Mail Order Merchandise Rule: Are Your Business Processes up to Snuff?

This is the first in a series of blog posts highlighting the major legal and regulatory issues that are specific to the multichannel merchant. The Mail Order Merchandise Rule, promulgated by the Federal Trade Commission, is intended to ensure that mail order customers actually receive the items that they order from catalog or online merchants. The Rule requires that when a seller advertises merchandise, it must have a reasonable basis for stating or implying that it can ship the merchandise within a certain time. If the business makes no shipment statement, it must have a reasonable basis for believing that it can ship within 30 days. That is why direct marketers sometimes call this the "30-day Rule." Surprisingly, though, many well-established mail order companies have only a loose grip on the operational steps necessary to comply with this rule.

It is usually the case in the highly competitive, technologically advanced environment of mail order and internet sales, that merchants are easily able to comply with the Rule by providing a stated shipment representation. If a website says the product will be shipped in two days, it almost always is, and often it is shipped even sooner. But when products are not timely shipped, things sometimes go a little sideways. The most common reason for failure to ship within the stated time frame is the lack of a product–the back order issue.

The rule provides that, if after taking the customer’s order, a seller learn that it cannot ship within the time stated, it must seek the customer’s consent to the delayed shipment. If it is the first such delay, and if the seller can provide a revised shipment date, it must notify the customer of his or her right to cancel the order; sellers are permitted to treat the client’s silence in response as an expression of assent.  But, if there is a second delay, or if the seller cannot provide a revised shipment date, then the seller MUST get the client to consent affirmatively to the continued delay. If a seller cannot obtain the customer’s consent to the delay – or if the customer refuses to consent -- the seller must, without being asked, promptly refund all the money the customer paid for the unshipped merchandise.

Indemnification Clauses Critical to Fighting Patent Trolls

Much has been written about the rise of lawsuits, and threatened lawsuits by so-called patent trolls, also known as “patent assertion entities” or “PAEs.” If your business has not yet been the target of a patent troll, you can count yourself among the fortunate few. The proliferation of these types of claims is so widespread that the Federal Trade Commission has actually instituted an investigation into the business practices of patent assertion entities. According to a White House Report issued on June 4, 2013, PAE lawsuits have jumped 250% since 2011, now accounting for 62% of all infringement cases. As many as 100,000 companies have been threatened by patent trolls just in the last 12 months. Often these cases are based on highly questionable interpretations of highly questionable patents, applying them to technology not imagined at the time that the patent was granted. Rather than bear the cost and risk associated with litigation, businesses faced with these claims often agree to pay license fees to the PAE, further feeding the cycle.

As with many threats to business, the most effective technique for dealing with these claims is to anticipate them during your procurement process. In many instances, a well-negotiated agreement with a vendor can provide you with protection against patent trolls in the form of an indemnification clause requiring the supplier of the product or service that gives rise to the patent claim to defend you. A well-drafted indemnification provision properly allocates risk to the party in the best position to understand and assess the risk of a claim. In addition, the supplier of the product or technology actually has an economic incentive to do battle with a patent troll that its individual customer may lack. Intellectual property indemnification provisions accordingly are a critical component of any agreement.

The Summer of Privacy: With the Government Under Fire, Retailers May Overlook New Rules and Risks

This may one day be known as the Summer of Privacy. From claims that the NSA surreptitiously obtains cellphone (and GPS) information from at least 100,000,000 Americans to the Supreme Court blessing routine collection of DNA evidence from arrestees, it is impossible to avoid almost daily stories on governmental privacy issues. But, don't be fooled by the focus on governmental activity. From advances on the "do not track" front to a vastly expanded federal children's privacy rule going into effect on July 1, 2013, the privacy temperature is rising not just for the government, but for online and multichannel retailers as well.

FTC Report outlines Consumer Privacy Framework, urges self-regulation

Following on the heels of the White House’s “Consumer Privacy Bill of Rights,” (recently discussed in this space), the Federal Trade Commission released its own final report on Consumer Privacy last month: “Protecting Consumer Privacy in an Era of Rapid Change, Recommendations for Businesses and Policymakers.” The issue of consumer privacy online continues to receive sustained attention from privacy advocates, policymakers and journalists (see, for example, the Wall Street Journal’s “What they Know” series), and this latest policy paper highlights a number of important areas for retailers.

Obama Administration Releases Consumer Privacy Bill of Rights

In April 2011, Senators Kerry and McCain introduced a bill entitled the “Commercial Privacy Bill of Rights." As discussed in this space, the bill would have required online collectors of information to permit individuals to opt out of the collection of information about browsing and shopping activities and required affirmative consent (opt-in) for the collection of sensitive personally identifiable information, including email addresses. The bill’s introduction was met with significant hand-wringing by the online business community about the impact that it might have on the business practices of even the most reputable electronic merchants. The bill was referred to committee, and little has been heard about it since.

But the issue has not gone away. Apple, Google, Facebook, Path, UPromise, and others have all suffered embarrassing public relations setbacks as a result of the exposure of certain of their practices relating to the collection and use of user information.

In the meantime, the Obama Administration has shifted its focus to a (mostly) non-legislative solution to the perceived need for more robust protection of consumers’ online privacy. On February 23, 2012, the Obama administration published A Consumer Privacy Bill of Rights The Consumer Privacy Bill of Rights provides for industry self-regulation coupled with the prospect of government enforcement in the event that industry fails to do the things that it claims it will do. It would apply to “personal data,” broadly defined as any data that can be linked back to an individual.

Commercial Privacy Bill of Rights Introduced in Congress

The introduction of the so-called Commercial Privacy Bill of Rights by Senators Kerry and McCain on April 12, 2011 suggests that we may be about to enter an era of robust regulation of information gathering regarding the online browsing and shopping habits of consumers. This type of data has come to be an important tool for online marketers to improve the efficiency of online advertising buys, and to improve other marketing techniques. At a minimum, this development presents a risk that online merchants will need to build out substantial new technical infrastructure to accommodate a welter of new rules under this bill. Beyond that, it may make it difficult even for highly respected and responsible merchants to engage in marketing activities that are an important part of their tool kit in the information age.

Among other things, the bill contains the following requirements:

• Collectors of information must implement security measures to protect the information they collect and maintain.

• Collectors of information must provide clear notice to individuals of the collection practices and the purposes of such collection. Additionally, collectors must provide the ability for an individual to opt out of any information collection that is unauthorized by the Act and to provide affirmative consent (opt-in) for the collection of sensitive personally identifiable information. Respecting companies’ existing relationships with customers and the ability to develop a relationship with a potential customers, the bill would require "robust and clear" notice to an individual of his or her ability to opt-out of the collection of information for the purpose of transferring it to third parties for behavioral advertising. It would also require collectors to provide individuals either the ability to access and correct their information, or to request cessation of its use and distribution.

• Collectors must bind third parties by contract to ensure that any individual information transferred to the third party by the collector will only be used or maintained in accordance with the bill’s requirements. The bill requires the collector to attempt to establish and maintain reasonable procedures to ensure that information is accurate.

Is a Privacy Battle Brewing? The Department of Commerce Pushes Back On Commercial Privacy Regulation

In an unusual move, the Department of Commerce has chimed in on the question of Internet data privacy, issuing a 78-page report from its Internet Policy Task Force.  While the Chairman of the FTC has welcomed the new report, the business-oriented tone of the Commerce report suggests that a battle is brewing.  Indeed, the report offers strong support for a “voluntary, multi-stakeholder process” that includes businesses as important, cooperative partners, while the FTC treats voluntary efforts by industry -- and industry itself -- almost contemptuously.  While Commerce defers to the FTC as the primary enforcement authority, it also stages what appears to be a power grab to take a leadership role in defining how industry will or will not be regulated in the areas of privacy and information security.

Do As I Say, Not As I Do: The FTC "Do Not Track" Initiative Could Cripple E-Commerce

Just as governments – including our own – are pursuing aggressive new initiatives to gather information about our individual browsing habits and electronic communications for law enforcement purposes, the FTC has decided to advise Congress on sweeping initiatives to prevent direct marketers from engaging in far less invasive practices that present none of the grave risks attendant to enhanced government surveillance.  Indeed, many of the commercial practices targeted by the FTC actually benefit consumers by assisting Internet sellers to configure their web sites, adjust their product offerings, and tailor advertising to the specific needs and interests of consumers.  While the FTC shrilly intones that consumer information about Internet browsing has been used by an unidentified "some" in "an irresponsible or even reckless manner," it fails to acknowledge forthrightly that the vast majority of direct marketers use such information solely to better serve their customers, and that new laws and FTC initiatives are unlikely to faze the tiny group of Internet pirates who misuse consumer data.

Although most headlines have focused on the FTC's proposal for a "do not track" list, the FTC report is about much more than that.  It foretells a highly aggressive new regulatory strategy that may change the landscape of Internet privacy without any concern for the cost impact on industry or a realistic assessment of the privacy interests of consumers.  It sweeps so broadly against business as to suggest that–if the FTC has its way–even entirely benign and non-intrusive information collection practices that do not track individual consumers will be sharply curtailed.  At the same time, new and intrusive requirements will be injected multiple times into virtually every consumer experience on the Web.  If you do business on the Internet, you need to know what the FTC is hoping to unleash on eCommerce.

The "Draft" Federal Privacy Bill: Uniformity, But at What Cost?

On May 3, 2010, Representatives Rick Boucher, Democrat of Virginia, and Cliff Stearns, Republican of Florida introduced a “discussion draft” of a bill “[t]o require notice to and consent of an individual prior to the collection and disclosure of certain personal information relating to that individual.”  The bill seeks to provide uniform, national regulation of information collection and disclosure practices for a wide range of companies--governing not only the Internet, but all other channels of interaction between businesses and consumers--and it has already generated controversy.  Not only does it include a definition of private information that goes far beyond all existing laws, it contains strict notice and consent provisions that may be difficult and costly to implement.  It is unclear what triggered the drafting of the bill, nor what compelling public interest would warrant such a degree of intrusion into private business practices.

It is important to keep the draft bill in perspective.  Numerous privacy and security bills have been proposed over the years and Congress has, to date, been unable to pass anything coming close to comprehensive national legislation.  For example, repeated attempts to pass federal security breach legislation have failed, resulting in a plethora of state laws which are both confusing and inconsistent.  If Congress can't bring itself to pass uniform rules dealing with the very real issue of security breaches involving the theft or loss of sensitive personal information, the likelihood of it passing a comprehensive law governing the collection and use of personal information -- a far less serious matter -- seems limited, at best.

Nevertheless, it remains useful to examine the bill and how it addresses key issues that affect eCommerce companies.  Even if the bill fails to gather support in Congress, individual states may feel inspired to adopt some of its provisions.

Should You Be FACTA Compliant? -- June 1, 2010 Deadline for Compliance with the FTC’s Red Flags Rule Approaches

Under the Fair and Accurate Credit Transactions Act (“FACTA”), Congress in 2003 mandated that businesses which extend credit to consumers for personal, family or household purposes must adopt policies and procedures designed to identify instances of possible “identity theft” in connection with transactions/requesting such credit.  The regulations promulgated by the Federal Trade Commission (“FTC”) implementing FACTA’s provisions are referred to as the “Red Flags Rule,” because the procedures adopted by businesses are supposed to identify “red flags” that signal a risk of identity theft in connection with a consumer credit transaction.  After deferring the effective date of the Red Flags Rule four times, the deadline for affected businesses to comply is now June 1, 2010.

On its face, FACTA would not appear to apply to many direct marketers or Internet sellers, who most often do not extend credit, themselves, but instead rely on credit cards.  The requirements of FACTA, however, extend to those retailers that sell products or services on installment plans or otherwise extend credit to consumers.  In addition, retailers that offer private label or co-brand credit cards (i.e. the retailer’s name appears on the credit card) may also be affected, even if they do not act as the issuer of the card.  This is because the FTC’s Red Flags Rule also applies to service providers and others who assist creditors (the card issuer) in receiving or processing requests for credit.  Furthermore, FTC staff has indicated their intent to apply the Red Flags Rule very broadly, so that the rule may be applied even to transactions involving the extension of credit to sole proprietorships, on the theory that such transactions involve a risk of identity theft for the individual operating such a business.

What’s Next For Sales Tax (a/k/a Use Tax) On Direct Mail?

Direct marketers know that successful eCommerce strategies often depend upon reaching customers offline as well as online. Direct mail, including the distribution of catalogs, remains one of the most effective ways of driving traffic to a website. Indeed, given the reluctance of some consumers to give out their e-mail addresses, and the protections afforded consumers from unwanted solicitation under anti-SPAM, Do-Not-Call and other consumer privacy laws, traditional “snail mail” marketing techniques remain an important way for Internet sellers to communicate directly with customers.

Although several larger states (including California, New York, and Pennsylvania) provide exemptions from tax for certain types of direct mail, the vast majority of jurisdictions treat direct mail as taxable. And in all states, including those that provide exemptions, there are myriad other complex legal issues affecting taxability, including sourcing rules, taxability of postage, “direct mail” certificates, and nexus considerations, each of which make determining the proper sales tax treatment of direct mail transactions challenging. Add the fact that mailings go to recipients in many, if not all 50 states (and countless localities), each of which has its own tax law, and the difficulty of properly applying tax to any particular direct mail transaction multiplies exponentially.

Think You’re Safe Storing or Releasing “Anonymized” Data? Think Again.

Anonymity is increasingly difficult to safeguard, and direct marketers that collect, maintain, share, and use customer information should take note of a recent class action settlement by Netflix than stemmed from the company's disclosure of an "anonymized" customer database.

Most federal and state privacy and data security statutes focus on the protection of "personally identifiable information," such as names, addresses, telephone numbers, financial account numbers, social security numbers, and email addresses. In response to such laws, many companies strip personally identifiable information from databases containing sensitive information. Once stripped of identifiers, the theory goes, the risks of identity theft or violations of consumer privacy rights resulting from disclosure of the data (whether purposeful or not) are eliminated. Some companies may even conclude that the data may be shared for marketing or "data mining" purposes without violating their privacy policies or applicable laws.

According to the Electronic Privacy Information Center, however, "computer scientists have revealed that this 'anonymized' data can easily be re-identified, such that the sensitive information may be linked back to an individual."

Thoughts from the NEMOA Spring Conference: Perils for Vendors from Affiliate Endorsements

Today was Day 3 of the New England Mail Order Association Spring Conference in Boston. It was a great conference with lots of opportunities for benchmarking and networking. A number of industry gurus were present, including George Michie from The Rimm-Kaufman Group, who gave a great talk on paid search issues that this lawyer found compelling.

Marty Eisenstein and I moderated a round table discussion on emerging online affiliate issues. There was quite a bit of interest in new FTC guidelines regarding testimonials and endorsements. These new guidelines have the potential to impact seriously a number of business practices that are quite common among reputable online merchants.

LifeLock: $12 Million to Settle Data Security False Advertising Claims

The company whose advertising campaign included displaying their CEO's social security number on the side of a truck has reached a settlement to pay $12 million to the FTC and 35 states who charged LifeLock, Inc. with false representations about the effectiveness of its services. In an official press release, FTC Chairman Jon Leibowitz said that “[w]hile LifeLock promised consumers complete protection against all types of identity theft, in truth, the protection it actually provided left enough holes that you could drive a truck through it.”

But the case against LifeLock didn't end there. The FTC and the states also charged LifeLock with making false claims about its own data security practices. According to the FTC, LifeLock failed to live up to the following representations: