New Media and Technology Law Blog

Apple X’s Face ID Feature Places Spotlight on Facial Recognition Technology, Raising Numerous Mobile Privacy and Data Usage Issues

This week’s Apple X announcement was not more than a few hours old, and the questions began to come in. Apple’s introduction of Face ID facial recognition on its new phone – although already available in some form on several Android phones – generated curiosity, concerns and creativity.  Unfortunately, the details about specifically how the recognition feature will really work are yet unknown.  All the public knows right now is that the phone’s facial “capture” function, powered by an updated camera and sensor array, will direct 30,000 infrared dots around a user’s face and create a hashed value that will presumably be matched against a user’s face during the unlocking procedure.

The questions and issues this raises are too numerous and varied to address in a single blog post. I will simply point out that the concerns over Face ID range from spoofing (e.g., Can the phone be unlocked by a picture? [Apple says no, explaining that the system will map the depth of faces]) to security (e.g., Is the “face map” or hashed value stored in a database which can be breached? [Apple, says no, like fingerprints in Apple’s current Touch ID feature, the face map will be securely stored locally on the device]).

One issue that I thought was particularly interesting, however, relates to the ability of apps residing on a phone to interact with facial captures. Unless disabled, Face ID could potentially be “always on,” ready to capture facial images to authenticate the unlocking of the phone, and possibly capturing facial images as the user interacts with the unlocked phone.  So, clients have asked: Will the apps on the phone be able to access and use those facial captures? Continue Reading

Online Vacation Rental Marketplace Sends Claims Packing with Carefully Drafted Terms

In a resounding victory for well-drafted terms and conditions and robust immunity under Section 230 of the Communications Decency Act, 47 U.S.C. § 230 (“CDA Section 230”), a Massachusetts district court granted summary judgment in favor of HomeAway, the online vacation rental marketplace, on two users’ claims stemming from a dispute over a property listing on the VRBO.com site. (Hiam v. HomeAway.com, Inc., No. 16-10360 (D. Mass. July 27, 2017)).   In its opinion, the court not only held that CDA Section 230 bars HomeAway from being treated as a “seller of travel services” under state consumer protection regulations, but also that HomeAway’s terms and conditions and privacy policy expressly disavowed any promises to pre-screen or monitor rental listings or release member information upon a user’s request. Continue Reading

Second Circuit Upholds Uber’s Mobile Contracting Process, Establishing Template for Mobile Online Contracting

In recent years, courts have issued varying rulings as to whether online or mobile users adequately consented to user agreements or terms of service when completing an online purchase or registering for a service.  In each case, judges have examined the facts closely, particularly the user interface that presents the terms to the user before he or she completes a transaction.  In an important ruling vindicating Uber’s user registration and electronic contracting process, the Second Circuit reversed the lower court and held that the notice of Uber’s terms of service was reasonably conspicuous and that the plaintiff unambiguously manifested assent to the terms, and therefore agreed to arbitrate his claims with Uber. (Meyer v. Uber Technologies, Inc., 2017 WL 3526682 (2d Cir. Aug. 17, 2017)).  While clearly good news for Uber in this litigation, in blessing Uber’s mobile contracting process, the court also established something of a template for other mobile apps to follow to ensure that their terms and conditions will be enforceable against their members or users.  Continue Reading

Ending Data Scraping Dispute, Craigslist Reaches $31M Settlement with Instamotor

Craigslist has used a variety of technological and legal methods to prevent unauthorized parties from violating its terms of use by scraping, linking to, or accessing user postings for their own commercial purposes. For example, in April, craigslist obtained a $60.5 million judgment against a real estate listings site that had allegedly received scraped craigslist data from another entity. And craigslist recently reached a $31 million settlement and stipulated judgment with Instamotor, an online and app-based used car listing service, over claims that Instamotor scraped craigslist content to create listings on its own service and sent unsolicited emails to craigslist users for promotional purposes.  (Craigslist, Inc. v. Instamotor, Inc., No. 17-02449 (Stipulated Judgment and Permanent Injunction Aug. 3, 2017)).   Continue Reading

Court Issues Injunction Barring Blocking of Scraping and Holds CFAA Likely Doesn’t Apply

A Green Light for Screen Scraping? Proceed With Caution…

While the law relating to screen scraping  is unclear, a recent landmark decision from the Northern District of California, hiQ Labs, Inc. v. LinkedIn, Corp., 2017 WL 3473663 (N.D. Cal. Aug. 14, 2017), appears to limit the applicability of the CFAA as a tool against scraping. Indeed, in granting injunctive relief against LinkedIn’s blocking of hiQ’s scraping activities, the hiQ court noted that, by invoking the CFAA, “[c]ompanies could prevent competitors or consumer groups from visiting their websites to learn about their products or analyze pricing.” While the hiQ decision suggests that, at least in some circumstances, scraping of publicly available websites does not give rise to a cause of action under the CFAA, scrapers beware – the road may still have some rough patches ahead.

Read the full Client Alert on our website.

Delaware Authorizes Stocks on Blockchain

On July 21st, Delaware Governor John Carney Jr. signed SB 69 into law. SB 69 amends the Delaware General Corporation Law (“DGCL”) to explicitly authorize the use of distributed ledger technology in the administration of Delaware corporate records, including stock ledgers.

Distributed ledger (or “blockchain”) technology-based platforms enable peer-to-peer transactions and eliminate the need for a trusted intermediary to verify and process the transactions. The potential applications of such technology in the administration of corporate records, and stock ledgers in particular, are tremendous. Continue Reading

SEC on Initial Coin Offerings: Tokens May Be Securities

No blockchain phenomenon has garnered more attention lately than Initial Coin Offerings (“ICOs”), which have exploded in value and raised more than $1.2 billion thus far this year.

In a typical ICO, a blockchain-based product or service provider offers proprietary digital assets (“tokens”) – rather than traditional forms of debt or equity – in exchange for working capital, usually provided in the form of a cryptocurrency such as Bitcoin or Ether (“ETH”).

One of the first truly significant ICOs was carried out by a platform called The DAO, an attempt by an entity known as Slock.it to build a “decentralized autonomous organization.” Over the span of about a month in May 2016, The DAO’s ICO raised about 12 million ETH — the equivalent of approximately $150 million.

Last week, the Securities and Exchange Commission released a report of investigation regarding potential federal securities law violations involving The DAO and related entities. Although it determined not to pursue enforcement action, its report stated that the digital tokens issued by The DAO in its ICO qualify as securities under the Securities Act of 1933 and the Securities Exchange Act of 1934. The SEC found that the DAO Tokens are securities because they constitute an “investment contract” under the federal securities laws.

Read the full Client Alert on our website.

Google Escapes Genericide Claim in Ninth Circuit Decision

On May 16, 2017, the Ninth Circuit rejected a petition for cancellation of the GOOGLE trademark based on a “genericide” theory that claimed Google should lose its trademark protection because the word “google” has become synonymous to the public with the term “search the internet.” (See Elliott v. Google, Inc., 2017 WL 2112311 (9th Cir. May 16, 2017)).

Genericide, or a claim of genericness that would allow for cancellation of a trademark, occurs when the public appropriates a trademark and uses it as a generic name for particular types of goods or services irrespective of source. The accusation of genericide is ironic: that because brands have become so popular, consumers simply use their names generically for a type of product, and thus brands should no longer be trademarked.  Such genericide can occur due to a trademark owner’s failure to police the mark, resulting in widespread usage by competitors leading to a perception of genericness among the public. Continue Reading

New York Attorney General Unveils Latest Ticket Bot Enforcement Actions against Ticket Vendors and Software Developer

With summer concerts and music festivals in full swing, many fans will be surprised to find $145 face value tickets reselling online for $3,000 to $11,000.

On May 11, 2017, New York Attorney General Eric Schneiderman took the most recent step in dealing with this problem, and announced seven settlements in “ticket bot” enforcement actions, calling for settlement payments totaling $4.19 million. This development represents the latest step in Schneiderman’s longstanding and highly publicized efforts to combat unfair ticket resale practices occurring in New York.  The enforcement also highlights the technological methods that ticket brokers use to evade the protective measures of well-known ticket marketplaces or otherwise conceal their online activities. Continue Reading

Washington Enacts a Biometric Privacy Statute in a Departure from the Existing Standard

We have been writing about the biometric privacy legal landscape, which has thus far been dominated by the Illinois Biometric Information Privacy Act (BIPA).  While there are a number of states that are considering bills modeled after BIPA, Washington has enacted a bill that takes a dramatically different approach.   On May 16, 2017, HB 1493 (the “Washington Statute,” or the “Statute”) was signed into law by Governor Jay Inslee and will become effective on July 23, 2017.

The stated purpose of the Statute is to require a business that collects and can attribute biometric data to a specific individual to disclose how it uses that biometric data and provide notice to and obtain consent from an individual before enrolling or changing the use of that individual’s biometric identifiers in a database. Unlike BIPA, the Statute does not provide a private cause of action; it may be enforced solely by the state attorney general under the Washington consumer protection act.  It should be noted, however, that Washington has traditionally been one of the leading states with regard to the enforcement of consumer privacy. Continue Reading

LexBlog