Just When You Thought That You Were Compliant With Privacy Law

You're a responsible business owner. I know that you are. If you weren't, you wouldn't have stopped to read this blog post.

You know that you have to follow certain privacy laws regarding the information that you collect on your site. You've even read my blog post on why you shouldn't use free privacy policies and hired a great lawyer to write them for you.

You're all done, right?

Sadly, no.

The law is an ever changing set of requirements. And there's just been another change that you should be aware of.

As of September 12, 2009, a new privacy law in the State of Maine will go into effect about the requirements for collecting and using information from minors in the State of Maine.

And it's a doozy.

Here's the gist of what it says. It says that you cannot collect any personally identifiable information from a minor in Maine without "verifiable parental consent".

Verifiable parental consent is defined as "any reasonable effort, taking into consideration available technology, including a request for authorization for future collection, use and disclosure described in the notice, to ensure that a parent of a minor receives notice of the collection of personal information, use and disclosure practices and authorizes the collection, use and disclosure, as applicable, of personal information and the subsequent use of that information before that information is collected from that minor."

And even if you collected the information properly, there are prohibitions about using that information "for the purpose of marketing a product or service to that minor or promoting any course of action for the minor relating to a product." There are also prohibitions against the transfer or sale of such information.

So, basically, even if you gather the information, you won't be able to use it.

And there's no grandfather clause. Starting on September 12th, you're responsible for making sure that your previously gathered lists are in compliance.

Here's the part where it gets interesting though...

If you violate, you can end up in a great deal of trouble with the Maine Attorney General's office and there are civil penalties of $10,000 to $20,000 for the first violation (and $20,000 per violation thereafter).

But that's not all.

Maine is also allowing for a private right of action for any minor whose personally identifiable has been gathered or who has been marketed to in violation of the law. They can sue for up to $250 per violation (or actual damage, whichever is greater) plus attorneys' fees and court costs. And, worse yet, if it is found that it was a knowing violation, the court can increase the award to three times the statutory amount (so, $750 per violation).

That's nothing to sneeze at.

So, what should you do?

First, you need to amend your privacy policy to comply with the law and to amend your sign up process (if you're still allowing minors from Maine on your site) to create a way to comply with the verifiable parental consent portion of the law. I'm suggesting to my clients that they add a date of birth field to the sign up process and that they specifically exclude minors from Maine in their privacy policies.

Next, you need to figure out a way to cull your current marketing lists that you've gathered to eliminate any minors from Maine. I'm also suggesting to my clients that they send out an email to everyone they have in their list in Maine about the new law and requesting that those people respond with verification of their date of birth. If people don't respond, they're off of the marketing list.

I'm interested to see how this will be applied and whether it will extend to social media platforms like Facebook, where a business can send out an email to their fan group. By definition, those companies have gathered personally identifiable information about their "fans" and, as far as I know, there's no ability to keep someone from being a fan of a company based on their age. My opinion is that, in order to comply with the law, if you have a Facebook fan group (or another similar group at another networking platform), you're going to need to send an email to all of the fans who are from Maine asking them to verify their age if they want to remain fans.

And you need to get all of this done before the 12th of September.

Are All Trademarks Created Equal?

You've worked very hard to develop your brand and your branding for your business. It's hard work. We all know that.

You know that you want to file for a trademark to protect your investment in time, energy and money in developing your brand. And you're completely right.

You should file for a trademark.

But not all trademarks are equal in the protection that they offer your marks.

Ok, don't hyperventilate... I'm going to explain.

You can file to protect different things in several different ways....

You can file to protect the words themselves, which is called a "character mark". So, if your company is called "Tiny Toes", you can file to protect those words from anyone else using them in the same class as you use them in. You can also register a trademark for your tagline or any other words that you use to designate your "brand".

But what if you have your words are in a pretty font or you have a logo (with or without your company name" and you want to protect the words using that font. Then you'd be filing what is referred to as a "specialized form mark". It protects the items in the picture that you file as they appear in the picture. So, if you have words in the logo that you file, they're protected. Sort of.

If the words appear without the picture, stylization or design that you've registered, they don't have protection on their own. This is VERY important to remember.

I can't tell you the number of times that I have clients ask me if they should file their logo or their words. The official answer is that for the best protection, you should file both as separate marks. One will protect your logo. One will protect the words.

I know, I know. Not everyone can afford to do that....

Since most of my clients are entrepreneurs who are just starting out, they don't have a lot of money to spend either. I get asked all the time which is the more important mark to file.

So, what's the answer? I generally tell them that they should start out filing their brand name first and filing the logo later on when they have more cash to spend.

Hope that helps you to decide how to best protect your brand.

My Trademark was Granted. I'm done, right?

You go through the entire arduous trademark process, you've been granted the trademark and you've received your pretty little certificate in the mail. You're all done but the framing, right?

Yes and no.

For now, you've got nothing to do but to enjoy being a trademark holder. You need to defend your mark to keep it strong, but assuming that no one tries to infringe your mark, you're golden.

So what the heck am I talking about?

I'm talking about the requirements of Sections 8, 9 and 15 of the Trademark Act.

Wait a second! I know you don't know what I'm talking about. I'm about to explain... Sheesh!

Section 8 requires that you file a §8 Declaration of Continued Use or a §8 Declaration of Excusable Nonuse between your fifth and sixth anniversary of usage (and between your ninth and tenth year, but I'll discuss that later on). It currently costs $100.00 per class. If you fail to file, your mark will be cancelled.

For those of you who have just had a heart attack because your sixth anniversary has passed and you haven't filed, please relax. The USPTO allows a six month grace period (for an extra $100.00 per class).

A §8 Declaration must include:
- The registration number;
- The name and address of the current owner;
- The fee for filing the Declaration;
- If the mark is in use: a statement that the registered mark is in use in commerce; a list of the goods/services recited in the registration on or in connection with which the mark is in use; and one specimen per class of goods/services. Examples of acceptable specimens are tags/labels for goods, and advertisements for services.
- If the owner resides outside the United States, the designation of a domestic representative; and
- A signed and dated affidavit or declaration under 37 C.F.R. §2.20

Ok, so you've got that, right?

Here's something you may not know. Trademark registrations are only good for ten years.

So, between every ninth and tenth anniversary of registration, you need to file a Section 9 renewal application and a Section 8 Declaration of Continued Use. It currently costs $500.00 per class to file both of these documents.

A §9 Renewal Application must include:

- A request to renew the registration signed by the registrant or the registrant's representative;
- The registration number, mark and date of registration.
- A name and address for correspondence.
- The filing fee; and
- If the registrant resides outside the United States, the designation of a domestic representative.

The USPTO also has a grace period of six months beyond the tenth anniversary, but it'll cost you an additional $100.00 per class.

So, failure to keep up with those will cost you your trademark registration. Do them. Don't forget.

There is one other section worth mentioning. It's §15. A §15 Declaration of Incontestability is completely optional (though I certainly suggest filing it). It costs $200.00 per class and you file it at the same time as your first §8 filing (between the fifth and sixth anniversary of the initial registration of your mark), so together it would be $300.00 per class.

So, what is it? The USPTO explains it best:

"An 'incontestable' registration is conclusive evidence of the validity of the registered mark, of the registration of the mark, of the owner's ownership of the mark and of the owner's exclusive right to use the mark with the goods/services. The claim of incontestability is subject to certain limited exceptions set forth in §§15 and 33(b) of the Trademark Act, 15 U.S.C. §§1065 and 1115(b). 15 U.S.C. §1065."

The §15 Declaration must include:

- The registration number and the date of registration;
- The fee for each class of goods/services in the registration to which the Declaration pertains;
- A statement that:
(a) the mark has been in continuous use in commerce for a period of five years subsequent to the date of registration, or the date of publication under 15 U.S.C. §1062(c), on or in connection with the goods/services recited in the registration and is still in use in commerce;
(b) there has been no final decision adverse to the owner's claim of ownership of the mark for the goods/services, or to the owner's right to register the mark or to keep the same on the register; and
(c) there is no proceeding involving the claimed rights pending in the USPTO or in a court of law and not finally disposed of; and
- A signed and dated affidavit or declaration under 37 C.F.R. §2.20.

You can find the §8, §9 and §15 forms for filing here. Some that can be registered together are listed together. Make sure you're reading the directions and filling out the right forms....

Don't lose your mark by mistake. Make sure you keep up with your trademark filings...

Protect Your Brand by Protecting Your Domain Name.

I won a case at WIPO last week. A link to the decision, in case you're curious, is here.

I was quite proud of myself. A goliath company was trying to wrest a domain name out of my client's hands and they lost. Because they were wrong. And what I realized when I started telling people that I had won at WIPO was that people had no idea what I was talking about.

People were completely unaware that there is a mechanism to challenge domain name registrations. Were you?

So why would you need such a thing?

Let's say you weren't fast enough. Let's say you've got a business and a competitor has started buying up versions of your domain name.

Worse yet, he's put a site up that looks confusingly like yours and directs people to his competing site.

What can you do? I mean other than tearing your hair out, of course.

Are you just out of luck?

Actually, no. You've got options.

You could ask your competitor to give you the domain name. But that's not very likely.

But you have another option.

Have you ever heard of WIPO? If not, don't worry, you're not alone. Many people haven't.

Ok, this is going to get confusing for a second, because it's a bit of an alphabet soup, but bear with me...

WIPO(the World Intellectual Property Organization) is the international body charged with resolving domain name disputes over global TLDs (or Top Level Domains (e.g., .com, .net, .biz, .info, .mobi, .org). By following the UDRP (Uniform Dispute Resolution Policy) and the supplemental rules, panels of one to three international arbitrators decide whether the domain should remain with the party that registered it or should be transferred to the complaining party.

Did you understand that? Don't worry, you're not alone.

What you need to understand is that WIPO is where you go when you need to challenge a domain name registration. And the UDRP (and supplemental rules) give you the formula to determine whether you have a valid claim.

The domain name dispute procedure is only available to resolve disputes that concern an "alleged abusive registration of a domain name". The criteria to determine whether the domain name has been registered abusively under Section 4(a) of the UDRP are:

(i) the domain name registered by the domain name registrant is identical or confusingly similar to a trademark or service mark in which the complainant (the person or entity bringing the complaint) has rights; and

(ii) the domain name registrant has no rights or legitimate interests in respect of the domain name in question; and

(iii) the domain name has been registered and is being used in bad faith (examples of which are set out in Section 4(b)).

All three elements must be met to win at WIPO. If you can prove all three, the domain name will be ordered to be transferred to you.

Pretty cool, no?

It's also important to remember that if you are on the other side as a Respondent and someone brings an action against you at WIPO, you shouldn't necessarily capitulate to their threat. Some companies use threats of WIPO action (or even filing WIPO actions) as a ploy to get you to turn over your URL.

If you're in the right, hire someone who knows what they're doing and fight. Because it's not like a regular court case, the cost of doing so is far less than it would be in court.

Don't ever forget to protect your brand. Protecting your domain name is a big part of that.

Don't Leave Home (Or Your Business) Without One...

Are you a business owner? Do you execute a power of attorney when you go on vacation so someone can act on your behalf when you're gone?

Should you? Should you have one even if you aren't going anywhere?

Actually, yes.

If you need to leave your business and have someone make decisions for you (and/or sign documents for you) while you're unavailable, you need to have a power of attorney.

There are several kinds of power of attorney, but for the purposes of a business discussion, we'll only talk about the ones that apply here.

It is important to note that you can appoint whomever you want to be your agent (as long as they're a competent adult) with a power of attorney. The person you appoint doesn't, in fact, have to be a lawyer. But the person you appoint is often referred to as an "attorney in fact".

Make sure that the person you appoint is someone you trust. If the person were to be untrustworthy, they could cause you quite a lot of trouble.

The most broad is a durable power of attorney. The durable power of attorney allows someone to make decisions for you and act on your behalf even if you should become disabled physically or mentally and cannot make your own decisions.

It is something that, should you be a sole owner of a business, that you should consider having so that if something should happen to you, your business and your family can be taken care of. In fact, I often advise my clients to have one with their spouse so that if they should ever be incapacitated, your spouse can do things that require both of your signatures (like sell your house) even if you can't sign. Please note, however, that this will not cover medical decisions and that is a different kind of power of attorney.

Another kind of power of attorney is a nondurable or special power of attorney. It generally puts someone in the position of being able to sign documents for you for a specific purpose (e.g., to sell your house, to sign a contract for a merger, etc.) It does not survive your incapacity or incompetence though.

It's very important to check the laws of your specific state when giving power of attorney. Although some states allow an oral power of attorney, many states require it to be in writing. In fact, here in New York, your power of attorney is even required to be notarized.

I would suggest that you have it in writing even if your state doesn't require it. Here's why...

Some governmental entities, for example, the IRS, and even banks will not accept an oral power of attorney. Also, even states that allow a power of attorney to be oral require it to be in writing if the power that you're giving would require you to have a written contract (e.g., sale of real estate, wills, etc.).

It's not something that business owners think about very often, particularly small business owners, but you certainly should give it some thought.

Top 5 Factors for Choosing the Right Lawyer

You know you need a lawyer. You do.

You're a responsible businessperson and you want to make sure that you're protected. Or, you're too late to protect yourself and you need a lawyer to help you resolve the situation.

Either way, you've got a big decision to make. You don't want to choose the wrong person, do you?

As of the end of 2002, according to the American Bar Association, there were over 1,049,000 lawyers and the number certainly has gone up since then.

So, how do you pick the right one?

In my opinion, there are five major points to examine before hiring an attorney. They are (in no particular order) area of practice, cost, firm size, reputation and personality.

Many people make the mistake of thinking that cost is the most important factor, but it's certainly not. It's better to pay a little more and have it done right the first time than to have to have your matter cleared up later on by an attorney who could have done it right in the first place.

So, let's take a look at these factors (listed, in my opinion, in order of importance):

1. Area of Expertise - You wouldn't go to a cardiologist to deliver your baby, would you? Of course not. You want a doctor who specializes in delivering babies.

Contrary to popular belief, attorneys also have areas of the law that they specialize in. It's a little confusing because there are laws in many states that forbid attorneys to claim that they are a "specialist" in a certain field.

That being said, certain lawyers are good at certain things and no lawyer is good at everything. Don't believe otherwise and if a lawyer tells you that they can handle every matter that comes up for you, don't believe them.

I can even use examples from my own practice.

I focus my practice on online businesses. Although I do general business law (i.e., setting up companies, drafting general business agreements, etc.), I specialize in the special things that online businesses need (i.e., privacy policies, terms of service, contest rules, trademarks, copyright issues, WIPO domain name disputes, etc.)

And I wouldn't suggest that you have someone who isn't familiar with all of the issues surrounding a particular part of the law. For example, I won't do tax law. I know nothing about taxes and I wouldn't feel comfortable advising a client on tax law and tax liability. I also don't do litigation work anymore. I have other attorneys that I refer my clients to, but I don't have the time or bankroll to do a good job for a client.

2. Reputation - You should check out the person you're about to hire. Use the Internet. Google them. Do some searching and see what they've done. See what past clients have to say about them.

Attorneys can't give out their past clients' names without permission, but often they have permission from some of their clients to allow other people to call for references. If not, they may have testimonials on their website, their LinkedIn page, or other places that may allow you to gauge the reputation of your potential lawyer.

Ask your friends, family, colleagues or network who have had similar legal situations for recommendations. Who did they use? Were they happy? What do they wish they asked at the beginning?

3. Personality - You wouldn't think that your lawyer's personality would matter that much. But it does.

Assume that you're going to be working closely with this person for the duration of time that your project takes. You want someone who is easy to talk to, who takes time to listen and really understands and cares what you want to achieve.

You want to be comfortable asking your lawyer all of your questions, even the ones that you think are dumb. You also want someone who doesn't sound like they're rushing you off of the phone every time you call or that you're bothering them when you need to talk to them.

They work for you, not the other way around. If they can't be nice to you, then there are about a million other lawyers to choose from. Certainly, one of them would be more than willing to be nice to you.

4. Cost - I'm not nutty. Cost is certainly a factor. You should feel like you're getting the best representation that you can afford for the money that you can spend.

Ask up front what it's going to cost. If the lawyer works on an hourly fee and the project is something that they do often, they should be able to give you a ballpark figure as to what it is going to cost.

The exception here is litigation (or other negotiations). I've seen them take as little as $5-10 thousand dollars to way over $100 thousand.

Here's what I would suggest. If you really want to hire an attorney who can't give you a good ballpark estimate, have them keep track and update you on how much is being spent on a more frequent basis than monthly. That way you have a better idea of how much you'll be spending.

5. Size of Firm - This factor actually ties into some of the others.

As a rule, larger firms tend to charge more. A lot more.

They tend to have a team working on your project rather than a single attorney (as it would be in a solo practice), so you don't necessarily get to talk to the same person all of the time. This can sometimes lead to confusion in your project.

That being said, for complex matters, like litigation, it makes sense to use a larger firm. They have the finances to withstand the costs of a long, drawn out litigation. They tend to have very experienced people in very focused fields.

However, as a solo practitioner, I can tell you that most large firms that do what I do charge about $400 - $600 per hour for an attorney with my level of experience. I don't have their kind of overhead and I pass that savings on to my clients.

Who is the best lawyer for you?

Only you can answer that question. But if you keep the factors I've discussed in mind, you'll find yourself in a good relationship with a good lawyer.

Can You Make Your Office "Greener"?

I know, I know.

You're probably thinking... Why is a lawyer talking about green office policies?

Well, other than the fact that today is Earth Day and I like to try to be relevant, I think that this might be a topic where lots of businesses have trouble. Happy Earth Day, by the way....

As a lawyer, I can tell you, it's HARD to get rid of all that paper. Have you ever been to a lawyer's office? It's rows and rows and rows of file cabinets.

Do you ever wonder what's in those cabinets? No, of course you don't. Don't lie.

Seriously, do you have the time to think about how much paper is in your lawyer's file cabinets? Of course you don't. And if you do, you might want to consider focusing more on building your business. Really....

As lawyers go, I have very little paper in my firm. And I like it that way. But even I would like to have less paper.

I figure if I'm an entrepreneur and I would like to reduce my use of paper, maybe you would too. So, I want to tell you something that you may or may not already know that'll save you a lot of paper.

I want to talk to you about the E-Sign Act of 2000.

I know, sounds sexy doesn't it? No? Don't worry, I don't think so either....

Did you know that there is a law that permits you to sign any contract electronically with the same force and effect as you signing it with a pen? Well, there is.

If we all adopted the use of electronic signatures, it would enormously reduce the number of pages we print out, sign and fax back to people that we do business with. Just think about it....

So, why doesn't everyone do it? Beats me. I'm guessing it's probably the same reason that some people still feel the need to go to the teller in the bank to withdraw money from their account rather than using the ATM.

I know, I know, you're now going to ask, "Well how do I do that? What is an electronic signature?" Hang on.... I'm gonna tell you... Sheesh!


The Electronic Signatures In Global and National Commerce Act (or E-Sign Act) defines an electronic signature as "The term 'electronic signature' means an electronic sound, symbol, or process, attached to or logically associated with a contract or other record and executed or adopted by a person with the intent to sign the record.'"

So, what does that mean?


It means that you make your mark on the document and it "may not be denied legal effect, validity, or enforceability solely because it is in electronic form".

I know, I can hear you think it... Oh yeah, that's very clear!

No, no. It's really easy. I promise.

The way most people do an electronic signature is that they type a slash (/) their mark and another slash. So, for me, mine look like this:

/deena burgess/ or /dbb/ or /Deena Burgess/

Or any other mark you like that can easily be identified as your mark. See? Piece of cake.

Don't you think you could start accepting electronic signatures on your agreements? Don't you think that if we all started doing it, it would do a lot to help the environment?

I do.

Happy Earth Day!

How Strong is Your Trademark?

The most important thing when deciding your "branding" for your business is to make sure that you pick words and logo that identify and protect your brand. Your intellectual property is some of the most valuable assets you have, particularly if you're just starting out.

If you're just starting out, you should pick a mark that is as strong as possible to build your brand around.

So, how do you know what makes a strong mark?

Because I'm going to tell you, that's how....

There are five classifications of marks (four of which can be registered with the USPTO). (Actually, Famous marks are given extra protection, but let's assume that if you're starting out, you don't have one of those.)

They are (in order of strength):

Fanciful - A fanciful mark is one that is a made up word or set of words that have no dictionary definition. Examples would include: Xerox, Google, Ebay.

Arbitrary - Arbitrary marks are ones where the words themselves have dictionary definitions, but no actual relation to the class of goods and services being protected. Examples: Shell for gasoline, Apple for computers, Tide for laundry detergent.

Suggestive - Suggestive marks are marks that have some relation to a feature or quality of the goods and services being offered but are not directly descriptive of the good or service. A suggestive mark would require you to do some thinking to see the relationship, otherwise it would fall into the descriptive category. Examples: Sunmaid for raisins, Coppertone for suntan lotion, Jaguar or Mustang for cars, Playboy for a men's magazine.

Descriptive - Descriptive marks are exactly what you'd think they are. They describe the service or product being offered. They are often not permitted registration on the Principal Register but instead have to be included on the Supplemental Register (once it has been used in commerce for 5 years, it can be moved to the Principal Register). Often marks that include a first name or surname fall into this category. Other examples include: Vision Center for an eyeglass store, Jiffy Lube for a 15 minute oil change spot, Bob's Ice Cream Shoppe for an ice cream store.

Generic - Generic marks are, well, generic terms for the product or service being offered. Examples: Apple if you're selling apples, Soap if you're selling soap. Adding a descriptor will, however, change the classification to Descriptive.

Interestingly enough, companies fight very hard to keep their marks from becoming generic. If your mark becomes a household description of a class of products or services, you weaken the strength of even the strongest types of marks.

Examples of somemarks who spend a lot of time and money fighting to keep from becoming generic include: Scotch tape, Band Aids, Xerox, Google and Kleenex.

Picking a strong mark and keeping it strong are essential to the value of your intellectual property and, in turn, your brand and your business.

If you have more questions about how to create a strong mark and how to protect that mark once you have it, I'm always happy to discuss it. You can either ask me on Twitter (http://www.twitter.com/DeenaEsq) or fill out the contact form on my website (http://www.ebusinesslawgroup.com)

Facebook is Out to Get Us. Or are They?

I’ve been following the general outcry in the blogosphere and on Twitter about the revision of Facebook’s Terms of Service on February 4, 2009.

And I’d like to say this in response, “Could everyone please get a grip for five minutes? You’re giving me a headache....”

But seriously, if you haven’t been following the controversy, here’s what’s happening. Facebook updated their Terms of Service at the beginning of February and removed some language from their License section.

The Consumerist covered it in an article entitled Facebook's New Terms Of Service: "We Can Do Anything We Want With Your Content. Forever."

In pertinent part, the article mentioned that the new Facebook Terms of Service reads as follows:

You hereby grant Facebook an irrevocable, perpetual, non-exclusive, transferable, fully paid, worldwide license (with the right to sublicense) to (a) use, copy, publish, stream, store, retain, publicly perform or display, transmit, scan, reformat, modify, edit, frame, translate, excerpt, adapt, create derivative works and distribute (through multiple tiers), any User Content you (i) Post on or in connection with the Facebook Service or the promotion thereof subject only to your privacy settings or (ii) enable a user to Post, including by offering a Share Link on your website and (b) to use your name, likeness and image for any purpose, including commercial or advertising, each of (a) and (b) on or in connection with the Facebook Service or the promotion thereof.

The article goes on to state that, “That language is the same as in the old TOS, but there was an important couple of lines at the end of that section that have been removed:”

The lines in question are as follows:

You may remove your User Content from the Site at any time. If you choose to remove your User Content, the license granted above will automatically expire, however you acknowledge that the Company may retain archived copies of your User Content.

This set off a hailstorm across the web. The Twitterverse (Twitter universe) went absolutely batty. People fretted about the content that they’re uploading (or have uploaded to Facebook). They even, in some cases, threatened to stop using Facebook altogether.

And they’re not altogether wrong. Your only recourse to avoid the provisions is to stop using Facebook.

Except...

Hey, I write Terms of Service for a living. You need to understand that Terms of Service are really a game of chess with your users where the penalty is not losing a player when you do it wrong, it’s a lawsuit. When I first read the articles, my first thought was that their lawyer was trying to avoid lawsuits for mistakes that might be made by Facebook by continuing to publish information from users who have terminated their accounts. I’m always trying to come up with the best way to protect my clients from lawsuits.

And I’m gratified to know that I’m about right. Today, Facebook CEO Mark Zuckerberg posted an update on the Facebook blog to let everyone know what was intended by the changes in the Terms of Service. You can find his post here. It is entitled, “On Facebook, People Own and Control Their Information.”

So, everyone stand down and take a deep breath. Please.

Are you still worried? Here’s what I would suggest...

Don’t place any information (photos, articles, blogs, etc.) on Facebook that you wouldn’t like for Facebook to have a license on. Simply place it somewhere that you have control over, and put the link on your Facebook page. That way you can share it with your friends and Facebook doesn’t have any of your copyrighted “content” to exercise their license over. It’s really the safest way to go...

Someone's Stolen My Email Database! What Do I Do Now?!?

I had a frantic client call me this week (OK, that’s not true. He emailed me, but you get the idea).

He had just found out that his site was the victim of an attack. The attacker stole all of the email addresses kept in his database, both opted in and not opted in.

The attacker then proceeded to use a false header (that falsely indicated that he was my client) and sent an email to all of the email addresses that he had stolen. (No, I don’t know the sex of the attacker, but I’m calling the attacker “he” for convenience.)

Even worse, the attacker set up the email so that anyone replying to the email would automatically email everyone else on the list. Ouch!

So, what do you do if this happens to you?

The very first thing you do is to contact the Federal Bureau of Investigation (FBI) in your area and ask to speak to the Computer Crimes Division. You need to report the crime that has taken place. Make no mistake about it. This is criminal.

The next thing you do is that you compose an email to the entire list (both opted in and not opted in) explaining what has happened, the steps that you’re taking to rectify the problem and assuring them that the email was not from you and that they should ignore the email altogether.

You then need to contact the appropriate people to find out how the criminal broke in to your database. Right after that, you need to “plug the hole” and figure out a way to make your system more secure.

While you’re at it, you should seriously think about your privacy policy and data retention policies. Make sure you have them and that you’re following the guidelines for protection your customers’ information that you’ve set forth therein.

If you don’t have a privacy policy, get one. If you don’t have a data retention policy, draft one. If you don’t know what a data retention policy is and/or why you should have one, you can check out my guest blog here about data retention policies.

Well, what’s the worst that can happen, right?

You really want to know? I’m warning you, it’s not pretty.

Let me give you your nightmare scenario.…

You might think that the worst case scenario is that you’re caught by your ISP or even by the FTC for violations of the CAN-SPAM Act.

But that’s not it. Though I’d rather give myself a frontal lobotomy with a home kit than to deal with the FTC again...

The real nightmare scenario is that you had emails go into the State of California. You see, to the government or even to your ISP, it’s easy enough to prove what happened. It’ll cost you, but it can be done.

But, under California Business & Professions Code § 17529.5, the State of California gives a private right of action to consumers who receive unsolicited commercial emails with falsified header information. And it’s a $1,000 hit per email.

Let me say that again.

California residents who receive an email from what appears to be you with false header information can sue you in small claims court for $1,000 PER EMAIL. And what they have to prove to be successful is minimal. You have the burden of proving that you didn’t send or sanction the sending of the emails.

I'm not saying that you're actually liable. You're not. You could meet the burden of proving that you didn't send or authorize them, but it would be unbelievably costly to defend all of those suits. If they were filed in small claims courts all over California, you'd have to fly to each location and defend each one.

Well, couldn't you just ignore them then? What's the worst that could happen?

The worst that could happen if you didn't defend is that you could be found liable in all of those suits. And that adds up. Fast.

Let’s say that your database had only 10,000 email addresses that were stolen by your friendly, neighborhood criminal. And since there are 50 states, let’s assume that the email addresses were evenly distributed (which, of course, they’re not). So that makes 200 email addresses in California.

At $1,000 per email, that’s $200,000. What if you had 20,000 email addresses? Or 50,000? Or even 100,000?

Are you starting to see how this could really ruin your day?

Don’t let this happen to you. Make sure your databases are secure. Make sure all of your customer information is as secure as you can make it.

And if it does happen, do whatever you can to mitigate the damages.... Quickly!

Are You Going to be Out of Business on February 10th?

If you’re a manufacturer of consumer products for children, you might just be. And if you’re not worried, you should be. The penalties for failing to follow these new regulations include civil and criminal penalties.

On February 10, 2009, the Consumer Products Safety Improvement Act of 2008 (“CPSIA”) begins its ban on children’s products that have not been tested by an accredited third party testing facility for lead and phthalates.

All children’s products (which is defined as “a consumer product designed or intended primarily for children 12 years of age or younger”) must be certified to contain less than 600ppm of lead to comply (which will lower to 300ppm on August 14, 2009 and to 100ppm if feasible on August 14, 2011) and must have a compliance certificate showing that compliance available to governmental agencies, retailers and consumers. Any item covered in paint will have to drop to 90ppm of lead in that paint no later than August 14, 2009.

In addition, children’s products need to comply with the phthalates ban (which requires that your products contain less than 0.01% of each specific banned phthalate) which also goes into effect on February 10, 2009. Phthalates are chemicals that make plastics more pliable.

Congress permanently banned the phthlates DEHP, DBP, and BBP in “children’s toys” (which is defined as “a product intended for a child 12 years of age or younger for use when playing”) or “child care articles” (which is defined as “a product that a child 3 and younger would use for sleeping, feeding, sucking or teething”).

Three additional phthalates (DINP, DIDP, and DnOP) have been prohibited from “to child care articles or toys that can be placed in a child’s mouth or brought to the mouth and kept in the mouth so that it can be sucked or chewed that contains a concentration of more than 0.1% of the above phthalates” on an interim basis pending more testing.

Fab. So, how do you know if a toy can be placed in a child’s mouth within the meaning of the law?

The regulation states, “A toy can be placed in a child’s mouth if any part of the toy can actually be brought to the mouth and kept in the mouth by a child so that it can be sucked and chewed. If the toy can only be licked, it is not able to be placed in the mouth. By definition, if a toy or part of a toy in one dimension is smaller than 5 centimeters, it can be placed in the mouth.”

It also makes it illegal to sell products that do not meet the new lead limit (the phthalates ban only requires that products manufactured after February 10, 2009 complies with the CPSIA) after February 10, 2009, so any current inventory will either have to be tested or destroyed.

Also included in the CPSIA are permanent labeling requirements so that consumers will know if they have a product that has been recalled.

For a full text of the legislation, you can visit the Consumer Products Safety Commission’s website at http://www.cpsc.gov/about/cpsia/cpsia.html

So, what does this mean to you?

It means that as of February 10th, you need to have each item you manufacture tested to meet the requirements of the CPSIA. This includes each component part of each item that you make. For example, if you made stuffed animals, you would need to test the threads (individually if there’s more than one), the outer fabrics (individually if there are more than one), the batting or stuffing material and any other elements added such as eyes, rivets, etc. You have to test each color and type of item in your stock.

This can get very expensive, very fast. It’s going to be a terrible burden on small business owners and, sadly, it’s likely to knock a lot of them out of business.

What do you mean by all consumer products for children under the age of 12?

I mean ALL consumer products that are intended for children under the age of 12. From posters, CDs, books and pens to stuffed animals and video game systems to juvenile furniture and clothing, they’re all included in the ban.

Are there any exemptions?

- There is an exemption for “inaccessible component parts” which are parts that cannot be accessed by children (this exemption does not apply to phthalates) during the foreseeable use or misuse of the product.

- There is also an exemption for “natural products” like wood, undyed cotton, linen, silk, wool, etc.

- Packaging which is intended to be thrown away is exempted from testing.

- Used items, like those sold in thrift stores, are not subject to the new testing requirements. However, it is still illegal to sell products that don’t comply with the new regulations. How that’s going to shake out, I’m simply not sure....

It sounds like a lot of work. And it is. So if you haven’t started, now would be a good time. February 10th is coming very soon. Get ready....

As an aside, there are several petitions online aimed at trying to get the regulations repealed and/or modified to lessen the burden on small businesses. One can be at the President-Elect’s site www.change.org. If you’re opposed to the legislation, I’d suggest also writing to your Congressmen and women to let them know how you feel about the law and asking them to protect you and other small businesses.

Good luck and let me know if you have any questions. I’m happy to help if I can.

I'm going to run a contest on my site....That's ok, right?

To answer that question, I'm going to give you the most lawyerly answer I know… It depends.

Before you start screaming at me, understand that there are a lot of factors that affect whether or not you'll have legal hurdles to clear before you run your game. In order to understand them, you'll need to have both a clear idea of the game that you're planning to run and the law surrounding contest law.

I think that many people believe that you can just run a contest for whatever prizes you want, whenever you want, with no knowledge that failure to run a promotion properly can be, in a worst case scenario, a crime (granted, a misdemeanor, but a crime nonetheless).

All sweepstakes (or games of chance) are governed by both federal and state statutes prohibiting illegal lotteries. Lotteries are generally prohibited except when run by the government. A lottery is defined as a promotion that contains three elements: (1) Prize; (2) Chance; and (3) Consideration.

So, how do you avoid the problem. Well, you have to eliminate one of the elements. Let's assume that no one's going to eliminate the prize (because who's going to enter a promotion with no prize?), so you need eliminate one of the other two elements. Games of skill (which would eliminate the chance element) are possible, but they tend to be difficult to get as many entrants. Examples of games of skill include things like essay contests or spelling bees (some states even require that the judge making the selection is one that is specialized in the field).

There are many different tests and factors for determining whether a game is a game of chance or game of skill, but suffice it to say that most games will fall under the game of chance umbrella. If you're looking to give away a prize for an entry on your website, you're definitely running a game of chance.

So, your last option is to eliminate consideration (aka the entry fee). I can see your mind going right now. You're thinking, "Well, ok. I wasn't going to charge any money for entry anyway. Done!" Back the truck up, buddy.

The definition of consideration is very broad. It has been held that consideration was given where people had to fill out a complicated form or send a self addressed stamped envelope to enter a contest.

How can you eliminate the consideration element then? Well, the easiest way is to ask only for the barest information that you need in order to award prizes (i.e., name and email address). If you're planning on using the information you gain for marketing purposes, I would strongly recommend that you give registrants the option to opt in to receive information from you and to make sure that it is clear that the opt in is not necessary in order to enter or to win the prizes.

If you're doing a promotion through the mail, you will also have to offer an alternative method of entry that is free for the entrant, but I assume that this crowd is thinking mostly of online contests.

Piece of cake, right? Well, not exactly. There's a couple of other things that you have to worry about.

First, if your combined prize value totals $500 or more, you may have some registrations to do. Rhode Island requires registration for promotions that have prizes totaling over $500; Florida and New York require registration and bonding for promotions with prizes totaling over $5,000. These registrations and bonding can be quite expensive. I would advise avoiding these prize limits if at all possible.

Second, you need to make sure that you have contest rules that protect you from liability and comply with all applicable laws. A sampling of the items (but certainly not all of them) that should be in your contest rules include:

- Odds of winning;
- Methods of entry;
- Number of entries per household or per person;
- Eligibility requirements (cannot be open to persons under the age of 18, residency, etc.);
- Description of prizes;
- Duration of the contest; and
- Void where prohibited clause.

I hope that this answers some of your questions about online contests and helps you to keep yourself out of illegal lottery territory with your next contest...

Are the works you're using really in the public domain?

I’m sure you’ve heard the phrase “public domain.” But do you really know what that means? It’s come to my attention that many people think that the public domain refers to anything that is available to the public at large.

Ok, folks. That’s not it. If you’re living under that delusion, then stop it now.

In actuality, the public domain is a group of intellectual property (which can refer to trademark and patent, but usually refers to copyright which is what we’ll discuss here) that belongs to no one. What it effectively means is that anyone can use those works without permission, payment or other concern about claims from other parties.

So, if you know what the public domain is, how do you know what works are in the public domain? How did they get there?

As you may or may not know from reading my earlier blog posts, copyright is automatically granted to an original work of authorship as soon as it’s put into a tangible medium of expression. You might be asking, “How are there works in the public domain then?”

You need to understand, as an initial matter, that the current copyright law was not always the way that copyrights were granted. The rules have changed several times over the years. It’s also important to note, as an aside, that there are works that are in the public domain in the United States that may be subject to copyright in other countries and vice versa.

There are really a couple of ways that works enter the public domain. First, if the work was put into the public domain by the author. Authors can choose to put their works into the public domain by choice. It certainly happens, but not often.

Most commonly, there are works that have fallen into the public domain based on their age or on their author’s failure to renew their copyright. The basics are a little confusing because the law has changed several times over the years, but here are the basics:

- If the work was published before 1923, it is currently in the public domain.

- If the work was published between 1923 and 1963 with notice, the work was eligible for a first term of 28 years and could register for an extension of 47 years (which has now been extended for an additional 20 years beyond that).

However, if the work was not renewed, it would have fallen into the public domain in 1991 at the latest. If it was timely renewed, the earliest of these works (the ones created in 1923) will fall into the public domain in 2018.

- If the work was published any time before 1978 without notice, the work is automatically in the public domain.

- If the work was published without notice between 1978 and March 1, 1989, the work may have fallen into the public domain unless the author corrected the omission of notice within the first five years.

- If the work was created before 1978 but was unpublished, the copyright would expire and the work would fall into the public domain seventy years after the author’s death or December 31, 2002, whichever is later.

- If the work was created before 1978 but was unpublished, but became published between January 1, 1978 and December 31, 2002, the work would fall into the public domain seventy years after the death of the author or December 31, 2047, whichever is later.

- If the work was created after January 1, 1978, regardless of whether it was published or unpublished, or whether it had notice or not, will not fall into the public domain until seventy years after the death of the author (or if it’s a corporate author, ninety five years after publication or one hundred twenty years after creation).

Sounds really simple, right? Of course not. It’s sometimes unbelievably confusing. And keep in mind that these are just the basics.

So, how can you be sure that you’re using works that are in the public domain? Well, you can use works that you know the original creation or publication date that you are sure fall within the public domain. Or you can look for works where the author has stated that he or she is allowing their works to be used in the public domain.

Otherwise, you face potential problems. And, as I’ve said before, copyright infringement suits are just no fun. So, be careful and you’ll avoid a lot of headache and heartache...

Why can politicians (and anyone else) use copyrighted music without the artist's permission?

There have been numerous allegations over the past weeks by musicians against the McCain campaign based on its use of songs in its advertisements and campaign rallies without the prior authorization of the artists who recorded those songs. Some of these artists include Jackson Browne (who sued the McCain campaign for the usage), Van Halen, Heart and the Foo Fighters. In all fairness, Obama was asked by Sam Moore to stop using his song, "Soul Man" as well.

Many of the artists feel that they should have the right to keep the McCain campaign from using their songs because they feel that (not only should they have been asked) it appears to other people that they have not only sanctioned the use of the song, but they have endorsed the candidate by allowing the song to be used.

So, why hasn't McCain stopped using the songs. It's actually very simple. The McCain campaign claims that they've purchased blanket licenses from ASCAP/BMI. A blanket license (often purchased by stadiums, sporting arenas and the like) gives the purchaser the right to use any of the over 4 million songs in the ASCAP/BMI library. They have the right to use them at campaign events, in advertisements or even broadcast them.

Will citing the source protect you from a copyright infringement claim?

There are an awful lot of misconceptions about copyright law that are floating around. One of my favorites that I keep hearing over and over again is that people believe that you can use any copyrighted work that you want as long as you give credit to the original author.


Ok, folks, this isn't school. Citing the source may have prevented you from being dinged for plagiarism when you were in school, but plagiarism isn't a violation of the law. Copyright infringement, on the other hand, is.


I've said this before, but I'll say it again since it bears repeating. Any original expression fixed in a tangible medium is protected by copyright. There are very few exceptions to that rule. (And for my international friends, this applies not only to United States law. The Berne Convention, the Universal Copyright Convention and the WIPO treaties subject member nations to the same requirements when using works that enjoy copyright protection under U.S. law.)


Copyright holders have certain exclusive rights to their works. Section 106 of the 1976 Copyright Act grants the owner of copyright the exclusive rights to do the following:

- To reproduce the work in copies or phonorecords;

- To prepare derivative works based upon the work;

- To distribute copies or phonorecords of the work to the public by sale or other transfer of ownership, or by rental, lease, or lending;

- To perform the work publicly, in the case of literary, musical, dramatic, and choreographic works, pantomimes, and motion pictures and other audiovisual works;

- To display the work publicly, in the case of literary, musical, dramatic, and choreographic works, pantomimes, and pictorial, graphic, or sculptural works, including the individual images of a motion picture or other audiovisual work; and

- In the case of sound recordings, to perform the work publicly by means of a digital audio transmission.


By using the copyrighted work without permission, you are violating several of these rights including, but not limited to, the right to display, the right to distribute and the right to reproduce the work.


Now, I'm not saying that you can't use discrete portions of the work for fair uses, like comment, parody or satire, under certain (usually non commercial) circumstances. However, using the work in its entirety (or even in large part) will subject you to liability under copyright law.


So, what can you do if you want to use a work that belongs to someone else? The easiest answer is to get permission from the copyright holder. Very often, in this day and age, people are willing to allow others to use their work provided that they're given credit and a link back to their site. Other copyright holders are willing to license their work for a nominal fee.


What do you do then if the copyright holder doesn't want you to use his or her work? Well, at that point, you have two options. Post the link (don't embed it on your site (I'll talk about that in another post), post just the link), find another work that does allow you to use it (Creative Commons is a good place to look) or create your own work from scratch on the same topic.


What can you do if you're already using or displaying someone's copyrighted work on your site? The first thing that you can do is to remove it. If you want to continue using it, you need to contact the copyright holder and ask their permission. Don't be surprised though if the copyright holder isn't thrilled to find out that you've been using their work without their permission.

The safest thing that you can do is to avoid using people's copyrighted work. If you don't know how to write, hire someone to do it for you as a "work for hire". If you need pictures, go out and take them. If you can't find a way to do it yourself make sure that you've got permission or a license to use the material before you post it on your site. Better safe than sorry....