The Dormant Commerce Clause, Geographical Identification, and Blocking Technology

[Jack Goldsmith and I will have an article out about the Dormant Commerce Clause, geolocation, and state regulations of Internet transactions in the Texas Law Review early next year, and I'm serializing it here. There is still plenty of time for editing, so we'd love to hear any recommendations you folks might have; in the meantime, you can read the entire PDF of the latest draft (though with some formatting glitches stemming from the editing process) here.]

We think that the economic significance of geographical differences has driven the development of increasingly sophisticated technologies that identify where an internet user is coming from, and that allow websites and other internet operations to treat users differently based on geography. These technologies today permeate internet operations.

Geographical identification and filtering technologies grew up so that internet firms could better serve consumers and businesses, and, more generally, could make the internet a more effective communications tool.[1] Many internet firms, and all major internet platforms, collect and use geographical information as a core element of their business models.[2] For example, the firms involved in Greater L.A. Agency and Online Merchants Guild—CNN and Amazon—collect masses of location data about their users so that they can provide geographically tailored information to those users.[3] Firms operating on the internet cherish this geographical data because relevant consumer preferences differ by geography, and the data enable firms to better deliver their content and services.

"Location information plays an important role" in "providing useful, meaningful experiences" online, notes Google, a huge consumer and user of location information. "From driving directions, to making sure your search results include things near you, to showing you when a restaurant is typically busy, location can make your experiences across Google more relevant and helpful," and can "also help[] with some core product functionality, like providing a website in the right language or helping to keep Google's services secure."[4]

The best-known reason for firms to geolocate is that they want to advertise, and advertising success correlates with geography. A firm might want to deliver high-end advertisements to wealthy neighborhoods, or to deliver coupons when customers enter the mall, or offer a Burger King discount at a McDonald's, or promote farm-related software in rural areas.[5]

In addition, online firms seek to segment markets geographically so that they can price discriminate based on differences in wealth or product demand by geography. The prices on the web of Amazon e-books, Steam-powered computer games,[6] and Staples office supplies differ based on where the user accesses their sites.[7] In these and many other ways,

[g]eoblocking enhances market partitioning on the Internet by enabling content and service providers to limit access by users to information about certain goods, services, and/or prices, thereby enabling the providers to discriminate among different markets and offer different goods and services in various markets, for different prices, with different technical standards and warranties, and at different times.[8]

Geographical identification is also relevant to cybersecurity and fraud detection. Google might block an attempted sign-in from Russia to a Gmail account normally centered in Florida.[9] If Visa computers notice that someone who lives and normally shops in Montana is buying software online from Chile, it can temporarily put a hold on the account.[10]

Geographical identification and filtering technologies also let businesses operating in multiple jurisdictions comply with the law. Copyright law is territorial, and rights in works like movies, pictures, and electronic books differ by geography. Netflix streams Rick and Morty and Star Trek: Discovery in the United Kingdom but not in the United States because its licensing contract requires such geographical differentiation to conform with underlying copyright law.[11] For similar reasons, Amazon requires publishers of e-books to specify the countries where they own publishing rights, and it allows sales only to those countries.[12] Google likewise removes certain pages from its search results when ordered to do so by a court, but generally limits such removals to search results coming to users in the court's jurisdiction.[13]

Similarly, online gambling services have grown as they have become adept at complying with national and state mandates to ensure that they offer their operations only to users in places they are licensed to offer games.[14] And the question whether an internet operator has "purposefully availed" itself of the benefits of a particular state for personal jurisdiction purposes now regularly depends in part on whether the operator took steps to keep its content out of the state.[15]

Firms use location data for many other tasks, including inferring political beliefs, wealth, race, and scores of other intimate personal details.[16] And governments frequently buy location data in the private marketplace to further law enforcement and intelligence aims.[17] The primary methods of collecting geographi­cal identification information include using IP addresses, Wi-Fi positioning, GPS tracking, and cell tower geolocation.

The location-data industry is at least a $12 billion market and growing fast.[18] Geo-identification and blocking technologies have become "standard features of internet operations."[19] Indeed, the distinction between internet and "real-space" operations is increasingly fictional. "Real-space" firms that undoubtedly must incur costs to comply with different laws where they do business—for example, McDonald's, Ford, and Exxon—have an integrated internet presence that relies heavily on geographical identification and targeting technologies, in part to foster legal compliance.[20] And all major firms with only (or primarily) an internet business presence—for example, Facebook and Twitter—similarly collect and use location data to enhance their products and services.[21]

Consumers can, with some work, evade location detection, including (among other techniques) by using virtual private networks, opting out of location services, and using a Tor browser. Companies in turn are developing counter­stra­te­gies to defeat evasion techniques. For example, streaming companies have implemented measures to make it harder to use VPNs to circumvent geolocation technology for streaming.[22] More broadly, geolocation technology can lessen the impact of evasion techniques by relying on multiple sources of location information combined with much other information that via big data analysis can reveal remarkably precise information about where internet users are located.[23]

Geographical identification and filtering on the internet have improved enormously in the last two decades, but they remain imperfect, and there is a persistent arms race at the margins between blocking and evasion technologies.

Still, geolocation technology doesn't have to be perfect to be useful for legal compliance, just as many laws and security technologies remain useful even if they are not perfectly enforced. That would be especially true if a state law treats reasonable use of geolocation technology as an adequate defense when geography matters—for instance, when reasonable even if imperfect geoblocking attempts are seen as evidence of lack of intent to target a particular state for personal jurisdiction purposes,[24] or when reasonable geolocation attempts are seen as sufficient for determining that a defendant's copyright infringement happened within the court's jurisdiction.[25]

[1]. See Jack Goldsmith & Tim Wu, Who Controls The Internet: Illusions of a Borderless World 49 (2006) ("geographical borders first emerged on the Internet not as a result of fiats by national governments, but rather organically, from below, because Internet users . . . demanded different Internet experiences that corresponded to geography").‌

[2]. The Location Based Marketing Association's 2020 survey of 871 companies found that 95% of companies worldwide use location-based digital services. Location Based Marketing Association, Global Location Trends Report 2020, at 5, https://thelbma.com/wp-content/uploads/2020/12/Global-Location-Trends-Report-2020-THE-LBMA.pdf [https://perma.cc/X2UX-N6NY].

[3]. For CNN, see WarnerMedia News and Sports Privacy Policy, https://www.warnermediaprivacy.com/policycenter/b2c/WMNS/en-us/ [https://perma.cc/95EE-TVB8] (noting that Warner companies, including CNN, "may have access to certain Information about your location, such as your country or address, when you provide it either directly or via device information," "may collect Information about your device's precise location," and "also may derive a general location from device information (such as an IP address)," and use such information, among other reasons, to enable consumers to (among other things) "locate and access personalized information or functionality based on your interests or location (e.‌g.‌, find stores, theaters, or show times)"). For Amazon, see Amazon.‌com Privacy Notice, https://www.amazon.com/gp/help/customer/display.html?nodeId=468496&ref_=footer_privacy [https://perma.cc/7L4C-WR5C] (noting eighteen examples of how consumers supply information to Amazon, and noting that as a result of these actions, and that as "a result of those actions, you might supply us with . . . your location information," and adding that the information that Amazon automatically collects and analyzes includes "the location of your device or computer").

[4]. Google, How Google Uses Location Information, https://policies.google.com/technologies/location-data?hl=en-US [https://perma.cc/4NVG-4XSY].

[5]. See Google Ads, Target Ads to Geographic Locations (last accessed February 13, 2022), https://support.google.com/google-ads/answer/1722043?hl=en [https://perma.cc/HQ7H-QF4T]; Pengcheng Xia et al., Competition Strategies for Location-Based Mobile Coupon Promotion. 16 J. Theoretical & Applied Electronic Commerce Research 3248 (2021); Tim Burd, Facebook's Pin Drop: Rule Your Area, AdLeaks (Oct. 10, 2018), https://www.adleaks.com/the-power-of-facebooks-pin [https://perma.cc/D2MS-LZY7].

[6]. Not actually steam-powered computer games.‌

[7]. See Jakub Mikians, László Gyarmati, Vijay Erramilli & Nikolaos Laoutaris, Detecting Price and Search Discrimination on the Internet, Proceedings of the 11th ACM Workshop on Hot Topics in Networks, HotNets-XI, Oct. 2012, at 79.‌

[8]. Marketa Trimble, The Role of Geoblocking in the Internet Legal Landscape, Revista d'Internet, Dret i Política (2017), at https://pdfs.semanticscholar.org/0075/a385d77a1903977c61371f6610bfff817cb3.pdf [https://perma.cc/Z296-ENYZ].

[9]. Google Account Help, 'Suspicious Sign in Prevented' Email, https://support.google.com/accounts/answer/6063333?hl=en [https://perma.cc/SZ6M-M3QD] ("If you've received a 'suspicious sign in prevented' email from Google, it means we recently blocked an attempt to access your account because we weren't sure it was really you. To help protect your account, we send you an email when we notice unusual sign-in activity, like an attempt to sign in from a different location or device than normal.").‌

[10]. In practice, credit card companies combine geolocation mechanisms with other mechanisms and databases to identify anomalous patterns that indicate possible fraud. See Mark Nelsen, Outsmarting Fraudsters with Advanced Analytics, https://usa.visa.com/visa-everywhere/security/outsmarting-fraudsters-with-advanced-analytics.html [https://perma.cc/WZM6-TE6D]; Credit Card Fraud Detection: Top ML Solutions in 2021, https://spd.group/machine-learning/credit-card-fraud-detection/ [https://perma.cc/9AA4-4RPC]; Identifying Financial Fraud with Geospatial Clustering, https://databricks.com/blog/2021/04/13/dentifying-financial-fraud-with-geospatial-clustering.html [https://perma.cc/H29V-DF38].

[11]. Geo-blocking: How and Why Netflix Does It?, Skope (May 2019), https://skopemag.com/2019/3/06/geo-blocking-how-and-why-netflix-does-it [https://perma.cc/4RRZ-QC6H]; Top 10 Shows on UK Netflix That Are Not Available in the US (May 24, 2021), https://www.smartdnsproxy.com/news/netflix/top-10-shows-on-uk-netflix-that-are-not-available-in-the-us-464.aspx [https://perma.cc/7BKM-NW7W]. Relatedly, Amazon web services enables users to "use geo restriction, also known as geo blocking, to prevent users in specific geographic locations from accessing content that you're distributing through a CloudFront distribution,‌" https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/georestrictions.html [https://perma.cc/4FWV-V8KS].

[12]. See Kindle Direct Publishing, eBook Distribution Rights, https://kdp.amazon.com/en_US/help/topic/G200652410 [https://perma.cc/YPV3-DFHW].

[13]. For example, Google argued that its duty to delist links in accord with Europe's "right to be forgotten" applied only within Europe, and not globally, and it relied in part on its "geo-blocking" capabilities. The European Court of Justice ruled that Google had a duty to delist from all European versions of its search engine, and should also take measures that that "effectively prevent or, at the very least discourage" the availability within Europe of delisted links on non-European versions of Google's search engine. Google v. Commission Nationale de L'informatique et des Libertés (CNIL), ECJ, Sept. 24, 2019, case C-507/‌17, para. 73.

[14]. See Jazette Enterprises Ltd. v. Commonwealth, 2014 WL 689044 (Ky. Ct. App. 2014) (requiring "geographical blocking ('geo-blocking') of all illegal gambling websites accessible within the Commonwealth"); Mark Griffiths, Online Gambling and Geolocation, 23(5) Gaming L. Rev. (May 2019), at https://www.liebertpub.com/doi/10.1089/glr2.2019.2352 [https://perma.cc/HFX3-SVJZ]

[15]. See Marketa Trimble, Targeting Factors and Conflict of Laws on the Internet, 40 Rev. Litig. 1 (2020).

[16]. See Valentino-DeVries et al., Your Apps Know Where You Were Last Night, and They're Not Keeping It Secret, N.Y. Times (Dec. 10, 2018).‌

[17]. Byron Tau, IRS Used Cellphone Location Data to Try to Find Suspects, Wall St. J. (June 19, 2020); Joseph Cox, How the U.‌S. Military Buys Location Data from Ordinary Apps, Vice (Nov. 16, 2020); Joseph Cox, CBP Bought 'Global' Location Data from Weather and Game Apps, Vice (Oct. 6, 2020).‌

[18]. See Grand View Research, Location Intelligence Market Size, Share & Trends Analysis, https://www.grandviewresearch.com/industry-analysis/location-intelligence-market [https://perma.cc/K2GD-6QUL]. According to Fortune Business Insights, the location data industry is projected to grow from $13.52 billion in 2021 to 36.22 billion in 2029. Fortune Business Insights, Location Analytics Summary (2021), https://www.fortunebusinessinsights.com/location-analytics-market-102041 [https://perma.cc/G3UT-XA4H].

[19]. Marketa Trimble, Copyright and Geoblocking: The Consequences of Eliminating Geoblocking, 25 B.‌U. J. Sci. & Tech. L. 476 (2019).‌

[20]. McDonald's privacy policy, which appears in different languages depending on geography, states that its "online services and in-restaurant technology may collect information about the exact location of your mobile device or computer using geolocation and technology such as GPS, Wi-Fi, Bluetooth, or cell tower proximity," in order, among many things, to provide targeted products and services and to comply with legal obligations. See McDonald's Global Customer Privacy Statement, https://www.mcdonalds.com/us/en-us/privacy.html#q1 [https://perma.cc/JHP2-4W4H]. Ford collects location information (including the information about the location of Ford cars) in a variety of ways for a variety of reasons, including to improve and better provide products and services, to "understand you and your preferences, to make recommendations, and to deliver personalized experiences and Products centered around you," to support dealer operations, and to "perform business functions, such as accounting, finance, tax, regulatory compliance, litigation, information security, fraud detection and prevention, protection of our rights and property, supplier and vendor management, human resources, information technology, and improving our internal operations," and to "support our compliance with valid inquiries and directives from law enforcement or other government agencies.‌" See Ford US Privacy Policy, https://www.ford.com/help/privacy/ [https://perma.cc/8XLK-ELT7]. Exxon's U.‌S. privacy policy collects the "[g]eolocation data of your computer or mobile device" to "provide you the route to service stations," and shared this information with "companies providing locator functionality.‌" It also collects geolocation data in part "to improve marketing and promotional efforts" including about "products and services suggested on the basis of weather information associated with the geolocation of your computer or mobile device.‌" See Exxon Privacy Policy, https://corporate.exxonmobil.com/Global-legal-pages/privacy-policy [https://perma.cc/P9YA-387D].

[21]. Twitter "require[s] information about your signup and current location, which we get from signals such as your IP address or device settings, to securely and reliably set up and maintain your account and to provide our services to you.‌" In addition, "[s]ubject to your settings, [Twitter] may collect, use, and store additional information about your location—such as your current precise position or places where you've previously used Twitter—to operate or personalize our services including with more relevant content like local trends, stories, ads, and suggestions for people to follow.‌" See Twitter Privacy Policy, https://twitter.com/en/privacy [https://perma.cc/3UV5-79M2]. Based on where you connect to the internet, where you use your phone, and the location from a Facebook and Instagram profile, Facebook uses "location-related information-such as your current location, where you live, the places you like to go, and the businesses and people you're near-to provide, personalize and improve our Products, including ads, for you and others.‌" Facebook Data Policy, https://www.facebook.com/privacy/explanation [https://perma.cc/C79M-WSBA]; see also https://www.facebook.com/about/ads [https://perma.cc/36PP-DFX2].

[22]. See, e.g., Ernesto Van der Sar, Netflix Intensifies 'VPN Ban' and Targets Residential IP-addresses Too, TorrentFreak (Aug. 11, 2021), https://torrentfreak.com/netflix-intensifies-vpn-ban-and-targets-residential-ip-addresses-too-210811/ [https://perma.cc/43CK-KN5G] (describing Netflix strategies); PureVPN, The Infamous Netflix VPN Ban Explained (Apr. 26, 2021), https://www.purevpn.com/blog/netflix-vpn-ban/ [https://perma.cc/H6E3-8UA6]; cf. Mike Williams, What To Do if Your VPN Doesn't Unblock Netflix Any More, Techradar, (Jan. 2022), https://www.techradar.com/vpn/what-to-do-if-your-vpn-doesnt-unblock-netflix-any-more [https://perma.cc/DE2J-YEFN] (describing arms race between streaming companies that block VPN circumvention and VPN technologies that can defeat the blocks).

[23]. See Trimble, supra note 108, at 30–31 ("[M]ethods of geolocation that rely on unreliable self-reporting or the more reliable detection of Internet protocol addresses [are] being replaced with advanced methods that combine data from multiple sources, such as GPS and Wi-Fi signals, to provide a significantly higher accuracy with increased granularity. Because of improved geolocation, geoblocking can function with greater accuracy and operate in more narrowly defined territories and specific locations.").

[24]. See id. at 33–34.‌

[25]. See, e.‌g.‌, Crim. Prods.‌, Inc. v. Doe-72.‌192.‌163.‌220, No. 16-CV-2589 WQH (JLB), 2016 WL 6822186, *2 (S.‌D. Cal. Nov. 18, 2016); see also AF Holdings, LLC v. Doe's 1–31, No. 12-CV-20922-UU, 2012 WL 12875472, *3 (S.‌D. Fla. July 12, 2012) (contemplating geolocation that suffices "to establish—to a reasonable degree of certainty—that the Defendant may be found within this district").‌