Litigation Management for the In-House Generalist and Business Leader (Part 1)

Understanding the basics of litigation management is essential for in-house counsel, and can give business leaders more perspective on playing the “litigation card.”  Yesterday InsideCounsel Magazine published the first in a six-part article series entitled “Litigation Management for the In-House Generalist” co-authored by myself and Michael Geibelson, a partner at Robins Kaplan LLP and a top-notch litigator.  Part 1 in the series introduces the six phases of litigation and provides important information on what to consider when commencing litigation.  Click the link above (or click here) to read the article, and enjoy!

AppChoices – Behavioral Advertising Controls Gone Mobile

Online behavioral advertising (also known as “interest-based” advertising and “targeted” advertising) is the use of information collected about an individual’s online behavior (e.g, web browsing history) to serve online advertisements through ad networks tailored to that individual’s interests. Online behavioral advertising is broken into two categories — first party (online ads served on a website based on an individual’s online behavior on that website) and third party (online ads served on a website based on an individual’s online behavior on other websites). Online behavioral advertising is designed to increase the click-through rate by serving ads of greater interest to consumers.  Studies have shown that a majority of consumers prefer targeted online ads over irrelevant ones.  However, behavioral advertising also raises privacy concerns, as to deliver targeted advertising to an individual you need to collect information about that individual (and the scope of collected information could be broad, potentially including sensitive information).

Back in 2009, the FTC released a report on online behavioral advertising recommending industry-self regulation of third party online behavioral advertising (and implying they would step in if industry self-regulation was ineffective).  In response to the FTC’s report, a group of advertising and marketing trade associations including the Direct Marketing Association, Interactive Advertising Bureau, Better Business Bureau, and Network Advertising Initiative formed the Digital Advertising Alliance.  The DAA developed the “AdChoices” program to provide consumers with the ability to control whether data about them can be used for third party online behavioral advertising purposes.

The primary consumer-facing aspects of the AdChoices program are (1) the DAA Icon, an “i” in a triangle, which companies can use to provide more prominent notice of that company’s interest-based advertising practices; and (2) the Consumer Choice page, a web page introduced in 2010 through which consumers can opt out of the collection and use of web viewing data for online behavioral advertising and other applicable uses.  It’s a good idea for companies to include a link to the Consumer Choice page in their privacy policy.

Since 2010, more and more advertising (including behavioral advertising) is served through ad-supported mobile apps. As a result, last week the Digital Advertising Alliance (“DAA”) introduced two enhancements to the AdChoices program to extend it to mobile apps:

  • The AppChoices mobile application, available for Android and Apple devices, that gives consumers the ability to opt out of the collection of app usage data for online behavioral advertising and other applicable uses.  The AppChoices app can be downloaded from major app stores.  The DAA hosts a page with app store links at http://www.aboutads.info/appchoices.
  • The Consumer Choice page for Mobile Web, an updated and mobile-optimized version of the current Consumer Choice page.

The purpose of the DAA is to demonstrate to the FTC that industry self-regulation of behavioral advertising works.  The industry groups forming the DAA know that if they fail in their mission, the FTC will step in to regulate behavioral advertising.  FTC regulations on behavioral advertising would likely be more onerous than the current self-regulatory principles, and may favor privacy protections over the benefits of targeted advertising to consumers and businesses. This is why businesses should be rooting for the DAA to succeed, and should support their efforts. Look for a major push from the DAA and its member groups to drive increased adoption and usage of both current and new self-regulatory tools in the marketplace.  Companies should consider including updating their privacy policies to include information about the AppChoices download page as well as a link to the Consumer Choice page.

Don’t get Hooked by Phishing or Spear Phishing

Cyber attacks such as the Anthem breach, the Home Depot breach, and the Target breach are becoming almost commonplace.  Major cyber attacks compromising information about millions of people often start not with a bang, but a whisper – a “phishing” or “spear phishing” email through which an attacker tries to acquire login credentials that can be used to launch a sophisticated and crippling attack. Over 90% of cyber attacks take the form of, or start with, a spear phishing attack, and phishing attacks are also very common. These attacks happen both in the office and at home. Phishing and spear phishing attacks can happen at any time, and can target any person or employee.

What is “Phishing?In a “phishing” attack, an attacker uses an email sent to a broad group of recipients (and not targeted to a specific group) to impersonate a company or business in an effort to get you to reveal personal information or login IDs/passwords, or to install malware or exploit a security hole on your computer.  It generally uses an official-looking email and website to gather information, and often contains the logo(s) of the company it is impersonating.

What is “Spear Phishing?In a “spear phishing” attack, an attacker uses an email tailored for a specific group of recipients (e.g., a group of employees at a specific business), often impersonating an individual such as someone from your own company or business, in an effort to get you to reveal personal information, login IDs/passwords, to steal money or data, or to install malware or exploit a security hole on your computer.

How do I spot a phishing or spear phishing emailLook for one or more of these key indicators that an email in your inbox is actually a phishing or spear phishing attack.

  • The email has spelling or grammatical errors. A phishing or spear phishing email often contains spelling or grammatical errors, and does not appear to be written by a business professional.
  • You do not recognize the sender’s email address. If you get an email asking you to click on a link or open an attachment, look carefully at the email address of the sender.  Be especially alert for email addresses that are similar to, but not the same as, your company’s email address (e.g., “joe.johnson@microsoft.co” instead of “joe.johnson@microsoft.com”).
  • The email contains links that don’t go where they say they do. Before you click on a link in an email you don’t recognize, “hover” your mouse cursor over the link. A pop-up will appear showing you where the link will go.  If they don’t match, it’s probably a phishing or spear phishing attempt.  In this example, this innocuous-looking link actually goes to a malicious website:

Bad link sample

  • The email asks you to open an attachment you don’t recognize. Many spear phishing emails ask you to open an attachment or click on a link.  If an email you don’t recognize asks you to open an attachment you weren’t expecting or that doesn’t look familiar, or to click on a link you don’t recognize, don’t click on it or open it, and check with your IT or Security department if you want to know for sure.
  • The email seems to be a security-related email, or asks you to take immediate action. Watch out for emails that state that your account will be suspended; ask you to reset, validate or verify your password, account information or personal information, or otherwise ask you to take immediate action to prevent something from happening.
  • The email relates to a current news event. Many phishing emails use a current news event, such as a natural disaster or security breach, to get you to provide information, click a link or open an attachment.
  • The email contains information from your social media accounts or other public information. Spear phishing attackers will often look at your public social media accounts (e.g., your Facebook feed, LinkedIn profile, tweets, etc.) and other public sources (e.g., Google searches) and use information about you or your friends to make a spear phishing email seem authentic.  If an email contains personal information about you other than your name and email address, take a close look to ensure it’s not a spear phishing attempt.

If you think an email you received is a phishing or spear phishing attempt, (1) do NOT click or open any links or attachments in the email, (2) if you are at work, immediately contact your Security or IT department to report it, especially if you clicked on an attachment or link or otherwise took action before you realized this (failing to report it will be much worse, so don’t be embarrassed); and (3) delete the email immediately.

Demystifying Text Marketing and Double Opt-In

Sending advertisements and promotions through SMS text messages to mobile devices is a compelling digital marketing method for a good reason — the incredibly vast number of mobile devices.  Apple announced last week that it sold a mind-boggling 74.5 million iPhones worldwide in the fourth quarter of 2014.  That’s 33,740 iPhones every hour, 24 hours a day, for 3 months. And an estimated 300 million Android phones were sold worldwide in the same calendar quarter.  Diving into the world of text marketing poses many challenges given the myriad of laws and rules to follow, and stringent compliance requirements such as “double opt-in.”  However, it isn’t really as daunting as it seems at first glance.

The many rules of text marketingA number of laws, rules and guidelines govern text marketing:

  • Text marketing messages are communications distributed over the cellular phone network, and fall under the laws, rules and regulations governing wireless carriers and mobile phone calls. This includes the Telephone Consumer Protection Act (TCPA). The Federal Communications Commission (FCC) enforces the TCPA.
  • CAN-SPAM, the law and associated rules that govern commercial email messages, also governs commercial emails sent to a mobile phone, e.g., 9525551212@vtext.com. The Federal Trade Commission (FCC) enforces CAN-SPAM, as well as laws and rules governing deceptive and unfair trade practices which apply to all marketing.
  • Mobile carriers can have their own rules around text marketing through their systems.
  • Industry groups have published best practice guidelines for companies engaged in text marketing, such as the Mobile Marketing Association (MMA)’s Consumer Best Practices for Messaging.
  • CTIA, the wireless trade association which operates the “Short Code” system used by many companies for text marketing (the “12345” in “Text ABC to 12345”), publishes the Short Code Monitoring Handbook. The Handbook contains rules governing SMS marketing campaigns that use Short Codes. SMS marketers found to be in violation of CTIA rules may be reported to wireless carriers by CTIA, potentially resulting in temporary or permanent suspension of the ability to run text marketing campaigns through those carriers.

Compared to email marketing or even print marketing, the rules governing US text marketing can seem downright draconian. For example, In US email marketing under CAN-SPAM, you can market to someone who hasn’t opted-in as long as you follow CAN-SPAM’s rules, including offering them the right to unsubscribe from further marketing emails, and consent for CAN-SPAM purposes can be oral or written. In US text marketing, to send a commercial text message to a mobile device you must have the unambiguous written consent of the mobile device owner, and “written” means “documented and saved.”  In email marketing, you can purchase opt-in lists; in text marketing, purchasing opt-in lists is not allowed.

Why is text marketing different?  There are three primary reasons.  First, unlike marketing emails, text messages aren’t free.  Consumers directly pay for text messaging services, regardless of whether it’s a flat monthly fee or a per-message charge. Consumers don’t directly pay to receive email marketing messages (the cost of Internet access is an indirect cost).  Second, text messages are viewed as more personal than other types of digital marketing, as they come right to a consumer’s mobile device and not to a device-independent email account. Third, text marketing messages are sent through already heavily-regulated cellular phone networks, and fall under many of the same stringent requirements that have been adapted or expanded to cover SMS – they’re considered on par with (and just as regulated as) a phone call. Keeping spam off the cellular phone networks has been a long-time focus of the FCC and mobile carriers.

Double Opt-InOne of the more misunderstood concepts in text marketing is the “double opt-in.”  Many believe that written consent from a consumer on a paper or web form is all that’s needed to send commercial text messages to that consumer.  However, remember that in text marketing, you need the unambiguous written consent of a mobile device owner before sending text marketing messages to that mobile device.  Don’t just focus on the consent being unambiguous – the consent must unambiguously be provided by the mobile device owner.

  • If you get written consent via an SMS text from a mobile device itself (a “device opt-in”), you have the written consent of the mobile device owner, and since it came from the mobile device itself it’s pretty clear, for consent purposes that the mobile device owner gave the consent.  (You still have to send a welcome email with certain information, such as message frequency and how to stop future text messages.)
  • However, if you get written consent through another method, such as a paper or web form (a “non-device opt-in”), it’s not clear that the person giving consent is the mobile device owner.   Even a statement on the paper or web form that “I own the device associated with this mobile number” is likely not sufficient – you can’t demonstrate conclusively that it’s true.  You don’t have unambiguous written consent unambiguously provided by the mobile device owner, and that’s where a second opt-in comes in.

The CTIA and MMA rules require that in addition to a non-device opt-in, a marketer must send a single text message to the mobile number provided through the non-device opt-in, asking the mobile device owner to text a response to start receiving marketing text messages for a campaign (e.g., “text ‘Y’).  If the mobile device owner sends the correct reply text (“Y”), he/she is confirming they want to receive marketing text messages (you still have to then send the welcome email noted above).  This confirmation – the “double opt-in” – removes any ambiguity around who provided the original non-device opt-in, turning it into unambiguous written consent unambiguously provided by the mobile device owner. The double opt-in isn’t to confirm the initial consent is valid – it’s to unambiguously confirm that the mobile device owner was the one that gave the consent.  (It’s important to note that double opt-in is a recommended best practice for device opt-ins too.)

The laws, rules and requirements around text marketing can seem daunting, but the potential rewards and ROI from well-executed text marketing campaigns can be quite significant for businesses.  Many service providers provide turnkey text marketing solutions designed for compliance with the various rules and regulations around text marketing.  And partnering with a digital marketing attorney focused on helping you achieve your business objectives while managing legal risk can help ensure you are on the right path as you move through the thicket of text marketing.

Why do in-house lawyers get so “lawyerly” sometimes?

It’s no secret that lawyers have been stereotyped as evil, stuffy, lying, legalese-spouting, risk-averse ambulance chasers. As the joke goes, “what’s the difference between a lawyer and a catfish?  One’s a scum-sucking bottom dweller, the other’s a fish.”  William Shakespeare’s famous line in Henry VI, Part 2 – “the first thing we do, let’s kill all the lawyers,” found everywhere from t-shirts to Eagles song lyrics – is commonly referenced to bash lawyers. (It was actually meant in the play as praise for lawyers as guardians of justice and keepers of law and order.)

You have an in-house attorney whom you view as a valued business partner.  While having lunch together, you ask him about an employee issue on your team and ask him for a short email summarizing his thoughts.  It can be confusing and frustrating when an hour later he sends you an email laden with designations of “ATTORNEY/CLIENT COMMUNICATION – PRIVILEGED AND CONFIDENTIAL” copying the head of Human Resources; pronouncements of potentially dire consequences for the company if you move forward with firing the employee; requests that you obtain approval from someone higher in your reporting structure; confirmations of something you have already discussed with him in person and said you would do; and warnings about forwarding the email on to others.  What’s going on?  Why do in-house lawyers get so lawyerly sometimes?

First, remember who your in-house attorneys represent.  Their client is the company that employs them – not you, or your supervisor, or management, or the CEO, or the Board of Directors.  (If you have wondered why in-house attorneys can’t advise employees on personal matters such as tax issues, family law issues, real estate issues, and wills & trusts, that’s the reason.)  In most cases in-house counsel can provide legal advice to you about company matters as you are an employee (and representative) of its client, but only where the matters fall within the scope of your official duties. This is why attorneys sometimes remove people from an email thread when they need to provide potentially privileged advice. Unlike many other employees, in-house attorneys must have a valid license in order to practice their craft, and are bound by a detailed code of professional ethics, which includes protecting their clients and their interests.

When outside counsel (attorneys at law firms retained by companies) provide advice to a client, that advice is generally presumed to be legal advice. Legal advice from an attorney to a client is generally considered confidential, and protected from disclosure to third parties, by what’s known as the “attorney-client privilege.” A company has a right to private communications with its legal counsel, and can refuse to disclose attorney-client privileged communications.  Unlike outside counsel, in-house attorneys dispense business advice as well as legal advice, or in some cases just business advice.  Because of this, there is no presumption that advice provided by in-house attorneys to their client and its representatives (employees) is legal advice and therefore protected by the attorney-client privilege.  They have to clearly demonstrate that the advice they are providing is protected legal advice and not unprotected business advice if they hope to assert an attorney-client privilege in the communication.

Additionally, part of an in-house attorney’s central role within a company is risk management.  Whether explicit or implicit in a Legal department’s mission statement, part of their job is to facilitate the company’s business objectives while at the same time managing risk to within the company’s stated risk tolerance level.  As I explained in my Risk Management 101 blog entry, any risk management decision comes down to some combination of accepting, mitigating, shifting, or avoiding risk.  To ensure risk is properly managed, in-house attorneys strive to ensure that business decision-makers understand the pros and cons of a business decision before making a risk management decision.  Lawyers often perform a risk management analysis as part of providing legal advice – they identify the potential risks and benefits of a particular course of action (and provide a suggested or recommended course of action if asked or expected to do so), and identify the person or role who needs to make the risk management decision, so that decision-maker can make an informed risk management decision on what to do about the identified risks.

Protecting the attorney/client privilege and managing risk while facilitating business objectives are the two primary reasons why in-house lawyers get “lawyerly” at times – they are doing their job representing and protecting the company and its interests while driving business forward.  When an in-house attorney provides legal advice, he/she “puts on their legal hat” and may seek to preserve attorney-client privilege in the advice to prevent its disclosure in later litigation or other proceedings, which could hurt the client.  This is why legal advice from an in-house attorney is clearly marked as being attorney-client privileged, why attorneys limit the number of recipients on emails or memos containing potentially privileged advice, and why in-house attorneys sometimes state that the email or memo should not be forwarded without their permission. If an in-house attorney formally asks you to do something in an email or memo that you have already discussed with them, this too is to help preserve privilege by ensuring you are acting at the direction of or under the supervision of counsel.

With respect to the legal advice itself, the attorney’s email may seem like “doom and gloom” by pointing out the risks (as well as the benefits) of a course of action, but the role of in-house counsel is not to accentuate the positive and eliminate the negative – our job is to facilitating the company’s business objectives while managing risk.  A good attorney does not say “yes” or “no” to a particular course of action (unless it’s illegal of course), but instead points out all the material pros and cons, provides an opinion if asked, and then lets the appropriate decision-maker call the ball on what to do about the risk.  In-house attorneys strive to ensure that decision-makers are making informed business risk management decisions based on a solid analysis of the pros and cons, not a quick decision based only on the potential benefits of doing (or not doing) something.

The next time your in-house lawyer starts sounding more lawyerly than normal, there’s likely a good reason they’re doing it — so suppress that urge to follow Shakespeare’s suggestion.

Moving on up (North) – Bringing your App, Website or Product to Canada

“We want to start selling our [app/product/service] in Canada,” says your Digital business executive.  “Any legal problems we should know about?”   Selling an app, product or service in Canada can seem like an easy way for a US company to expand the market for, and revenues generated from, something developed for the US market.  However, there are a number of considerations to consider, both from a legal and business perspective.  Some of them include:

  • Localize for the Canadian Market. As an American, I imagine that Canadians can easily tell whether a product is one designed for the US market being offered in Canada, or is one designed for the Canadian market.  Apps, websites, and services should be localized for the Canada market.  Canadian English is different than US English, and localization something that should not be overlooked.  If there is address information collected or displayed through an app or corresponding website, they should support provinces, Canadian postal codes, etc.  Localization is more than just translation; the app, website or service should be reviewed (ideally by one or more Canadian employees) to identify any pages, language, or content that may need adjusting for a Canadian audience.
  • Bilingual Requirements. The official language of Quebec is French, and many other provinces recognize both English and French as official languages. Websites (and apps) in Quebec are required to be bilingual.  Even without that requirement, it’s a good idea for websites and apps to be bilingual in Canada given the significant number of French Canadian speakers in the country.  Consider translating your license/services agreement and policies into French.  If you make your agreements bilingual, consider using a “dual-column” format so the English and French versions appear next to each other.  Ensure any bilingual agreements contain a provision stating that the parties agree that controlling version of the agreement shall be in the English language.
  • Data PrivacyFrom a legal perspective, Canada has a much more stringent national data privacy law than the US does.  Under Canada’s national data privacy laws, affirmative consent is generally required by consumers for a company to process personal information from Canadian consumers. Many provinces have their own privacy laws for private entities and public bodies. In addition, certain provinces also have provincial data privacy laws that can impact US companies.  For example, British Columbia’s data privacy law governing public bodies prevents any public body in BC from using a cloud-based service that stores data outside of Canada. (This law dates to 2004 and was a backlash against US government access to data under the USA PATRIOT Act of 2001.)  While many BC entities, such as schools, have complained about this law, it’s still on the books in British Columbia.
  • Marketing Communications. In addition, sending commercial electronic messages can be trickier in Canada due to a more complex Canadian law called CASL (Canada’s Anti-Spam Law) that governs commercial electronic messages (not just emails).  We’d want to look at that to see if it had an impact.  For more information, see my earlier post on preparing for CASL compliance.
  • Branding and IP. Companies should look at their branding, trademarks, and other IP used in or in connection with their app, websites, and services.  US trademark registrations don’t help in Canada if someone else is already using an identical or similar brand name in Canada. Dropping your US-branded app into the Canadian market could result in a cease-and-desist letter, or a lawsuit brought in Canadian courts. Patent protection in the US are not enforceable in Canada; you’d need to file Canadian registrations to obtain similar protections.
  • Other Considerations. Other considerations include looking at whether there are any export requirements or restrictions on exporting your product to Canada; whether NAFTA (the North American Free Trade Agreement) comes into play if there are any physical goods being sent to Canada; and ensuring you are complying with any local, provincial, or national tax requirements that may apply.

Before moving on up north, business teams should consider performing a cost/benefit analysis of the potential ROI of entering the Canadian market, evaluating these and other factors, to determine if adapting an app, website and/or service to the Canadian market is a sound business decision.

Progressive Reduction, Progressive Disclosure and Legal Disclosures – Incompatible?

Progressive Disclosure and Progressive Reduction are two common user experience (UX) techniques in website and application design.  Both reduce the amount of information provided by default to a user, which can be very useful when you have a small amount of screen real estate available on a website or in an application or striving for a clean user interface.  Both are designed to favor selective content disclosure over mouse clicks (it takes more clicks to view all of the information, but many people may not need to see the additional information and therefore won’t need the clicks).

Progressive Disclosure stack ranks information, features and options by usage, and breaks the display of the information, features and options onto multiple screens so that only the most commonly used or popular items appear by default.  The intent of Progressive Disclosure is to simplify the user interface and avoid overwhelming a user with information, features and options on a single screen (which results in a bad user experience).  Common examples of Progressive Disclosure in apps and on websites are “Learn More” links and expandable/collapsible data elements that are collapsed by default but expandable by the user. An example of Progressive Disclosure in the legal context is a “layered” privacy policy with an initial summary and links to the longer, full privacy policy.

Progressive Reduction uses user profiles and other information or options to progressively reduce content elements based on time or usage.  As the user becomes more familiar with the website or app (or as more time passes), the design can be simplified and reduced, as the assumption is that the user will still understand what to do.  For example, suppose a website has a prominent “Change Your Preferences” button with an icon.  As a user becomes more familiar with that button, it can be reduced to a “Preferences” button with an icon, and then just the icon.  Another example is expandable/collapsible data elements that are expanded by default, where if the user collapses them the website or application will remember the user’s preference and collapse them by default thereafter.

The Federal Trade Commission and state Attorneys General expect websites and apps to have “clear and conspicuous” and “legible and understandable” legal disclosures to avoid deceptive trade practice claims.  Requiring a click to access important disclosures is neither clear nor conspicuous to a user.  Thus, the concepts of Progressive Disclosure and Progressive Reduction seem to conflict with proper legal disclosures.  So can they coexist?  The answer is yes, but not for (1) the critical elements of the initial disclosure, and (2) information you are legally obligated to present to the user.

An initial website legal disclosure (e.g., special terms regarding a product, automatic renewal terms, etc.) must be clear, conspicuous, legible and understandable, as the FTC and state AGs expect. Progressive Disclosure and Progressive Reduction should not be used for the initial disclosure, and should never be used to break apart a legal agreement such as click-through terms. (If space is a concern, an attorney should try to make the disclosure as concise as possible, or use a scroll box with a greyed-out checkbox for consent or greyed-out “continue” button until the consumer scrolls to the bottom of the scroll box.)  For legal policies posted on a website, using a layered approach is a common way to apply principles of Progressive Disclosure.

In some cases, there are supplemental references to or confirmations of the initial disclosure, such as in an order confirmation email, or online notices of a policy change previously communicated by email or postal mail.  The supplemental references to, or confirmations of, a website legal disclosure are generally used to remind the consumer what they have agreed to, which can help defend against a claim that the disclosure was not clearly or conspicuously provided.  In some circumstances, such as with auto-renewing subscriptions in California, the full initial disclosure must be provided in the supplemental disclosure.  However, where there is no legal requirement to do so, Progressive Disclosure can be applied to the supplemental disclosure as long as the terms initially displayed are the ones for which the consumer would most expect to be reminded, i.e., the most critical terms.

A strong partnership with the User Experience team is critical to ensuring that legal disclosures are properly presented in websites and apps.  Demonstrating an understanding of UX concepts, and how to strike the right balance with legal disclosure requirements, strengthens their view of counsel as a valued business partner and problem solver.

Make Your Unsubscribe Process Work For You

When a consumer wants to no longer receive marketing communications from your company, both US anti-spam law (CAN-SPAM) and Canada anti-spam law (CASL) require you to provide a simple, easy-to-use unsubscribe mechanism.  No one these days questions the importance of offering an unsubscribe link to recipients of commercial emails – failing to do so is one of the easier ways to get in trouble for noncompliance.  However, I’ve seen many companies make the process too easy or unclear.  Some use a one-click unsubscribe; others don’t provide a good experience for those seeking to change their marketing preferences.

Here are some simple guidelines on good hygiene for your unsubscribe process:

  • Consider using an unsubscribe/manage preferences page, not a one-click unsubscribe. One-click unsubscribe means that as soon as a consumer clicks unsubscribe, it’s done and that consumer marketing record is off-limits.  As an alternative, consider a landing page through which a consumer can choose from “layers” of unsubscribe options (e.g., unsubscribe from emails about Product X, unsubscribe from emails from Product Division Alpha, unsubscribe from all emails from Company), and/or manage their communication preferences.  A person may initially think they want to unsubscribe, but on arriving at the page may instead realize he/she only wants to change or update their communication preferences to still receive some (but not all) communications.  The complexity of the page should be driven by the available “layered” choices (if simple, use radio buttons; if complex, use separate sections for each choice with sub-options).  You must allow the page visitor to take a final action from that page – you cannot use more than a single page plus the original click for unsubscribe requests.  (You can include a link to a separate “manage preferences” page if preferred.)
  • Design unsubscribe functionality to the principles of Simplicity, Clarity, Choice and Experience. Make it easy (but not too easy) for a consumer to opt out – you cannot make page visitors jump through hoops, and cannot ask them for additional personal information (other than email address) in order to unsubscribe.  Ensure disclosures and the unsubscribe process are clear to the reasonable consumer.  Provide alternatives to opting out (changes to frequency, content, or receipt point).  Provide a good experience and ensure they leave on good terms.
  • Clarify that they’ll still receive transactional emails. Where a page visitor can select to unsubscribe from all marketing emails, if appropriate consider language clarifying that they are unsubscribing from receiving all promotional emails, and that they’ll still receive transactional and relationship emails such as order confirmations and shipping notifications.
  • Humanize the unsubscribe notice. Use the unsubscribe process to remind the page visitor that they are working with a company, not an automated computer system.  Include your company’s branding on the unsubscribe/manage preferences page(s).
  • Ask for feedback after confirming the unsubscribe or change in preferences. Lastly, consider asking for feedback about why they are unsubscribing or changing their preferences, AFTER you have confirmed the unsubscribe or preference change.  This data can provide useful metrics to your organization to help shape your email and omni-channel marketing strategy.

Be the King of your CASL Marketing Compliance

Marketing campaigns, including both print marketing (such as flyers) and electronic marketing (such as emails and paid search campaigns), are critical drivers of business. The United States and Canada are two of the many countries which have enacted laws attempting to balance the right of businesses to use electronic marketing with restrictions and requirements for sending certain forms of commercial electronic messaging to curb unsavory business practices. Marketing messages must comply with the US CAN-SPAM Act (for email messages sent to US recipients) and CASL (for commercial electronic messages sent to Canadian recipients). Otherwise, businesses may face fines, litigation, and/or distracting and costly government investigations. Applying CAN-SPAM processes to Canadian recipients is a dangerous approach, as CASL is considerably broader in scope than CAN-SPAM. This note provides an overview of some of the core differences between CAN-SPAM and CASL to help you start to understand the compliance requirements.

What are CAN-SPAM and CASL? CAN-SPAM (the Controlling the Assault of Non-Solicited Pornography And Marketing Act) is a US law with associated regulations enacted in 2003 regulating the sending of commercial email messages. CASL (“Canada’s Anti-Spam Law”) is a Canadian law regulating commercial electronic messages effective July 1, 2014.

What types of messaging are covered? CAN-SPAM and CASL both apply to marketing communications, but CASL has a broader scope. CAN-SPAM applies to email messages where the primary purpose is the commercial advertisement or promotion of a commercial product or service. Emails were the focus of online marketing practices in 2003 when CAN-SPAM was enacted, and it has not been expanded to cover other types of commercial electronic messages. CASL applies to any electronic message sent to an electronic address, where the intent is to encourage the recipient to participate in a commercial activity. Under CASL, these electronic messages are called “commercial electronic messages” or “CEMs”. Examples of CEMs are emails, videos, SMS/MMS messages, instant messages, software or system tray pop-up messages, and social media messages.

When can I send marketing communications under CAN-SPAM? You do not need prior consent to send a commercial email under CAN-SPAM. You can send an unsolicited commercial email under CAN-SPAM unless the recipient has told you he/she does not want to receive them. However, it is considered an industry best practice to use opt-in lists for marketing communications. One important exception is that you can’t send a commercial email to certain email addresses provided by wireless carriers (e.g., vtext.com or sprintpcs.com) without express consent to do so. A “transactional or relationship” message is excluded from CAN-SPAM requirements as long as it’s not primarily commercial in nature. Commercial email messages sent under CAN-SPAM must comply with certain requirements such as identification of the sender and initiator of the message (including physical postal address); no false, deceptive or misleading header information; identification of the message as an advertisement unless the recipient has opted in to receive it; and notice of the right to opt out, and a working unsubscribe mechanism (see the statute and implementing regulations for full requirements).

When can I send marketing communications under CASL? Under CASL, you can only send a marketing communication to a Canadian computer, email address, or network if you have express consent (or in some circumstances, implied consent) to send it, with very limited exceptions. The requirement for consent before sending the message is the most important difference between CASL and CAN-SPAM. A commercial electronic message sent in compliance with CASL must include identification of each sender (there can be more than one); each sender’s contact information; and a free unsubscribe mechanism (see the statute and implementing regulations for full requirements). There are some limited categories of CEMs excluded from all or some of CASL’s requirements (for example, quotes or estimates requested by a recipient are excepted from CASL’s consent requirements only, but still require compliance with CASL’s identification, contact information, and unsubscribe requirements). CASL also covers other topics such as installation of computer software.

Do I need consent to send a commercial electronic message? Under CAN-SPAM, you don’t need express or implied consent before sending a commercial message (but it is an industry best practice to only send marketing messages to opt-in recipients). Under CASL, you need express consent (or in limited circumstances, implied consent) first. When asking for express consent under CASL (e.g., on a web page visited by a Canadian resident), you must disclose (a) that the communication is from your company, including a mailing address and either phone number, email address or web address; (b) the purpose for which consent is being sought; and (c) a statement that the person can withdraw consent. Remember that under CASL you can’t send an email asking for consent (as that email would violate CASL). Consents should be obtained through other means, e.g., during the website checkout process, via checked boxes on paper forms, etc. There is an exception to the consent requirement providing an implied consent for business relationships existing as of July 1, 2014, but that only lasts for 3 years and you still need to comply with all other CASL requirements when sending messages under that implied consent.

What is the difference between express and implied consent? Express consent is clearly and unambiguously stated, where implied consent is inferred from behavior and situational circumstances. When you take an affirmative action to clearly and unambiguously give consent, such as checking a box or signing your name, you are providing express consent. If you don’t uncheck a box indicating you wish to receive marketing communications, or you give your business card to someone, your consent to receive marketing communications is inferred, and you have provided implied consent. (Only certain types of implied consent are acceptable under CASL – see the statute for specifics.) Under CAN-SPAM, there is implied consent to send an unsolicited message unless the recipient has opted out of receiving it.

What should I do if I cannot tell where a person is from when asking for the right to market to them?  If you believe your campaign is likely to include Canadian recipients (e.g., it includes some .ca addresses), consider whether to follow CASL’s requirements for the Canadian recipients in the campaign. If you use a form to collect email addresses which will be used to send commercial electronic messages, please consider whether to require consent, or to pop up a consent box if the email address is a .ca address. If the form is on a Canada-specific page, you should always obtain consent.

The effective date of CASL is almost here, so don’t delay any further if you haven’t been paying attention to whether your electronic marketing strategy in Canada is CASL compliant. Failure to properly CASL could put your business in check.

The Pain of Preference Payments

Bankruptcy is boon to debtors in trouble, and a pain for creditors of those debtors.  You provide goods or services to a company only to find that their receivable is noncollectable once that company enters bankruptcy, and if you’re lucky if you receive cents on the dollar on the amount owed.  However, preference payments can sting even worse.  This blog entry gives an overview of preference payments and the common defenses.

Section 547 of the Bankruptcy Code allows a bankruptcy trustee (or a debtor-in-possession under Chapter 11) to “recapture,” or invalidate, payments made by the debtor for the benefit of a creditor during the 90 day period prior to the date the bankruptcy petition was filed (the “preference period”), regardless of whether the debtor received anything in return for the payment.  This is called a “preference payment,” so named because one of the goals of bankruptcy is to promote equality of distribution of assets to similarly-situated creditors, and to prevent a debtor from paying off its preferred creditors before filing for bankruptcy leaving basically nothing for the other creditors. There are certain requirements for a preference payment, e.g., that the payment was for an “antecedent” debt (the payment to the creditor followed provision of the goods and services to the debtor), and that the payment was made when the debtor was insolvent (there is a presumption of insolvency during the 90-day preference period).

Once a bankruptcy is filed, the trustee will often look at payments made by the debtor during the preference period, and will send demand letters (or complaints) seeking repayment of the alleged preference payments from creditors. These are the letters and court actions that vex many companies.  In some cases, repaying the alleged preference payment is more economical to a company than fighting it out with the trustee, resulting in attorneys’ fees and distractions for internal personnel.  However, companies can, and often do, fight back against preference payment recapture demands.  The Bankruptcy Code includes a number of defenses to a trustee’s attempted recapture of preference payments.  The three most common of these are:

  • Ordinary Course of Business Defense.  Under Section 547(c)(2) of the Bankruptcy Code, if a payment was made in the “ordinary course of business,” the recipient of the payment can avoid the obligation to return the payment.  (The reasoning for this is that if a payment was made in the ordinary course, there’s nothing preferential about it.)  A payment was made in the “ordinary course of business” if the creditor can prove (it has the burden of proof here) that the alleged preference payment was made either (a) consistent with the parties general business practices, such as the parties’ course of dealing; amount, timing and circumstances of previous payments; and contractual terms (the “Subjective Test”), or (b) consistent with common industry practice (the “Objective Test”). If you don’t have a payment history, you may not be able to use this exception. A trustee will likely give greater credibility to contractual terms where there’s a long history between the parties.  If that doesn’t exist, look to the actual payment history, not just the contractual terms.  The more consistency you have in your accounts payable practices with your partners and suppliers and the less “one-off” exceptions you allow, and the farther back your history goes, the easier it will likely be for you to claim the ordinary course defense. Good record-keeping is essential here.  It’s unclear whether payments made pursuant to an installment plan would be considered made in the ordinary course of business.
  • Contemporaneous New Value Defense.  Under Section 547(c)(1), if a payment by the debtor is substantially contemporaneous with the provision of “new value” by the creditor, the party receiving that payment can avoid the obligation to return the payment.  If the payment is essentially offset by new value contemporaneously provided to the debtor, the debtor’s estate is unaffected and thus there just a payment (but not a preferential payment).  A good example of this is a purchase of goods by check or cash – if the debtor paid $1,000 by check and received $1,000 in office supplies on a one-off purchase, the contemporaneous new value of office supplies received by the debtor offsets the $1,000 payment to the creditor.  To assert this defense, you must demonstrate (1) that the parties intended for the exchange of payment for value to be contemporaneous; (2) that the exchange was in fact contemporaneous; and (3) that the exchange was for new value.  If you’re concerned that a vendor may be in financial trouble, one approach is to restructure payment terms to provide for contemporaneous exchanges to better enable you to assert this defense later on.
  • Subsequent New Value Defense.  Under Section 547(c)(4) of the Bankruptcy Code, if following receipt of a preference payment a company provides new value to the debtor in the form of subsequent goods or services during the preference period, the amount of that “new value” can offset the corresponding amount of a prior preference payment.   For example, if you receive a preference payment of $10,000 sixty days prior to bankruptcy, and provide new services valued at $6,000 thirty days prior to bankruptcy (for which you do not receive another payment prior to bankruptcy), the $10,000 preference payment is offset by the $6,000 in new value, leaving a remaining preference amount of $4,000.  Credit cannot be carried forward; if there is a new payment in any amount after new value is provided but before the bankruptcy filing date, the new value is extinguished for the purposes of this defense.  This defense primarily differs from the contemporaneous new value defense in that the new value is not contemporaneous with the alleged preference payment.

One other important defense to consider is that it’s only a preference payment if made in the preference period.  For any payments made close to the 90-day mark, it may be worth a careful review of when the payment was received. In a number of courts, a “date of delivery” rule is used when determining the date of a payment for preference purposes.  Also note that for insiders of the debtor, the preference period is 1 year.

Two closing thoughts.  The possibility of recapture of preference payments shouldn’t automatically preclude you from doing business with companies which may not be fully financially stable – it’s often better to have the money and have to potentially return it than to never have it at all.  Finally, there are a lot of additional nuances to dealing with preference payment claims and litigation – consider talking with bankruptcy counsel to ensure you know your rights and defenses.