Sales Tax on Amazon: An Example of the Difficulties of Internet Enforcement

On March 28th, I published an article on the difficulties of the enforcement of the right to be forgotten. The first point I made concerned personal jurisdiction. Amazon.com's struggle to avoid collecting (state) sales tax stands as a great example of the issues of personal jurisdiction regarding internet sites.

Happily, Verne Kopytoff, writing for the New York Times, points out a Supreme Court case on point, Quill Corp. v. N. Dakota By & Through Heitkamp, 504 U.S. 298 (1992). Kopytoff doesn't get the personal jurisdiction framework quite right, a state has personal jurisdiction over a those corporations which have "certain minimum contacts" such that the suit "does not offend 'traditional notions of fair play and substantial justice.'" (International Shoe Co. v. Washington, 326 U.S. 310 (1945)). In essence, any corporation which engages in "systematic and continuous" activities within a state can be subject to that state's jurisdiction. (See cases following Int'l Shoe, particularly, Zippo Mfg. Co. v. Zippo Dot Com, Inc., 952 F. Supp. 1119 (W.D. Pa. 1997), for more information). What this means for internet retailers is not clear. The law of personal jurisdiction for internet retailers is very confusing. The law in one area of the country can be very different from another area. This presents one difficulty with enforcing anything regarding the internet or internet transactions.

Nevertheless, states seem to have accepted that, at present, they cannot tax Amazon itself (except for where Amazon has offices). States can tax their own citizens, however. So, a handful of states have enacted laws to tax 'Amazon Affiliates.' For the most part, Amazon has severed ties with Affiliates in those states to avoid collecting taxes.

In short, Amazon has been doing what I suggested websites would do. It is removing itself from the jurisdiction of those states. As a result, those states cannot enforce their laws.

In the case of Amazon, and other online retailers, removal hurts the states. As George Runner points out in the Times article, affiliates are, for example, Californians who sell products online. Not all buyers are Californians. In fact, buyers could be from anywhere. If we use a Fermi problem to estimate the amount of money coming into California from other states as a result of those sales we find that roughly $302.4 million flowed into California in 2010 as a result of Amazon Affiliates. (We assume (1) $15 billion in sales were made the the U.S. (based on a total of $18.707 billion in North America), (2) sales are proportionate to population (CA holds ~12% of the nations population), (2) 20% of sales are generated by Affiliates (no basis), (4) Affiliates get to keep 84% of sales generated (average for Affiliate program item + referral fee)). Assuming online retail accounts for 3.4% of sales that means California saw a total influx of $291.8 million in 2010 due to Amazon sales.

If we then use a Fermi problem to estimate the revenue generated by Amazon Affiliates for the State of California we discover that California collects ~$14 million. (We assume (1) Affiliates don't report sales as income, (2) Californians spend their money the same way as everyone else (and this chart is accurate), (3) The aggregate sales tax is 10% (Based on CA Board of Equalization numbers). Note that I didn't break down the amount past initial sales, i.e. what the sellers of products to Affiliates buy and how much of that goes to the State). $14 million is a lot of money for one company to be generating for one state. Unfortunately for California, if Amazon severs ties with its Affiliates none of that money will be flowing into the state.

The Times article also talks about an interesting strategy Amazon has adopted regarding its "presence" in a state. Amazon avoids having to collect taxes in states where it might be deemed to have a "presence" by assigning ownership of its warehouses to a subsidiary. In Texas that strategy is running into a bit of a problem. Comptroller Susan Combs has sent Amazon a $269 million tax bill. While Governor Rick Perry (R) is still trying to moderate the dispute Amazon has decided to close its Texas warehouse, effectively leaving the state.

According to the Times, lawmakers in several states are "trying to broaden the definition of physical presence in the state to include partner sites of all retailers, not just Amazon." No word yet on if lawmakers are also trying to broaden the definition of physical presence in the state to include more activities in order to try to force online retailers to collect sales tax.

If lawmakers do try to broaden the definition of physical presence it will be interesting to see what kind of Constitutional question arises and what impact that would have on other areas of 'internet law.'

White v. Samsung: An American Basis for a Right to Be Forgotten?

[Author's Note: White isn't the only possible American basis for a right to be forgotten]

Recently, there has been some push in Congress for some kind of bill to give internet users greater privacy rights. First, we saw Senator Leahy (D-VT) and Hatch (R-UT) release S.3804: Combating Online Infringement and Counterfeit Act (COICA). (While COICA does not explicitly address privacy concerns it broadens the ability of U.S. based law enforcement to engage with internet actors). Then, just a few weeks ago, Senator Kerry (D-MA) released a draft of a new privacy bill. Kerry's as-of-yet unnamed privacy bill has several provisions similar to the broad outlines of the European right to be forgotten. (Infosec Island has a great plain language summary of Kerry's bill).

These movements in Congress may provide a new, federal, basis for an American right to be forgotten. But, even without new federal involvement, there is some basis in White v. Samsung Electronics America, Inc., 989 F.2d 1512 (9th Cir. 1993), to infer a future the rise of an American right to be forgotten.


White v. Samsung stands as a core basis for the right of publicity. In White Vanna White sued Samsung for running an advertisement that showed a robot doing her job on what appeared to be the set of Wheel of Fortune. The 9th Circuit, over Judge Kozinski's dissent, held Samsung liable. Judge Kozinski, in his dissent, argues that "every famous person now has an exclusive right to anything that reminds the viewer of her." While it is not clear the 9th Circuit's expansion of the right of publicity was that broad the 6th and 10th Circuits have found cause to agree with Judge Kozinski. (ETW Corp. v. Jireh Pub., Inc., 332 F.3d 915 (6th Cir. 2003); Cardtoons, L.C. v. Major League Baseball Players Ass'n, 95 F.3d 959 (10th Cir. 1996)). Both the 6th and 10th Circuits note that the holding in White has significant interplay with the First Amendment.

What does all this mean for the internet? It's hard to say. But, it's possible that, at least in the 9th Circuit, a court might find cause to expand the right of personality to the everyday internet user, specifically in the commercial context. As a result, those pesky tailored ads might violate the user's rights, especially if they specifically incorporate information about the user.


Tailored ads are a difficult issue to tackle. On one hand, tailored ads are economically efficient. Companies are willing to pay more money to make sure their target demographic hears their message. Advertising engagement rings to married people, for instance, is a waste of money. Married people don't need and won't buy engagement rings. Being able to target unmarried men in committed relationships, however, would be a goldmine for Zales, Kay, Jarred, and every other jewelery company. And, consumers would probably like advertising more (or, inversely, hate advertising less) if they were only exposed to advertisements that were relevant to them. So it only makes sense that the push for tailored ads continues to gain ground.

On the other hand, Minority Report-esque ads are deeply disturbing. But companies seem determined to make those ads a reality. See the Corning's ad below:

http://www.youtube.com/watch?v=6Cf7IL_eZ38#t=04m05s

There's something a little chilling about walking into a store and having a robotic customer service agent recognize you. It makes sense that there would be push back against this form of technological change.

While White alone seems to provide good cover for internet user's right to be forgotten as far as advertisers go it doesn't really cover non-commercial transactions. In non-commercial transactions, the extent of the basis for a right to be forgotten depends on the legal theory under which the internet is approached. Courts may follow the 6th and 10th Circuits and use a 'speech' based theory or they may follow a 'property' theory like the New Hampshire Supreme Court in State v. Nelson, 150 N.H. 569, 571, 842 A.2d 83, 85 (2004). (There are, of course, other theories about digital "things" but I won't address them here. For further reading about "things" see Michael J. Madison, Law As Design: Objects, Concepts, and Digital Things, 56 Case W. Res. L. Rev. 381, 385 (2005)).

A property theory, as in Nelson, depends on the categorization of "things" on the internet as property, rather than "speech." In essence, content is chattel. In non-legalese, that means that the content you post to the web is something you "own" like your car. If someone comes and takes your car without your permission you can sue them. It is your car and, generally, you can control who uses it. Essentially, Nelson said the same thing except about photographic content. The defendant, Nelson, took several photographs laying on top of a dresser and copied them. The court found that the owner of the photographs had a property right in the content of the photographs.

While Nelson was a criminal case the reasoning seems applicable to civil cases as well. But, it is not clear how far that reasoning extends. Does it include just photographs (and, presumably, videos (which are just a series of photographs)) or does it include other kinds of content as well?

Even if Nelson includes other content it only protects content that users own. So, when Nelson is cobbled together with White internet users would only have a right to be forgotten insofar as commercial entities and misappropriation of content is concerned. Cyber-Bulling Statutes might expand that right to some degree but even with their inclusion information published about someone would not necessarily be subject to forgetfulness. At its extreme, the patchwork of rights established by White are still much more limited than the European Union's (EU's) right to be forgotten. The central concern at the heart of the EU's right to be forgotten, the publication of content about a person is not really addressed by this line of cases.

Enforcement of the Right to be Forgotten

Much has been made of the ascendency of the right to be forgotten in the European Union. Google's court battle in Spain, the European Commission's adoption of a proposal to clarify the right, and numerous references to the case of Wolfgang Werlé and Manfred Lauber have routinely made the news.

As explained by the European Commission in November 2010, the right to be forgotten is "the right of individuals to have their data no longer processed and deleted when they are no longer needed for legitimate purposes." This right, on an EU wide scale, is based in Article 8 of the Charter of Fundamental Rights of the European Union. Article 8 reads:

Protection of personal data

1. Everyone has the right to the protection of personal data concerning him or her.
2. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified.
3. Compliance with these rules shall be subject to control by an independent authority.

Insofar as it applies to the right to be forgotten, the interpretation of Article 8 varies within Europe, as a recent panel on social media and online privacy at Westminster demonstrated. But, the general trend seems to be movement towards allowing people to remove information about themselves posted online, irregardless of whether they posted that information, if speeches at the European parliament are any indication. This trend finds a basis in the controversial German court decision that Wolfgang Werlé and Manfred Lauber could prevent information being published about their murder of Walter Sedlmayr (although they could not scrub information that had already been published or archived).

While much must still be clarified about the right to be forgotten the possibility of an effective enforcement regime for the right to be forgotten seems unlikely. This is due to the glaring shortcomings of the various choices for how enforcement may be premised.


First, enforcement may be premised on the existence of personal jurisdiction. If the government (presumably, a nation or state) cannot physically seize the offender or assets of the offender it cannot enforce the right (unless it can convince another government to seize the offender or assets of the offender for it).

Let me given an example of how this works. Imagine that you criticize the King of Jordan. (This is highly illegal under Jordanian law so don't). Presumably, the Jordanian government would order you to be arrested. But, if you don't live in Jordan, have no assets in Jordan, and the Jordanian government cannot convince the nation where you are located (or where your assets are located) to seize you (or them) the Jordanian government cannot enforce its law. Essentially, you can violate Jordanian law with impunity. This plays out in exactly the same way with the right to be forgotten. Take the case of Julian Assange. The United States would, presumably, like to prosecute him for disclosing classified military information but cannot because it cannot physically seize him (or convince another government to seize and extradite him).

Second, enforcement may be premised on accessibility of markets. If a government can prevent its citizens from accessing a website that government can use that leverage to enforce that right. Of course, this enforcement mechanism is only effective if that website either obtains or reasonably stands to obtain a substantial portion of its income from the citizens of that nation. Why bother entering the Swiss market with its 7,731,167 people if the government places unreasonable restrictions on the content of your website and you cannot reasonably expect to see a large revenue stream flowing from that country?

China stands as a great example of this kind of enforcement. When Google entered the China market it stood to obtain a large portion of its revenue from that country and, so, agreed to censor search results on Google.cn. When the Chinese government pushed too far, Google realized that the Chinese government was placing unreasonable restrictions on its China venture and, so, decided to stop censoring results on Google.cn. Shortly thereafter, Google decided to leave China, demonstrating the fragility of this type of enforcement.


Third, enforcement may be premised on country-code specific top-level domain. In other words, websites that have country specific top-level domains (such as google.fr and google.it) would be deemed to be "located" in specific countries. This location would allow those countries to regulate those websites.

This kind of enforcement is problematic for three reasons: (1) it ignores other top-level domains; (2)it requires international recognition that country-code specific top-level domains are "located" in specific countries; (3) it would be possible to circumvent by moving assets out of the country in which the website is "located."

Essentially, generic top-level domains (and other top-level domains) would be unregulated making them very valuable (since no one country could regulate their contents) unless some kind of universal minimum contacts test could be devised. Further, hosting the website outside of the country and/or moving the assets connected to the website outside the country could allow for an end run around regulation. Enforcing regulation of those websites would require a foreign court to recognize the validity of a domestic court's order, no easy challenge.

The problems with this kind of enforcement was seen when the German courts ruled for Wolfgang Werlé and Manfred Lauber against the Wikimedia Foundation. Although the Wikimedia Foundation, parent company of Wikipedia.org, agreed to remove references to Wolfgang Werlé and Manfred Lauber on its German language site it refused to do so on its English language site. Since the Wikimedia Foundation had no assets in Germany the German government really had no way to enforce the decision, short of convincing another nation's government to do so.


Fourth, enforcement may be premised on forcing websites to comply. In other words, a nation may launch a sustained cyber attack against a website in order to force compliance. This tactic is a bit underhanded but successfully circumvents the problem of what to do if the government cannot physically seize assets attached to the website and does not have adequate leverage over the website to force compliance.

The problem with this kind of enforcement should be obvious. The website's owners and operations, the nation where the website is actually "located," and sophisticated groups of netizens, such as the Anonymous, may all seek some kind of retaliation. The nature of the retaliation would, obviously,  depend on which parties became involved but could result in some kind of substantial escalation.

In conclusion, without some kind of universal consensus enforcement of the right to be forgotten is problematic. The biggest challenge for those who seek enforcement is the relationship between the internet and  national boundaries. Increased bandwidth and technological globalization has made it very hard for nations to enforce 'rights' and 'duties' on a largely unregulated internet. Even highly regulated portions of the internet, like that behind China's Great Firewall, often see outbreaks of dissent and the government is largely incapable of stopping it. With the capacity of the internet to promulgate the Streisand Effect how the right to be forgotten might be effectively enforced remains to be seen.