A web-based company is a company that does not have a physical location. It exists only online in the form of a website. All of its business is conducted online through its website. It generates its revenue from web-based sales by offering products or services for sale from an online catalogue or product display.

Today there are many websites that publish personal information about people with whom the website has never had any contact. Unfortunately, there is little that a person can do about this, even if the information is inaccurate or false.

The Supreme Court has held that a person may sue a website for giving out false or inaccurate personal information only if the person can show that they suffered a concrete, actual or imminent injury as a result of the publication of the information. Such an injury would be something such as having an application for a mortgage or other loan denied or losing an employment opportunity. Absent a concrete, actual or imminent injury of this type, a person cannot sue a website for publishing information, even if it is false or incorrect.

The rules are different for non-public financial information. The Glamm-Leach-Bliley Act (GLBA), a federal law, limits the kind of non-public personal information financial institutions may disclose to third parties. A “financial institution” is not only a bank or credit union. 

The definition of “financial institution” covers any entity that is “significantly engaged” in a wide variety of financial activities. So a business that brokers loans, such as a car dealership, may be covered by the GLBA. Other businesses to which the GLBA may apply are businesses that offer financial advisory services, wire transfers, or other finance-related services.

The GLBA requires the businesses covered by the Act to give customers a notice saying which non-public personal information they collect, how they use it, and whom they share it with. If the business wants to disclose the information to third parties, it must provide customers with an opt-out mechanism. So, to protect non-public personal information, a person might want to locate these opt out mechanisms for the financial institutions with which they do business.

Meanwhile, the Federal Trade Commission has guidelines in the Fair Credit Reporting Act (FCRA) that apply to employers, landlords, insurers, and furnishers, which are businesses that compile credit reports, or maintain or destroy credit reports. 

A person has the right to know what information is in their credit file. A person also has a right  to know what information has been used against them if they are denied credit, and to dispute any errors. Agencies that compile your reports also have to obey certain guidelines about inaccurate, incomplete, unverifiable, or outdated information, and can only provide a person’s file to someone who has a “valid need” for it. They may not share a person’s “consumer report” data outside of that valid need.

If a person has an issue with a business that concerns a possible violation of the GLBA or the FCRA, they should contact the Federal Trade Commission or the office of the Attorney General in the state where they live.

If a person does business with a website that does not perform as promised, by, for example, taking money but failing to deliver a product or service as promised, a person has a variety of possible options for seeking resolution.

The city, county or state in which you live may have an agency or agencies that take consumer complaints. They might try to resolve a person’s complaint or they might be able to refer a person to another agency that can provide relief. A person can go to the website for their city, county or state government and look for an agency that deals with consumer complaints.

The Internet Crime Complaint Center is an agency of the federal government where a person can report online extortion, identity theft, hacking, economic espionage and other crimes involving the internet.   

If the crime committed against a person is not one of those listed, a person should still contact the ICCC and that agency might be able to refer the person to an agency that can deal with it.  

The Better Business Bureau (BBB) is not a government agency, but a non-profit organization whose mission is establishing trust in the marketplace. It can help a person make complaints against internet-based retailers and other businesses.

A person can check with the BBB before engaging in a transaction with a business to see if others have made complaints against them and whether they’ve been resolved or not. This is a way to assess the trustworthiness of a business before attempting to do business with it.

The FBI has an online form for communicating tips. A person can use the form to report potential cases of internet fraud, including data breaches, denial of service attacks, malware, phishing, and ransomware. The site links people to the appropriate agency that handles crime reporting for each specific type of crime.

The U.S. Federal Trade Commission (FTC) has an online complaint assistant for consumers who want to report fraudulent activity. A person can choose from various complaint categories, and is asked to answer some questions and tell the FTC what happened. Reporting these cases to the FTC helps it recognize patterns of fraud and abuse.

The eBay website has a Security Center that can help a person report auction-related fraud or scams to the proper authorities. A person can report a possible hacked account. If a person is the victim of a theft, the Security Center provides a way for law enforcement to find out if someone is trying to auction the stolen property.

What Happens If a Web-Based Company Has No Physical Location?

When suing any business, including an online company that does not have a physical location, the first important issue is determining where to file the lawsuit. If a person wants to sue a business, it is far more convenient if the person can sue the business in the closest court in the state where the person lives.

Generally, a person can file a complaint in any jurisdiction where:

  • The defendant lives;
  • The defendant does business;
  • The place where the accident or dispute happened;
  • The contract that is the basis for the complaint was executed or performed;
  • Substantial events leading to the lawsuit took place.

If a user logs onto the website of a company whose server is located in another state or country, it is difficult to say that the website has directed any activity to the user’s state. The user might have to sue the company where its server is located.

If a business operates only online, the active versus passive test provides guidance as to where a complaint can be filed. If a person sues an active website where there’s an exchange of money for services or products, the person can probably sue them in the state where they live. The idea is that by having an interaction with a person as a customer, the business has reached out to the person in their state, and can therefore be sued there.

A passive website offers a one-way interaction; the user goes to a website and reads text, or looks at pictures or videos. There is no interaction between the user and the website.

If a user accesses an active website, and suffers some harm as a result, it will be far easier for the user to sue that website in the user’s state. A passive website may have to be sued in a distant location. Some online businesses have terms of use that specify a certain location for legal action against them. For example, Facebook imposes the choice of Santa Clara County, California as the location in which it can be sued.

The issue of whom to sue and where can become complicated. It can be challenging to identify the owners of a business entity, especially one that does not have a physical location. This is an area in which an experienced business lawyer could be helpful. 

Can I Sue If a Website Posts Negative Content that Harms My Reputation?

Written defamation that ends up online is a form of libel. If content meets the definition of libel, one can potentially sue the source of the defamatory statement, if one can identify the person or who posted it. That may not always be possible.

While a person might want to sue the host or internet service provider (ISP) of the website that posts a defamatory statement, because of the potential for payment of any judgement, a federal law called the “Communications Decency Act” has specifically exempted website hosts and ISPs from most defamation claims.

It is also important to keep in mind that when pursuing a case for libel, a person must show the following:

  • The defendant made a false statement regarding the person
  • The statement was defamatory statement;
  • The defendant made the defamatory statement to a third party knowing it was false; 
  • The publisher acted negligently in publishing the communication.

It can be challenging to prove the elements of libel even if a website or other online platform is not involved. The challenge can be greater if the internet plays a role in the situation. A person would definitely want to consult an experienced defamation lawyer in order to find out whether a case can be pursued and if so, how.

The best strategy might be to seek removal of defamatory content from the website, but again, a lawyer would be able to assist a person in analysing options in a case of online defamation.

Do I Need a Lawyer for Help?

An experienced business lawyer is the best person to help you manage the many legal technicalities and complications of suing an online company. An experienced business lawyer can tell you whether you have a case worth pursuing, explain the implications of filing suit and advise on the right place to file your complaint.  It is definitely a good idea to consult with an experienced business lawyer if you feel you have a case against a web-based business.