Facebook: Not Just For Friends?

The Obama Administration is considering sending federal officers undercover on Facebook and other popular social networking sites. This effort raises a number of interesting questions, some legal, some not. For example, would the feds work with Facebook, or simply register, and silently patrol the social network looking for leads? If they went with the cooperative approach, just how much help could Facebook provide given its privacy policy and terms of use? Would it unlock the kingdom based upon an informal request, or would it require a subpoena or search warrant to comply? And, if the government decided to slip into the system without alerting Facebook, would it be required to follow Facebook's terms of use -- such as providing real names and contact information? What are the consequences if a person "tricks" someone into being their friend?

A confidential Department of Justice presentation obtained by the Electronic Frontier Foundation sheds some light on these issues, and also provides useful guidance in the crafting of privacy policies and terms of use by eCommerce companies, including those who provide social networks or online communities.

The presentation first shows that Facebook is "[o]ften cooperative with emergency requests." It is probably in the interest of most eCommerce companies to be cooperative in those situations, but it is likewise vital to ensure that your privacy policy makes clear the nature of such cooperation, and that you have some degree of internal controls in place to ensure that the emergency exception does not swallow the privacy rule. Vetting such requests with counsel can be an important protective measure to an appropriate balance of company interests.

In defending itself, Facebook explained: "We scrutinize every single law enforcement request; require a detailed description of why the request is being made; and if it is deemed appropriate, share only the minimum amount of information. We strive to respect the balance between law enforcement's need for information and the privacy rights of our users, and as a responsible company we adhere to the letter of the law." The presentation notes, in contrast, that Twitter only produces data "in response to legal process." Both approaches are sound.

The presentation also discusses the fact that supplying fake credentials (in violation of the terms of service) can result in civil and potentially criminal liability. CNET reports that at least one case has found no criminal liability from a breach of such terms of service, but the law, as CNET notes, remains unsettled. In the Drew case, the defendant allegedly created a deliberately false identity and pretended to be a sixteen-year old for the purpose of communicating with a minor, all "conscious violations" of the MySpace terms of service. In dismissing the criminal charges, the trial court concluded that the Computer Fraud and Abuse Act was unconstitutionally vague in connection with the argument that it criminalized intentional breaches of a website's terms of service. While it is helpful to know that the DOJ is mindful of the potential criminal implications of using false pretenses in connection with a social media account, the presentation also shows a degree of interest in such techniques that might be considered to be very disturbing by some.

Apart from whether fraudulent access to a community web site is a crime, the Drew case underscores the general importance of terms of service, and the additional degree of protection they can provide to users both in terms of criminal infiltration and unwarranted government intrusion. Clear terms that require accurate personal information in connection with all accounts help safeguard users from online predators and fraud, while also helping to ensure that law enforcement goes through appropriate channels (and not secretly) to obtain content from those sites. This is just another reminder to take those terms seriously and to treat them as more than simply boilerplate. As with privacy policies, periodic reviews are wise.

Thoughts from the NEMOA Spring Conference: Perils for Vendors from Affiliate Endorsements

Today was Day 3 of the New England Mail Order Association Spring Conference in Boston. It was a great conference with lots of opportunities for benchmarking and networking. A number of industry gurus were present, including George Michie from The Rimm-Kaufman Group, who gave a great talk on paid search issues that this lawyer found compelling.

Marty Eisenstein and I moderated a round table discussion on emerging online affiliate issues. There was quite a bit of interest in new FTC guidelines regarding testimonials and endorsements. These new guidelines have the potential to impact seriously a number of business practices that are quite common among reputable online merchants.

Imagine if you will the following scenario: Acme Direct Marketing is an online seller of skin cream. Acme enters into an agreement with a third party to create a revenue-sharing affiliate network for the purpose of generating traffic to Acme's website. Affiliates enroll through the third party--perhaps Google. Many affiliates, if not all, are anonymous as far as Acme is concerned. They are paid each month based upon the traffic that they drive to Acme's website. Traffic is measured by the third party, who bills Acme for traffic generated each month. I am guessing that this scenario sounds quite familiar to many online merchants--in fact almost all online merchants engage in some variation of this business practice.

Now assume that one such affiliate (or maybe several) includes content on its website for the purpose of attracting attention and referring traffic to the merchants for whom it is an affiliate. The material that it posts on its website is often not entirely accurate--after all, these folks know nothing about the cosmetics business, and even less about truth-in-advertising. Perhaps the affiliate takes some liberties with the supposed benefits of Acme's product.

Under new FTC guidelines, Acme is responsible for false or misleading statements made by its affiliates. Moreover, the affiliate is obligated to disclose that it receives remuneration in exchange for sending traffic to Acme's website.

In many instances, the system for managing far flung affiliate networks is simply not designed to permit monitoring of these affiliate sites. In addition, early indications in the marketplace show that third party affiliate programs are not eager to assume any of the legal risks associated with these new guidelines.

Under the circumstances, responsible merchants need to be thinking about techniques for monitoring affiliate networks, and for securing contractual assurances that the affiliates will comply with the new rules.