Protecting Your Business series, Episode 3

Transcript

David (LegitScript):  Hello, everyone, and welcome to our protecting your business series, which features experts from LegitScript and our compliance collective partners to help health care, telehealth, and addiction treatment operators navigate what comes after LegitScript Certification — from accessibility and privacy to advertising rules that keep shifting. Each episode tackles a real operational risk and shows what it takes to manage it. Today, we are talking about transparency and advertising, particularly looking at where advertising and disclosure scrutiny is headed for highly regulated businesses like health care. I'm David Khalaf, and for this episode, we are happy to welcome Michael Williams, who is a licensed attorney in California and Washington DC and is cofounder and CFO at Clym, a compliance platform that helps businesses better manage data privacy, web accessibility, and transparency requirements across more than a hundred and ninety global regulations from one dashboard.

And also Naomi Moono, an MBA graduate who is director of strategy for LegitScript Certification, which gives businesses in highly regulated industries a way to prove legitimacy to major online platforms and payment processors, opening doors to advertising and payment access so that they can grow their business. Michael and Naomi, thank you both for joining us today.

So transparency and advertising. Michael, let's kick it off with you. In previous episodes, we have talked about issues regarding accessibility and privacy compliance.

A company may get all squared away in those areas, and they may be thinking to themselves, great. We've checked all of our boxes. We're now free to go wild on all of our advertising and start bringing that revenue in.

However, advertising offers its own pitfalls. How so, and how are businesses managing rules and restrictions around advertising?

Michael (Clym):  Yeah. Definitely can confirm that privacy and accessibility compliance don't give a business a free pass on what it actually says or does in its advertising. So there's really two sides to the advertising issue. I'd say number one, there's a content of the advertisement itself. So the businesses need to make sure the claims are accurate and substantiated.

The important limitations are clearly disclosed, the things like testimonials or discounts or pricing are presented transparently rather than in a way that could mislead a consumer. Second, there is the technology used to deliver and measure that advertising, which is where a lot of these violations can come into play. So a company may want to use things like Google Analytics or Facebook Pixel or, you know, all of these other tracking technologies to retarget visitors, build audiences, measure conversations. But those activities can actually trigger privacy and consent requirements depending on what information is collected and stored, where the consumer is located, and how that information is being used.

So the challenge, I think, is for those businesses that these rules overlap and evolve. Right? And, like, I'm an attorney, and what an attorney wants to do is sometimes different from what marketing wants to do. So there's a natural tension there, and a business needs to kind of identify what the realities of their business are, but try to create some harmony between marketing and legal whenever possible.

And that involves adhering to what a privacy policy says, what a consent mechanism permits, and what actually happens, like, kind of from a technical perspective on the website. Those things kinda need to line up. So I would say the companies that manage this well treat advertising compliance as an ongoing operational process rather than a moment in time issue, which is kind of semantic of these sessions that we've we've thematic of what we've discussed in these sessions. Right?

It's almost never a moment in time. It's almost always an ongoing issue. So that means we're reviewing new technologies and campaigns before they launch, keeping your disclosures and legal documents current, using tools for age gating or legal document management, content takedown, I think having these various workflows to help operationalize the disclosure access and content related requirements before they become a problem. And I think that one thing to keep in mind here is that the goal is not to stop businesses from advertising.

It's to make sure they can advertise effectively while building the right controls around how they're collecting the data to be in compliance with these various laws.

David (LegitScript):  And like some of the other topics we've talked about, are there some state considerations when it comes to advertising? Is it sort of? I guess my question is does it change by jurisdiction? Like, some of these like, accessibility, like, you know, some of the other topics.

Michael (Clym):  It absolutely does. So there's just to give one example, some privates there's there's two primary concepts of consent. So there's an opt out jurisdiction and an opt in jurisdiction. So think about an opt out means that you as a business can collect functionally or generally as much data as you want, but you have to give a consumer the ability to restrict that after making a request. So I basically can tell you to stop collecting my data.

And whereas an opt in jurisdiction, I have to explicitly provide you with consent in order to collect my data. So oftentimes, we'll see before they come to climb companies taking a static approach. They'll just have one approach for everywhere, and that's wrong. Right?

Because if you're taking too restrictive an approach, your marketing is gonna suffer. If you're taking too liberal of an approach, your compliance is gonna suffer. So it's really important that you're using a software solution that can differentiate among the various locations and take a more dynamic approach so that you can again, I talked about kind of harmonizing legal and marketing. And, again, there's natural tensions there.

But you can do so to the best of your ability by implementing a more dynamic software that addresses both of those needs.

David (LegitScript):  You know, one of the themes that we touched upon over and over, and you touched a little bit upon this already. But in all these episodes, we talk a little bit about the need for ongoing attention to compliance. There's no real way to set it and forget it, essentially.

Talk a little bit more about how this plays out with the topic of advertising and transparency.

Michael (Clym):  Yeah. No. Of course. I think it is important because as the laws change, right, we'd mentioned in previous sessions how California's law was implemented for data privacy in twenty twenty.

It changes twenty twenty three. But websites change too. Right? So websites are constantly changing. Marketing teams add new pixels, analytics tools, chat applications, embedded videos, and other tracking technologies.

Vendors may change how the tools operate, you know, those kinds of things. So, again, compliance is almost never a moment in time issue. Your company might have had a compliant consent set up six months ago, but if someone in marketing adds a new tracking technology that starts collecting data prior to consent in an opt in jurisdiction, the website's actual behavior may no longer longer match what your privacy policy says, and it also may not be in compliance with the state regulate or state or jurisdictional regulation.

The same is true with what's called a data subject access request. So a lot of these privacy laws provide consumers with the right to do things like access the information or delete it or obtain a copy of the information about how a company is using their collected data.

And it's not enough to just state those rights in a privacy policy. The business has to actually be able to respond to these requests, and that's where transparency becomes really important.

So businesses need to understand what technologies are operating the website, what information they're collecting, and then whether consumers are being given the proper disclosures and the ability to access those kinds of things. So while there's not a set it a true set it and forget it solution, there are technologies like Clym that are out there that can help automate the process and really compress the amount of effort and work that companies need to put into their compliance efforts. For example, Clym has preconfigured default reg settings for a hundred and eighty different regulations globally.

So when you implement a client on our website, we will make that determination about that opt in versus opt out positioning on a jurisdiction by jurisdiction basis. So that's not something that you would necessarily have to figure out because, again, it gets complicated, and those things can change. But I think the practical takeaway is that compliance needs to become part of a normal website governance, not just something that's done one time.

David (LegitScript):  Yeah. And just to drive the point home, can you give us a good example of, you know, either a big misstep in advertising that someone made or, you know, a big challenge that has been posed by, you know, a law that's changed or something like that?

Michael (Clym):  So I think a good example is something as simple as adding an advertising pixel to a website.

So, like, a business so we had mentioned Google Analytics, Facebook Pixel. I suppose it's called Metapixel now or another marketing technology because the company wants to improve their retargeting or things like that. And so from a marketing team's perspective, that's just something they do every day. Right?

It's not that they may not even know that there's a need to update anything from a legal perspective. But if that technology starts selecting information about what a consumer is viewing, searching for their behavior on the site, those kinds of things before consent has been obtained in a particular jurisdiction, then that marketing decision could put that business in legal hot water.

As I mentioned before, as these rules keep changing, that creates additional challenges. And also, you know, again, there's a small army of ambulance chasing plaintiffs' attorneys that are out there that are operationalizing not only existing modern data privacy laws, but also other laws that are on the books. So for instance, in California, there's a law that was written in nineteen sixty seven, so before the Internet was invented, called the California Invasion of Privacy Act. And there are certain private litigants that are basically saying that if a website has so this is think about it like wiretapping, right, where you have there is a concept not to go too deep in the weeds here, but if you are in a state that is a what's called a two party consent law, in order to record a conversation, both parties so if I'm calling you on the phone and I'm like, I'm gonna record this call, you have to say yes for me to do that in a two party consent state.

Right? So similar for laws like the California Invasion of Privacy Act, what private litigants are now stating is that these tracking technologies are like recording a conversation, and they are filing lawsuits against website owners for using tracking technologies as basic as a Metapixel or or Google Analytics or things like this.

And state courts in California are tending to agree with them. Right? So I think that's what's causing challenges here. We're seeing a proliferation of demand letters and litigation. Demand letters being served and litigation being filed for violations of laws, again, that existed before websites existed.

But these private litigants are creating a lot of chaos in the market because of those be again, because of some very simple decisions that marketing teams make or a lack of awareness in general by a company.

David (LegitScript):  Let's bring Naomi into the conversation because logistics certification offers many advantages, one of which is, it opens the door to advertising on many major online platforms. Naomi, what do LegitScript's advertising and patient services standards say, and what are you all trying to achieve with them?

Naomi (LegitScript):  Yeah. Excellent question, David. So our advertising and patient services standards, they're really about making sure that what a patient sees in an advertisement, in marketing materials, on a website actually matches the experience when they're trying to access care. So starting with the patient services side, applicants within that certification standard are required to clearly disclose all the states, the territories, the provinces, the countries where their services are actually available.

And that might sound like kind of a small detail when I'm saying it right now, but it actually matters a lot in practice. If someone sees an advertisement, for example, for a telehealth service and assumes it's available where they live only to find out later it isn't, that's a pretty frustrating experience and also kind of a potential harmful gap between marketing and reality, especially if we're counting on that for care. And then, of course, for more of that solid compliance perspective, we need to ensure that everywhere that you are operating, that you're offering compliant services based off of the jurisdictions where you operate within and serve.

So we need clear visibility into every jurisdiction that you're servicing to make sure that you're operating compliantly within those jurisdictions. And then on the advertising standard, it really builds on kind of that same idea, that same framework. We require that advertising is transparent, that it's accurate, that it's not misleading in any way, and that it complies, of course, with the applicable laws and regulations governing that space. And that includes some pretty concrete requirements. So for example, businesses need to clearly identify themselves in their advertisements. They can't hide behind a different business name. They can't use a third party business name in their advertisement.

And then we also require, as another example, that advertisements are reflective or, excuse me, reflect accurately where they are offering services. So for example, we don't wanna see an advertisement claiming to offer services in a location where the business just simply doesn't operate and offer service. That's not transparent.

So what we're ultimately trying to achieve is, I think, pretty simple, but also pretty critical that patients need to be able to trust the marketing materials and the advertisements of a certified business. If a health care business is advertising a service, a location, an outcome, that claim should hold up when the patient actually engages with that business. And I think it's important to note that advertising more often than not is the very first interaction that a patient has with the provider or with the business. So that first impression, if that's misleading, it's gonna undermine trust before the process or the care even begins.

David (LegitScript):  Let's let's talk a little bit about competition because even if companies know all the rules out there, it can be a challenge because in competitive industries, it's common to see or more more common, at least, to see problematic advertising and maybe some problematic transparency practices as companies are are vying to gain an edge. How do you see this playing out in, say, the addiction treatment industry?

Naomi (LegitScript):  Yeah. That's a great question because specifically in that industry, it has a pretty well documented history of those deceptive practices, of patient brokering, of lead generation. Generation. So it's not a hypothetical concern.

It is a pattern that we have seen played out, honestly, repeatedly, and it's one of the exact reasons why platforms like Google, like Meta, require certification to be able to ensure compliance within these industries that do have a really high likelihood for patient harm and for deception. When an industry kind of has that track record of bad actors, as we would say, exploiting vulnerable patients for profit, extra scrutiny isn't always optional. Sometimes it's truly a necessity. One of the biggest trends that we've seen by far in this industry specifically is the use of third party business names in advertisements.

So, essentially, a business is advertising under a name. They're including a name in their advertisement that isn't its own, which in turn makes it very difficult for a patient to actually know who they are interacting with. That's a serious problem in the industry where patients are already vulnerable when they're searching for help and they're searching for care during those difficult moments in their lives. But I also will note that this is a great example of how within LegitScript, our certification standards, which govern our compliance reviews, aren't static.

So after observing that specific behavior in this market, we were seeing over the past few years businesses including third party business names in their advertisements, we made a change. And we actually included the advertising standards specifically on our addiction treatment program mandating that businesses cannot include third party business names in their advertisement. So I think that's a great example, especially, you know, how, David and Michael, you were kind of hinting on how the industry changes, laws, regulations change. Compliance isn't a moment in time.

Well, we take that into consideration when we're assessing the requirements surrounding our standards to ensure that they are continuing to reflect the industry and the concerns, the deceptive practices, the behaviors that we're seeing and really combat against them. But I think at the end of the day, it really comes back to, again, something simple but very, very critical. A patient needs to know who they're interacting with when they're looking for care.

David (LegitScript):  Yeah. Now as I mentioned, a lot of Logiscript applicants are applying because certification opens up the door to advertising on major online platforms. But another important consideration is how certification and compliance reinforces the relationship between applicants and their payment processing partners. How is that?

Naomi (LegitScript):  Yeah. Thanks for calling that out, David. I think advertising is a huge value proposition for certification and, of course, something utilized by partners to ensure that compliant businesses are on their platforms. But it's important to call out that payment piece because I think that that's equally important.

Certification plays a real practical role in payments because car brands like Visa and Mastercard recognize LegitScript certification as a way to streamline high risk registration for health care businesses. So similar to pharmacies, telehealth providers, they all fall within high risk merchants that card brands utilize their high risk merchant registration process for. And then similarly, there's payment providers and platforms that also recognize and in some cases require certification when onboarding merchants into their ecosystem and working with those car brands. And, really, I think all of this works because certification demonstrates that a business has, of course, met those core components of compliance standards that matter most to the card brands, to the payment space, and that includes things like privacy and transparency.

So payment providers, they aren't starting from scratch when evaluating risk when they can utilize LegitScript certification as an indicator that a business is operating compliantly and legitimately.

David (LegitScript):  Thanks, Naomi. That will do it for this episode on transparency and advertising. Michael, Naomi, thanks again for joining us. And everyone else, we hope to see you at a future episode. Take care.