A Conversation With Reed Freeman, ArentFox Schiff + Email Sender and Provider Coalition

With over 25 years in privacy law, time in Federal service, and a decade of close with with the largest email senders and providers, ArentFox Schiff partner Reed Freeman knows a thing or two about the digital domain and privacy.

If you think your company is paying plenty of attention to complying with privacy laws...you may want to listen to this. If you don't...you may want to listen to this!

Reed shares some fascinating examples of the intended and unintended consequences in this fast-moving space. Do you record calls? Potential privacy issue. Is your opt-in easy and your opt-out difficult? Potential legal issue in the near future. Recurring subscription business? You might want to listen in.

One tip worth excerpting here: "Obsess over your consumer complaints. They're the roadmap to avoid Federal investigation."

It's not all bad news — as Reed says, people generally think the legal requirements are more stringent than they actually are. This is a in-depth conversation about email, privacy and the changing legal landscape with a genuine expert in the space!

A Conversation With Reed Freeman, ArentFox Schiff & Email Sender & Provider Coalition

===

[00:00:00]

Matthew Dunn: Good morning. This is Dr. Matthew Dunn, host of the Future of Email, my guest today. Again, I've been really looking forward to an indepth conversation with Reid Freeman. Reid welcome.

Reed Freeman: Thank you. It's a delight to be here.

Matthew Dunn: You're partner at Aaron Fox and you're also the exec director of the email sender and Provider

Reed Freeman: Coalition, correct?

Well, technically I'm outside council but I operate in the capacity of executive director. I was gonna say, I think

Matthew Dunn: you keep the trains running there. We'll, we'll talk about the, the Center Provider Coalition in more depth, but . One of the things I really wanted to talk with you about, cuz frankly you're an expert in this space, is privacy.

It seems like the world woke up not that many years ago and said, oh, this actually matters, and bam, all of a sudden it's changing and even finally reaching our shores .

Reed Freeman: Well, yeah. You know, I've been at this [00:01:00] for 25 years in this practice. I started at the Federal Trade Commission. And so it's been interesting to me up until five years ago.

We had a certain type of privacy law, especially in the usa. Things were generally, it's either deceptive or it's unfair, or it's legal. And that was a, it was a lot of law and a lot of a lot of feel to it. And five years ago. The gdpr took, took effect and it'll be five years this summer and California passed its comprehensive privacy law, which has since been amended since then.

We've had four other states pass law, so now we have all of these big thick comprehensive codes. In privacy law. I was just, didn't exist really more than five years ago. Europe. What was called a directive, but it wasn't a, an implementing regulation, so the privacy has really become a, a. Front of burner issue, a C-suite issue since then.

And the reason for that is it's not just because everybody suddenly got very [00:02:00] interested in privacy, gdpr you, they can find you up to 4% of your global revenue regardless. So it's that's why we see fines, you know, as high as three quarters of a billion dollars with a b in Europe. And so, you know, That happens a couple of times and people notice and, and pay attention.

So you're

Matthew Dunn: saying companies have actually gotten smacked with fines of that scale?

Reed Freeman: Yes. Yes. Wow. We have seen fines that high even in the, in the u s a, just in December. Epic Games. I think they make Fortnite. Yeah. They, they, FTC went after them for two things. We'll talk about these children's privacy violation, collecting kids' information without parents' consent.

And then what they called dark patterns. We'll talk more about this. Dark patterns is another way of saying tricky, tricky language. Yeah. And manipulating your. It's a kind of a paternalistic term, but there were dark patterns in the, in the cancellation of it. Yeah. And the, we're gonna talk more about [00:03:00] this too.

The, the big deal with dark patterns is subscriptions that you can't get out of fees. Yeah. That you didn't know you were gonna pay. Yeah, yeah. The things that generate a lot of consumer complaints. And so the FTC went for basically a half a billion dollar or a quarter of a billion dollars for the children's.

250 million children's strategy, 250 million for dark patterns. So almost half a billion dollars by the FTC in just one case last year. So, wow. If that's not a wake up call, yeah. Uh, That it hardly anything is. So the FTC is on the beat and they are really ramping up enforcement in a big way.

Matthew Dunn: So put this in, put this in, in a, like a, sort of a simplified.

Context for a moment, cuz I agree half a billion dollars get almost anybody's attention. Mm-hmm. And I'm sure it's a C-suite issue but businesses that feel like they're still like doing things right and square, et cetera, et cetera, still need to pay attention. [00:04:00] How they're complying with privacy law, don't

Reed Freeman: they?

Yeah. So there's two, two kinds. There's sort of what I'll call privacy foot faults, and then there's just double faults, right? . So, okay. Foot fault's a technical violation, double fault's a big miss. Two of 'em. Okay. Okay. So so what we're talking about with, with Epic games was a, was a massive double fault.

Yeah. So, and, and, and so if C-Suite executives take nothing else from this podcast, It is obsess over your consumer complaints because you think about it like a regulators, they sit around. It's not like they think to themselves, Hmm, I'm gonna investigate epic games. No complaints piled up. They fed into the FTCs complaint system.

They got a whole bunch of them. Yep. And the FTC then launch an investigation and lo and behold, they found they alleged. A huge grove of consumer complaints and then all kinds of messaging back and forth, like, Hey, this is an issue. Yeah. Okay. And then no big deal. Nothing happens. Nothing happens. And so after a while, a pattern develops and [00:05:00] the FTC gets more and more frustrated as they go through these things.

Sure, sure. And and so if you know backwards, if you're a, if you're an executive Look at your consumer complaints. They are the roadmap to an investigation in many cases, especially the big misses, right? So if you, if you get a, a spike in complaints, you can sort of categorize your complaints. If you get a spike in a certain area, figure out what that area is and try to tamp them down, make people happy, make the, the, the, the more you do that, the less of a roadmap there is for the government.

And, and so consumer complaints is one thing. The. . The other thing that the footfalls you can make are all of these. Laws with all kinds of rules and prohibitions and mandates and consumer rights and things. Well, you really can, you really can foot fal your way into trouble with these, and that's sort of the trouble.

And that's why I've been thinking a lot this spring about what's really being enforced and what, what do we think is gonna be enforced going forward. [00:06:00] And I can tell you right, . The big issue right now is in, in each one of these states, there's an opt out. In California you can opt out of the sharing and sale of your personal information.

Mm-hmm. and the, the ag who has enforcement authority until July is already investigating, honoring opt-outs. I mean, you could sort of guess if, if the law gives you a, a single, really important Right. That's where the enforcement's gonna be. Wait, July. What changes in July? Alright. Yeah, good question. So a lot changes in July.

There's a giant amendment to this law that took effect in January, but it's not enforced in July. Okay. And it's not enforced. Until July four things from July on, so it's not retroactive. That's, and this law, we're talking California, right? Yeah. So California, there's two. It's complicated. This, this the C CPA A even.

Yeah. My mother has heard of the C C P A . It was amended by the C P R A. And it, it's still the c CPA has just had a [00:07:00] big amendment. The big, the one of the, the key changes in the, the CP RA is until, Until January, you had a right to the opt out of the sale of your personal information. And starting in, in January and being enforced in July is you can opt out of the sale and sharing of your personal information and sharing is not your mother's definition of sharing.

It's, it's, it's a, it sounds bigger than it is Sharing is sharing for. Basically behavioral advertising purposes. And so item two, item two of, of the takeaway is there are two well, I'll just say there are three. There are three giant bugaboos in advertising, three big ones. In, in privacy there's targeted advertising.

I don't know. , but you put internet within five words of advertising, you have a privacy problem. Yes, you always have. You always will. And Europe hates it. Our regulators are skeptical of it. So number two is [00:08:00] artificial intelligence. Artificial intelligence. It's not intuitive. Why is artificial intelligence a bugaboo?

Because some people, in some cases it can produce a bad. In hiring, in employment, in, in credit, it can produce biased outcomes. And because of that, the whole thing has a cloud over it by regulators and legislators. Number three of the less concern to to email marketers is the collection of any kind of biometric information.

There. Did the, it has become the case. Do you remember when if you sent a text message, you could expect to be sued? I mean, there was, it's the T cpa. You sent a text message, you're gonna get sued. It doesn't matter if God sends it, he's getting sued. Yeah. The same thing with biometrics. Now. It's the exact same.

You collect a fingerprint, you're gonna get sued and you're gonna have to defend yourself. And the reason is, why would that be the case? Cuz the law allows for a private right of. The law allows plaintiffs lawyers and [00:09:00] class actions to bring a case. And wh why do they do it? Because they get one third of the recovery.

Right, right. . Yeah. Yeah. So this is a, you know, if you want a law, if you want compliance with the law, make, give it a private right of action. Action.

Matthew Dunn: Yeah. Okay. And then, and is the, is it private right of action for infringement of that? Sale or sharing of personal information

Reed Freeman: that you mentioned. The, the California does not have a, a private right of action.

I think nine of the state bills, nine of the 48 would have a private right of action if any of those passes. That is a major game changer. Major game changer. Yeah. Right. Because right now, if you, if you think about it in most cases, The regulator can enforce the law, whether it's a California regulator or Virginia or Sure.

Or the ftc and they generally exercise discretion. They have what we call a, a target rich environment. . [00:10:00] They can go after any kind of, they, they actually say that out loud. I love that phrase. So nice. So they, they, they have some discretion in what they go after and how they go after it. And they exercise discretion and they do bring really bad cases, but.

Not always, you know, generally over a long period of time, in a lot of cases, generally they pick the low hanging fruit. Not so when there's a private rate of action, because there's no discretion. The only thing that matters is the plaintiff's lawyer thinks he can make one third on a bunch of money.

That's the only thing that matters. Right? Right, right. And so think about this, you, you collect fingerprints or a voiceprint or a facial scan. The the, the plaintiff's lawyer's gonna go after you and say that you violated the law in Illinois for that prohibits certain types of collection. Now this is America.

It's not loser pays. You Michael or Matthew Dunn have to pay to defend yourself. Yeah. And you're [00:11:00] gonna pay and pay and pay until you file a what's called a motion to dismiss to get rid of the case. And let's say you. The plaintiff's lawyer knows what that costs. Let's say that costs $75,000. Hey, for you, I'll settle for 50.

So they hold you hostage for the legal fees? Yep. And that is where we are in with the, with the biometrics. And that's where we will go if there is a private right of action in all these comprehensive laws.

Matthew Dunn: You said it blew right past it. Voice print. Does that mean a recorded call is a potential cause for this kind of private.

Reed Freeman: Oh, there's a different parade of action for that . Okay. So let's, let's parse that out. What is a voice print of the, the biometric laws put certain requirements and prohibitions on the collection of a biometric identifier. Mm-hmm. . So it has to be in a case of voice print, it has to be your voice in a way.

That I could use to identify you. Okay. So it would be at the unique aspects of your voice, the ones and zeros that go with a [00:12:00] digital collection of your voice. Just like a face scan is just facial geometry. Yeah. Yeah. Okay. So it's not just a recording. Now, there's a whole other set of laws that prohibit the they're 12 state states that.

Two-party consent to record. So if I'm on the phone with you in, in the 38 states, all I have to do is give consent. The whole thing can be recorded, but in 12 states, you also have to consent. Hey, by the way, we're recording this,

Matthew Dunn: Reid,

Reed Freeman: I got the disclosure. I got a big, I got a big opt-in thing. Got a big

Matthew Dunn: on on screen when I clicked record

Yeah, but can't you, can't you derive a voice print from a

Reed Freeman: recording? Yes, you could, but I think the plaintiff would have to prove that you're using the voice print to identify me. I see, I see. Not just to listen to my voice later, but to identify me as among others. Okay. So that's why the, the, the classic example who, who's being sued the most in these biometric cases?

Employers, because [00:13:00] it's the clock in, clock out. There's a whole set of technology for clock in, clock out based on a fingerprint. Yeah. And. and you know, I how employers in Illinois don't know that there's a sledgehammer that's gonna fall on their head. Yeah. I don't know. But but there's an entire group of lawyers who are looking out for that and bringing cases.

So think about this. So there's another set. The Gold Rush

Matthew Dunn: in. It's akin to the Gold Rush that happened in 1848, ada, ADA. people getting sued cuz their website's not ADA compliant. It's that kind. It's

Reed Freeman: very, very similar to that. Okay. And the reason is because the law provides an incentive for lawyers to find and bring cases.

So think about this. This is kind of funny, it's not intuitive until I say it out loud, but which came first? The lawyer or the client? The lawyer, the lawyer finds the case, recruits clients and then, and then sues you. So, wow. Yeah, it's it is a, it is a gold rush. And, you know, think about, you think about facial geometry.

How common can [00:14:00] that be? Well all of a sudden there is a whole bunch of the whole class of these cases being brought against virtual tryon technology. So I go to a website to try on sunglasses. It has to take facial geometry to, let me see what I look like with sunglasses or jewelry or makeup or a haircut.

Yep. So the, there are I think, five different sets of class actions going after virtual tryon services. Wow. Which I think is, is, you'll see how these shake out. But the, the, these are things that are increasing in popularity. Consumers like them, everybody likes them, but there are certain requirements and prohibitions in, in the law when you collect any kind of biometric identifi.

Hmm.

Matthew Dunn: So you were, I mean, you're, you're, you're focusing, I think on, on the laws that are likely to be enforced and it sounds like where there's a private right of action, likelihood of action and enforcement goes up. Fair. Mm-hmm. .

Reed Freeman: Yes, that's

Matthew Dunn: right. And also the, you know, the more, the more commonly something is practiced, maybe not for [00:15:00] the obvious reason, but like, I wouldn't have thought of makeup and try.

As biometric, but yeah, that's,

Reed Freeman: that's because you don't get one third. So so yeah, fair point. Let me, let me talk about something else that I think is, we're gonna see a lot of this year, and I, and I've started to see other lawyers say this too. The. . The by the way, if you didn't know why didn't want, weren't satisfied, that targeted advertising is a bugaboo in in privacy.

The Federal Trade Commission has coined the term surveillance advertising. Same thing. It's now surveillance advertising. Yeah. So, so here's the other, the one that I think we're gonna see a lot of is dark pattern. So, as we talked about earlier, a dark pattern according to the government is any kind of user interface that would cause you to do something maybe you wouldn't have done otherwise.

Okay. Pause and think about that definition. And then tell me how would you define sales? Yeah, really well, , that's pretty much it, right? So a dark pattern can be anything from, [00:16:00] it's really easy to subscribe to something and it's impossible to get out, get out. Uh, It, which by the way, is pretty common. It goes all the way to any kind of choice where it's, yes, I.

Big green and then a no thanks or, or worse yet options, you know, or, you know, tell me more. Where the choice isn't symmetric. Yes. No. That according to the government failing to have a yes no. Where there's a yes, there should also be a no is all, it's by itself a dark pattern. Hmm. Another, another one would be a false sense of urgency.

Hurry, sale ends in eight hours when it doesn't. That's pretty common, right? Yeah. Only three left. Right. These are, these are pretty common sales tactics to drive demand which are suddenly illegal now, where the, the reason I'm focusing on enforcement is when you take that to the logical. Really common things are flat out illegal, but where are the, where is the [00:17:00] enforcement gonna be?

Is it gonna be all the way at the extreme or will it dial back? Where's the, where's the gray where business will operate and as opposed to the red and the, and the pink where the enforcement is. Right? So that's always where business operates a little bit in the gray, that's where the market usually is, except for banks and, and with, except for some banks.

But , . So anyway, which just after

Matthew Dunn: SVB fell, the context

Reed Freeman: listener, that's why I have no comment on any of that. No comment on any of that.

Matthew Dunn: Right, right.

Reed Freeman: So, so, you know, I, I, I think we're gonna see the one, one thing the market hates more than anything is uncertainty. And we're in a period of uncertainty now where the government is.

all these things are illegal and the mark is used to doing a lot of these things. So where is the line gonna be? Yeah. But I, I think things, I think what we're gonna see is any kind of fee any kind of fee at all that's being charged, whether the FTC refers to most fees as junk fees. Okay. So any kind of fee any kind of of what we call a [00:18:00] negative option free trial where.

I get seven days for free. Then if I do nothing, I continue to enjoy the service. No, by the way, I'm gonna be charged every month. Yeah. Okay. So really these negative, well, that's a negative option for trial. That's a legal, a legal thing, but the, you know, consumers. Complain. There's a new app that's advertised on TV all the time.

You got unwanted subscriptions. Download this app and it'll get rid of your unwanted subscriptions. This is a big thing in, in the market right now. It's a lot of, anytime you can get recurring revenue Sure. It's a, it's a, it's a driver. So we see a lot of it and naturally we see consumers reacting to it and a lot of consumers complain.

So I think. , these kinds of subscriptions, negative option trials, fees. You know, if you're getting consumer complaints, you're probably, people probably don't understand what's going on or it's too hard to cancel. So you'd have to adjust things to keep the complaints down and just run faster than the other guy that bears chasing.

Hmm. So

Matthew Dunn: let's, let's drill into the [00:19:00] subscription thing a little bit, because as a, as a, as a SaaS company, we pay attention to this. So we, you know, campaign genius in my case. Because I wouldn't have thought that trial period then subscription could be interpreted as a dark pattern. Now that you say it out loud, it it makes sense.

How much is a SaaS company who operates that way? Free freemium or, or trial and subscribe. How much risk are they at

Reed Freeman: if they're. Okay, let's, let's unpack that. A a negative option free trial, like you described, is presumptively legal. Okay. What makes it illegal? What makes it illegal is when people don't get it.

Okay, so in, in, in consumer protection law, then the beautiful thing about consumer protection law is the law is what it should be in almost all cases. So in consumer protection law, you're not only liable for what you say, you're liable for what people take away. Not [00:20:00] everybody, not the idiot that's called the village Idiot standard, but the reasonable consumer what the reasonable consumer takes.

Yeah, New York, it's the Village Eddie Standard. Most states it's reasonable. So you know, if you think I'm convey. that, that you, this is free un but you gotta give your card and after seven days you're gonna be charging. Then every month after that, this amount, if you think you're conveying all of that, but you're getting a flood of consumer complaints of people saying, what?

Why am I charging? Why can't I get out? You've got a problem. With that, you need to be more clear. Yeah. And you know, where's the market? You know, the market's probably not where it should be right now. It's probably gonna shake out the more cases. The government brings, but it's not illegal to offer a negative option free trial.

It's illegal when people don't get it. And when you, when you, when you're aware that people are, are confused and have been, and feel like they've been victimized. So the law is what it should be. It's, it's, you know, I always joke my mother would be a good consumer protection lawyer because you know, she's [00:21:00] got good sense

Right? Right. And so that, that is, so I want to clear that up. Never. Subscriptions fees. These are things the FTC has said over and over, they're going after. And so why does this matter for email? Right? Let, let's bring it back home. Mm-hmm. It's curious there. There, there is. So you've heard of aiding and abetting, right?

Let's say you rob a bank and I drive you away, right? I'm the, I'm the getaway car. Well, I've aided and abetted grand larceny and right because I helped you. There is no aiding and abetting for the FTC Act. So what did they do? They made up something that's the same thing. They, their, their statute doesn't allow for it, but they made it up and courts bought it.

So it doesn't really matter what it's, it's called means and instrumentalities, but it's the same thing. I provide you the means and instrumentalities to commit fraud. And we see this in telemarketing a lot. So you think about a company has a, a freemium offer and an and a and an e. S. helps [00:22:00] them deliver it.

Mm-hmm. , well, you know, if the government can show the E s p knew or should have known this was a problem, they can go after both. And they go after the, the brand and the e email provider. So you're not, you're not inoculated by, by just being by burying your head in the sand and, and having a client.

If your client's engaged in deception, You're on the hook too. And so the, the FTC has said for generations companies should do due diligence on their vendors to make sure they're not crooks. Right. Well,

Matthew Dunn: well, and, and, and vice versa.

Reed Freeman: Right. Vendors. So what we're exactly, what we're seeing now is that FTC is saying vendors do due diligence on your brand customers.

Yeah,

Matthew Dunn: yeah, yeah. I was gonna, I was gonna throw a specific example at you. Cause this is, this is gold man. Thank you. We, we have for years used a subscription management platform as part of our SaaS service, and one of the [00:23:00] configuration options in that subscription management platform is notification about renewal, right?

Mm-hmm. , Hey. , just a reminder, your, your subscription is gonna renew at the end of the month or at the end of the quarter, or at the end of the year. And I've always thought you, you should have that on. Right. Right. It's like the decent thing to do.

Reed Freeman: Right. Not everybody does that. Well, yeah. How, how many times have you gotten that for subscription you've entered into yourself?

Yeah, so frequently, so , you know that, I would say that that's a best practice, right? Whether that's required by law, you know, I don't know. Depends on who you ask, but interesting. But. What does that accomplish? What that accomplishes is people who don't want the subscription. Yeah. Or frankly, who are too lazy to get out of it.

Don't, and then they don't want to complain because they got the notice. Right. Right. If you don't have that in your complaints pile up, you have, you have a problem. So, yeah. I, I know I wanna circle back to this. If you take [00:24:00] nothing else away, your complaints are gold. Yeah. The go. The, the, the rule of thumb is the government gets about one in 100 of what you get.

And, and they get them long after you got them. Because how many times have you complained to the Federal Trade Commission? I'll bet zero. Yeah. Pretty much. Yeah. Right. Okay. But how many times have you complained to a company? You've just written an email, been frustrated a lot. Right? So there's a huge multiplier.

So you. And exponentially more than the government, but they're typically the same. Mm-hmm. And you get them earlier so you have a chance to tamp them down before the government sees a problem. And the government really does sift through the FTC gets millions and millions of consumer complaints.

Sure. And they, they run all kinds of programs on them. See trends. what's trending? What is, what are people complaining the most about? What's new, what's old? And then they prioritize the cases they're gonna bring. You just don't wanna be in that mix. That is where you don't wanna be. Yeah. And you know, it's remarkable how often that that simple admonition [00:25:00] is something no one's ever thought about.

They, you know that the customer care will handle that. You know what? Actually not you, you legal should be in there looking at the complaints, raising it with management, saying, this is the spike I'm seeing. We've got to get this down. Well, I,

Matthew Dunn: I, I'd actually ex I'd extend that further and I, and I'm gonna hook this back to email in a, in a, in a, kind of a funny way.

I, I think a lot of companies are guilty of using email as a one-way channel at send, send. Have you ever gotten an email with a no reply as the reply address? Raise your hand kids. All of us, right? And you're like, why is it so freaking hard? To talk to you. You're willing to take my money, but you're not willing to listen to me.

Give me a break. Right. And would it help to, I'm paying attention to complaints. That's, that's like, that's the headline for this one. Now, this episode. But can do we help ourselves and make it. Making it easier for our

Reed Freeman: customers to talk to us. Well, [00:26:00] that's probably more than is required, but you hit on something really important.

The FTC has long taken the position, but now they're suing on it a lot, that it should be as easy to get out as it is to get in. Sure. Now that seems easy and obvious until you're running a business and you don't pay attention to that. Yeah. So yes, it, it when it's easy to subscribe and get your money taken out, but then you can't figure out where to cancel and you go and you get this endless loop.

Yeah. And bunch of screens and are you sure? Are you sure? Are you sure? You know, this goes on and on. You can't actually do it. That's where the government steps in and says There's no symmetry here. Yeah. There should be symmetry. Yeah. Yeah. Yeah. By the way, back to your SASS thing. Yeah. This is important.

So, where's the enforcement? The law is the law. Well, whatever it is, it applies to everybody. The enforcement is not on b2b by and large. I mean, unless it's B2B with small mom and pop shops. Yeah, which is basically consumers. The enforcement is b2c. Okay. So if you're a consumer facing brand, or you're a [00:27:00] vendor for a consumer facing brand, that's where the enforcement is.

The law is. It's just that the, you know, if, if General Motors goes and complains about Ford, the FTC will say, good grief. You know, if you have a way bigger budget than we do, you deal with it. You know, so

Matthew Dunn: Yeah. Yeah, that makes sense. And yeah, at the end, yeah, I guess at the end, end of the day, The, this, this consumer is, the consumer is the citizen.

Or closer too. Right? Right. A lot, a lot of the laws and, and, and focus of the laws is the tho those of us who those of us vote, pay taxes, all that other stuff. Right. Okay. Okay. So B to B2C branch should pay even more attention to their customer complaints. I think B2B brands should obviously, . Okay. So you're, you're saying it's it, it matters even more in the B2C space.

You said small business, like I, I, I get a half a billion dollar suit and I know what Fortnite is and was, so I wasn't entirely surprised. [00:28:00] I get the half a billion dollar suit. Should should the smaller B2C business still pay attention to this stuff from the very beginning?

Reed Freeman: Yeah. You know, This is this is something that's, that's deeply frustrating to me and, and others.

You look at the cases the Federal Trade Commission has brought in the last 15 years, which is basically they started bringing privacy cases 25 years ago. They've, they've enhanced a lot over the last 15 years. So many of them are against companies you've never heard. Why is that? Yes. Why is that? Because they don't have the resources to fight back.

And what happens is they agree to what's called an order. So they, they will agree to make the case go away, to end the bloodletting of legal fees and the production of documents and all of that. They'll agree to an order and then FTC will write its complaint and its order provisions and get a little bit more than they could have gotten.

From a judge, and then that becomes the going standard. So they're making [00:29:00] law on easy targets. And this is over and over and over again. So let's curious. The, the FTC will talk about its cases as though they were decided by the Supreme Court in an opinion. They weren't. They were settles. They, but there was an a greed settlement to, to make the case go away.

Yeah. And that become, What we call precedent for the next case. And the next case. And the next case. So when you, the FTC will talk about its privacy enforcement, they, they rattle out the names of these cases as though they were litigated decisions. Yeah. With a judge deciding they actually not, they were agreed by a lot of small companies to make a case go away.

Matthew Dunn: Hmm. That seems rather loose. .

Reed Freeman: Well, I mean, it's, it is good strategy. It works. Yeah. So. I don't wanna trash the, the FTC too much. I mean, that, that is something that I'm frustrated with. But but you know, by and large they, they, they don't bring a lot of cases that they could even if they think they could win because they're just [00:30:00] bad cases.

Matthew Dunn: Lets see if I can link to other things together that, that are through lines in what you've said. One is lawyers , and, and the other is, Data and privacy, let's call it practices. Lemme take the, lemme take the second one and then the first one, second one. I would hazard a guess that most companies of almost any size actually have God awful records about who said, yes you can.

Yes, you can store this. Yes, you can have this. Yes, you have permission to communicate with me, et cetera. Like, it's one of those things that we all talk. , but in practice, if someone said, you got Reid on your newsletter, when did he sign up? Oh shit. I don't know. I just like, there's a record in there. Right?

But if you came along and or your lawyer came along and said, Ooh, we're gonna pounce on you because you don't have permission to do what you did with Reid's email address. My, my top end [00:31:00] reaction would be, oh man, lawyers are, ex lawyers are expensive, aren't they? and, and really the, the big fulcrum in all this is, is the cost of the legal action is, is it's like it's so high that your average business just goes.

Yeah. Yeah. How do I get out of this? How do I

Reed Freeman: stop this? Yeah, yeah. Well the, the one of the things that's interested me since I've been, I've been with the p c since 2010. Mm-hmm. And the ESP legitimate, you know, we always talk about legitimate ESP and, and not legitimate. Yeah. What's, I think people will be heartened to hear is that legitimate.

Generally think the law is higher than it's oops. I'm sorry about.

Sorry about that. The lo they, they generally think the law's higher than it is. The CAN SPAM does not require permission-based emails. It requires an opportunity to opt out. Cal California tried to pass an OPT-in email bill in TW 2003, and that's why we [00:32:00] have can spam. Because they did pass the law, it was gonna take effect and Con business went to Congress and said, absolutely not right?

And Congress passed cans fan, which had been sitting around for five years. Okay? So but it's a best practice. And what is, what is permission to email do, first of all, better response rates. Second of all, you, you know, you get more engaged people and you get less. Complaints. So, you know, the legitimate, I mean, the E S P C has a requirement for members to do permission-based emails.

That's a re a membership requirement. But that's, that's an industry standard. And so I'm, I've always been hard, people talk about spam and, and marketing emails, and I always say, you know, this industry's operates at a higher level than, than a lot of others. So. But, but you raise a good point. It is becoming more and more important to have records, compliance records for how you're complying with these state laws, how you're complying with the gdpr because.

When the regulator comes, they, they expect you to have all of [00:33:00] these records. Yeah. Yeah. Which, which takes me to another point. Let's turn that upside down. Some of these laws require what's called a, a privacy impact assessment. This has been, I've been thinking about this a lot lately. If you're gonna do a certain kind of profiling of people, you're gonna do certain kinds of automated decision making.

These laws will require a privacy impact assessment, which is literally a, this is what we wanna do. These are the risks, these are the mitigators, so we think it's okay. Mm-hmm. , you know, good grief, like , these are the risks, really. You're gonna write that down. And you know, and it's not privileged. You know, say, no one's talking about this.

This document scares the wits out of me because you're now required to have this, you're required to keep it and produce it. When the government comes calling, and it is a roadmap to all of your own anxieties, , that you have to write down now. So we'll see how this shakes out, but I am a big advocate of having like legal do this and keeping it privileged because sure, if you really wanna [00:34:00] be honest about it and do it right, you have to write things down that you really wouldn't want other people to see.

And that's, that's the tension here. Yeah. Is, yeah. You know, how can you do a legitimate one and. Discovery. It's right, it's a problem. So, and of course, you know, then this just rammed through the C cpa. California Consumer Privacy Act went through the entire legislator, was signed by the governor in one week, one business week.

If you are on vacation, you missed the whole thing. So did anybody read it? Did anybody think about it? Did anybody talk about stuff like this? No. It just rammed through and it was signed because it's consumer privacy. So we're, this is all gonna shake out over the next several years. This is all new and we'll see how it shakes out.

But this is just one of the issues that's a big.

Matthew Dunn: Oh it's such a delight to have an expert in this space. I get to, you know, I get to pick on you. , , go wide for a second. Why is the US so different [00:35:00] on privacy issues?

Reed Freeman: Yeah, the, you know, the, I've thought a lot about this too. So let's just call it what it is.

The rest of the world, I mean, Russia Nigeria. I mean, countries all over the world have comprehensive privacy laws. China and Russia. Think about that. Yes. So, and we don't, you know, why, why is that? The, the re There's a reason. In, in 1974, we passed the Fair Credit Reporting Act, which is our first wildly big.

Privacy law, and it's exactly where it should be. Credit, right? Where bad things can happen. The, the Privacy Act for how the federal government treats people. Why do we have that? Richard Nixon? That was in the early seventies. Then we did the, the Children's Online Privacy Protection Act. Kram Leala for Health Efforts, financial, HIPAA for health.

We have all these laws that have built up and then suddenly Congress says we want a comprehensive privacy law. Guess, guess who stands up and says not? All those people I already did. Not me, not [00:36:00] me, not me. And by the way, if you do it, you gotta do it this way, that way. So it's almost like we matured without it.

And now it's really hard to go back and put that coat on and it, it's just what hap what happens time and time again is it gets introduced. Then a bunch of people come in and, and want their own ornament on the tree, and it becomes too big. It becomes, you just can't get it through. There are too many interests involved and it's too hard.

I'm not sure we'll ever have one, especially now that we have the state laws companies spend a lot of money doing C C P A and they don't want to do a whole new thing.

Matthew Dunn: Is California such a, you know, such a big part of the economy that C C P A becomes sort of the defacto

Reed Freeman: standard? Yes, that's a great point.

So we have all these laws but what you're seeing in the market is is people benchmarking to C C P A? Yeah. And they may do a, a, you know, are they saying like, we wanna. Put all of Utah in Connecticut, Colorado, Virginia you know, what you're seeing in the market is a lot more of let's do C C [00:37:00] P A and let's do the big stuff from the other laws that we have to so CPA is big enough.

It's hard enough. It's enforced enough that, yeah, it, it is the facto standard. So the

Matthew Dunn: defecto standard, the government through in a week,

Reed Freeman: right. Right. And then amended. And then amended. This is funny. It was a it was a very long single spaced red line of that was put to the voters. As if the voters read a giant face red line.

Yeah. But it said consumer privacy. Yeah. You know, pa, that that amendment passed a voter referendum. So you know, if this is what we're seeing now, it's once something says privacy and it gets a little a little tailwind, it's hard to stop.

Matthew Dunn: Yeah, it's, yeah, it's hard to stop. I, I , I don't think it works that way, but I find myself thinking that legislatures in other states that don't have a bill yet should find a way to go.

Yeah. What they said down there, California.

Reed Freeman: Yeah. They actually were seeing. We're seeing a lot of that. Yeah. But in [00:38:00] many of the, of the 48 bills do tailor to a certain standard. The problem is they don't all, and we don't know what's gonna get out. And all you need is a few big differences, which create a giant headache.

And for what? Marginal gain. Right. Not much.

Matthew Dunn: Yeah. Well, yeah, you not mar not much marginal gain, but plenty of marginal risk and headache. Right, right. Some lawyer in fill in the blank state is gonna go, oh, you have a consumer here. Guess what? Our law is different. Right, right. Hi, we'd like to talk

Reed Freeman: to you.

Yeah. That's why the, the. , they're all these bills and they can be different and we can raise our hands about 'em. But the ones that have a private right of action where, where a class action lawyer can bring a case, those are the ones that, that would really be an entire game changer. I is. Is

Matthew Dunn: it fair in a conversation with a lawyer to say, That we're, we, we, the rest of us are a little frustrated and sometimes confused by the stick The legal profession [00:39:00] swings in terms of cost and risk.

Reed Freeman: It's, it is entirely fair. It's entirely fair. The The, I think the, the rejoinder would be from the enforcers would be, if there was no stick, there'd be no compliance. Yeah. And, and then the, the, the bar that helps you would say if there weren't enforcement, you know, you wouldn't need us. But there is.

So you do. Yeah. So You know, that's why it's important to, if you're gonna hire a lawyer, to hire a lawyer who doesn't have to learn this all on your dime it's complicated. Yes, it's complicated and it really, I I get about 10 newsletters every day. Yeah. And I would say that privacy law, and this is the one thing uh, all things, I know this one thing very well.

It changes about 5% a. . So in five years it's an entire rewrite. Yeah. And that's a lot of law. I mean, there, there are books this thick that are like some of the privacy law. Yeah. Yeah. So it's a lot of law and it's just, it's a very, very dynamic area. But [00:40:00] circling back sure you can commit a, a footfall, but what are the big things you need to do?

Watch your consumer complaints and, and watch your spikes and honor consumer. Opt outs, honor consumer requests. If a consumer's asked you something, unless there's a good reason why you can't do it, you should do it. Because if they don't get it, they're gonna be frustrated and they're gonna complain.

And so that is that is the enforcement we're seeing. And then this whole dark pattern business, really, it ends up in, in deception and consumer complaints for being frustrated that they can. get out. Yeah.

Matthew Dunn: Well, I, I have to say, I mean, a sample set of one, so not a big sample set, but as an active, you know, active SaaS business with all of the subscriptions and dependencies and services involved in running a SaaS business, I, I think there's been a, a shift in the mindset of SaaS companies, at least the ones that serve b2b.

Okay. being better about doing the right thing. I just had an [00:41:00] interaction this morning, seriously, 10 minutes before we hopped on this call where I'd essentially opened a duplicate subscription and not realized it. Right? Mayor Culpa, right idiot. So I wrote the company and I said, oh, you know, I already have one and I'm using this one.

And they said, oh, no problem. Close that one down. We'll credit, you know the other one. They kept the revenue, they kept the customer. They've got me very happy. They'll probably have me for multiple years.

Reed Freeman: And it wasn't actually that.

Matthew Dunn: and it used to be a huge pain in the patooty. When you'd run into a situation like that, you wouldn't even know where to, where to look or who to call.

So I am hardened that I think businesses, it's like the online space is growing up a bit. Yeah. Like you could hide behind. Oh yeah. You can't find us, so we'll just keep charging your card. But , that doesn't tend to last. Yeah. And a noisy consumer or an unhappy customer has a very loud voice these days.

Reed Freeman: Yeah. Well, you know what? I think what we're gonna see is, I'm glad you raised that, is the online world really is, is no [00:42:00] longer looked at as a child anymore. It has to be a grownup like everybody else. Yeah. But what we're, what we're seeing now is, The same sort of start from the beginning with ai. So you know where , so you know, we are at, and we've talked about this before, but we are at like.

Midnight and half a second. Yeah, it is in AI right now. And look at what it can already do. Who knows what it'll be able to do, but it is generating all the same issues in intellectual property and privacy that the internet did when it took off. Yeah. And the iPhone and all the every new technology. Yeah.

But it's gonna be fun to watch AI grow up and to see it develop. And it's been interesting to see the difference in approach with Europe and the usa. Saw AI outta the glimmer of somebody's eye and said, quick, we have to regulate it. Yeah. the US said, , you know what? This has a lot of promise. It can also do a lot of harm.

Let's watch [00:43:00] it very closely and see how we should regulate it. Yeah, it's a very different approach. Top down to sort of manage but you know, we'll see who, who got it, right? But the, the US has been more hands off and the Europe has been, you know, shackle it from growth from birth. That's

Matthew Dunn: fairly, that's fairly consistent practice.

I tracked the rise of of. pretty closely cuz just a, as a technologist and the US we had all the science experiments of different standards, different carriers, yada, yada, yada Europe. It was like, we will declare that we're using this technology, everyone will adhere to it. So we jumped out early.

Then they leapfrogged us with, with more common usage across countries. Then we had to play catch up and. Basically the market had to force carriers to get on board with common standards. It's like that, that's how we do it, right? Yeah. It's Marine moca

Reed Freeman: and the entrepreneur states, and I have a US bias of course, but you know, it is actually [00:44:00] true.

That there's not a lot of VC money in Europe. There's not a lot of entrepreneurship. There's not a lot of startups, there's not a lot of in innovation in Europe. And there's a lot of companies fleeing Europe. Why too much regulation and GDPR is just one example. Yeah. Everything they do is like that

So, yeah. You know, I've always joked. , it's impossible to read the GDPR from beginning to end in one sitting. It's ipo, it can't be done. And and so, I mean, it's just, it's, there's a lot of law and there's a lot of I I dotting and t crossing Yeah. In, in Europe. So I mean, there's a reason why their innovation's not where we

Matthew Dunn: are.

Mm-hmm. Yeah. Yeah. And, and, We'll, we'll keep figuring out that balance as we go along. There's also a culture thing, like, yeah, let's just call it spade a spade. Like mm-hmm. , we take, we take some of the lumps for leaving it a little looser. And in catching up later, but we get some of the, what we see as gains.

And I imagine someone in Europe would say, oh, [00:45:00] you

Reed Freeman: guys are, that's too hard. Right know. And I, I don't buy it. You know, I go to Europe. I was just in Europe last two weeks ago, right? Uh You cannot swing a dead cat in continental Europe and not see a CCTV camera recording everything you do and every, everywhere you go.

No, they're everywhere. Wow. And they have a privacy a. Huge privacy law. Yeah. You know, for what? I'm recorded everywhere I go. Yeah. So there, we don't have those here. So, you know, , there's a lot of law for law's sake without sort of, with missing the big

Matthew Dunn: picture. Mm. That be, yeah. Little too bureaucratic from my taste.

Well read, I promised I would I would not tie you up all day. And this has been one of the most fascinating and educational conversations ever. What's your parting advice to someone who listens to this and says, okay, pay attention to my consumer complaints. Check pay attention to C C P A check.

Like when you talk with someone who runs a business, what's the most common, [00:46:00] gosh, if you just do this, you'd make your life easier, or aside from those

Reed Freeman: two pieces of advice. Yeah, so there's the, the things that I've talked about, but, but also the, the, what I wanted in part is this is all changing. Wildly quickly.

Yeah. The risk, the, the risk framework. What, what is risky now is gonna be different than what's risky in the fall next year. This time it's just, it's too dynamic. So I would say, you know, you, you should work with somebody you trust, a, a, a lawyer you trust who, who knows this space and just have a periodic call, like a checkup.

What's hot because it changes a lot. And the, and the, the, the sort of unknown thing is the government assumes that you know, what's important to the government. They just assume that. And when you, when you misstep, you might think, you know, I haven't done anything wrong. If you're misstepping a way the government doesn't like, they're gonna bring a case and wonder what's wrong with you.

So it it a little checkup for where are we and what is, what's important now I think is, is [00:47:00] worth its weight to. That is, doesn't cost that much for a quick checkup.

Matthew Dunn: That is terrific parting advice, Reid. It's been a gas. I look forward to further conversation live when we're together at a couple of conferences.

Reed Freeman: Okay. Terrific. Thanks so much for having me.