Business Transactions

Top Legal Issues for App Developers

Today, there is an app for nearly everything - from finding a neighborhood bar to pointing a tv satellite dish to the correct satellite. While the app industry explosion creates tremendous opportunities for developers, it also creates new legal issues. Here are legal pitfalls that can trip the unwary app developer:

Piggy-backing on an Existing Platform

When developers tie their apps to a third-party platform like Twitter, Facebook, or Amazon, they expose the app’s success to the whims of another company. That other company can very easily block your access to their APIs and modify their terms of use. If your app is not clearly allowed by the platform’s terms of use and not firmly inside the spirit of those terms, it’s prudent to have a dialogue with the platform before expending resources and time on building an app and business model that the platform can shut down with a few keystrokes.

Targeting Kids Can Lead to Large Government Fines

The financial consequences of violating the Children’s Online Privacy Protection Act (COPPA) is very real for app developers. To comply with COPPA, any website that engages children under 13 must post a privacy policy and obtain parental consent before collecting personal information from children under 13. The Federal Trade Commission (FTC) takes COPPA very seriously and has levied fines of up to $3,000,000 on websites that were not COPPA compliant. The FTC has also demonstrated its willingness to apply COPPA to app developers. Developer Broken Thumbs Apps paid $50,000 to settle FTC charges it collected email addresses and other personal information from 30,000 children signing up for the developer’s Emily's Girl World and Emily's Dress Up apps.

Incorporating Music into Apps

The commercial use of music typically requires a license and frequently requires multiple licenses from multiple parties. The music industry gives specific names to many licenses according to whether it is the song or sound recording you are using and ac¬cording to how you are using it. If your app requires background music, you will need master use licenses for any specific recordings and synchronization licenses for the underlying songs. Obtaining licenses for popular music can be expensive and administratively frustrating so stock music may be a viable option for those without large music licensing budgets.

Pushing the Privacy Envelope

There are currently no federal laws that explicitly prohibit app developers from collecting and even selling information about the online conduct of their customers (with the exception of personal information about children under 13 which is regulated by COPPA). Nevertheless, consumers, advocacy groups, regulatory agencies, and Congress tend not to like online business models that track and commercially use detailed information about consumers. Such activities create a potential risk of an FTC investigation or a consumer lawsuit when the app developer (i) does not disclose to consumers the fact that such data is being collected and/or sold and (ii) does not offer a mechanism by which consumers can opt out of having their information collected and sold.

Developing Apps for Other Companies

When developers produce apps for customers on a contractor basis, ownership is always a tricky question. App developers that want to protect their future rights to produce similar apps for other clients must clearly define in their contracts which rights the developer reserves in the background technology and source code and which exclusive rights, if any, the developer grants to the client.

Insight on COPPA Compliance for Plug-Ins, Ad Networks, Apps, & Third-Party Providers

TechFreedom, a Washington, DC-based think tank, offered a panel discussion shortly after the July 2013 effective date for new COPPA regulations. A recording of the panel, “COPPA: The Past, Present & Future of Children’s Privacy & Media”, is available online. The discussion highlighted the ambiguity still existing in application of the new COPPA rules to third-party providers.

What Is COPPA?

The Children’s Online Privacy Protection Act (COPPA) prohibits commercial websites and online services from collecting, using, or disclosing the personal information of children under thirteen without parental notice and consent. The Federal Trade Commission (FTC) issued regulations for COPPA in April 2000 and subsequently issued amended COPPA regulations which became effective on July 1, 2013.

How 2013 Regulations Impact Plug-Ins, Ad Networks, Apps and Other Third-Party Providers?

Among other things, the 2013 regulations clarify that COPPA applies to operators of commercial websites and online services with actual knowledge that they are collecting personal information directly from users of a child-directed website. This includes plug-in and app services providing services to and collecting user information from child-directed websites.

When Does a Third-Party Provider Have Actual Knowledge Its Customer Is a Child-Directed Website?

One of the panels’ most useful take-aways for plug-in and mobile app services involved FTC staff interpretations of what constitutes actual knowledge. Kandi Parsons, an attorney with the FTC Consumers Protection Bureau, indicated that third party websites have no general obligation to investigate whether their customers are child-directed websites or online services. (Note that as the verbal interpretation of an FTC staff person, this is informal insight. Hence, the FTC is not absolutely bound by what Ms. Parsons said. Here’s a transcript of a relevant portion of Ms. Parsons comments (starting at approximately 1:12 of the recording). . .:

If I can speak briefly to actual knowledge. . . . if you get a list of urls from somebody that says these are child-directed sites or services. As a third party, that is not sufficient to provide you actual knowledge. We don’t believe this gives you independent evidence of the child-directed nature of the site or service because the Commission was very clear that there’s not a duty to investigate. That would turn the obligation from an actual knowledge standard into a reason to know or should have known standard and we’re not interested in [making that conversion]. It’s an actual knowledge standard.

There is some ambiguity in Ms. Parsons’ later comments where she implies that a third party website would have a duty to investigate if it found a “red-flag” that it was serving a child-directed website (e.g., a website customer with the url “games-for-7-year-olds.com).

Can Third-Party Providers Comply with COPPA by Having Customers Sign Contracts Stating the Customer Is Not a Child-Directed Website?

The FTC addresses this question in its FAQs on Complying with COPPA. FTC staff persons also addressed the issue during the TechFreedom panel (at approximately 2:27 of the recording).

Here is what I distilled from those resources. In order for a third party provider to rely on such a customer representation, the customer would need to make an affirmative statement that the website was not a child-directed website. A third party provider could not rely on a “Not-a-Child-Directed-Website” response that was the default response in an online form. The analysis might be different (i) for a negotiated contract and (ii) for a checkbox in an online form where the customer had to self-identify itself as “child-directed website” or “not-child-directed-website”.

The customer contract will not shield the third party provider from COPPA liability if the third party provider has actual knowledge that the customer’s representation is untrue and the customer is actually a child-directed website.