<p>I have a web service API. Some calls return objects containing text fields with information provided by the user. From both a design and a security standpoint, what are the downsides to returning null in those fields when no information has been provided? Is there a clear advantage to always returning an empty string instead, other then simplifying the API by not requiring the client code to check for nulls?</p>

I don't think there's a security issue involved with returning null vs. returning an empty string.
There's not any real downside to returning null for those fields for which there is no information - that's kind of what nulls are meant to indicate.
You can simplify your client code by using
```
```
string.IsNullOrEmpty()
```
```
(assuming this is .NET)