Social media sites are transforming not only the daily lives of consumers, but also how companies interact with consumers. Here at Morrison Foerster, across all of our practice groups, we are seeing complex, cutting-edge legal issues arising out of social media. As with the Internet boom during the mid-to-late 1990s, social media is generating new legal questions at a far faster pace than the law’s ability to provide answers to such questions. In an effort to stay on top of these emerging issues, and to keep our clients and friends informed of new developments, Morrison Foerster publishes this blog devoted to the law and business of social media.<h2>ABOUT MORRISON FOERSTER</h2>Morrison Foerster is a leading global law firm that transforms complexity into advantage for its clients. Our clients include some of the largest financial institutions, banks, consulting and accounting firms, and Fortune 100, technology, and life sciences companies. Highlighting the firm’s commitment to client service, leadership in market-changing deals and impact litigation, and values-based culture, Morrison Foerster has been repeatedly recognized as one of the top 10 firms on The American Lawyer’s A-List. Year after year, the firm receives significant recognition from Chambers and The Legal 500 across their various guides, including Global, USA, Asia‑Pacific, Europe, UK, Latin America, and FinTech Legal. Our lawyers passionately care about delivering legal excellence while living our values. Morrison Foerster has a long-standing commitment to creating a culture that respects and celebrates differences, while providing an inclusive environment. The firm has achieved Mansfield Certification Plus since 2018 as a result of successfully reaching at least 30 percent women, communities of color, and LGBTQ+ lawyer representation in a notable number of current leadership roles and committees. The firm also has a long history of commitment to the community and society through providing pro bono legal services, including litigating for civil rights and civil liberties, improving public education and fostering the wellbeing of children, advocating for veterans, promoting international human rights, enforcing the right to asylum, and safeguarding the environment.

Social

Search

sociallyaware-abajournalweb100-1

Aaron is the chair of the firm’s Technology Transactions Group and co-chair of the Interactive + Digital Media Group. He advises clients on a wide range of complex transactions involving intellectual property and technology, including structuring and negotiating strategic licensing, development, collaboration, procurement, and distribution deals.Aaron’s practice focuses on advising both established and emerging companies in a variety of data- and technology-intensive sectors, including software, SaaS, cloud-based technology, digital media (social media, AR/VR, gaming, streaming media, AdTech), AI, healthcare, consumer electronics, e-commerce, other online business models, and mobile applications. He also maintains an active practice counseling companies on branding and marketing, trademark licensing, and content-related transactions, as well as the intellectual property aspects of mergers, acquisitions, asset spin-offs, and private equity investments.He has represented clients such as Autodesk, Meta, OpenAI, Splunk, Konami, Kaiser Permanente, SoftBank, Visa, and Yahoo, among others.Aaron has been recognized by numerous publications for his work on market-defining technology transactions. He is currently ranked by Chambers USA for “Technology Transactions.”Aaron also serves as co-editor of Socially Aware, the firm’s award-winning newsletter and blog devoted to the law and business of social media, and regularly publishes on various IP and technology-related topics. Aaron is also a sought-after speaker on new and emerging areas of law, and is a frequent presenter and panelist at conferences and legal services programs. In addition to his active practice, Aaron regularly provides pro bono assistance to various nonprofit and charitable organizations such as Common Sense Media and the Starlight Children’s Foundation. He is a member of the board of directors of California Lawyers for the Arts.While in law school at the University of California, Berkeley, Boalt Hall School of Law, Aaron served as executive editor of the California Law Review and was elected to the Order of the Coif. Following law school, Aaron served as law clerk to the Honorable William H. Orrick and the Honorable Martin J. Jenkins, both United States District Judges for the Northern District of California.

rubin_aaron_blog_150x150.png

rubin_aaron_common_640x280.jpg

rubin_aaron_heroretina_2700x1160.jpg

rubin_aaron_mobileretina_750x1040.jpg

rubin_aaron_social_600x600.jpg

Partner

technology-industries-thumb.jpg

Our technology transactions and information technology lawyers advise on issues relating to the acquisition and commercialization of new technologies and IP assets.

Technology Transactions

Technology Transactions Lawyers

Healthcare: Life Sciences

Intellectual Property: Patents: Licensing

Media, Technology and Telecoms: Outsourcing

 Top Ranked (Band 1) Nationwide: Artificial Intelligence

Outsourcing

Intellectual Property Patent 

Spotlight: Global-Wide (Global Market Leaders) Commercial Contracts

Spotlight: Global-Wide (Global Market Leaders) Artificial Intelligence

USA: Technology Sector (International & Cross-Border)

Recommended for Transactions

California: Recommended for Transactions

UK: England & Wales: Bronze for Transactions

Media, Technology and Telecoms: Technology Transactions

Japan: Highly Recommended for Transactions

Top Ranked (Band 1) Nationwide: Technology

Top Ranked (Band 1) California: Technology Transactions

Nationwide: Outsourcing

Top Ranked (Band 1) New York: Outsourcing

Top Ranked (Band 1) China: TMT: International Firms

Top Ranked (Band 1) in Japan: Technology, Media, Telecoms

Top Ranked (Band 1) USA: Technology Sector (International & Cross-Border)

Singapore TMT: Foreign Firms

Germany: Telecommunications

Germany: Media

London: Information Technology

Global: Outsourcing

Global: TMT

USA: Outsourcing

Asia-Pacific: TMT

Top Ranked (Band 1) Asia-Pacific Region: Technology, Media, Telecoms

Technology, Media & Telecoms: IT & Telecoms

China: TMT: Foreign Firms

Hong Kong: TMT

Top Ranked (Band 1) Japan: TMT: International Firms and Joint Ventures 

Aaron is the chair of our Technology Transactions Group. He advises clients on a wide range of complex transactions involving intellectual property and technology, including structuring and negotiating strategic licensing, development, collaboration, procurement, and distribution deals. Aaron’s practice focuses on advising both established and emerging companies in a variety of data– and technology–intensive sectors, including software, SaaS, cloud computing, AR/VR, AI, gaming, healthcare, consumer electronics, social media, e–commerce, other online business models, and mobile applications. He also maintains an active practice counseling companies on the intellectual property aspects of mergers, acquisitions, asset spin–offs, and private equity investments.

Aaron P. Rubin

Lawrence Gallick is of counsel in the firm’s Austin office and a member of the Technology Transactions Group.Lawrence focuses his practice on technology transactions and licensing matters. His diverse experience includes advising on SaaS agreements, cross-licensing agreements, research and collaboration agreements, development agreements, and distribution agreements. He counsels a broad range of companies across the software, hardware, life sciences, biotech and FinTech spaces, as well as other entities including universities.He advises clients in connection with general corporate matters including contract negotiations, and leasing and technology placement agreements.In 2023, Lawrence seconded at Amazon Lab126, where he led the negotiation of high-profile licensing deals for a variety of Amazon device teams. The secondment was an immersive opportunity to gain additional insights and experience from the perspective of in-house counsel. Lawrence also serves as co-editor of <a href="https://www.sociallyawareblog.com/" target="_blank">Socially Aware</a>, the firm’s award-winning newsletter and blog devoted to the law and business of social media, and regularly publishes on various IP and technology-related topics.Prior to joining the firm, Lawrence was counsel at another major law firm. Before earning his law degree, Lawrence was a web consultant, project manager, and web developer in Portland, Oregon, where he managed and consulted on projects using industry methodologies and performed custom development and integration of content management systems.Lawrence was named a Super Lawyers “Rising Star” in 2015 and 2018–2022, and is licensed in both California and New York. Lawrence earned his J.D. from the University at Buffalo School of Law, where he was the electronic systems editor for the Buffalo Law Review and awarded the ABA-BNA Award for Excellence in the Study of Intellectual Property Law.

gallick_lawrence_blog_150x150.png

gallick_lawrence_common_640x280.jpg

gallick_lawrence_heroretina_2700x1160.jpg

gallick_lawrence_mobileretina_750x1040.jpg

gallick_lawrence_social_600x600.jpg

Of Counsel

Lawrence Gallick

Anthony Ramirez is a partner in the Technology Transactions Group in the New York office of Morrison Foerster.Anthony advises clients on general commercial and transactional matters. He regularly advises companies on the IP aspects of their M&A transactions. His clients include technology, digital media and content for television and music, financial services, and communications companies with diverse intellectual property assets and issues.His practice focuses on the legal aspects of developing, licensing, and commercializing technology and intellectual property, as well as negotiating general commercial contracts, including outsourcing transactions, as well as content and data licenses. He regularly assists clients with legal issues relating to licensing and commercialization of digital media and content, digital content that is distributed over the Internet or streamed, mobile applications and social media, as well as the licensing of recorded music for distribution via digital platforms. Anthony is also experienced with issues relating to open-source software, software development, artificial intelligence and machine learning, cloud-based technology, and protection of proprietary information.Anthony has extensive experience working on matters involving disruptive technologies, such as blockchain. He has helped fintech clients with general intellectual property issues in connection with terms of service for online financial products and services.Anthony is an integral part of the outside pro bono legal team for nonprofit organizations based in New York, including advising clients on legal issues regarding entertainment, social media, privacy rights, and the negotiation of outsourcing and service agreements. Anthony received his J.D. from the University of Michigan Law School in 2009. He received his B.S. from Cornell University in 2004.

ramirez_anthony_blog_150x150.png

ramirez_anthony_common_640x280.jpg

ramirez_anthony_heroretina_2700x1160.jpg

ramirez_anthony_mobileretina_750x1040.jpg

ramirez_anthony_social_600x600.jpg

Anthony Ramirez is a partner in the Technology Transactions Group in the New York office of Morrison Foerster. He advises clients on general commercial and transactional matters. His clients include technology, media, and communications companies with considerable intellectual property assets. His practice focuses on the legal aspects of licensing and commercializing technology and intellectual property, as well as negotiating general commercial contracts. He also regularly assists clients with legal issues relating to mobile applications and social media.

Anthony M. Ramirez

favicon.ico

favicon-16x16.png

favicon-32x32.png

apple-touch-icon.png

MoFo Favicons

Socially Aware is devoted to the law and business of social media, proactively addressing emerging issues and keeping our clients informed of new developments. We cover fields such as artificial intelligence, privacy and data security, Section 230, intellectual property, and much more.

Welcome to Socially Aware

240920-socially-aware-header.jpg

Welcome to Socially Aware

240920-socially-aware-header

Socially Aware is devoted to the law and business of social media, proactively addressing emerging issues and keeping our clients informed of new developments. We cover fields such as artificial intelligence, privacy and data security, Section 230, intellectual property, and much more.

News and Announcements

Blog - Terms of Use

Blog - Privacy Policy

Blog - Blog Disclaimer

Blog - Attorney Advertising

morrison-foerster-blog-logo.png

Provides a data-driven look at the Federal Circuit.

Federal Circuitry

Brings together legal insights and in-depth analyses on trends and complex issues shaping the global technology industry.

MoFo Tech

Mofo Tech

Equips our clients with the most up-to-date and relevant information on employment and labor law issues.

Employment Law Commentary

In-depth analysis of developments and trends impacting government contracting.

Government Contracts Insight

Government Contracts Insights

Provides insights and reports on the most current class actions lawsuits and product liability issues that affect consumer-facing companies.

Class Dismissed Blog

Class Dismissed

MoFo’s Socially Aware blog provides timely updates and analysis of the many complex and cutting-edge legal and business issues arising out of social media.

Socially Aware

  Linkedin

MoFo LinkedIN

Socially Aware Blog - RSS

Stay Connected

Never miss a post from Socially Aware. Enter your email below to stay up-to-date.

Subscribe

The Law and Business of Social Media

Morrison Foerster - Footer

Blogs -  Home Button

Home

Blog - Topics

Web Scraping

Topics

Blog - Editors

Editors

Blog - About

About

Blog - Subscribe

More

Lawrence W. Gallick

SCOTUS Age-Gates the Internet: Free Speech Coalition v. Paxton and the Future of Adult Content Regulation

Social Links: Clickbait, Court Dates, and the Beige Apocalypse

The Bipartisan TAKE IT DOWN Act Is Now Federal Law

Social Links: AI, Age-Gating, and the COPPA Cabana

Social Links: Statehouse v. Smartphone

LinkedIN

OHIO SOCIAL MEDIA LAW STRUCK DOWNOn April 16, 2025, a federal judge in Ohio ended the state’s ambitious plan to severely limit social media access for minors. The court <a href="https://netchoice.org/wp-content/uploads/2025/04/Court-Permanently-Halts-Ohio-Age-Verification-Law_NetChoice-v-Yost_April-16-2025.pdf" target="_blank">permanently blocked</a> Ohio’s Attorney General from enforcing the <a href="https://codes.ohio.gov/ohio-revised-code/section-1349.09" target="_blank">Parental Notification by Social Media Operators Act</a>, effectively shelving the law.Passed with admirable optimism in July 2023 and <a href="https://www.ohioattorneygeneral.gov/Media/News-Releases/December-2023/Parental-Notification-by-Social-Media-Operators-Ac" target="_blank">set to roll out</a> in January 2024, the Act required social media platforms to make sure users were old enough to drive before letting them post memes and dance videos (unless their folks say it’s okay). The court saw through the state's well-intentioned lawmaking and called out the law for First Amendment violations. U.S. District Court Judge Algenon L. Marbley pointedly noted the state’s failure to clear the notoriously high bar of strict scrutiny, effectively dooming the Act from the start. Specifically, the judge felt the legislation cherry-picked which online platforms it wanted to target, essentially trying to referee a game it didn’t fully understand. “Ohio’s response to a societal worry that children might be harmed if they are allowed to access adult-only sections cannot be to ban children from the library altogether absent a permission slip,” Judge Marbley wrote in the decision.The court framed the situation as the classic standoff between two American sacred cows: the rights of kids to express themselves freely online and the rights of parents to raise their offspring without government micromanagement. Ultimately, the ruling reminded Ohio legislators that freedom of speech, even adolescent babble, is still constitutionally protected.This decision adds Ohio to a growing list of states being <a href="https://netchoice.org/litigation/" target="_blank">successfully challenged</a> by NetChoice, the tech trade association that’s rapidly becoming the grim reaper of underage social media control legislation.    ANOTHER ARKANSAS SOCIAL MEDIA LAW STRUCK DOWNArkansas has once again found itself on the losing side of a First Amendment battle. The state’s latest effort, the Social Media Safety Act (<a href="https://arkleg.state.ar.us/Home/FTPDocument?path=%2FACTS%2F2023R%2FPublic%2FACT689.pdf" target="_blank">Act 689</a>), met the same fate as its 2023 predecessor (<a href="https://arkleg.state.ar.us/Bills/Detail?id=sb396&ddBienniumSession=2023%2F2023R" target="_blank">SB 396</a>): <a href="https://netchoice.org/wp-content/uploads/2025/04/Court-Permanently-Halts-Arkansas-Age-Verification-Law_NetChoice-v-Griffin_Mar-31-2025.pdf" target="_blank">enjoined</a> as unconstitutional.The plaintiff in both cases, unsurprisingly, was NetChoice. Unless you’ve been living under a rock with no Wi-Fi, you know it from similar successful challenges in California, Utah, Maryland, Mississippi, Ohio, and Texas (not to mention extensive coverage in <a href="https://www.sociallyawareblog.com/search?q=netchoice" target="_blank">your favorite blog</a>). Courts across these states, as in Arkansas, have found these laws imposed undue burdens on free speech and were not properly tailored to address harms to minors. The Arkansas ruling marked the <a href="https://netchoice.org/netchoice-wins-court-declares-arkansas-age-verification-law-unconstitutional-permanently-halts-it-to-protect-arkansans-rights-privacy-online/" target="_blank">first time</a> NetChoice obtained a permanent injunction against restrictive social media laws, but it was quickly followed by <a href="https://netchoice.org/netchoice-v-yost/" target="_blank">another victory</a> in Ohio.The Social Media Safety Act would have required social media companies to verify that users were either at least 18 years old or had verifiable parental consent before creating an account. The law also mandated the use of third-party vendors to perform age verification, which could involve government-issued identification or other “commercially reasonable” methods. After granting access, platforms would be prohibited from retaining any identifying information, a provision that invited as much skepticism as it did compliance challenges.Although Arkansas’ latest statute has been struck down, the broader state-level push to regulate minors’ use of social media continues. Virginia is <a href="https://virginiamercury.com/2025/03/11/va-s-plan-to-restrict-social-media-for-minors-faces-pushback-and-calls-for-tighter-safeguards/#:~:text=Senate%20Bill%20854%2C%20sponsored%20by,ability%20to%20adjust%20that%20cap." target="_blank">considering</a> an amendment to its data privacy law that would restrict children under 16 to one hour of daily social media use, while also requiring age verification mechanisms. Arkansas has introduced additional legislation targeting social media companies, and Utah has <a href="/topics/utah-s-new-app-store-age-verification-law-what-s-b-142-means-for-kids-parents-and-tech" target="_blank">moved forward</a> with app store age restrictions that will be phased in between May 2025 and December 2026.Texas has introduced <a href="https://capitol.texas.gov/BillLookup/History.aspx?LegSess=89R&Bill=HB186" target="_blank">HB 186</a>, another attempt at mandating age verification, despite previous setbacks. Not to be outdone, Florida has proposed <a href="https://www.flsenate.gov/Session/Bill/2025/868/BillText/e1/HTML" target="_blank">SB 868</a>, which would authorize law enforcement to access minors’ messages during investigations, grant parents full access to a minor’s communications, and prohibit the use of accounts featuring disappearing messages.The trend is clear. States remain committed to policing minors’ online activity, but so far their efforts have largely faltered under constitutional scrutiny. NetChoice, it seems, will continue to have no shortage of work.X SUES MINNESOTA OVER DEEPFAKE LAWX has filed a federal lawsuit against Minnesota Attorney General Keith Ellison, challenging the constitutionality of a <a href="https://www.revisor.mn.gov/statutes/2023/cite/609.771" target="_blank">state law</a> aimed at combating election-related deepfakes.Passed with bipartisan support in 2023, the law makes it a crime to post fake videos intended to influence elections, with penalties including fines or even prison time. Legislators were understandably concerned about the growing potential for AI-generated misinformation to distort political campaigns. X, however, argues that the statute’s language is so vague that no reasonable platform could confidently determine what it allows.According to <a href="https://www.courthousenews.com/wp-content/uploads/2025/04/X-lawsuit-minnesota-deepfake.pdf" target="_blank">the lawsuit</a>, the risk of criminal penalties would force platforms to err on the side of caution, pulling down anything that even faintly resembles a deepfake. In X’s view, this would chill lawful political speech—precisely the kind of “<a href="https://www.aclu.org/documents/aclu-history-robust-uninhibited-and-wide-open-meaning-first-amendment" target="_blank">uninhibited, robust, and wide-open</a>” debate the First Amendment was built to protect.X also points out that it already maintains internal mechanisms, such as the “Community Notes” feature, to address misleading content without heavy-handed censorship. The platform is asking the court to, among other things, declare the statute in violation of both the Minnesota and U.S. Constitutions, nullify it, and prevent its enforcement.Supporters of the law are unsurprised by the challenge. State Senator <a href="https://www.senate.mn/members/member_bio.html?mem_id=1271" target="_blank">Erin Maye Quade</a>, one of the bill’s sponsors, defended the statute as narrowly tailored to prevent voter deception. In remarks that left little room for ambiguity, she <a href="https://senatedfl.mn/senator-erin-maye-quade-responds-to-failed-election-manipulator-elon-musks-lawsuit/" target="_blank">suggested</a> X’s motives might be less about free speech and more about preserving the ability to influence elections through technology. As for Attorney General Ellison’s office, the response so far has been measured: officials say they are reviewing the lawsuit and will respond “in the appropriate time and manner.” THE NINTH CIRCUIT’S EXPANSIVE TAKE ON INTERNET JURISDICTIONOn April 21, 2025, the Ninth Circuit, sitting en banc, delivered a <a href="https://cdn.ca9.uscourts.gov/datastore/opinions/2025/04/21/22-15815.pdf" target="_blank">10-1 decision</a> reviving Briskin v. Shopify, a class action accusing e-commerce platform Shopify of violating privacy laws through the use of internet cookies. The court adopted a notably broad view of specific personal jurisdiction over online businesses—a development likely to raise eyebrows across the tech and legal communities.The case arose when California resident Brandon Briskin alleged that Shopify surreptitiously installed tracking cookies on his iPhone after he made a purchase through Shopify’s platform. According to the complaint, the cookies monitored Briskin’s movements and online behavior without his consent, violating a host of California privacy statutes, the state constitution, and even the Fourth Amendment.Both the <a href="https://scholar.google.com/scholar_case?case=12735640797001602544&hl=en&as_sdt=6&as_vis=1&oi=scholarr" target="_blank">district court</a> and a <a href="https://scholar.google.com/scholar_case?case=1011294239889633344&hl=en&as_sdt=6&as_vis=1&oi=scholarr" target="_blank">Ninth Circuit panel</a> initially dismissed the claims for lack of jurisdiction. Shopify is headquartered in Canada, and none of its U.S. subsidiaries are based in California. However, the en banc majority reversed the panel, concluding that Shopify had “purposefully directed” its conduct at California consumers by allegedly monetizing their personal data.Judge <a href="https://appellate.courts.ca.gov/district-courts/3dca/bio/consuelo-maria-callahan" target="_blank">Consuelo Callahan</a>, the sole dissenter, warned that the majority’s reasoning effectively creates a “traveling cookie” doctrine, suggesting that if a company’s tracking software attaches to a consumer’s device, jurisdiction follows that individual wherever they go.The decision opens the door to broader assertions of jurisdiction, with potentially far-reaching consequences for social media, online commerce, and any platform that uses cookies. Given the stakes, we’ll be watching this one closely.UTAH CRACKS DOWN ON “FAMILY VLOGGING” AFTER HIGH-PROFILE ABUSE CASEIn a state where family vlogging is practically an industry, Utah has become the latest to step into the legal void around child influencers. Gov. Spencer Cox signed a <a href="https://le.utah.gov/Session/2025/bills/enrolled/HB0322.pdf" target="_blank">new law</a> aimed at protecting minors who appear in online content; a move that follows the child abuse conviction of former YouTube creator Ruby Franke.The new legislation gives adults the right to scrub content they were featured in as minors and requires parents to set aside earnings for child participants. Specifically, online creators who earn more than $150,000 annually from child-centric content must deposit 15% of those earnings into a trust, accessible when the child turns 18. The protections extend beyond YouTubers and TikTokers, applying also to child actors in film and television.<a href="https://www.cnn.com/2023/08/16/tech/kid-influencer-law/index.html" target="_blank">Illinois</a> and <a href="https://www.house.mn.gov/sessiondaily/Story/18352" target="_blank">Minnesota</a> have already adopted laws allowing children to sue for their share of online profits, but Utah’s approach goes further by offering a right to erasure. This is a notable shift for a state with deep roots in family-focused social media culture.The legislation arrives against the backdrop of the <a href="https://apnews.com/article/youtube-child-abuse-ruby-franke-jodi-hildebrandt-b237eb83bb592bbc3b1a3c3757b1263d" target="_blank">Franke scandal</a>, where the once-popular “8 Passengers” YouTube channel crumbled amid allegations (and admissions) of severe child abuse. Franke’s ex-husband told lawmakers earlier this year that he regretted allowing their family to be filmed for profit, warning that “children cannot give informed consent to be filmed on social media, period.”Utah’s family-centric online economy, buoyed by groups like the so-called “<a href="https://www.theatlantic.com/culture/archive/2024/10/momtok-secret-lives-of-mormon-wives-review-feminism-beauty-domesticity/680410/" target="_blank">MomTok</a>” community, has long flourished in the absence of meaningful regulation. Now, amid growing public discomfort with the commodification of children’s lives, lawmakers are trying to put some guardrails in place. As Eve Franke, the youngest of the Franke children, wrote in testimony supporting the law: “Kids deserve to be loved, not used by the ones that are supposed to love them the most.”

Lawrence Gallick is of counsel in the firm’s Austin office and a member of the Technology Transactions Group.

Anthony Ramirez is a partner in the Technology Transactions Group in the New York office of Morrison Foerster. Anthony advises clients on general commercial and transactional matters. He regularly advises companies on the IP aspects of their M&A transactions.











Anthony Ramirez

Aaron is the chair of the firm’s Technology Transactions Group and co-chair of the Interactive + Digital Media Group. He advises clients on a wide range of complex transactions involving intellectual property and technology, including structuring and negotiating strategic licensing, development, collaboration, procurement, and distribution deals.

Aaron Rubin

Class Actions

Compliance

Cybersecurity

Data Security

Digital Content

Disappearing Content

First Amendment

Free Speech

Privacy

Protected Speech

Social Media Policy

On December 19, 2019, the Staff of the U.S. Securities and Exchange Commission’s Division of Corporation Finance issued guidance outlining the Staff’s views about disclosure obligations that companies should consider with respect to technology, data and intellectual property risks that could arise when operations take place outside the United States. Companies should consider this guidance when preparing risk factor and other disclosures included in upcoming periodic reports and registration statements.BackgroundThe Staff notes that the SEC’s principles-based disclosure regime recognizes that new risks may arise over time, affecting different companies in different ways. For those companies that conduct business operations outside the United States, risks can arise for technology and intellectual property, particularly when operations take place in jurisdictions that do not provide protection that is comparable to the United States. The Staff observes that companies may be exposed to material risks of “theft of proprietary technology and other intellectual property, including technical data, business processes, data sets or other sensitive information.” Exposure to such risks can be heightened when companies conduct business in some foreign jurisdictions, house technology, data and intellectual property abroad, or license technology to joint ventures with foreign partners.The Staff notes that while there is no specific line-item requirement under the federal securities laws to disclose “information related to the compromise (or potential compromise) of technology, data or intellectual property,” the SEC’s disclosure requirements apply to a broad range of evolving business risks. The Staff indicates that disclosure about such matters may be necessary in risk factors, management’s discussion and analysis, the business section, legal proceedings, disclosure controls and procedures, and/or financial statements.Sources of RiskThe Staff notes that companies face the risk of theft of technology, data and intellectual property, which could occur through a direct intrusion by private parties or foreign actors (including those affiliated with or controlled by state actors). In this regard, a company could experience cyber intrusions, as well as physical theft through corporate espionage.  Indirect theft or compromise could also occur when a company’s products or components are “reverse engineered” by joint venture partners or other parties, resulting in infringement on the company’s patents or the theft of know-how or trade secrets. In addition, the Staff notes that companies may be required to “compromise protections or yield rights to technology, data or intellectual property in order to conduct business or access markets in a foreign jurisdiction, either through formal written agreements or due to legal or administrative requirements in the host nation.” The Staff cites examples such as:<ul><li>Patent license agreements pursuant to which a foreign licensee retains rights to improvements on the relevant technology, including the ability to sever such improvements and receive a separate patent, and the right to continued use of technology or intellectual property after the patent or license term of use expires;</li><li>Foreign ownership restrictions, such as joint venture requirements and foreign investment restrictions that can potentially compromise control over a company’s technology and proprietary information;</li><li>The use of unusual or idiosyncratic terms favoring foreign persons, including those associated with a foreign government, in technology license agreements, such as access and license provisions, as direct or indirect conditions to conducting business in the foreign jurisdiction; and</li><li>Regulatory requirements that restrict the ability of companies to conduct business, unless they agree to store data locally, use local services or technology in connection with their international operations, or comply with local licensing or administrative approvals that involve the sharing of intellectual property.</li></ul>Assessing and Disclosing RisksThe Staff encourages companies “to assess the risks related to the potential theft or compromise of their technology, data or intellectual property in connection with their international operations, as well as how the realization of these risks may impact their business, including their financial condition and results of operations, and any effects on their reputation, stock price and long-term value.” The Staff notes that when these risks are material to investment and voting decisions, the risks should be disclosed in a manner that allows investors to evaluate these risks “through the eyes of management.” The Staff states that disclosure about these risks should be specifically tailored to a company’s unique facts and circumstances, and that “hypothetical disclosure of potential risks is not sufficient to satisfy a company’s reporting obligations.”  The Staff suggests that companies consider the following questions when assessing and disclosing risks:<ul><li>Is there a heightened risk to your technology or intellectual property because you have or expect to maintain significant assets or earn a material amount of revenue abroad?</li><li>Do you operate in an industry or foreign jurisdiction that has caused, or may cause, you to be particularly susceptible to the theft of technology or intellectual property or the forced transfer of technology?  Do you believe that your products have been, or may be, subject to counterfeit and sale, including through e-commerce?</li><li>Have you directly or indirectly transferred or licensed technology or intellectual property to a foreign entity or government, such as through the creation of a joint venture with a foreign entity? Do you store technology or intellectual property locally in a foreign jurisdiction? Are you required to use equipment and services provided by a state actor, including equipment or services that could result in a reduction in protections?</li><li>Have you entered into a patent or technology license agreement with a foreign entity or government that provides such entity with rights to improvements on the underlying technology and/or rights to continued use of the technology following the licensing term, including in connection with a joint venture?</li><li>Are you subject to a requirement that foreign parties must be controlling shareholders or hold a majority of shares in a joint venture in which you are involved, or are you involved in a joint venture that is subject to foreign ownership restrictions or requirements that a foreign party retain certain ownership rights?</li><li>Have you provided access to your technology or intellectual property to a state actor or regulator in connection with foreign regulatory or licensing procedures, including but not limited to local licensing and administrative procedures?</li><li>Have you been required to yield rights to technology or intellectual property as a condition to conducting business in or accessing markets located in a foreign jurisdiction?</li><li>Are you operating in foreign jurisdictions where the ability to enforce rights over intellectual property is limited as a statutory or practical matter?</li><li>Do you conduct business in a foreign jurisdiction or through a joint venture that may be subject to state secrecy or other laws, such as those limiting or prohibiting the export of data or financial documentation? Are you able to readily produce data or other information that is housed internationally in response to regulatory requirements or inquiries?</li><li>Have conditions in a foreign jurisdiction caused you to relocate or consider relocating your operations to a different host nation? Have you considered related material costs, such as costs to train new employees, establish new facilities and supply chains, and the impact of any related gaps or lags in production, manufacture and/or export of your products?</li><li>Do you have controls and procedures in place to adequately protect technology and intellectual property from potential compromise or theft? Do these policies and procedures enable you to identify risks and incidents, analyze the impact on your business, respond expediently, appropriately and effectively when incidents occur and repair any damage caused by such incidents? Are your controls and procedures designed to detect: <ul><li>Malfeasance by employees, contractors or other insiders who may have access to your technology and intellectual property;</li><li>Industrial, corporate or other espionage events;</li><li>Unauthorized intrusions into commercial computer networks; and</li><li>Other forms of theft and cyber-theft of your technology and intellectual property?</li></ul> </li></ul><ul><li>What level of risk oversight and management does the board of directors and executive officers have with regard to the company’s data, technology and intellectual property and how these assets may be impacted by operations in foreign jurisdictions where they may be subject to additional risks? What knowledge do these individuals have about these risks and what role do they have in responding if and when an issue arises?</li></ul>Next StepsWhile the Staff’s guidance is not a new rule, regulation or statement of the U.S. Securities and Exchange Commission, it does represent an important reminder for companies preparing disclosures for upcoming periodic reports and registration statements. While the potential risks for a company’s technology, data and intellectual property are often addressed in risk factor disclosures, companies with international operations should consider whether such disclosures need to be augmented to address the particular risks of theft or compromise that can arise because of the jurisdictions in which operations occur and relationships with foreign entities. We expect that the Staff will be focused on these disclosures in their review of periodic reports and registration statements.

sociallyaware_gettyimages-513676272_600px-300x199.jpg

SEC Staff Issues Guidance on Technology, Data & IP Risks in International Operations

SEC Staff Issues Guidance on Technology, Data & IP Risks in International Operations

On December 19, 2019, the Staff of the U.S. Securities and Exchange Commission’s Division of Corporation Finance issued guidance outlining the Staff’s views abo

Securities Law

The high-end skincare brand Sunday Riley has settled lawsuits filed by the Federal Trade Commission claiming that the brand’s founder encouraged employees of her eponymous company to set up accounts “under different identities” on the cosmetics retail site Sephora.com and leave positive reviews for Sunday Riley’s products. The FTC filed the complaints after the agency conducted an investigation that was prompted by a whistle blower’s post on REDDIT last year. <a href="https://www.nytimes.com/2019/10/22/us/sunday-riley-fake-reviews.html" target="_blank" rel="noopener">Read about the settlement’s lenient terms</a>, which two of the FTC’s five commissioners don’t believe are severe enough to deter other companies from attempting to post fraudulent reviews online.Last month four senators—three Democrats and one Republican—<a href="https://www.forbes.com/sites/washingtonbytes/2019/10/22/the-access-act-promises-to-benefit-consumers/#2222238429e4" target="_blank" rel="noopener">introduced a bipartisan bill</a> to require communications platforms to provide their users with a means of exporting the data that their users have accumulated on the platforms, such as friends lists. The <a href="https://www.axios.com/senators-target-social-media-giants-with-data-portability-bill-222fc800-28ae-4917-8c06-ed55d809ff4a.html" target="_blank" rel="noopener">rationale</a> behind the legislation: making it easier for smaller platforms to compete with the likes of social media giants like Facebook and YouTube. Legislation like this is intended to benefit consumers and would require “<a href="https://www.forbes.com/sites/washingtonbytes/2019/10/22/the-access-act-promises-to-benefit-consumers/#3b66fe13429e" target="_blank" rel="noopener">operability standards to be revised</a>” as interfaces evolve, writes Forbes columnist Robert Seamans. The real challenge, he argues, would be determining the types of data covered by the legislation.<a href="https://blog.twitter.com/en_us/topics/product/2019/more-control-over-your-conversations-globally.html" target="_blank" rel="noopener">Twitter announced</a> it will extend to all of its users around the world the “Hide Replies” feature that it first <a href="https://techcrunch.com/2019/07/17/twitter-officially-launches-its-hide-replies-feature-initially-to-users-in-canada/" target="_blank" rel="noopener">tested in Canada in July</a> and then <a href="https://techcrunch.com/2019/09/19/twitter-launches-its-controversial-hide-replies-feature-in-the-u-s-and-japan/" target="_blank" rel="noopener">rolled out in the United States and Japan in September</a>. The feature allows users to “hide” any replies to their tweets. However, other Twitter users may view and respond to hidden replies by clicking a grey icon that appears on the tweets. <a href="https://blog.twitter.com/en_us/topics/product/2019/more-control-over-your-conversations-globally.html" target="_blank" rel="noopener">Twitter’s blog reports</a> that the platform’s test runs of the Hide Replies feature revealed that “27% of people who had their Tweets hidden said they would reconsider how they interact with others in the future,” and Twitter posters who hid replies “may want to take further action after [they] hide a reply, so now [Twitter will] check to see if you want to also block the replier.” This isn’t the first <a href="https://www.sociallyawareblog.com/2017/02/24/social-links-google-maps-gets-social-twitter-puts-trolls-in-time-out-todays-teens-take-to-chat-rooms/" target="_blank" rel="noopener">action that Twitter has taken to control trolls</a>, and the <a href="https://blog.twitter.com/en_us/topics/product/2019/more-control-over-your-conversations-globally.html" target="_blank" rel="noopener">platform’s blog promises</a> that it won’t be the last.Influencer culture has infiltrated the world of cybersecurity, with the Twitter accounts of several popular experts in that increasingly prominent field running ads for Lenovo’s “ThinkShield” line of products and services. VizSense, an influencer marker, reached out to the influencers, who included journalists, a former intelligence operative, and experts in areas like artificial intelligence, each with more than 10,000 Twitter followers apiece. <a href="https://www.axios.com/influencer-marketing-comes-to-cybersecurity-1a89489e-657b-4bc8-a42b-d1b9000ae2c0.html" target="_blank" rel="noopener">Find out why the campaign sparked controversy in the cybersecurity community</a>.Speaking of influencers, guess what <a href="https://www.bloomberg.com/news/articles/2019-11-05/becoming-an-influencer-embraced-by-86-of-young-americans" target="_blank" rel="noopener">Bloomberg reports</a> is now the number one career aspiration of the “overwhelming majority” of young Americans? Sigh.

Social Links: FTC fights fraudulent online product reviews; Twitter takes another swipe at trolls; Influencers affect everything from cybersecurity to career choices

The high-end skincare brand Sunday Riley has settled lawsuits filed by the Federal Trade Commission claiming that the brand’s founder encouraged employees of he

Social Links: FTC fights fraudulent online product reviews; Twitter takes another swipe at trolls; Influencers affect everything from cybersecurity to career choices

Influencer Marketing

Cyberbullying

Online Reviews

A recent <a href="https://law.justia.com/cases/federal/appellate-courts/ca9/17-16783/17-16783-2019-09-09.html" target="_blank" rel="noopener">decision from the Ninth Circuit Court of Appeals</a> in a dispute between LinkedIn and hiQ Labs has spotlighted the thorny legal issues involved in <a href="https://www.sociallyawareblog.com/2017/08/21/social-links-federal-court-issues-seminal-opinion-on-web-scraping-obama-breaks-twitter-record-tn-court-holds-states-subpoena-law-applies-to-digital-communications/" target="_blank" rel="noopener">unauthorized web scraping</a> of data from public websites. While some may interpret the LinkedIn decision as greenlighting such activity, this would be a mistake. On close review of the decision, and in light of other decisions that have held unauthorized web scrapers liable, the conduct remains vulnerable to legal challenge.hiQ and LinkedIn Founded in 2012, hiQ is a data analytics company that uses automated bots to scrape information from LinkedIn’s website. hiQ targets the information that users have made public for all to see in their LinkedIn profile. hiQ pays nothing to LinkedIn for the data, which it uses, along with its own predictive algorithm, to yield “people analytics,” which it then sells to clients.In May 2017, LinkedIn sent a cease-and-desist letter to hiQ demanding that it stop accessing and copying data from LinkedIn’s servers. LinkedIn also implemented technical measures to prevent hiQ from accessing the site, which hiQ circumvented.Shortly thereafter, with its entire business model under threat, hiQ filed suit in the United States District Court for the Northern District of California seeking injunctive relief and a declaration that LinkedIn had no right to prevent it from accessing public LinkedIn member profiles.Without access to LinkedIn public profile data, hiQ argued that it would likely be forced to breach its existing contracts with clients and to pass up pending deals with prospective clients. hiQ further noted that it was in the middle of a financing round when it received LinkedIn’s cease-and-desist letter and that in light of the uncertainty about the company’s future viability, that financing round stalled. hiQ claimed that if LinkedIn prevailed, it would have to lay off most, if not all, of its employees and shutter its operations.In August 2017, <a href="https://h2o.law.harvard.edu/collages/44940" target="_blank" rel="noopener">the district court granted hiQ’s motion for a preliminary injunction</a>. It ordered LinkedIn to withdraw its cease-and-desist letter, to remove any existing technical barriers to hiQ’s access to public profiles, and to refrain from putting in place any legal or technical measures with the effect of blocking hiQ’s access to public profiles.LinkedIn appealed the district court’s order. More than two years passed.The LinkedIn DecisionOn September 9, 2019, the <a href="https://www.law.com/therecorder/2019/09/09/ninth-circuit-upholds-data-miners-injunction-against-linkedin/?slreturn=20190817103036" target="_blank" rel="noopener">Ninth Circuit affirmed the district court’s preliminary injunction</a> forbidding LinkedIn from denying hiQ access to publicly available LinkedIn member profiles.The Ninth Circuit concluded that the district court did not abuse its discretion in finding that hiQ established a likelihood of irreparable harm because the survival of its business was threatened. The court further held that the district court did not abuse its discretion in balancing the equities and concluding that, even if some LinkedIn users retain some privacy interests in their information notwithstanding their decision to make their profiles public, those interests did not outweigh hiQ’s interest in continuing its business.While not ruling in favor of hiQ on the merits, the court held that the district court did not abuse its discretion in finding that hiQ raised serious questions going to (1) the merits of its claim for tortious interference with contract, alleging that LinkedIn intentionally interfered with its contracts with third parties, and (2) the merits of LinkedIn’s legitimate business purpose defense. hiQ also raised a serious question as to whether its state law causes of action for tortious interference and unfair competition were preempted, as LinkedIn alleged as its principal defense, by the <a href="https://www.nacdl.org/Landing/ComputerFraudandAbuseAct" target="_blank" rel="noopener">Computer Fraud and Abuse Act</a> (CFAA). The CFAA prohibits intentionally accessing a computer without authorization, or exceeding authorized access, and thereby obtaining information from any protected computer. In particular, the court concluded that hiQ had raised a serious question as to whether the CFAA’s reference to access “without authorization” limits the scope of statutory coverage to computer information for which authorization or access permission, such as password authentication, is generally required.In short, the court held that the district court did not abuse its discretion in finding that hiQ had made a sufficient showing under the preliminary injunction standard to obtain an order allowing it to continue to operate its business until the merits of the case were decided.Notably, the court recognized that at the preliminary injunction stage, it was not resolving the companies’ legal dispute definitively, nor was it addressing all the claims and defenses they had pleaded in the district court. The court noted that it was considering only the claims and defenses that the parties pressed on appeal and for which the companies had invoked additional claims and defenses in the district court. The Ninth Circuit expressed no opinion as to whether any of those other claims or defenses might ultimately prove meritorious.In particular, the Ninth Circuit recognized that while LinkedIn asserted that it has “claims under the Digital Millennium Copyright Act and under trespass and misappropriation doctrines,” it chose for purposes of the appeal to focus on <a href="https://www.sociallyawareblog.com/2014/07/21/data-for-the-taking-using-the-cfaa-to-combat-web-scraping/#more-3387" target="_blank" rel="noopener">the CFAA defense</a>, such that this was the sole defense to hiQ’s claims that the Ninth Circuit addressed.Practical ImplicationsProhibitions on webscraping can take many forms, and liability for unauthorized web scraping can be imposed under numerous legal theories. That one of those legal theories failed at the preliminary injunction stage in LinkedIn’s case does not mean it will fail in most cases.While the Ninth Circuit took a narrow view of the scope of the CFAA, not all courts would agree with that view. Even with publicly available data, like that on LinkedIn’s site, some courts have held that accessing a site after being expressly informed that further access is unauthorized can violate the CFAA.Moreover, the Ninth Circuit was careful to note that victims of webscraping are not without resort, even if the CFAA does not apply. The court recognized that claims for trespass to chattels, copyright infringement, misappropriation, unjust enrichment, conversion, breach of contract, breach of privacy may also lie.Thus, the decision should not be interpreted as greenlighting unauthorized web scraping. Even in the LinkedIn case itself, it is not clear which party will ultimately prevail.Importantly, the decision emphasizes the need to act promptly against unauthorized web scraping. The court clearly gave weight to the allegation that LinkedIn was well aware of hiQ’s practices for years before sending the cease-and-desist letter. The court further expressed concern that LinkedIn sent the cease-and-desist letter because it planned to create a new product that competed with hiQ’s services, which the court held could raise concerns under California’s unfair competition laws. To avoid such claims, unauthorized web scrapers should be addressed promptly before they free ride for years and build a business off your data.

Platform Liability

Commercial Litigation and Intellectual Property

International Arbitration

Bankruptcy Litigation

lawrence_j_blog_150x150.png

lawrence_j_common_640x280.jpg

lawrence_j_heroretina_2700x1160.jpg

lawrence_j_mobileretina_750x1040.jpg

lawrence_j_social_600x600.jpg

Alex advises on all aspects of complex commercial litigation in federal and state trial and appellate courts and in arbitration. He has represented U.S. and international clients in actions involving 

J. Lawrence

J. Alexander Lawrence

09_17_socially-aware_gettyimages-531172430600px-300x167.jpg

Ninth Circuit’s LinkedIn Decision Does Not Greenlight the Unauthorized Web Scraping of Public Websites

Ninth Circuit’s LinkedIn Decision Does Not Greenlight the Unauthorized Web Scraping of Public Websites

A recent decision from the Ninth Circuit Court of Appeals in a dispute between LinkedIn and hiQ Labs has spotlighted the thorny legal issues involved in unautho

Marketing

Last year we covered a wide range of online legal and business subjects intended for readers ranging from Internet entrepreneurs to social media marketers, from online shoppers to e-tailers, from networkers to influencers (and the brands that pay them).The topics of our blog posts covered a myriad of cutting-edge subjects, including a new federal law <a href="https://www.sociallyawareblog.com/2017/08/10/consumer-review-fairness-act-is-live/" target="_blank" rel="noopener">limiting a business’s ability to stop patrons from posting negative online reviews</a> and <a href="https://www.sociallyawareblog.com/2017/06/13/court-decisions-limit-ability-to-sue-in-federal-court-for-alleged-violations-of-nj-consumer-protection-l/" target="_blank" rel="noopener">a court opinion that gave online retailers some cause for celebration</a>.As interesting as those topics are, they weren’t the subjects of Socially Aware’s most widely read articles from last year. Here are the most popular posts that appeared on Socially Aware in 2017.<ol><li><a href="https://www.sociallyawareblog.com/2017/02/06/repeat-infringer-policy-requirement-for-key-copyright-safe-harbor-for-online-service-providers/" target="_blank" rel="noopener">Second Circuit Clarifies “Repeat Infringer” Policy Requirement for DMCA Copyright Safe Harbors</a></li><li><a href="https://www.sociallyawareblog.com/2017/04/10/new-yorks-new-cybersecurity-regulations/" target="_blank" rel="noopener">N.Y.’s New Cybersecurity Regulations: What Financial Services Companies Need to Know</a></li><li><a href="https://www.sociallyawareblog.com/2017/02/16/the-hague-district-courts-whatsapp-decision-creates-concerns-for-mobile-app-developers/" target="_blank" rel="noopener">The Hague District Court’s WhatsApp Decision Creates Concerns for Mobile App Developers</a></li><li><a href="https://www.sociallyawareblog.com/2017/02/23/google-ordered-foreign-stored-user-data/" target="_blank" rel="noopener">Google Ordered to Comply with Warrant for Foreign-Stored User Data</a></li><li><a href="https://www.sociallyawareblog.com/2017/04/25/limiting-statutory-damages-in-internet-copyright-cases/" target="_blank" rel="noopener">Limiting Statutory Damages in Internet Copyright Cases</a></li><li><a href="https://www.sociallyawareblog.com/2017/05/03/court-orders-google-foreign-stored-data/" target="_blank" rel="noopener">Court Orders Google to Turn Over Foreign-Stored Data</a></li><li><a href="https://www.sociallyawareblog.com/2017/08/30/zazzle-fizzles-website-operator-denied-copyright-safe-harbor-protection-for-its-sale-of-physical-products-featuring-user-generated-images/" target="_blank" rel="noopener">Zazzle Fizzles: Website Operator Denied Copyright Safe Harbor Protection for Its Sale of Physical Products Featuring User-Generated Images</a></li><li><a href="https://www.sociallyawareblog.com/2017/03/28/delaware-paves-the-way-for-blockchain-technology/" target="_blank" rel="noopener">Delaware Paves the Way for Blockchain Technology</a></li><li>Brands Beware: FTC Continues Campaign on Social Media Influencer Disclosures</li><li><a href="https://www.sociallyawareblog.com/2017/02/14/rules-for-cross-device-tracking/" target="_blank" rel="noopener">FTC Report Reinforces the Rules for Cross-Device Tracking</a></li></ol>

gettyimages-670635448_small-253x300.jpg

2017: Our Greatest Hits

Last year we covered a wide range of online legal and business subjects intended for readers ranging from Internet entrepreneurs to social media marketers, from

2017: Our Greatest Hits

Blockchain

DMCA

Stored Communications Act

“My Google Home Mini was inadvertently spying on me 24/7 due to a hardware flaw,” wrote a tech blogger who purchased Google Inc.’s latest internet of things (IoT) device. Following the incident, a pact of consumer advocacy groups insisted the U.S. Consumer Product Safety Commission (CPSC) recall the Google smart speaker due to privacy concerns arising when the device recorded all audio without voice command prompts.The CPSC is charged with protecting consumers from products that pose potential hazards. Traditionally, this has meant hazards that may cause physical injury or property damage. But as internet-connected household products continue to proliferate, issues like the “always-on” Google Home Mini raise an important question: Where does cybersecurity of consumer IoT devices fit within the current legal framework governing consumer products?<h5>The Explosion of IoT</h5>Forecasts predict that by 2020 IoT devices will account for 24 billion of the 34 billion devices connected to the internet. According to a recent Gemalto survey, “[a] hacker controlling IoT devices is the most common concern for consumers (65%), while six in ten (60%) worry about their data being stolen.”The rapid growth of the IoT market and continued integration into daily life raises the question of which regulatory body or bodies, if any, should be responsible for consumer safety when it comes to cybersecurity for consumer IoT devices.<h5>The Intersection of Consumer Product Safety, Privacy and Cybersecurity</h5>The CPSC’s jurisdiction has traditionally been limited to physical injury and property damage. It is “charged with protecting the public from unreasonable risks of injury or death associated with the use of the thousands of types of consumer products under the agency’s jurisdiction.”Companies reporting potential safety hazards are given the option to categorize the hazard as fire, mechanical, electrocution, chemical or “other.” But “other” has never been used to describe a hazard that did not involve a personal injury or property damage risk. CPSC enforcement actions against manufacturers of IoT devices for security defects that do not lead to physical injury or property damage would be unprecedented.One way to think about CPSC’s potential jurisdiction is over incidents that could give rise to product liability claims. Product liability primarily aims to compensate consumers and bystanders for injuries caused by unsafe products and to incentivize manufacturers and supply-chain participants to take reasonable precautions in producing and distributing products. The underlying policy rationale is that manufacturers are typically in the best position to prevent harms caused by their products.Product recalls seek to remove unsafe products from the market and prevent product liability claims from arising in the first place. But when does a privacy or security breach reach the threshold of a safety hazard or a product defect such that it mandates a recall? And what role do product recalls even play in an age where companies can deploy firmware updates to implement a corrective action for privacy or security breaches?The very features that are potential weaknesses for IoT devices can also be leveraged as strengths. Google demonstrated this by issuing a security patch to address the “always-on” issue in its Google Home Mini.<h5>Protecting Your Business in the Face of Regulatory Uncertainty</h5>How do IoT companies manage regulatory compliance where the regulatory framework is so uncertain and regulators are unable to keep up with technological developments? One possible construct is to anticipate traditional product defect claims that consumers might bring against IoT products, and use the power of connected devices to safeguard against liability while also protecting the product brand.Take, for example, manufacturing defects. Courts may find that errors or oversights in coding, random malfunctions or bugs in the system constitute product liability claims for manufacturing or design defects. But IoT companies can also look at ways to put checks in place to catch these issues early. And the ability of connected devices to provide effective—and even fun—warnings and instructions to consumers about possible flaws is limited only by developers’ creativity.What about failure to warn? Product manufacturers have traditionally had a duty to warn of risks that they know about or reasonably should have known about. We recently wrote about the growing role of artificial intelligence and the implications of product manufacturers’ ability to mine big data. Companies that choose to collect and store that data do assume risks, but they also have the ability to assess problems and develop innovative ways to provide warnings about them.It will take years for government regulators to catch up to these issues and enact applicable regulations, particularly in light of the current administration’s trend toward deregulation. This is a golden opportunity for IoT manufacturers to create their own framework for how best to protect consumers and to balance the risks and benefits of IoT devices.<h5>Where Do New Risks Fit into the Old Framework?</h5>Undoubtedly, the existing product liability framework has limits and doesn’t map perfectly to IoT devices. Consider the “always-on” feature recently brought to the CPSC’s attention. Under the economic loss doctrine, a plaintiff cannot recover monetary damages that don’t arise from physical injury to her person or physical harm to her property. Security breaches may cause an invasion of privacy without causing any physical injury, making the product liability framework inapplicable.As shown by the recent consumer advocacy letter, these groups may argue that security considerations and subsequent risks of IoT devices—while different from traditional public safety concerns—still fall within the CPSC’s broad mandate to “protect the public against unreasonable risk of injuries and death associated with consumer products.” But without a clear CPSC directive that an injury to privacy falls within the requirements to report a safety hazard, IoT manufacturers would be voluntarily involving CPSC should they decide to report incidents similar to the Google Home Mini.Although new regulations could fill the cybersecurity gap, technological innovation is far outpacing regulatory agencies. By the time applicable regulations are in place, they may already be out of date. Consequently, it is incumbent upon industry leaders to work together to pave the way for a robust cybersecurity framework that avoids stifling innovation by overregulation while still protecting consumers from security vulnerabilities.Advances in IoT technology and its continued integration into everyday life are changing traditional notions of consumer product safety. Working closely with product liability, privacy and cybersecurity specialists will allow IoT companies to anticipate legal issues and use technology to stay ahead of regulatory enforcement and consumer-driven lawsuits. This piece originally appeared in <a href="https://www.law360.com/articles/998965" target="_blank" rel="noopener">Law360</a>.*                   *                  *For more information on legal issues implicated by the Internet of Things, please see our earlier Socially Aware blog posts, <a href="https://www.sociallyawareblog.com/2016/02/02/the-internet-of-things-evaluating-the-interplay-of-interoperability-industry-standards-and-related-ip-licensing-approaches/" target="_blank" rel="noopener">The Internet of Things: Interoperability, Industry Standards & Related IP Licensing Approaches </a><a href="https://www.sociallyawareblog.com/2016/02/02/the-internet-of-things-evaluating-the-interplay-of-interoperability-industry-standards-and-related-ip-licensing-approaches/">(Part 1)</a>; <a href="https://www.sociallyawareblog.com/2016/04/14/the-internet-of-things-evaluating-the-interplay-of-interoperability-industry-standards-and-related-ip-licensing-approaches-part-2/" target="_blank" rel="noopener">The Internet of Things: Interoperability, Industry Standards & Related IP Licensing Approaches (Part 2)</a>; and <a href="https://www.sociallyawareblog.com/2015/02/02/ftc-issues-landmark-report-on-internet-of-things/" target="_blank" rel="noopener">FTC Issues Landmark Report on Internet of Things</a>.