Overlooked Legal Considerations for Business Websites Part 1: How the DMCA and Good Housekeeping Can Reduce Risk

If you have a business website, there are several key legal considerations that should be part of your website planning and maintenance program, but they often get overlooked during the design and development process. Reviewing your website to ensure it meets these requirements, and ensuring you have some basic business processes in place, can save you headaches down the road and reduce your overall risk.

To help businesses build these considerations into new website planning up front, or get back on track, we’ll cover the basics of six key topics in this multi-part series:

1. Ensuring you have the appropriate rights to use content included in your website
2. The DMCA (the Digital Millennium Copyright Act)
3. Properly using content or data obtained from other websites
4. Section 230 of the Communications Decency Act
5. Website accessibility in compliance with the ADA
6. Privacy including the CCPA, the CPRA, GDPR and website privacy policies

In this article, we will cover the first three topics, you can find more about compliance with the ADA here, and we will address the remaining topics in future articles.

No matter how simple or complex, websites consist of content like words, photographs, graphics, videos, and audio that are often subject to copyright protection. Many websites also include and display third-party content – sometimes unknowingly. Without the appropriate licenses to display that third-party content, you can be subject to copyright infringement claims which can be costly and time consuming.

Many websites contain content provided or posted by third parties, such as customers or visitors to the website. This content is commonly called User Generated Content, or “UGC.” UGC can easily contain material that infringes a third-party’s copyright. Congress passed the Digital Millennium Copyright Act, or DMCA, in 1998 to provide a liability shield from copyright infringement claims brought against the operators of most websites that display UGC so long as the operator follows a few basic steps.

In addition to liability arising from the content that is displayed on your website, you may incur liability from your use of content obtained from another party’s website. Given the ease of simply copying and pasting content on the Internet, one might be forgiven for thinking there is little to no risk from using content or data found on other websites. However, while some data and content available on the Internet is free for use without restriction, most content and data are subject to copyright and contractual protections. With minimal effort, you can determine the risk associated with using third-party content or data.

In this article, I will provide an overview of these risks and a roadmap to reduce the risk arising from your corporate website.

Do you really have the right to use that stock photo?

What is a website, really? Whether the website is a robust e-commerce platform, or a simple digital brochure describing services, a website is simply a collection of written, visual, and audio content. Most, if not all of this content, is subject to copyright protection. Oftentimes the content is created by employees of the company, or possibly obtained from a third-party marketing firm. Regardless of how a company creates a website, a company should take steps to ensure it has the necessary rights to all content displayed on its website.

If the content is created by employees of the company, under copyright law, the company would own the copyright to the content under the work-for-hire doctrine, which states that the employer is considered the author of copyrighted works created by its employees. Ownership of intellectual property is also assigned to the company in accordance with a written invention assignment agreement (which KO advises every company to use with virtually all employees). If the company engages a third-party to create the website, or collect content for the website, the company should have a written agreement that has a proper assignment or license granting the company the right to use the content.

We advise against simply copying content like text and images from other websites and using that content on your website. Unless you obtain the right to use that content from the copyright owner, it may be considered copyright infringement. Just because content is freely available on the Internet, does not mean it is freely available for use on your website without express permission. It is incredibly easy to search the Internet for the perfect image you need of the Rocky Mountains. But when you find that perfect image, be sure you obtain it from a reputable source, find out if it can be licensed, and understand the license terms.

We recommend avoiding the temptation to copy and use images that do not have clear terms and conditions associated with them. There are multiple organizations that own and have registered their copyrights to thousands of images. These copyright owners will proactively search the Internet for unauthorized use of their images. If they find that you are using an image of theirs, they can demand a payment under threat of a lawsuit for copyright infringement.

As mentioned above, if your company has copied and is using an image that it has not properly licensed, this may be considered copyright infringement because it would be infringing the exclusive rights of the copyright owner to reproduce and publicly display that image. If discovered, a cease and desist letter and demand for payment of license fees is likely and a settlement of the infringement claim may include paying attorneys’ fees too.

To lessen risk, we recommend the following:

1. Designate an employee, or external partner, with responsibility for maintaining an inventory of all content on the website and updating that inventory as the website is revised. The inventory should identify the source of all content, and with regard to third-party content, the inventory should maintain copies of all licenses granting the company the right to use third-party content.
2. Educate the responsible employee on the necessity of ensuring the company has the lawful right to use all third-party content. Require the employee to obtain third-party content from reputable sources under written agreements.
3. Ensure the company understands the scope of the license, including what is and is not authorized. Some licenses are very limited in scope, and may limit use to a single display, or for a limited period of time.
4. Periodically conduct an audit of the website to ensure any changes have been documented.

Am I responsible for UGC (User Generated Content) displayed on my website?

Not all websites allow users to post or upload UGC, but those that do could expose themselves to unnecessary liability arising from UGC that infringes a third-party’s copyright. Before the enactment of the DMCA, online service providers and website operators were being held liable for the UGC provided by the users of those websites if that content infringed a third-party’s copyright. Damages for copyright infringement vary wildly depending on the facts, but since the Copyright Act allows for statutory damages, the specter of six or seven-figure damage amounts is real.

With the passing of the DMCA, those online service providers and website operators could use the DMCA’s safe harbor provisions to reduce their risk to zero if they followed the act’s relatively straightforward requirements.

Obtaining the protections afforded by the DMCA is a relatively straightforward process that may not even require a lawyer’s assistance. The DMCA requires that (1) the company register a Registered Copyright Agent with the Copyright Office, (2) the website operator provide basic contact information for the Copyright Agent on the company’s website, (3) the website operator cannot have actual knowledge of the infringing activity or is not aware of facts making the infringement apparent, and (4) if properly notified of an infringement via a DMCA takedown request, expeditiously remove the material. The Copyright Agent is simply a person (by name or title) designated to receive takedown requests.

Registering a Copyright Agent and following the other relatively easy obligations to obtain safe harbor protection is one of the easiest and best protections you can obtain to eliminate exposure for copyright infringement arising from UGC displayed on your website.

What rights are needed to use third-party data, or content that is not copyrightable?

If your company offers products or services based on or involving data obtained from third-parties, make sure you know where that data is from, and more importantly, ensure you have the rights you need to use the data in the manner you are using it. Data is a curious asset in that it generally is not protected by intellectual property rights in the U.S. Instead, data is protected by contractual obligations: Party A gives Party B access to Party A’s data, but Party B promises to use that data for specific, limited purposes, and possibly keep that data confidential.

One source of data you may consider using are those found on publicly available websites. Maybe you want to analyze public comments or reviews about products purchased on Amazon. Maybe you want to use data from the County Assessor’s office. Generally, the source of the data will have terms governing its use. Most private actors will impose obligations and restrictions on the use of their data via a license agreement or terms of use. Be sure to find and review any relevant contractual terms that would govern the collection and use of that data. Oftentimes, the website’s governing document – typically called a Terms of Use or Terms of Service and found at the bottom of the webpage – will outline allowed and prohibited use of data and content found on the website.

By way of example, the Boulder County assessor’s office offers data sets related to property sales, assessments, and taxes at no cost for unrestricted download. The data is provided without warranty, but can be used for any purpose at all. Contrast that approach with Amazon’s Terms of Service which allow for use of their services and content for personal and non-commercial use. Under Amazon’s terms, scraping reviews, which is probably content that is not subject to copyright protection, from Amazon to create a product that offers a brand’s customer insights on what products get great reviews would be prohibited under the Terms of Service.

Collecting or using data in violation of the governing terms could lead to breach of contract claims, or possibly torts, such as trespass to chattels (the unauthorized access to property). To minimize these risks, find and review relevant legal terms to understand what is and is not allowed.

These practices can help your website deliver value as a marketing tool, while minimizing the risk to your business, but there are other legal factors to manage as well. In the next part of this series we will cover one or more of the additional topics referenced above. Keep in mind too, that many websites and brands have additional, complex legal considerations to stay on top of. Work with your in-house counsel or external partner to understand and minimize your risk.

Matt McKinney is a partner at KO Law Firm, focusing on structuring and negotiating complex commercial and technology transactions and representing companies in intellectual property and technology-related matters.