into effect on Dec. 1. The FTC established endorsement and testimonial guides for advertising in 1972 and updated them in 1980. The FTC Guides are neither laws nor regulations, carry no penalties, and are unenforceable on their own; rather, enforcement actions pursuant to '5 of the FTC Act or pursuant to a state unfair-and-deceptive-practices act may reference the FTC Guides when determining potential liability for advertisements that use endorsements and testimonials.

The Guides state: “Advertisers are subject to liability for false or unsubstantiated statements made through endorsements, or for failing to disclose material connections between themselves and their endorsers. Endorsers also may be liable for statements made in the course of their endorsements.”

The latest revisions of the FTC Guides make it clear that outside the context of traditional advertising (such as television commercials and print ads), celebrities have a duty to disclose their respective relationships with advertisers whenever making endorsements while not under the direct control of the advertiser (such as whenever celebrities participate on television talk shows, blogs and other social media).

Conclusion

The FTC experienced a number of dramatic changes in 2009, including:

• Appointment of a new chairman, new commissioners, new directors of separate FTC bureaus;
• House passage of amendments to the FTC Act to enhance the FTC's conventional enforcement authority;
• Release of several new reports recommending establishment and implementation of new approaches to defining and protecting consumer privacy in light of the growing prevalence of behavioral advertising;
• Enactment of the first revision in almost 30 years to the FTC Guides governing endorsements and testimonials in advertising, and;
• Publication of the FTC's latest report recommending the creation of specific and objective criteria to restrict the marketing of violent content to children.

If 2009 is a bellwether of what to anticipate from the FTC this year, then it seems reasonable to expect faster and more aggressive FTC action as mainstream advertisers continue competing aggressively for a shrinking pool of consumer dollars.

In addition, if the version of the bill amending the FTC Act that the House of Representatives has voted to approve becomes law this year with the FTC provisions intact, it certainly will bolster the prospect of the FTC increasing its enforcement efforts in privacy, advertising, entertainment and evolving media.

A broad survey of Federal Trade Commission (“FTC”) actions and appointments throughout 2009 reveals priorities in enforcement efforts.

For instance, the FTC initiated what some observers characterize as fundamental changes to its previous modus operandi ' changes that mark a more proactive approach on several fronts.

Indeed, the Obama Administration and the FTC have lobbied Congress to amend the FTC Act to enhance the FTC's conventional enforcement authority.

The House of Representatives voted 223 to 202 on Dec. 11 to approve The Wall Street Reform and Consumer Protection Act of 2009 (“H.R. 4173″) which primarily establishes a Consumer Financial Protection Agency and sets rules governing how some sophisticated financial instruments that fueled the current financial crisis are traded, and enhances the FTC's authority. The bill's ultimate fate remains uncertain because the Administration wants certain revisions and the Senate must still take up its version.

The version of the bill the House voted to approve amends the FTC Act by removing administrative obstacles to rulemaking by permitting the FTC to pursue civil actions without prior Department of Justice review and allowing the FTC to target advertising agencies, media, marketing companies and others that aid unfair commerce practices.

The bill says any person who furnishes “substantial assistance” in committing an unfair or deceptive act or practice can be punished as a primary perpetrator, even if the person didn't know about the violation.

Privacy

The FTC set a series of roundtables on privacy in new technologies and business practices, the first of which was held Dec. 7. These FTC roundtables examine:

• Cloud-computing;
• Mobile marketing; and
• Online behavioral advertising, social networking, and information-collection practices of retailers, data brokers and third-party applications.

About three dozen industry executives, consumer-privacy advocates, academics, technology experts and government employees debated issues of privacy and data collection over the Internet, including online behavioral targeting, whether privacy standards should differ for “sensitive” information, how to notify consumers about ad-targeting and whether online privacy should be regulated.

Another roundtable is scheduled for March 17. (For instructions on how to comment and/or participate, go to www.ftc.gov/bcp/workshops/privacyroundtables/index.shtml. A specific agenda will be posted there as well, but was not yet available at press time.)

Areas of Government Scrutiny

With Congress showing more interest in regulating these issues, lawmakers are looking beyond the Internet to:

• Interactive television commercials;
• Mobile phones; and
• Advertisements received by consumers via mail and telephone-sales promotions.

Rep. Rick Boucher (D-VA), Ghairman of the House Energy and Commerce Subcommittee on Communications, Technology and the Internet, is overseeing draft privacy legislation that would impose broad new privacy rules on advertisers. A draft of the bill may be unveiled this year.

This proposed measure could launch a new era in privacy law as the first major effort to regulate behavioral targeting, which epitomizes the future of advertising.

Privacy and Online Behavioral Advertising

In February 2009, the FTC issued Self-Regulatory Principles for Online Behavioral Advertising (Behavioral Advertising: Tracking, Targeting & Technology) (www.ftc.gov/opa/2009/02/behavad.shtm). The report focuses on how advertisers can best protect consumers' privacy while companies continue engaging in behavioral targeting to track and collect information on consumers' online and new-media activities.

Indeed, throughout 2009, new-media companies struggled with how best to protect consumer privacy, while the FTC pursued companies for violating privacy policies and failing to protect consumers' information.

Sears Holdings Management Corp.

One important 2009 case involved Sears Holdings Management Corp. (“Sears Holdings”), which handles marketing operations for Sears Roebuck and Kmart retail stores and operates the sears.com and kmart.com online retail sites. The FTC approved a final consent decree on Aug. 31, following a public comment period. According to the original FTC complaint, Sears Holdings created and made available to users of its Web sites a downloadable software application. The software was supposed to be used as part of a “My SHC Community” voluntary market research program. In re Sears Holdings Management Corp., FTC Docket No. C-4264.

Sears Holdings marketed this software via a pop-up box delivered to 15% of visitors to the sears.com and kmart.com Web sites. The box touted the market-research program as a method for customers to “talk directly” to a retailer and to obtain more relevant offerings in the future. In exchange for downloading the “research software” and retaining it for a month, each participant would be paid $10. Interested users were directed first to a landing page and then to a registration page where they were asked to enter their name, postal address, age and e-mail address. A scroll box located underneath the My SHC Community registration fields presented a Privacy Statement and User License Agreement ' 10 lines at a time ' notifying consumers that the downloadable software application installed on their computers would track their “online browsing.”

But the FTC said users were not notified until late in the registration process, beginning around line 75, that the software would monitor not just online browsing but “nearly all of the Internet behavior that occurs on the computer” on which the software was installed. The FTC charged that the software actually monitored each user's online secure sessions ' including sessions on third parties' Web sites ' and collected each user's personal information transmitted in those sessions, such as:

• Online bank statements;
• Prescription drug records;
• Shopping-cart contents;
• Library browsing histories;
• Video-rental records; and
• The sender, recipient, subject and size of Web-based e-mails.

According to the original FTC complaint, Sears Holdings “failed to disclose adequately” the full scope and extent of the software's data collection and that Sears Holdings buried its data-collection policy deep in the registration process, a deceptive practice in violation of '5 of the FTC Act.

Under the consent decree settling the charges, Sears Holdings agreed to destroy any information previously collected by the “My SHC Community” software. Sears Holdings also agreed that if it ever again decides to advertise or disseminate any tracking software, it must clearly and prominently disclose the types of data the software will monitor, record or transmit. This disclosure must be made prior to the user's installation of any tracking software and be separate from any user license agreement.

At the first FTC privacy roundtable in December, Chairman Leibowitz specifically referred to the Sears Holdings case: “Nobody argues that the folks at Sears are bad people who wanted to do bad things with the information. To the contrary, they probably didn't know exactly what they expected to learn from this data. That just demonstrates, however, that all of us are still feeling our way around what respecting privacy really means.”

The Iconix Case

In October, the FTC filed a complaint in Federal District Court in New York alleging that since 2006, Iconix Brand Group Inc. (“Iconix”) ' the owner, licensee or marketer of popular youngsters' apparel brands such as Mudd, Candie's, Bongo and OP ' knowingly collected and stored personal information obtained from 1,000 children without first notifying their parents or obtaining required parental consent, which is a violation of the FTC Act and the Children's Online Privacy Protection Act (“COPPA”). The complaint also alleged that Iconix enabled children to publicly share photos and stories online.

Section 5 of the FTC Act prohibits “unfair or deceptive trade acts or practices.” The FTC has used '5 to pursue companies that engage in “deceptive trade acts or practices” by failing to follow their own stated privacy practices, as well as companies that engage in “unfair” acts by inadequately securing consumers' personally identifiable information.

Under the FTC's Children's Online Privacy Protection Rule (16 C.F.R. '312) (the “Rule”), “personal information” includes “a photograph of the individual, when associated with other information collected online that would enable the physical or online contacting of the individual.” 16 C.F.R. '312.2.

Instead of contesting the FTC's charges, Iconix agreed to pay a $250,000 civil penalty and enter a consent order prohibiting COPPA violations in the future and requiring deletion of all personal information Iconix collected and maintained in violation of COPPA.

Also last year, the FTC released a report titled Beyond Voice: Mapping the Mobile Marketplace that addresses the challenges and concerns that “smartphones” and other mobile devices with which people can access the Internet present to protecting children's privacy (see, www.ftc.gov/opa/2009/04/mobilerpt.shtm). The United States currently has no laws relating specifically to mobile marketing campaigns aimed at children, although an industry self-regulatory body, the Mobile Marketing Association, has established voluntary guidelines. (See, “Recommendation Marketing Through Evolving Social Media Channels” in the October 2009 issue of e-Commerce Law & Strategy, at www.ljnonline.com/issues/ljn_ecommerce/26_6/news/152810-1.html.) As a result, the FTC staff agreed to expedite review of the COPPA rule to determine if affirmative express consent from parents should be required when advertisers collect information used to send individualized ads to children as part of a behavioral advertising campaign in mobile marketing. The expedited review is scheduled for this year.

Marketing Inappropriate Content to Children

On Dec. 3, the FTC released Marketing Violent Entertainment to Children: A Sixth Follow-Up Review of Industry Practices in the Motion Picture, Music Recording & Electronic Game Industries (www.ftc.gov/opa/2009/12/violentent.shtm). The report criticizes widespread cross-promotion of violent PG-13 movies to young children.

The FTC report found that PG-13 movies were regularly advertised on children's television networks such as Nickelodeon and the Cartoon Network, even though children aged two to 11 years old compose 50% of these networks' viewers any time of day. The FTC's review of movie studio marketing plans demonstrated that studios “intentionally market” violent PG-13 films to children under the age of 13 through advertising and promotional tie-ins with food, toys and other licensed products.

The FTC also found that studios continued to place a significant number of ads for violent R-rated movies during television programs and on Internet sites highly popular with children under 17.

This is the FTC's seventh such report to Congress since 2000. Although this latest report found that the movie and game industries made progress in restricting marketing of products, the report concluded that the music industry “had not significantly changed its marketing practices since the commission's initial report.”

The report suggested that the movie and music industries create explicit, objective criteria to restrict marketing of violent content to children, specifically marketing PG-13 movies to children directly, and through online and viral marketing and tie-ins with food, toys and other licensed products. The report also recommends that the movie, music and video-game industries increase enforcement against online posting of “red tag” trailers without adequate age-based access restrictions and that all three industries improve display of rating information in advertising and on packaging.

The FTC's latest report concerning marketing of violent media to children seems to support private organizations' assessments that more stringent and express restrictions must be established and effectively implemented to reduce the potential number of young children exposed to inappropriate entertainment-media marketing.

The FTC report specifically notes that the Motion Picture Association of America ' which has worked with other non-government bodies to rate and review ads and marketing of motion pictures to children ' “has not adopted any new rules prohibiting inappropriate targeting of R-rated and PG-13 rated films to teens and younger children.”

The report concludes that entertainment-industry “standards against targeting teens and younger children in the marketing of violent entertainment products have not sufficiently curbed marketing that reaches a large youth audience, particularly in online media. These standards need to be tightened and more strictly enforced.”

Endorsement and Testimonial
Guidelines in Advertising

In October, the FTC published its revised Guides Concerning the Use of Endorsements and Testimonials in Advertising (the “FTC Guides”) (See, 16 C.F.R. Part 255). These went into effect on Dec. 1. The FTC established endorsement and testimonial guides for advertising in 1972 and updated them in 1980. The FTC Guides are neither laws nor regulations, carry no penalties, and are unenforceable on their own; rather, enforcement actions pursuant to '5 of the FTC Act or pursuant to a state unfair-and-deceptive-practices act may reference the FTC Guides when determining potential liability for advertisements that use endorsements and testimonials.

The Guides state: “Advertisers are subject to liability for false or unsubstantiated statements made through endorsements, or for failing to disclose material connections between themselves and their endorsers. Endorsers also may be liable for statements made in the course of their endorsements.”

The latest revisions of the FTC Guides make it clear that outside the context of traditional advertising (such as television commercials and print ads), celebrities have a duty to disclose their respective relationships with advertisers whenever making endorsements while not under the direct control of the advertiser (such as whenever celebrities participate on television talk shows, blogs and other social media).

Conclusion

The FTC experienced a number of dramatic changes in 2009, including:

• Appointment of a new chairman, new commissioners, new directors of separate FTC bureaus;
• House passage of amendments to the FTC Act to enhance the FTC's conventional enforcement authority;
• Release of several new reports recommending establishment and implementation of new approaches to defining and protecting consumer privacy in light of the growing prevalence of behavioral advertising;
• Enactment of the first revision in almost 30 years to the FTC Guides governing endorsements and testimonials in advertising, and;
• Publication of the FTC's latest report recommending the creation of specific and objective criteria to restrict the marketing of violent content to children.

If 2009 is a bellwether of what to anticipate from the FTC this year, then it seems reasonable to expect faster and more aggressive FTC action as mainstream advertisers continue competing aggressively for a shrinking pool of consumer dollars.

In addition, if the version of the bill amending the FTC Act that the House of Representatives has voted to approve becomes law this year with the FTC provisions intact, it certainly will bolster the prospect of the FTC increasing its enforcement efforts in privacy, advertising, entertainment and evolving media.