Media Law Hotline Question of the Week

 


ASYA CALIXTO
Prince Lobel Tye LLP

A trusted business advisor to editors and marketing staff regarding First Amendment and media law, contributes to the NENPA Media Law Hotline.
www.princelobel.com


New England Newspaper Media Law Hotline 888-428-7490

My paper is considering moving to a new system of storing subscriber information, and we think we should revise our privacy policy as part of this process. What should we be considering as we do so?


You should certainly update your privacy policy to reflect changes in how you collect, use, and store information about visitors to your website. The Federal Trade Commission’s latest enforcement actions serve as a reminder of the importance of being honest and transparent with your visitors. For example, the FTC reprimanded Snapchat for telling its users that messages sent through Snapchat would disappear forever several seconds after they were received, when in fact there were well-known and widely available methods for a recipient to capture and store the messages indefinitely. American Apparel also got into trouble for representing in its privacy policy that it was complying with a self-regulatory privacy program, when in fact its certification had lapsed. The lesson? Don’t make promises you can’t keep. Be realistic, and revisit your privacy policy to make sure that what you convey to visitors is consistent with your practices.

If it’s been a while since you last reviewed your policy, now is a particularly good time to do so. Recent changes to California's privacy laws (which affect all websites that collect information about California residents) and to the Children Online Privacy Protection Act require that you make specific changes to your policy. As you review its policy, here are a few things to keep in mind:

1. California is Setting the Trend.

California may seem remote to New England newspapers, but the changes in California privacy law are significant for a couple of reasons. First, the California Online Privacy Protection Act (CalOPPA, for short) applies to operators of websites and mobile apps that collect personal information about California residents, whether those operators are located within or outside of the state. A tourist from California, for example, is protected by California law if she accesses your website on her trip to New England. Second, California is ahead of the curve when it comes to privacy. The changes it has adopted are likely to surface in other states. The following are three significant changes in CalOPPA:

New Protections for Children. A new section of CalOPPA, titled “Privacy Rights for California Minors in the Digital World,” took effect January 1, 2015. Website operators must now allow minors to remove content they have posted to websites. This means that you should establish a procedure for removing comments or other user-generated content that is posted by a California minor. Your privacy policy should contain instructions for minors who wish to request that their posts are removed. Website operators are now also prohibited from marketing certain goods to minors, such as alcohol, tobacco, firearms, and ultraviolet tanning services.
Transparency about Do Not Track. Do Not Track is similar to the Do Not Call registry. It allows users to make a one-time choice to opt out of tracking of their online behavior. When a registered user accesses a website, the website is automatically notified via an HTTP header that the user is on the Do Not Track registry. Websites are not required to honor Do Not Track requests, but California law requires that websites at least disclose whether they do so. If you honor Do Not Track requests, your privacy policy should reflect this; if you don’t, your policy should state as much. A simple “We do not respond to Do Not Track” will do the trick.
Collection of Personal Information by Third Parties. California also requires site operators to let users know whether third parties are allowed to collect personal information about visitors to the site. As with the Do Not Track requirement, this rule requires disclosure, but does not impose an obligation on websites to restrict third parties from collecting information.

2. Minors Get Even More Special Treatment.

When it comes to children, CalOPPA is just the beginning. The Child Online Privacy Protection Act (COPPA, for short) has also seen some recent updates. COPPA governs websites that are directed to children under the age of 13. Even if you don’t intend to target that demographic, however, you must comply with COPPA if you know that your site (or one of your advertisers) is collecting personal information from children younger than 13. (Usually, the term “personal information” means biographical, financial, and location information. When it comes to children, however, it can also mean using a child’s IP address or mobile device ID over time to identify the child as a recurring visitor.) Noncompliance with COPPA can result in fines of up to $16,000.

Parental Notice & Consent. COPPA requires that, before collecting information from children, website operators notify parents directly of what information they intend to collect. This type of “just in time” notice, which can be done with a pop-up disclosure, is meant to provide critical information to parents at the time that the information is relevant, rather than requiring parents to rely on the privacy policy. Once notice is provided, parents must consent to the collection of information, for example by submitting a scanned version of a signed consent form.
Protection of Children’s Information. COPPA also requires that online service providers take steps to safeguard children’s information. Information about children should only be retained for as long as necessary, and security measures must be taken to protect against unauthorized access. Your privacy policy should reflect the steps you take to address these requirements.

The Media Law Hotline is a service offered free of charge to NENPA members in good standing, and is staffed by the media and intellectual property lawyers at the Boston law firm of Prince Lobel Tye LLP. You can reach the NENPA Hotline (operated by media lawyers at Prince Lobel Tye), at 1-888-428-7490 or by email at media@princelobel.com.

 

Media Law Q&A — NEXT QUESTION...

Media Law Hotline 888.428.7490

Promoting Growth and Excellence in New England Newspapers since 1950