Blog

Social media offer businesses and organizations an unprecedented opportunity to have real-time conversations with customers. Your audience is talking, so you might as well join the conversation to answer questions, share advice and offers, engage people and manage relationships—an unanswered tweet or comment can cost you. Marketing professionals know that the combination of low-cost social media and traditional media are part of a powerful marketing strategy.

Research shows that the prevalence of social media doesn’t show signs of slowing. Since 2012, social media use among American adults ages 55-64 has increased by 79 percent. YouTube reaches more 18-34 year olds than any cable network. And social media has over taken porn as the No. 1 activity on the web, which perhaps should give us further pause.

Conversely, marketing cannot ignore the new and abundant legal and compliance issues relating to social media. Protections exist for online operators, for example, but not for companies that use social media. Industry-specific legislation and regulation affects social media use in financial, healthcare, energy and education fields, while a patchwork of federal and state laws and “guidelines” exists for everyone else. 

Because social media moves at lightning speed and any individual with an opinion and a social account can create content and messages related to your brand, you have no control over your brand’s message, which can make it hard to control your liability. The salt in the wound: sometimes there are no answers because the law hasn’t been decided.

Covered here are several of the critical areas you should consider in developing social media policies and programs. You shouldn’t be afraid to step out in the rain, but it’s better if you are prepared. Consideration of these issues is like bringing your umbrella and raincoat. 

PRIVACY

The Children’s Online Privacy Protection Act (COPPA). Designed to protect children under the age of 13, it requires special steps if your promotion targets children under 13, or if you have actual knowledge that children are participating. You must develop a program for obtaining prior parental consent, collecting only information that is necessary for the purpose for which consent was obtained, and keeping the information only for as long as necessary for this purpose. The FTC updated provisions of COPPA effective July 13, 2013, in part to address changes in technology, including social media, since the act was initially adopted in 2000.

Health Information Privacy (HIPAA). If you are in the health industry, you are already aware of the privacy and security rules pertaining to the protection of personally identifiable health information. However, it’s easy to forget that the rules apply on social media as well. Covered entities under HIPAA, as well as employers who maintain personal health information, need to develop a policy to prevent and address the risk of employees who post personal information about their fellow employees online. Consider, for example, a group of nurses who used Facebook to update each other at shift changes. While they might not use patient names, there could be sufficient information to be identifiable and actionable. Your policies, which need to well communicated and monitored, should extend compliance to explicitly include social media and include examples to illustrate how simple posts can lead to exposure. 

Gramm Leach Bliley Act. This act is to financial institutions what HIPAA is to health care. These rules govern the collection and protection of personal financial information. “Financial institutions” is broadly defined to include much more than banks. Just as health care providers might forget legal distinctions on social media, the risk is there for employees of financial institutions to make inappropriate posts as well.

State Privacy Laws. There are a myriad of state laws impacting privacy that should also be considered. Unfortunately, since social media crosses state boundaries, your use of it must generally comply with the laws in all states. This makes the most stringent laws applicable to all states.

CONTENT OWNERSHIP AND COPYRIGHT

It is important to understand the difference between sponsor content and user-generated content. User-generated content includes anything that users submit to an online entity, including the picture you tweeted of your dinner or favorite cocktail. It can have more impact than a company raving about itself. However, you may not be aware that the photograph was actually taken from a fine dining magazine protected by copyright. Further copying and using the content can expose you to liability. Since copyright is owned by the person who created it or by an employer if it was created by employees acting within the scope of their employment, the following questions should be considered: 

• Who took the picture or wrote the text? 
• Is this person acting within their job description? 
• If they didn’t create the content, does your company have a written agreement indicating permission to use the content? 

Copyright infringement occurs, even in social media, when someone copies, distributes, performs, publicly displays or creates derivatives of the same or substantially similar content without authorization. It happens every day. There are defenses—fair use, implied consent and challenges to ownership—but it would be better to have clear procedures in place to mitigate the risks than to fight it in court later.

Consider the selfie photo taken of multiple celebrities at the Oscars by Bradley Cooper using Ellen DeGeneres’s camera. The media asked Ellen for permission to use the photo. But since Bradley took the picture, he would own the copyright. What if Bradley objected to the use? What about the rights of the people in the picture? While in this very public example the celebrities may have impliedly consented to certain uses, you can see how the simple act of taking a photo and sharing it can raise many questions.

Trademarks. Use of trademarks in social media presents its own challenges. Trademark rights are acquired by using them with particular goods or services or by filing a federal application resulting in a registration. Use of another’s mark without their authorization can create risks if you use the mark in a way that would indicate that you are affiliated with or sponsored by the trademark owner. In this situation, context is everything. You need to carefully consider the nature and extent of use to avoid claims. 

Another issue is whether you can acquire rights in a trademark by using it on social media. Recent case law has indicated that use of a trademark in social media campaigns prior to actually providing the services or having goods to offer, does not establish rights. Thus, if you make a big splash through social media with a new brand, but you haven’t filed a trademark application, your use alone will not give you prior rights against someone else who starts using the mark to provide services or sell goods.

Confidentiality. We have all heard stories about social media posts and comments that expose information not meant for public consumption. Twitter seems to hold the news reins on business openings and closings, employee hirings and firings, stock tips and more. While news (and rumor) sharing might be commonplace on social media, companies can help protect themselves. When an employee discloses confidential company information such as trade secrets, strategies, client records or other sensitive material, confidentiality issues arise, which may be governed by laws, written contracts or other implied obligations. A particularly difficult issue is when employees of public companies disclose information that is cross-wise with SEC rules. 

Rights of Publicity. Generally, an individual has the right to control the commercial use of his or her identity. Laws related to right of publicity vary by state. In Kentucky, for example, the law only applies to those who have commercialized their identities. But in other states, this is not required. Also generally, the right applies after the person dies. In Indiana, rights of publicity are protected for up to 100 years after death. Usually, the law of the state of residence or domicile at death determines what law applies.

DMCA and Communications Decency Act. Protections exist for website operators and other interactive service providers such as those who host listservs, blogs and forums through which users submit questions, answers and opinions. 

The Digital Millennium Copyright Act allows service providers to avoid liability for copyright infringement if they comply with “safe harbor” provisions by having notice and takedown procedures and acting to take down infringing content, unless the service provider had prior knowledge of the infringement. Similarly, the Communications Decency Act will protect online service providers from liability for certain types of claims (defamation, invasion of privacy, misappropriation, negligence) based on the content created by others. Note that these provisions do not apply to protect users of social media, such as companies who use the services of others (Twitter, Facebook, Instagram) to promote their businesses.

Defamation and other nefarious acts … While some cases of copyright infringement or content ownership can be chalked up to ignorance or poor judgment, defamation is an intentional false statement that harms another’s reputation. Similar business claims—product disparagement, unfair competition, intentional interference (without justification) with existing/prospective relations—are also issues of concern.

WHAT ELSE?

If that isn’t enough, social media implicates other areas including Federal Trade Commission guidelines for testimonials and endorsements, as well as false advertising; state laws pertaining to sweepstakes, contests, and illegal lotteries; CAN-SPAM (yes, social media posts have been found to be electronic messages governed by this act); state and federal laws governing unfair competition; SEC rules governing what public companies can say to the public; and many more. (Look for more information on these topics in subsequent postings.)

The bottom line. All the laws, rules and business good sense that apply to your business apply to social media. The difference is the reaction time. That good idea can go bad quickly. That one little mistake can go viral almost instantaneously. Most recently, the New York Police Department, in an effort to promote goodwill between citizens and the police, started a social media campaign prompting the public to send pictures with their local police officers. After a few nice tweets, there came a flurry of pictures in which the friendly neighborhood police officer was not so friendly or neighborly. The campaign may end quickly, but it’s hard to take back what’s out there. Think about how far and wide those pictures will continue to circulate. 

The solution is not to disengage, but be ready for the storm. Social media policies must be comprehensive and developed with input from marketing, legal, IT staff, human resources, company compliance officers and others. But even the best policies won’t work unless they are communicated to employees (on a regular basis), communicated to new employees, and then monitored, maintained and regularly updated. As soon as the ink is dry, there will be a new form of social media to address, so just keep the pen out.