How to Keep Your Website out of Court

For businesses that operate on the Internet, the wide reach of the Web, its almost instant communications, and the associated ability to revise and target advertising, all at relatively low cost compared to telephone and other operations, can be a great boon to commerce.

But there is another side to doing business on the Web: the increased (often, unique) exposure to legal risks. Some of the most common risks, and common solutions, are outlined below.

Expanded jurisdiction: Businesses that merely advertise on the Internet may not necessarily be subject to jurisdiction in every state or nation where the advertisement can be viewed. But where a company actually invites and facilitates commerce (the buying and selling of goods and services) over the Internet, in theory, the company may be sued wherever it solicits business.

To avoid being sued in distant, inconvenient places, Web-based companies often insist, in their customer agreements, that all claims arising out of such commerce must be brought in a single, convenient location.

The chosen forum may be a preferred court, or may involve an arbitration process. The enforceability of such “choice of forum” provisions, however, may depend, at least in part, on whether the forum choice permits consumers to vindicate their rights. In Brower v. Gateway 2000, Inc., 676 N.Y.S.2d 569 (1st Dep’t 1998), available at www.internetlibrary.com, for example, a New York court held that the high cost of arbitration filing fees could make it impossible for a consumer to pursue relatively small claims. As a result, well counseled companies often give their users several options for dispute resolution mechanisms.

Intellectual property claims: The Internet is a place of ideas and creative works. Many of these ideas may be protected by intellectual property laws (governing copyright, trademark, and patent rights, among others). The owners of intellectual property generally enjoy the exclusive right to use, sell, license, and distribute the works.

Businesses operating on the Internet risk violating the intellectual property rights of others when they use materials without permission, or permit employees and outside contributors to post materials on their Websites.

The Digital Millennium Copyright Act, 17 U.S.C. §512, for example, requires that Website sponsors take down infringing material when requested by copyright owners, or face liability (and even removal from service networks).

To reduce such risks, companies often adopt usage policies that remind employees and contributors of their obligation to obtain permission to use any non-original work. Further, companies monitor their sites to detect apparent misuse, and they often use links to copyrighted works, rather than wholesale copying of works.

Privacy claims: Increasingly, state, federal, and international laws protect individual privacy and data security. These laws may apply with particular force to Web-based businesses. The Federal Trade Commission, for example, insists that companies follow the privacy-protection policies they announce on their sites, and that failure to do so may constitute an “unfair trade practice.” (See FTC Privacy Initiatives at www.ftc.gov/privacy.)

Businesses that operate across international lines, moreover, may find themselves subject to regulatory obligations in other regions, such as the European Union -- which has adopted a relatively restrictive set of privacy-protection principles, limiting the gathering and transfer of personal information. (See EU Privacy Directive at www.ec.europa.eu.)

To account for these new (and changing) obligations, many companies have created a “Chief Privacy Officer” position, dedicated to monitoring developments in the law and ensuring compliance with applicable regulations.

Defamation claims: Websites that invite postings from the public risk the possibility that some messages may be false and defamatory of others, and that those who suffer from defamatory attacks may sue, not only the message poster, but the Website operator as well.

The 1996 Communications Decency Act (CDA) aims to provide some immunity from such claims, at least in circumstances where the posted content clearly comes from a source other than the operator. The CDA, however, does not relieve an operator of all liability. Criminal violations, for example, are not covered. And the operator’s actions may, in some circumstances, limit application of the Act.

Many businesses, recognizing these risks, adopt some written usage policies and take some reasonable steps (such as monitoring or filtering) to ensure that patently defamatory or harassing messages do not appear.

[Disclosure: The author is a partner in the New York City offices of Jones Day, a law firm, and teaches Electronic Discovery at Rutgers and New York Law School. The views expressed are solely those of the author, and should not be attributed to the author’s firm or its clients.]

— Steven C. Bennett is a partner in the New York City offices of international law firm Jones Day.