Have you ever stopped to consider what someone would find if they could see your internet search history? You might be embarrassed by what would be revealed. Most people don’t think twice about asking ridiculous, embarrassing, or even deeply personal questions:

“Why is my goldfish not swimming?”

“What’s the best place for sushi in Mexico City?”

“What rhymes with fart?”

But very little of our life on the internet is private. And nowhere is that more misunderstood than with AI tools like ChatGPT or Claude.

The core problem is the gap between how people experience AI and what’s actually happening. The conversational interface feels private – like talking to an advisor, a therapist, or no one.

Legally, it may be closer to speaking on a recorded line.

Recently, a case out of the Southern District of New York should raise every lawyer and client’s spidey senses about using AI. Conversations with AI may not be as insulated as they seem, and they may be discoverable, particularly depending on the subscription tier being used.

Roadmap
I. What Is Discovery / Attorney-Client Privilege / Work Product Doctrine?
II. History: Your Deleted ChatGPT Logs Are Discoverable - New York Times v. OpenAI/Microsoft
III. Fast Forward: AI Searches Can Destroy Privilege?! - United States v. Heppner
IV. Digging into the Terms of Service, Privacy, and Usage Policies of Claude and ChatGPT
V. Plot Twist: AI-Assisted Drafting Is Protected Work Product in Michigan — Warner v. Gilbarco, Inc.
VI. Reconciling Heppner and Warner
VII. Potential Ways to Mitigate Risk
VIII. Public Policy Thoughts
IX. Sources

I. What Is Discovery / Attorney-Client Privilege / Work Product Doctrine?

Let’s start with the basics.

A) Discovery

When a lawsuit is filed, the parties enter a phase called discovery—the pretrial process where each side must formally exchange relevant, non-privileged information and evidence to evaluate claims and defenses. My Cousin Vinny provides a helpful illustration of how discovery works:

Discovery is designed to ensure both sides have access to the facts before resolution or trial. Because discovery is broad, the law also recognizes important limits. Two of the most significant limitations are (i) the Attorney-Client Privilege and (ii) the Work Product Doctrine.

B) Attorney-Client Privilege (A-C Privilege)

A-C Privilege is a rule that protects confidential communications (oral, written, or electronic) between a client and their attorney made for the purpose of seeking or providing legal advice. The privilege protects both individuals and institutions. For example, communications between Vandeley Industries employees and Vandeley attorneys are protected if they are made in confidence and for the purpose of seeking legal advice about Vandeley’s legal matters. When the privilege applies, those communications cannot be disclosed to opposing parties or required to be produced in legal proceedings (with some exceptions).

C) Work Product Doctrine (The WPD)

The WPD protects materials prepared by or at the direction of an attorney in anticipation of litigation. Unlike A-C Privilege, it focuses on documents and strategy (notes, memos, research, etc.). In rare cases, it can be overcome if the opposing party shows a substantial need and inability to obtain the equivalent without undue hardship.

Why do we have privilege?

The A-C Privilege exists for a very practical reason: the legal system works better when clients can speak openly and honestly with their lawyers. If people fear that anything they tell their attorney could later be exposed in court, clients would be more likely to withhold facts, soften details, or avoid seeking legal advice altogether. That prevents attorneys from fully understanding the situation and providing effective representation. In this way, the privilege not only protects the client’s interests but also supports the fair administration of justice.

What are the limits to privilege?

Many clients assume that if a lawyer is involved in any conversation or copied on an email, the communication is automatically protected. However, that’s not always the case. The primary purpose of the exchange must be to seek or deliver legal guidance—not merely to discuss business strategy, operational decisions, or general information in the presence of counsel.

Additionally, you can lose the A-C Privilege when:

• The communication is shared with a third party (called waiver).

• There was no intent for the communication to be confidential.

• The advice was used to further a crime or fraud (crime-fraud exception).

• The client puts the advice “at issue” in litigation (e.g., “I relied on my lawyer’s advice”).

How far does privilege extend in terms of legal tools and service providers?

Not every disclosure to a third party automatically destroys A-C privilege.

Under United States v. Kovel, the protection may extend to third parties who are engaged to assist counsel in providing legal advice, so long as they are retained for that purpose, operate under the attorney’s supervision and direction, and are bound by confidentiality obligations. Courts have consistently applied this doctrine to professionals such as forensic consultants, translators, and e-discovery vendors when their involvement is necessary to facilitate legal representation.

The same principle applies to the WPD. It does not cover every document a lawyer touches; it protects materials prepared by or at the direction of counsel in anticipation of litigation. This means the material must be created because of a real and identifiable prospect of litigation—not merely as part of routine business operations or general risk management. Documents created in the ordinary course of business, even if reviewed by a lawyer, may not qualify. These protections are specific and conditional — not automatic or absolute.

II. History: Your Deleted ChatGPT Logs Are Discoverable - New York Times v. OpenAI/Microsoft

In N.Y. Times Co. v. Microsoft Corp. (2023), pending in the Southern District of New York, the Times alleged that OpenAI and Microsoft used millions of its articles without permission to train AI models like ChatGPT, which can at times reproduce or closely paraphrase its reporting in ways that threaten subscriptions and paywalls. OpenAI and Microsoft denied infringement, arguing that training on publicly available text was fair use because the models learn linguistic patterns rather than store or republish articles, and that verbatim outputs are rare and unintended. See a previous post for more information.

As the case progressed, discovery became a central battleground. The Times sought access to up to 120 million user chat logs; the court ultimately ordered production of a smaller, anonymized sample of roughly 20 million conversations under a protective order. OpenAI argued discovery should be limited to chats tied to specific Times articles or exemplar prompts, but the Times contended it needed broader data to assess how the models function in real-world use and whether they generate Times-like content at scale. The court rejected OpenAI’s narrower proposal, holding that privacy concerns do not automatically bar discovery of relevant electronic data where safeguards are in place.

The case also raised issues about preserving and deleting data. At one point, the court required OpenAI to preserve and separate certain ChatGPT log data that would normally have been deleted—including conversations users thought they had already deleted.

This ruling highlights a tension between what users expect and what the law requires during litigation. Even if a platform makes conversations temporary, the underlying data may have to be kept once there is a legal duty to preserve it as evidence.

More broadly, it underscores an important point for both AI companies and users: even deleted conversations may not be fully or immediately erased.

III. Fast Forward: AI Searches Can Destroy Privilege?! in NY - United States v. Heppner

I’m sure most lawyers at this point have had a client put whatever they said into an AI chat or use AI to try to teach their own lawyers. Well, this case is a bit of schadenfreude for legal eagles….

Bradley Heppner, a financial executive facing fraud charges, used the consumer version of Anthropic’s Claude after receiving a grand jury subpoena. He input information he had learned from his defense counsel, generated 31 AI-produced documents, and sent them to his lawyers. The FBI later seized those materials during a search.

Heppner argued they were privileged.

Judge Rakoff disagreed. The ruling turned on several key principles:

• Routing AI material through counsel does not create privilege. Simply sending AI-generated documents to a lawyer does not automatically shield the client from discovery.

• Independent research is not privileged. A client’s self-directed research—whether Googling case law, drafting personal notes, or posing legal questions to an AI platform—does not become protected simply because it relates to a legal issue. If the work was not prepared by or at the direction of counsel, and is not itself a communication seeking legal advice, it may be discoverable.

• AI tools are not lawyers. No attorney directed the AI use, and AI platforms cannot form A-C relationships.

• The purpose was not to obtain legal advice from counsel. The documents were generated through Claude, which expressly disclaims providing legal advice, undermining any claim that the communications were made for the purpose of seeking legal counsel.

• There was no reasonable expectation of confidentiality. Anthropic’s policies permitted disclosure to government authorities and use of data for model training, defeating any claim that the communications were confidential.

• Privilege cannot be created after the fact. Sending AI-generated documents to counsel did not retroactively cloak them in privilege, and the work product doctrine did not apply because the lawyers had not directed the AI research.

As the Casey Anthony trial demonstrated years ago, even internet search histories can become evidence. AI prompts are simply a more sophisticated version of the same concept.

IV. Digging into the Terms of Service, Privacy, and Usage Policies of Claude and ChatGPT

Let’s review the ToS for the consumer v enterprise versions of Claude and ChatGPT.

A) Claude

B) ChatGPT

1. Training & Privilege Risk (Consumer vs. Enterprise)
   Consumer plans may use inputs/outputs for training unless users opt out; business/enterprise plans are opted out by default. However, both permit internal access for safety, security, abuse prevention, and legal compliance. Courts have not yet addressed how these commercial AI arrangements affect A-C privilege. Because companies can access data internally in some situations, parties in litigation may argue that these communications are not completely private.

2. Disclosure of Confidential Information
   Both platforms allow disclosure when legally required. Claude states it will coordinate with Enterprise administrators to narrow compelled disclosures; OpenAI says it will make reasonable efforts to notify customers where permitted. Still, these policies do not remove the risk of subpoenas or discovery in lawsuits. Organizations should pay close attention to provider notices, especially if litigation is expected or ongoing.

3. Data Retention Controls
   Claude Enterprise offers clearer, configurable retention settings (e.g., minimum 30-day retention). OpenAI retains data “as long as needed,” with deletion subject to legal and security exceptions. While deleting data can lower risk, it does not completely eliminate it because AI companies may still have to keep information for legal or compliance purposes.

4. Webpage Structure, Contract Complexity, and Enforceability
   Claude’s policies are spread across several different documents, which can make them harder to follow. OpenAI’s policies are more centralized and organized by user type, though they are still divided across multiple documents. This structure can create confusion in litigation, especially when questions about privilege, confidentiality, and data access depend on how different provisions interact. It may also raise enforceability questions if certain terms appear only in a privacy policy—which is typically a notice rather than a contract—or on informational webpages outside the formal terms of service.

V. Plot Twist: AI-Assisted Drafting Is Protected Work Product in Michigan — Warner v. Gilbarco, Inc.

But that same week, a federal court in Michigan reached what appeared to be the opposite conclusion.

In Warner v. Gilbarco, Inc., Magistrate Judge Anthony Patti of the Eastern District of Michigan held that a pro se litigant’s use of ChatGPT to help draft filings did not waive protection under the work product doctrine.

Warner involved a pro se employment discrimination plaintiff who used ChatGPT to help prepare her filings. Defendants moved to compel production of all documents and information concerning her use of third-party AI tools, including prompts, outputs, and activity logs.

Judge Patti denied the motion. His reasoning turned on a few key points:

• AI as a “tool,” not a third party. The court treated ChatGPT more like a drafting tool than a human consultant. On that view, using AI is closer to using a word processor or research database than sharing strategy with an outside person.

• Work product waiver is not privilege waiver. Even if privilege can be fragile when information is shared outside the attorney-client relationship, work product is typically waived only by disclosure to an adversary (or conduct likely to reach one). Simply using AI to draft is not the same as handing strategy to the other side.

• Prompts can reflect mental impressions. The court also recognized that forcing a litigant to disclose AI prompts and outputs could reveal mental impressions and legal strategy, which are the core protections of Rule 26(b)(3) of the Federal Rules of Civil Procedure. A discovery request demanding “how you drafted this” can become an indirect attempt to access protected work product.

VI. Reconciling Heppner and Warner

Placed side-by-side, Heppner and Warner seem to point in opposite directions.

• In Heppner, Judge Rakoff treated the AI system as a third party whose privacy terms undermined any reasonable expectation of confidentiality.

• In Warner, Judge Patti treated the AI system as a technological drafting tool, not a third-party receiving legal strategy.

The distinction is significant because modern legal practice already depends on cloud-based infrastructure. Email providers, document management systems, and collaborative platforms routinely process sensitive legal communications under terms of service that allow internal access for security, compliance, or operational purposes. If the mere presence of such terms were enough to defeat confidentiality, a wide range of everyday legal technologies—from Gmail to Microsoft 365—could potentially threaten privilege. Courts have historically rejected such an expansive view, recognizing that necessary technological intermediaries do not automatically destroy confidentiality.

The facts of the two cases also differ in important ways.

• In Heppner, the defendant had already retained counsel but independently used a consumer AI platform to generate documents after receiving a grand jury subpoena.

• In Warner, the plaintiff was representing herself, meaning the AI-assisted drafting directly reflected her own litigation strategy as the acting attorney.

Those differences help explain the outcomes, but they do not fully resolve the underlying issue.

What remains unresolved—and likely more important for future litigation—is the scenario neither case squarely addressed: the use of enterprise AI software—with contractual confidentiality protections and restrictions on data training—by an attorney or by a represented litigant acting under counsel’s direction.

Also importantly, neither Heppner nor Warner is binding precedent beyond their respective cases, as both are trial-court rulings that may serve only as persuasive authority for other courts. We’re still early in this AI era, and this area is still developing.

VII. Potential Ways to Mitigate Risk

Commercial-grade tools offer more protection but still require caution. Consumer-grade AI platforms generally do not provide the same level of contractual confidentiality protections as enterprise agreements, and even where users opt out of model training, other data access, retention, or disclosure provisions may still apply.

Don’t enter anything you don’t want seen. Sensitive information entered into these systems may not receive the same protections as communications made directly within the A-C relationship. In an abundance of caution, users should assume that information submitted to consumer platforms could be retained, accessed, or disclosed beyond their immediate control.

A) Considerations for Non-Lawyers (Clients)

Leave legal questions for the attorneys. Legal questions should be directed through attorneys, rather than having clients—or, in a business setting, managers or employees—independently rely on AI tools to conduct their own legal assessments outside of attorney direction. If research is conducted, documentation should clearly reflect that it was performed at the direction of counsel, demonstrating that the attorney was involved in and supervising the process.

Privilege isn’t magic. You have to work to keep it….Sending unprivileged AI-generated material to your lawyer does not retroactively make it privileged.

Be cautions with sensitive matters. Exercise extreme caution when using AI in connection with sensitive matters, especially for HR decisions, workplace complaints, investigations, or regulatory issues. Having a good AI policy in place at your company is key.

B) Considerations for Lawyers

Educate clients that AI usage may waive privilege or generate discoverable material. Clients should be cautioned against using consumer-grade generative AI platforms to analyze privileged or sensitive legal matters, as such platforms often retain, process, or train on user inputs. If you learn that a client is independently using AI to assess their legal situation, address the issue immediately and provide clear guidance.

Attorneys must also exercise caution with the information they input into large language models. Identifiable or sensitive client information should not be entered into AI systems unless adequate safeguards are in place. When AI tools are necessary, enterprise-level applications should be used where possible—particularly those that limit data retention, prohibit model training on user inputs, and impose strict contractual limits on use and disclosure. Lawyers should also understand and manage platform retention policies, including adjusting privacy settings and deleting prompts or histories where permitted.

VIII. Public Policy Thoughts

From a public policy perspective, especially given longstanding access-to-justice challenges, courts should not penalize individuals for researching their own legal issues. Legal representation is often unaffordable, so many people turn to available tools not to replace lawyers, but to understand when they need one. Just as consulting WebMD reflects a desire to be informed, the law should not discourage individuals from educating themselves about their rights.

Informed clients make better decisions, participate more effectively in the legal process, and are less likely to act out of panic or misinformation. The real concern is not self-education, but ensuring that the tools people use do not unintentionally undermine legal protections like A-C privilege.

Privilege should not hinge on technological literacy. Expanding waiver doctrine, as in Heppner, would disproportionately harm less sophisticated users who lack knowledge about data storage or platform practices or perhaps the funds to purchase an enterprise-grade version. If routine internal platform access defeated confidentiality, the same logic could threaten email, cloud storage, and other essential communication tools—an outcome courts like Kovel have rejected by recognizing that necessary intermediaries do not destroy privilege.

The justice system functions best when people have tools that help them engage with it responsibly. Research from The Bail Project similarly shows that supportive measures—such as reminders and transportation assistance—improve court participation. AI can serve a comparable supportive function: it does not replace lawyers, but helps individuals better understand and navigate the system. People engage more responsibly when given tools that promote clarity, not when barriers are raised.

When structured to preserve privilege, AI enhances meaningful participation without displacing professional representation. Public policy should reflect that reality by integrating modern tools in ways that expand access to justice while safeguarding core legal protections.

Share

Subscribe now

XI. Sources

1. United States v. Kovel, 296 F.2d 918 (2d Cir. 1961). https://law.justia.com/cases/federal/appellate-courts/F2/296/918/131265/

2. N.Y. Times Co. v. Microsoft Corp., et al., No. 1:23-cv-11195 (S.D.N.Y. filed Dec. 27, 2023). https://nytco-assets.nytimes.com/2023/12/NYT_Complaint_Dec2023.pdf

3. Motion for a Ruling that Documents the Defendant Generated Through an Artificial Intelligence Tool Are Not Privileged, United States v. Heppner, No. 25 Cr. 503 (JSR), Doc. 22 (S.D.N.Y. Feb. 6, 2026). https://storage.courtlistener.com/recap/gov.uscourts.nysd.652138/gov.uscourts.nysd.652138.22.0.pdf

4. Warner v. Gilbarco, Inc., No. 2:24-cv-12333, ECF No. 94 at 10-12 (E.D. Mich. Feb. 10, 2026). https://law.justia.com/cases/federal/district-courts/michigan/miedce/2:2024cv12333/379552/94/

5. Pete Brush, AI Docs Sent By Exec to Attys Not Privileged, Judge Says, Law360 (Feb. 11, 2026). https://www.law360.com/pulse/legal-tech/articles/2440082

6. Wednesday Testimony Delved into Internet Searches on Casey Anthony’s Computer, Jacksonville.com / Florida Times-Union (June 9, 2011). https://www.jacksonville.com/story/news/crime/2011/06/09/wednesday-testimony-delved-internet-searches-casey-anthonys-computer/15900821007/

7. Andrew R. Lee, Jason M. Loring & Graham H. Ryan, Your AI Conversations Are Not Privileged: What a New SDNY Ruling Means for Every Lawyer and Client, Jones Walker LLP, AI Law and Policy Navigator Blog (Feb. 13, 2026). https://www.joneswalker.com/en/insights/blogs/ai-law-blog/your-ai-conversations-are-not-privileged-what-a-new-sdny-ruling-means-for-every.html?id=102mif8

8. Andrew R. Lee, OpenAI Loses Privacy Gambit: 20 Million ChatGPT Logs Likely Headed to Copyright Plaintiffs, Jones Walker LLP, AI Law and Policy Navigator Blog (Jan. 6, 2026). https://www.joneswalker.com/en/insights/blogs/ai-law-blog/openai-loses-privacy-gambit-20-million-chatgpt-logs-likely-headed-to-copyright-p.html?id=102lzo9.

9. Parker Hancock, Your AI Conversations May Not Be Privileged: What United States v. Heppner Means for Every Organization Using AI, Baker Botts LLP, Our Take Blog (Feb. 13, 2026). https://ourtake.bakerbotts.com/post/102mibz/your-ai-conversations-may-not-be-privileged-what-united-states-v-heppner-means

10. Daniel Schwartz, A Court Just Confirmed What Employers Need to Hear: Your AI Conversations Are Not Privileged, Shipman & Goodwin LLP, Connecticut Employment Law Blog (Feb. 16, 2026). https://www.ctemploymentlawblog.com/2026/02/articles/a-court-just-confirmed-what-employers-need-to-hear-your-ai-conversations-are-not-privileged/

11. Michael Peltz, LinkedIn post re: United States v. Heppner ruling (Feb. 2026). https://www.linkedin.com/posts/mpeltz_ai-docs-sent-by-exec-to-attys-not-privileged-activity-7427479054242721792-n2LC/

12. Jason M. Loring, Andrew R. Lee, & Graham H. Ryan, Same Week, Different Frameworks: Why Heppner and Warner Both Got It Right on AI Privilege — and Why That’s the Problem, Nat’l L. Rev. (Mar. 5, 2026), https://natlawreview.com/article/same-week-different-frameworks-why-heppner-and-warner-both-got-it-right-ai

13. Joe Patrice, Does Asking ChatGPT a Legal Question Make It Discoverable? It Depends!, Above the Law (Feb. 24, 2026, 2:32 PM), https://abovethelaw.com/2026/02/does-asking-chatgpt-a-legal-question-make-it-discoverable-it-depends/

14. Attorney-Client Privilege, Legal Information Institute, Cornell Law School, Wex Legal Encyclopedia. https://www.law.cornell.edu/wex/attorney-client_privilege

15. Attorney Work Product Privilege, Legal Information Institute, Cornell Law School, Wex Legal Encyclopedia. https://www.law.cornell.edu/wex/attorney_work_product_privilege

16. Updates to Our Consumer Terms, Anthropic, https://www.anthropic.com/news/updates-to-our-consumer-terms (last visited Feb. 28, 2026).

17. Commercial Terms of Service, Anthropic, https://www.anthropic.com/legal/commercial-terms (last visited Feb. 28, 2026).

18. Consumer Terms of Service, Anthropic, https://www.anthropic.com/legal/consumer-terms (last visited Feb. 28, 2026).

19. Usage Policy, Anthropic, https://www.anthropic.com/legal/aup (last visited Feb. 28, 2026).

20. Privacy Policy, Anthropic, https://www.anthropic.com/legal/privacy (last visited Feb. 28, 2026).

21. Privacy Policy, OpenAI, https://openai.com/policies/row-privacy-policy/ (last visited Feb. 28, 2026).

22. Terms of Use, OpenAI, https://openai.com/policies/terms-of-use/ (last visited Feb. 28, 2026).

23. Service Terms, OpenAI, https://openai.com/policies/service-terms/ (last visited Feb. 28, 2026).

24. Data Processing Addendum, OpenAI, https://openai.com/policies/data-processing-addendum/ (last visited Feb. 28, 2026).

25. The Bail Project, “The False Promise of Bail: An Analysis of Release Mechanisms and Court Appearance in Tulsa County, Oklahoma,” June 10, 2025, bailproject.org/false-promise-of-bail.

    ---

    Disclaimer: This post is for general information purposes only. It does not constitute legal or tax advice. This post reflects the current opinions of the author(s) and are for educational purposes only. The opinions reflected herein are subject to change without notice.

    ---

    Images: All original images are AI-generated with using a combination of Dall-E, Firefly, DreamStudio and Pixlr.

For employees, consultants, and advisors at crypto startups, understanding token compensation is just as critical as understanding equity. Tokens may look deceptively simple—digital units recorded on a blockchain—but in practice, they come with their own thicket of legal, tax, and liquidity issues. Unlike equity, which has decades of case law and established market norms behind it, token compensation sits in a fast-evolving, often ambiguous regulatory environment.

This article is designed to demystify how token packages are structured, when and how tokens are actually delivered, and the restrictions and risks that may come with them. Whether you’re reviewing a consulting agreement, joining as an early employee, or advising a project in exchange for tokens, it pays (literally) to know what you’re signing up for.

The article is written with a focus on U.S. audiences, so for non-U.S. service providers, make sure you consult local tax and legal professionals for jurisdiction specific matters. Either way, we are lawyers but not YOUR lawyer, and this isn’t legal advice.

Note, be sure to read the glossary at the bottom of the document for important definitions and concepts described here.

Roadmap
I. What Are Tokens?
  A. Software Is Not Equity
  B. Dual Track Compensation
  C. Paperwork
     Checklist of What to Ask / Watch Out For
II. Types of Token Incentive Compensation
  A. Restricted Tokens or Restricted Token Awards (RTAs)
  B. Restricted Token Units (RTUs)
III. Differences Between Token v. Equity Comp
  A. No 409A safe harbor
  B. It bears repeating: tokens are not equity
  C. Tokens are pseudonymous
  D. Tokens can be more liquid than stock options
  E. Tokens are taxed the same as stock (for the most part)
  F. You may be granted a token interest or a token
  G. Paperwork may be delayed
  H. Tokens are subject to lockups and vesting (different restrictions)
  I. Transfer restrictions enforced via smart contracts or custodians
  J. Typical timelines for lockups and vesting schedules
  K. Acceleration for tokens
  L. Withholding taxes / net settlement
  M. You may not be able to participate in governance until you vest
IV. Tips and Nuances
  A. How to Value What You Are Getting
  B. What Happens If You Leave the Company?
  C. What If I’m a Non-US Person?
V. Glossary of Key Terms
VI. Sources

I. What Are Tokens?

A. Software Is Not Equity

Tokens are units recorded on a blockchain that can enable access to or voting power of a protocol. Critically, tokens are (usually) not equity and usually do not resemble traditional securities.1 Because of that, they confer no shareholder rights—no dividends, no corporate voting2, no residual claim on company assets. In other words, you should never confuse token ownership with owning stock. That said, it’s important to read the rest of this article to understand where tokens function like stock and where they differ, so you can evaluate what receiving or selling tokens may mean for you and conduct appropriate due diligence before accepting tokens as compensation.

B. Dual Track Compensation

In Web3, companies may issue tokens to their service providers in addition to, or in lieu of, equity. This is because in Web3, value may accrue to a decentralized, token-governed system rather than to the equity in a development company (DevCo). For more information about market trends in offers, we recommend Dragonfly’s 2024/2025 Crypto Compensation Report.

That said, token-based awards often (but not always) track the structure of traditional stock awards made under equity compensation plans, as a company will adopt a token plan along with individual form agreements. This was born out of a combination of not wanting to reinvent the wheel on incentive compensation, as well as an effort for companies to comply with existing securities laws during periods of high regulatory uncertainty.

C. Paperwork

As mentioned above, just like many companies have equity incentive plans/stock incentive plans, crypto startups often create token incentive plans whereby they’ll award tokens to the company’s service providers, as a form of incentive compensation—the most common papered forms of token awards are papered are the following:

• Restricted Token Awards (RTAs) and

• Restricted Token Units (RTUs)

[Note: We won’t go into token options and Token Purchase Agreements (TPAs) in this primer. Token options are pretty rare. TPAs are effectively the same as RTAs except that TPAs are paid for with cash while RTAs can be paid in either cash or services.]

II. Types of Token Incentive Compensation

Now, let’s get into the nitty gritty of RTUs and RTAs.

A. Restricted Tokens or Restricted Token Awards (RTAs)

1. What is it?

These are actual tokens issued to service providers, subject to some vesting restrictions (e.g., if you stop providing services to the company before they vest). You own these tokens and generally pay taxes in the year you receive them. The company’s right to take back the tokens (usually repurchase them upon separation) lapses as they vest. Unvested tokens are typically also subject to restrictions on transfer (but can be adjusted for estate planning purposes).

2. When do you see an RTA used?

When the fair market value of the token is still very low, usually pre-TGE, before a funding round has attributed a market-driven valuation to the tokens (i.e., before any SAFTs, token subscriptions, or token purchase agreements are entered into). So, you tend to see this used for grants issued after tokens have been minted but prior to a token being publicly launched.

3. When does settlement happen?

Title transfer happens around the time of the award for these. You need to give the team member title to the tokens, subject to the repurchase right. This means either actually give the tokens to the employee, or transfer legal title to them via legal agreement and have the company or a custodian hold them on behalf of the team member until vesting. Delivery of the tokens themselves may take place over time as vesting occurs after the lockup and cliff expires, sometimes using a platform such as Liquifi or Magna. There’s a bit of a debate over whether a multisig / smart contract vesting schedule is sufficient for 83(b) purposes where the employee doesn’t have dominion and control over the asset.

4. How are they taxed?

Token compensation is taxed as ordinary income at the time of grant. As with equity, you would generally be granted an RTA for unvested tokens, to incentivize you to earn them over a period of time with your contributions. If so, taxes can work in one of two ways, depending on whether you file an 83(b) election:

1. No 83(b) Election: If you don’t file, you are taxed when the tokens vest so you have to pay ordinary income on the value of the tokens at each vesting milestone. It can be costly if the token price appreciates. Since you likely can’t sell the tokens during the lockup, you could be stuck with a large tax bill and no liquidity to pay it!

2. 83(b) Election: If you file one within 30 days of the transfer, you pay ordinary income at the time of grant on the fair market value of the entire grant, vested or unvested. The token hopefully is worth more over time, so it makes sense to pay taxes on the full grant value at the time of the grant, rather than taxes at each vesting event for the amount of tokens that vested. Once you go to sell the tokens, depending on how long you hold them, you can be taxed at the capital gains rate.

Note: Tokens need to be minted and issued to the employee or service provider, as 83(b) elections can only be made on property you receive. Some firms may take a different perspective on this, so make sure you consult with a tax professional before accepting any tokens and filing an 83(b) election.

For RTAs, you technically own all of the tokens at grant under reverse vesting. However, the company retains the contractual right to repurchase any unvested tokens for a nominal amount if you leave before they vest. This “substantial risk of forfeiture” is what drives the default tax rule—without an 83(b) election, the Internal Revenue Service (“IRS”) treats the taxable event as occurring at vesting, not grant. Filing an 83(b) lets you accelerate the tax recognition based on the grant date despite this forfeiture risk.

Let’s say you were granted an RTA for fully vested tokens, then no 83(b) would be necessary and you would have a tax consequence on all the tokens under the RTA upfront.

5. Are there transfer restrictions?

Yes, through vesting and lock-ups.

6. How do you pay for it?

RTAs can be either purchased or received as compensation for services.

B. Restricted Token Units (RTUs)

1. What is it?

An RTU is akin to a restricted stock unit (RSU) in that an RTU is not an actual token but rather a contractual obligation to transfer tokens to the service provider in the future. You are issued tokens at the point of vesting. One unit is equal to one token.

2. When do you see an RTU used?

If the fair market value of the tokens would result in a material tax burden (i.e., if it would be too expensive for the contributors to make an 83(b) election because you have to pay taxes on the full value upfront), then that’s when you use RTUs. RTUs are most often used after a token is launched and in circulation (recall, most U.S. employees, consultants and advisors take RTAs pre-launch).

3. When does settlement happen?

Once the tokens vest, they will be delivered to the service provider’s wallet, but there could still be a transfer restriction via the unlock if the dates for the unlock and the vesting don’t align.

4. How are they taxed?

Service providers are taxed at settlement (i.e., delivery ), not when the RTUs are granted. With RTUs, you do not own the tokens until they settle in your wallet. Hence, there’s no option for an 83(b) election as there’s no property to elect on. The taxable amount is based on the fair market value at settlement, which also becomes your cost basis for future sales. Tokens are often issued on a net basis, meaning the company will sell a portion of your tokens to satisfy the taxes for each settlement date. There may be an option to structure it as deferred compensation and defer tax recognition, so it’s worth asking if that’s an option.

5. Are there transfer restrictions?

Yes, through vesting and lock-ups.

6. How do you pay for it?

Not really, you just earn them from working, which is why you pay taxes when you receive them.

III. Differences between Token v. Equity Comp

A. No 409A safe harbor.

Like equity, a token is valued for tax purposes by an independent, third-party valuation (from companies like Redwood or Teknos). In the equity context, people often refer to an independent valuation as a “409A Valuation” after Section 409A of the Internal Revenue Code, but while 409A Valuations last for up to 1 year, token valuations may go stale after 1 to 6 months – depending on the specific valuation company’s methodology and life cycle of the underlying company or token ecosystem. Unlike equity compensation, tokens probably don’t qualify as “service recipient stock” under Section 409A (meaning they probably aren’t treated like common stock by the IRS).

B. It bears repeating: tokens are not equity.

We may be wading into political territory here now, but objectively worth the risk. Here are a few reasons why:

• Stock represents ownership of a company, and ownership means you have rights under the law as a shareholder (like the right to inspect the books, claim to the company’s assets, receive dividends, vote for major company decisions, etc.). Companies often have a board of directors who have a fiduciary duty to maximize shareholder value.

• Tokens aren’t meant to bestow ownership of the company itself, so you aren’t entitled to any of those shareholder rights mentioned above. Rather, tokens are meant to support the development of and participation in a decentralized protocol (which is autonomous software, not a company). Protocols don’t have boards of managers who are obligated by law to maximize token value. In fact, public pronouncements by companies that they will dedicate themselves to maximizing token values may inadvertently trigger securities laws in certain jurisdictions. There are different types of tokens (utility, governance, security, etc.) and each token may offer some but not all of the following functions: access to services on the protocol, voting rights toward design of the protocol, etc. These are functions determined by innate, programmatic features of the underlying protocol, not legal prescriptions. Additionally, tokens can often be sold on public exchanges sooner than stock options, giving them an advantage in liquidity once restrictions are lifted.

C. Tokens are pseudonymous.

While stock ledgers track the name of a person or entity, token transactions on blockchain networks are typically linked to cryptographic addresses rather than real-world identities. This means that, unless specifically associated with an individual through Know Your Customer (KYC) processes or other off-chain methods, the identity of a token holder remains hidden.

D. Tokens can be more liquid than stock options.

The vast majority of startups fail, with over 95% failing in the 90’s and closer to 80% failing these days. So, unless there is an IPO, M&A deal or a company buy-back/tender offer, your options to purchase stock may be worth nothing at the end of the day, and due to transfer restrictions and limited ways to find a buyer, you may never have the opportunity to sell your shares and make money. Tokens, on the other hand, can be sold on public exchanges (decentralized or centralized) once they launch and any applicable restrictions are lifted.

E. Tokens are taxed the same as stock (for the most part).

Whether you get a bonus in stock or a bonus in tokens, both will be taxed (in the U.S.) as ordinary income upon receipt—the IRS treats the bonus as a receipt of property. After that point the token is generally viewed as a capital asset in the hands of the taxpayer (so capital gains treatment on disposition if you hold it for over a year). Similarly, whenever you get around to selling your shares (or tokens) you will be taxed based on the prevailing capital gains rate, as both are considered (usually) to be capital assets in your hands. That said, tokens are not eligible for qualified small business stock (QSBS) preferred tax treatment, so make sure you speak with a professional accounting advisor to understand your potential tax liability.

F. You may be granted a token interest or a token.

You may be granted either tokens outright or a right to receive tokens in the future. If you are issued tokens immediately, this functions much like a stock grant, and you may have the option to file an 83(b) election to accelerate taxation to the grant date. If you are instead only receiving a right to tokens later—typically tied to vesting or a network launch—you do not yet own tokens. In that case, the arrangement is more like an RSU: a contractual right that settles into actual tokens once the vesting or release conditions are met. If you are granted a token interest for unvested tokens, check with your tax advisor to see when it makes sense for you to file an 83(b).

G. Paperwork may be delayed.

Don’t be surprised, however, if your company doesn’t have a formalized token incentive plan: many companies believe that since their tokens are not regulated as securities, they can take the least operationally-intensive path forward, and give tokens directly to their team without robust token plan documentation. The existence or lack of an incentive plan shouldn’t be viewed negatively when you’re evaluating whether to accept a company’s tokens as part of your compensation, but you should inquire why the team chose one direction over another.

In many cases, a company will start solely by issuing equity to the team and later, once the company’s product is developed, they’ll create a token and issue some of it to their service providers. So, it’s possible you may start a gig at a company and not get any tokens until a point in the distant future, but your offer letter or service agreement may make an explicit promise of tokens if, and only if, tokens are ever created. Although, there is often no agreement nor specific promise, but rather just a handshake. What’s important to understand is that you are unlikely to ever see any sort of value associated with any token promises, as promising tokens with any kind of value pre-launch will likely cause tax risks (not tax advice).

Because token launches are complex and take many forms, you may not see any formal agreements until after the tokens are minted.3 That’s why the offer letter is very important as it may be the only document that serves as proof of a right to the token. It’s important to have an offer letter that outlines the comp structure and conditions.

H. Tokens are subject to lockups and vesting, which are 2 different types of transfer restrictions.

People often confuse lockups with vesting or use these terms interchangeably. Lockups refer to restrictions on transferability whereas vesting refers to whether or not the service provider has shed the risk of forfeiting or losing the tokens by satisfying the conditions imposed at the time of the token award. Both prevent you from being able to own the tokens “free4 and clear” of any restrictions.

Lockup refers to the period of time during which tokens cannot be sold or transferred. In many cases, the company maintains administrative custody of the tokens until they unlock.

Vesting refers to either the removal or lapsing of the company’s right to take back your tokens or the accrual of your rights to receive them. Unvested tokens, like unvested stock, are usually forfeited or repurchased upon termination of the individual’s service relationship with the company.

Once the token unlocks and is fully vested, the service provider has full control and ownership of the tokens underlying the token award in question and may hold or transfer/dispose of the tokens as they see fit. (But keep in mind you may have to pay taxes when you sell the tokens based on the difference between your basis in the tokens and fair market value when you sell them!)]

I. Transfer restrictions are enforced via smart contracts or custodians.

Transfer restrictions for tokens can refer to both the vesting and lockup (usually by mistake, when people are just speaking in shorthand). Typically, token agreements specify that tokens cannot be transferred until the later of when the vesting or lockup period is complete, partly because there could be a liquidity mismatch in non-83(b) scenarios. What do we mean by this? Since taxable income generally arises upon vesting, recipients without an 83(b) election may owe tax before they’re able to liquidate tokens. If a lockup is still in effect at vesting, this creates a liquidity mismatch that precludes sell-to-cover strategies (i.e., selling some tokens to cover your taxes). Once both conditions are met, the contributor can transfer their tokens to personal wallets or directly from company-controlled wallets. While your tokens remain subject to transfer restrictions, typically a third-party service provider (ex: Coinbase) will prevent you from transferring your tokens until the transfer restrictions lapse.

J. Typical timelines for lockups and vesting schedules.

The unlock / vesting schedules commonly do not track identically. Employee tokens are typically subject to a 4-year vesting period (but we have seen three years with some increase in popularity in recent years). The vesting schedule usually starts from your first day as an employee. If you receive tokens a few years after you join a company, the company will commonly give you vesting credit for your service to date. Often there’s a 1-year cliff (i.e., you have to wait 1 year to get a large chunk (25%) of the tokens), and the remaining will vest monthly over the remaining 3 years. Lockups tend to vary from 1 (in the case of liquidity providers, or other non-personnel ecosystem participants) to 4 years (for everyone else) in total, with the first tokens unlocking 1 year after the issuance of tokens or token launch.

Employees are typically subject to the same unlock schedule as all insiders (i.e. founders and investors). The 1-year cliff for lockup is done for securities law purposes (sometimes you’ll see 6 months for employees outside the US); in case tokens are deemed securities, then you need to have a holding period before the tokens could be sold to comply with securities laws. It can also be used to build confidence among a community of token holders: if employees/founders are able to sell quickly, the community may not have confidence that they’ll actually execute and just see it as a money grab. Lockups usually commence as of the TGE date, so depending on whether the token is live, the lockup and vesting start dates may not be the same. If the token launch has occurred, then the lockup probably begins when granted, and if prior to the token launch, it will begin at the token launch.

For consultants and advisors, you can expect a similar vesting and lockup duration. The only exception would be where you anticipate your relationship with the company to be shorter than 3 or 4 years, in which case vesting might be on an accelerated timeline (e.g., 1 year) but lockups would likely stay the same length as everyone else’s (particularly for a pre-launched token). If you’re only providing services for a few months or a year and are being offered tokens, be sure to ask for a vesting schedule that is commensurate to the amount of time you’ll be supporting the company.

K. Acceleration for tokens.

Recall that acceleration refers to the early vesting of equity upon certain events—usually a sale of the company or termination of employment. Double-trigger acceleration (DTA) (sale and termination) is more common and palatable to investors, while single-trigger acceleration (STA) (just the sale) is harder to get and often resisted; still, it’s worth asking for, especially if you are a key employee.

In the token space, DTA or STA are uncommon because there’s generally no change of control event that would interfere with token accrual rights; however, token accelerations upon termination do sometimes occur, though they’re typically not offered upfront and are instead provided as consideration for signing a separation agreement.

L. Withholding taxes are also a thing.

Tokens paid as compensation (as part of base compensation or bonuses) are subject to federal and state withholding taxes (employers can be secondarily liable for such taxes and face penalties if not paid). For RTUs, the project can either use net settlement, where tokens are withheld to cover taxes, or cash settlement, where the service provider receives all tokens and is responsible for paying the tax liability in cash by remitting cash back to the company equal to their tax obligation. Technically, the prior sentence could work for RTAs too, although in practice contributors almost always make 83(b) filings for RTAs and pay taxes upon issuance.

M. You may not be able to participate in governance until you vest.

As a stockholder, you can vote your shares whether vested or unvested (though not options or RSUs). Whether you can vote your unvested tokens depends on who possesses them. You may not be able to participate in governance with unvested tokens unless the tokens are in a wallet you control, or the company facilitates it. If you receive tokens under an RTA but the company continues to possess them pending vesting, you likely won’t be able to use those tokens to vote in governance.

IV. Tips and Nuances?

A. How to value what you are getting

With equity compensation, a company might promise you 0.3% of the fully diluted shares of the company. Similarly, token allocations are sometimes tied to your equity ownership percentage in the company given that it’s difficult to promise an exact number of tokens since companies often don’t know the total size of their token network at the time of grant. Sometimes, you may be allocated a fixed number of tokens pre-TGE, but that would usually be the case after the company knows the total supply and can vary depending on how close the company is to its token launch. Often, your ownership percentage of the token network will be based on a percentage of the company reserve (portion of the network reserved for insiders), rather than a percentage of the entire token network. Recently, we’ve been seeing a lot of companies use fair market value calculations when giving grants, calculated based on time- or volume-weighted averages.

Whether offered a hard number or percentage, that offer will likely look something like this:

• Subject to Board approval and the creation of the anticipated cryptocurrency network, the company anticipates granting to you an award of tokens with the right to receive:

  • [your pro-rata share of the company’s token reserve native to such cryptocurrency network (based on your fully-diluted equity holdings in the company at the time of the Network Generation)] OR

  • [[_____] tokens native to such cryptocurrency network]

If you are receiving a hard number, you might want to ask what percentage of the fully diluted equity it represents so you have context. If the token is minted, but not publicly launched (i.e. you can’t see what it’s trading at), it’s fair to ask what the valuation is at the time you’ll be granted it.

If the token hasn’t been minted yet, consider looking at comparable protocols or networks to see how their value has grown or shrunk over time.

B. What happens if you leave the company?

If you leave or stop providing services to a company prior to the token launch, there is a risk that because there is no contractual obligation to issue your tokens, the company may not do so once the token is minted. Also, even if the company is willing to still issue your tokens, you may need to qualify for another securities law exemption that differs from what active service providers can rely on. Good to have a conversation with your company if you plan to leave about how they will do right by you, and get that in writing!

If you leave the company and your tokens are only partially vested and partially unlocked, the company has a right to repurchase any RTAs that are unvested usually for a nominal value. For RTAs, if an 83(b) election is made and unvested tokens are forfeited, the taxes paid upfront are generally non-refundable. For RTUs, the unvested portion simply wouldn’t settle to your wallet.

C. What if I’m a non-U.S. person?

RTAs and TPAs are primarily for U.S. service providers due to specific tax elections available in the U.S. and UK, like the 83(b) election, which allows tax payments at the time of award rather than vesting. Outside the U.S. and U.K., RTAs and TPAs don’t offer the same tax advantages. Service providers in other regions generally use RTUs, which don’t allow the same tax optimizations as RTAs and TPAs. If you are a non-U.S. person who plans to become a U.S. tax-resident during the vesting period, you may want to file an 83(b) anyway.

For non-U.S. persons, token grants can be taxed very differently depending on jurisdiction — potentially at receipt, vesting, or sale, and sometimes regardless of liquidity. In some countries, employer withholding rules may apply or treaty relief may be available. Generally, tokens paid to non-employee service providers don’t require a company to withhold tax (there’s no withholding on consultants or advisors). Recipients should confirm local tax treatment before accepting tokens, especially if they are mobile employees or may relocate during the vesting period.

V. Glossary of Key Terms

• 83(b) Election: Under the Internal Revenue Code, recipients of property can elect to be taxed at the time they receive the property—on the spread between fair market value and purchase price—rather than at vesting. For token grants, eligibility for an 83(b) election (or equivalent in other jurisdictions) may determine the form of award issued, due to differing tax treatment.

• Acceleration: Acceleration means your vesting happens faster than originally planned. This can occur under certain conditions, such as the sale of the company (a “change of control”) or if you’re terminated without cause. For example, “double-trigger acceleration” requires both a sale and termination to accelerate vesting, while “single-trigger acceleration” requires only one of those events.

• Capital Gains vs. Ordinary Income: When you first receive or vest in tokens, their value is generally taxed as ordinary income—like a paycheck. Later, when you sell those tokens, any increase (or decrease) in value is treated as a capital gain (or loss). The rate you pay depends on how long you held the tokens: gains on tokens held more than a year usually qualify for lower, long-term capital gains tax rates.

• Cliff: The cliff is the initial period before any of your tokens start to vest. For example, if you have a one-year cliff on a four-year vesting schedule, none of your tokens vest until you’ve completed one full year of service—at which point a chunk (often 25%) vests all at once. After that, vesting typically continues monthly or quarterly.

• Custodians: It’s become more common for companies to use custodians instead of smart contracts for token compensation. A company will set up a qualified custodian/wallet for each contributor and use services like Coinbase Institutional, Copper Custody, LiquiFi, Magna, or Toku to manage vesting and lockup.

• DevCo (Development Company): The Development Company or DevCo is the traditional legal entity—often a corporation or limited company—that builds and maintains the decentralized project or protocol. It’s separate from the decentralized network itself, which may be governed by token holders or a DAO.

• Governance Rights: Governance rights to tokens enable holders to participate in decision-making processes on the blockchain, such as voting on protocol updates or network changes. These rights may be restricted until tokens vest or lock-ups expire. Companies may build in restrictions on service provider governance rights into the token comp paperwork and the smart contract.

• Lockup: A lockup is a set period of time when you’re not allowed to sell or transfer your tokens. During this period, the company often holds the tokens programmatically for you until they “unlock.”

• Minting: This is the process of creating new tokens and first circulating them on a blockchain.

• Smart Contract: Think of a smart contract as software code that automatically executes whenever certain conditions exist. Like a vending machine, if you put a dollar into it and select a beverage, the machine knows to release that specific drink. Using the word “contract” is a bit of a misnomer. It’s not a legal contract per se, but the idea is that it enforces the terms written into the code without needing intermediaries.

  • In the context of token compensation, companies may use smart contracts to automate the vesting and unlock of tokens. The smart contract in this example will hold the tokens in escrow until they are released once vesting/unlock milestones occur.

• Settlement: This refers to when tokens are delivered to the participant upon meeting certain conditions. Some companies bifurcate vesting and settlement events for administrative ease. E.g., you may vest on May 12th, but the company may do monthly token deliveries on the last day of each month or quarter.

• Token Generation Event (TGE): The event in which tokens are created or “minted” by the company. For tokens that are not yet live, service providers generally receive tokens shortly after the TGE, which can be subject to vesting and lock-up periods.

• Token Launch: This is the date when tokens are first sold to non-insiders (i.e., service providers and existing company investors). Service provider lockups are commonly measured from the Token Launch rather than from the date of issuance.

• Vesting: Vesting is about earning the right to fully own your tokens. It means the company can no longer take them back once you’ve met certain conditions—like staying with the company for a set time or achieving specific milestones. Unvested tokens, like unvested stock, are usually forfeited or repurchased if you leave before they vest.

• Withholding / Net Settlement: When tokens are treated as taxable compensation, the company may need to withhold taxes. In a net settlement, the company keeps or sells a portion of your tokens to cover the tax amount before transferring the rest to you. Alternatively, you might be required to pay the taxes in cash.

* * *

Token comp is still pretty new so the landscape is constantly evolving so make sure to seek out advice from a competent lawyer and/or tax professional.

Good luck!

Share

Subscribe now

Special thanks to the following people who reviewed this article in their individual capacities: Chris Ahsing, Jordan Blum, Bryan Edelman, Jonathan Edwards, Benjamin Helfman, Lindsay Lin, Nima Maleki, David Safren, Lee Schneider, Darin See, Zack Skelly, Demetrios Stellatos and Connor Tweardy

VI. Sources:

• 26 U.S.C. § 409A

• 26 CFR § 1.409A-1

• Digital assets, Internal Revenue Serv., https://www.irs.gov/filing/digital-assets

• Darren Goodman, Taryn E. Cannataro, & Jessica I. Kriegsfeld, Taxation of Token Awards: What You Should Know, Lowenstein Sandler LLP (Mar. 2024), https://www.lowenstein.com/news-insights/publications/articles/taxation-of-token-awards-what-you-should-know-goodman-cannataro-kriegsfeld

• Ethan Lippman, Navigating the Dual Equity Paradigm: Stocks vs. Tokens, Medium (Jul. 29, 2023), https://medium.com/ethsign/navigating-the-dual-equity-paradigm-stocks-vs-tokens-8733c6414bea

• Guangye Cao, Startup Financing: Token vs Equity, University of Michigan (Aug. 2023), https://arxiv.org/pdf/2402.04662

• Jake Chervinsky & Jesse Walden, Tokens Versus Equity, Variant (June 26, 2025), https://blog.variant.fund/tokens-versus-equity

• Josh Howarth, Startup Failure Rate Statistics (2025), ExplodingTopics (June 5, 2025), https://explodingtopics.com/blog/startup-failure-stats

• Kyril Kotashev, Startup Failure Rate: How Many Startups Fail and Why in 2025?, Failory (July 31, 2025), https://www.failory.com/blog/startup-failure-rate

• Madan Nagaldinne, Craig Naylor, & Mehdi Hasan, How tokens can attract top talent: A compensation primer for web3, a16z crypto (Aug. 8, 2024), https://a16zcrypto.com/posts/article/token-compensation-guide/

• Martin Lipton, Cryptocurrency Compensation: A Primer on Token-Based Awards, Harvard Law School Forum on Corporate Governance (May 19, 2018), https://corpgov.law.harvard.edu/

• Matthew Bartus, What is a Section 83(b) Election and Why Should You File One?, Cooley GO (July 14, 2025), https://www.cooleygo.com/what-is-a-section-83b-election/

• Minting, Ledger Academy (June 10, 2023), https://www.ledger.com/academy/glossary/minting

• Practical Law Employee Benefits & Executive Compensation Team, Expert Q&A on Cryptocurrency Compensation, Practical Law (Nov. 10, 2022), https://www.cooley.com/-/media/cooley/pdf/expert-qanda-on-cryptocurrency-compensation.pdf

• Robert Delgado, Erinn Madden, Carly Rhodes, & Washington National Tax, Section 409A: Fifteen Years Later, KPMG (Dec. 16, 2019), https://assets.kpmg.com/content/dam/kpmg/us/pdf/2019/12/tnf-wnit-section-409a-dec16-2019.pdf

• Robin Ji, Maximizing Employee Upside: Everything You Need to Know About Navigating 83(b) Elections in Token Compensation, Liquifi (Feb. 1, 2024), https://www.liquifi.finance/post/83b-elections-token-vesting-grants

• Robin Ji, Token Vesting and Allocations Industry Benchmarks, Liquifi (June 15, 2022), https://www.liquifi.finance/post/token-vesting-and-allocation-benchmarks

• Robin Ji, When To Use Vesting vs Lockups For Your Tokens, Liquifi (Nov. 23, 2022), https://www.liquifi.finance/post/when-to-use-vesting-vs-lockups-for-your

• U.S. Bureau of Labor Statistics, Table 5. Number of private sector establishments by age (1991-2004), https://www.bls.gov/bdm/us_age_naics_00_table7.txt-token

• What Is a Governance Token?, Ledger (Mar. 22, 2022), https://www.ledger.com/academy/what-is-a-governance-token-and-why-does-it-matter

• What Is a Token Generation Event (TGE)?, BitDegree (Jul. 07, 2023) https://www.bitdegree.org/crypto/learn/crypto-terms/what-is-token-generation-event-tge

• Jessica Furr, Read the Fine Print for Stock Options, The LawVerse (May 09, 2025), https://www.thelawverse.com/p/fine-print-for-stock-options

Disclaimer: This post is for general information purposes only. It does not constitute legal or tax advice. This post reflects the current opinions of the author(s) and are for educational purposes only. The opinions reflected herein are subject to change without notice.

Images: All original images are AI-generated with using a combination of Dall-E, Firefly, DreamStudio and Pixlr.

Some people fear commitment but still crave loyalty. They want consistency, maybe even exclusivity—but without the legal entanglement. It sounds like a contradiction, but it's exactly the vibe in the final scene of Four Weddings and a Funeral…….

• Charles: Let me ask you one thing. Do you think - after we've dried off, after we've spent lots more time together - you might agree not to marry me? And do you think not being married to me might maybe be something you could consider doing for the rest of your life?

• Carrie: I do.

The same push and pull plays out between companies and individual workers. Under an “exclusive relationship” arrangement, companies are setting match preferences for loyal, top-tier talent invested in their mission, while individual workers are on the prowl for stable, well-paying gigs that offer security. When it comes to more of an “open relationship” setup, companies will “like” + “winky face” for the ability to scale quickly and cut costs, while individual workers swipe right for autonomy, freedom—and yes, the ability to work in their pajamas.

So let’s look at both sides of this modern commitment-phobia—the individual worker vis-a-vis the business—and what each party should actually consider before saying “I do.”

We’ll be approaching this topic from a US perspective; different countries handle employment law very differently. For example, in the US, at-will employment is the default employment relationship, and it means that an employer can terminate an employee at any time, for any reason (or no reason), with or without notice—as long as it’s not illegal. Likewise, an employee can quit at any time, for any reason, with or without notice.

For clarity: Throughout this piece, I refer to a business as the “employer” when it is engaging someone in an employment relationship, and as the “company” when it is engaging someone in a contractor relationship. I refer to the individual worker as either an “employee” or a “contractor,” depending on the nature of the relationship.

I. Employee v Contractor Differences

A) Employees:

When an employer hires an employee for a formal employment relationship (sometimes referred to as a W-2 employee after the IRS tax form W-2), it’s taking on a set of legal obligations and operational responsibilities in addition to paying a salary. That’s because employment—under US law—is a status, not just a relationship. Employees are protected by a range of labor laws that govern things like working conditions, harassment protections, and wrongful termination rights. In other words, with W-2 status comes both protection and structure for the employee, and responsibility for the employer.

Specifically, if someone is classified as a W-2 employee, the employer is legally required to:

• Withhold and pay the employee’s income taxes, Social Security, and Medicare taxes (collectively known as “FICA” taxes)

• Pay the employer-side portion of Social Security and Medicare (an additional 7.65%)

• Provide a W-2 form at the end of the year for tax reporting

• Often contribute to unemployment insurance and workers’ compensation funds (state-dependent - if no state workers’ comp fund, then employer must purchase private insurance)

• Comply with wage and hour laws (like minimum wage and overtime rules)

• Offer benefits like health insurance or retirement plans (sometimes applicable under federal law or state law - depends on local requirements, number of employees at the employer, etc.)

• Follow anti-discrimination, leave, and labor protections (like FMLA, ADA, and Title VII)

B) Contractors:

By contrast, a contractor (aka freelancer, consultant, independent contractor or, referring to the IRS form tax form 1099, a 1099 contractor) is treated as an independent business. Being an independent contractor has its advantages: the contractor can set their own hours, take on multiple clients, more likely work remotely (many companies are calling employees back to the office or force quitting), and may be able to sidestep the internal politics of climbing the corporate ladder. Contractors may appear to take home more money up front than W-2 employees because no taxes are withheld from their pay—what they invoice is what they receive. However, that doesn’t mean the contractor’s total compensation is higher or equivalent. Why?

Contractors are fully responsible for their own financial and legal obligations. This includes paying 100% of their tax burden—the full 15.3% self-employment tax (both employee and employer portions of Social Security and Medicare)—plus regular income tax. With no automatic withholdings, they must file and pay quarterly estimated taxes. Miss a deadline, and the IRS adds penalties and interest.

Contractors also lack employee protections and benefits. They don’t receive:

• Employer-sponsored health insurance

• Access to employer-sponsored retirement accounts (and if lucky, employer contributions)

• Pre-tax perks (e.g., commuting, childcare)

• Certain protections under US employment law

That said, there are benefits to being a contractor. Contractors may be eligible for Section 199A “qualified business income” deductions, which can reduce taxable income by up to 20% (subject to carve-outs for certain service industries). This is a substantial tax benefit. Contractors can also deduct legitimate business expenses—such as home office costs, software subscriptions, and travel—which further narrows the financial gap with employees. When managed well, these tax advantages can meaningfully offset the additional burdens of self-employment.

The question is, from a cost perspective, is it worth it for the business or the individual worker financially to be a contractor?

II. How much does an employee cost an employer? Does the individual worker save money by being a contractor?

From a business’s perspective, acting as an employer by hiring an employee in California generally costs significantly more than just the employee's base salary. Employers are responsible for a range of payroll taxes—such as Social Security, Medicare, workers’ comp insurance, and federal and state unemployment insurance—and are often expected to provide a comprehensive benefits package that may include health, dental, vision, and life insurance. Using a contractor involves fewer financial obligations for the company, as contractors are responsible for their own taxes and benefits.

From the individual worker’s perspective, being a contractor means they must now cover self-employment taxes, purchase their own health insurance and other insurance or take the penalty, and forgo access to employer-sponsored benefits like guaranteed paid time off, disability coverage (varies but contractors could have disability through the state where they pay taxes), and retirement contributions. As a result, contractors would likely have to charge a considerably higher hourly or annual rate to achieve the same financial outcome as a full-time employee.

Let’s do some math to see how this works!

There are plenty of W-2 vs. 1099 calculators online, but for illustrative purposes, let’s use ChatGPT to model a single employee in California earning $200,000 annually, with the employer covering all healthcare costs and no 401(k) contributions for simplicity. I’ll assume as a contractor, the worker is doing 40 hours of work a week for 49 weeks of the year.

Note: This is a simplified example for illustrative purposes only. Actual taxes, benefits, and costs will vary depending on individual circumstances, deductions, and current regulations. This is not tax or legal advice. For full transparency, I’ll include the exact prompt used at the end of this article so you can try it yourself. Always consult a qualified tax advisor. The chart doesn’t include any potential deductions.

Takeaways:

For Businesses/Employers/Companies:

So you can see in the above chart, employers save money (around 20%) with contractors since there's no obligation to cover payroll taxes, health insurance, unemployment insurance, or other benefits. But that savings for employers comes at the expense of contractors. The contractor now covers the full cost of self-employment taxes, healthcare, insurance, and lacks access to paid leave or job protections. However, this cost-saving may come with tradeoffs, including less control over the worker, potential legal risks if the classification is incorrect, and the loss of team cohesion and institutional knowledge that can come with longer-term employees. We’ll dig into this a bit later

For Individual Workers/Employees/Contractors:

Focusing on gross pay isn’t the full picture. A contractor may earn more upfront, but they keep significantly less. To match the take-home pay and benefits of a W-2 employee, a contractor would need to charge more to get to the same result. In this ChatGPT-run example, a contractor would need to charge $255,000 per year ($130.61 per hour) to get to the same net value as an employee making $200,000 per year for 40 hours a week for 49 weeks. On average, a contractor may have to charge 30-70% more than the equivalent base salary to get the same net take-home pay. Again, there are lots of factors that go into these numbers, but this should hopefully help to weigh the considerations.

While this shows a financial difference to the business and individual worker, this isn’t a full picture of the cost or benefit. There are other risks and costs to consider.

III. Misclassification Risk

A) The cost of worker misclassification

Keeping a working relationship “complicated” has legal and financial consequences. As independent contracting grows (60 million Americans in 2022, with 90 million projected by 2028), regulators are paying close attention. In tech, contract roles exploded from 6% of postings in 2021 to 20% in 2022. And yet, an estimated 10% to 30% of U.S. employers are misclassifying workers, according to the National Employment Law Project.

The penalties to businesses are real and escalating. At the federal level, the Department of Labor can impose fines on businesses up to $1,000 per Fair Labor Standards Act (FLSA) violation, plus back wages (including unpaid overtime) and liquidated damages of 2x or 3x. Repeat violations can even lead to criminal charges.

Tax-wise, the costs add up fast. If a business misclassifies individual workers as contractors, the business may be required to pay a $50 fine for every unfiled W-2, 1.5% of the wages paid, 40% of the employee’s unpaid FICA taxes, and 100% of the employer’s share of unpaid FICA. If the misclassification is found to be intentional, the company could be liable for the full amount of unwithheld FICA and income taxes, plus reimbursement to the individual worker for Social Security and Medicare taxes they paid out of pocket.

States are piling on. In California, penalties range from $5,000 to $15,000 per violation—and up to $25,000 for repeat offenders. Add potential class action lawsuits from misclassified workers, and the exposure balloons.

Cases in point:

• Uber paid $100 million to the state of New Jersey in 2022 after an audit revealed large-scale misclassification of drivers.

• FedEx shelled out $228 million to settle claims with over 2,000 California drivers, some dating back over two decades.

  

B) How do you determine a person’s status as an employee v. contractor?

How individual workers are classified is a legal test: if the company controls how the work is done, sets schedules, integrates them into day-to-day workflows, or makes them economically dependent on that job—then legally, the worker may be an employee. Misclassification can trigger serious penalties: back taxes, back wages, fines, liability for unpaid benefits, and even class-action lawsuits.

So while using a contractor may feel flexible to the company, it’s only appropriate if the relationship is truly arms-length, preferably project-based and the service provided isn’t part of the core business. Even if both sides agree to the 1099, courts and agencies may dig into the true nature of the relationship.

TLDR: The label you choose doesn’t matter. It’s how the day-to-day relationship plays out that’s important. If they look, act, and smell like an employee, they probably are.

C) What can a business do to mitigate the financial and legal risk?

A business needs to be realistic about classification.

• Before engaging a contractor, run a proper test using IRS and state-specific frameworks (IRS 20-factor test, California’s ABC test, etc.). The key element is often control.

• Use a contractor agreement with clear deliverables and autonomy language.

• Have the contractor invoice the company (plus points if it’s from an entity and not an individual).

• Avoid giving contractors:

  • Company emails or equipment

  • Set hours or team lead oversight

  • Restrictions on taking on other clients.

IV. Contractors Dealing with Additional Costs of Being Contractors

Individual workers have additional costs and burdens if they are self-employed; a contractor can manage those costs by treating themselves like a business and planning ahead. They should talk to an accountant to game plan what is permitted and should be done to take full advantage of any tax savings. Specifically, a contractor could do the following:

• Set aside a certain amount of every check for taxes.

• Use bookkeeping software—or at the very least a spreadsheet—to track income and expenses.

• Deduct everything they’re entitled to: home office, laptop, software subscriptions, phone and internet bills, and even a portion of health insurance.

• Consider if it makes sense to pay quarterly taxes.

• Given they get no employment perks, build their own benefits stack into their rate.

• Contribute to a solo 401(k) or SEP IRA to lower their taxable income.

• For more advanced planning, evaluate whether setting up an S-corp makes sense. Many contractors go this route to reduce self-employment taxes through “reasonable compensation” rules. Note, this comes with added administrative costs and complexity—another reason to have a solid CPA in your corner.

V. The Value of Having Employees or Being an Employee

For Employers:
While a business may think it is saving money by using contractors, having an employee may save money in the long-term. Hiring full-time employees offers companies more than just reliable labor—it typically fosters long-term consistency and trust. Unlike contractors who may juggle multiple clients or roll off after short engagements, employees are generally more invested in the employer's success and culture and only need to be on-boarded once. That consistency may translate to:

• Higher quality work: Employees tend to gain deeper knowledge of the employer’s systems, products, and workflows—making them potentailly more efficient and effective over time.

• Institutional knowledge retention: Long-term employees accumulate context, history, and lessons learned that, and that “embedded wisdom” often helps teams avoid repeating past mistakes / speeds up decision-making.

• Reduced retraining costs: Long-term team members retain institutional knowledge, meaning less time and money spent onboarding new people.

• Stronger confidentiality: Employees are more likely to follow internal policies, protect proprietary information, and avoid conflicts of interest.

• Cultural alignment: With ongoing exposure to company values, strategy, and leadership, employees often become better ambassadors and collaborators.

In short, while contractors can offer flexibility, employees offer continuity—and that can pay off in both performance and protection.

For Employees:
Being an employee also offers advantages that go beyond steady pay. Employees benefit from:

• Job stability and legal protections: Employees typically enjoy more consistent work, wage protections, and legal safeguards around termination, discrimination, and workplace safety.

• Employer-sponsored benefits: Health insurance, retirement contributions, disability coverage, and paid time off can significantly enhance total compensation and provide peace of mind.

• Professional development and advancement: Employees are more likely to receive structured training, mentorship, and promotion opportunities.

• Sense of belonging: Being part of a team with a shared mission can foster stronger connections, purpose, and professional identity.

For many individual workers, the non-monetary benefits of being an employee—security, growth, and support—can be just as important as the paycheck.

V. Final Thoughts

The 1099 vs. W-2 question is less about titles and more about weighing costs, benefits, and risks. Not every relationship needs a marriage certificate. But some definitely need a prenup. Have awkward conversations up front and think about what’s right for you –whether you’re a business or an individual worker. Sometimes, it’s just more complicated to have an open relationship…

Share

Subscribe now

Special Thanks: Bryan Edelman, Lisa Kinard and Demetrios Stellatos

Resources:

• https://www.irs.gov/businesses/small-businesses-self-employed/independent-contractor-self-employed-or-employee

• https://www.irs.gov/newsroom/worker-classification-101-employee-or-independent-contractor

• https://legal.thomsonreuters.com/en/insights/articles/independent-contractor-vs-employee-what-does-it-matter

• https://www.dol.gov/agencies/whd/flsa/misclassification

• https://www.wagenmakerlaw.com/blog/employee-vs-independent-contractor

• https://www.labor.ca.gov/employmentstatus/abctest/

• https://www.forbes.com/advisor/business/w2-vs-1099/

• https://www.irs.gov/forms-pubs/about-form-w-2De

• https://velocityglobal.com/resources/blog/independent-contractor-pros-and-cons/#:~:text=Saves%20businesses%20money,contractors%20over%20full%2Dtime%20employees.

• https://www.papayaglobal.com/blog/calculate-salary-to-convert-contractor-to-an-employee/#:~:text=How%20much%20more%20should%20a,long%2Dterm%20contracts%20with%20them.

• https://thehill.com/opinion/technology/4800828-office-mandates-cause-attrition/

• https://www.wingspan.app/articles/lessons-from-uber-lime-meta-on-misclassifying-your-independent-contractors

• https://www.forthepeople.com/blog/lawsuit-alleges-uber-incorrectly-classified-drivers-independent-contractors/

• https://www.irs.gov/newsroom/qualified-business-income-deduction

Prompt for ChatGPT:

(control + F to replace bracketed info with other specifics]

“I am a [single] person in [California] earning [$200,000] per year as a W-2 employee. The company offers comprehensive benefits: health insurance (100% employer-paid for employee), dental and vision (99% paid), and life insurance (100% paid).

Please:

1. Create a fully itemized financial breakdown of what it costs the employer to hire me, including all payroll taxes and benefit contributions.

   • Break out each tax separately (Social Security, Medicare, FUTA, State Unemployment, etc.).

   • Break out each benefit separately (medical, dental, vision, life insurance).

2. Show my net take-home pay as a W-2 employee after federal, state, and employment taxes, with sub-line items for each tax.

3. Show the same scenario as a 1099 contractor earning [$200,000], with no benefits and including:

   • Self-employment taxes

   • Federal and state income taxes

   • The 199A/QBI deduction

4. Calculate the adjusted 1099 contractor income required to match the W-2 role’s total value (salary + benefits – taxes).

5. Calculate the hourly rate required for the contractor to match the W-2 value, assuming 40 hours per week for 49 weeks per year. Please ensure that the Contractor (To Match W-2 Value) column is fully calculated by solving for the contractor gross income required to equal the W-2 net value, rather than leaving placeholders.

6. Output a professional Excel table in HR-style format with three scenarios as columns:

   • W-2 Employee

   • 1099 Contractor (Paid Same)

   • 1099 Contractor (To Match W-2 Value)

7. Export to an Excel

Excel Formatting Requirements:

1. Top Header Row

• Dark green background with bold white text.

• Columns:

  • Category (line items)

  • W-2 Employee

  • 1099 Contractor (Paid Same)

  • 1099 Contractor (To Match W-2 Value)

This creates three comparison scenarios.

Below the Top Header Row, put a row with “Base Salary/Contract Fee” on the first cell. Then, put the amount I stated above in the next few cells for the pay amount. In the 4^th cell, calculate the gross amount you’d have to make as a contractor to walk away with the same net value as an employee.

2. Employer Costs Section

• Has a lighter green section header row labeled EMPLOYER COSTS.

• Line items underneath are indented for clarity:

  • Social Security (with rate & wage cap noted)

  • Medicare (with rate noted)

  • Federal Unemployment (FUTA)

  • State Unemployment (SUTA/ETT)

  • Company-Paid Benefits: Medical, Dental, Vision, Life Insurance

• Ends with an italics subtotal row: Total Employer Cost.

• Put an empty row between this and next section.

3. Employee Net Value Section

• Another lighter green section header row labeled EMPLOYEE NET VALUE.

• Breaks out employee’s take-home pay and taxes, with sub-items indented:

  • Take-Home Pay (after taxes)

  • Federal Income Tax

  • Social Security

  • Medicare

  • Additional Medicare (if applicable)

  • [CA Income Tax]

  • [CA SDI]

• Also includes Value of Employer Benefits as a separate line item.

• Ends with an italics subtotal row: Total Net Value to Worker.

• For 1099 contractor columns, include a full tax breakdown mirroring the W-2 format:

  • Self-Employment Tax (Social Security & Medicare separately).

  • Additional Medicare Tax (if applicable).

  • Federal Income Tax (after QBI deduction).

  • [CA Income Tax.]

• Show “Take-Home Pay (after taxes)” as gross income minus all of these.

4. Bottom Summary Row

• A final row separated by top and bottom borders.

• Bold text: Hourly Rate Needed to Match W-2 (40hrs/wk × 49wks). Put a line on the top and the bottom of this row.

• Only the “Contractor (To Match W-2 Value)” column shows a figure (e.g., $130.61).

5. Formatting Features

• Color coding: dark green (top headers), light green (section headers).

• Indentation for sub-items.

• Bold totals for emphasis.

• Currency formatting ($#,##0) for all monetary values.

• Text left-aligned, numbers right-aligned for readability.

• Cells that have a value of zero, put “$0”

{ChatGPT can be finicky so you may need to play with it a bit to make sure it generates everything properly. We can’t guarantee it will output the exact same way but hopefully it helps you get a foundation for a prompt. Again, not advice.}

Images: All original images are AI-generated with using a combination of Dall-E, Firefly, DreamStudio and Pixlr.

Disclaimer: This post is for general information purposes only. It does not constitute legal advice. This post reflects the current opinions of the author(s) and are for educational purposes only. The opinions reflected herein are subject to change without being updated.

Last week, a federal judge in the Northern District of California handed the AI industry a significant win regarding the use of copyrighted material to train large language models (LLMs). In Andrea Bartz, Charles Graeber, and Kirk Wallace Johnson v. Anthropic PBC, the court held that training LLMs on copyrighted books constitutes fair use—so long as the books were lawfully acquired. In other words, the ruling doesn’t give carte blanche to go pirating. Just two days later, a different federal judge in the Northern District of California granted summary judgment to Meta (Facebook) in a parallel AI copyright infringement case, reaching a similar conclusion.

Taken together, these were significant rulings as they mark the first decisions to provide clarity on how AI companies can color within the lines as they train their models. But make no mistake—they don’t give free rein to swashbuckling AI firms eager to plunder the open seas of online content. Let’s dig into the courts’ reasoning—and what it means for those trying to build in this fast-moving space.

I. The Case: Bartz, Graeber, Johnson v. Anthropic PBC

A. Background

In 2024, a group of authors filed a class-action suit against Anthropic, alleging that the company had used pirated copies of their books to train its chatbot, Claude. They claimed their works had been downloaded from shadow libraries like Books3, LibGen, and PiLiMi without their permission. They were purchased in print, then scanned and digitized (destroying the originals).

Anthropic admitted to downloading and storing these materials, but argued that the use was protected under the “fair use doctrine” — a legal principle that permits limited use of copyrighted material without permission for purposes such as commentary, criticism, education, or transformative uses. For a refresher on the “fair use doctrine,” check out a prior post.

According to Anthropic, feeding books into an AI model was “quintessentially transformative.” The point wasn’t to replicate or compete with the original books—it was to teach the model how to write and reason like a human. The company also emphasized that its model did not reproduce specific works but rather generated original content. The intent was not to copy or mimic the original pieces and so was not a threat to said authors.

Anthropic’s library strategy was twofold:

1. To Train LLMs: It used selected books to train and fine-tune Claude, aiming to improve fluency, tone, and reasoning.

2. Amass a “Forever” Research Library: It maintained a massive, searchable internal repository of books—over 7 million, including pirated works—even if they weren’t immediately used for training.

It’s the 2nd part of the strategy that was problematic.

B. The Ruling

The judge had no problem with:

1. Using lawfully purchased books for training: Anthropic’s use of lawfully purchased books—even when scanned and digitized—qualified as fair use under U.S. copyright law. The training process was deemed “spectacularly transformative.” The judge likened it to a person reading thousands of books to learn how to write better. The model, Claude, didn’t reproduce or redistribute content—it synthesized new outputs based on patterns.

2. Digitizing printed books for internal use: The court compared this to converting a personal bookshelf into a searchable digital format. As long as the books were legally purchased, scanning them for internal AI training was not considered infringement.

However, Judge William Alsup ruled against Anthropic on the pirated material. Yarr.

The judge rejected the notion that downstream transformative use could cleanse the initial wrongdoing. Coupled with bad facts that Anthropic’s own communications revealed that it chose not to license books in order to avoid what its CEO described as a “legal/practice/business slog.” Such shortcutting undermined the fair use defense. We’ll have to await the court to rule on damages.

II. Kadrey v. Meta

A. Background/Ruling

The Meta case has a similar fact pattern to that of Anthropic: authors including Sarah Silverman, Ta‑Nehisi Coates, among others sued Meta for copying their books from “shadow libraries” to train its LLM model known as Llama.

The court granted Meta’s motion and dismissed the authors’ copyright claims tied to LLM training. Judge Chhabria applied a 4-factor fair use test of which 3 of the 4 weighed in Meta’s favor:

• Factor 1 (Purpose and Character): Point for Meta. Training Llama to generate new content, not to replace books, was a “highly transformative” use. Meta’s commercial motive and use of shadow libraries didn’t outweigh the shift in purpose.

• Factor 2 (Nature of the Work): Point for the authors. Their books were creative, but this factor carried little weight ultimately.

• Factor 3 (Amount of Work Used): Point for Meta. Copying full books was “reasonably necessary” to teach the model how to handle long-form, structured content.

• Factor 4 (Market Effect): Point for Meta—but with caution. Plaintiffs showed no real evidence of lost sales or regurgitated outputs.

  • Caution this with the fact that the court flagged that if LLMs were to flood the market with similar works and undercut authors indirectly, this factor could weigh in favor of future plaintiffs.

Ultimately, the judge implied to his ruling should be taken with a giant giant of salt: Meta won not because its use was clearly lawful, but because the plaintiffs “made the wrong arguments.”

III. Recent U.S. Copyright Office Report

These rulings land just weeks after the U.S. Copyright Office (USCO) released a report—cheered by many creators—that rejected the notion of inherent fair use in Generative AI (GenAI) training and tackled the key question: Is using copyrighted content without permission to train AI models considered fair use?

Its answer: …maybe. The USCO wrote that such a determination would be fact specific but courts should focus on the (i) transformative use and (ii) market effects to determine such use of copyrighted works.

For example, if an AI model is used for noncommercial purposes and doesn’t reproduce the copyrighted material in its outputs, that may weigh in favor of fair use. But if the model were trained on pirated data or if its outputs compete with the original work, expect heavy legal scrutiny. The USCO drew a clear line between benign, internal uses and high-risk practices that copy expressive works from pirate sources to generate unrestricted outputs — particularly when licensing options are available.

Crucially, the USCO rejected the argument that training on copyrighted content is inherently fair use, cautioning that language models don’t just learn meaning—they absorb the arrangement and structure of linguistic expression. If a model memorizes and regurgitates protected material, that could constitute infringement.

The USCO also avoided recommending compulsory licensing, favoring instead the emergence of voluntary and extended collective licensing systems to manage the complexity of content ownership and permissions. This framework could offer a scalable path forward, especially as courts begin grappling with the scope of market harm caused by GenAI applications.

And although the report isn’t binding, it’s already appearing in court filings. Its emphasis on provenance, market impact, and licensing alternatives reinforces the direction courts like that of Alsup and Chhabria appear to be heading.

IV. Takeaway

Bottom line: you gotta pay tribute for what you use. You can’t Captain Hook your way through training LLMs.To amass your treasure, you can’t loot the open seas of creative content without a proper Letter of Marque (i.e. you pay for using content).

These rulings are a partial victory for both creators and AI companies—and they chart out a map for future legal battles. Courts agree that LLM training is transformative, but how you get your training data still matters. Judge Alsup took a piece-by-piece approach, flagging piracy as a dealbreaker. Judge Chhabria looked at the end goal alone, but warned that economic harm could still torpedo a fair use defense.

Future plaintiffs should focus on provenance and market harm (bring better data like surveys, sales drops, or dilution studies) to tip the scale in this battle.

This is still the beginning of this battle between creators and AI companies. Expect appeals in both cases and a range of interpretations from other jurists until clearer appellate guidance emerges. Either way, these are the early days on the great battle on the high seas of GenAI and fair use.

The ships are built. The flags are raised. Grab the popcorn—this one’s going to be a blockbuster

.

Subscribe now

Share

Resources:

• The Ruling: https://fingfx.thomsonreuters.com/gfx/legaldocs/jnvwbgqlzpw/ANTHROPIC%20fair%20use.pdf

• Anthropic Scores a Landmark AI Copyright Win—but Will Face Trial Over Piracy Claims - Wired: https://www.wired.com/story/anthropic-ai-copyright-fair-use-piracy-ruling/

• Pirates, Privateers, and Civil War Maritime Laws - Library of Congress: https://blogs.loc.gov/law/2020/05/pirates-privateers-and-civil-war-maritime-laws/

• Copyright and Artificial Intelligence Part 3: Generative AI Training - US Copyright Office: https://www.copyright.gov/ai/Copyright-and-Artificial-Intelligence-Part-3-Generative-AI-Training-Report-Pre-Publication-Version.pdf

• US Copyright Office Issues Report Addressing Use of Copyrighted Material to Train Generative AI Systems - Schulte Roth: https://www.srz.com/en/news_and_insights/alerts/us-copyright-office-issues-report-addressing-use-of-copyrighted-material-to-train-generative-ai-systems

• Mixed Anthropic Ruling Builds Roadmap for Generative AI Fair Use - Bloomberg Law: https://news.bloomberglaw.com/ip-law/mixed-anthropic-ruling-builds-roadmap-for-generative-ai-fair-use

• Anthropic and Meta fair use rulings on AI model training - McDermott Will & Emery: https://www.mwe.com/insights/anthropic-and-meta-fair-use-rulings-on-ai-model-training/#:~:text=Comparative%20implications,tip%20the%20scales%20next%20time.

• Northern District of California Judge Rules That Meta’s Training of AI Models is Fair Use - Goodwin: http://goodwinlaw.com/en/insights/publications/2025/06/alerts-practices-aiml-northern-district-of-california-judge-rules

• Images: All original images are AI-generated with using a combination of Dall-E, Firefly, DreamStudio and Pixlr.

• Disclaimer: This post is for general information purposes only. It does not constitute legal advice. This post reflects the current opinions of the author(s). The opinions reflected herein are subject to change without being updated.

Congratulations! You’ve just received a job offer from a startup—an exciting milestone full of possibility and new beginnings. While offer letters usually cover a range of details—like your role, manager, location, salary, benefits, and bonus—the equity piece is often the most complex. It’s one of the most important aspects to understand, as it can have a significant impact on your long-term financial future. That’s what we’ll focus on here.

You know how, when you have a weird mole on your back, you ask your doctor friend to take a look? Think of this as the legal equivalent—here to help you make sense of the fine print in your offer. No billable hours, just unsolicited (but hopefully helpful) opinions.

Do reach out to counsel for actual advice.

Roadmap:
A. Allocation between Cash and Equity
B. Types of Equity Under a Stock Plan
C. Stock Options: The Basics
D. Read the Stock Plan!!!
E. How to Value Your Options
F. Beware of Companies that Don’t Look Out for Employees
G. Action Items - What Should I Ask For?

A. Allocation between Cash and Equity

When you join a startup, your compensation will likely be a mix of cash and equity. It’s important to negotiate the right balance between these two components based on your financial needs and the perceived value of the equity.

If you believe the startup’s equity has significant growth potential, you might want to push for a higher equity percentage. However, if you’re unsure about the company’s future or prefer financial stability, it may be prudent to negotiate for more cash.

B. Types of Equity Under a Stock Plan

Equity in a startup can come in several forms: stock options, restricted stock units, or direct stock awards.

• Stock options give you the right to purchase a company’s common stock at a set price (the strike price) during a specified period of time.

• Restricted Stock Units (RSUs) are promises to give you stock, or the economics based on the underlying stock value, in the future, which are often tied to performance or time-based vesting.

• Direct stock awards or sales are when you receive stock outright or have the opportunity to buy it (typically at a discount). Unlike options, RSUs and direct awards usually come with immediate tax implications.

We’re focusing on options here because startups prefer them. Why? They align employee incentives with company growth, are easier to manage than other equity types, and offer tax advantages for both sides. Options also simplify things when employees leave—unvested options automatically return to the pool. Unlike stock grants, they defer taxes until exercised and don’t require upfront payment. Plus, they let employees buy shares at a discount if the company’s value increases.

Note, options are appropriate for earlier stage startups. A later-stage company may shift from using options as the default form of employee compensation to RSUs. Also, earlier stage startups tend to use their law firm’s forms without minimal changes. Later on, you’ll see more bespoke stock plans.

C. Stock Options: The Basics

Here are some essential concepts to understand and focus on as you try to make sense of your equity package:

• Number of Shares/Strike Price: Your offer letter should specify how many shares the options entitle you to purchase. To understand what that means for you financially, you’ll need to know the strike price (aka exercise price) for those shares. The strike price is the price at which an employee can buy company common stock when exercising their options, typically set at the stock's fair market value (FMV) on the grant date.

• Calculating the Total Exercise Price: The total exercise price of your options is equal to the number of shares under the grant times the strike price. For example, if the company offers you an option to purchase 3,000 shares at $1.00 per share, that means that you have to pay $3,000 (3,000 x $1) to exercise the options (note that you can elect to partially exercise any portion of the options once they are vested). The idea is that in the future, assuming the value of the company has gone up, you are buying your shares at a discount (i.e. the strike price).

• 409A Valuation: A 409A valuation is an independent appraisal used to determine the FMV of a private company's common stock. The FMV is used to set the exercise price of stock options, ensure compliance with IRS regulations, and avoid potential tax penalties. Under the prior example, if the 409A Valuation is $1.00 per share of common stock, then the FMV of the shares is $3,000 at the time of the grant.

Bringing these concepts together, at the time of the option grant, the exercise or strike price should equal the 409A valuation on a per share basis. Companies typically use the 409A to set the FMV of option grants. If a company offers you an option with a strike price below FMV, that’s a red flag and can lead to high tax penalties.

• Authorized v. Outstanding Shares. Authorized shares are the maximum number of shares a company can legally issue, as set by its certificate of incorporation — but they don’t reflect actual ownership. It’s just a cap on how many shares a company may issue. Outstanding shares are the shares that have been issued and are currently held by shareholders like founders, employees, and investors. To calculate your actual ownership, use the number of outstanding shares as your baseline.

• Fully-Diluted Shares: The fully-diluted shares refer to the total number of shares that would be outstanding if all convertible securities, such as stock options, warrants, and convertible bonds, were exercised or converted into common stock. This represents the maximum potential share count and is often used to assess more holistic ownership percentages and company valuation. Because companies all have different valuations, understanding your percentage of the fully-diluted shares is a digestible way to compare apples and oranges. More on this later!

• Vesting Schedule: This is the timeline over which you earn your equity. Companies use vesting to encourage you to stay with them and contribute to the company’s success over the course of years. Vesting typically occurs on a time-based schedule, which is usually over four years with a one-year “cliff”, meaning you’ll earn 25% of your equity after one year and then continue to vest monthly, quarterly, or yearly over the remaining 3 years. Sometimes you see vesting over 5 years, and you may also see vesting that does not include a cliff. Once options are vested, the employee can exercise them, meaning they can purchase the underlying shares at the strike price. Vesting usually starts on your first day of work, so you’ll want to confirm the date your option starts vesting (known as the “vesting commencement date”). If you are no longer providing services to a company, any unvested portion of your options is usually automatically returned to the option pool.

• Acceleration: If you have the clout, you may be able to negotiate vesting acceleration, which accelerates the vesting of the equity upon certain triggering events, such as the sale of the company or involuntary termination. Single-trigger acceleration (STA) occurs upon the sale of the company or an involuntary termination, leading to the immediate vesting of some or all equity. Double-trigger acceleration (DTA) occurs when an involuntary termination without cause follows the sale of the company, leading to accelerated vesting. Acceleration is difficult to negotiate as an employee—especially single-trigger acceleration, which is relatively rare. However, it’s worth asking if a company offers any acceleration. For founders, acceleration is a way to protect yourself. FWIW, many investors are fine with DTA but may balk at STA.

• Early Exercise Option: Some companies allow you to exercise your stock options early, meaning you can buy both vested and unvested shares. Unvested stock remains subject to vesting. Note that early exercising requires upfront payment, and you will have to pay ordinary income taxes on the spread between the exercise price and the then-current FMV. However, early exercise offers tax benefits. First, you get the benefit of being taxed only on the spread between exercise price and FMV at exercise, as opposed to the stock’s value in the future. Also, if you hold the shares for at least one year, the proceeds from their sale will qualify for long-term capital gains tax rate. However, you will need to file an 83(b) election with the IRS (VERY IMPORTANT!) upon exercising an unvested option. Whether vested or unvested, once you exercise your options, you become a stockholder and can vote your shares.

  • In addition to the out-of-pocket costs of early exercising, there are additional risks: losing the money if the company fails or if the shares lose value, owing taxes like alternative minimum tax (AMT) (a backup tax to prevent high earners from overusing deductions) or income tax, illiquidity until an IPO or limited secondary transactions, and the possibility of a company buyback of unvested shares at a potentially lower value if you leave. I recommend seeking advice from your tax professional on whether early exercising makes sense for you.

  ---

  Pro Tip: There are companies like SecFi that offer tools for scenario modeling, tax planning, and financing options (i.e. loans for option exercising). These are worth looking into to assess your options.

  ---

Now that we have a grasp of some of the basic terms, let’s talk about the Stock Plan and what to watch out for in the documentation.

D. Read the Stock Plan!!!

The stock plan (sometimes colloquially referred to as the option pool or stock pool) sets the overall rules and framework for the company's equity compensation, while the individual stock option agreement details the specific terms of the stock options granted to an individual employee within that framework.

Make sure you request a copy of and thoroughly review the company’s stock plan. It outlines crucial details like option expiration dates, rights of first refusal, and transfer restrictions. You usually won’t be able to get a copy until you onboard, but you can still ask about some of the below key terms:

Expiration: So long as you are still working for or engaged with the company, options typically expire 10 years from the date of grant.

BUT, if your service ends, options oftentimes expire 3 months after termination (or 6 months in the case of disability). Sometimes, you’ll see longer expiration periods so don’t assume anything (read the plan!). After you leave, you’ll need to make a quick decision if you want to exercise the options.

Since this can mean an all or nothing decision soon after you leave the company, you can try to negotiate for a longer window or use a company like SecFi to trade some of the potential upside for not losing the option entirely by not exercising.

Transfer Restrictions/Liquidity: Often, there are restrictions on transferring common stock. Even though you own shares, you may not be able to sell your shares without the company’s approval. This is important because you want to know if you can sell your shares before an IPO or sell on a secondary market. You would need to check the stock plan and also the company’s bylaws.

Change of Control: What happens to your unvested stock options if the company gets acquired? In the event of a merger or acquisition, options and shares under the plan will be treated as specified in the transaction agreement, which may include continuation, assumption, substitution, or cancellation with or without payment. Per this catchall, you could get nothing! Stay alert on the job—keep an eye out, listen closely, and try to sense any signs of a potential change of control, like shifts in leadership, strategy, or unusual activity behind the scenes.

Here are some examples of unusual additions to a stock plan you’ll want to keep an eye out for:

• Payment Method: The company may block loans against the options or shares.

• Fee Per Transfer: The company may require a fee per transfer.

• Clawback Provisions: If you violate a non-compete or non-solicit agreement or get fired for cause, the company can take back shares or the proceeds you make from selling the shares.

• Holding Period Requirements: The company may require you to keep a certain percentage of vested shares for a while, even after fully vested.

• Repurchase Rights: The company might be able to buy back shares at a set price, which could limit your ability to sell them.

E. How to Value Your Options

Now that you’ve reviewed the key terms in your stock plan, let’s dive into how to actually value your options. This section will walk you through what to ask for, what to look for in public documents, and how to make rough estimates when information is limited.

1) Calculate the paper value of your option

To calculate the value of your option grant, multiply the FMV of the common stock by the total number of shares granted. Where do you find the FMV? Two ways: the ideal way and the “make it work” way.

Ideal Way: Ask the company for their 409A valuation and when it was calculated.

If the company can’t tell you the 409A valuation and when it was calculated, that’s a red flag that they either don’t know what they are doing or they are being secretive. If you can’t get the official valuation from the company, there are ways to do some back of the envelope calculations (i.e. very rough estimates) on your own.

Alternative (Make it Work): Use the company’s certificate of incorporation (COI) to calculate the value of the common stock.

A COI is a public document that generally anyone can pull from the US state the company is incorporated in (usually Delaware). So, if the company doesn’t want to give you the COI, you are more than free to request it yourself directly from the state of incorporation. Once in hand, here’s what you can do yourself:

• Find the Last Price of their Financing Round: The COI will tell you the price per share (PPS) of preferred stock (usually called the “original issue price”) and the number of authorized shares for each class and series. Look at the very last series of the preferred stock’s original issue price (ex. if their last round was a Series C, then look at the Series C original issue price).

• Calculate the Value: The current 409A value is often around 20%-30% of the price for a Series Seed Preferred Stock after the Seed round. That goes up over time and gets closer to 40% after a Series C round and can be an even greater percentage if the Company has a lot of secondary activity. So, if the last round the company did was a Series Seed round and the Series Seed Preferred Stock price was $1.00, the company’s common stock will probably be valued somewhere between $0.20 to $0.30 per share. Caveat that the value of the common stock should, in theory, go up over time—so if it’s been a few years after a round and the company has not raised further funds, the value of the common stock may be out of those ranges.

Example: let’s look at Uniswap’s COI from 2022:

Looking at Uniswap’s 2022 COI, they had done 2 preferred rounds. The PPS of the Series A Preferred Stock was $2.35617 so it’s likely that the 409A valuation after the round was around $0.47, or 20% of the PPS. Again, not a precise calculation, but a rough, rough estimate. If you can, always get that official 409A valuation.

2. Figure out where you fall in the liquidation stack

Your option grant might look valuable on paper—but that value only matters if there’s enough money following a liquidation event to pay out to shareholders. That’s why it's important to understand where you sit in the payout hierarchy — aka liquidation stack.

As an option holder, you typically hold common stock, which is at the bottom of the stack. First, any debt gets repaid—banks, lenders, and convertible notes get paid before any equity holders see a dollar. Next come preferred shareholders, who have negotiated terms entitling them to be paid before common shareholders. Finally, if there’s anything left, common shareholders (including employees holding options) are paid.

To gauge whether your options are likely to be worth anything in an exit, you need to understand the company’s liquidation structure—which is usually spelled out in the COI. This determines how proceeds from a sale or liquidation are distributed among different stakeholders.

Key things to look for in the COI include the following:

• Return Multiples: Do preferred shareholders get just their original investment back (e.g., 1x), or a multiple of it (e.g., 2x or 3x) before the common sees anything?

• Seniority: Are some preferred share classes ranked higher than others in the liquidation order? Senior classes are paid out before junior ones.

• Preference: What exactly are preferred shareholders entitled to in a liquidation event? This includes the amount they’re owed (typically tied to their original investment), when they get paid (ahead of common), and any special provisions like interest or accrued dividends. Understanding the preference helps estimate how much needs to be paid out before common shareholders receive anything.

• Participation: Are preferred shares non-participating (investors choose between their preference or converting to common) or participating (investors get their preference and also share in the remaining proceeds)?

These features can dramatically affect how much, if anything, is left for common shareholders. For example, a 2x preference means preferred shareholders must receive twice their original investment before common gets paid. If the company exits for a modest amount, that could leave common shareholders—and option holders—with nothing.

Return Multiple and Seniority Example

Let’s run through an example of what a multiple of return and seniority to preferred shareholders would look like in a COI – from Globus Medical in 2012:

Here, the holders of Series E Preferred Stock were entitled to be paid first in a liquidation event (even before the other series of preferred stock), and if that happened prior to January 31, 2009, then they would get 1.5 times their PPS.

Preference and Participation

In a liquidity event, preferred stockholders generally have two options:

1. Take their liquidation preference (e.g., get paid back their investment or a multiple of it), or

2. Convert to common stock and share in the remaining proceeds pro rata with common shareholders—if this results in a higher return.

This flexibility ensures preferred shareholders always take the better deal, which often leaves less value for common shareholders. 1x non-participating preferred stock is the most common structure, granting investors the right to either receive their initial investment back (1x) or convert to common stock to share in the remaining proceeds—whichever results in a higher return to them.

In some cases, preferred stock can even be participating, meaning holders not only get their preference first but also share pro rata in the remaining proceeds with common shareholders. While this structure is less common, it does still happen (particularly in later rounds)—and it’s especially important to look out for.

You can often find these terms in the company’s COI. By reviewing the number of authorized shares and the liquidation preferences tied to each class of preferred stock, you can do some rough calculations to estimate how much each series of preferred stock would be paid before common shareholders receive anything.

Note, it’s not a perfect calculation as there usually are more authorized shares than outstanding shares.

Example: Uniswap 2022

Let’s look at a real-world example of 1x non-participating preferred – from Uniswap in 2022:

• The above tells us the authorized number of shares, including each series of preferred stock.

• Above tells us this is 1x non-participating preferred: the preferred get paid first (preference) — i.e. they get 1 times (1x) their original investment if there isn’t enough to go to everyone. If there is enough for the common and preferred, then the preferred convert into common and share in those proceeds (participation) pro rata with the other shareholders.

• Here, we can see the PPS (i.e. original issue price) of the Seed and Series A.

Now — using the information from the COI, let’s figure out how much preferred stock must be repaid before common shareholders receive any proceeds in a liquidation event. By multiplying the number of authorized shares for each preferred series by their respective PPS, we can estimate the total liquidation preference amount that takes precedence over common equity:

The total preference for preferred shareholders was around $12.7 million.

This means that, in a liquidation event, $12.7M would need be distributed to preferred shareholders first, before any money flows to common shareholders—not including any debt that might come before all equity holders. Huh…interesting…

Again, these are approximate estimates to provide a general sense of the figures involved, not precise calculations.

• Why? The number of authorized shares does not necessarily equal the number of outstanding shares. Companies often authorize slightly more shares than they immediately issue, typically maintaining a 3–5% buffer in the latest series of preferred stock. This buffer provides flexibility for future needs, such as issuing stock warrants in connection with bank loans.

3. Ask the company what percentage of the fully-diluted shares your options package represents

In addition to understanding the potential value of your option package and where you fall in the liquidation stack, it’s also helpful to ask what percentage of the company’s fully-diluted cap table your grant represents—essentially, how much of the pie you’re being offered. This gives you another lens to evaluate your equity: not just what it might be worth someday, but how much ownership you’re actually being granted relative to the whole company at the time of grant.

You may be able to find some metrics around what’s a typical percentage of the fully-diluted for someone at that role and level in another company. You can then ask around to peers or perhaps gleam some numbers on Reddit. There are also paid, firewalled metrics you can pay for if so inclined or if you have a friend in HR.

Thinking about your options package as a percentage of the cap table can be a helpful, complimentary way to evaluate its value. Note that as a company grows and their cap table increases, those percentages will likely go down over time.

F. Beware of Companies that Don’t Look Out for Employees

Anecdotally, you’ll hear about companies making decisions that hurt employees’ options under the catchall in the stock plan – that the company can basically do whatever it wants (recall above that the company can substitute or cancel options or stock under the stock plan without any compensation to you). Usually, under a merger:

• Vested options are cashed out or converted into shares of the acquirer.

• Unvested options could be accelerated (vested immediately), replaced with new unvested options in the acquirer, cashed out, or cancelled entirely.

Suffice it to say, everything depends on the deal. The company and board have ultimate leeway to make the “best decision” for shareholders.

A 2021 study from ASU reveals that in about 80% of mergers and acquisitions (M&As), employee stock options are often modified or canceled to reduce company costs, benefiting shareholders instead of employees. The study, which examined 1,277 deals between 2006 and 2014, found that canceling stock options could reduce the value of employee compensation by an average of 38.4%, leading to a 3-4% increase in market value for the target companies. While this cost-cutting benefits shareholders, particularly in cases where employee losses are high, it can negatively affect employees who lose potential future gains from their stock options.

You should monitor what is going on at your company or risk being left behind. Below are a few examples of companies who were willing to throw employees under the bus:

• In 2011, Skype, under Silver Lake's ownership, fired executives before its sale to Microsoft to avoid paying out their vested options, using complex legal clauses to invalidate them. Link

• In 2017, Juno, a ride-hailing company, was acquired by Gett for $200 million, but cancelled its restricted stock unit program for drivers instead offering cash bonuses. Link

• Most recently, OpenAI threatened to take back stock options from former employees if they didn't sign a non-disclosure agreement. The company has since apologized and promised not to do this in the future. Link

You can see why negotiating acceleration is so important because it can protect against these types of incidents.

G. Action Items - What Should I Ask For?

Now that you understand how the sausage is made, hopefully that empowers you to stand up for your own interests. If you don’t ask, you don’t get. It is harder to negotiate for more compensation once you start working for a company. It’s easier at this point, since the company wants to land you. Ask these questions to evaluate your option plan and what you should negotiate for:

• Can I get a copy of the stock plan/form of option grant and most recent certificate of incorporation? If I can’t get it until after I onboard, can you walk me through the key terms?

• What is the vesting schedule?

• Can I get an early exercise option?

• When do the options expire?

• What happens if I leave the company?

• What are the acceleration terms of my shares?

• What’s the 409A? When was it? Is the strike price of my option the current 409A value?

• What percentage of the fully-diluted shares are my shares?

• Are there any transfer restrictions?

• What’s the company’s discretion to cancel shares and options?

• Does the company have employees sign a non-disclosure agreement when they leave?

Take the time to understand what you’re being offered and seek professional advice if needed. Your equity could be worth a significant amount in the future, but it’s essential to ensure that you’re protected and that the terms are favorable. It may be worth paying a lawyer and/or accountant to help you assess your options (pun intended) to avoid long-term bigger dollar value pains.

Share

Subscribe now

Resources:

• Rev. Rul. 2007-19, https://www.irs.gov/irb/2007-19_IRB.

• Mischa Vaughn, What Happens to Stock when a Company Is Bought?, Carta (June 22, 2022), https://carta.com/blog/equity-stock-company-acquired-acquisition/.

• Kristoffer Warren, 409A Evaluation, Carta (Aug. 9, 2024), https://carta.com/learn/startups/equity-management/409a-valuation/.

• Fully Diluted Shares, CoolyGo (Apr. 28, 2021), https://www.cooleygo.com/glossary/fully-diluted-shares/.

• Chris Arnold, 11 Questions to Ask When Negotiating a Job Offer Including Stock Options, SecFi (July 4, 2023), https://secfi.com/learn/how-to-negotiate-a-job-offer-stock-options.

• Stock Vesting, Carta (Mar. 9, 2024), https://carta.com/learn/equity/stock-options/vesting/.

• Adam Lewis, Stock Options, Carta (Apr. 4, 2024),https://carta.com/learn/equity/stock-options/.

• Acceleration, CooleyGo (May 10, 2021), https://www.cooleygo.com/glossary/acceleration/.

• Sean Dugan, Early Exercise of Stock Options, Carta (Apr. 4, 2023), https://carta.com/learn/equity/stock-options/exercising/early-exercise/.

• Laura Moreno, 83(b) Elections, Carta (Apr. 15, 2024), https://carta.com/learn/equity/stock-options/taxes/83b-election/.

• Should I Contribute to ESPP? An Analysis of Pros and Cons for Employees with Employee Stock Purchase Plans, Upstock, https://www.upstock.io/post/should-i-contribute-to-espp-an-analysis-of-pros-and-cons-for-employees-with-employee-stock-purchase-plans.

• Vieje Piauwasdy, Avoid the 7 Most Common Employee Stock Option Mistakes, Carta (July 4, 2023), https://secfi.com/learn/avoid-the-7-most-common-employee-stock-option-mistakes.

• Jane Larson, Employee Stock Options Suffer in Most Merger Deals, Ariz. State Univ. W. P. Carey News (July 28, 2021), https://news.wpcarey.asu.edu/20210728-employee-stock-options-suffer-most-merger-deals.

• Kia Kokalitcheva, Juno, the ‘Anti-Uber’ Startup, Sells to Gett for $200 Million, Axios (Apr. 16, 2017), https://www.axios.com/2017/12/15/juno-the-anti-uber-startup-sells-to-gett-for-200-million-1513301874.

• Mary Russell, The Good Stuff – Continuation Plans – How to Avoid the Juny Drivers’ Fate of Cancelled RSUs in a $200 Million Acquisition, Stock Option Counsel (Apr. 27, 2017), https://www.stockoptioncounsel.com/blog/startup-stock-plan-gotcha-cancellation-of-unvested-equity-0-for-rsus-in-junos-200-million-acquisition/2017/4/27.

[Special thanks to Chris Ahsing, Bryan Edelman, Naveen Pai, Sam Silverberg, and Zack Skelly for their review.]

Images: All original images are AI-generated with using a combination of Dall-E, Firefly, DreamStudio and Pixlr.

Disclaimer: This post is for general information purposes only. It does not constitute legal advice. This post reflects the current opinions of the author(s). The opinions reflected herein are subject to change without being updated.

Here at The LawVerse, we don’t just take immense pride in what we write. We also meticulously craft the images you see in our articles. We’ll spend sometimes hours to get one image perfect through a mix of AI-generation and our own editing.

And, people have noticed. And by people, I mean my family member who has enlisted me to help them pull together images for a pregnancy-related app.

As we were building the app’s mise-en-scène, we debated whether to use stock photos (i.e. actual photographs) or AI-generated images (synthetic media). For a company on a budget, some of the pricier stock photo options were just out of reach. So, I turned to AI. The results were interesting.

I wanted to pass along what I learned through this process to help other startups who are trying to decide between stock photos and AI-generated images.

TLDR: you have to read the license to know what you are buying.

I. Why Choose AI and Not Real Photos?

AI-generated images can be a more attractive option than stock images for a few reasons.

• Customization: AI image generators let users custom-make images to fit a prompt within seconds. To get the perfect image, users can keep re-prompting the algorithm or edit the image later if they need to.

• Uniformity: AI image generators can keep the look consistent between the images, whereas stock photos may have different tones, lighting, or feel to them.

• Price: A subscription to an AI image generator can be much more cost-effective than buying licenses to many stock photos. Generating multiple images may be free up to a certain number of outputs or may require a subscription. Because I needed a lot of images, the cost for AI seemed more of a bargain.

• Ownership Rights: You can own the rights to use the output (i.e. images) without any restrictions....well, depends on the terms of use and the law in your country. Will discuss this more below.

II. AI-Generated Images: The Good, the Bad, the Too Perfect

Is this too good to be true? AI image generators have a few common pitfalls. Some are fixable. Others… not so much.

Let’s look at what I was trying to generate. Because this app is meant to appeal to a global audience, I tried to generate images showcasing diversity so that everyone could see themselves in the app. My prompting raised the following issues with using AI:

A. Homogeneity and Bias:

Just as humans have bias, so does the LLM creating the images. AI’s default person in an image will just look like the below: young, thin, pretty, and Caucasian. These default people are often too perfect–to the point of not looking human–and attractive by default.

Just as humans are biased, so too was the LLM creating the images. Now, I prompted it to reflect people with specific ethnicities to force it to be diverse, and the results were mixed.

Example Results - Good: I could get the result with some prompting.

Example Results - Bad:

Example Results - Bafflingly Bad:

After a few attempts, I finally realized that this is mixing an Orthodox man’s hat with the Orthodox woman’s outfit into something that looks like a cross between Guinan from Star Trek and Barbara Streisand from Yentil…..Oy, Captain.

I gave up trying to reprompt. Took the last image to Adobe Firefly to delete the hat thing and put on a winter beanie.

B. Weird Anomalies:

Besides bias, AI infamously generates weird things like extra limbs or random objects. Sometimes, everyone looks like they are wearing the same uniform, and the same person may appear in one image

III. What’s Causing These Odd AI Outputs?

Why do we get such strange results?

First, let’s look at what AI image generators do. Large language models (LLMs) like ChatGPT are complex algorithms designed to predict. In text, they act like fancy autocorrect machines: using the data they’ve been shown in the past (“trained” on) and what you give them, they play fill-in-the-blank to predict what comes next. AI image generators work the same way, using the data they’ve been given to make informed predictions about what you want to see.

While LLMs’ complexity makes it hard to pinpoint exactly why they produce these strange images, experts have a few theories:

• Training Data: LLMs only have the data we give them. If they’re trained on biased or outdated information, they’ll spit that bias back up.

• User Data: Besides training data, users’ prompts shape LLMs’ answers. A biased prompt creates a biased answer. To see this in action, look at Microsoft Bing chatbot, which produced less weird results when Microsoft limited how long users could chat with it.

• Dumb Computers: Unlike you and I, LLMs have no cultural or artistic knowledge. This means they can’t identify and correct their biased results unless their creators or users force them to. They also can’t use common sense or artistic principles to add texture to too-perfect skin, count how many fingers are on a hand, or stop hair from melting into the fabric of someone’s shirt.

IV. Do I Really Own the AI Output? Is There a Catch?

It feels too easy…..Let’s take a look at what ChatGBT’s terms of use say:

Ownership Means Commercial Usage Rights. The terms state that you own the images with certain limits and conditions. Ownership rights mean the right to use, modify, reprint, sell, merchandise, and distribute the images as you want – whether you generate the image for free or paid credit. [This wasn’t always the case. For example, with Dall-E 2, OpenAI owned the output.].

Note, this doesn’t necessarily mean you own the copyright.

Copyright (No Ownership in US). In the US, you can’t copyright AI-generated images because only works made by humans can be copyrighted (for more on this - please see this prior post). Having a copyright means you have the exclusive right to use or stop anyone from using your work (though there are some exceptions and the right doesn’t last forever).

Note, the American tradition isn’t followed in other countries:

• European Union (Ownership Is Possible): EU law doesn’t tell us much about the ownership of AI-generated works, so it’s really individual member states that must determine this question. Member states like Germany and France demand significant human input for copyright, excluding purely automated works.

• UK (Ownership Available): UK law requires that a work be the "author's own intellectual creation" showing a "personal touch." Under the Copyright Designs and Patents Act 1988 (CDPA), the UK extends copyright protection to "computer-generated works,” including those created by AI. The author is the person who made the necessary arrangements. The individual who made the “arrangements necessary for the creation of the work” would be considered the author of the work (though unclear who that person is making “necessary arrangements”).

• US (Not Really): What about if you really rework it…..are LawVerse images copyrightable?

  • In February 2023, the US Copyright Office awarded copyright protection to Kristina Kashtanova for the written content and the composite layout of text and images in her comic book "Zarya of the Dawn." However, the individual images produced by the AI tool Midjourney were not copyrighted because their unpredictable generation means the creator does not have enough control over their final appearance. Despite Kashtanova's significant involvement and creative input, the images alone were not eligible for copyright protection.

  • Most recently, in a January 2025 report from the U.S. Copyright Office, inputting prompts into generative AI, without more substantial involvement, does not grant the user copyright over the output, stressing that true authorship involves active control over the work’s expressive elements.

  • So for the LawVerse images, probably depends on how much I rework them….Ahem, I do!

Exclusivity. Because there is no copyright protection for an AI image, you don’t have any exclusivity rights to the output. That means that any AI-generated content is in the public domain (i.e., it’s not protected by IP laws….the public owns the works). So, while AI tools may promise you own the image, what they really mean is that you can use it (but so can everyone else). The fact that the LLM generated an image for you doesn’t mean you have exclusive rights. AI companies could also generate the same or similar output for someone else to use, and there’s nothing you can do to stop that.

Rights OpenAI Retains. Per the terms of use, OpenAI retains the rights to the model and use the generated content to improve its services. They may use your prompts and the resulting outputs for research, development, and improvement of their models and services. Additionally, OpenAI may employ the generated content for promotional purposes and marketing. They also reserve the right to monitor your usage to ensure compliance with their terms of service and content policies.

V. Can I Generate Anything I Want?

No, you have to comply with the license of the AI vendor.

For example, if you violate ChatGBT’s polices, OpenAI may suspend or terminate your access to its services, and you may be required to delete any content that violates their policies. Repeated or severe violations could include legal consequences, depending on the nature of the violation. Additionally, your account may be flagged or restricted from future use of OpenAI's tools.

OpenAI can also refuse to follow what it deems “harmful instructions…to produce harmful content.” Its universal policies require users to comply with laws, avoid causing harm, not misuse service outputs, and respect safety safeguards. This is known as content filtering, which effectively puts guardrails up before you can input anything into the model.

Specifically, the DALL-E 2 Content Policy prohibits creating, uploading, or sharing images that are not G-rated or could cause harm, including hate speech, harassment, violence, self-harm, sexual content, shocking subjects, illegal activities, deception, political content, health-related misinformation, and spam. Users must not mislead others about AI involvement and must respect the rights of others by not using images of people without consent, images without appropriate usage rights, or creating images of public figures.

VI. Do I Really Own the Output?

There are many cases pending before the US courts as to whether using copyrighted works without permission to train AI models that generate images are in violation of the original authors' works. If the algo is trained on images in violation of that creator’s copyright, AI companies promising that you own the image (or really the commercial use of that image) may be an empty promise. You could see creators trying to enforce their rights against AI users exploiting derivative works.

We just don’t know how the courts will come down on this. You will have to do your own risk/reward analysis here. Note, if you are trying to copy or imitate the style of another creator for your image, then that’s likely an increased risk.

VII. How Do My Rights under AI Compare to Those of Stock Photos?

Stock photos are professionally taken photographs available for licensing. The rights you get by using them are pretty similar to those of AI-generated images. Some of the most well-known photo companies include Getty Images, Shutterstock, and Adobe.

Ownership Means Commercial Usage Rights: When you purchase stock photos, you typically acquire a license that grants you the right to use the images under specific terms and conditions set by the stock photo provider. These rights generally include the ability to use, modify, reproduce, and distribute the images for commercial purposes. This does not mean you own the copyright to the image.

Copyright: Because photographs are taken by humans, they are eligible for copyright protection. Note that the copyright is usually held by the photographer or the stock photo agency, not by the customer of the stock photo company. Customers usually purchase a license to use the image, not the copyright. This means that while you can use the images according to the terms of the license, the copyright owner retains the exclusive right to enforce copyright protections against unauthorized use.

Exclusivity: Because photographs can be copyrighted, whoever owns the copyright can control its use and prevent others from using it. When a consumer licenses an image, you are likely obtaining the following types of licenses:

• Royalty-free licenses: You typically pay a one-time fee to use an image in various ways without paying any additional royalties per use. The license is non-exclusive, meaning the stock photo company can license the image out to someone else.

• Rights-managed licenses: Fees are based on a specific use, duration, or geographic region. Sometimes, this license may be exclusive for a fee.

• Exclusive licenses: The customer can obtain the right to be the exclusive user of the image (rarer in practice because it’s much more expensive).

• Duration: Stock photo licenses can vary significantly in duration depending on the type of license and the terms agreed upon. It could be into perpetuity, or it could be a few years.

Rights Retained by the Stock Photo Company: Stock photo providers retain certain rights over the images, including the ability to resell the same image to other clients (unless an exclusive license is purchased). They also set the terms and conditions of usage, which can include restrictions on how and where the images can be used, such as limitations on print runs, geographic regions, and types of media.

As an example, Shutterstock offers various types of licenses, including:

• standard licenses are royalty-free, allowing the same image to be used by multiple customers;

• enhanced licenses with broader usage rights but still non-exclusive;

• editorial licenses for non-commercial uses (i.e., news articles and educational materials); and

• premier licenses allow “sensitive use rights,” unlimited indemnification, third-party rights transferability, use in merchandise and templates, and high-resolution unwatermarked comps.

VIII. Bottom Line

IX. Extra Credit: Are NFTs like Stock Photos or AI-Generated Images?

An NFT gives the owner a unique digital certificate of authenticity, which bestows certain usage rights to the owner (sometimes to commercialize the underlying content). The copyright is retained by the original creator of the work unless the license itself transfers it. The rights should exist so long as you own the NFT.

When you buy a non-fungible token (NFT), it’s more akin to buying a license to a stock photo (assuming the NFT was not generated by AI). NFT projects are all over the place with how their licenses work (sometimes there is none).

So, NFTs are somewhere between an AI-generated image and stock photos.

Share

Subscribe now

[Special thanks to Jane Perov and Sam Silverberg.]

Resources:

• https://www.cooley.com/news/insight/2024/2024-01-29-copyright-ownership-of-generative-ai-outputs-varies-around-the-world

• https://www.reuters.com/legal/ai-generated-art-cannot-receive-copyrights-us-court-says-2023-08-21/

• https://www.novagraaf.com/en/insights/artificial-intelligence-and-copyright-who-owns-ai-generated-images

• https://www.forbes.com/sites/forbesbusinesscouncil/2024/04/16/who-really-owns-ai-art-what-businesses-need-to-know-about-generative-ai-and-intellectual-ownership/

• https://venturebeat.com/ai/who-owns-dall-e-images-legal-ai-experts-weigh-in/

• https://hbr.org/2023/04/generative-ai-has-an-intellectual-property-problem

• https://www.linkedin.com/pulse/who-owns-ai-generated-content-understanding-ownership-jha-pmp--bedoc/

• https://www.fairlicensing.com/en/blog/ai-generated-images-and-copyright#:~:text=Ultimately%2C%20the%20specific%20copyright%20laws,the%20necessary%20permissions%20and%20licenses.

• https://www.ropesgray.com/en/insights/alerts/2023/03/can-works-created-with-ai-be-copyrighted-copyright-office-issues-formal-guidance

• https://ipwatchdog.com/2023/12/12/copyright-office-affirms-fourth-refusal-register-generative-ai-work/id=170564/

• https://openai.com/policies/usage-policies/

• https://help.openai.com/en/articles/6338764-are-there-any-restrictions-to-how-i-can-use-dall-e-2-is-there-a-content-policy

• https://help.openai.com/en/articles/6425277-can-i-sell-images-i-create-with-dall-e

• Naruto v. Slater: https://law.justia.com/cases/federal/appellate-courts/ca9/16-15469/16-15469-2018-04-23.html

• Thaler v. Perlmutter: https://ecf.dcd.uscourts.gov/cgi-bin/show_public_doc?2022cv1564-24

• https://www.findlaw.com/legalblogs/legally-weird/who-owns-dall-e-images/

• https://www.nytimes.com/2023/02/26/technology/ai-chatbot-information-truth.html

• https://www.snexplores.org/article/ai-image-generators-bias#:~:text=Let's%20learn%20about%20bias&text=Bots%20can't%20know%20anything,images%20on%20which%20they%20trained.

• https://medium.com/@keithkisser/why-does-all-ai-art-look-like-that-f74e2a9e1c87

• https://www.thelawverse.com/p/so-what-if-my-ai-bot-wrote-this-paper-499

• https://support.shutterstock.com/s/article/what-is-shutterstocks-premier-license?language=en_US

• https://support.submit.shutterstock.com/s/article/What-is-a-Sensitive-Use-license?language=en_US

• https://fairuse.stanford.edu/overview/public-domain/welcome/#:~:text=The%20term%20%E2%80%9Cpublic%20domain%E2%80%9D%20refers,one%20can%20ever%20own%20it.

• https://openai.com/policies/row-terms-of-use/

• https://help.openai.com/en/collections/3643409-dall-e-content-policy

Images: All original images are AI-generated with using a combination of Dall-E, Firefly, DreamStudio and Pixlr.

Disclaimer: This post is for general information purposes only. It does not constitute legal advice. This post reflects the current opinions of the author(s) only. The opinions reflected herein are subject to change without being updated.

As happens with every election cycle, some are left cheering, some left crying, and some not really caring either way. Well, look on the bright side. As the great pop rock group Semisonic once said, “Every new beginning comes from some other beginning’s end, yeah.”

The new Trump administration is expected to trigger a legal reset and systemic shift in policy around innovative industries. However, regulating sectors such as blockchain and AI is hard. How does one even begin to write laws for new industries without stifling their growth while at the same protecting consumers?

Enter: regulatory innovation!

Now, you may say, “I thought the law was designed to be slow-moving and therefore, is inherently antiquated?” That presumption is wrong. In fact, we have a legal tradition of innovation through many different devices, such as regulatory sandboxes (aka sandboxes), no action letters, and safe harbors. These tools create flexibility in old laws and regulations so the law can adapt to new products and services.

Such legal innovation serves as a crucial bridge, offering a dynamic way to allow regulations to keep up with technological advances. This is particularly pertinent in areas like digital assets. Regulatory innovation offers flexibility allowing laws and rules to evolve alongside technological progress. This gives emerging industries clear and actionable guidelines, thereby minimizing the risks of stifling innovation while simultaneously protecting consumers. By embracing regulatory innovation, we can address the inherent challenges of regulating new and fast-changing industries effectively.

One powerful tool is the regulatory sandbox—a policy framework for implementing regulatory innovation while maintaining oversight. However, current regulatory sandboxes are far from perfect for innovative technologies. The ideal regulatory sandbox should take aspects from other similar policy tools like safe harbors and no action letters to offer a more comprehensive approach.

In this article, we’ll explore how regulatory innovation tools like regulatory sandboxes, no action letters, and safe harbors can effectively regulate innovative industries such as blockchain and AI by offering a dynamic framework that adapts to technological advances while balancing growth and consumer protection.

As crypto technologies revolutionize financial systems through decentralized networks and digital assets, traditional regulatory frameworks often fall short. Policymakers can address this by reforming laws and regulations to incorporate the flexibility of regulatory sandboxes, the broad applicability of safe harbors, and the tailored clarity of no action letters. This integrated framework would support sustainable innovation, ensure regulatory clarity, and position the US as a global leader in the crypto and AI sectors. Finally, we’ll propose a blueprint “Sustainable Sandbox” for the crypto industry.

Roadmap:

I. What Are Regulations? How Are They Different from Laws?
     a. Regulatory Sandboxes
     b. No Action Letters
     c. Safe Harbors

II. Regulatory Sandboxes in Practice
     a. Common Issues with Regulatory Sandboxes

III. Designing the Ideal Sandbox
     a. Our Recommendation for Redesigning the Sandbox for Digital Assets: The Sustainable Sandbox
     b. How Our Sustainable Sandbox Would Align With “FIT 21”
     c. Why There Is a Need for a Sustainable Sandbox Program Now

IV. Final Thoughts

V. Resources

I. What Are Regulations? How Are They Different from Laws?

Let’s begin with understanding what regulations really are.

Congress passes a law and delegates authority to an agency to carry out that law, including by promulgating new rules (the regulations). Think of it as your boss who gives you a task but doesn’t tell you how to get it done—you have to figure it out. Same thing here. In general, the government uses three different approaches to regulate industries:

1. A command and control regulation is when the government dictates a specific policy goal and controls the way to achieve it (like a micromanager). For instance, in the context of vehicle safety standards, the government may dictate the exact dimensions of a testing dummy required to meet car testing safety requirements.

2. Performance-based regulation, on the other hand, is when the government sets a standard but allows flexibility in how to meet its standard. As an illustration, a regulation could set a car emission threshold for reducing CO2 emissions but not dictate the emission-reducing technology used to achieve that goal.

3. A management-based regulation is when the government sets a broad policy goal but allows the regulated entity to set its own standards and means to achieve that goal. For example, a regulation may require offshore drilling companies to develop a program designed to reduce environmental hazards like oil spills.

Despite what one may think, many legitimate (and particularly large) businesses generally like regulations because they reduce competition from new entrants. Indeed, becoming regulated is one of the oldest tricks in the book. By building a regulatory “moat” around a business model, regulated incumbents raise the cost of entry to their respective industries. While the main purposes of regulations are to create fair markets and protect the public, a key outcome is that not all businesses and activities are created equally, and you don’t want to regulate our startups and emerging companies and projects out of business.

Now, let’s explore the various tools the law has for regulatory innovation.

a. Regulatory Sandboxes

A regulatory sandbox is a framework set up by a regulatory authority that allows startups and other businesses to conduct live experiments in a controlled environment under the regulator’s supervision. Businesses apply to the sandbox to seek waivers for certain laws that, while technically applicable, may not align with their innovative activities. The goal is to enable experimentation with new products and services outside the strict confines of traditional regulations—without eliminating oversight..

Instead, the regulatory sandbox provides a controlled environment where businesses can collaborate with regulators to test their ideas, while still adhering to certain baseline standards to ensure consumer protection and financial stability. This collaboration allows both parties to identify which regulations may need to be adapted or clarified, balancing innovation with accountability.

A regulatory sandbox serves as a tool for identifying outdated regulations and accelerating innovation. By allowing businesses to test their ideas under controlled conditions, it ensures oversight remains in place to protect consumers. Entrepreneurs benefit from a regulatory waiver lasting two to three years, enabling them to innovate freely. In return, the sandbox generates critical data to assess whether the waived regulations should be reformed or repealed. Without such a mechanism, unnecessary or impractical regulations would remain in force, stifling progress and innovation.

The UK, along with several US states, have adopted financial technology sandboxes. The UK’s Financial Conduct Authority’s Regulatory Sandbox has seen greater success, not just in participation but also in fostering innovation and collaboration, attracting a diverse range of entities, from large law firms to cryptocurrency projects, and enabling them to test new ideas within a structured regulatory framework.

b. No Action Letters

A no action letter is a written communication from a regulator to a company or individual who has asked the regulator whether a specific product or service implicates any regulations. If a company receives a no action letter, it’s an indication that the agency will not take enforcement action against the requester based on the facts described in a specific request. The letters are tailored to a very specific activity and may come with conditions.

While no action letters do not have the force of law and are not binding on the regulatory body, they can provide valuable guidance on regulatory compliance and are often used in areas of emerging business practices or where regulations may be ambiguous. However, they are also revocable at the discretion of the agency, which can leave a business scrambling to comply with an agency’s new regulatory stance. As an example, the state of California issued several no action letters concerning the registration requirements of cryptocurrency businesses that could have arguably qualified as money transmitters and thus been required to comply with burdensome regulatory requirements.

One recent letter described how a virtual currency exchange that purchases and sells virtual currencies directly with customers is not engaging in money transmission. With that no action letter in hand, the business could operate with a clearer understanding of its legal obligations and reduced risk of regulatory action. These letters, however, are very fact-specific, analyzing each discrete business model.

c. Safe Harbors

Lastly, a safe harbor is a law or regulation that states that if you perform certain actions, you are guaranteed not to be breaking the law. This is particularly useful in complex regulatory areas where the risk of non-compliance can be high and the rules may be open to interpretation. Unlike regulatory sandboxes, safe harbors are automatic (not needing an application and approval). Unlike no action letters, safe harbors have pre-defined criteria that must be met to qualify for the safe harbor.

One prominent safe harbor is Regulation D (“Reg D”), which establishes various requirements under which securities issuers can offer and sell securities without needing to register them with the Securities and Exchange Commission (“SEC”).

By adhering to these guidelines, issuers can ensure that they are in compliance with SEC regulations governing securities registration, protecting them from potential enforcement actions due to non-compliance. This safe harbor is especially important in the securities market because it provides a clear way for issuers to meet complex legal and regulatory expectations and reduce the significant risks of non-compliance.

It’s important to note that these definitions can be fluid, and one tool for regulatory innovation can resemble another. Ultimately, the effectiveness of the design is more important than the terminology used to describe it. Rather, to design the ideal regulatory sandbox, one must take the best parts from these other policy tools.

II. Regulatory Sandboxes in Practice

While current regulatory sandboxes are specifically designed for regulatory innovation, they still lag behind no action letters and safe harbors in terms of efficacy and prevalence.

a. Common Issues with Regulatory Sandboxes

Several factors hinder the effective use of regulatory sandboxes, including a (1) narrow scope, (2) limited duration, and (3) high regulatory costs. However, these issues could actually be mitigated by incorporating elements from the safe harbors and no action letters.

(1) Scope: Regulatory sandboxes apply only to entities that meet strict conditions and are approved, unlike safe harbors, which automatically exempt all compliant entities. Adopting a more permissive model that would allow for more participants to enter the program, similar to safe harbors, could eliminate burdensome application processes and broaden accessibility.

(2) Duration: Regulatory sandboxes often have limited or uncertain timelines, requiring recertification. In contrast, safe harbors remain effective until enabling laws are amended. Regulatory sandboxes should offer longer or indefinite durations to provide businesses with greater stability and certainty.

(3) Cost: Regulatory sandboxes are resource-intensive for regulators, while safe harbors are cost-efficient, applying automatically without ongoing oversight. A streamlined, safe-harbor-like approach could significantly reduce costs.

In essence, the “ideal” regulatory sandbox should functionally resemble a more engaged safe harbor!

III. Designing the Ideal Regulatory Sandbox

Regulatory sandboxes are not common in the US. Admittedly, no federal regulator currently has a viable regulatory sandbox program for innovative industries, and the few state sandboxes are still not fit for sustainable regulatory innovation, especially in the digital assets industry.

We propose a new “Sustainable Sandbox” for the crypto industry that fast-tracks supervised innovation of digital assets.

a. Our Recommendation for Redesigning the Sandbox for Digital Assets: The “Sustainable Sandbox”

Let’s roll up our sleeves and dive into the practical work of designing the ideal regulatory sandbox. This enhanced regulatory sandbox, a “Sustainable Sandbox,” should integrate the best features of existing frameworks while significantly adapting to the dynamic nature of the cryptocurrency sector.

Phase 1: Sandbox Enrollment

• Simplified Automatic Enrollment: Registration for sandbox participation should be streamlined to a simplified checkbox form. The focus should be on fulfilling the basic requirements in the form and basic compliance (e.g., appointment of a chief compliance officer) rather than substantive evaluation of the underlying business model or technology.

• Management-Based Approach to Design: For businesses that don’t fit the traditional compliance structures in the checkbox form—such as decentralized exchanges or decentralized autonomous organizations (DAOs)—an alternative management-based approach would allow participants to develop their own compliance frameworks. Regulators should set broad policy goals, such as transparency or fraud prevention, and participants can then propose their own standards and methods to meet those goals, subject to regulatory approval. This flexibility accommodates innovative and decentralized models while ensuring oversight. By focusing on outcomes and collaborating with industry stakeholders, regulators can address technological knowledge gaps while promoting effective compliance.

Phase 2: Sandbox Oversight

• Exemption During the Sandbox Period: To encourage participation and avoid deterring projects, participants should operate under a presumption of exemption from certain regulations, allowing them to innovate without the burden of potentially inapplicable laws. Clear guidelines upfront can alleviate concerns, though this exemption should not preclude enforcement of fraud or UDAP/UDAAP claims (i.e. unfair, deceptive or abusive business practices that harm consumers), ensuring protections against deceptive practices remain intact.

• Annual Reporting for Ongoing Oversight: Participants should be required to submit annual reports detailing specific operational aspects, such as cybersecurity incidents. This will ensure ongoing oversight and responsiveness to emerging risks without stifling innovation. It also allows for the collection of metrics to measure the effectiveness of the sandbox.

Phase 3: Sandbox Exit

• Transition to a Safe Harbor: The regulator in charge of the sandbox should, if it is able to, use the information the sandbox provides to create a tailored, sensible safe harbor once the sandbox ends. This would provide a stable, long-term framework for continued operations while ensuring compliance with the newly established rules.

• Issuance of No-Action Letters as a Contingency: If the regulatory framework remains uncertain at the end of the sandbox, participants should alternatively be issued no-action letters. These letters would provide assurance that the regulator will not pursue enforcement actions against entities that continue operations under the terms established during the sandbox. This approach offers a more permanent and predictable pathway for participants, making the initial investment in the sandbox worthwhile.

By adopting these parameters, the next US crypto regulatory sandbox could serve as a powerful tool for fostering innovation and growth in the cryptocurrency sector. This approach would align regulatory frameworks with the rapid pace of technological advancements, ensuring that the US remains at the forefront of the crypto industry while maintaining robust consumer and market protections.

b. How Our Sustainable Sandbox Would Align With “FIT 21”

The Sustainable Sandbox offers a pathway to address one of the most contentious debates in blockchain regulation: defining and measuring decentralization. Decentralization, a cornerstone of blockchain technology, promises enhanced security and privacy through distributed networks, but its regulation has proven divisive. The decentralization test outlined in the current draft of the Financial Industry Transparency for the 21st Century Act (“FIT 21”)–the leading legislative proposal aiming to regulate much of the crypto industry–has sparked widespread debate within the sector over what truly constitutes decentralization and how it should be regulated. This discord among industry players poses a significant challenge: if the crypto industry itself struggles to reach a consensus, how can lawmakers be expected to create effective regulations? That’s where the “Sustainable Sandbox” comes into play.

The Sustainable Sandbox would act as a bridge between innovation and regulation, offering a structured environment to address the decentralization debate while fostering experimentation and data-driven policymaking. Participants in the regulatory sandbox would be able to test their models of decentralization under real-world conditions without the fear of immediate regulatory enforcement. This would allow both the industry and regulators to collaboratively identify practical frameworks that balance innovation with compliance. Participants would gain the opportunity to refine their decentralized technologies while providing regulators with data-driven insights.

The Sustainable Sandbox would use a management-based approach to ensure flexibility and inclusivity for a wide range of participants. While a standard check-box filing system might suit many businesses, the management-based model would accommodate more innovative or decentralized entities that fall outside traditional regulatory frameworks. For example, a decentralized exchange without a conventional corporate structure—such as a c-suite or chief compliance officer—would not align well with standard regulatory processes. Instead, the management-based approach would allow the regulatory sandbox regulator to set high-level policy goals, like promoting transparency, mitigating risks, and ensuring consumer protections, while participants design their own standards and methods to achieve these objectives, subject to regulatory review and approval.

This approach ensures that the regulatory sandbox supports diverse business models, particularly those leveraging decentralized technologies, while maintaining oversight aligned with broader policy objectives. The Sustainable Sandbox would serve as an experimental platform to:

1. Define and Measure Decentralization: Develop clear, industry-supported metrics that define what decentralization means in various contexts within the crypto space. This includes tailoring distinct tests to assess decentralization across different market participants, ensuring that the criteria are relevant and appropriately stringent for each sector, whether they be layer 1s, applications, or DAOs.

2. Assess Regulatory Fit: Evaluate how different levels of decentralization interact with existing legal frameworks to determine if adjustments are necessary.

3. Influence Policy Development: Provide lawmakers with concrete data and insights into how decentralized technologies operate, supporting more informed legislation and regulation.

By adopting this management-based approach, the Sustainable Sandbox creates a thoughtful and iterative pathway to regulation, avoiding rushed or premature decentralization frameworks that could harm innovation or market stability. It ensures that both regulators and the industry are equipped to address the evolving challenges of decentralization and digital asset innovation.

In the dynamic landscape of blockchain and cryptocurrency, the importance of regulatory timing cannot be overstated. As we face the prospect of new administrations potentially reshaping the regulatory environment, there is a significant opportunity to influence the trajectory of policy development. However, this window should not compel us to rush into premature regulatory frameworks that could have long-term negative impacts on innovation and market stability.

c. Why There Is a Need for a Sustainable Sandbox Program Now

The need for regulatory innovation stems from two incentives: a “carrot” for businesses and a “stick” for regulators.

Innovative industries like blockchain and AI struggle with outdated legal frameworks that fail to address novel challenges. These industries seek regulatory certainty—a “carrot” that fosters innovation and compliance by providing clear rules. Tools like the Sustainable Sandbox allow companies to grow within legal boundaries while building accountability and trust. At the state level, stringent agreements with regulators show how structured frameworks can balance innovation and oversight.

Meanwhile, regulators face a “stick” from the Supreme Court’s decision in Loper Bright Enterprises v. Raimondo (2024) (see prior article), which limits courts' deference to agencies’ interpretations of their own authority. This decision shifts power toward highly regulated industries, granting them greater influence over how they are governed. Courts now independently assess an agency’s authority, reducing reliance on agency interpretations.

The power shift between agencies and industry requires agencies to adjust their practices and creates opportunities for more collaborative governance between agencies and industries. The Sustainable Sandbox is ideal for this task. Now is the time to implement the Sustainable Sandbox collaboratively, adapting to the new regulatory landscape.

IV. Final Thoughts

As technology advances, regulations must evolve to keep pace. Sandboxed environments provide controlled spaces for regulators to test ideas, gather data, and refine governance strategies for new technologies. Our Sustainable Sandbox proposal a forward-thinking framework, resilient to rapid innovation and designed to adapt alongside technological progress.

Share

Subscribe now

[Special thanks to Bryan Edelman, Jane Perov, Sam Reynolds, and Sam Silverberg.]

V. Resources

• Joshua Durham, REGULATORY SANDBOXES ENABLE PRAGMATIC BLOCKCHAIN REGULATION, 18 Wash. J. L. Tech. & Arts (2023) - available at https://digitalcommons.law.uw.edu/wjlta/vol18/iss1/3

• https://www.unsgsa.org/sites/default/files/resources-files/2020-09/Fintech_Briefing_Paper_Regulatory_Sandboxes.pdf

• https://pacscenter.stanford.edu/a-few-thoughts-on-regulatory-sandboxes/#:~:text=Information%20sharing%20and%20the%20ability,draw%20lessons%20from%20the%20sandbox.

• https://documents1.worldbank.org/curated/en/126281625136122935/pdf/How-to-Build-a-Regulatory-Sandbox-A-Practical-Guide-for-Policy-Makers.pdf

• https://digitalcommons.wcl.american.edu/cgi/viewcontent.cgi?article=1714&context=facsch_lawrev&mobileformat=false

• https://pacscenter.stanford.edu/a-few-thoughts-on-regulatory-sandboxes/

• https://frontierinstitute.org/success-in-the-sandbox-what-montana-can-learn-from-utah-and-arizonas-regulatory-sandboxes/

• https://blogs.worldbank.org/en/psd/four-years-and-counting-what-weve-learned-regulatory-sandboxes

• https://www.usatoday.com/story/news/politics/elections/2024/07/01/average-age-us-congress/74268869007/

• https://www.theregreview.org/2016/04/05/pritchett-types-of-regulation/

• https://financialservices.house.gov/news/documentsingle.aspx?DocumentID=409277

• https://www.fca.org.uk/firms/innovation/regulatory-sandbox

• https://dfpi.ca.gov/wp-content/uploads/sites/337/2019/12/Cryptocurrency-Exchange-Platform-%E2%80%93-10-28-19.pdf

• https://www.sec.gov/newsroom/speeches-statements/peirce-boe-fca-comment-05302024

• https://www.sec.gov/newsroom/speeches-statements/peirce-statement-token-safe-harbor-proposal-20

• https://www.ecfr.gov/current/title-17/chapter-II/part-230/subject-group-ECFR6e651a4c86c0174/section-230.506

• See generally 49 CFR Part 572.

• See generally 30 CFR Part 250 Subpart S.

  ---

  Images: All original images are AI-generated with using a combination of Dall-E, Firefly, DreamStudio and Pixlr.

  ---

  Disclaimer: This post is for general information purposes only. It does not constitute legal advice. This post reflects the current opinions of the author(s) only. The opinions reflected herein are subject to change without being updated.

Antitrust hasn’t always been an area of the law where the cool kids hung out; its relevance throughout history has ebbed and flowed depending upon the historical circumstances and the cast of characters involved.  Today, antitrust is once again “straight fire,” with the nerds taking over the school as years of limited regulation in the tech industry have led to a boiling point over issues like social media misinformation and AI’s existential risks.

The first domino might have already fallen, with the D.C. District Court recently ruling against Google in the biggest US antitrust trial in decades.  It could signal a broader trend, with antitrust suits pending against Apple, Google (part 2), Amazon, Visa, and Meta. Interestingly, these lawsuits have supporters from both sides of the aisle (regulating tech might be the last purple issue). While commentators disagree on why Big Tech presents antitrust concerns, they can agree that the concentration of power in tech is a problem. The result is a philosophical shift among antitrust enforcement agencies who are ramping up scrutiny of Big Tech.

Antitrust law, originally designed to curb the abuses of monopolistic titans like Standard Oil, has evolved dramatically over the years, particularly with the rise of the consumer welfare standard in the 1970s. Today, as Big Tech dominates the global market, antitrust enforcement is shifting again, moving beyond consumer prices to focus on the broader impact of corporate power on competition, innovation, and even democracy itself. This article explores how antitrust laws have developed, the challenges of regulating in the digital age, and how current legal battles are shaping the future of tech regulation in the United States.

Roadmap:

I. Antitrust Explained: History Repeating Itself All Over Again…
     A. Background on Antitrust Laws
     B. Who Brings Antitrust Lawsuits?
     C. Origin Story: Standard Oil and the Robber Barons
     D. The Chicago School, Robert Bork and the Rise of the Consumer Welfare Standard (1970s)
     E. Microsoft Loses Antitrust Case (2000)…Kinda
II. Vintage Antitrust: Pivot From Protecting Consumer Welfare Back To Competition
     A. The Limits of Consumer Welfare Model on Big Tech
     B. The New Brandeis Movement and Big Tech
III. DOJ V. Google - Round 1 Goes To The Government
     A. The Ruling
     B. Would Remedies Realistically Be Effective? 
IV. The Reformation Of Antitrust Law And Reactions
V. How Has Big Tech Dodged Antitrust Violations Until Now
     A. Antitrust Compliance Programs
     B. Avoidance Mergers: Special Dividends­­ and Acqui-Hires and Poaching
VI. Final Thoughts: The Past And The Future
VII. Extra Credit: Cases To Keep On Your Radar
VIII. Resources

I. Antitrust Explained: History Repeating Itself All Over Again…

A. Background on Antitrust Laws

Why do we have them? Antitrust laws are all about encouraging innovation and ensuring big companies don’t abuse their power, keeping competition fair.  It’s fine for a company to take over a market by offering something better, but problems start when a party uses its position to shut out new, creative competitors. These laws are there to stop shady tactics like paying off suppliers to avoid working with rivals, which hurts competition. Exclusive deals happen in business, but they need a closer look to make sure they’re not too restrictive. The goal is a healthy, competitive market where businesses can come and go easily, and consumers get clear info to make smart choices. By keeping big companies from unfairly blocking competition or misleading customers, antitrust laws keep the marketplace fair for everyone.

TL;DR on the Law:  Three main statutes govern antitrust law in the US:  (i) The Sherman Antitrust Act of 1890, (ii) the Clayton Act of 1914, and (iii) the Federal Trade Commission Act of 1914. These laws among others are the framework for the three “pillars” of prohibited behavior:

1. Agreements to Limit Fair Competition (i.e. Two Parties Acting Together):  Section 1 of the Sherman Act outlaws agreements between parties to unfairly restrain trade. This could include competitors agreeing to (i) fix prices, (ii) limit output, (iii) submit fake or coordinated bids to win a contract, or (iv) divide up markets and customers, among others.  These kinds of agreements are considered automatically illegal (called “per se illegal”). If an agreement is less obviously harmful, courts use a "rule of reason" standard to figure out if it's illegal (i.e. the court has to do some analysis on the overall big picture).

2. Monopolies (i.e. One Party’s Actions):  Section 2 of the Sherman Act prohibits monopolies that act unfairly to limit competition. A company breaks this law if (i) it controls a large part of the market (called “dominant position”) and (ii) uses its power to block or crush competitors through unfair practices (the legal jargon used here "predatory" or "exclusionary").

3. Anti-Competitive Mergers and Acquisitions (M&A): Section 7 of the Clayton Act prohibits mergers and acquisitions (when one company buys another) if they reduce competition or create a monopoly. If a company buys a competitor to limit competition, it can be illegal. Note, the Sherman Act can also be used to stop mergers that result in monopolies or trade restraints.

B. Who Brings Antitrust Lawsuits?

Two federal agencies enforce the antitrust laws: the Department of Justice (“DOJ”) and the Federal Trade Commission (“FTC”).  One might think we have two antitrust enforcement agencies because we value competition, but this redundancy is partly due to (i) historical developments (the DOJ was the enforcer under the Sherman Act while the FTC was established under the Federal Trade Commission Act) and (ii) a desire for specialized expertise.  

• The DOJ’s antitrust division, headed by Jonathon Kanter, is the historic and general enforcer of antitrust laws. It handles all criminal enforcement while also doing complex civil enforcement.  DOJ also has specific statutory authority in areas like banking, telecommunications, airlines, and railroads.

• The FTC, chaired by Lina Khan, is the expert in antitrust. It focuses on civil action (potentially through their own administrative court) particularly in consumer protection, advertising, and unfair competition, often targeting sectors like healthcare, pharmaceuticals, professional services, food, energy, and high-tech industries like computing and internet services.

Prior to investigating anyone, the agencies will coordinate so they don’t both bring a lawsuit against the same offender.  Although antitrust is known for being more of a federal thing, states have their own antitrust statutes, and the offices of the attorney general in each state are in charge of enforcing them.  More on that here.

But how did we get here in the first place?  Why do we have these laws?

C. Origin Story: Standard Oil and the Robber Barons

To understand the birth of antitrust laws, we have to go back to the late 19^th Century – a period known as the Gilded Age.  An epoch marked by massive income inequality, political corruption, industrialization, and the rise of powerful monopolies.  This was a time when the captains of industry, known as robber barons, like Andrew Carnegie, Cornelius Vanderbilt and J.P. Morgan would, according to rumors of the time, go to Delmonico’s, one of NYC’s most exclusive restaurants at that time, roll up hundred-dollar bills and smoke them – just because they could.

This concentration of wealth was evident among both corporations and individuals. Among the smoke-filled drawing rooms of the Jekyll Island Club was America’s first billionaire John D. Rockefeller, who founded Standard Oil in 1870, a company that along with Andrew Carnegie’s US Steel, inspired lawmakers to pass the Sherman Antitrust Act of 1890.  Standard Oil was notorious for its aggressive business strategies like undercutting competitors, restricting supply chains, and procuring exclusive contracts with railroads.  At its peak, Standard Oil controlled 90% of US oil production (hmm….sounds like Google).

In 1911, the Supreme Court struck down Standard Oil’s practices, ruling that it violated Sections 1 and 3 of the Sherman Act (pillar 1 and 3) and ordering its breakup into smaller companies. While Standard Oil may seem like a no-brainer example of antitrust violations, in reality, determining whether a violation had occurred was surprisingly tricky for the government.  Standard Oil consolidated many of its entities into a single trust, purposefully designed to obfuscate any governmental scrutiny.  As muckraking journalist Ida Tarbell (who exposed Standard Oil’s dealings) wrote, “You could argue its existence from its effects, but you could not prove it.”  

Going into the early 20th Century, antitrust enforcement was strong, focused on breaking up monopolies like Standard Oil and Northern Securities under Presidents Theodore Roosevelt and William Taft. This "trust-busting" period aimed to limit corporate power and promote fair competition. Key laws, including the Clayton Act and Federal Trade Commission Act, were introduced to strengthen the Sherman Act, preventing large corporations from using unfair practices to dominate industries. 

Then, a new philosophy changed everything.

D. The Chicago School, Robert Bork and the Rise of the Consumer Welfare Standard (1970s)

In the 1970s, the Chicago School of Economics, led by figures like Robert Bork, prompted a rethinking of antitrust law’s goals. They argued that large firms could achieve efficiencies that benefit consumers, and that market concentration wasn’t necessarily harmful unless it resulted in higher prices or reduced consumer choice.

The consumer welfare model gained momentum as it aligned with the broader pro-market, deregulation trends of the 1970s and 1980s, influencing courts and policymakers. This shift reduced the scrutiny of mergers and market concentration, with fewer cases brought against dominant firms unless there was clear evidence of consumer harm, primarily through price increases.

This trend continued into the 1980s through the Reagan era and beyond, persisting until the 1990s, when regulators began scrutinizing the rise and market dominance of major tech companies.

E. Microsoft Loses Antitrust Case (2000)…Kinda

The first company in the crosshairs of the government in this new era was Microsoft.  At the time, Microsoft controlled 90% of the PC operating system market. A federal judge ruled that Microsoft had abused this monopoly by bundling its Internet Explorer browser with Windows, effectively stifling competition from browsers like Netscape, which once held over 80% of the market. By giving Internet Explorer away for free and bundling it with Windows, Microsoft eroded Netscape’s market share and blocked innovation, actions that were ultimately deemed anticompetitive. The case not only highlighted Microsoft's effort to eliminate potential middleware competitors like Netscape, which could have diminished Windows' dominance, but also set important precedents for how tech giants wield power—especially when offering "free" services to consumers.

(Sounds like Google).

Surprisingly, despite the judge initially ordering Microsoft to be broken up, the company settled with the DOJ on appeal in 2001. Instead, the settlement-imposed restrictions on Microsoft’s business practices, including requirements to share its application programming interfaces (APIs) with third-party developers and limitations to ensure fair competition.

Why did the DOJ settle with Microsoft?  Well, in 2001, the Clinton administration was out, and the Bush administration was in.  Although courts had found Microsoft guilty of using its power to unfairly dominate competitors, breaking up the company was seen as too extreme, and constant monitoring wasn’t practical. Instead, the settlement required Microsoft to share more of its software with competitors, allowing them to develop products compatible with Windows. This compromise aimed to move the tech industry forward, but critics argued it didn’t do enough to rein in Microsoft's control, leaving room for future monopolistic behavior.

While the settlement wasn’t as severe as it could have been and allowed Microsoft to retain its dominance in the operating system market, it also made the company more cautious. Increased regulatory scrutiny slowed its expansion into new markets like mobile and internet services. This shift in focus created opportunities for new players to capitalize on this changing landscape.

Ironically, the antitrust case against Microsoft cleared the path for Google to rise as a new tech giant. Now, Google is finding itself in the crosshairs of its own antitrust battles.

History has a way of repeating itself.

II. Vintage Antitrust: Pivot From Protecting Consumer Welfare Back To Competition

A. The Limits of Consumer Welfare Model on Big Tech

As the digital age progressed, the Chicago School's focus on consumer welfare in antitrust law—primarily concerned with price—faced increasing criticism. Under this theory, as long as a company’s actions led to lower prices, courts rarely intervened, even when the company held significant market share. While effective for traditional industries, this approach proved inadequate for tech giants like Amazon, Google, and Facebook, which could dominate markets without raising prices, offering low-cost or free services instead.

These companies operate in complex, multi-sided markets, often acting as both platforms for sellers and competitors. They also benefit from network effects, where their services become more valuable as more people use them, making it difficult for smaller competitors to thrive. This shifted the focus from price to non-price harms like reduced innovation, exclusion of competitors, and control over data, revealing the limitations of the consumer welfare model in addressing modern monopolistic practices.

B. The New Brandeis Movement and Big Tech

Today’s antitrust enforcers (like Lina Khan, Chair of the FTC, and Jonathan Kanter, head of the DOJ’s Antitrust Division) embrace Neo-Brandeisianism (aka the New Brandeis Movement or the Neo Brandeis Movement).  Named after Supreme Court Justice Louis Brandeis, this approach emphasizes a broader view of competition, focusing less on consumer prices and more on how large corporations harm competition (particularly for small businesses) and stifle innovation.  Brandeis was a key figure in early 20^th-Century antitrust philosophy and focused more on competition and less so on price.  Critics have called Neo-Brandeisianim “hipster antitrust,” arguing that it tries to use antitrust law to address social issues like inequality, which they believe it wasn’t designed to handle. They worry it could lead to overregulation and political interference in business

Judges in cases brought by the DOJ under Kanter and the FTC under Khan also seem skeptical of Neo-Brandeisianism, and both agencies have suffered a string of losses in court. In the FTC's cases against the Microsoft-Activision and Meta-Within mergers, and the DOJ's case against UnitedHealth Group-Change Healthcare merger, the courts found insufficient evidence that these mergers would significantly harm consumers. The judges felt these cases were based on novel antitrust theories that lacked enough concrete evidence. Courts often focus on immediate, demonstrable harm to competition or consumers, so without clear proof of negative impacts—such as higher prices—they are less likely to block mergers, even when broader, more speculative antitrust theories are presented.

Amid facing skepticism from courts and critics, Khan and Kanter have continued  to pursue high-profile litigation against Big Tech. Their strategy isn’t just about winning individual cases—it’s also about educating the public and pushing Congress to update antitrust laws for the digital age.

III. DOJ V. Google - Round 1 Goes To The Government

A. The Ruling

Despite suffering such loses, Kanter and Khan’s efforts are paying off in a big way (to the power of googol).  In August 2024, the D.C. District Court dealt a major antitrust blow to Big Tech, with Judge Mehta ruling that Google had illegally maintained its monopoly over (i) internet search and (ii) search text ads—a significant victory (pillar 2) in the ongoing efforts to rein in tech giants. 

1. Search

Google engaged in behavior that harms competition by making exclusive contracts, primarily with device manufacturers and carriers, to make its search engine the default engine on smartphones and web browsers and block its competitors.

Google has argued that it dominates the market because its product is the best, so it was simply benefiting consumers by providing them with the best product.  Well, let’s think about that assertion.  Google paid Apple $20 billion a year to be the default search engine on Apple devices and around 50% of all search queries come from such default placements. The Apple agreement also prohibits Apple from making its search features better than Google’s. Siri and Spotlight, for instance, cannot be meaningfully improved without risking a renegotiation of the deal.  Perhaps the most surprising condition of the deal is Apple's obligation to defend Google in the face of regulatory scrutiny!  

As a result of deals like this, Google controls around 90% of the online search market (wow, there’s that number again) and 95% of search on smart phones. That market share also gives Google a leg-up in collecting uber valuable user data. For example, Google is able to gather as much user data in 13 months as Bing can accumulate in 17 years. All of this creates a flywheel effect and being so entrenched makes it hard to dethrone it. So is Google really on top because of its superior product, like it argued? Or does it rule because of it entrenches itself through superior negotiating power? 

2. Search Text Ads

Regarding the search text ads (not to be confused with the general search ads), Google acted anti-competitively by gradually raising ad prices in a way that masks the increases through auctions, making it seem like price fluctuations are due to demand when in reality, Google was just inflating prices.  This behavior showed Google could raise prices without concern for competitors, which is a clear sign of monopoly power. Judge Mehta called out this pricing manipulation as both monopolistic and unethical.

Ultimately, the fact that Judge Mehta rejected Google’s consumer benefit argument, one grounded in traditional antitrust theories, is a victory for Khan’s Neo-Brandeism. Despite the fact that Google’s dominance is arguably super convenient for consumers, it was not a get-out-of-jail-free-card for Google; this falls perfectly in line with the type of antitrust jurisprudence that Kanter, Khan and the Neo Brandeisians would be in favor of.

B. Would Remedies Realistically Be Effective? 

On Tuesday, October 8^th, the DOJ announced that it might seek to break up Google as a potential remedy (penalty). Per its court filing, “Fully remedying these harms requires not only ending Google’s control of distribution today, but also ensuring Google cannot control the distribution of tomorrow.” Judge Mehta is expected to decide on a remedy to this situation by summer 2025; meanwhile, Google will appeal the case.

The DOJ’s requested breakup seems improbable. A breakup of Google’s complex business structure  would be difficult, and breakups are an extreme remedy anyway. While Judge Mehta has avoided signaling specific remedies, the focus is likely to be on prohibiting Google’s exclusive contracts, possibly through a “choice screen” where users can select their preferred search engine, which is what was done in the EU’s antitrust cases against Google. It’s also doubtful whether consumers, given the choice, would choose to switch away from their old friend Google.  But AI could change all that too.

Critics of the antitrust action argue that forcing Google to change its agreements with device manufacturers and carriers could undermine innovation and leave consumers worse off by weakening products many rely on for their quality. It could for example lay a death blow to Mozilla’s Firefox web browser, which relies on an exclusivity agreement with Google for over 80% of its operating budget. Even if apps like Firefox survive, Google’s litigation costs—and any costs it passes onto consumers—could outweigh any benefits consumers see. Ultimately, while remedies aim to boost competition, their full impact will unfold slowly over years, with potential appeals further delaying the process.

Nevertheless, Judge Mehta’s ruling in the Google antitrust case is significant as it may guide future Big Tech cases, particularly on market definition, default settings, and scale.  It acts as a "test case" that could influence future rulings and might prompt companies like Alphabet or Amazon to restructure, potentially spinning off YouTube or AWS, to avoid harsher penalties.

IV. The Reformation Of Antitrust Law And Reactions

Clearly, the Neo-Brandeisists think antitrust needs to be reformed to be practical to the realities on the ground, but how could they be reformed practically? 

One type of proposed reform would make merger rules stricter and clearer to prevent Big Tech companies from consolidating power even more. For example, stricter merger rules could restrict when tech companies can buy out their smaller rivals, a practice that’s common today.

Other rules could prevent large tech companies from favoring their own products, as Google did. These rules could rein in Big Tech’s size and monopoly power (pillar 2).

Another type of proposed reform would make new rules designed specifically for Big Tech’s brave new world. Big Tech can consolidate power in new ways that antitrust doesn’t address. For example, companies “lock in” users to their products by making it difficult to move data to another company’s product or use multiple companies’ products together. Some companies, like Apple, have become infamous for this practice, creating a “walled garden” where only their products work. Tech-specific antitrust rules could knock down the garden’s walls, forcing companies to allow users to freely move their data between companies (a concept called “interoperability”).  This is the value proposition of crypto.

What’s been the pushback on reforms?

There’s been a lot of pushback on the suggested antitrust reforms for Big Tech. Critics often point to three major concerns: (1) feasibility, (2) innovation, and (3) the free market.

1. Feasibility: First, some critics argue that rules, like those that knock down the walled garden, aren’t feasible. They say forcing platforms to work together could create security risks and be too technically difficult to manage.

2. Innovation: Second, some critics argue that restrictions on behaviors like merging or self-favoring would hurt innovation and competition. They claim such rules would deter venture capital investment in startups and reduce incentives for mature tech companies to innovate, ultimately undermining U.S. competitiveness and global tech leadership.

3. Free Market: Finally, some critics advocate for free market approach. In this theory, antitrust issues will work themselves out through a sort of natural selection as the industry evolves. For example, Sears dominated retail through its mail-order catalogs and big-box stores but eventually lost ground as it failed to keep up with digital innovation, allowing Amazon to take the lead in online retail.

V. How Has Big Tech Dodged Antitrust Violations Until Now

Big Tech has a long history of staying one step ahead of government regulators on antitrust issues by adapting their strategies to avoid violations and scrutiny. These companies are not only proactive in ensuring compliance but also innovative in finding ways to circumvent potential legal challenges. Here’s how they had been managing to remain ahead:

A. Antitrust Compliance Programs

Until recently, Big Tech had little concern over antitrust investigations, as the long-standing consumer welfare model guiding enforcement remained unchanged for decades. This allowed companies to establish “antitrust compliance” measures—internal processes designed to ensure they operated within legal boundaries and avoided monopolistic practices.

To stay ahead of potential scrutiny, tech companies invested heavily in compliance, creating internal "antitrust filters" to review new products and services. They trained employees on antitrust issues and consulted legal experts to ensure their strategies wouldn’t be seen as anti-competitive. This proactive approach allowed them to avoid legal challenges while continuing to innovate and expand within the boundaries of US antitrust laws.  Even when investigations occurred, agencies like the DOJ and FTC often faced limited resources and lengthy timelines, as seen in the Microsoft case, where penalties arrived too late to have significant impact.

After the Google suit, there will be updates to their policies.

B. Avoidance Mergers: Special Dividends­­ and Acqui-Hires and Poaching

Big Tech’s playbook also has included innovative ways to consolidate power without triggering merger rules and government oversight. Big Tech commonly circumvents merger oversight by (1) keeping mergers below reporting thresholds (certain $ deal sizes require a government review), (2) structuring a merger as a different type of transaction, or (3) not technically merging at all.

1. Special Dividends: First, Big Tech uses a special dividend to keep mergers below the price that triggers reporting and oversight. In this strategy, the company that’s being bought pays its investors a special one-time dividend before the sale, reducing its overall value. This allows the buyer to acquire the company at a lower price, staying under the thresholds that would normally require reporting the deal to regulators.

2. Acqui-Hires: Second, Big Tech has used acqui-hires to structure mergers as a hiring event rather than a merger that triggers reporting and oversight. An acqui-hire is when a large company buys a startup primarily to gain its key employees. Sometimes, these deals are structured to look like regular employment contracts, hiding the true value of the acquisition by undervaluing the assets and promising future stock options. While these types of deals often go unreported, they can be anticompetitive by benefiting the companies involved while reducing future competition—which ultimately hurts consumers.

3. Reverse Acqui-hires / Controlling Stakes: Third, Big Tech gains control without outright purchases through reverse acqui-hires and acquiring controlling stakes. Unlike traditional acquihires, where a company is fully acquired mainly for its talent, a reverse acqui-hire involves hiring key employees and licensing a startup’s technology without acquiring the company, allowing it to remain independent. Additionally, purchasing controlling stakes gives Big Tech access to competitors’ confidential information and influence over strategic decisions. For example, Microsoft recently acquired a 49% stake in OpenAI while poaching talent from AI firm Inflection, actions that have attracted antitrust scrutiny in the U.S. and UK.

However, the government is keenly aware of these corporate maneuvers. The real question now is, with the first antitrust domino having fallen, what new strategies will Big Tech devise to navigate this shifting regulatory landscape? 

VI. Final Thoughts: The Past And The Future

The exclusive deal between Google and Apple is one of the most significant and consequential in tech history, shaping the competitive landscape of Silicon Valley.

It has allowed Google to solidify its dominance in search while Apple profits without entering the search market directly. This "co-opetition" has effectively shut out rivals like DuckDuckGo and Microsoft’s Bing, undermining claims that Google’s success is purely consumer-driven. Instead, Google’s financial leverage, bolstered by its agreement with Apple, has marginalized competitors and reinforced a closed ecosystem that stifles innovation and blocks new market entrants.

But the far-reaching influence of this deal goes beyond technical dominance. Silicon Valley’s largest companies, including Google and Apple, have not only built powerful businesses but have also leveraged their wealth and influence to shape government policy. The same tech giants now facing antitrust scrutiny have poured millions of dollars into lobbying efforts, creating a formidable political force that protects their interests. In 2024 alone, Google and other Big Tech players have funneled vast amounts of money into political super PACs and lobbying groups, aiming to sway policy in their favor and stave off regulatory threats. In 2023, Big Tech companies, led by giants like Apple, Microsoft, and Alphabet, spent $243.7 million on lobbying, making them the second-largest industry in lobbying expenditures, behind only the pharmaceutical sector at $382.6 million.  These aggressive lobbying tactics have helped Big Tech stay one step ahead of regulators, shaping antitrust enforcement and slowing down efforts to rein in their power.

The remedy imposed upon Google will truly shape the future of Big Tech.  One wonders if the actual remedy will be much reduced as concerns with the US falling behind China on the AI front could push Washington not to threaten US tech dominance.  The change in presidential administration adds another layer of intrigue, as it will undoubtedly influence the scope and execution of these remedies – not to mention, it could mean a new inflection point in the enforcement of antitrust laws and direction of the DOJ and FTC.

Even so, when you look at the Microsoft case, even though the remedies were softened, it still paved the way for the rise of Google.  The Gilded Age is over at this point and a new Google may emerge from all of this….

VII. Extra Credit:  Cases To Keep On Your Radar

With the rise of Khan (sounds like a Star Trek movie) and Kanter and suits brought against Amazon and Google (among others), Big Tech is on notice.  Keep the following cases on your radar:

1. Google (2^nd Case Focuses on Advertising): A second antitrust case targeting Google’s online advertising practices is currently ongoing, with trial scheduled to wrap-up on November 25, 2024. This case accuses Google of anticompetitive mergers and monopolistic practices in the ad tech space.

2.  Amazon: In September 2023, the FTC and 17 states sued Amazon, accusing it of maintaining a monopoly by squeezing sellers and favoring its own services on its marketplace. The FTC claims these practices led to artificially higher prices for consumers. Amazon has asked for the case to be dismissed, arguing that its marketplace benefits both consumers and sellers. The trial is set for October 2026.

3.  Apple: In March 2024, the Department of Justice sued Apple, alleging that it monopolized the smartphone market and stifled competition, especially for services like cloud streaming, messaging, and digital wallets. Apple has moved to dismiss the case, claiming that its practices enhance the iPhone experience and don’t violate antitrust laws.

4.  Meta (formerly Facebook): The FTC sued Meta in 2020, accusing it of monopolizing social media by acquiring Instagram and WhatsApp to eliminate competition. After some setbacks, the case is proceeding, with the FTC calling for the acquisitions to be undone. Meta argues that the acquisitions were not anticompetitive and contributed to innovation.

5. Visa: The DOJ filed a civil suit in 2024, accusing Visa of monopolizing the US debit network market through exclusionary policies and anticompetitive agreements. Visa allegedly isolated competitors by offering discounts for exclusive routing and paying rivals like Apple and PayPal to avoid developing competing products.

Subscribe now

Share

[Special thanks to Sam Silverberg.]

VIII. Resources:

• Carl Shapiro, Antitrust in a Time of Populism, 61 Intl. J. Indus. Org. (2018).

•  Daniel Francis, Christopher John Sprigman, Antitrust Principles, Cases, and Materials 7 (2d ed. 2024).

• United States v. Grinnell Corp., 384 U.S. 563 (1966).

• Amy Hayes, Here’s How John D Rockefeller Became the First Billionaire, THE COLLECTOR (Oct. 12, 2023). thecollector.com/how-john-d-rockefeller-became-first-billionaire/.

• Ashkay Jagtap, Aakash Biswas, James Blaney, The Antitrust Legacy of Standard Oil in Today’s World, THE WAY AHEAD (Nov. 1 2021). jpt.spe.org/twa/the-antitrust-legacy-of-standard-oil-intoday’s-world.

• Katie Wilson, 1912: When antitrust views collided in a presidential election, CASCADE PBS (Nov. 4, 2020) cascadepbs.org/opinion/2020/11/1912-when-antitrust-views-collided-presidential-election.

• R. Hewitt Pate, The Common Law Approach and Improving Standards for Analyzing Single Firm Conduct (Oct. 23, 2003).

• Thomas A. Lambert, Defining Unreasonably Exclusive Conduct: The “Exclusion of a Competitive Rival” Approach, 92 N.C.L. Rev. 1175, 1177(2014).

• See Mark S. Popofsky, Defining Exclusionary Conduct: Section 2, The Rule of Reason, and the Unifying Principle Underlying Antitrust Rules, 73 L.J. 435, 442 (2006).

• Rebecca Klar and Karl Evers-Hillstrom, How Big Tech fought antitrust reform–and won, THE HILL (Dec. 23, 2022) thehill.com/policy/technology/3785894-how-big-tech-fought-antitrust-reform-and-won/.

• Bryce Covert, Lina Khan’s Anti-Monopoly Power, THE NATION (Dec. 9, 2023) https://www.thenation.com/article/society/lina-khan-ftc-monopoly.

• Andre Fiebig & David Gerber, The Causes and Consequences of the Neo-Brandeisian Antitrust Movement in the United States, DEGRUYTER.COM (Apr. 5, 2021) https://www.degruyter.com/document/doi/10.15375/zwer-2021-0405/html

• Andrea O’Sullivan, What Is ‘Hipster Antitrust,’ MERCATUS.ORG (Oct. 18, 2018) https://www.mercatus.org/economic-insights/expert-commentary/what-hipster-antitrust.

• Lina Khan & Sandeep Vaheesan, Market Power and Inequality: The Antitrust Counterrevolution and Its Discontents 11 Harv. L. & Pol’y Rev. 235, 237 (2017).

• David Streitfeld, Amazon’s Antitrust Antagonist Has a Breakthrough Idea, THE NEW YORK TIMES (Sept. 7, 2018). https://www.nytimes.com/2018/09/07/technology/monopoly/-antitrust-era-lina-khan-amazon.html.

•  Russell Brandom, Amazon says new FTC Chair shouldn’t regulate it because she’s too mean, THE VERGE (Jun. 30, 2021) https://www.theverge.com/2021/6/30/22557456/amazon-lina-khan-recusal-petition-federal-trade-commission-antitrust.

• Callum Jones, ‘She’s going to prevail:’ FTC head Lina Khan is fighting for an anti-monopoly America, THE GUARDIAN (Mar. 9, 2024) https://www.theguardian.com/us-news/2024/mar/09/lina-khan-federal-trade-commission-antitrust-monopolies.

•  Brian Fung & Clare Duffy, Google has an illegal monopoly on search, judge rules. Here’s what’s next, CNN (Aug. 6 ,2024).

• David McCabe, Strongest U.S. Challenge to Big Tech’s Power Nears Climax in Google Trial, THE NEW YORK TIMES (May 2, 2024) https://www.nytimes.com/2024/05/02/technology/google-antitrust-trial-closing-arguments.html.

• Google Antitrust Ruling: A Landmark Decision in the Tech Industry, MONEY MORNING (Aug. 5, 2024), https://moneymorning.com/2024/08/05/google-antitrust-ruling-a-landmark-decision-in-the-tech-industry/.

• Jennifer Elias, Google’s antitrust ruling has experts looking to 25-year old Microsoft case for answers, CNBC (Aug. 7, 2024).

• Nick Riso, Google Antitrust Ruling: A Landmark Decision in the Tech Industry, MONEY MORNING (Aug. 5, 2024) https://moneymorning.com/2024/08/05/google-antitrust-ruling-a-landmark-decision-in-the-tech-industry/.

• Satya Marar, The Antitrust War Against Google Fails Consumers (Sep. 13 2023).

• Bill Scher, A Short History of Democrats and Antitrust, WASHINGTON MONTHLY (Jul. 19, 2021) https://washingtonmonthly.com/2021/07/19/a-short-history-of-democrats-and-antitrust/.

• Leah Nylen, Huge win for progressives as Lina Khan takes helm at FTC, POLITICO (Jun. 15, 2021) https://www.politico.com/news/2021/06/15/khan-confirm-ftc-494609.

• Roger P. Alford, The Bipartisan Consensus on Big Tech, 71 Emory L. J. 895 (2022).

• Gregory J. Werden, Identifying Exclusionary Conduct Under Section 2: The “No Economic Sense” Test, 73 Antitrust L.J. 413 (2006).

• Steven C. Salop & Craig Romaine, Preserving Monopoly: Economic Analysis, Legal Standards, and Microsoft, 7 Geo. Mason L. Rev. 617, 652 (1999).

• Zephyr Teachout, BREAK ‘EM UP; RECOVERING OUR FREEDOM FROM BIG AG, BIG TECH AND BIG MONEY (2020) 214.

• Robert Lande, Who Cares Whether A Monopoly is Efficient? The Sherman Act Is Supposed to Ban Them All, THE SLING (Nov. 15, 2023), https://www.thesling.org/who-cares-whether-a-monopoly-is-efficient-the-sherman-act-is-supposed-to-ban-them-all/.

• Mark McCareins, Why Antitrust Regulators Don’t Scare Big Tech, KELLOGG INSIGHT (Aug. 19, 2019) https://insight.kellogg.northwestern.edu/article/why-antitrust-regulators-dont-scare-big-tech.

• https://www.britannica.com/event/Gilded-Age

• https://www.history.com/news/robber-barons-gilded-age-wealth

• https://historyanecdotesforteachers.com/the-gilded-age/

• https://www.nytimes.com/2018/09/07/technology/monopoly-antitrust-lina-khan-amazon.html

• https://www.cnn.com/2023/10/16/tech/lina-khan-risk-takers/index.html

• https://www.gao.gov/products/gao-23-105790#:~:text=We%20found%20that%20DOJ%20and,or%20comments%20on%20that%20investigation.

• https://sgp.fas.org/crs/misc/R46875.pdf

• https://ainowinstitute.org/publication/antitrust-and-competition

• https://time.com/6116953/antitrust-reform-big-tech-congress-biden/

• https://www.csis.org/analysis/breaking-down-arguments-and-against-us-antitrust-legislation

• https://insight.kellogg.northwestern.edu/article/why-antitrust-regulators-dont-scare-big-tech

• https://systemicjustice.org/article/putting-the-anti-back-into-antitrust-the-need-for-antitrust-reform-in-the-digital-age/

• https://www.nytimes.com/2024/08/05/technology/antitrust-google-amazon-apple-meta.html

• https://www.ftc.gov/system/files/documents/public_statements/1596340/20210915_final_chopra_remarks_non-hsr_reported_acquisitions_by_big_tech_platforms.pdf

• https://www.kff.org/health-costs/issue-brief/understanding-the-role-of-the-ftc-doj-and-states-in-challenging-anticompetitive-practices-of-hospitals-and-other-health-care-providers/

• https://www.reuters.com/legal/us-judge-rules-google-broke-antitrust-law-search-case-2024-08-05/

• https://slate.com/technology/2024/08/google-monopoly-antitrust-decision-defeat-big-tech.html

• https://www.nytimes.com/2001/09/07/business/us-vs-microsoft-overview-us-abandoning-its-effort-break-apart-microsoft-saying.html

• https://knowledge.wharton.upenn.edu/article/the-microsoft-settlement-a-remedy-that-pleases-almost-no-one/

• https://www.cato.org/regulation/winter-2023-2024/neo-brandeisianisms-democracy-paradox

• https://www.paulweiss.com/practices/litigation/antitrust/publications/takeaways-from-the-doj-s-unitedhealth-change-healthcare-merger-loss?id=44360

• https://www.newyorker.com/magazine/2024/10/14/silicon-valley-the-new-lobbying-monster

• https://www.nytimes.com/2020/10/25/technology/apple-google-search-antitrust.html

• https://www.opensecrets.org/news/2023/10/google-ramped-up-federal-lobbying-ahead-of-doj-antitrust-showdown/

• https://www.visualcapitalist.com/ranked-which-u-s-industries-spend-the-most-on-lobbying/

• https://ainowinstitute.org/publication/antitrust-and-competition

• https://sgp.fas.org/crs/misc/R46875.pdf

• https://time.com/6116953/antitrust-reform-big-tech-congress-biden/

• https://moneymorning.com/2024/08/05/google-antitrust-ruling-a-landmark-decision-in-the-tech-industry/

Images: All images are AI-generated with using a combination of Dall-E, Firefly, DreamStudio and Pixlr.

Disclaimer:  This post is for general information purposes only. It does not constitute legal advice.  This post reflects the current opinions of the author(s).  The opinions reflected herein are subject to change without being updated.

On December 31, 1999, adorned in chokers and elevated by platform shoes, we were torn between playing Snake on our Nokias or Pokémon on our Gameboys, all while counting down the American Top 40 with Casey Kasem (RIP Shaggy) to that number-one hit, Smooth by Santana featuring Rob Thomas. Together, we collectively held our breath, awaiting the stroke of midnight and the dawn of a new millennium.

Y2K was supposed to bring chaos: computers crashing, planes falling, power outages, nuclear war, and the end of civilization as we knew it. But after the clock hit midnight on January 1, 2000, nothing much happened.

25 years later, we got the Y2K no one knew was coming in the major IT outage during the summer of 2024 that affected almost 8.5 million devices. The cause? A defect in a software update sent out by cybersecurity vendor CrowdStrike.

In this follow-up to the previous article, The Untouchables: Why Software Companies Escape Liability for Faulty Software?, we’ll lay out how CrowdStrike could leverage the legal protections to shield itself from liability from the various lawsuits related to the massive IT hiccup.

I. CrowdStrike and the IT Outage

CrowdStrike’s core technology is Falcon, a platform designed to prevent cybersecurity breaches. On July 19th, 2024, CrowdStrike pushed out a routine software update for Falcon—or so it thought. Operating off of a successful stress check done in March 2024, it seems CrowdStrike assumed the best and skipped some tests before pushing the July update, allowing a flaw to sneak through. With no phased rollout, the flawed update went out to everyone once released. Since Falcon is tightly integrated with Microsoft Windows, when the flaw crashed Falcon, down went the millions of Windows systems connected to it.

The outage affected airlines, hospitals, banks, media outlets, hotels, retail stores, stock markets, emergency services. Particularly affected was Delta Airlines, which relied on Windows for over half of their IT systems and accounted for nearly ⅔ of all canceled flights worldwide. And while CrowdStrike was able to find and push out a fix to the update file in 79 minutes, the disruption in many places went on longer. Many systems were stuck on the “Blue Screen of Death,” requiring manual reboots to get them out of the crash loops they were stuck in. The outage caused worldwide financial damage of at least $10 billion, with insurers estimating that U.S. Fortune 500 companies took $5.4 billion in losses.

II. A Deluge of Lawsuits

Every party affected by the outage—CrowdStrike shareholders, Delta passengers, Microsoft, Delta, and CrowdStrike themselves—all seem to have an opinion as to who and how people should be held responsible. Here are some of the outstanding lawsuits CrowdStrike is facing related to this incident that we’ll discuss: 

• CrowdStrike Sued by Air Passengers: CrowdStrike was sued in a class action by air travelers whose flights were delayed or canceled. They say CrowdStrike was negligent in testing and deploying its software and want compensation for their disrupted flights, as well as punitive damages.

  • Note that Delta was sued by passengers in a separate class action for breach of contract over how it handled refunds, with passengers also seeking compensation for travel disruptions.

• CrowdStrike Sued by Delta (and counter sues!): Delta sued CrowdStrike on October 25th citing $500 million in losses. Delta has accused CrowdStrike of gross negligence, misrepresentation, computer trespassing, trespass to personal property, strict liability, breach of contract, and deceptive and unfair business practices. Delta is seeking monetary and punitive damages.

  • CrowdStrike countersued to seek declaratory judgment that it wasn’t responsible for Delta’s claimed harm, noting Delta repeatedly declined help from CrowdStrike and Microsoft.

[CrowdStrike was also sued in a class action by its own shareholders as the shareholders say that CrowdStrike made false and misleading statements about their software testing. The shareholders want compensation after share prices dropped 32% post-outage, and $25 billion in market value was wiped out. For brevity, we’ll not discuss this suit.]

III. Can CrowdStrike Escape? The “Tech Veil” in Action!

Despite Delta’s chest puffing, holding software companies liable for tech defects isn’t easy. This is partly because products (and software lawsuits) are complex, partly because companies create defenses in contracts, and partly because of industry norms. Each of these issues can function as a “moat”: a competitive advantage for software companies and a deterrent for everyone else. We’ll walk through the implications of each moat within the Tech Veil that protects software companies from liability.

A. Recap of the “Tech Veil”

1. Litigation Moat: Software companies can face litigation for breach of warranty, negligence, or strict liability, but each claim has significant challenges. Breach of warranty requires a contract, which often limits damages, and limited damages often make lawsuits unattractive. Negligence claims are hard to win due to difficulties proving direct harm, especially with third-party involvement. Strict liability is rare since it only applies to software causing significant physical or property damage.

2. Contractual Moat: Software companies build defenses into their contracts by disclaiming warranties, limiting liability, and including indemnity clauses. Disclaiming warranties reduces the company's promises, limiting grounds for lawsuits. Liability limitations cap or restrict damages, and indemnity clauses can shift legal defense costs to the consumer if the company is sued due to the consumer's use of the software.

3. Structural Moat:  Certain legal barriers and norms help shield tech companies. For one, the software industry itself argues that flaws are inevitable.  Software is complicated and the components are intricate. Serious errors can slip by, with some of those issues only being discovered through real-world reviews and tests. But the fix, software companies argue, is not to hold them to a higher, more sensitive standard of liability. Software companies say that would slow development, inhibiting innovation and resulting in higher prices for consumers. Courts agree, resulting in cases frequently getting tossed out of court or settled for small amounts.

B. How CrowdStrike Could Beat Each Lawsuit

1. Airline Passengers v. CrowdStrike:  Negligence

The air travelers bringing a suit against CrowdStrike are alleging negligence, or that the software was carelessly made. In negligence cases, a direct contract isn’t required, but plaintiffs must prove four key elements:

1. There was a legal duty

2. The duty was breached

3. The breach of that duty caused harm

4. The harm led to damages

Proving negligence in software cases can be tricky because of the duty software companies owe. Unlike other technical professionals (like doctors and lawyers) who are held to a high standard of behavior, software companies are only required to act "reasonably" — i.e. not held to higher standards like doctors or lawyers. This makes it harder to prove they breached their duty, as the average person wouldn't catch every software defect.

Causation is also tricky—plaintiffs must prove the software itself caused the harm, not a third party like Delta, which managed the flights. CrowdStrike has pointed out that Delta was slow to recover, declined offered help, and failed to keep systems updated, shifting blame toward Delta.

Lastly, plaintiffs need to show tangible injury or property damage, which is rare in software-related cases. Punitive damages are even tougher, requiring proof of serious misconduct. Given the complexity of software, companies often argue that issues were unavoidable or due to carelessness, rather than intentional harm or recklessness.

Given these challenges, it seems unlikely that the airline passengers will have an easy win in court. Judges in tort cases like this one are typically cautious about holding a defendant liable for harm that may be too indirect or unforeseeable. With attention also focused on Delta's handling of the situation, there’s much to explore in the chain of causation between CrowdStrike's software error and the flight delays. If CrowdStrike couldn’t have reasonably foreseen Delta's heavy reliance on them or its outdated systems, Delta’s actions may overshadow any negligence by CrowdStrike, potentially shielding the company from liability.

2. Delta v. CrowdStrike:  Limitation of Liability

A.    Risk Shifting Provisions: Limitation of Liability

CrowdStrike and Delta have also been publicly disputing the extent of CrowdStrike’s liability.  In contracts, companies often limit their liability by restricting the types of damages covered, such as excluding indirect or punitive damages, and setting a monetary cap. In a letter to Delta prior to the lawsuit, CrowdStrike wrote that its liability was capped at an amount in the “single-digit millions.” According to CrowdStrike’s complaint, its liability for Delta’s services is capped at twice the fees Delta paid, excludes indirect or consequential damages, and requires Delta to comply with applicable laws (details below).

Delta argues in its complaint, however, that gross negligence or willful misconduct would override the liability cap—something CrowdStrike concedes, if proven (see below). To succeed, Delta must demonstrate that CrowdStrike’s actions were more than just careless. Gross negligence implies a severe lack of care with reckless disregard, while willful misconduct involves intentional disregard for known risks. Both are challenging standards to meet.

Delta points to CrowdStrike’s lack of a staged rollout and its admission that certain tests were skipped as examples of this misconduct. However, software development is complex, and skipping tests or not implementing a staged rollout does not necessarily prove intentional harm.

CrowdStrike points to Delta’s own IT decisions and response failures as primary causes of the slow recovery. It asserts that other companies resolved similar issues more quickly, suggesting Delta’s infrastructure and choices contributed to the impact. CrowdStrike also questions Delta’s compliance with federal cybersecurity requirements, particularly a 2023 TSA mandate for airlines. If CrowdStrike can demonstrate that Delta’s actions contributed to the incident, it could weaken Delta’s claim of gross negligence and reduce CrowdStrike’s potential liability.

What’s very telling is that Delta’s complaint doesn’t mention the limitation of liability language at all, suggesting it knows the only way it can win is to focus on a gross negligence or willful misconduct argument. To do so, it will try to argue that CrowdStrike’s actions were serious enough to warrant unlimited damages. However, CrowdStrike’s lawsuit for a court ruling on liability limits could force Delta to address these caps directly at an early stage of the trial process, potentially limiting Delta’s recovery if the court sides with CrowdStrike.

While these types of cases usually settle, if we get to the discovery phase, it would be interesting to read the full terms, i.e. the reps, warranties and indemnification provisions.

FWIW, CrowdStrike’s online terms and conditions protects it well in these areas:

• The warranty limits remedies to problem resolution, workarounds, or a prorated refund, placing maintenance responsibility on the customer, while indemnification is restricted to covering a customer’s defense costs in third-party intellectual property claims only. That’s some protective language!

IV. Final Thoughts: Is Software Getting Worse?

On August 12th, CrowdStrike's President accepted the Pwnie Award for the “Most Epic Fail” in cybersecurity. Just days later, on September 24th, Adam Meyers, CrowdStrike’s Senior VP for Counter Adversary Operations, testified before the House Homeland Security Cybersecurity and Infrastructure Protection Committee, admitting that CrowdStrike had "let our customers down." This incident is a reminder that software companies must prioritize actual quality assurance over assumptions. CrowdStrike has pledged to implement more software checks and stagger future updates to prevent similar issues.

The global IT outage caused by a faulty CrowdStrike update also illustrates how over-reliance on a few dominant players in sectors like transportation, healthcare, and finance can magnify risks to the public. While the CrowdStrike outage was directly caused by its faulty Falcon update, it was worsened by Microsoft's dominance in enterprise software. Windows systems, which are used globally in corporate and public infrastructure, were disproportionately affected. Though Microsoft wasn’t directly responsible, the widespread reliance on its systems amplified the consequences. Critics argue this is a prime example of the dangers of technological “monocultures,” where too many organizations depend on a single platform, increasing the impact of any failure. Tech folks have suggested this reflects the need to diversify software solutions across industries to reduce the risk of widespread outages.

Addressing these issues would require significant changes in industry priorities. Currently, the focus is on fast software development to serve more consumers and stay competitive in a market dominated by a few major players. Speed, in this case, isn’t a bug—it’s a feature. However, speed without reliability benefits no one. Without regulations addressing software monopolies and effective private regulation via lawsuits, companies are free to make repeated mistakes, leaving consumers with limited alternatives.

We've seen how courts hesitate to impose broad liability on tech companies, and how software firms promote the narrative that change is difficult, if not impossible. It may take an act of Congress to truly shift the status quo and penetrate the “Tech Veil.”

For now, death, taxes, and software bugs remain the only certainties in life.

Subscribe now

Share

[Special thanks to Sam Silverberg.]

Resources:

• https://www.reuters.com/technology/microsoft-says-about-85-million-its-devices-affected-by-crowdstrike-related-2024-07-20/

• https://www.techtarget.com/whatis/feature/Explaining-the-largest-IT-outage-in-history-and-whats-next

• https://www.crowdstrike.com/products/faq/

• https://www.theverge.com/2024/7/24/24205020/crowdstrike-test-software-bug-windows-bsod-issue

• https://abcnews.go.com/Business/delta-days-restore-normal-service-after-crowdstrike-outage/story?id=112299966

• https://www.cbs42.com/news/business/ap-us-opens-investigation-into-delta-after-global-tech-meltdown-leads-to-massive-cancellations/

• https://www.thestreet.com/investing/stocks/analysts-reboot-crowdstrike-stock-price-target-after-lawsuit

• https://www.bbc.com/news/articles/cy08ljxndr4o

• https://www.reuters.com/legal/crowdstrike-is-sued-by-shareholders-over-huge-software-outage-2024-07-31/

• https://www.reuters.com/legal/crowdstrike-is-sued-by-fliers-after-massive-outage-disrupts-air-travel-2024-08-05/

• https://www.reuters.com/legal/delta-passengers-sue-airline-refusing-refunds-after-computer-outage-2024-08-07/

• https://www.reuters.com/business/aerospace-defense/delta-air-warns-380-mln-revenue-hit-crowdstrike-outage-2024-08-08/

• https://assets.law360news.com/1868000/1868027/crowdstrike%20response%20letter%20(2024.08.08).pdf

• https://www.crowdstrike.com/terms-conditions/

• https://assets.law360news.com/1866000/1866558/2024.08.04%20-%20crowdstrike%20response%20to%20delta%207.29.24%20letter.pdf

• https://assets.law360news.com/1868000/1868027/crowdstrike%20response%20letter%20(2024.08.08).pdf

• https://www.americanbar.org/groups/business_law/resources/business-law-today/2014-october/section-10-b-litigation-the-current-landscape/

• https://www.pcmag.com/news/crowdstrike-exec-shows-up-to-accept-most-epic-fail-award-in-person

• https://www.reuters.com/technology/crowdstrike-exec-testify-before-congress-it-outage-2024-08-30/

• https://abcnews.go.com/US/wireStory/crowdstrike-executive-apologizes-congress-july-global-tech-outage-114077758

• https://moduscreate.com/blog/unrealistic-expectations-dangerous-piece-software/

• https://stackoverflow.blog/2023/12/25/is-software-getting-worse/

• https://www.commondreams.org/news/big-tech-monopoly_

• https://www.geekwire.com/2024/a-little-frightening-crowdstrike-outage-puts-microsofts-role-in-critical-infrastructure-back-in-the-spotlight/

• https://x.com/ByERussell/status/1849937873413325277/photo/1

• https://www.wsj.com/business/airlines/delta-sues-crowdstrike-over-july-operations-meltdown-099ad8fa

• https://www.reuters.com/legal/crowdstrike-delta-sue-each-other-over-flight-disruptions-2024-10-28/

• Delta Air Lines, Inc. v. CrowdStrike, Inc. - complaint filed on 10/25/24

• CrowdStrike, Inc. v. Delta Air Lines, Inc. - complaint filed on 10/25/24

AI Images:

• Image of Y2K generated by Dall-E, Firefly, DreamStudio and Pixlr

• Image of Blue Screens of Death generated by Dall-E, Firefly, and Pixlr

• Image of 3 Moats generated by Dall-E, Firefly, and Pixlr

• Image of Whack-A-Mole generated by Dall-E, Firefly, and Pixlr

• Image of Bird Strike generated by Dall-E, Firefly, and Pixlr

• Image of Falcon in Tech Veil generated by Dall-E, Firefly, and Pixlr

• Image of Ben Franklin generated by Dall-E, Firefly, and Pixlr

Disclaimer:  This post is for general information purposes only. It does not constitute legal advice.  This post reflects the current opinions of the author(s).  The opinions reflected herein are subject to change without being updated.

In a dramatic and rare turn of events, the CEO of a social media platform was arrested, not for his own conduct, but for the alleged transgressions of his company and its user base. Pavel Durov, the CEO of the messaging app Telegram, was taken into custody in August 2024 by the French police on personal charges for crimes connected to illicit activity on the app (more on that to come). The arrest sent shockwaves throughout the tech world, especially in the US, where such action is almost unthinkable.  Why?  Typically, authorities go after corporations rather than their executives.

What makes this case even more fascinating isn’t just the rarity of a CEO being arrested—it’s the fact that US authorities might have come to a different conclusion under US law. Should a social media CEO be legally responsible for user-generated content? Should platforms like Telegram be required to hand over data to government bodies for surveillance at the expense of privacy? Or does this veer too close to censorship? This debate hits at the core values that both the US and France have long championed—liberty, privacy, and freedom of speech, ideals inherited from the French Enlightenment. But where do we draw the line between protecting those ideals and safeguarding society? 

Let’s dig in. 

Roadmap:

I.  What Is Telegram?

II.  The Arrest and Charges:  EU v. US Law

     A. French and European Union Law:  Trying to Make Online Platforms Safe Spaces

     B. US Law:  Don’t Mess with ‘Mericans’ Free Speech

     C. The Takeaways for Social Media Companies Wanting to Do Business in Europe

          1. EU’s Proactive and Precautionary Regulatory Approach: Durov Is Made an Example of for Refusing to Cooperate

          2. French Compliance Obligations: Filing a Declaration of Cryptographic Services

III. Closing Thoughts: Global Trends

I. What Is Telegram?

Telegram is a messaging app with around 950 million users worldwide. It facilitates peer-to-peer messaging and small group chats, alongside larger public “channels” of up to 200,000 users. The app built its reputation on user privacy, both through tech tools and its owners’ distaste for content moderation. However, this commitment to privacy has also attracted criminals looking for a way to communicate discreetly and securely online.  That said, it’s also not the most protected social media platform as compared to its peers (more on that below).

In the past, Telegram had made headlines for platforming groups like neo-Nazis and ISIS.  But despite providing a space to extremists, the app has maintained a strong anti-censorship philosophy, reflected in its lean workforce of only 30 engineers working on the infrastructure and apps—a number dwarfed by its peers’ content moderation teams alone. Just as a comparison, Meta (Facebook) has 15,000 people working just on content moderation. 

II. The Arrest and Charges:  EU v. US Law

Durov faces multiple charges in France, including the following:

(1) complicity in allowing Telegram users to commit crimes through the platform; 

(2) refusing to cooperate with investigations into crimes that include the distribution of child sexual abuse material (CSAM), drug trafficking, and fraud; and 

(3) importing a cryptographic service into France without filing the requisite declaration with the government. 

Let’s break down the charges, where they come from, and how they contrast with the American approach.

A. French and European Union Law:  Trying to Make Online Platforms Safe Spaces

In an effort to make the digital world safer, French regulators have ramped up their expectations for content moderation on online platforms by focusing on the culpability of the executive officers. The charges against Durov are based on a recent and untested French criminal law. Passed in 2023, Article 323-3-2 of the French Penal Code imposes up to a 5-year sentence and €150,000 fine on executives who knowingly allow the distribution of, or facilitate payments for, illegal content or services on their platforms. In cases involving organized crime, the penalty is enhanced to up to 10 years and €500,000. This law’s imposition of personal liability for tech executives is unparalleled in both America and other European countries.

While France’s ability to charge Durov individually is clearly uncommon, its strict approach to social media moderation is more common across the continent. Article 323-3-2 was passed alongside the European Commission’s 2022 Digital Services Act (DSA), which requires social media companies like Telegram to monitor user-generated content and provide data related to alleged criminal activities. The EU can fine large violators up to 6% of their gross revenue, while the fine for smaller violators depends on the country they choose to be regulated in. Telegram is currently regulated by Belgium, although the EU is investigating whether it underreported its European user base to avoid oversight. Belgium also imposes a fine of up to 6% of gross revenue for DSA violations. The DSA supplements existing French law that requires social media platforms to moderate their content. For example, under the Loi Lutte Contra la Haine sur Internet (Law Against Hate Speech on the Internet), the French government can fine global internet companies up to $1.4M per violation and up to 4% of their global revenue for not removing hate speech.

While European laws are getting stricter on content moderation, France stands out as the most aggressive enforcer due to its ability to criminally charge executives individually.

B. US Law:  Don’t Mess with ‘Mericans’ Free Speech

In the United States, free speech protections are paramount, with social media platforms benefiting from strong legal shields against liability for user-generated content. Hence, the charges against Durov for complicity would be much harder to achieve in the US. 

Section 230 of the Communications Decency Act gives social media companies (and by extension, officers and employees) broad immunity for their users’ posts with some limits (companies will still be liable if they violate federal criminal law, create harmful content, or violate a third party’s intellectual property rights). This framework allows for a balance between free speech and accountability. This means that, had US law applied, Section 230 would likely shield Telegram and Durov for the most part from liability for failing to take down fraudulent, drug-related, and most other illegal user-generated content. However, Telegram would clearly be responsible for the user-generated CSAM on its platform, which falls into Section 230’s carve-out for federal crimes. More on Section 230 from a prior post.

Additionally, in the US, executives usually aren’t personally responsible for their company’s actions due to a concept called the "corporate veil." Under this legal doctrine, a company is seen as a separate entity from the people who run it, protecting executives from being sued for the company’s bad actions. This allows the executives to take business risks without worrying about losing their personal assets. However, if such executives were to engage in illegal activities or serious wrongdoing like fraud, courts can sometimes "pierce the corporate veil" and hold individuals personally responsible.

Understanding these differing legal philosophies, the complicity charge is alarming for social media companies in Europe for two reasons: 

1. It highlights Europe's trend toward holding platforms liable for user-generated content and lax moderation, unlike in the US where laws limit such liability, and 

2. It targets Telegram's CEO, Durov, personally rather than the company, which is uncommon in both the U.S. and Europe where corporate entities are typically held accountable.

Given the US’s laissez-faire attitude, perhaps Americans are more French than the French, peut-être?

C. The Takeaways for Social Media Companies Wanting to Do Business in Europe

1. EU’s Proactive and Precautionary Regulatory Approach: Durov Is Made an Example of for Refusing to Cooperate

France's tough stance on Telegram may be influenced by the company's history of resisting legal investigations and efforts to moderate content.  At the core of this refusal is Durov’s staunch opposition to government censorship. For context, the Russian-born Durov was forced to leave his home country after refusing to cooperate with the Russian government’s attempted censorship of his first social media app, Vkontakte. That experience strengthened Durov’s anti-censorship ideology and inspired him to create Telegram as a platform that lived up to his ideals of free speech, privacy, and resistance to government control. 

While these ideals aren't inherently problematic, it's the degree to which Durov adheres to them that often puts him at odds with governments. Durov’s pro-free-speech philosophy trends towards absolutism. His refusal to cooperate in the French investigation is just the latest in a series of negative encounters with state authorities. Telegram regularly refused to work with governments, even when their requests involved legitimate issues such as child pornography moderation and complying with mandatory reporting laws. For instance, Germany fined Telegram in 2022 for failing to comply with its criminal reporting laws, and Brazil temporarily suspended the company in 2023 for refusing to cooperate with an investigation into neo-Nazi activity. Telegram’s behavior, informed by its anti-moderation philosophy, goes considerably further than its competitors. In contrast, major social media platform owners Meta and Google regularly comply with lawful government data requests worldwide. Tech companies should note that the EU is willing to go further than the US and isn’t afraid of making an example of individuals.  That said, it’s the absolutist approach that is getting Durov and Telegram into trouble.

Ironically, if it chose to, Telegram could have cooperated with French authorities more easily than its peers. Despite its privacy-forward image, Telegram isn’t as secure as many other messaging platforms. Many large messaging services use end-to-end encryption by default, ensuring that only the participants in a conversation can read the messages—restricting even the platform or law enforcement from accessing the content. Telegram’s encryption, on the other hand, is optional; it automatically uses server-client encryption. Users must specifically opt into "secret chats" to access end-to-end encryption. These secret chats come with additional privacy features, such as self-destructing messages and anti-forwarding protections.  Moreover, it seems a bit disingenuous that a company that claims to care so much about privacy doesn’t offer end-to-end encryption by default.

2. French Compliance Obligations: Filing a Declaration of Cryptographic Services

Let’s dig into the charge of importing a cryptographic service into France without the required declaration as it’s yet another charge that could not exist under US law.  Durov’s encryption-related charge combines the two main themes we’ve seen so far: (i) how French law’s aggressive approach to content moderation differs from that of American, and (ii) how Telegram’s antagonistic behavior has made it the test case for France’s new approach. 

France charged Durov under Article 30-I of French Law 2004-575, known as “Loi pour la Confiance dans l’Economie Numérique” (Law for Confidence in the Digital Economy). The law requires those who import certain encryption tools to make a declaration to the French cybersecurity agency, the French Network and Information Security Agency (ANSSI). Interestingly, and perhaps a result of Telegram’s especially antagonistic relationship with national authorities, France has for the first time used its declaration law to charge a social media platform or executive. 

The French licensing system could not exist in America due to First Amendment protections, which recognize code as a form of free speech. This principle was established in the landmark 1996 case Bernstein v. Department of Justice, where a federal court held that the US government could not constitutionally require code to be licensed—as in France—before being published. Any restriction on free speech, like regulating code, requires a compelling government interest. Today, the US primarily applies its compelling interest through (i) export control laws and (ii) foreign investment oversight by the Committee on Foreign Investment in the United States (CFIUS), focusing on national security without broadly infringing upon free speech rights.

The declaration law’s first-ever use may signal that France has set its sights on encryption software that it sees as an impediment to enforcing its content moderation laws. Telegram’s antagonist behavior and reputation for attracting criminals make them a particularly good test case. But how far will France go? If France focuses on this charge, encryption software will become another area–alongside content moderation–where Europe’s law is increasingly diverging from those in America. Considering how much computer engineering and tech rely on encryption, understanding the compliance requirements should be a priority for any tech company aiming to do business in France.

III. Closing Thoughts: Global Trends

France’s crackdown on the darker corners of social media is part of a larger global trend. In 2022, a Brazilian court launched an aggressive moderation campaign to curb election misinformation. However, as the saying goes, "the road to hell is paved with good intentions." This experiment went viral when social media platform X (formerly Twitter) resisted the court's order to remove certain accounts for spreading alleged misinformation. In response, in September 2024, the Brazilian court blocked X nationwide, threatened heavy fines for Brazilians caught using the platform, and even threatened to arrest X’s executives in the country—a move that forced X to close its Brazilian office.  

In a notable about-face, as of September 21, 2024, X has reversed its stance after weeks of defying court orders, now complying with Brazil’s Supreme Court demands, including removing accounts deemed threats to democracy in an effort to have the platform unblocked. Similarly, just this month, Durov acknowledged these issues and pledged to improve Telegram's moderation practices, committing to the removal of features being misused for illegal activities.

The reality is that holding an absolutist stance about free speech becomes increasingly difficult for social media platforms as governments around the world, like those in Brazil and France, implement stricter regulations to combat misinformation, hate speech, and threats to democracy. These platforms, while championing free expression, often find themselves at odds with national laws designed to protect the public. The clash between ideals of unrestricted speech and the practical need for moderation in the face of real-world consequences highlights the delicate balance tech companies must navigate to operate globally, often leading them to compromise on their principles to avoid legal and financial penalties.

While many free speech advocates believed Brazil's moderation efforts went too far, it does suggest that other countries are looking to the EU as a model for stricter content regulation and may begin adopting similar policies to combat misinformation and protect democratic institutions.  Moreover, France’s actions are part of a broader European trend, where the European Council has recently passed a series of sweeping tech regulations (including the Digital Services Act discussed earlier). This trend is significant enough to have earned a nickname: "the Brussels effect." The process is simple: Europe sets strict global standards, and companies comply worldwide because it’s cheaper than customizing regulations for each country.

To conclude, Durov's arrest raises the question of whether France’s actions could signal the start of a new "Brussels effect," where social media platforms are forced to adopt more aggressive moderation globally. Given that companies often design their policies to meet Europe's stringent standards—since it's cheaper than customizing regulations for each market—platforms may increasingly have to adhere to the European standard for content moderation or face the risk of personal liability for their executives. Time will tell. 

In the meantime, if you're a CEO of a social media company, it might be wise to reconsider any European vacation plans. Instead of the French Riviera, there’s always the Redneck Riviera?!

Subscribe now

Share

[Special thanks to Anahita Arora, Sofia DeSimone, Bryan Edelman and Jane Perov for their thoughtful feedback.]

Resources:

• French Preliminary Charges, https://www.tribunal-de-paris.justice.fr/sites/default/files/2024-08/2024-08-26%20-%20CP%20TELEGRAM%20.pdf 

• Adam Satariano & Cecilia Kang, Can Tech Executives Be Held Responsible for What Happens on Their Platforms?, N.Y. Times (Aug. 28, 2024), https://www.nytimes.com/2024/08/28/technology/durov-telegram-liability-platforms.html. 

• Barbara Ortutay, What is Telegram and Why Was Its CEO Arrested in Paris?, AP News (Aug. 28, 2024, 4:36 PM), https://apnews.com/article/telegram-pavel-durov-arrest-2c8015c102cce23c23d55c6ca82641c5.

• Aurelian Breeden & Adam Satariano, Telegram Founder Charged With Wide Range of Crimes in France, N.Y. Times (Aug. 28, 2024), https://www.nytimes.com/2024/08/28/business/telegram-ceo-pavel-durov-charged.html.

• Mike Isaac & Sheera Frenkel, Telegram Founder’s Indictment Thrusts Encryption Into the Spotlight, N.Y. Times (Aug. 29, 2024), https://www.nytimes.com/2024/08/29/technology/telegram-encryption-pavel-durov.html. 

• Miranda Nazzaro, Telegram CEO’s Arrest: What It Could Mean for US Companies, The Hill (Aug. 29, 2024, 6:00 AM), https://thehill.com/policy/technology/4852352-telegram-ceo-detention-free-speech/

• Ash Johnson & Daniel Castro, Overview of Section 230: What It Is, Why It Was Created, and What It Has Achieved, Info. Tech. & Innovation Found. (Feb. 22, 2021), https://itif.org/publications/2021/02/22/overview-section-230-what-it-why-it-was-created-and-what-it-has-achieved/. 

• David Greene & Eva Galperin, The French Detention: Why We’re Watching the Telegram Situation Closely, EFF (Aug. 30, 2024), https://www.eff.org/deeplinks/2024/08/french-detention-why-were-watching-telegram-situation-closely.

• Ellen Ioanes, Why Telegram’s CEO Was Detained in France, VOX (Aug. 28, 2024, 4:45 PM), https://www.vox.com/technology/368896/telegram-pavel-durov-france-cyber-crimes-terrorism-content-moderation-macron-elon-musk. 

• Pieter Haeck, As France Cracks Down on Telegram, EU Sits on Sidelines, Politico (Aug. 29, 2024, 6:00 AM), https://www.politico.eu/article/telegram-crackdown-eu-pavel-durov-paris-online-dsa/.

• Joe Tidy, Telegram Repeatedly Refuses to Join Child Protection Schemes, BBC, https://www.bbc.com/news/articles/cy54905nv0go.

• Yohan Yun, How Big Tech Handles Privacy and Governments’ Data Demands, CoinTelegraph (Aug.29, 2024), https://cointelegraph.com/news/big-tech-privacy-government-data-regulation.

• Foo Yun Chee & Supantha Mukherjee, Musk’s X Has a Fraction of Rivals’ Content Moderators, EU Says, Reuters (Nov. 10, 2023, 3:48 PM), https://www.reuters.com/technology/musks-x-has-fraction-rivals-content-moderators-eu-says-2023-11-10/#:~:text=According%20to%20reports%20the%20companies,speaking%20on%20condition%20of%20anonymity. 

• Lorenzo Franceschi-Bicchierai, Telegram Says It Has ‘About 30 Engineers’; Security Experts Say That’s a Red Flag, TechCrunch (June 24, 2024, 1:04 PM), https://techcrunch.com/2024/06/24/experts-say-telegrams-30-engineers-team-is-a-security-red-flag/?guccounter=2.

• Digital Services Act, Eur. Council: Council of the Eur. Union (July 5, 2024), https://www.consilium.europa.eu/en/policies/digital-services-act/#consequences.

• Digital Services Act Tracker, DLA Piper, https://www.dlapiper.com/en/insights/publications/2024/02/digital-services-act-tracker (last visited Sept. 15, 2024).

• Jack Nicas & Kate Conger, How Brazil’s Experiment Fighting Fake News Led to a Ban on X, N.Y. Times (Aug. 31, 2024), https://www.nytimes.com/2024/08/31/world/americas/brazil-x-ban-free-speech.html?smid=nytcore-ios-share&referringSource=articleShare&sgrp=c-cb.

• Antoaneta Roussi, Clothilde Goujard & Océane Herrero, France Uses Arcane Cyber Law to Charge Telegram CEO, Politico (Sept. 5, 2024, 8:00 AM), https://www.politico.eu/article/telegram-ceo-pavel-durov-arrest-france-charges-cyber-laws/.

• Yohan Yun, How Big Tech Handles Privacy and Governments’ Data Demands, CoinTelegraph (Aug. 29, 2024), https://cointelegraph.com/news/big-tech-privacy-government-data-regulation. 

• Gabriel Stargardter, France Uses Tough, Untested Cybercrime Law to Target Telegram’s Durov, Reuters (Sept. 17,2024, 4:12 PM), https://www.reuters.com/world/europe/france-uses-tough-untested-cybercrime-law-target-telegrams-durov-2024-09-17.

• Liberty, Equality, Fraternity, France Diplomacy, https://www.diplomatie.gouv.fr/en/coming-to-france/france-facts/symbols-of-the-republic/article/liberty-equality-fraternity (last visited Sept. 20, 2024).

• Mark Trevelyan & Martin Coulter, Durov Says Telegram Will Tackle Criticism of How It Moderates Content, Reuters (Sept. 6, 2024, 10:20 AM), https://www.reuters.com/technology/durov-says-telegram-will-take-new-approach-towards-moderation-2024-09-06/.

• Bernstein v. U.S. Dep’t of State, 945 F. Supp. 1257 (N.D. Cal. 1996), reprinted in https://law.justia.com/cases/federal/district-courts/FSupp/945/1279/1457799/.

• Lora Kolodny, X Blocked in Brazil After Supreme Court Panel Upholds Suspension Order, CNBC (Sept. 2, 2024, 2:02 PM), https://cnbc.com/2024/09/02/x-blocked-in-brazil-after-court-majority-upholds-suspension-order.html. 

• Telegram Logos and App Screenshots, Telegram https://telegram.org/tour/screenshots (last visited Sept. 20, 2024).

• Margaret Fogarty, Artist Revives Singing Telegram with a Modern Twist, Western Union (May 13, 2020), https://www.westernunion.com/blog/en/artist-revives-singing-telegram-with-a-modern-twist/.

• Justino Mora, Demystifying the Signal Protocl for End-to-End Encryption (E2EE), Medium (Aug. 17, 2017), https://medium.com/@justinomora/demystifying-the-signal-protocol-for-end-to-end-encryption-e2ee-ad6a567e6cb4.

• Telegram FAQ, Telegram, https://telegram.org/faq?setln=en (last visited Sept. 22, 2024).

• MTProto Mobile Protocol, Telegram, https://core.telegram.org/mtproto (last visited Sept. 22, 2024).

• Susan Buckner & Aviana Cooper, Piercing the Corporate Veil, FindLaw (May 23, 2024), https://www.findlaw.com/smallbusiness/liability-and-insurance/officer-and-director-liability-piercing-the-corporate-veil.html.

• Jack Nicas & Ana Ionova, Elon Musk’s X Backs Down in Brazil, N.Y. Times (Sept. 21, 2024),https://www.nytimes.com/2024/09/21/world/americas/elon-musk-x-brazil.html.

AI Images:

• Image of French Propaganda Poster generated by Dall-E, Firefly, and Pixlr

• Image of Napoleon generated by Dall-E

• Image of James Madison generated by Dall-E

• Image of Colosseum v. Wrigley Field generated by Dall-E, Firefly, and Pixlr

• Image of Voltaire Movie Poster generated by Dall-E, Firefly, and Pixlr

• Image of Singing Telegram generated by Dall-E, Firefly, and Pixlr

• Image of Poker Match generated by Dall-E, DreamStudio, Firefly, and Pixlr

• Image of Redneck Riviera generated by Dall-E, Firefly, and Pixlr

Disclaimer:  This post is for general information purposes only. It does not constitute legal advice.  This post reflects the current opinions of the author(s).  The opinions reflected herein are subject to change without being updated.

Background

As previously discussed in this prior post, the case of Moody v. NetChoice concerned laws passed by Texas and Florida that had limited how social media companies, like Facebook and YouTube, could moderate the content that appears on their platforms. The Florida and Texas laws (i) aimed to stop tech companies from filtering, prioritizing, and labeling content in certain ways and (ii) required them to give specific reasons for removing or changing posts. Social media companies argued that these laws violated their free speech rights by restricting how they curate user-generated posts.

The Supreme Court's Decision

The Court didn’t actually make any ruling but vacated and sent the case back to the lower courts for further review.

Majority Opinion (Roberts, Sotomayor, Kagan, Barrett, Jackson, and Kavanaugh): Justice Kagan authored the Court’s opinion. 3 liberal and 3 conservative justices joined her opinion (with Justice Jackson joining only certain parts). Reading the majority opinion, it would seem the Court ruled against government control over social media content moderation, overturning conflicting appeals court decisions. However, this isn’t a victory for social media companies; it’s really a swing and a whiff.

NetChoice, the trade group representing Facebook and Google, had brought these cases as "facial challenges." It wanted the Court to declare that the laws were generally unconstitutional for everyone (as opposed to being unconstitutional for certain people — what’s called an “as applied challenge”). A win for social media companies would not only have blocked these laws but also prevented future tech regulations. 

However, since the Court chose not to decide the merits of the case and to send the cases back to the lower courts (a “remand”), the First Amendment discussions in the rulings are merely comments and observations, which are not legally binding (“dicta”). They create no precedent. Rather, the cases must be reconsidered by the lower courts and any decision was punted for another day.

The interesting takeaway from the ruling is that it offers a glimpse into the justices' perspectives on regulating social media and big tech:

• Justice Kagan viewed social media regulation as akin to newspaper regulation, primarily protected by the First Amendment. Her comments focused on the “intent to suppress” in these states’ laws. However, regulating algorithmic feeds may be constitutional because it sorts content based on “a user’s expressed interests and past activities.”

• Justice Jackson avoided weighing in on the First Amendment, theoretical debate, which might indicate a less tech-friendly position.

• Justice Barrett noted the potential implications of artificial intelligence (AI) in content moderation. She suggested that while AI might be used to implement human decisions, its outputs may not always be protected under the First Amendment (for example, if an AI model were tasked with determining what is and whether to remove hateful content). This is a point to watch in future cases.  Barrett also highlighted that the free speech analysis could change depending on the “corporate structure and ownership” of some platforms — specifically, if the platform were owned by foreign entities.

Minority Opinion (Thomas, Gorsuch, and Alito): In separate, concurring opinions the minority agreed with the decision to vacate and remand the cases, but they criticized the majority for what it considered superfluous comments and opinions based on an incomplete record.

Ironically, the minority offered their own views, disagreeing that content moderation is as expressive as traditional editorial functions. They argued that the laws should be upheld to some extent to address concerns about censorship and the suppression of diverse viewpoints on social media platforms. They believed the states had legitimate interests in ensuring that all voices be heard online.

Closing Thoughts

There’s a possibility that we might see some alignment in future cases between the liberal Jackson and the conservative Barrett, Thomas, Gorsuch, and Alito. The enemy of my enemy…

There is clearly a desire to regulate social media on all sides of the aisle, but the question is how you do so without violating freedom of speech. Conservatives aim to address what they see as a liberal bias that suppresses conservative voices, while liberals focus on tackling misinformation, hate speech, and harmful content that can spread without proper moderation.

Achieving this balance is difficult. One wonders when big tech will finally face regulation, and whether regulating big tech is one of the few remaining non-partisan issues.

Subscribe now

Share

Resources:

• https://www.thenation.com/article/society/supreme-court-netchoice-moody/

• https://www.americanactionforum.org/insight/moody-v-netchoice-implications-for-speech-regulation/#:~:text=As%20the%20Court%20made%20clear,balancing%20the%20marketplace%20of%20ideas.

• https://www.supremecourt.gov/opinions/23pdf/22-277_d18f.pdf

• https://www.theverge.com/2024/7/1/24166388/supreme-court-ruling-moody-paxton-texas-florida-social-media-law

• https://firstamendment.mtsu.edu/article/facial-challenges/

• https://www.law.cornell.edu/wex/dicta

• https://www.law.cornell.edu/wex/remand

• https://digitalcommons.law.utulsa.edu/cgi/viewcontent.cgi?article=1364&context=tlr

• https://scholarship.law.gwu.edu/cgi/viewcontent.cgi?params=/context/faculty_publications/article/1201/&path_info=Defining_Dicta_new.pdf

Images:

• Image of Luchadores generated by Dall-E, Firefly, and Pixlr

• Image of Scales of Justice generated by Dall-E, Firefly, DreamStudio and Pixlr

Disclaimer:  This post is for general information purposes only. It does not constitute legal advice.  This post reflects the current opinions of the author(s).  The opinions reflected herein are subject to change without being updated.

Follow up from my previous post:

Today, the US Supreme Court (in a 6-3 decision along conservative/liberal lines) in Loper Bright Enterprises v. Raimondo has overturned the “Chevron Doctrine” or “Chevron Deference.”  

Today, the US Supreme Court (in a 6-3 decision along conservative/liberal lines) in Loper Bright Enterprises v. Raimondo has overturned the “Chevron Doctrine” or “Chevron Deference.” Note, this is the second major ruling this week that reduces agency authority. The Court also ruled this week that the SEC’s use of in-house judges in securities fraud cases was unconstitutional (SEC v. Jarkesy).

Overturning the Chevron Doctrine is a big deal.  To put this in perspective, 70 Supreme Court decisions and 17,000 lower court decisions have relied on Chevron. It effectively weakens the power of executive agencies, ending a long-established precedent relied upon since 1984 (Chevron v. Natural Resources Council).

Under the Chevron Doctrine, a court is supposed to defer to an agency’s interpretation of the statute it administers when Congress’s intention of that law is ambiguous or silent -- so long as the agency’s interpretation is “reasonable.”   Please see my prior post for more about this legal doctrine.

I. The Ruling

What Does the Ruling Say?
Going forward, the court must decide if an agency has authority to act when a statute is ambiguous without automatically deferring to agencies' interpretations of said laws. Instead, courts will interpret the laws on their own and will only consider the agencies' views if they find them convincing (persuasive and not binding). In other words, the Supreme Court stressed that judges should make their own decisions if the meaning of the law is unclear and not just follow what agencies say.

What Does This Mean for Previously-Ruled Cases?
The ruling does not automatically overturn previous cases decided under the Chevron Doctrine. The Court clarified that it isn’t challenging prior decisions.  Nevertheless, people might try to revisit and challenge old cases where the Chevron deference was crucial to the outcome.

What Does This Mean for Open Cases?
For cases that are still open or under appeal, parties may argue for a re-evaluation of agency interpretations using the new standard of “independent judicial interpretation.”   This means that courts might reach different conclusions if they interpret the laws differently from the agencies.

What Are the Potential Consequences of Overturning Chevron?
Many may be celebrating the end of Chevron, but with anything, there will likely be many positive and negative effects of this decision:

• 1. Congress Must Clarify Agency Authority:   Instead of agencies creating regulations through enforcement (as you see with crypto from the SEC and the CFTC), they likely now have to wait for Congress to pass new laws to clarify what authority they actually do have.  Why?  Because these agencies would need explicit permission from Congress.

• 2. Increase in Lawsuits Against Agencies:  We will likely see more legal battles against agencies.  There could be a surge of lawsuits, making it chaotic as every unclear term in a law could be subject to litigation, complicating governance.

• 3. Agencies Defanged:  If Congress is stuck in partisan gridlock, it might mean no new laws are passed, leaving agencies with less power.  That Congress will act to clarify agency authority assumes a lot.

• 4. Agency Hesitancy:  Agencies may also become more cautious in issuing guidance and making rules given they will have less authority.

• 5. Power Shifts & Patchwork of Regs:  This decision could shift power to the courts, leading to varied interpretations of regulations across different regions. You may see forum shopping (where you sue in certain states that you know to be favorable to your views).

II. Final Thoughts

Once again, the present Supreme Court has proven a lack of deference for “stare decisis” (the legal concept that the law honors prior rulings, opinions and precedents from previous case law) — prior terms saw reversals on abortion and affirmative action.

What Does It Mean for Crypto?
For those thrilled about the ruling, this is not a complete panacea to SEC/CFTC overreach via regulation by enforcement. The Howey Test (the test that determines if a certain transaction is an “investment contract” and thereby a security) is judge made law. So overturning Chevron doesn’t overturn the Howey Test. The impact in reality would more likely arise in SEC rulemaking.

While the decision may curb some regulatory overreach, it also introduces uncertainty and potential chaos as the courts, Congress, and regulatory agencies adjust to this new legal landscape. The need for clear and comprehensive legislative action is more pressing than ever to establish well-defined regulatory frameworks that support the nascent crypto sector.

Subscribe now

Share

Images:

• Image of Tug of War generated by Dall-E, Firefly, DreamStudio and Pixlr

• Image of Judge Gensler generated by Dall-E, Firefly, DreamStudio and Pixlr

Disclaimer:  This post is for general information purposes only. It does not constitute legal advice.  This post reflects the current opinions of the author(s).  The opinions reflected herein are subject to change without being updated.

Introduction 

Software is an anomalous industry.  There aren't many types of businesses that can get away with releasing products or services to the public with the assumption that there could be a high likelihood of significant flaws and defects.  If Tesla were to release a car with faulty brakes with the attitude of, "We can just fix this later,” they’d be sued into bankruptcy.  Yet software companies don’t face an onslaught of lawsuits for products that could be laden with flaws, and if they are sued, they frequently get such cases thrown out or settled for nominal amounts. 

Ever wonder why software companies get away with that and why, as users, we are constantly asked to update software and accept and agree to updates in the terms of use and privacy policy?  In this article, we'll explore the legal barriers and norms shielding tech companies from an onslaught of civil litigation from private parties, the points of negotiation you should try to push for if you have any leverage with a software company, and the recent case law trends.  Buckle up, let’s go beyond the firewall, and get “wired in.” 

Roadmap:

I.  What Is a Bug?  Why Is It So Hard to Create Glitch-Free Software?

II.  Is Software a Service or a Product?

III.  Tech Veil Protects Software Companies from an Onslaught of Class Action Lawsuits

     A.  Litigation Moat

     B.  Contractual Moat 

     C.  Structural Moat  

IV.  Recent Case Law Trends in the US and UK

V.  Conclusion

VI. Extra Credit (Government Actors v. Software Developers)

Key Takeaways (TL;DR):

• Creating bug-free software is challenging because of its complexity and whether software is classified as a service or a product affects how liability is determined.

• Software companies are shielded by a "tech veil" that includes legal defenses like litigation hurdles, contractual terms, and structural protections.

• The terms of use and licensing agreements include disclaimers of warranties, liability limits, and indemnification clauses to protect software companies. Courts usually uphold these terms, so consumers should negotiate exceptions for express warranties, liability caps, and limit indemnification.

• Case law shows that courts often favor software companies in liability cases.

• Meanwhile, new regulatory efforts are emerging to hold software companies to higher standards, especially re AI, crypto, and cybersecurity.

I. What Is a Bug?  Why Is It So Hard to Create Glitch-Free Software?

A software bug is a mistake or glitch in a program that prevents it from working correctly. Imagine baking a cake with a typo in the recipe calling for 1 tablespoon instead of 1 teaspoon of salt, making it too salty. Now, if this cake is a layer in a multi-tiered cake, the mistake affects the entire dessert. Similarly, minor software errors can escalate due to dependencies (external libraries or modules a software relies on) and integrations (connecting different software systems), causing widespread issues in connected systems.

Writing flawless software is also like setting up a massive line of falling dominos: if one tile is out of place, the entire chain reaction may fail. Even a tiny mistake, like a misplaced character or minor logical error in the code, can lead to crashes, data loss, or security vulnerabilities. Working code in one part of a program might break when edits are made elsewhere. Software must also be compatible with different devices and systems and requires regular updates, which can introduce new problems. These factors make it incredibly challenging to ensure software is entirely fault-free.

II. Is Software a Service or a Product?

So now that we understand why software is complex as a technology, let’s explore why it’s tricky to hold software companies liable.  As a starting point, let's consider whether software is (i) an intangible good/product or (ii) a service.  Frustratingly, software could be both!   

Software as a service

In the US, contracts for services (and real property) fall under common law (i.e., case law and judicial decisions). Software may be considered a service if custom-designed for a specific customer, licensed in cloud applications (SaaS or software-as-a-service), or involved maintenance and support services.

Software as a product

Contracts for tangible and movable products or goods fall under state commercial laws (known as the Uniform Commercial Code (UCC)). The UCC provides a standardized, predictable framework for commercial transactions involving movable goods and products, which, in the context of software, we can think of as "off-the-shelf" products, software included in hardware, software sold on physical mediums, or any mass-marketed software.  For more on the UCC and how commercial law works in the US, I recommend my prior post.  

Of course, it's often difficult to classify software as a product OR a service as it may have elements of both.  In which case, software that is a mixture of product and service will require a court to analyze which predominates.  That analysis matters because whether the software is a service or a product can determine the available legal routes for a lawsuit.

III. Tech Veil Protects Software Companies from an Onslaught of Class Action Lawsuits

Like the corporate law concept of the “corporate veil” that shields stockholders from personal liability for a corporation’s legal infractions, software companies are protected against broad liability by a “tech veil.” 

Coined by Jenny Leung, the "tech veil" helps software companies and developers avoid liability for bugs, vulnerabilities or third-party misuse of their code.  Indeed, various legal tactics have created moats (i.e., a competitive advantages deterring adversaries) that shield software companies from the wrath of litigants. I classify these moats into three broad categories:

• A. Litigation Moats

• B. Contractual Moats

• C. Structural Moats

A. Litigation Moats

In general, software companies can be sued under claims for a (1) breach of warranty, (2) negligence, or (3) strict liability.  The factors that lead you to decide upon which legal theory to sue a software company depend on whether:

• the software is considered a good or service,

• the damage is economic, personal, or property-related,

• there is a contract in place, and

• the software is part of something abnormally dangerous.

1. Breach of Warranty

What is a breach of warranty?

When software fails or isn't delivered correctly, a user with a contract can sue the software company for breaching or violating the contract. This breach occurs when the company fails to fulfill its contractual obligations.

Contracts typically include promises or guarantees about the quality of the product or service, known as warranties. If the software doesn't meet the standards or specifications outlined in the warranties, it constitutes a breach of warranty. Often, when a software customer sues for breach of contract, the underlying issue is actually a breach of warranty. [Note: A breach of warranty is a specific type of breach of contract, but not all breaches of contract involve a breach of warranty. For simplicity, consider a breach of warranty claim as also being a breach of contract.]

There are two types of warranties:

1. “Express warranties” are specific promises made by the seller or service provider in the contract.  For example, I promise to deliver you working software by Tuesday.

2. “Implied warranties” are legal protections that the law automatically applies to goods and services, regardless of whether stated or not in the contract.  There are two types: (i) "fitness for particular use" (when the seller knows the buyer needs the goods for a specific purpose and the buyer relies on the seller to provide the correct goods for that purpose) and (ii) "merchantability" (goods are good enough to be sold and used for their usual purpose without any issues).  Here’s an example of a warranty:

When it comes to determining if the seller has done what's required under the contract, the standards are different for product contracts versus service contracts.  For product contracts, the seller must meet all the specifications, descriptions, and promises outlined in the contract exactly - this is called "perfect tender."  Even a minor deviation from any contract term is considered a breach.  

However, for service contracts, the requirements are not as strict. Instead, they only need to provide a service that substantially meets the main contractual requirements, even if there are some minor issues or deficiencies. As long as the essential parts of the contract are reasonably fulfilled and the service is fit for its intended purpose, it is generally considered acceptable.

Why can’t plaintiffs extract a lot of money against software companies for breach of warranty (contract) claims when there are issues with the software? 

When software fails and causes only financial losses, lawsuits are typically limited to breach of contract claims. Recovery is usually restricted to direct damages, which means compensating the customer for their actual losses, such as the cost or value lost. The goal is to place the non-breaching party in the position they would have been in if the contract had been fulfilled. This often makes lawsuits unattractive because legal costs can exceed potential recovery.

The rationale is that parties can manage risks through contract terms, with economic risks best handled within the contract framework and often mitigated with insurance. Contract law aims to facilitate fair exchanges (not punishment), focusing on restoring the parties to their expected positions if the contract were honored. We’ll see how the language of the contract itself can limit recovery.

If the damage involves an accident or physical harm, that’s better suited for the next two litigation moats.

2. Negligence 

What is negligence as it relates to software as a product vs. service?

If damages from software include damages to property or a person, a negligence lawsuit can be brought.  Negligence occurs when someone fails to take reasonable care to prevent harm to others.  Unlike contract related claims, negligence claims do not require a direct contractual relationship between the consumer and the manufacturer; liability is imposed by law. For example, let’s say a software bug led to an accident in a factory, in which some of the workers were injured.  Those workers could potentially sue the software company for negligence, even though they didn't directly purchase the software from or have a contract with that company.

Negligence claims for software products can be based on defects, which fall into these categories:

• (i) design defects (where the product’s design is itself unsafe),

• (ii) manufacturing defects (where the product deviates from design specifications), or 

• (iii) information defects (where there is a failure to provide proper instructions or warnings).  

For software as a service, negligence involves failing to perform services with reasonable care.   Negligence allows for compensation if it can be shown that a software defect arose from the service provider's lack of proper care in designing or developing the software.  Under this principle, a service provider isn't liable for every defect that causes loss but only for harmful defects that could have been identified and remedied through reasonable software practices.  

Why is it so hard to bring a negligence claim against a software company?

To succeed in a negligence claim, you must prove all of the following 4 elements:  (1) there was a legal duty, (2) that duty was breached, (3) the breach of that duty caused harm, and (4) that harm led to damages.  Pretty simple, right?  Well, for software, this is hard to prove:

• Duty and Breach of Duty (Element 1 & 2):  Software developers are not held to a higher "professional" standard of care like doctors or lawyers.  They have a duty to act with the reasonable care of an average person, which is a low bar.  Proving a breach of this minimal duty is tricky because an ordinary person would not catch every possible defect (we are only human and flawed, just like software).  

• Causation (Element 3):  Proving the software defect directly caused the harm is also challenging. Users must prove the software defect itself caused the harm, rather than any user-related contribution, like failure to install updates, improper installation, or unauthorized modifications to the software.  The involvement of multiple intermediaries (developer -> third-party vendor -> end-user) further complicates assigning blame.  Additionally, as software often interacts with other hardware or software, pinpointing the defect as the direct cause (known as ‘proximate cause’) becomes difficult.  Proving who caused the harm gets complicated!

• Damages (Element 4):   Most software products don't cause tangible injuries or property damage.  While exceptions exist like self-driving car software failures, these are rare cases.  So, proving damages can be pretty remote.

Remember, a litigant needs to prove all four elements (duty, breach, causation, and damages) to win – an uphill battle.

In cases where there was a contract between the user and the company, the “Economic Loss Doctrine” can prohibit plaintiffs from seeking compensation for negligence (and also strict liability) for solely economic losses. Recovery is limited to claims involving property or personal damage. It ensures that parties stick to the remedies specified in their contract, preventing them from seeking additional compensation through negligence claims.

Let's turn to strict liability, which focuses on the product's inherent danger rather than the developer's level of care.

3. Strict Liability 

What is strict liability?

If a software product is inherently, abnormally, or imminently dangerous (ex., software embedded in a medical device that could cause injury if it malfunctions), lawsuits might be brought under a strict liability standard.  Strict liability doesn't take fault into account.  Under strict liability, a software developer is automatically held accountable for all physical injuries and associated losses caused by a defective product it produces, regardless of whether it was negligent in its design or manufacturing decisions.  The idea is that when dealing with inherently dangerous products, the responsibility for any resulting harm should rest with the producer to ensure higher safety standards and protect public welfare.

Is it easy to succeed in a lawsuit against software companies for strict liability?   Who else can be liable?

You can sue anyone in the commercial chain of sale for strict liability as long as the product was defective when it left the defendant’s control.  To succeed, you must prove that: (i) the defendant was the supplier who produced or sold a defective product, (ii) the defective product was the cause of a physical injury or property damage, and (iii) the consumer suffered those damages.  Again, most software doesn't result in physical or personal damages, so this is more of an edge case.

Will strict liability apply to software as a service and a product?

Note that strict liability typically applies to defective products, not services, because services do not have the same characteristics that justify strict liability.  When customers hire service providers to create custom software, they are more involved and have better visibility into how the software is made.  Because of this, strict liability, which holds manufacturers responsible for defective products regardless of fault, usually does not apply to custom-developed software.  

That brings us to the end of the litigation moats.  Let's talk about contractual moats.

---

Decision Tree:  Which Kind of Harm Leads to What Type of Lawsuit

---

B. Contractual Moat

1. Terms of Contract

Software companies use various contractual techniques to protect themselves, deployed in the terms of use (TOU), privacy policies, licensing agreements, and end-user licensing agreements (EULA).

When you buy off-the-shelf software, the agreement you sign (or click "I agree") is usually one-sided.  It states that the software company isn't responsible if something goes wrong and restricts the use.  If you don't like the terms, too bad; you can take it or leave it.  Basically, the company is passing on all the risks to you, and the courts have generally upheld these clickwrap agreements as valid, enforceable contracts.  You probably click "I agree" without much thought, but remember that the TOU is a binding contract.  Since the rise of the internet, courts have supported software companies' ability to contract away most liability for defects in their products.  The law assumes you can make your own contracts and will only nullify a contract under rare circumstances.

Whether you are entering into terms of use (TOU) or end-user licensing agreements (EULA), you’ll notice certain boilerplate language, including disclaimers of warranties, indemnification, waivers, limitation of liability, barring consequential damages, dispute resolution, insurance requirements, assumption of the risk, force majeure clauses, among others.  These risk-shifting provisions transfer certain risks from the company to the user.  Tech companies are constantly updating and improving these terms, which is why you are frequently asked to accept any updates to the TOU and privacy policies.  You can see how crucial it is to negotiate software agreements if you have any leverage. 

This risk-shifting does come with a price. Harrison Hawkes, my former colleague, pointed out to me that software providers are able to include such blanket disclaimers and risk-shifting provisions partly because they've priced their offerings accordingly. In other words, software companies may be able to provide lower prices by shifting the risk to the consumer. One additional factor to consider when negotiating a contract.

Let’s look at a few examples of disclaimers of warranties, limitation of liability, and indemnification and see points where you can push back in your negotiations.

i. Disclaimer of Warranty

What is a disclaimer?

Interestingly, a software provider can disclaim express and implied warranties by including a clear and noticeable disclaimer in the contract.  For implied warranties, you'll often see phrases like "as is" or "with all faults." You've likely encountered this language in the TOU for many websites.  Here's an example of warranty disclaimer from Google:

How to push back against disclaimers

One way for you or your lawyer to push back on the disclaimers is to add a phrase saying, “EXCEPT AS EXPRESSLY SET FORTH IN THE REPRESENTATIONS AND WARRANTIES SECTION.”  “Representations and warranties” (R&W) is a section where a party states to the other party that a particular fact is true (a representation) or will be true (a warranty).  Sometimes, they are mutual (both sides make them), and sometimes, they are one-sided.  A representation looks backward in time, and a warranty is future-facing.  If the rep or warranty is not true, then the party making the rep or warranty has breached the contract, and you could sue.  R&W are often connected to an indemnification provision (see below).  Thus, by saying the disclaimer doesn’t apply to the R&W section, you limit what can be disclaimed.

ii. Limitation of Liability

Most software companies will limit their liability by (1) excluding indirect damages, consequential, lost profits, special damages, punitive damages, etc. (basically anything that’s not direct damages) and (2) putting a cap (a monetary limit) on the amount of damages.  Here’s an example from Microsoft:

How to push back against limitations of liability

If you have any wiggle room to negotiate the contract with a software company, add a carveout to the liability cap for (1) breaches of confidentiality; (2) indemnification obligations; and (3) gross negligence, willful misconduct, and fraud.  You can negotiate a higher monetary limit or cap for better coverage or require the software company to obtain insurance.

iii. Indemnification

Software contracts often include an indemnification clause, where one party agrees to compensate the other for legal defense costs.  This could be mutual or one-sided.  If the consumer is indemnifying the software company, that means the consumer must protect the software company if the company is sued due to the consumer's use of the software, whether for legitimate or unlawful reasons.  Here’s an example from Ironclad:

How to push back against indemnification

You can try to remove the indemnification provision altogether, but if that’s a non-starter for the software company, you can try to limit it in the following ways: 

1. Only agree to indemnify the company for your own gross negligence or willful misconduct.

2. Exclude indemnification claims that arise due to the software company's negligence, breach of contract, or intellectual property violations.

3. Cap the indemnification amount to a reasonable sum covering only direct damages, excluding indirect or consequential damages.

4. Ensure the indemnification only covers losses from an actual (not exploratory) lawsuit or claim brought by a third party against the software company.  Be careful as you could end up indemnifying the software company for suing you! If possible, limit losses to amounts paid or payable to third parties, avoiding internal costs incurred by the indemnified party.

5. Consider pushing for mutual indemnification (i.e. both parties agree to indemnify each other) under similar terms.   This tactic can help balance and defang an otherwise one-sided provision.

Note from the perspective of the party being indemnified (getting compensated): this is the best risk-shifting provision for the party being indemnified because, in theory, you can be made whole.   

Since UCC and contract law principles believe in the freedom to contract and only void a contract under certain edge cases, courts have upheld these risk-shifting provisions.  It's one of many things that have become the industry norm.

C. Structural Moat

1. Industry Norms and Illustrative Cases

After decades of improvement in software safety and quality, most commercial software is still shipped with serious flaws and defects, and as users, we’ve come to just accept this. 

Software industry argues flaws are inevitable

The software industry pushes the idea that such defects are unavoidable, and it tries to ameliorate those weaknesses by continuing to update the software.  If a higher standard were imposed on software providers, the industry argument is that it would lead to (i) slower development inhibiting innovation and (ii) higher prices for consumers.  Not to mention, software doesn't exist in a vacuum, and it must interact with the rest of the world.  Issues that cannot be mitigated by simple bug fixes, and which can only be discovered via thorough reviews and testing (or revealed when the software fails or is successfully hacked after deployment), are unlikely to ever be addressed.  This may be a form of Stockholm syndrome…

Apple Siri lawsuit: dodging a breach of implied warranty claim

Here's a classic example (Fazio v. Apple, Inc.) – in 2013, Apple was sued for breach of implied warranties for misrepresenting the capabilities of the voice-activated iPhone “Siri” assistant so that consumers would be encouraged to pay a premium for the iPhone 4S.  However, the court noted that the plaintiffs admitted Siri could perform basic functions like finding gas stations or restaurants.  Because Siri could still perform these tasks, the court concluded that the iPhone 4S was not entirely unfit for ordinary use.  Therefore, the plaintiffs did not provide enough evidence that Apple breached the implied warranty.

Third-party bad actors complicate pinpointing liability

Additionally, courts have been reluctant to hold a software company liable for a security vulnerability involving third-party bad actors.  While there is a logic to holding the wrongdoer liable for a hack, when do you hold a software company (the toolmaker) liable for someone else's nefarious actions?  The software company can also be seen as a victim in these situations, making secondary liability tenuous.  Furthermore, plaintiffs must demonstrate that the security breach caused actual harm or poses a substantial risk of imminent harm.  Courts often dismiss cases where plaintiffs only allege an increased risk of future identity theft or preventive costs, like credit monitoring, without showing concrete injury.

Sony data breach lawsuit:  evading negligence and breach of implied warranty

In 2014, Sony faced a data breach lawsuit (In re Sony Gaming Networks & Customer Data Sec. Breach Litig.) with the court dismissing 43 of the 51 claims.  Most negligence, negligent misrepresentation, and consumer protection claims were dismissed due to insufficient evidence of real harm. Plaintiffs argued for a “special relationship” with Sony, implying a higher duty to protect their data, but the court found no such relationship existed, citing typical consumer transactions and Sony's disclaimers. The Economic Loss Doctrine barred claims in California and Massachusetts, and the loss of free services was not considered an injury. Breach of implied warranty claims were dismissed due to effective disclaimers provided during registration. Ultimately, Sony settled the remaining claims for $15 million in games, online currency, and identity theft reimbursement.

Hidden complexities beneath software’s surface

Software is often a black box, making it difficult for laypeople to understand its inner workings.  Assigning blame is challenging because errors are not easily visible, and it is hard to determine whether the problem lies within the software or another component it interacts with.  If you leave a banana peel on the sidewalk and someone slips on it (breaking his arm), it’s pretty obvious that the banana peel led to the accident.  The complexity and lack of transparency with software make pinpointing the source of issues and holding the correct party accountable particularly difficult.

Hewlett-Packard Co.:  breach of warranty dropped because hard to prove the cause

As an illustration, Hewlett-Packard was sued in 2012 (Wilson v. Hewlett-Packard Co.) for breach of contract for violating its warranty due to its Pavilion and TouchSmart computers overheating and creating a danger to consumers.  The court dismissed these claims, saying the plaintiffs failed to explain how laptops without power could catch fire.  Without any proof, it was an implausible defect.

2. No Privity of Contract

End users may lack a formal relationship with software company

In business-to-business scenarios, the end user often lacks a direct, contractual relationship (“privity of contract”) with the software developer. This complicates accountability. Not having privity of contract often discourages consumers from pursuing tort or product liability claims against developers.  Additionally, contracts between vendors and manufacturers may limit the manufacturer's liability for end-user complaints.

Free products may not create a contractual relationship

A contract requires (i) an offer, (ii) acceptance, and (iii) payment (“consideration”). Many consumers don't pay directly for software; for example, Gmail users provide data instead of money, making them the product and ad companies the customers. Without a payment or consideration, there is no contract between users and the software company. This helps software companies avoid liability for breach of contract claims and can make users ineligible to bring claims under certain state consumer protection laws meant for paying customers.

Facebook privacy lawsuit - nonpaying users are not “consumers”

In a consumer protection class action suit brought against Facebook in 2011 (In re FACEBOOK PRIVACY LITIGATION) for a data breach, the court dismissed the lawsuit because the plaintiff hadn’t paid to use Facebook and was not protected by the California general consumer statute on point.  Without paying for services, the user was not considered a "consumer" under state law.  The law was designed to protect consumers.  Apple had a similar case dismissed.

Note, software lacks specific consumer protection laws and is not highly regulated like banks or drug companies. General consumer protection laws apply in some cases, but they don't address the unique safety and security challenges of software.

IV. Recent Case Law Trends in the US and UK

There is a clear desire by US courts to address data breaches.  While there are data protection laws in each of the states, which in theory can lead to a successful lawsuit for a plaintiff, winning a case against a software company for data breaches can still be challenging.  Judges are leveraging all available legal resources to protect consumers.  

Here are a few notable cases that illustrate the complexity and some positions the courts have taken:

• Liability upheld despite free service.  In a 2018 class action lawsuit in California against Facebook for a data breach affecting 29 million users (Echavarria v. Facebook, later Schmidt v. Facebook), Judge Alsup rejected Facebook’s claim that it shouldn't be liable because its service was free.  He emphasized that Facebook's business platform monetized users’ personally identifiable information (PII) by selling it to advertisers.  The judge noted that no previous case directly addressed this question and looked to be trying to find some logic to protect users.  The case was ultimately settled for $6.5 million--a drop in the bucket for Facebook.

• Bailment theory applied to electronic data mishandling.  A 2022 Indiana class action suit (Krupa v. TIC International Corp.) recently held software developers liable under a bailment theory (i.e., you temporarily hand over your belongings to someone else for a specific reason, with the understanding that they'll return them to you later).  The court recognized that bailment applies to electronic data, not just physical goods.  The Krupa court found that the defendant negligently exposed the plaintiff's personal data, which was held under an agreement of confidentiality.  Similarly, a 2021 New York case (Wallace v. Health Quest Systems, Inc.) denied a motion to dismiss a constructive bailment claim for a data breach, affirming that New York courts would extend bailment to intangible information.

Let's look at some examples from the crypto industry where there have been cases exploring whether developers owe a fiduciary duty to users.  A fiduciary duty is a legal obligation requiring one party (the fiduciary) to act in the other party's best interests (the beneficiary).  Fiduciaries must avoid conflicts of interest, act in good faith, act with care and loyalty, put the beneficiary's interests above their own, and fully disclose relevant information.  

• Economic loss rule bars negligence claims.  In Singh v. Illusory Systems, Inc., the software developers of the Nomad Bridge were sued for the theft of crypto assets due to a vulnerability in the underlying software.  The judge dismissed the negligence claims because the economic loss rule bars recovery for purely economic damages when a contract governs the dispute.  The plaintiffs were bound by agreements (the Terms of Use (TOU) and Apache License (a type of software license)) that covered the risks and limited liability for issues like security breaches and hacks.  Additionally, the court found no independent duty of care outside these contracts, particularly since the plaintiffs were sophisticated parties capable of understanding and negotiating risk allocation.  Lastly, the defendants weren't directly connected to the plaintiffs, so they didn't owe the plaintiffs any special care.  The negligence claims were dismissed as a result.

• Special relationship establishes duty of care.  While not a case pushing a breach of fiduciary duty, the following case goes into software companies and developers of a decentralized protocol having a duty of care towards the users of its protocol.  In Sarcuni v. bZx DAO, a major security breach of the bZx crypto protocol resulted in the theft of around $55 million in cryptocurrency. The breach occurred due to a phishing attack that compromised a bZx developer's private seed phrase, allowing the hacker to drain funds from the protocol.  The court determined that a “special relationship” existed between the plaintiffs and the defendants (who included the software developers, development company, and DAO, among others), establishing a duty of care. Unlike in Illusory, the judge ruled the terms of use / click wrap agreements were not conspicuous enough to be enforceable: “Plaintiffs had neither actual nor constructive notice of the Terms of Use and, therefore, aren't bound by them.” The terms were located at the bottom of the page so you had to scroll all the way to the bottom. The case was ultimately settled, so it’s unclear if the negligence claim, if tried, would have succeeded.  While software companies and developers may not rise to the level of being fiduciaries, the law seems to want to put some sort of duty on them and hold someone accountable even in the case of a decentralized blockchain, which in theory has no intermediaries.

Fiduciary duty on trial in UK.  There is one case worth watching presently in the UK. The case of Tulip Trading v Wladimir van der Laan & Ors asks whether Bitcoin developers owed fiduciary duties to cryptocurrency owners.  In March 2022, the UK High Court ruled that Bitcoin developers did not owe any fiduciary duties, but in 2023, the Court of Appeal overturned that decision, saying it is a "serious issue to be tried."  The case moved to a full trial to try this question.  But in an odd turn of events, Craig Wright who brought the Tulip lawsuit against Bitcoin developers and also falsely claimed to be Satoshi Nakamoto (the inventor of Bitcoin), dropped the lawsuit after it came out that he lied about being Satoshi… We’ll have to wait to see how the UK looks at this issue in a future lawsuit.

V. Conclusion 

It's clear that existing laws need an upgrade if society feels consumers need greater protections.  That could look like providing a professional standard of duty on software companies (some people even think we should hold software developers to a reasonable computer standard).  

VI. Extra Credit (Government Actors v. Software Developers)

With AI and crypto pushing the boundaries and raising novel questions of our legal systems, we are starting to see lawmakers take action to regulate Big Tech – although folks have been saying this for years.  Where conduct rises to the level of fraud or Bank Secrecy Act violations (money laundering / illicit finance), the government is flexing its muscle on these types of cases:

• Unfair or deceptive trade practices: The Federal Trade Commission (FTC) has broadened its scope beyond lawsuits for unfair competition against tech companies.  It now also takes action against unfair or deceptive trade practices, including software misrepresentation.  Notably, the FTC has taken legal action against companies like D-Link, TRENDnet, and ASUS  for vulnerabilities in internet-connected devices.  

• Liability for end user scams or misuse: 

  • The FTC a few months ago proposed a rule that would impose liability on anyone that provides the tools and services that they know or should have reason to know are being used in AI impersonation scams -- i.e. AI software companies and developers.  For more info, please read my comment letter to the FTC.

  • Commodity Futures Trading Commission (CFTC) Commissioner Brian Quintenz warned if "code developers could reasonably foresee, at the time they created the code, that it would likely be used by U.S. persons in a manner violative of CFTC regulations," they could be prosecuted for aiding and abetting such violations. 

• Unregistered security offering: The Securities and Exchange Commission (SEC) in 2018 charged Zachary Coburn (founder of EtherDelta and writer/deployer of the EtherDelta smart contract) with operating an unregistered national securities exchange.

• Mixers and money laundering: The Department of Justice has brought criminal prosecutions against individual crypto software developers for cryptocurrency mixing services (U.S. v. Rodriguez and Hill) that involve charges for alleged unlicensed money transmitter business and conspiracy to commit money laundering.  Case is pending.

• Accountability for negligence or deficient cybersecurity: 

  • The Department of Justice's Civil Cyber-Fraud Initiative will hold government contractors accountable for software insecurity resulting from negligent or fraudulent practices, such as providing deficient cybersecurity products or misrepresenting their cybersecurity practices.

  • In May 2021, President Biden issued the Executive Order on Improving the Nation's Cybersecurity, which mandates that software companies selling to the federal government meet new security standards.  These standards include providing greater transparency about their software development processes and cooperating in vulnerability disclosure programs to ensure the security of their products.

  • In March 2023,  President Biden's administration announced its National Cybersecurity Strategy, which aimed to hold software vendors accountable for cyberattacks by proposing legislation that shifts liability to companies that fail to secure their software adequately.  This initiative included a safe harbor for companies following best practices and aims to drive the market toward producing safer software while supporting innovation and competition among smaller businesses.  Thus far, there’s been no legislative action. 

Subscribe now

Share

[Special thanks to Jason Gottlieb and Emma McGrath (for doing some pro bono research confirming that the case law is truly all over the place) as well as Harrison Hawkes (for his review as a tech transactions expert)!]

Resources:

• https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2877380

• https://www.wsj.com/articles/should-software-companies-be-held-liable-security-flaws-d2a3f5db

• https://www.wsj.com/articles/if-software-companies-are-liable-for-bugs-how-exactly-would-that-work-9d150402

• https://www.coindesk.com/markets/2019/01/03/7-legal-questions-that-will-define-blockchain-in-2019/

• https://www.sitepoint.com/developers-sued-for-application-bugs/

• https://law.stackexchange.com/questions/78076/can-i-viably-sue-for-damages-caused-by-bugs-in-freeware

• https://www.justsecurity.org/87294/bugs-in-the-software-liability-debate/#:~:text=Taken%20together%2C%20in%20legal%20terms,recognize%2C%20that%20any%20harm%20occurred.

• https://www.scmagazine.com/analysis/software-liability-the-hard-truths-of-holding-manufacturers-responsible

• https://kaner.com/pdfs/theories.pdf

• https://digitalcommons.law.scu.edu/cgi/viewcontent.cgi?referer=&httpsredir=1&article=1025&context=chtlj

• https://www.dentons.com/en/insights/newsletters/2019/april/3/consumer-finance-report/back-to-basics-continued-what-are-implied-warranties-and-who-cares-anyway

• https://jolt.law.harvard.edu/assets/articlePDFs/v33/33HarvJLTech557.pdf

• https://digitalcommons.pepperdine.edu/cgi/viewcontent.cgi?article=1137&context=jbel

• https://www.americanbar.org/groups/construction_industry/publications/under_construction/2021/spring2021/economic_loss_doctrine/

• https://newrepublic.com/article/115402/sad-state-software-liability-law-bad-code-part-4

• https://kaner.com/pdfs/negligence_and_testing_coverage.pdf

• https://www.pcworld.com/article/457080/linkedin-wins-dismissal-of-lawsuit-seeking-damages-for-massive-password-breach.html

• https://casetext.com/case/in-re-facebook-privacy-litigation-1

• https://www.perkinscoie.com/en/news-insights/possibility-of-future-harm-allows-sony-data-breach-plaintiffs-to.html

• https://www.clarkhill.com/news-events/news/courts-look-unfavorably-on-recent-class-actions-arising-out-of-ransomware-attacks/

• https://www.law360.com/articles/1155760?copied=1

• https://jolt.law.harvard.edu/assets/articlePDFs/v33/33HarvJLTech557.pdf

• https://www.lowenstein.com/news-insights/publications/client-alerts/biden-administration-aims-to-shift-liability-for-cyberattacks-to-software-developers-privacy

• https://www.bloomberg.com/professional/insights/data/software-maker-liability-is-elusive-target-of-us-cyber-plan/

• https://www.perkinscoie.com/en/news-insights/possibility-of-future-harm-allows-sony-data-breach-plaintiffs-to.html

• https://www.law360.com/articles/1820275/attachments/0

• https://www.law360.com/articles/1820275

• https://www.nelsonslaw.co.uk/tulip-trading-v-wladimir-van-der-laan/

• https://www.mayerbrown.com/en/insights/publications/2023/02/stolen-crypto-uk-court-of-appeal-opens-door-to-software-developers-legal-duties-to-users

• https://www.technologyreview.com/2002/07/01/40875/why-software-is-so-bad/

• https://www.dundaslawyers.com.au/are-software-developers-liable-for-defects-in-their-software/

• https://www.ccdcoe.org/uploads/2018/10/TP_02.pdf

• https://repository.law.uic.edu/cgi/viewcontent.cgi?article=1705&context=jitpl

• https://www.eejournal.com/article/20161116-liability/

• https://scholarship.law.duke.edu/cgi/viewcontent.cgi?article=1322&context=dltr

• https://www.researchgate.net/publication/310674753_Legal_liability_for_bad_software

• https://dl.acm.org/doi/pdf/10.1145/2030256.2030258

• https://www.justice.gov/usao-sdny/pr/tornado-cash-founders-charged-money-laundering-and-sanctions-violations

• https://www.justice.gov/usao-sdny/file/1311391/dl?inline

• https://www.theblock.co/post/294142/us-senators-ring-alarms-over-the-dojs-treatment-of-crypto-mixers-and-its-interpretation-of-money-transmitters

• https://www.cooleygo.com/glossary/corporate-veil/

• https://www.law.cornell.edu/wex/bailment

• https://www.law.cornell.edu/wex/fiduciary_duty

• https://www.coindesk.com/markets/2019/01/03/7-legal-questions-that-will-define-blockchain-in-2019/

• https://www.cbinsights.com/research/report/business-moats-competitive-advantage/

• https://www.meta.com/legal/portal/limited-warranty/

• https://trial.docusign.com/?elqCampaignId=12586&tgr=com-trial-netlogin

• https://policies.google.com/terms?hl=en-US

• https://support.microsoft.com/en-us/topic/microsoft-software-license-terms-remote-help-4add423a-7701-49f8-b423-695a518060a2#:~:text=IF%20YOU%20HAVE%20ANY%20BASIS,SPECIAL%2C%20INDIRECT%20OR%20INCIDENTAL%20DAMAGES.

• https://legal.ironcladapp.com/terms-of-service

• https://www.britannica.com/science/Stockholm-syndrome

• https://www.regulations.gov/comment/FTC-2023-0030-0076

• https://www.cftc.gov/PressRoom/SpeechesTestimony/opaquintenz16

• https://www.sec.gov/news/press-release/2018-258

• https://www.justice.gov/usao-sdny/media/1349321/dl

• https://www.justice.gov/opa/pr/deputy-attorney-general-lisa-o-monaco-announces-new-civil-cyber-fraud-initiative

• https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/

• https://www.whitehouse.gov/wp-content/uploads/2023/03/National-Cybersecurity-Strategy-2023.pdf

• https://www.jdsupra.com/legalnews/a-basic-primer-on-damages-terms-in-35657/

• https://www.americanbar.org/groups/construction_industry/publications/under_construction/2021/spring2021/economic_loss_doctrine/

Legal Cases:

• https://topclassactions.com/lawsuit-settlements/lawsuit-news/apple-gets-siri-false-advertising-class-action-lawsuit-dismissed/

• https://casetext.com/case/in-re-sony-gaming-networks-customer-data-sec-breach-litig-4

• https://law.justia.com/cases/federal/appellate-courts/ca9/10-16249/10-16249-2012-02-16.html

• https://www.pcworld.com/article/457080/linkedin-wins-dismissal-of-lawsuit-seeking-damages-for-massive-password-breach.html

• https://casetext.com/case/in-re-facebook-privacy-litigation-1

• https://www.scribd.com/document/65952724/In-re-Apple-iPhone-Application-Litigation-Dismissal

• https://law.justia.com/cases/federal/district-courts/california/candce/3:2018cv05982/332800/153/

• https://dockets.justia.com/docket/indiana/insdce/1:2022cv01951/203289

• https://casetext.com/case/wallace-v-health-quest-sys-inc

• https://caselaw.findlaw.com/court/us-dis-crt-d-del/116009637.html

• https://casetext.com/case/sarcuni-v-bzx-dao

• https://www.mayerbrown.com/en/insights/publications/2023/02/stolen-crypto-uk-court-of-appeal-opens-door-to-software-developers-legal-duties-to-users

• https://www.ftc.gov/business-guidance/blog/2019/07/d-link-settlement-internet-things-depends-secure-software-development

• https://www.ftc.gov/news-events/news/press-releases/2013/09/marketer-internet-connected-home-security-video-cameras-settles-ftc-charges-it-failed-protect

• https://www.ftc.gov/news-events/news/press-releases/2016/02/asus-settles-ftc-charges-insecure-home-routers-cloud-services-put-consumers-privacy-risk

AI-Generated Images:

• Image of Software Developer Dodging Bullets created by Pixlr, Firefly, BeFunky, and DreamStudio

• Image of Get out of Jail Free Card created by Pixlr and Firefly

• Image of Castle with 3 Moats created by Dall-E and Firefly

• Image of Tech Veil bride created with Dall-E, Firefly, and Pixlr

• Image of Chasing the Rainbow created with Dall-E and Pixlr

• Image of Rip Van Winkle created by Dall-E, Firefly, and Pixlr

• Image of Alligator Purse created by Dall-E, Firefly, and Pixlr

• Image of Computer on the Stand by Dall-E, Firefly and Pixlr

Disclaimer:  This post is for general information purposes only. It does not constitute legal advice.  This post reflects the current opinions of the author(s).  The opinions reflected herein are subject to change without being updated.

[AI-generated image:  Bob Ross was famous for saying “anyone could paint,” but he didn’t say anyone could own the copyright of their painting.]

As generative AI (GAI) continues to advance and blur the lines between human and machine creativity, we are forced to confront these fundamental questions:  is expression unique to humans, and are there limits to the protections of human expression?  As human expression becomes increasingly intertwined with technology, these questions will be stress-tested like never before, challenging our understanding of what it means to be creative, who deserves protection under the law, and whether the AI output of human expression will trip up copyright laws.  

In this article, I’ll dive into copyrights, the exemptions, and the lawsuits AI companies face for supposed copyright infringement.

I. How Does Copyright Work? 

Copyright is a legal right established by the US Constitution that protects original creative works once they are physically created or documented. This protection applies to both published and unpublished works. It covers a variety of creative expressions, including literature, drama, music, art, films, software, and architecture. However, copyright does not cover basic facts, ideas, or methods; it focuses on how these elements are expressed creatively.

A copyright is exclusively a human right.  The US Copyright Office (USCO) has issued guidance that anything generated by AI is not copyrightable except the parts not generated by AI -- to create is to be human.  Using copyrighted works without the copyright owner's permission violates her or his exclusive rights to reproduce and distribute these works.

[AI-generated image:  sadly, robots can’t hold copyrights.]

II. What Happens If Someone Violates Your Copyright?

You can defend your copyright by suing the violator in federal court; infringement could lead to penalties.  The penalty can be up to $30,000 for each copyrighted work misused. However, if it's proven that the infringement was done on purpose, this amount could go up to $150,000 for each work involved.  It could even lead to a criminal investigation by the US Attorney's office if someone intentionally uses your copyrighted work for their own profit.  

III. Are There Exceptions So I Don’t Need to Ask for Permission?

While the right to copyright is robust, it is not absolute.  There are exceptions to this right.  Educational and library uses, public performances, the first sale doctrine, accessibility provisions for disabilities, face-to-face teaching, and fair use are examples of copyright exceptions. 

Among these exceptions, fair use is worth exploring as applied to AI-generated content. An affirmative defense against copyright infringement, fair use supports freedom of expression by allowing certain uses of protected works without permission in specific contexts. Defined under Section 107 of the Copyright Act, fair use covers activities like criticism, teaching, comment, news reporting, scholarship, and research.  

Fair use is determined on a case-by-case basis and involves a court considering four specific factors: (1) the purpose and character of the use, such as whether it's for commercial or educational purposes; (2) the nature of the copyrighted work; (3) the amount and substantiality of the portion used in relation to the entire copyrighted work; and (4) the effect of the use on the potential market value of the copyrighted work.

As a generalization, if (i) you borrow a small portion of and even transform the original copyrighted work, (ii) that original work is more factual, less creative, (iii) you use it for noncommercial purposes, and (iv) using that work doesn't really hurt the copyright owner's original work or market, you likely can rely on Fair Use.  "Transformative uses" mean adding something fresh with a different purpose from the original content, bringing a new expression, meaning, or message to the work.

IV. Actual Examples of Fair Use Defense Failing or Winning

Fail:  Shepard Fairey’s Obama Hope Poster Was Not Transformative Enough

[Left: photograph taken by Mannie Garcia.  Right: Shepard Fairey “Hope” Poster”.  Images pulled from the New York Times article linked here]

The street artist Shepard Fairey created his artwork using a photograph of Barack Obama by Mannie García, which he did not initially credit. When the photograph's origin became known, Fairey claimed his work was protected under fair use. However, the court disagreed, ruling that Fairey's adaptation was not sufficiently transformative and did not qualify as fair use. The lack of original attribution to Garcia also weakened any argument that the poster was meant as commentary or critique of the original photo. 

Win:  Leslie Nielsen Spoofing a Vanity Fair Photo of Demi Moore 

[Left:  the original photograph by Annie Leibovitz for Vanity Fair.  Right:  a parody photograph of Leslie Nielsen for a movie ad. Images pulled from Mondaq article linked here]

In 1991, Annie Leibovitz photographed a pregnant Demi Moore for a Vanity Fair cover, creating a widely recognized image. Two years later, for the promotion of "Naked Gun 33 1/3: The Final Insult," Paramount Pictures parodied this photo by superimposing Leslie Nielsen's face onto the body of a pregnant woman, mimicking Moore's pose, lighting, and background, but with exaggerated features like garish lighting and a flashy ring, accompanied by a humorous caption. When Leibovitz sued for copyright infringement, the U.S. Court of Appeals for the Second Circuit ruled in favor of Paramount, declaring the ad fair use. The court recognized the parody, noting it did not harm Leibovitz's market, and dismissed concerns about deterring celebrity participation in such shoots as not a legitimate harm. This case has become a notable example in copyright discussions, illustrating the permissible boundaries of parody under the fair use doctrine.

[Note, I only provide these snippets of original images from news articles for purely factual purposes for my commentary, comment, and teaching about copyright lawsuits to illustrate how an image could “transform.”  I make no money off this.  I do this for the love of the game.]

V. AI Companies Don't Like to Ask for Permission

If Homer Simpson has a drinking problem, GAI companies have a data problem -- they need more and more data and can’t help themselves.  Why?  In AI, data equals power. Notably, datasets can provide more power to AI companies than the algorithm, for it is the data from which the algorithms learn to make decisions, function, interpret, and respond to new inputs.  The more diverse and extensive the data, the more intelligent and capable the AI becomes.  AI companies need vast amounts of data from varied sources—books, articles, online reviews—to teach their AI systems how to understand and interact with human language effectively.

[AI-generated image:  once you feed the monster you nurture, it won’t let you stop.]

It seems AI companies will go to extremes to get a hold of that data.  The New York Times reported that AI labs have exhausted nearly every source of reputable English-language text available online to train their AI systems. High-quality data, particularly from professionally written and edited sources like books and articles, is deemed most valuable for training AI to produce human-like outputs. While big tech companies like Google and Microsoft may have a user base generating vast amounts of user data, privacy laws, and corporate policies restrict their use for AI training. By 2026, the demand for high-quality data is projected to exceed its availability. The New York Times highlighted the lengths AI companies are going to for data: (i) Meta considered buying Simon & Schuster and using copyrighted internet data, (ii) Google amended its service terms to utilize what its users have written in Google Docs and Google Maps (reviews), and (iii) OpenAI developed a tool to transcribe YouTube videos despite potential policy violations.

VI. Data Addiction Leads to Lawsuits for Copyright Infringement

The lengths AI companies take to ingest data have prompted content creators to sue GAI companies for using copyrighted works without permission to train AI systems.  Many cases have cropped up against AI companies regarding their nonconsensual data scraping practices.  These lawsuits raise a bunch of questions as to whether: 

• (i) training a model with copyrighted data requires a license, 

• (ii) the AI output infringes on the copyright of the materials used to train the models, and 

• (iii) it is a direct copyright infringement or can it be considered fair use?   

Let’s look at Tremblay v. OpenAI, Inc./Microsoft as an exemplar of this trend.  A group of authors, including Sarah Silverman, sued OpenAI and Microsoft for using their books to train AI language models without permission.  The authors (plaintiffs) argue that AI companies should not be able to shield themselves by labeling AI output images as "new" when they are using the authors’ derivative works without permission.  Conversely, AI companies (defendants) will likely assert a fair use argument – that they are transforming the origin work into something distinct with a different purpose.  However, the “black box” nature of AI adds complexity to this argument.  The lack of transparency, where even the developers may not precisely know how their AI systems make decisions, especially in deep learning models, will make it difficult to prove fair use.  

The judge partially agreed with the defendants' request to dismiss the case, throwing out four of the six claims, but the authors can revise and resubmit. The following claims will move forward to trial: (i) direct copyright infringement claim (that OpenAI directly copied the authors' work and used it for commercial gain without permission), and (ii) unfair competition claim (that OpenAI unfairly competed with the authors by using their work without permission).  It was evident the defendants used Plaintiff’s copyrighted works without permission for profit so that could be an infringement and an unfair practice.  The court dismissed claims for (i) vicarious copyright infringement, (ii) negligence, (iii) unjust enrichment, and (iv) violations of the Digital Millennium Copyright Act.  

[AI-generated image:  If only Sarah Silverman and Sam Altman could resolve their differences via a thumb war.]

Vicarious copyright infringement is the idea that a company is responsible for the infringing activities carried out with its technology, even if it did not directly engage in the infringing activities itself.  Here, the judge reasoned that the plaintiffs did not allege the “ChatGPT outputs contain[ed] direct copies of the copyrighted books,” and therefore, the authors needed to demonstrate “substantial similarity” between the source materials and ChatGPT's outputs. AI-generated content is not automatically a copyright infringement.  

This decision follows a trend in similar cases, where courts are willing to consider claims of direct copyright infringement and unfair competition but are unsure about how to view AI outputs.  So far, courts haven't viewed using an author’s work without permission to train language models as clearly an automatic copyright violation.

VII. Bottom Line

[Civil litigation can take years from filing the initial complaint to trying the case.]

Given that the courts have been flexible in allowing plaintiffs to resubmit their complaints and point out the weaknesses in the cases, it’s too early to know how this will all ultimately play out.  For copyright holders to win a lawsuit against the AI companies, they need to show that the outputs from the models are substantially similar to the copyrighted content or contain parts of it.  Is the use of copyrighted materials to train a model and then generate new content transformative enough to fall under fair use?  

We shall see – but we're likely years away from a resolution.  Meanwhile, AI companies, realizing their vulnerabilities to lawsuits, are increasingly entering into licensing agreements with content holders. This development signals an acknowledgment that obtaining consent prior to using someone’s work is necessary.    In any case, litigation is expensive for companies so we may continue to see some CYA measures enacted by AI companies. 

[AI-generated image:  On the left we have the AI companies trying to break into the Elysian Fields of human creativity on the right.  OpenAI looks to be trying a click-wrap type strategy where you have to opt-out of data scraping.]

Lawsuit Tracker: 

• Paul Tremblay, et al., v. OpenAI, Inc. (NDCA) 

  • See above

• Thomson Reuters Enterprise Centre GmbH v. ROSS Intelligence Inc. (DE)

  • Background:  Thomson Reuters filed a lawsuit against Ross Intelligence, alleging that the AI company illegally used Westlaw’s short summaries of points of law (headnotes) for training purposes, infringing on Thomson Reuters’ copyright.

  • Status:  In September 2023, the court ruled that the case could not be resolved on summary judgment due to disputed facts, and it is expected to go to trial in August 2024, with key issues including fair use and the transformative nature of Ross Intelligence’s AI training process.

• The New York Times Co. v. Microsoft Corp (SDNY)

  • Background:  The New York Times has initiated a copyright infringement lawsuit against OpenAI and Microsoft, arguing that Microsoft's chatbot, trained on its articles, hurts its business in two ways. Firstly, it diverts revenue by providing information that would have been accessed through Times' websites, like Wirecutter. Secondly, chatbots have emerged as a competing source of trustworthy information, threatening traditional news outlets like The Times and potentially damaging its reputation and revenue.

  • Status:  In  March 2024, OpenAI and Microsoft each filed motions to dismiss parts of the lawsuit, arguing that training their large language models (LLMs) didn’t disrupt the market for original news content.  

• Andersen et al. v. Stability AI Ltd. et al (NDCA)

  • Background:  The plaintiffs, a group of artists and content creators, allege that Stable Diffusion, Midjourney, and DreamUp were trained using copyrighted images without permission, resulting in copyright infringement. The claims include direct copyright infringement, creation of unauthorized derivative works, vicarious copyright infringement (based on user-generated content), violation of copyright management laws, unfair competition, violation of the right of publicity (for generating work "in the style of" specific artists) and breach of contract (against DeviantArt).

  • Status:  The defendants filed motions to dismiss, which the court granted in part in October 2023. Only one plaintiff's direct copyright infringement claim against Stability AI survived. The court allowed the plaintiffs to amend their claims, which they have done in an updated complaint. 

• Authors Guild v. OpenAI Inc. (SDNY)  

  • Background: The Authors Guild (including Jonathan Franzen, John Grisham, George R.R. Martin, and Jodi Picoult) is suing OpenAI for copyright infringement, claiming OpenAI used their books to train AI models without permission.

  • Status:  Still pending.

• J.L. et al. v. Google LLC (NDCA) 

  • Background: Filed by eight individuals who seek to represent millions of internet users and copyright holders, the lawsuit charges that Google's practice of scraping data from websites violates privacy and property rights. The plaintiffs contend that Google lacks the right to use their creative works, personal expressions, or any content shared online, simply because it is available on the internet.

  • Status:  In February 2024, Google filed a motion to dismiss a lawsuit, arguing that its generative AI models only use publicly available or lawfully obtained information for training. The company claims that the plaintiffs' privacy and security concerns are unfounded, as they have no property or privacy rights over information they shared publicly on the internet. Google asserts that, outside of copyright law and fair use provisions, there is no legal basis for controlling the use of publicly available information.

• Basbanes et al. v. Microsoft Corporation et al. (SDNY)

  • Background:  Journalists Nicholas Gage and Nicholas Basbanes sued OpenAI and Microsoft, accusing them of using copyrighted books and articles to train its AI model, ChatGPT. The complaint further points out that ChatGPT once had the capability to produce exact quotes from copyrighted texts but now offers summaries instead. According to the lawsuit, these summaries are considered derivative works that rely on the original materials that were copied.

  • Status:  Pending (filed January 2024).

• Kadrey v. Meta Platforms (now consolidated with Chabon v. Meta Platforms) (NDCA)

  • Background:  This case challenged Meta’s use of copyrighted books to train its LLaMA language models. 

  • Status:  The court dismissed most claims, including those asserting that all outputs of the model are infringing upon derivative works. The only remaining claim is for direct copyright infringement based on copies made during training.

• Makkai et al. v. Databricks, Inc. et al. (NDCA)

  • Background: Four prominent authors—Andre Dubus III, Susan Orlean, Rebecca Makkai, and Jason Reynolds—allege that Nvidia's NeMo Megatron models and Databricks' MosaicML models were trained on copyrighted works without permission. Nvidia has responded by asserting that their model creation complies with copyright laws, claiming fair use given the broad input sources and minimal influence of each work on the final model output.

  • Status:  Pending (just filed May 2024). 

Subscribe now

Share

Resources: 

• Image of Artist Robot – generated on Firefly and Dall-E

• Image of Rejected Robot – generated on Pixlr and DreamStudio

• Image of Sam Altman with Data Plant – generated on Firefly and Pixlr 

• Image of Thumb War – generated by DreamStudio and Firefly

• Image of Litigation Timeline - created with Visme

• Image of AI Companies Trying to Break Into the Elysian Fields of Human Expression – generated on Dall-E and Firefly

• What is machine learning (ML)?, IBM, https://www.ibm.com/topics/machine-learning (last visited Apr. 20, 2024).

• Randy Kennedy, “Artist Sues the A.P. Over Obama Image,” The New York Times, February 9, 2009, https://www.nytimes.com/2009/02/10/arts/design/10fair.html.

• Cade Metz, Cecilia Kang, Sheera Frenkel, Stuart A. Thompson and Nico Grant, "How Tech Giants Cut Corners to Harvest Data for A.I.," The New York Times, April 6, 2024, https://www.nytimes.com/2024/04/06/technology/tech-giants-harvest-data-artificial-intelligence.html.

• Cade Metz and Karen Weise, "Microsoft Seeks to Dismiss Parts of Suit Filed by The New York Times," The New York Times, March 4, 2024, https://www.nytimes.com/2024/03/04/technology/microsoft-ai-copyright-lawsuit.html.

• Michael M. Grynbaum and Ryan Mac, "The Times Sues Open AI and Microsoft Over A.I. Use of Copyrighted Work," The New York Times, December 27, 2023, https://www.nytimes.com/2023/12/27/business/media/new-york-times-open-ai-microsoft-lawsuit.html.

• Emilia David, "Sarah Silverman’s lawsuit against OpenAI partially dismissed" The Verge, February 13, 2024, https://www.theverge.com/2024/2/13/24072131/sarah-silverman-paul-tremblay-openai-chatgpt-copyright-lawsuit.

• Baker & Hostetler LLP, "Case Tracker: Artificial Intelligence Copyrights and Class Actions," BakerLaw, accessed May 10, 2024, https://www.bakerlaw.com/services/artificial-intelligence-ai/case-tracker-artificial-intelligence-copyrights-and-class-actions/.

• "A New Generation of Legal Issues Part 2:  First Lawsuits Arrive Addressing Generative AI," Perkins Coie LLP, April 20, 2023, https://www.perkinscoie.com/en/news-insights/first-lawsuits-arrive-addressing-generative-ai.html.

• “Recent Rulings in AI Copyright Lawsuits Shed Some Light, but Leave Many Questions," Perkins Coie LLP, December 14, 2023, https://www.perkinscoie.com/en/news-insights/recent-rulings-in-ai-copyright-lawsuits-shed-some-light-but-leave-many-questions.html

• Suzanne V. Wilson, "Artificial Intelligence and Copyright" United States Copyright Office, August 24, 2023, https://www.copyright.gov/ai/docs/Federal-Register-Document-Artificial-Intelligence-and-Copyright-NOI.pdf.

• Emilia David, "George R.R. Martin and other authors sue OpenAI for copyright infringement," The Verge, September 20, 2023, https://www.theverge.com/2023/9/20/23882140/george-r-r-martin-lawsuit-openai-copyright-infringement.

• Blake Brittain, "Google Hit With Class Action Lawsuit Over AI Data Scraping," Reuters, July 11, 2023, https://www.reuters.com/legal/litigation/google-hit-with-class-action-lawsuit-over-ai-data-scraping-2023-07-11/.

• Hailey Konnath, "Google Says AI Data Scraping Suit Still Doesn't Hold Up," Law360, February 12, 2024, https://www.law360.com/articles/1796997/google-says-ai-data-scraping-suit-still-doesn-t-hold-up.

• Stacey Chuvaieva, "Federal Judge Dismissive of AI Complaint:  Anderson v. Stability AI," Mitchell Silberberg & Knupp LLP, October 31, 2023, https://www.msk.com/newsroom-alerts-Federal-Judge-Dismissive-of-AI-Complaint.

• David Rabinwitz, "Using Copyrighted Works in AI Training Data May Infringe Even If the AI Output Doesn’t," Moses & Singer LLP, January 16, 2024, https://www.mosessinger.com/publications/using-copyrighted-works-in-ai-training-data-may-infringe-even-if-the-ai-output-doesnt.

• Isaiah Poritz, "OpenAI Hit With Another Copyright Suit From Pair of Journalists," Bloomberg Law, January 5, 2024, https://news.bloomberglaw.com/ip-law/openai-hit-with-another-copyright-suit-from-pair-of-journalists.

• Kyle Jahner, "Nvidia, Databricks Sued in Latest AI Copyright Class Actions," Bloomberg Law, May 3, 2024, https://news.bloomberglaw.com/ip-law/nvidia-databricks-sued-in-latest-ai-copyright-class-actions.

• Nancy Rubin and Steward McKelvey, "Canada:  The AGNS, Annie Leibovitz and the Naked Gun Lesson in Permissible Parody," Mondaq, September 4, 2013, https://www.mondaq.com/canada/advertising-marketing--branding/253026/the-agns-annie-leibovitz-and-the-naked-gun-lesson-in-permissible-parody.

• "Use of Excerpts from and Linking to Article Found to Be Fair Use," Winston & Strawn LLP,, October 26, 2010, https://www.winston.com/en/insights-news/use-of-excerpts-from-and-linking-to-article-found-to-be-fair-use.

• "Exceptions for Libraries & Archives," Copyright Alliance. https://copyrightalliance.org/education/copyright-law-explained/limitations-on-a-copyright-owners-rights/copyright-exceptions-libraries-archives/

• "Exceptions for Performances and Displays," Copyright Alliance. https://copyrightalliance.org/education/copyright-law-explained/limitations-on-a-copyright-owners-rights/copyright-exceptions-performances-displays/

• "First Sale Exceptions Copyright," Copyright Alliance. https://copyrightalliance.org/education/copyright-law-explained/limitations-on-a-copyright-owners-rights/first-sale-exceptions-copyright/

• " Exceptions for the Blind," Copyright Alliance. https://copyrightalliance.org/education/copyright-law-explained/limitations-on-a-copyright-owners-rights/copyright-exceptions-for-the-blind/

• " Exceptions for Educational Institutions," Copyright Alliance. https://copyrightalliance.org/education/copyright-law-explained/limitations-on-a-copyright-owners-rights/copyright-exceptions-educational-institutions/

Disclaimer:  This post is for general information purposes only. It does not constitute legal advice.  This post reflects the current opinions of the author(s).  The opinions reflected herein are subject to change without being updated.

This post originally appeared as a guest post on May 16, 2024 on @aisupremacy:

AI Supremacy

So What If My AI Bot Wrote This Paper!? 🏛️

🎧 Audio Intro: 4:05 Hello Everyone, I’ve been very stuck trying to think about AI and copyright in this wild-wild west era of Generative AI. I’m not a lawyer, but the lack of rule of law in America regarding AI and copyright has been stunning in historical terms…

Read more

2 years ago · 40 likes · 3 comments · Michael Spencer and Jessica Furr

Thanks to Michael Spencer (@aisupremacy) for reaching out and for the opportunity. Check out his Substack for the latest and greatest on AI.

Achieving a consensus on regulating AI, given its rapid evolution, complexity, and borderless impact, presents a formidable challenge. The conflicting and passionate viewpoints of the various stakeholders — regulators, doomers, or accelerationists — make it seem that consensus could never be possible.  So, we put that to the test.

[AI-generated image:  The debate arena where wits do battle –  the accelerationist Nick Land v. Doomer Geoffrey Hinton as refereed by FTC Commissioner Lina Khan]

We surveyed 43 people working in the AI industry (a statistically large enough sample size for generalizability) to gather their thoughts anonymously on regulating AI. The folks we surveyed work at big tech companies, banks, nonprofits, and startups, and their job functions spanned engineering and tech, business, legal & compliance, and non-profit and other functions. 

In reviewing those responses, we realized there was a surprising level of commonality.  We hope that sharing these AI insider viewpoints may debunk the myth of tribalism in AI and also better inform lawmakers that they have allies within the industry.  Below, you will find our high-level takeaways, the survey results, and some closing thoughts.  Enjoy!

Key Takeaways from the Survey (n = 43) (detailed results below)

1. Most respondents think that AI should be regulated (72% Yes and 19% Maybe). 

2. That number goes up even more for “high risk” use cases, such as AI systems dealing with biometric data, education, employment, law enforcement, etc. (88% Yes and 7% Maybe).

3. An overwhelming number of respondents believed that if the AI industry were to self-regulate, the companies should pledge to have the following measures or procedures in place:

   1. Require continuous evaluation for bias, security, and vulnerabilities (91%)

   2. Require the maintenance of policies and procedures (76%)

   3. Set standards for content provenance (i.e. where does the content originate), including watermarking, etc. (76%)

   4. Election integrity (52%)

Therefore, these are the low-hanging fruits for either creating regulations or setting standards for AI.

4. Interestingly, most folks think that there should be some kind of accountability for companies that create AI software, but they are not sure about what to do or how to go about it. These two questions delineated the dilemma:

   1. Do you think it’s fair that an AI company should be expected to know how the output generated by its technology is being used by its consumers? (44% Yes and 19% Maybe).

   2. Should AI companies be held liable for what their users do with the generated content? (42% Maybe, 16% Yes and 33% No).

5. There seems to be consensus around requiring social media platforms such as Facebook to take down harmful content (84% Yes) and be responsible for ensuring any synthetic content uploaded by users is labeled as AI-generated (79% Yes).

Final Thoughts

While it’s clear there is an industry desire for regulation, it’s also clear that many are unsure what it should look like in an ideal world.  We want to leave you with some final thoughts as you form your own opinions about AI regulation:

1. Regulation of emerging technologies, especially one as transformative as AI, should avoid negative externalities for industries and consumers.  You need a balance between fostering innovation and ensuring ethical, social, and legal safeguards. Good regulatory frameworks encourage creativity and experimentation while safeguarding against potential harm. 

2. Remember that there are already laws on the books that regulate AI as they would any industry.  The approach towards regulating AI should be surgical, using a scalpel instead of a sledgehammer. You don’t want to crush a fledgling industry with many positive use cases.

3. There is an entire ecosystem of stakeholders that need to be considered in designing AI regulations, including the builders of AI, the users of AI, and the platforms where AI content is published.

4. Given technology moves so fast, regulations should be designed not to favor one technology over another and not affect the development of the technology itself.  

5. Consider whether it makes sense for a certain technology to be regulated based on its tech capabilities, user behavior, user reach, and use cases.  Regulations may need a hybrid approach of different philosophies.

6. Soft laws or self-regulations may be more effective for fast-moving industries and should be designed with public-private partnerships.

7. Regulations should be designed to not become stale too quickly.  They should stand the test of time. (ex. The EU’s MiCA regulation was designed with Facebook’s Diem project in mind, but Diem has since shut down.)

Detailed Survey Results

[We want to thank everyone who participated in the survey.  We hope you feel you got your voice heard.  More to come!]

Subscribe now

Share

Resources:

• Survey conducted using Google Forms

• Image of Boxing Match Generated on Pixlr, ChatGBT and BeFunky

Disclaimer:  This post is for general information purposes only. It does not constitute legal advice.  This post reflects the current opinions of the author(s).  The opinions reflected herein are subject to change without being updated.

Frameworks aren't just for McKinsey consultants.  We lawyers are all about frameworks; anyone who went to law school remembers applying IRAC (issue, rule, application, conclusion) to a fact pattern on an exam.  So, let's break down all the legal issues that may arise in artificial intelligence (AI) – or at least we’ll give it a try.  Feel free to add to this by dropping comments below. 

Why do this? As a lawyer in an emerging industry, you must anticipate every potential pitfall, think creatively, and craft new and innovative legal solutions to protect your client in unchartered territory where precedents may be scarce. It’s truly exciting and invigorating for those legal eagles with the mettle to tackle the unknown.

The legal brain may at times feel like Mel Brooks in History of the World Part I (“Panic!”), but if we can war game AI like his son Max Brooks does with zombies, AI won’t feel like a foreboding hoard of the undead about to destroy us all. We hope….

We've applied an industry spotting framework that can be useful in the practice of law or business to the AI universe.  When legal issue spotting a particular industry or business scenario, we think about:

1. Regulation

2. Product

3. Customer/End User

4. Company

5. Competition

You may have some issues that could fall into more than one bucket, but hopefully, using this framework will help you develop a 360-degree perspective on many of the legal issues within this nascent industry.

Overall Framework: 

If you want to dig deeper into these topics, below are full explanations. Have fun!

I. Regulation

Federal Consumer Protection Laws

• The Federal Trade Commission (FTC):  Lying can be deemed an unfair and deceptive trade practice (Section 5 of the FTC Act).  The FTC asserts that this prohibition on deceptive or unfair conduct also applies to generative AI tools, including any actions that mislead or harm consumers, such as phishing scams, identity theft, deepfakes, and other forms of deception - Link

• Federal Communications Commission (FCC):  The FCC has prohibited AI-generated voices for unsolicited robocalls. - Link

• Securities and Exchange Commission (SEC):  The SEC has issued some recent fines for “AI Washing” in public company filings (meaning companies made false and/or misleading statements about their use of AI). - Link

Terrorism/Anti-Money Laundering (AML) Laws

• Office of Foreign Assets Control (OFAC):  Terrorists could use AI platforms for nefarious purposes (automate fake social media, spread disinformation, optimize logistics and planning of attacks, etc.), and OFAC could impose sanctions on AI companies or its code if they are found to be engaging with entities or persons on the OFAC sanctions list (think Tornado Cash). - Link

• Financial Crimes Enforcement Network (FinCEN):  The agency could view AI software as a potential tool used for money laundering and terrorist financing, and it can bring enforcement actions against a company that fails to comply with AML regulations. - Link

US State Laws 

• Deepfakes in Elections and Non-Consensual Sexual Content:  Various US states have begun to pass laws around deepfakes in regard to non-consensual sexual content and elections (below are a few examples). - Link. 

  • California

    • California law allows individuals to sue for non-consensual image-based sexual abuse (IBSA) deepfakes, holds creators and distributors liable, but it exempts deepfakes of public concern or newsworthiness.

    • Additionally, political candidates have a cause of action against deceptive deepfakes during elections, unless they are clearly labeled as manipulated or a parody.

  • New York has updated its right-of-publicity law to protect against unauthorized commercial use of digitally manipulated images for 40 years post-mortem, and separately, it prohibits the distribution of unauthorized IBSA deepfakes.  Disclaimers saying the representation is fake is not a defense.

• Employment/Use of AI for Hiring Bias:  In employment, AI-driven hiring tools might perpetuate discrimination if they inadvertently learn and replicate biases present in historical hiring data. New York passed the first law in the country to require companies to reveal how algorithms influence hiring employees. - Link

• Automatic Decision Making (aka Profiling Technologies):  This refers to systems in which decisions are made by AI without human involvement.  Algorithm based decision-making could be biased, which can impact consumers depending on how they are profiled.  Some states (California, Colorado, Connecticut, and Virginia) have passed laws integrating AI into their privacy laws, requiring notice, opt-out options, and consumer access to AI-driven decision-making processes. - Link

• Insurance Industry/Discrimination:  AI models might unfairly calculate premiums or deny coverage based on biased data, potentially discriminating against certain groups. As an example, the Colorado Division of Insurance is first in the nation to publish a final rule obliging life insurance companies to report how their AI models work. The purpose is to put into place AI governance and risk-management tools to combat discrimination and bias. - Link

• State-by-state Tracker: For more information, here’s a state-by-state tracker on AI legislation.

European Union (EU) Laws:  The EU has passed the first comprehensive AI regulatory framework in the world, which included requirements regarding transparency, disclosures, data quality, and human oversight.  It identifies high-risk and low-risk AI use cases. - Link

Climate:  The substantial computing power required for AI development may prompt the introduction of new climate regulations. - Link

II. Product

Intellectual Property (IP) Rights Issues

• Creation of Patents:  Per the US Patent and Trademark Office (USPTO), it is okay to use AI to create a patentable invention, but a "natural person" must provide a "significant contribution" to the invention to be eligible for a patent. The logic is that patents reward human ingenuity. - Link / Link 2

• Creation of Copyrights:  US Copyright Office (USCO) issued guidance that anything generated by AI is not copyrightable except the parts not generated by AI. - Link

  • AI-generated art cannot receive copyrights (Thaler v. Perlmutter of US Copyright Office (D.C. of District of Columbia). - Link

• Creation of Trademarks:  You base trademark rights on your use of the mark, not your creation of it. So, anything created by AI could be trademarked as long as it doesn't infringe on another's trademark. - Link

• Scraping Other Materials for Training:  There are open questions on scraping as to whether:

  • (i) training a model with copyrighted data requires a license,

  • (ii) the AI output infringes on the copyright of the training materials, and

  • (iii) it is a direct copyright infringement v. fair use? [The Fair Use Doctrine says there’s a limited exception for using a copyright without permission if it is “transformative.”]  If there's no direct copying, the owner of the data set being used by the AI company must show a substantial similarity in the output. 

    • Pending Litigation

      • There have been rulings by federal judges who have rejected the idea that the output of AI is an automatic copyright violation to those whose works were used to train the systems.  Direct copyright infringement causes of action have been permitted to go to trial. - Link

      • TLDR:   Presently, AI systems and rights holders are at odds over data collection, so you’re seeing AI companies enter into licensing agreements with content owners as a result.  Fair use may be a hard argument as a result.

• Ownership:

  • Custom AI Agents:  Companies are now letting you license their base models to build your own custom model.  What type of license are you getting?  Is it viral open-source software (OSS)?  If you're creating a custom model, who owns it?  How is liability allocated? Check the Terms of Use! - Link

  • AI-Generated Content:  Who owns the output that AI generates?  Check the Terms of Use! - Link1 / Link2

• Open v. Closed Source Code:  The code may be publicly available like any open-source software (OSS), meaning it can be scrutinized by anybody to see how it works.  With closed-source software (CSS), the code is not made public. - Link

  • Pros and Cons:

    • CSS allows the company to protect its IP, but it's also more of a black box regarding what it’s doing.  It leads to a concentration of power in the hands of centralized companies. On the flip side, CSS does mean that bad actors can't easily take its code and use it for nefarious purposes, so it may be easier to regulate AI at the company level and also impose liability. 

    • OSS allows for greater transparency, which can be good for strengthening the code for user development (less buggy, etc.) and regulatory scrutiny. 

    • The Biden administration has also weighed in on this debate to encourage CSS but VCs like Andreessen Horowitz disagree. - Link / Link2

• Data Sets: The algorithm (OSS vs CSS) actually may not be as important as transparency around data sets, which are paramount to train the models. The power of AI companies primarily stems from their control over extensive data sets through their various lines of business, which can give them more power than the code itself, as they determine the AI's capabilities and applications. - Link/Link2

  • “Synthetic Data:” Synthetic data refers to artificially created information by AI itself that’s used to train a model to avoid violating copyrights. Some refer to it as “laundering a copyright” because you wash the data to obfuscate the source. However, its repeated use can lead to degradation in quality, resulting in outputs that are merely less accurate copies of their originals (think AI inbreeding!). - Link

Product Harm

• Hacking:  Breaking into software can lead to theft of personal data.  If the code is impacted by bugs or viruses, it could lead to end-user lawsuits.  For example, if someone hacks into a Tesla’s computer and crashes the car, the manufacturer may be held responsible under a product liability claim.  - Link

• Image-Based Sexual Abuse (IBSA):  Without guardrails on technology, AI tools could unknowingly be used to create illegal or harmful content such as child sexual abuse material (CSAM).  Companies should institute policies to mitigate that risk and comply with local laws on CSAM reporting. 

  • Deepfake IBSA Material:  This is like the tort of nonconsensual IBSA material (colloquially referred to as “revenge pornography”) as it deals with a person's dignity and privacy of their likeness.  The difference is that with deepfake IBSA, there is a "distortion" that changes the way others may perceive you.  State laws differ on how they come down on deepfake IBSA.  States like CA and NY have instituted restrictions. - Link

  • Deepfake CSAM:  Under the Supreme Court decision Ashcroft v. Free Speech Coalition, fully fake CSAM can't be criminalized (i.e. no real children were involved in it).  However, if the CSAM pulled the faces of real children and morphed that into a new creation, that would probably be criminalized in each state as the government has a compelling interest to safeguard children.  - Link

• Deepfakes in Commerce:  The FTC is passing rules to make impersonation of government officials, businesses, and individuals a violation if deceptive to commerce.  Biden’s executive order also addresses deepfakes.  - Link / Link2

• Misinformation:  Internet companies are protected by Section 230 of the Communications Decency Act, which shields internet companies from liability for misinformation, which would include content generated by AI that users may post.  Question is whether Section 230 also applies to the AI output itself. AI could pull from data that's inaccurate or biased and that can lead to "hallucinations." - Link1 / Link2

  • FTC:  Lying can be deemed an unfair and deceptive trade practice under Section 5 of the FTC Act. - Link

  • Torts:  All of this could lead to torts lawsuits like for defamation, libel, right of privacy violation.

    • Example: There is a noteworthy Canadian case involving Air Canada being liable for negligent misrepresentation after its AI chatbot gave wrong information to a passenger. - Link1 / Link2

  • Election Laws:  States are beginning to pass laws to combat deepfakes in elections.

    • Example: California has a civil cause of action on the books for a political candidate deepfake video.  Check state laws! - Link

III. Customer / End User

Customer v. End User:  Who is the company's customer?  Sometimes, it's the end user and sometimes it’s a B-to-B situation.  Either way, the AI company should be concerned with how the product is used downstream and how liability is allocated amongst the various stakeholders.  - Link

Confidentiality / Privacy

• Confidential Information:  Many AI systems use the data a person inputs for training purposes, so users need to be careful to anonymize data, upgrade plans or change privacy settings. - Link

• Privacy Laws:  Given AI is trained on huge data sets, there may be an increase of personal data collected on people.  Companies may be collecting biometric or personal data on end users.  Each country has its own data privacy law (ex. GDPR in the EU) with which one would need to comply. - Link

  • HIPAA Violations:  Patient data may be collected. 

Discrimination and Bias

• Civil Rights Violations:  Title VII of the Civil Rights Act protects employees and job applicants from employment discrimination based on race, color, religion, sex, and national origin.  AI can show bias and may violate the Civil Rights Act, so under certain state or city laws, companies may need to test for bias. For example, NYC has passed such regulations (see Insurance and Automatic Decision Making in Section I) . - Link

IV. Company

Private Causes of Action:  AI companies and users should be prepared to be named in lawsuits concerning the unauthorized use of personal information or likeness, distribution of harmful or false content, and actions that invade privacy or cause emotional distress. Such “torts” include the following: defamation, libel/slander, false light claim, intentional infliction of emotional distress, right-of-publicity claim, non-consensual IBSA, CSAM, and expectation of privacy / invasion of privacy. - Link

Product Liability/Warranties/Liability/Indemnity

• Negligence v. Product Liability:  When there is no human involved in an incident (like a driverless car) or software gets a bug, it may turn a negligence case into a product liability case (manufacturing defect, a design defect, or a marketing defect).  - Link

• Allocation of Liability:  Liability may exist with the AI company (originator of algorithm) or maybe a seller of software incorporating that algorithm that then gets sold downstream to an end user.  Given this is a nascent industry, standards are still evolving. -  Link

• Software Developer Liability:  It has been hard to pierce the "tech veil" as courts have not recognized developers as fiduciaries or as having professional duties of care.  Courts have upheld posted disclaimers finding the downstream actors responsible.  This “tech veil” is always at risk of being eroded and some cases in the blockchain space are evidence of that. - Link

  • Deepfake Liability:  The FTC wants to hold software developers liable for deepfakes (more above).

Risk Mitigation/Self-Regulation

• Content and Safety Risk Assessments:  AI Companies should consider running red teaming and impact assessments.  The National Institute of Standards and Technology’s (NIST) AI Risk Management Framework provides a framework that can be useful.  - Link

• Content Moderation Policies:  Companies may consider having content regulation policies in place that put a guardrail on what can be produced to reduce consumer harms. - Link

• Audits:  Companies should consider allowing third-party auditors to evaluate their safety systems.  - Link1 / Link2

• Insurance:  Software providers may face liability for content produced by their software, so companies should be ready to be named as defendants in private lawsuits for defamation, right of publicity violations, and other legal issues. - Link

• Contracts/Terms of Service (ToS):

  • Implied Warranties:  AI companies want their ToS to disclaim the implied warranties of merchantability and fitness.  If left out, they are assumed as a matter of law.  - Link

  • Disclaimers, Waivers, Limitations of Liability and Consequential Damages:  Companies would want to make sure to include these in the ToS to mitigate their liability.

V. Competition

Antitrust:  General purpose AI requires substantial computing power that only the largest companies could afford.  Many of the largest AI companies are highly centralized and controlled by big tech.  It's very costly to create AI products, so it may discourage small companies from engaging in this new technology.  Big companies should play fairly and not stifle competition.  - Link1 / Link2

• Recently, the FTC launched inquiries into the big tech/AI deals. - Link

VI. Miscellaneous

Defenses for Regulating AI

• First Amendment Considerations:  Under Bernstein v. the Department of Justice (1999), the Ninth Circuit Court of Appeals ruled that software source code was protected speech under the First Amendment, and any government prohibition on its publication was unconstitutional.  - Link1 / Link2

• Section 230 of Communications Decency Act:  Section 230 of the Communications Decency Act provides limited legal immunity to service providers (and its users):  "No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider."  Software developers may have limited legal immunity for unlawful acts done by their users.  - Link1 / Link2

• Supporting Growth of Technology:  Imposing liability on software developers may hinder AI development. Premature regulation risks creating harmful or outdated laws. Effective regulation balances public benefits with risks. Overly restrictive rules may increase costs, reduce product quality, or shut down projects, ultimately affecting users.  - Link1 / Link2

Practicing Law - Link

• Duty of Confidentiality:  Be careful what you input into an AI model.  Don’t use client names as it could violate attorney-client privilege.

• Local Rules:  Do the local bar associations and courts allow the use of AI in the practice of law?  Each state has different rules, and the Supreme Court hasn't opined yet. Check your local rules!

• Duty of Competence and Diligence:  Sometimes generative AI hallucinates, so you have to be careful you're not using incorrect information. Don’t trust. Verify and doublecheck…Triple check!

For those that made it this far, here’s a little humor as a reward:

Why did the hippy zombie eat the human brain instead of the AI bot’s neural network?

It never eats anything artificial.

Subscribe now

Share

Leave a comment

CREDITS:

Joke:  Human made

Images:

• MindMap created with EdrawMind

• Mel Brooks Chased by Zombies created by DreamStudio and speech bubbles

• Robot Comedian generated from ChatGPT

Disclaimer:  This post is for general information purposes only. It does not constitute legal advice.  This post reflects the current opinions of the author(s).  The opinions reflected herein are subject to change without being updated.

[Mr. Whiskers (Larry David) appeared in a Super Bowl commercial for FTX.  He was later sued in a class action lawsuit for allegedly defrauding investors who lost money in the cryptocurrency exchange’s collapse.]

Those Sarah McLachlan ASPCA commercials are some of the most effective, emotional blackmail infomercials ever created, extracting our hard-earned dollars to rescue some of the most helpless cats and dogs across the country.  Similarly, and for just a few minutes of your time, you could impact the lives of those truly needing your help.  I’m of course talking about the glitterati – our beloved celebrities and influencers.

Join the cause, not with wallet but with keyboard, to educate our other favorite obsessions (besides pets) on the mistakes of not complying with advertising laws when they do product endorsements.  Every year, influencers and celebrities post their support of brands on their social media accounts, and companies exploit the person’s fame for promotional purposes.  Oh, the horror!  These adorable creatures with the memory of a goldfish (no offense, Dory) keep making the same mistakes and don’t learn from one another’s blunders.  Let’s help them.  After all, private islands and blow don’t come cheap.

Celebrities and influencers are generally most susceptible to lawsuits from these 3 sources:  (a) the Federal Trade Commission, (b) the Securities and Exchange Commission, and (c) Class Action Litigants. 

So, let's dive deep into the legalese, decipher the suits and penalties haunting our A-listers. 

I. The Shift in Regulatory Focus from Traditional Marketing to Social Media

While social media advertising is largely subject to the same laws and regulatory principles as traditional marketing, celebrities often get into the most trouble with their tweets and posts.  Why?  Unlike a TV commercial or newspaper spread, influencers are effectively the medium themselves because the promotional platform (ex. Twitter or Instagram) remains under the control of the celebrity.  This practice is a big change in the way companies reach their consumers. By leveraging celebrity influence, brands can now connect directly with their followers, creating more personal, targeted and effective advertising experiences. This shift has not gone unnoticed by regulators and class action litigants who are chomping at the bit to bring down our beloved superstars.

II. Federal Trade Commission:  General Enforcer for Deceptive or Unfair Business Practices with Endorsements and Testimonials

The Federal Trade Commission (the “FTC”) is the general consumer watch dog agency that deals with anti-trust, consumer protection and competition issues. 

A. The Law in a Nutshell:  Section 5(a) of the Federal Trade Commission Act (the “FTC Act”) grants the agency the authority to protect consumers from fraudulent and deceptive advertising practices, which include endorsements, testimonials, sponsorships and partnerships. 

B. Applying the Law to Celebrities:  The FTC scrutinizes celebrity enforcements with a particular focus on:

1. Failure to disclose a relationship with a brand

2. Misleading, fraudulent, or dishonest statements regarding a product

Per the FTC’s Endorsement Guides, if there’s a “material connection” between a brand and its endorser (i.e. celebrity is being paid to promote something), the quid pro quo must be front and center.  Why should I care, for example, if reality star Khloe Kardashian is being paid to endorse Old Navy jeans?  Let’s say you are looking to buy a pair of denims and come across a tweet from Ms. Kardashian raving about the brand.  Learning that she was paid to promote Old Navy jeans might make you weigh that tweet differently.

[Khloe Kardashian advertising Old Navy Jeans but not pointing out she’s being paid to promote it.]

Besides disclosing one’s relationship with a brand, influencers can't mislead the public and lie about liking a product they don't actually enjoy or haven’t actually used.  Ads must be honest and reflect the genuine opinion of the promoter who should make sure claims can be backed up with solid proof.  For example, if a celebrity touts the effectiveness of a health product, that claim can’t be so removed from what the science would show.  One odd but helpful example was when actress Gwyneth Paltrow and her company Goop promoted the unsubstantiated claim that vaginal eggs could regulate menstrual cycles, prevent uterine prolapse, and increase bladder control. 

[Gwyneth Paltrow promoting the vaginal egg on Jimmy Kimmel Live. Jimmy:  “How does it help?” Gwyneth:  “I don’t know.  I need to start my jade egg practice.” Yikes:  she should know better!]

C. Best Practices:  Here’s what influencers should aim to do to comply with the FTC’s rules:

1. Clearly disclose they are promoting sponsored content.  For social media, use hashtags like “#ad,” “#sponsored,” or “#partner” to indicate that the post is paid for.  Don’t make it hard to find a hashtag.  Best to put the disclosure at the top of the page and not buried in a group of hashtags. 

   1. Specifically for Instagram, the FTC has highlighted that a “material connection” should be disclosed above the “more” button because most people don’t click below that when scrolling through the platform. 

   2. Also, if you’re making an endorsement in a video, indicate it’s sponsored content in the video itself and not just in the description.  If you are live streaming a video, repeat the disclosure periodically so that new viewers can hear it.

2. Use simple and clear language. Avoid vague words or abbreviations, such as “sp,” “spon,” or “collab,” or stand-alone terms like “thanks.” 

3. Don’t promote a product you haven’t tried or make a claim that you know or should know isn’t scientifically true.  You may swear that tiger blood will cure all ailments but keep that to yourself — for multiple reasons.

4. Leverage online resources from the FTC.  The FTC has put together a pamphlet entitled  “Disclosures 101 for Social Media Influencers.” 

To help bring these best practices to life, here are some IRL examples of celebrity posts that miss and hit the mark:

Bad Practices: In tweets by singer Rihanna and wrestler Ric Flair, there are no disclosures about being paid to promote anything. 

Better Practices: Soccer player Carli Lloyd’s tweet (left) showing “#ad #Delta Partner” makes it clear this is an ad; her Instagram post (right) indicates “Paid partnership” up top and “#lacroixpartner” at the end. Always a masterclass with Carli.

D. Costs for Noncompliance:  After providing notice and observing continued bad behavior, the FTC can slap you with fines up to $50,120 per violation.  Around 90% of the FTC’s consumer protection actions focus on financial services, web and telecommunications, healthcare and retail sectors.  Usually, the FTC will alert the violator of the issue so s/he can fix the mistake, and it won’t go much further than that. 

Even so, the FTC does actively police social media.  Back in 2017, the FTC sent out more than 90 letters telling influencers that they needed to “clearly and conspicuously disclose their relationships to brands when promoting or endorsing products through social media.”  More recently, the FTC sued and settled their first monetary settlement with celebrity endorsers Scott Yancey (Flipping Vegas on A&E) and Dean Graziosi (author of Millionaire Success Habits) for their involvement in promoting a scammy real estate training program.  The influencers allegedly knew about customer complaints claiming the coaching programs were misleading and even attempted to plant fake, positive reviews online.  Graziosi agreed to pay $1.25 million, and Yancey will pay $450,000.  If a celebrity or influencer is particularly egregious, the FTC can get serious about it.

{Side note:  the Supreme Court recently curtailed some of the FTC's powers. Per its ruling in AMG Capital Management, LLC v. FTC (2021), the FTC can no longer request a court to return money to injured consumers, a key tool under Section 13(b) of the FTC Act. Instead, the FTC is limited to seeking injunctions to halt illegal activities without the ability to provide monetary relief to consumers. However, the FTC still retains its penalty authority. As of this writing, there is sentiment in DC that a congressional fix is forthcoming, so keep an eye on this development in the future.}

III.  The Securities and Exchange Commission:  Defending the Financial Market Against the Promotion of Unregistered Securities, Inadequate Disclosures, Fraud or Misleading Statements

In addition to the FTC (a general consumer watchdog agency), other government agencies regulate various industries and their advertising practices based on their subject matter expertise.  The Securities and Exchange Commission (the “SEC”) is the cop on the beat protecting investors and ensuring the securities market is fair, orderly and efficient.  It enforces the registration of securities, disclosure of financial information, and monitoring financial professionals and firms. 

A. The Law in a Nutshell:  The Securities Act of 1933 (the “Securities Act”) and the Securities Exchange Act of 1934 (the "Exchange Act") empower the agency to guard consumers against being materially misled by advertisements during the sale of securities.  Specifically, Section 17(b) of the Securities Act (known as the anti-touting provision) makes it unlawful to promote a security without disclosing the compensation for said endorsement.  Additionally, Section 17(a)(2) of the Securities Act (aka the anti-fraud provision) outlaws extracting money or property from another person through materially untrue statements or the omission of a material fact.