Intellectual Property Technology Law Journal

Transcription

1 Intellectual Property Technology Law Journal & Edited by the Technology and Proprietary Rights Group of Weil, Gotshal & Manges LLP VOLUME 19 NUMBER 7 JULY 2007 Social Networking Sites: To Monitor or Not to Monitor Users and Their Content? By Roxanne E. Christ, Jeanne S. Berges, and Shannon C. Trevino Several months ago, a federal district court in Texas dismissed claims brought against the popular social networking Web site MySpace.com. In the case, a 14-yearold (Julie Doe) and her mother had sued MySpace for negligence and gross negligence in failing to institute safety measures to protect minors after a 19-year-old man whom Julie Doe met through the service allegedly assaulted her sexually in a parking lot. In a strongly worded opinion, Judge Sparks noted that imposing an affirmative duty on MySpace to protect minors from sexual predators lurking on the site would stop MySpace s business in its tracks and that, if anyone had a duty to protect Julie Doe, it was her parents, not the social networking site. 1 The MySpace decision serves as an important reminder of the immunity afforded to Internet service providers under the Communications Decency Act (CDA). 2 However, operators of social networking sites should be attuned to recent legislative initiatives that could scale back that immunity. If some members of Congress and state legislators have their way, site operators will be forced to implement measures that sound politically favorable but will not necessarily make minors safer. Whether these laws will be enacted and withstand challenges that they violate the Roxanne E. Christ is a corporate partner, and Jeanne S. Berges and Shannon C. Treviño are associates in the Los Angeles office of Latham & Watkins LLP. They can be reached at roxanne.christ@lw.com, jeanne.berges@lw.com, and shannon.trevino@lw.com, respectively. constitutional right to free speech remains to be seen, especially in light of a recent federal court ruling that the Child Online Protection Act violates the First Amendment. Julie Doe registered with MySpace when she was 13 years old. MySpace requires that users be 14 years of age or older, so Julie Doe evidently lied about her age in order to join. Pete Solis, a 19-year-old, contacted Julie Doe through MySpace. She eventually gave Solis her telephone number (by this point Julie Doe had reached the age of 14), and the two engaged in telephone conversations for several weeks. Eventually, Solis and Julie Doe arranged to meet in person, and Solis allegedly committed the sexual assault when they met. Julie Doe s mother contacted law enforcement officials and filed a crime report. Solis was arrested and indicted for sexual assault, a second degree felony. Communications Decency Act The CDA protects providers and users of interactive computer services 3 from being treated as publishers or speakers of content provided by third parties. 4 Under the CDA, an internet service provider is generally immune from liability for publishing defamatory and other harmful material submitted by third party users. Neither of the parties in the MySpace lawsuit contested MySpace s status as an interactive computer service or the individual users status as content providers. The policies underlying the CDA include promoting free speech on the Internet and fostering the development of the Internet and interactive media. 5 Congress

2 also intended to encourage interactive service providers to monitor their own user communications for obscene and offensive material without risking liability for the efficacy of their monitoring activities. 6 Thus, from its inception, the CDA was intended to balance promoting free speech while encouraging Internet service providers to restrict content in an effort to protect minors. The CDA has its limits. It does not immunize providers from claims for copyright or trademark infringement. 7 It is not clear whether the CDA immunizes providers against misappropriation of trade secrets or rights of publicity, claims typically considered a mixture of tort and intellectual property law. The ambiguity arises out of the CDA s reference to intellectual property infringement without defining that term. 8 Social Networking Sites and the Communications Decency Act Julie Doe argued that the CDA did not shield MySpace from her claims for negligence and gross negligence. She claimed that the legislation protects Internet service providers only against content and not conduct. Because she was suing MySpace for failing to police its site and not for the content posted by Julie Doe s alleged attacker, Julie Doe argued the CDA should not apply. The MySpace lawsuit was not the first to be brought against an Internet intermediary that provided a forum for third-party users. Courts in the First, Fourth, Ninth, and Tenth Circuits have each held Internet intermediaries immune under the CDA from liability for defamatory and other unlawful content published on their sites. Courts have also applied the CDA s immunity to Internet service providers that failed to withdraw objectionable content even when they had prior notice of the content s unlawful nature. 9 The decision to publish, withdraw, postpone, or alter content is considered a traditional editorial function of a publisher, the exercise of which cannot be a basis for liability under the CDA. 10 Thus, the CDA immunizes interactive computer services from liability both for content published by others and for their own conduct as publishers. It is important to reiterate that the CDA is not a defense to copyright or trademark infringement. The Digital Millennium Copyright Act 11 and the Lanham Act s innocent-infringer provisions 12 can shield Internet service providers from liability for copyright and trademark infringement, respectively, if they meet certain requirements. To be eligible for the DMCA s defense, a provider must take actions to remove the infringing content upon receiving notice from rights owners. 13 To be deemed an innocent infringer and mount a successful defense to trademark infringement, a provider must establish that it did not actively engage in infringement itself and that it did not have specific knowledge of its users infringement. 14 Knowledge of Objectionable Material and Self-Regulation In an earlier and oft-cited case, Zeran v. American Online, Inc., 15 Kenneth Zeran received death threats after a user posted on AOL a false ad for T-shirts containing unsavory slogans related to the Oklahoma City bombing. The ad instructed people to call Zeran s home number. This led to abusive phone calls, local radio station announcements encouraging listeners to call Zeran s home number, and police surveillance of Zeran s home to protect his safety. In his lawsuit, Zeran claimed that AOL had a duty to remove the defamatory posting and effectively screen future defamatory material. 16 The Zeran court reiterated the purposes of the CDA. The court also noted that both the negligent communication of a defamatory statement and the failure to remove such a statement when first communicated by another party constitute publication. 17 Subsequent courts have applied the CDA to bar non-defamation claims related to the publication of third-party content or the harms resulting from such publication. 18 Zeran laid the groundwork for the MySpace court s refusal to hold MySpace liable for negligent failure to police its site for harmful third-party-provided content. Courts in other cases have upheld the promotion of free speech on the Internet over self-regulation of expression. As the theory goes, if interactive service providers were constantly faced with the specter of liability, there would be a chilling effect on the availability and proliferation of forums for speech on the Internet. 19 To address this concern, the CDA does not require interactive computer services to self-regulate but instead encourages it by immunizing providers from liability for removing users materials and for claims based on the effectiveness of a provider s self-regulation efforts. 20 In Carafano v. Metrosplash.com, Inc., 21 the Ninth Circuit granted Matchmaker.com full immunity under the CDA after false personal ad listings resulted in the delivery of sexually explicit phone calls, letters, and notes to the plaintiff. The plaintiff, an actress, sued for invasion of privacy, defamation, negligence, and misappropriation. 22 The court s holding centered on the fact that Matchmaker itself did not provide the essential published content, even though users generated some of the content in response to a Matchmaker questionnaire Intellectual Property & Technology Law Journal Volume 19 Number 7 July 2007

3 In the MySpace case, Julie Doe argued that MySpace had failed to protect minors and had prompted users to post photographs and personal information on their personal Web pages. 24 As in Zeran and Carafano, however, the MySpace court considered such actions to be taken by MySpace s operator in its capacity as a publisher and consequently immunized the operator from liability under the CDA. Recent decisions continue to immunize Internet intermediaries from liability for content supplied by others and refuse to impose an affirmative obligation to monitor and screen Web sites for objectionable content, including even child pornography. The Eastern District of Texas decided Doe v. Bates 25 approximately six weeks prior to the MySpace decision, dismissing claims against Yahoo! Inc. for negligence, intentional infliction of emotional distress, invasion of privacy, and civil conspiracy. The individual defendant, Mark Bates, was the moderator of the Candyman e-group in which thousands of participants shared and posted hard-core, illegal child pornography. 26 Sexually explicit photos of minor Johnny Doe were among the pornographic images posted to the e-group. 27 One of the key allegations lodged by the plaintiffs was that Yahoo! breached its duty of reasonable care to Johnny Doe by permitting the Candyman web site to serve as a platform for the uploading, downloading and large-scale distribution of hard-core child pornography through its servers without oversight or intervention because it was profitable to do so. 28 However, because Yahoo! played no role in the creation or development of the images, it was immune from liability under the CDA, even if Yahoo! placed advertising on the Web site or modified or enlarged the photographs. 29 In the latest CDA case, Universal Communications Systems v. Lycos, Inc., 30 the First Circuit followed suit by applying immunity to Lycos for content posted by third parties. Universal Communications Systems (UCS) sued Lycos after numerous postings on a Lycos-operated message board disparaged the financial performance and integrity of UCS. 31 UCS attempted to plead around the fact that third parties and not Lycos had provided the content by asserting that Lycos supplied culpable assistance to the service s subscribers. 32 The music industry has relied on the concept of culpable assistance in contributory copyright infringement actions to allege that certain software distributors foster piracy. 33 The First Circuit refused to apply the concept to negate Lycos immunity. The court also noted that, even if providing culpable assistance could bar CDA immunity, the Web site operator s registration and link system came nowhere close to meeting the standard for active inducement of unlawful behavior. 34 Social networking sites should be able to rebut claims that they supply culpable assistance to third-party content providers as long as they avoid taking affirmative steps to foster harmful postings, such as by advertising their services as a forum for adults to meet minors or for posting illegal child pornography. The Claimed Duty to Protect: State Law Claims for Negligence or Gross Negligence The MySpace court dismissed the plaintiffs claims for negligence or gross negligence because in general there is no duty to protect another person from the criminal acts of a third person. 35 One exception to the general rule is where a special relationship, such as that between employer-employee or parent-child, exists between the actor and third person. 36 The court held that no such relationship existed between MySpace and Julie Doe. Accordingly, Judge Sparks refused to impose liability for negligence. COPA Stopped Cold Congress passed COPA in 1998 in an attempt to address directly the constitutional flaws of the CDA (COPA is distinct from COPPA, the Child Online Privacy Protection Act, which requires Web site operators to obtain parental permission before collecting personal information from children under 13). On March 22, 2007, a federal court issued a permanent injunction against COPA s enforcement after ruling in ACLU v. Gonzales ) Civ. No (E.D. Pa. Mar. 22, 2007)) that the legislation violated the First Amendment. Like the CDA, COPA did not survive judicial scrutiny because although it served a compelling government interest, Congress did not narrowly tailor the law to its purpose. COPA would have imposed criminal sanctions on Web site operators for offering material considered harmful to minors, a term not only difficult to define but which also covered a broad range of material that is valuable to adults. Moreover, the affirmative defenses to COPA restricting minor access to harmful material through (1) credit card, debit accounts, adult access codes, and adult personal identification numbers, (2) accepting a digital certificate that verifies age, or (3) any other reasonably feasible measure to verify age were inadequate to overcome the law s constitutional problems because they failed to screen out minors and were not the least restrictive alternative Volume 19 Number 7 July 2007 Intellectual Property & Technology Law Journal 3

4 for protecting minors from sexually explicit material on the Internet. The most striking aspects of the court s decision were the following conclusions: Currently available filtering tools are 95 percent effective in restricting minors access to sexually explicit material and are less restrictive means for protecting youth than COPA. There is no evidence that age verification services reliably establish or verify age. Moreover, age verification is cost prohibitive for many Web site operators, can lead to a loss of users and will chill speech. These findings alleviate the pressure on social networking site operators and others to attempt to affirmatively monitor and restrict minors use of their services through age verification. In a foreshadowing of what might be a permissible move for legislators, the court stated that the government may give incentives or mandate that Internet service providers supply filtering tools. The Legislative Landscape Ultimately, Congress or state legislators may act to impose a statutory duty of care on interactive service providers. Pending legislation will probably not affect operators of social networking sites; however, the proposed laws evidence growing support for measures to increase the safety of minors who use the Internet. The Deleting Online Predators Act (DOPA) was originally introduced into the House of Representatives in 2006 but died in the Senate. Representative Kirk (R-Illinois) re-introduced the bill in the House on February 16, Senator Ted Stevens (R-Alaska) also recently introduced the Protecting Children in the 21st Century Act (S. 49) on January 4, 2007, which incorporates DOPA. DOPA would amend the Communications Act of 1934 to require schools and libraries receiving federal funding to restrict minors access to social networking sites and chat rooms. Minors would still be able to access such sites under adult supervision for educational purposes. Additional federal legislation includes the Internet Stopping Adults Facilitating the Exploitation of Today s Youth Act (SAFETY) of 2007, introduced in the House of Representatives on February 6, The SAFETY Act would make it a federal offense for Internet content hosting providers (the definition of which likely includes operators of social networking sites) to engage knowingly in conduct that the provider knows or has reason to know facilitates access to child pornography. 39 The SAFETY Act would make it a federal offense for Internet content hosting providers to knowingly engage in conduct which the provider knows or has reason to know facilitates access to child pornography. It would also impose strict penalties on service providers who fail, even negligently, to report child pornography and require sites to place warning labels where sexually explicit material can be found. Sites that do not select or alter content, which presumably includes social networking sites, would be exempt from the label requirement. Like DOPA, the Social Networking Website Prohibition Act proposed in Illinois, 40 targets venues that typically provide minors with access to social networking sites and does not threaten to expose the owners or operators of such sites to increased liability. Other states, such as Georgia and North Carolina, have introduced legislation aimed at site operators. 41 These bills, if enacted, would require operators of social networking sites to obtain parental permission before a minor can establish a user profile. Because the laws would in effect impose an age verification requirement on social networking sites and there is no way to actually verify age, they are not likely to pass constitutional muster in light of the court s decision in ACLU v. Gonzales. At the state level, several attorneys general have demanded that various social networking sites implement more effective age verification procedures, mechanisms for screening out child pornography, and plans for devoting more resources to screening posted content. 42 Connecticut Attorney General Richard Blumenthal also recently spearheaded a coalition of 44 states urging several social networking sites to require age verification and parental consent before allowing minors to post profiles. 43 Although these demands may not ultimately achieve legal force given the reluctance of federal courts to uphold age verification mandates, they do signify public support for increased protective measures. Recommended Best Practices for Social Networking Sites Operators of social networking sites and other sites can, for the time being, take comfort that the CDA provides immunity from liability for content posted by their users. Additionally, the age verification methods currently available on the market are not sufficiently accurate and remain cost prohibitive, especially for sites offering free access to material. Nevertheless, the cost and threat of litigation persists, and public support for increased safety measures to protect minors is growing. 4 Intellectual Property & Technology Law Journal Volume 19 Number 7 July 2007

5 The federal judiciary has likewise agreed that protecting minors from exposure to sexually explicit material on the Internet is a compelling governmental interest. What remains is for Congress and state legislatures to devise a narrowly tailored and least restrictive approach for protecting minor safety on the Internet. Interactive computer services should consider taking two steps to reduce the risk of litigation and to take the lead on increasing the safety of minors who use their services: Promote online safety. Sites should partner with online safety groups, parents and educators to develop and distribute effective online safety educational tools. Sites should also work collaboratively to develop and implement better online safety tools. Lobby state legislatures and Congress. Site operators should consider pushing legislators to devote greater financial resources to law enforcement to hire more investigators, increase the training of personnel, and purchase technological tools to identify and apprehend individuals who are using the Internet to harm others. Notes 1. Doe v. MySpace, Inc., No. A-06-CA-983-SS (W.D. Tex. Feb. 13, 2007). 2. The Communications Decency Act of 1996, 47 U.S.C In response to a series of court decisions striking down provisions of the CDA as unconstitutional on First Amendment grounds, Congress repealed most provisions of the legislation, though 230 still remains effective U.S.C. 230(f)(2) U.S.C. 230(c). 5. See Batzel v. Smith, 333 F.3d 1018, 1027 (9th Cir. 2003) (discussing the legislative history and intent of the CDA). 6. See id. (citing 47 U.S.C. 230(b)(4) and 141 Cong. Rec. H (statements of Reps. Cox, Wyden, and Barton) U.S.C. 230(e). 8. Id. 9. See, e.g., Zeran v. American Online, Inc., 129 F.3d 327, (4th Cir. 1997); Universal Commun. Sys. v. Lycos, Inc., 2007 U.S. App. LEXIS 3946, at *17 (1st. Cir. Feb. 23, 2007). 10. Zeran, 129 F.3d at U.S.C. 512(c) U.S.C. 1114(2) U.S.C. 512(c)(1)(A) and 17 U.S.C. 512(c)(1)(C) (DMCA safe harbor provisions requiring providers to remove access to infringing material upon receiving notice of such material or obtaining actual knowledge of infringement) U.S.C. 1114(2). See also Hendrickson v. ebay, 165 F. Supp. 2d 1082, 1095 (C.D. Cal. 2001). 15. Zeran v. American Online, Inc., 129 F. 3d 327 (4th Cir. 1997). 16. Id. at Id. at Doe v. MySpace, Inc., No. A-06-CA-983-SS, at *8 (W.D. Tex. Feb. 13, 2007) (citing Ben Ezra, Weinstein & Co. v. American Online, Inc., 206 F.3d 980, 986 (10th Cir. 2000); Zeran, 129 F.3d at 330; Doe v. Bates, 2006 WL , at *5 (E.D. Tex. Dec. 27, 2006); Beyond Sys., Inc. v. Keynetics, Inc., 422 F. Supp. 2d 523, 536 (D. Md. 2006); Barnes v. Yahoo!, Inc., No. Civ AA, 2005 WL , at *4 (D. Or. Nov. 8, 2005). 19. Zeran, 129 F.3d at U.S.C. 230(c)(2)(A) states that [n]o provider or user of an interactive computer service shall be held liable on account of (A) any action voluntarily taken in good faith to restrict access to or availability of material that the provider or user considers to be obscene, lewd, lascivious, filthy, excessively violent, harassing, or otherwise objectionable. 21. Carafano v. Metrosplash.com, Inc., 339 F.3d 1119 (9th Cir. 2003). 22. Id. at Id. at Verified Complaint at 3, Doe v. MySpace, Inc., No. A-06- CA-983-SS (W.D. Tex. Feb. 13, 2007). 25. Doe v. Bates, 2006 WL (E.D. Tex. Dec. 27, 2006). 26. Id. at * Id. at * Id. at * Id. at * Universal Communications Systems v. Lycos, Inc., 2007 U.S. App. LEXIS 3946 (1st. Cir. Feb. 23, 2007). 31. Id. at * Id. at * See, e.g., MGM Studios, Inc. v. Grokster, Ltd., 545 U.S. 913, 919 (2005) ( one who distributes a device with the object of promoting its use to infringe copyright, as shown by clear expression or other affirmative steps taken to foster infringement, is liable for the resulting acts of infringement by third parties. ). 34. Id. at * Doe v. MySpace, Inc., No. A-06-CA-983-SS, at *10 (W.D. Tex. Feb. 13, 2007). 36. Id. 37. H.R. 1120, 110th Cong. (2007). 38. H.R. 837, 110th Cong. 39. H.R. 837, 4(a). 40. S.B. 1682, 95th Gen. Assemb. (Ill. 2007). 41. S.B. 59, Gen. Assemb., Reg. Sess. (Ga. 2007); Protect Children from Sexual Predators Act, S.B. 132, 2007 Gen. Assemb., Reg. Sess. (N.C. 2007). 42. E.g., Letter dated May 22, 2006, from Greg Abbott, Attorney General of Texas, to Christopher DeWolfe, CEO of MySpace, Inc., John Hiller, CEO of Xanga. com, Mark Zukerberg, CEO of TheFacebook, Inc., and Jonathan Abrams, CEO of Friendster, Inc., in Verified Complaint, Exhibit D, Doe v. MySpace, Inc., No. A- 06-CA-983-SS (W.D. Tex. Feb. 13, 2007); AG Reilly Demands Changes to MySpace.com Website to Protect Volume 19 Number 7 July 2007 Intellectual Property & Technology Law Journal 5

6 Teens from Online Predators, (Media Center, May 2, 2006); Letter dated Mar. 24, 2006, from Jim Petro, Attorney General of Ohio, to Chris DeWolfe, CEO of MySpace, Inc., in Verified Complaint, Exhibit B, Doe v. MySpace, Inc., No. A-06-CA-983-SS (W.D. Tex. Feb. 13, 2007); Letter dated Mar. 20, 2006, from Richard Blumenthal, Attorney General of Connecticut, to Christine Varney of Hogan & Hartson LLP, in Verified Complaint, Exhibit A, Doe v. MySpace, Inc., No. A-06- CA-983-SS (W.D. Tex. Feb. 13, 2007). 43. Lindsay Martell, MySpace Age Verification Bill Proposed, Mar. 8, 2007, tc_nf/ Reprinted from Intellectual Property & Technology Law Journal July 2007, Volume 19, Number 7, pages 13-17, with permission from Aspen Publishers, Inc., Wolters Kluwer Law & Business, New York, NY, ,