For additional information see the Ad Law Access blog posts:

• Taking Stock of the TCPA in 2019: What is an “Autodialer”?
• FCC Reaffirms Potential TCPA Liability for Text Message Platforms

For a deeper focus on TCPA-related issues at the FCC, listen to the “Inside the TCPA” series on Kelley Drye Full Spectrum.

The Ad Law Access podcast is available now through Apple Podcasts, Spotify, Google Podcasts, SoundCloud, and other podcast services.

The FTC’s complaint against Google alleges that the company offered free and paid apps through its Play store. Many of these apps are rated for kids and offer “in-app purchases” ranging from $0.99 to $200, which can be incurred in unlimited amounts. The FTC alleges that many apps invite children to obtain virtual items in a context that blurs the line between what costs virtual currency and what costs real money.

At the time Google introduced in-app charges in March 2011, users were notified of an in-app charge with a popup containing information about the virtual item and the amount of the charge. A child, however, could clear the popup simply by pressing a button labeled “CONTINUE.” In many instances, once a user had cleared the popup, Google did not request any further action before billing the account holder for the corresponding in-app charge.

It was not until mid- to late-2012 that Google begin requiring password entry in connection with in-app charges. The complaint alleges, however, that once a password was entered, it was stored for 30 minutes, allowing a user to incur unlimited in-app charges during that time period. Regardless of the number or amount of charges incurred, Google did not prompt for additional password entry during this 30 minute period.

Google controls the billing process for these in-app charges and retains 30 percent of all revenue. For all apps, account holders can associate their Google accounts with certain payment mechanisms, such as a credit card, gift card, or mobile phone billing. The complaint highlights that Google received thousands of complaints related to unauthorized in-app charges by children and that unauthorized in-app purchases was the lead cause of chargebacks to consumers.

The FTC alleges that Google’s billing practices were unfair and violated Section 5 of the FTC Act. Under the terms of the proposed settlement order, Google must pay at least $19 million in refunds to consumers. Google is also required to obtain the “prior express, affirmative consent of the account holder” before billing a consumer for an in-app charge.

In instances where consent is sought for a specific in-app charge, the settlement requires Google to clearly and conspicuously disclose: (1) the in-app activity associated with the charge; (2) the specific amount of the charge; and (3) the account that will be billed for the charge. In addition, if consent is sought for potential future in-app charges, Google must clearly and conspicuously disclose: (1) the scope of the charges for which consent is sought, including the duration, devices, and apps to which consent applies; (2) the account that will be billed for the charge; and (3) the method(s) through which the account holder can revoke or otherwise modify the scope of consent.

The settlement with Google is a good reminder that app developers and mobile platforms should continue to review their advertising, marketing, and game experience (as well as consumer complaints), and determine whether existing disclosures may benefit from disclosure and process enhancements in line with the terms set forth in this latest settlement.

Specifically, the FTC alleged that Fandango and Credit Karma disabled the SSL (Secure Sockets Layer) certification validation procedure for each of their mobile apps. By doing so, the FTC claims that the apps were open to attackers positioning themselves between the app and the online service by presenting an invalid SSL certificate to the app – i.e., “man-in-the-middle” attacks. The FTC contends that Fandango and Credit Karma engaged in a number of practices that, when taken together, failed to provide reasonable and appropriate security in the development and maintenance of its mobile app, including:

• Overriding the default SSL certificate validation settings provided by the iOS and Android application programming interfaces (APIs) without implementing other security measures to compensate for the lack of SSL certificate validation;
• Failing to appropriately test, audit, assess, or review the apps, including failing to ensure that the transmission of sensitive personal information was secure;
• Failing to maintain an adequate process for receiving and addressing security vulnerability reports from third parties (Fandango only); and
• Failing to reasonably and appropriately oversee its service providers’ security practice (Credit Karma only).

As mobile privacy and security continues to be at the forefront of the FTC’s enforcement priorities, companies should keep abreast of developments in this area and regularly evaluate their mobile products and services. Stay tuned for a Kelley Drye client advisory discussing the enforcement trends for mobile and “red flags” that companies should watch out for.

With the rise in class action cases for alleged TCPA violations, businesses engaging in telemarketing should review their practices for obtaining customer consent prior to implementation of the new rules on October 16, 2013.

For more information, click to read our client advisory.

Yesterday, the California Superior Court dismissed the claim, holding that the state action is pre-empted by the federal Airline Deregulation Act, which prohibits states from applying regulations on airlines related to price, routes, or services. Judge Miller stated: “In this instances it’s services. . . . I think that this case is, in effect, an attempt to apply a state law designed to prevent unfair competition, which regulates an airline’s communications with consumers, and I think it’s pre-empted.” Press coverage is available here.

This is an interesting result for the first Attorney General app enforcement action and it’s too soon to tell whether the Attorney General will appeal the decision. Unfortunately, the ruling doesn’t provide any substantive guidance, or give much comfort, to companies that can’t make similar federal pre-emption arguments. Companies with mobile apps will want to keep their seatbacks and tray tables in their upright and locked positions as we watch for the Attorney General’s next activities in the mobile privacy space.

During a Lakers game last year, the team invited fans to text a message for a chance to have it appear on the scoreboard. A fan texted a message, and received the following confirmation from the Lakers in return: “Thnx! Txt as many times as u like. Not all msgs go on screen. Txt ALERTS for Lakers News alerts Msg&Data Rates May Apply. Txt STOP to quit. Txt INFO for info.” Shortly thereafter, the plaintiff filed a lawsuit against the Lakers arguing that the team had sent that message without consent, in violation of the Telephone Consumer Protection Act.

Applying a “common sense” reading of the TCPA, a California court determined that, by sending his original message, the plaintiff “expressly consented” to receiving a confirmatory text message from the Lakers. Indeed, the court noted that when the plaintiff sought to display his message on the scoreboard, “it is difficult to imagine how he could have been certain that the Lakers received his message without a confirmative response.” Accordingly, the court granted the Laker’s motion to dismiss the case.

There are still a number of legal risks associated with text message campaigns, but this decision — as well as other recent developments — suggests that companies now have a better shot at prevailing in these types of nuisance suits.

A Thompson Interactive webinar, “There's an App for That: Regulating Mobile Medical Devices” will address these issues. Discussed will be the regulatory status surrounding health-related and medical device mobile applications, or MMAs. The presentation will cover topics including FTC’s enforcement and recent statements regarding health-related mobile applications, design considerations key to application development, such as privacy, and FDA’s position regarding MMAs as explained in the draft guidance, the recent Congressional hearings on the issue. Participants will also have the chance to ask questions during the live Q&A portion of the webinar.

To register, please click here.

For instance, the Revised Guide explains that advertisers must account for the anticipated use of smartphones and tablets by either creating a mobile-optimized version that the ad will default to or designing the ad such that disclosures are clear and conspicuous regardless of how they are viewed. Additionally, the Revised Guide sets forth new considerations for advertisers using space-constrained ads, including the capacity to use short form disclosures such as “Ad:” and the possibility of republication by consumers.

For more information, see the Kelley Drye client advisory.

The 2012 Compliance Report indicates that the NAI and its members:

• Educate consumers about OBA and their choices
  
• Provide notice about each member’s OBA practices on the member’s site and on the sites where data is collected for OBA purposes
  
• Disclose the collection of health-related information
  
• Maintain opt-out mechanisms so users can elect not to receive OBA
  
• Require opt-in consent mechanisms for the use of sensitive consumer information
  
• Deliver OBA without the use of individuals’ personally identifiable information (“PII”)
  
• Do not specifically target OBA to children under age 13
  
• Use collected data only for marketing purposes
  
• Implement standards and restrictions on data retention, security, and transfer

The NAI also indicated that it will develop guidelines on the collection and use of data on mobile devices and use of mobile tracking technologies.

Online behavioral advertising continues to receive attention from regulators such as the Federal Trade Commission. Companies that engage in OBA should continue to ensure that they work with partners that comply with appropriate self-regulatory programs.

According to the Commission, the latest staff survey reveals that “little or no progress has been made” by the mobile app industry on increasing transparency in the mobile marketplace during the past year. In response, the Commission is urging app developers and app store operators to implement privacy best practices, such as those outlined in the FTC’s March 2012 privacy report. In addition, the report notes that FTC staff has launched multiple non-public investigations to determine whether certain entities in the mobile app ecosystem are violating the Children’s Online Privacy Protection Act (“COPPA”) or engaging in unfair or deceptive practices in violation of Section 5 of the FTC Act.

This Kelley Drye client advisory summarizes key results from the survey and provides recommendations for stakeholders in the mobile app ecosystem in light of the report.

In a ruling that should make companies breathe easier, last week, the FCC determined that such messages do not violate the TCPA. You can read more about the ruling on the Telecom Law Monitor.

The power of AR, particularly for marketers, is its ability to overlay highly relevant, timely, and interactive data about specific products or services within a user’s live physical environment. If you’re considering whether to add an AR app to your marketing mix, however, be aware that traditional consumer protection rules still apply.

Our article posted on Mashable, Navigating the Legal Pitfalls of Augmented Reality, highlights several key advertising law and consumer privacy principles that companies should consider when entering this emerging space.

On November 16th, Kelley Drye held a webinar which discussed the new rules of the road for mobile communications, marketing, and sweepstakes, and offered suggestions for reaching consumers while mitigating the legal risks.

Click here to download the slides from the webinar and click here to watch the recording.

As we’ve noted in previous posts, the number of lawsuits involving text message campaigns has increased dramatically in recent years. Part of the increase is because many companies aren’t paying attention to legal requirements. But the increase is also largely because class action attorneys have come to see these cases as an easy way to make money. For example, a recent case involving text messages sent by Jiffy Lube settled for $47 million. These attorneys will seize on any violation -- no matter how minor -- as an opportunity to force a settlement.

Most of the recent lawsuits could have been avoided if the text message campaigns if the campaigns had been carefully reviewed prior to launch. Sometimes, there's a tendency to try to skip that step in order to cut costs and launch quickly, but the recent string of multi-million dollar settlements demonstrates that’s a very short-sighted approach. It will cost exponentially less time and money to do things right from the start. If you're planning a new campaign, get your legal team involved early in the process.

This latest development follows the agreements reached earlier in the year between the Attorney General’s Office and Facebook, Amazon, Apple, Google, Hewlett-Packard, Microsoft, and Research In Motion, to improve privacy protections on mobile apps. The agreement included efforts to provide a way for privacy policies to be posted in a consistent location for apps, for the privacy policy to be reviewed prior to download, and for app users to report apps that do not comply with laws or the applicable terms of service.

A copy of the letter that the California Attorney General’s Office sent to mobile app developers can also be found here.

Companies are required to ensure their ads are truthful and substantiated. Although some marketers equate the word “ad” with a multi-million dollar TV campaign, the FTC clarifies that an ad can be pretty much anything a company says about what a product can do. Marketers need to ensure they can support these claims. The FTC also discusses the importance of making disclosures in a “clear and conspicuous” manner.

Marketers should think about privacy in the early stages of developing an app. Among other things, the FTC encourages marketers to only collect the information they need, to be transparent about data collection practices, to get consent before collecting sensitive information, and to keep user data secure. In addition, the FTC reminds marketers that they may be subject to the Children’s Online Privacy Protection Act if they collect personal information from children under 13.

The FTC’s guide addresses many of the issues that have gotten app developers in trouble over recent years. Therefore, it provides valuable insights for companies about what they need to do in order to stay out of trouble. Although it may cost more to run an app through a legal review prior to launch, it costs a lot less than having to deal with an FTC investigation later.

For a more detailed analysis of the FTC's guide, click here. And for more tips on developing a mobile app, click here, here, and here.

In this case, the plaintiff agreed to receive text messages from Taco Bell, and later opted-out. Taco Bell then sent the plaintiff a text message confirming his request. The plaintiff argued that the confirmation was sent without his consent and, therefore, in violation of the Telephone Consumer Protection Act. The court disagreed, noting: “Defendant’s sending a single, confirmatory text message in response to an opt-out request from Plaintiff, who voluntarily provided his phone number by sending the initial text message, does not appear to demonstrate an invasion of privacy contemplated by Congress in enacting the TCPA.” A contrary holding “would contravene public policy and the spirit of the statute.”

The court gave plaintiff 30 days to file an amended complaint, but it’s hard to imagine how the plaintiff will be able to overcome the court’s objections on this issue. This decision is good news for all mobile marketers, especially because the Mobile Marketing Association’s Consumer Best Practices Guidelines specifically require companies to send a confirmation message when consumers opt-out.

Although the terms stated that subscribers would receive a maximum of three messages per week, the consumer claims he received five messages in the week between March 11 and March 17, 2012, and four messages in the week between March 18 and March 24, 2012. The consumer argues that the two additional messages he received during the first week and the one additional message he received during the second week were sent without consent and, thus, in violation of the Telephone Consumer Protection Act.

Companies need to ensure they carefully draft the terms for their text message campaigns and that their campaigns are run in a manner that conforms with those terms. This case demonstrates that even a small deviation can result in a lawsuit.

“Universal and Cross-Platform Advertising Disclosures”

“Social Media Advertising Disclosures”

“Mobile Advertising Disclosures”

“Usability Research” and “Mobile Privacy Disclosures”

The comment period is open through July 11, 2012. The Commission is targeting this Fall for issuance of updated guidance.

Ohm previously served as a federal prosecutor for the U.S. Department of Justice's Computer Crime and Intellectual Property Section. Before his legal career, Ohm earned undergraduate degrees in computer science and electrical engineering and worked as a programmer, network administrator and IT specialist.

FTC Chairman Jon Leibowitz released a statement on Ohm's appointment: "Paul's keen insights on how the law applies to technology and privacy issues will be invaluable to the FTC's work in these areas. We have been fortunate in bringing in a series [of] top-notch experts to advise us on cutting-edge issues and enhance our in-house expertise. We look forward to having Paul on board."

Additional coverage is available here, here, and here. A full press release is available here.