Interest Based Advertising Under New Privacy Regimes: California, Colorado, and Virginia

Many companies in the United States conduct interest-based advertising, which may meet the definitions of targeted advertising or consumer profiling (as provided below)- those that do face a decision this year as to whether they want to continue to engage in such activities (in which case they need to do several things to comply with state privacy laws), or to change how they do business. A brief discussion of various state privacy regimes associated with targeting advertising follows:
 
California
 
California Privacy Rights Act (“CPRA”) is the successor to the California Consumer Privacy Act (“CCPA”) and takes effect January 1, 2023 with a lookback period going back to 2022 meaning businesses must track their collection, use, and disclosure of personal information up to 12 months before the law’s 2023 effective date. CPRA expands the scope of CCPA by adding limitations to the "sharing" of personal information in addition to the "selling" of personal information. 
 
Under CPRA, “Sharing” means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions between a business and a third party for cross-context behavioral advertising for the benefit of a business in which no money is exchanged. 
 
CPRA defines “cross-context behavioral advertising” as the “targeting of advertising to a consumer based on the consumer’s personal information obtained from the consumer’s activity across businesses, distinctly-branded websites, applications, or services, other than the business, distinctly-branded website, application, or service with which the consumer intentionally interacts.”
 
If a business sells or shares personal information or collects or uses sensitive personal information, CPRA requires a separate link to the “Do Not Sell or Share My Personal Information” internet web page and a separate link to the “Limit the Use of My Sensitive Personal Information” internet web page, if applicable, or a single link to both choices, or a statement that the business responds to and abides by opt-out preference signals sent by a platform, technology, or mechanism.
 
Colorado
 
The Colorado Privacy Act (“CPA”) takes effect July 2023.
 
Under VCDPA, If a controller sells personal data or processes it for targeted advertising or consumer profiling, it must provide consumers with the right to opt-out. 
 
Targeted advertising does not include (1) ads in response to consumer’s request for info or feedback, (2) ads based on activities on the controller's affiliated websites; (3) ads based on the context of a consumer's search query or visit to a website or app; and (4) the processing of personal data solely for measuring or reporting ad performance, frequency, or reach. 
 
Profiling means any form of automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable natural person’s economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.
 
Virginia
 
The Virginia Consumer Data Protection Act (“VCDPA”) takes effect January 1, 2023.
 
Under VCDPA, If a controller sells personal data or processes it for targeted advertising or consumer profiling, it must provide consumers with the right to opt-out. 
 
Targeted advertising does not include (1) ads in response to consumer’s request for info or feedback, (2) ads based on activities on the controller's affiliated websites; (3) ads based on the context of a consumer's search query or visit to a website or app; and (4) the processing of personal data solely for measuring or reporting ad performance, frequency, or reach. 
 
Profiling means any form of automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable natural person’s economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.

Apple Account Deletion Requirements

Apple's Store Review Guideline 5.1.1 contains in-app deletion requirements that require some tweaks and legwork by app developers to comply, as well as some tending to app-based privacy processes. The Guidelines provides people with greater control over their personal data by requiring that all apps that allow for account creation must also allow users to initiate deletion of their account from within the app. This requirement was set to apply to all app submissions by January 31, 2022. Due to the complexity of implementing this requirement, Apple extended the deadline to June 30, 2022 to give developers more time. Apple has provided the following guidance to developers:
  • The account deletion option should be easy to find in your app.
  • It’s insufficient to only provide the ability to temporarily disable or deactivate an account. People should be able to delete the account along with their personal data.
  • Apps in highly-regulated industries may need to provide additional support flows to confirm and facilitate the account deletion process.
  • Follow applicable legal requirements for storing and retaining user account information. This includes complying with local laws in different countries or regions. As always, check with your legal counsel.

EU Digital Services Act

On January 20, 2022, the European Union took a major first step in passing laws to transform how technology companies do business in the EU. There are still several steps before the laws become final, but in the initial vote yesterday, the 27-nation members overwhelmingly approved tighter controls.

The proposed Digital Services Act would, among other things, require major technology companies to aggressively police content and further limit advertising. For example, the law would require companies to remove content considered illegal in the country where it is viewed. This would include such things as Holocaust denials in Germany and racist postings in France. It would also allow Europeans to more easily opt out of targeted advertising and prohibit advertising targeted at children.

Christel Schaldemose, the lawmaker from Denmark who led negotiations on the bill, opined that "[w]ith the [Digital Services Act] we are going to take a stand against the Wild West the digital world has turned into . . . ."

The debate by the European Parliament and Council of the European Union on the final language is expected to take months. The law may serve as a model for the U.S. Congress where many members are also considering legislation to tighten control of digital practices.

Google LLC v. Oracle America Inc.

In a recent 6-2 decision, the U.S. Supreme Court held that Google LLC’s use of certain lines of code from Oracle America Inc.’s Java API to create its Android operating system qualified as “fair use” under the Copyright Act and thus was not copyright infringement even though Google did not have a license or permission to use the Java software. Google LLC v. Oracle Am., Inc., 141 S. Ct. 1163 (2021).

The decision brings to conclusion a $9 billion suit between Google and Oracle that has been ongoing for over a decade. More importantly, the Court’s findings on APIs and its reasoning behind its fair use analysis will likely have significant impact on computer code and software copyrights and subsequent decisions on infringement.

APIs

An application programming interface, or API, is a set of definitions and protocols for building and integrating application software which allows applications to communicate across different systems or platforms to complete tasks. APIs serve an important function in software interoperability and innovation because, as noted by the Court, APIs “allow programmers to build certain functions into their own programs, rather than write their own code to perform those functions from scratch.” Id. at *12.

Critical to the Court’s analysis in this case, is understanding that for each API there is an “implementing code” and a “declaring code.” The “implementing code” is what tells the computer how to execute a particular task. The “declaring code” then provides the name and location of each task within the API so that the implementing code can be linked to the task and executed. The declaring code thus functions both as a shortcut and organizational system which, once learned, can be easily applied by programmers in creating software.

In 2005 Google acquired Android and began working on developing its operating system for mobile devices. As part of this process, Google explored potential licensing options with Sun Microsystems (the original owner and developer of Java) for Google to license Java and incorporate it into the Android system. The licensing negotiations ultimately proved unsuccessful, and Google moved forward with creating its own version of Java to run its operating system. The new program recreated the functionality of Java and incorporated about 11,500 lines of code from Java’s APIs so that programmers would not have to learn a new system in order to interface with Google’s software. Google thus created its own implementing code but copied Java’s declaring code.

Fast forward a couple of years, and the releases of various versions of each company’s software, and Oracle enters the scene with its purchase of Sun in 2010. Oracle then filed suit against Google alleging that Google’s unlicensed use of the Java API in developing its Android software for mobile devices infringed Oracle’s copyrights for Java.

Copyrights

Copyrights protect original works of authorship that have been fixed in a tangible medium of expression which possess “at least a modicum” of creativity. Typically, when people think of copyrights they think of books, songs, or artwork-- but software can also be a creative work and thus eligible for copyright protection. Thus, unauthorized or unlicensed use of copyrighted software can be grounds for legal action, including claims for copyright infringement under the Copyright Act.

However, copyrights do not protect functional or utilitarian works such as ideas, procedures, processes, systems, method of operations, concepts, principles, and discovery.

Notably in reaching its decision, the Court chose not to definitively reach a decision as to whether an API was copyrightable and instead focused on whether Google’s use of the API constituted fair use, thus technically leaving the question of whether APIs in general are copyrightable open for debate. Future decisions on whether APIs are copyrightable though will likely be strongly influenced by the Court’s dicta which heavily implied that at least the declaring code of APIs is not eligible for copyright protection or if it is, the available protection is “thin.” As part of its fair use analysis, the Court stressed that declaring code is “inherently bound together with uncopyrightable ideas” and new creative expression in the form of implementing code. Id. at *42. This along with other differences between declaring code and most computer programs led the Court to find that “the declaring code is, if copyrightable at all, further than are most computer programs (such as the implementing code) from the core of copyright.” Id. at *43.

Fair Use Exception

Under the Copyright Act, “fair use” is a statutorily protected defense to copyright infringement which permits the unlicensed or unauthorized use of copyrighted works in certain, limited circumstances where the purpose of the original work is “transformed” into something new. The intent behind this defense is to allow courts to balance a creator’s ownership interest and rights to their work with the competing interests of the public and other creators in freedom of expression and creativity. Common examples of fair use include criticism, commentary, news reporting, teaching, scholarship, and research. These works are “transformative” because they create something new and “fulfills the objective of copyright law to stimulate creativity for public illumination.”

In making a fair use determination, courts weigh several factors on a sliding scale that balances the purpose and character of the use, the nature of the copyrighted work, the amount and substantiality of the portion used in relation to the copyrighted work as a whole, and the effect of the use upon the potential market for or value of the copyrighted work.

The Court found that each of these factors supported a finding of fair use in favor of Google because Google took only a portion of the functional declaring code from the Java API that was necessary to allow developers to work in and create its new mobile smartphone program.  “Google copied those lines not because of their creativity, their beauty, or even (in a sense) because of their purpose. It copied them because programmers had already learned to work with the Sun Java API’s system, and it would have been difficult, perhaps prohibitively so, to attract programmers to build its Android smartphone system without them.” Id. at *50-51. Google’s copying of the declaring code of the Java API thus was held to have a valid and transformative purpose that did not infringe upon Oracle’s copyrights.

Impact

In addition to putting to rest a decade long litigation and giving Google a decisive victory, the Court’s decision and fair use analysis also has far reaching impact for programmers and consumers alike. Although the full effect is still to be determined outside of the narrow scope of the Court’s decision, the Court’s ruling will likely serve to aid software innovation and interoperability efforts but limit the available protections for API creators attempting to license their work. At minimum, programmers and consumers will be able to rely on the ruling to defend their use of pre-existing API declaring code in creating new software.  

Florida Sales Tax Update

Effective July 1, 2021, Florida will require collection and payment of sales taxes by remote online businesses that sell over $100,000 in goods delivered to the state.

Previously, Florida only taxed online businesses if the seller had a physical presence in Florida. Now Florida sales taxes include "Marketplace Providers" or marketplace sellers who make over $100,000 in remote sales of personal property delivered to the state in the previous calendar year.

It is estimated Florida will collect $1 billion from the tax annually, which is be used to replenish the state’s unemployment trust fund after which the revenue will be used to reduce the commercial lease tax.

Florida is the only state to impose a state sales tax on commercial rent of real property including land, buildings, office or retail space, convention centers or meeting rooms, docks, and parking. The new tax law will reduce the state sales tax on commercial leases from 5.5% to 2% after the unemployment trust fund is built back.

Online retailers are encouraged to review their current tax system to ensure compliance with the new Florida sales tax including registering with the Florida Department of Revenue. All tax, penalty, and interest due on remote sales before July 1, 2021 will be waived if retailers register before October 1, 2021.

losey
ATTORNEY ADVERTISEMENT; PRIOR RESULTS DO NOT GUARANTEE A FUTURE OUTCOME