The TMCA

For years now we’ve been blogging about how much the FTC and even the SEC on occasion love scrolling Instagram posts to see what influencer are up to. This post is about another three letter organization who likes to scroll to confirm advertiser and influencer compliance with the FTC’s now very well-known Endorsement Guides. If You Don't Know Now You Know - The National Advertising Division or the NAD was founded in 1971 as an independent self-regulatory, non-profit organization, whose mission it is to ensure adverting claims are truthful and accurate. The NAD is part of the BBB National Programs, an independent non-profit organization that oversees more than a dozen national industry self-regulation programs. Advertisers can bring challenges against one another and the NAD also initiates its own challenges.  Participation is voluntary (this is not a court of law) and there is no possibility for fines or damages, but the NAD is friends with the FTC and refers cases on occasion. With that introduction out of the way, we are here to update you on a recent case filed by the NAD itself against Skims, the underwear, lounge wear and shapewear brand. While this blog probably won’t make you look slimmer, this post might just give your brand’s influencer advertising a clearer and more conspicuous look . Like many brands, Skims hires celebrities to promote the brand on social media. The case focused on whether social media posts by Lana Del Ray and Brittany Mahomes adequately disclosed the financial relationship between the influencers and the brand. At the outset, the NAD noted that: The FTC’s Endorsement Guides state that when there exists a connection between the endorser and the seller of the advertised product that might materially affect the weight or credibility of the endorsement, and that connection is not reasonably expected by the audience, such connection must be disclosed clearly and conspicuously. With that in mind, the NAD reviewed Instagram posts by Lana Del Ray that show her wearing Skims products, which either mentioned the brand by name or tag @skims in the caption of the post. The Brittany Mahomes’s posts feature her and her family wearing Skims products, but no specific mention of the brand in the caption of the post and while she tagged the brand in the picture, she did not tag @skimms in the caption. The NAD found that neither influencer had complied with the FTC Endorsement Guides. In reference to Lana Del Ray’s posts with the tag, the NAD stressed that: The FTC has further made it clear that tagging a brand you are wearing in a social media post is an endorsement of the brand. However, tagging a brand does not constitute a sufficient material connection disclosure, as an influencer could be tagging a brand simply because they like it and want their followers to be able to find it. The FTC makes it clear that just like any other endorsement, a social media post tagging a brand may require a material connection disclosure if the influencer has a relationship with that brand. As for Brittany Mahomes, the NAD put itself in the shoes of a reasonable consumer and found that even though the photos show the celebrity and her family with hair and makeup done, they are not so highly stylized that a consumer would understand them to be a paid advertisement campaign on direct viewing. Disclosures are still necessary. So we’ve told you what the influencers did and did not do (and you can see above how Brittany Mahomes corrected her post), but what about Skims? For their part, Skims followed three key practices that all brands should follows: Skims contractually required its influencers to comply with the Enforcement Guides. Skims provided its influencers with instructions on how to comply – suggesting the use of #ad and/or #sponsored Skims monitored their influencers and in the case of Lana Del Ray, contacted her team when they saw that she was not providing adequate disclosures. None of the three letter organizations that spend time on social media expect your brand’s influencers to be perfect, but the brand is ultimately responsible for its influencers’ behavior and engaging in these three best practices will go a long way to clearer and more conspicuous disclosures.

Are you ready to begin adding AI Agents to your human teams? You will soon be getting requests to do so. While business teams will be wowed by what AI Agents and their subagents can do, the artificial intelligence regulatory environment is increasingly uncertain, and we advise caution. Within its first few days, the new administration revoked the 2023 Executive Order on Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence (the “Old AI Executive Order”) – which had been intended to mitigate risks associated with AI technologies by imposing safety guidelines such as a watermarking system for AI-generated content. Next, the president issued a new executive order Removing Barriers to American Leadership in Artificial Intelligence (the “New AI Executive Order”), providing White House staff 180 days to develop a plan “to sustain and enhance America’s global AI dominance in order to promote human flourishing, economic competitiveness, and national security.” Under the New AI Executive Order, federal agencies are required to immediately review and suspend, revise, or rescind any prior governance and safety measures undertaken to comply with the Old AI Executive Order that are not consistent with the New AI Executive Order. Meanwhile, on January 21, the president announced a new $500 billion private sector deal, “The Stargate Project,” which is a new joint venture that relies on SoftBank, OpenAI, Oracle, and MGX as initial equity funders in a bid to rapidly expand U.S. AI infrastructure by building massive new data centers, first in Texas then in other potential sites across the country. In the same week, leading big tech companies including Oracle and OpenAI each announced the next phase of the AI revolution with the release of new AI Agents designed to autonomously handle specific tasks and ultimately “join the workforce and materially change the output of companies.” What Are AI Agents? While traditional AI chatbots using large language models (“LLMs”) are designed to respond to users within the AI system, the latest generation of advanced AI Agents (aka AI Super-Agents or Agentic AI) are now empowered to interact with computer, network, and internet environments to automate tasks. Open AI states that its new AI Agent, Operator, “can be asked to handle a wide variety of repetitive browser tasks such as filling out forms, ordering groceries, and even creating memes.” Accordingly, Operator “can ‘see’ (through screenshots) and ‘interact’ (using all the actions a mouse and keyboard allow) with a browser, enabling it to take action on the web without requiring custom API integrations.” By combining the power of LLMs with new technologies such as the Oracle Cloud Infrastructure and retrieval-augmented generation, Oracle’s AI Agents can interact with enterprise data and can apparently be used by companies to recruit qualified job candidates, perform complex customer data analytics, optimize call centers, and expedite legal, financial, and academic research tasks. AI Agents can be trained or instructed to follow the values of a user or business. Whether that can be consistently implemented remains to be seen. In testing, some AI systems have been shown to engage in “scheming” where they change results or take unexpected actions toward an ultimate goal set by the user. Although the usefulness of these technologies is undeniable, companies looking to deploy AI Agents should be aware of the legal risks and pitfalls that may accompany the use of these revolutionary new tools. Legal Challenges and Mitigation Strategies AI Agency Liability. In July 2024, a California district court allowed a case against HR and finance platform Workday to proceed, stating that an employer’s use of Workday’s AI-powered HR-screening algorithm may create direct liability for both the employer and Workday under the theory of agency liability. In this hiring discrimination case, the plaintiff alleged that his prospective employer delegated “traditional hiring functions, including rejecting applicants, to the algorithmic decision-making tools provided by Workday.” The court found that by designing an AI technology to make decisions that would normally be made by a live employee, Workday should be treated as an agent of the employer for purposes of liability so long as the employer actually relied on the AI technology in its hiring process. While this case is still making its way through the courts, AI Agent vendors and deployers could subsequently be exposed to both civil and criminal liability based on the actions of the AI Agent, a theory that had previously only been applied by the courts to the actions of live humans. AI Product Liability. Given the increased responsibility and autonomy being granted to AI Agents, it is possible that developers and deployers of AI Agents could also be required to contend with product liability claims. Manufacturers and sellers can be held responsible for injuries caused by defective or unreasonably dangerous products. If an AI Agent makes a poor and costly decision, a plaintiff may claim that the AI Agent was defectively designed and/or that the developer failed to adequately warn the plaintiff of the AI Agent’s limitations. This theory of liability is currently being tested in cases against AI-chatbot platform Character.AI. In the fall of 2024, the mother of a deceased minor in Florida brought a product liability case against the developers of Character.AI – an AI-chatbot role-playing platform that allows users to create and converse with AI-powered characters – alleging that her son died by suicide after becoming harmfully dependent on his relationship with his Character.AI companion “Dany.” In December, parents in Texas brought additional product liability claims, stating that, without warning, Character.AI chatbots exposed their children to hypersexualized content, self-harm, and violent behaviors, with one chatbot allegedly encouraging a child to kill his parents when they tried to limit his screen time. AI Contractual Considerations. Businesses seeking to onboard AI Agents should implement clear contractual provisions to allocate and manage risk. When reviewing warranties, limitations of liability, and indemnification clauses, companies should want to know if and to what extent the AI Agent vendor will indemnify the company for an AI Agent’s decision making, especially if those decisions are illegal or cause harm to end-users or others. Businesses should also consider who is responsible for training employees to use AI Agents safely and whether that training relates to the AI provider’s contractual liability. In addition to requiring compliance with emerging state and international AI regulations such as the Colorado AI Act and the EU AI Act, companies should also carefully contemplate intellectual property (“IP”) and data ownership, rules for algorithmic training inputs, and customization of standard liability shifting terms. Whereas typical software-as-a-service contracts usually address ownership of software and/or underlying data, AI Agent vendor contracts should also address IP-ownership of AI-generated content such as images, text, and even new software. Regarding algorithmic training inputs, companies must decide whether the AI Agent’s algorithm can train on company data, and if so, how such company data must be protected and stored. In addition, businesses should be wary of AI Agents violating third party terms of service which may prohibit access and use by bots. In non-negotiated use of Agentic AI, such as when a company deploys an off-the-shelf AI Agent from one of the major providers, companies should similarly review the provisions outlined above and weigh the ultimate risk of deploying this novel technology. AI Privacy and Cybersecurity Considerations. Using an AI Agent may result in the processing of enormous amounts of personal information as defined by state, federal, and international data privacy laws. For example, AI Agents designed to read and prepare automated responses to emails may digest any personal information contained in a user’s inbox, while an AI Agent designed to make investment decisions will process sensitive financial information about the user. By collecting such large amounts of personal information, companies may grow their cybersecurity attack target, as bad actors are typically attracted to companies known to collect large amounts of detailed and/or sensitive personal information. Furthermore, by deploying an AI Agent, a company in scope for comprehensive state privacy laws, such as the California Consumer Privacy Act, may be required to offer consumers the opportunity to opt-out of the AI-Agent’s automated decision making, while also disclosing to its consumers how their personal information is collected and used by the AI Agent, including whether their personal information subsequently trains the AI Agent’s algorithm. AI Agents that are not adequately directed and supervised could also perpetrate scams, develop vulnerable software code, or cause cybersecurity incidents, so human supervision and real-time monitoring will be essential to reduce legal risk, especially with initial uses of AI Agents. With the launch of AI Agents, concerns about AI scheming have become immediate. Adding AI Agents to your teams may have serious, unintended consequences and should involve significant testing and implementation of controls prior to and during use. Businesses will soon be training AI Agents in their corporate values and adding AI Agents to their teams. The way we work will never be the same.

Our friendly neighbors in the Great White North are implementing important changes in 2025 with respect to language requirements for trademarks and a new pilot project initiated by the Canadian Intellectual Property Office (“CIPO”) to issue cancellation proceedings against trademark registrations based upon non-use. Language Requirements In connection with the Charter of the French Language, the Quebec government has published the final regulation for Bill 96, the details of the initial draft for which are discussed in our prior post. This final regulation, released on June 26, 2024, lightens the requirements with respect to trademark registration, gives more guidance with respect to definitions of wording, and maintains requirements for signs and sizing. The important takeaways are listed here: The earlier draft limited an exception for using a non-French trademark on products to allow only registered trademarks to appear on a product exclusively in a language other than French. This has now been expanded to include “recognized marks,” meaning registered or unregistered (common law) trademarks may appear on products without a French translation (so long as there is not a French version registered at the Canadian Intellectual Property Office). Clarification has been provided with respect to product descriptions and generic terms. The use of any generic term or product description included with a trademark must be translated into French and permanently displayed on product packaging or on the product itself. a “generic term” is the wording used to describe the nature of a product; a “product description” is the wording used to describe the characteristics of a product. A grace period had been identified to allow for the sale of non-compliant products made before June 1, 2025, to be sold until June 1, 2027. The grace period has been extended also to include products made between June 1, 2025, and December 31, 2025, that were impacted by new federal labeling standards (Food, Drug and Cannabis Regulations). With respect to public signs, posters, and commercial advertising, previously the draft regulation made an exception for only registered trademarks to be used in a language other than French on public signs, posters, and commercial advertising. The final regulation now includes an exception for “recognized marks,” which will allow for both registered and unregistered trademarks to appear on public signs, posters and commercial advertising exclusively in a language other than French. “Marked Predominance” of French on signs visible from the exterior of commercial premises remains in place. The French text on an exterior sign should be twice the size of text that appears in any language other than French. However, it must also have a greater visual impact than the text in another language. That requirement is met if the section of the sign for the French text is at least twice the size of the space for the text in another language, and the legibility and permanent visibility of the French text is equivalent to the text in another language. This amendment gives greater flexibility to business owners in the creation of their signage, based on total area in which the text appears rather than making the French text twice the size of the text in another language. (For dynamic signs, the impact of the French language is considered greater if it will be visible twice as long as any text appearing in another language.) There remains a reasonable period of time to come into compliance. These requirements should be taken seriously, as businesses operating in Quebec face penalties and daily penalties for ongoing offenses, which can be directed at both corporations and their directors individually. Cancellation of Trademark Registrations CIPO has introduced a new pilot project, which started this month (January 2025). On a monthly basis, the Registrar of Trademarks on its own initiative will issue cancellation proceedings for non-use against trademarks. The selection will be random and will only focus on registrations that have been on the register for more than three years. Owners of the trademark registrations will be required to submit evidence of use of their trademarks for each identified product and/or service. Alternatively, the owner of the trademark registration may submit an explanation for any non-use due to exceptional circumstances. If no evidence of use is accepted and there are no exceptional circumstances for non-use, the registration will be cancelled in whole or in part. We encourage those with Canadian trademark registrations to ensure their marks are in use in Canada and to track evidence of such use. Doing so will make the job of providing evidence at the request of CIPO a more manageable endeavor.

On October 16, 2024, the Federal Trade Commission (FTC) announced a revision to its negative option rule. The rule, formally entitled the “Rule Concerning Recurring Subscriptions and Other Negative Option Programs,” is a robust governmental intervention into the marketing and sales of products or services that involve “negative option features.” A “negative option feature” exists if seller provides a contract “under which the consumer’s silence or failure to reject goods or services or to cancel the agreement is interpreted by the [ ] seller as acceptance or continuing acceptance of the offer.” 16 C.F.R. 425.2. Although the revised negative option rule does not prohibit negative option programs, it imposes certain requirements on sellers using them. I.     Negative Option Programs The FTC explains that many negative option programs fall into one of four familiar categories: Prenotification plans, such as book-of-the-month clubs, where “sellers provide periodic notices offering goods to participating consumers and then send—and charge for—those goods only if the consumers take no action to decline the offer.” Continuity plans, where “consumers agree in advance to receive periodic shipments of goods or provision of services . . . which they continue to receive until they cancel the agreement.” Automatic renewal plans, common in the magazine subscription context, where sellers “automatically renew consumers’ subscriptions when they expire, unless consumers affirmatively cancel the subscriptions.” Free-to-pay plans, in which “consumers receive goods or services for free . . . for a trial period” but afterward “sellers automatically begin charging a fee (or a higher fee) unless consumers affirmatively cancel or return the goods or services.” II.     Requirements for Negative Option Programs Regardless of the form of the negative option program, the FTC’s new rule, which is set to go into effect in part on January 14, 2025, and in full on May 14, 2025, imposes four principal requirements on all negative option programs, whether offered online or via more traditional channels. The FTC considers any negative option program that fails to meet each of the four requirements to be a per se violation of section five of the Federal Trade Commission Act, and the FTC may seek civil penalties for each violation. A.   No Misrepresentations; Information Requirements The first two requirements are closely related. The first requirement prohibits the misrepresentation of any material fact related to the transaction, including facts about the negative option feature and the underlying goods or services. The second requirement is that sellers clearly and conspicuously disclose all material terms related to the negative option feature. These material terms include: (1) “[t]hat consumers will be charged for the good or service, or that those charges will increase after any applicable trial period ends, and, if applicable, that the charges will be on a recurring basis, unless the consumer timely takes steps to prevent or stop such charges; (2) [t]he deadline (by date or frequency) by which the consumer must act in order to stop all charges; (3) [t]he amount (or range of costs) the consumer will be charged and, if applicable, the frequency of such charges a consumer will incur unless the consumer takes timely steps to prevent or stop those charges; (4) the date (or dates) each charge will be submitted for payment; and (5) the information necessary for the consumer to cancel the negative option feature.” The prohibition on misrepresentation takes effect on January 14, 2025, while the second requirement relating to the disclosure of material terms (along with the other requirements discussed below) take effect on May 14, 2025. 16 C.F.R. § 425.3 to § 425.4. B.   Consent The third requirement is that a seller promoting or offering goods or services with a negative option feature must “obtain the consumer’s unambiguously affirmative consent to the negative option feature offer separately from any other portion of the transaction,” “not include information that interferes with, detracts from, contradicts, or otherwise undermines the ability of consumers to provide their express informed consent,” and to maintain records regarding that consent for three years, unless consumers cannot complete a transaction without providing such consent. 16 C.F.R. § 425.5. C.   Click to Cancel The final requirement is the so-called “click to cancel” component of the rule. It requires that a seller offering a negative option program provide a “simple mechanism” for cancellation. 16 C.F.R. § 425.6(a). The cancellation mechanism must be “at least as simple” as the sign-up process and must be offered “through the same medium” as the sign-up. 16 C.F.R. § 425.6(b) and (c). For online negative option programs, consumers cannot be required to “interact with a live or virtual representative . . . to cancel if the consumer did not do so” to sign-up. 16 C.F.R. § 425.6(c)(1). And, for in-person programs, the seller must offer both an in-person cancellation option “where practical” as well as a telephonic or online option. 16 C.F.R. § 425.6(c)(3). III.     Challenges The negative option rule has been challenged by a number of industry groups. The litigation challenging the Rule was subsequently consolidated under Custom Communications Inc., v. FTC, 8th Cir, No. 24-3137. The challengers are seeking a stay of the rule prior to certain provisions taking effect on January 14, 2025. Additionally, there has been speculation as to whether the new administration will continue to support the negative option rule. The rule was passed by the FTC on a 3-2 party-line vote, with the recently named FTC Chair, Andrew Ferguson, voting against the rule. Stay tuned for more from the TMCA as the rule progresses through the courts and the Federal Trade Commission under the new administration. IV.     More Information The FTC has made a fact sheet about the revised negative option rule available and provided a plain language description of the rule.

The EU AI Act, which was passed by the European Parliament on 13 March and is set to become law later this year, will probably be the world’s first legislation to introduce a general regulatory framework for artificial intelligence systems. The European Union is known to pioneer the responsible regulation of emerging technology, and the AI Act is no exception: it intends to govern the development, deployment and use of AI systems in order to protect against risk and uphold health, safety and fundamental rights, while balancing technological development and competition. If successful in achieving that balance, it will likely inform legislative standards around the world. The framework comes at a time where artificial intelligence is increasingly becoming more easily and readily deployable in a range of sectors and products, presently with little or no limitations to its usages. Overview The Act will cover AI systems that are deployed anywhere in the European Union, defining an AI system broadly as: “a machine-based system designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments.” The framework classifies AI systems according to the risk they present and sets out categories ranging from “unacceptable risk” to “minimal risk”, each subject to varying degrees of regulation. The majority of the Act focuses on requirements for developers of “high risk” systems, including regulatory oversight and conformity assessments, data quality and traceability, robustness and accuracy, human oversight, and transparency – but there are also obligations for commercial users, importers, distributors and product manufacturers. Further, the Act prohibits certain systems that are deemed to present unacceptable risk. Rules are also laid down for general-purpose AI models, being those systems that are widely integrated into a range of products without a specific purpose. Prohibited Systems The Act bans, with very limited exceptions, AI systems which pose unacceptable threats to the safety, livelihood and rights of EU citizens, including systems designed to: Manipulate or influence people’s behaviour subconsciously; Exploit vulnerabilities of specific groups in order to distort their behaviour; Conduct social scoring (i.e. categorising people based on their behaviour, race, political opinions, sexual orientation, etc.); Enable facial recognition using web-scraping; Conduct real-time biometric identification, except in very limited law enforcement situations. Additionally, systems designed to do anything else which is already against the law are prohibited. High-risk Systems Systems considered high-risk are those with significant potential to cause harm or affect safety or fundamental rights. Specifically, AI systems used in certain sectors are designated as high-risk, including systems used in medical devices, lifts, machinery, aviation, automotive and transportation, education, border control, and the management of critical infrastructure. Of course, products within many of these sectors are already regulated products in the European Union and subject to safety standards and conformity assessment requirements. The Act designates as “high risk” any AI system used as part of a regulated product falling within any of the list of existing product regulations set out in Annex II of the Act.  In addition, Article 6(1) designates as “high risk” any system intended to be used as a safety component or as a safety product, if such product or system is subject to a legal requirement in the EU to undergo a third-party conformity assessment. Further, under Article 6(2) of the Act, regardless of the particular product or system in which an AI model might be deployed, if the AI system is developed for use within certain sectors listed in Annex III of the Act it will be considered “high-risk”. These listed sectors include education and vocational training, biometrics, law enforcement, employment and critical infrastructure. Any use of an AI system in one of the listed areas is deemed “high-risk” regardless of whether the system is part of a regulated product subject to EU safety standards. For example, in the employment sector, AI systems might be used to filter out prospective applicants; in the education sector, a system might be deployed to assist with deciding on admissions. Such systems will be deemed “high-risk” under the Act. Where a system is designated as high-risk, most obligations fall on the “provider”, i.e. the developer, of that system. Providers must conduct a Fundamental Rights Impact Assessment before placing their system on the market, and also must continuously assess risk after that. The assessment will evaluate the risks posed by the system and how these will be mitigated. If such a provider believes their system is not high-risk despite being designated as such by the Act, it must conduct and register an assessment to prove this before making the system available, in order to take advantage of the exemption for systems where there is no “significant risk of harm to the health, safety or fundamental rights of natural persons, including by not materially influencing the outcome of decision-marking” (Article 6(2a)). Providers of high-risk systems, as part of their ongoing risk assessment obligations, will need to integrate processes and documentation to minimise risks, and must ensure that the data used to train and test the system are governed in accordance with that assessment and that cybersecurity is maintained. Further, providers must put together technical documentation to demonstrate a system’s compliance with the Act and must keep records and logs of safety incidents. Such records must be provided to deployers of the system, but also to competent authorities if requested as part of a provider’s co-operation obligations under Article 23. A key concept of the Act is human oversight: high-risk systems must be developed in such a way to allow them to be overseen by natural persons when deployed, allowing users to intervene and override decisions made by AI algorithms. Transparency obligations dictate that users be informed when interacting with AI systems. Conformity Assessment Procedures and Regulatory Oversight To guarantee compliance with the standards and requirements laid out in the Act, before putting a high-risk system on the market, the providers will have to issue a declaration of conformity and apply a CE mark to the system. To do so, they will have to follow conformity assessment procedures, either in accordance with existing regulations for Annex II or Article 6(1) regulated products (such as medical devices, machinery, or automotives) or in accordance with the conformity assessment procedures laid out in the Act for AI systems used in non-regulated products within the designated high-risk sectors (as listed in Annex III). The conformity assessment procedure will in many cases involve notified bodies which will have the role of assessing the high-risk system’s conformity with the rules and standards laid out in the legislation. Notified bodies have a key role in product safety conformity assessment and certification in the EU and are designated to perform that role by the member states. However, the providers, as well as importers, distributors and deployers, of the AI systems will have the ultimate legal responsibility to ensure compliance with the regulatory requirements. Compliance obligations do not fall upon the heads of providers alone. Further down the supply chain, deployers of the AI system (being commercial users who exploit a system in their own product, rather than end-users who interact with the system) need to take measures to ensure that they use a high-risk system in accordance with the instructions from the provider. Importers of high-risk systems are also responsible for ensuring that a system conforms with the Act, and distributors must verify that a system bears the CE conformity marking before distributing it. Consequences for non-compliance can be serious: for example, breaches of certain high-risk system obligations can result in a fine of the higher of €35M and 7% of turnover, with small and medium size enterprises ("SMEs") and start-ups being subject to a fine which is the lower of the two figures. General Purpose Systems General-purpose AI (GPAI) models are those with no specific purpose and which instead generate output or content in response to a prompt from the user. Such models are frequently integrated into downstream apps and systems due to their range of uses and operate via extensive training using a huge amount of data (e.g. images or text). The obvious examples that spring to mind are tools like ChatGPT, or models used to create AI images or deep-fakes. Such models, regardless of whether they form high-risk systems or are subject to other requirements under the Act, have separate obligations. Given the models do not have specific intended purposes, risk assessments are difficult due to the huge range of potential uses. Providers of such models instead need to evaluate generic “systemic risks” that might apply in most usages, such as the generation of hate speech or misinformation, assisting or enabling fraud, and so forth. Models presenting systemic risks are the more powerful GPAIs, and will be subject to further obligations, including performing evaluations to identify and mitigate such risks, keep track of incidents and corrective measures taken, and maintain adequate cybersecurity. Obligations for all GPAI providers include publishing summaries of the content used to train the model and on the testing process, and to make detailed documentation on this available to downstream deployers of the model. Other notable obligations include: Labelling content as AI generated: Under Article 52, providers of systems, whether GPAI or not, which generate image, video, text or audio content, need to mark such content as AI-generated. The effects of this will mean that AI-generated images (such as the Willy’s Chocolate Experience advert) or videos (such as deep-fakes, which the obligation expressly applies to) need to be labelled as such. Additionally, AI-generated public interest articles or other media text also need to be labelled unless they have undergone human review. Compliance with copyright laws: Article 52C requires providers of GPAI models to put in place a policy to respect EU copyright laws. The Copyright in the Digital Single Market legislation (EU Directive 2019/790) requires EU member states to provide for an exception to copyright protection for the purpose of enabling data mining of published and lawfully accessible works. The exception opens up a wealth of content resources for training AI models, free from copyright restrictions, which can be highly valuable for developers. But publishers can reserve their rights if they wish to prevent their content being used for data mining. As part of the copyright protection policy that providers of GPAI models are required to adopt, technical means would have to be put in place to ensure that systems that scrape data from content resources for the purpose of training AI models can automatically identify and respect such reservations of rights. These rules are particularly relevant given the recent wave of copyright infringement lawsuits against GPAI developers relating largely to the use of published content for training AI models. Other Parts of the Act: Low-risk Systems and Balancing Innovation AI systems not prohibited or designated as high-risk, and which are not GPAI, are subject to little or no regulation under the Act. Systems which are not high risk but which still generate certain AI content such as chatbots are considered limited risk, and developers must still adhere to some obligations, including transparency to ensure users are notified that content they interact with is AI-generated (see above). Otherwise, systems presenting minimal or no risk are unregulated. Certain members of the industry have expressed concern that over-regulation will stifle the development of beneficial technology or will present a disproportionate burden on businesses. Specific parts of the Act attempt to address effects on technological advancement, especially for SMEs, by encouraging responsible development of AI systems. Article 53 requires “regulatory sandboxes” in each member state, to foster AI innovation in a controlled setting under the supervision of authorities. SMEs and start-ups are to be prioritised under this provision. Implementation and Consequences Following the Act being approved by the European Council and published in the EU’s Official Journal (likely to occur around May), it will become law and various parts and obligations will enter into force over a period of six months to three years following that. In addition to the role of notified bodies in relation to conformity assessments, the Act establishes the AI Office, part of the European Commission, to implement and enforce the obligations, and dictates that the Office will within 18 months publish guidelines to provide providers and deployers with practical examples of the various categories of risk and detailing actionable steps in order to assist them in complying with their obligations. Impact on Industry and Markets The rapid development of AI and the significant implications that the technology could soon have on people’s lives have raised great concerns not just from commentators and academics but also from governments and many industry leaders. The risks are broad, varied and very real. It is no surprise that authorities are keen to address and regulate the potential threats the technology could introduce to people’s rights and safety. The EU AI Act does not set out to exhaustively identify or evaluate each and every potential risk. Rather, whilst identifying some obvious areas of concern, its main function is to put the onus on developers of AI systems and on other organisations that wish to put on the market products and services powered by AI, to identify and weigh the risks and to address them in the framework of a regulatory system that mandates oversight, transparency and accountability. The European regulatory approach will be successful if it can ensure that AI technologies and AI powered products and services placed on the market in Europe are designed to service the requirements of consumers and other users whilst avoiding serious harm. To achieve this, a significant investment will have to be made by EU member states to build the necessary regulatory capabilities and to guarantee a high level of enforcement. Robust, highly professional and efficient regulatory and enforcement mechanisms can promote safety and quality without stunting safe and responsible innovation. If those systems can be put in place quickly enough and if they are equipped with the necessary resources, the European regulatory framework can achieve the task of protecting consumers in Europe and it can help to nudge the global AI industry in the right direction. It could also potentially provide a blueprint for regulations to be introduced in other parts of the world. But Europe alone cannot shape a global industry (particularly one that has so far been led by major players elsewhere, particularly in the US and China). Other major countries will have to play their parts as well, whether by adopting similar regulatory processes as the new EU framework or through alternative approaches, to ensure that AI technology is used to make the world a better place for people, whilst eliminating or minimising the potential threats.

The European Data Protection Board (EDPB), a board comprised primarily of representatives of the data protection supervisory authorities of the European Union’s member states, issued surprising new guidance in mid-November explaining how a key component of the European Union’s ePrivacy Directive applies to variety of commonly used technologies used for tracking on the internet. Article 5(3) of the ePrivacy Directive[1] (EPD) has long been a cornerstone of internet and privacy law in the European Union (EU). Under the directive, EU member states were required to pass laws that limited “the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user” to situations where the subscriber or user has been provided “clear and comprehensive information” about the practice and, thus informed, provided consent. The sole exceptions to this requirement are as necessary to transmit the user’s communication over a network or “as strictly necessary in order for the provider of [a service] explicitly requested by the subscriber or user to provide the service.” This aspect of the EPD has long been understood to apply to the cookies stored in users’ web browsers. Indeed, the EPD is often colloquially referred to as the “EU Cookie Directive.” It was logical that the EPD applied to cookies because cookies were designed with the express intention of allowing a website provider to store information in a user’s web browser for later retrieval. Cookies, however, are not the only ways in which a website operator or mobile app provider can store or access information in a user’s terminal equipment. Earlier guidance from the EDPB also confirmed that the EPD also applied to the tracking of a user through the practice of “device fingerprinting.” The EDPB’s new guidance, entitled “Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive,” goes further. It clarifies that the EPD also applies to many newer tracking technologies, many of which are ubiquitous components of the ad-supported internet. The guidance clarifies that the EPD always applies when four criteria are met: (1) the operation in question relates to information; (2) the operation relates to a subscriber’s or user’s “terminal equipment”; (3) the operation is made in the context of a publicly available electronic communications service on a public network; and (4) the operation involves “gaining of access” or “storage.” The EDPB guidance interprets all of these elements broadly enough to cover most or all tracking technologies in use on the internet. For instance, the EDPB’s guidance explains that the EPD applies to tracking of users by means of tracking pixels or tracking links. Tracking pixels are hyperlinked resources that are embedded into content to enable the collection of information about the users of the content. The information might be collected by the sender of the content or by a third party that aggregates tracking data. Tracking pixels also often contain additional information that facilitate tracking across pages, websites, and devices. Tracking links are web links that include additional information to facilitate tracking. The EDPB explains that tracking links are used, for instance, to enable e-commerce partners to identify and pay commissions to referral sources. In both contexts, the EDPB finds that the tracking meets all four of the criteria for the applicability of the EPD: information is both stored on and accessed from the user’s terminal equipment in the context of a public internet service. The EDPB guidance reaches the same conclusion with regard to tracking based on “local processing” or “processing instructed by software distributed on users’ terminal, where the information produced… is then made available to selected actors” by the software. The EDPB explains that if local code sends information “back over the network… such an operation (instructed by the entity producing the client-side code…) would constitute a ‘gaining of access to information already stored.’” This reasoning almost certainly implicates many common tracking technologies, such as Google Analytics, that operate through JavaScript code that execute within a client’s web browser. It also would almost certainly implicate tracking embedded in mobile apps running on users’ tablets and smartphones. The EDPB also explains that, under analogous reasoning, tracking via IP addresses and unique identifiers (even identifiers that are inherent in user authentication) also falls within the technical scope of the EPD. Of course, the fact that these tracking technologies fall within the scope of the EPD does not mean that these technologies cannot be used. However, it does require the providers and operators of these tracking technologies to provide users with information about the tracking and to collect users’ consent to the tracking before it begins. This will require providers and operators of tracking technologies to modify their websites and mobile apps to provide this information and to obtain and track users’ consent. Because the EDPB’s guidance is an interpretation of existing law, users of tracking technology will have no grace period to enact these changes before enforcement efforts can begin. [1] The directive was originally issued as “Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector” and amended in 2009 by “Directive 2009/136/EC.”

On 10 July 2023, the European Commission adopted its adequacy decision for the EU-U.S. Data Privacy Framework (“DPF”). The adequacy decision is designed to relieve U.S.-based businesses and other institutions and organisations that choose to participate in the DPF from legal uncertainties and administrative burdens in relation to personal data records originating from the EU. It is expected that the UK and Switzerland will soon adopt similar decisions that will allow participating organisations to enjoy the benefits of the DPF in relation to data imported from those two countries for processing in the U.S. or by U.S. organisations. The DPF is the third attempt to create a data bridge between the EU – with its heightened concern for protecting privacy interests of individuals – and the U.S., which has been for the past few decades slow in adopting policies and legislation to protect those rights (although more recently consumer privacy legislation is increasingly being adopted by US state legislatures). Even before the EU introduced its General Data Protection Regulation (“GDPR”), there was a self-certification scheme in place – not altogether unlike the new DPF – which allowed US-based companies and organisations to import personal data from the EU on the basis of the organisation’s legal commitment to safeguard the data and to protect the interests of data subjects. Just like the new DPF, under that scheme (the “Safe Harbor” arrangement), mechanisms were put in place to allow the U.S. Department of Commerce to enforce the commitments of participating organisations and to allow individuals to bring complaints. Just like the DPF, the “Safe Harbor” scheme was approved by the EU Commission under applicable EU law. GDPR was designed to allow the “Safe Harbor” scheme to continue to operate. It contained specific provisions empowering the EU Commission to enter into international arrangements like the “Safe Harbor” and the DPF. But in its decision of 6 October 2015 in the Maximilian Schrems v Data Protection Commissioner case (C-362/14), the EU Court of Justice held that the “Safe Harbor” scheme failed to meet the requirements of EU law in relation to the protection of personal data when it is taken outside the jurisdiction of the EU. In 2016, the EU Commission approved a second scheme, known as the EU-U.S. Privacy Shield. That scheme was once again ruled in a subsequent decision of the EU court of 16 July 2020 (Schrems II, C-311-18) to have fallen short of EU legal requirements. In both decisions, the main reason for the EU Court’s decision that personal data transferred to the U.S. under the terms of the schemes was not sufficiently protected, was the evidence that U.S. national security and law enforcement agencies were engaged in wide-range, on-going, and (according to the Court’s findings) indiscriminate mass monitoring and surveillance of communications which the agencies access through “back doors” provided by social media and other digital platforms based in the U.S. The rulings of the EU Court were particularly focused on the absence of legal redress mechanisms in the U.S. for EU individuals whose data is or may be exposed to such surveillance. The EU Commission gave its blessing to the new DPF scheme based largely on the signing by President Biden on 7 October 2022 of Executive Order 14086 on Enhancing Safeguards for United States Signals Intelligence laying down limitations and safeguards for all U.S. signals intelligence activities and on a supplemental Regulation on the Data Protection Review Court (28 CFR Part 302) issued by the U.S. Attorney General. Among other things, the Executive Order and the associated Regulation establish a tribunal and proceedings that affected EU individuals will be able to use to bring complaints regarding the use of their data by intelligence agencies. Those redress mechanisms and the other requirements of the DPF program were considered to be sufficient by the EU Commission to provide adequate safeguards to protect personal data transferred to the U.S. under the scheme. But what does this all mean for U.S. businesses, organisations, and institutions that consider signing up for the DPF program? Participation in the scheme means that the organisation will be free to collect, import, and use personal data records from any source in the EU without having to put in place transfer agreements with each data exporter and carry out transfer impact assessment in each case and without risking challenges against its use of personal data imported from the EU. This could be of real benefit for businesses and organisations that receive data regularly from the EU, particularly if they deal with many different categories of personal data, coming from different sources and processed for many different purposes. Self-certification under the DPF means that there is no need to address each and every one of those data transfers individually. Further, businesses and organisations love to declare that they respect people’s privacy and that they are committed to protecting personal information. By committing itself to the requirements of the DPF program, an organisation may be able to nurture the trust of other businesses, and organisations, and even the public itself, for being an organisation that truly respect the privacy of individuals and is committed to protecting their data. If the scheme is successful in attracting large portions of corporate America as well as various other organisations and institutions that may be eligible for the scheme, it might become a ‘must have’ for large companies in the public eye. The scheme undeniably offers advantage for some, but the administrative effort and the compliance burden in participating in the DPF should not be understated. One of the key criticisms of the defunct “Safe Harbor” scheme was that it lacked any real oversight or enforcement mechanisms. This is not the case with the DPF. The fundamental idea of the DPF (as any other mechanism to legitimise international data transfers outside the EU) is that the self-certifying organisation has to commit itself to a set of basic “Principles” which reflect the fundamental requirements of the GDPR, including securing for data subjects the same rights that they have under EU law. This in itself is a serious compliance burden which any organisation that contemplates joining the scheme should consider carefully. Alongside broad principles of establishing a legitimate basis for the use of data, particular protections for sensitive data, data security, controls over the re-purposing of personal data, and the sharing of data with third parties, the DPF also includes some very specific requirements. These include, among other things, specific information that has to be made available to data subjects regarding the organisation’s participation in the DPF scheme, the internal complaints handling procedures, and the external dispute resolution mechanism to which the organisation commits itself and other information. This means that participants would have to update their privacy policies to include this information. Participating organisations are also required to give data subjects certain specific choices – an opt-out from disclosures to third parties (other than service providers) and an opt-out from re-purposing the data. Apart from the implications of offering those choices, organisations would have to consider the logistics of offering these choices to all EU individuals whose data is being imported by the organisation into the U.S. Further, the DPF introduces a new set of requirements regarding the contractual arrangements that have to be put in place when the imported data is being shared with a third party controlling (that is, not a service provider which deals with the data on behalf of the participating organisation). Organisations will therefore need to set themselves up for new procedures and new contract forms for dealing with onward transfers. Another key element – which was lacking in the original “Safe Harbor” scheme but had already been addressed under the “Privacy Shield” program - is the requirement that the participating organisation must submit itself to external dispute resolution mechanisms. Those could take the form of private dispute resolution organisations, but there is also the option for an organisation to submit itself to the jurisdiction of data protection regulators in the EU. Either way, the requirement is that the mechanism must be free to the complaining individual. Finally, to ensure that participants maintain the privacy and data security standards to which they commit themselves through self-certification, the scheme requires participating organisations to verify their own compliance. Verification can take the form of self-audits or external audits. Either way, the verification needs to demonstrate that the participant’s privacy policy regarding personal information received from the EU is accurate, comprehensive, readily available, conforms to the “Principles”, and – importantly – that it is fully complied with. It must also indicate that individuals are informed of the organisation’s in-house complaint handling procedures and of the independent recourse mechanism(s) through which individuals may pursue complaints. Further, the verification needs to confirm that the participating organisation has in place procedures for training employees in the implementation of the privacy policy, and disciplining them for failure to follow it; and that it has in place internal procedures for periodically conducting objective reviews of compliance with the above. An annual self-certification declaration must be made each year confirmed by the declaration of a corporate officer. Executives would need to ensure their companies are indeed fully compliant before swearing such a declaration. Alongside the compliance burdens and verification and dispute resolution mechanisms, the DPF also includes a number of exceptions and provisions that apply to specific situations, such as allowances for journalism, airlines, and for corporate due diligence exercises, and special rules for clinical trials and medical research and for handling human resources data. These special rules are designed to ensure that the scheme’s requirements are not going to be prohibitive in respect of such activities or for organisations in the relevant sectors. They would require particular attention by affected organisations. Consideration of those sets of special rules is beyond the scope of this note.

Established through the Charter of the French Language, French is the official language of the Province of Québec. The Charter applies to businesses located in Québec and to other businesses providing services and selling goods in this province, making the use of French mandatory in connection with these business activities. Historically, the Charter has provided for a “recognized trademark” exception to this French language requirement for registered and known (but unregistered) trademarks in Canada. In these cases, the “recognized trademark” may appear on goods, advertising, signage and commercial publications in a language other than French (unless the French version of the mark has been registered, in which case use of this French version remains mandatory). In addition, where the “recognized trademark” exception applies to use on signage or on the face of a building, it must also feature indications on the same visual plane that informs consumers and passersby of the nature of the business in the French language. This is referred to as the “sufficient presence of French” requirement. In May 2021, the provincial government of Québec introduced (and later passed, in May 2022) an amendment to the Charter, referred to as “Bill 96,” which changes how “recognized trademarks” are treated in commerce and business. As of June 1, 2025, the scope of the “recognized trademark” exception will be restricted to registered trademarks, and inscriptions on products, on public signage and in commercial advertising. As a result, the “recognized trademark” exception will no longer be triggered by unregistered trademarks. Currently, where the “recognized trademark” exception does not apply, the Charter requires that products, packaging, and related informational documents (instruction manuals, for example), and commercial publications (including websites and social media) public signage and commercial advertising, must be in French, or in French and another language so long as the “other language” is not given heightened focus in comparison to the French language. This includes font size, use of color, positioning, and overall size. With the understanding that unregistered trademarks will no longer be an exception to this rule, this would require active steps by trademark owners to obtain registrations for trademarks, in order to continue to benefit from the exception, or to otherwise potentially implement significant updates to all impacted materials. For registered trademarks that feature generic or descriptive terms in a language other than French, the descriptive or generic term will need to be translated into French and appear on the product or on a medium permanently attached to the product. At this time, it is unclear how “generic” or “descriptive” may be interpreted in this context, or frankly, precisely what “medium permanently attached to the product” means. Additionally, where the “recognized trademark” exception is not available, the rule currently is that signs, posters, and billboards must be in French, or in French and another language so long as the French is featured in a predominant manner, with a greater visual impact than the other language. Thus, the current impact of Bill 96 is that both unregistered trademarks and registered trademarks appearing on public signage will be required to change from a “sufficient presence of French” to a “markedly predominant” use of the French language, meaning that the French language must have a greater visual impact than the text in the other language. For businesses who seek to comply with Bill 96 by seeking new trademark registrations, a challenge here is that the Canadian Intellectual Property Office has significant delays in the examination of trademark applications (as of this writing, approximately 43 months). This makes it very difficult for businesses to come into compliance via new trademark applications by the current June 1, 2025 implementation date. This tension between the compliance deadline and registration speed has been broached with CIPO by Canadian practitioners. In terms of next steps, we encourage interested parties with registered and unregistered trademark rights in Canada to review their business activities and trademark portfolios to determine: Whether new trademark applications should be filed. If so, if new applications are filed featuring pre-approved goods and services from CIPO’s manual, it may be possible to reduce the examination time from 43 months to about 21 months. Taking action now may make it possible to meet requirements by June 1, 2025. Expedited examination is also available under certain prescribed circumstances. Whether the loss of the “recognized trademark” exception will require changes to product packaging (generic/descriptive terms, unregistered trademarks), related documentation, commercial publications, and public signs visible from outside buildings. Bill 96 expands the government’s powers of enforcement and all Québec residents will have standing to seek injunctive relief and damages. The potential business risk in Canada is therefore considerable, and taking action toward compliance now is recommended. We will keep our readers updated on further guidance in connection with the impact of Bill 96.

Certain Colorado companies and others targeting Coloradans will soon be subject to the newly enacted Colorado Privacy Act (“CPA”), signed into law by Gov. Jared Polis on July 8, 2021. Colorado joins California and Virginia as the third state to enact its own comprehensive consumer data privacy legislation. Who must comply with the new CPA rules? Starting on July 31, 2023, businesses will be subject to the CPA if they are located in Colorado or intentionally target Colorado consumers, and either: (1) control or process personal data of more than 100,000 Colorado consumers per calendar year; or (2) derive revenue from the sale of personal data and control or processes the personal data of at least 25,000 Colorado consumers, unless they meet one of several exemptions. The law applies directly to both “controllers” and “processors,” meaning that the law may apply directly to some out of state service providers that agree to handle data subject to the CPA. However, the CPA does include broad exemptions for companies and data that are subject to specific state and federal laws, such as HIPAA, GLBA, the FCRA, COPPA, and FERPA, as well as data processed in connection with employment and in business-to-business contexts. To what data does the CPA apply? The CPA applies to “personal data,” which is defined broadly as information that is linked or reasonably linkable to an identified or identifiable individual. As with other recent privacy laws, there are also specific requirements for sensitive data, such as data relating to biometrics, race, ethnic origin, religious beliefs, mental/physical health, sex life/sexual orientation, or citizenship status. The law exempts from its requirements data that is de-identified, and defines specific criteria that must be met in order for data to be considered de-identified. Uniquely, the CPA also has specific requirements relating to the handling of ‘pseudonymized’ data, which was sometimes unclear under other state privacy laws. The CPA also exempts certain publicly available data that has either been made available through government records, or that the consumer made available to the public. What rights does the CPA give consumers? Although the CPA does provide consumers with many of the same rights available under the California and Virginia privacy laws, there are some important differences, which will require the implementation of new procedures. Colorado’s consumer rights fall into five main categories, described below. As in other states, these rights may be enforced by the individual directly, or through an agent: 1. Opt out. Consumers can opt out of the processing of their personal data for purposes of: a. targeted advertising; b. the sale of personal data (defined broadly to include most exchanges of personal data for monetary gain or other valuable consideration), or c. profiling in furtherance of decisions that produce legal or similarly significant effects concerning a consumer. 2. Access rights. Consumers may obtain a copy of  personal data and confirm if a company is using or otherwise processing their data. 3. Correction. Consumers can correct inaccuracies in their personal data. 4. Deletion. Consumers may request the deletion of their personal data. 5. Portability. Consumers have the right to obtain a copy of their personal data in a portable and, to the extent technically feasible, readily usable format. What are companies’ duties and obligations? The CPA’s requirements are broadly similar to the rights under CCPA/CPRA, and GDPR. Generally, the CPA includes the following core requirements: Transparency. Provide a transparent, clear, and meaningful privacy notice to ensure that it is easy to understand, meaningful to consumers, and in compliance with the CPA. Purpose Specification. Limit processing to what is necessary and appropriate for the specified purpose. Minimization. Only collect data that is adequate, relevant, and limited to what is necessary for the specified purpose. Consent to Secondary Use. Avoid using personal data beyond what was disclosed to the customer, except with prior consent. Care. Implement reasonable measures to protect against unauthorized acquisition. Nondiscrimination. Duty not to unlawfully discriminate. Impact Assessments. Companies must conduct data protection assessments prior to engaging in targeted advertising, profiling, and when processing presents high risks to consumers. Vendor Management. Companies must enter into data processing contracts with subcontractors, requiring them to protect personal data, assist in data rights compliance, and process personal data only for specified purposes. How could this impact my business? If your company is subject to the CPA, you must be sure that you understand all of the personal data collected or otherwise processed by your company, where it is throughout its lifecycle, who has access to it for what purpose, and which vendors may interact with the data. You may need to implement new procedures to respond to consumer data rights requests (typically within 45 days). Companies will likely need to update their privacy notices, as well as their contracts with service providers and others, and implement opt-out mechanisms and related notices, as needed. Companies who run afoul of the CPA may be fined up to $20,000 per violation. Who can enforce this new law? The CPA does not allow for a private right of action. Only the Colorado Attorney General and District Attorneys may bring enforcement actions. Additionally, the CPA authorizes the attorney general to promulgate rules relating to certain aspects of the CPA. Giving a nod to how difficult a pivot to compliance may be in Colorado, companies will have a 60-day time period to cure a violation of the CPA until January 1, 2025. However, the cure period expires on January 1, 2025.

The FTC recently reached deals with six CBD companies after it issued formal complaints against them in December 2020 over concerns about deceptive practices. The initial complaints (found here: In re Bionatrol Health, LLC, In re Epichouse, LLC, In re CBD Meds, Inc., In re Easybutter, LLC, In re Reef Industries, Inc., and In re Steves Distributing, LLC) brought various counts against the companies, including allegedly making a wide range of claims about their ability to treat serious health conditions, including cancer, heart disease, hypertension, Alzheimer’s disease, and other diseases. Some complaints also include deceptive pricing allegations. The FTC approved final consent orders resolving all the complaints. Those orders (found here: In re Bionatrol Health, LLC, In re Epichouse, LLC, In re CBD Meds, Inc., In re Easybutter, LLC, In re Reef Industries, Inc., In re Steves Distributing, LLC) obligate the companies to take and avoid various actions, including refraining from making misleading statements about the health benefits of CBD (including that such products prevent Alzheimer’s disease, autoimmune diseases, arthritis, cancer, diabetes, heart disease, seizures, skin cancer or other diseases), refraining from deceptive pricing tactics, notifying customers of the FTC’s lawsuit, and paying fines ranging from $20,000 to $85,000. These orders come on the heels of two years of relatively aggressive enforcement efforts against CBD companies by both the FDA (which we wrote about here) and the FTC. The FDA has already written two more warning letters to CBD companies in 2021, which you can find here. As shown on that same page, the FDA sent 21 letters to CBD companies in 2020 and, in 2019, sent another 22 letters. Sometimes these letters were jointly signed by the FTC, and the FTC has sent other letters to CBD companies over the past years (such as those discussed here). While the FDA continues to consider further regulations governing more widespread use of CBD products, these orders and letters will continue to act as de facto guidance for CBD companies. Dorsey will continue to monitor the FTC's and FDA’s actions in this area.

Hong Kong is an attractive franchising market, as an entry point to China and other international markets. While franchising in Hong Kong is not specifically regulated by law, there are common law principles and legislation that are applicable when setting up or operating a franchise in Hong Kong. Unlike some other jurisdictions, the system allows for foreign franchisors to enter into franchise agreements without establishing a wholly-owned subsidiary or branch office in Hong Kong. In addition, franchise operations are not required to register with the Hong Kong government or any trade associations. However, as the Hong Kong government does not impose any formalities that the franchisor must comply with when setting up a franchise system, it is imperative to consider the implications of common law, contract law, and other applicable legislations to determine how best to define franchise relationships. The provisions in the franchise agreement and the particular facts of the arrangement will define any relationship and there are key provisions to consider in franchise agreements to ensure you are well protected. For example, the Competition Ordinance, which came into effect on 14 December 2015, prohibits restrictions on competition in Hong Kong and the rules of the Ordinance can be implicated by restrictions imposed by the franchisor that go beyond what is reasonably necessary to maintain and protect the franchisor's legitimate business interests. Such restrictions, if found in a franchise agreement, may be considered anti-competitive. Likewise, restrictive covenants found in franchise agreements which extend past expiration of the franchise arrangement may be unenforceable and must be crafted narrowly, without excessive obligation, and with only restrictions that are no more than reasonably necessary to protect the franchisor’s legitimate business interests. For further legal and commercial advice on key provisions and concepts to consider when setting up franchises in Hong Kong and drafting franchise agreements, please see this Hong Kong Franchising Q&A recently published by our team of expert lawyers in Hong Kong for Thomson Reuters’ Practical Law database. Reproduced from Practical Law with the permission of the publishers. For further information, visit us.practicallaw.com.

On November 25, 2019, the Food and Drug Administration sent a wave of warning letters to fifteen CBD companies claiming they are breaking federal food, drug, and cosmetic laws based on their current CBD product marketing and labelling. Prior to this, the FDA had separately sent letters to seven other CBD companies in 2019 and to only one CBD company in 2018. A comprehensive list of CBD-related warning letters sent by the FDA can be found here. The FDA accompanies the most recent letters with a press release and a revised Consumer Update discussing the FDA’s potential concerns about CBD. As in the past, these letters targeted companies marketing CBD products to treat diseases or claiming that CBD has therapeutic uses for humans and/or animals. The letters also target companies that market CBD products as dietary supplements or as an additive to human and animal foods. At their most basic, the FDA’s objections are rooted in the agency’s interpretation of the Food, Drug, and Cosmetic Act (“FDCA”), which the FDA claims precludes CBD from being classified as a dietary supplement because CBD is also an active ingredient in the drug Epidiolex. The FDA also takes the position that, under the FDCA, CBD products could be viewed as new, unproven drugs where a company promotes use of CBD for curing and treating diseases and ailments. Despite the FDA’s fairly aggressive position and action in issuing the warning letters, the FDA’s press release indicates that it continues to “explore potential pathways for various types of CBD products to be lawfully marketed.” The FDA plans to provide an update on its progress regarding the agency’s approach to these products “in the coming weeks.” As of the time of writing this post, the FDA has not issued a further update. However, these statements still show signs of a potential reversal or at least softening of the FDA’s treatment of CBD. So, what lessons can CBD companies learn from these letters in hopes of avoiding the ire of the FDA? First, just because a company did not receive a letter from the FDA, that does not necessarily mean it is in compliance with the FDA’s current interpretation of the FDCA or that it won’t receive a letter in the future. The FDA has a limited enforcement budget and appears to continue to target offenders making extreme performance claims about CBD. Second, making statements about perceived health/wellness benefits of CBD products is a major no-no. And this doesn’t just apply to obviously extreme claims, such as stating that CBD may cure cancer. It also applies to less extreme statements about CBD performance, such as claiming that CBD products help with “skin rejuvenation” or “joint & muscle relief” or referring to CBD products as “dietary supplements” or food. Companies would be well served by implementing multi-level review processes (including external review where feasible) to ensure marketing materials, packaging, and websites do not fall on the wrong side of this line, at least until the FDA issues further and more specific guidance. Dorsey will continue to monitor the FDA’s actions and updates in this area.

The arrival of the California Consumer Privacy Act (CCPA) on January 1, 2020 brings steep risk for companies that collect information on California residents. In particular, and among other statutory penalties, a business that suffers a data breach is subject to statutory penalties of $100-750 per consumer per incident if such data breach arises from a failure to implement "reasonable security procedures and practices." What many businesses may not realize is that this risk is present even when data processing activities are conducted by a third party on behalf of the business and with vendors that businesses may not immediately think about when considering the processing of personal data. An oft-overlooked example of this risk lies within the advertising and marketing vendor ecosystem. Advertising technology, or AdTech, is an evolving field that encompasses software and other tools that help organizations target, deliver, and evaluate their digital advertising initiatives. It is not a secret that this technology includes tracking technologies to monitor online activity of consumers, which is then ultimately used to target consumers with tailored ads. While some organizations have the resources and personnel to undertake and oversee all of their advertising and other marketing needs, many rely on advertising vendors to fill this role. These AdTech vendors are part of the advertising vendor ecosystem, a complex, dynamic industry aimed to opportunistically deliver relevant ads to consumers. In order to accomplish this, these vendors must use consumer data. As an example of the complexity of the AdTech space, consider the following. Organizations hire media agencies to purchase media on behalf of their clients and ad agencies to generate creative media initiatives using that media. A media agency provides services through an agency trading desk (ATD), which gathers all available data obtained through advertising campaigns and plans and manages ads across several different platforms. Advertisers use technology platforms known as Demand Side Platforms (DSPs) to bid on and purchase ad placements through exchanges or networks using data and tools to optimize campaigns to accomplish the advertiser’s goals. Advertisers rely on Data Management Platforms (DMPs) to collect data from a variety of sources, including advertising campaigns, websites, social networks, and mobile apps, and then use data analytics, artificial intelligence, and machine learning technology to analyze that data to identify trends and target specific consumers. An advertising network is a company that acts as the intermediary between advertisers and publishers, aggregating ad inventory from publishers to sell to advertisers. Ad networks operate in an ad exchange, which is either an open or private marketplace that facilitates the buying and selling of ad inventories—advertisers often select desired ad inventory using DSPs. Supply Side Platforms (SSPs) are technology platforms used by publishers to analyze demand from ad networks and exchanges and consolidate and expose their ad inventory to DSPs to ultimately earn revenue. Ad networks, ad agencies, advertisers, and publishers run ad campaigns using ad servers, which are applications to host and deliver the ads, all while tracking and collecting ad performance data. Through these relationships, AdTech vendors may be processing a variety of personal data types on behalf of businesses, including names, physical addresses, phone numbers, email addresses, IP addresses, device IDs, behavioral, biometric, payment, social media profile information, etc. As such, companies have a responsibility to ensure the security of the information that AdTech vendors process on their behalf and may face CCPA liability in the event of a data breach for a compromise to this data if the company did not conduct proper third party security diligence and oversight of the vendor. Performing diligence on AdTech vendors is not a materially different process from performing diligence on any other vendor that processes personal information. Companies should assess the risk associated with the vendor, which can be related to the type of information processed, volume of information, technical integrations, sophistication of the vendor, or any combination of these or other factors. Once a company has determined the risk associated with a vendor, it should determine what level of diligence it should undertake in relation to that risk. Generally, diligence levels fall on a spectrum with bare contractual terms being the bare minimum and moving up through questionnaires, internal policy evaluations, third party artifacts, audits, all the way to even controlling the security of the vendor through various mechanisms. Whatever level of diligence a company decides to apply to a vendor, it should document that decision and the basis for reaching it. Companies should also consider including indemnity clauses in AdTech vendor contracts as a means to hold the vendors accountable for data breaches caused by unreliable data processing. Most important of all, however, with any vendor that may be processing personal information on behalf of a business, is to ensure that the business has established an efficient incident response process with the vendor. This process should not only be codified in the vendor contract, but also in the business' own incident response plan. It is critical that a vendor understands what type of security incident it needs to notify its customers about, who to contact at the customer site regarding the incident, and on what timeline. There may be key coordination efforts that need to be mutually undertaken during an incident and trying to figure all of this out in the heat of the moment will lead to problems. Remember, as a data controller, the customer may ultimately be responsible for the protection of the data; therefore, relying entirely on a vendor to handle incidents with no oversight or other controls may not be a reasonable position. In the end, AdTech vendors that handle personal information should be treated as any other vendor that processes sensitive information and should undergo proper diligence, oversight, and be subject to adequate contractual controls. Failure to do so could result in significant penalties under the CCPA and other emerging privacy laws.

As the U.S. cannabis market continues to grow at an extraordinary pace, a number of celebrities and companies have extended their names or brands to cannabis products via partnerships with licensed growers and dispensaries.  On the celebrity side, these partnerships include Willie’s Reserve (Willie Nelson), Bob Marley (Marley Natural), Whoopi Goldberg (Whoopi & Maya) and Snoop Dogg (Leafs by Snoop). But recent modifications to draft regulations in California threaten to restrict the ability of celebrities or companies to lend their names or brands to cannabis products sold in those states where adult or medicinal cannabis use is legal via intellectual property licensing arrangements to licensed sellers.  The proposed new rules, from the three state licensing authorities that regulate medicinal and recreational cannabis in California—the Bureau of Cannabis Control (“BCC”), the California Department of Public Health (“CDPH”) and the California Department of Food and Agriculture (“CDFA”)—came out in October as an update to the draft regulations that had been previously published in July. Among the updates contained in these proposed new rules is one that stands out for its potentially restrictive impact on brand and other types of IP licensing in the cannabis space.  While the regulations already require all commercial cannabis activity (other than authorized retail activity) to be conducted between licensed operators, the BCC’s updates to the draft regulations go further to provide that cannabis license holders cannot conduct commercial cannabis activities on behalf of, at the request of, or pursuant to a contract with any person that is not licensed under the Act.  The listed prohibited commercial cannabis activities are now defined to include the manufacturing or packaging of cannabis goods according to the specifications of a non-licensee, as well as packaging and labeling cannabis goods under a non-licensee’s brand. These updates are most likely intended to seek to curb the ability of unlicensed cannabis businesses to conduct regular business through licensed businesses by selling white-labeled products to such licensed businesses or otherwise.  However, the proposed changes could potentially have far-reaching implications for any authorized cannabis operators and IP licensors engaging with these companies who have an existing license deal or are considering entering into an operating relationship.  With the requirements for obtaining a cannabis license so arduous, a licensing deal seemed to be an easy option for non-licensees to get their brand into the cannabis industry.  But with the new restrictions, non-licensees may not have a direct licensing option to get their brand onto cannabis goods.  While authorized cannabis operators and non-licensees may be able to turn to more complex contractual structures in order to continue to do business together, parties will need to tread carefully. The deadline for public comment on the BCC’s changes was on November 5th. It remains to be seen whether the BCC’s proposed changes will ultimately be incorporated into the proposed rules and, eventually, continue through the formal rule making process until they are adopted as non-emergency regulations.

On June 13th, we hosted a “Meet the Regulators Breakfast” with Clark Russell, Deputy Bureau Chief of the Bureau of Internet and Technology of the NY State Office of the Attorney General, along with Dorsey’s privacy lawyer Bob Cattanach, which was sponsored by the Association of National Advertisers.  For those of you who missed out on this event, never fear—the TMCA has you covered with a recap of a few of the highlights. Operation Child Tracker: The Children's Online Privacy Protection Act (COPPA) first went into effect in 2000 and is designed to protect the online privacy of children under 13.  COPPA doesn’t just cover operators whose websites or online services directly collect personal information from children—it also covers those whose sites and services integrate third party services (such as plug-ins or advertising networks) that collect personal information from underage visitors.  And COPPA imposes strict liability on violators, so even if operators aren’t aware that third party advertisers have installed tracking technologies that violate COPPA, the operators themselves are still liable.  Deputy Bureau Chief Russell talked about Operation Child Tracker, a two-year, first-of-its-kind investigation by the AG’s office, which ended in a number of settlements totaling $835,000 with some of the nation’s most popular kids’ toy and media companies whose websites were home to third-party technologies that enabled the tracking of children’s online activity in violation of COPPA. Data Breaches:  We couldn’t have breakfast with the Deputy Bureau Chief of the Bureau of Internet and Technology without discussing data breaches!  Deputy Bureau Chief Russell led us through the AG’s 2017 report documenting the record number of data breach notices filed with the NY A.G.’s office in 2017.  There were a total of 1,583 data breaches reported, exposing the personal records of 9.2 million New Yorkers, which is four times the number of those reported impacted in 2016. The report shows that in 2017, employee negligence (which encompasses inadvertent exposure of records, insider wrongdoing, and the loss of a device or media) accounted for 25% of reported breaches. Operation Clean Turf: Deputy Bureau Chief Russell also discussed Operation Clean Turf and the AG’s recent investigation into fake social media accounts.  Operation Clean Turf was a year-long undercover investigation into the reputation management industry, astroturfing (i.e., masking the true sponsor of a message to make it appear as though it originates from and is supported by a grassroots participant) and false endorsements.  Operation Clean Turf specifically targeted the widespread practice of companies being paid to generate fake consumer reviews on websites such as Yelp and Google Local.  During the course of the investigation, representatives from the AG’s office, posing as an independent frozen yogurt shop in Brooklyn, called various search engine optimization (SEO) companies to request help with negative reviews of the yogurt shop on consumer-review websites.  Many of the SEO companies offered to write fake positive reviews and post them on consumer-review websites as part of their standard reputation management services.  These companies use advanced techniques to hide their identities and bypass consumer-review websites’ filtering and fake review detection, even going so far as to pay freelancers in the Philippines, Bangladesh and Eastern Europe $1 to $10 per fake review posted.  Operation Clean Turf resulted in 19 companies paying more than $350,000 in penalties and agreeing to cease their practice of writing fake online reviews for businesses. But fake reviews aren’t the only issue: companies are also using techniques to encourage would-be positive reviewers to post reviews, while filtering would-be negative reviewers away from review sites.  Deputy Bureau Chief Russell pointed to one example in which a pre-Uber New York car service business asked users whether they had a positive or negative experience with the business.  Those that clicked a button indicating they had a positive experience were redirected to a consumer review website, where they were offered a $10 discount on a future ride to post a positive review. Those that clicked the button indicating they had a negative experience were redirected to the business’ website where they could provide direct feedback to the company, and were not asked to write a review.  As Deputy Bureau Chief Russell pointed out, incentivizing customers to provide favorable reviews without disclosing such payments is a form of false advertising and a deceptive trade practice that violates New York Executive Law § 63(12), New York General Business Law §§ 349 and 350, and the FTC Endorsement Guidelines. In an era where consumers increasingly rely on consumer review sites, it is worrying to think that we may not be able to trust the authenticity of every review that we see—and, as companies adopt increasingly advanced techniques, we may not even be able to distinguish the genuine reviews from fake or paid ones.  Thankfully, the AG’s office is focused on this type of online consumer protection and continues to investigate such deceptive practices as a consumer protection measure.

In a wake-up call to businesses that offer non-compliant consumer warranties, last week the Federal Trade Commission announced that its staff had sent warning letters to six major companies that market and sell automobiles, cellular devices and video gaming systems. According to the FTC, the letters express concerns that the companies’ warranties may be prohibited by the Magnuson-Moss Warranty Act (which governs consumer product warranties) and the FTC Act because they “tie warranty coverage to the use of particular products or services.” The Magnuson-Moss Warranty Act provides in part that: No warrantor of a consumer product may condition his written or implied warranty of such product on the consumer’s using, in connection with such product, any article or service (other than article or service provided without charge under the terms of the warranty) which is identified by brand, trade, or corporate name. 15 U.S.C. § 2302(c). In addition to the exception for articles or services “provided without charge,” a company may apply for a waiver from the FTC if: (1) “the warranted product will function properly only if the article or service so identified is used in connection with the warranted product, and (2) the Commission finds that such a waiver is in the public interest.” 15 U.S.C. § 2302(c). The FTC staff determined that the following examples from the six companies’ warranties were problematic in light of 15 U.S.C. § 2302(c): The use of [the company’s parts] is required to keep your . . . manufacturer’s warranties and any extended warranties intact. This warranty shall not apply if this product . . . is used with products not sold or licensed by [company name]. This warranty does not apply if this product . . . had had the warranty seal on the [product] altered, defaced, or removed. The FTC Staff directed the six companies to review their warranty provisions and revise them if necessary, and informed the companies that the FTC Staff would be reviewing their written warranties and promotional materials after 30 days. Businesses that offer warranties covering consumer products would be well-advised to take a fresh look at their warranties. If those warranties are tied to use of a particular product or service, they may run afoul of the Magnuson-Moss Warranty Act unless the product or service is offered for free or the company has obtained a waiver from the FTC.

Deceptive “Made in USA” advertising and labeling claims have received a lot of attention from the FTC in recent years, reflecting the agency’s recognition that USA-origin claims are a persuasive selling point and should not be false and misleading. Many of the FTC’s enforcement actions have emphasized that “Made in USA” should not be used unless “all or virtually all” of the ingredients or components of the product are made and sourced in the United States. The same standard applies to words that are considered equivalent to “made” such as manufactured, built or produced. But what about “Assembled in the USA”? A mattress company using the ad claim “Designed and Assembled in the USA” ran afoul of FTC substantiation requirements when it turned out that the mattresses were imported from China already completed, with no assembly operations performed in the United States at all. See Complaint in In the Matter of Nectar Brand LLC. It is not surprising, then, that this ad claim was found to be deceptive. However, the Decision and proposed Consent Order provides helpful guidance about when it is appropriate to represent that a product is “Assembled in the USA.” According to the Consent Order, such a claim is substantiated if “the product is last substantially transformed in the United States, the product’s principal assembly takes place in the United States, and United States assembly operations are substantial.” (emphasis added). This is very clear guidance for companies using “Assembled in the USA” or closely analogous ad claims. As the FTC commented in its own blog post announcing the Complaint and Order, “Claims like Made in USA or Assembled in USA are more than just marketing talk to slap on a webpage or label…..Given how important USA claims are to many consumers, companies have an obligation to comply with the law. That starts with one simple principle: Tell the truth.” Definitely words to live by.

On February 26, in the wake of significant and far-reaching cybersecurity breaches (e.g., the Equifax Data Breach), the SEC published interpretive guidance to assist public companies in preparing disclosures about cybersecurity risks and incidents.  The SEC recognizes that cybersecurity threats present an “ongoing risk” to all public companies which can lead to “substantial costs and other negative consequences” including liability for stolen assets or information and repairs of system damage; increased cybersecurity protection costs, litigation and legal risks; increased insurance premiums; and damage to the company’s reputation, competitiveness, stock price and long-term shareholder value. The SEC’s new guidance reinforces and expands on its October 2011 guidance, emphasizing the importance of adopting sound cybersecurity policies and procedures and safeguards against insider trading in the event of a potentially material cybersecurity breach. Public Disclosure Requirements The SEC provides that “although no existing disclosure requirement explicitly refers to cybersecurity,” periodic reports, current reports and Securities Act and Exchange Act obligations all require public companies to disclose material risks and incidents including those related to cybersecurity. The SEC encourages companies to continue to use current report Form 8-K or Form 6-K to disclose material cybersecurity-related information promptly as this practice reduces the risk of selective disclosure. Beyond requirements explicitly found in SEC regulations, companies are also required to disclose material information and revisit previous disclosure, especially during a cybersecurity investigation, as may be necessary to ensure the company’s filings are not misleading.  Notably, companies “have a duty to correct prior disclosures that the company determines were untrue at the time it was made, or a duty to update a disclosure that becomes materially inaccurate after it is made.” The obligation to update prior disclosure is the subject of some debate, and perhaps will merit further guidance from the SEC.  According to a footnote in the guidance, the SEC bases this duty to update in Backman v. Polaroid Corp., 910 F.2d 10 (1st Cir. 1990), but acknowledges that other circuits have not found a duty to update.  Furthermore, the Private Securities Litigation Reform Act expressly disclaims any duty to update forward-looking statements.  15 U.S.C. §§ 77z-2(d) and 78u-5(d) ("Nothing in this section shall impose upon any person a duty to update a forward-looking statement.").  A duty to update prior disclosure, and the associated work and potential liability, may constrain future disclosure of cybersecurity risk. The SEC provides the following examples of factors companies should consider when evaluating their cybersecurity risk disclosure: 1) the occurrence of prior cybersecurity incidents, including their severity and frequency; 2) the aspects of the company’s business and operations that give rise to material cybersecurity risks and the potential costs and consequences of such risks; 3) the costs associated with maintaining cybersecurity protections, including, if applicable, insurance coverage relating to cybersecurity incidents or payments to service providers; and 4) existing or pending laws and regulations that may affect the requirements to which companies are subject relating to cybersecurity and the associated costs to companies. The SEC cautions that this guidance is not intended to suggest that a company should make detailed disclosures that could compromise its cybersecurity efforts.  There is no general requirement to expose potential system vulnerabilities in such a way that would make the company more susceptible to risk. However, the SEC expects that companies will provide disclosure that is tailored to their particular cybersecurity risks and incidents using company-specific, useful information as opposed to boilerplate language. The SEC guidance suggests companies adopt comprehensive policies and procedures related to cybersecurity and assess their compliance regularly.  Companies should have adequate disclosure controls and procedures in place to ensure that relevant cybersecurity information is processed and reported to the appropriate personnel to enable senior management to make disclosure decisions and certifications. These policies will not only allow the company to adhere to the SEC’s disclosure requirements but will also facilitate policies and procedures designed to prohibit directors, officers, and other corporate insiders from trading on the basis of material nonpublic information about cybersecurity risks and incidents. Insider Trading The SEC guidance provides that companies and their  corporate insiders should be mindful to adhere to the federal antifraud provisions as well as other applicable rules (such as codes of conduct required by exchanges) related to insider trading in connection with information about cybersecurity risks and incidents.  The SEC guidance advises companies in the midst of investigating significant cybersecurity incidents to consider implementing restrictions on insider trading in their securities to prevent corporate insiders from trading on the basis of material nonpublic information before the incident has been publicly disclosed, and to avoid the appearance of improper trading. Conclusion Companies are facing rapidly evolving cybersecurity threats.  It is increasingly important for companies to investigate and refine their own disclosure policies and procedures to ensure a momentary lapse in cybersecurity judgment does not culminate in unnecessary damages to the company or SEC enforcement actions.  The new SEC cybersecurity guidance can be found in its entirety here.

Use of profanity by employees, whether in the workplace, outside the workplace, or on social media, presents difficult legal issues for the employer, as highlighted by a recent Second Circuit Court of Appeals decision overturning the firing of an employee who engaged in a highly profane Facebook rant against a supervisor. Although an employer has a justifiable interest in keeping profanity out of the workplace, its interest does not overshadow an employee’s Section 7 protected rights to engage in concerted activity under the National Labor Relations Act (“NLRA”). In yet another NLRA-social media decision (see here and here), the court considered whether the vulgar and offensive language – directed at a supervisor – in an employee’s statement advocating for unionization is protected activity under the NLRA. See NLRB v. Pier Sixty, 855 F.3d 115 (2d Cir. 2017).  The court held that language was protected and overturned the company’s termination of the employee in question. Two days before a union election, an employee posted the following statement on Facebook: Bob is such a NASTY MOTHER F***ER don’t know how to talk to people!!!!!! F*** his mother and his entire f***ing family!!!! What a LOSER!!!! Vote YES for the UNION!!!!!!! The post was visible to the public for three days before the employee took it down. Company management saw the post before it was removed and terminated the employee. An unfair labor practice charge followed shortly afterward, alleging a violation of section 8(a)(1) of the NLRA. Section 7 of the NLRA guarantees employees the right to “self-organization, to form, join, or assist labor organizations . . . and to engage in other concerted activities for the purpose of collective bargaining or other mutual aid or protection.”  29 U.S.C. § 157 (emphasis added).  Section 8(a)(1), in turn, protects these rights by prohibiting employers from interfering with, restraining, or coercing employees in the exercise of these rights.  29 U.S.C. § 158(a)(1).  Ordinarily, an employer is prohibited from discharging employees for participating in union-election activity, and the employee’s Facebook post did explicitly call for a pro-union vote in the upcoming election.  But the protections of the NLRA are not absolute.  The National Labor Relations Board (“NLRB” or “Board”) has long held that an employee engaged in “ostensibly protected activity may act in such an abusive manner that he loses the protection” of the NLRA. See NLRB v. City Disposal Sys., Inc., 465 U.S. 822, 837 (1984). Here, the NLRB had ruled in favor of the employee. The Second Circuit upheld the Board, agreeing that the statement came close to, but did not cross, the line.  The Board and the court applied a “totality-of-the-circumstances” test.  Although the court gave considerable deference to the Administrative Law Judge’s factual findings (which were upheld by the Board), employers can find some comfort in the court’s note that the post seems “to sit at the outer-bounds of protected, union-related comments.” The court provided several reasons for its decision: First, although the post can be characterized as “dominated by vulgar attacks” on the supervisor, the message addresses the workplace concern of how management treats employees, qualifying the post as “concerted activity for the purpose of collective bargaining.” Second, profanity among employees had been consistently tolerated by the employer, so it could reasonably be inferred that the employee was not fired for mere profanity, but for the protected, union-related content of the comment. Third, the employer had engaged in other unlawful, anti-union conduct as the election approached, including threatening pro-union employees with the loss of their jobs or benefits, and by implementing a “no talk” rule prohibiting discussion of union issues. Fourth, the court gave some weight to the fact that this post was made on Facebook—“a key medium of communication among coworkers and a tool for organization in the modern era,” and that the employee apparently (although erroneously) believed the post would not be publicly available. The court found that the Facebook posting was different from an outburst in the presence of customers. Accordingly, there are a few takeaways for employers to keep in mind. Implement a Clear, Written Policy. To effectively discipline employees for using offensive or vulgar language at the workplace, employers should have a clear written policy against profanity that informs employees of the rules regarding the use of profane or vulgar language in their interactions with colleagues and customers. The policy should specify the consequences for violations. Enforce the Policy Consistently and Uniformly. Employers should be consistent in enforcing any policy against profanity in the workplace. Past failures to enforce or to impose appropriate sanctions may tie the employer’s hands in future situations where a sanctionable activity may arguably be clothed with NLRA-protection. (Consistency would necessarily include, for example, applying the policy to profanity by supervisors and managers as well as by line employees. The employer’s tolerance of profanity by supervisors was cited by the court as proof of inconsistent enforcement.) Consistent and uniform enforcement of the policy is key. Be Careful Not to Limit Protected Activities. The enforcement of a policy against profanity or other inappropriate conduct must be balanced against an employee’s right to engage in protected activities under the NRLA. The employer’s other anti-union conduct in the Pier Sixty case was a factor in the decision. The Pier Sixty court has made clear that not all offensive language loses NLRA-protection. This decision confirms courts’ willingness to broadly construe the coverage of the NLRA, especially when considering employee activities on social media. Employers should carefully consider the context of potential profanity policy violations before taking disciplinary actions. When faced with the question of whether to fire an employee who uses vulgar and offensive language in a Facebook post directed at a supervisor and her family, you should first determine whether the subject matter of the Facebook comment touches on any workplace concerns. If not, there may not be NLRA- protected conduct. But if the subject matter—notwithstanding the vulgarity—is arguably related to working terms and conditions, you should take extra caution to make sure that any discipline will not run afoul of the NLRA. Consider the company’s practice with regard to policing profanity at work. If the company has tolerated profanity use among its employees in the past, you may not be in a good position to sanction an employee for a statement that, although offensive, may be protected under the NLRA. Rebecca Bernhard, David Y. Trevor and Jillian Kornblatt are members of Dorsey’s Labor & Employment practice group and are regular contributors to Dorsey’s Quirky Questions blog. The Quirky Questions blog addresses unanticipated, real life employment questions.