In This Issue:

• California Voters Likely to Decide Consumer Privacy Rules
• Finally, a Full House
• Musical.ly Under Scrutiny
• Action Filed Against Clif Bar for Misleading Advertising for Sugary Bars
• FTC and FDA Working to Protect Children From Nicotine Products Marketed as Kid-Friendly
• Enjoy Life Foods Achieves Palm Oil-Free Certification

California Voters Likely to Decide Consumer Privacy Rules

By Alan L. Friel

California has a unique ballot initiative process that allows voters to directly pass legislation, and it appears that proponents of an initiative that could impact digital advertising and apply European Union (EU)-inspired consumer privacy protections – including opt-out consent to broad categories of data use and sharing – have obtained enough signatures to place the measure on the November ballot.

On May 3, 2018, Californians for Consumer Privacy announced that about 625,000 signatures in support of the initiative were filed with the California Secretary of State. A total of 365,880 valid signatures are needed to qualify the initiative, 58.5 percent of those submitted, suggesting that the measure is all but certain to make the ballot this fall. Given the size of California’s population and economy, California privacy and other consumer protection legislation has in the past had national impact. In the wake of growing public concerns over the improper use of online user information and data breaches, such as those illustrated by the Cambridge Analytica scandal and Russian election meddling, the ballot initiative could well garner sufficient support for passage.

California May Change the US Privacy Landscape

Indeed, at first blush, an overview of the proposal might sound appealing to consumers. The California Attorney General’s Title and Summary for a California ballot initiative titled “The Consumer Right to Privacy Act of 2018” (the Initiative):

ESTABLISHES NEW CONSUMER PRIVACY RIGHTS: EXPANDS LIABILITY FOR CONSUMER DATA BREACHES. INITIATIVE STATUTE. Gives consumers right to learn categories of personal information that businesses collect, sell, or disclose about them, and to whom information is sold or disclosed. Gives consumers the right to prevent businesses from selling or disclosing their personal information. Prohibits businesses from discriminating against consumers who exercise these rights. Allows consumers to sue businesses for security breaches of consumer data, even if consumers cannot prove injury. Allows for enforcement by consumers, whistleblowers, or public agencies. Imposes civil penalties. Applies to online and brick-and-mortar businesses …

The Initiative would regulate “personal information,” broadly defined to include IP addresses, cookie or pixel tag IDs, device IDs, and other unique identifiers, as well as more traditional types of personal information, and “inferences drawn” from that data. Unlike a federal consumer privacy bill recently introduced and discussed below, the Initiative is an opt-out scheme rather than an opt-in scheme. In some ways, then, it has similarities to the current US interest-based advertising self-regulatory opt-out program. However, the Initiative would prohibit conditioning service on consent, something neither the EU’s General Data Protection Regulation (GDPR) nor the current US self-regulatory program does.

While the proposed federal legislation would also restrict take-it-or-leave-it consent choices, it would allow the potential for commercially reasonable differential access terms, such as through pricing based on incentives and discounts for consent. The Initiative would thus not only restrict the ability of publishers and service providers of currently free-to-consumer, advertiser-supported content and services to require consent to interest-based advertising, but also prohibit them from even pricing access to interest-based-ad-free content and services differently than access to interest-based-ad-supported content.

Much like the current California Shine the Light Act, which gives consumers the right to learn about the sharing of their personal information with third parties for direct marketing purposes if they are not given choice regarding that sharing, the Initiative gives rights only to California residents. However, the scope of regulated activity and data is far more expansive than current California law, which is more about transparency than choice. Also, unlike the Shine the Light Act or proposed federal legislation, the Initiative provides an express private right of action, with no need to show injury beyond a violation of the statute for standing, and statutory damages of a minimum of $1,000 and up to $3,000 per violation, which would make filing claims very attractive to class action lawyers if it were to pass. Further, a security breach of the regulated data would also be subject to such statutory penalties.

A full copy of the Initiative is available here.

Proposed Federal Legislation Also Threatens the Status Quo

And California is not alone in proposing strict EU-inspired consumer privacy legislation. On April 10, Sens. Edward Markey, D-Mass., and Richard Blumenthal, D-Conn., introduced the Customer Online Notification for Stopping Edge-provider Network Transgressions (CONSENT) Act (or the Bill). CONSENT would provide the Federal Trade Commission (FTC) with new authority to establish regulations aimed at protecting the privacy of information belonging to customers of so-called edge providers, the content and content-enabling services that use the internet – websites, web services, search engines, social media platforms, online advertising services, web and mobile applications, and content-hosting and content-delivery services. Most notably, the Bill proposes to regulate the collection and use of online service usage data, which is deemed sensitive regardless of its nature and without being tied to a personally identifiable person.

The Bill, if passed in this form, would require, among other things, an edge provider to obtain opt-in consent from the customer to use, share or sell certain types of data, including usage data – the data that drives interest-based advertising. It would also prohibit requiring consent to use and sharing for “commercial purposes” as a condition of service. However, rather than banning price breaks or incentives for providing consent as the Initiative does, the Bill would give the FTC the authority to determine whether providing consideration to customers in exchange for consent is reasonable under the circumstances. Unlike the Initiative, the Bill proposes that only the FTC, certain other federal agencies, and state attorneys general may enforce the law, and there is no express private right of action.

For a more detailed analysis of the Bill, click here.

The Takeaway

Both the Initiative and the Bill pose a material risk to digital advertising as practiced in the United States today. But unlike the Bill, which can be reworked during the legislative process, the Initiative would become law based on the current draft if California voters were to pass it – that is, unless the Bill or some other federal consumer privacy legislation were to include a provision that expressly preempts state laws in the area, something the current Bill does not propose to do. If both were to pass in their current form, the Bill would create a floor providing for opt-in consent, and the Initiative would add higher restrictions as applied to California residents, such as prohibiting offering incentives to consumers for providing consent.

We will continue to follow and report on these and other legislative efforts that affect interest-based advertising, e-commerce and digital publishing.

Finally, a Full House

by Holly Melton

Short-Staffed

As the unseasonably chilly month of April arrived, the Federal Trade Commission (FTC) was operating with only two commissioners – Commissioner Terrell McSweeny and then-Acting Chairman Maureen Ohlhausen (this had been the case since former Chairman Edith Ramirez vacated her post in January 2017). Then, on April 16, Commissioner McSweeny announced that she would step down effective April 28, leaving Ohlhausen as the lone commissioner. Although McSweeny’s seven-year term technically expired in September 2017, she continued to serve in the absence of a replacement. Former Acting Chairman Ohlhausen, of course, was nominated to serve as a U.S. Court of Federal Claims judge in January of this year, but that nomination has not yet been confirmed.

New Kids on the Block

On April 26, 2018, the Senate confirmed the nominations of five new commissioners: Joseph Simons, Noah Joshua Phillips, Rebecca Kelly Slaughter, Rohit Chopra and Christine Wilson.

Joseph Simons was sworn in as the FTC’s new chairman on May 1 and is familiar to the agency. Most recently, Chairman Simons served as the director of the Bureau of Competition from June 2001 to August 2003. He also served as the associate director for Mergers and the assistant director for Evaluation in the ’80s. In private practice, he most recently co-chaired the antitrust group of a major law firm.

Commissioner Phillips served as chief counsel to Senator John Cornyn, R-Texas, beginning in 2011 and advised on antitrust, constitutional law, consumer privacy, fraud and intellectual property. Commissioner Slaughter served as chief counsel to Senator Chuck Schumer, D-N.Y., beginning in 2009, during which she advised on legal, competition, telecommunications, privacy, consumer protection and intellectual property matters.

Commissioner Chopra was most recently with the Consumer Federation of America, where he focused on consumer financial services and economic issues facing young people. Prior to that, Chopra served as special advisor to the secretary at the U.S. Department of Education. Chopra also formerly served as assistant director of the Consumer Financial Protection Bureau shortly after its formation in 2010, and was the first student loan ombudsman for the agency, appointed in 2011. Commissioners Phillips, Slaughter and Chopra were sworn in on May 2.

Wilson currently serves as the senior VP of Regulatory and International Affairs for Delta Air Lines Inc. In private practice, she focused on competition and antitrust law.

Not So Fast

Although the Senate confirmed Wilson’s appointment to the FTC, she has not yet been sworn in. Commissioner Ohlhausen’s term does not expire until Sept. 25, 2018, and she has made clear that she does not intend to vacate her post until her judicial appointment has been confirmed. Following the Senate’s confirmation of the new commissioners, Commissioner Ohlhausen congratulated Simons, Phillips, Slaughter and Chopra and stated, “I also congratulate Christine, who will take my seat if I am so fortunate as to be confirmed by the Senate as a judge on the U.S. Court of Federal Claims.”

The Takeaway

A number of the new commissioners have backgrounds focused less on privacy and consumer protection and more on competition and antitrust issues. It will be interesting to see how these new commissioners’ backgrounds shape the FTC’s enforcement priorities going forward.

Musical.ly Under Scrutiny

By Moustafa Badreldin

CARU Tunes In

Musical.ly Inc., operator of the Musical.ly mobile application available on the iPhone and Android operating systems (the App), has been referred to the Federal Trade Commission (FTC) by the Children’s Advertising Review Unit (CARU). CARU, in its regular role of monitoring advertising geared toward children, reviewed the marketing practices of Musical.ly and concluded that the App was marketed to children under the criteria set forth by the Children’s Online Privacy Protection Act (COPPA) and therefore must comply with COPPA standards.

The App is a social network that allows its users to create, share and view short user-generated videos, which usually take the form of music or dance videos. In its review of the App, CARU looked at the overall impression and usage of the App. CARU noted that many of the videos posted feature teens, and many of the account profiles appear to be of children who are under age 13. CARU stated that Musical.ly did not ask for age or date of birth upon registering its users, although Musical.ly did start to implement this feature during CARU’s review. Musical.ly argued that the App was not directed at children but was for a general audience, noting that the App does not feature “animated characters or child-oriented language or activities.”

CARU, however, focused its review on the overall impression left by the App. CARU was concerned that the App, even though it may not be directly marketed to children as Musical.ly claims, is in practice heavily used by children. In looking at the services and content of the App, CARU agreed that the App does not necessarily target children as its primary audience, but found that there were other factors, such as the App’s subject matter (many of the videos and stars featured on the App are popular among children under age 13), the App’s general audience (many profiles appearing to belong to children) and the visual content posted on the App (again, many appearing to feature children), that qualify the App under COPPA’s compliance criteria.

COPPA Standards

In finding that the App is secondarily marketed toward children, CARU determined that COPPA rules must be followed. COPPA provides exceptions for services that do not directly target children in their advertising but still may include children within their user base. This “hybrid service” exception allows services to set up age screens or limits by asking for a user’s age before the service is used. To comply with COPPA rules, the App must not collect personal information of a user before this age question is asked and must set up a mechanism by which no personal information is collected or used before parental notice is given and consent is obtained. If no such consent is obtained, the App must direct child visitors to a version of the service that does not involve the collection, use or disclosure of personal information as defined by COPPA, or that has a COPPA-compliant parental verification program.

Musical.ly, in its advertiser’s statement, did not agree with CARU’s determination, arguing again that its services were marketed to a general audience and that it is, therefore, not subject to COPPA rules.

The Takeaway

CARU’s determination here should make all online services take notice of how their website and services are actually used. Even if a company makes a deliberate effort to avoid child-directed marketing, regulators will look to the overall impression left by the company and will look into its actual user base in determining whether COPPA applies. We will continue to monitor this issue, particularly how the FTC responds to CARU’s referral, for future developments.

Action Filed Against Clif Bar for Misleading Advertising for Sugary Bars

By Stephanie Lucas

Snack Attack

A proposed class action was filed against Clif Bar & Co. in April 2018 in the U.S. District Court for the Northern District of California. The complaint alleges violations of California’s Unfair Competition Law, False Advertising Law and Consumer Legal Remedies Act, among numerous other causes of action. According to the complaint, the proposed class alleges that Clif Bar “employs a strategic marketing campaign intended to appeal to consumers interested in healthful foods in order to increase sales and profits, despite that the high-sugar bars are detrimental to health.” The complaint alleges that because Clif Bar markets its products as healthy, consumers are deceived into buying ZBars and “Classic” Clif Bars as healthy snacks, even though these bars actually derive as much as 37 percent of their calories from added sugar and are thus not especially healthy.

Just a Spoonful?

The complaint also goes into detail about the health risks of and public concerns surrounding the consumption of excessive sugar in snacks and the potentially severe consequences from ingesting too much sugar over time. Based on these concerns, the complaint alleges that Clif Bar deceptively omits, intentionally distracts from and otherwise downplays its bars’ high added sugar content, thereby misleading consumers into purchasing the bars. An example from the complaint is Clif Bar’s alleged representation that many of its high-sugar bars contain “no high fructose corn syrup,” which the plaintiffs allege confuses consumers and obscures the dangers of the bars’ added sugar.

The complaint requests a jury trial and is seeking compensatory, statutory and punitive damages, as well as pre- and post-judgment interest, attorneys’ fees and costs, and any other relief the court deems necessary from Clif Bar.

The Takeaway

This proposed consumer class action follows a growing trend of consumer watchdogs and the class action bar paying attention to the marketing from large brands and alleging potential deception, especially regarding healthy foods claims. Brands need to keep in mind that express and implied claims centered on nutrition or well-being arising out of the net impression consumers take away from packaging and marketing must be soundly substantiated.

FTC and FDA Working to Protect Children From Nicotine Products Marketed as Kid-Friendly

By Niloufar Massachi

Kid Caution

On May 1, 2018, the Federal Trade Commission (FTC) and the Food and Drug Administration (FDA) issued 13 joint warning letters to manufacturers, distributors and retailers that have misleadingly labeled or advertised e-liquids used in e-cigarettes to mimic products that appeal to kids, such as Tree Top-brand juice boxes, Golden Oreo cookies and War Heads candy. The two agencies are working together to protect young children from these liquid nicotine products and the potential danger they pose to kids who associate them with products that they eat and drink.

The letters claim misbranding in violation of the Federal Food, Drug, and Cosmetic Act because of the false or misleading nature of the e-liquid product labeling and/or advertising. The FTC adds that marketing e-liquids in packaging that resembles kid-friendly food products could present an unwarranted risk to the health or safety of children in violation of Section 5 of the FTC Act, which prohibits unfair or deceptive marketing practices.

The companies that received a warning letter have 15 working days to respond with information of specific corrective actions taken to address the agencies’ concerns and to describe plans for compliance. Failure to do so could lead to additional action, such as seizure or injunction.

The FTC’s chairman has stated, “Nicotine is highly toxic, and these letters make clear that marketing methods that put kids at risk of nicotine poisoning are unacceptable.” According to the FDA’s commissioner, “It is easy to see how a child could confuse these e-liquid products for something they believe they’ve consumed before, like a juice box. These are preventable accidents that have the potential to result in serious harm or even death.”

The Takeaway

Brands should be cautious about marketing or labeling products in ways that could confuse consumers, especially children, by a resemblance to other products. In particular, product packaging that misleads consumers and that could pose health and safety risks is likely to be targeted by regulators. The warning letters are part of the FDA’s continuing Youth Tobacco Prevention Program, which is aimed at addressing concerns with youth access to tobacco products. The FDA has stated that it will “be taking a series of escalating actions under [its] new Youth Tobacco Prevention Plan” to limit the appeal and exposure of tobacco products to youth. This demonstrates that the FDA will continue its focus on investigating and taking action against companies that mislead young consumers in the advertising and labeling of their products.

Enjoy Life Foods Achieves Palm Oil-Free Certification

By Njeri Chasseau

Palm-Free Is the Way to Be

Health foods brand Enjoy Life Foods is officially the first food company to become Certified Palm Oil Free by the International Palm Oil Free Certification Accreditation Programme (POFCAP). At less than 1 year old, POFCAP aims to set a new standard when it comes to holding companies to their promises to avoid unsustainable palm oil sources. The program currently operates in six countries, but its reach is widespread − a number of companies around the world have applied for certification for their products, with five companies, and 239 individual products, having achieved complete palm oil-free certification.

Palm oil, a highly controversial oil, is the most common vegetable oil found in a variety of foodstuffs sold around the world. The majority of palm oil is actually produced by plantations in three nations: Malaysia, Indonesia and Papua New Guinea. However, the process of producing palm oil has become highly contentious in recent years because of the impact on the environment (from clearcutting and other forms of degradation) and the use of forced labor, including child labor.

A number of food companies have taken measures to source from sustainable palm oil plantations and avoid those that engage in questionable practices. Enjoy Life Foods, however, is the first among such food companies to produce a line of items that would traditionally contain palm oil but do not, such as granola and protein products.

The Takeaway

Brands may want to make claims and tout certifications that their products have positive social, environmental or other attributes. Certifications − even third-party certifications − are advertising claims. Like all advertising claims, the brand must have sound substantiation for the express and implied claims that are made by use of a certification. Self-certifications are particularly suspect, but care also needs to be taken by companies participating in third-party certification programs.