From Brick and Mortar to Online: Preparing to Handle Future Pandemics

By: Mari Boyle

The coronavirus pandemic has forced businesses across industries to quickly adapt and change the way they operate. For small businesses with limited resources, this transition can be increasingly challenging. As state governments begin to lift some control measures, experts advise preparing for a potential second wave of coronavirus. For small businesses especially, it is important to prepare for this possibility. One of the ways small businesses can prepare is by establishing an online presence. Irrespective of whether a subsequent second wave of coronavirus occurs, small businesses can grow their business by transitioning solely from a brick and mortar model to operating online as well. This blog post will help you begin that transition by discussing how you can move your business online and issues to be aware of while operating in cyberspace.

taking your business online

Create a Website

The first step, particularly for small businesses looking to sell goods online, is creating a website. Through a website, businesses can continue selling their products and communicate to customers information about their business and operation plans throughout the different transitional phases of COVID-19. There are several affordable website design tools available to small business owners. Among the most popular include WordPress. This guide provides a comprehensive, step-by-step tutorial for how to set up your first website. It covers the important topics of registering the name of your website (domain name), designing your website, and other resources for building a website.

eCommerce

If you are looking to sell goods online, you have several options. You can create your own eCommerce store on your website and sell products through that medium. This gives you complete control over the website, design, and functionality. You can also hire someone to make your website for you. It’s easy to find website developers on sites like fiverr.com, upwork.com and freelancer.com. While hiring a developer will cost you some money, it will save you time that you can use on running your business.

Another option is to use hosted eCommerce platforms, such as Shopify. An advantage to this option is that a majority of the work is done for you and you can customize your site through pre-made templates. A third option is selling through marketplace sites such as Amazon, eBay, or Etsy. While this option allows for the least personal customization, it reaches a greater audience.

Email Marketing

Staying connected with your customers is important and can be done by text or email. There are several platforms that allow you to communicate with customers effectively through emails, such as Constant Contact, Vertical Response, and Mail Chimp. However, it is important to be aware of, and abide by, laws regulating commercial emails in the process. This post covers such laws, such as the CAN-SPAM Act which regulates commercial communications, in a later section.

Social Media

Meet your customers where they are by establishing or increasing your social media presence. Social media provides an additional low-cost platform for businesses to communicate and interact with customers. Small businesses can use these platforms to notify customers about changes in operations and direct them to your website. Businesses can bolster their social media presence by posting often and announcing sales or discounts.

Issues to be aware of… 

Taxes

When moving your business online, it is important to understand your tax liabilities.

In the past, online sellers only had to collect the applicable taxes in the state where the business maintained a physical presence. However, in 2018, the Supreme Court ruled that a business must also collect taxes in states where the business has a “nexus.”

Nexus” is a term used to describe a particular connection between the online seller and the state. If you are selling online to someone in another state and a “nexus” is found, you have to comply with that state’s tax laws and collect the applicable taxes. How “nexus” is defined, and the amount of the tax differs across states. Several states have established specific criteria as to when a business has established a “nexus” with that state through online sales. It is important to know how much you are selling, where you are selling, and the applicable tax. Many states have a de minimis rule that holds that unless you sell a certain amount to their residents, you do not have to remit sales tax to the state. All of the different standards can be challenging, so consider consulting a tax professional or find software to help you navigate the different tax laws. If you use an e-commerce platform, the platform will likely do this for you.

Data Privacy

Another concern of customers and business owners alike is data privacy. In operating a business online, business owners should be aware of state and federal data privacy laws to ensure compliance. For example, the Children’s Online Privacy Protection Act (COPPA) has specific requirements if your website or online service collects personal information from those under the age of 13. For more information on COPPA, see our blog post here.

Many states require businesses to take certain measures to protect the personal information they collect. In California, the California Consumer Privacy Act (CCPA), which went into effect this year, made robust changes to the state’s privacy laws in an effort to better protect consumer privacy rights. If you gather data from anyone in Europe, you must learn about the EU’s General Data Protection Legislation (GDPR). See our post here.

Additionally, most states have breach notification laws that require businesses to notify certain individuals in the event of unauthorized access to personal information. Businesses establishing an online presence should ensure their privacy policies are updated to comply with applicable state laws and know what data is being collected by their business.

Cybersecurity

Along with data privacy, of equal importance in moving online is protecting your business against cyberattacks.

According to the U.S. Small Business Administration, small businesses are often targets of cyberattacks because “they have the information that cybercriminals want, and they typically lack the security infrastructure or larger businesses.”

The most common types of cyberattacks include (1) Malware, software designed to cause damage to a network, (2) Viruses, harmful programs that spread from computer to connected computer, and (3) Phishing, which uses emails or websites to infect a computer with malware or a virus. In moving your business online, being proactive in protecting your business against cyber attacks can reduce your risk of becoming a victim. Some places to start include:

· Training your employees to spot phishing emails, use good browsing practices, and create strong passwords.

· Use antivirus software and update it regularly.

· Secure your Wi-Fi network by making sure it is password-protected, encrypted, and hidden through a Service Set Identified (SSID) For more ways you can protect your business from cyberattacks, take a look at this checklist.

CAN-SPAM

Mass communications can be a great way to reach your customers. However, when your emails or texts contain commercial content they must comply with the CAN-SPAM act. Briefly, the CAN-SPAM act has certain rules for emails that advertise or promote a product or service. Some of the rules include:

· Don’t Be Deceptive. The header information (who the email is from) must accurately identify the person or business that sent the email. The subject line must also accurately reflect the content of the message

· Do Disclose. You must disclose clearly and conspicuously that the email is an advertisement. You must also notify the recipient that they can opt-out of receiving future emails and how to do so.

Of note: This is not a comprehensive list of everything the CAN-SPAM act requires. For more information on what is required or prohibited by the CAN-SPAM act, see this guide.

Moving your business online gives you a relatively cost-effect way to grow your business without purchasing another physical storefront. In the face of the coronavirus pandemic, establishing an online presence can minimize the negative impact the pandemic has on your business and prepare your business for a potential second wave of coronavirus or whatever else may come.


Mari Boyle, at the time of this post, is a rising third-year student at Penn State Dickinson Law. Mari is from Pittsburgh, Pennsylvania and is interested in corporate law and litigation. Mari currently serves as President for the Business Law Society and as a Senior Editor of the Dickinson Law Review.

 

Sources:

https://www.ftc.gov/system/files/attachments/cybersecurity-basics/cybersecurity_sb_cyber-basics.pdf

https://www.ftc.gov/tips-advice/business-center/guidance/can-spam-act-compliance-guide-business

https://www.sba.gov/blog/5-ways-start-selling-online

 

What eCommerce Startups Need to Know About Online Sales Tax

https://www.solanosbdc.org/sites/default/files/Moving%20Your%20Biz%20Online%20Rough.pdf

https://www.wpbeginner.com/beginners-guide/the-ultimate-coronavirus-small-business-guide-wordpress-tools-for-remote-work/

https://www.wpbeginner.com/guides/

https://www.sba.gov/business-guide/manage-your-business/stay-safe-cybersecurity-threats

https://www.fcc.gov/general/cybersecurity-small-business

https://sites.psu.edu/entrepreneurshiplaw/2020/06/08/a-beginners-guide to complying-with-coppa

https://oag.ca.gov/privacy/ccpa

https://www.forbes.com/sites/kellyphillipserb/2019/10/02/new-sales-tax-rules-take-effective-this-week-in-more-than-a-dozen-states/#4ac097075cfb

Image Sources:

https://www.makdigitaldesign.com/ecommerce/10-tips-too-increase-sales-and-efficiency-of-your-ecommerce-store

How to Create A Website From Scratch: The Beginner’s Guide

https://www.cpomagazine.com/data-protection/the-future-of-data-privacy-corporate-compliance-in-a-post-gdpr-global-market/

 

A Beginners Guide to Complying with COPPA

By: Ashli Lyric Jones

As technology is advancing, children have the ability to access most websites, apps, and other technology with the click of a button. This access has given companies the ability to market directly towards children. Companies such as Youtube, TikTok, and Apple have been successful at appealing to children and adults of all ages. But with great success comes great responsibility and restrictions. And this responsibility needs to be taken seriously. Note that Google and Youtube violated COPPA and had to pay $170M.

When it comes to the collection of personal information from children under 13, the Children’s Online Privacy Protection Act (COPPA) puts parents in control. The Federal Trade Commission (FTC) enforces COPPA, which spells out what operators of websites and online services must do to protect children’s privacy and safety online. The following list should serve as a guide for businesses that must comply with the COPPA.

step 1: Determine if coppa applies to your business

Does your website or online service collect personal information from kids under 13? If so, it is likely that COPPA applies to you. To be more specific, you must comply with COPPA if you meet any of the following criteria:

  1. Your website or online service is directed to children under 13 and you collect personal information from them.
  2. Your website or online service is directed to children under 13 and you let others collect personal information from them.
  3. Your website or online service is directed to a general audience, but you have actual knowledge that you collect personal information from children under 13.
  4. Your company runs an ad network or plug-in, for example, and you have actual knowledge that you collect personal information from users of a website or service directed to children under 13.

The term “website” is defined broadly under COPPA. In addition to traditional websites, this Rule applies to:

  • mobile apps that send or receive information online (like network-connected games, social networking apps, or apps that deliver behaviorally-targeted ads)
  • internet-enabled gaming platforms
  • plug-ins
  • advertising networks
  • internet-enabled location-based services
  • voice-over-internet protocol services
  • connected toys or other Internet of Things devices

step 2: post a privacy policy that complies with coppa

Once you have determined that COPPA applies to your business, the next step is to post a privacy policy that is clear and comprehensive. This notice must describe how personal information is being collected online from kids under 13 and how it is being used.  The notice must also describe the practices of any other services collecting personal information on your site — for example, plug-ins or ad networks.

A link to your privacy policy should be included on your homepage and anywhere you collect personal information from children.  Additionally, if you operate a site or service directed to a general audience, but have a separate section for kids, you must post a link to your privacy policy on the homepage of the kids’ part of your site or service.

step 3: notify parents directly about your data collection practices

Under COPPA, you are required to give parents “direct notice” of your information practices before collecting information from their kids. The notice must tell parents:

  • that you collected their online contact information for the purpose of getting their consent;
  • that you want to collect personal information from their child;
  • that their consent is required for the collection, use, and disclosure of the information;
  • the specific personal information you want to collect and how it might be disclosed to others;
  • a link to your online privacy policy;
  • how the parent can give their consent; and
  • that if the parent doesn’t consent within a reasonable time, you’ll delete the parent’s online contact information from your records.

Additionally, if you make a material change to the practices parents previously agreed to, you have to send an updated direct notice.

step 4: obtain parents’ verifiable consent

COPPA gives you the authority to choose a reasonable method to obtain parents’ verifiable parental consent before collecting, using, or disclosing personal information from children. Parents must have the option of allowing the collection and use of their child’s personal information without agreeing to disclose that information to third parties.

If you make any changes to your practice of collection, use, or disclosure of personal information from kids you must send the parent a new notice and get their consent. Parents may revoke their consent at any time.

step 5: protect the security of kids’ personal information

When collecting any data, it is important to establish and maintain reasonable procedures to protect the confidentiality, security, and integrity of personal information collected from children. If you minimize what information you collect from children, it will be easier to protect kids’ personal information.

conclusion

The FTC looks at a variety of factors to see if a site or service is directed to children under 13 such as the subject matter of the site or service, the use of animated characters or other child-oriented activities and incentives, the use of visual and audio content, the age of models, ads on the site or service that are directed to children, and the presence of child celebrities or celebrities who appeal to kids.

It is important to determine if COPPA applies to your business. If COPPA applies to your business, you must establish and publish a privacy policy. Next, you must notify parents directly about your data collection practices and obtain verifiable parental consent. Lastly, it is important to protect the security of kids’ personal information.

When COPPA was first drafted there was no Youtube, no Facebook, no TikTok, and no iPhone. With the advancements in technology occurring at a rapid pace, it is important to make sure you stay up to date with all of the changes regarding COPPA. You don’t want to be the next business to get fined.


This post was originally authored on March 18, 2020, and can be found here. Ashli Jones, at the time of this post, is a rising third-year law student at Penn State Dickinson Law. She is from Long Island, New York and is a graduate of Spelman College in Atlanta, Georgia. Ashli is pursuing a certificate in Entrepreneurship with an Intellectual Property and Technology concentration. She is interested in intellectual property within the entertainment law field. Ashli is the President of the Sports & Entertainment Law Society, Mentorship Chair for the Women’s Law Caucus, and Social Chair for the Black Law Students Association.

 

Sources:

https://www.ftc.gov/tips-advice/business-center/guidance/childrens-online-privacy-protection-rule-six-step-compliance#step1

https://www.washingtonpost.com/

https://www.ftc.gov/news-events/blogs/business-blog/2019/11/youtube-channel-owners-your-content-directed-children

Photo Source: https://termly.io/resources/articles/coppa/