Is a free trial version "commercial speech"?

Enigma Software Gp. USA LLC v. Malwarebytes Inc., 2024 WL 2883671, No. 17-cv-02915-EJD (N.D. Cal. Jun. 6, 2024)

This is the latest decision in long-running litigation over Malwarebytes’ characterization of Enigma’s competing cybersecurity and anti-malware software as “malicious,” a “threat,” and as a Potentially Unwanted Program (“PUP”). The court refuses to dismiss Malwarebyte’s claims for violations of the Lanham Act; violations of New York General Business Law § 349; and tortious interference with business (the last on the ground that the 9^th Circuit already said it was sufficiently pled).

Malwarebytes argued that its characterizations of Enigma’s products as “malicious” and a “threat” didn’t occur in commercial advertising or promotion but rather as part of the operation of its products. The court characterized this as a fact-driven question (raising the issue of whether the jury will be asked to decide it).

screenshot of Malwarebytes characterizing Enigma programs as threats; green "upgrade now" button at top of screen

There’s no categorical rule that in-product statements are immune from Lanham Act claims. Here, the allegations sufficiently stated a marketing context. (It’s not clear to me, but it’s possible that the court is holding that this is true only to the extent that they were presented with the free version with an upselling invitation. I think that, as to the free trial version, this is difficult--Eric Goldman doesn't--it seems to me distinguishable from the database ROP cases where people get truthful information about other people during a free trial and also an invitation to access further/more entries in the database, because Malwarebytes is offering a non-informational service--removing programs--in the upsell, not additional noncommercial speech content. But it does seem like an edge case.)

Were the statements in an advertisement? The court reasoned that, although the words at issue—“malicious” and “threat”—were not themselves advertisements, “Enigma has alleged facts permitting an inference in its favor that Malwarebytes makes the speech in an advertising context.” Specifically, it alleged that the words appeared “during a free trial period designed to showcase Malwarebytes’s product capabilities,” so that the users experience “a marketing mechanism for Malwarebytes to entice users to ultimately purchase the Malwarebytes products.” Enigma alleged that Malwarebytes displays the challenged speech directly alongside buttons with phrases such as “Upgrade Now.” See SAC ¶¶ 118–19 (depicting scan results with “threats” near “Upgrade Now” button). This was plausibly an advertisement for purportedly superior products.

Other relevant factors—whether the speech refers to a particular product and whether the speaker has an economic motivation—also weighed in favor of characterizing this as commercial speech. (The court also cited the competition between the parties as relevant to satisfying the Gordon & Breach test for commercial advertising or promotion, even though Lexmark should probably be understood as removing that requirement.)

Enigma also sufficiently alleged that the statements were made to encourage people to buy Malwarebytes’ products and were sufficiently disseminated to the relevant purchasing public, even though only existing Malwarebytes customers saw the designations, because Enigma alleged that the majority of Malwarebytes users are free users and not paying customers, and that Malwarebytes’s sales model relies on its free programs to function as advertisements to induce users to upgrade to paid products. Malwarebytes allegedly displays the challenged designations to all consumers who seek to simultaneously deploy both Malwarebytes and Enigma products.

Material deception: Malwarebytes argued that it sufficiently disclosed to consumers its definitions for “threat” and “malicious,” as well as the specific criteria used to reach those designations, so that a reasonable consumer would understand that the challenged designations did not identify Enigma’s software as malware. In addition, it argued, because the Ninth Circuit held that the “PUP” classification was not an actionable statement of fact under the Lanham Act, the challenged designations were not materially deceptive because they were a disclosed result of the PUP classification and specifically were not statements that Enigma’s products were malware.

The court disagreed. Enigma alleged that it received hundreds of complaints from users of its products who had viewed Malwarebytes’s designations, and that the complaints included statements indicating that the users understood the designations to identify Enigma’s products as malware. Customers allegedly canceled orders for Enigma’s software and requested refunds, which allowed the court to infer that the statements influenced users’ purchasing decisions. The disclosures weren’t dispositive at the motion to dismiss stage.

The NYGBL claim survived for the same reasons.