Trademark, Copyright + Advertising

A deepfake is an image or video of a person, often a celebrity, who has been digitally altered using an artificial intelligence (“AI”) application to appear to be someone else. Deepfake technology has the potential to be either a boon or a bane to celebrities. As a boon, celebrities can use deepfake technology to extend their professional opportunities. For example, Bruce Willis licensed his likeness to AI-based content creation company, Deepcake, to create a “digital twin,” which was used in a Russian telecom commercial. Even though Willis might have health issues that limit some activities, his digital twin effectively allows Willis to continue his professional career indefinitely, regardless of his health or age, and without the need for his physical presence. Deepfake technology can also be a bane to a celebrity when used to exploit their likeness without compensation or authorization, which is the alleged situation in Kyland Young v. NeoCortext, Inc., No. 2:23-cv-02496-DSF-PVC (C.D. Cal.). Defendant NeoCortext’s deepfake app, Reface, allows a user to swap their face with someone else, including a celebrity, but the celebrity has not necessarily authorized NeoCortext or the user to show or manipulate their likeness. Reface uses the likeness of former Big Brother contestant, Kyland Young, among others, without authorization. Consequently, Young filed a complaint against NeoCortext on April 3, 2023 asserting a single cause of action—violation of the California Rights of Publicity Statute (Cal. Civ. Code § 3344). Young filed the case as a putative class action on behalf of an indefinite number of other similarly situated citizens of California. California’s Right of Publicity Statute protects individuals from having their likenesses used by others, knowingly and without permission, on products or to advertise or sell goods and services. Young claims that NeoCortext has violated this statute by using his likeness, and the likeness of other celebrities, to encourage users to pay to upgrade their version of the app. The basic version of Reface is free. It includes access to the Reface “Pre-sets catalogue” which, according to Reface’s Terms of Use, is a library of images and videos to use for face swapping that may include third party content from a variety of publicly available sources, such as mybestgif.com, Google Video, and others. Young alleges that the Pre-set catalogue contains images and videos of himself and many other celebrities, often including their most famous and recognizable scenes and appearances. This suggests that in addition to rights of publicity claims like Young’s, NeoCortext might also be at risk of copyright infringement claims from whoever owns the rights to those scenes and appearances. Young alleges that when a user initially opens the app, it shows them a background video of a user swapping his face with several celebrities and well-known fictional characters. Next, the app provides the user with access to the Pre-sets catalogue, which the user can search until they find an individual they want to become. They then upload their own image or video to the app. Reface scans the user’s uploaded image or video and generates a new image or video swapping the face of the individual in the Pre-set catalogue with the face from the user’s uploaded image or video. An image generated by the free version of the app contains a prominently-displayed, irremovable watermark stating “made with reface app.” The free version of the app also has a button labeled “Watermark” that shows a picture of a water drop crossed out. Clicking that button prompts the user to upgrade to the “Pro Version” of Reface for a monthly subscription fee or a single lifetime payment, which allows the user to generate deepfakes without watermarks. Young alleges that NeoCortext commercially exploits his likeness and the likenesses of other class members to promote paid subscriptions in two ways: (1) allowing users to pay to remove watermarks which detract from the images; and (2) using watermarks as free advertising to attract new users to Reface. This case is in its very early stages and remains pending. This case is a reminder that creators and users of deepfake apps and other generative AI technology should be mindful of third party rights, especially when they exploit those rights for their own commercial benefit. An image or video is not in the public domain merely because it is available on a public website, and different rights in a work (e.g., rights of publicity and copyright) might have different owners and restrictions. Moreover, while the face swapping by apps like Reface appears to go only one way (i.e., replacing the face of an individual in the Pre-set catalogue with a face in an image uploaded by the user), creators whose apps allow face swapping in the other direction (i.e., putting a celebrity’s face onto someone else’s body), could give rise to even more issues.

In a recent decision, the Federal Circuit approved the use of “Copyrightability Hearings.” Not sure what that means? Read on to find out. The case involved a dispute between two parties, SAS Institute, Inc. (“SAS”) and World Programming Limited (“WPL”). SAS created and markets a suite of software used for data access, management, analysis, and presentation, while WPL markets a competing system. Both systems generally allow users to input data in a specified format, then perform various functions depending on the users’ needs, and output resulting data. In the case, SAS alleged that WPL infringed several copyright registrations covering SAS’s system. The Federal Circuit decision is the latest development in a lengthy and contentious relationship between the parties, who have been suing each other since at least 2009. In its decision, the Federal Circuit considered whether nonliteral elements of SAS’s system are protected by SAS’s copyright registrations. The nonliteral elements at issue here include input formats—the vocabulary and syntax that dictate how users input their data—and output designs—the format and type of data that is generated and displayed to the users. The case began in the U.S. District Court for the Eastern District of Texas, where both parties moved for summary judgment on the eve of trial. SAS sought an order that the nonliteral elements are protected by copyright, while WPL sought an order that the nonliteral elements are not protected. In the District Court Decision, Judge Gilstrap noted that this put the Court in a tough position. The Court either had to grant one party’s motion or it had to deny both motions and let the copyrightability issue to go to trial. As copyrightability is a question of law for the Court to decide, letting it go to trial would risk “injecting copyrightability into the jury trial” and risk confusing the jury during its infringement analysis. To solve this issue the District Court conducted a “Copyrightability Hearing” to determine what the “core protectable expression” of each of SAS’s works is. Specifically, each party was asked to submit briefing and evidence in support of its position as to the copyrightability of the nonliteral elements. Following the hearing, Judge Gilstrap found that WPL showed that nonliteral elements of SAS’s system were not protected by copyright because some elements are present in SAS’s earlier system, SAS 76, and are now in the public domain, others are open-sourced and available to the public, and still others are well-known, conventional, or not original to SAS. The Court then found that SAS failed to show which nonliteral elements are protectable and instead argued that all of the elements are “creative.” Accordingly, the District Court found the nonliteral elements are not protected and dismissed SAS’s claims. On appeal, SAS argued that the Copyrightability Hearing was a novel procedure that was contrary to the Federal Rules of Civil Procedure. The Federal Circuit disagreed. It cited the well-settled rule that district court judges have discretion to manage their cases and to conduct reasonable pre-trial procedures to narrow the issues in dispute for trial. The majority opinion also relied on an analogy to patent law, citing Markman v. Westview Instruments, Inc., the case that spawned the now-standard Markman hearing designed to ascertain the scope and meaning of patent claims before trial. In short, the majority ultimately viewed the Copyrightability Hearing as nothing more than a pre-trial conference within the District Court’s discretion. SAS also argued that the District Court improperly placed the burden on SAS to prove that the nonliteral elements of its system are protected by SAS’s copyright registrations. SAS instead believed its copyright registrations entitled it to a presumption that the elements are protected. The Federal Circuit was split on this issue. The majority opinion, authored by Circuit Judge Reyna, affirmed the District Court’s decision, while the dissenting opinion, authored by Circuit Judge Newman, would reverse and remand. The majority opinion clarified that while copyright registrations establish a threshold showing of protectability, if the accused infringer presents evidence that elements of the work are not protected, the burden then falls on the copyright holder to rebut that evidence. Here, after WPL showed that several of the elements are not protectable, SAS failed to show that any of the nonliteral elements of its system are protected by its copyright registrations. The dissenting opinion expressed concern that the majority’s analysis is a “far-reaching change” to the question of copyrightability that would have a significant impact on the software industry. In that regard, the dissent cited a litany of cases finding that nonliteral elements of software programs, even those that may be well-known or pre-existing, are copyrightable when selected and arranged in a creative or original way. The opinion then faulted the District Court and the majority opinion for requiring the parties to engage in “filtering”—isolating protected and non-protected elements—which is “developed for determinations of infringement.” In the dissent’s view, because SAS has valid copyright registrations and had a non-frivolous argument that the selection and arrangement of its system was sufficiently creative, this case should have proceeded. It remains to be seen whether the majority’s opinion will bring “far-reaching change” to the protectability of software programs. It also remains to be seen whether “Copyrightability Hearings” become standard practice for courts faced with similar issues. In view of this decision, however, plaintiffs should be prepared to clearly explain what is – and what is not – protected by their copyright registrations. This may not be the last word on this dispute. Given the decades of litigation between the parties, the novel issues, and a split opinion from the Federal Circuit, an appeal to the Supreme Court may be forthcoming.

In 2018, the U.S. Copyright Office denied the registration of a 2-D work of art “A Recent Entrance into Paradise” generated by artificial intelligence (“AI”). The programmer behind the AI, Dr. Stephen Thaler, sued the Copyright Office sued the Copyright Office in Federal Court in D.C. in June 2022. We covered Thaler’s initial suit and his attempts to patent an AI-generated invention in previous TMCA articles. Thaler moved for summary judgment in January 2023 as to the legal issue alone – whether an AI-generated work is copyrightable . The Copyright Office cross-moved for summary judgment in February, and Thaler filed a reply brief on March 7th. In support of these dueling summary judgment cross-motions, the parties doubled down on their initial arguments. Thaler offered a creative view of how copyright law could adapt to accommodate AI-generated works. Specifically, Thaler argued that a programmer is analogous to an employer and is therefore the owner of the artwork created by the employee-like AI under the work for hire doctrine. The AI was like an employee, according to Thaler, because Thaler controlled the AI, directed the AI to create the 2-D artwork, and owned the AI. In its brief, the Copyright Office restated that copyright protection requires human authorship of the expressive elements of the work. In other words, a work of art is not registrable if a human merely typed a command into an AI program to create it. Rather, the human must direct the creative contents of the work. Perhaps the most surprising element of the motions was the Copyright Office’s hint at the end of its motion that more guidance on AI was forthcoming. Not long after, on March 10, 2023, the Copyright Office unveiled a Statement of Policy regarding works incorporating AI generated content, further articulating the lines drawn in its brief. We covered the intricacies of the policy in our recent TMCA post. The good news is works generated using AI can be registered with the Copyright Office, but only by virtue of a human author’s creative additions to the AI-generated content. The central inquiry is whether the human author (and not the AI) had creative control over the expressive elements of the work. The policy is likely cold comfort for Thaler, who claimed the artwork “A Recent Entrance into Paradise” was autonomously created by the AI, i.e., without control from Thaler. The policy statement also did not give any credence to Thaler’s work for hire analogy. The Copyright Office’s guidance might bring the landscape into focus for prospective applicants, but it may be too late for Thaler’s current masterpiece. The summary judgment motions are still pending before the district court. We will continue to monitor this developing issue, including the Copyright Office’s promise to hold a public comment period later this year.

The crinkle sound of the gold foil. The rich smell of honey and almond. The unique design of peaks and valleys. And the delicious taste of Swiss chocolate. There is little doubt that since its creation in 1908, Toblerone-branded chocolate has made a name for itself in the chocolate world. But one of its original and defining characteristics has recently been cast into doubt—its “Swissness.” In 1868, Jean Tobler opened a confectionery shop in Bern, Switzerland that was an immediate success and grew into a chocolate factory by 1899. A decade later, Jean’s son, Theodor Tobler and his cousin, Emil Baumann, invented a unique and innovative chocolate bar, a special recipe of milk chocolate, almond-based nougat, and honey formed into a distinct triangular shape. Theodor named this new confection “Toblerone,” a combination of his last name, “Tobler,” and “Torrone,” the Italian word for honey and almond nougat. The chocolate bar’s popularity and international recognition only grew from there, including a feature at the 1964 World’s Fair in New York City and the Expo in Montreal in 1967. In 1969, different varieties of the chocolate where introduced, and in 1970, the now infamous packaging was changed to add a depiction of the Matterhorn in the Swiss Alps, Switzerland’s highest and most famous mountain. Since this time, packages of Toblerone has included various indicators that the chocolate bars were manufactured in Switzerland, including the Matterhorn icon and statements like “of Switzerland,” and “Swiss milk chocolate.” Until recently, Toblerone was undoubtedly “Swiss,” as every chocolate bar bearing the Toblerone name since 1908 has come from Switzerland. But in late 2022, Mondelez International, the now owner of Toblerone, announced that some—but not all—of the chocolate bar’s production would be moved from its location in Bern, Switzerland to Bratislava, Slovakia in July 2023. And this decision has cost it its “Swissness.” Effective January 1, 2017, the Swiss government enacted legislation to protect the “Swissness” of the goods and services emanating from the country, with the goal of protecting the “excellent reputation” Swiss indicators of source enjoy both domestically and abroad. The legislation regulates the “Made in Switzerland” statement, the Swiss cross designations, and images of the iconic Matterhorn mountain, all of which the Swiss government views as part of the overarching Swiss brand. The Swiss government notes that “Swiss products and services are associated with exclusivity, tradition and quality, with their goods reputation inspiring confidence in the product or service in question and ultimately influencing the consumer’s buying decision.” As an added benefit, strict regulation surrounding these Swiss designations provide a clear competitive advantage for manufacturers and service providers who are able to demand a higher price for their “Swiss”-branded fares. This law stems from an intellectual property principal recognized in Europe and elsewhere in the world, but not in the United States, known as “geographic indicators.” Geographic indicators, which we have previously written about, are used to label products that directly specify a product’s particular geographic origin, like “champagne” from France or “parmigiano reggiano” from Italy. Technically speaking, sparkling wine from California cannot bear the “champagne,” “prosecco,” or “cava” labels, nor can cheese from Wisconsin be called “gouda” or “feta.” Certain geographic indicators can be registered under the European Community regulations, which in turn confers certain exclusive rights to the registered owner and protects the association of certain food and beverage characteristics within that particular geographic region. The 2017 “Swissness” law falls under this geographic indictor of intellectual property protection. Anyone wishing to use a “Swiss” designation on products or in connection with rendered services must meet strict criteria in proving they are “Swiss” enough. As is relevant to Toblerone’s confections, to qualify as “Swiss,” at least 80% of the raw materials used to create foodstuffs must originate in Switzerland. However, for milk and dairy products in particular—under which chocolate falls—the weight of milk as the raw material must equal 100%. Further, essential processing for milk products must be done inside the country, with few exceptions. In short, milk products must be made exclusively in Switzerland in order to use Swiss designations. Mondelez International’s decision to move its production of Toblerone chocolate to Slovakia defies this exclusivity, and therefore, is no longer deemed “Swiss.” Although some Toblerone chocolate will still emanate from the Bern factory, in order to comply with this “Swissness” law, Mondelez International announced plans to replace the Matterhorn with a more generic mountain-shaped icon, and will instead state that the chocolate was “established in Switzerland 1908,” instead of being “of Switzerland.” Some may view this Swissness law as overly strict, but others, including the Swiss government, see it as necessary to protect the strength and reputation of its brand. Citing consumer surveys, the Swiss government as justified this legislation by claiming the value Swiss branding adds to goods is as much as 20% of the sales price, and nearly 50% for luxury goods. While the benefit to companies and goods manufacturers is clear, it is equally as strong for consumers, who can rest assured that products bearing the Swiss cross or “made in Switzerland” statements are, in fact, Swiss. Despite the fact its product packaging is changing and it may not be “Swiss” anymore, Mondelez has reassured Toblerone fans and chocolate connoisseurs alike that the recipe, taste, and distinctive product shape of the famous chocolate bars will stay the same.

On February 1, 2023, the Federal Trade Commission (FTC) filed a complaint in the U.S. District Court for the Northern District of California alleging that digital health platform GoodRx violated the FTC Act by repeatedly sharing personal health information with advertising companies and platforms, such as Facebook and Google, and failed to report the unauthorized disclosures pursuant to its Health Breach Notification Rule (16 C.F.R. § 318).  Though GoodRx maintains that it shared all health information appropriately, according to the proposed stipulated order, the digital health platform has agreed to pay a $1.5 million civil penalty.  Once the proposed order is approved by a federal court judge, the monetary penalty, as well as several non-monetary sanctions, will go into effect.  This settlement may signal the beginning of a new era of health privacy enforcement, where the Health Insurance Portability and Accountability Act of 1996 (HIPAA) is not the only federal health privacy law for which organizations must ensure compliance. The FTC’s Health Breach Notification Rule is not new—even though the GoodRx complaint marks its first enforcement action.  The rule went into effect in September 2009 and was the subject of a 2021 FTC policy statement.  Substantively, the Health Breach Notification Rule is very similar to HIPAA’s Breach Notification Rule (45 C.F.R. §§ 164.400-414).  Pursuant to both rules, a data holder must notify the subject of any unsecured “individually identifiable health information” and the agency responsible for enforcing the applicable rule in response to a breach of such information.  Also pursuant to both rules, if a breach of unsecured personal health information involves more than 500 individuals (and, in the case of the Health Breach Notification Rule, if a breach involves exactly 500 individuals), the data holder must notify the media. The primary differentiating factor between the rules are the types of entities to which they apply.  The HIPAA Breach Notification Rule is specific in scope and only applies to Covered Entities and their Business Associates.  A Covered Entity is limited to a: (1) health plan, (2) health care clearinghouse, or (3) health care provider, who also electronically transmits health information in connection with transactions for which HHS has adopted standards.  A Business Associate is a person or entity who, on behalf of a Covered Entity, performs or assists in performance of a function or activity involving the use or disclosure of individually identifiable health information. The FTC’s Health Breach Notification Rule is broader in scope and applies to all vendors that “offer or maintain a personal health record (PHR).” A PHR is an electronic record of “individually identifiable health information,” as defined in section 1171(6) of the Social Security Act (42 U.S.C. 1320d(6)), that can be drawn from multiple sources and that is managed, shared, and controlled by or primarily for the individual. The FTC has stated that an example PHR Vendor might be a health app that collects information from consumers and can sync with a consumer’s fitness tracker. The Health Breach Notification Rule also applies to “PHR related entities” and “third-party service providers.”  A PHR Related Entity interacts with a PHR Vendor by either offering products or services through the Vendor’s website, offering products or services through a Covered Entity’s website that offers individual’s health records, or by accessing information in a PHR or sending information to a PHR.  The FTC states that an example of a PHR Related Entity might be a company that offers a fitness tracker and sends information to health apps.  A Third Party Service Provider is an entity that provides services to a PHR Vendor in connection with the offering or maintenance of a PHR or to a PHR Related Entity in connection with a product or service offered by that entity; and accesses, maintains, retains, modifies, records, stores, destroys, or otherwise holds, uses, or discloses unsecured PHR identifiable health information as a result of such services.  The FTC states that an example of a Third Party Service Provider might be a company that provides billing, debt collection, or data storage services relating to health information for a PHR. In light of the GoodRx complaint and the FTC’s enforcement of the Health Breach Notification Rule, all entities that utilize or maintain personal health information—and especially those offering healthcare apps, connected devices, and wearables, that often do not fall under the definitions of Covered Entities and Business Associates—should evaluate the applicability of the Health Breach Notification Rule to their organization and its business practices.  Entities that fall under the definitions of PHR Vendor, PHR Related Entity, and Third Party Service Provider, should be sure to have an effective privacy and security program in place, including procedures for conducting regular risk assessments and risk management trainings to ensure proper identification of and response to a breach of personal health information.  Such entities should also review their privacy policies, both internally and externally-facing, to ensure they reflect current data-sharing practices, and should review their vendor contracts to take inventory of any permissions or restrictions on how personal health information is used and disclosed to ensure they are obtaining the necessary consent. For more information on the Health Breach Notification Rule, the FTC’s Health Privacy webpage offers a variety of resources—including a simplified explainer of the rule, compliance tips, and an interactive tool geared toward mobile health apps.

This blog has covered artificial intelligence and copyright protection in the United States on a number of occasions, including It's Alive? and AI Artwork. To date, the Copyright Office has consistently rejected registration of works created using AI technology. The basis is that the Copyright Office and copyright case law have interpreted the term “authorship” from the Copyright Act to exclude non-humans. The current version of the Compendium of U.S. Copyright Office Practices indicates that “to qualify as a work of ‘authorship’ a work must be created by a human being.” The Copyright Office recently signaled a willingness to move away from a rigid approach to AI-created works when it approved registration of a graphic novel named Zarya of the Dawn consisting of human-authored text and AI-generated imagery. The scope of registration, however, was limited only to the human-authored text in the graphic novel. Because AI-generated works will continue to be created and the Copyright Office has seen an influx of applications to register such works, the Copyright Office determined that public guidance is necessary specifically for registration of works created utilizing AI-technology or containing AI-generated content. Accordingly, on March 16, 2023, the Copyright Office released a statement entitled “Copyright Registration Guidance: Works Containing Material Generated by Artificial Intelligence.” In this policy statement, the Copyright Office provides two types of examples of use of AI technology and indicates that “what matters is the extent to which the human had creative control over the work’s expression and ‘actually formed’ the traditional elements of authorship”: When AI technology determines the expressive elements of the output, the work will not be protectable because it is not the product of human authorship. When a human being selects or arranges AI-generated material in a sufficiently creative way, then the work will be protectable as to the human-authored aspects of the work. The Copyright Office affirms that an applicant must disclose the inclusion of AI-generated content in any works submitted for registration. In the “Author Created” field of an application, the applicant must provide an explanation of the human author’s contributions to the work. AI-generated content that is more than de minimis must be explicitly excluded from the application. The AI machine or the company who provided the AI technology does not need to be listed as an author in the application. Applicants are also encouraged to use the “Note to CO” field on the application to provide any additional information that will be useful to an examiner in reviewing the application. If applicants already have applications pending that do not meet the foregoing requirements, they should contact the Copyright Office’s Public Information Office to request that a note be added to the record about the use of AI for the examiner to consider when reviewing the application. If registrations have already been issued that require correction, then the registrant needs to submit a supplementary registration request to correct or amplify the information in the registration record. Finally, the Copyright Office notes that applicants who fail to comply with these policies and obtain registrations risk losing the benefits of the registration and that the Copyright Office may take steps to cancel any non-compliant registrations it discovers. Ultimately, this guidance from the Copyright Office does not change the underlying rules of the game. Works must still have elements of human authorship to be eligible for registration. But use of AI technology to create works of authorship will not be considered a disqualifying factor.

When you hear the word “gruyere,” what comes to mind? A bucolic region in the mountains of Switzerland? Perhaps the Gruyère region of neighboring France? Or, more likely, you think of a type of cheese. Not just any old cheese though – according to the Oxford Companion to Cheese, gruyere cheese is “widely considered among the greatest of all cheeses.” In a delightfully cheese-pun stuffed decision, the Fourth Circuit Court of Appeals recently held that U.S. cheese consumers primarily think of “gruyere” as a type of cheese, rather than a product specific to the Gruyère regions of Switzerland and France. As such, the Court found that the term “gruyere” was too generic to warrant a certification mark of geographic origin. As the Fourth Circuit explained, gruyere cheese originated in the district of La Gruyère in the Canton of Fribourg, Switzerland, in 1115 AD. The original area of production expanded to include other areas of Switzerland and certain neighboring areas of France. According to sources the court quoted, Swiss and French gruyere “producers make cheese from the unpasteurized milk of cows that graze on alpine grasses.” As is common in Europe, Switzerland and France have approved “Gruyère” as a protected designation of origin and a protected geographical indication, respectively. Those designations set forth detailed requirements for the gruyere production process, including that the cheese only be produced in specified areas of Switzerland and France. The U.S., however, does not extend similar protections to gruyere cheese. While the FDA has a general standard of identity of “Gruyere cheese,” that standard does not impose any geographic restrictions on where gruyere-labeled cheese can be produced. It’s no surprise that, as a result, cheese from all over the world – as well as from U.S. states such as Wisconsin and Idaho – has been labeled and sold as gruyere in the U.S. for decades. Of course, it’s also not a huge surprise that Swiss and French gruyere producers aren’t terribly keen on (maybe even cheesed off about) what the court termed “the indiscriminate labeling of cheese as gruyere in the United States.” In 2015, a Swiss and a French gruyere consortium (appellants in the Fourth Circuit case) teamed up to file an application with the USPTO to register the word “GRUYERE” as a certification mark. The intended mark would certify that the cheese originates in the Gruyère region of Switzerland and France, and would preclude any cheese produced outside that region from using the “GRUYERE” label. However, a group of U.S. dairy producers/importers (appellees in the Fourth Circuit) opposed the certification mark, arguing that the term “gruyere” was generic as to cheese and therefore not eligible for the certification. The TTAB agreed with the Opposers that “GRUYERE” is generic and could not be registered as a certification mark. After the Consortiums challenged that decision in a Virginia district court, the district court reached a similar conclusion and granted summary judgment for Opposers. The Consortiums then appealed to the Fourth Circuit, which noted that “[l]ike a fine cheese, this case has matured and is ripe for our review.” (Given the number of cheese puns in the decision, one wonders if the judges and their clerks nibbled on some gruyere while drafting the opinion.) The court began with a brief but helpful refresher course on certification marks, including indications of regional origin. The federal Lanham Act, 15 U.S.C. § 1127, defines a certification mark as “any word, name, symbol, or device, or any combination thereof” that is used “to certify regional or other origin, material, mode of manufacture, quality, accuracy, or other characteristics of such person’s goods or services or that the work or labor on the goods or services was performed by members of a union or other organization.” The court explained that, unlike a typical trademark, a “geographic certification mark is not used by the owner of the mark; rather, the owner of the certification mark controls how others use the mark.” Certification marks are, however, registrable “in the same manner and with the same effect as are trademarks.” 15 U.S.C. § 1054. Of course, this means that the same standards apply – including that a generic name (i.e., the name of a class of products or services) is ineligible for registration as a certification mark. The Fourth Circuit noted that the “critical issue in genericness cases is whether members of the relevant public primarily use or understand the term sought to be protected to refer to the genus of goods or services in question.” In this case, the issue was whether the cheese-consuming public primarily understand the term “GRUYERE” as referring to a type of cheese (i.e., generic), rather than indicating that the cheese was produced in the Gruyère region of Switzerland and France (i.e., non-generic). The district court had granted summary judgment to Opposers on the basis of three categories of evidence. First, the FDA standard of identity for “Gruyere cheese” indicates the mark is generic. Second, the district court held that USDA import data (which showed the prevalence of imported gruyere from countries other than Switzerland and France), as well as evidence of domestically produced gruyere-labeled cheese, favors a finding of genericness. Third, the district court found that “common usage” of the term gruyere shows that it is generic. On appeal, the Fourth Circuit agreed with the district court that the FDA standard of identity for “Gruyere cheese,” which does not contain any geographic restrictions on where the cheese can be produced, supports a finding that the term “GRUYERE” is generic. The court noted that, while the FDA standard of identity for “Gruyere cheese” does not preclude registration of the “GRUYERE” certification mark, that standard of identity “presents strong evidence that GRUYERE is a generic term.” Moving on to the second category of evidence (non-Swiss/French imports and domestically produced gruyere), the Fourth Circuit agreed with the Consortiums that the district court made an improper inference from the USDA import data. Specifically, the district court erroneously concluded that that data showed that the majority of gruyere-labeled cheese imported into the U.S. was from countries other than Switzerland and France, when that was unclear at best. Unfortunately for the Consortiums, despite this improper inference, the Fourth Circuit nonetheless held that “a substantial quantity of cheese has been imported to the United States from countries other than Switzerland and France and sold to consumers as gruyere.” Similarly, while conceding that some of the Consortiums’ criticisms of the domestically-produced gruyere cheese evidence had merit, the appellate court still concluded from the evidence that millions of pounds of domestic-produced cheese are sold as gruyere in the U.S. Next, the Fourth Circuit discussed the evidence of common usage of the term gruyere. Yet again, the court found that even though the district court had made mistakes, they didn’t impact the conclusion. The district court had first looked at various dictionary definitions of the term gruyere and concluded that most of those definitions did not limit the meaning of gruyere to cheese produced in Switzerland and France. But, as the Consortiums pointed out, some definitions do define “Gruyere cheese” as being produced or originating in Switzerland or France. Thus, the Fourth Circuit held that the district court erred in concluding from dictionary definitions of gruyere that the term was generic. But the district court had also considered references to gruyere in the media, and the Fourth Circuit agreed that those references – many of which described gruyere as originating in places other than Switzerland and France – supports a finding of genericness. Finally, the Fourth Circuit addressed the Consortiums’ argument that summary judgment was improper because Opposers failed to provide consumer survey evidence. In the court’s words, that “argument slices the cheese too thinly.” While survey evidence is common in genericness cases, it is not mandatory and evidence of consumer understanding of a mark may be obtained from any competent source. In sum, the court held that because the evidence made clear that cheese consumers in the U.S. understand “GRUYERE” to refer to a type of cheese (and not cheese from a particular region), the term is generic and the district court properly granted summary judgment to Opposers.

In order to strengthen the protection of the intellectual property rights and improve the quality control of trademark prosecution and enforcement, China issued a number of new regulations and practice guidelines in late 2022. The purpose of the new regulations, which were issued by the China National Intellectual Property Administration (the “CNIPA”) and the State Market Supervision Administration (the “State MSA”), was to further guide and regulate trademark practice as well as trademark agency conduct. In addition, on January 13, 2023, the CNIPA published the Draft Amendment of the PRC Trademark Law for Public Comments. The State MSA also published the Draft Amendment of the PRC Anti-Unfair Competition Law for Public Comments on November 22, 2022. This post will provide a brief update on these recently published regulations and guidelines regarding trademark practice in China, including highlighting the aspects that are relevant to foreign brand owners and foreign trademark practitioners. 1. Detailed Rules on Administration and Supervision of the Conduct of Trademark Agencies In China, most of the trademark applications are filed in the PRC Trademark Office through agencies such as law firms or companies that provide IP services. For foreign brand owners, a frequent concern and challenge in China is the prevalence of trademark squatting activities. As part of the Chinese government’s efforts to tackle this problem, the 2019 PRC Trademark Law seeks to address this problem by regulating these trademark agencies’ practice and conduct. For example, Article 19 of the PRC Trademark Law imposes certain duties on trademark agencies and prohibits certain conduct. A trademark agency violating any of those provisions under Article 19 may be penalized under Article 68 of the PRC Trademark Law. On October 27, 2022, the State MSA issued the Rules on Administration and Supervision of Trademark Agencies (the “Trademark Agencies Rules”), which came into effect on December 1, 2022. These new Rules supplement the general provisions (such as Articles 19 and 68 mentioned above) under current PRC Trademark Law and its implementation measures with respect to the practice and the conduct of trademark agencies in China. Specifically, Section 29 of the Trademark Agencies Rules explains what constitutes “disturbance to the market order of trademark agencies by way of slander or other improper means” under Article 68(2) of the PRC Trademark Law by setting out ten (10) specific practices that are prohibited. One of practices that is prohibited under Section 29(1) is for a trademark agent to accept an instruction to file a trademark application knowing that it is for a mark that is taking advantage of sudden events, quick fame gained by internet celebrities, influencers, hot topics or buzz words. In September 2022, just shortly before the Trademark Agencies Rules was issued, the trademark agency Alibaba Technology (Beijing) Co., Ltd was ordered by the local MSA to pay a fine in the amount of RMB80,000 (~US$12K) for accepting instructions to file trademark applications for a trademark squatter for the mark “谷爱凌GU AI LING” and “Eileen GU”, which are the Chinese and English names, respectively, of a freestyle skier who quickly gained great fame in China during the 2022 Winter Olympic Games held in Beijing. Under Section 23 of the Trademark Agencies Rules, if a trademark agency is intentionally involved in any IP infringing activities, such as submitting a bad faith trademark application, it will not only be penalized under the PRC Trademark Law, but will also be placed on a blacklist of enterprises deemed to have engaged in illegal and/or dishonest conduct. 2. Guidelines On Avoidance of Conflict with Prior Rights in Article 32 of the PRC Trademark Law On December 7, 2022, the CNIPA issued the "Guidelines on How to Avoid Conflict with Prior Rights in Trademark Application and Use" (the “Prior Rights Guidelines”), whereby it provided further clarification on the scope of “prior rights” under Article 32 of the PRC Trademark Law. This guidance included providing case examples and guidelines on how to avoid conflict with existing prior rights when applying for trademark registration in China. The Prior Rights Guidelines expand on the list of prior rights to include rights and interest in the title of a work, the name of a famous role in a work, the name of a database or a virtual figure. Such rights have previously been recognized by various decisions of the Chinese courts. In this regard, the Prior Rights Guidelines provide a case example in which protection of an opponent’s prior rights in the name of the world’s first Chinese Vocaloid and virtual figure “LUOTIANYI” was granted by the Chinese trademark authorities. 3. Clarifications On Class 35 Services in China On December 7, 2022, the CNIPA also published another important guideline providing clarifications on Class 35 services items, namely, the “Guidelines on the Application For and the Use of Service Marks in Class 35” (the “Class 35 Guidelines”). The Class 35 Guidelines provide a detailed interpretation of the service items in Class 35 in the PRC Goods and Service Classifications. In a nutshell, the Class 35 Guidelines explain that the services covered in Class 35 refer to services that are provided to others and to assist others’ business and operation rather than to the registrant itself for its own business operation. For example, advertising and promotion of one’s own trademarked clothing products does not qualify as “advertising” services under Class 35, but instead is use of a trademark for clothing under Class 25. By contrast, the typical use of a trademark for “advertising” services in Class 35 includes advertisement planning, design, and production for a third party’s products and/or services. Although Chinese courts have made similar clarifications in adjudicating trademark cases, the Class 35 Guidelines now provide clear guidance to assist trademark practitioners in understanding Class 35 services. However, foreign brand owners should know that this does not mean that Class 35 is unimportant and a brand owner should include Class 35 in its trademark portfolio in order to obtain proper trademark protection in China. By way of example, if a clothing products brand owner does not protect its trademark rights by securing trademark registration in Class 35, its brand name may be pirated by a third party in Class 35. The third-party pirate could then use the brand name as a shop name for selling clothing products, and the brand owner would likely find it difficult to stop the third party from using the shop name even if consumer confusion was obvious. 4. New Draft Amendments to the PRC Trademark Law and the PRC Anti-Unfair Competition Law for Public Comments On January 13, 2023, the CNIPA published the Draft Amendment of the Trademark Law of PRC on its website for public comment. The draft has introduced 23 new provisions into the trademark law as well as substantive amendments to 45 provisions in current trademark law. Significant amendments in the draft include the prohibition on repeated trademark applications for the same mark in respect of the same goods or service item by the same applicant/registrant, the introduction of “promise to use” requirement, and a related mechanism to remove registered trademarks that are not in use after five years of registration. In addition, on November 22, 2022, the State MSA released the Draft Amendment of the Anti-Unfair Competition Law of PRC for public comment. We will continue to monitor any developments on these important legal changes in China and make sure to keep you updated.

When Journey was inducted into the Rock and Roll Hall of Fame in 2017, Steve Perry was ranked 76th on Rolling Stone’s “100 Greatest Singers of All Time.” Arguably, many Journey fans view the front man and his voice as the core identifier for the band and its most popular and commercially successful music. After considerable success between 1978 and 1987, Perry left the band and the band took a hiatus until 1995. Perry agreed to reunite with the band under a new manager, and the band enjoyed the success of a new album. However, in 1998, Perry left the band permanently and the face of Journey was After All These Years, changed. An Agreement between the parties in 1997, the so-called “Elmo Agreement,” set forth the terms of profit sharing. The Agreement was amended in 1998 when Perry left the band, and Neal Schon and Jonathan Cain, longtime guitarist and keyboardist for Journey (respectively), state that Perry still “receives a significant share of profits from the exploitation of the Journey song marks.” Fast-forward to Fall 2020. Freedom NJ LLC, a company run by Schon and Cain and current members of the band, filed 20 new trademark applications for well-known song titles for merchandise, including such hits as Don’t Stop Believin’, Who’s Crying Now?, Wheel in the Sky, and Any Way You Want It. All of the applications matured to registration in early 2022. Notably, none of the applications were challenged by Perry when published for opposition purposes. In September 2022, Perry filed a Petition to Cancel each of the 20 trademark registrations, alleging that the applications should not have been filed without his authorization. The 1997 Elmo Agreement states that “any use or exploitation, or grant or license of rights in or to any Group Composition(s), in whole or in part, including, without limitation, the titles thereof in connection with any product or otherwise, without the prior, written, unanimous consent of all of the Partners in each instance.” Perry, as a partner to the Agreement, was apparently not consulted about the applications. The Elmo Agreement was amended in 1998, addressing Perry’s departure from Journey, but Perry asserts that the amendment did not change the unanimous consent requirements in the Agreement of 1997. Schon and Cain subsequently assigned their interests and rights in the songs subject to the Elmo Agreement in 2019 and 2020, respectively, but Perry has not transferred any of his rights and interests. Thus, Perry asserted that the registrant, Freedom NJ, is not the owner or the user of the trademarks registrations, because Perry never provided his consent to the use or registration of the titles as trademarks for merchandise. Aside from asserting an ownership issue, Perry also alleged that the applications were fraudulent in making statements that the registrant had exclusive rights to the marks, that the marks were not in use, and that the song titles as trademarks falsely suggest a connection with Perry as the lead singer of the 20 songs. In response to the Petition to Cancel, Freedom NJ filed its Answer in early December 2022 asserting affirmative defenses, including: (1) the marks have been in use since the 1970s and 1980s with no objection from Perry; (2) Perry has received proceeds resulting from the licensing of the registered trademarks; (3) cancellation of the registrations would lead to prejudice to both Perry and Freedom NJ; (4) Perry uses a company called Pear Co. to manage assets, and both Pear Co. and Perry are signatories of the Elmo Agreement, thus Perry should not be shielded from liability through Pear Co.; and (5) Perry’s substantial income from current Journey tours and albums is in jeopardy as a material breach of the Elmo Agreement through the filing of the Petition to Cancel the registrations. Additionally, Freedom NJ asserted the following defenses: laches (Perry was not diligent in pursuing these claims), acquiescence and waiver (Perry accepted the benefits of the Elmo Agreement), bad faith and unclean hands (Perry accepted the benefits of the Elmo Agreement and breached the agreement by filing the cancellation), and breach of contract (breach of Elmo Agreement terms). On January 4, 2023, counsel for Perry withdrew the Petition to Cancel the 20 registrations, and because Freedom NJ had already filed its Answer and the withdrawal was without its consent, the Petition for Cancellation was denied with prejudice. This means that Perry cannot challenge these registrations in the future. Why did the Petition seem to take the midnight train going anywhere but the finish line at the Trademark Trial and Appeal Board? At its crux, this TTAB filing did not ever seem to be about trademarks. Rather, it was about the terms of the Elmo Agreement between the parties. Perry appears to have gained nothing but expenses by filing the Petition to Cancel the 20 registrations, all while continuing to receive financial benefit from the licenses tied to the trademarks in the interim. Did Freedom NJ welcome this outcome with Open Arms? Schon posted on Twitter a screenshot of the filing and said “So much for [Cain] trying to throw me under the bus as he claimed I was blatantly trying to rip off [Perry] while collecting the checks for the very diligent work my wife and I did to protect our merch.” Cain separately filed a lawsuit in November 2022 against Schon in California for “running up enormous personal charges on the band’s credit card account.” Perhaps Schon and Cain are also going Separate Ways. If the band members, both present and past, cannot Faithfully follow the terms of their Agreements, they surely cannot have it Any Way [They] Want it. As the Wheel in the Sky keeps on turning, we will provide updates on further developments.

How would you pronounce #law? Is it “hashtag law,” as the PTO examiner suggested would be the most common understanding, or “pound law,” as alleged by the unsuccessful registrant of #law as a service mark. And to what does it refer: a hashtag for a social media topic, or a number that can be dialed from a mobile phone to reach an attorney referral service? Law firm Pound Law, LLC filed a lawsuit against the PTO and its director, arguing that its application for #law was improperly denied. According to Plaintiff, “the #LAW mark has become widely recognized by the relevant public as a distinctive brand and as a mnemonic/vanity telephone number mark uniquely associated with the services of Morgan & Morgan,” because Plaintiff spent “hundreds of millions” of dollars advertising it since 2006. Notably, this #law apparently only applies to telephone calls made on a mobile phone; it does not work on landlines, and the firm uses the website “www.forthepeople.com” and not either Pound Law or Morgan & Morgan. The examiner, and TTAB, decided that “consumers would not perceive [Plaintiff’s] use of #LAW as a source indicator but rather only as a means to contact [Plaintiff], based on the manner of use.” The history of this mark illustrates how quickly technology has unfolded over the past 15 years. Morgan & Morgan allegedly began using #law as a mnemonic and vanity phone number in 2006—the same year Twitter was founded. A few years later, Twitter took off: it had 300,000 tweets per day by the end of 2008, which ballooned to over 50 million tweets per day by early 2010. In 2022, there were over 500 million tweets per day, a non-negligible number of them using #law to identify the subject. A Twitter search renders countless tweets from law firms to law schools, legal consultants, protestors, and coaches using #law. Is Morgan & Morgan’s use really as “unique” and “distinctive” in 2023 as it may have been in 2007? The treatment of this mark calls to mind the Booking.com saga, covered extensively in this blog. The TTAB determined that the mark “Booking.com” was not registrable on the basis that it was generic, described here. The TTAB decision was overturned by Judge Brinkema in the Eastern District of Virginia, which held that Booking.com had acquired distinctiveness, described here, but awarded fees to the PTO because the case had been brought in district court instead of appealed directly to the Federal Circuit, as described here. The Fourth Circuit affirmed the District Court’s decision that the mark is registrable, but ordered the plaintiff to pay the PTO’s fees on appeal, described here. The PTO petitioned for certiorari to the U.S. Supreme Court, which was granted as described here, and the Supreme Court ultimately ruled that Booking.com is registrable, rejecting the premise that a generic.com term is ineligible for trademark protection, described here. This also calls to mind a different source of trademark obsolescence: trademarks that have been lost due to genericide. Among these are the yoyo, the flip phone and the escalator – all of which were marks associated with one brand until they became so widely used that they no longer identify a specific brand. Will #law go the way of the yoyo, or will it follow the winding path of the Booking.com decisions? Only time will tell.

On January 5, 2023, President Biden ushered in the new year by signing into law the Protecting American Intellectual Property Act of 2022 (“PAIPA”), Pub. Law 117-336.1 PAIPA was passed with considerable bipartisan support in both houses of Congress. The new law mandates the collection of certain data on international trade secret theft so the U.S. Government can issue annual unclassified public reports listing foreign individuals and entities who knowingly take or abuse U.S. trade secrets.  PAIPA also requires the President to impose harsh legal sanctions against such named offenders, including on any entity owned or controlled by such a listed person. PAIPA reports will name foreign individuals and entities who have knowingly engaged in, benefited from, or materially assisted in the theft of U.S. trade secrets that pose “a significant threat to U.S. national security, foreign policy, or economic health.” The public PAIPA reports must also list the names of the foreign individuals who serve as the chief executive officers or board members of any listed foreign entity and of any entity that is owned or controlled by such a listed entity. Moreover, the Government’s published list must also explain the “nature, objective, and outcome of the theft of trade secrets” for each listed individual or entity. PAIPA also prescribes that any such public listing of an entity or individual as having engaged in such trade secret theft is to be an executive determination by the President and not an administrative finding of fact. However, the new law does not set forth any specific legal process or threshold of evidence to be found by the President before making such a determination. PAIPA requires the President to impose at least five different kinds of sanctions on a listed person but gives the President discretion to select from among those sanctions.2 More specifically, PAIPA allows the President to: block a listed person’s property-related transactions through economic sanctions enforced by the Office of Foreign Assets Control (“OFAC”) in the U.S. Department of the Treasury; place a listed person on the Entity List enforced by the Bureau of Industry and Security (“BIS”) in the U.S. Department of Commerce and thereby block such person’s access to any goods, software or technology that would be subject to the Export Administration Regulations (“EAR”); bar a listed person from access to any Export-Import Bank assistance; urge denial of loans to a listed person by any international financial institution of which the United States is a member; block any U.S. financial institution from lending to a listed person; if a listed person is a foreign financial institution, bar such listed person from being named as a primary dealer in U.S. government debt instruments or acting as a repository for any U.S. government funds; debar a listed person from being a federal contractor or a supplier of goods or services to the U.S. Government; block any listed person’s banking or foreign exchange transaction that is subject to U.S. jurisdiction; bar any U.S. person from investing in any equity or debt securities of a listed person; deny an entry visa to a listed individual or a corporate officer, principal, or shareholder who holds a controlling interest in a listed entity; or apply any of the above sanctions to the executive officers of a listed entity. PAIPA also states that it does not authorize or require the President to impose any sanctions on a listed person with respect to the importation of goods into the United States. Additionally, PAIPA provides the President with the power to waive the imposition of sanctions that would otherwise be required under the law if the President determines that the “national interest” would be served by such a waiver and notifies the relevant committees of Congress. Congress also inserted a “sunset” provision into PAIPA and so, unless reauthorized by Congress, this new law would expire in seven years. PAIPA contains a civil penalty provision applicable to any person who violates, attempts to violate, conspires to violate, or causes a violation of PAIPA or regulations issued under PAIPA. The amount of the PAIPA civil penalty is linked directly to the penalty prescribed under § 206 of the International Emergency Economic Powers Act (“IEEPA”),3 the amount of which was updated for inflation as of January 2023 to $356,579 per violation.4 Plainly, application of OFAC’s broad blocking powers against a PAIPA-listed person would then have immediate and profound implications for the international banking community in regard to international funds transfers by such a listed person, especially those involving U.S. dollar assets or payments made in U.S. dollars. Such banking effects would also potentially impact the payments or bank deposits of any other entities around the world that are owned or controlled by such a listed person. This new legislation thus continues a growing trend to expand the application of U.S. export control beyond the traditional and relatively circumscribed protection of export-controlled technologies for military or “dual-use” applications. As one other recent example, in October 20195 as we described here, BIS invoked its Entity List designation authority on 28 Chinese entities, including Dahua, Hikvision and several other leading electronics manufacturers for their roles in the suppression of human rights and in promoting electronic surveillance among Uyghurs and other minority Muslim populations in the Xinjiang Uyghur Autonomous Region (“XUAR”) of China. PAIPA also appears to continue another trend in which Congress requires Presidential action in certain prescribed circumstances rather than deferring to traditional Executive Branch discretion in the enforcement of laws enacted by Congress. Given the potentially dire consequences for a foreign entity or individual that could result from such a PAIPA listing, the new law may well provide a stronger deterrent to international trade secret theft committed against U.S. companies. However, it might also conceivably spur more legal disputes about whether the property allegedly stolen by a foreign person truly constitutes a “trade secret” of a U.S. company that can be subject to this law as a way to invalidate and reverse such a PAIPA listing. These new and severe consequences, along with the required publication of the details and effects of the underlying trade secret thefts, may also give U.S. companies some pause about exactly when, how and possibly even whether to report any suspected or known international trade secret theft to the U.S. Government. These annual public PAIPA listings will certainly fuel more corporate due diligence in the conduct of significant international business transactions and add to the growing family of such U.S. Government lists to be examined, such as OFAC’s Specially Designated Nationals List (“SDN List”) and Non-SDN Chinese Military-Industrial Companies List (“Non-SDN CMIC List”), the Department of Defense Section 1237 List, and the BIS Entity List. Finally, it seems virtually certain that some PAIPA-listed foreign entity or individual will eventually challenge its designation under this new law and raise due process concerns about the sufficiency of evidence considered by the President, which could lead to adoption of formal processes by which a listed individual or entity could raise a reasonable administrative challenge and seek its removal from the PAIPA listing. More may be known about the future implementation of PAIPA when and if President Biden issues a new Executive Order to delegate the duties and powers under PAIPA to other U.S. Government officials. One possibility in such an Executive Order might be to place the locus of PAIPA’s enforcement under the Secretary of Commerce (with input from other relevant senior officials such as the Attorney General and the Director of the Federal Bureau of Investigation). Historically, the Commerce Department has led in the field of intellectual property protection and has generally advocated on behalf of U.S. industries that rely on trade secrets in their intellectual property portfolios, and it is also the Cabinet department that includes the U.S. Patent and Trademark Office. 1 https://www.congress.gov/bill/117th-congress/senate-bill/1294 2 The PAIPA requirement for the President to impose five or more sanctions from all legally available legal sanctions follows the precedent of a similar mandate from Congress in the Iran Threat Reduction and Syria Human Rights Act of 2012 (“ITRSHRA”), Pub. Law 112-158. 3 Pub. Law 95-223. 4 88 Fed. Reg. 2229, 2230 (Jan. 13, 2023). 5 https://www.federalregister.gov/documents/2019/10/09/2019-22210/addition-of-certain-entities-to-the-entity-list

Since the emergence of the Internet, under current European Union rules, services that host user-generated or user-contributed content have enjoyed legal immunity from liability, provided they take down unlawful content once notified of it. This existing regime gave online platforms, such as search engines, social media platforms, e-commerce sites and numerous other digital services, the freedom to determine their own rules on how their services can be used and – most importantly – the freedom to decide to what extent they wished to enforce their terms and conditions and user policies.  This hands-off approach is now set to change dramatically with the introduction of new regulatory frameworks in the European Union and the United Kingdom for the operation of digital platforms designed to protect users from unlawful and unsafe content, which means significant new compliance obligations for the operators of such services. Each of the UK and the EU have recently produced new regimes for combatting online harm and protecting the safety of online users. In the EU, the Digital Services Act (DSA) has been accepted as law and will come into force in February 2023. While the UK’s parallel Online Safety Bill (OSB) is still the subject of parliamentary debate, it is also expected to become law in April 2023 and intends to make the UK the “safest place in the world to be online”. These new regimes will drastically change the way digital platforms need to regulate their services and reduce online harm to users. They consist of wide-reaching measures designed to minimize unlawful content and to protect children in particular from harm online, and will introduce a serious compliance burden on any online platform, regardless of size, provided it has more than a negligible UK or EU presence. The laws will apply to almost all social media and content sharing platforms. The overall intention of the regimes is to minimize the presentation of harmful content to users by placing a duty of care on the providers of that content. Once in force, it is hoped these will create a safer environment for internet users, but this will come at a cost of more onerous obligations for platforms that host user-generated content, and harsh penalties if they do not comply. These new regulatory frameworks will supplement, rather than replace, the existing rules that have governed content dissemination in both the UK and the EU since 2000 and which provide hosting services with immunity from liability for user-contributed content (subject to take-down obligations). Platforms will continue to enjoy legal immunity in respect of content posted by users; however, regulatory obligations will now require service providers to take proactive measures to keep their platforms lawful and safe rather than simply respond to takedown obligations initiated by others. For businesses operating online, understanding the applicability of the legislation and the obligations imposed will be very important: large fines, business suspension and even imprisonment can result. Territorial application of the legislation Importantly, the new regimes extend to businesses outside of the UK and EU. The obligations apply regardless of the place of establishment of the company running the service, instead focusing on the location of its users. The UK’s OSB will apply to services that have “links with the UK” – meaning a “significant number” of UK users – or those where the UK is a target market.  Similarly, the EU’s DSA applies insofar as a platform offers services with a “substantial connection” to the EU, and notably requires such businesses having no establishment in the EU to appoint a legal representative there (who, where necessary, would be the target of regulatory enforcement action and liable for the service provider’s failures to meet its regulatory obligations). Types of digital services covered The OSB covers search engines and any user-to-user platform, which has a wide definition, encompassing any online service that allows user-generated content to be shared between users. This will extend to any app or website that has this functionality, such as those that allow users to talk with each other through messaging, comments and forums, as well as those that host users’ images, videos and other content. This means, for example, that certain online games and storage platforms may be covered, as well as the obvious messaging and content sharing apps and sites. The only platforms exempted are those that allow solely for emails, SMS, MMS and voice calling functionality, and this exemption does not extend to over-the-top messaging apps like WhatsApp. There are also exemptions for recognized news publisher content, and for sites where the only user-to-user content posted is in the form of comments or reviews. Under the DSA, search engines and intermediary services that are simply hosting, caching or functioning as a mere conduit, have some obligations. But, similar to the UK’s OSB, the most onerous obligations under the EU legislation are placed on those services that are deemed “online platforms”, being those that host and disseminate user content such as marketplaces and social media platforms. Each of the two regulatory regimes in the UK and the EU imposes additional obligations on the largest platforms: services deemed “high risk and high reach” under the OSB will have additional duties, such as having to provide users with empowerment tools and the option to verify their identity. Under the DSA, “very large online platforms” having 45 million users or more in the EU will have additional obligations. For smaller platforms, duties are less onerous; in line with this, the OSB applies a concept of proportionality in which measures required to be taken to comply with obligations will be proportionate to the risk level, size and capacity of the service provider. Key obligations imposed The duties relate mainly to illegal content and content harmful to children, and involve conducting risk assessments, having appropriate systems and processes in place, taking action in relation to illegal or harmful content, keeping records and reporting to the regulator. Importantly, these will need to be undertaken extensively and properly, and there is a duty to publish risk assessments or transparency reports under both regimes.  Regulatory oversight will be applied to ensure the services discharge their duties in accordance with guidelines and policies to be developed in due course by the national regulators (in the UK and in EU member states). With respect to illegal content posted on platforms under the OSB, service providers will need to carry out an assessment to understand the risks of such content being presented on their platform. A large focus of the OSB is on child sexual exploitation and terrorism content, but the duties relate to any criminal offence where the victim is an individual (with a few exceptions). Platforms must take proportionate measures to mitigate and manage the risk of such content, and must have systems in place to minimize the exposure of users to illegal content, allow users to report the content and have processes ensuring it is swiftly taken down. There is also a duty to report UK-linked child sexual offences to the National Crime Agency. Under the DSA, all online platforms are obligated to remove content that is illegal in any EU Member State, suspend accounts that disseminate such illegal content, and report criminal offences. Very large online platforms need to produce an annual risk assessment and independent audit, have risk mitigation measures in place, and appoint a compliance officer for illegal content obligations. Platforms that are likely to be accessed by children have additional obligations that extend beyond strictly illegal content, and each service provider must assess whether the platform is likely to be accessed by children. Under the OSB, platforms likely to be accessed by children need to carry out a children’s risk assessment for harmful content. Obvious examples are pornographic and violent content, but this could also extend to things like cyber bullying, self-harm promotion, or content about eating disorders, as well as anything that risks causing a child psychological or physical harm. The platform must implement proportionate measures to mitigate and manage the risk of harm to children to prevent them from encountering the harmful content. These include having proper age assurance mechanisms in place. Related to this, there is a specific provision requiring services that publish pornographic content to prevent children from accessing it, again, likely through age verification measures. In the case of the DSA, platforms “accessible to minors” must have appropriate measures in place to ensure that minors have a high level of privacy, safety and security.  Specific obligations are not listed in the same way as they are in the UK Bill, so operators of services will need to assess and limit the risks their platforms pose to children. Best practices for doing this are expected to be developed over time by regulators and quite likely by the industry itself. As originally proposed, the OSB outlined duties in relation to the management and mitigation of legal but harmful content to adults. The UK government recently announced that those duties have been dropped from the bill following political controversy not only over the fact that it is a heavy obligation to monitor legal but harmful content, but also over freedom of expression concerns. By comparison, under the DSA, there is no general duty on platforms to mitigate against harmful content to adults which is not unlawful. However, very large online platforms will have a risk assessment duty requiring them at least once a year to identify, analyze and assess “systemic risks” coming from their service regarding not only the dissemination of illegal content, but also serious harm to physical and mental wellbeing and to society in general. Consequences The OSB will be overseen by the UK’s communications regulator, OFCOM, which will have a range of powers to address non-compliance, including applying to the courts for an order that a business be blocked for use in the UK in cases where urgent action is required. Such an order is temporary but can be made permanent, and can require internet service providers, search engines and app stores to block the platform or take it down. In addition, fines of up to the greater of £18 million or 10% of the business’s annual revenue can be imposed. OFCOM will also have rights of entry and inspection and can request information at any time; a failure to comply with such a request, or the deliberate withholding or destroying of information, can result in the imprisonment of a senior manager. Under the DSA, each EU Member State will designate a competent authority to ensure compliance. The national regulators will be empowered to interview operators, carry out inspections, access data, request documents and information, and carry out searches and seizures. Again, in urgent situations, restriction of access can be ordered. The regulator can order a cessation of DSA infringements, and impose fines of up to 6% of annual turnover. How to prepare Preparation for compliance with the new regulatory regimes is essential for all affected digital platforms. The DSA will come into force on 17 February 2023, with most providers needing to publish an initial statement of usage by that date but otherwise having a one-year general grace period to comply with their remaining obligations. However, those that the regulator designates as “very large online platforms” will only have four months from such designation to comply. The OSB is likely to pass in April 2023; if it is delayed further than this, under Parliament rules, the bill will need to be dropped entirely and the legislation process will have to be restarted, which is something the Government will want to avoid. To help service providers comply with the OSB, OFCOM will publish Codes of Practice within three months of the Bill becoming law that can be taken as authority for compliance purposes. In practice, compliance with the regimes will likely involve developing and/or operating automated tools and algorithms, specialty compliance staff, secondary manual review systems, age assurance processes, user control mechanisms, policies, transparency, audits and record keeping. In the meantime, it is prudent for digital service providers to assess whether the OSB and DSA apply to their business, to prepare to implement such systems and processes, and to assess and adapt their existing systems and policies relating to user-generated content for risk.

What is ChatGPT? When asked this innocuous question, ChatGPT introduces itself, more or less, as an AI assistant trained to provide information and answer questions on a wide range of topics. It stresses that it does not have the ability to conduct internet searches or access any information outside of its training data (which stops at 2021). OpenAI launched ChatGPT in November of 2022 as a general-purpose AI chatbot built upon OpenAI’s GPT3 platform. The program quickly took the world by storm with its ability to produce a wide variety of at times cogent and accurate writings. Though not without flaws, ChatGPT is a sophisticated language model. This chatbot is yet another example of what AI holds for the future. One wonders: what ChatGPT can replace in the present? And, more ominously, what landmines lurk in its use? ChatGPT raises a number of copyright issues common to AI generally. For example: how to assess copyright infringement risks when interacting with chatbots trained on copyrighted works, such as books. Can one own copyright in what ChatGPT generates? Who, ultimately, owns works the works created? The legal landscape is still murky when it comes to copyright issues surrounding AI. Comprehensive case law has not yet developed on the subject, nor has statutory or regulatory guidance. As a starting point, the Copyright Office requires human creativity for copyright protection. What level of human creativity is sufficient, however, is unsettled. For our purposes of testing out ChatGPT, we each provided the same prompt to the bot on two separate days: write a blog post on chatgpt and copyright issues. The output took mere seconds to generate, which can be seen here. Unfortunately, the posts were not particularly insightful, even as starting drafts. Having said that, each output was unique and covered slightly varying copyright issues. The second output was the better of the two, indicating the program improves as it generates responses. As the human involvement here was limited to that simple prompt, it is unlikely to be sufficient for us to claim any ownership in the resulting work. Which raises the question: who does own it? OpenAI’s terms of use assign to its users all of OpenAI’s right, title, and interest in and to any output produced by ChatGPT in response to a user’s input. The terms, however, are careful to limit the assignment to what OpenAI owns, and specifically provide that ownership is settled only as “between the parties.” Of course, this leaves open the possibility that no rights are actually assigned. In addition, it is unclear if OpenAI’s wrap-around terms are sufficient to constitute the signed writing required under 17 U.S.C. § 204. While it is likely the terms would be enforceable against OpenAI, that question has not been firmly decided. Ownership of the output, thus, remains murky. OpenAI’s terms further caution that any user’s output may be similar to output of another user. Accordingly, more than one user could claim ownership in the exact same content the bot generates. Do any of those users own anything? Are these similar or exact works like the proverbial copies of Romeo and Juliet that coincidentally spring from the minds of authors without any exposure to the other’s works, each of which is protected and none of which infringe the others? Relatedly, can one lack exposure to the underlying copyrighted work if the tool used to create the new or derivative work was exposed? Or are these works more akin to copies that roll off a more sophisticated copy machine, each of which is an infringement? Instead, AI outputs may be public domain works from the outset. This brings us to the question of whether the outputs are infringing. ChatGPT relies, by its own explanation, on multiple texts and documents from various sources, many (most?) of which are copyrighted works. It is uncertain if some or much of any output is a copy of, or quite similar to, the foundational sources. Outputs may also be derivative works of one or more of the foundational sources. Both of the bot’s blog posts highlighted this issue. Its recommendation was to ask permission from the sources. Yet, the bot acknowledged the difficulty in seeking permission, as the sources are not identified. Unfortunately, the bot is not quite sophisticated enough to recognize the catch-22 it created. Understanding what the underlying works are, as well as the extent to which they are used, is necessary to determine issues of infringement, licensing and fair use. In some clever cross-marketing, the second blog output directed readers to a sister program that it says will curate and identify underlying sources, OpenAI API, which is currently available in private beta. For now, you can count on ChatGPT to give you a coherent, and oftentimes correct, response to your questions—save for queries reliant on information past the timestamp of 2021. In that way, the bot appears to be most useful as a search engine alternative. Too many issues remain unresolved to rely on the tool as a draft generator or an effective substitute for human effort. But keep your eyes and ears open for the fast moving developments with AI and legal resolutions. As AI increases in sophistication and its legal issues are gradually resolved, we can expect that more advanced uses will become viable.

Just in time for your health-focused new year’s resolutions, the FTC released an updated guide for marketers: The Health Products Compliance Guidance. This guide last issued in 1998 under a more narrow title, focusing on dietary supplements. The world of health has changed a lot since 1998. While the larger concepts in this updated guide may seems like nothing new, the FTC has helpfully walked us through more than fifty examples applying the concepts to modern products and forms of advertising. If your company advertises health-related products or services, we suggest reading this business guide cover-to-cover with a nice glass of green juice. The FTC makes every effort to draft their guides with non-lawyers in mind. If you only have a few minutes between your next walking meeting and your morning matcha, we’ll take you through the highlights: The foundational rules remain the same – (1) Advertising must be truthful and not misleading and (2) Before disseminating an ad, advertisers must have adequate substantiation for all objective product claims conveyed, expressly or by implication, to consumers acting reasonably. The FTC and FDA share jurisdiction on health-related products – Just because your products fall under FDA law does not mean you can ignore the FTC. The agencies coordinate their enforcement and regulatory efforts and the FTC’s jurisdiction extends to all advertising claims, even those made on labeling, for which the FDA has primary responsibly. However, the FTC gives deference to the FDA and health claims that meet the FDA “significant scientific agreement” standard will be presumed to be substantiated under FTC law. Health claims require competent and reliable scientific evidence – Randomized, controlled, human clinical trials (“RCTs”) are the most reliable form of evidence and are generally the type of substantiation that experts would require for health benefit claims. It is important to note that anecdotal evidence about the individual experiences of consumers, including surveys of consumer experiences, are never sufficient to substantiate claims about the effects of a health product. Similarly, public health recommendations from advisories from medical organizations cannot serve as a substitute for RCTs. Let the basic principles of scientific research guide your studies – The FTC’s guide recommends that advertisers ensure that the research upon which they rely for any health-related claims complies with the basic principles relied on by the scientific community for research. These key concepts include the use of control groups, randomization, double blinding, reliance on statistically significant results, and reliance on meaningful results. Match your claim to your study – The Guides note that this is common problem for advertisers: valid studies, but those studies don’t support the claim being made. Another warning to take to heart is that claims should be carefully worded to avoid overstating the certainty of science in areas where the science is still emerging. If there are significant limitations or inconsistences within the scientific literature, your consumers should be made aware. Advertising in the form of consumer or expert testimonials still require substantiation – As FTC guidance has repeated over and over again: advertisers should not make claims through consumer testimonials or expert endorsements that would be deceptive or deemed unsubstantiated if the advertiser made them directly. The Guide closes with two overarching recommendations: To ensure compliance with FTC law, marketers of any health-related product should follow two important steps: 1) Consider what express and implied messages consumers are likely to take from your ads. Where appropriate, carefully qualify your claims – in other words, clearly explain the limited circumstances in which the advertised benefits or results apply; 2) Carefully review the support for each claim to make sure it is scientifically sound, adequate in the context of the surrounding body of evidence, and relevant to the specific product and advertising claim. Cheers to a healthy 2023.

Justices of the Supreme Court will soon put on their whiskey glasses to decide the proper tests for infringement and dilution claims involving humorous use of another’s trademark. The Court granted certiorari in November to consider a dispute between VIP Products, LLC (“VIP”) and Jack Daniel’s Properties, Inc. (“Jack Daniel’s”) over VIP’s “Bad Spaniels” dog toy, which Jack Daniels contends infringes and dilutes its famous trademarks and which VIP asserts is permissible under the First Amendment. As discussed in a prior TMCA post, the dispute arose in 2014, after Jack Daniel’s sent a letter demanding that VIP cease all sales of its “Bad Spaniels” dog toy, which VIP had been selling since July 2013. A week later, VIP sought declaratory judgment in the U.S. District Court for the District of Arizona, arguing that it had designed the “Bad Spaniels” label to incorporate a few elements of the Jack Daniel’s label design, but had added a number of additional elements to make it clear that the product was a parody and entitled to First Amendment protection (for example, changing the Jack Daniel’s “Old No. 7 Brand Tennessee Sour Mash Whiskey” to “The Old No. 2, on Your Tennessee Carpet”). Jack Daniel’s counterclaimed, alleging trademark infringement, dilution, and unfair competition. The District Court ultimately granted Jack Daniel’s motion for partial summary judgement, finding VIP was not entitled to the defenses of nominative and First Amendment fair use, because it did not use Jack Daniel’s’ identical marks or trade dress. After a four-day bench trial, the District Court ruled in favor of Jack Daniel’s and permanently enjoined VIP from selling the “Bad Spaniels” dog toy. VIP appealed to the Ninth Circuit, which reversed the District Court on the grounds that: (1) the “Bad Spaniels” dog toy is an expressive work entitled to First Amendment protection, and (2) the District Court failed to require that Jack Daniel’s satisfy at least one of the two prongs of the Rogers test. VIP Prods. LLC. V. Jack Daniel’s Props., 953 F.3d 1170 (9th Cir. 2020); see also Rogers v. Grimaldi, 875 F.2d 994 (2d Cir. 1989) (holding that the Lanham Act only applies to expressive works if the plaintiff establishes that the defendant’s use of the mark either: (1) is not artistically relevant to the underlying work, or (2) explicitly misleads consumers as to the source or content of the work). On the dilution claim, the Ninth Circuit also reversed the District Court, because, although VIP used the Jack Daniel’s trade dress and bottle design to sell the dog toy, these elements were also used to convey a humorous message which was protected by the First Amendment, and thus “noncommercial.” Although Jack Daniel’s petitioned for a writ of certiorari in 2020 seeking review of the Ninth Circuit’s decision, the Court denied the petition. On remand, the District Court found that, based on the Ninth Circuit’s decision, the “Bad Spaniels” toy was entitled to First Amendment protection because Jack Daniel’s could not satisfy either prong of the Rogers test. The Ninth Circuit summarily affirmed. In August 2022, Jack Daniel’s again petitioned for a writ of certiorari asking the Court to consider the following questions: Whether humorous use of another’s trademark as one’s own on a commercial product is subject to the Lanham Act’s traditional likelihood-of-confusion analysis, or instead receives heightened First Amendment protection from trademark infringement claims. Whether humorous use of another’s mark as one’s own on a commercial product is “noncommercial” under 15 U.S.C. § 1125(c)(3)(C), thus barring as a matter of law a claim of dilution by tarnishment under the Trademark Dilution Revision Act. Apparently persuaded the second time around, the Court granted Jack Daniel’s’ petition and agreed to hear the case. In its writ, Jack Daniel’s contends that that the Ninth Circuit’s ruling “departs from the decisions of every other circuit to decide this question” and claims it “paves the way for companies like respondent to unleash mass confusion in the marketplace.” It appears that the International Trademark Association agrees and filed an amicus brief arguing: Since the Second Circuit’s decision in Rogers, all other circuits but the Ninth have faithfully limited Rogers to traditionally expressive or artistic works like movies, art, books, and the like. The Ninth Circuit’s decision below continues that circuit’s inappropriate (and concerning) steady expansion of Rogers to any product or service that merely contains discernible expression. This unwarranted expansion beyond the roots of Rogers creates a sharp circuit split on how to balance competing claims of trademark protection and free speech in the context of ordinary commercial products. The Ninth Circuit’s decision threatens a trademark infringement framework that has been intact and applied for nearly a century. Ultimately, if the Court sides with VIP, it would seem to represent a fairly significant expansion of how the Rogers test has typically been applied since it was first articulated in 1989. Notably, an expansion of the types of works covered under the Rogers test would likely leave brands with a narrower scope of protection when dealing with potential infringers claiming “parody” and “artistic expression.” Further, given that the Court is currently considering the Andy Warhol Foundation for the Visual Arts, Inc. v. Goldsmith case (which involves fair use in the copyright context and which the TMCA has covered here), the Court appears eager to define the role of the First Amendment in intellectual property cases. And the opinion in the Warhol case will almost certainly provide insight into the Court’s likely treatment of the issues in this case. We will be following this case closely, so keep an eye out for our eventual breakdown of the Court’s opinion.

More and more, we see trademark applications being filed for cultural phenomena, viral sensations and catchy hashtags. We’ve covered this topic before. Do you remember #covfefe? A recent non-precedential decision issued just after Thanksgiving once again confirmed that common laudatory phrases are often incapable of functioning as trademarks. The TTAB’s decision in In re Monday Night Ventures LLC was simple: TACO TUESDAY is indeed tasty, but it is not a trademark for beer. The Board found that TACO TUESDAY failed to function as a trademark for beer because it is a widely used message. In reviewing the Examiner’s refusal, the Board’s set out to answer the following question: We must assess whether Applicant’s proposed mark, TACO TUESDAY, functions as a mark based on whether the relevant public would perceive TACO TUESDAY as identifying the source or origin of the beer. To perform the failure-to-function analysis, the Board reviewed the evidence of record, which consisted of the specimens of use (including a beer menu), the mark as shown on a mockup of a beer can and lots of third-party use of Taco Tuesday submitted by the Examiner. The third-party use fell into two categories: (1) general uses of Taco Tuesday to refer to events on Tuesdays featuring tacos and drinks, including beer and (2) uses of Taco Tuesday on or in connection with beer. Notwithstanding the voluminous evidence of third-party use, the Applicant contended that the failure-to-function refusal was “illogical and incongruous” because TACO TUESDAY is not informational when applied to beer. The Board disagreed. After reviewing the evidence, the Board concluded that Taco Tuesdays often involve beer consumed with tacos. “Thus consumers are accustomed to encountering ‘Taco Tuesday’ in the context of beer.” While the beer menu specimen was adequate and did not show use of the mark in an informational manner, the Board found that Taco Tuesday cannot function as a trademark because of the environment in which it is perceived by consumers. While we surely did not need the Board to tell us that Taco Tuesdays and beer are a great pairing, the decision does provide helpful guidance for would-be trademark applicants of cultural phenomena. Common phrases are often incapable of functioning as trademarks, especially when applied to goods or services that are complementary to the phrase. It is a pretty safe bet that the USPTO would also likely reject TACO TUESDAY for margaritas, but would such a refusal extend to wine? I think wine and tacos are great together, but we’d be wise to see how many restaurants and wineries do a taco-wine pairing before fling an application. In fact, checking the internet before making a trademark filing for one of these types of marks is a great suggestion. While you might be first to file, that doesn’t mean the USPTO will let you have exclusive rights. A better strategy for one of these catch phrase trademarks might be to apply it to goods and services which are actually illogical and incongruous with the phrase. So go and enjoy some tacos and beer – it is Tuesday after all.

In MGFB Properties, Inc. v. Viacom Inc., the U.S. Court of Appeals for the Eleventh Circuit recently sided with Viacom and its subsidiary MTV in a trademark action brought by the owners of the Flora-Bama Lounge, who alleged infringement by the television series MTV Floribama Shore. The court held that the title of MTV’s show was protected by the First Amendment, applying the familiar Rogers v. Grimaldi test, which assists courts in balancing Lanham Act protection against free speech. The Flora-Bama Lounge bills itself as “the most famous beach bar in the country.” The lounge faces Orange Beach on the Florida-Alabama state line. Established in 1964, the Flora-Bama Lounge’s owners operate a restaurant and liquor store that also use the Flora-Bama name and host entertainment and athletic events. In 2013, the owners obtained a federal trademark registration for FLORA-BAMA for bar and restaurant services, among other things.   The lounge and the trademarks have made a splash in popular culture (or in the more legalistic telling of the Eleventh Circuit: “have been featured in artistic works by third parties”). Jimmy Buffett’s 1984 song Ragtop Day mentions a plan to “Get ourselves a cool one at the Florabama,” Kenny Chesney named a tune after the establishment, crooning: Sitting here at the Flora-Bama ’Bout to open up a big old can of Good times, unwind Fall in and out of love in the same night Can’t say I got a whole lot of cares I’m in the red neck Riviera It’s getting crazy, getting hammered Sitting right here at the Flora-Bama At the Flora-Bama Chesney packed 25,000 attendees on condo balconies, the beach, and boats near Flora-Bama Lounge for a 2014 concert he called “Flora-Bama Jama,” which was broadcast on Country Music Television, another Viacom channel. Fellow country music performer Neil Dover similarly penned a tribute to FloraBamaTime, where “you leave the world behind.” The lounge has also been described in books, films, and major news outlets. The conflict between the parties had its roots in Jersey Shore, MTV’s television series featuring 20-somethings who live in a beach house in New Jersey. Wanting to ensure that readers who have not watched Jersey Shore understand the show, the Eleventh Circuit explained how the Jersey Shore cast was perceived as belonging to a “sub-culture centered on a love of clubbing, taking care of one’s physical appearance, and a dedication to family and Italian culture.” That’s one way of putting it. Regardless of description, Jersey Shore was a hit that lasted six seasons and spawned several spinoffs. In 2016, MTV sought to revive the Jersey Shore franchise by developing a new series focused on Southern beach culture. That effort would become MTV Floribama Shore. The show’s name began with MTV’s goal of a Shore series that would highlight Southern beach culture. MTV also considered “Florida Shore,” but didn’t feel like that would capture the Gulf Coast setting and might be associated with Miami, which MTV thought had its own culture. MTV also considered “Gulf Shore,” but passed on that name because it sounded too much like another MTV show, Siesta Key. MTV settled on “Floribama” because that name would offer a sense of the subculture and part of the country MTV desired to feature. MTV was aware of the Flora-Bama Lounge during its development, mentioning it in an internal slide deck profiling the region. MTV also commissioned third-party marketing research, which found that 34% of 300 young people familiar with the region had heard the term “Flora-bama” and about half of them identified it as the lounge. Other research suggested that the term “Flora-bama” was either unknown or thought to refer strictly to the lounge. Just before MTV Floribama Shore was set to premiere in 2017, the lounge owners sent a cease-and-desist letter insisting that MTV change the name. MTV declined, the show premiered as scheduled, and it aired for four seasons. In 2019, after the second season aired, the lounge owners sued in Florida federal court, claiming trademark infringement and related torts. They alleged actual confusion, such as lounge patrons asking musicians if they had ever met cast members of the show or inquiring of staff as to when the cast would be in the lounge. According to the lounge owners, an elderly patron even criticized the lounge “for allowing MTV to air such a terrible depiction of the Flora-Bama.” The lounge owners also pointed to expert testimony claiming the show blurred internet search results for the lounge and the show, and that 22% of respondents to a survey were confused as to the sponsorship, approval, or affiliation between the lounge and the show. In response, MTV moved for summary judgment—and won. The Eleventh Circuit upheld the district court’s conclusion that the title MTV Floribama Shore was protected by the First Amendment and thus was a permitted use of the “Flora-bama” name. The court relied on the test for balancing trademark and free speech rights established by the Second Circuit Court of Appeals in Rogers v. Grimaldi—a test we’ve described before. Rogers holds that the title of an artistic work is not trademark infringement “unless the title has no artistic relevance to the underlying work whatsoever, or, if it has some artistic relevance, unless the title explicitly misleads as to the source or the content of the work.” Applying the first part of the test, the Eleventh Circuit concluded that the name MTV Floribama Shore was “well above the artistic reference threshold.” “Floribama” describes the subculture profiled in the series, as well as the geographic area where that subculture exists—“Flori” for Florida and “bama” for Alabama. Also relevant was the addition of MTV’s house mark, and “Shore” to tie the series to the Jersey Shore franchise. The court rejected the lounge owners’ contention that a trademark must be necessary to the name of an artistic work for the work to receive First Amendment protection. The court held that “a title will be artistically relevant when it is necessary to use the title” but that does not mean that “a title must be strictly necessary to be artistically relevant.” (And in the Eleventh Circuit’s view, it would be improper for courts to decide what forms of expression are “necessary” to an artistic work.) Next, the court analyzed the second part of the Rogers test—whether the MTV Floribama Shore title explicitly misleads as to the source of the work. In a previous decision, the Eleventh Circuit had refined this question as “whether (1) the secondary user overtly marketed the protected work as endorsed or sponsored by the primary user or (2) otherwise explicitly stated that the protected work was affiliated with the primary user.” The court concluded neither had occurred here. The court rejected the lounge owners’ survey evidence because there was no suggestion that any misunderstanding was engendered by an overt claim of affiliation by MTV. The court observed that the “MTV” house mark and “Shore” were added to the “Floribama” name, which undercut the lounge owners’ argument that the show’s name was intended to mislead. And although the owners charged that MTV’s use of the name was intentional, the court pointed out that even intentional copying of a mark does not supplant the Rogers test, a case in which a title received First Amendment protection even though it intentionally copied a mark. Finally, the court addressed a much-discussed footnote in Rogers, which provides that the test in Rogers would not apply when an artistic title is confusingly similar to other titles—the so-called “title-versus-title” exception. In the thirty-plus years since Rogers, no other circuit court has explicitly adopted the footnote’s rule. The Eleventh Circuit decided it need not resolve that legal question because the footnote exception didn’t apply. Here, the lounge owners’ Flora-Bama mark is not the title of an artistic work—it is a trademark used to identify the lounge and other businesses. The lounge owners sought to portray third-party use of the mark, such as by Kenny Chesney, as meaning that their mark was used as a title. The court rejected this theory, relying on basic trademark law. The third parties who used “Flora-Bama” in the titles of their artistic works did not do so to suggest that the works originated from the lounge. The titles identify what the artistic works are about, not who produced them. After all, Chesney might have been “sitting right here at the Flora-Bama,” but there was no evidence that the lounge was the source of his song.

2022 has been a whirlwind year for cybersecurity, data, and privacy counsel who are navigating an expanding regulatory landscape and unique sets of legal requirements from numerous jurisdictions. This trend is likely to continue and grow more complex in the new year as additional states adopt and implement privacy laws. A growing trend across privacy legislation is requiring company websites to respond to universal opt-out mechanisms, also known as “Global Privacy Control.” If ignored, a business exposes itself to liabilities that can result in legal and financial consequences. As businesses look toward 2023, we encourage them to examine their compliance obligations in connection with universal opt-out mechanisms and if applicable, develop an implementation plan. Universal Opt-Out – The Basics For those who are unfamiliar with the term, universal opt-out is a mechanism by which consumers can exercise their right to “opt out” of a platform or technology processing their personal data for targeted advertising or of the sale of their personal data. In practice, a consumer sets their preferences in their browser or with a plug-in to “opt out” of data sharing. Once the preference is set, a signal indicating the consumer’s preference is automatically sent each time they visit a website. If required, the website operator must respond to that signal by opting the person out of targeted advertising, the sharing of their personal data, or other sharing limited by statutes and regulations. The website operator also must inform its vendors and other third parties with which the consumer’s information has been shared of the opt-out request and they must honor it as well. Current Legal Requirements The most time-sensitive legal requirements come from California. On January 1, 2023, California’s Privacy Rights Act (CPRA) will be in effect. Under the current draft implementing regulations, businesses that interact with consumers online are required to respond to opt-out preference signals as well as to offer another opt-out option. While the CCPA previously included a 30-day cure period for violations, this is no longer available come January 1. Colorado’s Privacy Act (“CoPA”) goes into effect on July 1, 2023, and contains a similar requirement to respond to universal opt-out signals by July 1, 2024. Colorado’s draft regulations anticipate that a universal opt-out could be achieved in other ways than through a browser or plug-in signal, such as through a do not sell list that website operators would be required to query. The Colorado Department of Law plans to release a list of approved universal opt-out mechanisms no later than April 1, 2024. Connecticut’s Data Privacy Act (“CTDPA”) includes a universal opt-out requirement that goes into partial effect July 1, 2023, and into full effect July 1, 2025. Other states are considering similar provisions in their data privacy legislation. While only time will tell how these regulations will play out and how companies will manage to comply with the requirements, the Sephora case highlights the ease by which a regulator can allege legal violations and the monetary and reputational consequences this can have. This past August, the California Attorney General’s office announced a settlement with Sephora, Inc. alleging, among many things, that Sephora failed to process users’ requests to opt out of the sale of their data through the Global Privacy Control. The AG’s office lauded its settlement with Sephora and AG Rob Bonta emphasized that, “I hope today’s settlement sends a strong message to businesses that are still failing to comply with California’s consumer privacy law. My office is watching, and we will hold you accountable.” Technical and Legal Challenges Currently, only certain internet browsers (DuckDuckGo, Brave, Mozilla Firefox) or a separately installed plug-in enable universal opt-out signals. Notably, Google Chrome and Apple’s Safari do not enable such signals. Without support from major browsers, the technical implementation of responding to universal opt-out signals is naturally haphazard. Without more consumers opting to opt out in this way, the business pressure on companies to conform with opt-out requirements may not be omnipresent. The regulatory pressure to conform with the rules, however, remains and cannot be ignored (see, e.g., Sephora). Consent management platforms such as OneTrust are working on helping their customers integrate universal opt-out into their existing consent management program. Effects of Consumers Opting Out and How to Plan for the World of Universal Opt-Out In the short term, consumers opting out of sharing their personal data can have immediate strategic and financial consequences for business. The growth of importance of first party data may also present new business opportunities. It is critical, therefore, to bring together key company stakeholders to best address these changes and properly prepare. No one wants to be caught off guard, and the sooner companies can bring together their legal, business, and data privacy teams to discuss these changes, the more time they will have to pivot, adapt accordingly, and strongly position themselves. As the industry navigates this “new normal,” companies can no longer rely on previous advertising and consumer data business models. This is a time to think creatively and utilize the collective knowledge of company decision makers to implement new solutions. Dorsey’s Cybersecurity, Privacy and Social Media Practice Group would be happy to assist in these discussions.

With the holiday season upon us and online goods and services flying off the virtual shelves, companies should not lose sight of the increased risk of phishing and cyberattacks. Society’s reliance on online commerce means businesses are under immense pressure to ensure their website domain names provide a safe destination for customers. To do so, they must prevent attacks on themselves and their customers. Sophisticated domain name watching can provide an early warning of phishing attacks about to happen. According to a 2021 study from IRONSCALES, 81% of organizations around the world have experienced an increase in email phishing attacks since March 2020.1 Further, domain name registry Identity Digital recently reported that 92.9% of all of its abuse claims for Q2 2022 were related to phishing attacks.2 Due to advancing technology and the expansion of allowable characters which can be used in domain names, cyber attackers are now running sophisticated phishing schemes which are not only focused on the technologically-illiterate. See The Top 5 Phishing Scams of all Time - Check Point Software. Domain name fraud is being used to trick employees, customers, and business owners alike. Cybersquatting Cybersquatting occurs when an attacker purchases a domain name featuring a brand’s name and/or trademark and uses it for illegitimate purposes. Typosquatting Typosquatting is a form of cybersquatting in which an attacker purchases a domain name which contains typos or slight discrepancies from a legitimate brand. Ex: D0rsey.com; Dorseylawfirm.com Homoglyph Attacks Homoglyph (sometimes referred to as Homograph) attacks occur when an attacker takes advantage of the similarity between certain characters in Latin and non-Latin alphabets (such as Cyrillic and Greek) to register domain names which appear identical or very similar to the domain name of the legitimate brand. Ex: example.com vs. exαmple.com Once these fraudulent domain names are registered, attackers can set up fake websites and/or email addresses to impersonate brands and fool customers into trusting them. Often these fraudulent emails are used to entice unsuspecting users to transfer funds or interact with links which can result in data breaches or malware attacks. To proactively halt these attacks before they happen, companies can implement domain name watch services (including typosquatting and homoglyph watches) to alert them when a domain name is registered which may be of concern. For further information regarding how brand owners can implement good domain name practices to protect their brands, please see Jamie Nafziger’s article, Deepfakes, Fake News & Viral Hoaxes: How Good Domain Name Practices Can Help Prevent Truth Decay.

In a recent trade secrets litigation in the United States District Court in the Northern District of California, a jury awarded the plaintiffs 40 million dollars, half of which was punitive damages. The Court also subsequently issued a permanent injunction enjoining the use of the misappropriated trade secrets. Though the defendant is currently seeking relief from the massive damages award and injunction, this case is a cautionary tale on poaching employees from a competitor in two aspects. First, in a “poaching” situation, a defendant can be enjoined from ever selling the product that uses the alleged trade secret and owe damages in the form of saved research and development (“R&D”) costs that it can no longer benefit from after the injunction takes effect. Second, it is a reminder of the vast discretion that juries have when awarding damages and their ability to award punitive damages in a “poaching” situation if they are left with a bad taste in their mouth from what appears to be a conspiracy to wrongfully take trade secrets. Background Plaintiffs Comet Technologies USA Inc., Comet AG, and YXLON International GmbH (collectively, “Comet”) sued Defendant XP Power LLC (“XP Power”) for misappropriation of its trade secrets under the Defend Trade Secrets Act (“DTSA”). Comet is a long standing player (over 70 years) in the semiconductor industry; whereas, XP Power is a newer player in the generator industry—entering this sector in 2017. In the lawsuit, Comet asserted that XP Power misappropriated its trade secrets associated with equipment used to manufacture semiconductor chips, specifically, Comet’s RF power generators (“RF Generators”) and electrical circuits referred to as impedance matching networks (“Electrical Circuits”). The RF Generators and Electrical Circuits are used to produce plasma chambers, which, in turn, are sold to silicon chip makers. So how did XP Power, a California based LLC, acquire the trade secrets of Comet, a Swiss company? Comet alleged that in late 2017, XP Power poached three Comet employees who were key members of the RF Generators and Electrical Circuits division. The poaching allegedly started with XP Power’s three hour interview with the first Comet employee to jump ship. During this interview, XP Power allegedly inquired about Comet’s trade secrets and then decided that it should also poach a supervisor in the same division. Comet claims the third employee later on participated in a group interview with the aforementioned employees before joining XP Power. After their new positions were secured at XP Power, Comet asserts that these employees surreptitiously collected and shared Comet’s trade secrets. This was allegedly done by (1) saving CAD drawings of Comet’s products as “resumes” to avoid detection, (2) downloading RF Generators and Electrical Circuits files onto external hard drives; and, when confronted, (3) misrepresenting to Comet that they did not save, download, or otherwise collect such files. XP Power purportedly not only was aware of, but also encouraged, this behavior. Comet asserted that XP Power ultimately misappropriated, among other types, trade secrets associated with the: (a) RF Generators; (b) Electrical Circuits; and (c) next generation of Electrical Circuits (“NexGen EC”) for use in the development of XP Power’s own line of competing generators and electrical circuits. Key Events at Trial XP Power did not enter the market before Comet instituted its action; therefore, there were no lost profits or sales to use as a basis for damages. Instead, Comet’s theories for damages was limited to either (1) unjust enrichment (quantified as the savings XP Power enjoyed by not investing time and money into R&D) or (2) a reasonable royalty. At trial, Comet’s damages expert testified about Comet’s R&D costs for the trade secrets associated with each of the RF Generators, NexGen EC, and Electrical Circuits. The approximate amount Comet spent on R&D for each trade secret was $5 million, $6 million, and $11 million, respectively. The expert also explained that the amount spent on R&D is not limited to the line item in the chart underneath each trade secret, but also the amount “that was the foundation that that [the] work was built on.” The expert then testified, that if the jury found that the NexGen EC trade secret was misappropriated, “it’s not just the 6 million, it’s everything because those were built upon all of that work.” Jury Decision and Permanent Injunction Ultimately, the jury found that XP Power improperly acquired the RF Generators, NexGen EC, and Electrical Circuits trade secrets, but that this improper acquisition was a substantial factor in causing damages to only the trade secrets associated with the RF Generators and NexGen EC. The jury awarded damages based on the unjust enrichment theory, i.e., how much money XP Power saved on its own R&D, and awarded $5 million for the RF Generator trade secret and $15 million for the NexGen EC trade secret. For punitive damages, the jury awarded Comet $20 million, resulting in a 1:1 ratio between compensatory and punitive damages. Shortly thereafter, the Court issued a permanent injunction against XP Power as to all three trade secrets, finding that though the jury’s award “compensated past harm, [it] did not address ongoing or future harm.” XP Power’s Current Request In its motion currently pending before the Court, XP Power claims that the jury’s damages award for the NexGen EC trade secret was not based on any evidence since it was $15 million and not the $6 million shown in Comet’s expert’s chart at trial. XP Power also offers a second argument that is focused on the permanent injunction the Court issued. The crux of the second argument is that, by issuing a permanent injunction against use of the RF Generator and NexGen EC trade secrets, the very same trade secrets that the jury already award compensatory damages for, this equates to a double recovery for Comet. XP Power states that it is undisputed that it never sold a generator or matching networks product. As such, it is inequitable and punitive to issue a permanent injunction since “Comet is effectively being compensated for benefits that XP [Power] never received,” i.e., the sale of the infringing products. Thus, either the permanent injunction should be vacated or there should be a new trial on damages. Comet has until December 2, 2022 to respond to XP Power’s pending motion. Practice Points Polling the jury would be the only way to definitively determine why they awarded $15 million in compensatory damages for the NexGen EC trade secret, instead of the $6 million in R&D costs put forward by Comet’s expert. However, the expert’s passing comment about “foundational R&D costs” in the damages calculation may very well have been the culprit. This serves as an important reminder to carefully listen to a damages expert’s testimony and refute any testimony that a jury may hone in on as a basis to award significant damages (which can at times be unpredictable). Additionally, XP Power’s pending request to vacate the permanent injunction may go a step too far. One of the salient tools in intellectual property law, and even more so when trade secrets are involved, is using an injunction to prevent your competitor from running off with your hard work. This prevents redundant litigation. It is also a recognition of the fact that there is something unquantifiable associated with riding on the coattails of a competitor’s intellectual property. It would be odd that after lengthy trade secret litigation, the infringing competitor could simply release its competing product in the market using the plaintiff’s trade secrets. Practitioners and business owners should always remember that there is a way to avoid a court ordered injunction in such situations: negotiate a licensing agreement. While the costs associated with a license could be steep, it does allow the company to theoretically stay in business. As this case has shown, it is possible to be out 40 million dollars and a product line where a company opts to misappropriate a competitor’s trade secrets instead. Finally, all companies should work with their counsel to create the best hiring practices and potentially a special protocol when bringing on an employee of a competitor, which should include a review, prior to hiring, of any restrictive covenants that the employee has with their former employer. These steps could serve as a safety measure ensuring that new employees are fully aware of the gravity of taking potentially proprietary information from their former employee without express permission.

Casa Bonita – a self-described “Eatertainment” establishment near Denver, Colorado, featuring cliff divers, stage shows, and subpar Mexican food, appeared destined to become another Covid-19 related restaurant casualty. In 2020 Casa Bonita initially ceased operations due to a local order mandating the closure of indoor restaurants and entertainment due to the global pandemic. As a result of a lengthy closure and ensuing restrictions on indoor dining and entertainment establishments, Casa Bonita fell behind on its rent payments. On April 6, 2021, facing an eviction suit from its landlord, Summit Family Restaurants, Inc., the owner of Casa Bonita, filed for Chapter 11 bankruptcy protection: In re Summit Family Restaurants, Inc., Case No. 21-13328-MER (Bankr. Colo.). With the National Restaurant Association reporting that more than 90,000 restaurants have closed due to the pandemic, a standalone restaurant’s closure and subsequent bankruptcy filing would typically be unremarkable. However, most local restaurants do not have the benefit and notoriety of their own South Park episode. Casa Bonita gained national attention in 2003 when South Park, an animated series on Comedy Central, released an episode titled “Casa Bonita.” The episode features Casa Bonita as the much sought-after location of character Kyle Broflovski’s birthday party, to which heckler Eric Cartman is not invited. Cartman spends the episode manipulating his way onto the guest list (including kidnapping an invitee) to visit the “Disneyland of Mexican Restaurants.” Summit Family Restaurants sought to sell Casa Bonita in its bankruptcy case. The sale was complicated by the large pre-petition claim owed to the landlord whose consent was needed to consummate a sale. Additionally, the intellectual property required to operate Casa Bonita was held by a separate but related non-debtor entity, meaning that a buyer would also need to reach a deal with the third party in order to actually operate the restaurant. A group of Denver area locals banded together to form “Save Casa Bonita” and attempted to negotiate with Summit to purchase the restaurant. Negotiations broke down when the landlord would not consent to the sale. Enter South Park creators Trey Parker and Matt Stone. Parker and Stone successfully negotiated an agreement to purchase Casa Bonita with the landlord’s consent through the bankruptcy case for $3.1 million, an amount sufficient to pay all of Summit’s creditors in full. The Save Casa Bonita group objected to the sale, arguing that their offer to purchase the restaurant for $3.5 million was higher and better. The group’s founder expressed in an interview that the group sought to avoid for Casa Bonita to become a “‘South Park’ joke or ‘South Park’ fun land.” However, for reasons not publicly specified, Save Casa Bonita ultimately withdrew its objection to the sale. Could this have been because of the separate deal required to acquire or license the intellectual property rights for the restaurant? Maybe - Parker and Stone have publicly expressed their childhood love of the restaurant as a reason for purchasing Casa Bonita, but the timing suggests the purchase was also a strategic business move. The agreement to purchase Casa Bonita was reached shortly after the two entered a six-year, $935 million pact with ViacomCBS that includes 14 streaming South Park movies. Some in the media suspect the acquisition is part of a strategy for Parker and Stone to enhance the value of the South Park brand and capitalize on fandom trends. Parker and Stone recently announced their plans to reopen the restaurant, including improving the food, which was known to be less than stellar. The two have hired Dana Rodriguez, a three-time James Beard Award winner and Denver restaurant owner as the head chef of the new Casa Bonita. However, it appears the quirky charm of the restaurant will remain, including its cliff divers, arcade, and cave, as the new owners have expressed their motto to “change nothing and improve everything.” Time will tell how this investment works out and if and how Stone and Parker further intermesh Casa Bonita and the South Park brand.

photo by Arthur Shevtsov / Shutterstock.com Sometimes, the best place to determine whether a work qualifies as art is in a courtroom. In a recent decision, Judge John H. Chun of the District Court for the Western District of Washington found that a driving simulator video game, Spintires, is an expressive work entitled to First Amendment protection. See Saber Interactive Inc. v. Oovee, Ltd., No. 2:21-cv-01201-JHC, Dkt. 51 (W.D. Wash. Oct. 6, 2022). Spintires simulates driving through various wilderness tracks in a variety of real-world vehicles. While Oovee has licensed some of the vehicles depicted in Spintires, it has not licensed all of them. For the unlicensed vehicles, Oovee provides the following disclaimer: All other trademarks are the property of their respective owners. All characters and vehicles appearing in Spintires® are fictitious (except where licensed). Any representations to real-life persons (living or dead), or real-world vehicle designs (except where licensed), is purely coincidental. It is, of course, one of the unlicensed vehicles appearing in Spintires, the K-700, that is at the heart of the dispute in Saber Interactive v. Oovee. photo by Filmbildfabrik / Shutterstock.com In November 2015, Oovee released an update to Spintires that included, and seemed to emphasize, the K-700, which is a distinctive tractor with articulated steering. Peterburgsky traktorny zavod JSC, which is known under the brand name “Kirovets,” manufactures and sells the K-700. Kirovets exclusively licensed certain of its intellectual property rights in its vehicle designs to a video game developer call Saber, which sells its own driving simulation video game, Mudrunner. The license with Kirovets gives Saber the right to take legal enforcement action against infringers of Kirovets’s licensed IP rights. Oovee’s unlicensed use of the K-700 in Spintires led Saber to sue Oovee on September 2, 2021. On April 26, 2022, Saber filed a Second Amended Complaint (“SAC”) which included three claims: (1) unfair competition under Section 43(a) of the Lanham Act, 15 U.S.C. § 1125; (2) unfair competition under Washington’s Consumer Protection Act (“WCPA”), Washington Revised Code (“RCW”) 19.86.010; and (3) unjust enrichment. Oovee moved to dismiss the SAC under Federal Rule of Civil Procedure 12(b)(6) for failure to state a claim, arguing that the First Amendment bars Saber’s claims, and, even if it does not, Saber failed to plead facts sufficient to survive a motion to dismiss. The SAC alleged that Oovee engaged in unfair competition under the Lanham Act by using Saber’s trademark and trade dress without authorization. Saber argued that the First Amendment does not bar its unfair competition claim because Spintires is not an expressive work, and Spintires’ disclaimer is misleading. In the Ninth Circuit, courts use the “likelihood-of-confusion” test when evaluating an infringement claim under the Lanham Act unless artistic expression is at issue. When the alleged infringement involves artistic expression, courts apply a test set forth in Rogers v. Grimaldi, 875 F.2d 994 (2d Cir. 1989), which balances the First Amendment interest in protecting artistic expression against the interest in securing trademark rights under the Lanham Act. Rogers requires a defendant to make a threshold showing that its allegedly infringing use is part of an expressive work. If successful, the plaintiff then has the heightened burden of showing the likelihood-of-confusion test and one of Rogers’s two prongs: (1) the unauthorized use of the trademark has no artistic relevance to the underlying work whatsoever, or (2) the use of the trademark explicitly misleads as to the work’s source or content. Saber argued that Spintires is not an expressive work because it does not express ideas or social messages, it has no characters, dialogue, or plot, its music is simplistic and only in the background, and the simulated world is generic and computer-generated. Judge Chun cited a U.S. Supreme Court case and a Ninth Circuit case holding that video games may qualify for First Amendment protection, and then discussed another case in which the Ninth Circuit affirmed a district court’s conclusion that a race car driving simulation video game contained express elements such as the race car drivers being characters and the plot being the drama of the races. VIRAG, S.R.L. v Sony Computer Entertainment America LLC, No. 3:15-cv-01729-LB (N.D. Cal. Aug. 21, 2015), aff’d, 699 F. App’x 667, 668 (9th Cir. 2017). In view of the case law, Judge Chun determined that many of the features of Spintires alleged in the SAC establish that Spintires is an expressive work, explaining that “[u]sers interact with the virtual world by selecting a vehicle (which is like a character) and by navigating the virtual environment (which is like a plot).” As to the first Rogers prong, Saber failed to explain how Oovee’s use of the K-700 is artistically irrelevant, so the court did not consider the first prong. The court also determined that Saber could not meet the second prong, that Oovee’s use of the K-700 explicitly misleads consumers about its source or endorsement. The court concluded that Saber did not satisfy the second prong because it failed to point to an expressly misleading statement. The court noted that, while “the disclaimer is far from a model of clarity,” it does not explicitly mislead customers into thinking that Saber or Kirovets is associated with Spintires. Moreover, use of the K-700 mark alone is insufficient to satisfy the second Rogers prong. The court dismissed Saber’s claim for unfair competition under the Lanham Act, because the First Amendment protects Oovee’s use of the K-700. Under the same rational, the court also dismissed Saber’s claim for unfair competition under the WCPA. In addition, the court dismissed the trade dress claim because Saber failed to plead any facts to create a reasonable inference that the identified features of the K-700 are non-functional. Finally, the court dismissed the unjust enrichment claim because, under Rogers, Oovee did not impermissibly infringe Saber’s trademark rights and, therefore, did not receive a benefit at Saber’s expense. Accordingly, the court dismissed all claims against Oovee in the SAC but granted Saber leave to file a Third Amended Complaint. Saber Interactive is a win for anyone seeking validation for the idea that video games can be works of art, just like books, movies, etc. This decision also shows that courts take a broad view about what constitutes an expressive work in the context of video games. Video games do not require a traditional narrative structure, a memorable soundtrack, or stunning visuals to qualify for First Amendment protection. If a video game lets the player select their own vehicle, hop in, and take a drive through an interactive environment, that’s probably enough.

Trust and estate attorneys regularly advise their clients to enter into prenuptial agreements to protect the valuable assets each spouse brings to the marriage as well as how to distribute community property in the event of a divorce. Brand collaborations with celebrities, influencers or other brands are much like marriages, but brand collaborations are even more unlikely to last. Why not plan for the split, whether it be a conscious uncoupling or a Page 6 kind of divorce, with a prenup? . . . . Click here to see the rest of Fara’s article on IPWatchdog.

On August 30, 2022, the Hong Kong Privacy Commissioner for Personal Data (the “PCPD”) released a guidance note (the “Guidance Note”) on data security measures for information and communications technology to provide data users with recommended data security measures to facilitate their compliance with the relevant provisions under the Personal Data (Privacy) Ordinance (Cap 486 of the Laws of Hong Kong)(the “PDPO”). The PDPO was amended last year to criminalize doxxing, which we wrote about last year. According to the PCPD, in recent months, data users have been confronted with considerable challenges with respect to protection of data privacy and data security in light of the new normal consisting of hybrid modes of working and learning. In the first seven months of 2022, the PCPD received 68 data breach notifications from organizations, a quarter of which involved vulnerabilities of information and communication technology systems of data users. In light of these cybersecurity incidents, the PCPD issued the Guidance Note to provide comprehensive recommendations on best practices to strengthen data security systems in organizations, especially small and medium-sized enterprises. Background Data Protection Principle (“DPP”) 4(1) of Schedule 1 to the PDPO requires data users to take all practicable steps to ensure that personal data held by it is protected against unauthorized or accidental access, process, erasure, loss or use. In essence, it requires an organization to take into account the kind of data and the harm that could result if a data security incident occurs. The resulting harm from a data security breach depends on the volume and sensitivity of the relevant personal data and required steps to ensure security and compliance with the PDPO will need to be accordingly proportionate to the volume and degree of sensitivity. Summary of Recommended Data Security Measures To help guide organizations in their compliance efforts in protecting personal data, PCPD’s Guidance Note provides recommendations on data security measures in the following areas: Data Governance and Organizational Measures. An organization should establish clear internal policy and procedures on data governance and data security that cover areas including, among other things, roles and responsibilities of staff in maintaining systems and safeguarding data security, data security risk assessments and handling of data security incidents (such as an incident response plan and reporting mechanism). It may make reference to the IT security or cybersecurity standards and best practices set by reputable organizations and review and revise its policies and procedures periodically based on prevailing circumstances. A data user should also appoint suitable personnel specifically responsible for personal data security (such as a Chief Information Officer) and should provide sufficient training for staff members to educate and inform them of the organization’s data security policies and procedures. It may also include confidentiality obligation in its employment contracts with its staff members where appropriate. Risk Assessments. An organization is recommended to conduct risk assessments on data security for new systems and applications before launch and periodically thereafter. The PCPD also recommends SMEs to consider engaging third party specialists to conduct security risk assessments to identify relevant risks so as to address them promptly. Technical and Operational Security Measures. The Guidance Note provides a non-exhaustive list of technical and operational measures that an organization may consider putting in place to ensure data security. It should be noted that the adequacy of the security measures will depend on the circumstances and may vary on a case by case basis. Some of these measures include securing computer networks, establishing a database management system, adopting access control measures, setting up firewalls and anti-malware, protecting online applications, using encryption when transferring or storing data, preventing misuse of and filtering emails, setting up backup systems and ensuring timely destruction or anonymization of unnecessary or expired personal data. Data Processor Management. The Guidance Note recommends for organizations to properly manage data processors. Since it is common to engage contractors such as data processors for processing personal data (such as cloud and data analytics service providers), organizations should note that they may be liable for acts of its agents including data processors. As such, organizations should consider factors when engaging data processors such as competency and reliability of data processors, nature of personal data being transferred, security measures taken by data processors, protocols for reporting on data security incidents, and conducting field audits to ensure compliance with the data processing contract by data processors. Remedial Actions in the event of Data Security Incidents. DPP4(1) provides that organizations must take all practicable steps to protect the personal data they hold having regard to harm resulting from a data security incident. The Guidance Note, therefore, provides some common remedial actions organizations may take in the event of such incidents. These include: disconnecting the affected systems, changing passwords and ceasing access, changing system configurations, notifying affected individuals, reporting to PCPD and other relevant regulators, fixing the security weakness and following up on the lessons learnt. Monitoring, Evaluation and Improvement. The Guidance Notes recommends for organizations to engage an independent task force, such as an internal or external audit team, to monitor compliance with the organization’s data security policy and evaluate the effectiveness of the data security measures periodically. Other data security measures and recommendations including cloud services, ‘Bring-Your-Own-Devices’ (“BYOD”) and portable storage. As working remotely from the office has become increasingly more common, it is also common that data is transferred out from an organization’s information and communications systems. As a result, organizations may be exposed to a variety of security issues. The Guidance Note provides recommendations applicable to such circumstances and issues to consider with respect to using third-party cloud services, protecting personal data of an organization in BYOD situations and where portable storage devices are used. Conclusions The Guidance Note provides useful guidelines with specific measures that businesses should take to strengthen their data security systems and to minimize risks of data breaches which could cause reputational and financial damages. It would be a good time for businesses to review the adequacy and effectiveness of their existing data security policies and measures or putting in place one that is in line with the prevailing circumstances.

Slovenian-born Luka Doncic became a professional basketball player at the young age of sixteen years old and the towering height of 6’7”. He quickly made a name for himself, leading his Spanish team Real Madrid to the 2018 EuroLeague title, while also winning EuroLeague MVP, EuroLeague Final Four MVP, ACB Best Young Player, and ACB Most Valuable Player honors and participating in the EuroLeague 2010-2020 All-Decade Team. Recognizing that the sky was the limit for her young and talented son, Doncic’s mother, Mirjam Poterbin, filed a series of trademark applications with the U.S. Patent and Trademark Office in 2018-2019. The trademarks were intended to protect her son’s likeness for a vast variety of promotional-based goods and services, including computer games for basketball in Class 9, sporting equipment in Class 28, and business management services in Class 35. These trademarks each incorporate a variation of Doncic’s name and the “7” jersey number he was wearing during his time in the EuroLeague. According to the Trademark Manual of Examining Procedure (“TMEP”) § 813, when a trademark identifies a particular living individual, that mark can only be registered “with the written consent of the individual…if there is evidence that the name identifies a specific living individual who is publicly connected to the goods or services.” Unsurprisingly, Doncic gave his mother consent to use his name and protect his interests. The applications matured to registration, and Doncic’s career continued to take off. In 2018, Doncic was selected third overall in the NBA draft by the Atlanta Hawks, and was then immediately traded to the Dallas Mavericks, with whom he currently plays. In his first season in the NBA, Doncic became the youngest 20-point scorer in the Mavericks’ history, scored his first 30-point game, made the NBA’s All-Rookie First Team, and was named NBA Rookie of the Year, all while wearing the number “77” jersey. Everything seemed satisfactory for Poterbin and her up-and-coming NBA superstar son. However, recognizing the need to protect his own likeness and career potential, Doncic founded Luka99, Inc. to handle his business affairs. In 2021, Luka99 filed numerous trademark applications, the most pertinent ones of which include the wordmarks LUKA DONCIC and ORIGINAL HOOPS OF LUKA DONCIC, covering a wide array of goods and services, from printed books about athletes in Class 16 to insulated beverage sleeve holders in Class 21 and basketball hoops in Class 28. However, Doncic immediately ran into problems at the USPTO. The problem? None other than his own mother. On March 9, 2022, the USPTO’s examining attorney refused two of Doncic’s applications based on a likelihood of confusion under Section 2(d) of the Lanham Act with his mother’s existing LUKA 7 trademarks. In an attempt to clear the way for his applications, and in what appears to be an issue of first impression for the USPTO, on September 7, 2022, Doncic filed a cancellation action against his mother’s registrations seeking to revoke his consent under Section 813. His petition for cancellation notes that, on July 23, 2021, he sent his mother a letter “specifically and expressly revok[ing] the consent effective immediately.” As a result, his mother’s marks “remain[] registered without Mr. Doncic’s consent,” which violates Section 2(c) of the Lanham Act. The petition also includes claims for abandonment under Section 14(3) and false suggestion of a connection with an individual under Section 2(a). The outcome of Doncic’s petition is difficult to predict, as neither the TMEP nor applicable case law provide a clear answer to the question whether an individual can revoke their consent once it has been given. Doncic argues that allowing his mother’s registrations to stand will undoubtedly cause consumer confusion, creating the presumption that Doncic is affiliated with, sponsored by, or otherwise connected to his mother’s LUKA DONCIC 7 trademarks. He also points out that he granted his consent in the first place when he was young and reliant on his mother “to provide assistance and guidance for his off-court business opportunities.” But now, as an adult superstar with millions of professional fans, Doncic wants control of his own affairs. Unfortunately for the stare decisis fans out there, the outcome of this case might not establish new trademark law. While the revocation of consent issue is the most fascinating claim in Doncic’s petition, there is an easy way out—abandonment. According to Doncic, his mother is not using the LUKA 7 trademarks, and has no known licensees. As such, her registrations may be subject to cancellation on that ground alone, leaving the consent issue for another day and another matter. But this cancellation proceeding is one to keep an eye on – it could very well result in new trademark law. And new law regarding consent would have far-reaching applications, especially as athletes, including those in college, take a more vested interest in the rights to their own likeness and publicity. Poterbin’s answer to the petition is due on October 17, 2022, and her response (if any) may provide more clarity as to how this action will shake out. At this stage, it’s truly a jump ball.

It is not every day that Supreme Court oral arguments include references to The Lord of the Rings (both the books and the movies!), the Syracuse University athletic program, Mork and Mindy, All in the Family, Norman Lear (inaccurately characterized as having passed away, when he just celebrated his 100th birthday), the Mona Lisa (in a red dress, yet), photos of Abraham Lincoln and biographies of George Washington, but today’s oral argument in the case of Andy Warhol Foundation for the Visual Arts, Inc. v. Goldsmith included all of that and plenty more. Prior readers of this blog will be familiar with the underlying facts of this matter, but the core question in the case is whether the use of a copyrighted photograph taken of the artist Prince by the photographer Lynn Goldsmith, subsequently modified by the artist Andy Warhol to create what was referred to during the argument as the “Orange Prince,” qualifies as a fair use under Section 107 of the U.S. Copyright Act. Goldsmith says no, the Andy Warhol Foundation says yes, and the Office of the Solicitor General of the U.S. Justice Department has sided (mostly) with Goldsmith. Goldsmith Warhol                 So how did the argument go? The Court peppered the Foundation’s counsel with a wide range of questions, and at times expressed great concern that the test advocated by the Foundation for the first of the Section 107 fair use factors – the purpose and character of the use – cannot just focus on the “meaning or message” of the new work without severely limiting the rights of original creators. Justice Thomas asked the Foundation’s counsel if he took Warhol’s image, added the words “Go Orange,” and used it to promote the Syracuse University Athletic program (selling posters based on this new work at the same time), whether that use would be fair under the Foundation’s test, since the meaning and message of this new work were different from Warhol’s. When the Foundation’s counsel said probably not, Justice Thomas suggested that the Foundation’s position was both inconsistent and incapable of being practically applied. For her part, Goldsmith’s counsel attacked the Foundation’s position as putting the interests of copycats above the purposes of copyright. At the same time, multiple Justices expressed concern that treating the “meaning or message” of new works as irrelevant, as the appellate court below had (arguably) done, was a step too far. Indeed, several Justices, notably Justice Kagan, appeared to argue for an approach in which a new work’s meaning or message could be considered as part of the inquiry into the purpose and character of the new use, but not as shorthand for that factor as a whole. A recurring theme of the arguments was the nature of the “use” the Court was supposed to be considering for purposes of the fair use analysis. Was it Warhol’s original creation of the “Orange Prince” back in 1984, when he made a number of changes to Goldsmith’s photo, with her permission, for publication of the “Orange Prince” in a Vanity Fair article? Was it Warhol’s subsequent creation of fourteen additional works based on the Goldsmith Photo, dubbed the “Prince Series,” that now hang in museums and on the walls of collectors? Or was it the Foundation’s decision to license the “Orange Prince” to Vanity Fair again in 2016 for inclusion in another article about Prince following his death, this time without Goldsmith’s permission and without paying her? Goldsmith and the Solicitor General see this case as being about only (or at least primarily) the last of these uses, with the licensing of the “Orange Prince” essentially usurping a market Goldsmith actually exploits – the licensing of her images to media outlets – without compensation. But to the Foundation, the underlying meaning and message of Warhol’s “Orange Prince” – to comment on the reductive and dehumanizing nature of modern celebrity – was not diminished by the appearance of the “Orange Prince” in a Vanity Fair article published after Prince died. And, per the Foundation, the case is also about the original act of creation and the need to foster the ability of future artists to make use of preexisting works to communicate their own messages on subjects of their choosing. Another source of dispute between the parties and, at times, the Justices themselves, was what the purpose of the use of the “Orange Prince” was. To the Solicitor General and Goldsmith, the purpose of the two images was the same – to show Prince as Prince, unlike Warhol’s prior use of Campbell’s Soup cans to comment on consumerism, not to sell food products – such that no further inquiry into that aspect of the first fair-use factor was necessary. But Justice Roberts appeared to reject that argument, noting how different the two Prince images were, and that both communicated different messages. The Foundation argued on this point that, per the Supreme Court’s prior holding in Campbell v. Acuff-Rose, 510 U.S. 569 (1994), it was not necessary for any court to determine what the meaning or message was of a new work, but that what mattered was whether a new meaning or message could reasonably be perceived from the new work. Both counsel for Goldsmith and the Solicitor General were asked for their own tests as to how to evaluate the first fair use factor, and both advocated, at various points and somewhat inconsistently, for a requirement that the second artist show that it was “essential,” “necessary” or “highly useful” for them to use the first work. But several Justices expressed concerns that these proposed tests were overly limiting and/or too vague, and the Foundation vigorously argued that a test based on “necessity” would eviscerate the fair use defense and chill both creativity and freedom of expression. Finally, and for parties, perhaps most importantly, there is the question of what the effect of a Supreme Court holding will have on the case at hand. Several Justices asked what would or should happen if the Court ruled in favor of one side or the other on the first fair use factor, since none of the other three fair-use factors had been briefed. The Court gave no clear sense about what would happen next if it ruled for either side, although the prospect of a remand to the Second Circuit or the District Court was brought up by a number of Justices, depending on how the case was decided. In the end, what this case boils down to is balancing two equally important rights: the right of original creators to safeguard their copyrights and be compensated for their expression, and the right of secondary creators to innovate and build upon preexisting works, even if they are copyrighted. The Supreme Court argument did not clarify whether the balance is likely to tip in favor of one right or the other, or how to demarcate the boundaries between a use that is infringing and a use that is fair. Equally unclear is whether the Court will issue a limited ruling that does little more than address either the specific facts of this dispute or the interpretation of the first fair-use factor, or offer a broader balancing test capable of wider applicability in copyright cases that covers fair use as a whole. The decision, when it comes down, likely in 2023, will surely be an interesting and important read regardless of the outcome.

Unlike the current prohibitive policies on the trading and dealing of cryptocurrencies in China, the Chinese government has taken a more pragmatic approach towards non-fungible tokens (“NFTs”). It considers NFTs to be digitalized fine artworks/collectibles or ‘trending artistic digital products’ rather than digital financial products. This pragmatic approach is an effort by the Chinese government to adapt to the rising tide in NFT-related development based on block chain technology, given the rapidly increasing popularity of NFTs among Chinese traders and collectors, and the fast growing transactional market for NFTs in China. In April 2022, China saw its first court judgment on NFT infringement, which was issued by the Hangzhou Internet Court (the “Hangzhou Court”) in the case of Shenzhen Qice Diechu Culture Creation Co., Ltd vs Hangzhou Yuanyuzhou Technology Co., Ltd, a.k.a “chubby tiger having its shot” case. The Hangzhou Court is a district level court which was formed in 2017 and specializes in Internet-related cases. This post provides a brief introduction on this case and its potential influence on the dealing of NFTs by trading platforms in China. The facts of the case are not complicated. The plaintiff, Shenzhen Qice Diechu, has been granted an exclusive license to use the copyright relating to the artwork “chubby tiger having its shot” by the copyright owner. (the underlying artwork “chubby tiger having its shot”) The defendant Hangzhou Yuanyuzhou operates an NFT trading platform. A third party was found to have offered and sold NFT products created and based on the artwork “chubby tiger having its shot” on the defendant’s platform. The plaintiff therefore sued the defendant for copyright infringement. The defendant sought to rely on the Safe Harbor Principle in its defense – generally, a network service provider may be protected in a “safe harbor” against any infringement claim regarding any third party contents posted/offered on its platform if it has exercised reasonable duty of care and it has adequately followed a notice and takedown procedure. The defendant therefore sought to protect itself by arguing that it was just an NFT trading platform which simply hosts content. The Hangzhou Court held that the defendant cannot hide behind the Safe Harbor Principle in the present case and found the defendant liable for copyright infringement as a trading platform, because the role played by the defendant as a trading platform in the NFT transaction requires it to exercise its duty of care to a higher degree to ensure that the NFT products traded on its platform do not infringe the intellectual property rights of others. The Hangzhou Court was influenced by evidence that the defendant, although seemingly acting just as a trading platform, charged gas fees for minting the NFT digital work, and also charged commissions from the sales of NFT works; therefore, the defendant was a participant in the transaction rather than merely a platform providing an online trading venue to its members. As such, the Hangzhou Court held that the defendant must assume a higher level of responsibility and a stricter duty of care in relation to the dealing of NFTs on its platform in order for it to be able to seek the protection under the Safe Harbor Principle. The defendant in this case poorly exercised its duty of care in monitoring for IP infringement, because the infringing NFT work based on “chubby tiger having its shot” clearly bears a watermark with the Internet name of the real copyright owner. This should have immediately raised an alarm for the defendant. The Hangzhou Court held that the defendant could have easily found the existence of copyright infringement in relation to the NFT work in question by conducting simple check on the Internet. The Hangzhou Court discussed what it considered to be an adequate exercise of the duty of care in relation to NFTs. An NFT trading platform has to establish a pre-placement IP review mechanism. The platform must also have reasonable measures in place to conduct an ownership check of the NFT works which are to be placed on its platform and of the underlying artwork by requesting the traders/NFT creators to provide documents to prove ownership in or in relation to the underlying copyright, to the extent that a reasonable person would believe that the trader/creator is the owner of the underlying copyright or otherwise has been authorized to use the said copyright. The Hangzhou Court also addressed certain technical issues relating to NFTs, for example, in terms of the plaintiff’s request of deleting the infringing NFT work in question from the defendant’s platform, the Court ordered the defendant to “disconnect the infringing NFT digital work on the block chain and punch it into the address black hole to stop the infringement” given that the deletion of NFTs from the Internet is not possible. Unlike the other recent high profile cases involving NFTs in other jurisdictions, such as the Nike, Inc. v StockX LLC (involving Nike sneaker NFTs) and Hermès International v Mason Rothschild (Hermes Birkin bag-inspired NFTs), which are between the IP rights owners (as the plaintiffs) and the infringer creator of NFTs (as the defendants), this first NFT infringement case in China is against a trading platform. The reason is that the plaintiff could not ascertain the true identity of the infringing creator. As such, the plaintiff requested in the court proceeding, among other things, that the defendant provide the real identity of the creator so that the plaintiff can initiate legal proceeding against the creator as well. This indicates that the plaintiff is contemplating a new and further court proceeding against the creator of the infringing NFT work. The defendant in this case has appealed this judgment of a first instance court to the Hangzhou Intermediate People’s Court. We will continue to monitor this case and will report on any new developments. We will also keep an eye on any new court decisions involving NFTs in China, especially those from higher level courts.

The first California Consumer Privacy Act (CCPA) settlement was announced on August 24, together with a strong message from California Attorney General Rob Bonta regarding compliance with the CCPA. The settlement involves Sephora USA, Inc., and resulted from a sweep of enforcements by the Attorney General last year. As part of the settlement, Sephora agreed to pay $1.2 million and comply with requirements related to its CCPA obligations. Prior to the AG investigation, Sephora was notified of its alleged CCPA violations but failed to cure within the 30-day period allowed under law. This failure prompted the AG to initiate the enforcement action. The definition of “sale” under the CCPA is extremely broad, and includes “selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating” personal information “for monetary or other valuable consideration.” According to the complaint, Sephora made consumers’ information available to third parties in connection with targeted advertising and “analytics” services, both of which the complaint indicated constituted a “sale.” The complaint alleges further that Sephora’s vendors were not subject to appropriate “service provider” contracts necessary for the vendor’s processing to not be considered a sale for purposes of CCPA. At the time, the Sephora privacy policy stated that it did not “sell” personal information, and did not include an opt-out of sale link. Taking these issues into account, the complaint alleged that Sephora violated the CCPA by failing to: (i) display a “do not sell my personal information” link on its homepage, (ii) describe the categories of personal information sold or shared in its privacy policy, and (iii) honor opt-out requests, including through response to the Global Privacy Control (GPC), a browser plugin designed to enable consumers to automatically opt-out of data sales on numerous websites with a single setting. In addition to curing these violations, the settlement also requires Sephora to conform its service provider agreements to the CCPA’s requirements, properly configure service provider products and services, and provide reports to the California Attorney General relating to its sales of personal information, its relationships with service providers, and its ability to honor requests via GPC settings. The complaint also previewed to Sephora that the technologies it used may create additional risks for consumers’ sensitive information related to health conditions. This, by extension, could create risk of non-compliance with forthcoming CCPA requirements applicable to businesses’ processing of sensitive personal information. Companies should note that CCPA requirements are complex to implement, and the 30-day cure period may be insufficient to make all needed changes. In addition, the cure period currently allowed under the law will expire as of January 1, when the CPRA amendments to the CCPA becomes effective. It is therefore critical for companies to evaluate their CCPA compliance posture prior January 1, 2023, as the California Attorney General’s office, together with the new California Privacy Protection Agency, appear poised to increase their enforcement efforts, and may be less tolerant of non-compliance. In a press release issued together with the Sephora settlement, Attorney Rob Bonta stated: “I hope today’s settlement sends a strong message to businesses that are still failing to comply with California’s consumer privacy law. My office is watching, and we will hold you accountable. It’s been more than two years since the CCPA went into effect, and businesses’ right to avoid liability by curing their CCPA violations after they are caught is expiring. There are no more excuses.” Together with announcing the Sephora settlement, the Attorney General’s office also issued notices to a number of other businesses alleging non-compliance relating to their failure to honor opt-out requests via the GPC or similar controls. Recipients of these notices will have 30 days to cure the violations, or they will face enforcement actions. Businesses receiving such notices after January 1, 2023, however, will have no such opportunity to cure. Examples of the notices to cure sent by Bonta’s office can be found at oag.ca.gov/ccpa. There are several important lessons in the Sephora settlement. The California AG is treating GPC as a requirement, rather than an option. Although the statutory text of the CCPA does not mandate compliance with the GPC, the AG suggested this was a requirement in the 2021 amendments to the CCPA regulations, and in the CCPA FAQ page in July, 2021. Whether or not this constitutes sufficient notice and a true statutory requirement is somewhat debatable, but companies should take notice and ensure GPC compliance in order to avoid potential enforcement for non-compliance. Any doubts regarding whether third-party online behavioral advertising and profiling constitute data sales have now been removed (though such relationships are likely to fall within the scope of the CPRA’s new “sharing” opt-out requirements once the CPRA amendments take effect). Privacy policies must clearly disclose the categories of data sold, the fact that sales are taking place, and other requirements specified in the CCPA. Companies engaging in data sales must have a “do not sell” link on their homepage and in their privacy policy, with the required means to opt-out enabled. Service provider contracts must meet CCPA’s service provider contract requirements in order for the relationship to be exempt from the “sale” definition. Note that each relationship must, in fact, meet relevant service provider requirements, and language alone will not accomplish this. Similarly, service provider technologies may require additional configuration for processing to be in scope of the service provider agreement. Companies should be aware of using targeted advertising in a manner that implicitly reveals sensitive information (e.g. pregnancy or other health conditions). With the CPRA and other state laws becoming effective in the next year, companies have numerous tasks to do to prepare. For companies engaging in data sales, GPC implementation should be near the top of the to-do list, and more information is available at Global Privacy Control — Take Control Of Your Privacy

In a recent Show Cause Order, the United States Patent and Trademark Office took on the ghost of trademark attorneys past or rather it took aim at a scary level of fraud. The USPTO has threatened sanctions against Shenzhen Haiyi Enterprise Management Co. and its affiliates (collectively, “Haiyi”) for allegedly coopting the good name of deceased attorney Jeffrey Firestone and using the fake name “Jackson George” for other submissions. In recent years, the USPTO has tightened restrictions by requiring that all foreign applicants are represented by a licensed U.S. attorney. It also now requires that all filings are submitted using USPTO.gov accounts, which must be registered to individuals and are not to be shared among multiple people. Reports from the USPTO show an uptick in fraudulent filings presumably due, at least in part, to attempts to circumvent the USPTO’s requirement that registrants must eventually show use of their mark in the U.S. Haiyi, an intellectual property consulting firm based in China, allegedly helped applicants and registrants circumvent the rules by filing documents in the names of Mr. Jackson and Mr. George. As detailed in the order, Haiyi filed over 300 submission, “personally” signed by Mr. Jackson, after his death. There are over 2,500 records associated with the fictitious Mr. George, some filed at a suspiciously impossible rate. Two applications were filed at the exact same time from two different computers. Thirteen new applications were filed in a single hour from three different computers. Haiyi also has multiple USPTO.gov accounts registered in Mr. George’s name. The USPTO’s order also detailed how Haiyi filed fraudulent specimens of use, showing mock product lists on dubious websites and fabricated invoices listing vacant lots as shipping addresses. This paranormal activity was sniffed by cross-referencing emails, time stamps, signatures, trademark owners, computer networks, and credit cards used for fee payments. The USPTO’s sleuthing may shed new light on the more robust inquiries sent from Examining Attorneys reviewing trademark filings. If Haiyi cannot provide reasonable explanations for the alleged fraud, the USPTO has threatened to scrub Haiyi’s contact information from all the records, ignore submissions made by Haiyi, terminate proceedings involving Haiyi, delete Haiyi’s UPSTO.gov accounts, and block payments from Haiyi’s credit cards. At the time of this post, the USPTO has not yet sanctioned Haiyi, but we will continue to monitor this developing case.

Last month, the Court of Appeals for the Eleventh Circuit weighed in for the first time on the scienter requirement for copyright infringement under Section 1202(b) of the Digital Millennium Copyright Act or “DMCA.” In Victor Elias Photography, LLC v. Ice Portal, Inc., the Eleventh Circuit held that the DMCA has a “double scienter requirement” – not only does an alleged infringer need to know that so-called “copyright management information” or “CMI” has been removed or altered, the infringer also has to know that the removal would likely result in copyright infringement. In this decision, the Eleventh Circuit joined the Second and Ninth Circuits in holding that the defendant has to know that removing CMI would likely lead to future infringement, and not just make infringement possible or easier to accomplish. Victor Elias, the sole owner of the plaintiff (“Elias”), is a professional photographer who specializes in taking photographs of hotels and resorts throughout the U.S., Mexico, and the Caribbean, which he then licenses to these hotels and resorts. Elias registers his photographs for copyright and embeds CMI in the metadata of the images, which identifies Elias as owner and is used to find instances of copyright infringement. The defendant, a division of Shiji (US), Inc., acts as an intermediary between hotels and online travel agents, such as Expedia, by providing images of the hotels to these agents. In order to optimize the quality of the photographs, Shiji converts them to a different format, which sometimes erases metadata, including the CMI. Like any conscientious copyright owner, Elias regularly monitors the internet for evidence of copyright infringement. When, in 2016, he found unauthorized copies of his photographs on websites (including some non-online travel agent websites) from which his CMI had been stripped, Elias sued Shiji for violation of the DMCA. After discovery, the district court granted summary judgment to Shiji, concluding that Elias could not satisfy the “second scienter requirement” of Section 17 U.S.C. § 1202(b) of the DMCA. In other words, Elias had not established that Shiji “knew or had reason to know that its actions would induce, enable, facilitate, or conceal infringement.” Elias then appealed to the Eleventh Circuit. On appeal, the court noted that interpretation of Section 1202(b) of the DMCA was an issue of first impression in the Eleventh Circuit. That section prohibits a person from intentionally removing or altering CMI, or distributing works from which CMI has been removed or altered, “knowing, or . . . having reasonable grounds to know, that it will induce, enable, facilitate, or conceal [copyright infringement].” It was the last part of that provision that was at the crux of this dispute, and that the Eleventh Circuit sought to interpret. The court looked to its sister Circuits for guidance, as both the Second and the Ninth Circuits had previously addressed this provision. In Mango v. BuzzFeed, Inc., 970 F.3d 167 (2d Cir. 2020), the Second Circuit had held that, to establish a violation of Section 1202(b), a plaintiff must prove that the defendant distributed works originally containing CMI while (i) knowing that the CMI had been removed or altered without authorization and (ii) knowing or having reasonable grounds to know that such distribution “will induce, enable, facilitate, or conceal an infringement.” Those two knowledge elements are known as the “double-scienter requirement” of Section 1202(b). In Stevens v. Corelogic, Inc., 899 F.3d 666 (9th Cir. 2018), the Ninth Circuit had similarly held that a violation of Section 1202(b) requires the defendant to possess the mental state of knowing, or having a reasonable basis to know, that the defendant’s actions “will induce, enable, facilitate, or conceal an infringement.” Given the express language of the statute, Elias conceded that Section 1202(b) had a double-scienter requirement. Elias nonetheless argued that a defendant should be held liable if it knows, or has reasonable grounds to know, that its actions “make infringement generally possible or easier to accomplish.” Shiji, on the other hand, argued that a defendant must know or have reasonable grounds to know that removing CMI would likely lead to future infringement. In other words, the fight here was essentially about the probability of future infringement – does it have to be likely or just generally possible? Following the reasoning of the Ninth Circuit in Stevens, the court concluded that Shiji had the better of the argument. As the court noted, under Elias’s proposed standard, “the defendant would always know that its actions would ‘induce, enable, facilitate, or conceal’ infringement because distributing protected images wrongly cleansed of CMI would always make infringement easier in some general sense.” The court reasoned that such an interpretation would “effectively collapse the first and second scienter requirements.” (It would also mean we wouldn’t get to use the fun phrase “double-scienter requirement!”). Applying its statutory interpretation to this case, the court affirmed the district court, holding that Elias had failed to submit evidence sufficient to create a genuine issue of material fact as to whether Shiji knew or had reason to know that its actions “will induce, enable, facilitate, or conceal infringement” of Elias’ copyrighted works. Elias had argued that Shiji’s involvement in a 2016 arbitration involving allegations of CMI removal, as well as examples of images of Elias’ photographs on non-party websites that had been stripped of his CMI, reflected that Shiji had or had reason to have such knowledge. The court, however, found that the arbitration was factually distinguishable and would not have given Shiji any reason to know that its software’s effects on CMI would make copyright infringement “likely.” Similarly, the court held that there was no evidence linking Shiji’s actions of removing CMI with the instances of infringement Elias had discovered online. Did the court get it right? It seems so, at least on these facts, since there doesn’t appear to have been any evidence that Shiji knew or should have known that its action would make copyright infringement likely. The Eleventh Circuit’s statutory interpretation seems on the mark too – and is in accord with the conclusions reached by the Second and Ninth Circuits. What’s beyond doubt is that plaintiffs alleging a violation of Section 1202(b) have a very high burden indeed in these Circuits. Not just scienter – double-scienter!!