A statement of your intent: For example, "Our goal is to engage our customers through the mobile channel in a safe, easy, consumer-friendly way so that they ultimately will consider their mobile devices as a seamless and natural medium through which they can interact with our brand."

Your framework within which you engage consumers and protect their data: For example, "We insure that consumers interact with our brand strictly on a voluntary basis and in a highly secure environment using state-of-the-art encryption and other security protocols to protect against inadvertent disclosure, misappropriation, and external attack."

Your treatise for complying with laws and regulations: For example, "We commit ourselves to ensure that our mobile marketing programs are in compliance with current and future laws, regulations, and industry best practices. We will work with the governing bodies, our partners, and regulators to evaluate our program no less often than quarterly and will establish a communication policy to advise our employees, clients, and partners of any changes to our programs that are necessary to be in compliance with these regulations; moreover, we will promptly address any industry audits conducted by the mobile carriers, application store, or related parties."

Obtain permission when you want to engage someone in your mobile marketing programs.

Keep a record of someone's permission after you obtain it.

A list of the categories of information collected: This isn't just names, addresses, or phone numbers. Mobile devices also have the ability to collect less obvious information such as location data and behavioral data. Make sure you include all forms of information collection and tracking in your policy.

A list of the categories of third parties with whom data is shared: As a best practice, you should not share personally identifiable consumer data with any third parties unless it's absolutely necessary to carry out a legitimate business practice. For example, if you're using a third party to administer digital coupon delivery to consumers, you need to share information about your consumers' mobile devices with that third party.

A description of the process (if any) by which consumers can review and request changes to their collected information: A common method is to provide an e-mail or postal address for consumers to send requests for changing or deleting information you've collected about them.

A description of the process by which the operator notifies consumers of material changes to the operator's privacy policy: An acceptable policy is simply to state in your policy that you may make material changes from time to time and that consumers should periodically check back for the most up-to-date terms. If you anticipate making significant changes to your privacy policy, you can send an e-mail to all those whose e-mail addresses you've collected pursuant to the policy to notify them of the change.

The effective date of the privacy policy: Most privacy policies begin with "Last revised on [date]."

To start, the marketing material you use to invite the consumer to engage in your mobile program must contain opt-in information about the cost of engagement. For example, adding Std Txt&Data rates may apply (which stands for Standard text and data rates may apply) as part of the legal information near the call to action to participate means that the consumer would be charged a fee by their carrier for all text messaging, multimedia messaging, and data — application downloads, Web site views, and so on — in accordance with the contract they've entered into with their mobile carrier. There are even more detailed versions of this language as detailed in the Mobile Marketing Association Consumer Best Practices (www.mmaglobal.com/bestpractices.pdf).

Sending text messages on an ongoing basis. Your permission statement needs to outline the steps for obtaining prior permission. For example, your statement might require new customers to reply "yes" to all your text message prompts before they can receive future messages, as shown in Figure 3-3.

Charging for content or services on a phone.

Asking for donations through mobile devices. Your statement should detail the process for confirming present and future donations. For example, Figure 3-4 shows how making a $10 donation to support Haiti relief efforts requires the donor to reply "yes" to a confirmation message, even though the donation request was initiated by the prospective donor by sending a text message.

Tracking physical location. Some mobileapplications can serve pertinent information to consumers based on their physical location. Before activating any location usage application, consumers must be prompted with the specific request for permission. Your statement should include a process for gaining permission, such as a check box or online form that asks users if they want to allow you to use their location. You request this permission in different ways depending on your venue:

Personally identifiable information (PII): PII is any and all information that can be used to identify a person.

Non-personally identifiable information (non-PII): Non-PII is information collected through the course of the marketing process, such as clicks on a Website, that can't immediately be linked to a specific person.

Collect only data that you absolutely need: If you collect your customers' Social Security numbers, but don't do anything with them, you've created unnecessary risk.

Limit internal access to customer data to only those people who absolutely need it: Some businesses give everyone in their IT department access to all information out of convenience in case someone from IT has to fix something. But if you allow an employee who sets up e-mail accounts for new employees to have access to a customer's payment history, you've created unnecessary risk.

Store data in highly secure form: Encryption has become standard of care.

As soon as you're done with a customer's data and have no further need for it, destroy it: If you retain customers' data after they have closed their accounts, you've created unnecessary risk.

Winner data inprize promotions: Talk with your attorney to make sure your policy addresses state and local laws in addition to national laws for contests and promotions. (You can read more about laws for contests and promotions a little later in this chapter in the section called, "Complying with sweepstakes rules.")

Incentives: If you're using gifts, prizes, or other incentives to engage your customers, make sure your policy complies with local, state, and federal laws. These laws can be extremely complicated; consult your attorney or a specialist firm like ePrize (www.eprize.com).

Social media: If your business has a social media presence, give some thought to whether your policies or procedures should treat those who interact through their mobile devices differently from those who access through laptops or desktops. For example, if you want to use mobile social media technology to utilize consumers' location data, you may run into legal issues with publically posting the physical location of individuals. Allowing the general public to know where specific individuals are (or that they aren't home right now) can present safety and privacy concerns.

The Mobile Marketing Association (MMA): The MMA is the leading worldwide trade organization whose members include agencies, advertisers, hand-held device manufacturers, carriers and operators, retailers, software providers and service providers, as well as any company focused on the potential of marketing through and with mobile devices. The MMA has established several standards and updates them often with notice to their members. For example, the MMA recently published Global Mobile Advertising Guidelines and highlighted the fact on their Web site, shown in Figure 3-5. The MMA's Consumer Best Practices Guidelines (www.mmaglobal.com/bestpractices.pdf) is a good place to start learning about accepted industry practices, wireless carrier policies, and regulatory guidelines that have been agreed on by representative member companies from all parts of the industry. Check back at their Web site every six months or so for updates.

Figure 3-5. The Mobile Marketing Association advertises policy updates to members.

The Direct Marketing Association (DMA): The DMA is a leading trade organization in both the United States and the United Kingdom that focuses on direct marketing practices, including mobile marketing. In 2009, the DMA included a mobile marketing section in its Guidelines for Ethical Business Practice guidelines (www.dmaresponsibility.org/Guidelines/), which are designed to help you execute your mobile marketing programs properly.

CTIA — The Wireless Association: The CTIA is an international nonprofit membership organization that has represented the wireless communications industry. Its membership includes wireless carriers and their suppliers, as well as providers and manufacturers of wireless data services and products. Participating wireless carriers, in conjunction with CTIA, have voluntarily adopted the Wireless Carrier Content Classification & Internet Access Control Guidelines. The Guidelines were developed along with an industry-approved Classification Criteria. This is another critical resource you should consult if you want to market to consumers through the mobile channel.

Interactive Advertising Bureau (IAB): The IAB is an organization that includes more than 375 leading media and technology companies who are responsible for selling 86% of the online advertising in the United States. Among the IAB's core objectives are sharing best practices and educating industry members in responsible marketing methods to help fend off adverse governmental legislation and regulation. The IAB mobile committee produces best practices and mobile advertising guidelines, which are available at www.iab.net/iab_products_and_industry_services/1421/1488/mobileplatform.

Groupe Speciale Mobile Association (GSMA): The GSMA is a global association spanning 219 countries and uniting nearly 800 of the world's mobile operators, as well as more than 200 companies in the broader mobile ecosystem, including handset makers, software companies, equipment providers, Internet companies, and media and entertainment organizations. This organization is focused on innovating, incubating, and creating new opportunities for its membership and the growth of the mobile communications industry. Information on the GSMS is available at www.gsmworld.com/.

CAN-SPAM: CAN-SPAM is a U.S. federal statute that regulates the senders of commercial electronic mail. Electronic mail messages regulated under CAN-SPAM include e-mail and other electronic messages sent through social networking sites, but do not include text messages. (Text messages are governed by the TCPA discussed in the following bullet point.) In order to comply with CAN-SPAM, check the current law at ftc.gov/spam. If you violate any of the CAN-SPAM laws, the U.S. Federal Trade Commission (FTC) can prosecute you.

In addition to FTC involvement in spam, the Federal Communications Commission (FCC) has imposed a ban on sending unwanted commercial e-mail messages to wireless devices if the e-mail address receiving the e-mail includes a wireless domain e-mail address listed at www.fcc.gov/cgb/policy/DomainNameDownload.html. This is a special rule designed to prohibit marketers from sending commercial e-mail to mobile devices.

Telephone Consumer Protection Act (TCPA): The TCPA was passed by Congress in 1991 — long before SMS technology existed. The TCPA generally applies to telephone solicitations and other calls made to phone numbers, including wireless numbers. The FCC has noted that the law encompasses both voice calls and text calls to wireless numbers, including SMS messages. One of the things the TCPA prohibits is the use of auto-dialers — computers that dial phone numbers — without prior express consent from the owner of the mobile number or account. Without getting into all the legal mumbo jumbo, the TCPA's application to text messages gets pretty convoluted. To be on the safe side, don't send unsolicited text messages to anyone.

Telephone Sales Rule (TSR): The FTC issued the Telephone Sales Rule and has revised it on several occasions to update its applicability to the evolving climate of the mobile channel. The TSR consists of four general requirements for telemarketers:

National Do Not Call Registry: On October 1, 2003, the TSR gave consumers a choice about receiving most telemarketing calls by establishing the National Do Not Call Registry (see Figure 3-6). Telephone solicitors are required to ensure that they do not make telephone solicitation calls to any number listed not only on the National Do Not Call list, but also various lists containing those numbers that have changed from landline to wireless accounts and numbers that have been set aside for wireless service. Consumers can register their home and mobile phone numbers with the Do Not Call Registry at www.donotcall.gov. Most marketers are forbidden to place telemarketing calls to any phone number listed in the registry, but some exceptions exist, such as political organizations, charities, telephone surveyors, and companies that have pre-established business relationships with a consumer. Marketers are required to check the registry at least once every 31 days to clean their internal lists. Text messaging and e-mail also fall under the umbrella of the Do Not Call Registry.

Standards for telemarketers: The TSR prohibits deceptive and abusive telemarketing acts and practices and sets forth standards of conduct for telemarketing calls:

Predictive dialers: A predictive dialer is a computerized dialing system that automatically calls a batch of phone numbers within a given range. Telemarketers who use predictive dialers must connect the call to a live representative within two seconds of the consumer's completed greeting. If they don't, the call is considered abandoned even if it's answered by a live representative after the two seconds. Abandoned calls are generally prohibited, meaning you cannot keep someone waiting on a line longer than two seconds before they are connected to a live attendant.

Caller-ID: To be in compliance with the Caller-ID component of the TSR, a marketer may not block Caller-ID and must list a company name and telephone number that can be called by the consumer for company Do Not Call requests. The callback number must be answered with the same company name listed on the Caller-ID.