Summary
Gone are the days when nonprofits could rely solely on print ads, mailings, and word-of-mouth to raise funds. Though these tried-and-true fundraising mechanisms still have their place, nonprofits are scaling, in part by relying increasingly on the Internet, social media, and digital technologies, including artificial intelligence (AI), to solicit donations and engage with supporters. Such digitization in fundraising has introduced new opportunities, but also unique challenges. This article explores the key laws and legal considerations that impact online fundraising and the use of digital fundraising tools.
General Charitable Solicitation Laws
Nonprofits that solicit donations (including online) must comply with state charitable solicitation laws. While these laws vary by state, they typically involve an initial registration process and disclosure of certain organizational information. In New York, most nonprofits that have charitable assets or solicit donations in New York must register with the Charities Bureau. NY EXC Law § 172. This is done by completing Form CHAR410, which can be filed online through the Charities Online Registration Portal. Certain organizations, such as religious organizations and those that receive less than $25,000 in contributions and do not use professional fundraisers or fundraising counsel, are exempt from filing. NY EXC Law § 172-A.
Solicitations in New York, including those sent electronically, must include the following information: (i) a statement that upon request, a person may obtain from the organization or from the charities registry on the attorney general’s website, a copy of the last financial report filed by the organization with the attorney general (which statement must be in font no smaller than ten point bold face type or no smaller than the size used for most of the words in the statement); (ii) a description of the programs and activities for which the organization has or will expend contributions (or that such a description can be obtained from the organization); (iii) the organization’s address; and (iv) the following information for the Charities Bureau: Website (www.charitiesnys.com), Address (Office of the New York State Attorney General, The Capitol, Albany NY 12224), and Phone Number (212-416-8401). NY EXC Law § 174-B.
If your nonprofit was incorporated in another State but solicits donations in New York (including via online fundraising), it should register to do business in New York by filing an Application for Authority, as well as register with the Charities Bureau to solicit donations. This begs the question-what if you solicit donations online in numerous or even all fifty States?
The Impact of Multi-State and Online Solicitation
Online fundraising can create quite the conundrum from a registration and compliance perspective since it allows nonprofits to easily reach donors in multiple states. First, all states have their own laws which define “doing business” and “soliciting” differently. Second, presuming a broad interpretation of these laws, organizations may be required to register in numerous states. The nonprofit would need to engage a qualified attorney, accountant, or consultant to analyze the requirements and complete the registrations, which can be costly. Further, once registered, the nonprofit is subject to the reporting, annual filing, and tax laws and requirements of all these states. Note that not all states have automatic tax exemptions for nonprofits, and an organization can experience administrative overload in trying to comply with numerous conflicting rules and forms.
So, what can or should an organization in this situation do? Engaging the assistance of an attorney early on to assess and determine in which states registration is required is vital to avoiding unnecessary registrations and the associated administrative burdens, while simultaneously ensuring compliance. Such an assessment must be balanced with realistic expectations about what that organization can accomplish, especially if it has limited funds.
Online Donation Processing
Many donations, even those which aren’t solicited online, are processed online. Processing donations online triggers compliance concerns in several areas, including terms of use for payment platforms, payment processing rules for credit card transactions, and privacy and data security.
For example, Givebutter is a free, commonly used donation platform that is used to process donations. The Givebutter Terms of Use can be found here. While fairly standard, they do contain certain important restrictions and limitations. For example, the platform cannot be used for charitable gaming (e.g., to accept raffle ticket payments). Also, online charity scams are, unfortunately, quite prevalent. Many of these websites, including Givebutter, allow for a “Verified Account” badge to be placed on a campaign page. These badges certify to contributors that funds will go to an organization that is exempt from federal income tax. Submitting your IRS determination letter to your donation platform to obtain a verification badge is a best practice for transparency purposes and to put donors at ease.
Another area of compliance to be aware of relates to acceptance of payments via credit card. Nonprofits that process credit cards in-house or store credit card data must adhere to standards set by the Payment Card Industry (PCI) Security Standards Council to protect donor information and prevent fraud, for example, by installing a firewall to safeguard cardholder data and implementing an information security policy. PCI standards are not federal law; however, compliance is required via contracts with the major credit card brands. A certified PCI compliance consultant can ensure your organization’s payment systems meet PCI requirements, as well as identify any gaps and implement fixes.
Relatedly, nonprofits must comply with applicable data protection and privacy laws. A handful of states have privacy laws that don’t specifically exempt nonprofits. New York’s SHIELD ACT, for example, requires any person, business, or nonprofit that holds private data of New York residents (including credit or debit card numbers) to implement “reasonable safeguards” to protect such personal information, including by having secure information processing, transmission, storage, and disposal processes in place, as well as procedures to protect against unauthorized access. Further, donors or other individuals whose private information was invalidly accessed or acquired in connection with a security breach must be notified of such breach. NY GBL § 899-AA. Note, however, that there is some flexibility in the rules for small nonprofits, who are only required to have security safeguards in place that are “appropriate for” the size and complexity of the entity and its activities, as well as the sensitivity of the personal information. NY GBL § 899-BB(2)(c). A “small” nonprofit is one with fewer than 50 employees, less than $3 million in annual revenue, or less than $5 million in assets. NY GBL § 899-BB(1)(c).
Importantly, even where exceptions exist for nonprofits under state privacy laws, donors and other stakeholders expect transparency in how their data is being used and that it will be protected. An easy way to accomplish this is by implementing a clear privacy policy explaining how the organization manages, stores, and shares personal information. Limiting staff access to donor and other personal data only to those who have a legitimate business need for it can also greatly reduce the risk that donor information will be compromised.
AI-Specific Considerations
AI is used in fundraising in several contexts, such as generating content like donor solicitations and recognition materials, as well as cultivating relationships through donor profiling, i.e., analyzing donor data and predicting future giving behavior.
When inputting information to an AI tool, nonprofits should keep data privacy and protection top of mind and should not input any proprietary or personally identifiable information of donors or other individuals into an AI application. When it comes to output, it is important that the nonprofit’s usage meets the Terms of Use of the specific platform, and that all AI-generated content be vetted for accuracy and comply with applicable laws and regulations.
Most of us are aware that AI-generated content is not completely accurate. The OpenAI Terms of Use, for example, specifically state that output may not be accurate and that output, in some situations, “does not accurately reflect real people, places or facts”. Importantly, the user is the one responsible for evaluating the output for accuracy. Further, the nonprofit, not the AI tool, is the one that answers to donors, and New York law specifically prohibits making false statements in any fundraising solicitation. NY EXC Law § 172-d. If the dissemination of inaccurate output rises to the level of negligence, a nonprofit can also expose itself to tort liability. Another area of concern with AI output is the generation of biased results, which can result in the inequitable targeting of certain classes of donors and prospects. For these reasons, it is essential for nonprofit staff to carefully review AI output to identify inaccuracies and biases and edit the output to ensure reliability to the greatest extent possible.
Further, intellectual property infringement becomes an issue when AI tools are used to create protectable works or materials, such as those which are copyrightable or trademarkable. For example, the OpenAI Terms of Use provide that all output is assigned by OpenAI to the user, but only to the extent that OpenAI has any interest in the output. In other words, part, or all, of any output may actually be owned by a third party. Thus, when it comes to such works, nonprofits need to take steps to ensure the AI output they use does not infringe on the IP rights of others, such as through paraphrasing, modifications, citing to original sources, conducting searches for similar materials, and/or engaging a qualified attorney.
There may also be legal requirements or considerations triggered depending on the content and type of material generated by AI. For example, as discussed above, solicitation materials in New York must provide clear and accurate disclosures, including information about the organization, the use of donations, and contact information for the New York State Charities Bureau. Thus, such materials will likely need to be revised by a staff member to ensure compliance.
Finally, it is best practice for nonprofits to be transparent about their AI usage. Any fundraising materials generated using the help of AI should include a disclosure statement such as the following: “This content was created with the assistance of artificial intelligence (AI). AI was used to analyze data and generate an initial draft, which was reviewed and edited by a human.”
Conclusion
As nonprofits continue to leverage the Internet and digital technologies in their fundraising efforts, they must prioritize compliance with applicable laws and regulations. By staying informed about the latest legal developments and best practices, nonprofits can minimize risk while maximizing their charitable impact in the digital age. Meliora’s nonprofit attorneys can assist with this and answer any questions you may have.
