When FMC’s  staff book club went on Amazon to order copies of Creative License this summer, the online shopping service suggested we also check out Lawrence Lessig’s Remix, Greg Kot’s Ripped and Jonathan Zittrain’s The Future of the Internet and How to Stop It. Funny thing about these recommendations? They are all books our staff has read over the past several years. Amazon’s recommendation service was spot on, thanks to back-end data collection tracking our browsing and buying habits. This is the upside to advances in online data collection, and these improvements in technology and information tracking have greatly enhanced the ability of both developing and established artists stay connected with their fans. Data collection in the digital environment helps musicians (and their business partners) do everything from market and sell product to route tours to build anticipation for upcoming releases, appearances and more.

While leveraging user data for fan engagement and efficiency in web-based services is certainly a benefit, the explosion of mobile devices, apps and social networks raises significant privacy concerns about what data is collected from users, how it is collected and maintained, who the data is shared with and what standards should exist for transparency. To help answer these questions, FMC’s legal intern dream team of Adam Holofcener and Liz Allen compiled an article exploring why privacy online matters, the current state of US privacy law, what you’ll find in most online privacy policies (if you’re lucky enough to be using a website or app that has one) and how to protect yourself online as a consumer or artist. These are complicated, important questions that deserve consideration by fans, musicians and their business partners in deciding what kind of apps and services online — from credit card processing for merch sales to mobile streaming platforms for new releases — to use and direct fans to.

Let’s look at the example of SoundCloud to show why privacy and data collection online can be so confusing and tricky. Because there are no federal regulations regarding privacy online for adults, websites and app developers are left to their own good will and business interests in devising privacy policies. SoundCloud allows musicians to upload songs and share content with fans across their web browser-based service, apps on social networks and apps on mobile devices. Their privacy policy, though, claims to only govern “use of SoundCloud’s internet platform at www.soundcloud.com … and any services that SoundCloud provides through this website;” SoundCloud’s mobile app does not have a privacy policy of its own. Is the app governed by the soundcloud.com privacy policy or is it not a service provided through the SoundCloud website? Because the app is accessible through the website and presumably connects the user to content provided by the site, there is an argument for applying the website’s privacy policy to information collected by the app. On the other hand, the app is not the same thing as the SoundCloud webpage, which can be accessed separately through a mobile device’s browser. If the website’s privacy policy does not apply to SoundCloud’s app, the information a user provides to the website may be handled in a drastically different way than that provided to the SoundCloud app (even when owned by the same company). While it may be counterintuitive, this disparity in privacy protection between platforms for the same service is perfectly legal under the current privacy protection regime.

Ultimately, your personal information online is as safe as you keep it. If you choose to use apps and other internet services based on which privacy policies protect your information best, opt-out of certain information collection schemes and are conscious about how much and what types of information you provide, you will probably be in good shape. Most developers and companies aren’t evil and in fact are doing their best to build a sustainable 21st century digital music ecosystem. The absence of a privacy policy doesn’t necessarily mean a service intends to exploit your data, and many services do take privacy principles seriously.

For all the ins and outs of the privacy situation, read Adam and Liz’s full article.