Having now answered (to the extent I am comfortable doing so in the absence of any specific knowledge or facts of any particular case) the only question any client ever asks about advisory boards, I hasten to note that there are a lot of other – far far better – questions that could be asked about advisory boards.  Here are a couple:  What value can I reasonably expect from a member of my advisory board?  How do I get that value?  Why do I need an advisory board at all?  How do I find good advisors?

I don’t have any objective or quantifiable information around whether and how much value start-ups derive from their advisory boards.  My gut sense, based only on my law practice, is not much.  Mostly, what start-ups get is the opportunity to name a few luminaries on a slide towards the back of their deck.  The second thing they probably get is some introductions, probably to investors. 

I am sure there are some companies and entrepreneurs that have benefited greatly from advisory boards, but I have to believe this is a small number.  Below are a couple of links to blog posts on the subject of advisory boards.  The one from venture hacks seems to me to be particularly good in that it covers a lot more than just compensation, although it also covers comp.

Venture Hacks “Everything you ever wanted to know about advisors”

Ask the VC “Are Advisory Boards Helpful?”

Ask the VC “Advisory Board Compensation”

Parties to the Agreement

Consider who should be a party to the agreement.  Should the agreement cover “affiliates”?   The answer is probably yes.

Mutual or One-way

Consider whether the agreement should be mutual (i.e. each party is obligated to keep the other’s information confidential) or one-way (only one party discloses information and the other party is obligated to keep it confidential). 

How Broad is the Definition of Confidential Information

Usually it is very broad.  In particular note whether or not the information has to be specifically identified as confidential or whether it merely needs to be such that a reasonable person would understand that it is confidential.  Depending on the circumstances you might want to go one way or the other on this.  You may also want to identify certain specific categories of information as either confidential or non-confidential.

Is the Obligation to keep Information Confidential Clearly Stated

The agreement should expressly state that the parties (or party in the case of a one-way) must keep confidential information confidential.  An ancillary point is the standard of care which could be best efforts or reasonable efforts or the same level of effort used in the case of a party’s own information. 

Exceptions

There are a number of usual and customary exceptions to the definition of “confidential information”.  These include: (1) information that is or becomes public without a breach of the NDA, (2) information that becomes available to the recipient on a nonconfidential basis from a source not bound by an NDA that covers the relevant information, (3) information that a party knows (and can demonstrate that it knows) before entering into the NDA, (4) information independently developed by a party without the use of confidential information subject to the NDA, and (5) information required to be disclosed by law (SEC disclosure obligations for example) or judicial process (discovery in a litigation for example).  In this later case (legally compelled disclosure), there is usually a requirement of notice so that the party whose information is about to be disclosed can contest the required disclosure or seek some other protection.

Return or Destroy

There is (or should be) an obligation to return confidential information and destroy all copies at the end of the NDA.  This requirement is often coupled with a requirement that the recipient certify compliance in writing.  Also, some large companies like to retain one archival copy of whatever they get.  This is usually rationalized by arguing that they need it for the record in case of a law suit.

Limitation on Use

Very important.  These agreements should expressly limit the right of parties to use the confidential information they receive to the purpose for which it is delivered: for example, to decide whether or not to proceed with a particular transaction.  So, the agreement should say that the confidential information may only be used for the specified purpose.  If it does not say this, it may turn out that parties use the information for other purposes, such as advancing their own R&D.

Ownership etc.

The NDA should make it expressly and clear that no license or other rights to the confidential information is conveyed.  In a sense, this is part of the limitation on use, but is often stated separately as well.  Similarly, these agreements often state that no joint venture or other entity is formed and that neither party can act for the other in any respect.

Term and Termination

NDAs can be for a stated term (months or years) or they can be perpetual.  The argument for a stated term of years is that at some point the information is old and cold and the parties should be able to stop worrying about their obligations under the agreement.  In any event, the disclosing party should be concerned to make the term long enough so that the information is no longer likely to have value as a result of being confidential when the agreement expires.

With respect to termination, the termination of the agreement should not terminate the obligations of confidentiality and non-use.  The termination provision should expressly state that these obligations survive an otherwise general termination of the agreement.

Equitable Relief

These agreements often state that injunctive relief (a court order prohibiting a disclosure) is an available remedy.  Some companies want an agreement that such relief is automatically available, while others will only agree that the discloser has the right to seek an injunction.    

Governing Law and Venue

There is a distinction between the jurisdiction whose law will govern the contract and where suits may be brought.  I won’t comment on governing law, except to say that your lawyer may have an opinion about it and that in general all U.S. jurisdictions will enforce your garden variety NDA (that is plain vanilla ones).  What about NDAs with odd, different or peculiar provisions – who knows, it will depend on the provision.

Venue is more interesting.  At issue is where cases may be brought.  If you are in Boston, having to enforce your rights in Alaska is likely to be inconvenient and expensive.  Consider that when you agree to a specific venue.

Unusual Provisions

The foregoing list of provisions and comments is by no means exhaustive.  But, if you are presented with an NDA that raises any questions for you, consult your lawyer.  Just because someone from a big company (even a household name company) says “this is our standard NDA” does not mean that it is either standard or, even if it is their standard, that it does not have odd, different and perhaps pernicious provisions. 

Just to give you a flavor, here are a couple of provisions that I consider odd, that I have recently run across:

In a supposedly mutual NDA, I found the following “XXX agrees to use YYY’s Confidential Information for the sole purpose of evaluation or as otherwise agreed upon in writing by YYY.”  This provision looks fine except that YYY never agrees to limit its use of XXX’s confidential information. 

Here is another provision: “This NDA may not be assigned by either party by any means, including without limitation, by operation of law or merger, without the prior written consent of the other party.”  We all get that one can’t just transfer an NDA, but but what happens when you go to sell your business?  Did you just unwittingly make the other party’s consent a precondition to a sale of your business. 

Beware of limitations of liability provisions in NDAs.  Some pro-recipient NDAs include a disclaimer of indirect and consequential damages.  The problem is that almost all of the damages that would arise from misuse of confidential information are indirect or consequential. If the recipient breaches the NDA, it would probably argue that it can be liable only for injunctive relief, but not for damages.  While I have my doubts about the enforceability of a disclaimer of this nature, there is certainly a risk that it results in a fairly toothless NDA from the discloser’s perspective.

Occasionally, an NDA will include provisions which may allow the discloser of information to claim ownership of the IP rights in any modifications that the recipient makes to that information.  These provisions may be hidden in the definition of “Confidential Information”, which is one reason not to gloss over that provision, even if the beginning of the paragraph reads like a laundry list of every type of information and technology that the drafter could think of.

What is 409A and why do you care?

409A is a section of the Internal Revenue Code that governs the tax treatment of certain options.  409A provides that an option either (1) be an option for common stock of the employer and have a per share exercise price on the date of the grant equal to or greater than the fair market value of a share of common or (2) if the option has an exercise price of less than the fair market value of a share of common stock the recipient and the issuing company suffer some pretty draconian tax consequences.  (There are other ways to comply, but relate to less usual situations, such as options that are only exercisable on a liquidity event, and I am not going into that level of detail here and now.)

What are the draconian tax consequences?

There are three particularly nasty tax consequences:  (1) The recipient of the option will have income equal to the difference between the fair market value of a share of common stock and the exercise price of the option multiplied by the number of options, at the time the option vests, even if the recipient does not exercise the option.  (2) The recipient will get to pay a surtax of 20% over and above his or her normal income tax on the option related income.  (3) For each year for which the option remains outstanding, the recipient will suffer the same nasty tax consequences with respect to any increase in the value of the common stock. 

Why on earth would the IRS create such a rule?

Consider what could happen if the issuing company were publicly traded and was issuing options with below marked exercise prices to its execs.  Need I say more?  Unfortunately, 409A applies to all companies – not solely public ones.

What can I do to avoid the bad tax consequence?

Issue your options with an exercise price equal to or greater than the fair market value of the underlying shares.

How do I know what the fair market value of a share of my privately held technology start-up is?

Here are some ways to price your options:

(1) You can take a guess at the fair market value.  If you guess wrong you are toast.  And, by the way, your guess will be judged with 20/20 hindsight by the IRS.  So, that does not seem like a good solution.

(2) If there is a recent actual arms-length transaction in which common stock was sold, then you have price.  Note that I said “actual,” “recent,” and “arms-length.”  The fact that your lawyer took a few shares a year ago in consideration of an old invoice won’t cut it. 

(3) If you have a financially sophisticated person on your board (or as your CFO), and your company has been in business fewer than 10 years, 409A provides that such person can perform a valuation. 

(4) You can pay an outside appraiser to perform a valuation.   Most (all?), of my clients who have professional money invested in them end up doing this.  It is a toll and it is unfortunate that you have this cost, but that is you tax dollars at work. 

Like my entrepreneur friend, you can want to price options at $.03 but if you sold common stock last week  in an arms-length transaction for $.30 per share, don’t do it.

Sometimes it seems like all clients have the same issue at once.  One series of issues that seems to be among the popular issues du jour is what to do to secure domain names and corporate names.  Needless to say, this should also dovetail with securing appropriate trademarks. 

Here are some strategies you can consider when registering domain names:

1. Register with the most popular top-level domains. Obviously, .com domains are the most popular by far, followed by .net and .org. You might also register domain names in the .biz registry, and in the .info, and .us registries. The Columbian registry (.co) is also making a big push to be an alternate .com (though it’s not clear it has much traction yet), so you might consider that as well.

2. You might consider registering some of the popular country-code top-level domains such as .co.uk, .ca, .asia, .de, .cn, .eu, .jp, and so forth, and country domains for any country where you expect to have significant business activity.

3. You might consider applying to register a “non-resolving” (inactive) .xxx domain name once they become available on December 6, 2011, or if you already owned a trademark registration prior to September 1, 2011, you may be able to take advantage of the cost-effective .xxx “Sunrise B,” which allows trademark owners to block a domain name for at least ten years for a one-time fee.  See http://www.icmregistry.com/launch/general-availability/.  Josh Jarvis, one of my colleagues writes a blog on trademarks, copyrights and related matters, and you might check his blog out for more on these topics.

4.  To protect against competitors and cybersquatters, you may wish to “defensively” register certain variations of "yourdomainname"  in at least the most popular domains (.com, .net, and .org). Some tricks used by competitors and cybersquatters include:

a. Changing singular to plural, or vice-versa.

b. Common misspellings or spelling variations -- e.g., using “z” instead of “s”.

c. Hyphens in obvious phrase breaks -- e.g., “soft-boiled.com.”

c. Typos -- e.g., sofboiled.com (missing letter) or substituting “d” for “s” or vice versa because it’s adjacent on keyboards

5. To protect against disgruntled customers or unscrupulous competitors, you may wish to “defensively” register so-called “gripe” domain names, at least in the most popular domains (.com, .net, and .org).  Ever popular creative favorites among the disgruntled are “Sucks” (e.g., softboiledsucks.com) which is by far the most popular of these, though other obvious four letter words are used.

Generally, it’s easy to get carried away -- it’s simply not possible to capture every possible misspelling, typo, or gripe variation in a single top-level domain, let alone multiple top-level domains. This is especially the case where the number of top-level domains is expected to increase exponentially over the next few years. The key is to get the most obvious and most likely suspects, at least in the .com registry if nowhere else. Keep in mind that you may have legal recourse available in the event of future bad-faith cybersquatting.

With respect to corporate names, as with domain names, you can't, as a practical matter, get every similar name in every relevant jurisdiction, but again you should think defensively and get whatever makes common sense in Delaware.  You might consider, but I also think it may be going too far, other big jurisdictions such as New York, California, Texas, and Mass.  Getting the corporate name, really means forming a corporation (even if it is an inactive shell) in the relevant jurisdiction.

At the risk of fighting the last war, I am going to come back to idea (and in some cases reality) of “standard” open source seed preferred documents. 

To be clear: 

(1) A note that converts at a discount into the next round of equity financing is probably the best deal an entrepreneur can hope to get.  Now he or she may not be able to actually get such a deal (and certainly won’t get it from many VC investors).  Why is this the best deal an entrepreneur can hope to get?  Because it limits the investor’s upside.  Why do VC (and other) investors hate these notes?  Because the notes limit their upside.

(2)  A convertible note with a cap may be the worst deal an entrepreneur can get.  Why?  Because, she is selling equity at the lower of two prices.  One price is a fixed valuation and the other is something less.  If you are going to set a valuation, you might as well just take that.

(3)  The seed preferred is probably the investor’s best friend because it sets a valuation on the closing date.  And, it starts the capital gains clock ticking so that in the case of an early exit, there is some hope for capital gains tax treatment.

It is hard to object to a fair valuation.  Of course, if it is fair, then so be it.  Unfortunately, experience suggests that valuations at the seed stage are chronically too low, with the result that after the first VC round, founder equity is diluted to the point where it is hard to see how (in the absence of a spectacular exit) the founder pay day will be all that good.

Of course, the black magic of valuation is the special provenance of VCs.  So that last paragraph was just an observation from the peanut gallery.  Unfortunately, I have seen this show more than a few times, and it doesn’t change much over time.

But here is one that is more in the provenance of lawyers:  Sometimes seed preferred docs carry in them the germ of a most favored nation clause.  That is the clause that says something like:  The Series Seed will be given the same rights as the next series of Preferred Stock (with appropriate adjustments for economic terms). 

In effect, your seed investor has gotten today’s valuation (the low one) and tomorrow’s terms (the good ones that the VCs negotiate).  If you are an entrepreneur and you believe, as I am told some people do, that investment negotiations sometimes involve a trade off between price and terms, then you just lost on two counts.

Ah, but what did you get?  A nice, simple, clean deal (that give the investor what he wants low price and good terms) at a low transaction cost (whatever fixed fee you agree to with the lawyers).

Unfortunately, many seed investors won’t stop at a simple deal.  They have loads of their own requirements.  But that will be the subject of another post.

But when our client SCVNGR asked if we’d be interested in participating in one of their groundbreaking new LevelUp promotions, we jumped at the opportunity. LevelUp is SCVNGR’s exciting new pilot for building customer loyalty by combining online daily deals and location-based gaming mechanics.

Here’s how it works. LevelUp works with merchants to create the best deals in your city – say, a special on burritos, rock climbing, or fitness centers. Each business has three levels of deals - Level 1, Level 2 and Level 3. Buying Level 1 not only gives you a great discount, but it automatically “unlocks” Level 2, allowing you to “level up” to a great deal for a second visit. If after the second visit you like what you’re experiencing, you can “level up” again and get a third great deal.

We think this is genius, and we wanted to be a part of the fun. Although LevelUp is usually retail-focused, we worked with SCVNGR to create “LevelUp Your Startup,” a special LevelUp deal for entrepreneurs with great ideas who could use discounted legal and accounting advice as well as coveted access to premier investors.  As part of Level 1, Foley Hoag attorneys will meet with entrepreneurs to help get their companies incorporated with a startup legal package.  Entrepreneurs who buy Level 1 will unlock Level 2, which includes a startup accounting package. Buying Level 2 unlocks Level 3, where top-notch investors like Rich Miner from Google Ventures, Alex Taussig from Highland Capital Partners and folks from Common Angels, Robin Hood Ventures and Dreamit Ventures will take the entrepreneurs out to lunch and hear their pitch.

LevelUp Your Startup launched on April 5th. We offered 10 startups $2,800 worth of legal services for $250 (no, there’s no comma missing there). What’s more, a share of the proceeds of this promotion goes to support a very deserving organization: MassChallenge.  Within about an hour, the deals had sold out.  

Given the numbers involved, it’s probably obvious that in the case of this LevelUp our goal was not necessarily to make money.  Instead, we wanted to be part of a great team and show how an awesome new program could be used to foster our local entrepreneurial ecosystem and help new businesses get off on the right path.  By every measure, LevelUp Your Startup has been a huge success for Foley Hoag, SCVNGR, our new entrepreneurial clients, and MassChallenge.  I think this is where I yell “Woot!”

I have been giving some thought to Fred Wilson’s recent post, “A Challenge to Start Up Lawyers”.  His basic point is that he should be able to close an angel financing of under $1mm for legal cost of $5K.  Needless to say, this post brought out the sycophants (the Fred you are absolutely right crowd) and the deeply offended (the lawyers are worth every penny they charge crowd). 

I don’t think it is reasonable to be in either crowd.  Our firm enters into a wide variety of arrangements with start-up (and other) clients.  These arrangements are intended to reflect the needs of the client and the particulars of each situation.  We may agree with a client on fixed fees, deferrals, reduced hourly rates, premiums, blended rates – to describe just a few of the arrangements we have with various start-up clients and other clients.

But, I want to talk about the $5K for a $1mm seed preferred investment.  Let me start by separating the invoice amount from the time that needs to be put into the transaction.  In the world of hourly rates, these two things are inextricably intertwined, but they need not be.

Our firm knows, because we do many angel financings, that the result of hourly rates multiplied by the time spent is highly likely to exceed $5K.  (That does not mean that we charge more than $5K or less than the hourly rate times the hours – what we charge depends upon many factors, the most important one, of course, is any agreement we have with a client.  For example, it is not unusual for us to write off time that we feel is excessive for any reason.)

So, why are the time charges (remember not necessarily the invoiced amount) likely to exceed $5K when so many angel deals are done and the terms are so “standard?”

VCs and lawyers do tons of deals, entrepreneurs only a handful.  Investments, even (or perhaps especially) angel investments involve a lot of discussion.  By way of illustration, they may involve discussion of valuation, option pools, vesting for founders, structure (seed preferred versus convertible notes) and other items.  Note that I have not yet mentioned the actual terms of the seed preferred. 

I can just hear Fred and his army of outraged investors saying:  “But we posited that the deal would be a seed preferred on standard terms and we agreed (hypothetically) on readily available open source docs.” 

OK, but I know from experience that the entrepreneur is highly likely (near 100% of the time) to come to me and say, “Fred wants to do a priced deal, but my buddy Winston got funded with convertible notes, which is better?”  So, now we have a discussion on the merits vel non of priced deals and convertible deals.  (I know that Fred won’t do a convertible deal, but that does not mean the entrepreneur won’t ask the question.) 

So, Fred, does the time spent on the discussion of priced deals versus convertible deals count towards your $5K or not?  Well let’s tick off $500 for that discussion (in the hours times rate world) and move on.

OK, now there is some sort of email or other with the “terms”.  At this juncture, the entrepreneur wants to discuss whether the valuation is fair.  (Remember that the fact that I am a lawyer and (according to most investors) as likely to know about valuations as about paleo-anthropology will not stop the entrepreneur from asking what other clients are getting.)  The meter ticks on….

Eventually we get to the seed docs themselves.  I produce the docs at the speed of greased lightening.  Unfortunately, the entrepreneur reads them and, guess what, has intelligent questions. 

Here is a good question:  Ted Wang’s open source docs provide an MFN provision for new terms arrived at in the next equity round.  I have a client that asked at least these questions about that provision alone:  What does it mean?  Is it fair?  How might it impact my negotiations in the next round?  Does it give my angel investor a practical veto over the next round?  And the meter ticks on….

Anyway, you get my point.  It is not mere document production; it is time spent with the client.  No lawyer wants his client to sign something that the client is not comfortable with and does not understand.  It is just not good corporate hygiene.  (In fact, it might be malpractice.)

So here is one for you Fred:  Would you want your portfolio company to be using a lawyer who just says these are the standard open source docs, just sign them please?  Would you invest if you knew the entrepreneur signed on that basis?  Would you invest if the entrepreneur read the docs and did not have any questions?

Now back to the price.  Many high quality reputable firms would agree to a fixed price (perhaps $5K) – not because they believe they will be able to bring in the time at a profitable rate, but because they think of it as business development.  They may have other reasons as well.  The thing to do is to have a discussion and agree at the front end as to how the billing will be handled.  But don’t be under any illusion.  It is unlikely that rate times hours will yield $5K.

One more point is that law firms are likely to view fixed fee arrangements as loss leaders.  They are planning to get more work on which they can make a profit.  Fred’s example of the exit (where the law firm charged six figures) is an excellent case in point.  The risk, of course, is that the firm that did the early work at what is in effect a discount, does not get the more profitable back end work.  This can happen when VCs (and other advisors – most of whom know as much about legal work as they do about paleo-anthropology) come to the conclusion that the company needs a thousand lawyer national megafirm for the “important” work, and they push the client away from the start-up lawyer.  It can happen for other reasons as well, the ingrained preferences of a new CEO or CFO, the insistence of a new investor that the company use one of its “favorite” firms, or the insistence of a heavy hitting board member to the same effect.

This leads to a lose lose situation for the start-up lawyer, who will now think twice before doing the angel financing at a loss.

The recent FTC report envisions a do-not-track mechanism that lets consumers opt out of third party tracking for behavioral advertising, which is one of the most common forms of online tracking. If companies wish to share personal information with third parties for purposes other than online behavioral advertising, we think some greater form of user consent should be obtained. The system as currently envisioned would not apply to ordinary first party tracking or to a first party's use of a service provider for website analytics, assuming the service provider makes no additional use of the collected data.

It is important to keep in mind that the FTC is not proposing a blanket ban on all tracking.  Having said that, it is still not clear to me that the proposal is not based upon the perceived creepiness of tracking and the emotional response of many people to the idea that they are being tracked. 

The reason that third party tracking is “one of the most common forms of online tracking” is that there are substantial economic benefits to it.  No one has really answered the question:  What happens if do-not-track actually results in many people opting out?

One thing is likely, the people who make money as a result of this kind of tracking wont any more.  So, whatever “free” content is being supported this way will either disappear or will be paid for some other way.

Another thing that might happen was suggested to me by a well known entrepreneur and investor here in Boston.  A great deal of effort and ingenuity will be expended getting people to opt in.  If this happens, it could have a lot of ramifications.  One consequence that he suggested is that once people opt in, they will have expressly agreed to the use of their information and there is likely to be much more far reaching and free ranging use of their information compared to the current system in which abusers are likely to be outed unpleasantly one way or another.  A second consequence that he suggested is that businesses will try to position themselves as first party providers in various ways and thereby evade the ban.  Finally, he suggested that the cost getting people to opt in will simply be added to the cost of innovation.

One thing is for sure, there is significant money to be made through behavioral advertising.  Until the cost of getting to good quality behavioral advertising becomes so high that it become uneconomical to go there, the money will be seeking ways to get there. 

This is the time of year when pundits look forward and make predictions.  So, I decided to do the same.  Here are ten predictions for next year:

 1)     The Pats will beat the Eagles in the Superbowl

 2)     Angels will continue to invest at a torrid rate.

 3)     There will be continued modest improvement in numbers of VC financings (but not enough to get back to 2007 levels).

 4)     Cleantech and renewable energy start-ups will continue to have difficulty raising venture money.

 5)     There will be continued modest improvement in M&A exits (but not enough to get back to 2007 levels).

 6)     There will be approximately 50 IPOs of venture financed companies (more than half of t he 86 that happened in 2007).

 7)     VC fund formation will also be slower than 2007 (both in amount raised and new funds raised).

 8)     The west coast will continue to provide better terms and valuations to entrepreneurs than the east coast.

 9)     Consumer web privacy rules will be promulgated and they will not have a material impact on tracking.

 10)   Net neutrality rules will be promulgated, and they will allow differential pricing of some sort.

So we will not be seeing 2007 levels of activity, but the entrepreneurial ecosystem will be livelier than last year.  So, I am predicting cold, but with a chance of fun.

The other day at Mass TLC’s Mobility Summit I had a brief conversation with Mark Herrmann (an entrepreneur here in Boston) that touched on the FTC’s recent proposal for protecting consumer privacy online.  We were talking about the “do not track” proposal and the consensus in the tech industry that it just won’t fly. 

Mark’s comment:

“It is creepy that ‘they’ can and do track you out in the net, but ‘creepy is the new cool.’”

There is just no question that some people accept the fact that they are being tracked and fed targeted online advertising.  It is not just OK by them; it’s a value add.  I don’t disagree. 

But, for anyone who has read “1984” (and even a lot of people who haven’t) the notion of being tracked is creepy.  There are a lot of these folks – perhaps a significant majority of the U.S. population – that feel this way.

In 2011 the FTC and Congress are going to pay attention to these concerns. It is good politics. 

Prediction #1:  Legislation in this area will be one of the few places where we will see bipartisan consensus in the next Congress. 

Why: No Congressperson wants to be opposed to consumer privacy, and they all want to have supported some legislation that passed, when running in the next election.

Mark (and others) made the point that if you really end tracking, you will end Facebook.  So, whatever happens it won’t be that.  However, the political snowball is rolling down the mountain - there will be regulatory activity around consumer privacy. 

The only question is: What will be the nature and scope of the activity?

The big boys (those with well established businesses that either make money or have ready access to capital) are going to be lobbying hard for a regulatory framework that does not dent their current business model. 

Prediction #2:  The big boys will fight anything that disrupts tracking and they are going to win this battle – no one in Congress wants to run on the platform that they put Facebook (or others) out of business.

But the big boys are going to have to trade something.  The easy things for them to trade are procedural protections for the consumer. 

• The FTC wants the industry to adopt “privacy by design” principles.  This means that companies should adopt internal processes to promote consumer privacy and security protections into their daily practices and to consider privacy issues at every stage of design and development of products and services.
• The FTC wants the industry to make consumer data more available to consumers.  This means allowing for increased consumer access to data collected. 

Prediction #3:  The big boys will trade lots of procedural protections for the consumer to prevent substantive regulation that will directly affect their business models. 

Why:  The big boys can afford the administrative burden implicit in procedural protections.  It is just a matter of more money, more people and more oversight.  A company that is well established and profitable or that has easy access to capital can afford to write the code, hire an army of new engineers, consultants, lawyers etc. and create an entire Department of Privacy Compliance and Protection. 

In fact, to the extent that having to do all that makes it harder for start-ups, it may even be helpful to the established companies.

Some folks I talk to have expressed real concern about this looming regulatory push and how it might affect the entire ecosystem for digital media start-ups.

There is still a chance to influence the inevitable regulation that is upcoming and I am working on assembling a group of industry leaders to do just that.  I recently sent out a letter (here’s a link) to people I thought might be concerned enough to actually do something.

Read it and let me know what you think.

The tech community seems to think this is no big deal because industry will prevail.  By "prevail" tech folks seem to mean that the regs, whatever they are, will be so watered down that the regs will be meaningless.  Their position is that anything else is unthinkable because the really big boys, Facebook and Google –as well as many others, depend upon tracking and targeted advertising.  To put a damper on them would create massive disruption.  Also, traditional carriers have huge value in the data they have, so Verizon, ATT and etc. will not let it happen.

At some level you have to agree with these observations. 

But, the counterpoint to them is that the FTC has now come out with a proposal.  There is great political pressure on Congress to do something. There is wide bipartisan support in Congress for regulatory activity to protect personal privacy.  Finally, among the non-tech world (which is most of the population) is creeped out by the notion that they are tracked onthe web.

I am concerned that the tech world just does not recognize that the non-tech population really does not like tracking 9and other data gathering).  I think the tech world also underestimates the appeal of giving people a choice not to be tracked.  Strangely, Fred Wilson’s blog makes this clear.  He refers to the “silent majority” who are not troubled by the data collection practices of most web companies and the “vocal minority” that are.  My concern is that he may just be wrong. 

So, it is predictable that some compromise will be reached between the FTC and the large companies who are already alerted to the issues and are working on changes that will be OK for them.

One problem: large companies have different interest from early stage and smaller companies.  For example, large companies will have far greater resources to deal with and comply with all sorts of regulation.  If they are required to incorporate specific privacy based procedures into their product development and other activities, they have the financial and other resources to do this.  If they are required to make the gathered information available to consumers or place restrictions on “new” uses of such data they can carry the cost of doing these things.  In fact, big companies may support this type of regulation, in part, as a trade for leniency on tracking and, in part, because it will form a barrier to entry for little companies.

If this happens, regulation could go a long way to undermining the economics of some start-ups.  So, you can’t rely on Facebook, Google, Microsoft et. al. to carry the ball for early stage companies.

The FTC has a process by which interested parties can comment on and influence the outcome of proposed regulation.  The resulting regulation will reflect this input.  The problem that arises for small companies is that it (the process) is expensive and time consuming.  it takes time and money to write comments, track proceedings, contact congressmen etc.  Google, Facebook, Verizon, and ATT will be hiring armies of lobbyists to do this (they may already ahve the armies deployed) – but they will not be lobbying for changes that work for start-ups.  Smaller companies just will not be able to compete in the fight to influence regulation and may end up with a regulatory scheme that is not hostile to them.

Small companies and the people who invest in them need to find a way to participate in the process.  If they do not, they could be looking at a pretty bleak future.

The Federal Trade Commission (FTC) just published its preliminary Staff report setting out its proposed framework for protecting privacy in the digital economy. View the FTC’s press release here. The FTC is seeking comments on its proposed framework by January 31, 2011 and expects to issue a final report in 2011.

Every digital media business that attracts advertising revenue online and/or through mobile devices, as well as the venture capital and private equity funds that invest in them, has a stake in the outcome of this proposed framework. It can affect current business models, future financial performance and potential exit opportunities for current and potential companies that rely on collecting data from consumers.

The final report, and possible new regulations and/or federal legislation to follow, will help shape substantive law, enforcement policies and commercial best practices regarding consumer privacy practices that will need to be followed.

Notably, the FTC staff cites flaws in commercially available, privacy-related plug-ins and browser features, and supports a more uniform and comprehensive consumer choice mechanism for online behavioral advertising than currently exists. This is often called “Do Not Track,” in a nod to the currently mandated “Do Not Call” registry that restricts the activities of telemarketers. FTC staff identified and requested comment on a number of issues concerning the formulation and adoption of any such “Do Not Track” mechanism.

Other important components of the proposed framework include:

• Scope: The proposed framework would apply to all commercial entities that collect or use consumer data that can reasonably be linked to a specific consumer, computer or other device. Here, the FTC staff recognizes the erosion of the distinction between personally- identifiable information (e.g., name, address and social security number) and supposedly anonymous information that may be collected without the knowledge of the web- or mobile device-user.
• Promotion of consumer privacy: The proposed framework would require companies to promote consumer privacy and security protections into their daily practices and to consider privacy issues at every stage of design and development of products and services. Suggested steps include:1) providing security for consumer data; 2) limiting data collection to the relevancy of a specific business practice; 3) enforcing sound retention policies; 4) providing assurances of data accuracy; and 5) implementing comprehensive data management procedures throughout the lifecycle of products and services.
• Consumer choice: In addition to the “Do Not Track” mechanism described above, the proposed framework would require companies to provide consumers with a notice-and-choice mechanism at the point when the consumer is providing data to the company. This would not be required in the context of commonly- accepted practices, such as order fulfillment or first-party marketing, however.
• Transparency and Access to Data: The proposed framework would require vastly- increased transparency with respect to data collection practices and allow for increased consumer access to data collected. As part of implementing this component, the Commission suggests a level of simplification and standardization for currently loosely governed website privacy policies.

Before this framework is submitted in final form to the FTC for a vote by its commissioners, which will accelerate the process further, the FTC is requesting comment by interested parties on a variety of key related issues, including:

• Scope: Are there practical considerations that support excluding certain types of companies or businesses from the framework?
• Substantive Privacy Protections: What substantive protections should companies provide, and how should the costs and benefits of such protections be balanced?
• Comprehensive Data Management Procedures: How can the full range of stakeholders be given an incentive to develop and deploy privacy-enhancing technologies? 
• Consumer Choice; “Do Not Track”:
  • How should a universal choice mechanism be designed for consumers to control online behavioral advertising?
  • What are the costs and benefits of offering a standardized uniform choice mechanism to control online behavioral advertising?
  • What is the likely impact if large numbers of consumers elect to opt out?
  • Should a universal choice mechanism include an option that allows consumers more granular control over the types of advertising they want to receive and the type of data they are willing to have collected about them?
• Transparency of Data Practices: With respect to website privacy notices, is it feasible to standardize the format and terminology for describing data practices across industries? Should companies inform consumers of the identity of those with whom the company has shared data about the consumer, as well as the source of that data?
• Notifying Consumers of Changes in Data-Use Practices: What is the appropriate level of transparency and consent for prospective changes to data-handling practices?

Now consider the following investment scenario:  you get a $5mm on $5mm valuation, but what does that mean?  If there is a preference, then the investor's $5mm is worth more than yours (this is even more true if there is also a participation).  (Just consider what happens in a low value exit.)

But -- how much more is the investor’s position worth?  I am not a finance maven, but think about the exercise price of your company’s options.  This price is supposed to be the fair market value of a share of common stock.  Now no one (except maybe the IRS) really believes that the strike price of an option is actually the fair market value of share common stock on the date of issue since setting the exercise price of options is mostly an effort to pick the lowest price you think you can get away with.  Nevertheless, everyone agrees that a share of preferred stock is worth a lot more than a share of common stock.  For argument's sake, let's assume a share of common stock is worth half of a share of preferred stock.  In this case your $5mm on $5mm is really $5mm on $2.5mm.

Thinking of your common stock position this way will also give you a sense of how much bigger a score has to be for you to make a return than it has to be for the investor.  I am really thinking of smaller exits, which a lot of people think is likely to be one of the hallmarks of capital efficient businesses.

If you raise $5mm (at $5 mm pre (i.e. $5 on $5) with a preference and a participation) and you sell for $20mm in two years, your investor gets $12.5mm (a return of 150%) and you get $7.5 (a return of 50%).  If the exit is at $200mm, there is still a disparity, but it fades into insignificance.  A capped participation preserves the disparity in the low value exit scenario while making it go away in the high value scenario. 

It sometimes seems to me that the quid pro quo for downside protection should be a diminution of upside return, but that is not the way VC investments are structured.

When you realize that returns to VCs in the last decade have been at or near zero (industry wide, and despite the downside protection), you have to realize that returns to entrepreneurs have been far far worse.

Not many mechanisms have been devised to mitigate this situation from an entrepreneur’s point of view.  One that has been used on occasion is to structure the initial capitalization of the Company (i.e. before venture investment) with common stock and a preferred stock.  Usually this is a preferred "lite."  It does not have all of the bells and whistles of the usual VC preferred, but it carries some important rights such as a preference and anti-dilution provisions.  These preferred shares are issued for “real” consideration (cash for example) and then the argument is made (at the time of venture investment) that they are really an early seed round.

 Whether you can succeed with this strategy is, of course, a matter of negotiating strength.

Like everything else i write and look at several weeks later, there are a few nuances that I wish I could rework and a few additional points I wish I could make, but all in all I'm pretty happy with the article and about those additional points you ask? .......Stay tuned!

Picture this: you’re an entrepreneur about to make your first foray into e-commerce.  This is exciting, but you can’t help but feel a little concerned.  Every day, you read a new story about advocacy groups and even Congress scolding businesses for being careless in their treatment of the personal data they collect, or criticizing the shadowy ways in which they collect it.  Publishers of major websites are rethinking procedures as they discover tracking technologies residing on their sites that they weren’t even aware of.  The dollar amount of settlements in the wake of high profile data breaches would be enough to cripple your budding enterprise.  I’d be worried if you weren’t concerned about the increasingly high profile area of consumer privacy protection.  Thinking carefully now and coming up with a website privacy policy in accordance with some simple guidelines can give you peace of mind and will allow you to focus on running and growing your business and making the most of your new website.

As you’re starting out, you probably have only a handful of site visitors.  You may even know many of them personally and you know they are rooting for you to succeed.  Because you would never want to do anything to breach the trust of your precious new customers, your task may seem simple: promise them absolute protection of their privacy.  Promise to keep everything they share with you in a Seinfeldian vault, and promise that the combination to the vault is theirs alone.  To achieve this, you may immediately set about cutting and pasting the most stringent provisions you can find from privacy policies of your favorite well-known websites.  Danger! Resist the urge to do this.  This approach is problematic (first off, consider the copyright implications).  Instead, engage in some thoughtful planning and keep a few concepts in mind as you conceive your privacy policy....

            Now that OPPA has given you a rough idea of what you must tell visitors in your privacy policy, you need to consider what level of detail to include.  Although there is no negotiation taking place, by asking your customers to accept the terms of your privacy policy you are attempting to enter into an agreement with them.  For your side of the agreement, the more you promise, and the more you give your customers in terms of privacy protection, the more good will and reputational advantage you may earn.  These are important values to keep in mind with consumer consciousness concerning privacy on the rise.  On the other hand, your business will be bound to act in accordance with your privacy policy, the obligations it imposes, and the promises it contains.  Over-promising now could hamper your business’s future ability to collect and use information in benevolent and rewarding, but currently unforeseen, ways.  That said, I will reiterate the importance of disclosing enough so as not to mislead your customers.  With a nod to OPPA, website privacy policies are often constructed by asking, and presented by providing the answers to, the following questions:

• When do we collect information?  In addition to information you collect from users when they register as a member or order a product, do you collect information concerning site usage behavior, IP addresses and other anonymous information using tracking technologies?  If so, one component of the answer to the “when?” question may be “any time a user visits the website.”
• What information do we collect?  The answer to this question is often broken down into the personally identifiable information (e.g. first and last name, address, telephone number, etc.) that is collected and into another category, often called aggregate information.  Any data you collect from users on an anonymous basis to administer the site and analyze its usage probably falls into the aggregate information bucket.
• How do we use personal information?  In your answer to this question you may include things like order fulfillment or storage in a contact database.  Describe how you actually use information but beware of promises to never engage in certain other uses.  As I will describe, amending away such an absolute promise in a privacy policy can be tricky.
• What information do we disclose to third parties?  In answering this question, remember that you likely cannot make an absolute promise not to disclose personal information to thirds parties.  Leaving aside the acts of various scalawags that are out of your control, you need to think about any necessary disclosures to contractors (e.g. those who ship goods ordered from your site), to courts or law enforcement agencies, or to third parties in the context of a business combination.
• How do our customers access and update their information?  This process usually includes a user logging into their account on the site and updating the information they’ve shared.  If such online functionality is not available, it’s a good idea to post an e-mail address where users can request changes to or deletion of their personal information.

Answering these questions will likely require you to perform some internal due diligence.  You should engage all relevant departments (e.g. marketing, IT, billing) of your business in assessing and understanding your privacy practices.  Once you have a thorough understanding of what you’re actually doing with respect to website visitors’ privacy, you can craft a policy that is consistent with reality and with other statements made on the website, and that you will be able to adhere to.

Although not required, some policies contain a description of the physical and technical safeguards used to safeguard privacy.  You will likely build up trust capital by showing your customers that you have robust privacy protection practices in place.  Watch out here, though.  Don’t say you use, for example, secure socket link encryption for transactions if that’s not actually the case.  This is an example of a provision that sounds great when you read it in the privacy policy posted on megaretailer.biz, but which you may not be able to adhere to.  Better to remain silent on the security measures you employ than to give a list of impressive-sounding practices you don’t actually adhere to.

Another important consideration is your explanation of how the policy will be amended.  Be aware that there are certain best practices to be followed in trying to ensure that your privacy policy as amended will apply to continuing users of your site.  Once again, you’re trying to form an agreement with visitors to your website, and principles of contract formation are likely to apply.  This means that each time you change your privacy policy, the best practices include notifying visitors of the changes and requiring them to accept the changes after clicking through the amended policy. 

Keep the cumbersome amendment process in mind while crafting your privacy policy and deciding what promises you want to make at the outset.  Visitors who use your site in reliance on the promises you make will likely have a right to have those promises enforced, and amending promises away as your business evolves is a tricky proposition.  Avoid the temptation to make broad and absolute promises in your privacy policy, and cut out flowery, aspirational language.  Although “legalese” should be scrapped in favor of language that is easily read and understood, resist the urge to go too far in the other direction.  In your introductory paragraph, a clear description of the purpose and content of the privacy policy that doesn’t contain any promises you can’t fulfill or hidden liability traps beats a statement that effectively promises visitors the moon when it comes to protection of their privacy.

Of course, your company may have special concerns about its website.  For example, if you plan to collect data from children under the age of 13, you’ll need to comply with the Children’s Online Privacy Protection Act (“COPPA”).  Enforcement of COPPA is the responsibility of the FTC and has lately been the focus of review by the agency and the scrutiny of all sorts of advocacy groups.  This is an area that may be in flux and deserves careful monitoring. 

I have confidence that if you were able to find your way to this article, it won’t take long for you, perhaps with the able assistance of your attorney, to be well on your way to crafting a thoughtful, well-balanced website privacy policy using about the same number of words I’ve used in this primer.  For more on the topic of consumer privacy protection, visit Foley Hoag’s blog, Security, Privacy and the Law and please keep an eye out for a follow up primer on drafting website terms of use agreements.

Diligence is a topic that tends to be overlooked, probably because it is boring.  Mostly people think of it from the perspective of whether your documents are in order etc. and mostly that is right.

But, there is one thing that deserves special mention:  background checks. 

Not every investor hires an investigator, but they all know how to use Google and in this day and age, almost everything about you is easy to find online.  If you have something in your past, let’s call them “Uglies” that an investor might be sensitive to (say an SEC consent decree, a law suit for sexual harassment, or something else ugly) and you try to hide it and your investor finds out from the net or elsewhere (and they will find out), you will be doubly damned. It is bad to have the ugly but its much worse to have the ugly and hide it. 

So, how can you protect yourself?   Here are some best practices:

Rule number 1:  Google yourself so you know what others will find. 

Rule number 2:  If there is anything in your past that you would like to hide, assume that your investor will find out about it

Rule number 3:  Be up front and honest.  How your deal with uglies can magnify or mitigate their effect.

Here is a video (produced by me using xtranormal.com – so please forgive the clumsy production values) showing how the conversation is likely to go in the hallowed halls of your potential VC investor.

If you have something in your past that an investor might be sensitive to and you disclose it properly and candidly you get damned once (for having the ugly) but you are likely to get mitigation points for being up front, honest and candid.  . 

Here is my second video showing how an upfront and candid conversation might go down with your investor

The biggest common denominator in dealing with successful start-ups is still luck.  Luck as I define it is being in the right place at the right time (so be prepared to be in a lot of wrong places, before the right time comes along).  You want to at least stack the odds in your favor.  Technology start-up entrepreneurs are usually smart, and have technical skills to boot which makes them very employable.  So it doesn’t come as a surprise that many start-up entrepreneurs have regular jobs working days, before coming home to work several additional hours on their concept or idea while still dealing with all the other aspects of life like family and friends, chores and errands.  They usually have some kind of team in place and some of them have gone far enough to create a corporate entity and have taken care of the usual start-up documents and legal strategy that I recommend.  However, the question still looms – When can I give my two-week’s notice?  When can I spend days and weeks working on this idea, rather than cobbling together a few hours after work and spending weekends making incremental steps? 

On the flip side, being on a plane means that you could crash before you even get up to the right altitude or you could get seriously hurt while jumping out of a moving plane (yeah, I know we are talking about jumping from high locations in both instances, but just humor me).  Likewise, you should be aware of several risks while you are working at your current job and moonlighting as a start-up entrepreneur that could mean disaster when you make the jump.  Be aware of what restrictions apply to you while you are still with our current employer.  If you are in a senior enough position, or in a specialized role, your agreement with your employer, might forbid you to work with another entity after hours.  If you have a focused specialization, your agreements might automatically assign the work you do in a specific area while employed to your current employer.  Your employer might have certain trade-secrets and you need to be sure that you are not infringing on these.  It is possible that under your agreements, any works done on the company’s time using the company’s resources will belong to your employer.  What I am saying is make sure you know the scope of your engagement with your current employer.  This extends to restrictions that might apply once you have left like a non-compete and the inability to hire away other co-workers (this could be an issue if your co-founders are also co-workers).  The best way to deal with these problems is to first, understand your risks and second, be proactive in managing them.  I have seen cases where the former employer will sometime be the first client for a start-up (because they have figured out a way to solve a pain-point) or even be a potential acquirer of the start-up business down the line.  In both instances it helps to leave your employer on good terms and with a common understanding of the work you are going to be doing and how it does not jeopardize any existing agreements you might have. 

 In closing, there will come a time to jump, you will know it, yes it will be terrifying, but hopefully you’ll be high enough, have all the right tools and materials and know what you have to do to put together that parachute/paraglider in time. 

 Dr. Tim Kane’s study on the “The Importance of Start-ups in Job Creation and Job Destructions” is a revelation even to die-hard fans of the start-up community like myself.  Start-ups for purposes of the report are firms and companies in year zero, so they inherently have an advantage, as the report concedes,  since they can’t really lose jobs in year zero. Some cheering points that I took away:

• Without start-ups, there would be no net job growth in the U.S. economy (true on average and only not so for all but seven years between now and 1977).
• In recessionary periods, (we know what that feels like) job creation at start-ups remains stable, while net job losses at existing firms are highly sensitive to the business cycle.

   The study hopes that its finding will shift the standard focus of employment policymakers away from the common media stereotypes of thinking of the issue of job creation in large aggregates and in the context of very large layoffs by established companies.  Also, the report hopes to be an alarm call to states and cities that have policies and incentives in place mainly to lure in larger more established companies because, if the analysis is correct, these are not real drivers of job creation.  Hopefully cities and states take notice and we have more policies in place to help the real champions of job creation – start-up firms that develop organically.  

Here is what Andrew has to say on that subject:

Being honest with yourself is perhaps the hardest part of being an entrepreneur. You’ve sold your friends, your investors, and yourself on your vision. You wouldn’t be putting yourself and your family through this if you didn’t believe in your idea. So who keeps you honest and tells you when you don’t have a business? Your customers and your hypotheses.

There may come a time you need to face the fact that the earlyvangelists you thought you had are actually just very polite users. Face the fact that your product won’t be able to make money or scale. Face the fact that your hypotheses are all wrong. And ultimately, face that fact that it’s time to majorly rewrite your vision. The sooner you face these facts the more chances you’ll have to course-correct and win.

This led me to consider buying Steve Blanks’ book, The Four Steps to the Epiphany, so I went to Amazon and found a review (really an old blog post from 2006 (is that possible?) that I am sure I read before, but can’t exactly place) with these two paragraphs which I thought worth repeating:

Get out of the building. Very few startups fail for lack of technology. They almost always fail for lack of customers. Yet surprisingly few companies take the basic step of attempting to learn about their customers (or potential customers) until it is too late. I've been guilty of this many times in my career - it's just so easy to focus on product and technology instead. True, there are the rare products that have literally no market risk; they are all about technology risk ("cure for cancer"). For the rest of us, we need to get some facts to inform and qualify our hypotheses ("fancy word for guesses") about what kind of product customers will ultimately buy.

And this is where we find Steve's maxim that "In a startup no facts exist inside the building, only opinions." Most likely, your business plan is loaded with opinions and guesses, sprinkled with a dash of vision and hope. Customer development is a parallel process to product development, which means that you don't have to give up on your dream. We just want you to get out of the building, and start finding out whether your dream is a vision or a delusion. Surprisingly early, you can start to get a sense for who the customer of your product might be, how you'll reach them, and what they will ultimately need. Customer development is emphatically not an excuse to slow down or change the plan every day. It's an attempt to minimize the risk of total failure by checking your theories against reality.

Distinguishing between vision and delusion can be a real challenge. The difficulty in determining if you are on track or off track can be greatly exacerbated when there is a huge externality (like the great recession) that seems to touch every aspect of business. One tactic that can be very helpful is to write down your hypothesis and measure against it from time to time and then revise and remeasure. Here is what Andrew Elliott has to say about this idea:

This seems so obvious, yet it must be said: write down and track the evolution of your hypotheses. It’s something that’s almost too easy to gloss over — keeping track of your hypotheses and the results of your customer development work are vital. Failure to keep track of our hypotheses meant we were never quite clear on what was working and what was not. This meant we had a hard time focusing our development.

You don’t need to worry about wandering around in the desert for 40 years if you don’t do this because you won’t be around for 40 years.

One further thought, consider and try to account for confirmation bias when evaluating your hypotheses.