As we have helped businesses launch their exciting, new Facebook Pages, we’ve learned that there are some common concerns with Facebook’s rules. For this article, we have picked out five key issues for your company to consider. Ideally, your company will discuss these issues with your employees before your Page is launched, but even if you already have a Page, it is not too late to reduce your company’s legal risk in several areas.

Issue 1: Did your employee set up a Page, a Group, or a Profile?
Hopefully, the answer is a Page. We will explain the terminology and then the reason why a Page is the best option for business use.

Facebook Pages provide a way for “[a] public figure, business, or brand … to share information, interact with their [sic] fans, and create a highly engaging presence on Facebook.” Private individuals create Profiles to share information with their Friends. Businesses create Pages, and instead of Friends, Pages have Fans. Anyone can create a Group and can set it up to have open or closed membership.

Pages have a Wall, where the owner and Fans can, if the owner allows it, post content including comments, photos, and videos. (For an example of a Page with only basic content, check out the Procter & Gamble Page; for a Page with some extra content, check out the Coca-Cola Page.) Unlike a Profile, a Page must be publicly available and must share all content with all Facebook users. Pages can only be created and maintained by an official representative of an organization, and Profiles can only be created and maintained by a private individual.

For a number of reasons, businesses will usually want to have a Page rather than a Group. For example, Pages can communicate with an unlimited number of Fans; Group messages are limited to 5,000 people. Page administrators' identities are shielded; Group administrators' identities are disclosed. When the administrator of a Page posts a comment, it appears to come from the company; when a Group administrator posts a comment, it appears to come from that individual.
The way this issue can trip up your company is that a Group can never be converted into a Page. If your employee sets up a Group and gets lots of people to join it and sets up a great infrastructure for your company on Facebook, but then your company realizes that it really would prefer to have a Page, it cannot convert the Group into a Page. Its only option is to set up a Page and notify the Group members and have them re-join as Fans – a sure way to lose some people in the process.

Issue 2: Will your company be liable for user-generated content?
Once you launch your Page, Fans may be allowed to post comments, photos, and videos. What if one of those comments, photos, or videos infringes someone else’s copyright? If your company has allowed user-generated content on its main website, it has probably protected itself by complying with the safe harbor provisions of the Digital Millennium Copyright Act (DMCA). It may want to consider protecting itself under the same law on its Facebook Page.

The safe harbor requires your company to provide contact information for someone who can take down allegedly infringing material, to take down allegedly infringing material upon request, and to comply with some other requirements. Generally, DMCA compliance is described in a website’s Terms of Service. If you operate a Page that allows users to post anything at all, you should consider posting a Terms of Service for your Page that includes DMCA compliance, along with the other terms usual for a website that allows users to post content. As of now, most Facebook Pages do not have Terms of Service, partially because Facebook appeared to take responsibility for Pages’ DMCA take-down notices in the past. Facebook’s Statement of Rights and Responsibilities now makes it clear that Pages must have their own DMCA policies. Examples of Page Terms of Use can be seen on theCoca-Cola Page and the 1-800-FLOWERS.COM Page.

Another copyright issue Page owners face is that there are no technological blocks to users taking and re-using all content posted on Pages. This includes your company’s photos, posts and comments, as well as your Fans’ photos, posts and comments. There are also “Share” links for most items on Facebook, which allow users to repost content to their own Walls in their Profiles, thereby sharing that content with their own Friends. This poses a bit of a copyright conundrum. Under copyright law, if a Fan posts something to your Page, no one can use it in any way except to view it on your Page. Other Fans cannot repost it; you or other Fans cannot incorporate it into other works; you cannot use it in your advertising within or outside Facebook. If the Fan who owns the copyrighted material gets wind of certain kinds of use by others (particularly uses outside Facebook), or simply decides that s/he regrets having shared the material in the first place, you or your other Fans can face liability for re-using the material in ways that are expected within the world of Facebook. You may want to consider including license provisions in your Terms of Use for your Facebook Page. Some Page owners make all materials posted to the Page subject to a Creative Commons Copyright license. Essentially, that license allows anyone to re-use the material in any way so long as they aren’t making any money directly off of it. Other types of licenses can also be included in Terms of Use for a Page.

As for defamatory or other illegal content that users might post, in most cases, your company would be protected by the Communications Decency Act. However, you can remove offensive user posts, and you can set up user rules and expectations in your Page’s Terms of Use to reduce your risk. If you plan to set up a Page that you expect will provoke controversial posts by users, you should discuss this issue with your attorney.

Issue 3: Does your company have to do anything to protect its Fans’ privacy?
Facebook requires a Page to have a privacy policy if the Page “collect[s] user information.” Facebook defines information as “facts and other information about you, including actions you take.” A Page inevitably collects user information when a user becomes a Fan (including the fact that the user has become a Fan, the user’s full name, and, depending on the user’s privacy settings, the user’s profile photo) and may collect additional information (for example, when a user makes a Wall post or posts a Fan photo), so this policy seems to require that all Pages have their own privacy policies. However, currently, most Pages do not maintain privacy policies.

In the outside world, the Children’s Online Privacy Protection Act (COPPA) has stringent requirements for websites directed to children under age 13, including that they must have a privacy policy and what that privacy policy must contain. Many activities that are fine offline are restricted online due to COPPA. Furthermore, many sites that are not directed to children choose to have a privacy policy with a statement that they are not directed to children and will delete any information about a child under age 13 that they may have inadvertently collected. The Federal Trade Commission, which enforces COPPA, has been pursuing violators recently to the tune of over $1 million in fines in the past year, and state Attorneys General also have enforcement authority. A website (or Facebook Page) may expose its owner to liability in all fifty states.

“But,” you may say, “Facebook prohibits children under 13 from using the site, and I can age-restrict who is able to see my Page via the Edit Page Settings menu. So why should I worry about COPPA?” Facebook’s age restrictions give only false comfort. Anyone can sign up for the site using any date of birth; Facebook does nothing to verify identities or ages. In addition, people who may or may not be the parents of the children in question post information about children under age 13 often, both in their personal Profiles and on Pages. We have seen, for example, videos of children posted to Pages, with tags or comments containing identifying information about the children. The person posting the video generally says he or she is the child’s parent, but there is no way to verify this within Facebook. A child’s full name alone is enough to trigger a COPPA violation, so the risk of inadvertently violating the law is high, especially for companies whose products are marketed to the under-13 set in the real world.

Privacy considerations bring up one more issue on Facebook related to Issue 1 above: organizations are prohibited from maintaining a Profile instead of a Page. This is for the very good reason that the owner of a Profile has access to a great deal of personal information about any Friend, depending partially upon the Friend’s privacy settings. A Page, however, has access only to Fans’ names, possibly their photos, and the fact that they are Fans, unless the Fan affirmatively chooses to provide additional information. Your organization could inadvertently collect information from Facebook users that it cannot use and does not want, if it maintains a Profile instead of a Page.

Issue 4: Is there anything special your company should consider before setting up an account?
Facebook is not designed for businesses: as the Privacy Policy says, “We built Facebook to make it easy to share information with your friends and people around you.”

If nothing else in this post convinces you of this, the rules for administration of Pages via user accounts should. Facebook allows individuals to maintain one of two kinds of accounts: a business account or a personal account. A person’s business account cannot run searches on Facebook and does not have a Profile; it is used only to administer Pages and advertisements on Facebook. A person’s business account can be converted to a personal account by clicking an ever-present “Create Your Profile” button at the top of the page. Once this has been done, the account cannot be converted back to a business account. A person cannot have both a personal account and a business account; as Facebook’s Help section on business accounts says, “[p]lease be aware that managing multiple accounts is a serious violation of Facebook’s Terms of Use. If we determine that an individual has more than one account, we reserve the right to terminate all of their accounts.”

Pages are administered via people’s existing personal or business Facebook accounts. Each Facebook account must be maintained by only a single individual; Facebook’s policies prohibit sharing or transfer of accounts. However, Pages may have multiple administrators. Each administrator has full edit rights and can add or delete other administrators. The only administrator who cannot be deleted is the one who started a Page. So if you have an employee start a Page for your organization, s/he will always have full edit access to your Page, whether the setup is done via a personal or a business Facebook account.

In sum: an account set up to start a Page is the property of the employee who sets it up and cannot be transferred to another employee. Multiple employees also cannot administer a Page via the same account, whether it is a business account or a personal account. Employees who maintain both a personal account for personal use and a business account for use in association with maintaining your Page risk losing both their personal and business accounts.

Companies are currently grappling with who should be the administrator who starts a Page and whether they need a written agreement with that person to protect the company’s interests. Employees are currently grappling with whether they want to use their personal Facebook accounts to manage projects for their employer and/or their employer’s customers.

Issue 5: Are there any quirky rules of which your company should be aware?
Facebook prohibits users from running contests on Facebook without written permission from Facebook. In our experience, Facebook often takes months to respond to inquiries, if it ever does so. Contests are also subject to the Facebook Promotions Guidelines, which are short, sweet and straight to the point: you cannot promote your contest as being on Facebook, indicate that Facebook has approved or is affiliated with your contest, or administer the contest on Facebook unless it is via an Application on the Facebook Platform. We will save the complicated rules governing Applications for another time. If your company wants to run a contest on Facebook, it will require significant lead time and research to comply with Facebook’s rules.

Conclusion
Business adoption of Facebook is moving at light speed. We hope that Facebook will amend some of its rules to make them more realistic and helpful for business use. In the meantime, companies should work closely with their legal advisors to protect themselves to the greatest extent possible as they leap into the social networking world.

The issues we discuss here are based on the August 28, 2009 revision to the Facebook Statement of Rights and Responsibilities (which most sites call their Terms of Use), so please bear in mind that Facebook may have made one of its frequent revisions since the time of our writing. The date of the latest revision appears at the top of the Statement of Rights and Responsibilities page. If you want to stay up-to-date on changes to Facebook’s policies governing users in general and Pages in particular, add yourself as a fan of the Facebook Site Governance Page and the Facebook Pages / Public Profiles Page. (As you will see in the discussion of Issue 4 above, this can only be done via a personal account with a Profile, and not via a business account.)