Over the past few years, we have seen increasing legislative and regulatory activity around the globe on the issue of digital accessibility. Most recently, the French government issued a new law and corresponding technical order (known as the General Accessibility Reference for Administrations, or RGAA) last year that impose a broad range of accessibility obligations on businesses earning more than €250 million in annual revenue in France (as averaged over the prior three years). The RGAA requires covered businesses to make websites, mobile apps, and other online services that have been localized for France accessible to people with disabilities. Specifically, these online services must comply with the Web Content Accessibility Guidelines version 2.1, Levels A and AA, or ETSI/EN 301 549 v.2.1.2 (2018-08). In addition to meeting this accessibility requirement, covered businesses must satisfy a number of other testing, notification, training, and documentation requirements. Websites created on or after October 1, 2019, are already subject to the RGAA, but websites created before October 1, 2019, will need to be compliant by October 1, 2020, and compliance obligations will become effective for mobile apps, software, and other online services on July 1, 2021.

For the second year in a row, Washington State is considering the “Washington Privacy Act,” legislation that would regulate the collection and use of consumer data and have Washington join a chorus of states looking to legislate privacy. The bill (SB 6281) passed the Washington Senate with near-unanimous approval on February 14 and has until March 6 to be approved by the House of Representatives.

The bill mirrors existing privacy laws, like the GDPR and CCPA, in its treatment of consumer rights and restrictions on data use and regulates the use of facial recognition technology. It has attracted criticism from a variety of stakeholders, including some who argue it insufficiently protects consumers.

What’s in the Washington Privacy Act (as of February 18, 2020)?

Scope: The Washington Privacy Act would apply to “legal entities” that conduct business in Washington or offer products or services targeted to Washington residents and (i) control or process personal data of 100,000 or more consumers annually or (ii) derive over 50% of gross revenue from the sale of personal data and process or control the personal data of 25,000 or more consumers. The bill carves out certain organizations (e.g., state agencies, local government, and tribes) and types of information (e.g., information covered by GLBA or HIPAA) from the scope. The bill does not apply to employment data and delays application to higher education and non-profit organizations for 3 years.

Restrictions on Covered Businesses: The bill uses a controller/processor structure similar to the GDPR and assigns responsibilities based on the business’s role. Controllers must (1) publish a privacy policy, explaining why and how they use data; (2) limit collection of personal data to only that data reasonably necessary to the purposes for which it was collected (“purpose specification”); (3) minimize the data collected and maintained (“data minimization”); (4) avoid secondary uses of the data; and (5) maintain reasonable data security practices. They must also conduct data protection assessments for certain data processing activities. Processing of sensitive data (which includes specific geolocation data and genetic or biometric data) requires the consumer’s consent.

Consumer Rights: The bill provides Washington consumers with rights to access, correct, and delete their personal data. They also have the right to data portability. Consumers can opt out of the processing of their personal data for targeted advertising, sale, or profiling in furtherance of decisions that produce legal effects concerning the consumer.

Facial Recognition: The bill’s section on facial recognition requires processors offering facial recognition technology to make their technology available for controllers or third parties to conduct independent tests for accuracy and unfair performance bias. If independent testing finds inaccuracies or bias, the processor must implement a mitigation plan. Controllers using facial recognition technology in public must post a notice. Consent must be obtained from a consumer prior to enrolling an image of the consumer in a facial recognition service, subject to exceptions. Meaningful human review is required prior to making decisions using facial recognition technology that produce legal effects on consumers.

Enforcement and Effective Date: The attorney general would have exclusive authority to enforce the law; there is no private right of action. Civil penalties are available, up to $7,500 per violation. The Act would supersede local laws, ordinances, and regulations. The Act would take effect on July 31, 2021.

What happens between now and March 6?

The bill is currently proceeding through the House of Representatives. There are a number of “cut-off” deadlines the bill has to meet in order to progress.

  • By February 28, the bill needs approval by the House Committee on Innovation, Technology and Economic Development.
  • By March 2, the bill needs approval by the House Appropriations Committee.
  • By March 6, the bill needs approval by a vote on the House floor.
  • By March 12, the House and Senate need to resolve any differences in the version passed by the Senate on February 14 and the version passed by the House.

In the 2019 legislative session, the Washington Privacy Act received approval from the Senate but underwent extensive amendment in the House, where it ultimately failed to move forward. This year may be a repeat of the last, as the House did not advance the companion bill to this session’s Washington Privacy Act, HB 2742, and significant debate animates stakeholders, including consumer privacy groups, particularly regarding the treatment of facial recognition technology. With just three weeks remaining in the 2020 legislative session, an uphill battle remains for the Washington Privacy Act.

The FTC recently requested public comments on questions related to its Endorsement Guides (the Guides).

While the FTC has periodically updated the FAQs associated with the Guides, it has not directly updated the Guides since 2009.  Given the changes to influencer and social media marketing over the years, the FTC is seeking input on a range of issues related to endorsements, influencers, reviews, and affiliate marketing.  For example, the FTC asks the following questions in the proposed Federal Register notice:

  • Are any specific provisions of the Guides no longer necessary, and, if so, which provisions and why are they no longer necessary?
  • What is the degree of compliance with the Guides, and do the Guides support industry self-regulation or voluntary standards?
  • Should the information in FAQs be incorporated into the Guides?
  • What changes are needed to address technological, economic, or environmental changes?
  • How well are advertisers and endorsers disclosing material connections on social media?
  • How do children understand disclosures of material connections?
  • How do incentives like free or discounted products bias consumer reviews even when reviewers are not required to make a positive review and whether/how those incentives should be disclosed?
  • Should the Guides address affiliate links, and, if so, how?
  • What disclosures, if any, do advertisers or the operators of review websites or review platforms need to make about the creation, collection, processing, or publication of reviews or ratings in order to prevent deception or unfairness?

The FTC’s announcement follows its November 2019 “Disclosures 101 for Social Media Influencers” and recent cases related to fake reviews and fake indicators of online influence.  In addition, the FTC staff indicated this month that the FTC is continuing to investigate influencer activities, and more cases are in the pipeline regarding deceptive reviews and the failure to disclose material connections between influencers and brands.  Bottom line:  good influencer practices are essential for brands and influencers, and the FTC continues to focus on influencer marketing.

Key Takeaways:

  • The FTC is seeking comments from interested parties within 60 days after publication in the Federal Register.
  • The comments could result in updates to the Endorsement Guides or related FTC guidance.
  • Endorsements and influencers continue to be an enforcement priority for the FTC, so brands should audit their endorsement and influencer policies (and associated monitoring and training programs) for influencers, marketers, agencies, and employees.

On December 20, 2019 the FTC sued FleetCor Technologies, Inc. and its CEO, Ronald Clarke, for alleged misleading advertising practices, claiming FleetCor had collected at least $200 Million dollars in hidden fees from fuel card service customers. According to the Complaint, FleetCor’s ads promised customers that their fuel card service had no setup, transaction, or membership fees. But the FTC alleges that FleetCor charged customers those very fees, merely renamed as “Account Administration Fees,” “Program Fees,” “High Credit Risk Account Fees,” “Convenience Network and Out of Network Fees,” “Minimum Program Administration Fees,” and “Late Fees and Interest and Finance Charges.”  Continue Reading FTC Sues FleetCor for Hidden Fee and other Deceptive Advertising Practices

The National Advertising Division recently revealed its plans to launch a fast-track resolution process to resolve certain false advertising claims in a mere 2-4 weeks. This fast-track process will provide a useful tool for companies that want to quickly and efficiently challenge certain competitor advertising practices. Continue Reading NAD Reveals Initial Plans for 2020 Fast-Track Process

Companies providing web services to government agencies may want to note a recent decision in State of California ex rel. Bashin v. Conduent Inc., in which the California Superior Court denied defendant’s motion to dismiss a false claims act suit stemming from its representations in an RFP with the state regarding website accessibility. Continue Reading Web Accessibility Suit Alleging False Claims Act Violations Survives in California Court

In November, the FTC issued a new resource for online social media influencers, titled “Disclosures 101 for Social Media Influencers,” which provides compliance tips for influencers disclosing payment, free products, and other “material connections” in their social media posts.  This new guide is the latest development in an ongoing effort by the FTC to educate influencers on when disclosure obligations apply and how to make effective disclosures.  A few takeaways from the new guide Continue Reading FTC Publishes “101” Disclosures Guidance for Social Media Influencers

On October 21, 2019, the Federal Trade Commission (FTC) announced that it had settled two cases regarding alleged fake indicators of social media influence and fake product reviews.

In the first action, the FTC alleged that Devumi, LLC and its CEO had “sold fake indicators of social media influence, including fake followers, subscribers, views, and likes, to users of different social media platforms, including LinkedIn, Twitter, YouTube, Pinterest, Vine, and SoundCloud.”  These fake indicators were designed to make the influencers more attractive to businesses and individuals hiring the influencers or making purchase decisions related to the influencers (e.g., the more followers or engagement associated with the influencer, the higher fees a business might pay to engage them or more value consumers might give their opinion). Continue Reading FTC Settles Two Cases of Alleged Fake Reviews and Online Influence

Businesses must begin taking concrete steps to prepare for the next wave of environmental and consumer products safety litigation, which is likely to focus on any historic and/or current use of materials containing certain per- and polyfluoroalkyl substances (PFAS). An umbrella term covering more than 5,000 man-made chemical compounds, PFAS has been widely used in consumer and industrial products for more than 70 years, including in many common food containers and wrappers, non-stick cookware, furniture, clothing and other products that resist water, grease or oil. Known colloquially as “forever chemicals,” scientific studies have suggested that human exposure to unsafe levels of PFAS may be linked to a variety of health risks. The federal government has announced regulatory and legislative efforts to reduce or eliminate the use of PFAS compounds in consumer products and several state governments have already adopted laws doing the same.

The following update addresses possible risks for manufacturers and distributors of products containing PFAS, as well as next steps these companies should take. Read our update here.