Supreme Court Denies Petitions for Cert of Amazon and Overstock

As we recently wrote, last spring New York State’s highest court, the Court of Appeals, issued a decision upholding the state’s Internet affiliate nexus law after a challenge made by Overstock.com and Amazon.com. The Court of Appeals found that the law, which creates a rebuttable presumption of nexus for out-of-state vendors who employ in-state affiliates, satisfies substantial nexus requirements and does not violate the Due Process clause.

In September, Overstock.com and Amazon.com sought review of the decision of the Court of Appeals by filing petitions for certiorari with the United States Supreme Court. After extensive briefing by the petitioners, the State of New York, and many amicus curiae, on December 2, the Supreme Court denied the petitions for cert. (See the cases’ status here and here.)

This ends the petitioner’s facial constitutional challenge to the New York affiliate nexus law as Overstock.com and Amazon.com have now exhausted their appellate options. The decision by the Supreme Court not to hear the case, however, does not mean that every state’s affiliate nexus law is valid and enforceable. For instance, the Illinois Supreme Court held in October that Illinois’s Internet affiliate nexus statute was preempted by the Federal Internet Tax Freedom Act. The Supreme Court’s decision Monday has no impact on the now unenforceable Illinois law.

California Ups the Ante On Privacy Policy Disclosures

For the past decade, California law has set the template for commercial website privacy policies.  With the passage of a new law, set to take effect January 1, 2014, the state has updated the disclosures required of any commercial website operator who collects personally identifiable information from California residents.

California’s Online Privacy Protection Act.   In 2003, California became the only state to require all websites that collect personal information (“PII”) from visitors – in this case, California residents – to post a privacy policy.   Until then, there was no generally applicable privacy policy requirement under either state or federal law, and, to this day, neither the other states nor the federal government have imposed such a requirement.  Federal privacy policy requirements have been limited to specific kinds of information (such as under Children’s Privacy Protection Act) or industries (under the Health Insurance Portability and Accountability Act).  Under the 2003 law, Internet sites need to identify the “categories” of personally identifiable information collected about “individual consumers”; describe the “categories” of third parties with whom the information may be shared; disclose (if there is one) any process for individuals to review or request changes to their personal information; explain how notice is given to consumers of changes in the privacy policy; and post the policy’s effective date. The definition of PII is more expansive than encountered in data breach statutes, and includes email addresses, partial addresses (including street names and towns), and first and last names.  The privacy policy also must be “conspicuously” posted, as defined by the statute.

Now, however, the law has been significantly expanded.

Despite Prior Veto, Missouri Governor Signs Click-Through Internet Affiliate Nexus Provision into Law

As we reported last month, on June 5, Missouri Governor Jay Nixon vetoed a bill that included an Internet affiliate nexus provision. What a difference a month makes. On July 5, Governor Nixon signed a different bill, S.B. 23, that amends Missouri’s definition of “engages in business activities in this state” under Mo. Stat. § 144.605(2) to add a presumption of nexus for retailers with “click-through” online advertising agreements with residents of the state. Under the Missouri statute, “a vendor shall be presumed to engage in business activities within this state if the vendor enters in an agreement with one or more residents of this state under which the resident, for a commission or other consideration, directly or indirectly refers potential customers” to the vendor by an Internet link or otherwise, so long as the vendor realizes at least $10,000 in sales from such referrals. The presumption may be rebutted by submitting proof that the affiliates were not engaged in activities that were significantly associated with the retailer’s ability to make or maintain a market for sales in the state. In particular, such proof may consist of “sworn written statements from all of the residents with whom the vendor has an agreement stating that they did not engage in any solicitation in the state on behalf of the vendor during the preceding year.” See Mo. Stat. 144.605(e), (f).

The Missouri statute continues a disturbing trend among state “click-through” Internet affiliate nexus laws under which a presumption of nexus is created regardless of whether the compensation paid to the in-state affiliate is based on sales completed by the retailer. Statutes recently enacted in Kansas, Maine, and Minnesota contain similar language, as do statutes already on the books in Arkansas, North Carolina, Rhode Island, and Vermont (although Vermont’s statute is not yet in effect). By the plain terms of such statutes, a passive “pay-per-click” advertising arrangement would be sufficient to create a presumption of nexus. Such a presumption is inconsistent with the reasoning of the New York Court of Appeals’ decision upholding the New York affiliate nexus law. See Overstock.com, Inc. v. Department of Taxation and Finance, 20 N.Y.3d 586 (2013). In Overstock, the Court emphasized that “no one disputes that a substantial nexus would be lacking if [in-state] residents were merely engaged to post passive advertisements on their websites.” 20 N.Y.3d at 596. These several states’ affiliate nexus statutes are at odds, on their face, with this fundamental principle.

Washington Court Rules On Statutory Exclusion For Internet Service, Awards Refund To Online Services Provider

On June 4, 2013, the Washington Superior Court issued a decision that AOL, Inc. is entitled to a multi–million dollar refund of sales tax paid on services that AOL purchased for use in providing Internet access and online services to its members during the period 2002-2006. In response to an appeal by the Washington Department of Revenue from a decision of the Washington Board of Tax Appeal rendered in AOL’s favor, the Superior Court agreed with the arguments made by AOL. The company asserted the services at issue were “internet services” under RCW 82.04.297(3), and thus excluded from the statutory definition of taxable “network telephone service” under RCW 82.04.065(2) in effect during the time period in question. The Washington Department of Revenue had argued that the services AOL purchased were nothing more than transmission services, subject to Washington sales tax. The Court rejected the Department’s arguments, finding that AOL met each and every independent subpart of the exclusion for internet services. Consequently, the Court held that the services were not subject to taxation under the applicable state statute. As a result, the Court concluded that the Board properly awarded AOL a full refund of all amounts paid to the Department.

AOL was represented in the case by Martin Eisenstein and Matt Schaefer of Brann & Isaacson.

Congressional Privacy Caucus Begins Inquiry into Data Brokers

The Bipartisan Congressional Privacy Caucus, chaired by Representatives Ed Markey (D-Mass.) and Joe Barton (R-Texas), announced this week that they are launching an inquiry into data brokers.  Members of the caucus sent letters to nine data brokers – Acxiom, Epsilon (Alliance Data Systems), Equifax, Experian, Harte-Hanks, Intelius, Fair Isaac, Merkle, and Meredith Corp.  – requesting that they provide information about their practices. 

The Caucus’s letters request information including:

• The names of entities that have provided consumer information to the data broker;
• The data items collected from or about consumers and the methods by which the data was collected;
• Products or services offered to third parties that utilize consumer data;
• The information consumers are given access to, if it is requested, and any policies around sharing or deletion of that data; and
• Encryption or other safety protocols used to protect data.

The data brokers were asked to respond within three weeks. 

New Hampshire Does Not Tax Internet Access

Reaffirming its state’s anti-tax DNA, the New Hampshire legislature confirmed what some state tax practitioners have been arguing all along: the New Hampshire communications services tax does not apply to Internet access charges. (New Hampshire does not have a sales tax.) On June 21, 2012, the Legislature enacted a statute, 2011 NH 1418, that bars imposition of the communications services tax on “Internet access” charges. The statute also prohibits the New Hampshire Department of Revenue from enforcing any existing assessments of communications services tax on charges for Internet access and requires the prompt withdrawal of any pending assessments. Even though the effective date of the legislation is the date of its enactment, June 21, 2012, the law prohibits the Department from issuing any “additional” assessments with respect to Internet access charges. The statute does not limit the prohibition to Internet access services provided after June 21, 2012, so a fair reading of the statute is that any future assessments for Internet access charges, regardless of when the services were provided, are precluded.

The new law defines the term Internet access in the same way as that term is defined in Section 1105(5) of the Internet Tax Freedom Act (“ITFA”), codified as a note to 47 U.S.C. § 151. The law should apply not only to services provided by Internet Service Providers (“ISPs”) but to services purchased by such ISPs in order to provide Internet access.

Prior to the June 21, 2012 legislation, the New Hampshire Department of Revenue had taken the position that the Communications Services Tax applied to Internet access charges, and that such tax was not prohibited by the ITFA. See New Hampshire Department Technical Information Release, TIR 2008-006, September 15, 2008. In that TIR, the Department took the position that it is grandfathered under the ITFA.

Court Rules that the Illinois Internet Affiliate Nexus Law is Unconstitutional and Violates the Internet Tax Freedom Act

Yesterday (April 25, 2012), Judge Robert Lopez Cepero of the Illinois Circuit Court for Cook County granted summary judgment in favor of the Performance Marketing Association (“PMA”) in its constitutional challenge to the Illinois "Internet affiliate nexus" statute, Public Act 96-1544 (the “Act”), which took effect in July 2011. Judge Cepero ruled from the bench, after oral argument by the parties’ counsel, that the Illinois law is both unconstitutional under the “substantial nexus” requirement of the Commerce Clause and violates the federal Internet Tax Freedom Act's moratorium against discriminatory state taxes on electronic commerce. The Court will enter a formal order encapsulating its rulings, although Judge Cepero indicated that he does not plan to issue a written opinion, separate from his remarks made on the record at the hearing. The Defendant, the Director of the Illinois Department of Revenue, is said to be reviewing his options, but is expected to appeal the ruling directly to the Illinois Supreme Court. (George Isaacson and Matt Schaefer of Brann & Isaacson represent the PMA in the case.)


Like other “Internet affiliate nexus” laws, the Illinois statute seeks to impose a use tax collection obligation upon out-of-state Internet retailers who enter into contracts with affiliates located in the state, under which the affiliate places a link on its website connecting Internet users to the retailer’s website, and receives commissions or other compensation based on sales made to such customers. Under the terms of the Act, any Internet retailer that realized $10,000 in annual sales from customers who reached its website through links on the sites of Illinois Internet affiliates would be required to collect Illinois use tax. The Court held, however, that the activity described in the Illinois law was not sufficient to create use tax nexus with Illinois for purposes of the Commerce Clause. The Court also held that imposing a use tax collection obligation upon Internet retailers engaged in such online linking relationships, but not on other retailers engaged in similar offline adverting arrangements, is “premature” in light of the ITFA's moratorium, which remains in effect until November 1, 2014.

Are You Minding The Store? Executives Held Personally Liable For Unreported Sales Tax

Two recent decisions provide an important reminder for executives and tax managers of Internet retailers and remote sellers: Make sure that you: (1) understand your company’s sales and use tax obligations; (2) have a defensible position on state tax issues; and (3) pay attention to notices from state revenue departments, including those that come from outside your home state ― or you could find yourself subject to personal liability for unreported sales and use tax.

Most states’ tax laws deem sales/use taxes collected by a company to be held in trust for the state, and allow the state to impose personal liability upon responsible corporate officers for the failure to report and remit such “trust fund” taxes. Some state statutes go farther and impose liability on corporate officers for unreported tax.

In a New York State Tax Tribunal Decision (DTA No. 822971) issued on February 23, 2012, the CEO of a publicly-traded, online vendor of wireless phone devices and accessories was determined to be personally liable for unpaid sales tax, largely with respect to shipping and handling fees charged by his company on sales to consumers. The CEO argued that he could not be held personally liable because, among other things: (1) the company had a tax department that handled such matters, on which he relied, and that reported to the company’s CFO; (2) the company further relied upon outside accountants and auditors to ensure tax compliance; (3) the size of the company and number of transactions involved made monitoring them impossible for the company’s chief executive; and (4) the CEO did not sign the company’s sale tax returns. The Tax Tribunal rejected all of the CEO’s arguments, holding that he was a responsible officer with the power to exercise oversight over all functions related to sales tax compliance, and could not avoid liability by arguing that he relied upon others – even a full tax department and outside tax professionals – to ensure the company’s compliance.

In Eberhardt v. Michigan Department of Treasury, Michigan Court of Appeals No. 299532 (March 8, 2012), the Court upheld the imposition of personal liability against the sole shareholder and responsible corporate officer of an Indiana retailer of spas and related supplies, for unreported tax on sales to Michigan residents. The Department had previously issued an assessment for unpaid sales/use tax to company, which failed to respond. The Department subsequently assessed the shareholder for the amounts not paid by the company on the theory that he was personally liable as a responsible corporate officer. The appellant responded by arguing that the State of Michigan lacked jurisdiction to issue the earlier assessment to the company. The Michigan Tax Tribunal upheld the assessment, and the Court of Appeals affirmed. The Court found that the corporate officer was barred by the company’s failure to respond to the original sales tax assessment to raise the issue of lack of jurisdiction over the company as a defense. The Court therefore affirmed the imposition of liability of over $225,000 against the appellant.

These recent decisions should be a wake-up call for all corporate officers and tax managers – whether they work in a sole proprietorship, small private company, or even in a large, publicly traded company – to be certain that the they are confident the company’s state sales/use tax affairs are being handled appropriately, and tax counsel consulted where they have meaningful doubt or uncertainty regarding the company’s compliance. Failure to exercise proper oversight responsibility could mean the company’s tax liabilities become their own.

Illinois Governor Signs "Amazon" Affiliate Nexus Law

On March 10, Illinois Governor Pat Quinn signed into law HB 3659, the affiliate nexus bill passed by the legislature in January. Quinn's signing makes Illinois the fourth state (along with New York, Rhode Island, and North Carolina) to enact such a law. The Illinois bill provides that once an out-of-state Internet retailer realizes $10,000 in receipts from sales made to customers linked to the retailer's website from the websites of its Illinois affiliates, the retailer will be deemed to be a “retailer having or maintaining a place of business in this State” and be obligated to collect and remit tax on all of its sales to Illinois consumers.

In response, Amazon.com promptly informed its Illinois affiliates that it is terminating its relationships with them. Look for further developments in the coming days.

Is a Privacy Battle Brewing? The Department of Commerce Pushes Back On Commercial Privacy Regulation

In an unusual move, the Department of Commerce has chimed in on the question of Internet data privacy, issuing a 78-page report from its Internet Policy Task Force.  While the Chairman of the FTC has welcomed the new report, the business-oriented tone of the Commerce report suggests that a battle is brewing.  Indeed, the report offers strong support for a “voluntary, multi-stakeholder process” that includes businesses as important, cooperative partners, while the FTC treats voluntary efforts by industry -- and industry itself -- almost contemptuously.  While Commerce defers to the FTC as the primary enforcement authority, it also stages what appears to be a power grab to take a leadership role in defining how industry will or will not be regulated in the areas of privacy and information security.

Do As I Say, Not As I Do: The FTC "Do Not Track" Initiative Could Cripple E-Commerce

Just as governments – including our own – are pursuing aggressive new initiatives to gather information about our individual browsing habits and electronic communications for law enforcement purposes, the FTC has decided to advise Congress on sweeping initiatives to prevent direct marketers from engaging in far less invasive practices that present none of the grave risks attendant to enhanced government surveillance.  Indeed, many of the commercial practices targeted by the FTC actually benefit consumers by assisting Internet sellers to configure their web sites, adjust their product offerings, and tailor advertising to the specific needs and interests of consumers.  While the FTC shrilly intones that consumer information about Internet browsing has been used by an unidentified "some" in "an irresponsible or even reckless manner," it fails to acknowledge forthrightly that the vast majority of direct marketers use such information solely to better serve their customers, and that new laws and FTC initiatives are unlikely to faze the tiny group of Internet pirates who misuse consumer data.

Although most headlines have focused on the FTC's proposal for a "do not track" list, the FTC report is about much more than that.  It foretells a highly aggressive new regulatory strategy that may change the landscape of Internet privacy without any concern for the cost impact on industry or a realistic assessment of the privacy interests of consumers.  It sweeps so broadly against business as to suggest that–if the FTC has its way–even entirely benign and non-intrusive information collection practices that do not track individual consumers will be sharply curtailed.  At the same time, new and intrusive requirements will be injected multiple times into virtually every consumer experience on the Web.  If you do business on the Internet, you need to know what the FTC is hoping to unleash on eCommerce.

The Conservative Approach of Over-Collection of Sales Tax Is Perilous

Many companies (and their advisors) believe there is no harm in “over-collecting” sales tax and, therefore, erring on the side of collection of tax in gray areas.  But that is a very risky course of action, as AT&T recently found out.

It seems that AT&T was collecting sales and use tax on Internet service it provided to customers.  It did so, despite the federal Internet Tax Freedom Act, 47 U.S.C. § 151 n. (1998), as extended and amended by the Internet Tax Nondiscrimination Act, P.L. 108-435 (2004) and the Internet Tax Freedom Act Amendments Act of 2007, P.L. 110-108 (2007), which prohibits states from imposing taxes on Internet access, with the exception of certain grandfathered states.  Even a company of the size of AT&T apparently got it wrong, since it continued to collect tax on Internet access in all states.  Its customers reacted, and commenced a class action law suit against AT&T.

AT&T recently settled the lawsuit with the class action plaintiffs at significant expense to AT&T.  See In re AT&T Mobility Wireless Data Services Sales Litigation, MDL No. 2147, Case No. 10 C 2278 (N.D. Ill. Aug.11, 2010).  While AT&T is not obligated to refund to the plaintiffs any amounts not refunded to AT&T by a state, it is required to seek such refunds.  If it obtains a refund, AT&T, of course, must distribute the amounts it receives to its customers, but it doesn’t have to dip into its own pocket to do so.

So, you say, what is the harm to AT&T?  As part of the settlement, AT&T is required to pay the cost of notice to each member of the class.  Given the size of the class, this likely will be a substantial cost.  In addition, AT&T must pay a contingency fee to the lawyers for the class action plaintiffs, which is generally based on the value of the settlement, and can be millions of dollars.  Thus, far from being an income neutral proposition for AT&T, AT&T’s decision to collect tax created a large expense to it.

The conclusion to be drawn is that retailers need to be very careful to make sure they get it right.  To simply err on the side of over-collection may prove to create substantial exposure.  Rather, the true amount due must be collected.  If a retailer gets in a bind by over-collecting, the state will not compensate the retailer for its additional expenses.