The Metaverse: A Legal Primer for the Hospitality Industry

The metaverse, regarded by many as the next frontier in digital commerce, does not, on its surface, appear to offer many benefits to an industry with a core mission of providing a physical space for guests to use and occupy. However, there are many opportunities that the metaverse may offer to owners, operators, licensors, managers, and other participants in the hospitality industry that should not be ignored.

What is the Metaverse?

The metaverse is a term used to describe a digital space that allows social interactions, frequently through use of a digital avatar by the user. Built largely using decentralized, blockchain technology instead of centralized servers, the metaverse consists of immersive, three-dimensional experiences, persistent and traceable digital assets, and a strong social component. The metaverse is still in its infancy, so many of the uses for the metaverse remain aspirational; however, metaverse platforms have already seen a great deal of activity and commerce. Meanwhile, technology companies are working to produce the next-generation consumer electronics that they hope will make the metaverse a more common location for commerce.

The Business Case for the Hospitality Industry

The hospitality industry may find the metaverse useful in enhancing marketing and guest experiences.

Immersive virtual tours of hotel properties and the surrounding area may allow potential customers to explore all aspects of the property and its surroundings before booking. Operators may also add additional booking options or promotions within the virtual tour to increase exposure to customers.

Creating hybrid, in-person and remote events, such as conferences, weddings, or other celebrations, is also possible through the metaverse. This would allow guests on-site to interact with those who are not physically present at the property for an integrated experience and possible additional revenue streams.

Significantly, numerous outlets have identified the metaverse as one of the top emerging trends in technology. As its popularity grows, the metaverse will become an important location for the hospitality industry to interact with and market to its customer base.

Legal Issues to Consider

  1. Select the right platform for you. There are multiple metaverse platforms, and they all have tradeoffs. Some, including Roblox and Fortnite, offer access to more consumers but generally give businesses less control over content within the programs. Others, such as Decentraland and the Sandbox, provide businesses with greater control but smaller audiences and higher barriers to entry. Each business should consider who its target audience is, what platform will be best to reach that audience, and its long term metaverse strategy before committing to a particular platform.
  2. Register your IP. Businesses should consider filing trademark applications covering core metaverse goods or services and securing any available blockchain domains, which can be used to facilitate metaverse payments and to direct users to blockchain content, such as websites and decentralized applications. Given the accelerating adoption of blockchain domains along with limited dispute resolution recourse available, we strongly encourage businesses to consider securing intellectual property rights now.
  3. Establish a dedicated legal entity. Businesses may want to consider setting up a new subsidiary or affiliate to hold digital assets, shield other parts of their business from metaverse-related liability, and isolate the potential tax consequences.
  4. Take custody of digital assets. Because of their digital character, digital assets such as cryptocurrency, which may be the primary method of payment in the metaverse, are uniquely vulnerable to loss and theft. Before acquiring cryptocurrency, businesses will need to set up a secure blockchain wallet and adopt appropriate access and security controls.
  5. Protect and enforce your IP. The decentralized nature of the metaverse poses a significant challenge to businesses and intellectual property owners. Avenues for enforcing intellectual property rights in the metaverse are constantly evolving and may require multiple tools to stop third-party infringements.
  6. Reserve metaverse rights. Each Business that licenses its IP, particularly those that do so on a geographic or territorial basis, should review existing license agreements to determine what rights, if any, its licensees have for metaverse-related uses. Moving forward, each brand owner is encouraged to expressly reserve rights for metaverse-related uses and exercise caution before authorizing any third party to deploy IP to the metaverse on a business’ behalf.
  7. Tax matters. Attention needs to be paid to how the tax law applies to metaverse transactions, despite the current tax law not fully addressing the metaverse. This is particularly the case for state and local sales and use, communications, and hotel taxes.

Ready to Enter?

As we move into the future, the metaverse appears poised to provide a tremendous opportunity for the hospitality industry to connect directly with consumers in an interactive way that was until recently considered science fiction. But like every new frontier, technological or otherwise, there are legal and regulatory hurdles to consider and overcome.

© 2022 ArentFox Schiff LLP

Comparing and Contrasting the State Laws: Does Pseudonymized Data Exempt Organizations from Complying with Privacy Rights?

Some organizations are confused as to the impact that pseudonymization has (or does not have) on a privacy compliance program. That confusion largely stems from ambiguity concerning how the term fits into the larger scheme of modern data privacy statutes. For example, aside from the definition, the CCPA only refers to “pseudonymized” on one occasion – within the definition of “research” the CCPA implies that personal information collected by a business should be “pseudonymized and deidentified” or “deidentified and in the aggregate.”[1] The conjunctive reference to research being both pseudonymized “and” deidentified raises the question whether the CCPA lends any independent meaning to the term “pseudonymized.” Specifically, the CCPA assigns a higher threshold of anonymization to the term “deidentified.” As a result, if data is already deidentified it is not clear what additional processing or set of operations is expected to pseudonymize the data. The net result is that while the CCPA introduced the term “pseudonymization” into the American legal lexicon, it did not give it any significant legal effect or status.

Unlike the CCPA, the pseudonymization of data does impact compliance obligations under the data privacy statutes of Virginia, Colorado, and Utah. As the chart below indicates, those statutes do not require that organizations apply access or deletion rights to pseudonymized data, but do imply that other rights (e.g., opt out of sale) do apply to such data. Ambiguity remains as to what impact pseudonymized data has on rights that are not exempted, such as the right to opt out of the sale of personal information. For example, while Virginia does not require an organization to re-identify pseudonymized data, it is unclear how an organization could opt a consumer out of having their pseudonymized data sold without reidentification.


ENDNOTES

[1] Cal. Civ. Code § 1798.140(ab)(2) (West 2021). It should be noted that the reference to pseudonymizing and deidentifying personal information is found within the definition of the word “Research,” as such it is unclear whether the CCPA was attempting to indicate that personal information will not be considered research unless it has been pseudonymized and deidentified, or whether the CCPA is mandating that companies that conduct research must pseudonymize and deidentify. Given that the reference is found within the definition section of the CCPA, the former interpretation seems the most likely intent of the legislature.

[2] The GDPR does not expressly define the term “sale,” nor does it ascribe particular obligations to companies that sell personal information. Selling, however, is implicitly governed by the GDPR as any transfer of personal information from one controller to a second controller would be considered a processing activity for which a lawful purpose would be required pursuant to GDPR Article 6.

[3] Va. Code 59.1-577(B) (2022).

[4] Utah Code Ann. 13-61-303(1)(a) (2022).

[5] Va. Code 59.1-577(D) (2022) (exempting compliance with Va. Code 59.1-573(A)(1) through (4)

[6] C.R.S. 6-1-1307(3) (2022) (exempting compliance with C.R.S. Section 6-1-1306(1)(b) to (1)(e)).

[7] Utah Code Ann. 13-61-303(1)(c) (exempting compliance with Utah Code Ann. 13-61-202(1) through (3)).

[8] Va. Code 59.1-577(D) (2022) (exempting compliance with Va. Code 59.1-573(A)(1) through (4)

[9] C.R.S. 6-1-1307(3) (2022) (exempting compliance with C.R.S. Section 6-1-1306(1)(b) to (1)(e)).

[10] Va. Code 59.1-577(D) (2022) (exempting compliance with Va. Code 59.1-573(A)(1) through (4)

[11] C.R.S. 6-1-1307(3) (2022) (exempting compliance with C.R.S. Section 6-1-1306(1)(b) to (1)(e)).

[12] Utah Code Ann. 13-61-303(1)(c) (exempting compliance with Utah Code Ann. 13-61-202(1) through (3)).

[13] Va. Code 59.1-577(D) (2022) (exempting compliance with Va. Code 59.1-574).

[14] Va. Code 59.1-577(D) (2022) (exempting compliance with Va. Code 59.1-574).

©2022 Greenberg Traurig, LLP. All rights reserved.

Top Legal Industry News for Spring 2022: Law Firm Hiring, Industry Recognition, Women in Law

We’re back with another edition of our legal industry news roundup. Read more below for the latest updates in law firm hiring and expansion, legal industry awards, and recognition of leading women in the field today.

Law Firm Hiring and Expansion

Keller and Heckman added Counsel Daniel P. McGee to the firm’s Tobacco and E-Vapor practice. Mr. McGee’s experience includes counseling companies on a broad range of complex tobacco industry and U.S. Food and Drug Administration (FDA) regulatory matters and developing strategies to help companies bring new products to market.

“Daniel’s expertise and industry perspective will be invaluable to Keller and Heckman clients who are carefully navigating the challenges and pitfalls of a highly regulated and rapidly evolving legal landscape,” said Azim Chowdhury, a Partner in the firm’s Tobacco and E-Vapor and Food and Drug practices. “In addition to expanding our tobacco and e-vapor capabilities, we are especially looking forward to utilizing Daniel’s expertise in state law compliance, particularly for clients expanding into the hemp and CBD categories.”

Richard Mann, Chair of Keller and Heckman’s Management Committee, expressed excitement over Mr. McGee’s joining the firm, saying. “The addition of Daniel to our practice demonstrates Keller and Heckman’s commitment to helping our clients understand and comply with continuously evolving regulations in this growing field.”

Mr. McGee said he’s looking forward to collaborating with the Tobacco and E-Vapor team at Keller and Heckman.

“After spending the bulk of my legal career as in-house counsel to the tobacco industry, I made a strategic decision to focus on the industry as a whole and join a law firm that is a leader in tobacco regulatory compliance and public policy initiatives.”

Norris McLaughlin, P.A. welcomed Michael J. Willner as a Member in the firm’s New York office. Mr. Willner joined the firm’s Real Estate, Finance, and Land Use Practice Group.

Mr. Willner works with individuals and entities involved with managing real estate assets, as well as condominiums and co-ops. He specializes in condominium and cooperative law, commercial and residential real estate transactions and related litigation.

Holtzman Vogel Baran Torchinksy & Josefiak PLLC opened a new office in Phoenix, Arizona. The firm held its ribbon cutting ceremony on April 26 for the office at the Esplenade with the Arizona Chamber of Commerce.

The office is led by resident Partner Christine Fort and Dallin M. Holt, Of Counsel.

“After over 20 years representing high-profile clients in all aspects of political and regulatory law, we are grateful to now open our fourth office to help support our growing roster of clients in the West,” said Managing Partner Jill Holtzman Vogel, former Chief Counsel for the RNC and a sitting member of the Virginia General Assembly. “We could have chosen anywhere to expand our reach, but Arizona and the Phoenix metro area is dynamic and fast-growing – just like our team. This is absolutely the right place for Holtzman Vogel to put down roots, and we are thrilled to open the doors and get started.”

Goldberg Segalla added Ian G. Zolty to the firm’s Workers’ Compensation group in Princeton, N.J.

Mr. Zolty has experience counseling and defending employers, insurance carriers, and third-party administrators in workers’ compensation matters throughout New Jersey, including hospitals, insurance companies and school boards, among others.

Legal Industry Recognition

City & State New York named three shareholders at Greenberg Traurig, LLP to its 2022 Energy & Environment Power 100 listSteven C. RussoDoreen U. Saia, and Zackary D. Knaub. The recognition spotlights significant legal professionals in the New York area that are “reshaping the energy industry – and rescuing our environment.”

Mr. Russo is the co-chair of the firm’s Environmental Practice, focusing his practice on environmental law, the National Environmental Policy Act, the State Environmental Quality Review Act, and more. Ms. Saia is the chair of the Albany Office’s Energy & Natural Resources Practice, where she focuses her efforts on supporting national and international electricity corporations and aiding in related financial transactions. Mr. Knaub is a shareholder in both the Environmental and the Government Law & Policy groups, practicing specifically in energy and environmental legal and government affairs matters, including litigation, dispute resolution, government procurement, and regulatory matters.

Tammie Alexander, chair of the Business Department at Steptoe & Johnson PLLC, is a 2022 Bar Foundation Fellow, appointed by the West Virginia Bar Foundation Board of Directors.  Recognizing lawyers and judges in West Virginia with noteworthy dedication to the practice of law, the Bar Foundation has nominated only 450 out of 6,000 eligible individuals since 1999. Since the program’s inception, 22 Steptoe & Johnson attorneys have been selected as fellows.

Ms. Alexander, located in the firm’s Morgantown office, focuses her practice on an array of topics, including banking, real estate, commercial transactions, title insurance, and construction matters. She primarily assists with large scale projects that involve multiple property owners, governmental agencies, and financial investors.

The South Carolina School of Law provided the Platinum Compleat Lawyer Award, the school’s highest alumni honor, to Erna Womble, retired litigation partner at Womble Bond Dickinson (US) LLP. Established in 1992, the Compleat Lawyer Awards are meant to recognize alumni for notable professional, civil, and legal accomplishments. Recipients are members of the field who exemplify professional competence, ethics, and integrity.

Erna Womble, who graduated from the University of South Carolina School of Law in 1986, joined Womble Bond Dickinson in 1987. Today, she serves as the Co-President of Clearly Bespoke Strategies, Inc., a strategic advising company. Ms. Womble said of the award: “I am profoundly honored by the award from the law school which began my career as a lawyer-in-training. One of my excellent professors often admonished that when lawyers cease to learn, they cease to be good lawyers. More than three decades later, I’m still a lawyer-in-training. I am forever grateful to my beloved firm which afforded me the singular privilege of raising children whilst working with scions of industry and holders of the public trust in serving some of the firm’s best clients.”

Women in the Legal Industry

The Los Angeles Business Journal announced their “Women of Influence: Attorneys,” list which included Stubbs, Alderton & Markiles’ Heather Antoine. The list highlighted lawyers working for large businesses in legal areas such as data protection and intellectual property law.

Heather Antoine focuses her law firm practice on corporate property and data protection as Chair of the firm’s Trademark & Brand Protection practice, and Co-Chair of the Privacy & Data Security practice group. Some of her credits include features in the Los Angeles Times and CNBC.

Robinson & Cole LLP voted partner Britt-Marie K. Cole-Johnson to join the firm’s Managing Committee, allowing her to participate in the firm’s policy and practice strategic development. This comes after a series of noteworthy recognitions in the legal field: Cole-Johnson was recently presented with the Distinguished Leader Award by the Connecticut Law Tribune’s Connecticut Legal Awards, and she was additionally selected as an honoree for The 100 Women of Color Gala & Awards.

“[Ms. Cole-Johnson] is well-known for her talents as a legal advisor but also for her deep commitment to community organizations. She joined the firm thirteen years ago after law school and has been a true and constant champion for equitable and inclusive business practices within the firm, with her clients, and within the community. I look forward to her bringing that leadership and perspective to our Managing Committee,” said Robinson & Cole colleague Rhonda J. Tobin.

The accolades followed a recent appointment by Connecticut Governor Ned Lamont for the Connecticut Paid Leave Authority board.

Romer Debbas, LLP formed an all-female, diverse Agency Lending & Affordable Housing Department, focusing on representation in the property market. Partner Carmen I. Pagan, and Associates Catherine M. Azevedo and Pamela U. Norbert lead the new team with years of legal knowledge in real estate financing, commercial property law and lending service providers.

The new department expanded the firm’s practice areas in bankruptcy, corporate and business law, immigration, litigation, taxation and trusts and estate law.

For more business of law legal news, click here to visit the National Law Review.

Copyright ©2022 National Law Forum, LLC

10 Law Firm Newsletter Ideas to Attract Clients

How to Start and Grow a Newsletter for a Law Firm

Email marketing often gets a bad rap. After all, we all know the annoyance of getting spam and promotional emails. Much of this content just ends up deep in our inbox. The same can happen to newsletters… especially boring ones.

Don’t let your law firm email newsletter fall to this fate. In this guide, I’ll talk about how to start a successful newsletter and use it to attract clients.

Plus, you’ll get 10 content ideas for creating an engaging newsletter.

Why start a newsletter?

A study conducted by Law Technology Today found that 86% of law firms fail to collect an email address when they acquire a new lead. Starting an email newsletter is one way to prioritize growing your email list and taking down information to nurture users into potential clients.

With this in mind, an email newsletter is about more than just sending a generic email every month; instead, it can be an effective tool for drumming up new business for your law firm. It also gives you a medium through which you can share firm news, build trust with your subscribers, and establish your law firm’s brand.

Benefits of starting a law firm newsletter

Email newsletter marketing offers many benefits to your law firm. Beyond simply sending updates to your email list, an email newsletter can bring the following perks:

  • Connection – A law firm newsletter builds connection with your new and potential clients by telling them more about your firm and offering a way for subscribers to respond directly to your email.
  • Traffic – An effective newsletter can work to drive more users to your website and social media pages.
  • Sales – Newsletters offer a convenient way for subscribers to reach out to your firm, increasing the likelihood that they will turn into new clients.
  • Community – Sending a consistent newsletter can help drive users to your social media accounts, therefore growing your community and visibility on social.
  • Reputation Management – Email provides an avenue for you to build rapport with your audience, get ahead of bad PR, and ultimately build trust in your firm.

How to write a law firm email newsletter

Before you sit down and start typing away at your newsletter, you’ll want to understand the fundamentals of what it takes to write and market a great newsletter. Here’s how to get started.

Define your target audience

Generalism is the killer of many marketing campaigns. If you don’t define your target audience – that is, the interests and persona of the people you are trying to reach – you risk offering the wrong type of content to the wrong audience. And disjointed messaging won’t bring the client-generating results that you want.

Instead, you’ll want to brainstorm a few factors to ensure you are writing for your ideal audience. These factors include:

  • What types of legal services your audience is interested in
  • What legal issues they are struggling with most
  • What questions they’re likely to have about the legal process
  • What their goals are when it comes to hiring a lawyer
  • What interests they have in understanding law, the legal system, etc.

If you’ve been in your field for a while, you’ll likely have an idea of how to answer these questions. If you’re more green, you can always ask your network, social media followers, and existing clients some of these questions to better understand their interests.

Grow your email list

Of course, before you can see results from an email newsletter you’ll need an audience to send it to! Now, building an email list organically takes time, but it’s worth it to build a list of subscribers who are actually interested in your content.

Never buy email subscribers, as these will likely be dead accounts or otherwise users who will never work with you. Instead, invest in blogging and website marketing in order to grow your community organically.

Here are some tips for growing your law firm email list:

  1. Embed a signup form on your website in order to capture users’ contact information (at the very least, their email address and name)
  2. Publish helpful blog content to drive organic search engine traffic and traffic from social media
  3. Offer downloadable content – like PDFs, infographics, guides, etc. – behind a sign-up wall to encourage users to subscribe
  4. Use email marketing software like Mailchimp to add email list signup forms to various pages or articles on your website
  5. Offer value with impactful content. If you’re able to demonstrate that you are an authority in your industry, people will be excited to subscribe for future updates

Plan your content

With your target audience in mind, you can begin to plan your newsletter content. I highly recommend choosing a “theme” and then building out a newsletter based on that theme.

For example, one month you may decide to talk about common mistakes people make in hiring a lawyer. So, you write four newsletters over the course of the month – each one addressing a different ‘mistake’ people make and how to avoid it.

You can use a notebook, Google Doc, or spreadsheet to plan your content and keep organized. Try to plan at least a month in advance so you are prepared with content ideas ahead of time. You can even write your content and schedule the delivery weeks or months out.

Write your newsletter

Whether you consider yourself a good writer or not, drafting a great email newsletter is relatively simple. There are just a few tips to keep in mind to help you produce engaging content every time:

  • Write an eye-catching subject line. Rather than simply say “newsletter”, you can include the actual subject of your email (e.g. ‘Don’t make this mistake…) to entice subscribers to click
  • Make it “scannable”. Instead of typing a long wall of text, break your email content into shorter paragraphs, sentences, or bulleted lists. This makes it easier for readers to ‘scan’ your content and find the content they are interested in.
  • ‘Close the loop’. This is a concept I got from an email copywriter. Open your email with a ‘hook’ – could be a tip, a question, or an intro to a story – and then resolve the hook at the end of your email. For example, you could open with “Many clients make a huge mistake in hiring a lawyer…” and then at the end of the email you say “Don’t want to make that mistake? Here’s how to avoid it…”. This keeps readers interested from start to finish.
  • Add a link. Include links to related blog posts, social media posts, videos, etc. to drive traffic to your other channels.
  • Include a call to action. Either encourage readers to respond to a question (e.g. “What do you think about…?”), contact you directly (e.g. “Respond now to schedule a consultation”), or visit your other platforms (e.g. “Visit our website to learn more about…”).

Use an email platform

Email marketing software like Mailchimp and ConvertKit makes it easy to write, format, schedule, and deliver your newsletter content. There’s no need to create a long CC chain to your subscribers and send your email manually. These tools allow you to send your newsletter to an entire list, schedule the delivery date, add media, and more.

Preview and test your newsletter

It’s always a good idea to preview your newsletter to check if you made any mistakes. Further, send yourself a test email to make sure there are no delivery issues. You can then also see how your newsletter looks on different devices and decide if you need to change up your content.

Send it out

Once your email template is complete, give it a final once-over for any selling issues or mistakes. When you’ve double-checked your content, you’re ready to send it to your email list.

Track results

Most email marketing tools will also provide analytics regarding your email open rate, subscriber growth, or unsubscribe rate. These metrics will help you determine the success of your newsletter and make adjustments over time. For example, if you see that your open rate is low, that may mean you need more engaging subject lines. Or, if there have been a lot of unsubscribes, this may mean users aren’t enjoying your content.

Try these creative law firm newsletter ideas

Now, the funnest part of publishing an email newsletter is the amount of creativity there is in thinking up content ideas. I strongly encourage you to be adventurous with your newsletter and not be afraid of veering from the same old script.

Here are some creative law firm newsletter ideas for you to consider:

1. Topic series

Produce a series of newsletters that cover a primary topic. For example, you can commit the month of November to talk about “DUI FYIs”, in which you reveal helpful tips in addressing a DUI over a series of emails. This approach gets subscribers looking forward to your upcoming emails and makes it easier for you to plan your content.

2. Q&A

The legal process can be super confusing for clients and the general public. With this idea, you can address a single question and answer via email over the course of the campaign. Again, this can encourage users to look forward to your upcoming Q&A sessions.

3. Interviews

Know an industry expert who has a perspective to share? Highlight this individual and provide value to your audience by including an interview in your newsletter. You can do this several times in your email marketing strategy. And, it can get subscribers to ask questions to your email campaign, which is great for deliverability and engagement.

4. Email course

Some topics warrant a deeper explanation. For subscribers wanting to learn more about the legal process or a particular topic, you can offer a multi-step email course. They will have to open each email to get new nuggets of information and to complete the course.

5. Videos

It’s no secret that today’s users love video content. Including videos in your emails is a good way to improve open rates and direct users to your video (typically, your YouTube channel or website). Be sure to include “Video:” in your email subject line to encourage subscribers to one your email.

6. Templates

Many email marketing platforms offer professional-looking email templates you can use so you don’t have to design your newsletter from scratch. A great-looking email could encourage users to engage with your content. Typically, these templates include social media icons as well, which can direct more traffic to these platforms. You can update colors, fonts, logos, images, and more.

7. ‘Get to know me’

When new subscribers join your newsletter, they may not know much about you. A “Get to know me” email can help introduce them to you, your interests, and your approach to law. Keep it fun by sharing interesting facts about yourself, likes and dislikes, hobbies, or whatever you think will be exciting to your audience.

8. Meet the team

Similarly, you can run a “Meet the team” series to introduce your entire staff to your list. This is a great way to build trust and provide that added human connection. If you have a large staff, consider breaking this out into several emails for even more content.

9. Storytime

Email subscribers love a good story. Now, while you don’t want to share any confidential information about your cases, you could share lessons learned from the industry, funny office stories, or a personal life story. You can even slowly tell the story over a course of emails to keep readers interested.

10. In the news

We’ve all come across hot news stories where celebrities land themselves in legal trouble or a large company is going under. Turn trending topics into legal lessons, offer your own unique spin, and make the legal process more relatable to your readers. We are all talking about these pop culture stories anyway, might as well use it for great email content!

Email newsletters build connection with your audience

An email newsletter is one of the best ways to build trust and connection with potential and existing clients. Remember, subscribers care less about “marketing content” and more about the value your firm can provide, the stories you tell, and how you can help them navigate their legal woes.

So, keep things fun and interesting with creative email content. Try different media, switch up topics, and, above all, stay consistent so you nurture a strong, engaged audience.

Copyright 2022 © Hennessey Digital

Article By Jason Hennessey with Hennessey Digital.

For more articles about law firm management, please visit the NLR Business of Law section.

A Lawyer’s Guide to Integrated Marketing

Like many lawyers, I did not learn about marketing in law school. I knew nothing about communications or media relations before law school, either. When I graduated and began practicing at a boutique matrimonial law firm, there was no internal or external marketing resource, and no direct conversations or plans about public relations or branding. One founding partner talked about the importance of reputation for connecting with potential clients and how his connections in the legal community resulted in many referrals, but he never mentioned marketing.

Yet, as I tagged along to bar association meetings, drafted articles that the partner published in a legal journal, and received encouragement to network at Inns of Court sessions, I saw this side of legal practice come to light. We didn’t call it marketing, or PR, and it was well before social media, but I understood that the partner was intentionally marketing the practice and generating awareness of the firm’s experience — an effort that resulted in new client engagements.

When I decided to leave law after a few years, I enrolled in a New York University course about marketing for professional services. As luck would have it, the instructor was Deborah Brightman Farone, an extraordinary legal marketer then and now — she was inducted into the Legal Marketing Association’s Hall of Fame at the organization’s 2022 annual conference. Deborah introduced me to the field of law firm marketing, and since then, I have worked with hundreds of lawyers and professional marketers on business development and integrated marketing plans, and have helped them make marketing part of their daily practice.

Most lawyers need to understand what this marketing thing is all about. I see firsthand their appreciation for the importance of building client relationships, cross-selling expertise within the firm, and networking. However, I don’t see an understanding of the terms and tactics of legal marketing as often. I think that with so much to learn in law school, there just isn’t time to learn the business side of law. Once a lawyer is practicing law, there may be little direction about how to reach prospects and referral sources, stand apart from other lawyers doing similar work, and find time to “market oneself.”

I frequently read articles where lawyers describe their routes to becoming partner or managing a practice or office. The words “PR” or “marketing” may not appear in their answers, but as someone who has advised lawyers about practice growth for more than 20 years, I know that positioning themselves as knowledge leaders played a role in the success of their relationship-building and practice development. And that, of course, is marketing.

This article will take you through five steps I always examine with lawyers who are just getting started with marketing, or participating in a firmwide marketing program.

  1. Acknowledge the Need for Education

Earning a JD and passing the bar exam prepare a lawyer for the practice of law, but not the business of law. My colleague Vivian Hood recently wrote, “Law schools focus on teaching the art of law, and not so much on the art of connections.” Courses about marketing, public relations, or social media are not part of the law school curriculum. Rather, law school teaches students to read cases and apply precedent, analyze facts and frame arguments, and spot the real issues and see the red herrings. Likewise, legal writing courses, moot court competitions, internships, and other hands-on work prepare them for practicing law. Their understanding of marketing may extend to billboards they see on their way to work, law firm ads in legal journals, or networking events with bar associations.

Lawyers know how to practice law, but do not know what marketing is or how it supports business development and revenue. Education is the first step to heightening awareness. On many occasions, I have explained how PR works so lawyers understand the events that result in being quoted in a trade publication, or the behind-the-scenes steps that go into earning a speaking engagement at an industry event.

  1. Discuss Perceptions of Marketing

The only way to know how an attorney perceives marketing is to ask, and then provide guidance about worthwhile and suitable marketing efforts.

Lawyers often shy away from marketing because they associate it with sales. My colleague Glennie Green explains, “Most attorneys envision some sort of sales when the idea of marketing and business development comes up. They see car salespeople, or aggressive pitches for timeshares. But that is the wrong mindset. Business development is not sales. Business development is cultivating and nurturing relationships.”

Relationships can be built in many ways. A common misconception is that marketing success is based on the ability to be a natural rainmaker who can walk into any room and instantly make connections for the firm. That belief can create unrealistic expectations and undue stress, because rainmakers are few and far between. Relationships can be built and nurtured without that unique rainmaker quality. Everyone adapts to situations differently ­— some of us are introverts, others extroverts, or a combination of traits.

  1. Assess the Impact of Previous Experiences

Lawyers may base their perceptions of marketing on prior experiences. Lawyers have told me, “I wrote many articles in the past, and they never amounted to any new business.”

“I traveled to speak at a conference, and not a single attendee turned out to be a new client.”

“I did an interview with a reporter who misquoted me.”

“I have a LinkedIn profile, but I’m not interested in doing anything with it; it’s just like Facebook.”

Many people fear failure, and many transactional lawyers and litigators are driven by winning. It is no surprise, then, that lawyers question the value of something that has not been a winner in the past. Understanding and acknowledging these hesitations can lead to productive discussions about marketing and, more specifically, about techniques that may be better suited for the lawyer.

  1. Discuss the Time Commitment

The billable-hour model of legal practice can affect a lawyer’s availability to market their practice. Too many business-driving commitments will inevitably frustrate a lawyer and diminish the success of marketing. It’s better to work with a distinct set of action items that can take only a few minutes a day rather than many hours each week.

Glennie Green has helped lawyers identify their advocates — assistants, paralegals, the firm’s librarians; people they can partner with to achieve their action items. One managing partner with a busy practice serves as an example of this effort. “He has made a commitment to conduct a certain number of meetings a month with current and potential referral sources,” she says. “He enlists a paralegal in the office to help schedule those meetings, as well as maintain his ‘marketing’ calendar. This allows him to keep his focus on his practice and manage the firm. He regularly checks his calendar for new appointments, and he says he looks forward to seeing whom he will meet with next. Once he realized that he didn’t have to do it all and enlisted some help, his plan and marketing goals became not only manageable but systematic.”

  1. Find the Comfort Zone

Marketing efforts must be tailored to a lawyer’s personality and interests. Everyone has a different comfort level. Some lawyers love to speak at conferences, and others would rather research a case and write an analysis for a journal. One lawyer may already enjoy engaging on social media, and another may feel crushed for time but would be amenable to doing a 30-minute interview with a reporter. Perhaps a lawyer may enjoy participating in an association’s events or committees. Green explains, “Knowing a lawyer’s areas of confidence, and recognizing what causes any discomfort, is crucial to establish the right marketing plan with the flexibility to change direction as needed.”

The avenues for marketing include website content and branding, social media posts and engagement, media relations, published quotes and articles, rankings submissions and awards, conferences and speaking opportunities, networking, events, and more. The questions and conversations I’ve provided lead to more precise choices of marketing tactics, as well as more informed expectations of results. An integrated marketing and business development program offers lawyers a selection of tactics, with deliberate matching to their preferences and the flexibility to change as needed.

© Copyright 2008-2022, Jaffe Associates

French Insider Episode 12: Navigating the Metaverse with Jim Gatto [PODCAST]

Joining host Sarah Aberg is Jim Gatto. Jim joins us today to discuss the metaverse, the technology and business models involved in these virtual worlds, the role of NFTs and cryptocurrency in the digital economy, and the legal, regulatory, and governance issues that can arise when companies seek to enter that space.

Jim Gatto is a partner in Sheppard Mullin’s Washington, D.C. office, where he leads the  Blockchain & Fintech Team, Social Media & Games Team, and Open Source Team. Jim’s practice focuses on blockchain, interactive entertainment, digital art, AI, and online gambling. He advises clients on IP strategies, development and publishing agreements, licensing and technology transaction agreements, and tech regulatory issues. Jim has been involved with blockchain since 2012 and has been recognized as a thought leader by leading organizations including as a Cryptocurrency, Blockchain and Fintech Trailblazer by the National Law Journal.

Sarah Aberg is special counsel in the White Collar Defense and Corporate Investigations Group in Sheppard Mullin’s New York office. Sarah’s practice encompasses litigation, internal investigations and white collar defense.  Her areas of focus include financial services and securities, as well as corporate fraud in a variety of industries, including technology, construction, and non-profits.  Sarah’s regulatory practice encompasses market regulation, foreign registration and disclosure requirements, supervisory procedures, and sales practices.  Sarah represents corporations, financial services companies, and associated individuals in connection with investigations and regulatory matters before the U.S. Department of Justice, the Securities and Exchange Commission, the Commodity Futures Trading Commission, FINRA, the New York Stock Exchange, the New York State Department of Financial Services, and the New York Attorney General’s Office.

What We Discussed in This Episode:

  1. What is the Metaverse?
  2. How Do Metaverses Differ from Earlier Virtual Worlds?
  3. What Role Do NFTs Play in the Digital Economy?
  4. Investing in a Metaverse: What are the Risks?
  5. What are Legal, Regulatory, and Tax Considerations?
  6. What Governance Issues Exist for Brands Operating in a Metaverse?
  7. What are the Inflationary and Deflationary Aspects of the Virtual Economy?
  8. How Might Blockchain and Cryptocurrency Alter International Financial Transactions?
  9. Is the World Moving into a Virtual/Digital Economy?

How Businesses Can Use LinkedIn Company Newsletters in Their Marketing Efforts

LinkedIn has added what I think is the most helpful tool in a long time for businesses to engage with and bring value to their followers – the ability for LinkedIn Company Pages to publish email newsletters right through LinkedIn.

This underscores the importance of having a company page and how it can be used as a content hub for marketing and recruiting your business.

Linked Company Page newsletters are available to businesses with more than 150 followers that actively maintain their LinkedIn presences.

You can create a LinkedIn Company Page newsletter in three simple steps:

  1. Create: Start writing an article on and select “Create a Newsletter.” Give it a title, add a header image (it prompts you with the dimensions) and cut and paste your text. You can add hyperlinks and images for each article too.
  2. Publish: When you publish your newsletter it will post to your feed and LinkedIn will notify your followers. They can opt in to receive email and in-platform notifications when you publish new content.
  3. Review performance: View the analytics of each newsletter sent out and see the number of subscribers. The number increases pretty quickly which is awesome. And it’s opt in so you don’t have to worry about GDPR rules.

There’s a lot of opportunity here because it is a new feature (for companies – it’s been available to individuals for a short time) and most companies don’t know about it yet (and certainly aren’t using it yet), so being an early adopter is to your benefit.

Even if you send out an email newsletter, you should still utilize the LinkedIn platform to send out a newsletter because you will reach a different audience and cast a wider net for your content.

In addition, people are opting into this newsletter, so it’s not building an audience from scratch, and if you haven’t ever sent out an email newsletter, this is a great way to start. If email marketing programs and CRM management tools overwhelm you, this is a great way to test out the waters.

It’s also really easy to repurpose content you already have. I would include hyperlinks to your website or blog with the full text (in order to keep the newsletter short and to drive traffic to your site).

You can embed links from YouTube into the newsletter to play. Check out my LinkedIn newsletter to see how it looks.

Here are some content ideas for what you can include in your LinkedIn Company Page Newsletter:

  • Article snippets with links to your latest blog posts or client alerts
  • Links to past webinars (provide a synopsis too)
  • Links to recent podcasts and videos (with shownotes)
  • Recent case studies
  • Q&As with your employees
  • Highlights of your community service/pro bono work
  • Announcements of your recent hires
  • Recent press coverage (this would be the only place where I would recommend including self-promotional items in the newsletter – the rest of it should be client-focused)
  • Upcoming events/webinars – this is a great way to promote them
  • Open jobs – why not promote them through this newsletter? It’s a competitive job market
  • News about your diversity and women’s initiatives programs – clients care a lot about this

Check out this new feature and let me know what you think of it. With nearly 800 million people on LinkedIn and the fact that your competitors are very likely not using it yet, it’s at least worth trying out.

Copyright © 2022, Stefanie M. Marrone. All Rights Reserved.

WW International to Pay $1.5 Million Civil Penalty for Alleged COPPA Violations

In 2014, with childhood obesity on the rise in the United States, tech company Kurbo, Ltd. (Kurbo) marketed a free app for kids that, according to the company, was “designed to help kids and teens ages 8-17 reach a healthier weight.” When WW International (WW) (formerly Weight Watchers) acquired Kurbo in 2018, the app was rebranded “Kurbo by WW,” and WW continued to market the app to children as young as eight. But according to the Federal Trade Commission (FTC), Kurbo’s privacy practices were not exactly child-friendly, even if its app was. The FTC’s complaint, filed by the Department of Justice (DOJ) last month, claims that WW’s notice, data collection, and data retention practices violated the Children’s Online Privacy Protection Act Rule (COPPA Rule). WW and Kurbo, under a stipulated order, agreed to pay a $1.5 million civil penalty in addition to complying with a range of injunctive provisions. These provisions include, but are not limited to, deleting all personal information of children whose parents did not provide verifiable parental consent in a specified timeframe, and deleting “Affected Work Product” (defined in the order to include any models or algorithms developed in whole or in part using children’s personal information collected through the Kurbo Program).

Complaint Background

The COPPA Rule applies to any operator of a commercial website or online service directed to children that collects, uses, and/or discloses personal information from children and to any operator of a commercial website or online service that has actual knowledge that it collects, uses, and/or discloses personal information from children. Operators must notify parents and obtain their consent before collecting, using, or disclosing personal information from children under 13.

The complaint states that children enrolled in the Kurbo app by signing up through the app or having a parent do it on their behalf. Once on Kurbo, users could enter personal information such as height, weight, and age, and the app then tracked their weight, food consumption, and exercise. However, the FTC alleges that Kurbo’s age gate was porous, requiring no verification process to establish that children who affirmed they were over 13 were the age they claimed to be or that users asserting they were parents were indeed parents. In fact, the complaint alleges that the registration area featured a “tip-off” screen that gave visitors just two choices for registration: the “I’m a parent” option or the “I’m at least 13” option. Visitors saw the legend, “Per U.S. law, a child under 13 must sign up through a parent” on the registration page featuring these choices. In fact, thousands of users who indicated that they were at least 13 were younger and were able to change their information and falsify their real age. Users who lied about their age or who falsely claimed to be parents were able to continue to use the app. In 2020, after a warning from the FTC, Kurbo implemented a registration screen that removed the legend and the “at least 13” option. However, the new process failed to provide verification measures to establish that users claiming to be parents were indeed parents.

Kurbo’s notice of data collection and data retention practices also fell short. The COPPA Rule requires an operator to “post a prominent and clearly labeled link to an online notice of its information practices with regard to children on the home or landing page or screen of its Web site or online service, and, at each area of the Web site or online service where personal information is collected from children.” But beginning in November 2019, Kurbo’s notice at registration was buried in a list of hyperlinks that parents were not required to click through, and the notice failed to list all the categories of information the app collected from children. Further, Kurbo did not comply with the COPPA Rule’s mandate to keep children’s personal information only as long as reasonably necessary for the purpose it was collected and then to delete it. Instead, the company held on to personal information indefinitely unless parents specifically requested its removal.

Stipulated Order

In addition to imposing a $1.5 million civil penalty, the order, which was approved by the court on March 3, 2022, requires WW and Kurbo to:

  • Refrain from disclosing, using, or benefitting from children’s personal information collected in violation of the COPPA Rule;
  • Delete all personal information Kurbo collected in violation of the COPPA Rule within 30 days;
  • Provide a written statement to the FTC that details Kurbo’s process for providing notice and seeking verifiable parental consent;
  • Destroy all affected work product derived from improperly collecting children’s personal information and confirm to the FTC that deletion has been carried out;
  • Delete all children’s personal information collected within one year of the user’s last activity on the app; and
  • Create and follow a retention schedule that states the purpose for which children’s personal information is collected, the specific business need for retaining such information, and criteria for deletion, including a set timeframe no longer than one year.

Implications of the Order

Following the U.S. Supreme Court’s decision in AMG Capital Management, LLC v. Federal Trade Commission, which halted the FTC’s ability to use its Section 13(b) authority to seek monetary penalties for violations of the FTC Act, the FTC has been pushing Congress to grant it greater enforcement powers. In the meantime, the FTC has used other enforcement tools, including the recent resurrection of the agency’s long-dormant Penalty Offense Authority under Section 5(m)(1)(B) of the FTC Act and a renewed willingness to use algorithmic disgorgement (which the FTC first applied in the 2019 Cambridge Analytica case).

Algorithmic disgorgement involves “requir[ing] violators to disgorge not only the ill-gotten data, but also the benefits—here, the algorithms—generated from that data,” as then-Acting FTC Chair Rebecca Kelly Slaughter stated in a speech last year. This order appears to be the first time algorithmic disgorgement was applied by the Commission in an enforcement action under COPPA.

Children’s privacy issues continue to attract the attention of the FTC and lawmakers at both federal and state levels. Companies that collect children’s personal information should be careful to ensure that their privacy policies and practices fully conform to the COPPA Rule.

© 2022 Keller and Heckman LLP

Utah Becomes Fourth U.S. State to Enact Consumer Privacy Law

On March 24, 2022, Utah became the fourth state in the U.S., following California, Virginia and Colorado, to enact a consumer data privacy law, the Utah Consumer Privacy Act (the “UCPA”). The UCPA resembles Virginia’s Consumer Data Protection Act (“VCDPA”) and Colorado’s Consumer Privacy Act (“CPA”), and, to a lesser extent, the California Consumer Privacy Act (as amended by the California Privacy Rights Act) (“CCPA/CPRA”). The UCPA will take effect on December 31, 2023.

The UCPA applies to a controller or processor that (1) conducts business in Utah or produces a product or service targeted to Utah residents; (2) has annual revenue of $25,000,000 or more; and (3) satisfies at least one of the following thresholds: (a) during a calendar year, controls or processes the personal data of 100,000 or more Utah residents, or (b) derives over 50% of its gross revenue from the sale of personal data, and controls or processes the personal data of 25,000 or more consumers.

As with the CPA and VCDPA, the UCPA’s protections apply only to Utah residents acting solely within their individual or household context, with an express exemption for individuals acting in an employment or commercial (B2B) context. Similar to the CPA and VCDPA, the UCPA contains exemptions for covered entities, business associates and protected health information subject to the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), and financial institutions or personal data subject to the Gramm-Leach-Bliley Act (“GLB”). As with the CCPA/CPRA and VCDPA, the UCPA also exempts from its application non-profit entities.

In line with the CCPA/CPRA, CPA and VCDPA, the UCPA provides Utah consumers with certain rights, including the right to access their personal data, delete their personal data, obtain a copy of their personal data in a portable manner, opt out of the “sale” of their personal data, and opt out of “targeted advertising” (as each term is defined under the law). Notably, the UCPA adopts the VCDPA’s more narrow definition of “sale,” which is limited to the exchange of personal data for monetary consideration by a controller to a third party. Unlike the CCPA/CPRA, CPA and VCDPA, the UCPA will not provide Utah consumers with the ability to correct inaccuracies in their personal data. Also unlike the CPA and VCDPA, the UCPA will not require controllers to obtain prior opt-in consent to process “sensitive data” (i.e., racial or ethnic origin, religious beliefs, sexual orientation, citizenship or immigration status, medical or health information, genetic or biometric data, or geolocation data). It will, however, require controllers to first provide consumers with clear notice and an opportunity to opt out of the processing of his or her sensitive data. With respect to the processing of personal data “concerning a known child” (under age 13), controllers must process such data in accordance with the Children’s Online Privacy Protection Act. The UCPA will prohibit controllers from discriminating against consumers for exercising their rights.

In addition, the UCPA will require controllers to implement reasonable and appropriate data security measures, provide certain content in their privacy notices, and include specific language in contracts with processors.

Unlike the CCPA/CPRA, VCDPA and CPA, the UCPA will not require controllers to conduct data protection assessments prior to engaging in data processing activities that present a heightened risk of harm to consumers, or to conduct cybersecurity audits or risk assessments.

In line with existing U.S. state privacy laws, the UCPA does not provide for a private right of action. The law will be enforced by the Utah Attorney General.

Copyright © 2022, Hunton Andrews Kurth LLP. All Rights Reserved.

EDPB on Dark Patterns: Lessons for Marketing Teams

“Dark patterns” are becoming the target of EU data protection authorities, and the new guidelines of the European Data Protection Board (EDPB) on “dark patterns in social media platform interfaces” confirm their focus on such practices. While they are built around examples from social media platforms (real or fictitious), these guidelines contain lessons for all websites and applications. The bad news for marketers: the EDPB doesn’t like it when dry legal texts and interfaces are made catchier or more enticing.

To illustrate, in a section of the guidelines regarding the selection of an account profile photo, the EDPB considers the example of a “help/information” prompt saying “No need to go to the hairdresser’s first. Just pick a photo that says ‘this is me.’” According to the EDPB, such a practice “can impact the final decision made by users who initially decided not to share a picture for their account” and thus makes consent invalid under the General Data Protection Regulation (GDPR). Similarly, the EDPB criticises an extreme example of a cookie banner with a humourous link to a bakery cookies recipe that incidentally says, “we also use cookies”, stating that “users might think they just dismiss a funny message about cookies as a baked snack and not consider the technical meaning of the term “cookies.”” The EDPB even suggests that the data minimisation principle, and not security concerns, should ultimately guide an organisation’s choice of which two-factor authentication method to use.

Do these new guidelines reflect privacy paranoia or common sense? The answer should lie somewhere in between, but the whole document (64 pages long) in our view suggests an overly strict approach, one that we hope will move closer to commonsense as a result of a newly started public consultation process.

Let us take a closer look at what useful lessons – or warnings – can be drawn from these new guidelines.

What are “dark patterns” and when are they unlawful?

According to the EDPB, dark patterns are “interfaces and user experiences […] that lead users into making unintended, unwilling and potentially harmful decisions regarding the processing of their personal data” (p. 2). They “aim to influence users’ behaviour and can hinder their ability to effectively protect their personal data and make conscious choices.” The risk associated with dark patterns is higher for websites or applications meant for children, as “dark patterns raise additional concerns regarding potential impact on children” (p. 8).

While the EDPB takes a strongly negative view of dark patterns in general, it recognises that dark patterns do not automatically lead to an infringement of the GDPR. The EDPB acknowledges that “[d]ata protection authorities are responsible for sanctioning the use of dark patterns if these breach GDPR requirements” (emphasis ours; p. 2). Nevertheless, the EDPB guidance strongly links the concept of dark patterns with the data protection by design and by default principles of Art. 25 GDPR, suggesting that disregard for those principles could lead to a presumption that the language or a practice in fact creates a “dark pattern” (p. 11).

The EDPB refers here to its Guidelines 4/2019 on Article 25 Data Protection by Design and by Default and in particular to the following key principles:

  • “Autonomy – Data subjects should be granted the highest degree of autonomy possible to determine the use made of their personal data, as well as autonomy over the scope and conditions of that use or processing.
  • Interaction – Data subjects must be able to communicate and exercise their rights in respect of the personal data processed by the controller.
  • Expectation – Processing should correspond with data subjects’ reasonable expectations.
  • Consumer choice – The controllers should not “lock in” their users in an unfair manner. Whenever a service processing personal data is proprietary, it may create a lock-in to the service, which may not be fair, if it impairs the data subjects’ possibility to exercise their right of data portability in accordance with Article 20 GDPR.
  • Power balance – Power balance should be a key objective of the controller-data subject relationship. Power imbalances should be avoided. When this is not possible, they should be recognised and accounted for with suitable countermeasures.
  • No deception – Data processing information and options should be provided in an objective and neutral way, avoiding any deceptive or manipulative language or design.
  • Truthful – the controllers must make available information about how they process personal data, should act as they declare they will and not mislead data subjects.”

Is data minimisation compatible with the use of SMS two-factor authentication?

One of the EDPB’s positions, while grounded in the principle of data minimisation, undercuts a security practice that has grown significantly over the past few years. In effect, the EDPB seems to question the validity under the GDPR of requests for phone numbers for two-factor authentication where e-mail tokens would theoretically be possible:

“30. To observe the principle of data minimisation, [organisations] are required not to ask for additional data such as the phone number, when the data users already provided during the sign- up process are sufficient. For example, to ensure account security, enhanced authentication is possible without the phone number by simply sending a code to users’ email accounts or by several other means.
31. Social network providers should therefore rely on means for security that are easier for users to re[1]initiate. For example, the [organisation] can send users an authentication number via an additional communication channel, such as a security app, which users previously installed on their mobile phone, but without requiring the users’ mobile phone number. User authentication via email addresses is also less intrusive than via phone number because users could simply create a new email address specifically for the sign-up process and utilise that email address mainly in connection with the Social Network. A phone number, however, is not that easily interchangeable, given that it is highly unlikely that users would buy a new SIM card or conclude a new phone contract only for the reason of authentication.” 
(emphasis ours; p. 15)

The EDPB also appears to be highly critical of phone-based verification in the context of registration “because the email address constitutes the regular contact point with users during the registration process” (p. 15).

This position is unfortunate, as it suggests that data minimisation may preclude controllers from even assessing which method of two-factor authentication – in this case, e-mail versus SMS one-time passwords – better suits its requirements, taking into consideration the different security benefits and drawbacks of the two methods. The EDPB’s reasoning could even be used to exclude any form of stronger two-factor authentication, as additional forms inevitably require separate processing (e.g., phone number or third-party account linking for some app-based authentication methods).

For these reasons, organisations should view this aspect of the new EDPB guidelines with a healthy dose of skepticism. It likewise will be important for interested stakeholders to participate in the consultation to explain the security benefits of using phone numbers to keep the “two” in two-factor authentication.

Consent withdrawal: same number of clicks?

Recent decisions by EU regulators (notably two decisions by the French authority, the CNIL have led to speculation about whether EU rules effectively require website operators to make it possible for data subjects to withdraw consent to all cookies with one single click, just as most websites make it possible to give consent through a single click. The authorities themselves have not stated that this is unequivocally required, although privacy activists notably filed complaints against hundreds of websites, many of them for not including a “reject all” button on their cookie banner.

The EDPB now appears to side with the privacy activists in this respect, stating that “consent cannot be considered valid under the GDPR when consent is obtained through only one mouse-click, swipe or keystroke, but the withdrawal takes more steps, is more difficult to achieve or takes more time” (p. 14).

Operationally, however, it seems impossible to comply with a “one-click withdrawal” standard in absolute terms. Just pulling up settings after registration or after the first visit to a website will always require an extra click, purely to open those settings. We expect this issue to be examined by the courts eventually.

Is creative wording indicative of a “dark pattern”?

The EDPB’s guidelines contain several examples of wording that is intended to convince the user to take a specific action.

The photo example mentioned in the introduction above is an illustration, but other (likely fictitious) examples include the following:

  • For sharing geolocation data: “Hey, a lone wolf, are you? But sharing and connecting with others help make the world a better place! Share your geolocation! Let the places and people around you inspire you!” (p.17)
  • To prompt a user to provide a self-description: “Tell us about your amazing self! We can’t wait, so come on right now and let us know!” (p. 17)

The EDPB criticises the language used, stating that it is “emotional steering”:

“[S]uch techniques do not cultivate users’ free will to provide their data, since the prescriptive language used can make users feel obliged to provide a self-description because they have already put time into the registration and wish to complete it. When users are in the process of registering to an account, they are less likely to take time to consider the description they give or even if they would like to give one at all. This is particularly the case when the language used delivers a sense of urgency or sounds like an imperative. If users feel this obligation, even when in reality providing the data is not mandatory, this can have an impact on their “free will”” (pp. 17-18).

Similarly, in a section about account deletion and deactivation, the EDPB criticises interfaces that highlight “only the negative, discouraging consequences of deleting their accounts,” e.g., “you’ll lose everything forever,” or “you won’t be able to reactivate your account” (p. 55). The EDPB even criticises interfaces that preselect deactivation or pause options over delete options, considering that “[t]he default selection of the pause option is likely to nudge users to select it instead of deleting their account as initially intended. Therefore, the practice described in this example can be considered as a breach of Article 12 (2) GDPR since it does not, in this case, facilitate the exercise of the right to erasure, and even tries to nudge users away from exercising it” (p. 56). This, combined with the EDPB’s aversion to confirmation requests (see section 5 below), suggests that the EDPB is ignoring the risk that a data subject might opt for deletion without fully recognizing the consequences, i.e., loss of access to the deleted data.

The EDPB’s approach suggests that any effort to woo users into giving more data or leaving data with the organisation will be viewed as harmful by data protection authorities. Yet data protection rules are there to prevent abuse and protect data subjects, not to render all marketing techniques illegal.

In this context, the guidelines should in our opinion be viewed as an invitation to re-examine marketing techniques to ensure that they are not too pushy – in the sense that users would in effect truly be pushed into a decision regarding personal data that they would not otherwise have made. Marketing techniques are not per se unlawful under the GDPR but may run afoul of GDPR requirements in situations where data subjects are misled or robbed of their choice.

Other key lessons for marketers and user interface designers

  • Avoid continuous prompting: One of the issues regularly highlighted by the EDPB is “continuous prompting”, i.e., prompts that appear again and again during a user’s experience on a platform. The EDPB suggests that this creates fatigue, leading the user to “give in,” i.e., by “accepting to provide more data or to consent to another processing, as they are wearied from having to express a choice each time they use the platform” (p. 14). Examples given by the EDPB include the SMS two-factor authentication popup mentioned above, as well as “import your contacts” functionality. Outside of social media platforms, the main example for most organisations is their cookie policy (so this position by the EDPB reinforces the need to manage cookie banners properly). In addition, newsletter popups and popups about “how to get our new report for free by filling out this form” are frequent on many digital properties. While popups can be effective ways to get more subscribers or more data, the EDPB guidance suggests that regulators will consider such practices questionable from a data protection perspective.
  • Ensure consistency or a justification for confirmation steps: The EDPB highlights the “longer than necessary” dark pattern at several places in its guidelines (in particular pp. 18, 52, & 57), with illustrations of confirmation pop-ups that appear before a user is allowed to select a more privacy-friendly option (and while no such confirmation is requested for more privacy-intrusive options). Such practices are unlawful according to the EDPB. This does not mean that confirmation pop-ups are always unlawful – just that you need to have a good justification for using them where you do.
  • Have a good reason for preselecting less privacy-friendly options: Because the GDPR requires not only data protection by design but also data protection by default, make sure that you are able to justify an interface in which a more privacy-intrusive option is selected by default – or better yet, don’t make any preselection. The EDPB calls preselection of privacy-intrusive options “deceptive snugness” (“Because of the default effect which nudges individuals to keep a pre-selected option, users are unlikely to change these even if given the possibility” p. 19).
  • Make all privacy settings available in all platforms: If a user is asked to make a choice during registration or upon his/her first visit (e.g., for cookies, newsletters, sharing preferences, etc.), ensure that those settings can all be found easily later on, from a central privacy settings page if possible, and alongside all data protection tools (such as tools for exercising a data subject’s right to access his/her data, to modify data, to delete an account, etc.). Also make sure that all such functionality is available not only on a desktop interface but also for mobile devices and across all applications. The EDPB illustrates this point by criticising the case where an organisation has a messaging app that does not include the same privacy statement and data subject request tools as the main app (p. 27).
  • Be clearer in using general language such as “Your data might be used to improve our services”: It is common in most privacy statements to include a statement that personal data (e.g., customer feedback) “can” or “may be used” to improve an organisation’s products and services. According to the EDPB, the word “services” is likely to be “too general” to be viewed as “clear,” and it is “unclear how data will be processed for the improvement of services.” The use of the conditional tense in the example (“might”) also “leaves users unsure whether their data will be used for the processing or not” (p. 25). Given that the EDPB’s stance in this respect is a confirmation of a position taken by EU regulators in previous guidance on transparency, and serves as a reminder to tell data subjects how data will be used.
  • Ensure linguistic consistency: If your website or app is available in more than one language, ensure that all data protection notices and tools are available in those languages as well and that the language choice made on the main interface is automatically taken into account on the data-related pages (pp. 25-26).

Best practices according to the EDPB

Finally, the EDPB highlights some other “best practices” throughout its guidelines. We have combined them below for easier review:

  • Structure and ease of access:
    • Shortcuts: Links to information, actions, or settings that can be of practical help to users to manage their data and data protection settings should be available wherever they relate to information or experience (e.g., links redirecting to the relevant parts of the privacy policy; in the case of a data breach communication to users, to provide users with a link to reset their password).
    • Data protection directory: For easy navigation through the different section of the menu, provide users with an easily accessible page from where all data protection-related actions and information are accessible. This page could be found in the organisation’s main navigation menu, the user account, through the privacy policy, etc.
    • Privacy Policy Overview: At the start/top of the privacy policy, include a collapsible table of contents with headings and sub-headings that shows the different passages the privacy notice contains. Clearly identified sections allow users to quickly identify and jump to the section they are looking for.
    • Sticky navigation: While consulting a page related to data protection, the table of contents could be constantly displayed on the screen allowing users to quickly navigate to relevant content thanks to anchor links.
  • Transparency:
    • Organisation contact information: The organisation’s contact address for addressing data protection requests should be clearly stated in the privacy policy. It should be present in a section where users can expect to find it, such as a section on the identity of the data controller, a rights related section, or a contact section.
    • Reaching the supervisory authority: Stating the specific identity of the EU supervisory authority and including a link to its website or the specific website page for lodging a complaint is another EDPB recommendation. This information should be present in a section where users can expect to find it, such as a rights-related section.
    • Change spotting and comparison: When changes are made to the privacy notice, make previous versions accessible with the date of release and highlight any changes.
  • Terminology & explanations:
    • Coherent wording: Across the website, the same wording and definition is used for the same data protection concepts. The wording used in the privacy policy should match that used on the rest of the platform.
    • Providing definitions: When using unfamiliar or technical words or jargon, providing a definition in plain language will help users understand the information provided to them. The definition can be given directly in the text when users hover over the word and/or be made available in a glossary.
    • Explaining consequences: When users want to activate or deactivate a data protection control, or give or withdraw their consent, inform them in a neutral way of the consequences of such action.
    • Use of examples: In addition to providing mandatory information that clearly and precisely states the purpose of processing, offering specific data processing examples can make the processing more tangible for users
  • Contrasting Data Protection Elements: Making data protection-related elements or actions visually striking in an interface that is not directly dedicated to the matter helps readability. For example, when posting a public message on the platform, controls for geolocation should be directly available and clearly visible.
  • Data Protection Onboarding: Just after the creation of an account, include data protection points within the onboarding experience for users to discover and set their preferences seamlessly. This can be done by, for example, inviting them to set their data protection preferences after adding their first friend or sharing their first post.
  • Notifications (including data breach notifications): Notifications can be used to raise awareness of users of aspects, changes, or risks related to personal data processing (e.g., when a data breach occurs). These notifications can be implemented in several ways, such as through inbox messages, pop-in windows, fixed banners at the top of the webpage, etc.

Next steps and international perspectives

These guidelines (available online) are subject to public consultation until 2 May 2022, so it is possible they will be modified as a result of the consultation and, we hope, improved to reflect a more pragmatic view of data protection that balances data subjects’ rights, security, and operational business needs. If you wish to contribute to the public consultation, note that the EDPB publishes feedback it receives (as a result, we have occasionally submitted feedback on behalf of clients wishing to remain anonymous).

Irrespective of the outcome of the public consultation, the guidelines are guaranteed to have an influence on the approach of EU data protection authorities in their investigations. From this perspective, it is better to be forewarned – and to have legal arguments at your disposal if you wish to adopt an approach that deviates from the EDPB’s position.

Moreover, these guidelines come at a time when the United States Federal Trade Commission (FTC) is also concerned with dark patterns. The FTC recently published an enforcement policy statement on the matter in October 2021. Dark patterns are also being discussed at the Organisation for Economic Cooperation and Development (OECD). International dialogue can be helpful if conversations about desired policy also consider practical solutions that can be implemented by businesses and reflect a desirable user experience for data subjects.

Organisations should consider evaluating their own techniques to encourage users to go one way or another and document the justification for their approach.

© 2022 Keller and Heckman LLP