The Website Audit

With the proliferation of commercial Web sites, the legal risks have increased.  The number of laws and regulatory pronouncements that affect Web sites have increased exponentially.  Consequently, owners of such Web sites should consider performing a Web site legal audit.

What Is a Web Site Legal Audit?

A Web site legal audit involves the review of a Web site by an experienced Internet lawyer.  After the review, the lawyer issues a written report alerting the client to actual or possible legal problems associated with the Web site.

Why Should a Web Site Owner Obtain a Web Site Legal Audit?

Many laws and regulations apply to doing business on the Internet or operating a Web site.  Violating a law can subject a Web site owner to substantial civil liability, including the risk of defending a class action lawsuit.  In addition, some online activities such as offering an illegal lottery instead of a legal sweepstakes can impose criminal liability if not done properly.  Web site owners should know and understand what laws or rules apply to their Web sites.

What Are Some of the Laws and Legal Concerns that Affect Web Sites?

The Children’s Online Privacy Protection Act of 1998.  If you operate a commercial Web site or an online service directed to children under 13 that collects personal information from children or if you operate a general audience Web site and have actual knowledge that you are collecting personal information from children, you must comply with COPPA.  The Federal Trade Commission may bring enforcement actions and impose civil penalties for violations of COPPA.

Trademark Issues.  Does the name of the Web site or your product name infringe on any federally registered trademarks or service marks?  Does the Web site use any meta tags that contain registered trademarks or service marks that might create trademark infringement?  Do any of the links on your Web site infringe the registered trademark of another?

Anticybersquatting Consumer Protection Act.  Does the Web site’s domain name infringe on any federally registered trademarks or service marks?  Instead of actual damages, the ACPA authorizes a court to impose on cybersquatters statutory damages of not less than $1,000 and not more than $100,000 per domain name.

Domain Name Issues.  Do any existing domain names infringe on your trademark(s) or service mark(s)?  Does the Web site owner actually have “legal title” to its domain name or does the Web site developer, the Internet service provider or an employee hold it?  We all can find the title to our car and the deed to our house, but can you find anything to show that you own your domain name? Do you know who will get the notice from your domain name registrar that the domain name renewal fee must be paid to avoid losing the domain name? Does the Web site owner have any written evidence from a reliable source that shows who owns the domain name?    What would happen if the renewal notice were sent to a person who is no longer employed by your company?  When is your domain name renewal fee due?  Have you paid the renewal fee for a period longer than one year?

Copyright.  Does the Web site owner actually own the copyright to the Web site or is it owned by the Web site developer or an employee?  Does the Web site display proper copyright notices?  Did the Web site owner file a copyright registration for the Web site with the U.S. Copyright Office?  Should the owner obtain a federal copyright registration?   Does the Web site owner understand copyright issues as they relate to Web sites and copyright infringement?

Digital Millennium Copyright Act.  Does the Web site take advantage of the safe harbor provisions of the DMCA to eliminate or reduce the risk of copyright infringement caused by content uploaded to the Web site by users?  Does the Web site notify its users of the name and email and mailing address of the agent authorized to accept notices of alleged copyright infringement?  Has the Web site filed a notice with the U.S. Copyright Office designating its copyright agent?

Privacy.  Does the Web site have a privacy policy?  If so, is it adequate and is it being strictly followed?  Do the proper employees know and understand the privacy policy and make sure that the policy is followed?  Does it make sense to obtain Trust-e and/or BBBOnLine privacy certification?

User Agreement.  Does the Web site need a user agreement?  If the Web site has a user agreement, is it legally binding?  Does the Web site user agreement have a choice-of-law provision that provides for exclusive jurisdiction and venue in your state and county if a dispute arises?  Does the agreement limit the Web site owner’s liability and disclaim all warranties?

Legal Issues.  Does the Web site disclaim liability for the accuracy of information contained on the Web site or on Web sites to which the Web site links?  Does the Web site display other necessary disclaimers?

Affiliate and Content Provider, and License Agreements.  Does the Web site owner have written agreements for all transactions involving third parties who provide content or data or who receive content or data?  Do the agreements contain confidentiality provisions to protect the confidentiality of user data?  Do content providers represent and warrant that all content will not infringe on the intellectual property rights of any third party and agree to indemnify the recipient of the content from any alleged or actual intellectual property right infringement?

Sweepstakes and Contests.  If the Web site offers a sweepstakes or a contest, is it legal or is it an illegal lottery?  If the prize is more than $5,000, did the Web site provide proper notices to the states that require such notices and post any necessary bonds?  Does the sweepstakes have adequate rules posted on the Web site?

Advertising.  Does the Web site comply with advertising laws and guidelines such as the Federal Trade Commission’s rules applicable to bait and switch, catalogs, children’s advertising, comparative ads, contests and sweepstakes, credit, disclosures and disclaimers, endorsements and testimonials, food ads, franchises and business opportunities, free claims, guarantees, Internet advertising, leasing, mail order advertising, pricing and rainchecks?

Framing and Linking.  Does the Web site's use of frames or deep linking to other Web sites create liability?

Insurance.  Do you carry the proper types of insurance for your online activities?  Are you covered for intellectual property infringement on your Web site or for defamation that is published on your Web site by you or a user?  Does your insurance cover invasion of privacy and other types of privacy liabilities?  Would your insurance cover you if a hacker obtained credit card information from your database or if an employee improperly used credit card information?

Tax Issues.  If the Web site sells products nationally, does it collect sales taxes for sales in jurisdictions in which it has “nexus” when required by law?

International Law. Does the Web site offer goods or services to citizens of countries outside the United States?  If so, does the Web site comply with applicable foreign law?  For example, if the Web site collects personally identifiable information from a citizen of a European Union country, the European Union requires that the Web site not collect any information until after it first obtains the consent of the user.

How Much Does a Web Site Legal Audit Cost?

The cost of a Web site legal audit depends on several factors such as the size of the site to be reviewed, the scope of the audit (will all the factors listed above be reviewed or will it be a limited review), will a detailed report be prepared or will it be a summary report?  In general, you should expect to pay between $1,000 and $2,500.

Is the Web Site Legal Audit Worth the Cost?

They say “an ounce of prevention is worth a pound of cure.”  How much is it worth for a Web site owner to discover that it violates the Children’s Online Privacy Protection Act so that it can eliminate the problem and avoid being the subject of an expensive and nationally publicized Federal Trade Commission enforcement action?  How much is it worth to find out that your use of users’ personally identifiable information violates privacy laws and could cause you to become the defendant in a class action lawsuit?