Key Legal Issues for Online Retailers to Be Aware of

E-commerce and mobile commerce offer retailers the advantages of lower operational costs, a 24/7 sales platform and an expansive customer reach. Although online transactions are subject to many of the same legal principles applicable to physical transactions, they also raise certain new legal issues, particularly contract and data privacy issues.

Many traditional state law contract principles (e.g., offer and acceptance) apply to online transactions, but with a twist. For example, retailers typically use "clickwrap" or "browsewrap" agreements on their websites to bind users to their website's terms. A clickwrap agreement requires an express acceptance of the terms through the "click" of an "I accept" or similar button, whereas a browsewrap agreement is simply a posting of website terms, typically through a hyperlink on the homepage, which states that use of the website signifies acceptance.

Courts have considered whether clickwraps and browsewraps create enforceable contracts. In general, clickwraps have been held to create enforceable contracts, unless the terms are unconscionable. Since browsewrap agreements don't require affirmative action by the website user to indicate assent, the validity of a browsewrap agreement depends on a factual analysis of whether the user has actual or constructive knowledge of the terms of the website. The cases indicate that the more conspicuous a website's terms, and the greater the confirmation that a user has consciously elected to accept the terms, the more likely the terms will be enforceable.

The most significant new legal issues created by online retailing relate to consumer privacy and data security in light of the volume of personally identifiable data (i.e., data that can identify a person or a mobile device) collected in such transactions. This data is often shared with third parties delivering content, display ads or performing data analyses in connection with online transactions. Privacy issues are magnified by the widespread use of mobile devices and mobile apps, which store and use personal data in more complex ways than internet browser software, and consequently may pose a greater security risk.

Mobile apps may use hardware IDS (permanent identification numbers associated with a device) to promote functions and track users, collect geo-location information through GPS and other methods, and access certain files (e.g., contacts and call logs) stored on a mobile device.

In the United States, a patchwork of federal and state laws and regulations regulate aspects of consumer privacy and data security. Federal agencies, particularly the FTC acting under the Federal Trade Commission Act or the Children's Online Privacy Protection Act of 1998 and related rules, and state agencies, notably in California acting under the California Online Privacy Act, have developed privacy guidelines and recommendations and pursue enforcement actions against companies for allegedly unfair or deceptive uses of personal data. In addition, other nations (notably, the EU and China) have adopted often markedly different data privacy regulations applicable to transactions with consumers in such countries.

Moreover, class-action suits involving data security breaches continue to be filed against companies, asserting claims based on unfair competition, negligence or the violation of consumer privacy laws. These suits, if successful, can result in significant damage awards.

Accordingly, retailers should carefully review and consider their online activities and privacy policies in light of the federal, state and international laws which may apply to their online transactions. In particular, companies should ensure that they, and their service providers, are indeed following the privacy policies set forth on their retail websites.

Lois F. Herzeca and Howard S. Hogan are partners with the law firm Gibson Dunn, as well as co-chairs of the firm's Fashion, Retail and Consumer Products practice. They're also co-authors of the new book, "Fashion Law and Business: Brands & Retailers."