INTERNET LAW BLOG

Recently, there has been a virtual tsunami of articles about the so-called hidden dangers of using the Pokémon GO app. The vast majority of them concern potential violations of the privacy rights of both consumers and landmark-owners. The media’s Chicken Little-like take on this is that augmented reality apps are opening the door to a dystopian future.

However, what has not been widely discussed is the impact of all this on the developers of augmented reality apps. That deserves some space as well.

I am the managing attorney of the Nissenbaum Law Group, LLC, a boutique commercial law firm located in NY, NJ, PA and TX with a focus in intellectual property. Our firm handles a fair amount of work involving apps. This includes everything from licensing agreements and movie and book deals to lawsuits over infringement of our clients’ intellectual property. We have reviewed the Pokémon GO controversy from the developers’ perspective and have come to the conclusion that it raises some very intriguing legal issues. Here are a few.

What sort of access is really necessary in order to utilize the app?

Many commentators have complained that signing into Pokemon GO provides “full access” to users’ Google accounts, i.e. gmail, maps, contacts, calendar, etc. See Slate.com’s excellent article on this concern. But does the app need to require a user to give total access to their Google account or is that simply an unnecessary overreach? If not, why stir up the hornet’s nest of privacy concerns when you can simply dial back the access without impairing the app’s functionality? The developer may not have complete control over how the app is downloaded, but that is precisely the point. Indeed, implementing such legal protections might give the developer a marketing edge to sell a more privacy-friendly product when others are not, e.g. end-to-end encryption. On the other hand, many developers have taken the position that no change is necessary since the heightened access level is fully disclosed and consented to by the app users in the terms and conditions and privacy policy. Either way, the developer should enter this legal thicket with eyes open. There is a downside of having the “benefit” of free access to user data.

The web has been rife with articles concerning Poké Stops and Pokémon Gyms located at properties owned by people who have no idea that they have been selected.

Notable examples of this have come from such wide-ranging landmarks as the Holocaust Museum and Arlington National Cemetery. Setting aside the concern that it can be irritating to suddenly have 50 people show up at a national landmark because it has now become part of a video game, there are serious questions about whether this is also an invasion of privacy.State laws differ, but generally, invasion of privacy breaks down into three basic categories. As set forth in the Restatement of the Law, Second, Torts, § 652, they are:

• Intrusion Upon Seclusion – One who intentionally intrudes, physically or otherwise, upon the solitude or seclusion of another or his private affairs or concerns, is subject to liability to the other for invasion of his privacy, if the intrusion would be highly offensive to a reasonable person.
• Appropriation of Name or Likeness – One who appropriates to his own use or benefit the name or likeness of another is subject to liability to the other for invasion of his privacy.
• Publicity Given to Private Life – One who gives publicity to a matter concerning the private life of another is subject to liability to the other for invasion of his privacy, if the matter publicized is of a kind that
  (a) would be highly offensive to a reasonable person, and
  (b) is not of legitimate concern to the public.

It is obvious that any one or all of these could apply to the legal issues raised by augmented reality technology.

So how can the developer be protected? A good start would be a waiver of liability. It is critical that the terms and conditions for the app waive liability not just for the company distributing it, but the developer, as well. Another important consideration is whether the developer can obtain a suitable insurance policy that would cover these sorts of claims. There is no way of being completely protected, but such measures at least can offer a partial shield to potential liability.

Where does copyright law come into all this? Let’s consider the following hypothetical: the XYZ Candy Company is known throughout the country as being the best place to buy high-end candy and related items in bulk. It has a tremendous Internet presence and has franchised stores all along the eastern seaboard. Its unique building design—which is in the shape of one of its candies—has been copyrighted (Yes, under the right circumstances, a building design can be the subject of a copyright).But now, the XYZ Candy Company building also has become a Pokémon Gym. Players from miles around aggregate to that location because the name and logo are depicted in the app as a Pokémon Gym location. At what point does this mean the app is using the copyrighted design in violation of the copyright registration? The concern is not just that a developer would lose a lawsuit like that, but that they would be sued at all. Even a successful defense against such a challenge would create all sorts of negative consequences for the developer, e.g. litigation cost; backlash from the fan base; strain on the relationship with the app distributor; etc. If the potential for a copyright suit relating to building design is significant, the developer should consider negotiating license agreements / location releases with the copyright owner to specifically authorize the app’s use of it.

Another legal risk for the developer that should be mitigated by appropriate waivers of liability and indemnification clauses is a slip and fall claim. Believe it or not, there are already proposed laws that would prevent people from walking in public locations while utilizing their cell phone. These laws would penalize pedestrians who use the sidewalk while distracted: something which would only be exacerbated by using a cell phone with an augmented reality location app. (And while we are on the subject, how about liability for using the app while driving?)This raises the obvious question of who would be indemnifying the developer in this scenario. Perhaps the user. They could, on the one hand, hold the developer harmless from the user’s own claim for damages caused by the user’s negligence and, on the other hand, indemnify the developer for any claims by others (third parties) for damage that also arose from the user’s conduct. While not foolproof, the best way to try to obtain this protection would be to include it within appropriate terms and conditions for use of the app.

An integral way that augmented reality apps can be monetized is for the property owners to pay (perhaps on a per visitor basis) to be listed as a sponsored location. This can be complemented by such businesses using their status as an augmented reality location to provide discounted services to participants. All of this raises the question of how the developer can maximize the value of the brand and the monetization opportunities. Proper intellectual property registrations and a strong licensing and enforcement regime would be critical to doing so.Let’s take the example of a restaurant that advertises itself as a “Poké Stop” and utilizes a game image in connection with the stylized “Poké Stop” mark in its store window. That is arguably an instance of both copyright and trademark infringement. To best enforce those rights, however, it would be important for the game developer to have federally (if not internationally) registered those intellectual property rights.

But why is it important to inhibit this type of use? Doesn’t it help promote the game? Perhaps, but, on the other hand, once a restaurant can associate itself with the game and the developer for free, the opportunity to sell that right to another restaurant diminishes greatly. Why would Restaurant A pay to be a sponsored location, if Restaurant B is doing it without paying? The value of the license—the amount that Restaurant A might pay the developer for that opportunity—is greatly enhanced by properly policing the intellectual property and not allowing third party infringers to use those rights without permission.Moreover, even if the developer is not seeking to make money from these opportunities, it still behooves it to have a license in place. Having a proper license can help the developer maintain brand integrity and quality control.

As to brand control, for example, if the game is sold and targeted as being family-friendly, it will be important to ensure that the reality-based locations that are associating themselves with the game and its intellectual property, are appropriate venues, rather than liquor stores, places of adult entertainment and so forth.

Quality control is also critical. A license can help maintain this and ensure that a location using the brand indiciative of the game does not inadvertently tarnish it. In other words, if there is a restaurant that has health code violations, terrible reviews and other such challenges, the developer may very well not want to have its game associated with it. A proper license can help to provide an exit strategy and afford the developer enhanced rights.

Augmented reality apps are a quintessential example of disruptive technology. Their impact will extend beyond the digital world and affect other segments of society that may not currently even be aware of their existence. In the past, the law has done a very uneven job of keeping up with the pace of change created by such disruptive technologies… I could provide more examples, but I just saw a Mewtwo run into my law library. Gotta catch ‘em all…

How Can The American Legal System Improve Its Approach To Policing And Regulating Digital Technology Without Unduly Stifling Innovation And Civil Liberties?  

We now have more information available at our fingertips than during all of collective history. This digital technology encompasses a vast amount of information as well as processing and accessing it. But how, if possible, can we even regulate digital technology? After all, the internet is difficult to police; it’s a public good, an exchange of information, not a physical location that can be patrolled. And even if it were, would we want it to be policed? Or does this violate our free speech and, most importantly, our right to privacy? Despite these concerns, there are some things that can be done to improve internet safety without unduly affecting civil liberties, including establishing international standards, requiring the stringent self-regulation and transparency of intermediaries (such as search engines and internet service providers), setting up a council within the US to address complaints, and lastly, educating the consumers who use this technology.

First of all, it is worth noting that there are many individuals who feel the internet should be self-governing. David Johnson, for example, has been a strong proponent of this, stating that “governing the Internet well fundamentally entails governing ourselves, making sure that more of our time, attention and effort … make society more productive, congruent, ethical, and, yes, interesting, complex and empowering for everyone… It is no light duty to be a good netizen.”[1] While his idea of a benevolent internet citizen, or “netizen,” is optimistic and hopeful, it doesn’t reflect the current reality. There are many violations being committed that require some type of legal intervention to properly resolve them.

And what are these violations? The most common are those committed by criminals, including identity theft, phishing, malware, and fraud. Other common violations are committed at the commercial level and include collecting consumer information to sell or use in marketing without compensating, or sometimes even advising, the consumer. More recently we have become aware of governmental violations of “accidental disclosure,”[2] such as when a government employee’s laptop is stolen as well as the citizens’ information contained within it. This has occurred with other organizations as well, such as major retailers, credit card companies, and health insurance companies. While these infractions don’t occur with the frequency one would expect given the amount of available data, they happen enough to be concerning, and can have serious detrimental financial, psychological, and emotional effects on the individuals involved.

Clearly, then, some type of legal intervention is necessary. However, a large part of digital technology is essentially local access to worldwide information, and there is little worldwide consensus on how this should be handled and who’s jurisdiction it is. For example, someone from Country A is communicating with another person from Country B, and they are using a server maintained in Country C. So, if a problem arises, under which country’s laws is it handled? This can become very tricky, as different countries have different laws. Because of this, the US needs to be part of an international committee whose purpose is to codify a system of “Standards and Practices.” Guidelines regulating the obtainment of information and it’s appropriate usage should be created. Furthermore, penalties for violating this use should also be established, along with an agreement to enforce those penalties. This should reduce violations occurring both criminally and commercially. Of course, not all countries will be willing to participate, but establishing these laws for the majority would be the first step in managing global communications.

The US has the FTC to try and regulate these concerns within its own boundaries, yet the agency is having a difficult time. When it was established in 1914, it’s role was to prevent unfair methods of competition. Then in 1938 it’s role evolved to also “prevent fraud, deception, and unfair business practices in the marketplace.”[3] These provisions were established long before digital technology and simply do not meet the needed current regulation demands. There is just too much information. In 2009, for example, Google processed 24 petabytes (that’s 24 of 108 bytes) of information daily[4]; and that was six years ago. Neither the FTC’s size nor defined scope allow it to properly regulate and investigate the numerous concerns from all of this data. So, if the FTC can’t do it, who can?

One solution has been the required transparency and strict self-regulation of intermediaries; essentially, those companies through which consumers access information. These companies in effect “govern online life”[5] and include internet service providers such as Comcast and search engines such as Google. The problem with this method, however, is that there can be an inherent bias. Does Google prevent a site from being accessed because it has been identified as violating privacy rights, or because the site would compete with Google directly? And how does Google itself collect and use our private information? What is needed is a clear definition of use rules, as the Business Forum for Consumer Privacy has called for, which would “require all organizations to be transparent, offer and honor appropriate choice, ensure that risks to consumers related to use are assessed and managed, and implement security for the information they maintain.”[6Making the intermediaries more responsible for safety and security seems obvious, and clear law defining this monitoring is required. Yet we also need someone to “watch the watchers,” so to speak.

The establishment of a consumer-based council which would watch over the intermediaries and ensure they are complying with this model is necessary; this council could then file reports with the FTC after having conducted an investigation. Furthermore, the council could adhere to a strict confidentiality agreement to help maintain individual privacy; it could withhold individual names and identifying information from the FTC or any other government agency. This would eliminate the concern that “enforcement of privacy rights against enterprises would have the effect of exposing data to the government that otherwise would be forbidden to see.”[7] Thus privacy is maintained, and justice can still be meted out.

But creating laws and regulations and committees to enforce them is only part of the solution. Educating consumers is of the utmost importance. People need to be aware of where and how they are accessing information. Logging into a bank account from a random server while at a mall, for example, probably isn’t the safest way to look up that bank balance. It’s also critical to inform people of the unlikelihood that mailing $500 to a foreign country will result in the winning of an overseas lottery, and that they will probably never meet that attractive individual from a dating website whom they’ve been sending money. Additionally, people need to be educated on the importance of anti-virus protection, what malware does, and that Trojan describes more than a resident of ancient Troy. A safety study conducted in December 2005 discovered that 81% of personal home computers did not have “first-order protection measures such as current antivirus software, spyware protection, and effective firewalls.”[8] This is a scary statistic to be sure, and clearly the public is not receiving adequate information on how to utilize the internet safely. Another reality that needs to be reiterated to consumers is that once information is put out on the internet it becomes a public good, and can be retained there indefinitely. A series of public service announcements over the media, including television, radio, and even in print, would help educate individuals. Also, periodically noting safety suggestions on internet homepages would serve as a good reminder whenever people are online.

And what of privacy? Even according to the US Privacy Act of 1974, “the increasing use of computers and sophisticated information technology, while essential to the efficient operations of the Government, has greatly magnified the harm to individual privacy that can occur from any collection, maintenance, use, or dissemination of personal information.”[9] The bottom line is that consumers are essentially exchanging some level of privacy for the freedoms of communication, accessing information, and commerce that the internet provides. This is inescapable and inherit in design; the system is more “for flexibility…than security.”[10] This needs to be made clear to consumers through a variety of medium. Yet creating a private domestic council that would maintain privacy and assist the FTC, as well as establishing an international committee, are crucial to regulating digital technology. Furthermore, neither of these would unduly infringe upon civil liberties, allowing us as law-abiding consumers to continue to express our individuality and creativity.

[1]  Johnson, David R. “Democracy in Cyberspace: Self Governing Netizens & a New, Global Form of Civic Virtue, Online.” The Next Digital Decade: Essays on the Future of the Internet. Berin Szoka and Adam Marcus. Washington D.C.: TechFreedom, 2010. http://www.nyu.edu/projects/nissenbaum/papers/The-Next-Digital-Decade-Essays-on-the-Future-of-the-Internet.pdf . Accessed May 2015.

[2]  Downes, Larry. “A Market Approach to Privacy Policy.” The Next Digital Decade: Essays on the Future of the Internet. Berin Szoka and Adam Marcus. Washington D.C.: TechFreedom, 2010. http://www.nyu.edu/projects/nissenbaum/papers/The-Next-Digital-Decade-Essays-on-the-Future-of-the-Internet.pdf , pg 515. Accessed May 2015.

All preceding information contained within the paragraph regarding the types of misuses of data are taken from the author cited.

[3] Federal Trade Commission, About the FTC, Our strategic goals, https://www.ftc.gov/about-ftc . Accessed May 2015.

[4]  “MapReduce”. Portal.acm.org. Retrieved 16 August 2009. http://en.wikipedia.org/wiki/Petabyte . Accessed May 2015

[5]  Pasquale, Frank. “Trusting (and Verifying) Online Intermediaries‘ Policing.” The Next Digital Decade: Essays on the Future of the Internet. Berin Szoka and Adam Marcus. Washington D.C.: TechFreedom, 2010. http://www.nyu.edu/projects/nissenbaum/papers/The-Next-Digital-Decade-Essays-on-the-Future-of-the-Internet.pdf , pg 348. Accessed May 2015.

[6]  Downes, Larry. “A Market Approach to Privacy Policy.” The Next Digital Decade: Essays on the Future of the Internet. Berin Szoka and Adam Marcus. Washington D.C.: TechFreedom, 2010. http://www.nyu.edu/projects/nissenbaum/papers/The-Next-Digital-Decade-Essays-on-the-Future-of-the-Internet.pdf , pg 524. Accessed May 2015.

[7]  Ibid, pg 523.

[8]  AOL/NCSA ONLINE SAFETY STUDY 2 (Dec. 2005).

[9]  Pub.L. 93–579, 88 Stat. 1896, enacted December 31, 1974, 5 U.S.C. § 552a

[10]  Zitrrain, Johnathan. “Protecting the Internet Without Wrecking It: How to Meet the Security Threat.” The Next Digital Decade: Essays on the Future of the Internet. Berin Szoka and Adam Marcus. Washington D.C.: TechFreedom, 2010. http://www.nyu.edu/projects/nissenbaum/papers/The-Next-Digital-Decade-Essays-on-the-Future-of-the-Internet.pdf , pg 92. Accessed May 2015.

How Can The American Legal System Improve Its Approach To Policing And Regulating Digital Technology Without Unduly Stifling Innovation And Civil Liberties?                                                                                                                          

As globalization increases at an unprecedented rate and technology sprouts from nearly every nook and cranny of our daily lives, and increasingly so, the growing phenomenon carries a handful of questions and issues as outdated laws struggle to keep it in place. In particular, digital technology poses many questions, as it is becoming a grounds for illegal distribution, copyright infringement, and a free-riding resource that takes copious amounts of time, energy, and labor to create. In response, the American legal system can improve its regulation and policing of digital technology by ensuring digital technology is taken seriously, valued and affordable.

To begin, digital technology must be taken seriously; this is to say the limitless accounts, usernames, and information – which seem largely scattered about in the digital space – must be regulated to better identify individuals on the internet. Currently, there is a digital spider web of genuine, false, and somewhere-in-between accounts; many individual users do not have accounts, while other individual users have multiple accounts, some with conflicting information – this must be better regulated. The legislature needs to propose that everyone, somewhat like their social security number – but not the identical number for security purposes – has a digital security number. From this, all users must use their digital security number to create an account on any digital technological software, interface, etc. By doing so, digital technology will be better policed because all individuals knows that their digital security number will always trace back to them and thus this will serve as a self-policing deterrent.

Further, it not only gives the government an idea of how many internet users we have, but also it allows further innovation because there is less security risk of pirating, given the increased surveillance on accounts. While this may seem intrusive at first, it proves no more invasive than a social security number itself, and much like a social security number the negatives of stolen identity, fraud, and others come with this; however, it will help clear up the digital spider web and pave a clear path to additional secure innovation, while simultaneously reducing the number of individuals who use the digital world as a playground on others’ hard work and privacy. Additionally, while this only applies to residents of the United States, due to jurisdictional reasons, it seems this may be one of the largest pirating categories of individuals; after all many countries have created their own versions of digital technology. Most importantly, it allows digital users to take their digital identity as serious as their actual identity, and this leads me to my next point; by taking digital technology and identity more serious, one can find the value in the product.

Secondly, digital technology must be valued. One way to accomplish this is for legal entities to raise awareness to the public demonstrating the time, energy, hard work, and effort into making the digital technology. Often times, those who fail to notice the value in a product, do not see it as worthy of the price and are not confident in paying for it. If we can increase individual perceptions on the value of the product, we can further increase the likelihood individuals will confidently buy the products as they see them as a product of hard work and worthy of the price. Additionally, Peer-to-Peer sites must be more heavily regulated. By having countless expensive products suddenly free at one’s fingertips it not only takes away the value these products have, but it also allows one to free-ride on others’ product of intensive labor and time. With this in mind, to make digital technology further valued and confidently paid for, it must be appropriately priced and made more readily available.

Thirdly, another self-policing technique is making digital technology more affordable. Programs such as Photoshop, Microsoft Office, and After Effects are quite expensive based on a minimum wage salary – some even costing more than entry-line computers. Given this, many resort to pirating of software because purchasing the digital technology poses too great a burden to bear, demonstrating that even if a product is highly valued, if it is not affordable, individuals simply cannot make the purchase. Further, many countries allow programs central to computer functioning, such as Microsoft Office, to be installed as part of the factory settings, not all computers do this in the United States; this leads to both individuals becoming more apt to pirate such programs and individuals not valuing a product properly, due to lack of exposure to the product. If more knew about technology such as Photoshop, more would know the value of the product, and if it were more affordable, more would buy it confidently. The legislature could mandate that computers are to come installed with basic software free for both the purpose of exposure to the products and cheaper costs to the customers. For example, it could be mandated that computer companies are to pay software companies a given amount per computer, which has their product installed, and as a result, the computer company could receive a small amount back per computer purchased – this not only benefits individual consumers, because the digital technology price is fixed into the computers price and also because it is purchased via manufacturer-to-manufacturer at wholesale, but also the software and computer companies.

In sum, the American legal system often faces difficult tasks of balancing freedom and regulation, but one alternative is self-policing. To achieve further self-policing in the world of digital technology, if said technology is taken seriously, valued, and affordable, it is likely more individuals will front the cost because they are more confident in doing so. After all, we all know few things in life are free, however, we also know that when one is not confident in buying an expensive product, which one does not take seriously, it seems highly unlikely one would accept the burden. To conclude, digital technology seems to be on a strong positive curve of ever-expanding and ever-increasing, action must be taken, but rights are to be protected, as a solution to the American legal system approach, we need to aim for deterrence, confidence, and self-policing through affordability, digital security numbers, and valued products.

How Can The American Legal System Improve Its Approach To Policing And Regulating Digital Technology Without Unduly Stifling Innovation And Civil Liberties?

As digital innovation grows and internet access is becoming easily accessible to people from and the world, more individuals are invested in creating technology that not only makes the lives of its users easier but provides electronic material that is more advanced than what currently exist. Yet, as there will always be a steady rise in digital innovation there will always be legal concerns to where innovation ends and the need for and legal protection for its users begin. As the internet is this unlimited means to information, communication, and creation there are concerns as to if there should be limitations to its abilities, that might in turn stifle the ability for digital creatives to design products that help to move the nation further in advancements. Creation of digital media such as social media sites and blogs allow easy access to communication with people from every corner of the world but also allow for malicious members to gain access to other people’s information and private lives. In regulating such sites, is it ok to disrupt the innovated ability of quick communication because there are individuals who seek to use it with negative intentions? If anything there will always be people who choose to one up the system and go around the true intentions of digital technologies for malevolent objectives. The legal system might do better in understanding that these issues will occur and seeking to develop methods to weed out persons or companies that use media with negative intentions while still allowing people to create and distribute their innovated material to the world.

A step that would allow policing of digital technology to be carried out fairly is the creation of an Internet database that would allow individuals to reveal their concerns about certain technologies that they believe might be taking away certain rights and raising confidentiality issues. In the creation of this site people could file claims and these accusations could be investigated as to whether the legal assistance is necessary or not. Also, if the laws were directly geared towards just allowing the community to be informed about the limitations and possible privacy concerns about certain digital technologies and sites, individuals would be able to pick and choose which ones they might decide to use. This would allow advancement to continue while giving people the ability to see if certain sites would go against their privacy concerns from the beginning, consequently resulting in everyone having an understanding of what liberties and protection might be available to them. Individuals would not be able to state that they weren’t fully informed of what they were signing up for and people would have more access to information.

For example, in the most recent case of social media vs. civil liberty: Facebook has created a bit of a stir with the creation of something that have made many people feel like they were losing rights. In creation of Facebook’s new Messenger App that allowed their users to use a separate App from the original Facebook one to communicate with their friends via their phone; many people found issue with the App’s ability to share one’s information and location. This appeared to many as an invasion of privacy, although Facebook stated it was implemented to create a better service for its consumers. The program made many feel that their privacy was being imposed on and that innovation was more important than their rights.

This issue shows the problem that arises when modernization is met with a legal barrier that is in place. I believe the American legal system could go about situations like this and more by regulating technologies ability to access and manipulate it’s viewers information by requiring them to label the steps they are taking to protect the consumers privacy somewhere on their digital website or product. If a company were to state how they plan to protect one’s information at the start it’d be easier for a consumer to decide if it were the right type of product for them or not. Also, it is important for technology creators to let their consumer know if their information will be changed or updated, providing this information somewhere that is easy to read. Digital providers should also detail whether any changes will result in a change in privacy guidelines and they should state this upfront before the change begins, allowing people the chance to delete their account if they are uncomfortable.

Sometimes when sites update or change the way they have going about something they neglect to inform the consumers about all the changes that will be implicated. These results in anger from those consumers who feel they don’t have enough of a say in something that they are investing money and time in. Also, when sites evolve or upgrade their privacy settings are changed in result, in requiring that these changes be stated upfront people would be informed to what is happening to their information and whether they are ok with continuing to use this technology. Communication between creators of technology and those that use these products are essential to a society of well-informed citizens. Allowing the American Legal system to serve as a middleman between the law, technology advancement, and customer concerns would allow for a brighter future generation and progress in digital innovation to continue to thrive.

The advancement and progress of digital technology is reaching a point where many feel that one most choose to accept innovation while giving up their rights to privacy and civil liberty but the implication of certain limitations to this will not only allow advancement to continue but allow consumers to rest assure that they will not lose their rights to privacy.